@tinycloud/sdk-core 2.8.0-beta.0 → 2.9.0-beta.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.cjs +267 -1
  2. package/dist/index.cjs.map +1 -1
  3. package/dist/index.d.cts +112 -2
  4. package/dist/index.d.ts +112 -2
  5. package/dist/index.js +259 -1
  6. package/dist/index.js.map +1 -1
  7. package/package.json +2 -2
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts","../src/client-types.ts","../src/notifications.ts","../src/identity.ts","../src/requester/index.ts","../../../node_modules/multiformats/src/bases/base32.ts","../../../node_modules/multiformats/src/bytes.ts","../../../node_modules/multiformats/src/vendor/base-x.js","../../../node_modules/multiformats/src/bases/base.ts","../../../node_modules/multiformats/src/bases/base36.ts","../../../node_modules/multiformats/src/bases/base58.ts","../../../node_modules/multiformats/src/vendor/varint.js","../../../node_modules/multiformats/src/varint.ts","../../../node_modules/multiformats/src/hashes/digest.ts","../../../node_modules/multiformats/src/cid.ts","../src/policy/errors.ts","../src/policy/jcs.ts","../src/policy/capability.ts","../src/policy/signed-object.ts","../../../node_modules/multiformats/src/bases/base10.ts","../../../node_modules/multiformats/src/bases/base16.ts","../../../node_modules/multiformats/src/bases/base2.ts","../../../node_modules/multiformats/src/bases/base256emoji.ts","../../../node_modules/multiformats/src/bases/base64.ts","../../../node_modules/multiformats/src/bases/base8.ts","../../../node_modules/multiformats/src/bases/identity.ts","../../../node_modules/multiformats/src/codecs/json.ts","../../../node_modules/multiformats/src/hashes/identity.ts","../../../node_modules/multiformats/src/hashes/sha2.ts","../../../node_modules/multiformats/src/hashes/hasher.ts","../../../node_modules/multiformats/src/basics.ts","../src/policy/authoring.ts","../src/networkId.ts","../src/storage.schema.ts","../src/TinyCloud.ts","../src/spaces/SpaceService.ts","../src/spaces/Space.ts","../src/spaces/spaces.schema.ts","../src/delegations/types.schema.ts","../src/expiry.ts","../src/account/AccountService.ts","../src/manifest.ts","../src/space.ts","../src/delegations/DelegationManager.ts","../src/delegations/SharingService.schema.ts","../src/capabilities.ts","../src/delegations/SharingService.ts","../src/authorization/CapabilityKeyRegistry.ts","../src/authorization/strategies.ts","../src/authorization/spaceCreation.ts","../src/version.ts","../../../node_modules/uint8arrays/src/equals.ts","../../../node_modules/uint8arrays/src/alloc.node.ts","../../../node_modules/uint8arrays/src/util/as-uint8array.node.ts","../../../node_modules/uint8-varint/src/index.ts","../../../node_modules/uint8arrays/src/concat.node.ts","../../../node_modules/uint8arrays/src/from-string.node.ts","../../../node_modules/uint8arrays/src/util/bases.ts","../../../node_modules/uint8arrays/src/to-string.node.ts","../../../node_modules/@multiformats/multiaddr/src/errors.ts","../../../node_modules/@chainsafe/is-ip/src/is-ip.node.ts","../../../node_modules/@multiformats/multiaddr/src/constants.ts","../../../node_modules/@multiformats/multiaddr/src/utils.ts","../../../node_modules/@multiformats/multiaddr/src/validation.ts","../../../node_modules/@multiformats/multiaddr/src/registry.ts","../../../node_modules/@multiformats/multiaddr/src/components.ts","../../../node_modules/@multiformats/multiaddr/src/multiaddr.ts","../../../node_modules/@multiformats/multiaddr/src/index.ts","../../../node_modules/@multiformats/multiaddr-to-uri/src/index.ts","../../../node_modules/ip-regex/index.js","../../../node_modules/function-timeout/index.js","../../../node_modules/clone-regexp/node_modules/is-regexp/index.js","../../../node_modules/clone-regexp/index.js","../../../node_modules/super-regex/index.js","../../../node_modules/is-ip/index.js","../../../node_modules/@multiformats/uri-to-multiaddr/src/index.ts","../src/location.ts"],"sourcesContent":["/**\n * @tinycloud/sdk-core\n *\n * Core TinyCloud SDK package providing shared interfaces and the TinyCloud class.\n *\n * This package defines the platform-agnostic interfaces that both web-sdk and node-sdk\n * implement. The main TinyCloud class accepts an IUserAuthorization implementation,\n * allowing it to work in both browser and Node.js environments.\n *\n * @packageDocumentation\n */\n\n// Platform-agnostic client types (canonical definitions)\nexport {\n ClientSession,\n EnsData,\n SiweConfig,\n ServerHost,\n ClientSessionSchema,\n EnsDataSchema,\n SiweConfigSchema,\n validateClientSession,\n SiweMessage,\n} from \"./client-types\";\n\n// Notification handler\nexport {\n INotificationHandler,\n SilentNotificationHandler,\n} from \"./notifications\";\n\n// ENS resolver\nexport { IENSResolver } from \"./ens\";\n\n// WASM bindings abstraction\nexport {\n IWasmBindings,\n ISessionManager,\n type PersistedSessionProof,\n type ValidatedPersistedSessionProof,\n} from \"./wasm\";\n\n// Signer interface\nexport { ISigner, Bytes } from \"./signer\";\n\n// Identity helpers\nexport {\n IdentityParseError,\n addressStorageKey,\n canonicalizeAddress,\n canonicalizeDid,\n canonicalizeDidUrl,\n didCacheKey,\n didEquals,\n isEvmAddress,\n makePkhSpaceId,\n parsePkhDid,\n pkhDid,\n principalDid,\n principalDidEquals,\n type CanonicalAddress,\n type DidCacheKeyOptions,\n type DidEqualsOptions,\n type PkhDidParts,\n} from \"./identity\";\n\nexport {\n HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,\n LISTEN_SQL_STATEMENT_CATALOG,\n POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA,\n POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA,\n POLICY_ENGINE_DENIAL_SCHEMA,\n POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES,\n POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA,\n PORTABLE_DELEGATION_SCHEMA,\n REQUESTER_ENGINE_RETRY_ATTEMPTS,\n REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,\n REQUESTER_NEAR_EXPIRY_SECONDS,\n TranscriptRequester,\n TranscriptRequesterError,\n createTranscriptRequester,\n deriveDelegationCid,\n parseNodeNativePortableDelegation,\n type HolderKeyBindingPresentation,\n type ListenSqlStatementName,\n type PolicyEngineGrantPresentationDenialCode,\n type PortableDelegation,\n type RequesterHttpRequest,\n type RequesterHttpResponse,\n type RequesterEndpointResolution,\n type RequesterInvocationCapability,\n type RequesterSigningCapability,\n type RequesterTransport,\n type TranscriptRequesterErrorCode,\n type TranscriptRequesterErrorState,\n type TranscriptRequesterOptions,\n type TranscriptRequesterReadKvResult,\n type TranscriptRequesterReadSqlResult,\n} from \"./requester\";\n\n// Encryption network identity helpers\nexport {\n canonicalizeNetworkId,\n parseCanonicalNetworkId,\n type CanonicalParsedNetworkId,\n} from \"./networkId\";\n\n// Session storage interface and types\nexport {\n // Interface\n ISessionStorage,\n // Types (derived from Zod schemas)\n PersistedSessionData,\n PersistedTinyCloudSession,\n TinyCloudSession,\n ValidationError,\n // Validation\n validatePersistedSessionData,\n} from \"./storage\";\n\n// User authorization interface and types\nexport {\n IUserAuthorization,\n Extension,\n PartialSiweMessage,\n UserAuthorizationConfig,\n} from \"./userAuthorization\";\nexport type { SignInOptions } from \"./userAuthorization\";\n\n// Main TinyCloud class\nexport { TinyCloud, TinyCloudConfig } from \"./TinyCloud\";\n\n// Account-level app registry, delegation, and materialized index helpers\nexport { AccountService } from \"./account/AccountService\";\nexport type {\n AccountApplication,\n AccountApplicationListOptions,\n AccountDelegation,\n AccountDelegationListOptions,\n AccountDelegationRevokeOptions,\n AccountIndexEnsureResult,\n AccountIndexRebuildResult,\n AccountIndexStatus,\n AccountIndexedReadOptions,\n AccountServiceConfig,\n AccountSpace,\n AccountSpaceListOptions,\n AccountStatus,\n} from \"./account/AccountService\";\n\n// Re-export service types from sdk-services for convenience\nexport {\n // Context\n ServiceContext,\n type ServiceContextConfig,\n type IServiceContext,\n // Service types\n type IService,\n // KV Service\n KVService,\n PrefixedKVService,\n type IKVService,\n type IPrefixedKVService,\n type KVServiceConfig,\n type KVGetOptions,\n type KVPutOptions,\n type KVListOptions,\n type KVDeleteOptions,\n type KVHeadOptions,\n type KVCreateSignedReadUrlOptions,\n type KVResponse,\n type KVListResponse,\n type KVSignedReadUrlResponse,\n type KVResponseHeaders,\n // Result pattern\n type Result,\n ok,\n err,\n serviceError,\n ErrorCodes,\n type ErrorCode,\n type ServiceError,\n // Session\n type ServiceSession,\n // Platform dependencies\n type InvokeFunction,\n type InvokeAnyFunction,\n type InvokeAnyEntry,\n type FetchFunction,\n type TelemetryConfig,\n type TelemetryEventHandler,\n TinyCloudDebugLogger,\n tinyCloudDebugLogger,\n enableTinyCloudDebug,\n disableTinyCloudDebug,\n getTinyCloudDebugLogs,\n clearTinyCloudDebugLogs,\n installTinyCloudDebugGlobals,\n type TinyCloudDebugEvent,\n type TinyCloudDebugLevel,\n type TinyCloudDebugEnableOptions,\n type TinyCloudDebugTimer,\n // Retry\n type RetryPolicy,\n defaultRetryPolicy,\n // SQL Service\n SQLService,\n DatabaseHandle,\n SQLAction,\n type ISQLService,\n type IDatabaseHandle,\n type SQLServiceConfig,\n type SqlValue,\n type SqlStatement,\n type QueryOptions,\n type ExecuteOptions,\n type BatchOptions,\n type QueryResponse,\n type ExecuteResponse,\n type BatchResponse,\n type SQLActionType,\n // DuckDB Service\n DuckDbService,\n DuckDbDatabaseHandle,\n DuckDbAction,\n type IDuckDbService,\n type IDuckDbDatabaseHandle,\n type DuckDbServiceConfig,\n type DuckDbQueryOptions,\n type DuckDbExecuteOptions,\n type DuckDbBatchOptions,\n type DuckDbOptions,\n type DuckDbValue,\n type DuckDbStatement,\n type DuckDbQueryResponse,\n type DuckDbExecuteResponse,\n type DuckDbBatchResponse,\n type DuckDbActionType,\n type SchemaInfo,\n type TableInfo,\n type ColumnInfo,\n type ViewInfo,\n // Hooks Service\n HooksService,\n type IHooksService,\n type HookServiceName,\n type HookSubscription,\n type HookEvent,\n type HookStreamEvent,\n type HookWebhookScope,\n type HookWebhookRegistration,\n type HookWebhookRecord,\n type HookWebhookListOptions,\n type HookWebhookUnregisterOptions,\n type SubscribeOptions,\n type HooksServiceConfig,\n // Vault Service\n DataVaultService,\n VaultHeaders,\n VaultPublicSpaceKVActions,\n createVaultCrypto,\n type IDataVaultService,\n type VaultCrypto,\n type WasmVaultFunctions,\n type DataVaultConfig,\n type VaultPutOptions,\n type VaultGetOptions,\n type VaultListOptions,\n type VaultGrantOptions,\n type VaultEntry,\n type VaultNetworkReadResult,\n type VaultError,\n // Secrets Service\n SecretsService,\n SECRET_NAME_RE,\n canonicalizeSecretScope,\n resolveSecretListPrefix,\n resolveSecretPath,\n type ISecretsService,\n type SecretPayload,\n type SecretsError,\n type ResolvedSecretPath,\n type SecretScopeOptions,\n // Encryption Service (network-scoped)\n EncryptionService,\n DecryptTransportResponseError,\n parseNetworkId,\n buildNetworkId,\n isNetworkId,\n networkDiscoveryKey,\n NetworkIdError,\n ENCRYPTION_NETWORK_URN_PREFIX,\n NETWORK_NAME_PATTERN,\n canonicalizeEncryptionJson,\n canonicalHashHex,\n hexEncode,\n hexDecode,\n base64Encode as encryptionBase64Encode,\n base64Decode as encryptionBase64Decode,\n utf8Encode as encryptionUtf8Encode,\n utf8Decode as encryptionUtf8Decode,\n encryptToNetwork,\n decryptEnvelopeWithKey,\n validateEnvelope,\n generateRandomReceiverKey,\n deriveSignedReceiverKey,\n buildCanonicalDecryptRequest,\n buildDecryptFacts,\n buildDecryptAttenuation,\n buildDecryptInvocation,\n checkDecryptInvocationInput,\n verifyDecryptResponse,\n canonicalSignedResponse,\n openWrappedKey,\n discoverNetwork,\n ensureNetworkUsableForDecrypt,\n DEFAULT_ENCRYPTION_ALG,\n ENVELOPE_VERSION,\n DEFAULT_KEY_VERSION,\n DECRYPT_FACT_TYPE,\n DECRYPT_RESULT_TYPE,\n DECRYPT_ACTION,\n ENCRYPTION_SERVICE,\n ENCRYPTION_SERVICE_SHORT,\n encryptionError,\n type IEncryptionService,\n type EncryptionServiceConfig,\n type DecryptTransport,\n type EncryptToNetworkOptions,\n type DecryptEnvelopeOptions,\n type ParsedNetworkId,\n type BuildDecryptInvocationInput,\n type BuiltDecryptInvocation,\n type CanonicalJson,\n type DecryptCapabilityProof,\n type DecryptInvocationFact,\n type DecryptInvocationSigner,\n type DecryptRequestBody,\n type DecryptResponseBody,\n type EncryptionCrypto,\n type EncryptionError,\n type EncryptionErrorInput,\n type InlineEncryptedEnvelope,\n type NetworkDescriptor,\n type ReceiverKeyPair,\n type ReceiverKeySigner,\n type EncryptToNetworkInput,\n type EncryptToNetworkResult,\n type CanonicalDecryptRequest,\n type BuildCanonicalDecryptRequestInput,\n type BuildDecryptFactsInput,\n type RandomReceiverKeyInput,\n type SignedReceiverKeyInput,\n type VerifyDecryptResponseInput,\n type DiscoverNetworkInput,\n type DiscoveredNetwork,\n type DiscoverySource,\n type NodeDescriptorFetcher,\n type WellKnownDescriptorFetcher,\n} from \"@tinycloud/sdk-services\";\n\n// Space utilities\nexport {\n SpaceHostResult,\n fetchPeerId,\n submitHostDelegation,\n activateSessionWithHost,\n} from \"./space\";\n\n// Delegations\nexport {\n // Result pattern (aliased to avoid conflict with sdk-services Result)\n Result as DelegationResult,\n DelegationError,\n DelegationErrorCodes,\n DelegationErrorCode,\n // Delegation types\n Delegation,\n DelegationStatus,\n DelegationRevocationReceipt,\n AccountDelegationResource,\n AccountDelegationRecord,\n AccountDelegationPage,\n AccountDelegationQueryOptions,\n CreateDelegationParams,\n CreateDelegationWasmParams,\n CreateDelegationWasmResult,\n DelegatedResource,\n DelegationChain,\n DelegationApiResponse,\n // Configuration types\n DelegationManagerConfig,\n KeyProvider,\n // Classes\n DelegationManager,\n // v2 SharingService\n SharingService,\n createSharingService,\n ISharingService,\n SharingServiceConfig,\n EncodedShareData,\n ReceiveOptions,\n ShareAccess,\n DelegateReceivedShareParams,\n DelegatedShareAccess,\n // v2 types\n JWK,\n KeyType,\n KeyInfo,\n CapabilityEntry,\n DelegationRecord,\n DelegationChainV2,\n DelegationDirection,\n DelegationFilters,\n SpaceOwnership,\n SpaceInfo,\n ShareSchema,\n ShareLink,\n ShareLinkData,\n IngestOptions,\n GenerateShareParams,\n} from \"./delegations\";\n\n// Authorization (v2 spec)\nexport {\n // Class\n CapabilityKeyRegistry,\n // Interface\n ICapabilityKeyRegistry,\n // Factory\n createCapabilityKeyRegistry,\n // Types\n StoredDelegationChain,\n // Error codes\n CapabilityKeyRegistryErrorCodes,\n CapabilityKeyRegistryErrorCode,\n // SignStrategy types\n SignRequest,\n SignResponse,\n SignCallback,\n OpenKeySigningStrategyOptions,\n OpenKeySigningRequestBody,\n OpenKeySigningResponseBody,\n OpenKeyCallbackStrategy,\n AutoSignStrategy,\n AutoRejectStrategy,\n CallbackStrategy,\n EventEmitterStrategy,\n SignStrategy,\n defaultSignStrategy,\n createOpenKeyCallbackSigningStrategy,\n // Space creation handler types\n SpaceCreationContext,\n ISpaceCreationHandler,\n AutoApproveSpaceCreationHandler,\n defaultSpaceCreationHandler,\n} from \"./authorization\";\n\n// Spaces (v2 spec)\nexport {\n // Space object\n Space,\n ISpace,\n SpaceConfig,\n ISpaceScopedDelegations,\n ISpaceScopedSharing,\n // SpaceService\n SpaceService,\n ISpaceService,\n SpaceServiceConfig,\n SpaceErrorCodes,\n SpaceErrorCode,\n createSpaceService,\n // URI utilities\n parseSpaceUri,\n buildSpaceUri,\n // Public space utility\n makePublicSpaceId,\n // Delegation creation types\n SpaceDelegationParams,\n CreateDelegationFunction,\n} from \"./spaces\";\n\n// Protocol version checking\nexport {\n ProtocolMismatchError,\n VersionCheckError,\n UnsupportedFeatureError,\n checkNodeInfo,\n} from \"./version\";\nexport type { NodeInfo } from \"./version\";\n\n// Manifest types and resolution (capability chain delegation)\nexport {\n // Types\n type Manifest,\n type ManifestDefaults,\n type ManifestKnowledge,\n type ManifestSecretActions,\n type ComposeManifestOptions,\n type ComposedManifestRequest,\n type ManifestRegistryRecord,\n type PermissionEntry,\n type ResolvedCapabilities,\n type ResolvedDelegate,\n type ResourceCapability,\n type SpaceAbilitiesMap,\n // Errors\n ManifestValidationError,\n // Constants\n ACCOUNT_REGISTRY_PATH,\n ACCOUNT_REGISTRY_SPACE,\n DEFAULT_DEFAULTS,\n DEFAULT_EXPIRY,\n DEFAULT_KNOWLEDGE_ROOT,\n DEFAULT_MANIFEST_SPACE,\n DEFAULT_MANIFEST_VERSION,\n SECRETS_SPACE,\n SERVICE_LONG_TO_SHORT,\n SERVICE_SHORT_TO_LONG,\n VAULT_PERMISSION_SERVICE,\n ENCRYPTION_PERMISSION_SERVICE,\n ENCRYPTION_MANIFEST_SPACE,\n // Types\n type AbilitiesMap,\n // Functions\n applyPrefix,\n composeManifestRequest,\n expandActionShortNames,\n expandPermissionEntries,\n expandPermissionEntry,\n loadManifest,\n manifestAbilitiesUnion,\n normalizeDefaults,\n parseExpiry,\n resolveManifestKnowledgeRoot,\n resolveManifest,\n resourceCapabilitiesToAbilitiesMap,\n resourceCapabilitiesToSpaceAbilitiesMap,\n validateManifest,\n} from \"./manifest\";\n\nexport {\n ACCOUNT_INDEX_SCHEMA,\n BOOTSTRAP_ALLOWLIST,\n BOOTSTRAP_DEFAULT_SPACE,\n BOOTSTRAP_ENCRYPTION_NETWORK_NAME,\n BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,\n BOOTSTRAP_MANIFEST,\n BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,\n BOOTSTRAP_PUBLIC_SPACE,\n BOOTSTRAP_SESSION_REQUESTS,\n BOOTSTRAP_SPACE_MANIFESTS,\n BOOTSTRAP_SPACE_NAMES,\n SECRET_RECORDS_SCHEMA,\n TINYCLOUD_ACCOUNT_SPACE_MANIFEST,\n TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,\n TINYCLOUD_DEFAULT_SPACE_MANIFEST,\n TINYCLOUD_PUBLIC_SPACE_MANIFEST,\n TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,\n bootstrapEncryptionNetworkId,\n bootstrapSpaceId,\n bootstrapSteps,\n composeBootstrapSpaceManifest,\n KV,\n SQL,\n DUCKDB,\n CAPABILITIES,\n HOOKS,\n ENCRYPTION,\n SPACE,\n CAPABILITY_REGISTRY,\n type CapabilityRegistryEntry,\n type CapabilityStatus,\n type BootstrapAllowlistEntry,\n type BootstrapAllowlistKind,\n type BootstrapEncryptionNetworkStep,\n type BootstrapManifest,\n type BootstrapRawAbilityAllowlistEntry,\n type BootstrapSchemaStep,\n type BootstrapSeedApplicationsStep,\n type BootstrapSeedSpacesStep,\n type BootstrapSpaceDescriptor,\n type BootstrapSpaceName,\n type BootstrapSpaceStep,\n type BootstrapStep,\n type BootstrapStepKind,\n} from \"@tinycloud/bootstrap\";\n\n// TinyCloud location registry helpers\nexport {\n CloudLocationResolutionError,\n DEFAULT_TINYCLOUD_FALLBACK_HOST,\n DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,\n LocationRecordValidationError,\n canonicalLocationPayload,\n fetchLocationRecord,\n httpUrlToMultiaddr,\n locationPayloadForRecord,\n multiaddrToHttpUrl,\n resolveCloudLocation,\n resolveTinyCloudHosts,\n signLocationRecord,\n validateLocationRecord,\n validateLocationRecordPayload,\n verifyDidKeyEd25519Signature,\n verifyLocationRecord,\n type LocationCandidate,\n type LocationCandidateInput,\n type LocationRecord,\n type LocationRecordPayload,\n type LocationRecordSigner,\n type LocationResolutionAttempt,\n type LocationSource,\n type ResolveCloudLocationOptions,\n type ResolveTinyCloudHostsOptions,\n type ResolvedCloudLocation,\n type ResolvedTinyCloudHosts,\n} from \"./location\";\n\n// Capability subset checking and recap parsing\nexport {\n // Errors\n CaveatedDelegationUnsupportedError,\n PermissionNotInManifestError,\n SessionExpiredError,\n // Functions\n isCapabilitySubset,\n actionContains,\n canonicalizeRecapCaveats,\n parseRecapCapabilities,\n recapCaveatsEqual,\n // Types\n type ParseRecapFromSiwe,\n type SubsetCheckResult,\n type WasmRecapEntry,\n} from \"./capabilities\";\n\n// Default lifetimes for delegation flows. See `expiry.ts` for the\n// \"pick a tier, not a number\" rationale.\nexport {\n DEFAULT_SIGNED_READ_URL_EXPIRY_MS,\n EXPIRY,\n type ExpiryTier,\n} from \"./expiry\";\n\n// Policy signed-object profile core\nexport {\n ED25519_JCS_SIGNATURE_SUITE,\n EIP191_JCS_SIGNATURE_SUITE,\n POLICY_ENGINE_RECORD_SCHEMA,\n POLICY_SCHEMA,\n POLICY_STATUS_SCHEMA,\n SignatureMaterialError,\n SignatureVerificationError,\n SignedObjectCanonicalizationError,\n SignedObjectDigestError,\n SignedObjectIdError,\n SignedObjectProfileError,\n SignedObjectSchemaError,\n SigningKeyBindingError,\n UnsupportedSignatureSuiteError,\n canonicalizeSignedObjectUnsigned,\n createAndSignPolicy,\n createAndSignPolicyEngineRecord,\n createAndSignPolicyStatus,\n createAndSignSignedObject,\n deriveSignedObjectMaterial,\n jcsCanonicalize,\n normalizeJson,\n serializeJcsJson,\n signedObjectIdFor,\n toSignedObjectError,\n validatePolicyEngineRecordSigned,\n validatePolicyEngineRecordSignedShape,\n validatePolicyEngineRecordUnsigned,\n validatePolicySigned,\n validatePolicySignedShape,\n validatePolicyStatusSigned,\n validatePolicyStatusSignedShape,\n validatePolicyStatusUnsigned,\n validatePolicyUnsigned,\n verifyPolicy,\n verifyPolicyEngineRecord,\n verifyPolicyStatus,\n verifySignedObject,\n type JsonObject,\n type JsonValue,\n type Policy,\n type PolicyEngineRecord,\n type PolicyStatus,\n type SignatureSuite,\n type SignedObjectErrorCode,\n type SignedObjectKind,\n type SignedObjectMaterial,\n type SignedObjectSignature,\n type SignedObjectSigner,\n type SignedObjectVerificationResult,\n type SignedPolicyObject,\n type UnsignedPolicy,\n type UnsignedPolicyEngineRecord,\n type UnsignedPolicyObject,\n type UnsignedPolicyStatus,\n} from \"./policy\";\n","/**\n * Platform-agnostic client types for TinyCloud SDK.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport { SiweMessage } from \"siwe\";\n\nexport { SiweMessage };\n\n/** ENS data associated with a user session. */\nexport interface EnsData {\n domain?: string | null;\n avatarUrl?: string | null;\n}\n\nexport const EnsDataSchema = z.object({\n domain: z.string().nullable().optional(),\n avatarUrl: z.string().nullable().optional(),\n});\n\n/** SIWE configuration. All fields optional — callers provide only what they need to override. */\nexport interface SiweConfig {\n domain?: string;\n uri?: string;\n chainId?: number;\n statement?: string;\n nonce?: string;\n expirationTime?: string;\n notBefore?: string;\n requestId?: string;\n resources?: string[];\n}\n\nexport const SiweConfigSchema = z\n .object({\n domain: z.string().optional(),\n uri: z.string().optional(),\n chainId: z.number().optional(),\n statement: z.string().optional(),\n nonce: z.string().optional(),\n expirationTime: z.string().optional(),\n notBefore: z.string().optional(),\n requestId: z.string().optional(),\n resources: z.array(z.string()).optional(),\n })\n .passthrough();\n\n/** Representation of an active client session. */\nexport interface ClientSession {\n /** User address (may be delegated) */\n address: string;\n /** User address without delegation */\n walletAddress: string;\n /** EIP-155 chain ID */\n chainId: number;\n /** Key to identify the session */\n sessionKey: string;\n /** The SIWE message text (from SiweMessage.prepareMessage()) */\n siwe: string;\n /** The signature of the SIWE message */\n signature: string;\n /** ENS data supported by TinyCloud */\n ens?: EnsData;\n}\n\nexport const ClientSessionSchema = z.object({\n address: z.string(),\n walletAddress: z.string(),\n chainId: z.number(),\n sessionKey: z.string(),\n siwe: z.string(),\n signature: z.string(),\n ens: EnsDataSchema.optional(),\n});\n\n/** The URL of a server running tinycloud-node. */\nexport type ServerHost = string;\n\n/** Validate unknown data as a ClientSession. Returns the parsed session or null. */\nexport function validateClientSession(data: unknown): ClientSession | null {\n const result = ClientSessionSchema.safeParse(data);\n return result.success ? result.data : null;\n}\n","/**\n * Notification handler interface for TinyCloud SDK.\n *\n * Abstracts UI notifications so that web-sdk can show toasts\n * while node-sdk uses a silent no-op handler.\n *\n * @packageDocumentation\n */\n\n/**\n * Platform-agnostic notification handler.\n *\n * Implementations can provide different UX patterns:\n * - Browser: toast notifications via antd or similar\n * - Node.js: silent (default) or logging\n * - CLI: console output\n */\nexport interface INotificationHandler {\n /** Called on successful operations (e.g., \"Successfully signed in\") */\n success(message: string, description?: string): void;\n /** Called on warnings */\n warning(message: string, description?: string): void;\n /** Called on errors */\n error(category: string, message: string, description?: string): void;\n /** Optional cleanup (e.g., dismiss all active notifications) */\n cleanup?(): void;\n}\n\n/** No-op handler for environments without UI (node-sdk default). */\nexport class SilentNotificationHandler implements INotificationHandler {\n success(): void {}\n warning(): void {}\n error(): void {}\n}\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n method: \"pkh\";\n namespace: \"eip155\";\n chainId: number;\n address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"IdentityParseError\";\n }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n const fragmentIndex = input.indexOf(\"#\");\n if (fragmentIndex < 0) {\n return { did: input, fragment: \"\" };\n }\n return {\n did: input.slice(0, fragmentIndex),\n fragment: input.slice(fragmentIndex),\n };\n}\n\nfunction assertValidChainId(chainId: number): void {\n if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n }\n}\n\nexport function isEvmAddress(input: string): boolean {\n return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n if (!isEvmAddress(address)) {\n throw new IdentityParseError(`Invalid EVM address: ${address}`);\n }\n return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n assertValidChainId(chainId);\n return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n const match = did.match(PKH_DID_RE);\n if (!match) return null;\n\n const chainId = Number(match[1]);\n assertValidChainId(chainId);\n\n return {\n method: \"pkh\",\n namespace: \"eip155\",\n chainId,\n address: canonicalizeAddress(match[2]),\n };\n}\n\nexport function canonicalizeDid(did: string): string {\n const pkh = parsePkhDid(did);\n if (pkh) {\n return pkhDid(pkh.address, pkh.chainId);\n }\n if (DID_RE.test(did)) {\n return did;\n }\n throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n const { did, fragment } = splitDidUrl(didUrl);\n return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n const { did, fragment } = splitDidUrl(input);\n const pkh = parsePkhDid(did);\n const base = pkh\n ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n : canonicalizeDid(did);\n\n return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n address: string,\n chainId: number,\n name: string,\n): string {\n assertValidChainId(chainId);\n if (!name) {\n throw new IdentityParseError(\"Space name cannot be empty\");\n }\n return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","import { bytesToHex, sha256 } from \"viem\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport type {\n InvokeAnyFunction,\n InvokeFunction,\n ServiceHeaders,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport { z } from \"zod\";\nimport {\n POLICY_VERSION_V0,\n TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n OWNER_NODE_ENDPOINT_SCHEMA,\n W3C_VC_CREDENTIAL_VERIFIER,\n jcsCanonicalize,\n normalizePolicyCapability,\n normalizeJson,\n policyCapabilityContains,\n verifyPolicyEngineRecordForRequester,\n type PolicyCapability,\n type TranscriptShareBootstrap,\n} from \"../policy\";\n\nexport const REQUESTER_NEAR_EXPIRY_SECONDS = 30;\nexport const REQUESTER_ENGINE_RETRY_ATTEMPTS = 3;\nexport const REQUESTER_ENGINE_RETRY_MAX_DELAY_MS = 250;\n\nexport const POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA =\n \"xyz.tinycloud.policy-engine/challenge-request/v0\" as const;\nexport const POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA =\n \"xyz.tinycloud.policy/challenge/v0\" as const;\nexport const POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA =\n \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const POLICY_ENGINE_DENIAL_SCHEMA =\n \"xyz.tinycloud.policy-engine/denial/v0\" as const;\nexport const HOLDER_KEY_BINDING_PRESENTATION_SCHEMA =\n \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const PORTABLE_DELEGATION_SCHEMA =\n \"xyz.tinycloud.policy/portable-delegation/v0\" as const;\n\nexport const POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES = [\n \"schema-invalid\",\n \"challenge-not-found\",\n \"challenge-expired\",\n \"challenge-nonce-consumed\",\n \"presentation-expired\",\n \"presentation-audience-mismatch\",\n \"presentation-evidence-missing\",\n \"digest-mismatch\",\n \"evidence-requirement-unknown\",\n \"evidence-requirement-duplicate\",\n \"holder-signature-invalid\",\n \"holder-signature-signer-mismatch\",\n \"id-mismatch\",\n \"requested-capabilities-exceeded\",\n \"requested-capabilities-hash-mismatch\",\n \"evidence-authority-missing\",\n \"evidence-credential-invalid\",\n \"evidence-domain-invalid\",\n \"evidence-domain-missing\",\n \"evidence-freshness-expired\",\n \"evidence-freshness-unestablishable\",\n \"evidence-issuer-missing\",\n \"evidence-issuer-untrusted\",\n \"evidence-presentation-invalid\",\n \"evidence-requirements-invalid\",\n \"evidence-verifier-unsupported\",\n \"enrollment-binding-mismatch\",\n \"enrollment-expired\",\n \"enrollment-not-yet-valid\",\n \"enrollment-out-of-scope\",\n \"enrollment-revoked\",\n \"enrollment-revoked-irreversible\",\n \"enrollment-status-rollback\",\n \"signature-invalid\",\n \"signer-not-authorized\",\n \"audience-mismatch\",\n \"capability-not-contained\",\n \"evidence-invalid\",\n \"evidence-missing\",\n \"evidence-stale\",\n \"evidence-subject-mismatch\",\n \"evidence-untrusted\",\n \"grant-ttl-exceeds-policy\",\n \"holder-did-mismatch\",\n \"holder-key-not-permitted\",\n \"holder-signature-invalid\",\n \"owner-mismatch\",\n \"policy-expired\",\n \"policy-inactive\",\n \"policy-not-found\",\n \"policy-not-satisfied\",\n \"policy-revoked\",\n \"policy-status-rollback\",\n \"rate-limited\",\n] as const;\n\nexport type PolicyEngineGrantPresentationDenialCode =\n (typeof POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES)[number];\n\nexport type TranscriptRequesterErrorCode =\n | \"requester-bootstrap-malformed\"\n | \"requester-bootstrap-unknown-key\"\n | \"requester-engine-record-signature-invalid\"\n | \"requester-engine-record-owner-mismatch\"\n | \"requester-engine-record-audience-mismatch\"\n | \"requester-engine-record-endpoint-mismatch\"\n | \"requester-engine-record-invalid\"\n | \"requester-policy-engine-endpoint-invalid\"\n | \"requester-engine-unreachable\"\n | \"requester-engine-response-invalid\"\n | \"requester-renewal-required\"\n | \"requester-challenge-reused\"\n | \"requester-presentation-invalid\"\n | \"requester-delegation-invalid\"\n | \"requester-delegation-wrong-holder\"\n | \"requester-delegation-not-refresh-only\"\n | \"requester-delegation-ttl-excessive\"\n | \"requester-delegation-capability-wider\"\n | \"requester-owner-node-endpoint-invalid\"\n | \"requester-delegation-import-failed\"\n | \"requester-invocation-signer-required\"\n | \"requester-invocation-signer-mismatch\"\n | \"requester-node-denied\"\n | \"requester-node-unreachable\"\n | \"requester-node-response-invalid\"\n | \"requester-access-not-contained\"\n | \"requester-access-denied\"\n | \"requester-access-unreachable\"\n | \"requester-access-ended\"\n | `policy-engine-denied-${PolicyEngineGrantPresentationDenialCode}`;\n\nexport type TranscriptRequesterErrorState =\n | \"bootstrap-invalid\"\n | \"denied\"\n | \"unreachable\"\n | \"renewal-required\"\n | \"access-ended\"\n | \"invalid\"\n | \"not-contained\";\n\nexport class TranscriptRequesterError extends Error {\n public readonly code: TranscriptRequesterErrorCode;\n public readonly state: TranscriptRequesterErrorState;\n public readonly denialCode?: PolicyEngineGrantPresentationDenialCode;\n public readonly status?: number;\n\n constructor(\n code: TranscriptRequesterErrorCode,\n message: string,\n state: TranscriptRequesterErrorState = \"invalid\",\n denialCode?: PolicyEngineGrantPresentationDenialCode,\n status?: number,\n ) {\n super(message);\n this.name = \"TranscriptRequesterError\";\n this.code = code;\n this.state = state;\n this.denialCode = denialCode;\n this.status = status;\n }\n}\n\nexport interface RequesterHttpRequest {\n readonly method: \"POST\" | \"GET\";\n readonly url: string;\n readonly headers?: Readonly<Record<string, string>>;\n readonly body?: unknown;\n /** Endpoint requests must not follow redirects. */\n readonly redirect?: \"error\";\n /** Transport must connect only to one of these pre-resolved public addresses. */\n readonly allowedResolvedAddresses?: readonly string[];\n}\n\nexport interface RequesterHttpResponse {\n readonly status: number;\n readonly body: unknown;\n /** Required for policy-engine and owner-node requests; reports the non-redirected final URL. */\n readonly finalUrl?: string;\n /** Required for policy-engine and owner-node requests; reports the actual connected IP. */\n readonly resolvedAddress?: string;\n}\n\nexport interface RequesterEndpointResolution {\n readonly addresses: readonly string[];\n}\n\nexport interface RequesterTransport {\n request(request: RequesterHttpRequest): Promise<RequesterHttpResponse>;\n /** Resolve before egress so the requester can pin public addresses and detect rebinding. */\n resolveEndpoint?(endpoint: string): Promise<RequesterEndpointResolution>;\n}\n\nexport interface RequesterInvocationCapability {\n readonly holderDid: string;\n readonly verificationMethod: string;\n readonly jwk: object;\n readonly invoke: InvokeFunction;\n readonly invokeAny?: InvokeAnyFunction;\n}\n\nexport interface HolderKeyBindingPresentation {\n readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n readonly policyId: string;\n readonly eligibleSubjectDid: string;\n readonly holderDid: string;\n readonly holderBinding: unknown;\n readonly requestedCapabilities: readonly PolicyCapability[];\n readonly requestedCapabilitiesHash: string;\n readonly audience: string;\n readonly nonce: string;\n readonly expiresAt: string;\n readonly evidence?: readonly unknown[];\n readonly holderSignature: {\n readonly suite: string;\n readonly signerDid: string;\n readonly value: string;\n };\n}\n\nexport interface RequesterSigningCapability {\n readonly holderDid: string;\n readonly keyId: string;\n readonly suite?: string;\n readonly holderBinding?: unknown;\n readonly eligibleSubjectDid?: string;\n readonly evidence?: readonly unknown[];\n signGrantPresentation?(input: {\n readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n readonly policyId: string;\n readonly eligibleSubjectDid: string;\n readonly holderDid: string;\n readonly holderBinding: unknown;\n readonly requestedCapabilities: readonly PolicyCapability[];\n readonly requestedCapabilitiesHash: string;\n readonly audience: string;\n readonly nonce: string;\n readonly expiresAt: string;\n readonly evidence?: readonly unknown[];\n }): Promise<string> | string;\n signKeyBinding(input: {\n readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n readonly policyId?: string;\n readonly eligibleSubjectDid?: string;\n readonly holderDid: string;\n readonly holderBinding?: unknown;\n readonly requestedCapabilities?: readonly PolicyCapability[];\n readonly requestedCapabilitiesHash?: string;\n readonly audience: string;\n readonly nonce: string;\n readonly challengeId: string;\n readonly issuedAt: string;\n readonly keyId: string;\n }): Promise<string> | string;\n}\n\nexport interface PortableDelegation {\n readonly schema?: typeof PORTABLE_DELEGATION_SCHEMA;\n readonly delegationId: string;\n readonly policyId: string;\n readonly issuerDid: string;\n readonly holderDid: string;\n readonly audience?: string;\n readonly issuedAt: string;\n readonly expiresAt: string;\n readonly terminal: boolean;\n readonly maxTtlSeconds: number;\n readonly capabilities: readonly PolicyCapability[];\n readonly encoded?: string;\n}\n\nexport interface TranscriptRequesterOptions {\n readonly bootstrap: unknown;\n readonly requesterDid: string;\n readonly ownerDid: string;\n readonly audience: string;\n readonly grantIssuerDid: string;\n /** Owner-node binding from trusted TinyCloud discovery/config, never copied from bootstrap. */\n readonly trustedOwnerNode: {\n readonly endpoint: string;\n readonly spaceId: string;\n };\n readonly transport: RequesterTransport;\n readonly signingCapability?: RequesterSigningCapability;\n readonly invocationCapability?: RequesterInvocationCapability;\n readonly eligibleSubjectDid?: string;\n readonly holderBinding?: unknown;\n readonly evidence?: readonly unknown[];\n readonly presentationTtlSeconds?: number;\n readonly now?: () => Date;\n readonly sleep?: (milliseconds: number) => Promise<void>;\n readonly random?: () => number;\n readonly engineRetryAttempts?: number;\n}\n\nexport interface TranscriptRequesterReadSqlResult {\n readonly rows: readonly unknown[];\n}\n\nexport interface TranscriptRequesterReadKvResult {\n readonly value: unknown;\n}\n\nconst JsonValueSchema: z.ZodType<unknown> = z.lazy(() =>\n z.union([\n z.string(),\n z.number().finite(),\n z.boolean(),\n z.null(),\n z.array(JsonValueSchema),\n z.record(JsonValueSchema),\n ]),\n);\n\nconst Rfc3339Schema = z\n .string()\n .refine((value) => parseStrictRfc3339(value) !== undefined, {\n message: \"must be strict RFC 3339 date-time with timezone\",\n });\n\nconst SignedRecordSchema = z\n .object({\n schema: z.string(),\n engineRecordId: z.string(),\n ownerDid: z.string(),\n endpoint: z.string(),\n audience: z.string(),\n supportedPolicyVersions: z.array(z.string()),\n supportedEvidenceVerifiers: z.array(z.string()),\n grantIssuerDid: z.string(),\n expiresAt: Rfc3339Schema,\n signature: z\n .object({\n suite: z.string(),\n signerDid: z.string(),\n value: z.string(),\n })\n .strict(),\n })\n .strict();\n\nconst PolicyEngineSchema = z\n .object({\n endpoint: z.string().url(),\n audience: z.string(),\n supportedEvidenceVerifiers: z.tuple([\n z.literal(W3C_VC_CREDENTIAL_VERIFIER),\n ]),\n signedRecord: SignedRecordSchema,\n })\n .strict();\n\nconst OwnerNodeSchema = z\n .object({\n schema: z.literal(OWNER_NODE_ENDPOINT_SCHEMA),\n endpoint: z.string().url(),\n spaceId: z.string().min(1),\n })\n .strict();\n\nconst ResourceHintSchema = z\n .object({\n resourceType: z.string(),\n resourceId: z.string(),\n requestedCapabilities: z.array(JsonValueSchema).min(1),\n })\n .strict();\n\nconst BootstrapSchema = z\n .object({\n schema: z.literal(TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA),\n policyId: z.string(),\n policyEngine: PolicyEngineSchema,\n ownerNode: OwnerNodeSchema,\n resourceHint: ResourceHintSchema,\n })\n .strict();\n\nconst SignatureSchema = z\n .object({\n suite: z.string(),\n signerDid: z.string(),\n value: z.string(),\n })\n .strict();\n\nconst ChallengeSchema = z\n .object({\n schema: z.literal(POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA),\n challengeId: z.string(),\n policyId: z.string(),\n audience: z.string(),\n nonce: z.string().min(16),\n challengeExpiresAt: Rfc3339Schema,\n acceptedSuites: z.array(z.string()).min(1),\n requestedCapabilitiesTemplate: z.array(JsonValueSchema).optional(),\n signature: SignatureSchema,\n })\n .strict();\n\nconst ChallengeResponseSchema = z\n .object({ challenge: ChallengeSchema })\n .strict();\n\nconst DenialSchema = z\n .object({\n schema: z.literal(POLICY_ENGINE_DENIAL_SCHEMA),\n code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n message: z.string().optional(),\n })\n .strict();\n\nconst ErrorEnvelopeDenialSchema = z\n .object({\n error: z\n .object({\n code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n message: z.string().optional(),\n })\n .strict(),\n })\n .strict();\n\nconst WireDelegationSchema = z\n .object({\n delegationId: z.string(),\n issuanceId: z.string().min(1),\n issuerDid: z.string(),\n holderDid: z.string(),\n policyId: z.string(),\n capabilityHashHex: z.string().regex(/^[0-9a-f]{64}$/),\n revocationMode: z.literal(\"refresh_only\"),\n issuedAt: Rfc3339Schema,\n expiresAt: Rfc3339Schema,\n terminal: z.boolean(),\n encoded: z.string(),\n })\n .strict();\n\nconst ResolveResponseSchema = z\n .object({ delegation: WireDelegationSchema })\n .strict();\nconst DelegateReceiptSchema = z\n .object({\n cid: z.string().min(1),\n activated: z.array(z.string()),\n skipped: z.array(z.string()),\n })\n .strict();\n\nconst SqlReadResponseSchema = z\n .object({ rows: z.array(JsonValueSchema) })\n .strict();\nconst KvReadResponseSchema = z.object({ value: JsonValueSchema }).strict();\n\nexport const LISTEN_SQL_STATEMENT_CATALOG = [\n {\n name: \"listen.getConversation\",\n sql: \"SELECT id, title, source, source_id, source_url, started_at, ended_at, duration_secs, summary, metadata, transcript_json, transcript_text, created_at, updated_at FROM conversation WHERE id = ?\",\n fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n },\n {\n name: \"listen.listParticipants\",\n sql: \"SELECT id, name, email, speaker_label FROM participant WHERE conversation_id = ? ORDER BY COALESCE(speaker_label, name), id\",\n fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n },\n] as const;\n\nexport type ListenSqlStatementName =\n (typeof LISTEN_SQL_STATEMENT_CATALOG)[number][\"name\"];\ntype ListenSqlStatement = (typeof LISTEN_SQL_STATEMENT_CATALOG)[number];\ntype ResolvedListenSqlStatement = {\n readonly name: string;\n readonly sql: string;\n readonly fixedParams: readonly {\n readonly index: number;\n readonly value: unknown;\n }[];\n};\n\nexport function listenTranscriptScopedStatementName(\n statementName: ListenSqlStatementName,\n conversationId: string,\n): string {\n if (conversationId.length === 0) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"conversation ID must be non-empty for a scoped Listen SQL read\",\n \"not-contained\",\n );\n }\n return `${statementName}@${encodeURIComponent(conversationId)}`;\n}\ntype NormalizedWireDelegation = PortableDelegation & {\n readonly encoded: string;\n};\n\nconst LISTEN_SQL_STATEMENT_BY_NAME: ReadonlyMap<string, ListenSqlStatement> =\n new Map(\n LISTEN_SQL_STATEMENT_CATALOG.map((statement) => [\n statement.name,\n statement,\n ]),\n );\n\nexport class TranscriptRequester {\n private readonly bootstrap: TranscriptShareBootstrap;\n private readonly requesterDid: string;\n private readonly ownerDid: string;\n private readonly audience: string;\n private readonly grantIssuerDid: string;\n private readonly transport: RequesterTransport;\n private readonly signingCapability?: RequesterSigningCapability;\n private readonly invocationCapability?: RequesterInvocationCapability;\n private readonly policyEngineRecordExpiresAtMs: number;\n private readonly policyEngineAddresses: ReadonlySet<string>;\n private readonly ownerNodeAddresses: ReadonlySet<string>;\n private readonly now: () => Date;\n private readonly sleep: (milliseconds: number) => Promise<void>;\n private readonly random: () => number;\n private readonly engineRetryAttempts: number;\n private readonly requestedCapabilities: readonly PolicyCapability[];\n private readonly nativeAuthorityCeiling: readonly PolicyCapability[];\n private readonly requestedCapabilitiesHash: string;\n private readonly eligibleSubjectDid: string;\n private readonly holderBinding: unknown;\n private readonly evidence?: readonly unknown[];\n private readonly presentationTtlSeconds: number;\n private readonly usedChallengeNonces = new Set<string>();\n private importedDelegation?: PortableDelegation;\n private importedDelegationCid?: string;\n private accessEnded = false;\n\n private constructor(\n bootstrap: TranscriptShareBootstrap,\n requestedCapabilities: readonly PolicyCapability[],\n nativeAuthorityCeiling: readonly PolicyCapability[],\n requestedCapabilitiesHash: string,\n policyEngineRecordExpiresAtMs: number,\n policyEngineAddresses: ReadonlySet<string>,\n ownerNodeAddresses: ReadonlySet<string>,\n options: TranscriptRequesterOptions,\n ) {\n this.bootstrap = bootstrap;\n this.requestedCapabilities = requestedCapabilities;\n this.nativeAuthorityCeiling = nativeAuthorityCeiling;\n this.requestedCapabilitiesHash = requestedCapabilitiesHash;\n this.requesterDid = options.requesterDid;\n this.ownerDid = options.ownerDid;\n this.audience = options.audience;\n this.grantIssuerDid = options.grantIssuerDid;\n this.transport = options.transport;\n this.signingCapability = options.signingCapability;\n this.invocationCapability = options.invocationCapability;\n this.policyEngineRecordExpiresAtMs = policyEngineRecordExpiresAtMs;\n this.policyEngineAddresses = policyEngineAddresses;\n this.ownerNodeAddresses = ownerNodeAddresses;\n this.eligibleSubjectDid =\n options.eligibleSubjectDid ??\n options.signingCapability?.eligibleSubjectDid ??\n options.requesterDid;\n this.holderBinding = options.holderBinding ??\n options.signingCapability?.holderBinding ?? {\n type: \"enrolled-agent\",\n enrollment: {\n schema: \"xyz.tinycloud.policy/holder-enrollment/v0\",\n holderDid: options.requesterDid,\n },\n };\n this.evidence = options.evidence ?? options.signingCapability?.evidence;\n this.presentationTtlSeconds = Math.min(\n Math.max(options.presentationTtlSeconds ?? 60, 1),\n 300,\n );\n this.now = options.now ?? (() => new Date());\n this.sleep =\n options.sleep ??\n ((milliseconds) =>\n new Promise((resolve) => setTimeout(resolve, milliseconds)));\n this.random = options.random ?? Math.random;\n this.engineRetryAttempts =\n options.engineRetryAttempts ?? REQUESTER_ENGINE_RETRY_ATTEMPTS;\n }\n\n static async create(\n options: TranscriptRequesterOptions,\n ): Promise<TranscriptRequester> {\n const bootstrap = parseBootstrap(options.bootstrap);\n if (\n bootstrap.ownerNode.endpoint !== options.trustedOwnerNode.endpoint ||\n bootstrap.ownerNode.spaceId !== options.trustedOwnerNode.spaceId\n ) {\n throw endpointError(\n \"owner-node\",\n \"bootstrap owner-node binding does not match trusted discovery/config\",\n );\n }\n const record = await verifyRecordBeforeEgress(bootstrap, options);\n if (record.endpoint !== bootstrap.policyEngine.endpoint) {\n throw new TranscriptRequesterError(\n \"requester-engine-record-endpoint-mismatch\",\n \"policy engine record endpoint does not match bootstrap endpoint\",\n \"bootstrap-invalid\",\n );\n }\n if (record.audience !== bootstrap.policyEngine.audience) {\n throw new TranscriptRequesterError(\n \"requester-engine-record-audience-mismatch\",\n \"policy engine record audience does not match bootstrap audience\",\n \"bootstrap-invalid\",\n );\n }\n const policyEngineAddresses = await validateAndResolvePublicEndpoint(\n bootstrap.policyEngine.endpoint,\n options.transport,\n \"policy-engine\",\n );\n const ownerNodeAddresses = await validateAndResolveOwnerNode(\n bootstrap.ownerNode.endpoint,\n options.transport,\n );\n const requestedCapabilities =\n bootstrap.resourceHint.requestedCapabilities.map((capability, index) =>\n parsePolicyCapability(\n capability,\n `$.resourceHint.requestedCapabilities[${index}]`,\n ),\n );\n const nativeAuthorityCeiling = requestedCapabilities.map((capability) => ({\n ...capability,\n space: bootstrap.ownerNode.spaceId,\n }));\n return new TranscriptRequester(\n bootstrap,\n requestedCapabilities,\n nativeAuthorityCeiling,\n requestedCapabilitiesHash(requestedCapabilities),\n parseStrictRfc3339(record.expiresAt)!,\n policyEngineAddresses,\n ownerNodeAddresses,\n options,\n );\n }\n\n get accessState(): \"active\" | \"needs-renewal\" | \"access-ended\" {\n if (this.accessEnded) {\n return \"access-ended\";\n }\n if (this.importedDelegation === undefined) {\n return \"needs-renewal\";\n }\n if (this.requiresRenewal(this.importedDelegation)) {\n return \"needs-renewal\";\n }\n return \"active\";\n }\n\n async readSql(\n statementName: ListenSqlStatementName,\n conversationId?: string,\n ): Promise<TranscriptRequesterReadSqlResult> {\n try {\n const catalogStatement = listenSqlStatementFromCatalog(statementName);\n const selectedConversationId =\n conversationId ?? this.bootstrap.resourceHint.resourceId;\n const statement: ResolvedListenSqlStatement = {\n ...catalogStatement,\n name:\n conversationId === undefined\n ? catalogStatement.name\n : listenTranscriptScopedStatementName(\n statementName,\n conversationId,\n ),\n fixedParams: catalogStatement.fixedParams.map((item) => ({\n ...item,\n value:\n item.value === \"{conversationId}\"\n ? selectedConversationId\n : item.value,\n })),\n };\n const delegation = await this.ensureFreshDelegation();\n const requested = this.sqlAccessCapabilityForDelegation(\n delegation,\n statement,\n );\n this.assertContainedByDelegation(delegation, requested);\n const response = await this.nativeInvoke(\n \"sql\",\n requested.path,\n \"tinycloud.sql/read\",\n {\n action: \"executeStatement\",\n name: statement.name,\n // The native constrained-SQL route injects caveat-pinned values and\n // rejects callers that supply those indices. Uncaveated reads must\n // resolve the catalog placeholder themselves.\n params:\n requested.caveats === undefined\n ? statement.fixedParams.map((item) => item.value)\n : [],\n },\n requested.caveats,\n );\n return parseNodeDataResponse(\n response,\n SqlReadResponseSchema,\n \"SQL read\",\n ) as TranscriptRequesterReadSqlResult;\n } catch (error) {\n this.recordAccessEnded(error);\n throw error;\n }\n }\n\n async readKv(path: string): Promise<TranscriptRequesterReadKvResult> {\n try {\n const delegation = await this.ensureFreshDelegation();\n const grantedKv = delegation.capabilities.find(\n (capability) =>\n capability.service === \"tinycloud.kv\" &&\n capability.path === path &&\n capability.actions.includes(\"tinycloud.kv/get\"),\n );\n const requested = parsePolicyCapability(\n {\n service: \"tinycloud.kv\",\n space: grantedKv?.space ?? \"applications\",\n path,\n actions: [\"tinycloud.kv/get\"],\n },\n \"$.kvRead\",\n );\n this.assertContainedByDelegation(delegation, requested);\n const response = await this.nativeInvoke(\"kv\", path, \"tinycloud.kv/get\");\n return parseNodeDataResponse(\n response,\n KvReadResponseSchema,\n \"KV read\",\n ) as TranscriptRequesterReadKvResult;\n } catch (error) {\n this.recordAccessEnded(error);\n throw error;\n }\n }\n\n private async nativeInvoke(\n service: \"sql\" | \"kv\",\n path: string,\n action: \"tinycloud.sql/read\" | \"tinycloud.kv/get\",\n body?: unknown,\n caveats?: Record<string, unknown>,\n ): Promise<RequesterHttpResponse> {\n const capability = this.invocationCapability;\n if (capability === undefined) {\n throw new TranscriptRequesterError(\n \"requester-invocation-signer-required\",\n \"holder invocation capability is required for native reads\",\n );\n }\n if (\n capability.holderDid !== this.requesterDid ||\n capability.holderDid !== this.signingCapability?.holderDid\n ) {\n throw new TranscriptRequesterError(\n \"requester-invocation-signer-mismatch\",\n \"invocation signer must be the presentation key-binding holder\",\n );\n }\n if (\n this.importedDelegationCid === undefined ||\n this.importedDelegation === undefined\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n \"native read requires a confirmed delegation import\",\n );\n }\n const session: ServiceSession = {\n delegationHeader: { Authorization: this.importedDelegation.encoded! },\n delegationCid: this.importedDelegationCid,\n spaceId: this.bootstrap.ownerNode.spaceId,\n verificationMethod: capability.verificationMethod,\n jwk: capability.jwk,\n };\n let invocationHeaders: ServiceHeaders;\n if (caveats === undefined) {\n invocationHeaders = capability.invoke(session, service, path, action);\n } else {\n if (capability.invokeAny === undefined) {\n throw new TranscriptRequesterError(\n \"requester-invocation-signer-required\",\n \"holder invocation capability must support caveated native reads\",\n );\n }\n invocationHeaders = capability.invokeAny(session, [\n {\n spaceId: this.bootstrap.ownerNode.spaceId,\n service,\n path,\n action,\n caveats: [caveats],\n },\n ]);\n }\n const headers = headersRecord(invocationHeaders);\n const response = await this.transport.request({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/invoke`,\n headers,\n redirect: \"error\",\n allowedResolvedAddresses: [...this.ownerNodeAddresses],\n ...(body === undefined ? {} : { body }),\n });\n this.assertOwnerNodeResponse(response, \"/invoke\");\n return response;\n }\n\n private async ensureFreshDelegation(): Promise<PortableDelegation> {\n if (this.accessEnded) {\n throw new TranscriptRequesterError(\n \"requester-access-ended\",\n \"requester access has ended\",\n \"access-ended\",\n );\n }\n if (\n this.importedDelegation !== undefined &&\n !this.requiresRenewal(this.importedDelegation)\n ) {\n return this.importedDelegation;\n }\n if (\n this.signingCapability === undefined ||\n this.signingCapability.holderDid !== this.requesterDid\n ) {\n throw new TranscriptRequesterError(\n \"requester-renewal-required\",\n \"a permitted requester signing capability is required for access-triggered renewal\",\n \"renewal-required\",\n );\n }\n try {\n let lastError: unknown;\n const attempts = Math.max(1, this.engineRetryAttempts);\n for (let attempt = 0; attempt < attempts; attempt++) {\n const challenge = await this.obtainChallenge();\n const presentation = await this.mintPresentation(challenge);\n try {\n const delegation = await this.resolveOnce(challenge, presentation);\n this.importedDelegation = delegation;\n return delegation;\n } catch (error) {\n if (\n !(error instanceof TranscriptRequesterError) ||\n error.state !== \"unreachable\"\n ) {\n throw error;\n }\n lastError = error;\n }\n if (attempt + 1 < attempts) {\n await this.sleep(retryDelay(attempt, this.random()));\n }\n }\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n lastError instanceof Error\n ? lastError.message\n : \"policy engine unreachable\",\n \"unreachable\",\n );\n } catch (error) {\n this.recordAccessEnded(error);\n throw error;\n }\n }\n\n private recordAccessEnded(error: unknown): void {\n if (\n error instanceof TranscriptRequesterError &&\n error.state === \"access-ended\"\n ) {\n this.accessEnded = true;\n }\n }\n\n private async obtainChallenge(): Promise<z.infer<typeof ChallengeSchema>> {\n this.assertPolicyEngineRecordCurrent();\n const response = await this.challengeRequestWithRetry({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/challenge`,\n redirect: \"error\",\n allowedResolvedAddresses: [...this.policyEngineAddresses],\n body: {\n policyId: this.bootstrap.policyId,\n },\n });\n return parseEngineSuccess(\n response.body,\n ChallengeResponseSchema,\n \"challenge response\",\n ).challenge;\n }\n\n private async mintPresentation(\n challenge: z.infer<typeof ChallengeSchema>,\n ): Promise<HolderKeyBindingPresentation> {\n if (\n challenge.policyId !== this.bootstrap.policyId ||\n challenge.audience !== this.bootstrap.policyEngine.audience ||\n challenge.audience !== this.audience\n ) {\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n \"challenge response binding does not match requester context\",\n );\n }\n if (this.usedChallengeNonces.has(challenge.nonce)) {\n throw new TranscriptRequesterError(\n \"requester-challenge-reused\",\n \"challenge nonce was already used by this requester\",\n );\n }\n this.usedChallengeNonces.add(challenge.nonce);\n const expiresAt = new Date(\n this.now().getTime() + this.presentationTtlSeconds * 1000,\n )\n .toISOString()\n .replace(\".000Z\", \"Z\");\n const input = {\n schema: HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,\n policyId: this.bootstrap.policyId,\n eligibleSubjectDid: this.eligibleSubjectDid,\n holderDid: this.requesterDid,\n holderBinding: this.holderBinding,\n requestedCapabilities: this.requestedCapabilities,\n requestedCapabilitiesHash: this.requestedCapabilitiesHash,\n audience: this.audience,\n nonce: challenge.nonce,\n expiresAt,\n ...(this.evidence === undefined ? {} : { evidence: this.evidence }),\n } as const;\n const signature =\n this.signingCapability!.signGrantPresentation === undefined\n ? await this.signingCapability!.signKeyBinding({\n ...input,\n challengeId: challenge.challengeId,\n issuedAt: expiresAt,\n keyId: this.signingCapability!.keyId,\n })\n : await this.signingCapability!.signGrantPresentation(input);\n if (typeof signature !== \"string\" || signature.length === 0) {\n throw new TranscriptRequesterError(\n \"requester-presentation-invalid\",\n \"signing capability returned an invalid holder key-binding signature\",\n );\n }\n return {\n ...input,\n holderSignature: {\n suite: this.signingCapability!.suite ?? challenge.acceptedSuites[0]!,\n signerDid: this.requesterDid,\n value: signature,\n },\n };\n }\n\n private async resolveOnce(\n challenge: z.infer<typeof ChallengeSchema>,\n presentation: HolderKeyBindingPresentation,\n ): Promise<PortableDelegation> {\n void challenge;\n this.assertPolicyEngineRecordCurrent();\n const response = await this.resolveRequestOnce({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/resolve`,\n redirect: \"error\",\n allowedResolvedAddresses: [...this.policyEngineAddresses],\n body: { presentation },\n });\n const parsed = parseEngineSuccess(\n response.body,\n ResolveResponseSchema,\n \"resolve response\",\n );\n return this.importPortableDelegation(parsed.delegation);\n }\n\n private async importPortableDelegation(\n input: unknown,\n ): Promise<PortableDelegation> {\n const parsed = parseNodeNativePortableDelegation(input);\n if (parsed.policyId !== this.bootstrap.policyId) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n \"portable delegation policy id does not match bootstrap\",\n );\n }\n if (parsed.holderDid !== this.requesterDid) {\n throw new TranscriptRequesterError(\n \"requester-delegation-wrong-holder\",\n \"portable delegation is not targeted at the requester DID\",\n );\n }\n if (parsed.issuerDid !== this.grantIssuerDid) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n \"portable delegation issuer does not match the verified grant issuer DID\",\n );\n }\n if (parsed.maxTtlSeconds > 300) {\n throw new TranscriptRequesterError(\n \"requester-delegation-ttl-excessive\",\n \"portable delegation TTL exceeds 300 seconds\",\n );\n }\n const issuedAt = parseStrictRfc3339(parsed.issuedAt)!;\n const expiresAt = parseStrictRfc3339(parsed.expiresAt)!;\n if (\n expiresAt <= issuedAt ||\n expiresAt - issuedAt > parsed.maxTtlSeconds * 1000\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-ttl-excessive\",\n \"portable delegation expires outside its maxTtlSeconds bound\",\n );\n }\n const capabilities = parsed.capabilities.map((capability, index) =>\n parsePolicyCapability(capability, `$.delegation.capabilities[${index}]`),\n );\n for (const granted of capabilities) {\n if (\n !this.nativeAuthorityCeiling.some((requested) =>\n policyCapabilityContains(requested, granted),\n )\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-capability-wider\",\n \"portable delegation grants a capability outside the bootstrap requested set\",\n );\n }\n }\n if (\n typeof parsed.encoded !== \"string\" ||\n parsed.encoded.split(\".\").length !== 3\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n \"portable delegation is not a compact-JWS UCAN\",\n );\n }\n const delegation = { ...parsed, capabilities } as PortableDelegation;\n const response = await this.transport.request({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/delegate`,\n headers: { Authorization: parsed.encoded },\n redirect: \"error\",\n allowedResolvedAddresses: [...this.ownerNodeAddresses],\n });\n this.assertOwnerNodeResponse(response, \"/delegate\");\n const receipt = parseDelegateReceipt(response);\n const target = this.bootstrap.ownerNode.spaceId;\n if (\n !receipt.activated.includes(target) ||\n receipt.skipped.includes(target)\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n receipt.activated.includes(target) && receipt.skipped.includes(target)\n ? \"owner node returned a contradictory delegation receipt\"\n : \"owner node did not activate the target owner space\",\n );\n }\n this.importedDelegationCid = deriveDelegationCid(parsed.encoded);\n return delegation;\n }\n\n private assertOwnerNodeResponse(\n response: RequesterHttpResponse,\n path: string,\n ): void {\n this.assertEndpointResponse(\n response,\n this.bootstrap.ownerNode.endpoint,\n path,\n this.ownerNodeAddresses,\n \"owner-node\",\n );\n }\n\n private assertPolicyEngineRecordCurrent(): void {\n if (this.policyEngineRecordExpiresAtMs <= this.now().getTime()) {\n throw new TranscriptRequesterError(\n \"requester-engine-record-invalid\",\n \"verified policy engine record has expired\",\n \"bootstrap-invalid\",\n );\n }\n }\n\n private assertPolicyEngineResponse(\n response: RequesterHttpResponse,\n path: string,\n ): void {\n this.assertEndpointResponse(\n response,\n this.bootstrap.policyEngine.endpoint,\n path,\n this.policyEngineAddresses,\n \"policy-engine\",\n );\n }\n\n private assertEndpointResponse(\n response: RequesterHttpResponse,\n endpoint: string,\n path: string,\n allowedAddresses: ReadonlySet<string>,\n kind: \"owner-node\" | \"policy-engine\",\n ): void {\n const expected = `${trimTrailingSlash(endpoint)}${path}`;\n const error = (message: string) => endpointError(kind, message);\n if (\n response.finalUrl !== expected ||\n response.resolvedAddress === undefined\n ) {\n throw error(\n `${kind} transport metadata is missing or indicates a redirect`,\n );\n }\n if (!allowedAddresses.has(normalizeIp(response.resolvedAddress))) {\n throw error(`${kind} address changed after endpoint validation`);\n }\n }\n\n private assertContainedByDelegation(\n delegation: PortableDelegation,\n requested: PolicyCapability,\n ): void {\n if (this.requiresRenewal(delegation)) {\n throw new TranscriptRequesterError(\n \"requester-renewal-required\",\n \"delegation requires renewal before access\",\n \"renewal-required\",\n );\n }\n if (\n !delegation.capabilities.some((granted) =>\n policyCapabilityContains(granted, requested),\n )\n ) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"requested access is outside the imported delegation capabilities\",\n \"not-contained\",\n );\n }\n }\n\n private sqlAccessCapabilityForDelegation(\n delegation: PortableDelegation,\n statement: ResolvedListenSqlStatement,\n ): PolicyCapability {\n const grantedSql = delegation.capabilities.find(\n (capability) =>\n capability.service === \"tinycloud.sql\" &&\n capability.actions.includes(\"tinycloud.sql/read\"),\n );\n if (grantedSql === undefined) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"delegation has no SQL read grant\",\n \"not-contained\",\n );\n }\n if (grantedSql.caveats !== undefined) {\n const statements = (\n grantedSql.caveats as {\n statements?: readonly {\n name?: unknown;\n sql?: unknown;\n fixedParams?: unknown;\n }[];\n }\n ).statements;\n const matchesCatalogSelection = statements?.some(\n (candidate) =>\n candidate.name === statement.name &&\n candidate.sql === statement.sql &&\n Array.isArray(candidate.fixedParams) &&\n jcsCanonicalize(candidate.fixedParams) ===\n jcsCanonicalize(statement.fixedParams),\n );\n if (!matchesCatalogSelection) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"SQL statement is outside the delegated catalog-derived statement caveat\",\n \"not-contained\",\n );\n }\n return grantedSql;\n }\n return parsePolicyCapability(\n {\n service: \"tinycloud.sql\",\n space: grantedSql.space,\n path: grantedSql.path,\n actions: [\"tinycloud.sql/read\"],\n },\n \"$.sqlRead\",\n );\n }\n\n private requiresRenewal(delegation: PortableDelegation): boolean {\n const expiresAt = parseStrictRfc3339(delegation.expiresAt)!;\n return (\n expiresAt - this.now().getTime() <= REQUESTER_NEAR_EXPIRY_SECONDS * 1000\n );\n }\n\n private async challengeRequestWithRetry(\n request: RequesterHttpRequest,\n ): Promise<RequesterHttpResponse> {\n let lastError: unknown;\n const attempts = Math.max(1, this.engineRetryAttempts);\n for (let attempt = 0; attempt < attempts; attempt++) {\n try {\n const response = await this.transport.request(request);\n this.assertPolicyEngineResponse(response, \"/policy/v0/challenge\");\n if (response.status >= 500) {\n lastError = new Error(`engine returned ${response.status}`);\n } else if (response.status >= 400) {\n const denial = parseDenialBody(response.body);\n if (denial !== undefined) {\n throw errorForDenial(denial, response.status);\n }\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n \"policy engine returned an invalid denial body\",\n );\n } else {\n return response;\n }\n } catch (error) {\n if (\n error instanceof TranscriptRequesterError &&\n error.state !== \"unreachable\"\n ) {\n throw error;\n }\n lastError = error;\n }\n if (attempt + 1 < attempts) {\n await this.sleep(retryDelay(attempt, this.random()));\n }\n }\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n lastError instanceof Error\n ? lastError.message\n : \"policy engine unreachable\",\n \"unreachable\",\n );\n }\n\n private async resolveRequestOnce(\n request: RequesterHttpRequest,\n ): Promise<RequesterHttpResponse> {\n try {\n const response = await this.transport.request(request);\n this.assertPolicyEngineResponse(response, \"/policy/v0/resolve\");\n if (response.status >= 500) {\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n `engine returned ${response.status}`,\n \"unreachable\",\n );\n }\n if (response.status >= 400) {\n const denial = parseDenialBody(response.body);\n if (denial !== undefined) {\n throw errorForDenial(denial, response.status);\n }\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n \"policy engine returned an invalid denial body\",\n );\n }\n return response;\n } catch (error) {\n if (error instanceof TranscriptRequesterError) {\n throw error;\n }\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n error instanceof Error ? error.message : \"policy engine unreachable\",\n \"unreachable\",\n );\n }\n }\n}\n\nexport async function createTranscriptRequester(\n options: TranscriptRequesterOptions,\n): Promise<TranscriptRequester> {\n return TranscriptRequester.create(options);\n}\n\nfunction parseBootstrap(input: unknown): TranscriptShareBootstrap & {\n readonly resourceHint: { readonly requestedCapabilities: readonly unknown[] };\n} {\n const normalized = normalizeExternal(input, \"requester-bootstrap-malformed\");\n const parsed = BootstrapSchema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n parsed.error.issues.some((issue) => issue.code === \"unrecognized_keys\")\n ? \"requester-bootstrap-unknown-key\"\n : \"requester-bootstrap-malformed\",\n parsed.error.message,\n \"bootstrap-invalid\",\n );\n }\n return parsed.data as TranscriptShareBootstrap & {\n readonly resourceHint: {\n readonly requestedCapabilities: readonly unknown[];\n };\n };\n}\n\nasync function verifyRecordBeforeEgress(\n bootstrap: TranscriptShareBootstrap,\n options: TranscriptRequesterOptions,\n) {\n try {\n return await verifyPolicyEngineRecordForRequester({\n signedRecord: bootstrap.policyEngine.signedRecord,\n ownerDid: options.ownerDid,\n audience: options.audience,\n grantIssuerDid: options.grantIssuerDid,\n now: (options.now ?? (() => new Date()))()\n .toISOString()\n .replace(\".000Z\", \"Z\"),\n requiredPolicyVersion: POLICY_VERSION_V0,\n requiredEvidenceVerifier: W3C_VC_CREDENTIAL_VERIFIER,\n });\n } catch (error) {\n const code = errorCodeForRecordFailure(error);\n throw new TranscriptRequesterError(\n code,\n error instanceof Error ? error.message : String(error),\n \"bootstrap-invalid\",\n );\n }\n}\n\nfunction errorCodeForRecordFailure(\n error: unknown,\n): TranscriptRequesterErrorCode {\n const code =\n typeof error === \"object\" && error !== null && \"code\" in error\n ? (error as { code?: unknown }).code\n : undefined;\n if (code === \"policy-engine-record-signature-invalid\") {\n return \"requester-engine-record-signature-invalid\";\n }\n if (code === \"policy-engine-record-owner-mismatch\") {\n return \"requester-engine-record-owner-mismatch\";\n }\n if (code === \"policy-engine-record-audience-mismatch\") {\n return \"requester-engine-record-audience-mismatch\";\n }\n return \"requester-engine-record-invalid\";\n}\n\nfunction parsePolicyCapability(input: unknown, path: string): PolicyCapability {\n try {\n return normalizePolicyCapabilityForRequester(\n input,\n ) as unknown as PolicyCapability;\n } catch (error) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n `${path}: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n}\n\nfunction listenSqlStatementFromCatalog(\n statementName: unknown,\n): ListenSqlStatement {\n if (typeof statementName !== \"string\") {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"SQL statement name must be a string from the canonical Listen statement catalog\",\n \"not-contained\",\n );\n }\n const statement = LISTEN_SQL_STATEMENT_BY_NAME.get(statementName);\n if (statement === undefined) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"SQL statement is not in the canonical Listen statement catalog\",\n \"not-contained\",\n );\n }\n return statement;\n}\n\nfunction normalizePolicyCapabilityForRequester(\n input: unknown,\n): PolicyCapability {\n const normalized = normalizeExternal(input, \"requester-delegation-invalid\");\n return normalizePolicyCapability(normalized);\n}\n\nfunction requestedCapabilitiesHash(\n capabilities: readonly PolicyCapability[],\n): string {\n const canonical = [...capabilities].sort((left, right) =>\n `${left.service}\\0${left.space}\\0${left.path}`.localeCompare(\n `${right.service}\\0${right.space}\\0${right.path}`,\n ),\n );\n const encoder = new TextEncoder();\n const domain = encoder.encode(\n \"xyz.tinycloud.policy/RequestedCapabilities/v0\\0\",\n );\n const body = encoder.encode(jcsCanonicalize(canonical));\n const bytes = new Uint8Array(domain.length + body.length);\n bytes.set(domain, 0);\n bytes.set(body, domain.length);\n return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nfunction normalizeWireDelegation(\n delegation: z.infer<typeof WireDelegationSchema>,\n): NormalizedWireDelegation {\n const signed = delegationAuthorityFromCompactJws(delegation.encoded);\n const invalid = (field: string): never => {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n `portable delegation ${field} does not match its signed compact-JWS authority`,\n );\n };\n if (delegation.delegationId !== deriveDelegationCid(delegation.encoded))\n invalid(\"delegationId\");\n if (delegation.issuerDid !== signed.issuerDid) invalid(\"issuerDid\");\n if (delegation.holderDid !== signed.holderDid) invalid(\"holderDid\");\n if (delegation.policyId !== signed.policyId) invalid(\"policyId\");\n if (Date.parse(delegation.issuedAt) !== signed.issuedAtMs)\n invalid(\"issuedAt\");\n if (Date.parse(delegation.expiresAt) !== signed.expiresAtMs)\n invalid(\"expiresAt\");\n if (delegation.terminal !== signed.terminal) invalid(\"terminal\");\n if (delegation.issuanceId !== signed.issuanceId) invalid(\"issuanceId\");\n if (delegation.capabilityHashHex !== signed.capabilityHashHex)\n invalid(\"capabilityHashHex\");\n if (delegation.revocationMode !== signed.revocationMode)\n invalid(\"revocationMode\");\n return {\n delegationId: deriveDelegationCid(delegation.encoded),\n issuerDid: signed.issuerDid,\n holderDid: signed.holderDid,\n policyId: signed.policyId,\n issuedAt: new Date(signed.issuedAtMs).toISOString().replace(\".000Z\", \"Z\"),\n expiresAt: new Date(signed.expiresAtMs).toISOString().replace(\".000Z\", \"Z\"),\n terminal: signed.terminal,\n maxTtlSeconds: Math.ceil((signed.expiresAtMs - signed.issuedAtMs) / 1000),\n capabilities: signed.capabilities,\n encoded: delegation.encoded,\n };\n}\n\n/**\n * Parse a frozen policy-engine delegation response and derive its authority\n * exclusively from the signed compact-JWS payload. This performs no egress or\n * node import and is suitable for constrained runners that cannot honestly\n * satisfy the public-endpoint transport profile.\n */\nexport function parseNodeNativePortableDelegation(\n input: unknown,\n): PortableDelegation {\n return normalizeWireDelegation(\n parseEngineSuccess(input, WireDelegationSchema, \"portable delegation\"),\n );\n}\n\nfunction delegationAuthorityFromCompactJws(encoded: string): {\n issuerDid: string;\n holderDid: string;\n policyId: string;\n issuanceId: string;\n capabilityHashHex: string;\n revocationMode: \"refresh_only\";\n issuedAtMs: number;\n expiresAtMs: number;\n terminal: boolean;\n capabilities: PolicyCapability[];\n} {\n try {\n const parts = encoded.split(\".\");\n if (parts.length !== 3) throw new Error(\"not compact JWS\");\n const payload = normalizeJson(\n JSON.parse(new TextDecoder().decode(base64UrlBytes(parts[1]!))),\n ) as Record<string, unknown>;\n const issuer = requiredPayloadString(payload, \"iss\");\n const holderDid = requiredPayloadString(payload, \"aud\");\n const issuedAt = requiredPayloadEpoch(payload, \"nbf\");\n const expiresAt = requiredPayloadEpoch(payload, \"exp\");\n const facts = payload.fct;\n if (!Array.isArray(facts)) throw new Error(\"UCAN fct is absent\");\n const authorityFacts = facts.filter(\n (fact) =>\n fact !== null &&\n typeof fact === \"object\" &&\n !Array.isArray(fact) &&\n \"xyz.tinycloud.policy/policyId\" in fact,\n ) as Record<string, unknown>[];\n if (authorityFacts.length !== 1)\n throw new Error(\"UCAN policy authority fact is not unique\");\n const fact = authorityFacts[0]!;\n const policyId = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/policyId\",\n );\n const issuanceId = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/issuanceId\",\n );\n const capabilityHashHex = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/capabilityHashHex\",\n );\n if (!/^[0-9a-f]{64}$/.test(capabilityHashHex)) {\n throw new Error(\n \"UCAN capability hash is not 64 lowercase hex characters\",\n );\n }\n const revocationMode = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/revocationMode\",\n );\n const delegationMode = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/delegationMode\",\n );\n if (revocationMode !== \"refresh_only\")\n throw new Error(\"unsupported UCAN revocation mode\");\n if (delegationMode !== \"terminal\")\n throw new Error(\"UCAN delegation is not terminal\");\n const att = payload.att;\n if (att === null || typeof att !== \"object\" || Array.isArray(att)) {\n throw new Error(\"UCAN att is absent\");\n }\n const capabilities: PolicyCapability[] = [];\n for (const [resource, rawAbilities] of Object.entries(att)) {\n if (\n rawAbilities === null ||\n typeof rawAbilities !== \"object\" ||\n Array.isArray(rawAbilities)\n ) {\n throw new Error(\"UCAN att abilities are invalid\");\n }\n const abilities = rawAbilities as Record<string, unknown>;\n const marker = resource.indexOf(\"/sql/\");\n if (!resource.startsWith(\"tinycloud:\") || marker < 0)\n throw new Error(\"unsupported UCAN resource\");\n const space = resource.slice(0, marker);\n const path = resource.slice(marker + \"/sql/\".length);\n for (const [action, rawCaveats] of Object.entries(abilities)) {\n const service = action.startsWith(\"tinycloud.sql/\")\n ? \"tinycloud.sql\"\n : action.startsWith(\"tinycloud.kv/\")\n ? \"tinycloud.kv\"\n : undefined;\n if (!Array.isArray(rawCaveats) || rawCaveats.length !== 1) {\n throw new Error(\"UCAN ability must have exactly one caveat branch\");\n }\n const caveats = rawCaveats;\n if (service === undefined) throw new Error(\"unsupported UCAN ability\");\n const first = caveats[0];\n capabilities.push(\n normalizePolicyCapability({\n service,\n space,\n path,\n actions: [action],\n ...(first !== null &&\n typeof first === \"object\" &&\n !Array.isArray(first) &&\n Object.keys(first).length > 0\n ? { caveats: first }\n : {}),\n }),\n );\n }\n }\n if (capabilities.length === 0) throw new Error(\"UCAN att is empty\");\n const fragment = issuer.indexOf(\"#\");\n const issuerDid = fragment < 0 ? issuer : issuer.slice(0, fragment);\n if (!issuerDid.startsWith(\"did:\") || !holderDid.startsWith(\"did:\")) {\n throw new Error(\"UCAN issuer or audience is not a DID\");\n }\n return {\n issuerDid,\n holderDid,\n policyId,\n issuanceId,\n capabilityHashHex,\n revocationMode,\n issuedAtMs: issuedAt * 1000,\n expiresAtMs: expiresAt * 1000,\n terminal: true,\n capabilities,\n };\n } catch (error) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n `node-native compact-JWS capabilities are invalid: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n}\n\nfunction requiredPayloadString(\n payload: Record<string, unknown>,\n key: string,\n): string {\n const value = payload[key];\n if (typeof value !== \"string\" || value.length === 0) {\n throw new Error(`UCAN ${key} is not a non-empty string`);\n }\n return value;\n}\n\nfunction requiredPayloadEpoch(\n payload: Record<string, unknown>,\n key: string,\n): number {\n const value = payload[key];\n if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n throw new Error(`UCAN ${key} is not a non-negative integer epoch`);\n }\n return value;\n}\n\nfunction base64UrlBytes(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\");\n const binary = atob(padded);\n return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction parseEngineSuccess<T>(\n input: unknown,\n schema: z.ZodType<T>,\n label: string,\n): T {\n const normalized = normalizeExternal(\n input,\n \"requester-engine-response-invalid\",\n );\n const denial = parseDenialBody(normalized);\n if (denial !== undefined) {\n throw errorForDenial(denial);\n }\n const parsed = schema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n `${label} failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction parseDataResponse<T>(\n response: RequesterHttpResponse,\n schema: z.ZodType<T>,\n label: string,\n): T {\n if (response.status >= 500) {\n throw new TranscriptRequesterError(\n \"requester-access-unreachable\",\n `${label} endpoint returned ${response.status}`,\n \"unreachable\",\n );\n }\n if (response.status >= 400) {\n const normalized = normalizeExternal(\n response.body,\n \"requester-access-denied\",\n );\n const denial = parseDenialBody(normalized);\n if (denial !== undefined) {\n throw errorForDenial(denial, response.status);\n }\n throw new TranscriptRequesterError(\n \"requester-access-denied\",\n `${label} denied`,\n \"denied\",\n );\n }\n const normalized = normalizeExternal(\n response.body,\n \"requester-engine-response-invalid\",\n );\n const parsed = schema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n `${label} response failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction parseDelegateReceipt(\n response: RequesterHttpResponse,\n): z.infer<typeof DelegateReceiptSchema> {\n if (response.status !== 200) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n `owner node delegation import returned ${response.status}`,\n response.status >= 500 ? \"invalid\" : \"denied\",\n undefined,\n response.status,\n );\n }\n const normalized = normalizeExternal(\n response.body,\n \"requester-delegation-import-failed\",\n );\n const parsed = DelegateReceiptSchema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n `owner node delegation receipt failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction parseNodeDataResponse<T>(\n response: RequesterHttpResponse,\n schema: z.ZodType<T>,\n label: string,\n): T {\n if (response.status >= 500) {\n throw new TranscriptRequesterError(\n \"requester-node-unreachable\",\n `${label} node returned ${response.status}: ${nodeErrorMessage(response.body)}`,\n \"unreachable\",\n undefined,\n response.status,\n );\n }\n if (response.status >= 400) {\n throw new TranscriptRequesterError(\n \"requester-node-denied\",\n `${label} node denied: ${nodeErrorMessage(response.body)}`,\n \"denied\",\n undefined,\n response.status,\n );\n }\n const normalized = normalizeExternal(\n response.body,\n \"requester-node-response-invalid\",\n );\n const parsed = schema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-node-response-invalid\",\n `${label} node response failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction nodeErrorMessage(body: unknown): string {\n if (typeof body === \"string\") return body;\n if (body !== null && typeof body === \"object\") {\n const record = body as Record<string, unknown>;\n const code = typeof record.code === \"string\" ? record.code : undefined;\n const message =\n typeof record.message === \"string\" ? record.message : undefined;\n if (code !== undefined)\n return message === undefined ? code : `${code}: ${message}`;\n }\n return \"native node refusal\";\n}\n\nexport function deriveDelegationCid(encoded: string): string {\n const digest = createDigest(0x1e, blake3(new TextEncoder().encode(encoded)));\n return CID.createV1(0x55, digest).toString();\n}\n\nfunction headersRecord(headers: ServiceHeaders): Record<string, string> {\n return Array.isArray(headers) ? Object.fromEntries(headers) : headers;\n}\n\nasync function validateAndResolveOwnerNode(\n endpoint: string,\n transport: RequesterTransport,\n): Promise<ReadonlySet<string>> {\n return validateAndResolvePublicEndpoint(endpoint, transport, \"owner-node\");\n}\n\nasync function validateAndResolvePublicEndpoint(\n endpoint: string,\n transport: RequesterTransport,\n kind: \"owner-node\" | \"policy-engine\",\n): Promise<ReadonlySet<string>> {\n let url: URL;\n try {\n url = new URL(endpoint);\n } catch {\n throw endpointError(kind, `${kind} endpoint is not a URL`);\n }\n if (\n url.protocol !== \"https:\" ||\n url.username !== \"\" ||\n url.password !== \"\" ||\n url.hash !== \"\" ||\n url.search !== \"\"\n ) {\n throw endpointError(\n kind,\n `${kind} endpoint must use HTTPS without credentials, query, or fragment`,\n );\n }\n if (transport.resolveEndpoint === undefined) {\n throw endpointError(\n kind,\n `${kind} endpoint resolution metadata is required`,\n );\n }\n let resolution: RequesterEndpointResolution;\n try {\n resolution = await transport.resolveEndpoint(url.origin);\n } catch (error) {\n throw endpointError(\n kind,\n `${kind} endpoint resolution failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n if (resolution.addresses.length === 0) {\n throw endpointError(kind, `${kind} endpoint resolved to no addresses`);\n }\n const addresses = new Set<string>();\n for (const address of resolution.addresses) {\n const normalized = normalizeIp(address);\n if (!isPublicIp(normalized)) {\n throw endpointError(\n kind,\n `${kind} endpoint resolved to a non-public address: ${address}`,\n );\n }\n addresses.add(normalized);\n }\n return addresses;\n}\n\nfunction endpointError(\n kind: \"owner-node\" | \"policy-engine\",\n message: string,\n): TranscriptRequesterError {\n return new TranscriptRequesterError(\n kind === \"owner-node\"\n ? \"requester-owner-node-endpoint-invalid\"\n : \"requester-policy-engine-endpoint-invalid\",\n message,\n \"bootstrap-invalid\",\n );\n}\n\nfunction normalizeIp(value: string): string {\n return value.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction isPublicIp(value: string): boolean {\n const ip = normalizeIp(value);\n const parts = ip.split(\".\");\n if (\n parts.length === 4 &&\n parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n ) {\n const [a, b] = parts.map(Number) as [number, number, number, number];\n return !(\n a === 0 ||\n a === 10 ||\n a === 127 ||\n (a === 100 && b >= 64 && b <= 127) ||\n (a === 169 && b === 254) ||\n (a === 172 && b >= 16 && b <= 31) ||\n (a === 192 && b === 0) ||\n (a === 192 && b === 168) ||\n (a === 198 && (b === 18 || b === 19)) ||\n (a === 198 && b === 51 && parts[2] === \"100\") ||\n (a === 203 && b === 0 && parts[2] === \"113\") ||\n a >= 224\n );\n }\n if (!ip.includes(\":\")) return false;\n if (\n ip === \"::\" ||\n ip === \"::1\" ||\n ip.startsWith(\"2001:db8:\") ||\n ip.startsWith(\"fe8\") ||\n ip.startsWith(\"fe9\") ||\n ip.startsWith(\"fea\") ||\n ip.startsWith(\"feb\") ||\n ip.startsWith(\"fc\") ||\n ip.startsWith(\"fd\") ||\n ip.startsWith(\"ff\")\n )\n return false;\n const mapped = ip.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n if (mapped !== null) return isPublicIp(mapped[1]!);\n const mappedHex = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n if (mappedHex !== null) {\n const high = Number.parseInt(mappedHex[1]!, 16);\n const low = Number.parseInt(mappedHex[2]!, 16);\n return isPublicIp(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);\n }\n return true;\n}\n\nfunction parseDenialBody(\n input: unknown,\n):\n | { code: PolicyEngineGrantPresentationDenialCode; message?: string }\n | undefined {\n const normalized = normalizeExternal(\n input,\n \"requester-engine-response-invalid\",\n );\n const direct = DenialSchema.safeParse(normalized);\n if (direct.success) {\n return { code: direct.data.code, message: direct.data.message };\n }\n const envelope = ErrorEnvelopeDenialSchema.safeParse(normalized);\n if (envelope.success) {\n return {\n code: envelope.data.error.code,\n message: envelope.data.error.message,\n };\n }\n return undefined;\n}\n\nfunction errorForDenial(\n denial: { code: PolicyEngineGrantPresentationDenialCode; message?: string },\n status?: number,\n): TranscriptRequesterError {\n const accessEnded =\n denial.code === \"policy-inactive\" ||\n denial.code === \"policy-revoked\" ||\n denial.code === \"policy-expired\";\n return new TranscriptRequesterError(\n `policy-engine-denied-${denial.code}`,\n denial.message ?? `policy engine denied ${denial.code}`,\n accessEnded ? \"access-ended\" : \"denied\",\n denial.code,\n status,\n );\n}\n\nfunction retryDelay(attempt: number, random: number): number {\n const base = Math.min(REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, 50 * 2 ** attempt);\n return Math.min(\n REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,\n Math.floor(base * (0.5 + random)),\n );\n}\n\nfunction trimTrailingSlash(value: string): string {\n return value.endsWith(\"/\") ? value.slice(0, -1) : value;\n}\n\nfunction normalizeExternal(\n input: unknown,\n code: TranscriptRequesterErrorCode,\n): unknown {\n try {\n return normalizeJson(input);\n } catch (error) {\n throw new TranscriptRequesterError(\n code,\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction parseStrictRfc3339(value: string): number | undefined {\n if (\n !/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/.test(\n value,\n )\n ) {\n return undefined;\n }\n const parsed = Date.parse(value);\n if (Number.isNaN(parsed)) {\n return undefined;\n }\n const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n const reparsed = Date.parse(value);\n return Date.parse(canonical) === reparsed ? parsed : undefined;\n}\n","import { rfc4648 } from './base.js'\n\nexport const base32 = rfc4648({\n prefix: 'b',\n name: 'base32',\n alphabet: 'abcdefghijklmnopqrstuvwxyz234567',\n bitsPerChar: 5\n})\n\nexport const base32upper = rfc4648({\n prefix: 'B',\n name: 'base32upper',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567',\n bitsPerChar: 5\n})\n\nexport const base32pad = rfc4648({\n prefix: 'c',\n name: 'base32pad',\n alphabet: 'abcdefghijklmnopqrstuvwxyz234567=',\n bitsPerChar: 5\n})\n\nexport const base32padupper = rfc4648({\n prefix: 'C',\n name: 'base32padupper',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=',\n bitsPerChar: 5\n})\n\nexport const base32hex = rfc4648({\n prefix: 'v',\n name: 'base32hex',\n alphabet: '0123456789abcdefghijklmnopqrstuv',\n bitsPerChar: 5\n})\n\nexport const base32hexupper = rfc4648({\n prefix: 'V',\n name: 'base32hexupper',\n alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV',\n bitsPerChar: 5\n})\n\nexport const base32hexpad = rfc4648({\n prefix: 't',\n name: 'base32hexpad',\n alphabet: '0123456789abcdefghijklmnopqrstuv=',\n bitsPerChar: 5\n})\n\nexport const base32hexpadupper = rfc4648({\n prefix: 'T',\n name: 'base32hexpadupper',\n alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV=',\n bitsPerChar: 5\n})\n\nexport const base32z = rfc4648({\n prefix: 'h',\n name: 'base32z',\n alphabet: 'ybndrfg8ejkmcpqxot1uwisza345h769',\n bitsPerChar: 5\n})\n","export const empty = new Uint8Array(0)\n\nexport function toHex (d: Uint8Array): string {\n return d.reduce((hex, byte) => hex + byte.toString(16).padStart(2, '0'), '')\n}\n\nexport function fromHex (hex: string): Uint8Array {\n const hexes = hex.match(/../g)\n return hexes != null ? new Uint8Array(hexes.map(b => parseInt(b, 16))) : empty\n}\n\nexport function equals (aa: Uint8Array, bb: Uint8Array): boolean {\n if (aa === bb) { return true }\n if (aa.byteLength !== bb.byteLength) {\n return false\n }\n\n for (let ii = 0; ii < aa.byteLength; ii++) {\n if (aa[ii] !== bb[ii]) {\n return false\n }\n }\n\n return true\n}\n\nexport function coerce (o: ArrayBufferView | ArrayBuffer | Uint8Array): Uint8Array {\n if (o instanceof Uint8Array && o.constructor.name === 'Uint8Array') { return o }\n if (o instanceof ArrayBuffer) { return new Uint8Array(o) }\n if (ArrayBuffer.isView(o)) {\n return new Uint8Array(o.buffer, o.byteOffset, o.byteLength)\n }\n throw new Error('Unknown type, must be binary type')\n}\n\nexport function isBinary (o: unknown): o is ArrayBuffer | ArrayBufferView {\n return o instanceof ArrayBuffer || ArrayBuffer.isView(o)\n}\n\nexport function fromString (str: string): Uint8Array {\n return new TextEncoder().encode(str)\n}\n\nexport function toString (b: Uint8Array): string {\n return new TextDecoder().decode(b)\n}\n","/* eslint-disable */\n// base-x encoding / decoding\n// Copyright (c) 2018 base-x contributors\n// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)\n// Distributed under the MIT software license, see the accompanying\n// file LICENSE or http://www.opensource.org/licenses/mit-license.php.\n/**\n * @param {string} ALPHABET\n * @param {any} name\n */\nfunction base (ALPHABET, name) {\n if (ALPHABET.length >= 255) { throw new TypeError('Alphabet too long') }\n var BASE_MAP = new Uint8Array(256);\n for (var j = 0; j < BASE_MAP.length; j++) {\n BASE_MAP[j] = 255;\n }\n for (var i = 0; i < ALPHABET.length; i++) {\n var x = ALPHABET.charAt(i);\n var xc = x.charCodeAt(0);\n if (BASE_MAP[xc] !== 255) { throw new TypeError(x + ' is ambiguous') }\n BASE_MAP[xc] = i;\n }\n var BASE = ALPHABET.length;\n var LEADER = ALPHABET.charAt(0);\n var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up\n var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up\n /**\n * @param {any[] | Iterable<number>} source\n */\n function encode (source) {\n // @ts-ignore\n if (source instanceof Uint8Array) ; else if (ArrayBuffer.isView(source)) {\n source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n } else if (Array.isArray(source)) {\n source = Uint8Array.from(source);\n }\n if (!(source instanceof Uint8Array)) { throw new TypeError('Expected Uint8Array') }\n if (source.length === 0) { return '' }\n // Skip & count leading zeroes.\n var zeroes = 0;\n var length = 0;\n var pbegin = 0;\n var pend = source.length;\n while (pbegin !== pend && source[pbegin] === 0) {\n pbegin++;\n zeroes++;\n }\n // Allocate enough space in big-endian base58 representation.\n var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;\n var b58 = new Uint8Array(size);\n // Process the bytes.\n while (pbegin !== pend) {\n var carry = source[pbegin];\n // Apply \"b58 = b58 * 256 + ch\".\n var i = 0;\n for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {\n carry += (256 * b58[it1]) >>> 0;\n b58[it1] = (carry % BASE) >>> 0;\n carry = (carry / BASE) >>> 0;\n }\n if (carry !== 0) { throw new Error('Non-zero carry') }\n length = i;\n pbegin++;\n }\n // Skip leading zeroes in base58 result.\n var it2 = size - length;\n while (it2 !== size && b58[it2] === 0) {\n it2++;\n }\n // Translate the result into a string.\n var str = LEADER.repeat(zeroes);\n for (; it2 < size; ++it2) { str += ALPHABET.charAt(b58[it2]); }\n return str\n }\n /**\n * @param {string | string[]} source\n */\n function decodeUnsafe (source) {\n if (typeof source !== 'string') { throw new TypeError('Expected String') }\n if (source.length === 0) { return new Uint8Array() }\n var psz = 0;\n // Skip leading spaces.\n if (source[psz] === ' ') { return }\n // Skip and count leading '1's.\n var zeroes = 0;\n var length = 0;\n while (source[psz] === LEADER) {\n zeroes++;\n psz++;\n }\n // Allocate enough space in big-endian base256 representation.\n var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.\n var b256 = new Uint8Array(size);\n // Process the characters.\n while (source[psz]) {\n // Decode character\n var carry = BASE_MAP[source.charCodeAt(psz)];\n // Invalid character\n if (carry === 255) { return }\n var i = 0;\n for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {\n carry += (BASE * b256[it3]) >>> 0;\n b256[it3] = (carry % 256) >>> 0;\n carry = (carry / 256) >>> 0;\n }\n if (carry !== 0) { throw new Error('Non-zero carry') }\n length = i;\n psz++;\n }\n // Skip trailing spaces.\n if (source[psz] === ' ') { return }\n // Skip leading zeroes in b256.\n var it4 = size - length;\n while (it4 !== size && b256[it4] === 0) {\n it4++;\n }\n var vch = new Uint8Array(zeroes + (size - it4));\n var j = zeroes;\n while (it4 !== size) {\n vch[j++] = b256[it4++];\n }\n return vch\n }\n /**\n * @param {string | string[]} string\n */\n function decode (string) {\n var buffer = decodeUnsafe(string);\n if (buffer) { return buffer }\n throw new Error(`Non-${name} character`)\n }\n return {\n encode: encode,\n decodeUnsafe: decodeUnsafe,\n decode: decode\n }\n}\nvar src = base;\n\nvar _brrp__multiformats_scope_baseX = src;\n\nexport default _brrp__multiformats_scope_baseX;\n","import { coerce } from '../bytes.js'\nimport basex from '../vendor/base-x.js'\nimport type { BaseCodec, BaseDecoder, BaseEncoder, CombobaseDecoder, Multibase, MultibaseCodec, MultibaseDecoder, MultibaseEncoder, UnibaseDecoder } from './interface.js'\n\ninterface EncodeFn { (bytes: Uint8Array): string }\ninterface DecodeFn { (text: string): Uint8Array }\n\n/**\n * Class represents both BaseEncoder and MultibaseEncoder meaning it\n * can be used to encode to multibase or base encode without multibase\n * prefix.\n */\nclass Encoder<Base extends string, Prefix extends string> implements MultibaseEncoder<Prefix>, BaseEncoder {\n readonly name: Base\n readonly prefix: Prefix\n readonly baseEncode: EncodeFn\n\n constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn) {\n this.name = name\n this.prefix = prefix\n this.baseEncode = baseEncode\n }\n\n encode (bytes: Uint8Array): Multibase<Prefix> {\n if (bytes instanceof Uint8Array) {\n return `${this.prefix}${this.baseEncode(bytes)}`\n } else {\n throw Error('Unknown type, must be binary type')\n }\n }\n}\n\n/**\n * Class represents both BaseDecoder and MultibaseDecoder so it could be used\n * to decode multibases (with matching prefix) or just base decode strings\n * with corresponding base encoding.\n */\nclass Decoder<Base extends string, Prefix extends string> implements MultibaseDecoder<Prefix>, UnibaseDecoder<Prefix>, BaseDecoder {\n readonly name: Base\n readonly prefix: Prefix\n readonly baseDecode: DecodeFn\n private readonly prefixCodePoint: number\n\n constructor (name: Base, prefix: Prefix, baseDecode: DecodeFn) {\n this.name = name\n this.prefix = prefix\n const prefixCodePoint = prefix.codePointAt(0)\n /* c8 ignore next 3 */\n if (prefixCodePoint === undefined) {\n throw new Error('Invalid prefix character')\n }\n this.prefixCodePoint = prefixCodePoint\n this.baseDecode = baseDecode\n }\n\n decode (text: string): Uint8Array {\n if (typeof text === 'string') {\n if (text.codePointAt(0) !== this.prefixCodePoint) {\n throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`)\n }\n return this.baseDecode(text.slice(this.prefix.length))\n } else {\n throw Error('Can only multibase decode strings')\n }\n }\n\n or<OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n return or(this, decoder)\n }\n}\n\ntype Decoders<Prefix extends string> = Record<Prefix, UnibaseDecoder<Prefix>>\n\nclass ComposedDecoder<Prefix extends string> implements MultibaseDecoder<Prefix>, CombobaseDecoder<Prefix> {\n readonly decoders: Decoders<Prefix>\n\n constructor (decoders: Decoders<Prefix>) {\n this.decoders = decoders\n }\n\n or <OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n return or(this, decoder)\n }\n\n decode (input: string): Uint8Array {\n const prefix = input[0] as Prefix\n const decoder = this.decoders[prefix]\n if (decoder != null) {\n return decoder.decode(input)\n } else {\n throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`)\n }\n }\n}\n\nexport function or <L extends string, R extends string> (left: UnibaseDecoder<L> | CombobaseDecoder<L>, right: UnibaseDecoder<R> | CombobaseDecoder<R>): ComposedDecoder<L | R> {\n return new ComposedDecoder({\n ...(left.decoders ?? { [(left as UnibaseDecoder<L>).prefix]: left }),\n ...(right.decoders ?? { [(right as UnibaseDecoder<R>).prefix]: right })\n } as Decoders<L | R>)\n}\n\nexport class Codec<Base extends string, Prefix extends string> implements MultibaseCodec<Prefix>, MultibaseEncoder<Prefix>, MultibaseDecoder<Prefix>, BaseCodec, BaseEncoder, BaseDecoder {\n readonly name: Base\n readonly prefix: Prefix\n readonly baseEncode: EncodeFn\n readonly baseDecode: DecodeFn\n readonly encoder: Encoder<Base, Prefix>\n readonly decoder: Decoder<Base, Prefix>\n\n constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn, baseDecode: DecodeFn) {\n this.name = name\n this.prefix = prefix\n this.baseEncode = baseEncode\n this.baseDecode = baseDecode\n this.encoder = new Encoder(name, prefix, baseEncode)\n this.decoder = new Decoder(name, prefix, baseDecode)\n }\n\n encode (input: Uint8Array): string {\n return this.encoder.encode(input)\n }\n\n decode (input: string): Uint8Array {\n return this.decoder.decode(input)\n }\n}\n\nexport function from <Base extends string, Prefix extends string> ({ name, prefix, encode, decode }: { name: Base, prefix: Prefix, encode: EncodeFn, decode: DecodeFn }): Codec<Base, Prefix> {\n return new Codec(name, prefix, encode, decode)\n}\n\nexport function baseX <Base extends string, Prefix extends string> ({ name, prefix, alphabet }: { name: Base, prefix: Prefix, alphabet: string }): Codec<Base, Prefix> {\n const { encode, decode } = basex(alphabet, name)\n return from({\n prefix,\n name,\n encode,\n decode: (text: string): Uint8Array => coerce(decode(text))\n })\n}\n\nfunction decode (string: string, alphabetIdx: Record<string, number>, bitsPerChar: number, name: string): Uint8Array {\n // Count the padding bytes:\n let end = string.length\n while (string[end - 1] === '=') {\n --end\n }\n\n // Allocate the output:\n const out = new Uint8Array((end * bitsPerChar / 8) | 0)\n\n // Parse the data:\n let bits = 0 // Number of bits currently in the buffer\n let buffer = 0 // Bits waiting to be written out, MSB first\n let written = 0 // Next byte to write\n for (let i = 0; i < end; ++i) {\n // Read one character from the string:\n const value = alphabetIdx[string[i]]\n if (value === undefined) {\n throw new SyntaxError(`Non-${name} character`)\n }\n\n // Append the bits to the buffer:\n buffer = (buffer << bitsPerChar) | value\n bits += bitsPerChar\n\n // Write out some bits if the buffer has a byte's worth:\n if (bits >= 8) {\n bits -= 8\n out[written++] = 0xff & (buffer >> bits)\n }\n }\n\n // Verify that we have received just enough bits:\n if (bits >= bitsPerChar || (0xff & (buffer << (8 - bits))) !== 0) {\n throw new SyntaxError('Unexpected end of data')\n }\n\n return out\n}\n\nfunction encode (data: Uint8Array, alphabet: string, bitsPerChar: number): string {\n const pad = alphabet[alphabet.length - 1] === '='\n const mask = (1 << bitsPerChar) - 1\n let out = ''\n\n let bits = 0 // Number of bits currently in the buffer\n let buffer = 0 // Bits waiting to be written out, MSB first\n for (let i = 0; i < data.length; ++i) {\n // Slurp data into the buffer:\n buffer = (buffer << 8) | data[i]\n bits += 8\n\n // Write out as much as we can:\n while (bits > bitsPerChar) {\n bits -= bitsPerChar\n out += alphabet[mask & (buffer >> bits)]\n }\n }\n\n // Partial character:\n if (bits !== 0) {\n out += alphabet[mask & (buffer << (bitsPerChar - bits))]\n }\n\n // Add padding characters until we hit a byte boundary:\n if (pad) {\n while (((out.length * bitsPerChar) & 7) !== 0) {\n out += '='\n }\n }\n\n return out\n}\n\nfunction createAlphabetIdx (alphabet: string): Record<string, number> {\n // Build the character lookup table:\n const alphabetIdx: Record<string, number> = {}\n for (let i = 0; i < alphabet.length; ++i) {\n alphabetIdx[alphabet[i]] = i\n }\n return alphabetIdx\n}\n\n/**\n * RFC4648 Factory\n */\nexport function rfc4648 <Base extends string, Prefix extends string> ({ name, prefix, bitsPerChar, alphabet }: { name: Base, prefix: Prefix, bitsPerChar: number, alphabet: string }): Codec<Base, Prefix> {\n const alphabetIdx = createAlphabetIdx(alphabet)\n return from({\n prefix,\n name,\n encode (input: Uint8Array): string {\n return encode(input, alphabet, bitsPerChar)\n },\n decode (input: string): Uint8Array {\n return decode(input, alphabetIdx, bitsPerChar, name)\n }\n })\n}\n","import { baseX } from './base.js'\n\nexport const base36 = baseX({\n prefix: 'k',\n name: 'base36',\n alphabet: '0123456789abcdefghijklmnopqrstuvwxyz'\n})\n\nexport const base36upper = baseX({\n prefix: 'K',\n name: 'base36upper',\n alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'\n})\n","import { baseX } from './base.js'\n\nexport const base58btc = baseX({\n name: 'base58btc',\n prefix: 'z',\n alphabet: '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'\n})\n\nexport const base58flickr = baseX({\n name: 'base58flickr',\n prefix: 'Z',\n alphabet: '123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ'\n})\n","/* eslint-disable */\nvar encode_1 = encode;\n\nvar MSB = 0x80\n , REST = 0x7F\n , MSBALL = ~REST\n , INT = Math.pow(2, 31);\n\n/**\n * @param {number} num\n * @param {number[]} out\n * @param {number} offset\n */\nfunction encode(num, out, offset) {\n out = out || [];\n offset = offset || 0;\n var oldOffset = offset;\n\n while(num >= INT) {\n out[offset++] = (num & 0xFF) | MSB;\n num /= 128;\n }\n while(num & MSBALL) {\n out[offset++] = (num & 0xFF) | MSB;\n num >>>= 7;\n }\n out[offset] = num | 0;\n \n // @ts-ignore\n encode.bytes = offset - oldOffset + 1;\n \n return out\n}\n\nvar decode = read;\n\nvar MSB$1 = 0x80\n , REST$1 = 0x7F;\n\n/**\n * @param {string | any[]} buf\n * @param {number} offset\n */\nfunction read(buf, offset) {\n var res = 0\n , offset = offset || 0\n , shift = 0\n , counter = offset\n , b\n , l = buf.length;\n\n do {\n if (counter >= l) {\n // @ts-ignore\n read.bytes = 0;\n throw new RangeError('Could not decode varint')\n }\n b = buf[counter++];\n res += shift < 28\n ? (b & REST$1) << shift\n : (b & REST$1) * Math.pow(2, shift);\n shift += 7;\n } while (b >= MSB$1)\n\n // @ts-ignore\n read.bytes = counter - offset;\n\n return res\n}\n\nvar N1 = Math.pow(2, 7);\nvar N2 = Math.pow(2, 14);\nvar N3 = Math.pow(2, 21);\nvar N4 = Math.pow(2, 28);\nvar N5 = Math.pow(2, 35);\nvar N6 = Math.pow(2, 42);\nvar N7 = Math.pow(2, 49);\nvar N8 = Math.pow(2, 56);\nvar N9 = Math.pow(2, 63);\n\nvar length = function (/** @type {number} */ value) {\n return (\n value < N1 ? 1\n : value < N2 ? 2\n : value < N3 ? 3\n : value < N4 ? 4\n : value < N5 ? 5\n : value < N6 ? 6\n : value < N7 ? 7\n : value < N8 ? 8\n : value < N9 ? 9\n : 10\n )\n};\n\nvar varint = {\n encode: encode_1\n , decode: decode\n , encodingLength: length\n};\n\nvar _brrp_varint = varint;\n\nexport default _brrp_varint;\n","import varint from './vendor/varint.js'\n\nexport function decode (data: Uint8Array, offset = 0): [number, number] {\n const code = varint.decode(data, offset)\n return [code, varint.decode.bytes]\n}\n\nexport function encodeTo (int: number, target: Uint8Array, offset = 0): Uint8Array {\n varint.encode(int, target, offset)\n return target\n}\n\nexport function encodingLength (int: number): number {\n return varint.encodingLength(int)\n}\n","import { coerce, equals as equalBytes } from '../bytes.js'\nimport * as varint from '../varint.js'\nimport type { MultihashDigest } from './interface.js'\n\n/**\n * Creates a multihash digest.\n */\nexport function create <Code extends number> (code: Code, digest: Uint8Array): Digest<Code, number> {\n const size = digest.byteLength\n const sizeOffset = varint.encodingLength(code)\n const digestOffset = sizeOffset + varint.encodingLength(size)\n\n const bytes = new Uint8Array(digestOffset + size)\n varint.encodeTo(code, bytes, 0)\n varint.encodeTo(size, bytes, sizeOffset)\n bytes.set(digest, digestOffset)\n\n return new Digest(code, size, digest, bytes)\n}\n\n/**\n * Turns bytes representation of multihash digest into an instance.\n */\nexport function decode (multihash: Uint8Array): MultihashDigest {\n const bytes = coerce(multihash)\n const [code, sizeOffset] = varint.decode(bytes)\n const [size, digestOffset] = varint.decode(bytes.subarray(sizeOffset))\n const digest = bytes.subarray(sizeOffset + digestOffset)\n\n if (digest.byteLength !== size) {\n throw new Error('Incorrect length')\n }\n\n return new Digest(code, size, digest, bytes)\n}\n\nexport function equals (a: MultihashDigest, b: unknown): b is MultihashDigest {\n if (a === b) {\n return true\n } else {\n const data = b as { code?: unknown, size?: unknown, bytes?: unknown }\n\n return (\n a.code === data.code &&\n a.size === data.size &&\n data.bytes instanceof Uint8Array &&\n equalBytes(a.bytes, data.bytes)\n )\n }\n}\n\n/**\n * Represents a multihash digest which carries information about the\n * hashing algorithm and an actual hash digest.\n */\nexport class Digest<Code extends number, Size extends number> implements MultihashDigest {\n readonly code: Code\n readonly size: Size\n readonly digest: Uint8Array\n readonly bytes: Uint8Array\n\n /**\n * Creates a multihash digest.\n */\n constructor (code: Code, size: Size, digest: Uint8Array, bytes: Uint8Array) {\n this.code = code\n this.size = size\n this.digest = digest\n this.bytes = bytes\n }\n}\n\n/**\n * Used to check that the passed multihash has the passed code\n */\nexport function hasCode <T extends number> (digest: MultihashDigest, code: T): digest is MultihashDigest<T> {\n return digest.code === code\n}\n","import { base32 } from './bases/base32.js'\nimport { base36 } from './bases/base36.js'\nimport { base58btc } from './bases/base58.js'\nimport { coerce } from './bytes.js'\nimport * as Digest from './hashes/digest.js'\nimport * as varint from './varint.js'\nimport type * as API from './link/interface.js'\n\n// This way TS will also expose all the types from module\nexport * from './link/interface.js'\n\nexport function format <T extends API.Link<unknown, number, number, API.Version>, Prefix extends string> (link: T, base?: API.MultibaseEncoder<Prefix>): API.ToString<T, Prefix> {\n const { bytes, version } = link\n switch (version) {\n case 0:\n return toStringV0(\n bytes,\n baseCache(link),\n base as API.MultibaseEncoder<'z'> ?? base58btc.encoder\n )\n default:\n return toStringV1(\n bytes,\n baseCache(link),\n (base ?? base32.encoder) as API.MultibaseEncoder<Prefix>\n )\n }\n}\n\nexport function toJSON <Link extends API.UnknownLink> (link: Link): API.LinkJSON<Link> {\n return {\n '/': format(link)\n }\n}\n\nexport function fromJSON <Link extends API.UnknownLink> (json: API.LinkJSON<Link>): CID<unknown, number, number, API.Version> {\n return CID.parse(json['/'])\n}\n\nconst cache = new WeakMap<API.UnknownLink, Map<string, string>>()\n\nfunction baseCache (cid: API.UnknownLink): Map<string, string> {\n const baseCache = cache.get(cid)\n if (baseCache == null) {\n const baseCache = new Map()\n cache.set(cid, baseCache)\n return baseCache\n }\n return baseCache\n}\n\nexport class CID<Data = unknown, Format extends number = number, Alg extends number = number, Version extends API.Version = API.Version> implements API.Link<Data, Format, Alg, Version> {\n readonly code: Format\n readonly version: Version\n readonly multihash: API.MultihashDigest<Alg>\n readonly bytes: Uint8Array\n readonly '/': Uint8Array\n\n /**\n * @param version - Version of the CID\n * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n * @param multihash - (Multi)hash of the of the content.\n */\n constructor (version: Version, code: Format, multihash: API.MultihashDigest<Alg>, bytes: Uint8Array) {\n this.code = code\n this.version = version\n this.multihash = multihash\n this.bytes = bytes\n\n // flag to serializers that this is a CID and\n // should be treated specially\n this['/'] = bytes\n }\n\n /**\n * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`\n * please either use `CID.asCID(cid)` or switch to new signalling mechanism\n *\n * @deprecated\n */\n get asCID (): this {\n return this\n }\n\n // ArrayBufferView\n get byteOffset (): number {\n return this.bytes.byteOffset\n }\n\n // ArrayBufferView\n get byteLength (): number {\n return this.bytes.byteLength\n }\n\n toV0 (): CID<Data, API.DAG_PB, API.SHA_256, 0> {\n switch (this.version) {\n case 0: {\n return this as CID<Data, API.DAG_PB, API.SHA_256, 0>\n }\n case 1: {\n const { code, multihash } = this\n\n if (code !== DAG_PB_CODE) {\n throw new Error('Cannot convert a non dag-pb CID to CIDv0')\n }\n\n // sha2-256\n if (multihash.code !== SHA_256_CODE) {\n throw new Error('Cannot convert non sha2-256 multihash CID to CIDv0')\n }\n\n return (\n CID.createV0(\n multihash as API.MultihashDigest<API.SHA_256>\n )\n )\n }\n default: {\n throw Error(\n `Can not convert CID version ${this.version} to version 0. This is a bug please report`\n )\n }\n }\n }\n\n toV1 (): CID<Data, Format, Alg, 1> {\n switch (this.version) {\n case 0: {\n const { code, digest } = this.multihash\n const multihash = Digest.create(code, digest)\n return (\n CID.createV1(this.code, multihash)\n )\n }\n case 1: {\n return this as CID<Data, Format, Alg, 1>\n }\n default: {\n throw Error(\n `Can not convert CID version ${this.version} to version 1. This is a bug please report`\n )\n }\n }\n }\n\n equals (other: unknown): other is CID<Data, Format, Alg, Version> {\n return CID.equals(this, other)\n }\n\n static equals <Data, Format extends number, Alg extends number, Version extends API.Version>(self: API.Link<Data, Format, Alg, Version>, other: unknown): other is CID {\n const unknown = other as { code?: unknown, version?: unknown, multihash?: unknown }\n return (\n unknown != null &&\n self.code === unknown.code &&\n self.version === unknown.version &&\n Digest.equals(self.multihash, unknown.multihash)\n )\n }\n\n toString (base?: API.MultibaseEncoder<string>): string {\n return format(this, base)\n }\n\n toJSON (): API.LinkJSON<this> {\n return { '/': format(this) }\n }\n\n link (): this {\n return this\n }\n\n readonly [Symbol.toStringTag] = 'CID';\n\n // Legacy\n\n [Symbol.for('nodejs.util.inspect.custom')] (): string {\n return `CID(${this.toString()})`\n }\n\n /**\n * Takes any input `value` and returns a `CID` instance if it was\n * a `CID` otherwise returns `null`. If `value` is instanceof `CID`\n * it will return value back. If `value` is not instance of this CID\n * class, but is compatible CID it will return new instance of this\n * `CID` class. Otherwise returns null.\n *\n * This allows two different incompatible versions of CID library to\n * co-exist and interop as long as binary interface is compatible.\n */\n static asCID <Data, Format extends number, Alg extends number, Version extends API.Version, U>(input: API.Link<Data, Format, Alg, Version> | U): CID<Data, Format, Alg, Version> | null {\n if (input == null) {\n return null\n }\n\n const value = input as any\n if (value instanceof CID) {\n // If value is instance of CID then we're all set.\n return value\n } else if ((value['/'] != null && value['/'] === value.bytes) || value.asCID === value) {\n // If value isn't instance of this CID class but `this.asCID === this` or\n // `value['/'] === value.bytes` is true it is CID instance coming from a\n // different implementation (diff version or duplicate). In that case we\n // rebase it to this `CID` implementation so caller is guaranteed to get\n // instance with expected API.\n const { version, code, multihash, bytes } = value\n return new CID(\n version,\n code,\n multihash as API.MultihashDigest<Alg>,\n bytes ?? encodeCID(version, code, multihash.bytes)\n )\n } else if (value[cidSymbol] === true) {\n // If value is a CID from older implementation that used to be tagged via\n // symbol we still rebase it to the this `CID` implementation by\n // delegating that to a constructor.\n const { version, multihash, code } = value\n const digest = Digest.decode(multihash) as API.MultihashDigest<Alg>\n return CID.create(version, code, digest)\n } else {\n // Otherwise value is not a CID (or an incompatible version of it) in\n // which case we return `null`.\n return null\n }\n }\n\n /**\n * @param version - Version of the CID\n * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n * @param digest - (Multi)hash of the of the content.\n */\n static create <Data, Format extends number, Alg extends number, Version extends API.Version>(version: Version, code: Format, digest: API.MultihashDigest<Alg>): CID<Data, Format, Alg, Version> {\n if (typeof code !== 'number') {\n throw new Error('String codecs are no longer supported')\n }\n\n if (!(digest.bytes instanceof Uint8Array)) {\n throw new Error('Invalid digest')\n }\n\n switch (version) {\n case 0: {\n if (code !== DAG_PB_CODE) {\n throw new Error(\n `Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`\n )\n } else {\n return new CID(version, code, digest, digest.bytes)\n }\n }\n case 1: {\n const bytes = encodeCID(version, code, digest.bytes)\n return new CID(version, code, digest, bytes)\n }\n default: {\n throw new Error('Invalid version')\n }\n }\n }\n\n /**\n * Simplified version of `create` for CIDv0.\n */\n static createV0 <T = unknown>(digest: API.MultihashDigest<typeof SHA_256_CODE>): CID<T, typeof DAG_PB_CODE, typeof SHA_256_CODE, 0> {\n return CID.create(0, DAG_PB_CODE, digest)\n }\n\n /**\n * Simplified version of `create` for CIDv1.\n *\n * @param code - Content encoding format code.\n * @param digest - Multihash of the content.\n */\n static createV1 <Data, Code extends number, Alg extends number>(code: Code, digest: API.MultihashDigest<Alg>): CID<Data, Code, Alg, 1> {\n return CID.create(1, code, digest)\n }\n\n /**\n * Decoded a CID from its binary representation. The byte array must contain\n * only the CID with no additional bytes.\n *\n * An error will be thrown if the bytes provided do not contain a valid\n * binary representation of a CID.\n */\n static decode <Data, Code extends number, Alg extends number, Version extends API.Version>(bytes: API.ByteView<API.Link<Data, Code, Alg, Version>>): CID<Data, Code, Alg, Version> {\n const [cid, remainder] = CID.decodeFirst(bytes)\n if (remainder.length !== 0) {\n throw new Error('Incorrect length')\n }\n return cid\n }\n\n /**\n * Decoded a CID from its binary representation at the beginning of a byte\n * array.\n *\n * Returns an array with the first element containing the CID and the second\n * element containing the remainder of the original byte array. The remainder\n * will be a zero-length byte array if the provided bytes only contained a\n * binary CID representation.\n */\n static decodeFirst <T, C extends number, A extends number, V extends API.Version>(bytes: API.ByteView<API.Link<T, C, A, V>>): [CID<T, C, A, V>, Uint8Array] {\n const specs = CID.inspectBytes(bytes)\n const prefixSize = specs.size - specs.multihashSize\n const multihashBytes = coerce(\n bytes.subarray(prefixSize, prefixSize + specs.multihashSize)\n )\n if (multihashBytes.byteLength !== specs.multihashSize) {\n throw new Error('Incorrect length')\n }\n const digestBytes = multihashBytes.subarray(\n specs.multihashSize - specs.digestSize\n )\n const digest = new Digest.Digest(\n specs.multihashCode,\n specs.digestSize,\n digestBytes,\n multihashBytes\n )\n const cid =\n specs.version === 0\n ? CID.createV0(digest as API.MultihashDigest<API.SHA_256>)\n : CID.createV1(specs.codec, digest)\n return [cid as CID<T, C, A, V>, bytes.subarray(specs.size)]\n }\n\n /**\n * Inspect the initial bytes of a CID to determine its properties.\n *\n * Involves decoding up to 4 varints. Typically this will require only 4 to 6\n * bytes but for larger multicodec code values and larger multihash digest\n * lengths these varints can be quite large. It is recommended that at least\n * 10 bytes be made available in the `initialBytes` argument for a complete\n * inspection.\n */\n static inspectBytes <T, C extends number, A extends number, V extends API.Version>(initialBytes: API.ByteView<API.Link<T, C, A, V>>): { version: V, codec: C, multihashCode: A, digestSize: number, multihashSize: number, size: number } {\n let offset = 0\n const next = (): number => {\n const [i, length] = varint.decode(initialBytes.subarray(offset))\n offset += length\n return i\n }\n\n let version = next() as V\n let codec = DAG_PB_CODE as C\n if (version as number === 18) {\n // CIDv0\n version = 0 as V\n offset = 0\n } else {\n codec = next() as C\n }\n\n if (version !== 0 && version !== 1) {\n throw new RangeError(`Invalid CID version ${version}`)\n }\n\n const prefixSize = offset\n const multihashCode = next() as A // multihash code\n const digestSize = next() // multihash length\n const size = offset + digestSize\n const multihashSize = size - prefixSize\n\n return { version, codec, multihashCode, digestSize, multihashSize, size }\n }\n\n /**\n * Takes cid in a string representation and creates an instance. If `base`\n * decoder is not provided will use a default from the configuration. It will\n * throw an error if encoding of the CID is not compatible with supplied (or\n * a default decoder).\n */\n static parse <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version>(source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): CID<Data, Code, Alg, Version> {\n const [prefix, bytes] = parseCIDtoBytes(source, base)\n\n const cid = CID.decode(bytes)\n\n if (cid.version === 0 && source[0] !== 'Q') {\n throw Error('Version 0 CID string must not include multibase prefix')\n }\n\n // Cache string representation to avoid computing it on `this.toString()`\n baseCache(cid).set(prefix, source)\n\n return cid\n }\n}\n\nfunction parseCIDtoBytes <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version> (source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): [Prefix, API.ByteView<API.Link<Data, Code, Alg, Version>>] {\n switch (source[0]) {\n // CIDv0 is parsed differently\n case 'Q': {\n const decoder = base ?? base58btc\n return [\n base58btc.prefix as Prefix,\n decoder.decode(`${base58btc.prefix}${source}`)\n ]\n }\n case base58btc.prefix: {\n const decoder = base ?? base58btc\n return [base58btc.prefix as Prefix, decoder.decode(source)]\n }\n case base32.prefix: {\n const decoder = base ?? base32\n return [base32.prefix as Prefix, decoder.decode(source)]\n }\n case base36.prefix: {\n const decoder = base ?? base36\n return [base36.prefix as Prefix, decoder.decode(source)]\n }\n default: {\n if (base == null) {\n throw Error(\n 'To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided'\n )\n }\n return [source[0] as Prefix, base.decode(source)]\n }\n }\n}\n\nfunction toStringV0 (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<'z'>): string {\n const { prefix } = base\n if (prefix !== base58btc.prefix) {\n throw Error(`Cannot string encode V0 in ${base.name} encoding`)\n }\n\n const cid = cache.get(prefix)\n if (cid == null) {\n const cid = base.encode(bytes).slice(1)\n cache.set(prefix, cid)\n return cid\n } else {\n return cid\n }\n}\n\nfunction toStringV1 <Prefix extends string> (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<Prefix>): string {\n const { prefix } = base\n const cid = cache.get(prefix)\n if (cid == null) {\n const cid = base.encode(bytes)\n cache.set(prefix, cid)\n return cid\n } else {\n return cid\n }\n}\n\nconst DAG_PB_CODE = 0x70\nconst SHA_256_CODE = 0x12\n\nfunction encodeCID (version: API.Version, code: number, multihash: Uint8Array): Uint8Array {\n const codeOffset = varint.encodingLength(version)\n const hashOffset = codeOffset + varint.encodingLength(code)\n const bytes = new Uint8Array(hashOffset + multihash.byteLength)\n varint.encodeTo(version, bytes, 0)\n varint.encodeTo(code, bytes, codeOffset)\n bytes.set(multihash, hashOffset)\n return bytes\n}\n\nconst cidSymbol = Symbol.for('@ipld/js-cid/CID')\n","export type SignedObjectErrorCode =\n | \"schema-invalid\"\n | \"canonicalization-mismatch\"\n | \"digest-mismatch\"\n | \"id-mismatch\"\n | \"signing-key-binding\"\n | \"signature-material-invalid\"\n | \"signature-suite-unsupported\"\n | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n public readonly code: SignedObjectErrorCode;\n\n constructor(code: SignedObjectErrorCode, message: string) {\n super(message);\n this.name = \"SignedObjectProfileError\";\n this.code = code;\n }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"schema-invalid\", message);\n this.name = \"SignedObjectSchemaError\";\n }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"canonicalization-mismatch\", message);\n this.name = \"SignedObjectCanonicalizationError\";\n }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"digest-mismatch\", message);\n this.name = \"SignedObjectDigestError\";\n }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"id-mismatch\", message);\n this.name = \"SignedObjectIdError\";\n }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signing-key-binding\", message);\n this.name = \"SigningKeyBindingError\";\n }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signature-material-invalid\", message);\n this.name = \"SignatureMaterialError\";\n }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signature-suite-unsupported\", message);\n this.name = \"UnsupportedSignatureSuiteError\";\n }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signature-invalid\", message);\n this.name = \"SignatureVerificationError\";\n }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n if (error instanceof SignedObjectProfileError) {\n return error;\n }\n return new SignedObjectProfileError(\n \"schema-invalid\",\n error instanceof Error ? error.message : String(error),\n );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n | null\n | boolean\n | number\n | string\n | JsonValue[]\n | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted lexicographically by their raw UTF-16 code units,\n * as required by RFC 8785 section 3.2.3, before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n if (input === null) {\n return null;\n }\n\n switch (typeof input) {\n case \"boolean\":\n return input;\n case \"number\":\n if (!Number.isFinite(input)) {\n throw new SignedObjectCanonicalizationError(\n `${path} must be a finite JSON number`,\n );\n }\n return input;\n case \"string\":\n assertUnicodeScalarString(input, path);\n return input;\n case \"object\":\n return normalizeJsonObjectOrArray(input, path);\n case \"bigint\":\n case \"function\":\n case \"symbol\":\n case \"undefined\":\n default:\n throw new SignedObjectCanonicalizationError(\n `${path} is not a JSON value`,\n );\n }\n}\n\nexport function serialize(value: JsonValue): string {\n if (value === null) {\n return \"null\";\n }\n\n switch (typeof value) {\n case \"boolean\":\n return value ? \"true\" : \"false\";\n case \"number\": {\n const encoded = JSON.stringify(value);\n if (encoded === undefined) {\n throw new SignedObjectCanonicalizationError(\n \"number could not be serialized as JSON\",\n );\n }\n return encoded;\n }\n case \"string\":\n return JSON.stringify(value);\n case \"object\":\n if (Array.isArray(value)) {\n return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n }\n return serializeObject(value);\n default:\n throw new SignedObjectCanonicalizationError(\n `unsupported JSON value type ${typeof value}`,\n );\n }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n assertNoSymbolKeys(input, path);\n\n if (Array.isArray(input)) {\n for (const key of Object.getOwnPropertyNames(input)) {\n if (key === \"length\") {\n continue;\n }\n if (!isArrayIndexKey(key, input.length)) {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} is not allowed on a JSON array`,\n );\n }\n const descriptor = Object.getOwnPropertyDescriptor(input, key);\n if (descriptor?.enumerable !== true) {\n throw new SignedObjectCanonicalizationError(\n `${path}[${key}] must be an enumerable JSON array item`,\n );\n }\n if (!(\"value\" in descriptor)) {\n throw new SignedObjectCanonicalizationError(\n `${path}[${key}] must be a JSON data property`,\n );\n }\n }\n const output: JsonValue[] = [];\n for (let index = 0; index < input.length; index++) {\n if (!objectHasOwn(input, index)) {\n throw new SignedObjectCanonicalizationError(\n `${path}[${index}] must not be a sparse array hole`,\n );\n }\n output.push(normalizeJson(input[index], `${path}[${index}]`));\n }\n return output;\n }\n\n const proto = Object.getPrototypeOf(input);\n if (proto !== Object.prototype && proto !== null) {\n throw new SignedObjectCanonicalizationError(\n `${path} must be a plain JSON object`,\n );\n }\n\n const output = Object.create(null) as MutableJsonObject;\n for (const key of Object.getOwnPropertyNames(input)) {\n assertUnicodeScalarString(key, `${path} key`);\n if (key === \"__proto__\" || key === \"constructor\") {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} is not allowed`,\n );\n }\n const descriptor = Object.getOwnPropertyDescriptor(input, key);\n if (descriptor?.enumerable !== true) {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} must be an enumerable JSON object property`,\n );\n }\n if (!(\"value\" in descriptor)) {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} must be a JSON data property`,\n );\n }\n const value = descriptor.value;\n output[key] = normalizeJson(value, `${path}.${key}`);\n }\n return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n if (Object.getOwnPropertySymbols(input).length > 0) {\n throw new SignedObjectCanonicalizationError(\n `${path} must not have symbol properties`,\n );\n }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n if (!/^(0|[1-9]\\d*)$/.test(key)) {\n return false;\n }\n const index = Number(key);\n return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n const keys = Object.keys(value).sort(compareUtf16CodeUnits);\n const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n return `{${parts.join(\",\")}}`;\n}\n\nfunction compareUtf16CodeUnits(a: string, b: string): number {\n const max = Math.min(a.length, b.length);\n for (let index = 0; index < max; index++) {\n const leftCodeUnit = a.charCodeAt(index);\n const rightCodeUnit = b.charCodeAt(index);\n if (leftCodeUnit !== rightCodeUnit) {\n return leftCodeUnit - rightCodeUnit;\n }\n }\n return a.length - b.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n for (let index = 0; index < value.length; index++) {\n const code = value.charCodeAt(index);\n if (code >= 0xd800 && code <= 0xdbff) {\n const next = value.charCodeAt(index + 1);\n if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n throw new SignedObjectCanonicalizationError(\n `${path} contains a lone high surrogate`,\n );\n }\n index++;\n continue;\n }\n if (code >= 0xdc00 && code <= 0xdfff) {\n throw new SignedObjectCanonicalizationError(\n `${path} contains a lone low surrogate`,\n );\n }\n }\n}\n","import { CAPABILITY_REGISTRY } from \"@tinycloud/bootstrap\";\nimport { bytesToHex, sha256 } from \"viem\";\nimport { jcsCanonicalize, normalizeJson, type JsonValue } from \"./jcs\";\n\nconst POLICY_CAPABILITY_DOMAIN = \"xyz.tinycloud.policy/PolicyCapability/v0\";\nconst textEncoder = new TextEncoder();\n\nexport type PolicyCapabilityErrorCode =\n | \"policy-capability-malformed\"\n | \"policy-capability-unknown-key\"\n | \"policy-capability-malformed-service\"\n | \"policy-capability-malformed-space\"\n | \"policy-capability-malformed-path\"\n | \"policy-capability-malformed-action\"\n | \"policy-capability-empty-actions\"\n | \"policy-capability-malformed-caveats\";\n\nexport class PolicyCapabilityError extends Error {\n public readonly code: PolicyCapabilityErrorCode;\n\n constructor(code: PolicyCapabilityErrorCode, message: string) {\n super(message);\n this.name = \"PolicyCapabilityError\";\n this.code = code;\n }\n}\n\nexport interface PolicyCapability {\n readonly service: \"tinycloud.kv\" | \"tinycloud.sql\" | \"tinycloud.vfs\";\n readonly space: string;\n readonly path: string;\n readonly actions: readonly string[];\n readonly caveats?: JsonObject;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\ninterface NormalizeOptions {\n readonly allowPrefixPaths?: boolean;\n readonly requireCanonical?: boolean;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nconst CEILING_SERVICES = new Set([\"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.vfs\"]);\nconst GRANTABLE_ACTIONS = new Map<string, ReadonlySet<string>>();\n\nfor (const entry of CAPABILITY_REGISTRY) {\n if (!CEILING_SERVICES.has(entry.service)) {\n continue;\n }\n if (entry.aliasOf !== undefined || entry.implies !== undefined || entry.urn.endsWith(\"/*\")) {\n continue;\n }\n const existing = GRANTABLE_ACTIONS.get(entry.service);\n if (existing === undefined) {\n GRANTABLE_ACTIONS.set(entry.service, new Set([entry.urn]));\n continue;\n }\n (existing as Set<string>).add(entry.urn);\n}\n\n/**\n * Strict authoring validator for resolved Listen-adapter PolicyCapability JSON.\n * It accepts only concrete service/space/path/action/caveat forms and rejects\n * manifest-shaped permission payloads before any Policy is signed.\n */\nexport function normalizePolicyCapability(input: unknown): PolicyCapability {\n return normalizePolicyCapabilityWithOptions(input, { requireCanonical: true });\n}\n\n/**\n * Frozen-vector canonicalizer for the m1-b-01a policy-capability vectors.\n * Prefix paths are allowed here only to preserve behavioral conformance with\n * the vendored engine vectors; authoring uses normalizePolicyCapability.\n */\nexport function canonicalizePolicyCapability(input: unknown): PolicyCapability {\n return normalizePolicyCapabilityWithOptions(input, { allowPrefixPaths: true });\n}\n\nexport function policyCapabilityDigestHex(input: unknown): string {\n const canonical = canonicalizePolicyCapability(input);\n const jcs = textEncoder.encode(jcsCanonicalize(canonical));\n const domain = textEncoder.encode(`${POLICY_CAPABILITY_DOMAIN}\\0`);\n const bytes = new Uint8Array(domain.length + jcs.length);\n bytes.set(domain, 0);\n bytes.set(jcs, domain.length);\n return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nexport function policyCapabilityContains(authority: unknown, request: unknown): boolean {\n let auth: PolicyCapability;\n let req: PolicyCapability;\n try {\n auth = canonicalizePolicyCapability(authority);\n req = canonicalizePolicyCapability(request);\n } catch {\n return false;\n }\n if (auth.service !== req.service || auth.space !== req.space) {\n return false;\n }\n if (!pathContains(auth.path, req.path)) {\n return false;\n }\n const authActions = new Set(auth.actions);\n for (const action of req.actions) {\n if (!authActions.has(action)) {\n return false;\n }\n }\n return caveatsContain(auth.caveats, req.caveats);\n}\n\nfunction normalizePolicyCapabilityWithOptions(\n input: unknown,\n options: NormalizeOptions,\n): PolicyCapability {\n const object = expectObject(input, \"$\");\n assertExactKeys(object, [\"service\", \"space\", \"path\", \"actions\", \"caveats\"], \"$\");\n const service = requiredString(object, \"service\", \"$\", \"policy-capability-malformed-service\");\n if (!CEILING_SERVICES.has(service)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-service\",\n \"$.service is outside the frozen permissionsCeiling vocabulary\",\n );\n }\n const space = requiredString(object, \"space\", \"$\", \"policy-capability-malformed-space\");\n validateConcreteSpace(space);\n const canonicalSpace = space.normalize(\"NFC\");\n if (options.requireCanonical && canonicalSpace !== space) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-space\",\n \"$.space must already be canonical NFC\",\n );\n }\n const rawPath = requiredString(object, \"path\", \"$\", \"policy-capability-malformed-path\");\n validateRawPath(rawPath, options);\n const path = normalizePath(rawPath);\n if (options.requireCanonical && path !== rawPath) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path must already be canonical\",\n );\n }\n validateRawPath(path, options);\n const actions = normalizeActions(\n requiredArray(object, \"actions\", \"$\", \"policy-capability-malformed-action\"),\n service,\n options,\n );\n const output = Object.create(null) as {\n service: PolicyCapability[\"service\"];\n space: string;\n path: string;\n actions: string[];\n caveats?: JsonObject;\n };\n output.service = service as PolicyCapability[\"service\"];\n output.space = canonicalSpace;\n output.path = path;\n output.actions = actions;\n if (hasOwn(object, \"caveats\")) {\n output.caveats = validateCaveats(\n requiredValue(object, \"caveats\", \"$\", \"policy-capability-malformed-caveats\"),\n output.service,\n );\n }\n return output;\n}\n\nfunction expectObject(input: unknown, path: string): JsonObject {\n try {\n const normalized = normalizeJson(input);\n if (normalized === null || typeof normalized !== \"object\" || Array.isArray(normalized)) {\n throw new PolicyCapabilityError(\"policy-capability-malformed\", `${path} must be an object`);\n }\n return normalized as JsonObject;\n } catch (error) {\n if (error instanceof PolicyCapabilityError) {\n throw error;\n }\n throw new PolicyCapabilityError(\n \"policy-capability-malformed\",\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new PolicyCapabilityError(\n key === \"id\" || key === \"scope\" ? \"policy-capability-malformed\" : \"policy-capability-unknown-key\",\n `${path} has unknown field ${key}`,\n );\n }\n }\n}\n\nfunction requiredValue(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyCapabilityErrorCode,\n): JsonValue {\n if (!hasOwn(object, key)) {\n throw new PolicyCapabilityError(code, `${path}.${key} is required`);\n }\n return object[key];\n}\n\nfunction requiredString(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyCapabilityErrorCode,\n): string {\n const value = requiredValue(object, key, path, code);\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyCapabilityError(code, `${path}.${key} must be a non-empty string`);\n }\n return value;\n}\n\nfunction requiredArray(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyCapabilityErrorCode,\n): readonly JsonValue[] {\n const value = requiredValue(object, key, path, code);\n if (!Array.isArray(value)) {\n throw new PolicyCapabilityError(code, `${path}.${key} must be an array`);\n }\n return value;\n}\n\nfunction validateConcreteSpace(space: string): void {\n if (space === \"*\" || space.includes(\"*\") || space.includes(\"?\") || space.includes(\"/\")) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-space\",\n \"$.space must be concrete\",\n );\n }\n}\n\nfunction validateRawPath(path: string, options: NormalizeOptions): void {\n if (path.length === 0) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is empty\");\n }\n if (!options.allowPrefixPaths && path.endsWith(\"/\")) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path must be an exact concrete path, not a prefix\",\n );\n }\n if (path.endsWith(\"/*\") || path.includes(\"**\")) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is a prefix form\");\n }\n const segments = path.split(\"/\");\n for (let index = 0; index < segments.length; index++) {\n const segment = segments[index]!;\n const isTrailingPrefixSegment =\n options.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;\n if (segment.length === 0 && !isTrailingPrefixSegment) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path has an empty segment\");\n }\n if (segment === \".\" || segment === \"..\") {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path has a traversal segment\",\n );\n }\n if (segment === \"*\" || segment === \"?\" || segment.includes(\"*\") || segment.includes(\"?\")) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path has a wildcard segment\",\n );\n }\n }\n}\n\nfunction normalizePath(path: string): string {\n return decodeUnreserved(path).normalize(\"NFC\");\n}\n\nfunction decodeUnreserved(path: string): string {\n return path.replace(/%[0-9A-Fa-f]{2}/g, (encoded) => {\n const char = String.fromCharCode(Number.parseInt(encoded.slice(1), 16));\n return /^[A-Za-z0-9._~-]$/.test(char) ? char : encoded.toUpperCase();\n });\n}\n\nfunction normalizeActions(\n actions: readonly JsonValue[],\n service: string,\n options: NormalizeOptions,\n): string[] {\n const accepted = GRANTABLE_ACTIONS.get(service);\n if (accepted === undefined) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-service\",\n \"$.service is unsupported\",\n );\n }\n const unique = new Set<string>();\n const rawActions: string[] = [];\n for (let index = 0; index < actions.length; index++) {\n const action = actions[index];\n if (typeof action !== \"string\" || action.length === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-action\",\n `$.actions[${index}] must be a non-empty action URN`,\n );\n }\n if (!action.startsWith(`${service}/`) || action.includes(\"*\") || !accepted.has(action)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-action\",\n `$.actions[${index}] is not a grantable action URN`,\n );\n }\n rawActions.push(action);\n unique.add(action);\n }\n if (unique.size === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-empty-actions\",\n \"$.actions must not be empty\",\n );\n }\n const normalizedActions = [...unique].sort();\n if (\n options.requireCanonical &&\n (rawActions.length !== normalizedActions.length ||\n rawActions.some((action, index) => action !== normalizedActions[index]))\n ) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-action\",\n \"$.actions must already be sorted, deduplicated canonical action URNs\",\n );\n }\n return normalizedActions;\n}\n\nfunction validateCaveats(input: JsonValue, service: PolicyCapability[\"service\"]): JsonObject {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats must be an object\",\n );\n }\n if (service === \"tinycloud.sql\") {\n return validateSqlCaveats(input as JsonObject);\n }\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats are not defined for this service\",\n );\n}\n\nfunction validateSqlCaveats(input: JsonObject): JsonObject {\n assertCaveatKeys(input, [\"mode\", \"readOnly\", \"statements\"], \"$.caveats\");\n const mode = caveatString(input, \"mode\", \"$.caveats\");\n if (mode !== \"constrained-statements\") {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats.mode is unsupported\",\n );\n }\n if (requiredCaveat(input, \"readOnly\", \"$.caveats\") !== true) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats.readOnly must be true\",\n );\n }\n const statements = requiredCaveat(input, \"statements\", \"$.caveats\");\n if (!Array.isArray(statements) || statements.length === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats.statements must be a non-empty array\",\n );\n }\n for (let index = 0; index < statements.length; index++) {\n validateSqlStatement(statements[index], `$.caveats.statements[${index}]`);\n }\n return input;\n}\n\nfunction validateSqlStatement(input: JsonValue, path: string): void {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n }\n const object = input as JsonObject;\n assertCaveatKeys(object, [\"name\", \"sql\", \"fixedParams\"], path);\n caveatString(object, \"name\", path);\n caveatString(object, \"sql\", path);\n const fixedParams = requiredCaveat(object, \"fixedParams\", path);\n if (!Array.isArray(fixedParams)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.fixedParams must be an array`,\n );\n }\n for (let index = 0; index < fixedParams.length; index++) {\n validateFixedParam(fixedParams[index], `${path}.fixedParams[${index}]`);\n }\n}\n\nfunction validateFixedParam(input: JsonValue, path: string): void {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n }\n const object = input as JsonObject;\n assertCaveatKeys(object, [\"index\", \"value\"], path);\n const index = requiredCaveat(object, \"index\", path);\n if (typeof index !== \"number\" || !Number.isSafeInteger(index) || index < 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.index must be a non-negative integer`,\n );\n }\n requiredCaveat(object, \"value\", path);\n}\n\nfunction assertCaveatKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path} has unknown field ${key}`,\n );\n }\n }\n}\n\nfunction requiredCaveat(object: JsonObject, key: string, path: string): JsonValue {\n if (!hasOwn(object, key)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.${key} is required`,\n );\n }\n return object[key];\n}\n\nfunction caveatString(object: JsonObject, key: string, path: string): string {\n const value = requiredCaveat(object, key, path);\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.${key} must be a non-empty string`,\n );\n }\n return value;\n}\n\nfunction pathContains(authority: string, request: string): boolean {\n if (authority === request) {\n return true;\n }\n return authority.endsWith(\"/\") && request.startsWith(authority);\n}\n\nfunction caveatsContain(authority: JsonObject | undefined, request: JsonObject | undefined): boolean {\n if (authority === undefined) {\n return request === undefined;\n }\n if (request === undefined) {\n return Object.keys(authority).length === 0;\n }\n if (authority.mode !== \"constrained-statements\" || request.mode !== \"constrained-statements\") {\n return false;\n }\n const authorityStatements = Array.isArray(authority.statements) ? authority.statements : [];\n const requestStatements = Array.isArray(request.statements) ? request.statements : [];\n return requestStatements.every((statement) =>\n authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement)),\n );\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n return objectHasOwn(object, key);\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n SignatureMaterialError,\n SignatureVerificationError,\n SignedObjectDigestError,\n SignedObjectIdError,\n SignedObjectProfileError,\n SignedObjectSchemaError,\n SigningKeyBindingError,\n UnsupportedSignatureSuiteError,\n toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n | typeof ED25519_JCS_SIGNATURE_SUITE\n | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n suite: SignatureSuite;\n signerDid: string;\n value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n readonly schema: typeof POLICY_SCHEMA;\n readonly policyId: string;\n readonly ownerDid: string;\n readonly signingKeyDid: string;\n readonly createdAt: string;\n readonly expiresAt?: string;\n readonly resource: JsonObject;\n readonly when: JsonObject;\n readonly grant: JsonObject;\n readonly disclosure?: JsonObject;\n readonly audit?: JsonObject;\n readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n readonly schema: typeof POLICY_STATUS_SCHEMA;\n readonly statusId: string;\n readonly policyId: string;\n readonly ownerDid: string;\n readonly sequence: number;\n readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n readonly effectiveAt: string;\n readonly reasonCode?: string;\n readonly signingKeyDid: string;\n readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n readonly engineRecordId: string;\n readonly ownerDid: string;\n readonly endpoint: string;\n readonly audience: string;\n readonly supportedPolicyVersions: string[];\n readonly supportedEvidenceVerifiers: string[];\n readonly grantIssuerDid: string;\n readonly expiresAt: string;\n readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n PolicyEngineRecord,\n \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n | Policy\n | PolicyStatus\n | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n | UnsignedPolicy\n | UnsignedPolicyStatus\n | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n readonly suite: SignatureSuite;\n readonly signerDid: string;\n signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n readonly kind: SignedObjectKind;\n readonly idField: string;\n readonly id: string;\n readonly domain: string;\n readonly unsigned: JsonObject;\n readonly jcs: string;\n readonly jcsBytes: Uint8Array;\n readonly digest: Uint8Array;\n readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n readonly kind: SignedObjectKind;\n readonly schema: string;\n readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n readonly idPrefix: string;\n readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n Policy: {\n kind: \"Policy\",\n schema: POLICY_SCHEMA,\n idField: \"policyId\",\n idPrefix: \"pol_\",\n domain: POLICY_SCHEMA,\n },\n PolicyStatus: {\n kind: \"PolicyStatus\",\n schema: POLICY_STATUS_SCHEMA,\n idField: \"statusId\",\n idPrefix: \"polst_\",\n domain: POLICY_STATUS_SCHEMA,\n },\n PolicyEngineRecord: {\n kind: \"PolicyEngineRecord\",\n schema: POLICY_ENGINE_RECORD_SCHEMA,\n idField: \"engineRecordId\",\n idPrefix: \"peng_\",\n domain: POLICY_ENGINE_RECORD_SCHEMA,\n },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n const descriptor = descriptorForUnsigned(input);\n const unsigned = validateUnsignedForDescriptor(input, descriptor);\n return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n const normalized = expectJsonObject(normalizeJson(input), \"$\");\n const descriptor = descriptorForUnsigned(normalized);\n const stripped = stripOwnIdAndSignature(normalized, descriptor);\n const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n if (descriptor.kind === \"Policy\") {\n validatePolicyPermissionsCeilingForSigning(unsigned);\n }\n assertSupportedSignatureSuite(signer.suite);\n requireStringType(signer.signerDid, \"$.signer.signerDid\");\n assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n const material = materialForUnsigned(unsigned, descriptor);\n const signatureValue = encodeSignatureValue(\n await signer.signDigest(material.digest),\n signer.suite,\n );\n const signature = validateSignature({\n suite: signer.suite,\n signerDid: signer.signerDid,\n value: signatureValue,\n });\n return {\n ...unsigned,\n [descriptor.idField]: material.id,\n signature,\n } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<Policy> {\n return createAndSignSignedObject(input, signer).then((object) =>\n validatePolicySignedShape(object),\n );\n}\n\nexport function createAndSignPolicyStatus(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n return createAndSignSignedObject(input, signer).then((object) =>\n validatePolicyStatusSignedShape(object),\n );\n}\n\nexport function createAndSignPolicyEngineRecord(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n return createAndSignSignedObject(input, signer).then((object) =>\n validatePolicyEngineRecordSignedShape(object),\n );\n}\n\nexport async function verifySignedObject(\n input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n const signed = validateSignedObjectShape(input);\n const signedJson = signed as unknown as JsonObject;\n const descriptor = descriptorForSchema(signed.schema);\n const signature = validateSignature(signed.signature);\n assertSigningKeyBindingForVerify(signedJson, signature);\n const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n const material = materialForUnsigned(unsigned, descriptor);\n assertIdMatches(signedJson, material, descriptor);\n if (!(await verifySignature(signature, material.digest))) {\n throw new SignatureVerificationError(\"signature verification failed\");\n }\n return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n const result = await verifySignedObject(input);\n return {\n object: validatePolicySignedShape(result.object),\n material: result.material,\n };\n}\n\nexport async function verifyPolicyStatus(\n input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n const result = await verifySignedObject(input);\n return {\n object: validatePolicyStatusSignedShape(result.object),\n material: result.material,\n };\n}\n\nexport async function verifyPolicyEngineRecord(\n input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n const result = await verifySignedObject(input);\n return {\n object: validatePolicyEngineRecordSignedShape(result.object),\n material: result.material,\n };\n}\n\nexport async function validatePolicySigned(\n input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n try {\n const result = await verifyPolicy(input);\n return { ok: true, object: result.object, material: result.material };\n } catch (error) {\n return { ok: false, error: toSignedObjectError(error) };\n }\n}\n\nexport async function validatePolicyStatusSigned(\n input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n try {\n const result = await verifyPolicyStatus(input);\n return { ok: true, object: result.object, material: result.material };\n } catch (error) {\n return { ok: false, error: toSignedObjectError(error) };\n }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n try {\n const result = await verifyPolicyEngineRecord(input);\n return { ok: true, object: result.object, material: result.material };\n } catch (error) {\n return { ok: false, error: toSignedObjectError(error) };\n }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n input: unknown,\n): UnsignedPolicyEngineRecord {\n return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n input: unknown,\n): PolicyEngineRecord {\n return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n const normalized = expectJsonObject(normalizeJson(input), \"$\");\n const schema = requiredString(normalized, \"schema\", \"$\");\n const descriptor = descriptorForSchema(schema);\n switch (descriptor.kind) {\n case \"Policy\":\n return validatePolicySignedShape(normalized);\n case \"PolicyStatus\":\n return validatePolicyStatusSignedShape(normalized);\n case \"PolicyEngineRecord\":\n return validatePolicyEngineRecordSignedShape(normalized);\n }\n}\n\nfunction validateUnsignedForDescriptor(\n input: unknown,\n descriptor: ObjectDescriptor,\n): JsonObject {\n switch (descriptor.kind) {\n case \"Policy\":\n return validatePolicyUnsigned(input) as unknown as JsonObject;\n case \"PolicyStatus\":\n return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n case \"PolicyEngineRecord\":\n return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n assertExactKeys(\n object,\n signed\n ? [\n \"schema\",\n \"policyId\",\n \"ownerDid\",\n \"signingKeyDid\",\n \"createdAt\",\n \"expiresAt\",\n \"resource\",\n \"when\",\n \"grant\",\n \"disclosure\",\n \"audit\",\n \"signature\",\n ]\n : [\n \"schema\",\n \"ownerDid\",\n \"signingKeyDid\",\n \"createdAt\",\n \"expiresAt\",\n \"resource\",\n \"when\",\n \"grant\",\n \"disclosure\",\n \"audit\",\n ],\n \"$\",\n );\n expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n if (signed) {\n requiredString(object, \"policyId\", \"$\");\n validateSignature(requiredValue(object, \"signature\", \"$\"));\n }\n requiredString(object, \"ownerDid\", \"$\");\n requiredString(object, \"signingKeyDid\", \"$\");\n requiredDateString(object, \"createdAt\", \"$\");\n optionalDateString(object, \"expiresAt\", \"$\");\n validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n if (hasOwn(object, \"disclosure\")) {\n validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n }\n if (hasOwn(object, \"audit\")) {\n validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n }\n return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n assertExactKeys(\n object,\n signed\n ? [\n \"schema\",\n \"statusId\",\n \"policyId\",\n \"ownerDid\",\n \"sequence\",\n \"disposition\",\n \"effectiveAt\",\n \"reasonCode\",\n \"signingKeyDid\",\n \"signature\",\n ]\n : [\n \"schema\",\n \"policyId\",\n \"ownerDid\",\n \"sequence\",\n \"disposition\",\n \"effectiveAt\",\n \"reasonCode\",\n \"signingKeyDid\",\n ],\n \"$\",\n );\n expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n if (signed) {\n requiredString(object, \"statusId\", \"$\");\n validateSignature(requiredValue(object, \"signature\", \"$\"));\n }\n requiredString(object, \"policyId\", \"$\");\n requiredString(object, \"ownerDid\", \"$\");\n requiredInteger(object, \"sequence\", \"$\", 0);\n expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n \"active\",\n \"suspended\",\n \"revoked\",\n ], \"$.disposition\");\n requiredDateString(object, \"effectiveAt\", \"$\");\n optionalString(object, \"reasonCode\", \"$\");\n requiredString(object, \"signingKeyDid\", \"$\");\n return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n input: unknown,\n signed: boolean,\n): JsonObject {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n assertExactKeys(\n object,\n signed\n ? [\n \"schema\",\n \"engineRecordId\",\n \"ownerDid\",\n \"endpoint\",\n \"audience\",\n \"supportedPolicyVersions\",\n \"supportedEvidenceVerifiers\",\n \"grantIssuerDid\",\n \"expiresAt\",\n \"signature\",\n ]\n : [\n \"schema\",\n \"ownerDid\",\n \"endpoint\",\n \"audience\",\n \"supportedPolicyVersions\",\n \"supportedEvidenceVerifiers\",\n \"grantIssuerDid\",\n \"expiresAt\",\n ],\n \"$\",\n );\n expectConst(\n requiredString(object, \"schema\", \"$\"),\n POLICY_ENGINE_RECORD_SCHEMA,\n \"$.schema\",\n );\n if (signed) {\n requiredString(object, \"engineRecordId\", \"$\");\n validateSignature(requiredValue(object, \"signature\", \"$\"));\n }\n requiredString(object, \"ownerDid\", \"$\");\n requiredString(object, \"endpoint\", \"$\");\n requiredString(object, \"audience\", \"$\");\n requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n expectConst(value, \"v0\", path),\n );\n requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n requiredString(object, \"grantIssuerDid\", \"$\");\n requiredDateString(object, \"expiresAt\", \"$\");\n return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n const object = expectJsonObject(input, \"$.signature\");\n assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n const suite = requiredString(object, \"suite\", \"$.signature\");\n assertSupportedSignatureSuite(suite);\n const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n const value = requiredString(object, \"value\", \"$.signature\");\n decodeSignatureValue(value, suite);\n return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n requiredString(object, \"resourceType\", path);\n requiredString(object, \"resourceId\", path);\n const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n for (let index = 0; index < ceiling.length; index++) {\n validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n for (let index = 0; index < ceiling.length; index++) {\n validatePolicyCapabilityForSigning(\n ceiling[index],\n `$.resource.permissionsCeiling[${index}]`,\n );\n }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n try {\n const canonical = canonicalizePolicyCapability(object);\n if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n }\n } catch (error) {\n if (error instanceof SignedObjectSchemaError) {\n throw error;\n }\n throw new SignedObjectSchemaError(\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n try {\n const canonical = normalizePolicyCapability(object);\n if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n }\n } catch (error) {\n if (error instanceof SignedObjectSchemaError) {\n throw error;\n }\n throw new SignedObjectSchemaError(\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n const keys = Object.keys(object);\n if (keys.length !== 1) {\n throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n }\n const key = keys[0];\n if (key === \"allOf\" || key === \"anyOf\") {\n const values = requiredArray(object, key, path, 1);\n for (let index = 0; index < values.length; index++) {\n validateExpression(values[index], `${path}.${key}[${index}]`);\n }\n return;\n }\n if (key === \"subject\") {\n const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n assertExactKeys(subject, [\"did\"], `${path}.subject`);\n requiredString(subject, \"did\", `${path}.subject`);\n return;\n }\n if (key === \"evidence\") {\n validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n return;\n }\n throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(\n object,\n [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n path,\n );\n requiredString(object, \"requirementId\", path);\n requiredString(object, \"verifier\", path);\n requiredValue(object, \"requirements\", path);\n if (hasOwn(object, \"authority\")) {\n const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n assertExactKeys(\n authority,\n [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n `${path}.authority`,\n );\n optionalString(authority, \"profile\", `${path}.authority`);\n if (hasOwn(authority, \"acceptedIssuers\")) {\n requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n }\n optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n }\n if (hasOwn(object, \"freshness\")) {\n const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n requiredInteger(object, \"maxTtlSeconds\", path, 1);\n expectOneOf(requiredString(object, \"delegationMode\", path), [\n \"terminal\",\n \"attenuable\",\n ], `${path}.delegationMode`);\n expectOneOf(requiredString(object, \"revocation\", path), [\n \"refresh_only\",\n \"active_cutoff\",\n ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"denial\"], path);\n expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"issuance\"], path);\n expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n unsigned: JsonObject,\n descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n const jcs = jcsCanonicalize(unsigned);\n const jcsBytes = textEncoder.encode(jcs);\n const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n return {\n kind: descriptor.kind,\n idField: descriptor.idField,\n id,\n domain: descriptor.domain,\n unsigned,\n jcs,\n jcsBytes,\n digest,\n digestHex: bytesToHex(digest).slice(2),\n };\n}\n\nfunction assertIdMatches(\n signed: JsonObject,\n material: SignedObjectMaterial,\n descriptor: ObjectDescriptor,\n): void {\n const actual = requiredString(signed, descriptor.idField, \"$\");\n if (actual === material.id) {\n return;\n }\n if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n throw new SignedObjectDigestError(\n `${descriptor.idField} was not derived from the signed object digest`,\n );\n }\n throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n unsigned: JsonObject,\n signerDid: string,\n): void {\n if (!hasOwn(unsigned, \"signingKeyDid\")) {\n return;\n }\n const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n if (signingKeyDid !== signerDid) {\n throw new SigningKeyBindingError(\n `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n );\n }\n}\n\nfunction assertSigningKeyBindingForVerify(\n signed: JsonObject,\n signature: SignedObjectSignature,\n): void {\n if (!hasOwn(signed, \"signingKeyDid\")) {\n return;\n }\n const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n if (signature.signerDid !== signingKeyDid) {\n throw new SigningKeyBindingError(\n `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n );\n }\n}\n\nfunction assertSignerDidMatchesSuite(\n signerDid: string,\n suite: SignatureSuite,\n): void {\n if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n ed25519PublicKeyFromDidKey(signerDid);\n return;\n }\n if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n parseDidPkh(signerDid);\n return;\n }\n throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n signature: SignedObjectSignature,\n digest: Uint8Array,\n): Promise<boolean> {\n if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n try {\n return ed25519.verify(signatureBytes, digest, publicKey);\n } catch {\n throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n }\n }\n\n if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n const pkh = parseDidPkh(signature.signerDid);\n const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n try {\n return verifyMessage({\n address: pkh.address,\n message: { raw: digest },\n signature: bytesToHex(signatureBytes),\n });\n } catch {\n throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n }\n }\n\n throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n if (!did.startsWith(\"did:key:\")) {\n throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n }\n const identifier = did.slice(\"did:key:\".length);\n if (!identifier.startsWith(\"z\")) {\n throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n }\n let bytes: Uint8Array;\n try {\n bytes = bases.base58btc.decode(identifier);\n } catch {\n throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n }\n if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n return bytes.slice(2);\n }\n throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n let parsed: ReturnType<typeof parsePkhDid>;\n try {\n parsed = parsePkhDid(did);\n } catch {\n throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n }\n if (!parsed) {\n throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n }\n return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n }\n const bytes = base64UrlDecode(value);\n if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n }\n if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n if (bytes.length !== 65) {\n throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n }\n const v = bytes[64];\n if (v !== 27 && v !== 28) {\n throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n }\n }\n return bytes;\n}\n\nfunction encodeSignatureValue(\n value: Uint8Array | string,\n suite: SignatureSuite,\n): string {\n if (typeof value === \"string\") {\n const encoded = value.startsWith(\"0x\")\n ? base64UrlEncode(hexToBytes(value))\n : value;\n decodeSignatureValue(encoded, suite);\n return encoded;\n }\n const encoded = base64UrlEncode(value);\n decodeSignatureValue(encoded, suite);\n return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n object: JsonObject,\n descriptor: ObjectDescriptor,\n): JsonObject {\n const output = Object.create(null) as { [key: string]: JsonValue };\n for (const [key, value] of Object.entries(object)) {\n if (key === descriptor.idField || key === \"signature\") {\n continue;\n }\n output[key] = value;\n }\n return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new SignedObjectSchemaError(`${path} must be an object`);\n }\n return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n }\n }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n if (!hasOwn(object, key)) {\n throw new SignedObjectSchemaError(`${path}.${key} is required`);\n }\n return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n if (!hasOwn(object, key)) {\n return;\n }\n requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n if (typeof value !== \"string\" || value.length === 0) {\n throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n }\n return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n if (!hasOwn(object, key)) {\n return;\n }\n if (typeof requiredValue(object, key, path) !== \"boolean\") {\n throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n }\n}\n\nfunction requiredInteger(\n object: JsonObject,\n key: string,\n path: string,\n minimum: number,\n): number {\n const value = requiredValue(object, key, path);\n if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n throw new SignedObjectSchemaError(\n `${path}.${key} must be an integer >= ${minimum}`,\n );\n }\n return value;\n}\n\nfunction requiredArray(\n object: JsonObject,\n key: string,\n path: string,\n minimum: number,\n): readonly JsonValue[] {\n const value = requiredValue(object, key, path);\n if (!Array.isArray(value) || value.length < minimum) {\n throw new SignedObjectSchemaError(\n `${path}.${key} must be an array with at least ${minimum} item(s)`,\n );\n }\n return value;\n}\n\nfunction requiredStringArray(\n object: JsonObject,\n key: string,\n path: string,\n check?: (value: string, path: string) => void,\n): void {\n const values = requiredArray(object, key, path, 0);\n for (let index = 0; index < values.length; index++) {\n const itemPath = `${path}.${key}[${index}]`;\n const value = requireStringType(values[index], itemPath);\n check?.(value, itemPath);\n }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n if (!hasOwn(object, key)) {\n return;\n }\n assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n const match = value.match(\n /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n );\n if (!match) {\n throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n }\n const parsed = Date.parse(value);\n if (Number.isNaN(parsed)) {\n throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n }\n const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n if (canonical !== value) {\n throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n if (actual !== expected) {\n throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n }\n return expected;\n}\n\nfunction expectOneOf<T extends string>(\n actual: string,\n allowed: readonly T[],\n path: string,\n): T {\n for (const value of allowed) {\n if (actual === value) {\n return value;\n }\n }\n throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n const output = new Uint8Array(left.length + right.length);\n output.set(left, 0);\n output.set(right, left.length);\n return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n let output = \"\";\n let buffer = 0;\n let bits = 0;\n for (const byte of bytes) {\n buffer = (buffer << 8) | byte;\n bits += 8;\n while (bits >= 5) {\n bits -= 5;\n output += BASE32_ALPHABET[(buffer >> bits) & 31];\n }\n }\n if (bits > 0) {\n output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n }\n return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n let output = \"\";\n for (let index = 0; index < bytes.length; index += 3) {\n const a = bytes[index];\n const b = bytes[index + 1];\n const c = bytes[index + 2];\n const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n output += alphabet[(triplet >> 18) & 63];\n output += alphabet[(triplet >> 12) & 63];\n if (index + 1 < bytes.length) {\n output += alphabet[(triplet >> 6) & 63];\n }\n if (index + 2 < bytes.length) {\n output += alphabet[triplet & 63];\n }\n }\n return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n if (value.length % 4 === 1) {\n throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n }\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n const bytes: number[] = [];\n let buffer = 0;\n let bits = 0;\n for (const char of value) {\n const index = alphabet.indexOf(char);\n if (index < 0) {\n throw new SignatureMaterialError(\"signature value is not base64url\");\n }\n buffer = (buffer << 6) | index;\n bits += 6;\n if (bits >= 8) {\n bits -= 8;\n bytes.push((buffer >> bits) & 0xff);\n }\n }\n const decoded = Uint8Array.from(bytes);\n if (base64UrlEncode(decoded) !== value) {\n throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n }\n return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n const hex = value.slice(2);\n if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n throw new SignatureMaterialError(\"hex signature must have even length\");\n }\n const output = new Uint8Array(hex.length / 2);\n for (let index = 0; index < output.length; index++) {\n output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n }\n return output;\n}\n","import { baseX } from './base.js'\n\nexport const base10 = baseX({\n prefix: '9',\n name: 'base10',\n alphabet: '0123456789'\n})\n","import { rfc4648 } from './base.js'\n\nexport const base16 = rfc4648({\n prefix: 'f',\n name: 'base16',\n alphabet: '0123456789abcdef',\n bitsPerChar: 4\n})\n\nexport const base16upper = rfc4648({\n prefix: 'F',\n name: 'base16upper',\n alphabet: '0123456789ABCDEF',\n bitsPerChar: 4\n})\n","import { rfc4648 } from './base.js'\n\nexport const base2 = rfc4648({\n prefix: '0',\n name: 'base2',\n alphabet: '01',\n bitsPerChar: 1\n})\n","import { from } from './base.js'\n\nconst alphabet = Array.from('🚀🪐☄🛰🌌🌑🌒🌓🌔🌕🌖🌗🌘🌍🌏🌎🐉☀💻🖥💾💿😂❤😍🤣😊🙏💕😭😘👍😅👏😁🔥🥰💔💖💙😢🤔😆🙄💪😉☺👌🤗💜😔😎😇🌹🤦🎉💞✌✨🤷😱😌🌸🙌😋💗💚😏💛🙂💓🤩😄😀🖤😃💯🙈👇🎶😒🤭❣😜💋👀😪😑💥🙋😞😩😡🤪👊🥳😥🤤👉💃😳✋😚😝😴🌟😬🙃🍀🌷😻😓⭐✅🥺🌈😈🤘💦✔😣🏃💐☹🎊💘😠☝😕🌺🎂🌻😐🖕💝🙊😹🗣💫💀👑🎵🤞😛🔴😤🌼😫⚽🤙☕🏆🤫👈😮🙆🍻🍃🐶💁😲🌿🧡🎁⚡🌞🎈❌✊👋😰🤨😶🤝🚶💰🍓💢🤟🙁🚨💨🤬✈🎀🍺🤓😙💟🌱😖👶🥴▶➡❓💎💸⬇😨🌚🦋😷🕺⚠🙅😟😵👎🤲🤠🤧📌🔵💅🧐🐾🍒😗🤑🌊🤯🐷☎💧😯💆👆🎤🙇🍑❄🌴💣🐸💌📍🥀🤢👅💡💩👐📸👻🤐🤮🎼🥵🚩🍎🍊👼💍📣🥂')\nconst alphabetBytesToChars: string[] = (alphabet.reduce<string[]>((p, c, i) => { p[i] = c; return p }, ([])))\nconst alphabetCharsToBytes: number[] = (alphabet.reduce<number[]>((p, c, i) => {\n const codePoint = c.codePointAt(0)\n if (codePoint == null) {\n throw new Error(`Invalid character: ${c}`)\n }\n p[codePoint] = i\n return p\n}, ([])))\n\nfunction encode (data: Uint8Array): string {\n return data.reduce((p, c) => {\n p += alphabetBytesToChars[c]\n return p\n }, '')\n}\n\nfunction decode (str: string): Uint8Array {\n const byts = []\n for (const char of str) {\n const codePoint = char.codePointAt(0)\n if (codePoint == null) {\n throw new Error(`Invalid character: ${char}`)\n }\n const byt = alphabetCharsToBytes[codePoint]\n if (byt == null) {\n throw new Error(`Non-base256emoji character: ${char}`)\n }\n byts.push(byt)\n }\n return new Uint8Array(byts)\n}\n\nexport const base256emoji = from({\n prefix: '🚀',\n name: 'base256emoji',\n encode,\n decode\n})\n","import { rfc4648 } from './base.js'\n\nexport const base64 = rfc4648({\n prefix: 'm',\n name: 'base64',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',\n bitsPerChar: 6\n})\n\nexport const base64pad = rfc4648({\n prefix: 'M',\n name: 'base64pad',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',\n bitsPerChar: 6\n})\n\nexport const base64url = rfc4648({\n prefix: 'u',\n name: 'base64url',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',\n bitsPerChar: 6\n})\n\nexport const base64urlpad = rfc4648({\n prefix: 'U',\n name: 'base64urlpad',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=',\n bitsPerChar: 6\n})\n","import { rfc4648 } from './base.js'\n\nexport const base8 = rfc4648({\n prefix: '7',\n name: 'base8',\n alphabet: '01234567',\n bitsPerChar: 3\n})\n","import { fromString, toString } from '../bytes.js'\nimport { from } from './base.js'\n\nexport const identity = from({\n prefix: '\\x00',\n name: 'identity',\n encode: (buf) => toString(buf),\n decode: (str) => fromString(str)\n})\n","import type { ArrayBufferView, ByteView } from './interface.js'\n\nconst textEncoder = new TextEncoder()\nconst textDecoder = new TextDecoder()\n\nexport const name = 'json'\nexport const code = 0x0200\n\nexport function encode <T> (node: T): ByteView<T> {\n return textEncoder.encode(JSON.stringify(node))\n}\n\nexport function decode <T> (data: ByteView<T> | ArrayBufferView<T>): T {\n return JSON.parse(textDecoder.decode(data))\n}\n","import { coerce } from '../bytes.js'\nimport * as Digest from './digest.js'\nimport type { DigestOptions } from './hasher.js'\n\nconst code: 0x0 = 0x0\nconst name = 'identity'\n\nconst encode: (input: Uint8Array) => Uint8Array = coerce\n\nfunction digest (input: Uint8Array, options?: DigestOptions): Digest.Digest<typeof code, number> {\n if (options?.truncate != null && options.truncate !== input.byteLength) {\n if (options.truncate < 0 || options.truncate > input.byteLength) {\n throw new Error(`Invalid truncate option, must be less than or equal to ${input.byteLength}`)\n }\n\n input = input.subarray(0, options.truncate)\n }\n\n return Digest.create(code, encode(input))\n}\n\nexport const identity = { code, name, encode, digest }\n","import crypto from 'crypto'\nimport { coerce } from '../bytes.js'\nimport { from } from './hasher.js'\n\nexport const sha256 = from({\n name: 'sha2-256',\n code: 0x12,\n encode: (input) => coerce(crypto.createHash('sha256').update(input).digest())\n})\n\nexport const sha512 = from({\n name: 'sha2-512',\n code: 0x13,\n encode: input => coerce(crypto.createHash('sha512').update(input).digest())\n})\n","import * as Digest from './digest.js'\nimport type { MultihashHasher } from './interface.js'\n\ntype Await<T> = Promise<T> | T\n\nconst DEFAULT_MIN_DIGEST_LENGTH = 20\n\nexport interface HasherInit <Name extends string, Code extends number> {\n name: Name\n code: Code\n encode(input: Uint8Array): Await<Uint8Array>\n\n /**\n * The minimum length a hash is allowed to be truncated to in bytes\n *\n * @default 20\n */\n minDigestLength?: number\n\n /**\n * The maximum length a hash is allowed to be truncated to in bytes. If not\n * specified it will be inferred from the length of the digest.\n */\n maxDigestLength?: number\n}\n\nexport function from <Name extends string, Code extends number> ({ name, code, encode, minDigestLength, maxDigestLength }: HasherInit<Name, Code>): Hasher<Name, Code> {\n return new Hasher(name, code, encode, minDigestLength, maxDigestLength)\n}\n\nexport interface DigestOptions {\n /**\n * Truncate the returned digest to this number of bytes.\n *\n * This may cause the digest method to throw/reject if the passed value is\n * greater than the digest length or below a threshold under which the risk of\n * hash collisions is significant.\n *\n * The actual value of this threshold can depend on the hashing algorithm in\n * use.\n */\n truncate?: number\n}\n\n/**\n * Hasher represents a hashing algorithm implementation that produces as\n * `MultihashDigest`.\n */\nexport class Hasher<Name extends string, Code extends number> implements MultihashHasher<Code> {\n readonly name: Name\n readonly code: Code\n readonly encode: (input: Uint8Array) => Await<Uint8Array>\n readonly minDigestLength: number\n readonly maxDigestLength?: number\n\n constructor (name: Name, code: Code, encode: (input: Uint8Array) => Await<Uint8Array>, minDigestLength?: number, maxDigestLength?: number) {\n this.name = name\n this.code = code\n this.encode = encode\n this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH\n this.maxDigestLength = maxDigestLength\n }\n\n digest (input: Uint8Array, options?: DigestOptions): Await<Digest.Digest<Code, number>> {\n if (options?.truncate != null) {\n if (options.truncate < this.minDigestLength) {\n throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`)\n }\n\n if (this.maxDigestLength != null && options.truncate > this.maxDigestLength) {\n throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`)\n }\n }\n\n if (input instanceof Uint8Array) {\n const result = this.encode(input)\n\n if (result instanceof Uint8Array) {\n return createDigest(result, this.code, options?.truncate)\n }\n\n return result.then(digest => createDigest(digest, this.code, options?.truncate))\n } else {\n throw Error('Unknown type, must be binary type')\n /* c8 ignore next 1 */\n }\n }\n}\n\n/**\n * Create a Digest from the passed uint8array and code, optionally truncating it\n * first.\n */\nfunction createDigest <Code extends number> (digest: Uint8Array, code: Code, truncate?: number): Digest.Digest<Code, number> {\n if (truncate != null && truncate !== digest.byteLength) {\n if (truncate > digest.byteLength) {\n throw new Error(`Invalid truncate option, must be less than or equal to ${digest.byteLength}`)\n }\n\n digest = digest.subarray(0, truncate)\n }\n\n return Digest.create(code, digest)\n}\n","import * as base10 from './bases/base10.js'\nimport * as base16 from './bases/base16.js'\nimport * as base2 from './bases/base2.js'\nimport * as base256emoji from './bases/base256emoji.js'\nimport * as base32 from './bases/base32.js'\nimport * as base36 from './bases/base36.js'\nimport * as base58 from './bases/base58.js'\nimport * as base64 from './bases/base64.js'\nimport * as base8 from './bases/base8.js'\nimport * as identityBase from './bases/identity.js'\nimport * as json from './codecs/json.js'\nimport * as raw from './codecs/raw.js'\nimport * as identity from './hashes/identity.js'\nimport * as sha2 from './hashes/sha2.js'\nimport { CID, hasher, digest, varint, bytes } from './index.js'\n\nexport const bases = { ...identityBase, ...base2, ...base8, ...base10, ...base16, ...base32, ...base36, ...base58, ...base64, ...base256emoji }\nexport const hashes = { ...sha2, ...identity }\nexport const codecs = { raw, json }\n\nexport { CID, hasher, digest, varint, bytes }\n","import {\n POLICY_ENGINE_RECORD_SCHEMA,\n POLICY_SCHEMA,\n createAndSignPolicy,\n createAndSignPolicyEngineRecord,\n validatePolicyEngineRecordSignedShape,\n verifyPolicyEngineRecord,\n type Policy,\n type PolicyEngineRecord,\n type SignedObjectSigner,\n type UnsignedPolicyEngineRecord,\n} from \"./signed-object\";\nimport {\n PolicyCapabilityError,\n normalizePolicyCapability,\n type JsonObject,\n type PolicyCapability,\n} from \"./capability\";\nimport { normalizeJson, type JsonValue } from \"./jcs\";\nimport { SignedObjectProfileError, SignedObjectSchemaError } from \"./errors\";\n\nexport const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA =\n \"xyz.tinycloud.exchange/transcript-bootstrap/v0\" as const;\nexport const OWNER_NODE_ENDPOINT_SCHEMA =\n \"xyz.tinycloud.exchange/owner-node-endpoint/v1\" as const;\nexport const POLICY_VERSION_V0 = \"v0\" as const;\nexport const W3C_VC_CREDENTIAL_VERIFIER = \"w3c.vc/credential/v1\" as const;\n\nexport type PolicyAuthoringErrorCode =\n | PolicyCapabilityError[\"code\"]\n | \"policy-authoring-malformed\"\n | \"policy-authoring-unknown-key\"\n | \"policy-engine-record-absent\"\n | \"policy-engine-record-date-invalid\"\n | \"policy-engine-record-signature-invalid\"\n | \"policy-engine-record-audience-mismatch\"\n | \"policy-engine-record-expired\"\n | \"policy-engine-record-owner-mismatch\"\n | \"policy-engine-record-grant-issuer-mismatch\"\n | \"policy-engine-record-policy-version-unsupported\"\n | \"policy-engine-record-evidence-verifier-unsupported\"\n | \"transcript-share-bootstrap-malformed\";\n\nexport class PolicyAuthoringError extends Error {\n public readonly code: PolicyAuthoringErrorCode;\n\n constructor(code: PolicyAuthoringErrorCode, message: string) {\n super(message);\n this.name = \"PolicyAuthoringError\";\n this.code = code;\n }\n}\n\nexport interface CreateTranscriptSharePolicyInput {\n readonly ownerDid: string;\n readonly signingKeyDid: string;\n readonly createdAt: string;\n readonly expiresAt?: string;\n readonly resourceType: string;\n readonly resourceId: string;\n readonly permissionsCeiling: readonly unknown[];\n readonly when: JsonObject;\n readonly grant: JsonObject;\n readonly disclosure?: JsonObject;\n readonly audit?: JsonObject;\n}\n\nexport interface TranscriptShareBootstrap {\n readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;\n readonly policyId: string;\n readonly policyEngine: {\n readonly endpoint: string;\n readonly audience: string;\n readonly supportedEvidenceVerifiers: readonly [\n typeof W3C_VC_CREDENTIAL_VERIFIER,\n ];\n readonly signedRecord: PolicyEngineRecord;\n };\n /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */\n readonly ownerNode: {\n readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;\n readonly endpoint: string;\n readonly spaceId: string;\n };\n readonly resourceHint: JsonObject;\n}\n\nexport interface ComposeTranscriptShareBootstrapInput {\n readonly policyId: string;\n readonly policyEngineRecord: PolicyEngineRecord;\n readonly ownerNodeEndpoint: string;\n readonly ownerSpaceId: string;\n readonly resourceHint: JsonObject;\n}\n\nexport interface CreatePolicyEngineRecordInput {\n readonly ownerDid: string;\n readonly endpoint: string;\n readonly audience: string;\n readonly grantIssuerDid: string;\n readonly expiresAt: string;\n readonly supportedPolicyVersions?: readonly string[];\n readonly supportedEvidenceVerifiers?: readonly string[];\n}\n\nexport interface VerifyPolicyEngineRecordOptions {\n readonly signedRecord: unknown;\n readonly ownerDid: string;\n readonly audience: string;\n readonly grantIssuerDid: string;\n readonly now: string;\n readonly requiredPolicyVersion?: string;\n readonly requiredEvidenceVerifier?: string;\n}\n\n/**\n * Author a transcript-sharing Policy from already-resolved Listen-adapter\n * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the\n * SDK does not expand or invent permissions while signing authority-bearing\n * objects.\n */\nexport async function createAndSignTranscriptSharePolicy(\n input: CreateTranscriptSharePolicyInput,\n signer: SignedObjectSigner,\n): Promise<Policy> {\n const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n assertExactKeys(\n normalized,\n [\n \"ownerDid\",\n \"signingKeyDid\",\n \"createdAt\",\n \"expiresAt\",\n \"resourceType\",\n \"resourceId\",\n \"permissionsCeiling\",\n \"when\",\n \"grant\",\n \"disclosure\",\n \"audit\",\n ],\n \"$\",\n );\n const permissions = requiredArray(normalized, \"permissionsCeiling\", \"$\");\n if (permissions.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n \"$.permissionsCeiling must not be empty\",\n );\n }\n const ceiling: PolicyCapability[] = [];\n for (let index = 0; index < permissions.length; index++) {\n ceiling.push(\n wrapCapabilityError(() => normalizePolicyCapability(permissions[index])),\n );\n }\n return createAndSignPolicy(\n {\n schema: POLICY_SCHEMA,\n ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n signingKeyDid: requiredString(normalized, \"signingKeyDid\", \"$\"),\n createdAt: requiredString(normalized, \"createdAt\", \"$\"),\n ...(hasOwn(normalized, \"expiresAt\")\n ? { expiresAt: requiredString(normalized, \"expiresAt\", \"$\") }\n : {}),\n resource: {\n resourceType: requiredString(normalized, \"resourceType\", \"$\"),\n resourceId: requiredString(normalized, \"resourceId\", \"$\"),\n permissionsCeiling: ceiling,\n },\n when: requiredObject(normalized, \"when\", \"$\"),\n grant: requiredObject(normalized, \"grant\", \"$\"),\n ...(hasOwn(normalized, \"disclosure\")\n ? { disclosure: requiredObject(normalized, \"disclosure\", \"$\") }\n : {}),\n ...(hasOwn(normalized, \"audit\")\n ? { audit: requiredObject(normalized, \"audit\", \"$\") }\n : {}),\n },\n signer,\n ).catch((error) => {\n throw wrapSignedObjectError(error);\n });\n}\n\nexport function createUnsignedPolicyEngineRecord(\n input: CreatePolicyEngineRecordInput,\n): UnsignedPolicyEngineRecord {\n const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n assertExactKeys(\n normalized,\n [\n \"ownerDid\",\n \"endpoint\",\n \"audience\",\n \"grantIssuerDid\",\n \"expiresAt\",\n \"supportedPolicyVersions\",\n \"supportedEvidenceVerifiers\",\n ],\n \"$\",\n );\n const supportedPolicyVersions = hasOwn(normalized, \"supportedPolicyVersions\")\n ? requiredStringArray(normalized, \"supportedPolicyVersions\", \"$\")\n : [POLICY_VERSION_V0];\n validateSupportedPolicyVersions(\n supportedPolicyVersions,\n \"$.supportedPolicyVersions\",\n );\n const supportedEvidenceVerifiers = hasOwn(\n normalized,\n \"supportedEvidenceVerifiers\",\n )\n ? requiredStringArray(normalized, \"supportedEvidenceVerifiers\", \"$\")\n : [W3C_VC_CREDENTIAL_VERIFIER];\n validateSupportedEvidenceVerifiers(\n supportedEvidenceVerifiers,\n \"$.supportedEvidenceVerifiers\",\n );\n const expiresAt = fieldString(\n normalized,\n \"expiresAt\",\n \"$\",\n \"policy-engine-record-date-invalid\",\n );\n parseStrictRfc3339(expiresAt, \"$.expiresAt\");\n\n return {\n schema: POLICY_ENGINE_RECORD_SCHEMA,\n ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n endpoint: validatePolicyEngineEndpoint(\n requiredString(normalized, \"endpoint\", \"$\"),\n ),\n audience: requiredString(normalized, \"audience\", \"$\"),\n supportedPolicyVersions,\n supportedEvidenceVerifiers,\n grantIssuerDid: requiredString(normalized, \"grantIssuerDid\", \"$\"),\n expiresAt,\n };\n}\n\nexport async function createAndSignRequesterPolicyEngineRecord(\n input: CreatePolicyEngineRecordInput,\n signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n return createAndSignPolicyEngineRecord(\n createUnsignedPolicyEngineRecord(input),\n signer,\n ).catch((error) => {\n throw wrapSignedObjectError(error);\n });\n}\n\n/**\n * Compose the SDK-level transcript-share bootstrap record. This record is not\n * an invitation and is not authority; it only tells a requester where to ask\n * and which policy id to reference.\n */\nexport function composeTranscriptShareBootstrap(\n input: ComposeTranscriptShareBootstrapInput,\n): TranscriptShareBootstrap {\n const normalized = expectObject(\n input,\n \"$\",\n \"transcript-share-bootstrap-malformed\",\n );\n assertExactKeys(\n normalized,\n [\n \"policyId\",\n \"policyEngineRecord\",\n \"ownerNodeEndpoint\",\n \"ownerSpaceId\",\n \"resourceHint\",\n ],\n \"$\",\n );\n const signedRecord = expectPolicyEngineRecord(\n requiredValue(normalized, \"policyEngineRecord\", \"$\"),\n );\n if (\n !signedRecord.supportedEvidenceVerifiers.includes(\n W3C_VC_CREDENTIAL_VERIFIER,\n )\n ) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"policy engine record does not support the bootstrap evidence verifier\",\n );\n }\n return {\n schema: TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n policyId: requiredString(normalized, \"policyId\", \"$\"),\n policyEngine: {\n endpoint: signedRecord.endpoint,\n audience: signedRecord.audience,\n supportedEvidenceVerifiers: [W3C_VC_CREDENTIAL_VERIFIER],\n signedRecord,\n },\n ownerNode: {\n schema: OWNER_NODE_ENDPOINT_SCHEMA,\n endpoint: validateOwnerNodeEndpoint(\n requiredString(normalized, \"ownerNodeEndpoint\", \"$\"),\n ),\n spaceId: requiredString(normalized, \"ownerSpaceId\", \"$\"),\n },\n resourceHint: requiredObject(normalized, \"resourceHint\", \"$\"),\n };\n}\n\nfunction validateOwnerNodeEndpoint(value: string): string {\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"$.ownerNodeEndpoint must be a URL\",\n );\n }\n if (\n url.protocol !== \"https:\" ||\n url.username !== \"\" ||\n url.password !== \"\" ||\n url.hash !== \"\" ||\n url.search !== \"\"\n ) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"$.ownerNodeEndpoint must be an HTTPS URL without credentials, query, or fragment\",\n );\n }\n return url.toString().replace(/\\/$/, \"\");\n}\n\nfunction validatePolicyEngineEndpoint(value: string): string {\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n \"$.endpoint must be a URL\",\n );\n }\n if (\n url.protocol !== \"https:\" ||\n url.username !== \"\" ||\n url.password !== \"\" ||\n url.hash !== \"\" ||\n url.search !== \"\"\n ) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n \"$.endpoint must be an HTTPS URL without credentials, query, or fragment\",\n );\n }\n return url.toString().replace(/\\/$/, \"\");\n}\n\n/**\n * Requester-side authentication gate for policy-engine endpoints. A requester\n * MUST NOT send credential evidence or call /resolve unless this verification\n * succeeds.\n */\nexport async function verifyPolicyEngineRecordForRequester(\n options: VerifyPolicyEngineRecordOptions,\n): Promise<PolicyEngineRecord> {\n const normalized = expectObject(options, \"$\", \"policy-authoring-malformed\");\n assertExactKeys(\n normalized,\n [\n \"signedRecord\",\n \"ownerDid\",\n \"audience\",\n \"grantIssuerDid\",\n \"now\",\n \"requiredPolicyVersion\",\n \"requiredEvidenceVerifier\",\n ],\n \"$\",\n );\n if (!hasOwn(normalized, \"signedRecord\")) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-absent\",\n \"$.signedRecord must be present\",\n );\n }\n const signedRecord = normalized[\"signedRecord\"];\n if (\n signedRecord === null ||\n typeof signedRecord !== \"object\" ||\n Array.isArray(signedRecord)\n ) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-absent\",\n \"$.signedRecord must be present\",\n );\n }\n const recordObject = signedRecord as JsonObject;\n const expiresAt = fieldString(\n recordObject,\n \"expiresAt\",\n \"$.signedRecord\",\n \"policy-engine-record-date-invalid\",\n );\n const now = fieldString(\n normalized,\n \"now\",\n \"$\",\n \"policy-engine-record-date-invalid\",\n );\n const expiresMs = parseStrictRfc3339(expiresAt, \"$.signedRecord.expiresAt\");\n const nowMs = parseStrictRfc3339(now, \"$.now\");\n if (expiresMs <= nowMs) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-expired\",\n \"$.signedRecord.expiresAt is expired\",\n );\n }\n\n let verified: PolicyEngineRecord;\n try {\n verified = (await verifyPolicyEngineRecord(recordObject)).object;\n } catch (error) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-signature-invalid\",\n error instanceof Error ? error.message : String(error),\n );\n }\n if (verified.signature.signerDid !== verified.ownerDid) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-signature-invalid\",\n \"$.signedRecord.signature.signerDid must match ownerDid for the direct-owner requester profile\",\n );\n }\n\n const expectedOwnerDid = requiredString(normalized, \"ownerDid\", \"$\");\n if (verified.ownerDid !== expectedOwnerDid) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-owner-mismatch\",\n \"$.signedRecord.ownerDid does not match\",\n );\n }\n const expectedAudience = requiredString(normalized, \"audience\", \"$\");\n if (verified.audience !== expectedAudience) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-audience-mismatch\",\n \"$.signedRecord.audience does not match\",\n );\n }\n const expectedGrantIssuerDid = requiredString(\n normalized,\n \"grantIssuerDid\",\n \"$\",\n );\n if (verified.grantIssuerDid !== expectedGrantIssuerDid) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-grant-issuer-mismatch\",\n \"$.signedRecord.grantIssuerDid does not match\",\n );\n }\n const requiredPolicyVersion = hasOwn(normalized, \"requiredPolicyVersion\")\n ? requiredString(normalized, \"requiredPolicyVersion\", \"$\")\n : POLICY_VERSION_V0;\n if (!verified.supportedPolicyVersions.includes(requiredPolicyVersion)) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-policy-version-unsupported\",\n \"$.signedRecord.supportedPolicyVersions does not include the required version\",\n );\n }\n const requiredEvidenceVerifier = hasOwn(\n normalized,\n \"requiredEvidenceVerifier\",\n )\n ? requiredString(normalized, \"requiredEvidenceVerifier\", \"$\")\n : W3C_VC_CREDENTIAL_VERIFIER;\n if (!verified.supportedEvidenceVerifiers.includes(requiredEvidenceVerifier)) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-evidence-verifier-unsupported\",\n \"$.signedRecord.supportedEvidenceVerifiers does not include the required verifier\",\n );\n }\n return verified;\n}\n\nfunction expectObject(\n input: unknown,\n path: string,\n code: PolicyAuthoringErrorCode,\n): JsonObject {\n try {\n const normalized = normalizeJson(input);\n if (\n normalized === null ||\n typeof normalized !== \"object\" ||\n Array.isArray(normalized)\n ) {\n throw new PolicyAuthoringError(code, `${path} must be an object`);\n }\n return normalized as JsonObject;\n } catch (error) {\n if (error instanceof PolicyAuthoringError) {\n throw error;\n }\n throw new PolicyAuthoringError(\n code,\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction expectPolicyEngineRecord(input: JsonValue): PolicyEngineRecord {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"$.policyEngineRecord must be an object\",\n );\n }\n try {\n return validatePolicyEngineRecordSignedShape(input);\n } catch (error) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction assertExactKeys(\n object: JsonObject,\n allowed: readonly string[],\n path: string,\n): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-unknown-key\",\n `${path} has unknown field ${key}`,\n );\n }\n }\n}\n\nfunction requiredValue(\n object: JsonObject,\n key: string,\n path: string,\n): JsonValue {\n if (!hasOwn(object, key)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} is required`,\n );\n }\n return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n const value = requiredValue(object, key, path);\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} must be a non-empty string`,\n );\n }\n return value;\n}\n\nfunction fieldString(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyAuthoringErrorCode,\n): string {\n if (!hasOwn(object, key)) {\n throw new PolicyAuthoringError(code, `${path}.${key} is required`);\n }\n const value = object[key];\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyAuthoringError(\n code,\n `${path}.${key} must be a non-empty string`,\n );\n }\n return value;\n}\n\nfunction requiredObject(\n object: JsonObject,\n key: string,\n path: string,\n): JsonObject {\n const value = requiredValue(object, key, path);\n if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} must be an object`,\n );\n }\n return value as JsonObject;\n}\n\nfunction requiredArray(\n object: JsonObject,\n key: string,\n path: string,\n): readonly JsonValue[] {\n const value = requiredValue(object, key, path);\n if (!Array.isArray(value)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} must be an array`,\n );\n }\n return value;\n}\n\nfunction requiredStringArray(\n object: JsonObject,\n key: string,\n path: string,\n): string[] {\n const values = requiredArray(object, key, path);\n return values.map((value, index) => {\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key}[${index}] must be a non-empty string`,\n );\n }\n return value;\n });\n}\n\nfunction validateSupportedPolicyVersions(\n values: readonly string[],\n path: string,\n): void {\n if (values.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path} must not be empty`,\n );\n }\n for (let index = 0; index < values.length; index++) {\n if (values[index] !== POLICY_VERSION_V0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}[${index}] is unsupported`,\n );\n }\n }\n}\n\nfunction validateSupportedEvidenceVerifiers(\n values: readonly string[],\n path: string,\n): void {\n if (values.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path} must not be empty`,\n );\n }\n for (let index = 0; index < values.length; index++) {\n if (values[index] !== W3C_VC_CREDENTIAL_VERIFIER) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}[${index}] is unsupported`,\n );\n }\n }\n}\n\nfunction wrapCapabilityError<T>(fn: () => T): T {\n try {\n return fn();\n } catch (error) {\n if (error instanceof PolicyCapabilityError) {\n throw new PolicyAuthoringError(error.code, error.message);\n }\n throw error;\n }\n}\n\nfunction wrapSignedObjectError(error: unknown): Error {\n if (error instanceof PolicyAuthoringError) {\n return error;\n }\n if (\n error instanceof SignedObjectSchemaError ||\n error instanceof SignedObjectProfileError\n ) {\n return new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n error.message,\n );\n }\n return new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n error instanceof Error ? error.message : String(error),\n );\n}\n\nfunction parseStrictRfc3339(value: string, path: string): number {\n const match = value.match(\n /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?Z$/,\n );\n if (!match) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-date-invalid\",\n `${path} must be strict RFC 3339`,\n );\n }\n const parsed = Date.parse(value);\n if (Number.isNaN(parsed)) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-date-invalid\",\n `${path} must be parseable`,\n );\n }\n const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n if (canonical !== value) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-date-invalid\",\n `${path} must be normalizable`,\n );\n }\n return parsed;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (\n Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }\n ).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n return objectHasOwn(object, key);\n}\n","import {\n buildNetworkId,\n parseNetworkId,\n type ParsedNetworkId,\n} from \"@tinycloud/sdk-services\";\n\nimport { canonicalizeDid } from \"./identity\";\n\nexport interface CanonicalParsedNetworkId extends ParsedNetworkId {\n /** Owner DID canonicalized with TinyCloud identity rules. */\n ownerDid: string;\n}\n\n/**\n * Canonicalize a TinyCloud encryption network id.\n *\n * Network ids embed an owner DID. For `did:pkh:eip155` owners, address casing\n * can vary between SIWE/session tokens and delegated network resources. This\n * helper parses the network id, canonicalizes the owner DID, and rebuilds the\n * URN so comparisons can use one stable representation.\n */\nexport function canonicalizeNetworkId(networkId: string): string {\n const parsed = parseNetworkId(networkId);\n return buildNetworkId(canonicalizeDid(parsed.ownerDid), parsed.name);\n}\n\nexport function parseCanonicalNetworkId(\n networkId: string,\n): CanonicalParsedNetworkId {\n const canonical = canonicalizeNetworkId(networkId);\n return parseNetworkId(canonical) as CanonicalParsedNetworkId;\n}\n","/**\n * Zod schemas for session persistence types.\n *\n * This is the source of truth for session-related types. TypeScript types\n * are derived from these schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type { Result, ServiceError } from \"@tinycloud/sdk-services\";\n\n// =============================================================================\n// Shared Patterns\n// =============================================================================\n\n/**\n * Ethereum address pattern (checksummed or lowercase).\n */\nconst ethereumAddressPattern = /^0x[a-fA-F0-9]{40}$/;\n\n// =============================================================================\n// ENS Data Schema\n// =============================================================================\n\n/**\n * Schema for ENS data associated with a session.\n */\nexport const EnsDataSchema = z.object({\n /** ENS name/domain. */\n domain: z.string().nullable().optional(),\n /** ENS avatar URL. */\n avatarUrl: z.string().nullable().optional(),\n});\n\nexport type EnsData = z.infer<typeof EnsDataSchema>;\n\n// =============================================================================\n// Persisted TinyCloud Session Schema\n// =============================================================================\n\n/**\n * Schema for TinyCloud-specific session data that's persisted.\n */\nexport const PersistedTinyCloudSessionSchema = z.object({\n /** The delegation header containing the UCAN */\n delegationHeader: z.object({\n Authorization: z.string(),\n }),\n /** The delegation CID */\n delegationCid: z.string(),\n /** The space ID for this session */\n spaceId: z.string(),\n /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */\n spaces: z.record(z.string(), z.string()).optional(),\n /** The verification method DID */\n verificationMethod: z.string(),\n});\n\nexport type PersistedTinyCloudSession = z.infer<\n typeof PersistedTinyCloudSessionSchema\n>;\n\n// =============================================================================\n// Persisted Session Data Schema\n// =============================================================================\n\n/**\n * Schema for full persisted session data.\n *\n * Contains all data needed to restore a session without re-authentication.\n */\nexport const PersistedSessionDataSchema = z.object({\n /** User's Ethereum address */\n address: z\n .string()\n .regex(ethereumAddressPattern, \"Invalid Ethereum address\"),\n /** EIP-155 Chain ID */\n chainId: z.number().int().positive(),\n /** Session key in JWK format (stringified) */\n sessionKey: z.string(),\n /** The signed SIWE message */\n siwe: z.string(),\n /** User's signature of the SIWE message */\n signature: z.string(),\n /** TinyCloud delegation data if available */\n tinycloudSession: PersistedTinyCloudSessionSchema.optional(),\n /** Session expiration timestamp (ISO 8601 with timezone offset) */\n expiresAt: z.string().datetime({ offset: true }),\n /** Session creation timestamp (ISO 8601 with timezone offset) */\n createdAt: z.string().datetime({ offset: true }),\n /** Schema version for migrations */\n version: z.string(),\n /** Optional ENS data */\n ens: EnsDataSchema.optional(),\n /**\n * TinyCloud hosts this session was created against. Persisted so a\n * restored session resolves to the same node without re-running the\n * registry/fallback resolution (or the wallet sign-in flow). Optional\n * for backward compatibility with sessions persisted before this field\n * existed — those restore and lazily re-resolve their hosts.\n */\n tinycloudHosts: z.array(z.string()).optional(),\n});\n\nexport type PersistedSessionData = z.infer<typeof PersistedSessionDataSchema>;\n\n// =============================================================================\n// TinyCloud Session Schema (Runtime)\n// =============================================================================\n\n/**\n * Schema for full TinyCloud session with delegation data.\n *\n * This is the runtime session type used for making invocations and delegations.\n */\nexport const TinyCloudSessionSchema = z.object({\n /** User's Ethereum address */\n address: z.string().regex(ethereumAddressPattern, \"Invalid Ethereum address\"),\n /** EIP-155 Chain ID */\n chainId: z.number().int().positive(),\n /** Session key ID */\n sessionKey: z.string(),\n /** The space ID for this session */\n spaceId: z.string(),\n /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */\n spaces: z.record(z.string(), z.string()).optional(),\n /** The delegation CID */\n delegationCid: z.string(),\n /** The delegation header for API calls */\n delegationHeader: z.object({\n Authorization: z.string(),\n }),\n /** The verification method DID */\n verificationMethod: z.string(),\n /** The session key JWK (required for invoke operations) */\n jwk: z.object({}).passthrough(),\n /** The signed SIWE message */\n siwe: z.string(),\n /** User's signature of the SIWE message */\n signature: z.string(),\n});\n\nexport type TinyCloudSession = z.infer<typeof TinyCloudSessionSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validation error type for schema validation failures.\n */\nexport interface ValidationError extends ServiceError {\n code: \"VALIDATION_ERROR\";\n meta?: {\n issues: z.ZodIssue[];\n path?: string;\n };\n}\n\n/**\n * Validate persisted session data against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validatePersistedSessionData(JSON.parse(rawData));\n * if (result.ok) {\n * // result.data is typed as PersistedSessionData\n * console.log(result.data.address);\n * } else {\n * console.error(result.error.message);\n * }\n * ```\n */\nexport function validatePersistedSessionData(\n data: unknown\n): Result<PersistedSessionData, ValidationError> {\n const result = PersistedSessionDataSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"session\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate TinyCloud session against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateTinyCloudSession(\n data: unknown\n): Result<TinyCloudSession, ValidationError> {\n const result = TinyCloudSessionSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"session\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate persisted TinyCloud session against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validatePersistedTinyCloudSession(\n data: unknown\n): Result<PersistedTinyCloudSession, ValidationError> {\n const result = PersistedTinyCloudSessionSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"session\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n","import {\n IUserAuthorization,\n ClientSession,\n Extension,\n SignInOptions,\n} from \"./userAuthorization\";\nimport {\n ServiceContext,\n IService,\n IServiceContext,\n IKVService,\n KVService,\n ISQLService,\n SQLService,\n IDuckDbService,\n DuckDbService,\n IDataVaultService,\n IEncryptionService,\n IHooksService,\n HooksService,\n ServiceSession,\n InvokeFunction,\n InvokeAnyFunction,\n FetchFunction,\n RetryPolicy,\n defaultRetryPolicy,\n TelemetryConfig,\n ServiceConstructor,\n Result,\n ok,\n err,\n serviceError,\n ServiceError,\n ErrorCodes,\n} from \"@tinycloud/sdk-services\";\nimport { makePublicSpaceId } from \"./spaces/SpaceService\";\n\n/**\n * Configuration for the TinyCloud SDK.\n */\nexport interface TinyCloudConfig {\n /** Whether to automatically resolve ENS names */\n resolveEns?: boolean;\n\n // === Service Configuration ===\n\n /**\n * TinyCloud host URLs.\n * Required when using services.\n */\n hosts?: string[];\n\n /**\n * Platform-specific invoke function from WASM binding.\n * Required when using services.\n */\n invoke?: InvokeFunction;\n\n /**\n * Optional multi-resource invoke function for aggregated capability requests.\n */\n invokeAny?: InvokeAnyFunction;\n\n /**\n * Custom fetch implementation.\n * Defaults to globalThis.fetch.\n */\n fetch?: FetchFunction;\n\n /**\n * Service constructors to register.\n * Built-in services (like KVService) are registered by default unless overridden.\n *\n * @example\n * ```typescript\n * services: {\n * kv: KVService, // default\n * files: MyFileService, // custom\n * }\n * ```\n */\n services?: Record<string, ServiceConstructor>;\n\n /**\n * Per-service configuration.\n *\n * @example\n * ```typescript\n * serviceConfigs: {\n * kv: { prefix: 'myapp' },\n * files: { maxSize: 10_000_000 },\n * }\n * ```\n */\n serviceConfigs?: Record<string, Record<string, unknown>>;\n\n /**\n * Retry policy for service operations.\n */\n retryPolicy?: Partial<RetryPolicy>;\n\n /**\n * Default-off telemetry for service operation timing.\n */\n telemetry?: TelemetryConfig;\n}\n\n/**\n * TinyCloud SDK - Unified entry point for web and node.\n *\n * This class provides the main SDK interface. Platform-specific behavior\n * is injected through the IUserAuthorization implementation:\n * - WebUserAuthorization for browser environments\n * - NodeUserAuthorization for Node.js environments\n *\n * @example\n * ```typescript\n * // Web usage\n * import { TinyCloud } from '@tinycloud/sdk-core';\n * import { WebUserAuthorization } from '@tinycloud/web-sdk';\n *\n * const auth = new WebUserAuthorization({ ... });\n * const tc = new TinyCloud(auth);\n * await tc.signIn();\n * const result = await tc.kv.put('key', 'value');\n *\n * // Node usage\n * import { TinyCloud } from '@tinycloud/sdk-core';\n * import { NodeUserAuthorization, PrivateKeySigner } from '@tinycloud/node-sdk';\n *\n * const signer = new PrivateKeySigner(process.env.PRIVATE_KEY);\n * const auth = new NodeUserAuthorization({\n * signStrategy: { type: 'auto-sign' },\n * signer,\n * domain: 'api.myapp.com'\n * });\n * const tc = new TinyCloud(auth);\n * await tc.signIn();\n * ```\n */\nexport class TinyCloud {\n /**\n * User authorization handler.\n * Provides authentication and signing capabilities.\n */\n public readonly userAuthorization: IUserAuthorization;\n\n /**\n * SDK configuration.\n */\n private config: TinyCloudConfig;\n\n /**\n * Registered extensions.\n */\n private extensions: Extension[] = [];\n\n // === Service Infrastructure ===\n\n /**\n * Service context providing platform dependencies to services.\n */\n private _serviceContext?: ServiceContext;\n\n /**\n * Registered services by name.\n */\n private _services: Map<string, IService> = new Map();\n\n /**\n * Whether services have been initialized.\n */\n private _servicesInitialized: boolean = false;\n\n /**\n * Create a new TinyCloud SDK instance.\n *\n * @param userAuthorization - Platform-specific authorization implementation\n * @param config - Optional SDK configuration\n */\n constructor(userAuthorization: IUserAuthorization, config?: TinyCloudConfig) {\n this.userAuthorization = userAuthorization;\n this.config = config || {};\n }\n\n // === Service Management ===\n\n /**\n * Initialize services with platform dependencies.\n * Must be called before using services.\n *\n * @param invoke - Platform-specific invoke function from WASM binding\n * @param hosts - TinyCloud host URLs (optional, uses config.hosts)\n * @param fetchFn - Custom fetch implementation (optional)\n */\n public initializeServices(\n invoke?: InvokeFunction,\n hosts?: string[],\n fetchFn?: FetchFunction,\n ): void {\n const effectiveInvoke = invoke ?? this.config.invoke;\n const effectiveHosts = hosts ?? this.config.hosts;\n\n if (!effectiveInvoke) {\n throw new Error(\n \"invoke function is required to initialize services. \" +\n \"Provide it via config.invoke or initializeServices().\",\n );\n }\n\n if (!effectiveHosts || effectiveHosts.length === 0) {\n throw new Error(\n \"hosts are required to initialize services. \" +\n \"Provide them via config.hosts or initializeServices().\",\n );\n }\n\n // Create service context\n this._serviceContext = new ServiceContext({\n invoke: effectiveInvoke,\n invokeAny: this.config.invokeAny,\n fetch: fetchFn ?? this.config.fetch ?? globalThis.fetch.bind(globalThis),\n hosts: effectiveHosts,\n retryPolicy: this.config.retryPolicy,\n telemetry: this.config.telemetry,\n });\n\n // Register default services (can be overridden via config.services)\n const serviceConstructors: Record<string, ServiceConstructor> = {\n kv: KVService,\n sql: SQLService,\n duckdb: DuckDbService,\n hooks: HooksService,\n ...this.config.services,\n };\n\n // Create and register services\n for (const [name, ServiceClass] of Object.entries(serviceConstructors)) {\n const serviceConfig = this.config.serviceConfigs?.[name] ?? {};\n const service = new ServiceClass(serviceConfig);\n service.initialize(this._serviceContext);\n this._serviceContext.registerService(name, service);\n this._services.set(name, service);\n }\n\n this._servicesInitialized = true;\n }\n\n /**\n * Get the service context.\n * @throws Error if services are not initialized\n */\n public get serviceContext(): IServiceContext {\n if (!this._serviceContext) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first.\",\n );\n }\n return this._serviceContext;\n }\n\n /** @internal Retire this service graph after its owner replaces a session. */\n public retireServices(): void {\n try {\n this._serviceContext?.retire();\n } finally {\n this._services.clear();\n this._servicesInitialized = false;\n }\n }\n\n /**\n * Get a registered service by name.\n *\n * @param name - Service name (e.g., 'kv')\n * @returns The service instance or undefined\n */\n public getService<T extends IService>(name: string): T | undefined {\n return this._services.get(name) as T | undefined;\n }\n\n /**\n * Get the KV service.\n * @throws Error if services are not initialized\n */\n public get kv(): IKVService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"kv\") as IKVService | undefined;\n if (!service) {\n throw new Error(\"KV service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the SQL service.\n * @throws Error if services are not initialized\n */\n public get sql(): ISQLService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"sql\") as ISQLService | undefined;\n if (!service) {\n throw new Error(\"SQL service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the DuckDB service.\n * @throws Error if services are not initialized\n */\n public get duckdb(): IDuckDbService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"duckdb\") as IDuckDbService | undefined;\n if (!service) {\n throw new Error(\"DuckDB service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the Hooks service.\n * @throws Error if services are not initialized\n */\n public get hooks(): IHooksService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"hooks\") as IHooksService | undefined;\n if (!service) {\n throw new Error(\"Hooks service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the Data Vault service.\n * @throws Error if services are not initialized or vault service is not registered\n */\n public get vault(): IDataVaultService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"vault\") as\n | IDataVaultService\n | undefined;\n if (!service) {\n throw new Error(\"Vault service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the Encryption service.\n * @throws Error if services are not initialized or encryption service is not registered\n */\n public get encryption(): IEncryptionService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"encryption\") as\n | IEncryptionService\n | undefined;\n if (!service) {\n throw new Error(\"Encryption service is not registered.\");\n }\n return service;\n }\n\n /**\n * Notify services of session change.\n * Called internally after sign-in and sign-out.\n *\n * @param session - The new session, or null if signed out\n */\n private notifyServicesOfSessionChange(session: ServiceSession | null): void {\n if (this._serviceContext) {\n this._serviceContext.setSession(session);\n }\n }\n\n /**\n * Abort all pending service operations.\n * Called internally before sign-out.\n */\n private abortServiceOperations(): void {\n if (this._serviceContext) {\n this._serviceContext.abort();\n }\n }\n\n /**\n * Convert ClientSession to ServiceSession.\n * Returns null if session lacks required fields.\n */\n private toServiceSession(\n clientSession: ClientSession | undefined,\n ): ServiceSession | null {\n if (!clientSession) return null;\n\n // TinyCloudSession contains the required fields\n const tcSession = (clientSession as any).tinycloudSession;\n if (!tcSession) return null;\n\n return {\n delegationHeader: tcSession.delegationHeader,\n delegationCid: tcSession.delegationCid,\n spaceId: tcSession.spaceId,\n verificationMethod: tcSession.verificationMethod,\n jwk: tcSession.jwk,\n };\n }\n\n /**\n * Add an extension to the SDK.\n * Extensions can add capabilities and lifecycle hooks.\n */\n public extend(extension: Extension): void {\n this.extensions.push(extension);\n this.userAuthorization.extend(extension);\n }\n\n /**\n * Check if an extension is enabled.\n * @param namespace - The extension namespace to check\n */\n public isExtensionEnabled(namespace: string): boolean {\n return this.extensions.some((ext) => ext.namespace === namespace);\n }\n\n // === Authentication Methods (delegate to userAuthorization) ===\n\n /**\n * Get the current session, if signed in.\n */\n public get session(): ClientSession | undefined {\n return this.userAuthorization.session;\n }\n\n /**\n * Check if the user is signed in.\n */\n public get isSignedIn(): boolean {\n return !!this.userAuthorization.session;\n }\n\n /**\n * Sign in and create a new session.\n * Notifies services of the new session after successful sign-in.\n * @param options - Optional per-call SIWE overrides for this sign-in only\n * @returns The new session\n */\n public async signIn(options?: SignInOptions): Promise<ClientSession> {\n const session = await this.userAuthorization.signIn(options);\n\n // Notify services of the new session\n const serviceSession = this.toServiceSession(session);\n this.notifyServicesOfSessionChange(serviceSession);\n\n return session;\n }\n\n /**\n * Sign out and clear the current session.\n * Aborts pending service operations and notifies services.\n */\n public async signOut(): Promise<void> {\n // Abort all pending operations before sign-out\n this.abortServiceOperations();\n\n await this.userAuthorization.signOut();\n\n // Clear cached public KV service\n this._publicKV = undefined;\n\n // Clear session from services\n this.notifyServicesOfSessionChange(null);\n }\n\n /**\n * Get the current wallet address.\n */\n public address(): string | undefined {\n return this.userAuthorization.address();\n }\n\n /**\n * Get the current chain ID.\n */\n public chainId(): number | undefined {\n return this.userAuthorization.chainId();\n }\n\n /**\n * Sign a message with the connected wallet.\n * @param message - Message to sign\n */\n public async signMessage(message: string): Promise<string> {\n return this.userAuthorization.signMessage(message);\n }\n\n // === Public Space Methods ===\n\n /**\n * Cached public KV service instance.\n */\n private _publicKV?: IKVService;\n\n /**\n * Construct the deterministic public space ID for a given address and chain ID.\n *\n * @param address - Ethereum address (0x-prefixed)\n * @param chainId - Chain ID (e.g., 1 for mainnet)\n * @returns The public space ID\n */\n static makePublicSpaceId(address: string, chainId: number): string {\n return makePublicSpaceId(address, chainId);\n }\n\n /**\n * Ensure the user's public space exists.\n * Creates it via spaces.create('public') if it doesn't.\n * Called automatically by modules that need to publish data.\n *\n * Requires the user to be signed in and services to be initialized.\n */\n public async ensurePublicSpace(): Promise<Result<void, ServiceError>> {\n const address = this.address();\n const chainId = this.chainId();\n if (!address || !chainId) {\n return err(\n serviceError(\n ErrorCodes.AUTH_REQUIRED,\n \"Must be signed in to ensure public space\",\n \"public-space\",\n ),\n );\n }\n\n if (!this._serviceContext) {\n return err(\n serviceError(\n ErrorCodes.AUTH_REQUIRED,\n \"Services not initialized. Call initializeServices() or signIn() first.\",\n \"public-space\",\n ),\n );\n }\n\n const spaceId = makePublicSpaceId(address, chainId);\n\n // Check if it already exists via invoke\n try {\n const session = this._serviceContext.session;\n if (!session) {\n return err(\n serviceError(\n ErrorCodes.AUTH_REQUIRED,\n \"No active session\",\n \"public-space\",\n ),\n );\n }\n\n const headers = this._serviceContext.invoke(\n session,\n \"space\",\n spaceId,\n \"tinycloud.space/info\",\n );\n\n const response = await this._serviceContext.fetch(\n `${this._serviceContext.hosts[0]}/invoke`,\n { method: \"POST\", headers, body: JSON.stringify({ spaceId }) },\n );\n\n if (response.ok) {\n return ok(undefined);\n }\n\n if (response.status === 404) {\n // Space doesn't exist — create it\n const createHeaders = this._serviceContext.invoke(\n session,\n \"space\",\n \"public\",\n \"tinycloud.space/create\",\n );\n\n const createResponse = await this._serviceContext.fetch(\n `${this._serviceContext.hosts[0]}/invoke`,\n {\n method: \"POST\",\n headers: createHeaders,\n body: JSON.stringify({ name: \"public\" }),\n },\n );\n\n if (!createResponse.ok) {\n // 409 means it already exists — that's fine\n if (createResponse.status === 409) {\n return ok(undefined);\n }\n const errorText = await createResponse.text();\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Failed to create public space: ${createResponse.status} - ${errorText}`,\n \"public-space\",\n ),\n );\n }\n\n return ok(undefined);\n }\n\n // Other error from info check\n const errorText = await response.text();\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Failed to check public space: ${response.status} - ${errorText}`,\n \"public-space\",\n ),\n );\n } catch (error) {\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Network error ensuring public space: ${String(error)}`,\n \"public-space\",\n { cause: error instanceof Error ? error : undefined },\n ),\n );\n }\n }\n\n /**\n * Get a KVService scoped to the user's own public space.\n * Writes require authentication (owner/delegate).\n *\n * @throws Error if not signed in or services not initialized\n */\n public get publicKV(): IKVService {\n if (!this._servicesInitialized || !this._serviceContext) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n\n const address = this.address();\n const chainId = this.chainId();\n if (!address || !chainId) {\n throw new Error(\"Must be signed in to access publicKV.\");\n }\n\n // Return cached instance if available\n if (this._publicKV) {\n return this._publicKV;\n }\n\n const publicSpaceId = makePublicSpaceId(address, chainId);\n const session = this._serviceContext.session;\n if (!session) {\n throw new Error(\"No active session. Sign in first.\");\n }\n\n // Create a KV service with a context that targets the public space\n const publicKV = new KVService({ prefix: \"\" });\n const publicContext = new ServiceContext({\n invoke: this._serviceContext.invoke,\n fetch: this._serviceContext.fetch,\n hosts: this._serviceContext.hosts,\n retryPolicy: this.config.retryPolicy,\n telemetry: this.config.telemetry,\n });\n publicContext.setSession({\n ...session,\n spaceId: publicSpaceId,\n });\n publicKV.initialize(publicContext);\n\n this._publicKV = publicKV;\n return this._publicKV;\n }\n\n /**\n * Read from any user's public space (unauthenticated).\n * Uses the public REST endpoint — no session needed.\n *\n * @param host - TinyCloud server URL (e.g., \"https://node.tinycloud.xyz\")\n * @param spaceId - Full public space ID\n * @param key - Key to read\n * @param fetchFn - Optional custom fetch function\n * @returns The data at the key\n */\n static async readPublicSpace<T = unknown>(\n host: string,\n spaceId: string,\n key: string,\n fetchFn?: FetchFunction,\n ): Promise<Result<T, ServiceError>> {\n const doFetch = fetchFn ?? globalThis.fetch.bind(globalThis);\n const encodedKey = key.split(\"/\").map(encodeURIComponent).join(\"/\");\n const url = `${host}/public/${encodeURIComponent(spaceId)}/kv/${encodedKey}`;\n\n try {\n const response = await doFetch(url, { method: \"GET\" });\n\n if (!response.ok) {\n if (response.status === 404) {\n return err(\n serviceError(\n ErrorCodes.NOT_FOUND,\n `Key not found: ${key} in space ${spaceId}`,\n \"public-space\",\n ),\n );\n }\n const errorText = await response.text();\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Failed to read public space: ${response.status} - ${errorText}`,\n \"public-space\",\n { meta: { status: response.status } },\n ),\n );\n }\n\n const contentType = response.headers.get(\"content-type\");\n let data: T;\n if (contentType?.includes(\"application/json\")) {\n data = (await response.json()) as T;\n } else {\n const text = await response.text();\n // Try parsing as JSON, fall back to raw text\n try {\n data = JSON.parse(text) as T;\n } catch {\n data = text as unknown as T;\n }\n }\n\n return ok(data);\n } catch (error) {\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Network error reading public space: ${String(error)}`,\n \"public-space\",\n { cause: error instanceof Error ? error : undefined },\n ),\n );\n }\n }\n\n /**\n * Read from any user's public space by address (unauthenticated).\n * Convenience method that constructs the space ID from address and chain ID.\n *\n * @param host - TinyCloud server URL\n * @param address - Ethereum address (0x-prefixed)\n * @param chainId - Chain ID (e.g., 1 for mainnet)\n * @param key - Key to read\n * @param fetchFn - Optional custom fetch function\n * @returns The data at the key\n */\n static async readPublicKey<T = unknown>(\n host: string,\n address: string,\n chainId: number,\n key: string,\n fetchFn?: FetchFunction,\n ): Promise<Result<T, ServiceError>> {\n const spaceId = makePublicSpaceId(address, chainId);\n return TinyCloud.readPublicSpace<T>(host, spaceId, key, fetchFn);\n }\n}\n","/**\n * SpaceService - Global singleton for managing spaces (owned and delegated).\n *\n * SpaceService provides a unified interface for discovering, creating,\n * and accessing spaces. It handles both owned spaces (created by the user)\n * and delegated spaces (shared by other users).\n *\n * @packageDocumentation\n */\n\nimport type {\n IDataVaultService,\n ISecretsService,\n IKVService,\n Result,\n ServiceError,\n ServiceSession,\n FetchFunction,\n InvokeFunction,\n} from \"@tinycloud/sdk-services\";\nimport { ok, err, serviceError } from \"@tinycloud/sdk-services\";\nimport type {\n SpaceInfo,\n SpaceOwnership,\n Delegation,\n CreateDelegationParams,\n ShareLink,\n GenerateShareParams,\n} from \"../delegations/types\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry\";\nimport type { ISharingService } from \"../delegations/SharingService\";\nimport {\n Space,\n type ISpace,\n type ISpaceScopedDelegations,\n type ISpaceScopedSharing,\n type SpaceConfig,\n} from \"./Space\";\nimport {\n validateServerDelegationsResponse,\n validateServerOwnedSpacesResponse,\n validateServerCreateSpaceResponse,\n validateServerSpaceInfoResponse,\n type ServerDelegationsResponse,\n} from \"./spaces.schema.js\";\nimport { EXPIRY } from \"../expiry\";\nimport {\n canonicalizeAddress,\n makePkhSpaceId,\n parsePkhDid,\n pkhDid,\n principalDidEquals,\n} from \"../identity\";\n\n// =============================================================================\n// Service Name and Error Codes\n// =============================================================================\n\nconst SERVICE_NAME = \"space\";\n\nfunction ownerDidEquals(a: string, b: string | undefined): boolean {\n if (!b) return false;\n try {\n return principalDidEquals(a, b);\n } catch {\n return a === b;\n }\n}\n\n/**\n * Error codes for SpaceService operations.\n */\nexport const SpaceErrorCodes = {\n /** Space not found */\n NOT_FOUND: \"SPACE_NOT_FOUND\",\n /** Space already exists */\n ALREADY_EXISTS: \"SPACE_ALREADY_EXISTS\",\n /** Creation failed */\n CREATION_FAILED: \"SPACE_CREATION_FAILED\",\n /** Authentication required */\n AUTH_REQUIRED: \"AUTH_REQUIRED\",\n /** Invalid space name or URI */\n INVALID_NAME: \"INVALID_SPACE_NAME\",\n /** Network error */\n NETWORK_ERROR: \"NETWORK_ERROR\",\n /** Not initialized */\n NOT_INITIALIZED: \"NOT_INITIALIZED\",\n} as const;\n\nexport type SpaceErrorCode = (typeof SpaceErrorCodes)[keyof typeof SpaceErrorCodes];\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Parameters for creating a space-scoped delegation.\n * Extends CreateDelegationParams with the spaceId.\n */\nexport interface SpaceDelegationParams extends Omit<CreateDelegationParams, \"spaceId\"> {\n /** The space ID to create the delegation for */\n spaceId: string;\n}\n\n/**\n * Function type for creating delegations.\n * Platform SDKs provide this to handle SIWE-based delegation creation.\n */\nexport type CreateDelegationFunction = (\n params: SpaceDelegationParams\n) => Promise<Result<Delegation, ServiceError>>;\n\n/**\n * Configuration for SpaceService.\n */\nexport interface SpaceServiceConfig {\n /** TinyCloud host URLs */\n hosts: string[];\n /** Active session for authentication */\n session: ServiceSession;\n /** Platform-specific invoke function */\n invoke: InvokeFunction;\n /** Optional custom fetch implementation */\n fetch?: FetchFunction;\n /** Optional capability key registry for delegated space discovery */\n capabilityRegistry?: ICapabilityKeyRegistry;\n /** Factory function to create a space-scoped KV service */\n createKVService?: (spaceId: string) => IKVService;\n /** Factory function to create a space-scoped Data Vault service */\n createVaultService?: (spaceId: string) => IDataVaultService;\n /** Factory function to create a space-scoped secrets service */\n createSecretsService?: (spaceId: string) => ISecretsService;\n /** User's PKH DID (derived from address or provided explicitly) */\n userDid?: string;\n /** Optional SharingService for v2 sharing links (client-side) */\n sharingService?: ISharingService;\n /**\n * Factory function to create delegations using SIWE-based flow.\n * Platform SDKs (web-sdk, node-sdk) provide this using their WASM bindings.\n * Required for space.delegations.create() to work.\n */\n createDelegation?: CreateDelegationFunction;\n /** Optional best-effort hook after the SDK discovers or creates a space. */\n onSpaceRegistered?: (space: SpaceInfo) => void | Promise<void>;\n}\n\n/**\n * Interface for SpaceService.\n */\nexport interface ISpaceService {\n /**\n * List all spaces the user has access to (owned + delegated).\n */\n list(): Promise<Result<SpaceInfo[], ServiceError>>;\n\n /**\n * Create a new space.\n *\n * @param name - The name for the new space\n */\n create(name: string): Promise<Result<SpaceInfo, ServiceError>>;\n\n /**\n * Get a Space object by name or full URI.\n *\n * For owned spaces, use the short name: `sdk.space('default')`\n * For delegated spaces, use the full URI: `sdk.space('tinycloud:pkh:eip155:1:0x...:photos')`\n *\n * @param nameOrUri - Short name or full URI\n */\n get(nameOrUri: string): ISpace;\n\n /**\n * Check if a space exists and the user has access.\n *\n * @param nameOrUri - Short name or full URI\n */\n exists(nameOrUri: string): Promise<Result<boolean, ServiceError>>;\n\n /**\n * Get the current user's primary space ID.\n */\n getCurrentSpaceId(): string | undefined;\n\n /**\n * Update the service configuration.\n */\n updateConfig(config: Partial<SpaceServiceConfig>): void;\n}\n\n// =============================================================================\n// Public Space Utilities\n// =============================================================================\n\n/**\n * Construct the deterministic public space ID for a given address and chain ID.\n *\n * Public space IDs follow the format:\n * `tinycloud:pkh:eip155:{chainId}:{address}:public`\n *\n * Given an address and chain ID, any client can construct this ID\n * to discover and read a user's public data without prior interaction.\n *\n * @param address - Ethereum address (0x-prefixed)\n * @param chainId - Chain ID (e.g., 1 for mainnet)\n * @returns The full public space ID URI\n *\n * @example\n * ```typescript\n * const spaceId = makePublicSpaceId('0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045', 1);\n * // => \"tinycloud:pkh:eip155:1:0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045:public\"\n * ```\n */\nexport function makePublicSpaceId(address: string, chainId: number): string {\n return makePkhSpaceId(address, chainId, \"public\");\n}\n\n// =============================================================================\n// Space URI Utilities\n// =============================================================================\n\n/**\n * Parse a space URI to extract components.\n *\n * Full URI format: `tinycloud:pkh:eip155:{chainId}:{address}:{name}`\n * Short name format: `{name}`\n *\n * @param uri - The space URI or short name\n * @returns Parsed components or null if invalid\n */\nexport function parseSpaceUri(\n uri: string\n): { owner: string; name: string; chainId?: string; address?: string } | null {\n // Full URI format: tinycloud:pkh:eip155:{chainId}:{address}:{name}\n const fullUriMatch = uri.match(\n /^tinycloud:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40}):(.+)$/\n );\n if (fullUriMatch) {\n const [, chainId, address, name] = fullUriMatch;\n try {\n const chainIdNumber = Number(chainId);\n const canonicalAddress = canonicalizeAddress(address);\n return {\n owner: pkhDid(canonicalAddress, chainIdNumber),\n name,\n chainId: String(chainIdNumber),\n address: canonicalAddress,\n };\n } catch {\n return null;\n }\n }\n\n // Short name format - just return the name, owner will be inferred\n if (/^[a-zA-Z0-9_-]+$/.test(uri)) {\n return {\n owner: \"\", // Will be filled in from session\n name: uri,\n };\n }\n\n return null;\n}\n\n/**\n * Build a full space URI from components.\n *\n * @param owner - Owner DID (did:pkh:eip155:{chainId}:{address})\n * @param name - Space name\n * @returns Full space URI\n */\nexport function buildSpaceUri(owner: string, name: string): string {\n const pkh = parsePkhDid(owner);\n if (pkh) {\n return makePkhSpaceId(pkh.address, pkh.chainId, name);\n }\n // Fallback - shouldn't happen with valid PKH DIDs\n return `tinycloud:${owner}:${name}`;\n}\n\n// =============================================================================\n// Server Response Transformation\n// =============================================================================\n\n/**\n * Transform validated server delegation response to SDK's Delegation[] format.\n *\n * Server returns { [cid: string]: DelegationInfo } where:\n * - Key is the delegation CID\n * - Value is DelegationInfo with delegator, delegate, capabilities, etc.\n *\n * SDK expects Delegation[] with cid field included.\n *\n * @param validatedData - Pre-validated server response from validateServerDelegationsResponse()\n * @param defaultSpaceId - Default space ID to use if not extractable from resource\n */\nfunction transformServerDelegations(\n validatedData: ServerDelegationsResponse,\n defaultSpaceId: string\n): Delegation[] {\n const result: Delegation[] = [];\n\n for (const [cid, info] of Object.entries(validatedData)) {\n // Extract path from capabilities (use first capability's resource path)\n const capabilities = info.capabilities;\n let path = \"\";\n let spaceId = defaultSpaceId;\n const actions: string[] = [];\n\n for (const cap of capabilities) {\n actions.push(cap.ability);\n // Parse resource to extract space and path\n // Resource format: tinycloud:pkh:eip155:{chainId}:{address}:{spaceName}/{service}/{path}\n const resourceMatch = cap.resource.match(\n /^(tinycloud:pkh:eip155:\\d+:0x[a-fA-F0-9]+:[^/]+)\\/[^/]+\\/(.*)$/\n );\n if (resourceMatch) {\n spaceId = resourceMatch[1];\n path = resourceMatch[2] || \"\";\n }\n }\n\n // Extract first string parent CID (server may return byte arrays for some CIDs)\n const firstStringParent = info.parents?.find((p): p is string => typeof p === 'string');\n\n result.push({\n cid,\n delegateDID: info.delegate,\n delegatorDID: info.delegator,\n spaceId,\n path,\n actions,\n expiry: info.expiry ? new Date(info.expiry) : new Date(Date.now() + EXPIRY.SHARE_MS),\n isRevoked: false,\n createdAt: info.issued_at ? new Date(info.issued_at) : undefined,\n parentCid: firstStringParent,\n });\n }\n\n return result;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * SpaceService - Global singleton for managing spaces.\n *\n * @example\n * ```typescript\n * const spaceService = new SpaceService({\n * hosts: ['https://node.tinycloud.xyz'],\n * session,\n * invoke,\n * });\n *\n * // List all accessible spaces\n * const result = await spaceService.list();\n * if (result.ok) {\n * for (const space of result.data) {\n * console.log(`${space.name} (${space.type})`);\n * }\n * }\n *\n * // Create a new space\n * const createResult = await spaceService.create('photos');\n *\n * // Get a space object for operations\n * const space = spaceService.get('photos');\n * await space.kv.put('album/vacation', { photos: [...] });\n * ```\n */\nexport class SpaceService implements ISpaceService {\n private hosts: string[];\n private session: ServiceSession;\n private invoke: InvokeFunction;\n private fetchFn: FetchFunction;\n private capabilityRegistry?: ICapabilityKeyRegistry;\n private createKVServiceFn?: (spaceId: string) => IKVService;\n private createVaultServiceFn?: (spaceId: string) => IDataVaultService;\n private createSecretsServiceFn?: (spaceId: string) => ISecretsService;\n private _userDid?: string;\n private sharingService?: ISharingService;\n private createDelegationFn?: CreateDelegationFunction;\n private onSpaceRegisteredFn?: (space: SpaceInfo) => void | Promise<void>;\n\n /** Cache of created Space objects */\n private spaceCache: Map<string, ISpace> = new Map();\n\n /** Cache of space info */\n private infoCache: Map<string, { info: SpaceInfo; cachedAt: number }> = new Map();\n\n /** Cache TTL in milliseconds (5 minutes) */\n private readonly cacheTTL = 5 * 60 * 1000;\n\n /**\n * Create a new SpaceService instance.\n *\n * @param config - Service configuration\n */\n constructor(config: SpaceServiceConfig) {\n this.hosts = config.hosts;\n this.session = config.session;\n this.invoke = config.invoke;\n this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n this.capabilityRegistry = config.capabilityRegistry;\n this.createKVServiceFn = config.createKVService;\n this.createVaultServiceFn = config.createVaultService;\n this.createSecretsServiceFn = config.createSecretsService;\n this._userDid = config.userDid;\n this.sharingService = config.sharingService;\n this.createDelegationFn = config.createDelegation;\n this.onSpaceRegisteredFn = config.onSpaceRegistered;\n }\n\n /**\n * Update the service configuration.\n */\n updateConfig(config: Partial<SpaceServiceConfig>): void {\n if (config.hosts) this.hosts = config.hosts;\n if (config.session) this.session = config.session;\n if (config.invoke) this.invoke = config.invoke;\n if (config.fetch) this.fetchFn = config.fetch;\n if (config.capabilityRegistry) this.capabilityRegistry = config.capabilityRegistry;\n if (config.createKVService) this.createKVServiceFn = config.createKVService;\n if (config.createVaultService) this.createVaultServiceFn = config.createVaultService;\n if (config.createSecretsService) this.createSecretsServiceFn = config.createSecretsService;\n if (config.userDid !== undefined) this._userDid = config.userDid;\n if (config.sharingService) this.sharingService = config.sharingService;\n if (config.createDelegation) this.createDelegationFn = config.createDelegation;\n if (config.onSpaceRegistered) this.onSpaceRegisteredFn = config.onSpaceRegistered;\n\n // Clear caches when config changes\n this.spaceCache.clear();\n this.infoCache.clear();\n }\n\n /**\n * Get the current user's primary space ID.\n */\n getCurrentSpaceId(): string | undefined {\n return this.session?.spaceId;\n }\n\n /**\n * Get the primary host URL.\n */\n private get host(): string {\n return this.hosts[0];\n }\n\n /**\n * Get the current user's PKH DID.\n */\n private get userDid(): string | undefined {\n // Return explicitly set user DID, or try to derive from verificationMethod\n if (this._userDid) {\n return this._userDid;\n }\n // verificationMethod might be did:key format - cannot derive PKH from it\n // The caller should provide userDid explicitly for full functionality\n return undefined;\n }\n\n // ===========================================================================\n // List Spaces\n // ===========================================================================\n\n /**\n * List all spaces the user has access to.\n *\n * Combines owned spaces (from the server) with delegated spaces\n * (from the capability registry).\n */\n async list(): Promise<Result<SpaceInfo[], ServiceError>> {\n if (!this.session) {\n return err(\n serviceError(SpaceErrorCodes.AUTH_REQUIRED, \"Authentication required\", SERVICE_NAME)\n );\n }\n\n try {\n const spaces: SpaceInfo[] = [];\n\n // 1. Get owned spaces from the server\n const ownedResult = await this.listOwnedSpaces();\n if (ownedResult.ok) {\n spaces.push(...ownedResult.data);\n }\n\n // 2. Get delegated spaces from capability registry\n if (this.capabilityRegistry) {\n const delegatedSpaces = this.discoverDelegatedSpaces();\n spaces.push(...delegatedSpaces);\n }\n\n // Remove duplicates (prefer owned over delegated)\n const uniqueSpaces = this.deduplicateSpaces(spaces);\n for (const space of uniqueSpaces) {\n this.notifySpaceRegistered(space);\n }\n\n return ok(uniqueSpaces);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list spaces: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n /**\n * List owned spaces from the server.\n */\n private async listOwnedSpaces(): Promise<Result<SpaceInfo[], ServiceError>> {\n try {\n const headers = this.invoke(this.session, \"space\", \"\", \"tinycloud.space/list\");\n\n const response = await this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list owned spaces: ${response.status} - ${errorText}`,\n SERVICE_NAME,\n { meta: { status: response.status } }\n )\n );\n }\n\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerOwnedSpacesResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const spaces: SpaceInfo[] = validationResult.data.map((item) => ({\n id: item.id,\n name: item.name ?? this.extractNameFromId(item.id),\n owner: item.owner,\n type: \"owned\" as SpaceOwnership,\n permissions: [\"*\"], // Full permissions for owned spaces\n }));\n\n return ok(spaces);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error listing owned spaces: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n /**\n * Discover delegated spaces from the capability registry.\n */\n private discoverDelegatedSpaces(): SpaceInfo[] {\n if (!this.capabilityRegistry) {\n return [];\n }\n\n const spaces: Map<string, SpaceInfo> = new Map();\n\n // Get all capabilities and extract unique space IDs\n const capabilities = this.capabilityRegistry.getAllCapabilities();\n\n for (const capability of capabilities) {\n const spaceId = capability.delegation.spaceId;\n\n // Skip if we already have this space\n if (spaces.has(spaceId)) {\n const existing = spaces.get(spaceId)!;\n // Merge permissions\n if (existing.permissions) {\n const actions = capability.delegation.actions;\n for (const action of actions) {\n if (!existing.permissions.includes(action)) {\n existing.permissions.push(action);\n }\n }\n }\n continue;\n }\n\n // Skip if this is the user's own space\n if (spaceId === this.session?.spaceId) {\n continue;\n }\n\n const parsed = parseSpaceUri(spaceId);\n\n spaces.set(spaceId, {\n id: spaceId,\n name: parsed?.name ?? this.extractNameFromId(spaceId),\n owner: capability.delegation.delegatorDID ?? parsed?.owner ?? \"\",\n type: \"delegated\",\n permissions: [...capability.delegation.actions],\n expiresAt: capability.expiresAt,\n });\n }\n\n return Array.from(spaces.values());\n }\n\n /**\n * Extract space name from a full space ID.\n */\n private extractNameFromId(id: string): string {\n const parsed = parseSpaceUri(id);\n if (parsed) {\n return parsed.name;\n }\n // Fallback: take last segment\n const parts = id.split(\":\");\n return parts[parts.length - 1] || id;\n }\n\n /**\n * Deduplicate spaces, preferring owned over delegated.\n */\n private deduplicateSpaces(spaces: SpaceInfo[]): SpaceInfo[] {\n const seen = new Map<string, SpaceInfo>();\n\n for (const space of spaces) {\n const existing = seen.get(space.id);\n if (!existing || (existing.type === \"delegated\" && space.type === \"owned\")) {\n seen.set(space.id, space);\n }\n }\n\n return Array.from(seen.values());\n }\n\n // ===========================================================================\n // Create Space\n // ===========================================================================\n\n /**\n * Create a new space.\n *\n * @param name - The name for the new space\n */\n async create(name: string): Promise<Result<SpaceInfo, ServiceError>> {\n if (!this.session) {\n return err(\n serviceError(SpaceErrorCodes.AUTH_REQUIRED, \"Authentication required\", SERVICE_NAME)\n );\n }\n\n // Validate name\n if (!name || !/^[a-zA-Z0-9_-]+$/.test(name)) {\n return err(\n serviceError(\n SpaceErrorCodes.INVALID_NAME,\n \"Space name must contain only alphanumeric characters, underscores, and hyphens\",\n SERVICE_NAME\n )\n );\n }\n\n try {\n const headers = this.invoke(this.session, \"space\", name, \"tinycloud.space/create\");\n\n const response = await this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ name }),\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n\n if (response.status === 409) {\n return err(\n serviceError(\n SpaceErrorCodes.ALREADY_EXISTS,\n `Space \"${name}\" already exists`,\n SERVICE_NAME\n )\n );\n }\n\n return err(\n serviceError(\n SpaceErrorCodes.CREATION_FAILED,\n `Failed to create space: ${response.status} - ${errorText}`,\n SERVICE_NAME,\n { meta: { status: response.status } }\n )\n );\n }\n\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerCreateSpaceResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.CREATION_FAILED,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const spaceInfo: SpaceInfo = {\n id: validationResult.data.id,\n name: validationResult.data.name || name,\n owner: validationResult.data.owner || this.userDid || \"\",\n type: \"owned\",\n permissions: [\"*\"],\n };\n\n // Cache the info\n this.infoCache.set(spaceInfo.id, { info: spaceInfo, cachedAt: Date.now() });\n this.notifySpaceRegistered(spaceInfo);\n\n return ok(spaceInfo);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error creating space: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n private notifySpaceRegistered(space: SpaceInfo): void {\n if (!this.onSpaceRegisteredFn) return;\n void Promise.resolve(this.onSpaceRegisteredFn(space)).catch(() => {\n // Account-space registration is an index maintenance side effect; it must\n // not make the canonical space operation fail.\n });\n }\n\n // ===========================================================================\n // Get Space\n // ===========================================================================\n\n /**\n * Get a Space object by name or full URI.\n *\n * @param nameOrUri - Short name or full URI\n */\n get(nameOrUri: string): ISpace {\n // Resolve the full space ID\n const spaceId = this.resolveSpaceId(nameOrUri);\n\n // Check cache\n const cached = this.spaceCache.get(spaceId);\n if (cached) {\n return cached;\n }\n\n // Create new Space object\n const parsed = parseSpaceUri(spaceId);\n const name = parsed?.name ?? this.extractNameFromId(spaceId);\n\n const config: SpaceConfig = {\n id: spaceId,\n name,\n createKV: this.createSpaceScopedKV.bind(this),\n createVault: this.createSpaceScopedVault.bind(this),\n createSecrets: this.createSpaceScopedSecrets.bind(this),\n createDelegations: this.createSpaceScopedDelegations.bind(this),\n createSharing: this.createSpaceScopedSharing.bind(this),\n getInfo: this.getSpaceInfo.bind(this),\n };\n\n const space = new Space(config);\n this.spaceCache.set(spaceId, space);\n\n return space;\n }\n\n /**\n * Resolve a name or URI to a full space ID.\n */\n private resolveSpaceId(nameOrUri: string): string {\n const parsed = parseSpaceUri(nameOrUri);\n\n if (!parsed) {\n // Invalid format, return as-is\n return nameOrUri;\n }\n\n if (parsed.owner) {\n // Full URI - return as-is\n return nameOrUri;\n }\n\n // Short name - build full URI from user's DID\n if (this.userDid) {\n return buildSpaceUri(this.userDid, parsed.name);\n }\n\n // No user DID available, return as-is\n return nameOrUri;\n }\n\n // ===========================================================================\n // Exists Check\n // ===========================================================================\n\n /**\n * Check if a space exists and the user has access.\n */\n async exists(nameOrUri: string): Promise<Result<boolean, ServiceError>> {\n const spaceId = this.resolveSpaceId(nameOrUri);\n\n // Check info cache first\n const cached = this.infoCache.get(spaceId);\n if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {\n return ok(true);\n }\n\n // Query the server\n const infoResult = await this.getSpaceInfo(spaceId);\n return ok(infoResult.ok);\n }\n\n // ===========================================================================\n // Space Info\n // ===========================================================================\n\n /**\n * Get space info from server or cache.\n */\n private async getSpaceInfo(spaceId: string): Promise<Result<SpaceInfo, ServiceError>> {\n // Check cache\n const cached = this.infoCache.get(spaceId);\n if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {\n return ok(cached.info);\n }\n\n if (!this.session) {\n return err(\n serviceError(SpaceErrorCodes.AUTH_REQUIRED, \"Authentication required\", SERVICE_NAME)\n );\n }\n\n try {\n const headers = this.invoke(this.session, \"space\", spaceId, \"tinycloud.space/info\");\n\n const response = await this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ spaceId }),\n });\n\n if (!response.ok) {\n if (response.status === 404) {\n return err(\n serviceError(SpaceErrorCodes.NOT_FOUND, `Space not found: ${spaceId}`, SERVICE_NAME)\n );\n }\n\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to get space info: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerSpaceInfoResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const data = validationResult.data;\n const spaceInfo: SpaceInfo = {\n id: data.id,\n name: data.name ?? this.extractNameFromId(data.id),\n owner: data.owner,\n type: data.type ?? (ownerDidEquals(data.owner, this.userDid) ? \"owned\" : \"delegated\"),\n permissions: data.permissions,\n expiresAt: data.expiresAt ? new Date(data.expiresAt) : undefined,\n };\n\n // Cache the info\n this.infoCache.set(spaceId, { info: spaceInfo, cachedAt: Date.now() });\n\n return ok(spaceInfo);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error getting space info: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n // ===========================================================================\n // Space-Scoped Service Factories\n // ===========================================================================\n\n /**\n * Create a space-scoped KV service.\n */\n private createSpaceScopedKV(spaceId: string): IKVService {\n if (this.createKVServiceFn) {\n return this.createKVServiceFn(spaceId);\n }\n\n // Return a proxy that throws a helpful error\n return new Proxy({} as IKVService, {\n get: () => {\n throw new Error(\n \"KV service factory not configured. Provide createKVService in SpaceServiceConfig.\"\n );\n },\n });\n }\n\n /**\n * Create a space-scoped Data Vault service.\n */\n private createSpaceScopedVault(spaceId: string): IDataVaultService {\n if (this.createVaultServiceFn) {\n return this.createVaultServiceFn(spaceId);\n }\n\n return new Proxy({} as IDataVaultService, {\n get: () => {\n throw new Error(\n \"Vault service factory not configured. Provide createVaultService in SpaceServiceConfig.\"\n );\n },\n });\n }\n\n /**\n * Create a space-scoped secrets service.\n */\n private createSpaceScopedSecrets(spaceId: string): ISecretsService {\n if (this.createSecretsServiceFn) {\n return this.createSecretsServiceFn(spaceId);\n }\n\n return new Proxy({} as ISecretsService, {\n get: () => {\n throw new Error(\n \"Secrets service factory not configured. Provide createSecretsService in SpaceServiceConfig.\"\n );\n },\n });\n }\n\n /**\n * Create space-scoped delegation operations.\n */\n private createSpaceScopedDelegations(spaceId: string): ISpaceScopedDelegations {\n const self = this;\n\n return {\n async list(): Promise<Result<Delegation[], ServiceError>> {\n // List outgoing delegations (created by user) using tinycloud.capabilities/read\n try {\n // Facts contain the query params for the capabilities/read capability\n const facts = [\n {\n capabilitiesReadParams: {\n type: \"list\",\n filters: { direction: \"created\" },\n },\n },\n ];\n\n // The capabilities/read endpoint requires path=\"all\" to match server routing\n const headers = self.invoke(\n self.session,\n \"capabilities\",\n \"all\",\n \"tinycloud.capabilities/read\",\n facts\n );\n\n const response = await self.fetchFn(`${self.host}/invoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list delegations: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n // Server returns { [cid: string]: DelegationInfo } - validate and transform to Delegation[]\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerDelegationsResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const delegations = transformServerDelegations(validationResult.data, spaceId);\n return ok(delegations);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error listing delegations: ${String(error)}`,\n SERVICE_NAME\n )\n );\n }\n },\n\n async listReceived(): Promise<Result<Delegation[], ServiceError>> {\n // List incoming delegations (received by user) using tinycloud.capabilities/read\n try {\n // Facts contain the query params for the capabilities/read capability\n const facts = [\n {\n capabilitiesReadParams: {\n type: \"list\",\n filters: { direction: \"received\" },\n },\n },\n ];\n\n // The capabilities/read endpoint requires path=\"all\" to match server routing\n const headers = self.invoke(\n self.session,\n \"capabilities\",\n \"all\",\n \"tinycloud.capabilities/read\",\n facts\n );\n\n const response = await self.fetchFn(`${self.host}/invoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list received delegations: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n // Server returns { [cid: string]: DelegationInfo } - validate and transform to Delegation[]\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerDelegationsResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const delegations = transformServerDelegations(validationResult.data, spaceId);\n return ok(delegations);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error listing received delegations: ${String(error)}`,\n SERVICE_NAME\n )\n );\n }\n },\n\n async create(\n params: Omit<CreateDelegationParams, \"spaceId\">\n ): Promise<Result<Delegation, ServiceError>> {\n // Use the platform-provided createDelegation function (SIWE-based flow)\n if (self.createDelegationFn) {\n return self.createDelegationFn({ ...params, spaceId });\n }\n\n // Fallback: return error if no createDelegation function provided\n // The old invoke-based approach doesn't work because /delegate expects\n // SIWE delegation headers, not invocation headers\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"Delegation creation requires a createDelegation function. \" +\n \"This should be provided by the platform SDK (web-sdk or node-sdk).\",\n SERVICE_NAME\n )\n );\n },\n\n async revoke(cid: string): Promise<Result<void, ServiceError>> {\n try {\n const headers = self.invoke(\n self.session,\n \"delegation\",\n cid,\n \"tinycloud.delegation/revoke\"\n );\n\n const response = await self.fetchFn(`${self.host}/revoke`, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ cid, spaceId }),\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to revoke delegation: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n return ok(undefined);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error revoking delegation: ${String(error)}`,\n SERVICE_NAME\n )\n );\n }\n },\n };\n }\n\n /**\n * Create space-scoped sharing operations.\n *\n * When a SharingService is configured, delegates to client-side v2 sharing.\n * V2 sharing links are self-contained with embedded private keys - no server tracking.\n */\n private createSpaceScopedSharing(spaceId: string): ISpaceScopedSharing {\n const self = this;\n\n return {\n async generate(\n params: Omit<GenerateShareParams, \"spaceId\">\n ): Promise<Result<ShareLink, ServiceError>> {\n // Use v2 SharingService when available (client-side sharing links)\n if (self.sharingService) {\n // Note: SharingService uses session.spaceId for the space.\n // For space-scoped sharing on delegated spaces, ensure the session\n // is configured for the correct space before calling generate().\n const result = await self.sharingService.generate(params);\n if (!result.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n result.error.message || \"Failed to generate share link\",\n SERVICE_NAME\n )\n );\n }\n return ok(result.data);\n }\n\n // Fallback: return error since server endpoint doesn't exist\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"SharingService not configured. V2 sharing requires a SharingService instance.\",\n SERVICE_NAME\n )\n );\n },\n\n async list(): Promise<Result<ShareLink[], ServiceError>> {\n // V2 sharing links are self-contained (not server-tracked)\n // This operation is not supported in the v2 spec\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"Listing share links is not supported in v2. Share links are self-contained tokens that are not tracked on the server.\",\n SERVICE_NAME\n )\n );\n },\n\n async revoke(token: string): Promise<Result<void, ServiceError>> {\n // V2 sharing links are revoked by revoking the underlying delegation\n // This requires the delegation CID, not the share token\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"Revoking share links by token is not supported in v2. To revoke access, revoke the underlying delegation using space.delegations.revoke(cid).\",\n SERVICE_NAME\n )\n );\n },\n };\n }\n}\n\n/**\n * Create a new SpaceService instance.\n *\n * @param config - Service configuration\n * @returns A new SpaceService instance\n */\nexport function createSpaceService(config: SpaceServiceConfig): ISpaceService {\n return new SpaceService(config);\n}\n","/**\n * Space - Represents a scoped access point to a TinyCloud space.\n *\n * The Space object provides scoped access to services within a specific space,\n * whether owned by the user or delegated from another user.\n *\n * @packageDocumentation\n */\n\nimport type {\n IDataVaultService,\n ISecretsService,\n IKVService,\n Result,\n ServiceError,\n} from \"@tinycloud/sdk-services\";\nimport type { SpaceInfo } from \"../delegations/types\";\n\n/**\n * Interface for space-scoped delegation operations.\n *\n * Provides delegation management scoped to a specific space.\n */\nexport interface ISpaceScopedDelegations {\n /**\n * List delegations created by the user in this space (outgoing).\n */\n list(): Promise<Result<import(\"../delegations/types\").Delegation[], ServiceError>>;\n\n /**\n * List delegations received by the user for this space (incoming).\n */\n listReceived(): Promise<Result<import(\"../delegations/types\").Delegation[], ServiceError>>;\n\n /**\n * Create a delegation within this space.\n */\n create(\n params: Omit<import(\"../delegations/types\").CreateDelegationParams, \"spaceId\">\n ): Promise<Result<import(\"../delegations/types\").Delegation, ServiceError>>;\n\n /**\n * Revoke a delegation within this space.\n */\n revoke(cid: string): Promise<Result<void, ServiceError>>;\n}\n\n/**\n * Interface for space-scoped sharing operations.\n *\n * Provides sharing link management scoped to a specific space.\n */\nexport interface ISpaceScopedSharing {\n /**\n * Generate a sharing link for a resource in this space.\n */\n generate(\n params: Omit<import(\"../delegations/types\").GenerateShareParams, \"spaceId\">\n ): Promise<Result<import(\"../delegations/types\").ShareLink, ServiceError>>;\n\n /**\n * List active sharing links in this space.\n */\n list(): Promise<Result<import(\"../delegations/types\").ShareLink[], ServiceError>>;\n\n /**\n * Revoke a sharing link.\n */\n revoke(token: string): Promise<Result<void, ServiceError>>;\n}\n\n/**\n * Interface for a Space object.\n *\n * Provides scoped access to services within a specific space.\n */\nexport interface ISpace {\n /**\n * The space identifier.\n */\n readonly id: string;\n\n /**\n * The short name of the space.\n */\n readonly name: string;\n\n /**\n * KV operations scoped to this space.\n */\n readonly kv: IKVService;\n\n /**\n * Data Vault operations scoped to this space.\n */\n readonly vault: IDataVaultService;\n\n /**\n * Secrets operations scoped to this space.\n */\n readonly secrets: ISecretsService;\n\n /**\n * Delegation operations scoped to this space.\n */\n readonly delegations: ISpaceScopedDelegations;\n\n /**\n * Sharing operations scoped to this space.\n */\n readonly sharing: ISpaceScopedSharing;\n\n /**\n * Get space metadata.\n */\n info(): Promise<Result<SpaceInfo, ServiceError>>;\n}\n\n/**\n * Configuration for creating a Space object.\n */\nexport interface SpaceConfig {\n /**\n * The space identifier (full URI).\n */\n id: string;\n\n /**\n * The short name of the space.\n */\n name: string;\n\n /**\n * Factory function to create a space-scoped KV service.\n */\n createKV: (spaceId: string) => IKVService;\n\n /**\n * Factory function to create a space-scoped Data Vault service.\n */\n createVault: (spaceId: string) => IDataVaultService;\n\n /**\n * Factory function to create a space-scoped secrets service.\n */\n createSecrets?: (spaceId: string) => ISecretsService;\n\n /**\n * Factory function to create space-scoped delegations.\n */\n createDelegations: (spaceId: string) => ISpaceScopedDelegations;\n\n /**\n * Factory function to create space-scoped sharing.\n */\n createSharing: (spaceId: string) => ISpaceScopedSharing;\n\n /**\n * Function to get space info.\n */\n getInfo: (spaceId: string) => Promise<Result<SpaceInfo, ServiceError>>;\n}\n\nfunction unavailableSecretsService(): ISecretsService {\n return new Proxy({} as ISecretsService, {\n get: () => {\n throw new Error(\n \"Secrets service factory not configured. Provide createSecrets in SpaceConfig.\"\n );\n },\n });\n}\n\n/**\n * Space - Provides scoped access to services within a specific space.\n *\n * @example\n * ```typescript\n * const space = sdk.space('default');\n *\n * // KV operations scoped to this space\n * await space.kv.put('key', 'value');\n * const result = await space.kv.get('key');\n *\n * // Delegation operations scoped to this space\n * await space.delegations.create({\n * delegateDID: 'did:pkh:eip155:1:0x...',\n * path: '/shared/',\n * actions: ['tinycloud.kv/get']\n * });\n *\n * // Get space metadata\n * const info = await space.info();\n * ```\n */\nexport class Space implements ISpace {\n private readonly _id: string;\n private readonly _name: string;\n private readonly _kv: IKVService;\n private readonly _vault: IDataVaultService;\n private readonly _secrets: ISecretsService;\n private readonly _delegations: ISpaceScopedDelegations;\n private readonly _sharing: ISpaceScopedSharing;\n private readonly _getInfo: (spaceId: string) => Promise<Result<SpaceInfo, ServiceError>>;\n\n /**\n * Create a new Space instance.\n *\n * @param config - Space configuration\n */\n constructor(config: SpaceConfig) {\n this._id = config.id;\n this._name = config.name;\n this._kv = config.createKV(config.id);\n this._vault = config.createVault(config.id);\n this._secrets = config.createSecrets?.(config.id) ?? unavailableSecretsService();\n this._delegations = config.createDelegations(config.id);\n this._sharing = config.createSharing(config.id);\n this._getInfo = config.getInfo;\n }\n\n /**\n * The space identifier (full URI).\n */\n get id(): string {\n return this._id;\n }\n\n /**\n * The short name of the space.\n */\n get name(): string {\n return this._name;\n }\n\n /**\n * KV operations scoped to this space.\n */\n get kv(): IKVService {\n return this._kv;\n }\n\n /**\n * Data Vault operations scoped to this space.\n */\n get vault(): IDataVaultService {\n return this._vault;\n }\n\n /**\n * Secrets operations scoped to this space.\n */\n get secrets(): ISecretsService {\n return this._secrets;\n }\n\n /**\n * Delegation operations scoped to this space.\n */\n get delegations(): ISpaceScopedDelegations {\n return this._delegations;\n }\n\n /**\n * Sharing operations scoped to this space.\n */\n get sharing(): ISpaceScopedSharing {\n return this._sharing;\n }\n\n /**\n * Get space metadata.\n *\n * @returns Result containing space information\n */\n async info(): Promise<Result<SpaceInfo, ServiceError>> {\n return this._getInfo(this._id);\n }\n}\n","/**\n * Zod schemas for Space and SpaceService configuration types.\n *\n * These schemas provide runtime validation for space management types.\n * Types are derived from schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type { Result, ServiceError } from \"@tinycloud/sdk-services\";\nimport { CreateDelegationParamsSchema } from \"../delegations/types.schema.js\";\n\n// =============================================================================\n// Validation Error Type\n// =============================================================================\n\n/**\n * Validation error type for schema validation failures.\n */\nexport interface ValidationError extends ServiceError {\n code: \"VALIDATION_ERROR\";\n meta?: {\n issues: z.ZodIssue[];\n path?: string;\n };\n}\n\n// =============================================================================\n// SpaceConfig Schema\n// =============================================================================\n\n/**\n * Configuration for creating a Space object.\n *\n * Contains the space identifier, name, and factory functions for creating\n * space-scoped services.\n */\nexport const SpaceConfigSchema = z.object({\n /** The space identifier (full URI) */\n id: z.string(),\n /** The short name of the space */\n name: z.string(),\n /** Factory function to create a space-scoped KV service */\n createKV: z.function(),\n /** Factory function to create a space-scoped Data Vault service */\n createVault: z.function(),\n /** Optional factory function to create a space-scoped secrets service */\n createSecrets: z.function().optional(),\n /** Factory function to create space-scoped delegations */\n createDelegations: z.function(),\n /** Factory function to create space-scoped sharing */\n createSharing: z.function(),\n /** Function to get space info */\n getInfo: z.function(),\n});\n\nexport type SpaceConfig = z.infer<typeof SpaceConfigSchema>;\n\n// =============================================================================\n// SpaceServiceConfig Schema\n// =============================================================================\n\n/**\n * Configuration for SpaceService.\n *\n * Contains all the dependencies needed for the SpaceService to manage\n * spaces, including hosts, session, and factory functions.\n */\nexport const SpaceServiceConfigSchema = z.object({\n /** TinyCloud host URLs */\n hosts: z.array(z.string()),\n /** Active session for authentication */\n session: z.unknown(),\n /** Platform-specific invoke function */\n invoke: z.function(),\n /** Optional custom fetch implementation */\n fetch: z.function().optional(),\n /** Optional capability key registry for delegated space discovery */\n capabilityRegistry: z.unknown().optional(),\n /** Factory function to create a space-scoped KV service */\n createKVService: z.function().optional(),\n /** Factory function to create a space-scoped Data Vault service */\n createVaultService: z.function().optional(),\n /** Factory function to create a space-scoped secrets service */\n createSecretsService: z.function().optional(),\n /** User's PKH DID (derived from address or provided explicitly) */\n userDid: z.string().optional(),\n /** Optional SharingService for v2 sharing links (client-side) */\n sharingService: z.unknown().optional(),\n /** Factory function to create delegations using SIWE-based flow */\n createDelegation: z.function().optional(),\n});\n\nexport type SpaceServiceConfig = z.infer<typeof SpaceServiceConfigSchema>;\n\n// =============================================================================\n// SpaceDelegationParams Schema\n// =============================================================================\n\n/**\n * Parameters for creating a space-scoped delegation.\n *\n * Extends CreateDelegationParams with the spaceId field.\n */\nexport const SpaceDelegationParamsSchema = CreateDelegationParamsSchema.extend({\n /** The space ID to create the delegation for */\n spaceId: z.string(),\n});\n\nexport type SpaceDelegationParams = z.infer<typeof SpaceDelegationParamsSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validate a SpaceConfig object against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validateSpaceConfig(config);\n * if (result.ok) {\n * const space = new Space(result.data);\n * } else {\n * console.error(\"Invalid config:\", result.error.message);\n * }\n * ```\n */\nexport function validateSpaceConfig(\n data: unknown\n): Result<SpaceConfig, ValidationError> {\n const result = SpaceConfigSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate a SpaceServiceConfig object against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validateSpaceServiceConfig(config);\n * if (result.ok) {\n * const service = new SpaceService(result.data);\n * } else {\n * console.error(\"Invalid config:\", result.error.message);\n * }\n * ```\n */\nexport function validateSpaceServiceConfig(\n data: unknown\n): Result<SpaceServiceConfig, ValidationError> {\n const result = SpaceServiceConfigSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate a SpaceDelegationParams object against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validateSpaceDelegationParams(params);\n * if (result.ok) {\n * await createDelegation(result.data);\n * } else {\n * console.error(\"Invalid params:\", result.error.message);\n * }\n * ```\n */\nexport function validateSpaceDelegationParams(\n data: unknown\n): Result<SpaceDelegationParams, ValidationError> {\n const result = SpaceDelegationParamsSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n// =============================================================================\n// Server Response Schemas\n// =============================================================================\n\n/**\n * Server's DelegationInfo structure (from capabilities/read response).\n * This schema validates the shape of delegation data received from the server.\n */\nexport const ServerDelegationInfoSchema = z.object({\n /** DID of the delegator */\n delegator: z.string(),\n /** DID of the delegate */\n delegate: z.string(),\n /** Parent delegation CIDs - accepts string or byte array format from server */\n parents: z.array(z.union([z.string(), z.array(z.number())])),\n /** Expiration time (ISO8601 string) */\n expiry: z.string().optional(),\n /** Not-before time (ISO8601 string) */\n not_before: z.string().optional(),\n /** Issued-at time (ISO8601 string) */\n issued_at: z.string().optional(),\n /** Capabilities granted by this delegation */\n capabilities: z.array(\n z.object({\n resource: z.string(),\n ability: z.string(),\n })\n ),\n});\n\nexport type ServerDelegationInfo = z.infer<typeof ServerDelegationInfoSchema>;\n\n/**\n * Server response for capabilities/read endpoint.\n * Returns a record mapping CID -> DelegationInfo.\n */\nexport const ServerDelegationsResponseSchema = z.record(\n z.string(),\n ServerDelegationInfoSchema\n);\n\nexport type ServerDelegationsResponse = z.infer<typeof ServerDelegationsResponseSchema>;\n\n/**\n * Server response for space/list endpoint.\n * Returns an array of owned space info.\n */\nexport const ServerOwnedSpaceSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Space name (optional, can be derived from id) */\n name: z.string().optional(),\n /** Owner DID */\n owner: z.string(),\n /** Creation timestamp */\n createdAt: z.string().optional(),\n});\n\nexport type ServerOwnedSpace = z.infer<typeof ServerOwnedSpaceSchema>;\n\nexport const ServerOwnedSpacesResponseSchema = z.array(ServerOwnedSpaceSchema);\n\nexport type ServerOwnedSpacesResponse = z.infer<typeof ServerOwnedSpacesResponseSchema>;\n\n/**\n * Server response for space/create endpoint.\n */\nexport const ServerCreateSpaceResponseSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Space name */\n name: z.string(),\n /** Owner DID */\n owner: z.string(),\n /** Creation timestamp */\n createdAt: z.string().optional(),\n});\n\nexport type ServerCreateSpaceResponse = z.infer<typeof ServerCreateSpaceResponseSchema>;\n\n/**\n * Server response for space/info endpoint.\n */\nexport const ServerSpaceInfoResponseSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Space name (optional) */\n name: z.string().optional(),\n /** Owner DID */\n owner: z.string(),\n /** Ownership type */\n type: z.enum([\"owned\", \"delegated\"]).optional(),\n /** Permissions the user has in this space */\n permissions: z.array(z.string()).optional(),\n /** Expiration for delegated access */\n expiresAt: z.string().optional(),\n});\n\nexport type ServerSpaceInfoResponse = z.infer<typeof ServerSpaceInfoResponseSchema>;\n\n// =============================================================================\n// Server Response Validation Helpers\n// =============================================================================\n\n/**\n * Validate server delegations response (capabilities/read).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerDelegationsResponse(\n data: unknown\n): Result<ServerDelegationsResponse, ValidationError> {\n // Handle null/undefined as empty response\n if (data === null || data === undefined) {\n return { ok: true, data: {} };\n }\n\n // Handle array format (legacy compatibility) - return as-is, validation happens elsewhere\n if (Array.isArray(data)) {\n return { ok: true, data: {} };\n }\n\n const result = ServerDelegationsResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server delegations response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate server owned spaces response (space/list).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerOwnedSpacesResponse(\n data: unknown\n): Result<ServerOwnedSpacesResponse, ValidationError> {\n const result = ServerOwnedSpacesResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server owned spaces response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate server create space response (space/create).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerCreateSpaceResponse(\n data: unknown\n): Result<ServerCreateSpaceResponse, ValidationError> {\n const result = ServerCreateSpaceResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server create space response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate server space info response (space/info).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerSpaceInfoResponse(\n data: unknown\n): Result<ServerSpaceInfoResponse, ValidationError> {\n const result = ServerSpaceInfoResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server space info response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n","/**\n * Zod schemas for delegation management types.\n *\n * These schemas provide runtime validation for delegation, capability key management,\n * and sharing link functionality. Types are derived from schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n FetchFunction,\n InvokeAnyFunction,\n InvokeFunction,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\n\n// =============================================================================\n// Result Type (Generic)\n// =============================================================================\n\n/**\n * Creates a Result schema for a given data type and error type.\n * Result types provide explicit error handling instead of throwing.\n */\nexport function createResultSchema<T extends z.ZodTypeAny, E extends z.ZodTypeAny>(\n dataSchema: T,\n errorSchema: E\n) {\n return z.discriminatedUnion(\"ok\", [\n z.object({ ok: z.literal(true), data: dataSchema }),\n z.object({ ok: z.literal(false), error: errorSchema }),\n ]);\n}\n\n/**\n * Result type pattern for delegation operations.\n */\nexport type Result<T, E = DelegationError> =\n | { ok: true; data: T }\n | { ok: false; error: E };\n\n// =============================================================================\n// JWK Type (JSON Web Key)\n// =============================================================================\n\n/**\n * JSON Web Key representation for cryptographic keys.\n * Follows the JWK specification (RFC 7517).\n */\nexport const JWKSchema = z.object({\n /** Key type (e.g., \"EC\", \"RSA\", \"OKP\") */\n kty: z.string(),\n /** Curve for EC/OKP keys (e.g., \"P-256\", \"Ed25519\") */\n crv: z.string().optional(),\n /** X coordinate for EC keys, public key for OKP */\n x: z.string().optional(),\n /** Y coordinate for EC keys */\n y: z.string().optional(),\n /** Private key value (d parameter) */\n d: z.string().optional(),\n /** Public exponent for RSA keys */\n e: z.string().optional(),\n /** Modulus for RSA keys */\n n: z.string().optional(),\n /** Key ID */\n kid: z.string().optional(),\n /** Algorithm */\n alg: z.string().optional(),\n /** Key use (e.g., \"sig\", \"enc\") */\n use: z.string().optional(),\n /** Key operations (e.g., [\"sign\", \"verify\"]) */\n key_ops: z.array(z.string()).optional(),\n});\n\nexport type JWK = z.infer<typeof JWKSchema>;\n\n// =============================================================================\n// Key Management Types\n// =============================================================================\n\n/**\n * Type of key in the capability registry.\n */\nexport const KeyTypeSchema = z.enum([\"main\", \"session\", \"ingested\"]);\nexport type KeyType = z.infer<typeof KeyTypeSchema>;\n\n/**\n * Information about a cryptographic key used for delegations.\n */\nexport const KeyInfoSchema = z.object({\n /** Unique identifier for this key */\n id: z.string(),\n /** DID associated with this key */\n did: z.string(),\n /** Type of key determining its authority level */\n type: KeyTypeSchema,\n /** Private key in JWK format */\n jwk: JWKSchema.optional(),\n /** Priority for key selection (lower = higher priority) */\n priority: z.number(),\n});\n\nexport type KeyInfo = z.infer<typeof KeyInfoSchema>;\n\n// =============================================================================\n// Error Types\n// =============================================================================\n\n/**\n * Error type for delegation operations.\n */\nexport const DelegationErrorSchema = z.object({\n /** Error code for programmatic handling */\n code: z.string(),\n /** Human-readable error message */\n message: z.string(),\n /** The service that produced the error */\n service: z.literal(\"delegation\"),\n /** Original error if wrapping another error */\n cause: z.instanceof(Error).optional(),\n /** Additional metadata about the error */\n meta: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type DelegationError = z.infer<typeof DelegationErrorSchema>;\n\n/**\n * Error codes for delegation operations.\n */\nexport const DelegationErrorCodes = {\n AUTH_REQUIRED: \"AUTH_REQUIRED\",\n AUTH_EXPIRED: \"AUTH_EXPIRED\",\n NOT_INITIALIZED: \"NOT_INITIALIZED\",\n NOT_FOUND: \"NOT_FOUND\",\n REVOKED: \"REVOKED\",\n NETWORK_ERROR: \"NETWORK_ERROR\",\n TIMEOUT: \"TIMEOUT\",\n ABORTED: \"ABORTED\",\n INVALID_INPUT: \"INVALID_INPUT\",\n PERMISSION_DENIED: \"PERMISSION_DENIED\",\n CREATION_FAILED: \"CREATION_FAILED\",\n REVOCATION_FAILED: \"REVOCATION_FAILED\",\n INVALID_TOKEN: \"INVALID_TOKEN\",\n KV_SERVICE_UNAVAILABLE: \"KV_SERVICE_UNAVAILABLE\",\n DATA_FETCH_FAILED: \"DATA_FETCH_FAILED\",\n VALIDATION_ERROR: \"VALIDATION_ERROR\",\n} as const;\n\nexport type DelegationErrorCode =\n (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];\n\n// =============================================================================\n// Delegation Types\n// =============================================================================\n\n/**\n * Represents a delegation from one DID to another.\n */\nexport const DelegationSchema = z.object({\n /** Content identifier (CID) of the delegation */\n cid: z.string(),\n /** DID of the delegate (the party receiving the delegation) */\n delegateDID: z.string(),\n /** Space ID this delegation applies to */\n spaceId: z.string(),\n /** Resource path this delegation grants access to */\n path: z.string(),\n /** Actions this delegation authorizes */\n actions: z.array(z.string()),\n /** Exact ReCap caveats that constrain every action in this scope. */\n caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n /** When this delegation expires (accepts Date or ISO string from JSON) */\n expiry: z.coerce.date(),\n /** Whether this delegation has been revoked */\n isRevoked: z.boolean(),\n /** DID of the delegator (the party granting the delegation) */\n delegatorDID: z.string().optional(),\n /** When this delegation was created (accepts Date or ISO string from JSON) */\n createdAt: z.coerce.date().optional(),\n /** Parent delegation CID if this is a sub-delegation */\n parentCid: z.string().optional(),\n /** Whether sub-delegation is allowed */\n allowSubDelegation: z.boolean().optional(),\n /** Authorization header (UCAN bearer token) */\n authHeader: z.string().optional(),\n});\n\nexport type Delegation = z.infer<typeof DelegationSchema>;\n\n/** Node-confirmed lifecycle state for one delegation. */\nexport const DelegationStatusSchema = z.object({\n cid: z.string().min(1),\n status: z.enum([\"active\", \"revoked\", \"expired\", \"unavailable\", \"not_found\"]),\n exists: z.boolean(),\n active: z.boolean(),\n revoked: z.boolean(),\n expired: z.boolean(),\n}).strict().superRefine((value, context) => {\n const valid = value.status === \"active\"\n ? value.exists && value.active && !value.revoked && !value.expired\n : value.status === \"revoked\"\n ? value.exists && !value.active && value.revoked && !value.expired\n : value.status === \"expired\"\n ? value.exists && !value.active && !value.revoked && value.expired\n : value.status === \"unavailable\"\n ? value.exists && !value.active && !value.revoked && !value.expired\n : !value.exists && !value.active && !value.revoked && !value.expired;\n if (!valid) {\n context.addIssue({\n code: z.ZodIssueCode.custom,\n message: \"delegation status flags do not match status\",\n });\n }\n});\n\nexport type DelegationStatus = z.infer<typeof DelegationStatusSchema>;\n\nexport const DelegationRevocationReceiptSchema = z.object({\n revoked: z.literal(true),\n cid: z.string().min(1),\n}).strict();\n\nexport type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;\n\nexport const AccountDelegationResourceSchema = z.object({\n resource: z.string().min(1),\n actions: z.array(z.string()),\n caveats: z.array(z.record(z.string(), z.unknown())),\n}).strict();\n\nconst AccountDelegationDateSchema = z\n .string()\n .datetime({ offset: true })\n .transform((value) => new Date(value));\n\nexport const AccountDelegationRecordSchema = z.object({\n cid: z.string().min(1),\n direction: z.enum([\"granted\", \"received\"]),\n delegatorDid: z.string().min(1),\n delegateDid: z.string().min(1),\n resources: z.array(AccountDelegationResourceSchema),\n parents: z.array(z.string()),\n issuedAt: AccountDelegationDateSchema.nullable(),\n notBefore: AccountDelegationDateSchema.nullable(),\n expiresAt: AccountDelegationDateSchema.nullable(),\n status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]),\n revokedAt: AccountDelegationDateSchema.nullable().optional(),\n revokedBy: z.string().optional(),\n revokedAncestorCid: z.string().optional(),\n}).strict();\n\nexport const AccountDelegationPageSchema = z.object({\n schemaVersion: z.literal(2),\n items: z.array(AccountDelegationRecordSchema),\n nextCursor: z.string().optional(),\n}).strict();\n\nexport type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;\nexport type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;\nexport type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;\n\nexport const AccountDelegationQueryOptionsSchema = z.object({\n direction: z.enum([\"granted\", \"received\", \"all\"]).optional(),\n status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]).optional(),\n space: z.string().trim().min(1).optional(),\n limit: z.number().int().min(1).max(100).optional(),\n cursor: z.string().min(1).optional(),\n}).strict();\n\nexport type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;\n\n/**\n * Entry in the capability registry mapping a capability to available keys.\n */\nexport const CapabilityEntrySchema = z.object({\n /** Resource URI this capability applies to */\n resource: z.string(),\n /** Action this capability authorizes */\n action: z.string(),\n /** Keys that can exercise this capability, ordered by priority */\n keys: z.array(KeyInfoSchema),\n /** The delegation that grants this capability */\n delegation: DelegationSchema,\n /** When this capability expires (accepts Date or ISO string from JSON) */\n expiresAt: z.coerce.date().optional(),\n});\n\nexport type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;\n\n/**\n * Persistent record of a delegation stored in the system.\n */\nexport const DelegationRecordSchema = z.object({\n /** Content identifier (CID) of the delegation */\n cid: z.string(),\n /** Space ID this delegation applies to */\n spaceId: z.string(),\n /** DID of the delegator (grantor) */\n delegator: z.string(),\n /** DID of the delegatee (recipient) */\n delegatee: z.string(),\n /** Key ID used to sign/exercise this delegation */\n keyId: z.string().optional(),\n /** Resource path pattern this delegation grants access to */\n path: z.string(),\n /** Actions this delegation authorizes */\n actions: z.array(z.string()),\n /** When this delegation expires (accepts Date or ISO string from JSON) */\n expiry: z.coerce.date().optional(),\n /** When this delegation becomes valid (not before) (accepts Date or ISO string) */\n notBefore: z.coerce.date().optional(),\n /** Whether this delegation has been revoked */\n isRevoked: z.boolean(),\n /** When this delegation was created (accepts Date or ISO string from JSON) */\n createdAt: z.coerce.date(),\n /** Parent delegation CID if this is a sub-delegation */\n parentCid: z.string().optional(),\n});\n\nexport type DelegationRecord = z.infer<typeof DelegationRecordSchema>;\n\n/**\n * Parameters for creating a new delegation.\n */\nexport const CreateDelegationParamsSchema = z.object({\n /** DID of the delegate (the party receiving the delegation) */\n delegateDID: z.string(),\n /** Resource path this delegation grants access to */\n path: z.string(),\n /** Actions to authorize */\n actions: z.array(z.string()),\n /** When this delegation expires (accepts Date or ISO string) */\n expiry: z.coerce.date().optional(),\n /** Whether to disable sub-delegation */\n disableSubDelegation: z.boolean().optional(),\n /** Optional statement for the SIWE message */\n statement: z.string().optional(),\n});\n\nexport type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;\n\n/**\n * A chain of delegations from root to leaf (array format).\n */\nexport const DelegationChainSchema = z.array(DelegationSchema);\nexport type DelegationChain = z.infer<typeof DelegationChainSchema>;\n\n/**\n * Structured delegation chain (v2 spec).\n */\nexport const DelegationChainV2Schema = z.object({\n /** The root delegation from the original authority */\n root: DelegationSchema,\n /** Intermediate delegations in the chain (may be empty) */\n chain: z.array(DelegationSchema),\n /** The final delegation to the current user */\n leaf: DelegationSchema,\n});\n\nexport type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;\n\n// =============================================================================\n// Filtering and Query Types\n// =============================================================================\n\n/**\n * Direction of delegation to filter by.\n */\nexport const DelegationDirectionSchema = z.enum([\"granted\", \"received\", \"all\"]);\nexport type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;\n\n/**\n * Filters for listing delegations.\n */\nexport const DelegationFiltersSchema = z.object({\n /** Filter by delegation direction */\n direction: DelegationDirectionSchema.optional(),\n /** Filter by resource path pattern */\n path: z.string().optional(),\n /** Filter by required actions */\n actions: z.array(z.string()).optional(),\n /** Include revoked delegations */\n includeRevoked: z.boolean().optional(),\n /** Filter by delegator DID */\n delegator: z.string().optional(),\n /** Filter by delegatee DID */\n delegatee: z.string().optional(),\n /** Only include delegations valid at this time */\n validAt: z.coerce.date().optional(),\n /** Maximum number of results to return */\n limit: z.number().optional(),\n /** Cursor for pagination */\n cursor: z.string().optional(),\n});\n\nexport type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;\n\n// =============================================================================\n// Space Types\n// =============================================================================\n\n/**\n * Type of space ownership.\n */\nexport const SpaceOwnershipSchema = z.enum([\"owned\", \"delegated\"]);\nexport type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;\n\n/**\n * Information about a space the user has access to.\n */\nexport const SpaceInfoSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Human-readable name for the space */\n name: z.string().optional(),\n /** DID of the space owner */\n owner: z.string(),\n /** Whether user owns or has delegated access */\n type: SpaceOwnershipSchema,\n /** Permissions the user has in this space */\n permissions: z.array(z.string()).optional(),\n /** When the access expires (for delegated spaces) */\n expiresAt: z.coerce.date().optional(),\n});\n\nexport type SpaceInfo = z.infer<typeof SpaceInfoSchema>;\n\n// =============================================================================\n// Share Link Types\n// =============================================================================\n\n/**\n * Schema for encoding share link data.\n */\nexport const ShareSchemaSchema = z.enum([\"base64\", \"compact\", \"ipfs\"]);\nexport type ShareSchema = z.infer<typeof ShareSchemaSchema>;\n\n/**\n * A shareable link containing delegation credentials.\n */\nexport const ShareLinkSchema = z.object({\n /** Unique token identifying this share link */\n token: z.string(),\n /** Full URL for sharing */\n url: z.string(),\n /** The delegation this link grants access to */\n delegation: DelegationSchema,\n /** Encoding schema used for the link */\n schema: ShareSchemaSchema,\n /** When this share link expires */\n expiresAt: z.coerce.date().optional(),\n /** Human-readable description of what is being shared */\n description: z.string().optional(),\n});\n\nexport type ShareLink = z.infer<typeof ShareLinkSchema>;\n\n/**\n * Data retrieved from a share link.\n */\nexport function createShareLinkDataSchema<T extends z.ZodTypeAny>(dataSchema: T) {\n return z.object({\n /** The retrieved data */\n data: dataSchema,\n /** The delegation that authorized this access */\n delegation: DelegationSchema,\n /** The space the data belongs to */\n spaceId: z.string(),\n /** The resource path that was accessed */\n path: z.string(),\n });\n}\n\nexport const ShareLinkDataSchema = createShareLinkDataSchema(z.unknown());\nexport type ShareLinkData<T = unknown> = {\n data: T;\n delegation: Delegation;\n spaceId: string;\n path: string;\n};\n\n// =============================================================================\n// Ingestion Types\n// =============================================================================\n\n/**\n * Options for ingesting an external delegation.\n */\nexport const IngestOptionsSchema = z.object({\n /** Whether to persist the delegation to storage */\n persist: z.boolean().optional(),\n /** Whether to validate the full delegation chain */\n validateChain: z.boolean().optional(),\n /** Name for the ingested key */\n keyName: z.string().optional(),\n /** Whether to create a session key for this delegation */\n createSessionKey: z.boolean().optional(),\n /** Override the priority for the ingested key */\n priority: z.number().optional(),\n});\n\nexport type IngestOptions = z.infer<typeof IngestOptionsSchema>;\n\n// =============================================================================\n// Parameter Types\n// =============================================================================\n\n/**\n * Parameters for generating a share link.\n */\nexport const GenerateShareParamsSchema = z.object({\n /** Resource path to share */\n path: z.string(),\n /** Actions to authorize */\n actions: z.array(z.string()).optional(),\n /** When the share link expires */\n expiry: z.coerce.date().optional(),\n /** Encoding schema for the link */\n schema: ShareSchemaSchema.optional(),\n /** Human-readable description */\n description: z.string().optional(),\n /** Base URL for the share link */\n baseUrl: z.string().optional(),\n});\n\nexport type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;\n\n// =============================================================================\n// Configuration Types\n// =============================================================================\n\n// Note: These types include functions and external types which cannot be fully validated at runtime.\n// We use z.unknown().refine() for runtime type checking while preserving TypeScript types.\n\n/**\n * Configuration for DelegationManager.\n * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.\n */\nexport const DelegationManagerConfigSchema = z.object({\n /** TinyCloud host URLs */\n hosts: z.array(z.string()),\n /** Account space used by account-wide delegation history queries */\n accountSpaceId: z.string().min(1).optional(),\n /** Active session for authentication */\n session: z.unknown().refine(\n (val): val is ServiceSession => val !== null && typeof val === \"object\",\n { message: \"Expected a ServiceSession object\" }\n ),\n /** Platform-specific invoke function */\n invoke: z.unknown().refine(\n (val): val is InvokeFunction => typeof val === \"function\",\n { message: \"Expected an invoke function\" }\n ),\n /** Platform-specific invoke function for raw resource URIs */\n invokeAny: z.unknown().refine(\n (val): val is InvokeAnyFunction => val === undefined || typeof val === \"function\",\n { message: \"Expected an invokeAny function or undefined\" }\n ).optional(),\n /** Optional custom fetch implementation */\n fetch: z.unknown().refine(\n (val): val is FetchFunction => val === undefined || typeof val === \"function\",\n { message: \"Expected a fetch function or undefined\" }\n ).optional(),\n});\n\nexport type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;\n\n/**\n * Provider interface for cryptographic key operations.\n */\nexport const KeyProviderSchema = z.object({\n /** Generate a new session key, returns key ID */\n createSessionKey: z.unknown().refine(\n (val): val is (name: string) => Promise<string> => typeof val === \"function\",\n { message: \"Expected a function\" }\n ),\n /** Get JWK for a key */\n getJWK: z.unknown().refine(\n (val): val is (keyId: string) => object => typeof val === \"function\",\n { message: \"Expected a function\" }\n ),\n /** Get DID for a key */\n getDID: z.unknown().refine(\n (val): val is (keyId: string) => Promise<string> => typeof val === \"function\",\n { message: \"Expected a function\" }\n ),\n});\n\nexport type KeyProvider = z.infer<typeof KeyProviderSchema>;\n\n// =============================================================================\n// API Response Types\n// =============================================================================\n\n/**\n * Response from the delegation API.\n */\nexport const DelegationApiResponseSchema = z.object({\n /** SIWE message content */\n siwe: z.string(),\n /** Signature of the SIWE message */\n signature: z.string(),\n /** Delegation version */\n version: z.number(),\n /** CID of the created delegation */\n cid: z.string().optional(),\n});\n\nexport type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;\n\n// =============================================================================\n// WASM Delegation Types\n// =============================================================================\n\n/**\n * A single (service, space, path, actions) entry inside a\n * createDelegation WASM result.\n *\n * Mirrors the Rust `DelegatedResource` struct in\n * `tinycloud-sdk-wasm/src/session.rs`. Field names match the manifest\n * {@link PermissionEntry} shape so callers can reconstruct what they sent\n * without having to re-parse the UCAN.\n *\n * `service` is the short form (e.g. `\"kv\"`, `\"sql\"`) as returned by the\n * Rust layer. The SDK layer translates to the long form\n * (`\"tinycloud.kv\"`) when comparing against manifests.\n */\nexport const DelegatedResourceSchema = z.object({\n /** Short-form service name, e.g. \"kv\", \"sql\", \"duckdb\", \"capabilities\", \"hooks\". */\n service: z.string(),\n /** Full space id string, e.g. \"tinycloud:pkh:eip155:1:0x....:default\". */\n space: z.string(),\n /** Resource path; empty string when the resource URI had no path segment. */\n path: z.string(),\n /** Full-URN ability strings, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n actions: z.array(z.string()),\n /** Exact ReCap caveats that constrain every action in this scope. */\n caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n});\n\nexport type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;\n\n/**\n * Input parameters for the createDelegation WASM function.\n *\n * A single call may encode multiple `(service, path, actions)` entries\n * via the `abilities` map — the underlying UCAN will contain one\n * attenuation entry per `(service, path)` pair, all signed by the same\n * session key in one blob.\n *\n * The `abilities` shape is identical to what `prepareSession` accepts\n * (`Record<shortService, Record<path, actionURNs[]>>`), so manifest\n * resolution can feed both sides from one data structure.\n */\nexport const CreateDelegationWasmParamsSchema = z.object({\n /** The session containing delegation credentials */\n session: z.unknown().refine(\n (val): val is ServiceSession => val !== null && typeof val === \"object\",\n { message: \"Expected a ServiceSession object\" }\n ),\n /** DID of the delegate */\n delegateDID: z.string(),\n /** Space ID this delegation applies to */\n spaceId: z.string(),\n /**\n * Multi-resource abilities map: short-service → path → full-URN actions.\n * Matches the shape accepted by `prepareSession`.\n *\n * Example:\n * ```\n * {\n * kv: {\n * \"com.listen.app/\": [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]\n * },\n * sql: {\n * \"com.listen.app/data.sqlite\": [\"tinycloud.sql/read\"]\n * }\n * }\n * ```\n */\n abilities: z.record(z.string(), z.record(z.string(), z.array(z.string()))),\n /** Expiration time in seconds since Unix epoch */\n expirationSecs: z.number(),\n /** Optional not-before time in seconds since Unix epoch */\n notBeforeSecs: z.number().optional(),\n});\n\nexport type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;\n\n/**\n * Result from the createDelegation WASM function.\n *\n * A single UCAN may cover multiple resources. The `resources` array\n * describes every `(service, space, path, actions)` entry granted, in\n * deterministic (service, path) lexicographic order (the Rust side sorts\n * the HashMap entries before signing).\n */\nexport const CreateDelegationWasmResultSchema = z.object({\n /** Base64url-encoded UCAN delegation */\n delegation: z.string(),\n /** CID of the delegation */\n cid: z.string(),\n /** DID of the delegate */\n delegateDID: z.string(),\n /** Expiration time */\n expiry: z.coerce.date(),\n /**\n * All (service, space, path, actions) entries granted by this delegation.\n * Always non-empty on success.\n */\n resources: z.array(DelegatedResourceSchema),\n});\n\nexport type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates a Delegation object and returns a Result.\n */\nexport function validateDelegation(data: unknown): Result<Delegation, DelegationError> {\n const result = DelegationSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates a CreateDelegationParams object and returns a Result.\n */\nexport function validateCreateDelegationParams(\n data: unknown\n): Result<CreateDelegationParams, DelegationError> {\n const result = CreateDelegationParamsSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates a DelegationFilters object and returns a Result.\n */\nexport function validateDelegationFilters(\n data: unknown\n): Result<DelegationFilters, DelegationError> {\n const result = DelegationFiltersSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates a ShareLink object and returns a Result.\n */\nexport function validateShareLink(data: unknown): Result<ShareLink, DelegationError> {\n const result = ShareLinkSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Generic validation function factory.\n */\nexport function createValidator<T>(\n schema: z.ZodType<T>\n): (data: unknown) => Result<T, DelegationError> {\n return (data: unknown): Result<T, DelegationError> => {\n const result = schema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n };\n}\n","/**\n * Default lifetimes for the various delegation shapes the SDK mints.\n *\n * The SDK has many delegation flows (session sign-in, runtime grants,\n * share links, manifest installs, public-space sub-delegations, …) and\n * each one used to pick its own number freehand. That made it hard to\n * tell whether a chosen value was deliberate or copy-pasted, and made\n * silent inconsistencies easy to ship.\n *\n * Every default below answers two questions:\n * - Who recovers if the delegation leaks? (re-auth, revocation, no one)\n * - Who is the principal at use time? (issuer, third party)\n *\n * The five tiers fall out of those answers. Pick a tier, not a number,\n * when introducing a new delegation surface.\n *\n * @packageDocumentation\n */\n\n/**\n * Auto-refreshable, never user-visible. The SDK can re-derive these\n * transparently from the active session. Lifetime exists only to bound\n * replay if the wire format leaks.\n *\n * Use for: public-space sub-delegations, internal capability re-derivations.\n */\nconst EPHEMERAL_MS = 60 * 60 * 1000; // 1 hour\n\n/**\n * Short-lived bearer URLs for direct KV reads. Anyone holding the URL can\n * read the object until expiry, so the default is deliberately shorter than\n * delegation-style tiers. Callers can request a different TTL per URL.\n *\n * Use for: KV signed read URLs.\n */\nconst SIGNED_READ_URL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * The user's currently-active sign-in session. Recovery is trivial\n * (re-sign-in). Length tracks how long the user/agent is expected to\n * be working without re-prompt.\n *\n * Use for: TinyCloudNode session expiry, runtime permission grants\n * (which are capped by the session anyway).\n */\nconst SESSION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Ad-hoc third-party delegations the caller often forgets to revoke.\n * Default sized so a forgotten share link prunes itself within a week\n * rather than living forever; callers pass longer for known recipients.\n *\n * Use for: SharingService share links, DelegationManager defaults,\n * SpaceService server-response fallback.\n */\nconst SHARE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Manifest-declared delegations for installed apps. Long enough that\n * monthly re-prompts feel like maintenance, short enough that\n * abandoning an app prunes its access.\n *\n * Use for: manifest `expiry` defaults.\n */\nconst APP_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\n/**\n * Hard ceiling for caller-supplied expiry. Effectively \"forever\" — the\n * constant exists primarily to guard against integer overflow / typo'd\n * input, not as a security policy lever. Long-lived API-token-style\n * delegations are a first-class use case; revocation is the right\n * control for them.\n */\nconst MAX_MS = 10 * 365 * 24 * 60 * 60 * 1000; // 10 years\n\nexport const EXPIRY = {\n EPHEMERAL_MS,\n SIGNED_READ_URL_MS,\n SESSION_MS,\n SHARE_MS,\n APP_MS,\n MAX_MS,\n} as const;\n\nexport const DEFAULT_SIGNED_READ_URL_EXPIRY_MS = EXPIRY.SIGNED_READ_URL_MS;\n\nexport type ExpiryTier = keyof typeof EXPIRY;\n","import {\n err,\n ok,\n serviceError,\n type IDatabaseHandle,\n type IKVService,\n type QueryResponse,\n type Result,\n type ServiceError,\n type SqlValue,\n} from \"@tinycloud/sdk-services\";\nimport {\n ACCOUNT_REGISTRY_PATH,\n composeManifestRequest,\n type Manifest,\n} from \"../manifest\";\nimport { ACCOUNT_INDEX_SCHEMA } from \"@tinycloud/bootstrap\";\nimport type {\n AccountDelegationPage,\n AccountDelegationQueryOptions,\n Delegation,\n DelegationRevocationReceipt,\n SpaceInfo,\n} from \"../delegations/types\";\nimport type { DelegationManager } from \"../delegations/DelegationManager\";\nimport type { ISpaceService } from \"../spaces/SpaceService\";\n\nconst SERVICE_NAME = \"account\";\nconst ACCOUNT_INDEX_DB = \"account\";\nconst ACCOUNT_INDEX_NAMESPACE = \"tinycloud.account.index\";\nconst ACCOUNT_SPACES_PATH = \"spaces/\";\n\nexport interface AccountApplication {\n appId: string;\n manifests: Manifest[];\n updatedAt?: string;\n name?: string;\n description?: string;\n manifestHash?: string;\n}\n\nexport interface AccountSpace {\n spaceId: string;\n name: string;\n ownerDid: string;\n type: \"owned\" | \"delegated\" | \"discovered\";\n permissions: string[];\n status: \"active\" | \"archived\";\n registeredAt?: string;\n updatedAt?: string;\n expiresAt?: Date;\n}\n\nexport interface AccountDelegation {\n cid: string;\n direction: \"granted\" | \"received\";\n spaceId: string;\n spaceName?: string;\n counterpartyDid: string;\n delegateDid: string;\n delegatorDid?: string;\n path: string;\n actions: string[];\n expiry: Date;\n status: \"active\" | \"expired\" | \"revoked\";\n createdAt?: Date;\n}\n\nexport interface AccountStatus {\n did: string;\n host: string;\n primarySpaceId?: string;\n accountSpaceId?: string;\n applications: number;\n spaces: number;\n grantedDelegations: number;\n receivedDelegations: number;\n}\n\nexport interface AccountIndexRebuildResult {\n database: string;\n applications: number;\n spaces: number;\n delegations: number;\n syncedAt: string;\n}\n\nexport interface AccountIndexEnsureResult {\n database: string;\n}\n\nexport interface AccountIndexedReadOptions {\n preferIndex?: boolean;\n refreshIndex?: boolean;\n}\n\nexport type AccountApplicationListOptions = AccountIndexedReadOptions;\n\nexport type AccountSpaceListOptions = AccountIndexedReadOptions;\n\nexport interface AccountDelegationListOptions {\n direction?: \"granted\" | \"received\" | \"all\";\n space?: string;\n preferIndex?: boolean;\n refreshIndex?: boolean;\n}\n\nexport interface AccountDelegationRevokeOptions {\n cid: string;\n space: string;\n}\n\nexport interface AccountServiceConfig {\n getDid: () => string;\n getHost: () => string;\n getPrimarySpaceId: () => string | undefined;\n getAccountSpaceId: () => string | undefined;\n getSpaces: () => ISpaceService;\n getDelegationManager?: () => Pick<DelegationManager, \"query\" | \"revoke\">;\n getAccountDb?: () => IDatabaseHandle | undefined;\n ensureAccountSpaceHosted?: () => Promise<void>;\n}\n\nexport class AccountService {\n constructor(private readonly config: AccountServiceConfig) {}\n\n async status(): Promise<Result<AccountStatus>> {\n const apps = await this.applications.list();\n if (!apps.ok) return apps;\n\n const delegations = await this.delegations.list();\n if (!delegations.ok) return delegations;\n\n const spaces = await this.spaces.list();\n if (!spaces.ok) return spaces;\n\n return ok({\n did: this.config.getDid(),\n host: this.config.getHost(),\n primarySpaceId: this.config.getPrimarySpaceId(),\n accountSpaceId: this.config.getAccountSpaceId(),\n applications: apps.data.length,\n spaces: spaces.data.length,\n grantedDelegations: delegations.data.filter((d) => d.direction === \"granted\").length,\n receivedDelegations: delegations.data.filter((d) => d.direction === \"received\").length,\n });\n }\n\n readonly applications = {\n list: async (options: AccountApplicationListOptions = {}): Promise<Result<AccountApplication[]>> => {\n if (options.preferIndex) {\n const indexed = await this.index.applications.list();\n if (indexed.ok && indexed.data.length > 0) return indexed;\n if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;\n\n const canonical = await this.applications.list();\n if (canonical.ok && options.refreshIndex !== false) {\n await this.replaceApplicationsIndexQuietly(canonical.data);\n }\n return canonical;\n }\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const listed = await kvResult.data.list({ prefix: ACCOUNT_REGISTRY_PATH });\n if (!listed.ok) return accountErr(listed.error);\n\n const applications: AccountApplication[] = [];\n for (const key of listed.data.keys) {\n const loaded = await kvResult.data.get<StoredApplicationRecord>(key);\n if (!loaded.ok) return accountErr(loaded.error);\n applications.push(applicationFromRecord(key, loaded.data.data));\n }\n\n applications.sort((a, b) => a.appId.localeCompare(b.appId));\n return ok(applications);\n },\n\n get: async (appId: string): Promise<Result<AccountApplication>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const key = applicationKey(appId);\n const loaded = await kvResult.data.get<StoredApplicationRecord>(key);\n if (!loaded.ok) return accountErr(loaded.error);\n return ok(applicationFromRecord(key, loaded.data.data));\n },\n\n register: async (manifest: Manifest | Manifest[]): Promise<Result<AccountApplication>> => {\n const manifests = Array.isArray(manifest) ? manifest : [manifest];\n const request = composeManifestRequest(manifests);\n if (request.registryRecords.length === 0) {\n return err(\n serviceError(\n \"INVALID_MANIFEST\",\n \"Manifest did not produce an account application registry record\",\n SERVICE_NAME,\n ),\n );\n }\n\n await this.config.ensureAccountSpaceHosted?.();\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n let registered: AccountApplication | undefined;\n for (const record of request.registryRecords) {\n const manifestHash = hashJson(record.manifests);\n if (await this.indexHasApplicationHash(record.app_id, manifestHash)) {\n registered = {\n appId: record.app_id,\n manifests: record.manifests,\n manifestHash,\n name: record.manifests[0]?.name,\n description: record.manifests[0]?.description,\n };\n continue;\n }\n\n const stored = {\n app_id: record.app_id,\n manifests: record.manifests,\n manifest_hash: manifestHash,\n updated_at: new Date().toISOString(),\n };\n const written = await kvResult.data.put(record.key, stored);\n if (!written.ok) return accountErr(written.error);\n registered = applicationFromRecord(record.key, stored);\n await this.upsertApplicationIndexQuietly(registered);\n }\n\n return ok(registered!);\n },\n\n remove: async (appId: string): Promise<Result<void>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const removed = await kvResult.data.delete(applicationKey(appId));\n if (!removed.ok) return accountErr(removed.error);\n await this.deleteApplicationIndexQuietly(appId);\n return ok(undefined);\n },\n };\n\n readonly spaces = {\n list: async (options: AccountSpaceListOptions = {}): Promise<Result<AccountSpace[]>> => {\n if (options.preferIndex) {\n const indexed = await this.index.spaces.list();\n if (indexed.ok && indexed.data.length > 0) return indexed;\n if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;\n\n const canonical = await this.spaces.syncAccessible();\n if (canonical.ok && options.refreshIndex !== false) {\n await this.replaceSpacesIndexQuietly(canonical.data);\n }\n return canonical;\n }\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const listed = await kvResult.data.list({ prefix: ACCOUNT_SPACES_PATH });\n if (!listed.ok) return accountErr(listed.error);\n\n const spaces: AccountSpace[] = [];\n for (const key of listed.data.keys) {\n const loaded = await kvResult.data.get<StoredSpaceRecord>(key);\n if (!loaded.ok) return accountErr(loaded.error);\n spaces.push(spaceFromRecord(key, loaded.data.data));\n }\n\n spaces.sort((a, b) => a.name.localeCompare(b.name) || a.spaceId.localeCompare(b.spaceId));\n return ok(spaces);\n },\n\n get: async (spaceId: string): Promise<Result<AccountSpace>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const loaded = await kvResult.data.get<StoredSpaceRecord>(spaceKey(spaceId));\n if (!loaded.ok) return accountErr(loaded.error);\n return ok(spaceFromRecord(spaceKey(spaceId), loaded.data.data));\n },\n\n register: async (space: SpaceInfo | AccountSpace): Promise<Result<AccountSpace>> => {\n await this.config.ensureAccountSpaceHosted?.();\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const stored = spaceRecordFromInput(space);\n const written = await kvResult.data.put(spaceKey(stored.space_id), stored);\n if (!written.ok) return accountErr(written.error);\n\n const registered = spaceFromRecord(spaceKey(stored.space_id), stored);\n await this.upsertSpaceIndexQuietly(registered);\n return ok(registered);\n },\n\n syncAccessible: async (): Promise<Result<AccountSpace[]>> => {\n const listed = await this.config.getSpaces().list();\n if (!listed.ok) return accountErr(listed.error);\n\n const registered: AccountSpace[] = [];\n for (const space of listed.data) {\n const result = await this.spaces.register(space);\n if (!result.ok) return result;\n registered.push(result.data);\n }\n return ok(registered);\n },\n\n remove: async (spaceId: string): Promise<Result<void>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const removed = await kvResult.data.delete(spaceKey(spaceId));\n if (!removed.ok) return accountErr(removed.error);\n await this.deleteSpaceIndexQuietly(spaceId);\n return ok(undefined);\n },\n };\n\n readonly delegations = {\n query: async (\n options: AccountDelegationQueryOptions = {},\n ): Promise<Result<AccountDelegationPage>> => {\n const manager = this.config.getDelegationManager?.();\n if (!manager) {\n return err(serviceError(\n \"NOT_INITIALIZED\",\n \"Delegation history requires an authenticated delegation manager\",\n SERVICE_NAME,\n ));\n }\n const queried = await manager.query(options);\n return queried.ok ? ok(queried.data) : accountErr(queried.error);\n },\n\n list: async (\n options: AccountDelegationListOptions = {},\n ): Promise<Result<AccountDelegation[]>> => {\n if (options.preferIndex) {\n const indexed = await this.index.delegations.list(options);\n if (indexed.ok && indexed.data.length > 0) return indexed;\n if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;\n\n const live = await this.delegations.list({\n direction: options.direction,\n space: options.space,\n });\n if (live.ok && options.refreshIndex !== false) {\n await this.replaceDelegationsIndexQuietly(live.data);\n }\n return live;\n }\n\n const spaces = await this.config.getSpaces().list();\n if (!spaces.ok) return accountErr(spaces.error);\n\n const targetSpaces = options.space\n ? spaces.data.filter((space) => space.id === options.space || space.name === options.space)\n : spaces.data;\n\n const delegations: AccountDelegation[] = [];\n for (const space of targetSpaces) {\n const scoped = this.config.getSpaces().get(space.id).delegations;\n\n if (options.direction !== \"received\") {\n const granted = await scoped.list();\n if (!granted.ok) return accountErr(granted.error);\n delegations.push(...granted.data.map((d) => mapDelegation(d, space, \"granted\")));\n }\n\n if (options.direction !== \"granted\") {\n const received = await scoped.listReceived();\n if (!received.ok) return accountErr(received.error);\n delegations.push(...received.data.map((d) => mapDelegation(d, space, \"received\")));\n }\n }\n\n delegations.sort((a, b) => a.spaceId.localeCompare(b.spaceId) || a.cid.localeCompare(b.cid));\n return ok(delegations);\n },\n\n revoke: async (\n input: string | AccountDelegationRevokeOptions,\n ): Promise<Result<DelegationRevocationReceipt | void>> => {\n const cid = typeof input === \"string\" ? input : input.cid;\n const manager = this.config.getDelegationManager?.();\n if (manager) {\n const revoked = await manager.revoke(cid);\n return revoked.ok ? ok(revoked.data) : accountErr(revoked.error);\n }\n\n // Deprecated compatibility path for callers constructing AccountService directly.\n if (typeof input === \"string\") {\n return err(serviceError(\n \"NOT_INITIALIZED\",\n \"CID-only revocation requires an authenticated delegation manager\",\n SERVICE_NAME,\n ));\n }\n const space = await this.resolveSpace(input.space);\n if (!space.ok) return space;\n const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(cid);\n if (!revoked.ok) return accountErr(revoked.error);\n return ok(undefined);\n },\n };\n\n readonly index = {\n ensure: async (): Promise<Result<AccountIndexEnsureResult>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n return ok({ database: ACCOUNT_INDEX_DB });\n },\n\n rebuild: async (): Promise<Result<AccountIndexRebuildResult>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const applications = await this.applications.list();\n if (!applications.ok) return applications;\n\n const spaces = await this.spaces.list();\n if (!spaces.ok) return spaces;\n\n const delegations = await this.delegations.list();\n if (!delegations.ok) return delegations;\n\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const statements = [\n { sql: \"DELETE FROM applications\" },\n { sql: \"DELETE FROM application_state\" },\n { sql: \"DELETE FROM spaces\" },\n { sql: \"DELETE FROM delegations\" },\n { sql: \"DELETE FROM sync_state\" },\n ...applications.data.map((app) => ({\n sql:\n \"INSERT INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)\",\n params: [\n app.appId,\n app.name ?? null,\n app.description ?? null,\n app.updatedAt ?? syncedAt,\n JSON.stringify(app.manifests),\n ],\n })),\n ...applications.data.map((app) => ({\n sql:\n \"INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)\",\n params: [app.appId, app.manifestHash ?? hashJson(app.manifests), syncedAt],\n })),\n ...spaces.data.map((space) => ({\n sql:\n \"INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n space.spaceId,\n space.name,\n space.ownerDid,\n space.type,\n JSON.stringify(space.permissions),\n space.status,\n space.registeredAt ?? syncedAt,\n space.updatedAt ?? syncedAt,\n space.expiresAt?.toISOString() ?? null,\n ],\n })),\n ...delegations.data.map((delegation) => ({\n sql:\n \"INSERT INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n delegation.cid,\n delegation.direction,\n delegation.spaceId,\n delegation.spaceName ?? null,\n delegation.counterpartyDid,\n delegation.delegateDid,\n delegation.delegatorDid ?? null,\n delegation.path,\n JSON.stringify(delegation.actions),\n delegation.expiry.toISOString(),\n delegation.status,\n delegation.createdAt?.toISOString() ?? null,\n syncedAt,\n ],\n })),\n {\n sql: \"INSERT INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"applications\", syncedAt, applications.data.length],\n },\n {\n sql: \"INSERT INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"spaces\", syncedAt, spaces.data.length],\n },\n {\n sql: \"INSERT INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"delegations\", syncedAt, delegations.data.length],\n },\n ];\n\n const rebuilt = await dbResult.data.batch(statements);\n if (!rebuilt.ok) return accountErr(rebuilt.error);\n\n return ok({\n database: ACCOUNT_INDEX_DB,\n applications: applications.data.length,\n spaces: spaces.data.length,\n delegations: delegations.data.length,\n syncedAt,\n });\n },\n\n applications: {\n list: async (): Promise<Result<AccountApplication[]>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const queried = await dbResult.data.query<string | null>(\n \"SELECT applications.app_id, name, description, updated_at, manifest_json, application_state.manifest_hash FROM applications LEFT JOIN application_state ON applications.app_id = application_state.app_id ORDER BY applications.app_id\",\n );\n if (!queried.ok) return accountErr(queried.error);\n\n return ok((queried.data.rows as unknown as IndexedApplicationRow[]).map(indexedApplicationFromRow));\n },\n },\n\n spaces: {\n list: async (): Promise<Result<AccountSpace[]>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const queried = await dbResult.data.query<string | null>(\n \"SELECT space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at FROM spaces ORDER BY name, space_id\",\n );\n if (!queried.ok) return accountErr(queried.error);\n\n return ok((queried.data.rows as unknown as IndexedSpaceRow[]).map(indexedSpaceFromRow));\n },\n },\n\n delegations: {\n list: async (\n options: AccountDelegationListOptions = {},\n ): Promise<Result<AccountDelegation[]>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const where: string[] = [];\n const params: SqlValue[] = [];\n if (options.direction && options.direction !== \"all\") {\n where.push(\"direction = ?\");\n params.push(options.direction);\n }\n if (options.space) {\n where.push(\"(space_id = ? OR space_name = ?)\");\n params.push(options.space, options.space);\n }\n\n const queried = await dbResult.data.query<string | null>(\n `SELECT cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at FROM delegations${\n where.length > 0 ? ` WHERE ${where.join(\" AND \")}` : \"\"\n } ORDER BY space_id, cid`,\n params,\n );\n if (!queried.ok) return accountErr(queried.error);\n\n return ok((queried.data.rows as unknown as IndexedDelegationRow[]).map(indexedDelegationFromRow));\n },\n },\n\n query: async <T = Record<string, unknown>>(\n sql: string,\n params?: SqlValue[],\n ): Promise<Result<QueryResponse<T>>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n const queried = await dbResult.data.query<T>(sql, params);\n if (!queried.ok) return accountErr(queried.error);\n return ok(queried.data);\n },\n\n status: async (): Promise<Result<AccountIndexStatus>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n const queried = await dbResult.data.query<string | number>(\n \"SELECT source, synced_at, count FROM sync_state ORDER BY source\",\n );\n if (!queried.ok) {\n if (isMissingIndexError(queried.error)) {\n return ok({ database: ACCOUNT_INDEX_DB, state: \"missing\", sources: [] });\n }\n return accountErr(queried.error);\n }\n return ok({\n database: ACCOUNT_INDEX_DB,\n state: \"ready\",\n sources: (queried.data.rows as unknown as IndexedSyncStateRow[]).map(([source, syncedAt, count]) => ({\n source,\n syncedAt,\n count,\n })),\n });\n },\n };\n\n private accountKV(): Result<IKVService> {\n const accountSpaceId = this.config.getAccountSpaceId();\n if (!accountSpaceId) {\n return err(\n serviceError(\n \"ACCOUNT_SPACE_UNAVAILABLE\",\n \"Account space is unavailable. Sign in with a wallet-backed profile first.\",\n SERVICE_NAME,\n ),\n );\n }\n return ok(this.config.getSpaces().get(accountSpaceId).kv);\n }\n\n private accountDb(): Result<IDatabaseHandle> {\n const db = this.config.getAccountDb?.();\n if (!db) {\n return err(\n serviceError(\n \"ACCOUNT_INDEX_UNAVAILABLE\",\n \"Account index database is unavailable. Sign in with a wallet-backed profile first.\",\n SERVICE_NAME,\n ),\n );\n }\n return ok(db);\n }\n\n private async indexHasApplicationHash(appId: string, manifestHash: string): Promise<boolean> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return false;\n\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return false;\n\n const queried = await dbResult.data.query<string>(\n \"SELECT 1 FROM application_state WHERE app_id = ? AND manifest_hash = ? LIMIT 1\",\n [appId, manifestHash],\n );\n return queried.ok && queried.data.rows.length > 0;\n }\n\n private async upsertApplicationIndexQuietly(app: AccountApplication): Promise<void> {\n await ignoreIndexFailure(() => this.upsertApplicationIndex(app));\n }\n\n private async upsertApplicationIndex(app: AccountApplication): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const updatedAt = app.updatedAt ?? new Date().toISOString();\n const manifestHash = app.manifestHash ?? hashJson(app.manifests);\n const written = await dbResult.data.batch([\n {\n sql:\n \"INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)\",\n params: [\n app.appId,\n app.name ?? null,\n app.description ?? null,\n updatedAt,\n JSON.stringify(app.manifests),\n ],\n },\n {\n sql:\n \"INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)\",\n params: [app.appId, manifestHash, updatedAt],\n },\n ]);\n if (!written.ok) return accountErr(written.error);\n return ok(undefined);\n }\n\n private async deleteApplicationIndexQuietly(appId: string): Promise<void> {\n await ignoreIndexFailure(() => this.deleteApplicationIndex(appId));\n }\n\n private async deleteApplicationIndex(appId: string): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const deleted = await dbResult.data.batch([\n { sql: \"DELETE FROM applications WHERE app_id = ?\", params: [appId] },\n { sql: \"DELETE FROM application_state WHERE app_id = ?\", params: [appId] },\n ]);\n if (!deleted.ok) return accountErr(deleted.error);\n return ok(undefined);\n }\n\n private async upsertSpaceIndexQuietly(space: AccountSpace): Promise<void> {\n await ignoreIndexFailure(() => this.upsertSpaceIndex(space));\n }\n\n private async upsertSpaceIndex(space: AccountSpace): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const updatedAt = space.updatedAt ?? new Date().toISOString();\n const written = await dbResult.data.batch([\n {\n sql:\n \"INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n space.spaceId,\n space.name,\n space.ownerDid,\n space.type,\n JSON.stringify(space.permissions),\n space.status,\n space.registeredAt ?? updatedAt,\n updatedAt,\n space.expiresAt?.toISOString() ?? null,\n ],\n },\n ]);\n if (!written.ok) return accountErr(written.error);\n return ok(undefined);\n }\n\n private async deleteSpaceIndexQuietly(spaceId: string): Promise<void> {\n await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));\n }\n\n private async deleteSpaceIndex(spaceId: string): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const deleted = await dbResult.data.batch([\n { sql: \"DELETE FROM spaces WHERE space_id = ?\", params: [spaceId] },\n ]);\n if (!deleted.ok) return accountErr(deleted.error);\n return ok(undefined);\n }\n\n private async resolveSpace(space: string): Promise<Result<SpaceInfo>> {\n const listed = await this.config.getSpaces().list();\n if (!listed.ok) return accountErr(listed.error);\n\n const found = listed.data.find((candidate) => candidate.id === space || candidate.name === space);\n if (!found) {\n return err(\n serviceError(\"SPACE_NOT_FOUND\", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME),\n );\n }\n return ok(found);\n }\n\n private async replaceApplicationsIndexQuietly(applications: AccountApplication[]): Promise<void> {\n await ignoreIndexFailure(async () => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return;\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return;\n\n await dbResult.data.batch([\n { sql: \"DELETE FROM applications\" },\n { sql: \"DELETE FROM application_state\" },\n ...applications.map((app) => ({\n sql:\n \"INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)\",\n params: [\n app.appId,\n app.name ?? null,\n app.description ?? null,\n app.updatedAt ?? syncedAt,\n JSON.stringify(app.manifests),\n ],\n })),\n ...applications.map((app) => ({\n sql:\n \"INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)\",\n params: [app.appId, app.manifestHash ?? hashJson(app.manifests), syncedAt],\n })),\n {\n sql: \"INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"applications\", syncedAt, applications.length],\n },\n ]);\n });\n }\n\n private async replaceSpacesIndexQuietly(spaces: AccountSpace[]): Promise<void> {\n await ignoreIndexFailure(async () => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return;\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return;\n\n await dbResult.data.batch([\n { sql: \"DELETE FROM spaces\" },\n ...spaces.map((space) => ({\n sql:\n \"INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n space.spaceId,\n space.name,\n space.ownerDid,\n space.type,\n JSON.stringify(space.permissions),\n space.status,\n space.registeredAt ?? syncedAt,\n space.updatedAt ?? syncedAt,\n space.expiresAt?.toISOString() ?? null,\n ],\n })),\n {\n sql: \"INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"spaces\", syncedAt, spaces.length],\n },\n ]);\n });\n }\n\n private async replaceDelegationsIndexQuietly(delegations: AccountDelegation[]): Promise<void> {\n await ignoreIndexFailure(async () => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return;\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return;\n\n await dbResult.data.batch([\n { sql: \"DELETE FROM delegations\" },\n ...delegations.map((delegation) => ({\n sql:\n \"INSERT OR REPLACE INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n delegation.cid,\n delegation.direction,\n delegation.spaceId,\n delegation.spaceName ?? null,\n delegation.counterpartyDid,\n delegation.delegateDid,\n delegation.delegatorDid ?? null,\n delegation.path,\n JSON.stringify(delegation.actions),\n delegation.expiry.toISOString(),\n delegation.status,\n delegation.createdAt?.toISOString() ?? null,\n syncedAt,\n ],\n })),\n {\n sql: \"INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"delegations\", syncedAt, delegations.length],\n },\n ]);\n });\n }\n\n private async ensureAccountIndex(db: IDatabaseHandle): Promise<Result<void>> {\n const migrated = await db.migrations.apply({\n namespace: ACCOUNT_INDEX_NAMESPACE,\n migrations: [\n {\n id: \"001_initial\",\n sql: [...ACCOUNT_INDEX_SCHEMA],\n },\n ],\n });\n if (!migrated.ok) return accountErr(migrated.error);\n return ok(undefined);\n }\n}\n\ninterface StoredApplicationRecord {\n app_id?: string;\n appId?: string;\n manifests?: Manifest[];\n manifest_hash?: string;\n manifestHash?: string;\n updated_at?: string;\n updatedAt?: string;\n}\n\nfunction applicationKey(appId: string): string {\n return `${ACCOUNT_REGISTRY_PATH}${appId}`;\n}\n\nfunction appIdFromKey(key: string): string {\n return key.startsWith(ACCOUNT_REGISTRY_PATH) ? key.slice(ACCOUNT_REGISTRY_PATH.length) : key;\n}\n\nfunction applicationFromRecord(key: string, record: StoredApplicationRecord): AccountApplication {\n const manifests = Array.isArray(record.manifests) ? record.manifests : [];\n const first = manifests[0];\n return {\n appId: record.app_id ?? record.appId ?? first?.app_id ?? appIdFromKey(key),\n manifests,\n updatedAt: record.updated_at ?? record.updatedAt,\n name: first?.name,\n description: first?.description,\n manifestHash: record.manifest_hash ?? record.manifestHash ?? hashJson(manifests),\n };\n}\n\ntype IndexedApplicationRow = [string, string | null, string | null, string | null, string, string | null];\n\nfunction indexedApplicationFromRow(row: IndexedApplicationRow): AccountApplication {\n const [appId, name, description, updatedAt, manifestJson, manifestHash] = row;\n return {\n appId,\n name: name ?? undefined,\n description: description ?? undefined,\n updatedAt: updatedAt ?? undefined,\n manifests: JSON.parse(manifestJson) as Manifest[],\n manifestHash: manifestHash ?? undefined,\n };\n}\n\ninterface StoredSpaceRecord {\n space_id?: string;\n spaceId?: string;\n name?: string;\n owner_did?: string;\n ownerDid?: string;\n owner?: string;\n type?: \"owned\" | \"delegated\" | \"discovered\";\n permissions?: string[];\n status?: \"active\" | \"archived\";\n registered_at?: string;\n registeredAt?: string;\n updated_at?: string;\n updatedAt?: string;\n expires_at?: string;\n expiresAt?: string | Date;\n}\n\nfunction spaceKey(spaceId: string): string {\n return `${ACCOUNT_SPACES_PATH}${spaceId}`;\n}\n\nfunction spaceIdFromKey(key: string): string {\n return key.startsWith(ACCOUNT_SPACES_PATH) ? key.slice(ACCOUNT_SPACES_PATH.length) : key;\n}\n\nfunction spaceRecordFromInput(space: SpaceInfo | AccountSpace): Required<Pick<StoredSpaceRecord, \"space_id\" | \"name\" | \"owner_did\" | \"type\" | \"permissions\" | \"status\" | \"updated_at\">> &\n StoredSpaceRecord {\n const now = new Date().toISOString();\n const accountSpace: AccountSpace = \"spaceId\" in space\n ? space\n : {\n spaceId: space.id,\n name: space.name ?? space.id.split(\":\").pop() ?? space.id,\n ownerDid: space.owner ?? \"\",\n type: (space.type ?? \"discovered\") as AccountSpace[\"type\"],\n permissions: space.permissions ?? [],\n status: \"active\" as const,\n expiresAt: space.expiresAt,\n };\n\n return {\n space_id: accountSpace.spaceId,\n name: accountSpace.name,\n owner_did: accountSpace.ownerDid,\n type: accountSpace.type,\n permissions: accountSpace.permissions,\n status: accountSpace.status,\n registered_at: accountSpace.registeredAt ?? now,\n updated_at: now,\n expires_at: accountSpace.expiresAt instanceof Date\n ? accountSpace.expiresAt.toISOString()\n : accountSpace.expiresAt,\n };\n}\n\nfunction spaceFromRecord(key: string, record: StoredSpaceRecord): AccountSpace {\n const expiresAt = record.expires_at ?? record.expiresAt;\n return {\n spaceId: record.space_id ?? record.spaceId ?? spaceIdFromKey(key),\n name: record.name ?? spaceIdFromKey(key).split(\":\").pop() ?? spaceIdFromKey(key),\n ownerDid: record.owner_did ?? record.ownerDid ?? record.owner ?? \"\",\n type: record.type ?? \"discovered\",\n permissions: Array.isArray(record.permissions) ? record.permissions : [],\n status: record.status ?? \"active\",\n registeredAt: record.registered_at ?? record.registeredAt,\n updatedAt: record.updated_at ?? record.updatedAt,\n expiresAt: expiresAt ? new Date(expiresAt) : undefined,\n };\n}\n\ntype IndexedSpaceRow = [string, string, string, \"owned\" | \"delegated\" | \"discovered\", string, \"active\" | \"archived\", string | null, string, string | null];\n\nfunction indexedSpaceFromRow(row: IndexedSpaceRow): AccountSpace {\n const [spaceId, name, ownerDid, type, permissionsJson, status, registeredAt, updatedAt, expiresAt] = row;\n return {\n spaceId,\n name,\n ownerDid,\n type,\n permissions: JSON.parse(permissionsJson) as string[],\n status,\n registeredAt: registeredAt ?? undefined,\n updatedAt,\n expiresAt: expiresAt ? new Date(expiresAt) : undefined,\n };\n}\n\nfunction hashJson(value: unknown): string {\n const input = stableJson(value);\n let hash = 0xcbf29ce484222325n;\n const prime = 0x100000001b3n;\n for (let index = 0; index < input.length; index += 1) {\n hash ^= BigInt(input.charCodeAt(index));\n hash = BigInt.asUintN(64, hash * prime);\n }\n return hash.toString(16).padStart(16, \"0\");\n}\n\nfunction stableJson(value: unknown): string {\n if (value === null || typeof value !== \"object\") {\n return JSON.stringify(value);\n }\n if (Array.isArray(value)) {\n return `[${value.map(stableJson).join(\",\")}]`;\n }\n const object = value as Record<string, unknown>;\n return `{${Object.keys(object)\n .sort()\n .map((key) => `${JSON.stringify(key)}:${stableJson(object[key])}`)\n .join(\",\")}}`;\n}\n\nexport interface AccountIndexStatus {\n database: string;\n state: \"ready\" | \"missing\";\n sources: Array<{\n source: string;\n syncedAt: string;\n count: number;\n }>;\n}\n\ntype IndexedSyncStateRow = [string, string, number];\n\ntype IndexedDelegationRow = [\n string,\n \"granted\" | \"received\",\n string,\n string | null,\n string,\n string,\n string | null,\n string,\n string,\n string,\n \"active\" | \"expired\" | \"revoked\",\n string | null,\n];\n\nfunction indexedDelegationFromRow(row: IndexedDelegationRow): AccountDelegation {\n const [\n cid,\n direction,\n spaceId,\n spaceName,\n counterpartyDid,\n delegateDid,\n delegatorDid,\n path,\n actionsJson,\n expiry,\n status,\n createdAt,\n ] = row;\n return {\n cid,\n direction,\n spaceId,\n spaceName: spaceName ?? undefined,\n counterpartyDid,\n delegateDid,\n delegatorDid: delegatorDid ?? undefined,\n path,\n actions: JSON.parse(actionsJson) as string[],\n expiry: new Date(expiry),\n status,\n createdAt: createdAt ? new Date(createdAt) : undefined,\n };\n}\n\nfunction mapDelegation(\n delegation: Delegation,\n space: SpaceInfo,\n direction: \"granted\" | \"received\",\n): AccountDelegation {\n return {\n cid: delegation.cid,\n direction,\n spaceId: delegation.spaceId || space.id,\n spaceName: space.name,\n counterpartyDid:\n direction === \"granted\"\n ? delegation.delegateDID\n : delegation.delegatorDID ?? delegation.delegateDID,\n delegateDid: delegation.delegateDID,\n delegatorDid: delegation.delegatorDID,\n path: delegation.path,\n actions: delegation.actions,\n expiry: delegation.expiry,\n status: delegation.isRevoked\n ? \"revoked\"\n : delegation.expiry.getTime() <= Date.now()\n ? \"expired\"\n : \"active\",\n createdAt: delegation.createdAt,\n };\n}\n\nfunction accountErr(error: ServiceError): Result<never> {\n return err(serviceError(error.code, error.message, SERVICE_NAME, { cause: error.cause, meta: error.meta }));\n}\n\nfunction isMissingIndexError(error: ServiceError): boolean {\n return /no such table:/i.test(error.message);\n}\n\nasync function ignoreIndexFailure(task: () => Promise<unknown>): Promise<void> {\n try {\n await task();\n } catch {\n // The account index is a cache. Canonical reads/writes must not fail\n // because a best-effort cache update could not be applied.\n }\n}\n","/**\n * TinyCloud App Manifest\n *\n * A declarative description of an app's identity and the capabilities it\n * needs. The manifest drives the SIWE recap at sign-in time, enabling a\n * single wallet prompt that covers the app's own permissions plus any\n * pre-declared delegations.\n *\n * The SDK does NOT fetch external manifests. Apps compose their own manifest\n * (optionally including backend or agent addenda) before handing it to the\n * SDK.\n *\n * Canonical spec: `.claude/specs/manifest.md`.\n *\n * @packageDocumentation\n */\n\nimport ms from \"ms\";\nimport { resolveSecretPath, SECRET_NAME_RE } from \"@tinycloud/sdk-services\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * A single permission entry inside a manifest. This is the shape apps write\n * in their `manifest.json` and the shape we compare against when performing\n * the capability-subset derivability check in the delegation flow.\n *\n * `service` uses the long form (e.g. `\"tinycloud.kv\"`, `\"tinycloud.sql\"`).\n * `\"tinycloud.vault\"` is an SDK-only shorthand that expands to the KV\n * resources the vault service uses; it is never encoded as a recap service.\n */\nexport interface PermissionEntry {\n /** Service namespace, e.g. \"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.duckdb\", \"tinycloud.capabilities\". */\n service: string;\n /** Space name or full space URI. Defaults to \"applications\" inside manifests. */\n space?: string;\n /**\n * Service-specific path.\n * - tinycloud.kv: hierarchical prefix. \"/\" = all, \"foo/\" = prefix match, \"foo\" = exact key\n * - tinycloud.sql: database name/file (e.g. \"data.sqlite\") or \"/\" for all\n * - tinycloud.duckdb: database name/file\n * - tinycloud.capabilities: capability key URI or \"/\" for all\n */\n path: string;\n /**\n * Short action names (e.g. \"get\", \"put\", \"read\", \"schema\"). The SDK expands\n * these to full URNs (e.g. `tinycloud.kv/get`) during resolution.\n * Already-expanded URNs are passed through unchanged.\n */\n actions: string[];\n /** Exact ReCap caveat branches when this authority came from a signed ReCap. */\n caveats?: Record<string, unknown>[];\n /** When true, the manifest prefix is NOT prepended to `path`. Default false. */\n skipPrefix?: boolean;\n /** Per-entry expiry override, ms-format. */\n expiry?: string;\n /** User/agent-facing context for why this permission is requested. */\n description?: string;\n}\n\nexport type ManifestSecretActions =\n | true\n | string\n | string[]\n | {\n /** Actual vault secret name. Defaults to the manifest object key. */\n name?: string;\n /** Optional scoped secret namespace. Omit for global secrets. */\n scope?: string;\n actions?: string | string[];\n expiry?: string;\n description?: string;\n };\n\n/**\n * The valid values for `Manifest.defaults`.\n *\n * - `false` → no auto-included permissions\n * - `true` → standard tier (KV + SQL read/write + capabilities:read)\n * - `\"admin\"` → standard + SQL schema\n * - `\"all\"` → everything the SDK supports (including DuckDB)\n *\n * Unknown string values silently fall back to `true`. Values are normalized\n * (lowercase + trim) before matching.\n */\nexport type ManifestDefaults = boolean | \"admin\" | \"all\";\n\n/**\n * Agent-readable app knowledge bundle pointer.\n *\n * - `true` means the default root: `knowledge/index.md`\n * - string values must point at a markdown root under `knowledge/`\n */\nexport type ManifestKnowledge = true | string;\n\n/** Default root used when `manifest.knowledge === true`. */\nexport const DEFAULT_KNOWLEDGE_ROOT = \"knowledge/index.md\";\n\n/**\n * The raw manifest shape an app declares. See `.claude/specs/manifest.md`.\n */\nexport interface Manifest {\n /** Schema version. Optional, defaults to 1. */\n manifest_version?: 1;\n /** Application identifier / namespace prefix. Required. */\n app_id: string;\n /** Display name. Required. */\n name: string;\n /** Description of what the app or delegate does. Optional. */\n description?: string;\n /** DID of this manifest's delegate target. Optional. Required only for delegation materialization. */\n did?: string;\n /** URL to app icon. Optional. */\n icon?: string;\n /** App version string. Optional. */\n appVersion?: string;\n /** Default expiry for permissions. ms-format (\"30d\", \"2h\", \"1y\"). Default \"30d\". */\n expiry?: string;\n /** Space name or full space URI. Optional, defaults to \"applications\". */\n space?: string;\n /**\n * Path prefix auto-prepended to permission paths. Optional, defaults to\n * `app_id`. Set to `\"\"` to disable entirely. Individual permissions can opt\n * out with `skipPrefix: true`.\n */\n prefix?: string;\n /**\n * Default permission set to auto-include. Optional, defaults to `true`.\n * See {@link ManifestDefaults}.\n */\n defaults?: ManifestDefaults | string;\n /** Whether to include the public-space companion delegation. Default `true`. */\n includePublicSpace?: boolean;\n /** Agent-readable knowledge bundle root. `true` means `knowledge/index.md`. */\n knowledge?: ManifestKnowledge;\n /**\n * Additional permissions beyond the defaults. Use for cross-space access,\n * DuckDB (opt-in), or `skipPrefix: true` entries.\n */\n permissions?: PermissionEntry[];\n /**\n * Secret name shorthand. Entries resolve to encrypted vault KV resources in\n * the `secrets` space.\n */\n secrets?: Record<string, ManifestSecretActions>;\n}\n\n/**\n * A resolved permission entry with fully-expanded paths and action URNs.\n * This is the shape the delegation flow compares against parsed recap\n * capabilities, and the shape the session-key delegation path actually uses.\n */\nexport interface ResourceCapability {\n /** Long-form service, e.g. \"tinycloud.kv\". */\n service: string;\n /** Space name or URI. Short names are resolved to full SpaceIds at sign-in time. */\n space: string;\n /** Path with the manifest prefix applied (or skipped per `skipPrefix`). */\n path: string;\n /** Full-URN actions, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n actions: string[];\n /** Per-entry expiry override in milliseconds. */\n expiryMs?: number;\n /** User/agent-facing context copied from the source permission entry. */\n description?: string;\n}\n\n/**\n * A resolved delegation entry with fully-expanded permissions.\n */\nexport interface ResolvedDelegate {\n /** DID of the delegate. */\n did: string;\n /** Informational display name. Optional. */\n name?: string;\n /** Expiry in milliseconds (per-delegation > manifest default > 30 days). */\n expiryMs: number;\n /** Fully resolved permissions. */\n permissions: ResourceCapability[];\n}\n\n/**\n * The output of {@link resolveManifest}: a fully-expanded capability set\n * ready to drive the SIWE recap.\n */\nexport interface ResolvedCapabilities {\n /** Application identifier copied from manifest.app_id. */\n app_id: string;\n /** Delegate DID copied from manifest.did, when present. */\n did?: string;\n /** Effective default space for this manifest. */\n space: string;\n /** All session-key resources with paths fully resolved (prefix applied). */\n resources: ResourceCapability[];\n /** Default expiry for the session, in milliseconds. */\n expiryMs: number;\n /** Whether to include the public-space companion. */\n includePublicSpace: boolean;\n /** Delegate targets derived from manifests that declare `did`. */\n additionalDelegates: ResolvedDelegate[];\n}\n\nexport interface ManifestRegistryRecord {\n /** KV key inside the account space. */\n key: string;\n /** App id this record describes. */\n app_id: string;\n /** Latest manifest payloads composed for this app id. */\n manifests: Manifest[];\n}\n\nexport interface ComposeManifestOptions {\n /** Include implicit account-space registry permissions. Default true. */\n includeAccountRegistryPermissions?: boolean;\n}\n\nexport interface ComposedManifestRequest {\n /** Validated manifests that were composed. */\n manifests: Manifest[];\n /** Full permission union requested from the user in one SIWE. */\n resources: ResourceCapability[];\n /** Delegations that can be materialized after sign-in. */\n delegationTargets: ResolvedDelegate[];\n /** Account-space registry records to write after successful sign-in. */\n registryRecords: ManifestRegistryRecord[];\n /** Effective session expiry, using the longest composed manifest expiry. */\n expiryMs: number;\n /** Whether to include the public-space companion behavior. */\n includePublicSpace: boolean;\n}\n\n/**\n * Thrown when the manifest fails validation (missing id/name, bad expiry,\n * empty actions on a permission, etc).\n */\nexport class ManifestValidationError extends Error {\n constructor(message: string) {\n super(`Manifest validation failed: ${message}`);\n this.name = \"ManifestValidationError\";\n }\n}\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/**\n * Default expiry when neither the manifest, delegation, nor permission\n * specifies one. APP tier — see `expiry.ts`. Spec: 30 days.\n *\n * Kept as an ms-format string because the manifest schema stores expiry\n * as a string and the parser is shared between this default and\n * caller-provided values; converting `EXPIRY.APP_MS` back to a string\n * here would duplicate that same `30d` literal in another form.\n */\nexport const DEFAULT_EXPIRY = \"30d\";\n\n/**\n * Default `defaults` value when the manifest omits it. Spec: standard tier.\n */\nexport const DEFAULT_DEFAULTS: ManifestDefaults = true;\n\n/** Default manifest schema version. */\nexport const DEFAULT_MANIFEST_VERSION = 1;\n\n/** Default space for manifest-declared app data. */\nexport const DEFAULT_MANIFEST_SPACE = \"applications\";\n\n/** Account-space name used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_SPACE = \"account\";\n\n/** Account-space KV prefix used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_PATH = \"applications/\";\n\nexport const SECRETS_SPACE = \"secrets\";\n\n/** SDK-only permission service for encrypted vault resources. */\nexport const VAULT_PERMISSION_SERVICE = \"tinycloud.vault\";\n\ntype VaultKVBase = \"vault\";\n\ninterface VaultActionExpansion {\n bases: readonly VaultKVBase[];\n action: string;\n}\n\n/**\n * Known services and their short-form (recap URI) names. The TinyCloud\n * node encodes the recap resource URI with the short service name, while\n * action URNs and manifest entries use the long `tinycloud.<short>` form.\n * This table is the canonical bridge between the two.\n */\nexport const SERVICE_SHORT_TO_LONG: Readonly<Record<string, string>> =\n Object.freeze({\n kv: \"tinycloud.kv\",\n sql: \"tinycloud.sql\",\n duckdb: \"tinycloud.duckdb\",\n capabilities: \"tinycloud.capabilities\",\n hooks: \"tinycloud.hooks\",\n encryption: \"tinycloud.encryption\",\n delegation: \"tinycloud.delegation\",\n });\n\n/**\n * Manifest service identifier for TinyCloud encryption network grants.\n *\n * Encryption permissions live on a network id URN\n * (`urn:tinycloud:encryption:<ownerDid>:<network>`), not on a space.\n * The `path` field is the literal networkId; `actions` are\n * `[\"decrypt\"]` (expanded to `[\"tinycloud.encryption/decrypt\"]`).\n *\n * Apps should omit `space` for encryption permissions. The SDK may emit\n * an internal `\"encryption\"` compatibility label after expansion so the\n * older `PermissionEntry`/`ResourceCapability` shape can still carry the\n * raw network URN through subset checks.\n */\nexport const ENCRYPTION_PERMISSION_SERVICE = \"tinycloud.encryption\";\n\n/** Synthetic space label used by encryption manifest entries. */\nexport const ENCRYPTION_MANIFEST_SPACE = \"encryption\";\n\n/**\n * Inverse of {@link SERVICE_SHORT_TO_LONG}.\n */\nexport const SERVICE_LONG_TO_SHORT: Readonly<Record<string, string>> =\n Object.freeze(\n Object.fromEntries(\n Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s]),\n ),\n );\n\n/**\n * Default permission entries for the `true` / standard tier.\n *\n * `tinycloud.capabilities/read` is added separately for every requested\n * space, without the app path prefix. That keeps capability introspection\n * space-scoped instead of app-data scoped.\n */\nconst DEFAULT_STANDARD_ENTRIES: readonly PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n },\n {\n service: \"tinycloud.sql\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\"],\n },\n];\n\n/**\n * Default permission entries for the `\"admin\"` tier: standard + sql/schema.\n */\nconst DEFAULT_ADMIN_ENTRIES: readonly PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n },\n {\n service: \"tinycloud.sql\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\", \"schema\"],\n },\n];\n\n/**\n * Default permission entries for the `\"all\"` tier: admin + DuckDB.\n *\n * DuckDB is opt-in and only appears in this tier or in explicit manifest\n * `permissions` entries.\n */\nconst DEFAULT_ALL_ENTRIES: readonly PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n },\n {\n service: \"tinycloud.sql\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\", \"schema\"],\n },\n {\n service: \"tinycloud.duckdb\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\"],\n },\n];\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Parse an ms-format duration string (e.g. \"30d\", \"2h\", \"1y\") into\n * milliseconds.\n *\n * @throws {ManifestValidationError} on empty string, non-string input, or\n * any input `ms()` cannot parse.\n */\nexport function parseExpiry(duration: string): number {\n if (typeof duration !== \"string\" || duration.length === 0) {\n throw new ManifestValidationError(\n `expiry must be a non-empty duration string (got ${JSON.stringify(duration)})`,\n );\n }\n // `ms` returns `undefined` for unparseable input and can return a number\n // or a string depending on the call signature; cast explicitly.\n const parsed = (ms as unknown as (v: string) => number | undefined)(duration);\n if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n throw new ManifestValidationError(\n `invalid expiry duration: ${JSON.stringify(duration)}`,\n );\n }\n return parsed;\n}\n\n/**\n * Expand a list of action short names (or already-expanded URNs) into full\n * ability URNs of the form `<service>/<action>`.\n *\n * Examples:\n * `expandActionShortNames(\"tinycloud.kv\", [\"get\", \"put\"])`\n * → `[\"tinycloud.kv/get\", \"tinycloud.kv/put\"]`\n * `expandActionShortNames(\"tinycloud.kv\", [\"tinycloud.kv/get\"])`\n * → `[\"tinycloud.kv/get\"]` (passed through unchanged)\n */\nexport function expandActionShortNames(\n service: string,\n actions: readonly string[],\n): string[] {\n return actions.map((a) => {\n if (a.includes(\"/\")) {\n // Already a full URN — pass through.\n return a;\n }\n return `${service}/${a}`;\n });\n}\n\n/**\n * Expand SDK virtual permission services into concrete recap-capable services.\n *\n * Today this handles `\"tinycloud.vault\"`, which is backed by inline\n * network-encrypted KV records:\n * - read/get: `vault/<path>` with `tinycloud.kv/get`\n * - write/put: `vault/<path>` with `tinycloud.kv/put`\n * - delete/del: `vault/<path>` with `tinycloud.kv/del`\n * - list: `vault/<path>` with `tinycloud.kv/list`\n * - head: `vault/<path>` with `tinycloud.kv/get`\n * - metadata: `vault/<path>` with `tinycloud.kv/metadata`\n */\nexport function expandPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n if (entry.service === ENCRYPTION_PERMISSION_SERVICE) {\n return expandEncryptionPermissionEntry(entry);\n }\n if (entry.service !== VAULT_PERMISSION_SERVICE) {\n return [\n {\n ...entry,\n actions: expandActionShortNames(entry.service, entry.actions),\n },\n ];\n }\n\n return expandVaultPermissionEntry(entry);\n}\n\n/**\n * Expand a `tinycloud.encryption` manifest entry.\n *\n * - `path` MUST be a networkId URN (`urn:tinycloud:encryption:...`).\n * The manifest prefix is always skipped — network ids are top-level\n * owner-scoped resources, not space-scoped paths.\n * - `actions` must be `decrypt`, `network.create`, or `network.revoke`\n * (or their already-expanded `tinycloud.encryption/*` forms).\n *\n * The returned entry uses an internal `space = \"encryption\"` compatibility\n * label so old manifest grouping code does not collapse it into the app's\n * data space, and `skipPrefix` is forced to `true` so the prefix application\n * step is a no-op.\n */\nfunction expandEncryptionPermissionEntry(\n entry: PermissionEntry,\n): PermissionEntry[] {\n if (\n typeof entry.path !== \"string\" ||\n !entry.path.startsWith(\"urn:tinycloud:encryption:\")\n ) {\n throw new ManifestValidationError(\n `tinycloud.encryption entries require path to be a networkId URN ` +\n `(got ${JSON.stringify(entry.path)})`,\n );\n }\n const normalizedActions: string[] = [];\n for (const action of entry.actions) {\n if (action === \"decrypt\" || action === \"tinycloud.encryption/decrypt\") {\n normalizedActions.push(\"tinycloud.encryption/decrypt\");\n continue;\n }\n if (\n action === \"network.create\" ||\n action === \"tinycloud.encryption/network.create\"\n ) {\n normalizedActions.push(\"tinycloud.encryption/network.create\");\n continue;\n }\n if (\n action === \"network.revoke\" ||\n action === \"tinycloud.encryption/network.revoke\"\n ) {\n normalizedActions.push(\"tinycloud.encryption/network.revoke\");\n continue;\n }\n if (action.includes(\"/\")) {\n throw new ManifestValidationError(\n `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n );\n }\n throw new ManifestValidationError(\n `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n );\n }\n // Dedupe while preserving order\n const dedupedActions: string[] = [];\n const seen = new Set<string>();\n for (const a of normalizedActions) {\n if (!seen.has(a)) {\n dedupedActions.push(a);\n seen.add(a);\n }\n }\n // Encryption resources are network-scoped, not space-scoped. We\n // always emit the synthetic \"encryption\" space label so manifest\n // grouping can deal with it uniformly without collapsing the\n // networkId URN into an app data space.\n return [\n {\n service: ENCRYPTION_PERMISSION_SERVICE,\n space: ENCRYPTION_MANIFEST_SPACE,\n path: entry.path,\n actions: dedupedActions,\n skipPrefix: true,\n ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n },\n ];\n}\n\n/**\n * Expand a list of permission entries using {@link expandPermissionEntry}.\n */\nexport function expandPermissionEntries(\n entries: readonly PermissionEntry[],\n): PermissionEntry[] {\n return entries.flatMap(expandPermissionEntry);\n}\n\n/**\n * Apply the manifest prefix to a permission path per the spec rules.\n *\n * - `skipPrefix: true` → path is returned as-is\n * - `prefix === \"\"` → path is returned as-is\n * - path starts with \"/\" → `prefix + path` (e.g. \"com.listen.app\" + \"/\" → \"com.listen.app/\")\n * - otherwise → `prefix + \"/\" + path` (e.g. \"com.listen.app\" + \"data.sqlite\" → \"com.listen.app/data.sqlite\")\n */\nexport function applyPrefix(\n prefix: string,\n path: string,\n skipPrefix: boolean,\n): string {\n if (skipPrefix) {\n return path;\n }\n if (prefix === \"\") {\n return path;\n }\n if (path.startsWith(\"/\")) {\n return `${prefix}${path}`;\n }\n return `${prefix}/${path}`;\n}\n\n/**\n * Fetch and parse a manifest from a URL (browser) or file path (node).\n * The runtime decides the fetch strategy via `globalThis.fetch`; this is\n * platform-agnostic. Callers that want custom loading should JSON.parse a\n * Manifest themselves and skip this helper.\n *\n * @throws if the fetch fails, the JSON is invalid, or the manifest fails\n * validation.\n */\nexport async function loadManifest(url: string): Promise<Manifest> {\n const fetchFn: typeof fetch | undefined = (\n globalThis as { fetch?: typeof fetch }\n ).fetch;\n if (typeof fetchFn !== \"function\") {\n throw new ManifestValidationError(\n \"loadManifest requires a global fetch; pass the manifest object directly on runtimes without fetch\",\n );\n }\n const res = await fetchFn(url);\n if (!res.ok) {\n throw new ManifestValidationError(\n `failed to fetch manifest from ${url}: HTTP ${res.status}`,\n );\n }\n const json = (await res.json()) as unknown;\n return validateManifest(json);\n}\n\n/**\n * Validate a manifest-shaped object and return it strongly-typed.\n * Throws {@link ManifestValidationError} on any hard failure.\n */\nexport function validateManifest(input: unknown): Manifest {\n if (input === null || typeof input !== \"object\") {\n throw new ManifestValidationError(\"manifest must be an object\");\n }\n const m = input as Manifest;\n if (\n m.manifest_version !== undefined &&\n m.manifest_version !== DEFAULT_MANIFEST_VERSION\n ) {\n throw new ManifestValidationError(\n `manifest.manifest_version must be ${DEFAULT_MANIFEST_VERSION}`,\n );\n }\n if (typeof m.app_id !== \"string\" || m.app_id.length === 0) {\n throw new ManifestValidationError(\n \"manifest.app_id is required and must be a non-empty string\",\n );\n }\n if (typeof m.name !== \"string\" || m.name.length === 0) {\n throw new ManifestValidationError(\n \"manifest.name is required and must be a non-empty string\",\n );\n }\n if (\n m.did !== undefined &&\n (typeof m.did !== \"string\" || m.did.length === 0)\n ) {\n throw new ManifestValidationError(\n \"manifest.did must be a non-empty DID string\",\n );\n }\n if (\n m.space !== undefined &&\n (typeof m.space !== \"string\" || m.space.length === 0)\n ) {\n throw new ManifestValidationError(\n \"manifest.space must be a non-empty string\",\n );\n }\n if (m.expiry !== undefined) {\n // Will throw with a clear error if invalid.\n parseExpiry(m.expiry);\n }\n if (m.knowledge !== undefined) {\n resolveManifestKnowledgeRoot(m.knowledge);\n }\n if (m.permissions !== undefined) {\n if (!Array.isArray(m.permissions)) {\n throw new ManifestValidationError(\n \"manifest.permissions must be an array\",\n );\n }\n m.permissions.forEach((p, i) =>\n validatePermissionEntry(p, `permissions[${i}]`),\n );\n }\n if (m.secrets !== undefined) {\n validateManifestSecrets(m.secrets);\n }\n return m;\n}\n\n/**\n * Resolve a manifest knowledge pointer to its root markdown file.\n *\n * This is metadata only; app knowledge does not create capabilities.\n */\nexport function resolveManifestKnowledgeRoot(\n knowledge: Manifest[\"knowledge\"] | undefined,\n): string | undefined {\n if (knowledge === undefined) {\n return undefined;\n }\n if (knowledge === true) {\n return DEFAULT_KNOWLEDGE_ROOT;\n }\n if (typeof knowledge !== \"string\" || knowledge.length === 0) {\n throw new ManifestValidationError(\n \"manifest.knowledge must be true or a knowledge/*.md root path\",\n );\n }\n if (!/^knowledge\\/.+\\.md$/.test(knowledge)) {\n throw new ManifestValidationError(\n \"manifest.knowledge must be true or a knowledge/*.md root path\",\n );\n }\n return knowledge;\n}\n\nfunction validateManifestSecrets(secrets: unknown): void {\n if (secrets === null || typeof secrets !== \"object\" || Array.isArray(secrets)) {\n throw new ManifestValidationError(\"manifest.secrets must be an object\");\n }\n\n for (const [name, spec] of Object.entries(secrets)) {\n if (!SECRET_NAME_RE.test(name)) {\n throw new ManifestValidationError(\n `manifest.secrets.${name} must match ${SECRET_NAME_RE.source}`,\n );\n }\n try {\n resolveSecretPath(\n secretNameFromSpec(name, spec as ManifestSecretActions),\n { scope: secretScopeFromSpec(spec as ManifestSecretActions) },\n );\n } catch (error) {\n throw new ManifestValidationError(\n `manifest.secrets.${name}: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n const actions = secretActionsFromSpec(name, spec as ManifestSecretActions);\n if (actions.length === 0) {\n throw new ManifestValidationError(\n `manifest.secrets.${name} actions must be non-empty`,\n );\n }\n for (const action of actions) {\n if (typeof action !== \"string\" || action.length === 0) {\n throw new ManifestValidationError(\n `manifest.secrets.${name} actions must be non-empty strings`,\n );\n }\n }\n if (\n spec !== null &&\n typeof spec === \"object\" &&\n !Array.isArray(spec) &&\n (spec as { expiry?: unknown }).expiry !== undefined\n ) {\n parseExpiry((spec as { expiry: string }).expiry);\n }\n }\n}\n\nfunction validatePermissionEntry(p: unknown, path: string): void {\n if (p === null || typeof p !== \"object\") {\n throw new ManifestValidationError(`${path} must be an object`);\n }\n const entry = p as PermissionEntry;\n if (typeof entry.service !== \"string\" || entry.service.length === 0) {\n throw new ManifestValidationError(`${path}.service is required`);\n }\n if (\n entry.space !== undefined &&\n (typeof entry.space !== \"string\" || entry.space.length === 0)\n ) {\n throw new ManifestValidationError(\n `${path}.space must be a non-empty string`,\n );\n }\n if (typeof entry.path !== \"string\") {\n throw new ManifestValidationError(\n `${path}.path is required (use \"\" or \"/\" for root)`,\n );\n }\n if (!Array.isArray(entry.actions) || entry.actions.length === 0) {\n throw new ManifestValidationError(\n `${path}.actions must be a non-empty array`,\n );\n }\n for (const action of entry.actions) {\n if (typeof action !== \"string\" || action.length === 0) {\n throw new ManifestValidationError(\n `${path}.actions must contain non-empty strings`,\n );\n }\n if (entry.service === VAULT_PERMISSION_SERVICE) {\n vaultActionExpansion(action);\n }\n }\n if (entry.caveats !== undefined &&\n (!Array.isArray(entry.caveats) || entry.caveats.some((caveat) =>\n caveat === null || typeof caveat !== \"object\" || Array.isArray(caveat)\n ))\n ) {\n throw new ManifestValidationError(`${path}.caveats must be an array of objects`);\n }\n if (entry.expiry !== undefined) {\n parseExpiry(entry.expiry);\n }\n}\n\n/**\n * Normalize a `defaults` value: lowercase + trim, then match against known\n * tiers. Unknown string values silently fall back to `true` (standard).\n * Boolean values pass through.\n */\nexport function normalizeDefaults(\n value: Manifest[\"defaults\"] | undefined,\n): ManifestDefaults {\n if (value === undefined) {\n return DEFAULT_DEFAULTS;\n }\n if (typeof value === \"boolean\") {\n return value;\n }\n if (typeof value !== \"string\") {\n // Spec says unknown values silently fall back to `true`.\n return true;\n }\n const normalized = value.trim().toLowerCase();\n if (normalized === \"admin\" || normalized === \"all\") {\n return normalized;\n }\n // Anything else, including \"true\"/\"false\"/\"standard\"/garbage, falls back\n // to the standard tier per spec.\n return true;\n}\n\n/**\n * Return the default permission entries for the given tier. Entries are\n * deep-cloned so callers can mutate them without affecting the constants.\n */\nfunction defaultEntriesForTier(tier: ManifestDefaults): PermissionEntry[] {\n if (tier === false) {\n return [];\n }\n const source =\n tier === \"admin\"\n ? DEFAULT_ADMIN_ENTRIES\n : tier === \"all\"\n ? DEFAULT_ALL_ENTRIES\n : DEFAULT_STANDARD_ENTRIES;\n return source.map((e) => ({\n service: e.service,\n space: e.space,\n path: e.path,\n actions: [...e.actions],\n ...(e.skipPrefix !== undefined ? { skipPrefix: e.skipPrefix } : {}),\n }));\n}\n\n/**\n * Resolve a raw manifest into a {@link ResolvedCapabilities} object: expand\n * shortform actions, apply the prefix, merge defaults, and compute effective\n * expiries. Pure function — does no I/O.\n *\n * Resolution semantics (spec):\n * - `prefix` defaults to `app_id`; set to `\"\"` to disable prefix application entirely.\n * - `space` defaults to `applications`; per-permission `space` overrides it.\n * - `defaults` defaults to `true` (standard tier); unknown string values fall back to `true`.\n * - Per-entry expiry overrides per-delegation overrides manifest > `DEFAULT_EXPIRY`.\n * - Default entries use `skipPrefix: false` so they inherit the manifest prefix.\n */\nexport function resolveManifest(input: Manifest): ResolvedCapabilities {\n const manifest = validateManifest(input);\n\n const prefix =\n manifest.prefix !== undefined ? manifest.prefix : manifest.app_id;\n const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;\n const expiryMs = parseExpiry(manifest.expiry ?? DEFAULT_EXPIRY);\n const includePublicSpace = manifest.includePublicSpace ?? true;\n const tier = normalizeDefaults(manifest.defaults);\n\n const defaultEntries = defaultEntriesForTier(tier);\n const explicitEntries = manifest.permissions ?? [];\n const secretEntries = secretEntriesForManifest(manifest.secrets);\n\n // Merge order: defaults first, then explicit entries, so explicit entries\n // for the same (service, space, path) tuple override defaults.\n const allEntries: PermissionEntry[] = [\n ...defaultEntries,\n ...explicitEntries,\n ...secretEntries,\n ];\n\n const resources: ResourceCapability[] = withCapabilitiesReadForSpaces(\n allEntries.flatMap((entry) => resolveEntry(entry, prefix, expiryMs, space)),\n );\n\n const additionalDelegates: ResolvedDelegate[] =\n manifest.did === undefined\n ? []\n : [\n {\n did: manifest.did,\n name: manifest.name,\n expiryMs,\n permissions: resources.map(cloneResourceCapability),\n },\n ];\n\n return {\n app_id: manifest.app_id,\n ...(manifest.did !== undefined ? { did: manifest.did } : {}),\n space,\n resources,\n expiryMs,\n includePublicSpace,\n additionalDelegates,\n };\n}\n\nfunction normalizeSecretActions(actions: readonly string[]): string[] {\n const out: string[] = [];\n const seen = new Set<string>();\n const add = (action: string) => {\n if (!seen.has(action)) {\n out.push(action);\n seen.add(action);\n }\n };\n\n for (const action of actions) {\n if (action === \"read\") {\n add(\"get\");\n continue;\n }\n if (action === \"write\") {\n add(\"put\");\n continue;\n }\n if (action === \"delete\") {\n add(\"del\");\n continue;\n }\n if (\n action === \"get\" ||\n action === \"put\" ||\n action === \"del\" ||\n action === \"list\" ||\n action === \"metadata\"\n ) {\n add(action);\n continue;\n }\n if (\n action === \"tinycloud.kv/get\" ||\n action === \"tinycloud.kv/put\" ||\n action === \"tinycloud.kv/del\" ||\n action === \"tinycloud.kv/list\" ||\n action === \"tinycloud.kv/metadata\"\n ) {\n add(action);\n continue;\n }\n throw new ManifestValidationError(\n `unknown secret action ${JSON.stringify(action)}; expected read, write, delete, list, or metadata`,\n );\n }\n\n return out;\n}\n\nfunction secretNameFromSpec(\n fallbackName: string,\n spec: ManifestSecretActions,\n): string {\n if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n return spec.name ?? fallbackName;\n }\n return fallbackName;\n}\n\nfunction secretScopeFromSpec(\n spec: ManifestSecretActions,\n): string | undefined {\n if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n return spec.scope;\n }\n return undefined;\n}\n\nfunction secretActionsFromSpec(\n name: string,\n spec: ManifestSecretActions,\n): string[] {\n if (spec === true) {\n return [\"read\"];\n }\n if (typeof spec === \"string\") {\n return [spec];\n }\n if (Array.isArray(spec)) {\n return spec;\n }\n if (spec === null || typeof spec !== \"object\") {\n throw new ManifestValidationError(\n `manifest.secrets.${name} must be true, a string action, an actions array, or an object`,\n );\n }\n if (spec.actions === undefined) {\n return [\"read\"];\n }\n if (typeof spec.actions === \"string\") {\n return [spec.actions];\n }\n if (Array.isArray(spec.actions)) {\n return spec.actions;\n }\n throw new ManifestValidationError(\n `manifest.secrets.${name}.actions must be a string or array`,\n );\n}\n\nfunction secretEntriesForManifest(\n secrets: Manifest[\"secrets\"] | undefined,\n): PermissionEntry[] {\n if (secrets === undefined) {\n return [];\n }\n\n const entries: PermissionEntry[] = [];\n for (const [name, spec] of Object.entries(secrets)) {\n const actions = secretActionsFromSpec(name, spec);\n const secretPath = resolveSecretPath(\n secretNameFromSpec(name, spec),\n { scope: secretScopeFromSpec(spec) },\n );\n const extra: { expiry?: string; description?: string } =\n spec !== true && typeof spec === \"object\" && !Array.isArray(spec)\n ? spec\n : {};\n entries.push({\n service: VAULT_PERMISSION_SERVICE,\n space: SECRETS_SPACE,\n path: secretPath.vaultKey,\n actions: normalizeSecretActions(actions),\n skipPrefix: true,\n ...(extra.expiry !== undefined ? { expiry: extra.expiry } : {}),\n ...(extra.description !== undefined\n ? { description: extra.description }\n : {}),\n });\n }\n return entries;\n}\n\n/**\n * Expand a single permission entry into a {@link ResourceCapability}:\n * apply the prefix to the path and expand short actions into full URNs.\n */\nfunction resolveEntry(\n entry: PermissionEntry,\n prefix: string,\n _inheritedExpiryMs: number,\n inheritedSpace: string,\n): ResourceCapability[] {\n // Encryption permissions reference a networkId URN as their resource\n // — the manifest prefix is meaningless against a top-level\n // owner-scoped resource and would corrupt the URN. Always skip.\n const skipPrefixForEntry =\n entry.skipPrefix === true ||\n entry.service === ENCRYPTION_PERMISSION_SERVICE;\n const resolvedPath = applyPrefix(prefix, entry.path, skipPrefixForEntry);\n const entryExpiryMs =\n entry.expiry !== undefined ? parseExpiry(entry.expiry) : undefined;\n return expandPermissionEntry({\n ...entry,\n space: entry.space ?? inheritedSpace,\n path: resolvedPath,\n skipPrefix: true,\n }).map((expanded) => ({\n service: expanded.service,\n space: expanded.space ?? inheritedSpace,\n path: expanded.path,\n actions: expanded.actions,\n // Only populate `expiryMs` when the entry had its own expiry override.\n // When absent, callers use the parent (delegation or manifest) expiry\n // which is carried on ResolvedDelegate.expiryMs / ResolvedCapabilities.expiryMs.\n ...(entryExpiryMs !== undefined ? { expiryMs: entryExpiryMs } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n }));\n}\n\nfunction expandVaultPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n const byBase = new Map<VaultKVBase, string[]>();\n\n for (const action of entry.actions) {\n const expansion = vaultActionExpansion(action);\n for (const base of expansion.bases) {\n const actions = byBase.get(base) ?? [];\n if (!actions.includes(expansion.action)) {\n actions.push(expansion.action);\n }\n byBase.set(base, actions);\n }\n }\n\n return [...byBase.entries()].map(([base, actions]) => ({\n ...entry,\n service: \"tinycloud.kv\",\n path: vaultKVPath(base, entry.path),\n actions,\n skipPrefix: true,\n }));\n}\n\nfunction vaultActionExpansion(action: string): VaultActionExpansion {\n const normalized = normalizeVaultAction(action);\n if (normalized === \"read\" || normalized === \"get\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n }\n if (normalized === \"write\" || normalized === \"put\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/put\" };\n }\n if (normalized === \"delete\" || normalized === \"del\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/del\" };\n }\n if (normalized === \"list\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/list\" };\n }\n if (normalized === \"head\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n }\n if (normalized === \"metadata\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/metadata\" };\n }\n\n throw new ManifestValidationError(\n `unknown vault action ${JSON.stringify(action)}; expected read, write, delete, get, put, del, list, head, or metadata`,\n );\n}\n\nfunction normalizeVaultAction(action: string): string {\n if (action.startsWith(`${VAULT_PERMISSION_SERVICE}/`)) {\n return action.slice(`${VAULT_PERMISSION_SERVICE}/`.length);\n }\n if (action.startsWith(\"tinycloud.kv/\")) {\n return action.slice(\"tinycloud.kv/\".length);\n }\n if (action.includes(\"/\")) {\n throw new ManifestValidationError(\n `unknown vault action ${JSON.stringify(action)}; expected a tinycloud.vault or tinycloud.kv action`,\n );\n }\n return action;\n}\n\nfunction vaultKVPath(base: VaultKVBase, path: string): string {\n const normalized = path.startsWith(\"/\") ? path.slice(1) : path;\n return `${base}/${normalized}`;\n}\n\nfunction cloneResourceCapability(\n entry: ResourceCapability,\n): ResourceCapability {\n return {\n service: entry.service,\n space: entry.space,\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.expiryMs !== undefined ? { expiryMs: entry.expiryMs } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n };\n}\n\nfunction clonePermissionEntry(entry: PermissionEntry): PermissionEntry {\n return {\n service: entry.service,\n ...(entry.space !== undefined ? { space: entry.space } : {}),\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.caveats !== undefined\n ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n : {}),\n ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n };\n}\n\nfunction dedupeResources(\n resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n const byKey = new Map<string, ResourceCapability>();\n\n for (const resource of resources) {\n const key = `${resource.service}\\u0000${resource.space}\\u0000${resource.path}\\u0000${resource.expiryMs ?? \"\"}`;\n const existing = byKey.get(key);\n if (existing === undefined) {\n byKey.set(key, cloneResourceCapability(resource));\n continue;\n }\n\n const seen = new Set(existing.actions);\n for (const action of resource.actions) {\n if (!seen.has(action)) {\n existing.actions.push(action);\n seen.add(action);\n }\n }\n if (\n existing.description === undefined &&\n resource.description !== undefined\n ) {\n existing.description = resource.description;\n }\n }\n\n return [...byKey.values()];\n}\n\nfunction capabilitiesReadPermission(space: string): ResourceCapability {\n return {\n service: \"tinycloud.capabilities\",\n space,\n path: \"\",\n actions: [\"tinycloud.capabilities/read\"],\n };\n}\n\nfunction withCapabilitiesReadForSpaces(\n resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n if (resources.length === 0) {\n return [];\n }\n\n const spaces = new Set(\n resources\n .filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE)\n .map((resource) => resource.space),\n );\n return dedupeResources([\n ...resources,\n ...[...spaces].map(capabilitiesReadPermission),\n ]);\n}\n\nfunction accountRegistryPermissions(): ResourceCapability[] {\n return [\n ...[ACCOUNT_REGISTRY_PATH, \"spaces/\"].map((path) => ({\n service: \"tinycloud.kv\",\n space: ACCOUNT_REGISTRY_SPACE,\n path,\n actions: [\"tinycloud.kv/get\", \"tinycloud.kv/put\", \"tinycloud.kv/list\"],\n })),\n {\n service: \"tinycloud.delegation\",\n space: ACCOUNT_REGISTRY_SPACE,\n path: \"\",\n actions: [\"tinycloud.delegation/list\"],\n },\n ];\n}\n\nfunction accountRegistryIndexPermission(): ResourceCapability {\n return {\n service: \"tinycloud.sql\",\n space: ACCOUNT_REGISTRY_SPACE,\n path: \"account\",\n actions: [\"tinycloud.sql/read\", \"tinycloud.sql/write\", \"tinycloud.sql/schema\"],\n };\n}\n\n/**\n * Compose one or more manifests into the single capability request that should\n * be signed. Fetching manifests is intentionally out of band; callers pass the\n * already-loaded manifest objects.\n */\nexport function composeManifestRequest(\n inputs: readonly Manifest[],\n options: ComposeManifestOptions = {},\n): ComposedManifestRequest {\n if (!Array.isArray(inputs) || inputs.length === 0) {\n throw new ManifestValidationError(\n \"composeManifestRequest requires at least one manifest\",\n );\n }\n\n const includeAccountRegistryPermissions =\n options.includeAccountRegistryPermissions ?? true;\n const manifests = inputs.map(validateManifest);\n const resolved = manifests.map(resolveManifest);\n const resources = resolved.flatMap((entry) => entry.resources);\n const delegationTargets = resolved.flatMap((entry) =>\n entry.additionalDelegates.map((delegate) => ({\n ...delegate,\n permissions: dedupeResources(delegate.permissions),\n })),\n );\n\n if (includeAccountRegistryPermissions) {\n resources.push(...accountRegistryPermissions());\n resources.push(accountRegistryIndexPermission());\n }\n const resourcesWithImplicitCapabilities =\n withCapabilitiesReadForSpaces(resources);\n\n const manifestsByAppId = new Map<string, Manifest[]>();\n for (const manifest of manifests) {\n const current = manifestsByAppId.get(manifest.app_id);\n if (current === undefined) {\n manifestsByAppId.set(manifest.app_id, [manifest]);\n } else {\n current.push(manifest);\n }\n }\n\n const registryRecords: ManifestRegistryRecord[] =\n includeAccountRegistryPermissions\n ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({\n key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,\n app_id,\n manifests: appManifests.map((manifest) => ({\n ...manifest,\n permissions: manifest.permissions?.map(clonePermissionEntry),\n })),\n }))\n : [];\n\n return {\n manifests,\n resources: resourcesWithImplicitCapabilities,\n delegationTargets,\n registryRecords,\n expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),\n includePublicSpace: resolved.some((entry) => entry.includePublicSpace),\n };\n}\n\n// ---------------------------------------------------------------------------\n// Abilities map construction (bridge to WASM prepareSession / createDelegation)\n// ---------------------------------------------------------------------------\n\n/**\n * The shape `prepareSession` and the multi-resource `createDelegation` WASM\n * export both accept:\n *\n * ```\n * { [shortService]: { [path]: [fullUrnAction, ...] } }\n * ```\n *\n * - `shortService` is the recap-level service segment (`\"kv\"`, `\"sql\"`,\n * `\"duckdb\"`, `\"capabilities\"`, `\"hooks\"`) — not the manifest long form.\n * - `path` is the fully-resolved path (prefix already applied). An empty\n * string means \"no path segment\" on the resource URI.\n * - Action strings are full URNs like `\"tinycloud.kv/get\"`.\n *\n * This is a single source of truth for both the session's own recap (at\n * sign-in) and the delegations it can derive (post sign-in). We re-use it\n * for both so one manifest drives both sides.\n */\nexport type AbilitiesMap = Record<string, Record<string, string[]>>;\n\n/**\n * Per-space abilities map accepted by the newer WASM session config:\n *\n * ```\n * { [spaceIdOrName]: { [shortService]: { [path]: [fullUrnAction, ...] } } }\n * ```\n */\nexport type SpaceAbilitiesMap = Record<string, AbilitiesMap>;\n\n/**\n * Convert a list of {@link ResourceCapability} entries (manifest\n * long-form service, full-URN actions) into the {@link AbilitiesMap}\n * shape the WASM layer expects.\n *\n * When multiple entries target the same `(service, path)` pair, their\n * action lists are merged and deduped. Entries whose service has no\n * short-form mapping in {@link SERVICE_LONG_TO_SHORT} are rejected with\n * a {@link ManifestValidationError} — the SDK does not silently drop\n * unknown services because the recap encoding would lose them.\n *\n * Paths are kept verbatim: this function does NOT collapse\n * `\"com.listen.app/\"` and `\"com.listen.app\"` or reinterpret empty /\n * slash strings. Callers that care about path canonicalization should\n * normalize before calling.\n */\nexport function resourceCapabilitiesToAbilitiesMap(\n resources: readonly ResourceCapability[],\n): AbilitiesMap {\n const out: AbilitiesMap = {};\n for (const r of resources) {\n const shortService = SERVICE_LONG_TO_SHORT[r.service];\n if (shortService === undefined) {\n throw new ManifestValidationError(\n `unknown service '${r.service}' — no short-form mapping. Known services: ${Object.keys(SERVICE_LONG_TO_SHORT).join(\", \")}`,\n );\n }\n if (out[shortService] === undefined) {\n out[shortService] = {};\n }\n const pathsMap = out[shortService];\n const existing = pathsMap[r.path];\n if (existing === undefined) {\n // Copy so downstream mutation can't leak back into the input.\n pathsMap[r.path] = [...r.actions];\n } else {\n // Merge + dedupe while preserving first-seen order.\n const seen = new Set(existing);\n for (const action of r.actions) {\n if (!seen.has(action)) {\n existing.push(action);\n seen.add(action);\n }\n }\n }\n }\n return out;\n}\n\n/**\n * Group resolved capabilities by `space`, then convert each group into a WASM\n * abilities map. Short space names are left as-is here; platform layers that\n * know the wallet address and chain id turn them into full SpaceIds.\n */\nexport function resourceCapabilitiesToSpaceAbilitiesMap(\n resources: readonly ResourceCapability[],\n): SpaceAbilitiesMap {\n const grouped = new Map<string, ResourceCapability[]>();\n for (const resource of resources) {\n const entries = grouped.get(resource.space);\n if (entries === undefined) {\n grouped.set(resource.space, [resource]);\n } else {\n entries.push(resource);\n }\n }\n\n const out: SpaceAbilitiesMap = {};\n for (const [space, entries] of grouped.entries()) {\n out[space] = resourceCapabilitiesToAbilitiesMap(entries);\n }\n return out;\n}\n\n/**\n * Build the {@link AbilitiesMap} that a session should be signed with,\n * given a {@link ResolvedCapabilities} (i.e. the output of\n * {@link resolveManifest}).\n *\n * The resulting map is the **union** of:\n * 1. the app's own resources (`resolved.resources`), and\n * 2. every permission declared in every `additionalDelegates[*]` entry.\n *\n * The union is what makes the manifest's delegations ergonomic: at\n * sign-in, the session key acquires recap coverage for both the app's\n * runtime needs and every downstream delegation target. Post sign-in,\n * `delegateTo(backendDID, backendPermissions)` can then issue the\n * sub-delegation via the session key (no wallet prompt) because the\n * caps are already part of the granted set.\n *\n * Duplicate `(service, path, action)` triples across resources and\n * delegations are merged and deduped — the session SIWE doesn't need\n * them repeated.\n */\nexport function manifestAbilitiesUnion(\n resolved: ResolvedCapabilities,\n): AbilitiesMap {\n const all: ResourceCapability[] = [...resolved.resources];\n for (const delegate of resolved.additionalDelegates) {\n for (const perm of delegate.permissions) {\n all.push(perm);\n }\n }\n return resourceCapabilitiesToAbilitiesMap(all);\n}\n","/**\n * Shared space utilities for TinyCloud.\n *\n * These functions are platform-agnostic and can be used by both\n * web-sdk and node-sdk for space hosting and session activation.\n */\n\n/**\n * Result of a space hosting or session activation attempt.\n */\nexport interface SpaceHostResult {\n /** Whether the operation succeeded (2xx status) */\n success: boolean;\n /** HTTP status code */\n status: number;\n /** Error message if failed */\n error?: string;\n /** Space IDs that were successfully activated */\n activated?: string[];\n /** Space IDs that were skipped (e.g., space doesn't exist yet) */\n skipped?: string[];\n /** Raw node receipt CID. This identifies the commit event, not the delegation. */\n commitEventCid?: string;\n}\n\n/**\n * Fetch the peer ID from TinyCloud server for space hosting.\n *\n * The peer ID identifies the TinyCloud server instance that will host the space.\n *\n * @param host - TinyCloud server URL (e.g., \"https://node.tinycloud.xyz\")\n * @param spaceId - The space ID to host\n * @returns The peer ID string\n * @throws Error if the request fails\n */\nexport async function fetchPeerId(\n host: string,\n spaceId: string\n): Promise<string> {\n const res = await fetch(\n `${host}/peer/generate/${encodeURIComponent(spaceId)}`\n );\n\n if (!res.ok) {\n const error = await res.text().catch(() => res.statusText);\n throw new Error(`Failed to get peer ID: ${res.status} - ${error}`);\n }\n\n return res.text();\n}\n\n/**\n * Submit a space hosting delegation to TinyCloud server.\n *\n * This registers a new space with the server, allowing the user\n * to store data in it.\n *\n * @param host - TinyCloud server URL\n * @param headers - Delegation headers (from siweToDelegationHeaders)\n * @returns Result indicating success/failure\n */\nexport async function submitHostDelegation(\n host: string,\n headers: Record<string, string>\n): Promise<SpaceHostResult> {\n const res = await fetch(`${host}/delegate`, {\n method: \"POST\",\n headers,\n });\n\n if (!res.ok) {\n return {\n success: false,\n status: res.status,\n error: await res.text().catch(() => res.statusText),\n };\n }\n try {\n const body = await res.json() as { cid?: string; activated?: string[]; skipped?: string[] };\n return {\n success: true,\n status: res.status,\n commitEventCid: body.cid,\n activated: body.activated ?? [],\n skipped: body.skipped ?? [],\n };\n } catch {\n return { success: true, status: res.status, activated: [], skipped: [] };\n }\n}\n\n/**\n * Activate a session with TinyCloud server.\n *\n * This submits the session delegation to the server, enabling the session\n * key to perform operations on behalf of the user.\n *\n * @param host - TinyCloud server URL\n * @param delegationHeader - Session delegation header (from session.delegationHeader)\n * @returns Result indicating success/failure (404 means space doesn't exist)\n */\nexport async function activateSessionWithHost(\n host: string,\n delegationHeader: { Authorization: string }\n): Promise<SpaceHostResult> {\n const res = await fetch(`${host}/delegate`, {\n method: \"POST\",\n headers: delegationHeader,\n });\n\n if (res.ok) {\n try {\n const body = await res.json() as { cid?: string; activated?: string[]; skipped?: string[] };\n return {\n success: true,\n status: res.status,\n activated: body.activated ?? [],\n skipped: body.skipped ?? [],\n commitEventCid: body.cid,\n };\n } catch {\n // Fallback for older servers that return plain text CID\n return {\n success: true,\n status: res.status,\n activated: [],\n skipped: [],\n };\n }\n }\n\n return {\n success: false,\n status: res.status,\n error: await res.text().catch(() => res.statusText),\n };\n}\n","/**\n * DelegationManager - Handles delegation CRUD operations.\n *\n * This class manages the creation, revocation, listing, and querying\n * of delegations within TinyCloud. It extracts and improves upon the\n * delegation functionality previously in ITinyCloudStorage.\n *\n * @packageDocumentation\n */\n\nimport type {\n FetchFunction,\n FetchResponse,\n InvokeAnyFunction,\n InvokeFunction,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n Result,\n DelegationError,\n DelegationErrorCodes,\n Delegation,\n DelegationStatus,\n DelegationStatusSchema,\n DelegationRevocationReceipt,\n DelegationRevocationReceiptSchema,\n AccountDelegationPage,\n AccountDelegationPageSchema,\n AccountDelegationQueryOptionsSchema,\n AccountDelegationQueryOptions,\n CreateDelegationParams,\n DelegationChain,\n DelegationManagerConfig,\n DelegationApiResponse,\n} from \"./types\";\nimport { EXPIRY } from \"../expiry\";\n\n/**\n * Delegation action constants.\n */\nconst DelegationAction = {\n CREATE: \"tinycloud.delegation/create\",\n REVOKE: \"tinycloud.delegation/revoke\",\n STATUS: \"tinycloud.delegation/status\",\n LIST: \"tinycloud.delegation/list\",\n GET: \"tinycloud.delegation/get\",\n CHECK: \"tinycloud.delegation/check\",\n} as const;\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n code: string,\n message: string,\n cause?: Error,\n meta?: Record<string, unknown>\n): DelegationError {\n return {\n code,\n message,\n service: \"delegation\",\n cause,\n meta,\n };\n}\n\n/**\n * DelegationManager handles all delegation-related operations.\n *\n * @example\n * ```typescript\n * import { DelegationManager } from \"@tinycloud/sdk-core/delegations\";\n *\n * const delegations = new DelegationManager({\n * hosts: [\"https://node.tinycloud.xyz\"],\n * session,\n * invoke,\n * });\n *\n * // Create a delegation\n * const result = await delegations.create({\n * delegateDID: \"did:pkh:eip155:1:0x...\",\n * path: \"shared/\",\n * actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n * expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours\n * });\n *\n * if (result.ok) {\n * console.log(\"Created delegation:\", result.data.cid);\n * }\n * ```\n */\nexport class DelegationManager {\n private hosts: string[];\n private session: ServiceSession;\n private invoke: InvokeFunction;\n private invokeAny?: InvokeAnyFunction;\n private fetchFn: FetchFunction;\n private accountSpaceId?: string;\n\n /**\n * Creates a new DelegationManager instance.\n *\n * @param config - Configuration including hosts, session, and invoke function\n */\n constructor(config: DelegationManagerConfig) {\n this.hosts = config.hosts;\n this.session = config.session;\n this.invoke = config.invoke;\n this.invokeAny = config.invokeAny;\n this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n this.accountSpaceId = config.accountSpaceId;\n }\n\n /**\n * Updates the session (e.g., after re-authentication).\n *\n * @param session - New session to use for operations\n */\n public updateSession(session: ServiceSession): void {\n this.session = session;\n }\n\n /**\n * Gets the primary host URL.\n */\n private get host(): string {\n return this.hosts[0];\n }\n\n /**\n * Executes an invoke operation against the delegation API.\n */\n private async invokeOperation(\n path: string,\n action: string,\n body?: string\n ): Promise<FetchResponse> {\n const headers = this.invoke(this.session, \"delegation\", path, action);\n\n return this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n body,\n });\n }\n\n /**\n * Creates a new delegation.\n *\n * Delegates specific permissions to another DID for a given path.\n * The delegatee can then use these permissions to access resources\n * within the specified scope.\n *\n * @param params - Parameters for the delegation\n * @returns Result containing the created Delegation or an error\n *\n * @example\n * ```typescript\n * const result = await manager.create({\n * delegateDID: bob.did,\n * path: \"documents/shared/\",\n * actions: [\"tinycloud.kv/get\", \"tinycloud.kv/put\"],\n * expiry: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days\n * });\n * ```\n */\n async create(params: CreateDelegationParams): Promise<Result<Delegation>> {\n // Validate inputs\n if (!params.delegateDID) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"delegateDID is required\"\n ),\n };\n }\n\n if (!params.path) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"path is required\"\n ),\n };\n }\n\n if (!params.actions || params.actions.length === 0) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"at least one action is required\"\n ),\n };\n }\n\n try {\n const body = JSON.stringify({\n delegateDID: params.delegateDID,\n path: params.path,\n actions: params.actions,\n expiry: params.expiry?.toISOString(),\n disableSubDelegation: params.disableSubDelegation ?? false,\n statement: params.statement,\n });\n\n const response = await this.invokeOperation(\n params.path,\n DelegationAction.CREATE,\n body\n );\n\n if (!response.ok) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to create delegation: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, path: params.path }\n ),\n };\n }\n\n const apiResponse = (await response.json()) as DelegationApiResponse;\n\n const delegation: Delegation = {\n cid: apiResponse.cid ?? \"\",\n delegateDID: params.delegateDID,\n spaceId: this.session.spaceId,\n path: params.path,\n actions: params.actions,\n expiry: params.expiry ?? new Date(Date.now() + EXPIRY.SHARE_MS),\n isRevoked: false,\n allowSubDelegation: !(params.disableSubDelegation ?? false),\n createdAt: new Date(),\n };\n\n return { ok: true, data: delegation };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation creation: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Revokes an existing delegation.\n *\n * Once revoked, the delegation can no longer be used to access resources.\n * This also invalidates any sub-delegations derived from this delegation.\n *\n * @param cid - The CID of the delegation to revoke\n * @returns Result indicating success or an error\n *\n * @example\n * ```typescript\n * const result = await manager.revoke(\"bafy...\");\n * if (result.ok) {\n * console.log(\"Delegation revoked successfully\");\n * }\n * ```\n */\n async revoke(cid: string): Promise<Result<DelegationRevocationReceipt>> {\n if (!cid) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"cid is required\"\n ),\n };\n }\n\n try {\n if (!this.invokeAny) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Revocation requires an invokeAny function that can sign the target CID\"\n ),\n };\n }\n\n const headers = this.invokeAny(\n this.session,\n [{\n resource: `urn:cid:${cid}`,\n service: \"delegation\",\n path: \"\",\n action: DelegationAction.REVOKE,\n }],\n );\n const response = await this.fetchFn(`${this.host}/revoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n\n if (response.status === 404) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_FOUND,\n `Delegation not found: ${cid}`\n ),\n };\n }\n\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.REVOCATION_FAILED,\n `Failed to revoke delegation: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, cid }\n ),\n };\n }\n\n const parsed = DelegationRevocationReceiptSchema.safeParse(await response.json());\n if (!parsed.success || parsed.data.cid !== cid) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.REVOCATION_FAILED,\n \"Node returned an invalid delegation revocation receipt\",\n undefined,\n { cid },\n ),\n };\n }\n return { ok: true, data: parsed.data };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation revocation: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Reads the node-confirmed lifecycle state of one delegation without\n * exposing delegation metadata.\n */\n async status(cid: string): Promise<Result<DelegationStatus>> {\n if (!cid) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.INVALID_INPUT, \"cid is required\"),\n };\n }\n if (!this.invokeAny) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Delegation status requires an invokeAny function that can sign the target CID\"\n ),\n };\n }\n\n try {\n const headers = this.invokeAny(this.session, [{\n resource: `urn:cid:${cid}`,\n service: \"delegation\",\n path: \"\",\n action: DelegationAction.STATUS,\n }]);\n const response = await this.fetchFn(`${this.host}/delegation/status`, {\n method: \"POST\",\n headers: { ...headers, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ cid }),\n });\n if (!response.ok && response.status !== 404) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to get delegation status: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, cid }\n ),\n };\n }\n const parsed = DelegationStatusSchema.safeParse(await response.json());\n const responseStatusMatches = parsed.success && (\n response.status === 404\n ? parsed.data.status === \"not_found\" && !parsed.data.exists\n : parsed.data.status !== \"not_found\"\n );\n if (!parsed.success || parsed.data.cid !== cid || !responseStatusMatches) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Node returned an invalid delegation status response\",\n undefined,\n { cid }\n ),\n };\n }\n return { ok: true, data: parsed.data };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.ABORTED, \"Request aborted\", error),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation status: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /** Query lifecycle-complete delegation history for the authenticated account. */\n async query(\n options: AccountDelegationQueryOptions = {},\n ): Promise<Result<AccountDelegationPage>> {\n const validated = AccountDelegationQueryOptionsSchema.safeParse(options);\n if (!validated.success) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"Invalid delegation query options\",\n undefined,\n { issues: validated.error.issues },\n ),\n };\n }\n if (!this.invokeAny) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Delegation query requires an invokeAny function\",\n ),\n };\n }\n if (!this.accountSpaceId) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Delegation query requires an account space\",\n ),\n };\n }\n try {\n const invocationHeaders = this.invokeAny(this.session, [{\n spaceId: this.accountSpaceId,\n service: \"delegation\",\n path: \"\",\n action: DelegationAction.LIST,\n }]);\n const headers = Object.fromEntries(new Headers(invocationHeaders).entries());\n headers[\"content-type\"] = \"application/json\";\n const response = await this.fetchFn(`${this.host}/delegation/query`, {\n method: \"POST\",\n headers,\n body: JSON.stringify(validated.data),\n });\n if (!response.ok) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to query delegations: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status },\n ),\n };\n }\n const parsed = AccountDelegationPageSchema.safeParse(await response.json());\n if (!parsed.success) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Node returned an invalid delegation query response\",\n ),\n };\n }\n return { ok: true, data: parsed.data };\n } catch (error) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation query: ${String(error)}`,\n error instanceof Error ? error : undefined,\n ),\n };\n }\n }\n\n /**\n * Lists all delegations for the current session's space.\n *\n * Returns both delegations created by the current user (as delegator)\n * and delegations granted to the current user (as delegatee).\n *\n * @returns Result containing an array of Delegations or an error\n *\n * @example\n * ```typescript\n * const result = await manager.list();\n * if (result.ok) {\n * for (const delegation of result.data) {\n * console.log(`${delegation.cid}: ${delegation.path} -> ${delegation.delegateDID}`);\n * }\n * }\n * ```\n */\n async list(): Promise<Result<Delegation[]>> {\n try {\n const response = await this.invokeOperation(\"\", DelegationAction.LIST);\n\n if (!response.ok) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to list delegations: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status }\n ),\n };\n }\n\n const data = (await response.json()) as Array<{\n cid: string;\n delegateDID: string;\n delegatorDID?: string;\n spaceId: string;\n path: string;\n actions: string[];\n expiry: string;\n isRevoked: boolean;\n createdAt?: string;\n parentCid?: string;\n allowSubDelegation?: boolean;\n }>;\n\n const delegations: Delegation[] = data.map((item) => ({\n cid: item.cid,\n delegateDID: item.delegateDID,\n delegatorDID: item.delegatorDID,\n spaceId: item.spaceId,\n path: item.path,\n actions: item.actions,\n expiry: new Date(item.expiry),\n isRevoked: item.isRevoked,\n createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n parentCid: item.parentCid,\n allowSubDelegation: item.allowSubDelegation,\n }));\n\n return { ok: true, data: delegations };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation list: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Gets the full delegation chain for a given delegation.\n *\n * Returns the chain of delegations from the root (original delegator)\n * to the specified delegation, including all intermediate sub-delegations.\n *\n * @param cid - The CID of the delegation to get the chain for\n * @returns Result containing the DelegationChain or an error\n *\n * @example\n * ```typescript\n * const result = await manager.getChain(\"bafy...\");\n * if (result.ok) {\n * console.log(\"Chain length:\", result.data.length);\n * for (const delegation of result.data) {\n * console.log(`- ${delegation.delegatorDID} -> ${delegation.delegateDID}`);\n * }\n * }\n * ```\n */\n async getChain(cid: string): Promise<Result<DelegationChain>> {\n if (!cid) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"cid is required\"\n ),\n };\n }\n\n try {\n const body = JSON.stringify({ cid, includeChain: true });\n\n const response = await this.invokeOperation(\n cid,\n DelegationAction.GET,\n body\n );\n\n if (!response.ok) {\n const errorText = await response.text();\n\n if (response.status === 404) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_FOUND,\n `Delegation not found: ${cid}`\n ),\n };\n }\n\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to get delegation chain: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, cid }\n ),\n };\n }\n\n const data = (await response.json()) as {\n chain: Array<{\n cid: string;\n delegateDID: string;\n delegatorDID?: string;\n spaceId: string;\n path: string;\n actions: string[];\n expiry: string;\n isRevoked: boolean;\n createdAt?: string;\n parentCid?: string;\n allowSubDelegation?: boolean;\n }>;\n };\n\n const chain: DelegationChain = data.chain.map((item) => ({\n cid: item.cid,\n delegateDID: item.delegateDID,\n delegatorDID: item.delegatorDID,\n spaceId: item.spaceId,\n path: item.path,\n actions: item.actions,\n expiry: new Date(item.expiry),\n isRevoked: item.isRevoked,\n createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n parentCid: item.parentCid,\n allowSubDelegation: item.allowSubDelegation,\n }));\n\n return { ok: true, data: chain };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during chain retrieval: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Checks if the current session has permission for a given path and action.\n *\n * This can be used to verify permissions before attempting an operation,\n * or to implement custom access control logic.\n *\n * @param path - The resource path to check\n * @param action - The action to check (e.g., \"tinycloud.kv/get\")\n * @returns Result containing a boolean indicating permission or an error\n *\n * @example\n * ```typescript\n * const result = await manager.checkPermission(\"documents/private/\", \"tinycloud.kv/put\");\n * if (result.ok && result.data) {\n * console.log(\"Permission granted\");\n * } else {\n * console.log(\"Permission denied\");\n * }\n * ```\n */\n async checkPermission(path: string, action: string): Promise<Result<boolean>> {\n if (!path) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"path is required\"\n ),\n };\n }\n\n if (!action) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"action is required\"\n ),\n };\n }\n\n try {\n const body = JSON.stringify({ path, action });\n\n const response = await this.invokeOperation(\n path,\n DelegationAction.CHECK,\n body\n );\n\n if (!response.ok) {\n // 403 means permission denied, which is a valid result\n if (response.status === 403) {\n return { ok: true, data: false };\n }\n\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to check permission: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, path, action }\n ),\n };\n }\n\n const data = (await response.json()) as { allowed: boolean };\n return { ok: true, data: data.allowed };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during permission check: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n}\n","/**\n * Zod schemas for SharingService types.\n *\n * These schemas provide runtime validation for sharing link data,\n * receive options, and service configuration.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n FetchFunction,\n IKVService,\n InvokeFunction,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n JWKSchema,\n DelegationSchema,\n KeyProviderSchema,\n IngestOptionsSchema,\n type Result,\n type DelegationError,\n DelegationErrorCodes,\n} from \"./types.schema.js\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry.js\";\nimport type { DelegationManager } from \"./DelegationManager.js\";\n\n// =============================================================================\n// EncodedShareData Schema\n// =============================================================================\n\n/**\n * Schema for data encoded in a sharing link.\n *\n * This is the primary validation point for external share link data.\n * The link is base64-decoded and JSON-parsed, then validated against this schema.\n */\nexport const EncodedShareDataSchema = z.object({\n /** Private key in JWK format (must include d parameter) */\n key: JWKSchema.refine(\n (jwk) => typeof jwk.d === \"string\" && jwk.d.length > 0,\n { message: \"JWK must include private key (d parameter)\" }\n ),\n /** DID of the key */\n keyDid: z.string().min(1, \"keyDid is required\"),\n /** The delegation granting access */\n delegation: DelegationSchema,\n /** Resource path this link grants access to */\n path: z.string().min(1, \"path is required\"),\n /** TinyCloud host URL */\n host: z.string().url(\"host must be a valid URL\"),\n /** Space ID */\n spaceId: z.string().min(1, \"spaceId is required\"),\n /** Schema version (must be 1) */\n version: z.literal(1),\n});\n\nexport type EncodedShareData = z.infer<typeof EncodedShareDataSchema>;\n\n// =============================================================================\n// ReceiveOptions Schema\n// =============================================================================\n\n/**\n * Schema for options when receiving a sharing link.\n */\nexport const ReceiveOptionsSchema = z.object({\n /**\n * Whether to automatically create a sub-delegation to the current session key.\n * Default: true\n */\n autoSubdelegate: z.boolean().optional(),\n /**\n * Whether to use the current session key for operations (requires autoSubdelegate).\n * Default: true\n */\n useSessionKey: z.boolean().optional(),\n /**\n * Ingestion options passed to CapabilityKeyRegistry.\n */\n ingestOptions: IngestOptionsSchema.optional(),\n});\n\nexport type ReceiveOptions = z.infer<typeof ReceiveOptionsSchema>;\n\n// =============================================================================\n// SharingServiceConfig Schema\n// =============================================================================\n\n/**\n * Schema for SharingService configuration.\n *\n * Note: Function fields use z.function() for shape validation only.\n * External types (ServiceSession, DelegationManager, ICapabilityKeyRegistry)\n * use z.unknown() with runtime type refinement.\n */\nexport const SharingServiceConfigSchema = z.object({\n /** TinyCloud host URLs */\n hosts: z.array(z.string().url()).min(1, \"At least one host URL is required\"),\n /**\n * Active session for authentication.\n * Required for generate(), optional for receive().\n */\n session: z\n .unknown()\n .refine(\n (val): val is ServiceSession =>\n val === undefined || (val !== null && typeof val === \"object\"),\n { message: \"Expected a ServiceSession object or undefined\" }\n )\n .optional(),\n /** Platform-specific invoke function */\n invoke: z\n .unknown()\n .refine((val): val is InvokeFunction => typeof val === \"function\", {\n message: \"Expected an invoke function\",\n }),\n /** Optional custom fetch implementation */\n fetch: z\n .unknown()\n .refine(\n (val): val is FetchFunction =>\n val === undefined || typeof val === \"function\",\n { message: \"Expected a fetch function or undefined\" }\n )\n .optional(),\n /** Key provider for cryptographic operations */\n keyProvider: KeyProviderSchema,\n /** Capability key registry for key/delegation management */\n registry: z\n .unknown()\n .refine(\n (val): val is ICapabilityKeyRegistry =>\n val !== null && typeof val === \"object\",\n { message: \"Expected an ICapabilityKeyRegistry object\" }\n ),\n /**\n * Delegation manager for creating delegations.\n * Required for generate(), optional for receive().\n */\n delegationManager: z\n .unknown()\n .refine(\n (val): val is DelegationManager =>\n val === undefined || (val !== null && typeof val === \"object\"),\n { message: \"Expected a DelegationManager object or undefined\" }\n )\n .optional(),\n /** Factory for creating KV service instances */\n createKVService: z.unknown().refine(\n (val): val is (config: {\n hosts: string[];\n session: ServiceSession;\n invoke: InvokeFunction;\n fetch?: FetchFunction;\n pathPrefix?: string;\n }) => IKVService => typeof val === \"function\",\n { message: \"Expected a createKVService factory function\" }\n ),\n /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n baseUrl: z.string().optional(),\n /**\n * Custom delegation creation function.\n */\n createDelegation: z\n .unknown()\n .refine((val) => val === undefined || typeof val === \"function\", {\n message: \"Expected a createDelegation function or undefined\",\n })\n .optional(),\n /**\n * WASM function for client-side delegation creation.\n */\n createDelegationWasm: z\n .unknown()\n .refine((val) => val === undefined || typeof val === \"function\", {\n message: \"Expected a createDelegationWasm function or undefined\",\n })\n .optional(),\n /** CID computation used to verify transportable child delegations. */\n computeCid: z\n .unknown()\n .refine((val): val is (data: Uint8Array, codec: bigint) => string => val === undefined || typeof val === \"function\", {\n message: \"Expected a computeCid function or undefined\",\n })\n .optional(),\n /**\n * Path prefix for KV operations.\n */\n pathPrefix: z.string().optional(),\n /**\n * Session expiry time.\n */\n sessionExpiry: z.date().optional(),\n /**\n * Callback to create a DIRECT delegation from wallet to share key.\n * This is the preferred method for long-lived share links because it\n * bypasses the session delegation chain entirely.\n */\n onRootDelegationNeeded: z\n .unknown()\n .refine((val) => val === undefined || typeof val === \"function\", {\n message: \"Expected an onRootDelegationNeeded function or undefined\",\n })\n .optional(),\n});\n\nexport type SharingServiceConfig = z.infer<typeof SharingServiceConfigSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates encoded share data from a decoded link.\n *\n * @param data - Unknown data to validate (from JSON.parse)\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const parsed = JSON.parse(base64UrlDecode(linkData));\n * const result = validateEncodedShareData(parsed);\n * if (!result.ok) {\n * return result; // Forward the error\n * }\n * const shareData = result.data;\n * ```\n */\nexport function validateEncodedShareData(\n data: unknown\n): Result<EncodedShareData, DelegationError> {\n const result = EncodedShareDataSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: `Invalid share data: ${result.error.message}`,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates receive options.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateReceiveOptions(\n data: unknown\n): Result<ReceiveOptions, DelegationError> {\n const result = ReceiveOptionsSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: `Invalid receive options: ${result.error.message}`,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates SharingService configuration.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateSharingServiceConfig(\n data: unknown\n): Result<SharingServiceConfig, DelegationError> {\n const result = SharingServiceConfigSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: `Invalid SharingService config: ${result.error.message}`,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n","/**\n * Capability subset checking and recap parsing.\n *\n * This module powers the capability-chain delegation flow. The key decision\n * a `delegateTo` call has to make is: \"are the requested capabilities a\n * subset of what the current session already grants?\"\n *\n * - If yes → issue the delegation via the session-key UCAN path (no wallet prompt).\n * - If no → raise {@link PermissionNotInManifestError} so the caller can\n * trigger an escalation flow via `requestPermissions`.\n *\n * Canonical spec: `.claude/specs/capability-chain.md`.\n *\n * @packageDocumentation\n */\n\nimport {\n DEFAULT_MANIFEST_SPACE,\n type PermissionEntry,\n SERVICE_SHORT_TO_LONG,\n expandActionShortNames,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a `delegateTo` call requests capabilities that the current\n * session does not already grant. The caller can catch this and trigger\n * `requestPermissions(missing)` to show an escalation modal.\n */\nexport class PermissionNotInManifestError extends Error {\n public readonly missing: PermissionEntry[];\n public readonly granted: PermissionEntry[];\n\n constructor(missing: PermissionEntry[], granted: PermissionEntry[]) {\n super(\n `Requested capabilities exceed current session. Missing ${missing.length} entries.`\n );\n this.name = \"PermissionNotInManifestError\";\n this.missing = missing;\n this.granted = granted;\n }\n}\n\n/**\n * Thrown when the current session has expired (or will expire within the\n * safety margin). The caller should trigger a fresh sign-in.\n */\nexport class SessionExpiredError extends Error {\n public readonly expiredAt: Date;\n\n constructor(expiredAt: Date) {\n super(`Session expired at ${expiredAt.toISOString()}`);\n this.name = \"SessionExpiredError\";\n this.expiredAt = expiredAt;\n }\n}\n\n/**\n * Thrown when the installed WASM delegation boundary cannot encode every\n * constrained ReCap branch in a requested child delegation.\n */\nexport class CaveatedDelegationUnsupportedError extends Error {\n /** Stable machine-readable error code for fail-closed caveated delegation. */\n code = \"CAVEATED_DELEGATION_UNSUPPORTED\" as const;\n /** Requested entries whose constrained ReCap branches cannot be preserved. */\n entries: PermissionEntry[];\n\n constructor(entries: PermissionEntry[]) {\n super(\n \"Cannot create a caveated delegation because this WASM delegation boundary cannot preserve every ReCap caveat branch exactly.\"\n );\n this.name = \"CaveatedDelegationUnsupportedError\";\n this.entries = entries.map(cloneEntry);\n }\n}\n\n// ---------------------------------------------------------------------------\n// Space normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize a space identifier to its short-name form.\n *\n * Recap resource URIs in a signed SIWE encode the space as a full URI of the\n * form `tinycloud:pkh:eip155:{chainId}:{address}:{name}` (e.g.\n * `tinycloud:pkh:eip155:1:0xd559...:default`). Manifest permissions and\n * backend-advertised permissions use the short `{name}` form (e.g.\n * `\"default\"`).\n *\n * Strict string comparison between these two forms would always fail, so we\n * normalize both sides to the short name before comparing. The trailing\n * segment after the last `:` in a `tinycloud:` URI is the space name.\n *\n * Short names (`\"default\"`, `\"work-space\"`) are returned unchanged.\n * Any non-`tinycloud:` string is returned unchanged. A malformed URI with a\n * trailing colon is returned unchanged (so the check degrades to a strict\n * mismatch rather than collapsing to an empty string).\n *\n * @internal\n */\nexport function normalizeSpace(space: string): string {\n if (!space.startsWith(\"tinycloud:\")) {\n return space;\n }\n const lastColon = space.lastIndexOf(\":\");\n if (lastColon === -1 || lastColon === space.length - 1) {\n return space;\n }\n return space.slice(lastColon + 1);\n}\n\n// ---------------------------------------------------------------------------\n// Subset check\n// ---------------------------------------------------------------------------\n\nexport interface SubsetCheckResult {\n /** True when every requested entry is covered by a granted entry. */\n subset: boolean;\n /** Entries the granted set does not cover (empty when `subset` is true). */\n missing: PermissionEntry[];\n}\n\n/**\n * Check whether `requested` is a strict subset of `granted`.\n *\n * Matching rules for each `requested[i]`:\n * - `service` matches exactly.\n * - `space` matches exactly.\n * - Path containment:\n * - If `granted.path` ends with `/`, it covers any `requested.path` that\n * starts with `granted.path`.\n * - Otherwise, the paths must match exactly.\n * - Action containment: every requested URN must be matched exactly or by a\n * service-scoped wildcard such as `tinycloud.kv/*`.\n *\n * Any `requested` entry that does not find a matching `granted` entry is\n * added to `missing` and the overall result is non-subset.\n *\n * Both sides are expected to be in the canonical long-form shape (service\n * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}\n * or `expandActionShortNames` to normalize inputs first.\n */\nexport function isCapabilitySubset(\n requested: readonly PermissionEntry[],\n granted: readonly PermissionEntry[]\n): SubsetCheckResult {\n const missing: PermissionEntry[] = [];\n\n for (const req of requested) {\n const match = granted.find((g) => canonicalizeEntryMatches(req, g));\n if (match === undefined) {\n missing.push(cloneEntry(req));\n continue;\n }\n // `match` is confirmed to cover `req`; nothing to record.\n }\n\n return { subset: missing.length === 0, missing };\n}\n\n/**\n * Returns true when `granted` fully covers `requested` — same service, same\n * space, path containment per spec, and action set containment.\n */\nfunction canonicalizeEntryMatches(\n requested: PermissionEntry,\n granted: PermissionEntry\n): boolean {\n if (requested.service !== granted.service) {\n return false;\n }\n // Normalize both sides so callers passing short names (`\"default\"`) match\n // recap-parsed full URIs (`\"tinycloud:pkh:eip155:1:0xd559...:default\"`) and\n // vice versa. Idempotent for short names.\n if (\n normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !==\n normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)\n ) {\n return false;\n }\n if (!pathContains(granted.path, requested.path)) {\n return false;\n }\n // Normalize actions to full URN form on both sides before set comparison,\n // so a caller passing short names (\"get\") against a granted entry with\n // full URNs still behaves correctly.\n const reqActions = new Set(\n expandActionShortNames(requested.service, requested.actions)\n );\n const grantedActions = expandActionShortNames(granted.service, granted.actions);\n for (const a of reqActions) {\n if (!grantedActions.some((grantedAction) => actionContains(grantedAction, a))) {\n return false;\n }\n }\n // There is no safe general partial ordering for arbitrary ReCap caveat\n // objects. A caveated authority therefore only covers the same caveat set;\n // treating it as uncaveated would authorize a broader child delegation.\n if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {\n return false;\n }\n return true;\n}\n\n/**\n * Compare ReCap caveat branch sets without losing signed branch structure.\n *\n * ReCap represents an unconstrained ability as `[{}]`, while SDK callers can\n * represent that same authority as `undefined` or `[]`. Those three forms are\n * equivalent. Every other branch, including an unconstrained branch mixed\n * with a constrained one, remains part of the canonical comparison.\n */\nexport function recapCaveatsEqual(\n left: readonly Record<string, unknown>[] | undefined,\n right: readonly Record<string, unknown>[] | undefined,\n): boolean {\n return canonicalizeRecapCaveats(left) === canonicalizeRecapCaveats(right);\n}\n\n/**\n * Canonicalize a ReCap caveat branch set for exact equality checks.\n *\n * Object keys and branch order do not affect equality. A lone unconstrained\n * branch is normalized to the SDK's empty-caveat representation, but an\n * unconstrained branch in a mixed set is deliberately retained.\n */\nexport function canonicalizeRecapCaveats(\n caveats: readonly Record<string, unknown>[] | undefined,\n): string {\n const canonicalize = (value: unknown): string => {\n if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n return JSON.stringify(value);\n }\n if (typeof value === \"number\") {\n if (Number.isFinite(value)) return JSON.stringify(value);\n throw new Error(\"ReCap caveats must contain only JSON values.\");\n }\n if (Array.isArray(value)) return `[${value.map(canonicalize).join(\",\")}]`;\n if (typeof value === \"object\") {\n const object = value as Record<string, unknown>;\n const prototype = Object.getPrototypeOf(object);\n if (prototype !== Object.prototype && prototype !== null) {\n throw new Error(\"ReCap caveats must contain only JSON values.\");\n }\n return `{${Object.keys(object).sort().map((key) =>\n `${JSON.stringify(key)}:${canonicalize(object[key])}`,\n ).join(\",\")}}`;\n }\n throw new Error(\"ReCap caveats must contain only JSON values.\");\n };\n const branches = (caveats ?? []).map(canonicalize).sort();\n if (branches.length === 0 || (branches.length === 1 && branches[0] === \"{}\")) {\n return \"[]\";\n }\n return `[${branches.join(\",\")}]`;\n}\n\n/** Return whether a granted action pattern covers one requested action. */\nexport function actionContains(grantedAction: string, requestedAction: string): boolean {\n if (grantedAction === \"*\" || grantedAction === requestedAction) return true;\n if (!grantedAction.endsWith(\"/*\")) return false;\n const service = grantedAction.slice(0, -2);\n return requestedAction === service || requestedAction.startsWith(`${service}/`);\n}\n\n/**\n * Path containment per spec:\n * - `granted.path` ends with `/` → prefix match (requested starts with granted)\n * - otherwise → exact string match\n *\n * The empty string is treated as \"no path constraint\" and matches anything.\n * The single-character `\"/\"` also matches anything (it is a trailing-slash\n * prefix of zero-length).\n */\nfunction pathContains(grantedPath: string, requestedPath: string): boolean {\n if (grantedPath === \"\" || grantedPath === \"/\") {\n return true;\n }\n if (grantedPath.endsWith(\"/\")) {\n return requestedPath.startsWith(grantedPath);\n }\n return requestedPath === grantedPath;\n}\n\nfunction cloneEntry(entry: PermissionEntry): PermissionEntry {\n return {\n service: entry.service,\n ...(entry.space !== undefined ? { space: entry.space } : {}),\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.caveats !== undefined\n ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n : {}),\n ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n };\n}\n\n// ---------------------------------------------------------------------------\n// Recap parsing (WASM wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * The raw shape returned from the WASM `parseRecapFromSiwe` export. The\n * Rust layer encodes the service in the short form (e.g. `\"kv\"`) because\n * that is what the SIWE recap resource URI actually contains. We normalize\n * to the manifest long form (`\"tinycloud.kv\"`) in {@link parseRecapCapabilities}.\n *\n * @internal\n */\nexport interface WasmRecapEntry {\n service: string;\n space: string;\n path: string;\n actions: string[];\n /** Exact ReCap caveats shared by every action in this entry. */\n caveats?: Record<string, unknown>[];\n}\n\n/**\n * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed\n * SIWE message string and returns an array of raw recap entries. Throws if\n * the SIWE is malformed or the recap statement has been tampered.\n *\n * Exposed as an interface so the SDK can inject the web or node binding\n * without `capabilities.ts` needing to know which.\n */\nexport type ParseRecapFromSiwe = (siweString: string) => WasmRecapEntry[];\n\n/**\n * Parse a signed SIWE message into an array of {@link PermissionEntry}\n * objects in the canonical long-form manifest shape.\n *\n * This is a thin wrapper around the WASM `parseRecapFromSiwe` export that:\n * 1. Normalizes short-form services (`\"kv\"`) to long-form (`\"tinycloud.kv\"`).\n * 2. Returns entries in a deterministic order (sorted by space, then service,\n * then path) so downstream equality checks are stable.\n *\n * Returns an empty array when the SIWE has no recap resource (plain auth\n * SIWE); this matches the WASM function's behavior and the spec.\n *\n * @param parseWasm The WASM `parseRecapFromSiwe` binding.\n * @param siwe The signed SIWE message string (exactly what `session.siwe` stores).\n */\nexport function parseRecapCapabilities(\n parseWasm: ParseRecapFromSiwe,\n siwe: string\n): PermissionEntry[] {\n const raw = parseWasm(siwe);\n if (!Array.isArray(raw)) {\n throw new Error(\n \"parseRecapFromSiwe returned a non-array value; wasm binding may be out of sync\"\n );\n }\n const normalized: PermissionEntry[] = raw.map((entry) => {\n const longService =\n SERVICE_SHORT_TO_LONG[entry.service] ??\n // Unknown short names pass through. If the recap already contained a\n // long-form service (e.g. a future tinycloud-node version emits long\n // form directly), don't double-prefix.\n (entry.service.startsWith(\"tinycloud.\")\n ? entry.service\n : `tinycloud.${entry.service}`);\n return {\n service: longService,\n // The Rust layer emits the space as a full `tinycloud:pkh:...:name`\n // URI (the recap target URI). Normalize to the short name so the\n // returned entries match the shape manifests use.\n space: normalizeSpace(entry.space),\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.caveats === undefined\n ? {}\n : { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }),\n };\n });\n\n // Sort for determinism (callers do equality checks on arrays of entries\n // in tests; deterministic ordering keeps those stable).\n normalized.sort((a, b) => {\n const aSpace = a.space ?? DEFAULT_MANIFEST_SPACE;\n const bSpace = b.space ?? DEFAULT_MANIFEST_SPACE;\n if (aSpace !== bSpace) return aSpace < bSpace ? -1 : 1;\n if (a.service !== b.service) return a.service < b.service ? -1 : 1;\n if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n return 0;\n });\n\n return normalized;\n}\n","/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * This service implements the v2 sharing specification, which embeds private keys\n * directly in sharing links. This allows recipients to exercise delegations\n * without requiring prior session setup.\n *\n * Key differences from v1 SharingLinks:\n * - Private keys are embedded in the link (not just tokens)\n * - Recipients can optionally sub-delegate to their own session key\n * - Pre-configured KV service returned for immediate use\n *\n * @packageDocumentation\n */\n\nimport type {\n IKVService,\n ServiceSession,\n InvokeFunction,\n FetchFunction,\n} from \"@tinycloud/sdk-services\";\nimport type {\n Result,\n DelegationError,\n Delegation,\n KeyInfo,\n KeyProvider,\n GenerateShareParams,\n ShareLink,\n ShareLinkData,\n ShareSchema,\n JWK,\n IngestOptions,\n CreateDelegationParams,\n CreateDelegationWasmParams,\n CreateDelegationWasmResult,\n} from \"./types\";\nimport { DelegationErrorCodes } from \"./types\";\nimport type { DelegationManager } from \"./DelegationManager\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry\";\nimport { validateEncodedShareData } from \"./SharingService.schema.js\";\nimport { SERVICE_LONG_TO_SHORT, type PermissionEntry } from \"../manifest\";\nimport { principalDid } from \"../identity\";\nimport {\n actionContains,\n CaveatedDelegationUnsupportedError,\n recapCaveatsEqual,\n} from \"../capabilities\";\nimport { bases } from \"multiformats/basics\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\n\n// ---------------------------------------------------------------------------\n// Local helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Infer the short-form service name (`\"kv\"`, `\"sql\"`, etc) that all of the\n * given full-URN action strings belong to.\n *\n * SharingService issues single-service delegations (KV-only, SQL-only, …) —\n * the multi-resource WASM `createDelegation` call requires the service\n * segment explicitly because it's keyed separately from the action list.\n * This helper extracts the namespace half (`\"tinycloud.kv\"`) from each URN,\n * maps it to the short form via {@link SERVICE_LONG_TO_SHORT}, and returns\n * `undefined` if the actions are not all from the same known service.\n *\n * Returning `undefined` is intentional: the caller must surface a clear\n * error rather than guessing.\n */\nfunction inferShortServiceFromActionUrns(\n actions: readonly string[]\n): string | undefined {\n let short: string | undefined;\n for (const action of actions) {\n const slash = action.indexOf(\"/\");\n if (slash === -1) return undefined;\n const longService = action.slice(0, slash);\n const candidate = SERVICE_LONG_TO_SHORT[longService];\n if (candidate === undefined) return undefined;\n if (short === undefined) {\n short = candidate;\n } else if (short !== candidate) {\n return undefined;\n }\n }\n return short;\n}\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * Default actions for read-only sharing links.\n */\nconst DEFAULT_READ_ACTIONS = [\"tinycloud.kv/get\", \"tinycloud.kv/metadata\"];\n\n/**\n * Default expiry for share links — SHARE tier (see ../expiry.ts).\n */\nimport { EXPIRY } from \"../expiry\";\nconst DEFAULT_EXPIRY_MS = EXPIRY.SHARE_MS;\n\n/**\n * Prefix for the base64 schema.\n */\nconst BASE64_PREFIX = \"tc1:\";\n\n// =============================================================================\n// Helper Functions\n// =============================================================================\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n code: string,\n message: string,\n cause?: Error,\n meta?: Record<string, unknown>\n): DelegationError {\n return {\n code,\n message,\n service: \"delegation\",\n cause,\n meta,\n };\n}\n\n/**\n * Base64 encode for URLs (URL-safe base64).\n */\nfunction base64UrlEncode(data: string): string {\n // Use btoa for browser, Buffer for Node.js\n let base64: string;\n if (typeof btoa !== \"undefined\") {\n base64 = btoa(unescape(encodeURIComponent(data)));\n } else if (typeof Buffer !== \"undefined\") {\n base64 = Buffer.from(data, \"utf-8\").toString(\"base64\");\n } else {\n throw new Error(\"No base64 encoding available\");\n }\n // Make URL-safe\n return base64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Base64 decode for URLs (URL-safe base64).\n */\nfunction base64UrlDecode(encoded: string): string {\n // Restore standard base64\n let base64 = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n // Add padding if needed\n while (base64.length % 4) {\n base64 += \"=\";\n }\n // Decode\n if (typeof atob !== \"undefined\") {\n return decodeURIComponent(escape(atob(base64)));\n } else if (typeof Buffer !== \"undefined\") {\n return Buffer.from(base64, \"base64\").toString(\"utf-8\");\n } else {\n throw new Error(\"No base64 decoding available\");\n }\n}\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Data encoded in a sharing link.\n */\nexport interface EncodedShareData {\n /** Private key in JWK format (includes d parameter) */\n key: JWK;\n /** DID of the key */\n keyDid: string;\n /** The delegation granting access */\n delegation: Delegation;\n /** Resource path this link grants access to */\n path: string;\n /** TinyCloud host URL */\n host: string;\n /** Space ID */\n spaceId: string;\n /** Schema version */\n version: 1;\n}\n\n/**\n * Options for receiving a sharing link.\n */\nexport interface ReceiveOptions {\n /**\n * Whether to automatically create a sub-delegation to the current session key.\n * Default: true\n */\n autoSubdelegate?: boolean;\n /**\n * Whether to use the current session key for operations (requires autoSubdelegate).\n * Default: true\n */\n useSessionKey?: boolean;\n /**\n * Ingestion options passed to CapabilityKeyRegistry.\n */\n ingestOptions?: IngestOptions;\n}\n\n/**\n * Result of receiving a sharing link.\n */\nexport interface ShareAccess {\n /** The delegation that was received/created */\n delegation: Delegation;\n /** Key info for the received key */\n key: KeyInfo;\n /** Pre-configured KV service for the shared path */\n kv: IKVService;\n /** The space ID */\n spaceId: string;\n /** The path prefix for this share */\n path: string;\n}\n\n/**\n * Parameters for attenuating a received share to another principal.\n *\n * Omitted path/actions/expiry inherit the received share's exact values. Any\n * supplied value must be equal to or an attenuated subset of the parent.\n */\nexport interface DelegateReceivedShareParams {\n /** DID that may exercise the child delegation. */\n delegateDID: string;\n /** Equal to or below the shared path. Defaults to the shared path. */\n path?: string;\n /** Subset of the shared actions. Defaults to all shared actions. */\n actions?: string[];\n /** No later than the sharing-link expiry. Defaults to the parent expiry. */\n expiry?: Date;\n /** Optional node origin that further narrows the configured-host allowlist. */\n expectedHost?: string;\n}\n\n/**\n * A transport-ready child delegation with non-secret source lineage.\n *\n * `delegation.delegationHeader` is a live bearer credential. Treat it like a\n * secret: do not log it or persist it outside secure credential storage.\n * Only `source` is safe to retain as non-secret lineage metadata.\n */\nexport interface DelegatedShareAccess {\n delegation: Delegation & {\n delegationHeader: { Authorization: string };\n ownerAddress: string;\n chainId: number;\n host: string;\n resources: Array<{ service: string; space: string; path: string; actions: string[] }>;\n disableSubDelegation: boolean;\n };\n source: {\n parentCid: string;\n spaceId: string;\n path: string;\n host: string;\n expiresAt: Date;\n };\n}\n\n/**\n * Configuration for SharingService.\n */\nexport interface SharingServiceConfig {\n /** TinyCloud host URLs */\n hosts: string[];\n /**\n * Active session for authentication.\n * Required for generate(), optional for receive().\n */\n session?: ServiceSession;\n /** Platform-specific invoke function */\n invoke: InvokeFunction;\n /** Optional custom fetch implementation */\n fetch?: FetchFunction;\n /** Key provider for cryptographic operations */\n keyProvider: KeyProvider;\n /** Capability key registry for key/delegation management */\n registry: ICapabilityKeyRegistry;\n /**\n * Delegation manager for creating delegations (used if createDelegation not provided).\n * Required for generate(), optional for receive().\n */\n delegationManager?: DelegationManager;\n /** Factory for creating KV service instances */\n createKVService: (config: {\n hosts: string[];\n session: ServiceSession;\n invoke: InvokeFunction;\n fetch?: FetchFunction;\n pathPrefix?: string;\n }) => IKVService;\n /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n baseUrl?: string;\n /**\n * Custom delegation creation function. When provided, this is used instead\n * of delegationManager.create(). This allows platforms to use their own\n * delegation creation logic (e.g., SIWE-based /delegate endpoint).\n */\n createDelegation?: (params: CreateDelegationParams) => Promise<Result<Delegation, DelegationError>>;\n /**\n * WASM function for client-side delegation creation.\n * When provided, this is preferred over server-side creation (createDelegation/delegationManager).\n * Creates UCAN delegations directly without requiring server roundtrip.\n */\n createDelegationWasm?: (params: CreateDelegationWasmParams) => CreateDelegationWasmResult;\n /** Compute a CID for serialized delegation bytes. Required for share attenuation. */\n computeCid?: (data: Uint8Array, codec: bigint) => string;\n /**\n * Path prefix for KV operations.\n * When set, paths passed to generate() are prefixed with this value.\n * This ensures the share path matches the session's authorized paths.\n */\n pathPrefix?: string;\n /**\n * Session expiry time.\n * When set, sharing link expiry is clamped to not exceed this value\n * unless onRootDelegationNeeded is provided and returns a new delegation.\n */\n sessionExpiry?: Date;\n /**\n * Callback to create a DIRECT delegation from the root (wallet) to a share key.\n * This bypasses the session delegation chain, allowing share links with\n * expiry longer than the current session.\n *\n * When provided and share expiry > session expiry:\n * 1. SharingService creates the ephemeral share key\n * 2. This callback is invoked with the share key DID\n * 3. The callback signs a direct PKH -> share key delegation with the wallet\n * 4. The returned delegation is used for the share link\n *\n * This is the CORRECT solution for long-lived share links because:\n * - It creates a fresh delegation chain: PKH -> share key\n * - Not constrained by session expiry (no sub-delegation from session key)\n *\n * @param params - Parameters for creating the root delegation\n * @returns The delegation from wallet to share key, or undefined to fall back to session extension\n */\n onRootDelegationNeeded?: (params: {\n /** DID of the share key to delegate to */\n shareKeyDID: string;\n /** Space ID */\n spaceId: string;\n /** Path to grant access to */\n path: string;\n /** Actions to grant */\n actions: string[];\n /** Requested expiry time */\n requestedExpiry: Date;\n }) => Promise<Delegation | undefined>;\n /** Reject operations after the host session/service graph has been retired. */\n assertActive?: () => void;\n}\n\n/**\n * Interface for the SharingService.\n */\nexport interface ISharingService {\n /**\n * Generate a sharing link with an embedded private key.\n *\n * This creates a new session key, delegates to it, and encodes\n * the key and delegation into a shareable link.\n */\n generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;\n\n /**\n * Receive and activate a sharing link.\n *\n * Decodes the link, ingests the key into the registry, and optionally\n * creates a sub-delegation to the current session key.\n */\n receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;\n\n /**\n * Consume a sharing link locally and create an attenuated child delegation.\n * The raw link and embedded private JWK are never returned. The returned\n * child delegation is itself a sensitive bearer credential.\n */\n delegateReceivedShare(\n link: string,\n params: DelegateReceivedShareParams\n ): Promise<Result<DelegatedShareAccess, DelegationError>>;\n\n /**\n * Encode sharing data into a link string.\n */\n encodeLink(data: EncodedShareData, schema?: ShareSchema): string;\n\n /**\n * Decode a link string into sharing data.\n */\n decodeLink(link: string): EncodedShareData;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * @example\n * ```typescript\n * import { SharingService } from \"@tinycloud/sdk-core/delegations\";\n *\n * const sharing = new SharingService({\n * hosts: [\"https://node.tinycloud.xyz\"],\n * session,\n * invoke,\n * keyProvider,\n * registry,\n * delegationManager,\n * createKVService,\n * baseUrl: \"https://share.myapp.com\"\n * });\n *\n * // Generate a sharing link\n * const result = await sharing.generate({\n * path: \"/kv/documents/report.pdf\",\n * actions: [\"tinycloud.kv/get\"],\n * expiry: new Date(\"2024-12-31\")\n * });\n *\n * if (result.ok) {\n * console.log(\"Share this URL:\", result.data.url);\n * }\n *\n * // Receive a sharing link\n * const receiveResult = await sharing.receive(shareUrl);\n * if (receiveResult.ok) {\n * // Use the pre-configured KV service\n * const data = await receiveResult.data.kv.get(\"report.pdf\");\n * }\n * ```\n */\nexport class SharingService implements ISharingService {\n private hosts: string[];\n private session?: ServiceSession;\n private invoke: InvokeFunction;\n private fetchFn: FetchFunction;\n private keyProvider: KeyProvider;\n private registry: ICapabilityKeyRegistry;\n private delegationManager?: DelegationManager;\n private createKVService: SharingServiceConfig[\"createKVService\"];\n private baseUrl: string;\n private createDelegationFn?: SharingServiceConfig[\"createDelegation\"];\n private createDelegationWasmFn?: SharingServiceConfig[\"createDelegationWasm\"];\n private computeCidFn?: SharingServiceConfig[\"computeCid\"];\n private pathPrefix: string;\n private sessionExpiry?: Date;\n private onRootDelegationNeeded?: SharingServiceConfig[\"onRootDelegationNeeded\"];\n private assertActiveFn?: SharingServiceConfig[\"assertActive\"];\n\n /**\n * Creates a new SharingService instance.\n */\n constructor(config: SharingServiceConfig) {\n this.hosts = config.hosts;\n this.session = config.session;\n this.invoke = config.invoke;\n this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n this.keyProvider = config.keyProvider;\n this.registry = config.registry;\n this.delegationManager = config.delegationManager;\n this.createKVService = config.createKVService;\n this.baseUrl = (config.baseUrl ?? \"\").replace(/\\/$/, \"\"); // Remove trailing slash\n this.createDelegationFn = config.createDelegation;\n this.createDelegationWasmFn = config.createDelegationWasm;\n this.computeCidFn = config.computeCid;\n this.pathPrefix = config.pathPrefix ?? \"\";\n this.sessionExpiry = config.sessionExpiry;\n this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n this.assertActiveFn = config.assertActive;\n }\n\n /**\n * Gets the primary host URL.\n */\n private get host(): string {\n return this.hosts[0];\n }\n\n /**\n * Updates the session (e.g., after re-authentication).\n */\n public updateSession(session: ServiceSession): void {\n this.assertActiveFn?.();\n this.session = session;\n }\n\n /**\n * Updates the service configuration.\n * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.\n */\n public updateConfig(config: Partial<Pick<SharingServiceConfig, \"session\" | \"delegationManager\" | \"createDelegation\" | \"createDelegationWasm\" | \"sessionExpiry\" | \"onRootDelegationNeeded\" | \"assertActive\">>): void {\n this.assertActiveFn?.();\n if (config.session !== undefined) {\n this.session = config.session;\n }\n if (config.delegationManager !== undefined) {\n this.delegationManager = config.delegationManager;\n }\n if (config.createDelegation !== undefined) {\n this.createDelegationFn = config.createDelegation;\n }\n if (config.createDelegationWasm !== undefined) {\n this.createDelegationWasmFn = config.createDelegationWasm;\n }\n if (config.sessionExpiry !== undefined) {\n this.sessionExpiry = config.sessionExpiry;\n }\n if (config.onRootDelegationNeeded !== undefined) {\n this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n }\n if (config.assertActive !== undefined) {\n this.assertActiveFn = config.assertActive;\n }\n }\n\n /**\n * Generate a sharing link with an embedded private key.\n *\n * Flow:\n * 1. Spawn new session key (unique per share)\n * 2. Create delegation from current session to spawned key\n * 3. Package: { key (with private!), delegation, path, host }\n * 4. Encode based on schema (base64 for now)\n * 5. Return link string\n */\n async generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n // Require session for generating (not for receiving)\n if (!this.session) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Session required for generating sharing links. Call signIn() first.\"\n ),\n };\n }\n\n // Require delegation capability\n if (!this.createDelegationWasmFn && !this.createDelegationFn && !this.delegationManager) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"DelegationManager, createDelegation, or createDelegationWasm function required for generating sharing links.\"\n ),\n };\n }\n\n // Validate path\n if (!params.path) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"path is required\"\n ),\n };\n }\n\n const actions = params.actions ?? DEFAULT_READ_ACTIONS;\n const requestedExpiry = params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS);\n let expiry = requestedExpiry;\n\n const schema: ShareSchema = params.schema ?? \"base64\";\n\n // Build full path with prefix (matches how KVService stores data)\n // If pathPrefix is \"demo-app\" and path is \"hello\", fullPath is \"demo-app/hello\"\n const fullPath = this.pathPrefix\n ? `${this.pathPrefix}/${params.path}`.replace(/\\/+/g, \"/\") // Normalize slashes\n : params.path;\n\n // Only base64 schema is implemented in v1\n if (schema !== \"base64\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n `Schema '${schema}' not implemented. Only 'base64' is supported.`\n ),\n };\n }\n\n // Step 1: Spawn a new session key unique to this share\n // We create this FIRST so we can pass its DID to onRootDelegationNeeded if needed\n let keyId: string;\n let keyDid: string;\n let keyJwk: JWK;\n\n try {\n const shareKeyName = `share:${Date.now()}:${Math.random().toString(36).substring(2, 10)}`;\n keyId = await this.keyProvider.createSessionKey(shareKeyName);\n const keyCreationActiveError = this.retiredGraphError();\n if (keyCreationActiveError) return { ok: false, error: keyCreationActiveError };\n keyDid = await this.keyProvider.getDID(keyId);\n const keyDidActiveError = this.retiredGraphError();\n if (keyDidActiveError) return { ok: false, error: keyDidActiveError };\n keyJwk = this.keyProvider.getJWK(keyId) as JWK;\n\n // Ensure the private key is included\n if (!keyJwk.d) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"KeyProvider did not return private key (d parameter) in JWK\"\n ),\n };\n }\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to generate session key for share: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n\n // Step 2: Check if any existing key can satisfy this delegation\n // Only prompt for root delegation if NO existing key in the registry can handle it\n let delegation: Delegation;\n // Strip fragment from DID URL to get plain DID for UCAN audience\n // getDID() returns \"did:key:z6Mk...#z6Mk...\" but audience needs \"did:key:z6Mk...\"\n const plainDID = keyDid.split('#')[0];\n\n // Helper to handle delegation result (returns early on error)\n const handleDelegationResult = (\n result: Awaited<ReturnType<typeof this.createSessionDelegation>>\n ): Delegation | { ok: false; error: DelegationError } => {\n if (result && typeof result === 'object' && 'ok' in result) {\n return result as { ok: false; error: DelegationError };\n }\n return result as Delegation;\n };\n\n // Check if any key in the registry can satisfy this delegation request\n // A key can satisfy the request if it has a delegation that:\n // 1. Covers the required path and actions\n // 2. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n // 3. Allows sub-delegation\n const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(\n fullPath,\n actions,\n requestedExpiry\n );\n\n if (canSatisfyFromRegistry) {\n // An existing key can satisfy this request - use session delegation (no prompt)\n const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);\n const childDelegationActiveError = this.retiredGraphError();\n if (childDelegationActiveError) return { ok: false, error: childDelegationActiveError };\n const parsed = handleDelegationResult(delegationResult);\n if ('ok' in parsed && parsed.ok === false) {\n return parsed;\n }\n delegation = parsed as Delegation;\n } else if (this.onRootDelegationNeeded) {\n // No existing key can satisfy the request - try root delegation\n try {\n const rootDelegation = await this.onRootDelegationNeeded({\n shareKeyDID: plainDID,\n spaceId: this.session.spaceId,\n path: fullPath,\n actions,\n requestedExpiry,\n });\n const rootDelegationActiveError = this.retiredGraphError();\n if (rootDelegationActiveError) return { ok: false, error: rootDelegationActiveError };\n\n if (rootDelegation) {\n delegation = rootDelegation;\n expiry = requestedExpiry;\n } else {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"The active session ReCap does not authorize this sharing delegation.\",\n ),\n };\n }\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"The active session ReCap does not authorize this sharing delegation.\",\n err instanceof Error ? err : undefined,\n ),\n };\n }\n } else {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"The active session ReCap does not authorize this sharing delegation.\",\n ),\n };\n }\n\n const finalActiveError = this.retiredGraphError();\n if (finalActiveError) return { ok: false, error: finalActiveError };\n\n // Step 3: Package the share data\n const shareData: EncodedShareData = {\n key: keyJwk,\n keyDid,\n delegation,\n path: fullPath,\n host: this.host,\n spaceId: this.session.spaceId,\n version: 1,\n };\n\n // Step 4: Encode the link\n const encodedData = this.encodeLink(shareData, schema);\n\n // Step 5: Build the full URL\n const baseUrl = params.baseUrl ?? this.baseUrl;\n const url = baseUrl ? `${baseUrl}/share/${encodedData}` : encodedData;\n\n const shareLink: ShareLink = {\n token: encodedData,\n url,\n delegation,\n schema,\n expiresAt: expiry,\n description: params.description,\n };\n\n return { ok: true, data: shareLink };\n }\n\n /**\n * Check if any key in the registry can satisfy the delegation request.\n * A key can satisfy if it has a delegation that:\n * 1. Covers the required path (exact match or parent path)\n * 2. Has all required actions\n * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n * 4. Allows sub-delegation\n * @internal\n */\n private findSuitableKeyForDelegation(\n path: string,\n actions: string[],\n requestedExpiry: Date\n ): boolean {\n // Check registry for keys with sufficient capabilities\n const allKeys = this.registry.getAllKeys();\n for (const key of allKeys) {\n const delegations = this.registry.getDelegationsForKey(key.id);\n for (const delegation of delegations) {\n // A registry can contain capabilities for several spaces. A share\n // created by this service may only spend authority for its own\n // session space.\n if (delegation.spaceId !== this.session?.spaceId) {\n continue;\n }\n\n // SharingService cannot reproduce arbitrary signed ReCap caveats when\n // issuing a child delegation. Treat caveated authority as unusable\n // here rather than minting a broader child capability.\n if ((delegation.caveats?.length ?? 0) > 0) {\n continue;\n }\n\n // Check if delegation is valid and not expired\n if (!this.registry.isDelegationValid(delegation)) {\n continue;\n }\n\n // Check if delegation has sufficient expiry\n if (delegation.expiry < requestedExpiry) {\n continue;\n }\n\n // Check if delegation allows sub-delegation\n if (delegation.allowSubDelegation === false) {\n continue;\n }\n\n // Check if delegation covers the path (exact match or parent path)\n const delegationPath = delegation.path || '';\n if (!this.pathMatches(delegationPath, path)) {\n continue;\n }\n\n // Check if delegation has all required actions\n const delegationActions = delegation.actions || [];\n const hasAllActions = actions.every(action =>\n delegationActions.includes(action) || delegationActions.includes('*')\n );\n if (!hasAllActions) {\n continue;\n }\n\n // Found a suitable key\n return true;\n }\n }\n\n return false;\n }\n\n private retiredGraphError(): DelegationError | undefined {\n try {\n this.assertActiveFn?.();\n return undefined;\n } catch (err) {\n return createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"The session service graph has been retired.\",\n err instanceof Error ? err : undefined,\n );\n }\n }\n\n /**\n * Check if a delegation path matches/covers the requested path.\n * A delegation path covers the request if:\n * - It's an exact match\n * - It's a parent path (e.g., delegation for \"\" covers \"foo/bar\")\n * - It uses wildcards that match\n * @internal\n */\n private pathMatches(delegationPath: string, requestedPath: string): boolean {\n // Empty delegation path covers everything\n if (delegationPath === '' || delegationPath === '*') {\n return true;\n }\n\n // Exact match\n if (delegationPath === requestedPath) {\n return true;\n }\n\n // Check if delegation path is a parent of requested path\n const normalizedDelegation = delegationPath.replace(/\\/$/, '');\n const normalizedRequest = requestedPath.replace(/\\/$/, '');\n\n if (normalizedRequest.startsWith(normalizedDelegation + '/')) {\n return true;\n }\n\n return false;\n }\n\n /**\n * Create a delegation from the current session to a share key.\n * This is the fallback path when root delegation is not available.\n * @internal\n */\n private async createSessionDelegation(\n delegateDID: string,\n path: string,\n actions: string[],\n expiry: Date\n ): Promise<Delegation | Result<never, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n if (!this.session) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Session required for creating delegation\"\n ),\n };\n }\n\n if (this.createDelegationWasmFn) {\n // Client-side delegation creation via WASM.\n //\n // SharingService always issues single-resource delegations (one\n // path, one action list). The multi-resource WASM API takes an\n // `abilities` map shaped `Record<shortService, Record<path,\n // actions[]>>`, so we infer the short service from the first\n // action URN (every action in a share call shares the same\n // service namespace by construction — KV-only, SQL-only, etc).\n //\n // The result comes back with a `resources` array; for a\n // single-entry call it always has exactly one entry, and we\n // mirror that entry's `path` + `actions` back into the flat\n // Delegation shape that the rest of SharingService works with.\n try {\n if (actions.length === 0) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.VALIDATION_ERROR,\n \"createDelegation requires at least one action\"\n ),\n };\n }\n const shortService = inferShortServiceFromActionUrns(actions);\n if (shortService === undefined) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.VALIDATION_ERROR,\n `createDelegation: cannot infer service from actions ${JSON.stringify(actions)} — expected full URNs like \"tinycloud.kv/get\"`\n ),\n };\n }\n\n const wasmResult = this.createDelegationWasmFn({\n session: this.session,\n delegateDID,\n spaceId: this.session.spaceId,\n abilities: {\n [shortService]: {\n [path]: [...actions],\n },\n },\n expirationSecs: Math.floor(expiry.getTime() / 1000),\n });\n const childSigningActiveError = this.retiredGraphError();\n if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n\n // Register the delegation with the server\n const registerRes = await this.fetchFn(`${this.host}/delegate`, {\n method: \"POST\",\n headers: {\n Authorization: wasmResult.delegation,\n },\n });\n const registrationActiveError = this.retiredGraphError();\n if (registrationActiveError) return { ok: false, error: registrationActiveError };\n\n if (!registerRes.ok) {\n const errorText = await registerRes.text();\n const registrationTextActiveError = this.retiredGraphError();\n if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to register delegation with server: ${registerRes.status} ${errorText}`\n ),\n };\n }\n\n // Single-entry call → resources[0] is authoritative for the\n // flat Delegation shape. We assert length here because a\n // zero-length result would mean the Rust side dropped our\n // single input — that's a protocol bug, not a runtime\n // condition to silently coerce.\n if (wasmResult.resources.length === 0) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"createDelegation WASM returned empty resources array for a single-entry request\"\n ),\n };\n }\n const primary = wasmResult.resources[0];\n return {\n cid: wasmResult.cid,\n delegateDID: wasmResult.delegateDID,\n spaceId: this.session.spaceId,\n path: primary.path,\n actions: primary.actions,\n expiry: wasmResult.expiry,\n isRevoked: false,\n authHeader: wasmResult.delegation,\n allowSubDelegation: true,\n createdAt: new Date(),\n };\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to create delegation via WASM: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n } else {\n // Server-side delegation creation (fallback)\n const delegationParams: CreateDelegationParams = {\n delegateDID,\n path,\n actions,\n expiry,\n disableSubDelegation: false,\n };\n\n const delegationResult = this.createDelegationFn\n ? await this.createDelegationFn(delegationParams)\n : await this.delegationManager!.create(delegationParams);\n const delegationCreationActiveError = this.retiredGraphError();\n if (delegationCreationActiveError) return { ok: false, error: delegationCreationActiveError };\n\n if (!delegationResult.ok) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to create delegation for share: ${delegationResult.error.message}`,\n delegationResult.error.cause,\n delegationResult.error.meta\n ),\n };\n }\n\n return delegationResult.data;\n }\n }\n\n /**\n * Receive and activate a sharing link.\n *\n * Flow:\n * 1. Decode link -> extract { key, delegation, path, host }\n * 2. Ingest key into CapabilityKeyRegistry\n * 3. If autoSubdelegate (default true) + useSessionKey:\n * - Create sub-delegation from ingested key -> current session\n * - Register sub-delegation capabilities\n * 4. Return ShareAccess with pre-configured KV service\n */\n async receive(\n link: string,\n options: ReceiveOptions = {}\n ): Promise<Result<ShareAccess, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n const {\n autoSubdelegate = true,\n useSessionKey = true,\n ingestOptions,\n } = options;\n\n // Step 1: Decode and validate the link\n const decodeResult = this.decodeLinkWithValidation(link);\n if (!decodeResult.ok) {\n return decodeResult;\n }\n const shareData = decodeResult.data;\n\n // Schema validation ensures key.d and delegation exist, but we need\n // to check business rules (expiry, revocation) separately\n\n // Check delegation expiry\n const delegationExpiry = new Date(shareData.delegation.expiry);\n if (delegationExpiry < new Date()) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.AUTH_EXPIRED,\n \"Sharing link has expired\"\n ),\n };\n }\n\n // Check delegation revocation\n if (shareData.delegation.isRevoked) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.REVOKED,\n \"Sharing link has been revoked\"\n ),\n };\n }\n\n // Step 2: Create KeyInfo and ingest into registry\n const keyInfo: KeyInfo = {\n id: `ingested:${shareData.keyDid}`,\n did: shareData.keyDid,\n type: \"ingested\",\n jwk: shareData.key,\n priority: 2, // Ingested keys have lowest priority\n };\n\n this.registry.ingestKey(keyInfo, shareData.delegation, ingestOptions);\n\n // The delegation and key to use for operations\n let activeDelegation = shareData.delegation;\n let activeKey = keyInfo;\n\n // Step 3: Auto-subdelegate if requested\n if (autoSubdelegate && useSessionKey && this.session) {\n const child = await this.delegateReceivedShare(link, {\n delegateDID: this.session.verificationMethod,\n expectedHost: shareData.host,\n });\n if (!child.ok) return child;\n activeDelegation = child.data.delegation;\n activeKey = {\n id: `session:${principalDid(this.session.verificationMethod)}`,\n did: this.session.verificationMethod,\n type: \"session\",\n priority: 0,\n };\n }\n\n // Step 4: Create pre-configured KV service for the shared path\n // Construct session from share data - no need for existing session\n // Use the authHeader if available, otherwise fall back to constructing from CID\n const portableAuthorization = (activeDelegation as Delegation & {\n delegationHeader?: { Authorization?: string };\n }).delegationHeader?.Authorization;\n const authHeader = portableAuthorization ?? activeDelegation.authHeader ?? `Bearer ${activeDelegation.cid}`;\n const activeSession = activeKey.type === \"session\" && this.session\n ? this.session\n : undefined;\n const shareSession: ServiceSession = {\n delegationHeader: { Authorization: authHeader },\n delegationCid: activeDelegation.cid,\n spaceId: shareData.spaceId,\n verificationMethod: activeSession?.verificationMethod ?? shareData.keyDid,\n jwk: activeSession?.jwk ?? shareData.key,\n };\n\n const kvService = this.createKVService({\n hosts: [shareData.host],\n session: shareSession,\n invoke: this.invoke,\n fetch: this.fetchFn,\n pathPrefix: shareData.path,\n });\n\n const shareAccess: ShareAccess = {\n delegation: activeDelegation,\n key: activeKey,\n kv: kvService,\n spaceId: shareData.spaceId,\n path: shareData.path,\n };\n\n return { ok: true, data: shareAccess };\n }\n\n /**\n * Create a constrained child delegation from a received sharing link.\n *\n * This is the safe handoff for a browser delegating shared input to an\n * agent or service: the bearer link is decoded and used only in this SDK\n * instance, while the recipient receives a child UCAN without the embedded\n * private key. The child UCAN is a sensitive bearer credential and must not\n * be logged or stored insecurely.\n */\n async delegateReceivedShare(\n link: string,\n params: DelegateReceivedShareParams\n ): Promise<Result<DelegatedShareAccess, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n const decoded = this.decodeLinkWithValidation(link);\n if (!decoded.ok) return decoded;\n const shareData = decoded.data;\n this.assertDelegationCaveatsPreservable(shareData.delegation);\n\n const parentExpiry = new Date(shareData.delegation.expiry);\n const now = new Date();\n if (parentExpiry <= now) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.AUTH_EXPIRED, \"Sharing link has expired\"),\n };\n }\n if (shareData.delegation.isRevoked) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.REVOKED, \"Sharing link has been revoked\"),\n };\n }\n if (shareData.delegation.allowSubDelegation === false) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Sharing link does not allow delegation\"\n ),\n };\n }\n const delegateDID = principalDid(params.delegateDID?.trim() ?? \"\");\n if (!/^did:(?:key|pkh):[^\\s]+$/.test(delegateDID)) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.INVALID_INPUT, \"A valid delegateDID is required\"),\n };\n }\n const trustedHost = trustedNodeOrigin(shareData.host, this.hosts, params.expectedHost);\n if (!trustedHost) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Sharing-link host is not a configured TinyCloud host\"\n ),\n };\n }\n if (\n shareData.delegation.spaceId !== shareData.spaceId ||\n principalDid(shareData.delegation.delegateDID) !== principalDid(shareData.keyDid) ||\n !shareKeyMatchesDid(shareData.key, shareData.keyDid) ||\n !capabilityPathContains(shareData.delegation.path, shareData.path)\n ) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Sharing-link metadata does not match its parent delegation\"\n ),\n };\n }\n if (!shareData.delegation.authHeader) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Sharing link is missing its signed parent delegation\"\n ),\n };\n }\n if (!this.createDelegationWasmFn || !this.computeCidFn) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Client-side delegation and CID support are required\"\n ),\n };\n }\n\n const path = params.path ?? shareData.path;\n if (!capabilityPathContains(shareData.path, path)) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Requested path exceeds the sharing-link capability\"\n ),\n };\n }\n\n const parentActions = shareData.delegation.actions;\n const actions = params.actions ?? [...parentActions];\n if (\n actions.length === 0 ||\n new Set(actions).size !== actions.length ||\n actions.includes(\"*\") ||\n actions.some((action) => !parentActions.some((parentAction) => actionContains(parentAction, action)))\n ) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Requested actions exceed the sharing-link capability\"\n ),\n };\n }\n\n const expiry = params.expiry ?? parentExpiry;\n if (expiry <= now || expiry > parentExpiry) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Child delegation expiry must be active and no later than the sharing link\"\n ),\n };\n }\n\n const service = inferShortServiceFromActionUrns(actions);\n if (!service) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"Sharing-link actions must belong to one known TinyCloud service\"\n ),\n };\n }\n\n const owner = ownerFromSpaceId(shareData.spaceId);\n if (!owner) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Sharing link has an unsupported owner space\"\n ),\n };\n }\n\n try {\n const parentSession: ServiceSession = {\n delegationHeader: { Authorization: shareData.delegation.authHeader },\n delegationCid: shareData.delegation.cid,\n spaceId: shareData.spaceId,\n verificationMethod: shareData.keyDid,\n jwk: shareData.key,\n };\n const result = this.createDelegationWasmFn({\n session: parentSession,\n delegateDID,\n spaceId: shareData.spaceId,\n abilities: { [service]: { [path]: actions } },\n expirationSecs: Math.floor(expiry.getTime() / 1000),\n });\n const childSigningActiveError = this.retiredGraphError();\n if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n const verifiedChild = verifySignedChild(result, {\n delegateDID,\n issuerDID: principalDid(shareData.keyDid),\n parentCid: shareData.delegation.cid,\n service,\n spaceId: shareData.spaceId,\n path,\n actions,\n expiresAt: expiry,\n parentExpiresAt: parentExpiry,\n }, this.computeCidFn);\n if (!verifiedChild) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"Delegation signer returned a child outside the requested capability\"\n ),\n };\n }\n\n const registrationInit = {\n method: \"POST\",\n headers: { Authorization: result.delegation },\n redirect: \"error\" as const,\n };\n const registration = await this.fetchFn(new URL(\"/delegate\", trustedHost).toString(), registrationInit);\n const registrationActiveError = this.retiredGraphError();\n if (registrationActiveError) return { ok: false, error: registrationActiveError };\n if (!registration.ok) {\n throw new Error(`node rejected child delegation (${registration.status})`);\n }\n\n const primary = verifiedChild.resource;\n return {\n ok: true,\n data: {\n delegation: {\n cid: result.cid,\n delegateDID: verifiedChild.delegateDID,\n delegatorDID: shareData.keyDid.split(\"#\")[0],\n spaceId: shareData.spaceId,\n path: primary.path,\n actions: primary.actions,\n expiry: verifiedChild.expiresAt,\n isRevoked: false,\n allowSubDelegation: false,\n parentCid: shareData.delegation.cid,\n createdAt: now,\n delegationHeader: { Authorization: result.delegation },\n ownerAddress: owner.address,\n chainId: owner.chainId,\n host: trustedHost,\n resources: result.resources,\n disableSubDelegation: true,\n },\n source: {\n parentCid: shareData.delegation.cid,\n spaceId: shareData.spaceId,\n path: primary.path,\n host: trustedHost,\n expiresAt: verifiedChild.expiresAt,\n },\n },\n };\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"Failed to create or register the child delegation\"\n ),\n };\n }\n }\n\n /**\n * The child-delegation WASM boundary accepts action-only abilities. Reject\n * every constrained parent branch before that boundary can broaden it.\n */\n private assertDelegationCaveatsPreservable(delegation: Delegation): void {\n if (recapCaveatsEqual(delegation.caveats, undefined)) return;\n const service = delegation.actions[0]?.split(\"/\", 1)[0] ?? \"tinycloud.unknown\";\n const entry: PermissionEntry = {\n service,\n space: delegation.spaceId,\n path: delegation.path,\n actions: [...delegation.actions],\n caveats: delegation.caveats ?? [],\n };\n throw new CaveatedDelegationUnsupportedError([entry]);\n }\n\n /**\n * Encode sharing data into a link string.\n *\n * @param data - The share data to encode\n * @param schema - The encoding schema (default: \"base64\")\n * @returns Encoded link string\n */\n encodeLink(data: EncodedShareData, schema: ShareSchema = \"base64\"): string {\n if (schema !== \"base64\") {\n throw new Error(`Schema '${schema}' not implemented. Only 'base64' is supported.`);\n }\n\n const jsonString = JSON.stringify(data);\n const encoded = base64UrlEncode(jsonString);\n return `${BASE64_PREFIX}${encoded}`;\n }\n\n /**\n * Decode a link string into sharing data.\n *\n * @param link - The encoded link string (may include URL prefix)\n * @returns Decoded share data\n * @throws Error if link format is invalid or data fails validation\n */\n decodeLink(link: string): EncodedShareData {\n const result = this.decodeLinkWithValidation(link);\n if (!result.ok) {\n throw new Error(result.error.message);\n }\n return result.data;\n }\n\n /**\n * Decode and validate a link string into sharing data.\n *\n * Internal method that returns a Result instead of throwing.\n * Used by receive() for proper error handling.\n *\n * @param link - The encoded link string (may include URL prefix)\n * @returns Result with decoded share data or validation error\n */\n private decodeLinkWithValidation(link: string): Result<EncodedShareData, DelegationError> {\n // Extract the encoded data from the link\n let encoded = link;\n\n // Handle full URL format: https://share.example.com/share/tc1:...\n if (link.includes(\"/share/\")) {\n const parts = link.split(\"/share/\");\n encoded = parts[parts.length - 1];\n }\n\n // Handle query parameter format: ?share=tc1:...\n if (link.includes(\"?share=\")) {\n try {\n const url = new URL(link);\n encoded = url.searchParams.get(\"share\") ?? encoded;\n } catch {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Invalid URL format in sharing link\"\n ),\n };\n }\n }\n\n // Remove the schema prefix\n if (!encoded.startsWith(BASE64_PREFIX)) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n `Invalid sharing link format. Expected prefix '${BASE64_PREFIX}'`\n ),\n };\n }\n\n const base64Data = encoded.slice(BASE64_PREFIX.length);\n\n let jsonString: string;\n try {\n jsonString = base64UrlDecode(base64Data);\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n `Failed to decode base64 data: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(jsonString);\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n `Failed to parse share data JSON: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n\n // Convert delegation expiry to Date before validation if it's a string\n // This is needed because JSON.parse doesn't restore Date objects\n if (\n parsed &&\n typeof parsed === \"object\" &&\n \"delegation\" in parsed &&\n parsed.delegation &&\n typeof parsed.delegation === \"object\" &&\n \"expiry\" in parsed.delegation &&\n typeof parsed.delegation.expiry === \"string\"\n ) {\n (parsed.delegation as { expiry: Date }).expiry = new Date(parsed.delegation.expiry);\n }\n\n // Validate against schema\n const validationResult = validateEncodedShareData(parsed);\n if (!validationResult.ok) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n validationResult.error.message,\n undefined,\n validationResult.error.meta\n ),\n };\n }\n\n return { ok: true, data: validationResult.data };\n }\n}\n\n/**\n * Create a new SharingService instance.\n */\nexport function createSharingService(config: SharingServiceConfig): ISharingService {\n return new SharingService(config);\n}\n\nfunction ownerFromSpaceId(spaceId: string): { chainId: number; address: string } | null {\n const match = spaceId.match(/^tinycloud:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40}):/);\n if (!match) return null;\n const chainId = Number(match[1]);\n if (!Number.isSafeInteger(chainId)) return null;\n return { chainId, address: match[2] };\n}\n\nfunction parseTrustedNodeOrigin(value: string): string | null {\n try {\n const url = new URL(value);\n if (\n ![\"http:\", \"https:\"].includes(url.protocol) ||\n url.username ||\n url.password ||\n (url.pathname !== \"\" && url.pathname !== \"/\") ||\n url.search ||\n url.hash\n ) return null;\n return url.origin.toLowerCase();\n } catch {\n return null;\n }\n}\n\nfunction trustedNodeOrigin(candidate: string, configured: string[], expected?: string): string | null {\n const origin = parseTrustedNodeOrigin(candidate);\n if (!origin) return null;\n const allowed = new Set(configured.map(parseTrustedNodeOrigin).filter((value): value is string => Boolean(value)));\n if (!allowed.has(origin)) return null;\n if (expected && parseTrustedNodeOrigin(expected) !== origin) return null;\n return origin;\n}\n\nfunction canonicalCapabilityPath(path: string): string | null {\n if (\n /[\\u0000-\\u001f\\\\]/.test(path) ||\n /%(?:2e|2f|5c)/i.test(path) ||\n path.includes(\"//\")\n ) return null;\n const wildcardIndex = path.indexOf(\"*\");\n if (wildcardIndex !== -1 && !path.endsWith(\"/*\") && !path.endsWith(\"/**\")) return null;\n if (path.slice(0, -3).includes(\"*\") || (path.endsWith(\"/*\") && path.slice(0, -2).includes(\"*\"))) return null;\n const segments = path.split(\"/\");\n if (segments.some((segment) => segment === \".\" || segment === \"..\")) return null;\n return path;\n}\n\nfunction capabilityPathContains(parent: string, child: string): boolean {\n const canonicalParent = canonicalCapabilityPath(parent);\n const canonicalChild = canonicalCapabilityPath(child);\n if (canonicalParent === null || canonicalChild === null) return false;\n if (canonicalParent === \"\" || canonicalParent === \"/\") return true;\n if (canonicalParent === canonicalChild) return true;\n if (canonicalParent.endsWith(\"/**\")) {\n return canonicalChild.startsWith(canonicalParent.slice(0, -2));\n }\n if (canonicalParent.endsWith(\"/*\")) {\n const prefix = canonicalParent.slice(0, -1);\n if (!canonicalChild.startsWith(prefix)) return false;\n const remainder = canonicalChild.slice(prefix.length);\n return remainder.length > 0 && !remainder.includes(\"/\");\n }\n return canonicalParent.endsWith(\"/\") && canonicalChild.startsWith(canonicalParent);\n}\n\nfunction shareKeyMatchesDid(key: JWK, didUrl: string): boolean {\n if (\n key.kty !== \"OKP\" ||\n key.crv !== \"Ed25519\" ||\n typeof key.x !== \"string\" ||\n typeof key.d !== \"string\"\n ) return false;\n try {\n const didBytes = bases.base58btc.decode(principalDid(didUrl).slice(\"did:key:\".length));\n const publicKey = didBytes.length === 34 && didBytes[0] === 0xed && didBytes[1] === 0x01\n ? didBytes.slice(2)\n : null;\n if (!publicKey) return false;\n const jwkBytes = decodeBase64UrlBytes(key.x);\n const privateKey = decodeBase64UrlBytes(key.d);\n const derivedPublicKey = ed25519.getPublicKey(privateKey);\n return (\n privateKey.length === 32 &&\n publicKey.length === jwkBytes.length &&\n publicKey.every((byte, index) => byte === jwkBytes[index]) &&\n derivedPublicKey.length === jwkBytes.length &&\n derivedPublicKey.every((byte, index) => byte === jwkBytes[index])\n );\n } catch {\n return false;\n }\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n let encoded = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n while (encoded.length % 4) encoded += \"=\";\n if (typeof atob !== \"undefined\") {\n return Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));\n }\n return Uint8Array.from(Buffer.from(encoded, \"base64\"));\n}\n\nfunction verifySignedChild(\n result: CreateDelegationWasmResult,\n expected: {\n delegateDID: string;\n issuerDID: string;\n parentCid: string;\n service: string;\n spaceId: string;\n path: string;\n actions: string[];\n expiresAt: Date;\n parentExpiresAt: Date;\n },\n computeCid: NonNullable<SharingServiceConfig[\"computeCid\"]>,\n): { delegateDID: string; expiresAt: Date; resource: CreateDelegationWasmResult[\"resources\"][number] } | null {\n const parts = result.delegation.split(\".\");\n if (parts.length !== 3) return null;\n let payload: Record<string, unknown>;\n try {\n payload = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(parts[1]))) as Record<string, unknown>;\n } catch {\n return null;\n }\n const delegateDID = typeof payload.aud === \"string\" ? principalDid(payload.aud) : \"\";\n const issuerDID = typeof payload.iss === \"string\" ? principalDid(payload.iss) : \"\";\n const proofs = Array.isArray(payload.prf) ? payload.prf : [];\n const expirationSecs = typeof payload.exp === \"number\" && Number.isInteger(payload.exp) ? payload.exp : 0;\n const expiresAt = new Date(expirationSecs * 1000);\n if (\n delegateDID !== expected.delegateDID ||\n issuerDID !== expected.issuerDID ||\n proofs.length !== 1 ||\n proofs[0] !== expected.parentCid ||\n expiresAt <= new Date() ||\n expiresAt > expected.expiresAt ||\n expiresAt > expected.parentExpiresAt ||\n computeCid(new TextEncoder().encode(result.delegation), 0x55n) !== result.cid\n ) return null;\n\n const att = payload.att;\n if (!att || typeof att !== \"object\" || Array.isArray(att)) return null;\n const entries = Object.entries(att as Record<string, unknown>);\n if (entries.length !== 1) return null;\n const [resourceUri, abilityValue] = entries[0];\n const prefix = `${expected.spaceId}/${expected.service}/`;\n if (!resourceUri.startsWith(prefix) || resourceUri.slice(prefix.length) !== expected.path) return null;\n if (!abilityValue || typeof abilityValue !== \"object\" || Array.isArray(abilityValue)) return null;\n const signedActions = Object.keys(abilityValue as Record<string, unknown>).sort();\n const expectedActions = [...expected.actions].sort();\n if (\n signedActions.length !== expectedActions.length ||\n !signedActions.every((action, index) => action === expectedActions[index])\n ) return null;\n\n if (principalDid(result.delegateDID) !== delegateDID || result.resources.length !== 1) return null;\n if (result.expiry.getTime() !== expiresAt.getTime()) return null;\n const resource = result.resources[0];\n if (\n resource.service !== expected.service ||\n resource.space !== expected.spaceId ||\n resource.path !== expected.path\n ) return null;\n const actualActions = [...resource.actions].sort();\n if (\n actualActions.length !== expectedActions.length ||\n !actualActions.every((action, index) => action === expectedActions[index])\n ) return null;\n return { delegateDID, expiresAt, resource };\n}\n","/**\n * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.\n *\n * The registry maintains mappings between:\n * - Keys and their associated delegations\n * - Capabilities (resource/action pairs) and the keys that can exercise them\n *\n * This enables automatic key selection when performing operations, choosing\n * the most appropriate key based on priority and validity.\n *\n * @packageDocumentation\n */\n\nimport type { Result, ServiceError } from \"@tinycloud/sdk-services\";\nimport { ok, err, serviceError } from \"@tinycloud/sdk-services\";\nimport type {\n KeyInfo,\n CapabilityEntry,\n Delegation,\n IngestOptions,\n} from \"../delegations/types\";\nimport { actionContains, recapCaveatsEqual } from \"../capabilities\";\n\n// =============================================================================\n// Service Name\n// =============================================================================\n\nconst SERVICE_NAME = \"capability-key-registry\";\n\n// =============================================================================\n// Error Codes\n// =============================================================================\n\n/**\n * Error codes specific to CapabilityKeyRegistry operations.\n */\nexport const CapabilityKeyRegistryErrorCodes = {\n /** Key not found in registry */\n KEY_NOT_FOUND: \"KEY_NOT_FOUND\",\n /** No key available for the requested capability */\n NO_CAPABLE_KEY: \"NO_CAPABLE_KEY\",\n /** Delegation has expired */\n DELEGATION_EXPIRED: \"DELEGATION_EXPIRED\",\n /** Delegation has been revoked */\n DELEGATION_REVOKED: \"DELEGATION_REVOKED\",\n /** Invalid delegation data */\n INVALID_DELEGATION: \"INVALID_DELEGATION\",\n /** Key already registered */\n KEY_EXISTS: \"KEY_EXISTS\",\n} as const;\n\nexport type CapabilityKeyRegistryErrorCode =\n (typeof CapabilityKeyRegistryErrorCodes)[keyof typeof CapabilityKeyRegistryErrorCodes];\n\n// =============================================================================\n// Storage Types\n// =============================================================================\n\n/**\n * Stored delegation with chain information.\n */\nexport interface StoredDelegationChain {\n /** The delegation itself */\n delegation: Delegation;\n /** Parent delegation CID if this is a sub-delegation */\n parentCid?: string;\n /** Key ID used to sign/exercise this delegation */\n keyId: string;\n /** When this was stored */\n storedAt: Date;\n}\n\n/**\n * Internal delegation store structure.\n */\ninterface DelegationStore {\n /** Delegations indexed by key ID */\n byKey: Map<string, Delegation[]>;\n /** Delegations indexed by CID. A single signed ReCap can carry many scopes. */\n byCid: Map<string, StoredDelegationChain[]>;\n /** Capability entries indexed by \"resource|action\" key */\n byCapability: Map<string, CapabilityEntry[]>;\n}\n\n// =============================================================================\n// Interface\n// =============================================================================\n\n/**\n * Interface for the CapabilityKeyRegistry.\n *\n * Tracks keys and their capabilities for automatic key selection.\n */\nexport interface ICapabilityKeyRegistry {\n /**\n * Register a key with its associated delegations.\n *\n * @param key - Key information\n * @param delegations - Delegations granted to this key\n */\n registerKey(key: KeyInfo, delegations: Delegation[]): void;\n\n /**\n * Remove a key and all its associated delegations.\n *\n * @param keyId - The key ID to remove\n */\n removeKey(keyId: string): void;\n\n /**\n * Get a key that can exercise the specified capability.\n *\n * Uses the key selection algorithm:\n * 1. Filter keys that have the required capability\n * 2. Check delegation validity (not expired, not revoked)\n * 3. Sort by priority (session=0, main=1, ingested=2)\n * 4. Return highest priority valid key\n *\n * @param resource - Resource URI (e.g., \"tinycloud://space-id/kv/my-data\")\n * @param action - Action to perform (e.g., \"tinycloud.kv/get\")\n * @returns The best matching key, or null if none available\n */\n getKeyForCapability(resource: string, action: string): KeyInfo | null;\n\n /**\n * Get all registered capabilities.\n *\n * @returns All capability entries in the registry\n */\n getAllCapabilities(): CapabilityEntry[];\n\n /**\n * Get all delegations for a specific key.\n *\n * @param keyId - The key ID\n * @returns Array of delegations for this key\n */\n getDelegationsForKey(keyId: string): Delegation[];\n\n /**\n * Ingest a key and delegation from an external source (e.g., sharing link).\n *\n * @param key - Key information to ingest\n * @param delegation - Delegation to associate with the key\n * @param options - Ingestion options\n */\n ingestKey(\n key: KeyInfo,\n delegation: Delegation,\n options?: IngestOptions\n ): void;\n\n /**\n * Check if a delegation is currently valid.\n *\n * @param delegation - The delegation to check\n * @returns true if valid, false if expired or revoked\n */\n isDelegationValid(delegation: Delegation): boolean;\n\n /**\n * Get a key by its ID.\n *\n * @param keyId - The key ID\n * @returns The key info, or undefined if not found\n */\n getKey(keyId: string): KeyInfo | undefined;\n\n /**\n * Get all registered keys.\n *\n * @returns Array of all registered keys\n */\n getAllKeys(): KeyInfo[];\n\n /**\n * Clear all registered keys and delegations.\n */\n clear(): void;\n\n /**\n * Revoke a delegation by CID.\n *\n * @param cid - The delegation CID to revoke\n * @returns Result indicating success or failure\n */\n revokeDelegation(cid: string): Result<void, ServiceError>;\n\n /**\n * Find capabilities that match a resource path pattern.\n *\n * @param resourcePattern - Resource pattern (supports wildcards)\n * @param action - Optional action filter\n * @returns Matching capability entries\n */\n findCapabilities(\n resourcePattern: string,\n action?: string\n ): CapabilityEntry[];\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.\n *\n * @example\n * ```typescript\n * const registry = new CapabilityKeyRegistry();\n *\n * // Register a session key with its delegations\n * registry.registerKey(sessionKey, [rootDelegation]);\n *\n * // Get the best key for an operation\n * const key = registry.getKeyForCapability(\n * \"tinycloud://my-space/kv/data\",\n * \"tinycloud.kv/get\"\n * );\n *\n * if (key) {\n * // Use this key for the operation\n * console.log(\"Using key:\", key.id);\n * }\n * ```\n */\nexport class CapabilityKeyRegistry implements ICapabilityKeyRegistry {\n /**\n * Registry of all keys indexed by ID.\n */\n private keys: Map<string, KeyInfo> = new Map();\n\n /**\n * Delegation storage.\n */\n private store: DelegationStore = {\n byKey: new Map(),\n byCid: new Map(),\n byCapability: new Map(),\n };\n\n // ===========================================================================\n // Key Management\n // ===========================================================================\n\n /**\n * Register a key with its associated delegations.\n *\n * @param key - Key information\n * @param delegations - Delegations granted to this key\n */\n registerKey(key: KeyInfo, delegations: Delegation[]): void {\n // Store the key\n this.keys.set(key.id, key);\n\n // Initialize delegation storage for this key\n if (!this.store.byKey.has(key.id)) {\n this.store.byKey.set(key.id, []);\n }\n\n // Process each delegation\n for (const delegation of delegations) {\n this.addDelegation(key, delegation);\n }\n }\n\n /**\n * Remove a key and all its associated delegations.\n *\n * @param keyId - The key ID to remove\n */\n removeKey(keyId: string): void {\n // Get delegations for this key\n const delegations = this.store.byKey.get(keyId) || [];\n\n // Remove this key's entries without dropping other scopes from the same\n // signed ReCap.\n for (const delegation of delegations) {\n const chains = this.store.byCid.get(delegation.cid);\n if (!chains) continue;\n const remaining = chains.filter((chain) => chain.keyId !== keyId);\n if (remaining.length === 0) {\n this.store.byCid.delete(delegation.cid);\n } else {\n this.store.byCid.set(delegation.cid, remaining);\n }\n }\n\n // Remove from byCapability\n for (const [capKey, entries] of this.store.byCapability) {\n const filtered = entries.filter(\n (entry) => !entry.keys.some((k: KeyInfo) => k.id === keyId)\n );\n if (filtered.length === 0) {\n this.store.byCapability.delete(capKey);\n } else {\n // Remove this key from entries that have multiple keys\n for (const entry of filtered) {\n entry.keys = entry.keys.filter((k: KeyInfo) => k.id !== keyId);\n }\n this.store.byCapability.set(capKey, filtered.filter((e) => e.keys.length > 0));\n }\n }\n\n // Remove from byKey\n this.store.byKey.delete(keyId);\n\n // Remove the key itself\n this.keys.delete(keyId);\n }\n\n // ===========================================================================\n // Capability Lookup\n // ===========================================================================\n\n /**\n * Get a key that can exercise the specified capability.\n *\n * Key selection algorithm:\n * 1. Filter keys that have the required capability\n * 2. Check delegation validity (not expired, not revoked)\n * 3. Sort by priority (session=0, main=1, ingested=2)\n * 4. Return highest priority valid key\n *\n * @param resource - Resource URI\n * @param action - Action to perform\n * @returns The best matching key, or null if none available\n */\n getKeyForCapability(resource: string, action: string): KeyInfo | null {\n // Find matching capabilities\n const matchingEntries = this.findMatchingEntries(resource, action);\n\n if (matchingEntries.length === 0) {\n return null;\n }\n\n // Collect all valid keys from matching entries\n const validKeys: KeyInfo[] = [];\n\n for (const entry of matchingEntries) {\n // Check if the delegation is valid\n if (!this.isDelegationValid(entry.delegation)) {\n continue;\n }\n\n // Add keys from this entry\n for (const key of entry.keys) {\n if (!validKeys.some((k: KeyInfo) => k.id === key.id)) {\n validKeys.push(key);\n }\n }\n }\n\n if (validKeys.length === 0) {\n return null;\n }\n\n // Sort by priority (lower is better)\n validKeys.sort((a: KeyInfo, b: KeyInfo) => a.priority - b.priority);\n\n return validKeys[0];\n }\n\n /**\n * Get all registered capabilities.\n *\n * @returns All capability entries in the registry\n */\n getAllCapabilities(): CapabilityEntry[] {\n const all: CapabilityEntry[] = [];\n for (const entries of this.store.byCapability.values()) {\n all.push(...entries);\n }\n return all;\n }\n\n // ===========================================================================\n // Delegation Tracking\n // ===========================================================================\n\n /**\n * Get all delegations for a specific key.\n *\n * @param keyId - The key ID\n * @returns Array of delegations for this key\n */\n getDelegationsForKey(keyId: string): Delegation[] {\n return this.store.byKey.get(keyId) || [];\n }\n\n // ===========================================================================\n // Ingestion\n // ===========================================================================\n\n /**\n * Ingest a key and delegation from an external source.\n *\n * @param key - Key information to ingest\n * @param delegation - Delegation to associate with the key\n * @param options - Ingestion options\n */\n ingestKey(\n key: KeyInfo,\n delegation: Delegation,\n options?: IngestOptions\n ): void {\n // Apply priority override if specified\n const keyToStore: KeyInfo = options?.priority !== undefined\n ? { ...key, priority: options.priority }\n : key;\n\n // Store the key\n this.keys.set(keyToStore.id, keyToStore);\n\n // Initialize delegation storage\n if (!this.store.byKey.has(keyToStore.id)) {\n this.store.byKey.set(keyToStore.id, []);\n }\n\n // Add the delegation\n this.addDelegation(keyToStore, delegation);\n }\n\n // ===========================================================================\n // Validation\n // ===========================================================================\n\n /**\n * Check if a delegation is currently valid.\n *\n * @param delegation - The delegation to check\n * @returns true if valid, false if expired or revoked\n */\n isDelegationValid(delegation: Delegation): boolean {\n // Check if revoked\n if (delegation.isRevoked) {\n return false;\n }\n\n // Check expiry\n const now = new Date();\n if (delegation.expiry && delegation.expiry < now) {\n return false;\n }\n\n return true;\n }\n\n // ===========================================================================\n // Key Access\n // ===========================================================================\n\n /**\n * Get a key by its ID.\n *\n * @param keyId - The key ID\n * @returns The key info, or undefined if not found\n */\n getKey(keyId: string): KeyInfo | undefined {\n return this.keys.get(keyId);\n }\n\n /**\n * Get all registered keys.\n *\n * @returns Array of all registered keys\n */\n getAllKeys(): KeyInfo[] {\n return Array.from(this.keys.values());\n }\n\n // ===========================================================================\n // Clear\n // ===========================================================================\n\n /**\n * Clear all registered keys and delegations.\n */\n clear(): void {\n this.keys.clear();\n this.store.byKey.clear();\n this.store.byCid.clear();\n this.store.byCapability.clear();\n }\n\n // ===========================================================================\n // Revocation\n // ===========================================================================\n\n /**\n * Revoke a delegation by CID.\n *\n * @param cid - The delegation CID to revoke\n * @returns Result indicating success or failure\n */\n revokeDelegation(cid: string): Result<void, ServiceError> {\n const stored = this.store.byCid.get(cid);\n\n if (!stored || stored.length === 0) {\n return err(\n serviceError(\n CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,\n `Delegation not found: ${cid}`,\n SERVICE_NAME\n )\n );\n }\n\n // A CID identifies the signed delegation as a whole, including every\n // scope reconstructed from its ReCap.\n for (const chain of stored) chain.delegation.isRevoked = true;\n for (const keyDelegations of this.store.byKey.values()) {\n for (const delegation of keyDelegations) {\n if (delegation.cid === cid) delegation.isRevoked = true;\n }\n }\n\n // Update in byCapability\n for (const entries of this.store.byCapability.values()) {\n for (const entry of entries) {\n if (entry.delegation.cid === cid) {\n entry.delegation.isRevoked = true;\n }\n }\n }\n\n return ok(undefined);\n }\n\n // ===========================================================================\n // Search\n // ===========================================================================\n\n /**\n * Find capabilities that match a resource path pattern.\n *\n * @param resourcePattern - Resource pattern (supports wildcards)\n * @param action - Optional action filter\n * @returns Matching capability entries\n */\n findCapabilities(\n resourcePattern: string,\n action?: string\n ): CapabilityEntry[] {\n const results: CapabilityEntry[] = [];\n\n for (const entries of this.store.byCapability.values()) {\n for (const entry of entries) {\n // Check action match if specified\n if (action && entry.action !== action) {\n continue;\n }\n\n // Check resource pattern match\n if (this.matchesResourcePattern(entry.resource, resourcePattern)) {\n results.push(entry);\n }\n }\n }\n\n return results;\n }\n\n // ===========================================================================\n // Private Methods\n // ===========================================================================\n\n /**\n * Add a delegation to the store.\n *\n * @param key - The key associated with this delegation\n * @param delegation - The delegation to add\n */\n private addDelegation(key: KeyInfo, delegation: Delegation): void {\n // Add to byKey\n const keyDelegations = this.store.byKey.get(key.id) || [];\n if (!keyDelegations.some((d) => this.sameDelegationScope(d, delegation))) {\n keyDelegations.push(delegation);\n this.store.byKey.set(key.id, keyDelegations);\n }\n\n // Add to byCid\n const chains = this.store.byCid.get(delegation.cid) ?? [];\n if (!chains.some((chain) =>\n chain.keyId === key.id && this.sameDelegationScope(chain.delegation, delegation)\n )) {\n chains.push({\n delegation,\n parentCid: delegation.parentCid,\n keyId: key.id,\n storedAt: new Date(),\n });\n this.store.byCid.set(delegation.cid, chains);\n }\n\n // Add to byCapability for each action\n for (const action of delegation.actions) {\n const capKey = this.makeCapabilityKey(delegation.path, action);\n const entries = this.store.byCapability.get(capKey) || [];\n\n // Check if we already have an entry for this exact delegation\n const existingEntry = entries.find((e) =>\n this.sameDelegationScope(e.delegation, delegation)\n );\n\n if (existingEntry) {\n // Add this key if not already present\n if (!existingEntry.keys.some((k: KeyInfo) => k.id === key.id)) {\n existingEntry.keys.push(key);\n // Re-sort by priority\n existingEntry.keys.sort((a: KeyInfo, b: KeyInfo) => a.priority - b.priority);\n }\n } else {\n // Create new capability entry\n const entry: CapabilityEntry = {\n resource: delegation.path,\n action,\n keys: [key],\n delegation,\n expiresAt: delegation.expiry,\n };\n entries.push(entry);\n this.store.byCapability.set(capKey, entries);\n }\n }\n }\n\n /**\n * Create a capability key for indexing.\n *\n * @param resource - Resource path\n * @param action - Action\n * @returns Combined key string\n */\n private makeCapabilityKey(resource: string, action: string): string {\n return `${resource}|${action}`;\n }\n\n private sameDelegationScope(left: Delegation, right: Delegation): boolean {\n return left.cid === right.cid &&\n left.spaceId === right.spaceId &&\n left.path === right.path &&\n left.actions.length === right.actions.length &&\n left.actions.every((action) => right.actions.includes(action)) &&\n recapCaveatsEqual(left.caveats, right.caveats);\n }\n\n /**\n * Find capability entries that match a resource and action.\n *\n * @param resource - Resource to match\n * @param action - Action to match\n * @returns Matching entries\n */\n private findMatchingEntries(\n resource: string,\n action: string\n ): CapabilityEntry[] {\n const results: CapabilityEntry[] = [];\n\n // Exact match\n const exactKey = this.makeCapabilityKey(resource, action);\n const exactEntries = this.store.byCapability.get(exactKey);\n if (exactEntries) {\n results.push(...exactEntries);\n }\n\n // Wildcard matches - check all entries for patterns that match this resource\n for (const [capKey, entries] of this.store.byCapability) {\n if (capKey === exactKey) continue; // Already handled\n\n for (const entry of entries) {\n // Check if the entry's action matches\n if (!this.actionMatches(entry.action, action)) {\n continue;\n }\n\n // Check if the entry's resource pattern matches the requested resource\n if (this.resourceMatchesPattern(resource, entry.resource)) {\n if (!results.some((r) =>\n this.sameDelegationScope(r.delegation, entry.delegation)\n )) {\n results.push(entry);\n }\n }\n }\n }\n\n return results;\n }\n\n /**\n * Check if an action pattern matches a specific action.\n *\n * @param pattern - Action pattern (may include wildcard like \"tinycloud.kv/*\")\n * @param action - Specific action to check\n * @returns true if pattern matches action\n */\n private actionMatches(pattern: string, action: string): boolean {\n return actionContains(pattern, action);\n }\n\n /**\n * Check if a resource matches a pattern.\n *\n * Patterns support:\n * - Exact match: \"/kv/data\" matches \"/kv/data\"\n * - Wildcard suffix: \"/kv/*\" matches \"/kv/anything\"\n * - Double wildcard: \"/kv/**\" matches \"/kv/any/nested/path\"\n *\n * @param resource - The specific resource being accessed\n * @param pattern - The pattern from the delegation\n * @returns true if resource matches pattern\n */\n private resourceMatchesPattern(resource: string, pattern: string): boolean {\n // Exact match\n if (pattern === resource) {\n return true;\n }\n\n // Double wildcard (**) - matches any nested path\n if (pattern.endsWith(\"/**\")) {\n const prefix = pattern.slice(0, -3);\n return resource.startsWith(prefix);\n }\n\n // Single wildcard (*) - matches one path segment\n if (pattern.endsWith(\"/*\")) {\n const prefix = pattern.slice(0, -2);\n if (!resource.startsWith(prefix)) {\n return false;\n }\n const remainder = resource.slice(prefix.length);\n // Should be a single segment (no more slashes except possibly trailing)\n return !remainder.includes(\"/\") || remainder === \"/\";\n }\n\n // Prefix match for paths ending with /\n if (pattern.endsWith(\"/\") && resource.startsWith(pattern)) {\n return true;\n }\n\n return false;\n }\n\n /**\n * Check if a specific resource matches a resource pattern for searching.\n *\n * @param entryResource - The resource from a capability entry\n * @param searchPattern - The pattern to search for\n * @returns true if entry resource matches search pattern\n */\n private matchesResourcePattern(\n entryResource: string,\n searchPattern: string\n ): boolean {\n // Use the same logic as resourceMatchesPattern\n return this.resourceMatchesPattern(entryResource, searchPattern) ||\n this.resourceMatchesPattern(searchPattern, entryResource);\n }\n}\n\n/**\n * Create a new CapabilityKeyRegistry instance.\n *\n * @returns A new registry instance\n */\nexport function createCapabilityKeyRegistry(): ICapabilityKeyRegistry {\n return new CapabilityKeyRegistry();\n}\n","/**\n * SignStrategy types for TinyCloud authorization.\n *\n * These types define how sign requests are handled across different\n * SDK implementations (web-sdk, node-sdk). The pattern allows for\n * automatic signing, rejection, callback-based approval, or event-driven\n * workflows.\n *\n * @packageDocumentation\n */\n\n/**\n * Sign request passed to callback or event handlers.\n */\nexport interface SignRequest {\n /** Ethereum address of the signer */\n address: string;\n /** Chain ID for the signing context */\n chainId: number;\n /** Message to be signed */\n message: string;\n /** Type of sign operation */\n type: \"siwe\" | \"message\";\n /**\n * What the signature is for. Lets strategies apply different policies to\n * account-bootstrap signatures (which may be auto-signed server-side)\n * versus the user-initiated sign-in. Absent on requests from older SDKs.\n */\n purpose?: \"sign-in\" | \"bootstrap-session\" | \"bootstrap-host\" | \"message\";\n}\n\n/**\n * Sign response from callback or event handlers.\n */\nexport interface SignResponse {\n /** Whether the sign request was approved */\n approved: boolean;\n /** The signature if approved */\n signature?: string;\n /** Reason for rejection if not approved */\n reason?: string;\n}\n\n/**\n * Callback handler type for sign requests.\n */\nexport type SignCallback = (request: SignRequest) => Promise<SignResponse>;\n\nexport interface OpenKeySigningStrategyOptions {\n /**\n * OpenKey signing endpoint URL.\n *\n * The SDK sends `POST endpoint` with JSON:\n * `{ address, chainId, message, type, keyId? }`.\n *\n * Expected successful response shape:\n * `{ signature: \"0x...\" }` or `{ approved: true, signature: \"0x...\" }`.\n *\n * Explicit-approval-needed response shape:\n * `{ approved: false, reason?: string }` or\n * `{ needsApproval: true, reason?: string, approvalUrl?: string }`.\n */\n endpoint: string;\n /** Optional OpenKey managed key id. */\n keyId?: string;\n /** Optional bearer token or async token supplier. */\n token?: string | (() => string | Promise<string | undefined>) | undefined;\n /** Extra headers to include on every request. */\n headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);\n /** Fetch implementation. Defaults to `globalThis.fetch`. */\n fetch?: typeof fetch;\n /** Request credentials mode for browser integrations. */\n credentials?: \"include\" | \"omit\" | \"same-origin\";\n}\n\nexport interface OpenKeySigningRequestBody extends SignRequest {\n keyId?: string;\n}\n\nexport interface OpenKeySigningResponseBody {\n approved?: boolean;\n signature?: string;\n reason?: string;\n error?: string;\n needsApproval?: boolean;\n approvalUrl?: string;\n}\n\nexport interface OpenKeyCallbackStrategy extends CallbackStrategy {\n /** Marker used by SDK runtimes to choose the bootstrap-safe initial SIWE. */\n openKeyAutoSign: true;\n}\n\nasync function resolveOpenKeyToken(\n token: OpenKeySigningStrategyOptions[\"token\"],\n): Promise<string | undefined> {\n return typeof token === \"function\" ? token() : token;\n}\n\nasync function resolveOpenKeyHeaders(\n headers: OpenKeySigningStrategyOptions[\"headers\"],\n): Promise<Record<string, string>> {\n return typeof headers === \"function\" ? headers() : headers ?? {};\n}\n\nfunction openKeyApprovalReason(body: OpenKeySigningResponseBody): string {\n if (body.reason) return body.reason;\n if (body.error) return body.error;\n if (body.approvalUrl) {\n return `OpenKey explicit approval required: ${body.approvalUrl}`;\n }\n return \"OpenKey explicit approval required\";\n}\n\n/**\n * Create a callback signing strategy that delegates message signing to OpenKey.\n *\n * The helper deliberately returns the existing `CallbackStrategy` shape. When\n * OpenKey's policy gate says a request needs explicit approval, the callback\n * returns `{ approved: false, reason }`; `NodeUserAuthorization` then surfaces\n * that reason as the sign-in/signing error.\n */\nexport function createOpenKeyCallbackSigningStrategy(\n options: OpenKeySigningStrategyOptions,\n): OpenKeyCallbackStrategy {\n return {\n type: \"callback\",\n openKeyAutoSign: true,\n handler: async (request) => {\n const fetchImpl = options.fetch ?? globalThis.fetch;\n if (!fetchImpl) {\n throw new Error(\"OpenKey signing strategy requires a fetch implementation\");\n }\n\n const token = await resolveOpenKeyToken(options.token);\n const extraHeaders = await resolveOpenKeyHeaders(options.headers);\n const body: OpenKeySigningRequestBody = {\n ...request,\n ...(options.keyId ? { keyId: options.keyId } : {}),\n };\n\n const response = await fetchImpl(options.endpoint, {\n method: \"POST\",\n credentials: options.credentials,\n headers: {\n \"content-type\": \"application/json\",\n ...(token ? { authorization: `Bearer ${token}` } : {}),\n ...extraHeaders,\n },\n body: JSON.stringify(body),\n });\n\n let parsed: OpenKeySigningResponseBody | undefined;\n try {\n parsed = (await response.json()) as OpenKeySigningResponseBody;\n } catch {\n parsed = undefined;\n }\n\n if (!response.ok) {\n return {\n approved: false,\n reason:\n parsed?.reason ??\n parsed?.error ??\n `OpenKey signing failed with HTTP ${response.status}`,\n };\n }\n\n if (parsed?.needsApproval || parsed?.approved === false) {\n return {\n approved: false,\n reason: openKeyApprovalReason(parsed),\n };\n }\n\n if (typeof parsed?.signature === \"string\" && parsed.signature.length > 0) {\n return {\n approved: true,\n signature: parsed.signature,\n };\n }\n\n return {\n approved: false,\n reason: \"OpenKey signing response did not include a signature\",\n };\n },\n };\n}\n\n/**\n * Auto-sign strategy: automatically signs all requests.\n *\n * Use cases:\n * - Trusted backend services\n * - Automated scripts\n * - CI/CD pipelines\n *\n * @example\n * ```typescript\n * const strategy: AutoSignStrategy = { type: 'auto-sign' };\n * ```\n */\nexport interface AutoSignStrategy {\n type: \"auto-sign\";\n}\n\n/**\n * Auto-reject strategy: rejects all sign requests.\n *\n * Use cases:\n * - Read-only applications\n * - Testing rejection flows\n *\n * @example\n * ```typescript\n * const strategy: AutoRejectStrategy = { type: 'auto-reject' };\n * ```\n */\nexport interface AutoRejectStrategy {\n type: \"auto-reject\";\n}\n\n/**\n * Callback strategy: delegates sign decisions to a callback function.\n *\n * Use cases:\n * - CLI applications with user prompts\n * - Custom approval workflows\n * - Interactive sign flows\n *\n * @example\n * ```typescript\n * const strategy: CallbackStrategy = {\n * type: 'callback',\n * handler: async (req) => {\n * const approved = await promptUser(`Sign message for ${req.address}?`);\n * return { approved, signature: approved ? await signer.sign(req.message) : undefined };\n * }\n * };\n * ```\n */\nexport interface CallbackStrategy {\n type: \"callback\";\n handler: SignCallback;\n}\n\n/**\n * Event emitter strategy: emits sign requests as events.\n *\n * Uses EventTarget for cross-platform compatibility (browser + Node.js).\n *\n * Events emitted:\n * - 'sign-request': When a sign request is received\n *\n * Use cases:\n * - Async approval workflows\n * - External signing services\n * - Multi-step authorization flows\n *\n * @example\n * ```typescript\n * const emitter = new EventTarget();\n * const strategy: EventEmitterStrategy = { type: 'event-emitter', emitter };\n *\n * emitter.addEventListener('sign-request', async (event) => {\n * const { request, respond } = (event as CustomEvent).detail;\n * const approved = await externalApprovalService.check(request);\n * respond({ approved, signature: approved ? await sign(request.message) : undefined });\n * });\n * ```\n */\nexport interface EventEmitterStrategy {\n type: \"event-emitter\";\n emitter: EventTarget;\n /** Timeout in milliseconds for waiting on event response (default: 60000) */\n timeout?: number;\n}\n\n/**\n * Sign strategy union type.\n *\n * Determines how sign requests are handled in UserAuthorization implementations.\n */\nexport type SignStrategy =\n | AutoSignStrategy\n | AutoRejectStrategy\n | CallbackStrategy\n | EventEmitterStrategy;\n\n/**\n * Default sign strategy is auto-sign for convenience.\n */\nexport const defaultSignStrategy: SignStrategy = { type: \"auto-sign\" };\n","/**\n * Space creation handler types for TinyCloud authorization.\n *\n * These types abstract space creation confirmation, allowing different\n * implementations for web (modal) vs node (auto-approve) environments.\n *\n * @packageDocumentation\n */\n\n/**\n * Context passed to space creation handlers.\n */\nexport interface SpaceCreationContext {\n /** The unique identifier for the space being created */\n spaceId: string;\n /** Ethereum address of the user creating the space */\n address: string;\n /** Chain ID for the creation context */\n chainId: number;\n /** Host URL where the space will be created */\n host: string;\n}\n\n/**\n * Interface for handling space creation confirmation.\n *\n * Implementations can provide different UX patterns:\n * - Auto-approve for backend services\n * - Modal confirmation for web apps\n * - CLI prompts for terminal apps\n *\n * @example\n * ```typescript\n * class ModalSpaceCreationHandler implements ISpaceCreationHandler {\n * async confirmSpaceCreation(context: SpaceCreationContext): Promise<boolean> {\n * return await showConfirmationModal(`Create space ${context.spaceId}?`);\n * }\n *\n * onSpaceCreated(context: SpaceCreationContext): void {\n * showToast(`Space ${context.spaceId} created!`);\n * }\n *\n * onSpaceCreationFailed(context: SpaceCreationContext, error: Error): void {\n * showErrorModal(`Failed to create space: ${error.message}`);\n * }\n * }\n * ```\n */\nexport interface ISpaceCreationHandler {\n /**\n * Called when a new space needs to be created.\n * Returns true if space should be created, false to skip.\n *\n * @param context - Information about the space to be created\n * @returns Promise resolving to true to proceed, false to cancel\n */\n confirmSpaceCreation(context: SpaceCreationContext): Promise<boolean>;\n\n /**\n * Called after successful space creation.\n * Optional - implement to show success UI or perform cleanup.\n *\n * @param context - Information about the created space\n */\n onSpaceCreated?(context: SpaceCreationContext): void;\n\n /**\n * Called if space creation fails.\n * Optional - implement to show error UI or perform recovery.\n *\n * @param context - Information about the space that failed to create\n * @param error - The error that occurred\n */\n onSpaceCreationFailed?(context: SpaceCreationContext, error: Error): void;\n}\n\n/**\n * Default handler that auto-approves all space creation.\n *\n * Use cases:\n * - Backend services\n * - Automated scripts\n * - Node.js applications without UI\n *\n * @example\n * ```typescript\n * const handler = new AutoApproveSpaceCreationHandler();\n * const config = { spaceCreationHandler: handler };\n * ```\n */\nexport class AutoApproveSpaceCreationHandler implements ISpaceCreationHandler {\n /**\n * Always returns true to auto-approve space creation.\n */\n async confirmSpaceCreation(): Promise<boolean> {\n return true;\n }\n}\n\n/**\n * Default space creation handler that auto-approves all requests.\n */\nexport const defaultSpaceCreationHandler: ISpaceCreationHandler =\n new AutoApproveSpaceCreationHandler();\n","/**\n * Protocol version checking for SDK-to-node compatibility.\n *\n * @packageDocumentation\n */\n\nexport class ProtocolMismatchError extends Error {\n name = \"ProtocolMismatchError\" as const;\n constructor(\n public readonly sdkProtocol: number,\n public readonly nodeProtocol: number,\n public readonly nodeVersion: string,\n public readonly host: string\n ) {\n super(\n `SDK protocol version ${sdkProtocol} is incompatible with node protocol version ${nodeProtocol} (node v${nodeVersion}) at ${host}. ` +\n (sdkProtocol < nodeProtocol\n ? \"Please update your SDK.\"\n : \"Please update the TinyCloud node.\")\n );\n }\n}\n\nexport class VersionCheckError extends Error {\n name = \"VersionCheckError\" as const;\n constructor(\n public readonly host: string,\n public readonly cause?: Error\n ) {\n super(\n `Failed to fetch node info at ${host}. Ensure the node is running and the /info endpoint is accessible.`\n );\n }\n}\n\nexport class UnsupportedFeatureError extends Error {\n name = \"UnsupportedFeatureError\" as const;\n constructor(\n public readonly feature: string,\n public readonly host: string,\n public readonly availableFeatures: string[]\n ) {\n super(\n `Feature \"${feature}\" is not supported by the node at ${host}. ` +\n `Available features: ${availableFeatures.join(\", \") || \"none\"}.`\n );\n }\n}\n\nexport interface NodeInfo {\n features: string[];\n nodeId?: string;\n quotaUrl?: string;\n}\n\nexport async function checkNodeInfo(\n host: string,\n sdkProtocol: number,\n fetchFn: typeof globalThis.fetch = globalThis.fetch.bind(globalThis)\n): Promise<NodeInfo> {\n let response: Response;\n try {\n response = await fetchFn(`${host}/info`, {\n signal: AbortSignal.timeout(5000),\n });\n } catch (err) {\n throw new VersionCheckError(host, err as Error);\n }\n\n if (!response.ok) {\n throw new VersionCheckError(host);\n }\n\n const data = (await response.json()) as {\n protocol: number;\n version: string;\n features: string[];\n nodeId?: string;\n quota_url?: string;\n };\n\n if (sdkProtocol !== data.protocol) {\n throw new ProtocolMismatchError(\n sdkProtocol,\n data.protocol,\n data.version,\n host\n );\n }\n\n return {\n features: data.features ?? [],\n nodeId: data.nodeId,\n quotaUrl: data.quota_url,\n };\n}\n","/**\n * Returns true if the two passed Uint8Arrays have the same content\n */\nexport function equals (a: Uint8Array, b: Uint8Array): boolean {\n if (a === b) {\n return true\n }\n\n if (a.byteLength !== b.byteLength) {\n return false\n }\n\n for (let i = 0; i < a.byteLength; i++) {\n if (a[i] !== b[i]) {\n return false\n }\n }\n\n return true\n}\n","import { Buffer } from 'node:buffer'\nimport { asUint8Array } from '#util/as-uint8array'\n\n/**\n * Returns a `Uint8Array` of the requested size. Referenced memory will\n * be initialized to 0.\n */\nexport function alloc (size: number = 0): Uint8Array {\n return asUint8Array(Buffer.alloc(size))\n}\n\n/**\n * Where possible returns a Uint8Array of the requested size that references\n * uninitialized memory. Only use if you are certain you will immediately\n * overwrite every value in the returned `Uint8Array`.\n */\nexport function allocUnsafe (size: number = 0): Uint8Array {\n return asUint8Array(Buffer.allocUnsafe(size))\n}\n","/**\n * To guarantee Uint8Array semantics, convert nodejs Buffers\n * into vanilla Uint8Arrays\n */\nexport function asUint8Array (buf: Uint8Array): Uint8Array {\n return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength)\n}\n","/* eslint-disable no-fallthrough */\nimport { allocUnsafe } from 'uint8arrays/alloc'\nimport type { Uint8ArrayList } from 'uint8arraylist'\n\nconst N1 = Math.pow(2, 7)\nconst N2 = Math.pow(2, 14)\nconst N3 = Math.pow(2, 21)\nconst N4 = Math.pow(2, 28)\nconst N5 = Math.pow(2, 35)\nconst N6 = Math.pow(2, 42)\nconst N7 = Math.pow(2, 49)\n\n/** Most significant bit of a byte */\nconst MSB = 0x80\n/** Rest of the bits in a byte */\nconst REST = 0x7f\n\nexport function encodingLength (value: number): number {\n if (value < N1) {\n return 1\n }\n\n if (value < N2) {\n return 2\n }\n\n if (value < N3) {\n return 3\n }\n\n if (value < N4) {\n return 4\n }\n\n if (value < N5) {\n return 5\n }\n\n if (value < N6) {\n return 6\n }\n\n if (value < N7) {\n return 7\n }\n\n if (Number.MAX_SAFE_INTEGER != null && value > Number.MAX_SAFE_INTEGER) {\n throw new RangeError('Could not encode varint')\n }\n\n return 8\n}\n\nexport function encodeUint8Array (value: number, buf: Uint8Array, offset: number = 0): Uint8Array {\n switch (encodingLength(value)) {\n case 8: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 7: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 6: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 5: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 4: {\n buf[offset++] = (value & 0xFF) | MSB\n value >>>= 7\n }\n case 3: {\n buf[offset++] = (value & 0xFF) | MSB\n value >>>= 7\n }\n case 2: {\n buf[offset++] = (value & 0xFF) | MSB\n value >>>= 7\n }\n case 1: {\n buf[offset++] = (value & 0xFF)\n value >>>= 7\n break\n }\n default: throw new Error('unreachable')\n }\n return buf\n}\n\nexport function encodeUint8ArrayList (value: number, buf: Uint8ArrayList, offset: number = 0): Uint8ArrayList {\n switch (encodingLength(value)) {\n case 8: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 7: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 6: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 5: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 4: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value >>>= 7\n }\n case 3: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value >>>= 7\n }\n case 2: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value >>>= 7\n }\n case 1: {\n buf.set(offset++, (value & 0xFF))\n value >>>= 7\n break\n }\n default: throw new Error('unreachable')\n }\n return buf\n}\n\nexport function decodeUint8Array (buf: Uint8Array, offset: number): number {\n let b = buf[offset]\n let res = 0\n\n res += b & REST\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 1]\n res += (b & REST) << 7\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 2]\n res += (b & REST) << 14\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 3]\n res += (b & REST) << 21\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 4]\n res += (b & REST) * N4\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 5]\n res += (b & REST) * N5\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 6]\n res += (b & REST) * N6\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 7]\n res += (b & REST) * N7\n if (b < MSB) {\n return res\n }\n\n throw new RangeError('Could not decode varint')\n}\n\nexport function decodeUint8ArrayList (buf: Uint8ArrayList, offset: number): number {\n let b = buf.get(offset)\n let res = 0\n\n res += b & REST\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 1)\n res += (b & REST) << 7\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 2)\n res += (b & REST) << 14\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 3)\n res += (b & REST) << 21\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 4)\n res += (b & REST) * N4\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 5)\n res += (b & REST) * N5\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 6)\n res += (b & REST) * N6\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 7)\n res += (b & REST) * N7\n if (b < MSB) {\n return res\n }\n\n throw new RangeError('Could not decode varint')\n}\n\nexport function encode (value: number): Uint8Array\nexport function encode (value: number, buf: Uint8Array, offset?: number): Uint8Array\nexport function encode (value: number, buf: Uint8ArrayList, offset?: number): Uint8ArrayList\nexport function encode <T extends Uint8Array | Uint8ArrayList = Uint8Array> (value: number, buf?: T, offset: number = 0): T {\n if (buf == null) {\n buf = allocUnsafe(encodingLength(value)) as T\n }\n if (buf instanceof Uint8Array) {\n return encodeUint8Array(value, buf, offset) as T\n } else {\n return encodeUint8ArrayList(value, buf, offset) as T\n }\n}\n\nexport function decode (buf: Uint8ArrayList | Uint8Array, offset: number = 0): number {\n if (buf instanceof Uint8Array) {\n return decodeUint8Array(buf, offset)\n } else {\n return decodeUint8ArrayList(buf, offset)\n }\n}\n","import { Buffer } from 'node:buffer'\nimport { asUint8Array } from '#util/as-uint8array'\n\n/**\n * Returns a new Uint8Array created by concatenating the passed Uint8Arrays\n */\nexport function concat (arrays: Uint8Array[], length?: number): Uint8Array {\n return asUint8Array(Buffer.concat(arrays, length))\n}\n","import { Buffer } from 'node:buffer'\nimport bases, { type SupportedEncodings } from './util/bases.js'\nimport { asUint8Array } from '#util/as-uint8array'\n\nexport type { SupportedEncodings }\n\n/**\n * Create a `Uint8Array` from the passed string\n *\n * Supports `utf8`, `utf-8`, `hex`, and any encoding supported by the multiformats module.\n *\n * Also `ascii` which is similar to node's 'binary' encoding.\n */\nexport function fromString (string: string, encoding: SupportedEncodings = 'utf8'): Uint8Array {\n const base = bases[encoding]\n\n if (base == null) {\n throw new Error(`Unsupported encoding \"${encoding}\"`)\n }\n\n if (encoding === 'utf8' || encoding === 'utf-8') {\n return asUint8Array(Buffer.from(string, 'utf-8'))\n }\n\n // add multibase prefix\n return base.decoder.decode(`${base.prefix}${string}`) // eslint-disable-line @typescript-eslint/restrict-template-expressions\n}\n","import { bases } from 'multiformats/basics'\nimport type { MultibaseCodec } from 'multiformats'\nimport { allocUnsafe } from '#alloc'\n\nfunction createCodec (name: string, prefix: string, encode: (buf: Uint8Array) => string, decode: (str: string) => Uint8Array): MultibaseCodec<any> {\n return {\n name,\n prefix,\n encoder: {\n name,\n prefix,\n encode\n },\n decoder: {\n decode\n }\n }\n}\n\nconst string = createCodec('utf8', 'u', (buf) => {\n const decoder = new TextDecoder('utf8')\n return 'u' + decoder.decode(buf)\n}, (str) => {\n const encoder = new TextEncoder()\n return encoder.encode(str.substring(1))\n})\n\nconst ascii = createCodec('ascii', 'a', (buf) => {\n let string = 'a'\n\n for (let i = 0; i < buf.length; i++) {\n string += String.fromCharCode(buf[i])\n }\n return string\n}, (str) => {\n str = str.substring(1)\n const buf = allocUnsafe(str.length)\n\n for (let i = 0; i < str.length; i++) {\n buf[i] = str.charCodeAt(i)\n }\n\n return buf\n})\n\nexport type SupportedEncodings = 'utf8' | 'utf-8' | 'hex' | 'latin1' | 'ascii' | 'binary' | keyof typeof bases\n\nconst BASES: Record<SupportedEncodings, MultibaseCodec<any>> = {\n utf8: string,\n 'utf-8': string,\n hex: bases.base16,\n latin1: ascii,\n ascii,\n binary: ascii,\n\n ...bases\n}\n\nexport default BASES\n","import { Buffer } from 'node:buffer'\nimport bases, { type SupportedEncodings } from './util/bases.js'\n\nexport type { SupportedEncodings }\n\n/**\n * Turns a `Uint8Array` into a string.\n *\n * Supports `utf8`, `utf-8` and any encoding supported by the multibase module.\n *\n * Also `ascii` which is similar to node's 'binary' encoding.\n */\nexport function toString (array: Uint8Array, encoding: SupportedEncodings = 'utf8'): string {\n const base = bases[encoding]\n\n if (base == null) {\n throw new Error(`Unsupported encoding \"${encoding}\"`)\n }\n\n if (encoding === 'utf8' || encoding === 'utf-8') {\n return Buffer.from(array.buffer, array.byteOffset, array.byteLength).toString('utf8')\n }\n\n // strip multibase prefix\n return base.encoder.encode(array).substring(1)\n}\n","/**\n * Thrown when an invalid multiaddr is encountered\n */\nexport class InvalidMultiaddrError extends Error {\n static name = 'InvalidMultiaddrError'\n name = 'InvalidMultiaddrError'\n}\n\nexport class ValidationError extends Error {\n static name = 'ValidationError'\n name = 'ValidationError'\n}\n\nexport class InvalidParametersError extends Error {\n static name = 'InvalidParametersError'\n name = 'InvalidParametersError'\n}\n\nexport class UnknownProtocolError extends Error {\n static name = 'UnknownProtocolError'\n name = 'UnknownProtocolError'\n}\n","import { isIPv4, isIPv6, isIP as ipVersion } from \"node:net\";\n\nexport { isIPv4, isIPv6, ipVersion };\n\n/** Check if `input` is IPv4 or IPv6. */\nexport function isIP(input: string): boolean {\n return Boolean(ipVersion(input));\n}\n","// the values here come from https://github.com/multiformats/multiaddr/blob/master/protocols.csv\n\nexport const CODE_IP4 = 4\nexport const CODE_TCP = 6\nexport const CODE_UDP = 273\nexport const CODE_DCCP = 33\nexport const CODE_IP6 = 41\nexport const CODE_IP6ZONE = 42\nexport const CODE_IPCIDR = 43\nexport const CODE_DNS = 53\nexport const CODE_DNS4 = 54\nexport const CODE_DNS6 = 55\nexport const CODE_DNSADDR = 56\nexport const CODE_SCTP = 132\nexport const CODE_UDT = 301\nexport const CODE_UTP = 302\nexport const CODE_UNIX = 400\nexport const CODE_P2P = 421 // also IPFS\nexport const CODE_ONION = 444\nexport const CODE_ONION3 = 445\nexport const CODE_GARLIC64 = 446\nexport const CODE_GARLIC32 = 447\nexport const CODE_TLS = 448\nexport const CODE_SNI = 449\nexport const CODE_NOISE = 454\nexport const CODE_QUIC = 460\nexport const CODE_QUIC_V1 = 461\nexport const CODE_WEBTRANSPORT = 465\nexport const CODE_CERTHASH = 466\nexport const CODE_HTTP = 480\nexport const CODE_HTTP_PATH = 481\nexport const CODE_HTTPS = 443\nexport const CODE_WS = 477\nexport const CODE_WSS = 478\nexport const CODE_P2P_WEBSOCKET_STAR = 479\nexport const CODE_P2P_STARDUST = 277\nexport const CODE_P2P_WEBRTC_STAR = 275\nexport const CODE_P2P_WEBRTC_DIRECT = 276\nexport const CODE_WEBRTC_DIRECT = 280\nexport const CODE_WEBRTC = 281\nexport const CODE_P2P_CIRCUIT = 290\nexport const CODE_MEMORY = 777\n","import { isIPv4 } from '@chainsafe/is-ip'\nimport { base32 } from 'multiformats/bases/base32'\nimport { bases } from 'multiformats/basics'\nimport { concat as uint8ArrayConcat } from 'uint8arrays/concat'\nimport { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'\nimport { toString as uint8ArrayToString } from 'uint8arrays/to-string'\nimport { InvalidMultiaddrError } from './errors.ts'\nimport type { MultibaseCodec } from 'multiformats'\nimport type { SupportedEncodings } from 'uint8arrays/to-string'\n\nexport function bytesToString (base: SupportedEncodings): (buf: Uint8Array) => string {\n return (buf) => {\n return uint8ArrayToString(buf, base)\n }\n}\n\nexport function stringToBytes (base: SupportedEncodings): (value: string) => Uint8Array {\n return (buf) => {\n return uint8ArrayFromString(buf, base)\n }\n}\n\nexport function bytes2port (buf: Uint8Array): string {\n const view = new DataView(buf.buffer)\n return view.getUint16(buf.byteOffset).toString()\n}\n\nexport function port2bytes (port: string | number): Uint8Array {\n const buf = new ArrayBuffer(2)\n const view = new DataView(buf)\n view.setUint16(0, typeof port === 'string' ? parseInt(port) : port)\n\n return new Uint8Array(buf)\n}\n\nexport function onion2bytes (str: string): Uint8Array {\n const addr = str.split(':')\n\n if (addr.length !== 2) {\n throw new Error(`failed to parse onion addr: [\"'${addr.join('\", \"')}'\"]' does not contain a port number`)\n }\n\n if (addr[0].length !== 16) {\n throw new Error(`failed to parse onion addr: ${addr[0]} not a Tor onion address.`)\n }\n\n // onion addresses do not include the multibase prefix, add it before decoding\n const buf = uint8ArrayFromString(addr[0], 'base32')\n\n // onion port number\n const port = parseInt(addr[1], 10)\n\n if (port < 1 || port > 65536) {\n throw new Error('Port number is not in range(1, 65536)')\n }\n\n const portBuf = port2bytes(port)\n\n return uint8ArrayConcat([buf, portBuf], buf.length + portBuf.length)\n}\n\nexport function onion32bytes (str: string): Uint8Array {\n const addr = str.split(':')\n\n if (addr.length !== 2) {\n throw new Error(`failed to parse onion addr: [\"'${addr.join('\", \"')}'\"]' does not contain a port number`)\n }\n\n if (addr[0].length !== 56) {\n throw new Error(`failed to parse onion addr: ${addr[0]} not a Tor onion3 address.`)\n }\n\n // onion addresses do not include the multibase prefix, add it before decoding\n const buf = base32.decode(`b${addr[0]}`)\n\n // onion port number\n const port = parseInt(addr[1], 10)\n\n if (port < 1 || port > 65536) {\n throw new Error('Port number is not in range(1, 65536)')\n }\n\n const portBuf = port2bytes(port)\n\n return uint8ArrayConcat([buf, portBuf], buf.length + portBuf.length)\n}\n\nexport function bytes2onion (buf: Uint8Array): string {\n const addrBytes = buf.subarray(0, buf.length - 2)\n const portBytes = buf.subarray(buf.length - 2)\n const addr = uint8ArrayToString(addrBytes, 'base32')\n const port = bytes2port(portBytes)\n return `${addr}:${port}`\n}\n\n// Copied from https://github.com/indutny/node-ip/blob/master/lib/ip.js#L7\n// but with buf/offset args removed because we don't use them\nexport const ip4ToBytes = function (ip: string): Uint8Array {\n ip = ip.toString().trim()\n\n const bytes = new Uint8Array(4)\n\n ip.split(/\\./g).forEach((byte, index) => {\n const value = parseInt(byte, 10)\n\n if (isNaN(value) || value < 0 || value > 0xff) {\n throw new InvalidMultiaddrError('Invalid byte value in IP address')\n }\n\n bytes[index] = value\n })\n\n return bytes\n}\n\n// Copied from https://github.com/indutny/node-ip/blob/master/lib/ip.js#L7\n// but with buf/offset args removed because we don't use them\nexport const ip6ToBytes = function (ip: string): Uint8Array {\n let offset = 0\n ip = ip.toString().trim()\n\n const sections = ip.split(':', 8)\n\n let i\n for (i = 0; i < sections.length; i++) {\n const isv4 = isIPv4(sections[i])\n let v4Buffer: Uint8Array | undefined\n\n if (isv4) {\n v4Buffer = ip4ToBytes(sections[i])\n sections[i] = uint8ArrayToString(v4Buffer.subarray(0, 2), 'base16')\n }\n\n if (v4Buffer != null && ++i < 8) {\n sections.splice(i, 0, uint8ArrayToString(v4Buffer.subarray(2, 4), 'base16'))\n }\n }\n\n if (sections[0] === '') {\n while (sections.length < 8) { sections.unshift('0') }\n } else if (sections[sections.length - 1] === '') {\n while (sections.length < 8) { sections.push('0') }\n } else if (sections.length < 8) {\n for (i = 0; i < sections.length && sections[i] !== ''; i++) { }\n const argv: [number, number, ...string[]] = [i, 1]\n for (i = 9 - sections.length; i > 0; i--) {\n argv.push('0')\n }\n sections.splice.apply(sections, argv)\n }\n\n const bytes = new Uint8Array(offset + 16)\n\n for (i = 0; i < sections.length; i++) {\n if (sections[i] === '') {\n sections[i] = '0'\n }\n\n const word = parseInt(sections[i], 16)\n\n if (isNaN(word) || word < 0 || word > 0xffff) {\n throw new InvalidMultiaddrError('Invalid byte value in IP address')\n }\n\n bytes[offset++] = (word >> 8) & 0xff\n bytes[offset++] = word & 0xff\n }\n\n return bytes\n}\n\n// Copied from https://github.com/indutny/node-ip/blob/master/lib/ip.js#L63\nexport const ip4ToString = function (buf: Uint8Array): string {\n if (buf.byteLength !== 4) {\n throw new InvalidMultiaddrError('IPv4 address was incorrect length')\n }\n\n const result = []\n\n for (let i = 0; i < buf.byteLength; i++) {\n result.push(buf[i])\n }\n\n return result.join('.')\n}\n\nexport const ip6ToString = function (buf: Uint8Array): string {\n if (buf.byteLength !== 16) {\n throw new InvalidMultiaddrError('IPv6 address was incorrect length')\n }\n\n const result: string[] = []\n\n for (let i = 0; i < buf.byteLength; i += 2) {\n const byte1 = buf[i]\n const byte2 = buf[i + 1]\n\n const tuple = `${byte1.toString(16).padStart(2, '0')}${byte2.toString(16).padStart(2, '0')}`\n\n result.push(tuple)\n }\n\n const ip = result.join(':')\n\n try {\n const url = new URL(`http://[${ip}]`)\n\n return url.hostname.substring(1, url.hostname.length - 1)\n } catch {\n throw new InvalidMultiaddrError(`Invalid IPv6 address \"${ip}\"`)\n }\n}\n\nexport function ip6StringToValue (str: string): string {\n try {\n const url = new URL(`http://[${str}]`)\n\n return url.hostname.substring(1, url.hostname.length - 1)\n } catch {\n throw new InvalidMultiaddrError(`Invalid IPv6 address \"${str}\"`)\n }\n}\n\nconst decoders = Object.values(bases).map((c) => c.decoder)\nconst anybaseDecoder = (function () {\n let acc = decoders[0].or(decoders[1])\n decoders.slice(2).forEach((d) => (acc = acc.or(d)))\n return acc\n})()\n\nexport function mb2bytes (mbstr: string): Uint8Array {\n return anybaseDecoder.decode(mbstr)\n}\n\nexport function bytes2mb (base: MultibaseCodec<any>): (buf: Uint8Array) => string {\n return (buf) => {\n return base.encoder.encode(buf)\n }\n}\n","import { ValidationError } from './errors.ts'\n\nexport function integer (value: string): void {\n const int = parseInt(value)\n\n if (int.toString() !== value) {\n throw new ValidationError('Value must be an integer')\n }\n}\n\nexport function positive (value: any): void {\n if (value < 0) {\n throw new ValidationError('Value must be a positive integer, or zero')\n }\n}\n\nexport function maxValue (max: number): (value: any) => void {\n return (value) => {\n if (value > max) {\n throw new ValidationError(`Value must be smaller than or equal to ${max}`)\n }\n }\n}\n\nexport function validate (...funcs: Array<(value: string) => void>): (value: string) => void {\n return (value) => {\n for (const fn of funcs) {\n fn(value)\n }\n }\n}\n\nexport const validatePort = validate(\n integer,\n positive,\n maxValue(65_535)\n)\n","import { isIPv4, isIPv6 } from '@chainsafe/is-ip'\nimport { CID } from 'multiformats'\nimport { base64url } from 'multiformats/bases/base64'\nimport { CODE_CERTHASH, CODE_DCCP, CODE_DNS, CODE_DNS4, CODE_DNS6, CODE_DNSADDR, CODE_GARLIC32, CODE_GARLIC64, CODE_HTTP, CODE_HTTP_PATH, CODE_HTTPS, CODE_IP4, CODE_IP6, CODE_IP6ZONE, CODE_IPCIDR, CODE_MEMORY, CODE_NOISE, CODE_ONION, CODE_ONION3, CODE_P2P, CODE_P2P_CIRCUIT, CODE_P2P_STARDUST, CODE_P2P_WEBRTC_DIRECT, CODE_P2P_WEBRTC_STAR, CODE_P2P_WEBSOCKET_STAR, CODE_QUIC, CODE_QUIC_V1, CODE_SCTP, CODE_SNI, CODE_TCP, CODE_TLS, CODE_UDP, CODE_UDT, CODE_UNIX, CODE_UTP, CODE_WEBRTC, CODE_WEBRTC_DIRECT, CODE_WEBTRANSPORT, CODE_WS, CODE_WSS } from './constants.ts'\nimport { UnknownProtocolError, ValidationError } from './errors.ts'\nimport { bytes2mb, bytes2onion, bytes2port, bytesToString, ip4ToBytes, ip4ToString, ip6StringToValue, ip6ToBytes, ip6ToString, mb2bytes, onion2bytes, onion32bytes, port2bytes, stringToBytes } from './utils.ts'\nimport { validatePort } from './validation.ts'\nimport type { Registry as RegistryInterface } from './index.ts'\n\nexport const V = -1\n\nexport interface ProtocolCodec {\n /**\n * A numeric code that will be used in the binary representation of the tuple.\n */\n code: number\n\n /**\n * A string name that will be used in the string representation of the addr.\n */\n name: string\n\n /**\n * Size defines the expected length of the address part of the tuple - valid\n * values are `-1` (or the `V` constant) for variable length (this will be\n * varint encoded in the binary representation), `0` for no address part or a\n * number that represents a fixed-length address.\n */\n size?: number\n\n /**\n * If specified this protocol codec will also be used to decode tuples with\n * these names from string multiaddrs.\n */\n aliases?: string[]\n\n /**\n * Where the multiaddr has been encoded as a string, decode the value if\n * necessary, unescaping any escaped values\n */\n stringToValue?(value: string): string\n\n /**\n * To encode the multiaddr as a string, escape any necessary values\n */\n valueToString?(value: string): string\n\n /**\n * To encode the multiaddr as bytes, convert the value to bytes\n */\n valueToBytes?(value: string): Uint8Array\n\n /**\n * To decode bytes to a multiaddr, convert the value bytes to a string\n */\n bytesToValue?(bytes: Uint8Array): string\n\n /**\n * Perform any necessary validation on the string value\n */\n validate?(value: string): void\n}\n\nclass Registry implements RegistryInterface {\n private protocolsByCode = new Map<number, ProtocolCodec>()\n private protocolsByName = new Map<string, ProtocolCodec>()\n\n getProtocol (key: string | number): ProtocolCodec {\n let codec: ProtocolCodec | undefined\n\n if (typeof key === 'string') {\n codec = this.protocolsByName.get(key)\n } else {\n codec = this.protocolsByCode.get(key)\n }\n\n if (codec == null) {\n throw new UnknownProtocolError(`Protocol ${key} was unknown`)\n }\n\n return codec\n }\n\n addProtocol (codec: ProtocolCodec): void {\n this.protocolsByCode.set(codec.code, codec)\n this.protocolsByName.set(codec.name, codec)\n\n codec.aliases?.forEach(alias => {\n this.protocolsByName.set(alias, codec)\n })\n }\n\n removeProtocol (code: number): void {\n const codec = this.protocolsByCode.get(code)\n\n if (codec == null) {\n return\n }\n\n this.protocolsByCode.delete(codec.code)\n this.protocolsByName.delete(codec.name)\n\n codec.aliases?.forEach(alias => {\n this.protocolsByName.delete(alias)\n })\n }\n}\n\nexport const registry = new Registry()\n\nconst codecs: ProtocolCodec[] = [{\n code: CODE_IP4,\n name: 'ip4',\n size: 32,\n valueToBytes: ip4ToBytes,\n bytesToValue: ip4ToString,\n validate: (value) => {\n if (!isIPv4(value)) {\n throw new ValidationError(`Invalid IPv4 address \"${value}\"`)\n }\n }\n}, {\n code: CODE_TCP,\n name: 'tcp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_UDP,\n name: 'udp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_DCCP,\n name: 'dccp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_IP6,\n name: 'ip6',\n size: 128,\n valueToBytes: ip6ToBytes,\n bytesToValue: ip6ToString,\n stringToValue: ip6StringToValue,\n validate: (value) => {\n if (!isIPv6(value)) {\n throw new ValidationError(`Invalid IPv6 address \"${value}\"`)\n }\n }\n}, {\n code: CODE_IP6ZONE,\n name: 'ip6zone',\n size: V\n}, {\n code: CODE_IPCIDR,\n name: 'ipcidr',\n size: 8,\n bytesToValue: bytesToString('base10'),\n valueToBytes: stringToBytes('base10')\n}, {\n code: CODE_DNS,\n name: 'dns',\n size: V\n}, {\n code: CODE_DNS4,\n name: 'dns4',\n size: V\n}, {\n code: CODE_DNS6,\n name: 'dns6',\n size: V\n}, {\n code: CODE_DNSADDR,\n name: 'dnsaddr',\n size: V\n}, {\n code: CODE_SCTP,\n name: 'sctp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_UDT,\n name: 'udt'\n}, {\n code: CODE_UTP,\n name: 'utp'\n}, {\n code: CODE_UNIX,\n name: 'unix',\n size: V,\n stringToValue: (str) => decodeURIComponent(str),\n valueToString: (val) => encodeURIComponent(val)\n}, {\n code: CODE_P2P,\n name: 'p2p',\n aliases: ['ipfs'],\n size: V,\n bytesToValue: bytesToString('base58btc'),\n valueToBytes: (val) => {\n if (val.startsWith('Q') || val.startsWith('1')) {\n return stringToBytes('base58btc')(val)\n }\n\n return CID.parse(val).multihash.bytes\n }\n}, {\n code: CODE_ONION,\n name: 'onion',\n size: 96,\n bytesToValue: bytes2onion,\n valueToBytes: onion2bytes\n}, {\n code: CODE_ONION3,\n name: 'onion3',\n size: 296,\n bytesToValue: bytes2onion,\n valueToBytes: onion32bytes\n}, {\n code: CODE_GARLIC64,\n name: 'garlic64',\n size: V\n}, {\n code: CODE_GARLIC32,\n name: 'garlic32',\n size: V\n}, {\n code: CODE_TLS,\n name: 'tls'\n}, {\n code: CODE_SNI,\n name: 'sni',\n size: V\n}, {\n code: CODE_NOISE,\n name: 'noise'\n}, {\n code: CODE_QUIC,\n name: 'quic'\n}, {\n code: CODE_QUIC_V1,\n name: 'quic-v1'\n}, {\n code: CODE_WEBTRANSPORT,\n name: 'webtransport'\n}, {\n code: CODE_CERTHASH,\n name: 'certhash',\n size: V,\n bytesToValue: bytes2mb(base64url),\n valueToBytes: mb2bytes\n}, {\n code: CODE_HTTP,\n name: 'http'\n}, {\n code: CODE_HTTP_PATH,\n name: 'http-path',\n size: V,\n stringToValue: (str) => `/${decodeURIComponent(str)}`,\n valueToString: (val) => encodeURIComponent(val.substring(1))\n}, {\n code: CODE_HTTPS,\n name: 'https'\n}, {\n code: CODE_WS,\n name: 'ws'\n}, {\n code: CODE_WSS,\n name: 'wss'\n}, {\n code: CODE_P2P_WEBSOCKET_STAR,\n name: 'p2p-websocket-star'\n}, {\n code: CODE_P2P_STARDUST,\n name: 'p2p-stardust'\n}, {\n code: CODE_P2P_WEBRTC_STAR,\n name: 'p2p-webrtc-star'\n}, {\n code: CODE_P2P_WEBRTC_DIRECT,\n name: 'p2p-webrtc-direct'\n}, {\n code: CODE_WEBRTC_DIRECT,\n name: 'webrtc-direct'\n}, {\n code: CODE_WEBRTC,\n name: 'webrtc'\n}, {\n code: CODE_P2P_CIRCUIT,\n name: 'p2p-circuit'\n}, {\n code: CODE_MEMORY,\n name: 'memory',\n size: V\n}]\n\ncodecs.forEach(codec => {\n registry.addProtocol(codec)\n})\n","import * as varint from 'uint8-varint'\nimport { concat as uint8ArrayConcat } from 'uint8arrays/concat'\nimport { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'\nimport { toString as uint8ArrayToString } from 'uint8arrays/to-string'\nimport { InvalidMultiaddrError } from './errors.ts'\nimport { registry, V } from './registry.ts'\nimport type { Component } from './index.js'\nimport type { ProtocolCodec } from './registry.ts'\n\nexport function bytesToComponents (bytes: Uint8Array): Component[] {\n const components: Component[] = []\n\n let i = 0\n while (i < bytes.length) {\n const code = varint.decode(bytes, i)\n const codec = registry.getProtocol(code)\n const codeLength = varint.encodingLength(code)\n const size = sizeForAddr(codec, bytes, i + codeLength)\n let sizeLength = 0\n\n if (size > 0 && codec.size === V) {\n sizeLength = varint.encodingLength(size)\n }\n\n const componentLength = codeLength + sizeLength + size\n\n const component: Component = {\n code,\n name: codec.name,\n bytes: bytes.subarray(i, i + componentLength)\n }\n\n if (size > 0) {\n const valueOffset = i + codeLength + sizeLength\n const valueBytes = bytes.subarray(valueOffset, valueOffset + size)\n\n component.value = codec.bytesToValue?.(valueBytes) ?? uint8ArrayToString(valueBytes)\n }\n\n components.push(component)\n\n i += componentLength\n }\n\n return components\n}\n\nexport function componentsToBytes (components: Component[]): Uint8Array {\n let length = 0\n const bytes: Uint8Array[] = []\n\n for (const component of components) {\n if (component.bytes == null) {\n const codec = registry.getProtocol(component.code)\n const codecLength = varint.encodingLength(component.code)\n let valueBytes: Uint8Array | undefined\n let valueLength = 0\n let valueLengthLength = 0\n\n if (component.value != null) {\n valueBytes = codec.valueToBytes?.(component.value) ?? uint8ArrayFromString(component.value)\n valueLength = valueBytes.byteLength\n\n if (codec.size === V) {\n valueLengthLength = varint.encodingLength(valueLength)\n }\n }\n\n const bytes = new Uint8Array(codecLength + valueLengthLength + valueLength)\n\n // encode the protocol code\n let offset = 0\n varint.encodeUint8Array(component.code, bytes, offset)\n offset += codecLength\n\n // if there is a value\n if (valueBytes != null) {\n // if the value has variable length, encode the length\n if (codec.size === V) {\n varint.encodeUint8Array(valueLength, bytes, offset)\n offset += valueLengthLength\n }\n\n // finally encode the value\n bytes.set(valueBytes, offset)\n }\n\n component.bytes = bytes\n }\n\n bytes.push(component.bytes)\n length += component.bytes.byteLength\n }\n\n return uint8ArrayConcat(bytes, length)\n}\n\nexport function stringToComponents (string: string): Component[] {\n if (string.charAt(0) !== '/') {\n throw new InvalidMultiaddrError('String multiaddr must start with \"/\"')\n }\n\n const components: Component[] = []\n let collecting: 'protocol' | 'value' = 'protocol'\n let value = ''\n let protocol = ''\n\n for (let i = 1; i < string.length; i++) {\n const char = string.charAt(i)\n\n if (char !== '/') {\n if (collecting === 'protocol') {\n protocol += string.charAt(i)\n } else {\n value += string.charAt(i)\n }\n }\n\n const ended = i === string.length - 1\n\n if (char === '/' || ended) {\n const codec = registry.getProtocol(protocol)\n\n if (collecting === 'protocol') {\n if (codec.size == null || codec.size === 0) {\n // a protocol without an address, eg. `/tls`\n components.push({\n code: codec.code,\n name: codec.name\n })\n\n value = ''\n protocol = ''\n collecting = 'protocol'\n\n continue\n } else if (ended) {\n throw new InvalidMultiaddrError(`Component ${protocol} was missing value`)\n }\n\n // continue collecting value\n collecting = 'value'\n } else if (collecting === 'value') {\n const component: Component = {\n code: codec.code,\n name: codec.name\n }\n\n if (codec.size != null && codec.size !== 0) {\n if (value === '') {\n throw new InvalidMultiaddrError(`Component ${protocol} was missing value`)\n }\n\n component.value = codec.stringToValue?.(value) ?? value\n }\n\n components.push(component)\n\n value = ''\n protocol = ''\n collecting = 'protocol'\n }\n }\n }\n\n if (protocol !== '' && value !== '') {\n throw new InvalidMultiaddrError('Incomplete multiaddr')\n }\n\n return components\n}\n\nexport function componentsToString (components: Component[]): string {\n return `/${components.flatMap(component => {\n if (component.value == null) {\n return component.name\n }\n\n const codec = registry.getProtocol(component.code)\n\n if (codec == null) {\n throw new InvalidMultiaddrError(`Unknown protocol code ${component.code}`)\n }\n\n return [\n component.name,\n codec.valueToString?.(component.value) ?? component.value\n ]\n }).join('/')}`\n}\n\n/**\n * For the passed address, return the serialized size\n */\nfunction sizeForAddr (codec: ProtocolCodec, bytes: Uint8Array, offset: number): number {\n if (codec.size == null || codec.size === 0) {\n return 0\n }\n\n if (codec.size > 0) {\n return codec.size / 8\n }\n\n return varint.decode(bytes, offset)\n}\n","import { equals as uint8ArrayEquals } from 'uint8arrays/equals'\nimport { bytesToComponents, componentsToBytes, componentsToString, stringToComponents } from './components.js'\nimport { InvalidMultiaddrError, InvalidParametersError } from './errors.ts'\nimport { registry } from './registry.ts'\nimport { isMultiaddr } from './index.js'\nimport type { MultiaddrInput, Multiaddr as MultiaddrInterface, Component } from './index.js'\n\nconst inspect = Symbol.for('nodejs.util.inspect.custom')\nexport const symbol = Symbol.for('@multiformats/multiaddr')\n\nfunction toComponents (addr: MultiaddrInput): Component[] {\n if (addr == null) {\n addr = '/'\n }\n\n if (isMultiaddr(addr)) {\n return addr.getComponents()\n }\n\n if (addr instanceof Uint8Array) {\n return bytesToComponents(addr)\n }\n\n if (typeof addr === 'string') {\n addr = addr\n .replace(/\\/(\\/)+/, '/')\n .replace(/(\\/)+$/, '')\n\n if (addr === '') {\n addr = '/'\n }\n\n return stringToComponents(addr)\n }\n\n if (Array.isArray(addr)) {\n return addr\n }\n\n throw new InvalidMultiaddrError('Must be a string, Uint8Array, Component[], or another Multiaddr')\n}\n\ninterface MultiaddrOptions {\n validate?: boolean\n}\n\n/**\n * Creates a {@link Multiaddr} from a {@link MultiaddrInput}\n */\nexport class Multiaddr implements MultiaddrInterface {\n [symbol]: boolean = true\n readonly #components: Component[]\n\n // cache string representation\n #string: string | undefined\n // cache byte representation\n #bytes: Uint8Array | undefined\n\n constructor (addr: MultiaddrInput | Component[] = '/', options: MultiaddrOptions = {}) {\n this.#components = toComponents(addr)\n\n if (options.validate !== false) {\n validate(this)\n }\n }\n\n get bytes (): Uint8Array {\n if (this.#bytes == null) {\n this.#bytes = componentsToBytes(this.#components)\n }\n\n return this.#bytes\n }\n\n toString (): string {\n if (this.#string == null) {\n this.#string = componentsToString(this.#components)\n }\n\n return this.#string\n }\n\n toJSON (): string {\n return this.toString()\n }\n\n getComponents (): Component[] {\n return [\n ...this.#components.map(c => ({ ...c }))\n ]\n }\n\n encapsulate (addr: MultiaddrInput): MultiaddrInterface {\n const ma = new Multiaddr(addr)\n\n return new Multiaddr([\n ...this.#components,\n ...ma.getComponents()\n ], {\n validate: false\n })\n }\n\n decapsulate (addr: Multiaddr | string): MultiaddrInterface {\n const addrString = addr.toString()\n const s = this.toString()\n const i = s.lastIndexOf(addrString)\n\n if (i < 0) {\n throw new InvalidParametersError(`Address ${this.toString()} does not contain subaddress: ${addrString}`)\n }\n\n return new Multiaddr(s.slice(0, i), {\n validate: false\n })\n }\n\n decapsulateCode (code: number): Multiaddr {\n let index\n\n for (let i = this.#components.length - 1; i > -1; i--) {\n if (this.#components[i].code === code) {\n index = i\n break\n }\n }\n\n return new Multiaddr(this.#components.slice(0, index), {\n validate: false\n })\n }\n\n equals (addr: { bytes: Uint8Array }): boolean {\n return uint8ArrayEquals(this.bytes, addr.bytes)\n }\n\n /**\n * Returns Multiaddr as a human-readable string\n * https://nodejs.org/api/util.html#utilinspectcustom\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * console.info(multiaddr('/ip4/127.0.0.1/tcp/4001'))\n * // 'Multiaddr(/ip4/127.0.0.1/tcp/4001)'\n * ```\n */\n [inspect] (): string {\n return `Multiaddr(${this.toString()})`\n }\n}\n\n/**\n * Ensures all multiaddr tuples are correct. Throws if any invalid protocols or\n * values are encountered.\n */\nexport function validate (addr: Multiaddr): void {\n addr.getComponents()\n .forEach(component => {\n const codec = registry.getProtocol(component.code)\n\n if (component.value == null) {\n return\n }\n\n codec.validate?.(component.value)\n })\n}\n","/**\n * @packageDocumentation\n *\n * A standard way to represent addresses that\n *\n * - support any standard network protocol\n * - have a binary packed format\n * - have a nice string representation\n * - encapsulate well\n *\n * @example\n *\n * ```TypeScript\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const addr = multiaddr('/ip4/127.0.0.1/udp/1234')\n * // Multiaddr(/ip4/127.0.0.1/udp/1234)\n *\n * addr.bytes\n * // <Uint8Array 04 7f 00 00 01 11 04 d2>\n *\n * addr.toString()\n * // '/ip4/127.0.0.1/udp/1234'\n *\n * addr.getComponents()\n * // [\n * // { code: 4, name: 'ip4', value: '127.0.0.1' },\n * // { code: 273, name: 'udp', value: '1234' }\n * // ]\n *\n * addr.encapsulate('/sctp/5678')\n * // Multiaddr(/ip4/127.0.0.1/udp/1234/sctp/5678)\n * ```\n *\n * @example Adding custom protocols\n *\n * To add application-specific or experimental protocols, add a protocol codec\n * to the protocol registry:\n *\n * ```ts\n * import { registry, V, multiaddr } from '@multiformats/multiaddr'\n * import type { ProtocolCodec } from '@multiformats/multiaddr'\n *\n * const maWithCustomTuple = '/custom-protocol/hello'\n *\n * // throws UnknownProtocolError\n * multiaddr(maWithCustomTuple)\n *\n * const protocol: ProtocolCodec = {\n * code: 2059,\n * name: 'custom-protocol',\n * size: V\n * // V means variable length, can also be 0, a positive integer (e.g. a fixed\n * // length or omitted\n * }\n *\n * registry.addProtocol(protocol)\n *\n * // does not throw UnknownProtocolError\n * multiaddr(maWithCustomTuple)\n *\n * // protocols can also be removed\n * registry.removeProtocol(protocol.code)\n * ```\n */\n\nimport { Multiaddr as MultiaddrClass, symbol } from './multiaddr.js'\nimport { registry, V } from './registry.ts'\nimport type { ProtocolCodec } from './registry.ts'\n\n/**\n * The protocol registry stores protocol codecs that allow transformation of\n * multiaddr tuples from bytes to string and back again, and also validation of\n * the address values.\n */\nexport interface Registry {\n /**\n * Retrieve a protocol definition by it's code or name\n */\n getProtocol (key: string | number): ProtocolCodec\n\n /**\n * Add a new protocol definition\n */\n addProtocol (codec: ProtocolCodec): void\n\n /**\n * Remove a protocol definition by it's code\n */\n removeProtocol (code: number): void\n}\n\n/**\n * These types can be parsed into a {@link Multiaddr} object\n */\nexport type MultiaddrInput = string | Multiaddr | Uint8Array | null | Component[]\n\n/**\n * A Component is a section of a multiaddr with a name/code, possibly with a\n * value.\n *\n * Component names/codes are defined in the protocol table.\n *\n * @see https://github.com/multiformats/multiaddr/blob/master/protocols.csv\n */\nexport interface Component {\n /**\n * The code of the component as defined in the protocol table\n */\n code: number\n\n /**\n * The name of the component as defined in the protocol table\n */\n name: string\n\n /**\n * The component value, if one is present\n */\n value?: string\n\n /**\n * The bytes that make up the component. This will be set if the multiaddr\n * was parsed from a `Uint8Array`, or if `.bytes` has been accessed on it.\n */\n bytes?: Uint8Array\n}\n\nexport interface Multiaddr {\n bytes: Uint8Array\n\n /**\n * Returns Multiaddr as a String\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/4001').toString()\n * // '/ip4/127.0.0.1/tcp/4001'\n * ```\n */\n toString(): string\n\n /**\n * Returns Multiaddr as a JSON encoded object\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * JSON.stringify(multiaddr('/ip4/127.0.0.1/tcp/4001'))\n * // '/ip4/127.0.0.1/tcp/4001'\n * ```\n */\n toJSON(): string\n\n /**\n * Returns the components that make up this Multiaddr\n *\n * @example\n * ```ts\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/4001').getComponents()\n * // [{ name: 'ip4', code: 4, value: '127.0.0.1' }, { name: 'tcp', code: 6, value: '4001' }]\n * ```\n */\n getComponents(): Component[]\n\n /**\n * Encapsulates a Multiaddr in another Multiaddr\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const mh1 = multiaddr('/ip4/8.8.8.8/tcp/1080')\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080)\n *\n * const mh2 = multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n *\n * const mh3 = mh1.encapsulate(mh2)\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080/ip4/127.0.0.1/tcp/4001)\n *\n * mh3.toString()\n * // '/ip4/8.8.8.8/tcp/1080/ip4/127.0.0.1/tcp/4001'\n * ```\n *\n * @param {MultiaddrInput} addr - Multiaddr to add into this Multiaddr\n */\n encapsulate(addr: MultiaddrInput): Multiaddr\n\n /**\n * Decapsulates a Multiaddr from another Multiaddr\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const mh1 = multiaddr('/ip4/8.8.8.8/tcp/1080')\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080)\n *\n * const mh2 = multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n *\n * const mh3 = mh1.encapsulate(mh2)\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080/ip4/127.0.0.1/tcp/4001)\n *\n * mh3.decapsulate(mh2).toString()\n * // '/ip4/8.8.8.8/tcp/1080'\n * ```\n *\n * @param {Multiaddr | string} addr - Multiaddr to remove from this Multiaddr\n */\n decapsulate(addr: Multiaddr | string): Multiaddr\n\n /**\n * A more reliable version of `decapsulate` if you are targeting a specific\n * code, such as 421 (the `p2p` protocol code). The last index of the code\n * will be removed from the `Multiaddr`, and a new instance will be returned.\n * If the code is not present, the original `Multiaddr` is returned.\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const addr = multiaddr('/ip4/0.0.0.0/tcp/8080/p2p/QmcgpsyWgH8Y8ajJz1Cu72KnS5uo2Aa2LpzU7kinSupNKC')\n * // Multiaddr(/ip4/0.0.0.0/tcp/8080/p2p/QmcgpsyWgH8Y8ajJz1Cu72KnS5uo2Aa2LpzU7kinSupNKC)\n *\n * addr.decapsulateCode(421).toString()\n * // '/ip4/0.0.0.0/tcp/8080'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/8080').decapsulateCode(421).toString()\n * // '/ip4/127.0.0.1/tcp/8080'\n * ```\n */\n decapsulateCode(code: number): Multiaddr\n\n /**\n * Checks if two Multiaddrs are the same\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const mh1 = multiaddr('/ip4/8.8.8.8/tcp/1080')\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080)\n *\n * const mh2 = multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n *\n * mh1.equals(mh1)\n * // true\n *\n * mh1.equals(mh2)\n * // false\n * ```\n */\n equals(addr: { bytes: Uint8Array }): boolean\n}\n\n/**\n * Check if object is a {@link Multiaddr} instance\n *\n * @example\n *\n * ```js\n * import { isMultiaddr, multiaddr } from '@multiformats/multiaddr'\n *\n * isMultiaddr(5)\n * // false\n * isMultiaddr(multiaddr('/ip4/127.0.0.1'))\n * // true\n * ```\n */\nexport function isMultiaddr (value: any): value is Multiaddr {\n return Boolean(value?.[symbol])\n}\n\n/**\n * A function that takes a {@link MultiaddrInput} and returns a {@link Multiaddr}\n *\n * @example\n * ```js\n * import { multiaddr } from '@libp2p/multiaddr'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n * ```\n *\n * @param {MultiaddrInput} [addr] - If String or Uint8Array, needs to adhere to the address format of a [multiaddr](https://github.com/multiformats/multiaddr#string-format)\n */\nexport function multiaddr (addr?: MultiaddrInput): Multiaddr {\n return new MultiaddrClass(addr)\n}\n\n/**\n * Export all table.csv codes. These are all named exports so can be tree-shaken\n * out by bundlers.\n */\nexport * from './constants.ts'\nexport { registry, V }\nexport type { ProtocolCodec }\n","/**\n * @packageDocumentation\n *\n * This module allows easy conversion of Multiaddrs to string URIs.\n *\n * @example Converting multiaddrs to string URIs\n *\n * ```js\n * import { multiaddrToUri } from '@multiformats/multiaddr-to-uri'\n *\n * console.log(multiaddrToUri('/dnsaddr/protocol.ai/https'))\n * // -> https://protocol.ai\n *\n * console.log(multiaddrToUri('/ip4/127.0.0.1/tcp/8080'))\n * // -> http://127.0.0.1:8080\n *\n * console.log(multiaddrToUri('/ip4/127.0.0.1/tcp/8080', { assumeHttp: false }))\n * // -> tcp://127.0.0.1:8080\n * ```\n *\n * Note:\n *\n * - When `/tcp` is the last (terminating) protocol HTTP is assumed by default (implicit `assumeHttp: true`)\n * - this means produced URIs will start with `http://` instead of `tcp://`\n * - passing `{ assumeHttp: false }` disables this behavior\n * - Might be lossy - e.g. a DNSv6 multiaddr\n * - Can throw if the passed multiaddr:\n * - is not a valid multiaddr\n * - is not supported as a URI e.g. circuit\n */\n\nimport { CODE_TCP, CODE_DNS, CODE_DNS4, CODE_DNS6, CODE_DNSADDR, multiaddr, CODE_TLS, CODE_IP6 } from '@multiformats/multiaddr'\nimport type { Component, Multiaddr } from '@multiformats/multiaddr'\n\nexport interface MultiaddrToUriOpts {\n assumeHttp?: boolean\n}\n\nconst ASSUME_HTTP_CODES = [\n CODE_TCP,\n CODE_DNS,\n CODE_DNSADDR,\n CODE_DNS4,\n CODE_DNS6\n]\n\ninterface Interpreter {\n (head: Component, rest: Component[]): string | undefined\n}\n\nfunction extractSNI (ma: Component[]): string | undefined {\n return extractTuple('sni', ma)?.value\n}\n\nfunction extractPort (ma: Component[]): string {\n const port = extractTuple('tcp', ma)?.value\n\n if (port == null) {\n return ''\n }\n\n return `:${port}`\n}\n\nfunction extractTuple (name: string, ma: Component[]): Component | undefined {\n return ma.find(component => component.name === name)\n}\n\nfunction hasTLS (ma: Component[]): boolean {\n return ma.some(({ code }) => code === CODE_TLS)\n}\n\nfunction interpretNext (head: Component, rest: Component[]): string | undefined {\n const interpreter = interpreters[head.name]\n if (interpreter == null) {\n throw new Error(`Can't interpret protocol ${head.name}`)\n }\n const restVal = interpreter(head, rest)\n if (head.code === CODE_IP6) {\n return `[${restVal}]`\n }\n return restVal\n}\n\nconst interpreters: Record<string, Interpreter> = {\n ip4: (head, rest) => head.value,\n ip6: (head, rest) => {\n if (rest.length === 0) {\n return head.value\n }\n return `[${head.value}]`\n },\n tcp: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `tcp://${interpretNext(tail, rest)}:${head.value}`\n },\n udp: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `udp://${interpretNext(tail, rest)}:${head.value}`\n },\n dnsaddr: (head, rest) => head.value,\n dns4: (head, rest) => head.value,\n dns6: (head, rest) => head.value,\n dns: (head, rest) => head.value,\n ipfs: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `${interpretNext(tail, rest)}`\n },\n p2p: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `${interpretNext(tail, rest)}`\n },\n http: (head, rest) => {\n const maHasTLS = hasTLS(rest)\n const sni = extractSNI(rest)\n const port = extractPort(rest)\n if (maHasTLS && sni != null) {\n return `https://${sni}${port}`\n }\n const protocol = maHasTLS ? 'https://' : 'http://'\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base as http, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `${protocol}${baseVal}`\n },\n 'http-path': (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n const baseVal = interpretNext(tail, rest)\n const decodedValue = decodeURIComponent(head.value ?? '')\n return `${baseVal}${decodedValue}`\n },\n tls: (head, rest) => {\n // Noop, the parent context knows that it's tls. We don't need to do\n // anything here\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return interpretNext(tail, rest)\n },\n sni: (head, rest) => {\n // Noop, the parent context uses the sni information, we don't need to do\n // anything here\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return interpretNext(tail, rest)\n },\n https: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base as http, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `https://${baseVal}`\n },\n ws: (head, rest) => {\n const maHasTLS = hasTLS(rest)\n const sni = extractSNI(rest)\n const port = extractPort(rest)\n if (maHasTLS && sni != null) {\n return `wss://${sni}${port}`\n }\n const protocol = maHasTLS ? 'wss://' : 'ws://'\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `${protocol}${baseVal}`\n },\n wss: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base as http, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `wss://${baseVal}`\n }\n}\n\nexport function multiaddrToUri (input: Multiaddr | string | Uint8Array, opts?: MultiaddrToUriOpts): string {\n const ma = multiaddr(input)\n const components = ma.getComponents()\n const head = components.pop()\n if (head == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n\n const interpreter = interpreters[head.name]\n\n if (interpreter == null) {\n throw new Error(`No interpreter found for ${head.name}`)\n }\n\n let uri = interpreter(head, components) ?? ''\n\n if (opts?.assumeHttp !== false && ASSUME_HTTP_CODES.includes(head.code)) {\n // strip any declared protocol\n uri = uri.replace(/^.*:\\/\\//, '')\n\n if (head.value === '443') {\n uri = `https://${uri}`\n } else {\n uri = `http://${uri}`\n }\n }\n\n if (uri.startsWith('http://') || uri.startsWith('https://') || uri.startsWith('ws://') || uri.startsWith('wss://')) {\n // this will strip default ports while keeping paths intact\n uri = new URL(uri).toString()\n\n // strip trailing slash, e.g. http://127.0.0.1/ -> http://127.0.0.1\n if (uri.endsWith('/')) {\n uri = uri.substring(0, uri.length - 1)\n }\n }\n\n return uri\n}\n","const word = '[a-fA-F\\\\d:]';\n\nconst boundry = options => options && options.includeBoundaries\n\t? `(?:(?<=\\\\s|^)(?=${word})|(?<=${word})(?=\\\\s|$))`\n\t: '';\n\nconst v4 = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]\\\\d|\\\\d)(?:\\\\.(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]\\\\d|\\\\d)){3}';\n\nconst v6segment = '[a-fA-F\\\\d]{1,4}';\n\nconst v6 = `\n(?:\n(?:${v6segment}:){7}(?:${v6segment}|:)| // 1:2:3:4:5:6:7:: 1:2:3:4:5:6:7:8\n(?:${v6segment}:){6}(?:${v4}|:${v6segment}|:)| // 1:2:3:4:5:6:: 1:2:3:4:5:6::8 1:2:3:4:5:6::8 1:2:3:4:5:6::1.2.3.4\n(?:${v6segment}:){5}(?::${v4}|(?::${v6segment}){1,2}|:)| // 1:2:3:4:5:: 1:2:3:4:5::7:8 1:2:3:4:5::8 1:2:3:4:5::7:1.2.3.4\n(?:${v6segment}:){4}(?:(?::${v6segment}){0,1}:${v4}|(?::${v6segment}){1,3}|:)| // 1:2:3:4:: 1:2:3:4::6:7:8 1:2:3:4::8 1:2:3:4::6:7:1.2.3.4\n(?:${v6segment}:){3}(?:(?::${v6segment}){0,2}:${v4}|(?::${v6segment}){1,4}|:)| // 1:2:3:: 1:2:3::5:6:7:8 1:2:3::8 1:2:3::5:6:7:1.2.3.4\n(?:${v6segment}:){2}(?:(?::${v6segment}){0,3}:${v4}|(?::${v6segment}){1,5}|:)| // 1:2:: 1:2::4:5:6:7:8 1:2::8 1:2::4:5:6:7:1.2.3.4\n(?:${v6segment}:){1}(?:(?::${v6segment}){0,4}:${v4}|(?::${v6segment}){1,6}|:)| // 1:: 1::3:4:5:6:7:8 1::8 1::3:4:5:6:7:1.2.3.4\n(?::(?:(?::${v6segment}){0,5}:${v4}|(?::${v6segment}){1,7}|:)) // ::2:3:4:5:6:7:8 ::2:3:4:5:6:7:8 ::8 ::1.2.3.4\n)(?:%[0-9a-zA-Z]{1,})? // %eth0 %1\n`.replace(/\\s*\\/\\/.*$/gm, '').replace(/\\n/g, '').trim();\n\n// Pre-compile only the exact regexes because adding a global flag make regexes stateful\nconst v46Exact = new RegExp(`(?:^${v4}$)|(?:^${v6}$)`);\nconst v4exact = new RegExp(`^${v4}$`);\nconst v6exact = new RegExp(`^${v6}$`);\n\nconst ipRegex = options => options && options.exact\n\t? v46Exact\n\t: new RegExp(`(?:${boundry(options)}${v4}${boundry(options)})|(?:${boundry(options)}${v6}${boundry(options)})`, 'g');\n\nipRegex.v4 = options => options && options.exact ? v4exact : new RegExp(`${boundry(options)}${v4}${boundry(options)}`, 'g');\nipRegex.v6 = options => options && options.exact ? v6exact : new RegExp(`${boundry(options)}${v6}${boundry(options)}`, 'g');\n\nexport default ipRegex;\n","import vm from 'node:vm';\n\nexport default function functionTimeout(function_, {timeout} = {}) {\n\tconst script = new vm.Script('returnValue = function_()');\n\n\tconst wrappedFunction = (...arguments_) => {\n\t\tconst context = {\n\t\t\tfunction_: () => function_(...arguments_),\n\t\t};\n\n\t\tscript.runInNewContext(context, {timeout});\n\n\t\treturn context.returnValue;\n\t};\n\n\tObject.defineProperty(wrappedFunction, 'name', {\n\t\tvalue: `functionTimeout(${function_.name || '<anonymous>'})`,\n\t\tconfigurable: true,\n\t});\n\n\treturn wrappedFunction;\n}\n\nexport function isTimeoutError(error) {\n\treturn error?.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT';\n}\n","const {toString} = Object.prototype;\n\nexport default function isRegexp(value) {\n\treturn toString.call(value) === '[object RegExp]';\n}\n","import isRegexp from 'is-regexp';\n\nconst flagMap = {\n\tglobal: 'g',\n\tignoreCase: 'i',\n\tmultiline: 'm',\n\tdotAll: 's',\n\tsticky: 'y',\n\tunicode: 'u'\n};\n\nexport default function clonedRegexp(regexp, options = {}) {\n\tif (!isRegexp(regexp)) {\n\t\tthrow new TypeError('Expected a RegExp instance');\n\t}\n\n\tconst flags = Object.keys(flagMap).map(flag => (\n\t\t(typeof options[flag] === 'boolean' ? options[flag] : regexp[flag]) ? flagMap[flag] : ''\n\t)).join('');\n\n\tconst clonedRegexp = new RegExp(options.source || regexp.source, flags);\n\n\tclonedRegexp.lastIndex = typeof options.lastIndex === 'number' ?\n\t\toptions.lastIndex :\n\t\tregexp.lastIndex;\n\n\treturn clonedRegexp;\n}\n","import functionTimeout, {isTimeoutError} from 'function-timeout';\nimport timeSpan from 'time-span';\nimport cloneRegexp from 'clone-regexp'; // TODO: Use `structuredClone` instead when targeting Node.js 18.\n\nconst resultToMatch = result => ({\n\tmatch: result[0],\n\tindex: result.index,\n\tgroups: result.slice(1),\n\tnamedGroups: result.groups ?? {},\n\tinput: result.input,\n});\n\nexport function isMatch(regex, string, {timeout} = {}) {\n\ttry {\n\t\treturn functionTimeout(() => cloneRegexp(regex).test(string), {timeout})();\n\t} catch (error) {\n\t\tif (isTimeoutError(error)) {\n\t\t\treturn false;\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n\nexport function firstMatch(regex, string, {timeout} = {}) {\n\ttry {\n\t\tconst result = functionTimeout(() => cloneRegexp(regex).exec(string), {timeout})();\n\n\t\tif (result === null) {\n\t\t\treturn;\n\t\t}\n\n\t\treturn resultToMatch(result);\n\t} catch (error) {\n\t\tif (isTimeoutError(error)) {\n\t\t\treturn;\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n\nexport function matches(regex, string, {timeout = Number.POSITIVE_INFINITY, matchTimeout = Number.POSITIVE_INFINITY} = {}) {\n\tif (!regex.global) {\n\t\tthrow new Error('The regex must have the global flag, otherwise, use `firstMatch()` instead');\n\t}\n\n\treturn {\n\t\t* [Symbol.iterator]() {\n\t\t\ttry {\n\t\t\t\tconst matches = string.matchAll(regex); // The regex is only executed when iterated over.\n\n\t\t\t\twhile (true) {\n\t\t\t\t\tconst nextMatch = functionTimeout(() => matches.next(), {timeout: (timeout !== Number.POSITIVE_INFINITY || matchTimeout !== Number.POSITIVE_INFINITY) ? Math.min(timeout, matchTimeout) : undefined}); // `matches.next` must be called within an arrow function so that it doesn't loose its context.\n\n\t\t\t\t\tconst end = timeSpan();\n\t\t\t\t\tconst {value, done} = nextMatch();\n\t\t\t\t\ttimeout -= Math.ceil(end());\n\n\t\t\t\t\tif (done) {\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tyield resultToMatch(value);\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tif (!isTimeoutError(error)) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t};\n}\n","import ipRegex from 'ip-regex';\nimport {isMatch} from 'super-regex';\n\nconst maxIPv4Length = 15;\nconst maxIPv6Length = 45;\n\nconst options = {\n\ttimeout: 400,\n};\n\nexport function isIP(string) {\n\tif (string.length > maxIPv6Length) {\n\t\treturn false;\n\t}\n\n\treturn isMatch(ipRegex({exact: true}), string, options);\n}\n\nexport function isIPv6(string) {\n\tif (string.length > maxIPv6Length) {\n\t\treturn false;\n\t}\n\n\treturn isMatch(ipRegex.v6({exact: true}), string, options);\n}\n\nexport function isIPv4(string) {\n\tif (string.length > maxIPv4Length) {\n\t\treturn false;\n\t}\n\n\treturn isMatch(ipRegex.v4({exact: true}), string, options);\n}\n\nexport function ipVersion(string) {\n\tif (isIPv6(string)) {\n\t\treturn 6;\n\t}\n\n\tif (isIPv4(string)) {\n\t\treturn 4;\n\t}\n}\n","/**\n * @packageDocumentation\n *\n * ```typescript\n * import { uriToMultiaddr } from '@multiformats/uri-to-multiaddr'\n *\n * console.log(uriToMultiaddr('https://protocol.ai'))\n * // -> /dns4/protocol.ai/tcp/443/https\n * ```\n *\n * Domain names can represent one of\n *\n * - `/dns4` - domain resolves to an ipv4 address (**default**)\n * - `/dns6` - domain resolves to an ipv6 address\n * - `/dnsaddr` - domain has a [DNSLink](https://docs.ipfs.io/guides/concepts/dnslink/) TXT record pointing to an IPFS CID\n *\n * This library assumes `/dns4` when it finds a domain name in the input string.\n * It makes no attempt query DNS. To override the default assumption, you can pass\n * in an options object as the second parameter to override it:\n *\n * ```typescript\n * import { uriToMultiaddr } from '@multiformats/uri-to-multiaddr'\n *\n * console.log(uriToMultiaddr('https://protocol.ai'), { defaultDnsType: 'dns6' })\n * // -> /dns6/protocol.ai/tcp/443/https\n * ```\n *\n * See [test.js](./test.js) for the currently supported conversions.\n *\n * **Note**: `uri-to-multiaddr` will throw if the passed URI:\n *\n * - is not a valid, according the WHATWG URL spec implementation used.\n * - is not supported yet\n *\n * ## Related\n *\n * - [@multiformats/multiaddr-to-uri](https://github.com/multiformats/js-multiaddr-to-uri) - convert it back again\n */\n\nimport { multiaddr } from '@multiformats/multiaddr'\nimport { isIPv4, isIPv6 } from 'is-ip'\nimport type { Multiaddr } from '@multiformats/multiaddr'\n\nconst portFor: Record<string, string> = {\n http: '80',\n https: '443',\n ws: '80',\n wss: '443'\n}\n\nconst BROWSER_SCHEMES = ['http', 'https', 'ws', 'wss']\n\nexport interface MultiaddrFromUriOpts {\n /**\n * If a URI contains a domain name, by default the `/dns/` tuple will be used\n * to define it. If you wish to use `/dnsaddr` or something more specific like\n * `/dns4` or `/dns6`, pass it as an option here.\n *\n * @default 'dns'\n */\n defaultDnsType?: 'dns' | 'dns4' | 'dns6' | 'dnsaddr'\n}\n\n/**\n * Convert a URI to a multiaddr\n *\n * http://foobar.com => /dns/foobar.com/tcp/80/http\n * https://foobar.com => /dns/foobar.com/tcp/443/https\n * https://foobar.com:5001 => /dns/foobar.com/tcp/5001/https\n * https://127.0.0.1:8080 => /ip4/127.0.0.1/tcp/8080/https\n * http://[::1]:8080 => /ip6/::1/tcp/8080/http\n * tcp://foobar.com:8080 => /dns/foobar.com/tcp/8080\n * udp://foobar.com:8080 => /dns/foobar.com/udp/8080\n */\n\nexport function uriToMultiaddr (uriStr: string, opts?: MultiaddrFromUriOpts): Multiaddr {\n opts = opts ?? {}\n const defaultDnsType = opts.defaultDnsType ?? 'dns'\n const { scheme, hostname, port, path } = parseUri(uriStr)\n const parts = [\n tupleForHostname(hostname, defaultDnsType),\n tupleForPort(port, scheme),\n tupleForScheme(scheme)\n ]\n\n if (path != null) {\n parts.push(tupleForPath(path))\n }\n\n const multiaddrStr = '/' + parts\n .filter(x => Boolean(x))\n // @ts-expect-error ts cannot see we filter falsy values\n .reduce((a, b) => a.concat(b), [])\n .join('/')\n\n return multiaddr(multiaddrStr)\n}\n\nfunction parseUri (uriStr: string): { scheme: string, hostname: string, port: string, path?: string } {\n const [scheme] = uriStr.split(':')\n\n // browsers will only parse URLs with schemes they understand\n if (!BROWSER_SCHEMES.includes(scheme)) {\n uriStr = 'http' + uriStr.substring(scheme.length)\n }\n\n // Use the WHATWG URL global, in node >= 10 and the browser\n let { protocol, hostname, port, pathname, search } = new URL(uriStr)\n\n if (port == null || port === '') {\n const protocolPort = portForProtocol(scheme)\n\n if (protocolPort != null) {\n port = protocolPort\n }\n\n // browsers will omit the port when it's common\n if (protocolPort == null && protocol === 'http:') {\n // we overrode the protocol with http, set the port to 80\n port = '80'\n }\n }\n\n let path: string | undefined\n\n if (pathname != null && pathname !== '' && pathname !== '/') {\n if (pathname.startsWith('/')) {\n pathname = pathname.substring(1)\n }\n\n path = pathname\n }\n\n if (search != null && search !== '') {\n path = path ?? ''\n path += search\n }\n\n return { scheme, hostname, port, path }\n}\n\nfunction tupleForHostname (hostname: string, defaultDnsType: string): [string, string] | undefined {\n if (hostname == null || hostname === '') {\n return undefined\n }\n\n if (isIPv4(hostname)) {\n return ['ip4', hostname]\n }\n\n if (isIPv6(hostname)) {\n return ['ip6', hostname]\n }\n\n // literal ipv6 in url should be wrapped in square brackets [x:y:z]\n // https://www.ietf.org/rfc/rfc2732.txt\n if (hostname[0] === '[') {\n const trimmed = hostname.substring(1, hostname.length - 1)\n if (isIPv6(trimmed)) {\n return ['ip6', trimmed]\n }\n }\n // assumes that any non-ip hostname is a dns4 address.\n return [defaultDnsType, hostname]\n}\n\nfunction tupleForPort (port: string, scheme: string): [string, string] | undefined {\n if (port == null || port === '') {\n return undefined\n }\n\n if (scheme === 'udp') {\n return ['udp', port]\n }\n\n return ['tcp', port]\n}\n\nfunction tupleForScheme (scheme: string): [string] | undefined {\n if (scheme.match(/^tcp$|^udp$/) != null) {\n return undefined\n }\n\n if (scheme === 'https') {\n return ['/tls/http']\n }\n\n if (scheme === 'wss') {\n return ['/tls/ws']\n }\n\n return [scheme]\n}\n\nfunction tupleForPath (path: string): [string, string] | undefined {\n if (path == null || path === '') {\n return undefined\n }\n\n return ['http-path', encodeURIComponent(path)]\n}\n\nfunction portForProtocol (protocol: string): string | undefined {\n if (protocol == null || protocol === '' || portFor[protocol] == null) {\n return undefined\n }\n\n return portFor[protocol]\n}\n","/**\n * TinyCloud location registry helpers.\n *\n * The registry maps a DID to one or more multiaddrs. Registry records are\n * signed by the DID subject; centralized storage is only a discovery cache.\n */\n\nimport { multiaddr } from \"@multiformats/multiaddr\";\nimport { multiaddrToUri } from \"@multiformats/multiaddr-to-uri\";\nimport { uriToMultiaddr } from \"@multiformats/uri-to-multiaddr\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { verifyMessage } from \"viem\";\n\nexport interface LocationRecordPayload {\n version: 1;\n subject: string;\n multiaddrs: string[];\n updated_at: string;\n sequence: number;\n}\n\nexport interface LocationRecord extends LocationRecordPayload {\n signature: string;\n}\n\nexport type LocationSource =\n | \"explicit\"\n | \"blockchain\"\n | \"centralized\"\n | \"fallback\";\n\nexport const DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL =\n \"https://registry.tinycloud.xyz\";\nexport const DEFAULT_TINYCLOUD_FALLBACK_HOST = \"https://node.tinycloud.xyz\";\n\nexport interface LocationCandidate {\n source: LocationSource;\n multiaddrs: string[];\n record?: LocationRecord;\n}\n\nexport interface LocationResolutionAttempt {\n source: LocationSource;\n candidate?: LocationCandidate;\n error?: Error;\n}\n\nexport interface ResolvedCloudLocation {\n subject: string;\n source: LocationSource;\n multiaddrs: string[];\n record?: LocationRecord;\n attempts: LocationResolutionAttempt[];\n resolvedAt: string;\n}\n\nexport interface ResolveCloudLocationOptions {\n /** Highest-priority location supplied directly by the caller. */\n explicitMultiaddrs?: string[];\n /** Optional blockchain resolver adapter. */\n blockchain?: (\n subject: string,\n ) => Promise<LocationCandidateInput | null | undefined>;\n /** Centralized location registry base URL, e.g. https://registry.tinycloud.xyz. */\n centralizedRegistryUrl?: string;\n /** Lowest-priority fallback location. */\n fallbackMultiaddrs?: string[];\n /** Custom fetch implementation. Defaults to globalThis.fetch. */\n fetch?: typeof fetch;\n /** Verify centralized/blockchain record signatures. Default true. */\n verifyRecords?: boolean;\n}\n\nexport interface ResolvedTinyCloudHosts {\n hosts: string[];\n location: ResolvedCloudLocation;\n}\n\nexport interface ResolveTinyCloudHostsOptions {\n /** Highest-priority TinyCloud HTTP host URLs or multiaddrs supplied directly. */\n explicitHosts?: string[];\n /** Optional blockchain resolver adapter. */\n blockchain?: ResolveCloudLocationOptions[\"blockchain\"];\n /** Centralized location registry URL. Default https://registry.tinycloud.xyz. */\n registryUrl?: string | null;\n /** Lowest-priority fallback HTTP host URLs or multiaddrs. Default hosted TinyCloud node. */\n fallbackHosts?: string[] | null;\n /** Custom fetch implementation. Defaults to globalThis.fetch. */\n fetch?: typeof fetch;\n /** Verify centralized/blockchain record signatures. Default true. */\n verifyRecords?: boolean;\n}\n\nexport type LocationCandidateInput =\n | string[]\n | LocationRecord\n | {\n multiaddrs: string[];\n record?: LocationRecord;\n };\n\nexport type LocationRecordSigner =\n | {\n type: \"did:pkh\";\n signMessage(message: string): Promise<string>;\n }\n | {\n type: \"did:key\";\n signBytes(bytes: Uint8Array): Promise<Uint8Array>;\n };\n\nexport class LocationRecordValidationError extends Error {\n constructor(message: string) {\n super(`Location record validation failed: ${message}`);\n this.name = \"LocationRecordValidationError\";\n }\n}\n\nexport class CloudLocationResolutionError extends Error {\n public readonly attempts: LocationResolutionAttempt[];\n\n constructor(subject: string, attempts: LocationResolutionAttempt[]) {\n super(`Unable to resolve TinyCloud location for ${subject}`);\n this.name = \"CloudLocationResolutionError\";\n this.attempts = attempts;\n }\n}\n\nexport function locationPayloadForRecord(\n record: LocationRecord,\n): LocationRecordPayload {\n return {\n version: record.version,\n subject: record.subject,\n multiaddrs: [...record.multiaddrs],\n updated_at: record.updated_at,\n sequence: record.sequence,\n };\n}\n\nexport function canonicalLocationPayload(\n payload: LocationRecordPayload,\n): string {\n return JSON.stringify({\n version: payload.version,\n subject: payload.subject,\n multiaddrs: payload.multiaddrs,\n updated_at: payload.updated_at,\n sequence: payload.sequence,\n });\n}\n\nexport async function signLocationRecord(\n payload: LocationRecordPayload,\n signer: LocationRecordSigner,\n): Promise<LocationRecord> {\n validateLocationRecordPayload(payload);\n const message = canonicalLocationPayload(payload);\n const signature =\n signer.type === \"did:pkh\"\n ? await signer.signMessage(message)\n : base64UrlEncode(\n await signer.signBytes(new TextEncoder().encode(message)),\n );\n return { ...payload, signature };\n}\n\nexport function validateLocationRecordPayload(\n input: unknown,\n): LocationRecordPayload {\n if (input === null || typeof input !== \"object\") {\n throw new LocationRecordValidationError(\"payload must be an object\");\n }\n\n const payload = input as Partial<LocationRecordPayload>;\n if (payload.version !== 1) {\n throw new LocationRecordValidationError(\"version must be 1\");\n }\n validateSubject(payload.subject);\n validateMultiaddrs(payload.multiaddrs);\n if (\n typeof payload.updated_at !== \"string\" ||\n Number.isNaN(Date.parse(payload.updated_at))\n ) {\n throw new LocationRecordValidationError(\n \"updated_at must be an ISO timestamp\",\n );\n }\n if (\n typeof payload.sequence !== \"number\" ||\n !Number.isSafeInteger(payload.sequence) ||\n payload.sequence < 0\n ) {\n throw new LocationRecordValidationError(\n \"sequence must be a non-negative safe integer\",\n );\n }\n\n return {\n version: 1,\n subject: payload.subject,\n multiaddrs: [...payload.multiaddrs],\n updated_at: payload.updated_at,\n sequence: payload.sequence,\n };\n}\n\nexport function validateLocationRecord(input: unknown): LocationRecord {\n const payload = validateLocationRecordPayload(input);\n const signature = (input as Partial<LocationRecord>).signature;\n if (typeof signature !== \"string\" || signature.length === 0) {\n throw new LocationRecordValidationError(\n \"signature must be a non-empty string\",\n );\n }\n return { ...payload, signature };\n}\n\nexport async function verifyLocationRecord(\n input: LocationRecord,\n): Promise<boolean> {\n const record = validateLocationRecord(input);\n const payload = canonicalLocationPayload(locationPayloadForRecord(record));\n\n if (record.subject.startsWith(\"did:pkh:\")) {\n return verifyPkhSignature(record.subject, payload, record.signature);\n }\n if (record.subject.startsWith(\"did:key:\")) {\n return verifyDidKeySignature(record.subject, payload, record.signature);\n }\n return false;\n}\n\nexport async function fetchLocationRecord(\n registryUrl: string,\n subject: string,\n fetchFn: typeof fetch = globalThis.fetch,\n): Promise<LocationRecord | null> {\n const url = `${registryUrl.replace(/\\/$/, \"\")}/v1/locations/${encodeURIComponent(subject)}`;\n const response = await fetchFn(url);\n if (response.status === 404) {\n return null;\n }\n if (!response.ok) {\n throw new Error(`location registry returned HTTP ${response.status}`);\n }\n const body = (await response.json()) as { record?: unknown };\n if (body.record === undefined) {\n throw new LocationRecordValidationError(\"registry response missing record\");\n }\n return validateLocationRecord(body.record);\n}\n\nexport async function resolveCloudLocation(\n subject: string,\n options: ResolveCloudLocationOptions = {},\n): Promise<ResolvedCloudLocation> {\n validateSubject(subject);\n const verifyRecords = options.verifyRecords ?? true;\n const attempts = await Promise.all([\n resolveExplicit(subject, options.explicitMultiaddrs),\n resolveBlockchain(subject, options.blockchain, verifyRecords),\n resolveCentralized(subject, options, verifyRecords),\n resolveFallback(subject, options.fallbackMultiaddrs),\n ]);\n\n const winner = attempts.find((attempt) => attempt.candidate)?.candidate;\n if (!winner) {\n throw new CloudLocationResolutionError(subject, attempts);\n }\n\n return {\n subject,\n source: winner.source,\n multiaddrs: [...winner.multiaddrs],\n ...(winner.record ? { record: winner.record } : {}),\n attempts,\n resolvedAt: new Date().toISOString(),\n };\n}\n\nexport async function resolveTinyCloudHosts(\n subject: string,\n options: ResolveTinyCloudHostsOptions = {},\n): Promise<ResolvedTinyCloudHosts> {\n const location = await resolveCloudLocation(subject, {\n explicitMultiaddrs: hostsToMultiaddrs(options.explicitHosts),\n blockchain: options.blockchain,\n centralizedRegistryUrl:\n options.registryUrl === null\n ? undefined\n : (options.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL),\n fallbackMultiaddrs: hostsToMultiaddrs(\n options.fallbackHosts === null\n ? undefined\n : (options.fallbackHosts ?? [DEFAULT_TINYCLOUD_FALLBACK_HOST]),\n ),\n fetch: options.fetch,\n verifyRecords: options.verifyRecords,\n });\n\n return {\n hosts: location.multiaddrs.map((addr) => multiaddrToHttpUrl(addr)),\n location,\n };\n}\n\nexport function multiaddrToHttpUrl(input: string): string {\n const uri = multiaddrToUri(multiaddr(input));\n if (!uri.startsWith(\"http://\") && !uri.startsWith(\"https://\")) {\n throw new LocationRecordValidationError(\n `multiaddr does not resolve to http/https: ${input}`,\n );\n }\n return uri;\n}\n\nexport function httpUrlToMultiaddr(input: string): string {\n const url = new URL(input);\n if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n throw new LocationRecordValidationError(\"URL must use http or https\");\n }\n return uriToMultiaddr(url.toString()).toString();\n}\n\nfunction hostsToMultiaddrs(hosts: string[] | undefined): string[] | undefined {\n if (hosts === undefined || hosts.length === 0) {\n return undefined;\n }\n return hosts.map((host) =>\n host.startsWith(\"/\") ? host : httpUrlToMultiaddr(host),\n );\n}\n\nasync function resolveExplicit(\n subject: string,\n multiaddrs: string[] | undefined,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"explicit\", async () => {\n if (multiaddrs === undefined || multiaddrs.length === 0) {\n return null;\n }\n return toCandidate(subject, \"explicit\", multiaddrs, false);\n });\n}\n\nasync function resolveBlockchain(\n subject: string,\n resolver: ResolveCloudLocationOptions[\"blockchain\"],\n verifyRecords: boolean,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"blockchain\", async () => {\n if (!resolver) {\n return null;\n }\n return toCandidate(\n subject,\n \"blockchain\",\n await resolver(subject),\n verifyRecords,\n );\n });\n}\n\nasync function resolveCentralized(\n subject: string,\n options: ResolveCloudLocationOptions,\n verifyRecords: boolean,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"centralized\", async () => {\n if (!options.centralizedRegistryUrl) {\n return null;\n }\n const record = await fetchLocationRecord(\n options.centralizedRegistryUrl,\n subject,\n options.fetch,\n );\n return toCandidate(subject, \"centralized\", record, verifyRecords);\n });\n}\n\nasync function resolveFallback(\n subject: string,\n multiaddrs: string[] | undefined,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"fallback\", async () => {\n if (multiaddrs === undefined || multiaddrs.length === 0) {\n return null;\n }\n return toCandidate(subject, \"fallback\", multiaddrs, false);\n });\n}\n\nasync function resolveAttempt(\n source: LocationSource,\n resolve: () => Promise<LocationCandidate | null>,\n): Promise<LocationResolutionAttempt> {\n try {\n const candidate = await resolve();\n return candidate ? { source, candidate } : { source };\n } catch (error) {\n return {\n source,\n error: error instanceof Error ? error : new Error(String(error)),\n };\n }\n}\n\nasync function toCandidate(\n subject: string,\n source: LocationSource,\n input: LocationCandidateInput | null | undefined,\n verifyRecord: boolean,\n): Promise<LocationCandidate | null> {\n if (input === null || input === undefined) {\n return null;\n }\n\n if (Array.isArray(input)) {\n validateMultiaddrs(input);\n return { source, multiaddrs: [...input] };\n }\n\n const maybeRecord = input as Partial<LocationRecord>;\n if (maybeRecord.version === 1 && maybeRecord.signature !== undefined) {\n const record = validateLocationRecord(input);\n if (record.subject !== subject) {\n throw new LocationRecordValidationError(\n \"location record subject does not match requested subject\",\n );\n }\n if (verifyRecord && !(await verifyLocationRecord(record))) {\n throw new LocationRecordValidationError(\n \"location record signature is invalid\",\n );\n }\n return { source, multiaddrs: [...record.multiaddrs], record };\n }\n\n const candidateInput = input as { multiaddrs?: unknown; record?: unknown };\n if (!Array.isArray(candidateInput.multiaddrs)) {\n throw new LocationRecordValidationError(\n \"candidate multiaddrs must be an array\",\n );\n }\n validateMultiaddrs(candidateInput.multiaddrs);\n if (candidateInput.record !== undefined) {\n const record = validateLocationRecord(candidateInput.record);\n if (record.subject !== subject) {\n throw new LocationRecordValidationError(\n \"location record subject does not match requested subject\",\n );\n }\n if (verifyRecord && !(await verifyLocationRecord(record))) {\n throw new LocationRecordValidationError(\n \"location record signature is invalid\",\n );\n }\n return { source, multiaddrs: [...candidateInput.multiaddrs], record };\n }\n return { source, multiaddrs: [...candidateInput.multiaddrs] };\n}\n\nfunction validateSubject(subject: unknown): asserts subject is string {\n if (typeof subject !== \"string\" || subject.length === 0) {\n throw new LocationRecordValidationError(\n \"subject must be a non-empty string\",\n );\n }\n if (!subject.startsWith(\"did:pkh:\") && !subject.startsWith(\"did:key:\")) {\n throw new LocationRecordValidationError(\n \"subject must be did:pkh or did:key\",\n );\n }\n}\n\nfunction validateMultiaddrs(input: unknown): asserts input is string[] {\n if (!Array.isArray(input)) {\n throw new LocationRecordValidationError(\"multiaddrs must be an array\");\n }\n for (const addr of input) {\n if (typeof addr !== \"string\" || addr.length === 0) {\n throw new LocationRecordValidationError(\n \"multiaddr entries must be non-empty strings\",\n );\n }\n try {\n multiaddr(addr);\n } catch {\n throw new LocationRecordValidationError(`invalid multiaddr: ${addr}`);\n }\n }\n}\n\nasync function verifyPkhSignature(\n did: string,\n payload: string,\n signature: string,\n): Promise<boolean> {\n const address = did.split(\":\").at(-1);\n if (!address || !/^0x[a-fA-F0-9]{40}$/.test(address)) {\n throw new LocationRecordValidationError(\n \"did:pkh subject must end with an EVM address\",\n );\n }\n if (!/^0x[0-9a-fA-F]+$/.test(signature)) {\n throw new LocationRecordValidationError(\"did:pkh signature must be hex\");\n }\n\n return verifyMessage({\n address: address as `0x${string}`,\n message: payload,\n signature: signature as `0x${string}`,\n });\n}\n\nfunction verifyDidKeySignature(\n did: string,\n payload: string,\n signature: string,\n): boolean {\n const publicKey = ed25519PublicKeyFromDidKey(did);\n const signatureBytes = decodeBase64Url(signature);\n if (signatureBytes.length !== 64) {\n throw new LocationRecordValidationError(\n \"did:key signature must be a base64url Ed25519 signature\",\n );\n }\n return ed25519.verify(\n signatureBytes,\n new TextEncoder().encode(payload),\n publicKey,\n );\n}\n\nexport function verifyDidKeyEd25519Signature(\n did: string,\n payload: Uint8Array,\n signature: Uint8Array,\n): boolean {\n const publicKey = ed25519PublicKeyFromDidKey(did);\n return ed25519.verify(signature, payload, publicKey);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n const identifier = did.slice(\"did:key:\".length);\n if (!identifier.startsWith(\"z\")) {\n throw new LocationRecordValidationError(\n \"did:key must use base58btc multibase\",\n );\n }\n\n const bytes = bases.base58btc.decode(identifier);\n if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n return bytes.slice(2);\n }\n if (bytes.length === 33 && bytes[0] === 0xed) {\n return bytes.slice(1);\n }\n throw new LocationRecordValidationError(\n \"did:key must be an Ed25519 public key\",\n );\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n let output = \"\";\n\n for (let i = 0; i < bytes.length; i += 3) {\n const a = bytes[i];\n const b = bytes[i + 1];\n const c = bytes[i + 2];\n const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n\n output += alphabet[(triplet >> 18) & 63];\n output += alphabet[(triplet >> 12) & 63];\n if (i + 1 < bytes.length) {\n output += alphabet[(triplet >> 6) & 63];\n }\n if (i + 2 < bytes.length) {\n output += alphabet[triplet & 63];\n }\n }\n\n return output;\n}\n\nfunction decodeBase64Url(value: string): Uint8Array {\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n const bytes: number[] = [];\n let buffer = 0;\n let bits = 0;\n\n for (const char of value) {\n const index = alphabet.indexOf(char);\n if (index < 0) {\n throw new LocationRecordValidationError(\n \"did:key signature must be base64url\",\n );\n }\n\n buffer = (buffer << 6) | index;\n bits += 6;\n if (bits >= 8) {\n bits -= 8;\n bytes.push((buffer >> bits) & 0xff);\n }\n }\n\n return Uint8Array.from(bytes);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMA,iBAAkB;AAClB,kBAA4B;AAUrB,IAAM,gBAAgB,aAAE,OAAO;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,WAAW,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAeM,IAAM,mBAAmB,aAC7B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,gBAAgB,aAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAC1C,CAAC,EACA,YAAY;AAoBR,IAAM,sBAAsB,aAAE,OAAO;AAAA,EAC1C,SAAS,aAAE,OAAO;AAAA,EAClB,eAAe,aAAE,OAAO;AAAA,EACxB,SAAS,aAAE,OAAO;AAAA,EAClB,YAAY,aAAE,OAAO;AAAA,EACrB,MAAM,aAAE,OAAO;AAAA,EACf,WAAW,aAAE,OAAO;AAAA,EACpB,KAAK,cAAc,SAAS;AAC9B,CAAC;AAMM,SAAS,sBAAsB,MAAqC;AACzE,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;;;ACvDO,IAAM,4BAAN,MAAgE;AAAA,EACrE,UAAgB;AAAA,EAAC;AAAA,EACjB,UAAgB;AAAA,EAAC;AAAA,EACjB,QAAc;AAAA,EAAC;AACjB;;;ACjCA,kBAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AACnB,IAAM,SAAS;AAEf,SAAS,YAAY,OAAkD;AACrE,QAAM,gBAAgB,MAAM,QAAQ,GAAG;AACvC,MAAI,gBAAgB,GAAG;AACrB,WAAO,EAAE,KAAK,OAAO,UAAU,GAAG;AAAA,EACpC;AACA,SAAO;AAAA,IACL,KAAK,MAAM,MAAM,GAAG,aAAa;AAAA,IACjC,UAAU,MAAM,MAAM,aAAa;AAAA,EACrC;AACF;AAEA,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,uBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,wBAAW,OAAO;AAC3B;AAEO,SAAS,kBAAkB,SAAmC;AACnE,SAAO,oBAAoB,OAAO,EAAE,YAAY;AAClD;AAEO,SAAS,OAAO,SAAiB,UAAkB,GAAW;AACnE,qBAAmB,OAAO;AAC1B,SAAO,kBAAkB,OAAO,IAAI,oBAAoB,OAAO,CAAC;AAClE;AAEO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;AAEO,SAAS,gBAAgB,KAAqB;AACnD,QAAM,MAAM,YAAY,GAAG;AAC3B,MAAI,KAAK;AACP,WAAO,OAAO,IAAI,SAAS,IAAI,OAAO;AAAA,EACxC;AACA,MAAI,OAAO,KAAK,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,mBAAmB,gBAAgB,GAAG,EAAE;AACpD;AAEO,SAAS,mBAAmB,QAAwB;AACzD,QAAM,EAAE,KAAK,SAAS,IAAI,YAAY,MAAM;AAC5C,SAAO,GAAG,gBAAgB,GAAG,CAAC,GAAG,QAAQ;AAC3C;AAEO,SAAS,aAAa,QAAwB;AACnD,SAAO,gBAAgB,YAAY,MAAM,EAAE,GAAG;AAChD;AAEO,SAAS,UAAU,GAAW,GAAWA,WAA4B,CAAC,GAAY;AACvF,QAAM,eAAeA,SAAQ,iBAAiB,eAAe;AAC7D,SAAO,aAAa,CAAC,MAAM,aAAa,CAAC;AAC3C;AAEO,SAAS,mBAAmB,GAAW,GAAoB;AAChE,SAAO,UAAU,GAAG,GAAG,EAAE,gBAAgB,KAAK,CAAC;AACjD;AAEO,SAAS,YAAY,OAAeA,WAA8B,CAAC,GAAW;AACnF,QAAM,EAAE,KAAK,SAAS,IAAI,YAAY,KAAK;AAC3C,QAAM,MAAM,YAAY,GAAG;AAC3B,QAAMC,QAAO,MACT,kBAAkB,IAAI,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,KAC/D,gBAAgB,GAAG;AAEvB,SAAOD,SAAQ,mBAAmB,GAAGC,KAAI,GAAG,QAAQ,KAAKA;AAC3D;AAEO,SAAS,eACd,SACA,SACAC,OACQ;AACR,qBAAmB,OAAO;AAC1B,MAAI,CAACA,OAAM;AACT,UAAM,IAAI,mBAAmB,4BAA4B;AAAA,EAC3D;AACA,SAAO,wBAAwB,OAAO,IAAI,oBAAoB,OAAO,CAAC,IAAIA,KAAI;AAChF;;;AClIA,IAAAC,eAAmC;AACnC,oBAAuB;;;ACDvB;;;;;;;;;;;;;;ACAO,IAAM,QAAQ,IAAI,WAAW,CAAC;AAW/B,SAAU,OAAQ,IAAgB,IAAc;AACpD,MAAI,OAAO,IAAI;AAAE,WAAO;EAAK;AAC7B,MAAI,GAAG,eAAe,GAAG,YAAY;AACnC,WAAO;EACT;AAEA,WAAS,KAAK,GAAG,KAAK,GAAG,YAAY,MAAM;AACzC,QAAI,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG;AACrB,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEM,SAAU,OAAQ,GAA6C;AACnE,MAAI,aAAa,cAAc,EAAE,YAAY,SAAS,cAAc;AAAE,WAAO;EAAE;AAC/E,MAAI,aAAa,aAAa;AAAE,WAAO,IAAI,WAAW,CAAC;EAAE;AACzD,MAAI,YAAY,OAAO,CAAC,GAAG;AACzB,WAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU;EAC5D;AACA,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAMM,SAAU,WAAY,KAAW;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,GAAG;AACrC;AAEM,SAAU,SAAU,GAAa;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,CAAC;AACnC;;;ACnCA,SAAS,KAAM,UAAUC,OAAI;AAC3B,MAAI,SAAS,UAAU,KAAK;AAAE,UAAM,IAAI,UAAU,mBAAmB;EAAE;AACvE,MAAI,WAAW,IAAI,WAAW,GAAG;AACjC,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,aAAS,CAAC,IAAI;EAChB;AACA,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,QAAI,IAAI,SAAS,OAAO,CAAC;AACzB,QAAI,KAAK,EAAE,WAAW,CAAC;AACvB,QAAI,SAAS,EAAE,MAAM,KAAK;AAAE,YAAM,IAAI,UAAU,IAAI,eAAe;IAAE;AACrE,aAAS,EAAE,IAAI;EACjB;AACA,MAAI,OAAO,SAAS;AACpB,MAAI,SAAS,SAAS,OAAO,CAAC;AAC9B,MAAI,SAAS,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,GAAG;AAC1C,MAAI,UAAU,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI;AAI3C,WAASC,QAAQ,QAAM;AAErB,QAAI,kBAAkB;AAAY;aAAW,YAAY,OAAO,MAAM,GAAG;AACvE,eAAS,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;IAC7E,WAAW,MAAM,QAAQ,MAAM,GAAG;AAChC,eAAS,WAAW,KAAK,MAAM;IACjC;AACA,QAAI,EAAE,kBAAkB,aAAa;AAAE,YAAM,IAAI,UAAU,qBAAqB;IAAE;AAClF,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO;IAAG;AAErC,QAAI,SAAS;AACb,QAAIC,UAAS;AACb,QAAI,SAAS;AACb,QAAI,OAAO,OAAO;AAClB,WAAO,WAAW,QAAQ,OAAO,MAAM,MAAM,GAAG;AAC9C;AACA;IACF;AAEA,QAAI,QAAS,OAAO,UAAU,UAAU,MAAO;AAC/C,QAAI,MAAM,IAAI,WAAW,IAAI;AAE7B,WAAO,WAAW,MAAM;AACtB,UAAI,QAAQ,OAAO,MAAM;AAEzB,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,MAAM,IAAI,GAAG,MAAO;AAC9B,YAAI,GAAG,IAAK,QAAQ,SAAU;AAC9B,gBAAS,QAAQ,SAAU;MAC7B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,GAAG;AACrC;IACF;AAEA,QAAI,MAAM,OAAO,OAAO,MAAM;AAC9B,WAAO,MAAM,MAAM,EAAE,KAAK;AAAE,aAAO,SAAS,OAAO,IAAI,GAAG,CAAC;IAAG;AAC9D,WAAO;EACT;AAIA,WAAS,aAAc,QAAM;AAC3B,QAAI,OAAO,WAAW,UAAU;AAAE,YAAM,IAAI,UAAU,iBAAiB;IAAE;AACzE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,IAAI,WAAU;IAAG;AACnD,QAAI,MAAM;AAEV,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,SAAS;AACb,QAAIA,UAAS;AACb,WAAO,OAAO,GAAG,MAAM,QAAQ;AAC7B;AACA;IACF;AAEA,QAAI,QAAU,OAAO,SAAS,OAAO,SAAU,MAAO;AACtD,QAAI,OAAO,IAAI,WAAW,IAAI;AAE9B,WAAO,OAAO,GAAG,GAAG;AAElB,UAAI,QAAQ,SAAS,OAAO,WAAW,GAAG,CAAC;AAE3C,UAAI,UAAU,KAAK;AAAE;MAAO;AAC5B,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,OAAO,KAAK,GAAG,MAAO;AAChC,aAAK,GAAG,IAAK,QAAQ,QAAS;AAC9B,gBAAS,QAAQ,QAAS;MAC5B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,KAAK,GAAG,MAAM,GAAG;AACtC;IACF;AACA,QAAI,MAAM,IAAI,WAAW,UAAU,OAAO,IAAI;AAC9C,QAAIE,KAAI;AACR,WAAO,QAAQ,MAAM;AACnB,UAAIA,IAAG,IAAI,KAAK,KAAK;IACvB;AACA,WAAO;EACT;AAIA,WAASC,QAAQC,SAAM;AACrB,QAAI,SAAS,aAAaA,OAAM;AAChC,QAAI,QAAQ;AAAE,aAAO;IAAO;AAC5B,UAAM,IAAI,MAAM,OAAON,KAAI,YAAY;EACzC;AACA,SAAO;IACL,QAAQC;IACR;IACA,QAAQI;;AAEZ;AACA,IAAI,MAAM;AAEV,IAAI,kCAAkC;AAEtC,IAAA,iBAAe;;;ACjIf,IAAM,UAAN,MAAa;EAKX,YAAaE,OAAY,QAAgB,YAAoB;AAJpD;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;EACpB;EAEA,OAAQ,OAAiB;AACvB,QAAI,iBAAiB,YAAY;AAC/B,aAAO,GAAG,KAAK,MAAM,GAAG,KAAK,WAAW,KAAK,CAAC;IAChD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;;AAQF,IAAM,UAAN,MAAa;EAMX,YAAaA,OAAY,QAAgB,YAAoB;AALpD;AACA;AACA;AACQ;AAGf,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,UAAM,kBAAkB,OAAO,YAAY,CAAC;AAE5C,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI,MAAM,0BAA0B;IAC5C;AACA,SAAK,kBAAkB;AACvB,SAAK,aAAa;EACpB;EAEA,OAAQ,MAAY;AAClB,QAAI,OAAO,SAAS,UAAU;AAC5B,UAAI,KAAK,YAAY,CAAC,MAAM,KAAK,iBAAiB;AAChD,cAAM,MAAM,qCAAqC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,+CAA+C,KAAK,MAAM,EAAE;MACjJ;AACA,aAAO,KAAK,WAAW,KAAK,MAAM,KAAK,OAAO,MAAM,CAAC;IACvD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;EAEA,GAAgC,SAAmE;AACjG,WAAO,GAAG,MAAM,OAAO;EACzB;;AAKF,IAAM,kBAAN,MAAqB;EAGnB,YAAaC,WAA0B;AAF9B;AAGP,SAAK,WAAWA;EAClB;EAEA,GAAiC,SAAmE;AAClG,WAAO,GAAG,MAAM,OAAO;EACzB;EAEA,OAAQ,OAAa;AACnB,UAAM,SAAS,MAAM,CAAC;AACtB,UAAM,UAAU,KAAK,SAAS,MAAM;AACpC,QAAI,WAAW,MAAM;AACnB,aAAO,QAAQ,OAAO,KAAK;IAC7B,OAAO;AACL,YAAM,WAAW,qCAAqC,KAAK,UAAU,KAAK,CAAC,+BAA+B,OAAO,KAAK,KAAK,QAAQ,CAAC,gBAAgB;IACtJ;EACF;;AAGI,SAAU,GAAyC,MAA+C,OAA8C;AACpJ,SAAO,IAAI,gBAAgB;IACzB,GAAI,KAAK,YAAY,EAAE,CAAE,KAA2B,MAAM,GAAG,KAAI;IACjE,GAAI,MAAM,YAAY,EAAE,CAAE,MAA4B,MAAM,GAAG,MAAK;GAClD;AACtB;AAEM,IAAO,QAAP,MAAY;EAQhB,YAAaD,OAAY,QAAgB,YAAsB,YAAoB;AAP1E;AACA;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAClB,SAAK,aAAa;AAClB,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;AACnD,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;EACrD;EAEA,OAAQ,OAAiB;AACvB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;EAEA,OAAQ,OAAa;AACnB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;;AAGI,SAAU,KAAmD,EAAE,MAAAA,OAAM,QAAQ,QAAAE,SAAQ,QAAAC,QAAM,GAAsE;AACrK,SAAO,IAAI,MAAMH,OAAM,QAAQE,SAAQC,OAAM;AAC/C;AAEM,SAAU,MAAoD,EAAE,MAAAH,OAAM,QAAQ,UAAAI,UAAQ,GAAoD;AAC9I,QAAM,EAAE,QAAAF,SAAQ,QAAAC,QAAM,IAAK,eAAMC,WAAUJ,KAAI;AAC/C,SAAO,KAAK;IACV;IACA,MAAAA;IACA,QAAAE;IACA,QAAQ,CAAC,SAA6B,OAAOC,QAAO,IAAI,CAAC;GAC1D;AACH;AAEA,SAAS,OAAQE,SAAgB,aAAqC,aAAqBL,OAAY;AAErG,MAAI,MAAMK,QAAO;AACjB,SAAOA,QAAO,MAAM,CAAC,MAAM,KAAK;AAC9B,MAAE;EACJ;AAGA,QAAM,MAAM,IAAI,WAAY,MAAM,cAAc,IAAK,CAAC;AAGtD,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,KAAK,EAAE,GAAG;AAE5B,UAAM,QAAQ,YAAYA,QAAO,CAAC,CAAC;AACnC,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,YAAY,OAAOL,KAAI,YAAY;IAC/C;AAGA,aAAU,UAAU,cAAe;AACnC,YAAQ;AAGR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,UAAI,SAAS,IAAI,MAAQ,UAAU;IACrC;EACF;AAGA,MAAI,QAAQ,gBAAgB,MAAQ,UAAW,IAAI,UAAY,GAAG;AAChE,UAAM,IAAI,YAAY,wBAAwB;EAChD;AAEA,SAAO;AACT;AAEA,SAAS,OAAQ,MAAkBI,WAAkB,aAAmB;AACtE,QAAM,MAAMA,UAASA,UAAS,SAAS,CAAC,MAAM;AAC9C,QAAM,QAAQ,KAAK,eAAe;AAClC,MAAI,MAAM;AAEV,MAAI,OAAO;AACX,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;AAEpC,aAAU,UAAU,IAAK,KAAK,CAAC;AAC/B,YAAQ;AAGR,WAAO,OAAO,aAAa;AACzB,cAAQ;AACR,aAAOA,UAAS,OAAQ,UAAU,IAAK;IACzC;EACF;AAGA,MAAI,SAAS,GAAG;AACd,WAAOA,UAAS,OAAQ,UAAW,cAAc,IAAM;EACzD;AAGA,MAAI,KAAK;AACP,YAAS,IAAI,SAAS,cAAe,OAAO,GAAG;AAC7C,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAmBA,WAAgB;AAE1C,QAAM,cAAsC,CAAA;AAC5C,WAAS,IAAI,GAAG,IAAIA,UAAS,QAAQ,EAAE,GAAG;AACxC,gBAAYA,UAAS,CAAC,CAAC,IAAI;EAC7B;AACA,SAAO;AACT;AAKM,SAAU,QAAsD,EAAE,MAAAJ,OAAM,QAAQ,aAAa,UAAAI,UAAQ,GAAyE;AAClL,QAAM,cAAc,kBAAkBA,SAAQ;AAC9C,SAAO,KAAK;IACV;IACA,MAAAJ;IACA,OAAQ,OAAiB;AACvB,aAAO,OAAO,OAAOI,WAAU,WAAW;IAC5C;IACA,OAAQ,OAAa;AACnB,aAAO,OAAO,OAAO,aAAa,aAAaJ,KAAI;IACrD;GACD;AACH;;;AH9OO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,oBAAoB,QAAQ;EACvC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,UAAU,QAAQ;EAC7B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AI/DD;;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;AAEM,IAAM,cAAc,MAAM;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACZD;;;;;AAEO,IAAM,YAAY,MAAM;EAC7B,MAAM;EACN,QAAQ;EACR,UAAU;CACX;AAEM,IAAM,eAAe,MAAM;EAChC,MAAM;EACN,QAAQ;EACR,UAAU;CACX;;;ACXD,IAAI,WAAWM;AAEf,IAAI,MAAM;AAAV,IACI,OAAO;AADX,IAEI,SAAS,CAAC;AAFd,IAGI,MAAM,KAAK,IAAI,GAAG,EAAE;AAOxB,SAASA,QAAO,KAAK,KAAK,QAAM;AAC9B,QAAM,OAAO,CAAA;AACb,WAAS,UAAU;AACnB,MAAI,YAAY;AAEhB,SAAM,OAAO,KAAK;AAChB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,WAAO;EACT;AACA,SAAM,MAAM,QAAQ;AAClB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,aAAS;EACX;AACA,MAAI,MAAM,IAAI,MAAM;AAGpB,EAAAA,QAAO,QAAQ,SAAS,YAAY;AAEpC,SAAO;AACT;AAEA,IAAIC,UAAS;AAEb,IAAI,QAAQ;AAAZ,IACI,SAAS;AAMb,SAAS,KAAK,KAAK,QAAM;AACvB,MAAI,MAAS,GACT,SAAS,UAAU,GACnB,QAAS,GACT,UAAU,QACV,GACA,IAAI,IAAI;AAEZ,KAAG;AACD,QAAI,WAAW,GAAG;AAEhB,WAAK,QAAQ;AACb,YAAM,IAAI,WAAW,yBAAyB;IAChD;AACA,QAAI,IAAI,SAAS;AACjB,WAAO,QAAQ,MACV,IAAI,WAAW,SACf,IAAI,UAAU,KAAK,IAAI,GAAG,KAAK;AACpC,aAAS;EACX,SAAS,KAAK;AAGd,OAAK,QAAQ,UAAU;AAEvB,SAAO;AACT;AAEA,IAAI,KAAK,KAAK,IAAI,GAAI,CAAC;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AAEvB,IAAI,SAAS,SAAgC,OAAK;AAChD,SACE,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACA;AAEjB;AAEA,IAAI,SAAS;EACT,QAAQ;EACR,QAAQA;EACR,gBAAgB;;AAGpB,IAAI,eAAe;AAEnB,IAAA,iBAAe;;;ACrGT,SAAUC,QAAQ,MAAkB,SAAS,GAAC;AAClD,QAAMC,QAAO,eAAO,OAAO,MAAM,MAAM;AACvC,SAAO,CAACA,OAAM,eAAO,OAAO,KAAK;AACnC;AAEM,SAAU,SAAU,KAAa,QAAoB,SAAS,GAAC;AACnE,iBAAO,OAAO,KAAK,QAAQ,MAAM;AACjC,SAAO;AACT;AAEM,SAAU,eAAgB,KAAW;AACzC,SAAO,eAAO,eAAe,GAAG;AAClC;;;ACPM,SAAU,OAA8BC,OAAYC,SAAkB;AAC1E,QAAM,OAAOA,QAAO;AACpB,QAAM,aAAoB,eAAeD,KAAI;AAC7C,QAAM,eAAe,aAAoB,eAAe,IAAI;AAE5D,QAAM,QAAQ,IAAI,WAAW,eAAe,IAAI;AAChD,EAAO,SAASA,OAAM,OAAO,CAAC;AAC9B,EAAO,SAAS,MAAM,OAAO,UAAU;AACvC,QAAM,IAAIC,SAAQ,YAAY;AAE9B,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQ,KAAK;AAC7C;AAKM,SAAUC,QAAQ,WAAqB;AAC3C,QAAM,QAAQ,OAAO,SAAS;AAC9B,QAAM,CAACF,OAAM,UAAU,IAAWE,QAAO,KAAK;AAC9C,QAAM,CAAC,MAAM,YAAY,IAAWA,QAAO,MAAM,SAAS,UAAU,CAAC;AACrE,QAAMD,UAAS,MAAM,SAAS,aAAa,YAAY;AAEvD,MAAIA,QAAO,eAAe,MAAM;AAC9B,UAAM,IAAI,MAAM,kBAAkB;EACpC;AAEA,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQ,KAAK;AAC7C;AAEM,SAAUE,QAAQ,GAAoB,GAAU;AACpD,MAAI,MAAM,GAAG;AACX,WAAO;EACT,OAAO;AACL,UAAM,OAAO;AAEb,WACE,EAAE,SAAS,KAAK,QAChB,EAAE,SAAS,KAAK,QAChB,KAAK,iBAAiB,cACtB,OAAW,EAAE,OAAO,KAAK,KAAK;EAElC;AACF;AAMM,IAAO,SAAP,MAAa;;;;EASjB,YAAaH,OAAY,MAAYC,SAAoB,OAAiB;AARjE;AACA;AACA;AACA;AAMP,SAAK,OAAOD;AACZ,SAAK,OAAO;AACZ,SAAK,SAASC;AACd,SAAK,QAAQ;EACf;;;;AC1DI,SAAU,OAA0F,MAASG,OAAmC;AACpJ,QAAM,EAAE,OAAO,QAAO,IAAK;AAC3B,UAAQ,SAAS;IACf,KAAK;AACH,aAAO,WACL,OACA,UAAU,IAAI,GACdA,SAAqC,UAAU,OAAO;IAE1D;AACE,aAAO,WACL,OACA,UAAU,IAAI,GACbA,SAAQ,OAAO,OAAwC;EAE9D;AACF;AAYA,IAAM,QAAQ,oBAAI,QAAO;AAEzB,SAAS,UAAW,KAAoB;AACtC,QAAMC,aAAY,MAAM,IAAI,GAAG;AAC/B,MAAIA,cAAa,MAAM;AACrB,UAAMA,aAAY,oBAAI,IAAG;AACzB,UAAM,IAAI,KAAKA,UAAS;AACxB,WAAOA;EACT;AACA,SAAOA;AACT;AAjDA;AAmDM,IAAO,MAAP,MAAO,KAAG;;;;;;EAYd,YAAa,SAAkBC,OAAc,WAAqC,OAAiB;AAX1F;AACA;AACA;AACA;AACA;AAmHA,wBAAC,IAAsB;AA3G9B,SAAK,OAAOA;AACZ,SAAK,UAAU;AACf,SAAK,YAAY;AACjB,SAAK,QAAQ;AAIb,SAAK,GAAG,IAAI;EACd;;;;;;;EAQA,IAAI,QAAK;AACP,WAAO;EACT;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,eAAO;MACT;MACA,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,UAAS,IAAK;AAE5B,YAAIA,UAAS,aAAa;AACxB,gBAAM,IAAI,MAAM,0CAA0C;QAC5D;AAGA,YAAI,UAAU,SAAS,cAAc;AACnC,gBAAM,IAAI,MAAM,oDAAoD;QACtE;AAEA,eACE,KAAI,SACF,SAA6C;MAGnD;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,QAAAC,QAAM,IAAK,KAAK;AAC9B,cAAM,YAAmB,OAAOD,OAAMC,OAAM;AAC5C,eACE,KAAI,SAAS,KAAK,MAAM,SAAS;MAErC;MACA,KAAK,GAAG;AACN,eAAO;MACT;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAQ,OAAc;AACpB,WAAO,KAAI,OAAO,MAAM,KAAK;EAC/B;EAEA,OAAO,OAAsF,MAA4C,OAAc;AACrJ,UAAM,UAAU;AAChB,WACE,WAAW,QACX,KAAK,SAAS,QAAQ,QACtB,KAAK,YAAY,QAAQ,WAClBC,QAAO,KAAK,WAAW,QAAQ,SAAS;EAEnD;EAEA,SAAUC,OAAmC;AAC3C,WAAO,OAAO,MAAMA,KAAI;EAC1B;EAEA,SAAM;AACJ,WAAO,EAAE,KAAK,OAAO,IAAI,EAAC;EAC5B;EAEA,OAAI;AACF,WAAO;EACT;;EAMA,EAJU,YAAO,aAIhB,uBAAO,IAAI,4BAA4B,EAAC,IAAC;AACxC,WAAO,OAAO,KAAK,SAAQ,CAAE;EAC/B;;;;;;;;;;;EAYA,OAAO,MAAwF,OAA+C;AAC5I,QAAI,SAAS,MAAM;AACjB,aAAO;IACT;AAEA,UAAM,QAAQ;AACd,QAAI,iBAAiB,MAAK;AAExB,aAAO;IACT,WAAY,MAAM,GAAG,KAAK,QAAQ,MAAM,GAAG,MAAM,MAAM,SAAU,MAAM,UAAU,OAAO;AAMtF,YAAM,EAAE,SAAS,MAAAH,OAAM,WAAW,MAAK,IAAK;AAC5C,aAAO,IAAI,KACT,SACAA,OACA,WACA,SAAS,UAAU,SAASA,OAAM,UAAU,KAAK,CAAC;IAEtD,WAAW,MAAM,SAAS,MAAM,MAAM;AAIpC,YAAM,EAAE,SAAS,WAAW,MAAAA,MAAI,IAAK;AACrC,YAAMC,UAAgBG,QAAO,SAAS;AACtC,aAAO,KAAI,OAAO,SAASJ,OAAMC,OAAM;IACzC,OAAO;AAGL,aAAO;IACT;EACF;;;;;;EAOA,OAAO,OAAsF,SAAkBD,OAAcC,SAAgC;AAC3J,QAAI,OAAOD,UAAS,UAAU;AAC5B,YAAM,IAAI,MAAM,uCAAuC;IACzD;AAEA,QAAI,EAAEC,QAAO,iBAAiB,aAAa;AACzC,YAAM,IAAI,MAAM,gBAAgB;IAClC;AAEA,YAAQ,SAAS;MACf,KAAK,GAAG;AACN,YAAID,UAAS,aAAa;AACxB,gBAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB;QAEzE,OAAO;AACL,iBAAO,IAAI,KAAI,SAASA,OAAMC,SAAQA,QAAO,KAAK;QACpD;MACF;MACA,KAAK,GAAG;AACN,cAAM,QAAQ,UAAU,SAASD,OAAMC,QAAO,KAAK;AACnD,eAAO,IAAI,KAAI,SAASD,OAAMC,SAAQ,KAAK;MAC7C;MACA,SAAS;AACP,cAAM,IAAI,MAAM,iBAAiB;MACnC;IACF;EACF;;;;EAKA,OAAO,SAAuBA,SAAgD;AAC5E,WAAO,KAAI,OAAO,GAAG,aAAaA,OAAM;EAC1C;;;;;;;EAQA,OAAO,SAAyDD,OAAYC,SAAgC;AAC1G,WAAO,KAAI,OAAO,GAAGD,OAAMC,OAAM;EACnC;;;;;;;;EASA,OAAO,OAAoF,OAAuD;AAChJ,UAAM,CAAC,KAAK,SAAS,IAAI,KAAI,YAAY,KAAK;AAC9C,QAAI,UAAU,WAAW,GAAG;AAC1B,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,WAAO;EACT;;;;;;;;;;EAWA,OAAO,YAA2E,OAAyC;AACzH,UAAM,QAAQ,KAAI,aAAa,KAAK;AACpC,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,UAAM,iBAAiB,OACrB,MAAM,SAAS,YAAY,aAAa,MAAM,aAAa,CAAC;AAE9D,QAAI,eAAe,eAAe,MAAM,eAAe;AACrD,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,UAAM,cAAc,eAAe,SACjC,MAAM,gBAAgB,MAAM,UAAU;AAExC,UAAMA,UAAS,IAAW,OACxB,MAAM,eACN,MAAM,YACN,aACA,cAAc;AAEhB,UAAM,MACJ,MAAM,YAAY,IACd,KAAI,SAASA,OAA0C,IACvD,KAAI,SAAS,MAAM,OAAOA,OAAM;AACtC,WAAO,CAAC,KAAwB,MAAM,SAAS,MAAM,IAAI,CAAC;EAC5D;;;;;;;;;;EAWA,OAAO,aAA4E,cAAgD;AACjI,QAAI,SAAS;AACb,UAAM,OAAO,MAAa;AACxB,YAAM,CAAC,GAAGI,OAAM,IAAWD,QAAO,aAAa,SAAS,MAAM,CAAC;AAC/D,gBAAUC;AACV,aAAO;IACT;AAEA,QAAI,UAAU,KAAI;AAClB,QAAI,QAAQ;AACZ,QAAI,YAAsB,IAAI;AAE5B,gBAAU;AACV,eAAS;IACX,OAAO;AACL,cAAQ,KAAI;IACd;AAEA,QAAI,YAAY,KAAK,YAAY,GAAG;AAClC,YAAM,IAAI,WAAW,uBAAuB,OAAO,EAAE;IACvD;AAEA,UAAM,aAAa;AACnB,UAAM,gBAAgB,KAAI;AAC1B,UAAM,aAAa,KAAI;AACvB,UAAM,OAAO,SAAS;AACtB,UAAM,gBAAgB,OAAO;AAE7B,WAAO,EAAE,SAAS,OAAO,eAAe,YAAY,eAAe,KAAI;EACzE;;;;;;;EAQA,OAAO,MAA0G,QAAkEF,OAAmC;AACpN,UAAM,CAAC,QAAQ,KAAK,IAAI,gBAAgB,QAAQA,KAAI;AAEpD,UAAM,MAAM,KAAI,OAAO,KAAK;AAE5B,QAAI,IAAI,YAAY,KAAK,OAAO,CAAC,MAAM,KAAK;AAC1C,YAAM,MAAM,wDAAwD;IACtE;AAGA,cAAU,GAAG,EAAE,IAAI,QAAQ,MAAM;AAEjC,WAAO;EACT;;AAGF,SAAS,gBAAqH,QAAkEA,OAAmC;AACjO,UAAQ,OAAO,CAAC,GAAG;;IAEjB,KAAK,KAAK;AACR,YAAM,UAAUA,SAAQ;AACxB,aAAO;QACL,UAAU;QACV,QAAQ,OAAO,GAAG,UAAU,MAAM,GAAG,MAAM,EAAE;;IAEjD;IACA,KAAK,UAAU,QAAQ;AACrB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,UAAU,QAAkB,QAAQ,OAAO,MAAM,CAAC;IAC5D;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,SAAS;AACP,UAAIA,SAAQ,MAAM;AAChB,cAAM,MACJ,yFAAyF;MAE7F;AACA,aAAO,CAAC,OAAO,CAAC,GAAaA,MAAK,OAAO,MAAM,CAAC;IAClD;EACF;AACF;AAEA,SAAS,WAAY,OAAmBG,QAA4BH,OAA+B;AACjG,QAAM,EAAE,OAAM,IAAKA;AACnB,MAAI,WAAW,UAAU,QAAQ;AAC/B,UAAM,MAAM,8BAA8BA,MAAK,IAAI,WAAW;EAChE;AAEA,QAAM,MAAMG,OAAM,IAAI,MAAM;AAC5B,MAAI,OAAO,MAAM;AACf,UAAMC,OAAMJ,MAAK,OAAO,KAAK,EAAE,MAAM,CAAC;AACtC,IAAAG,OAAM,IAAI,QAAQC,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAO;EACT;AACF;AAEA,SAAS,WAAoC,OAAmBD,QAA4BH,OAAkC;AAC5H,QAAM,EAAE,OAAM,IAAKA;AACnB,QAAM,MAAMG,OAAM,IAAI,MAAM;AAC5B,MAAI,OAAO,MAAM;AACf,UAAMC,OAAMJ,MAAK,OAAO,KAAK;AAC7B,IAAAG,OAAM,IAAI,QAAQC,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAO;EACT;AACF;AAEA,IAAM,cAAc;AACpB,IAAM,eAAe;AAErB,SAAS,UAAW,SAAsBP,OAAc,WAAqB;AAC3E,QAAM,aAAoB,eAAe,OAAO;AAChD,QAAM,aAAa,aAAoB,eAAeA,KAAI;AAC1D,QAAM,QAAQ,IAAI,WAAW,aAAa,UAAU,UAAU;AAC9D,EAAO,SAAS,SAAS,OAAO,CAAC;AACjC,EAAO,SAASA,OAAM,OAAO,UAAU;AACvC,QAAM,IAAI,WAAW,UAAU;AAC/B,SAAO;AACT;AAEA,IAAM,YAAY,uBAAO,IAAI,kBAAkB;;;AVnc/C,IAAAQ,cAAkB;;;AWAX,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAYC,OAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,kBAAkB,OAAO;AAC/B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,yBAAyB;AAAA,EAChE,YAAY,SAAiB;AAC3B,UAAM,eAAe,OAAO;AAC5B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,uBAAuB,OAAO;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,8BAA8B,OAAO;AAC3C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iCAAN,cAA6C,yBAAyB;AAAA,EAC3E,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO;AAC5C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,yBAAyB;AAAA,EACvE,YAAY,SAAiB;AAC3B,UAAM,qBAAqB,OAAO;AAClC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,oBAAoB,OAA0C;AAC5E,MAAI,iBAAiB,0BAA0B;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,IAAI;AAAA,IACT;AAAA,IACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EACvD;AACF;;;ACzEA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAWK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAaC,SAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQA;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,qBAAqB;AAC1D,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,sBAAsB,GAAW,GAAmB;AAC3D,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,eAAe,EAAE,WAAW,KAAK;AACvC,UAAM,gBAAgB,EAAE,WAAW,KAAK;AACxC,QAAI,iBAAiB,eAAe;AAClC,aAAO,eAAe;AAAA,IACxB;AAAA,EACF;AACA,SAAO,EAAE,SAAS,EAAE;AACtB;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAMC,QAAO,MAAM,WAAW,KAAK;AACnC,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACxNA,uBAAoC;AACpC,IAAAC,eAAmC;AAInC,IAAM,cAAc,IAAI,YAAY;AAY7B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAYC,OAAiC,SAAiB;AAC5D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAiBA,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,IAAM,mBAAmB,oBAAI,IAAI,CAAC,gBAAgB,iBAAiB,eAAe,CAAC;AACnF,IAAM,oBAAoB,oBAAI,IAAiC;AAE/D,WAAW,SAAS,sCAAqB;AACvC,MAAI,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAAG;AACxC;AAAA,EACF;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,YAAY,UAAa,MAAM,IAAI,SAAS,IAAI,GAAG;AAC1F;AAAA,EACF;AACA,QAAM,WAAW,kBAAkB,IAAI,MAAM,OAAO;AACpD,MAAI,aAAa,QAAW;AAC1B,sBAAkB,IAAI,MAAM,SAAS,oBAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD;AAAA,EACF;AACA,EAAC,SAAyB,IAAI,MAAM,GAAG;AACzC;AAOO,SAAS,0BAA0B,OAAkC;AAC1E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAOO,SAAS,6BAA6B,OAAkC;AAC7E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAYO,SAAS,yBAAyB,WAAoB,SAA2B;AACtF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,6BAA6B,SAAS;AAC7C,UAAM,6BAA6B,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,IAAI,OAAO;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,GAAG;AACtC,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI,IAAI,KAAK,OAAO;AACxC,aAAW,UAAU,IAAI,SAAS;AAChC,QAAI,CAAC,YAAY,IAAI,MAAM,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,eAAe,KAAK,SAAS,IAAI,OAAO;AACjD;AAEA,SAAS,qCACP,OACAC,UACkB;AAClB,QAAM,SAAS,aAAa,OAAO,GAAG;AACtC,kBAAgB,QAAQ,CAAC,WAAW,SAAS,QAAQ,WAAW,SAAS,GAAG,GAAG;AAC/E,QAAM,UAAU,eAAe,QAAQ,WAAW,KAAK,qCAAqC;AAC5F,MAAI,CAAC,iBAAiB,IAAI,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,eAAe,QAAQ,SAAS,KAAK,mCAAmC;AACtF,wBAAsB,KAAK;AAC3B,QAAM,iBAAiB,MAAM,UAAU,KAAK;AAC5C,MAAIA,SAAQ,oBAAoB,mBAAmB,OAAO;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,eAAe,QAAQ,QAAQ,KAAK,kCAAkC;AACtF,kBAAgB,SAASA,QAAO;AAChC,QAAM,OAAO,cAAc,OAAO;AAClC,MAAIA,SAAQ,oBAAoB,SAAS,SAAS;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,MAAMA,QAAO;AAC7B,QAAM,UAAU;AAAA,IACd,cAAc,QAAQ,WAAW,KAAK,oCAAoC;AAAA,IAC1E;AAAA,IACAA;AAAA,EACF;AACA,QAAM,SAAS,uBAAO,OAAO,IAAI;AAOjC,SAAO,UAAU;AACjB,SAAO,QAAQ;AACf,SAAO,OAAO;AACd,SAAO,UAAU;AACjB,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,WAAO,UAAU;AAAA,MACf,cAAc,QAAQ,WAAW,KAAK,qCAAqC;AAAA,MAC3E,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,MAA0B;AAC9D,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AACtF,YAAM,IAAI,sBAAsB,+BAA+B,GAAG,IAAI,oBAAoB;AAAA,IAC5F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB;AAC1C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,QAAQ,QAAQ,QAAQ,UAAU,gCAAgC;AAAA,QAClE,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cACP,QACA,KACA,MACAC,OACW;AACX,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACpE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,eACP,QACA,KACA,MACAA,OACQ;AACR,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAMA,KAAI;AACnD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,6BAA6B;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,cACP,QACA,KACA,MACAA,OACsB;AACtB,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAMA,KAAI;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,mBAAmB;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAqB;AAClD,MAAI,UAAU,OAAO,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AACtF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,MAAcD,UAAiC;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,sBAAsB,oCAAoC,iBAAiB;AAAA,EACvF;AACA,MAAI,CAACA,SAAQ,oBAAoB,KAAK,SAAS,GAAG,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG;AAC9C,UAAM,IAAI,sBAAsB,oCAAoC,yBAAyB;AAAA,EAC/F;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS;AACpD,UAAM,UAAU,SAAS,KAAK;AAC9B,UAAM,0BACJA,SAAQ,oBAAoB,UAAU,SAAS,SAAS,KAAK,QAAQ,WAAW;AAClF,QAAI,QAAQ,WAAW,KAAK,CAAC,yBAAyB;AACpD,YAAM,IAAI,sBAAsB,oCAAoC,6BAA6B;AAAA,IACnG;AACA,QAAI,YAAY,OAAO,YAAY,MAAM;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,YAAY,OAAO,YAAY,OAAO,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACxF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,iBAAiB,IAAI,EAAE,UAAU,KAAK;AAC/C;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,CAAC,YAAY;AACnD,UAAM,OAAO,OAAO,aAAa,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC;AACtE,WAAO,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,YAAY;AAAA,EACrE,CAAC;AACH;AAEA,SAAS,iBACP,SACA,SACAA,UACU;AACV,QAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,aAAuB,CAAC;AAC9B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,UAAM,SAAS,QAAQ,KAAK;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW,GAAG,OAAO,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,eAAW,KAAK,MAAM;AACtB,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,CAAC,GAAG,MAAM,EAAE,KAAK;AAC3C,MACEA,SAAQ,qBACP,WAAW,WAAW,kBAAkB,UACvC,WAAW,KAAK,CAAC,QAAQ,UAAU,WAAW,kBAAkB,KAAK,CAAC,IACxE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAkB,SAAkD;AAC3F,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,iBAAiB;AAC/B,WAAO,mBAAmB,KAAmB;AAAA,EAC/C;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA+B;AACzD,mBAAiB,OAAO,CAAC,QAAQ,YAAY,YAAY,GAAG,WAAW;AACvE,QAAM,OAAO,aAAa,OAAO,QAAQ,WAAW;AACpD,MAAI,SAAS,0BAA0B;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,OAAO,YAAY,WAAW,MAAM,MAAM;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,eAAe,OAAO,cAAc,WAAW;AAClE,MAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS;AACtD,yBAAqB,WAAW,KAAK,GAAG,wBAAwB,KAAK,GAAG;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAkB,MAAoB;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,QAAQ,OAAO,aAAa,GAAG,IAAI;AAC7D,eAAa,QAAQ,QAAQ,IAAI;AACjC,eAAa,QAAQ,OAAO,IAAI;AAChC,QAAM,cAAc,eAAe,QAAQ,eAAe,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,uBAAmB,YAAY,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAAA,EACxE;AACF;AAEA,SAAS,mBAAmB,OAAkB,MAAoB;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,SAAS,OAAO,GAAG,IAAI;AACjD,QAAM,QAAQ,eAAe,QAAQ,SAAS,IAAI;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,iBAAe,QAAQ,SAAS,IAAI;AACtC;AAEA,SAAS,iBAAiB,QAAoB,SAA4B,MAAoB;AAC5F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAyB;AAChF,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,QAAoB,KAAa,MAAsB;AAC3E,QAAM,QAAQ,eAAe,QAAQ,KAAK,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,WAAmB,SAA0B;AACjE,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,SAAO,UAAU,SAAS,GAAG,KAAK,QAAQ,WAAW,SAAS;AAChE;AAEA,SAAS,eAAe,WAAmC,SAA0C;AACnG,MAAI,cAAc,QAAW;AAC3B,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,KAAK,SAAS,EAAE,WAAW;AAAA,EAC3C;AACA,MAAI,UAAU,SAAS,4BAA4B,QAAQ,SAAS,0BAA0B;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,sBAAsB,MAAM,QAAQ,UAAU,UAAU,IAAI,UAAU,aAAa,CAAC;AAC1F,QAAM,oBAAoB,MAAM,QAAQ,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC;AACpF,SAAO,kBAAkB;AAAA,IAAM,CAAC,cAC9B,oBAAoB,KAAK,CAAC,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,SAAS,OAAO,QAAoB,KAAsB;AACxD,SAAOE,cAAa,QAAQ,GAAG;AACjC;;;AC3eA,qBAAwB;;;ACAxB;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACND;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACdD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAEA,IAAM,WAAW,MAAM,KAAK,orEAAwe;AACpgB,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAAG,IAAE,CAAC,IAAI;AAAG,SAAO;AAAE,GAAI,CAAA,CAAG;AAC3G,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAC5E,QAAM,YAAY,EAAE,YAAY,CAAC;AACjC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,MAAM,sBAAsB,CAAC,EAAE;EAC3C;AACA,IAAE,SAAS,IAAI;AACf,SAAO;AACT,GAAI,CAAA,CAAG;AAEP,SAASC,QAAQ,MAAgB;AAC/B,SAAO,KAAK,OAAO,CAAC,GAAG,MAAK;AAC1B,SAAK,qBAAqB,CAAC;AAC3B,WAAO;EACT,GAAG,EAAE;AACP;AAEA,SAASC,QAAQ,KAAW;AAC1B,QAAM,OAAO,CAAA;AACb,aAAW,QAAQ,KAAK;AACtB,UAAM,YAAY,KAAK,YAAY,CAAC;AACpC,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI,MAAM,sBAAsB,IAAI,EAAE;IAC9C;AACA,UAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAI,OAAO,MAAM;AACf,YAAM,IAAI,MAAM,+BAA+B,IAAI,EAAE;IACvD;AACA,SAAK,KAAK,GAAG;EACf;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAEO,IAAM,eAAe,KAAK;EAC/B,QAAQ;EACR,MAAM;EACN,QAAAD;EACA,QAAAC;CACD;;;ACzCD;;;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AC5BD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAGO,IAAM,WAAW,KAAK;EAC3B,QAAQ;EACR,MAAM;EACN,QAAQ,CAAC,QAAQ,SAAS,GAAG;EAC7B,QAAQ,CAAC,QAAQ,WAAW,GAAG;CAChC;;;ACND,IAAMC,eAAc,IAAI,YAAW;AACnC,IAAM,cAAc,IAAI,YAAW;;;ACHnC,IAAAC,oBAAA;SAAAA,mBAAA;kBAAAC;;AAIA,IAAM,OAAY;AAClB,IAAM,OAAO;AAEb,IAAMC,UAA4C;AAElD,SAAS,OAAQ,OAAmBC,UAAuB;AACzD,MAAIA,UAAS,YAAY,QAAQA,SAAQ,aAAa,MAAM,YAAY;AACtE,QAAIA,SAAQ,WAAW,KAAKA,SAAQ,WAAW,MAAM,YAAY;AAC/D,YAAM,IAAI,MAAM,0DAA0D,MAAM,UAAU,EAAE;IAC9F;AAEA,YAAQ,MAAM,SAAS,GAAGA,SAAQ,QAAQ;EAC5C;AAEA,SAAc,OAAO,MAAMD,QAAO,KAAK,CAAC;AAC1C;AAEO,IAAME,YAAW,EAAE,MAAM,MAAM,QAAAF,SAAQ,OAAM;;;ACrBpD;;gBAAAG;EAAA;;oBAAmB;;;ACKnB,IAAM,4BAA4B;AAqB5B,SAAUC,MAAiD,EAAE,MAAAC,OAAM,MAAAC,OAAM,QAAAC,SAAQ,iBAAiB,gBAAe,GAA0B;AAC/I,SAAO,IAAI,OAAOF,OAAMC,OAAMC,SAAQ,iBAAiB,eAAe;AACxE;AAoBM,IAAO,SAAP,MAAa;EAOjB,YAAaF,OAAYC,OAAYC,SAAkD,iBAA0B,iBAAwB;AANhI;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOF;AACZ,SAAK,OAAOC;AACZ,SAAK,SAASC;AACd,SAAK,kBAAkB,mBAAmB;AAC1C,SAAK,kBAAkB;EACzB;EAEA,OAAQ,OAAmBC,UAAuB;AAChD,QAAIA,UAAS,YAAY,MAAM;AAC7B,UAAIA,SAAQ,WAAW,KAAK,iBAAiB;AAC3C,cAAM,IAAI,MAAM,6DAA6D,KAAK,eAAe,EAAE;MACrG;AAEA,UAAI,KAAK,mBAAmB,QAAQA,SAAQ,WAAW,KAAK,iBAAiB;AAC3E,cAAM,IAAI,MAAM,0DAA0D,KAAK,eAAe,EAAE;MAClG;IACF;AAEA,QAAI,iBAAiB,YAAY;AAC/B,YAAM,SAAS,KAAK,OAAO,KAAK;AAEhC,UAAI,kBAAkB,YAAY;AAChC,eAAO,aAAa,QAAQ,KAAK,MAAMA,UAAS,QAAQ;MAC1D;AAEA,aAAO,OAAO,KAAK,CAAAC,YAAU,aAAaA,SAAQ,KAAK,MAAMD,UAAS,QAAQ,CAAC;IACjF,OAAO;AACL,YAAM,MAAM,mCAAmC;IAEjD;EACF;;AAOF,SAAS,aAAoCC,SAAoBH,OAAY,UAAiB;AAC5F,MAAI,YAAY,QAAQ,aAAaG,QAAO,YAAY;AACtD,QAAI,WAAWA,QAAO,YAAY;AAChC,YAAM,IAAI,MAAM,0DAA0DA,QAAO,UAAU,EAAE;IAC/F;AAEA,IAAAA,UAASA,QAAO,SAAS,GAAG,QAAQ;EACtC;AAEA,SAAc,OAAOH,OAAMG,OAAM;AACnC;;;ADnGO,IAAMC,UAASC,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,CAAC,UAAU,OAAO,cAAAC,QAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAM,CAAE;CAC7E;AAEM,IAAM,SAASD,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,WAAS,OAAO,cAAAC,QAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAM,CAAE;CAC3E;;;AEEM,IAAM,QAAQ,EAAE,GAAG,kBAAc,GAAG,eAAO,GAAG,eAAO,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,qBAAY;AACtI,IAAM,SAAS,EAAE,GAAG,cAAM,GAAGC,kBAAQ;;;AZf5C,IAAAC,eAAkD;AAgB3C,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AAC7B,IAAM,8BACX;AAEK,IAAM,8BAA8B;AACpC,IAAM,6BACX;AA0GF,IAAM,cAA0D;AAAA,EAC9D,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AACxB,IAAM,eAAe;AACrB,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEK,SAAS,iCAAiC,OAAwB;AACvE,SAAO,gBAAgB,KAAK;AAC9B;AAEO,SAAS,2BAA2B,OAAsC;AAC/E,QAAM,aAAa,sBAAsB,KAAK;AAC9C,QAAM,WAAW,8BAA8B,OAAO,UAAU;AAChE,SAAO,oBAAoB,UAAU,UAAU;AACjD;AAEO,SAAS,kBAAkB,OAAwB;AACxD,SAAO,2BAA2B,KAAK,EAAE;AAC3C;AAEA,eAAsB,0BACpB,OACA,QAC6B;AAC7B,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,aAAa,sBAAsB,UAAU;AACnD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,8BAA8B,UAAU,UAAU;AACnE,MAAI,WAAW,SAAS,UAAU;AAChC,+CAA2C,QAAQ;AAAA,EACrD;AACA,gCAA8B,OAAO,KAAK;AAC1C,oBAAkB,OAAO,WAAW,oBAAoB;AACxD,8BAA4B,OAAO,WAAW,OAAO,KAAK;AAC1D,mCAAiC,UAAU,OAAO,SAAS;AAC3D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,QAAM,iBAAiB;AAAA,IACrB,MAAM,OAAO,WAAW,SAAS,MAAM;AAAA,IACvC,OAAO;AAAA,EACT;AACA,QAAM,YAAY,kBAAkB;AAAA,IAClC,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,OAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,WAAW,OAAO,GAAG,SAAS;AAAA,IAC/B;AAAA,EACF;AACF;AAEO,SAAS,oBACd,OACA,QACiB;AACjB,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,0BAA0B,MAAM;AAAA,EAClC;AACF;AAEO,SAAS,0BACd,OACA,QACuB;AACvB,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,gCAAgC,MAAM;AAAA,EACxC;AACF;AAEO,SAAS,gCACd,OACA,QAC6B;AAC7B,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,sCAAsC,MAAM;AAAA,EAC9C;AACF;AAEA,eAAsB,mBACpB,OACyE;AACzE,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,aAAa;AACnB,QAAM,aAAa,oBAAoB,OAAO,MAAM;AACpD,QAAM,YAAY,kBAAkB,OAAO,SAAS;AACpD,mCAAiC,YAAY,SAAS;AACtD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,kBAAgB,YAAY,UAAU,UAAU;AAChD,MAAI,CAAE,MAAM,gBAAgB,WAAW,SAAS,MAAM,GAAI;AACxD,UAAM,IAAI,2BAA2B,+BAA+B;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,QAAQ,SAAS;AACpC;AAEA,eAAsB,aACpB,OAC6D;AAC7D,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,0BAA0B,OAAO,MAAM;AAAA,IAC/C,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,mBACpB,OACmE;AACnE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,gCAAgC,OAAO,MAAM;AAAA,IACrD,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,yBACpB,OACyE;AACzE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,sCAAsC,OAAO,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,qBACpB,OACiD;AACjD,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,KAAK;AACvC,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEA,eAAsB,2BACpB,OACuD;AACvD,MAAI;AACF,UAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEA,eAAsB,iCACpB,OAC6D;AAC7D,MAAI;AACF,UAAM,SAAS,MAAM,yBAAyB,KAAK;AACnD,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEO,SAAS,uBAAuB,OAAgC;AACrE,SAAO,oBAAoB,OAAO,KAAK;AACzC;AAEO,SAAS,6BAA6B,OAAsC;AACjF,SAAO,0BAA0B,OAAO,KAAK;AAC/C;AAEO,SAAS,mCACd,OAC4B;AAC5B,SAAO,gCAAgC,OAAO,KAAK;AACrD;AAEO,SAAS,0BAA0B,OAAwB;AAChE,SAAO,oBAAoB,OAAO,IAAI;AACxC;AAEO,SAAS,gCAAgC,OAA8B;AAC5E,SAAO,0BAA0B,OAAO,IAAI;AAC9C;AAEO,SAAS,sCACd,OACoB;AACpB,SAAO,gCAAgC,OAAO,IAAI;AACpD;AAEA,SAAS,0BAA0B,OAAoC;AACrE,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,SAASC,gBAAe,YAAY,UAAU,GAAG;AACvD,QAAM,aAAa,oBAAoB,MAAM;AAC7C,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,0BAA0B,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,gCAAgC,UAAU;AAAA,IACnD,KAAK;AACH,aAAO,sCAAsC,UAAU;AAAA,EAC3D;AACF;AAEA,SAAS,8BACP,OACA,YACY;AACZ,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,uBAAuB,KAAK;AAAA,IACrC,KAAK;AACH,aAAO,6BAA6B,KAAK;AAAA,IAC3C,KAAK;AACH,aAAO,mCAAmC,KAAK;AAAA,EACnD;AACF;AAEA,SAAS,oBAAoB,OAAgB,QAA6B;AACxE,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYD,gBAAe,QAAQ,UAAU,GAAG,GAAG,eAAe,UAAU;AAC5E,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,yBAAuBE,eAAc,QAAQ,YAAY,GAAG,GAAG,YAAY;AAC3E,qBAAmBA,eAAc,QAAQ,QAAQ,GAAG,GAAG,QAAQ;AAC/D,gBAAcA,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAC5D,MAAIC,QAAO,QAAQ,YAAY,GAAG;AAChC,uBAAmBD,eAAc,QAAQ,cAAc,GAAG,GAAG,cAAc;AAAA,EAC7E;AACA,MAAIC,QAAO,QAAQ,OAAO,GAAG;AAC3B,kBAAcD,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgB,QAA6B;AAC9E,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAD;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYD,gBAAe,QAAQ,UAAU,GAAG,GAAG,sBAAsB,UAAU;AACnF,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,kBAAgB,QAAQ,YAAY,KAAK,CAAC;AAC1C,cAAYA,gBAAe,QAAQ,eAAe,GAAG,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG,eAAe;AAClB,qBAAmB,QAAQ,eAAe,GAAG;AAC7C,iBAAe,QAAQ,cAAc,GAAG;AACxC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,gCACP,OACA,QACY;AACZ,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA;AAAA,IACED,gBAAe,QAAQ,UAAU,GAAG;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC;AAAA,IAAoB;AAAA,IAAQ;AAAA,IAA2B;AAAA,IAAK,CAAC,OAAO,SAClE,YAAY,OAAO,MAAM,IAAI;AAAA,EAC/B;AACA,sBAAoB,QAAQ,8BAA8B,GAAG;AAC7D,EAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuC;AAChE,QAAM,SAAS,iBAAiB,OAAO,aAAa;AACpD,EAAAC,iBAAgB,QAAQ,CAAC,SAAS,aAAa,OAAO,GAAG,aAAa;AACtE,QAAM,QAAQD,gBAAe,QAAQ,SAAS,aAAa;AAC3D,gCAA8B,KAAK;AACnC,QAAM,YAAYA,gBAAe,QAAQ,aAAa,aAAa;AACnE,QAAM,QAAQA,gBAAe,QAAQ,SAAS,aAAa;AAC3D,uBAAqB,OAAO,KAAK;AACjC,SAAO,EAAE,OAAO,WAAW,MAAM;AACnC;AAEA,SAAS,uBAAuB,OAAgB,MAAoB;AAClE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,gBAAgB,cAAc,oBAAoB,GAAG,IAAI;AAClF,EAAAD,gBAAe,QAAQ,gBAAgB,IAAI;AAC3C,EAAAA,gBAAe,QAAQ,cAAc,IAAI;AACzC,QAAM,UAAUI,eAAc,QAAQ,sBAAsB,MAAM,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,6BAAyB,QAAQ,KAAK,GAAG,GAAG,IAAI,uBAAuB,KAAK,GAAG;AAAA,EACjF;AACF;AAEA,SAAS,2CAA2C,OAAyB;AAC3E,QAAM,WAAW,iBAAiBF,eAAc,OAAO,YAAY,GAAG,GAAG,YAAY;AACrF,QAAM,UAAUE,eAAc,UAAU,sBAAsB,cAAc,CAAC;AAC7E,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD;AAAA,MACE,QAAQ,KAAK;AAAA,MACb,iCAAiC,KAAK;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,OAAgB,MAAoB;AACpE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,6BAA6B,MAAM;AACrD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,0CAA0C;AAAA,IACrF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,mCAAmC,OAAgB,MAAoB;AAC9E,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,0BAA0B,MAAM;AAClD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,iDAAiD;AAAA,IAC5F;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,wBAAwB,GAAG,IAAI,uCAAuC;AAAA,EAClF;AACA,QAAM,MAAM,KAAK,CAAC;AAClB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,SAASA,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,aAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,yBAAmB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK,GAAG;AAAA,IAC9D;AACA;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,iBAAiBF,eAAc,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,UAAU;AAC1F,IAAAD,iBAAgB,SAAS,CAAC,KAAK,GAAG,GAAG,IAAI,UAAU;AACnD,IAAAD,gBAAe,SAAS,OAAO,GAAG,IAAI,UAAU;AAChD;AAAA,EACF;AACA,MAAI,QAAQ,YAAY;AACtB,gCAA4BE,eAAc,QAAQ,YAAY,IAAI,GAAG,GAAG,IAAI,WAAW;AACvF;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,+BAA+B,GAAG,EAAE;AAC/E;AAEA,SAAS,4BAA4B,OAAgB,MAAoB;AACvE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD;AAAA,IACE;AAAA,IACA,CAAC,iBAAiB,YAAY,gBAAgB,aAAa,WAAW;AAAA,IACtE;AAAA,EACF;AACA,EAAAD,gBAAe,QAAQ,iBAAiB,IAAI;AAC5C,EAAAA,gBAAe,QAAQ,YAAY,IAAI;AACvC,EAAAE,eAAc,QAAQ,gBAAgB,IAAI;AAC1C,MAAIC,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBD,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAD;AAAA,MACE;AAAA,MACA,CAAC,WAAW,mBAAmB,4BAA4B;AAAA,MAC3D,GAAG,IAAI;AAAA,IACT;AACA,mBAAe,WAAW,WAAW,GAAG,IAAI,YAAY;AACxD,QAAIE,QAAO,WAAW,iBAAiB,GAAG;AACxC,0BAAoB,WAAW,mBAAmB,GAAG,IAAI,YAAY;AAAA,IACvE;AACA,oBAAgB,WAAW,8BAA8B,GAAG,IAAI,YAAY;AAAA,EAC9E;AACA,MAAIA,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBD,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAD,iBAAgB,WAAW,CAAC,qBAAqB,GAAG,GAAG,IAAI,YAAY;AACvE,oBAAgB,WAAW,uBAAuB,GAAG,IAAI,cAAc,CAAC;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAA,iBAAgB,QAAQ,CAAC,UAAU,iBAAiB,kBAAkB,YAAY,GAAG,IAAI;AACzF,cAAYD,gBAAe,QAAQ,UAAU,IAAI,GAAG,uBAAuB,GAAG,IAAI,SAAS;AAC3F,kBAAgB,QAAQ,iBAAiB,MAAM,CAAC;AAChD,cAAYA,gBAAe,QAAQ,kBAAkB,IAAI,GAAG;AAAA,IAC1D;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,iBAAiB;AAC3B,cAAYA,gBAAe,QAAQ,cAAc,IAAI,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,aAAa;AACzB;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,QAAQ,GAAG,IAAI;AACxC,cAAYD,gBAAe,QAAQ,UAAU,IAAI,GAAG,CAAC,QAAQ,QAAQ,OAAO,GAAG,GAAG,IAAI,SAAS;AACjG;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,UAAU,GAAG,IAAI;AAC1C,cAAYD,gBAAe,QAAQ,YAAY,IAAI,GAAG,CAAC,OAAO,YAAY,MAAM,GAAG,GAAG,IAAI,WAAW;AACvG;AAEA,SAAS,oBACP,UACA,YACsB;AACtB,QAAM,MAAM,gBAAgB,QAAQ;AACpC,QAAM,WAAWF,aAAY,OAAO,GAAG;AACvC,QAAMO,UAAS,YAAY,YAAYP,aAAY,OAAO,GAAG,WAAW,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC9F,QAAM,KAAK,GAAG,WAAW,QAAQ,GAAG,iBAAiBO,OAAM,CAAC;AAC5D,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAAA;AAAA,IACA,eAAW,yBAAWA,OAAM,EAAE,MAAM,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,gBACP,QACA,UACA,YACM;AACN,QAAM,SAASL,gBAAe,QAAQ,WAAW,SAAS,GAAG;AAC7D,MAAI,WAAW,SAAS,IAAI;AAC1B;AAAA,EACF;AACA,MAAI,IAAI,OAAO,IAAI,WAAW,QAAQ,eAAe,EAAE,KAAK,MAAM,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,OAAO;AAAA,IACvB;AAAA,EACF;AACA,QAAM,IAAI,oBAAoB,GAAG,WAAW,OAAO,mBAAmB,WAAW,QAAQ,EAAE;AAC7F;AAEA,SAAS,iCACP,UACA,WACM;AACN,MAAI,CAACG,QAAO,UAAU,eAAe,GAAG;AACtC;AAAA,EACF;AACA,QAAM,gBAAgBH,gBAAe,UAAU,iBAAiB,GAAG;AACnE,MAAI,kBAAkB,WAAW;AAC/B,UAAM,IAAI;AAAA,MACR,cAAc,SAAS,iCAAiC,aAAa;AAAA,IACvE;AAAA,EACF;AACF;AAEA,SAAS,iCACP,QACA,WACM;AACN,MAAI,CAACG,QAAO,QAAQ,eAAe,GAAG;AACpC;AAAA,EACF;AACA,QAAM,gBAAgBH,gBAAe,QAAQ,iBAAiB,GAAG;AACjE,MAAI,UAAU,cAAc,eAAe;AACzC,UAAM,IAAI;AAAA,MACR,uBAAuB,UAAU,SAAS,iCAAiC,aAAa;AAAA,IAC1F;AAAA,EACF;AACF;AAEA,SAAS,4BACP,WACA,OACM;AACN,MAAI,UAAU,6BAA6B;AACzC,+BAA2B,SAAS;AACpC;AAAA,EACF;AACA,MAAI,UAAU,4BAA4B;AACxC,gBAAY,SAAS;AACrB;AAAA,EACF;AACA,QAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAClF;AAEA,eAAe,gBACb,WACAK,SACkB;AAClB,MAAI,UAAU,UAAU,6BAA6B;AACnD,UAAM,YAAY,2BAA2B,UAAU,SAAS;AAChE,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,aAAO,uBAAQ,OAAO,gBAAgBA,SAAQ,SAAS;AAAA,IACzD,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,UAAU,UAAU,4BAA4B;AAClD,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,iBAAO,4BAAc;AAAA,QACnB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,KAAKA,QAAO;AAAA,QACvB,eAAW,yBAAW,cAAc;AAAA,MACtC,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,QAAM,IAAI,+BAA+B,gCAAgC,UAAU,KAAK,EAAE;AAC5F;AAEA,SAAS,2BAA2B,KAAyB;AAC3D,MAAI,CAAC,IAAI,WAAW,UAAU,GAAG;AAC/B,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI,uBAAuB,sCAAsC;AAAA,EACzE;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,UAAU,OAAO,UAAU;AAAA,EAC3C,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI,uBAAuB,yCAAyC;AAC5E;AAEA,SAAS,YAAY,KAAyC;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,YAAY,GAAG;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ;AACnC;AAEA,SAAS,qBAAqB,OAAe,OAAmC;AAC9E,MAAI,MAAM,WAAW,KAAK,CAAC,aAAa,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG,GAAG;AAC1E,UAAM,IAAI,uBAAuB,mDAAmD;AAAA,EACtF;AACA,QAAM,QAAQ,gBAAgB,KAAK;AACnC,MAAI,UAAU,+BAA+B,MAAM,WAAW,IAAI;AAChE,UAAM,IAAI,uBAAuB,oCAAoC;AAAA,EACvE;AACA,MAAI,UAAU,4BAA4B;AACxC,QAAI,MAAM,WAAW,IAAI;AACvB,YAAM,IAAI,uBAAuB,oCAAoC;AAAA,IACvE;AACA,UAAM,IAAI,MAAM,EAAE;AAClB,QAAI,MAAM,MAAM,MAAM,IAAI;AACxB,YAAM,IAAI,uBAAuB,gDAAgD;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,OACQ;AACR,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAMC,WAAU,MAAM,WAAW,IAAI,IACjC,gBAAgB,WAAW,KAAK,CAAC,IACjC;AACJ,yBAAqBA,UAAS,KAAK;AACnC,WAAOA;AAAA,EACT;AACA,QAAM,UAAU,gBAAgB,KAAK;AACrC,uBAAqB,SAAS,KAAK;AACnC,SAAO;AACT;AAEA,SAAS,uBACP,QACA,YACY;AACZ,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW,WAAW,QAAQ,aAAa;AACrD;AAAA,IACF;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAkC;AAC/D,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,SAAO,oBAAoBN,gBAAe,QAAQ,UAAU,GAAG,CAAC;AAClE;AAEA,SAAS,oBAAoB,QAAkC;AAC7D,MAAI,WAAW,cAAe,QAAO,YAAY;AACjD,MAAI,WAAW,qBAAsB,QAAO,YAAY;AACxD,MAAI,WAAW,4BAA6B,QAAO,YAAY;AAC/D,QAAM,IAAI,wBAAwB,qCAAqC,MAAM,EAAE;AACjF;AAEA,SAAS,iBAAiB,OAAgB,MAA0B;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAASC,iBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB,GAAG,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAASC,eAAc,QAAoB,KAAa,MAAyB;AAC/E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EAChE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASH,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,SAAO,kBAAkBE,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AAC7E;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAoB;AAC3E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,oBAAkBD,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACtE;AAEA,SAAS,kBAAkB,OAAkB,MAAsB;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,wBAAwB,GAAG,IAAI,6BAA6B;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAoB,KAAa,MAAoB;AAC5E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,MAAI,OAAOD,eAAc,QAAQ,KAAK,IAAI,MAAM,WAAW;AACzD,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,oBAAoB;AAAA,EACtE;AACF;AAEA,SAAS,gBACP,QACA,KACA,MACA,SACQ;AACR,QAAM,QAAQA,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,SAAS;AAChF,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,0BAA0B,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASE,eACP,QACA,KACA,MACA,SACsB;AACtB,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS;AACnD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,mCAAmC,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBACP,QACA,KACA,MACA,OACM;AACN,QAAM,SAASE,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,WAAW,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AACxC,UAAM,QAAQ,kBAAkB,OAAO,KAAK,GAAG,QAAQ;AACvD,YAAQ,OAAO,QAAQ;AAAA,EACzB;AACF;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,gBAAcJ,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,MAAI,CAACG,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,gBAAcH,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,cAAc,OAAe,MAAoB;AACxD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B;AAAA,EACrE;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,yCAAyC;AAAA,EACpF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,4CAA4C;AAAA,EACvF;AACF;AAEA,SAAS,YAA8B,QAAgB,UAAa,MAAiB;AACnF,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,YAAY,QAAQ,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,SACA,MACG;AACH,aAAW,SAAS,SAAS;AAC3B,QAAI,WAAW,OAAO;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B,MAAM,EAAE;AAC7E;AAEA,SAASG,QAAO,QAAoB,KAAsB;AACxD,SAAOJ,cAAa,QAAQ,GAAG;AACjC;AAEA,SAAS,8BAA8B,OAAgD;AACrF,MAAI,UAAU,+BAA+B,UAAU,4BAA4B;AACjF,UAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,YAAY,OAA+B;AAClD,aAAO,qBAAO,OAAO,OAAO;AAC9B;AAEA,SAAS,YAAY,MAAkB,OAA+B;AACpE,QAAM,SAAS,IAAI,WAAW,KAAK,SAAS,MAAM,MAAM;AACxD,SAAO,IAAI,MAAM,CAAC;AAClB,SAAO,IAAI,OAAO,KAAK,MAAM;AAC7B,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,gBAAU,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IACjD;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,cAAU,gBAAiB,UAAW,IAAI,OAAS,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAMQ,YACJ;AACF,MAAI,SAAS;AACb,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK;AACrB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACpD,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAUA,UAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAUA,UAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,QAAMA,YACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQA,UAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI,uBAAuB,kCAAkC;AAAA,IACrE;AACA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,WAAW,KAAK,KAAK;AACrC,MAAI,gBAAgB,OAAO,MAAM,OAAO;AACtC,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,QAAM,MAAM,MAAM,MAAM,CAAC;AACzB,MAAI,IAAI,SAAS,MAAM,KAAK,CAAC,iBAAiB,KAAK,GAAG,GAAG;AACvD,UAAM,IAAI,uBAAuB,qCAAqC;AAAA,EACxE;AACA,QAAM,SAAS,IAAI,WAAW,IAAI,SAAS,CAAC;AAC5C,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,WAAO,KAAK,IAAI,OAAO,SAAS,IAAI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;;;AarlCO,IAAM,oCACX;AACK,IAAM,6BACX;AACK,IAAM,oBAAoB;AAC1B,IAAM,6BAA6B;AAiBnC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAYC,OAAgC,SAAiB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AA0TA,eAAsB,qCACpBC,UAC6B;AAC7B,QAAM,aAAaC,cAAaD,UAAS,KAAK,4BAA4B;AAC1E,EAAAE;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAACC,QAAO,YAAY,cAAc,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,WAAW,cAAc;AAC9C,MACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe;AACrB,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,mBAAmB,WAAW,0BAA0B;AAC1E,QAAM,QAAQ,mBAAmB,KAAK,OAAO;AAC7C,MAAI,aAAa,OAAO;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,yBAAyB,YAAY,GAAG;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,SAAS,UAAU,cAAc,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmBC,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmBA,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,wBAAwB;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,wBAAwBD,QAAO,YAAY,uBAAuB,IACpEC,gBAAe,YAAY,yBAAyB,GAAG,IACvD;AACJ,MAAI,CAAC,SAAS,wBAAwB,SAAS,qBAAqB,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,2BAA2BD;AAAA,IAC/B;AAAA,IACA;AAAA,EACF,IACIC,gBAAe,YAAY,4BAA4B,GAAG,IAC1D;AACJ,MAAI,CAAC,SAAS,2BAA2B,SAAS,wBAAwB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASH,cACP,OACA,MACAI,OACY;AACZ,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QACE,eAAe,QACf,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,GACxB;AACA,YAAM,IAAI,qBAAqBA,OAAM,GAAG,IAAI,oBAAoB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAASC,iBACP,QACA,SACA,MACM;AACN,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASC,eACP,QACA,KACA,MACW;AACX,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,KACA,MACAG,OACQ;AACR,MAAI,CAACF,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,qBAAqBE,OAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACnE;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAuHA,SAAS,mBAAmB,OAAe,MAAsB;AAC/D,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAMC,gBAEF,OAGA,UACD,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,SAASC,QAAO,QAAoB,KAAsB;AACxD,SAAOD,cAAa,QAAQ,GAAG;AACjC;;;A3BhtBO,IAAM,gCAAgC;AACtC,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAE5C,IAAM,yCACX;AACK,IAAM,0CACX;AACK,IAAM,uCACX;AACK,IAAM,8BACX;AACK,IAAM,yCACX;AACK,IAAM,6BACX;AAEK,IAAM,gDAAgD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA8CO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAMlD,YACEE,OACA,SACA,QAAuC,WACvC,YACA,QACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AACZ,SAAK,QAAQ;AACb,SAAK,aAAa;AAClB,SAAK,SAAS;AAAA,EAChB;AACF;AA8IA,IAAM,kBAAsC,cAAE;AAAA,EAAK,MACjD,cAAE,MAAM;AAAA,IACN,cAAE,OAAO;AAAA,IACT,cAAE,OAAO,EAAE,OAAO;AAAA,IAClB,cAAE,QAAQ;AAAA,IACV,cAAE,KAAK;AAAA,IACP,cAAE,MAAM,eAAe;AAAA,IACvB,cAAE,OAAO,eAAe;AAAA,EAC1B,CAAC;AACH;AAEA,IAAM,gBAAgB,cACnB,OAAO,EACP,OAAO,CAAC,UAAUC,oBAAmB,KAAK,MAAM,QAAW;AAAA,EAC1D,SAAS;AACX,CAAC;AAEH,IAAM,qBAAqB,cACxB,OAAO;AAAA,EACN,QAAQ,cAAE,OAAO;AAAA,EACjB,gBAAgB,cAAE,OAAO;AAAA,EACzB,UAAU,cAAE,OAAO;AAAA,EACnB,UAAU,cAAE,OAAO;AAAA,EACnB,UAAU,cAAE,OAAO;AAAA,EACnB,yBAAyB,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3C,4BAA4B,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC9C,gBAAgB,cAAE,OAAO;AAAA,EACzB,WAAW;AAAA,EACX,WAAW,cACR,OAAO;AAAA,IACN,OAAO,cAAE,OAAO;AAAA,IAChB,WAAW,cAAE,OAAO;AAAA,IACpB,OAAO,cAAE,OAAO;AAAA,EAClB,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,cACxB,OAAO;AAAA,EACN,UAAU,cAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,cAAE,OAAO;AAAA,EACnB,4BAA4B,cAAE,MAAM;AAAA,IAClC,cAAE,QAAQ,0BAA0B;AAAA,EACtC,CAAC;AAAA,EACD,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,0BAA0B;AAAA,EAC5C,UAAU,cAAE,OAAO,EAAE,IAAI;AAAA,EACzB,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,cACxB,OAAO;AAAA,EACN,cAAc,cAAE,OAAO;AAAA,EACvB,YAAY,cAAE,OAAO;AAAA,EACrB,uBAAuB,cAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AACvD,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,iCAAiC;AAAA,EACnD,UAAU,cAAE,OAAO;AAAA,EACnB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,OAAO,cAAE,OAAO;AAAA,EAChB,WAAW,cAAE,OAAO;AAAA,EACpB,OAAO,cAAE,OAAO;AAClB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,uCAAuC;AAAA,EACzD,aAAa,cAAE,OAAO;AAAA,EACtB,UAAU,cAAE,OAAO;AAAA,EACnB,UAAU,cAAE,OAAO;AAAA,EACnB,OAAO,cAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,oBAAoB;AAAA,EACpB,gBAAgB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,+BAA+B,cAAE,MAAM,eAAe,EAAE,SAAS;AAAA,EACjE,WAAW;AACb,CAAC,EACA,OAAO;AAEV,IAAM,0BAA0B,cAC7B,OAAO,EAAE,WAAW,gBAAgB,CAAC,EACrC,OAAO;AAEV,IAAM,eAAe,cAClB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,2BAA2B;AAAA,EAC7C,MAAM,cAAE,KAAK,6CAA6C;AAAA,EAC1D,SAAS,cAAE,OAAO,EAAE,SAAS;AAC/B,CAAC,EACA,OAAO;AAEV,IAAM,4BAA4B,cAC/B,OAAO;AAAA,EACN,OAAO,cACJ,OAAO;AAAA,IACN,MAAM,cAAE,KAAK,6CAA6C;AAAA,IAC1D,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,uBAAuB,cAC1B,OAAO;AAAA,EACN,cAAc,cAAE,OAAO;AAAA,EACvB,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,WAAW,cAAE,OAAO;AAAA,EACpB,WAAW,cAAE,OAAO;AAAA,EACpB,UAAU,cAAE,OAAO;AAAA,EACnB,mBAAmB,cAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACpD,gBAAgB,cAAE,QAAQ,cAAc;AAAA,EACxC,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU,cAAE,QAAQ;AAAA,EACpB,SAAS,cAAE,OAAO;AACpB,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,cAC3B,OAAO,EAAE,YAAY,qBAAqB,CAAC,EAC3C,OAAO;AACV,IAAM,wBAAwB,cAC3B,OAAO;AAAA,EACN,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC7B,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAC7B,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,cAC3B,OAAO,EAAE,MAAM,cAAE,MAAM,eAAe,EAAE,CAAC,EACzC,OAAO;AACV,IAAM,uBAAuB,cAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC,EAAE,OAAO;AAElE,IAAM,+BAA+B;AAAA,EAC1C;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AACF;AAcO,SAAS,oCACd,eACA,gBACQ;AACR,MAAI,eAAe,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,GAAG,aAAa,IAAI,mBAAmB,cAAc,CAAC;AAC/D;AAKA,IAAM,+BACJ,IAAI;AAAA,EACF,6BAA6B,IAAI,CAAC,cAAc;AAAA,IAC9C,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEK,IAAM,sBAAN,MAAM,qBAAoB;AAAA,EA4BvB,YACN,WACA,uBACA,wBACAC,4BACA,+BACA,uBACA,oBACAC,UACA;AAdF,SAAiB,sBAAsB,oBAAI,IAAY;AAGvD,SAAQ,cAAc;AAYpB,SAAK,YAAY;AACjB,SAAK,wBAAwB;AAC7B,SAAK,yBAAyB;AAC9B,SAAK,4BAA4BD;AACjC,SAAK,eAAeC,SAAQ;AAC5B,SAAK,WAAWA,SAAQ;AACxB,SAAK,WAAWA,SAAQ;AACxB,SAAK,iBAAiBA,SAAQ;AAC9B,SAAK,YAAYA,SAAQ;AACzB,SAAK,oBAAoBA,SAAQ;AACjC,SAAK,uBAAuBA,SAAQ;AACpC,SAAK,gCAAgC;AACrC,SAAK,wBAAwB;AAC7B,SAAK,qBAAqB;AAC1B,SAAK,qBACHA,SAAQ,sBACRA,SAAQ,mBAAmB,sBAC3BA,SAAQ;AACV,SAAK,gBAAgBA,SAAQ,iBAC3BA,SAAQ,mBAAmB,iBAAiB;AAAA,MAC1C,MAAM;AAAA,MACN,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAWA,SAAQ;AAAA,MACrB;AAAA,IACF;AACF,SAAK,WAAWA,SAAQ,YAAYA,SAAQ,mBAAmB;AAC/D,SAAK,yBAAyB,KAAK;AAAA,MACjC,KAAK,IAAIA,SAAQ,0BAA0B,IAAI,CAAC;AAAA,MAChD;AAAA,IACF;AACA,SAAK,MAAMA,SAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,QACHA,SAAQ,UACP,CAAC,iBACA,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,YAAY,CAAC;AAC9D,SAAK,SAASA,SAAQ,UAAU,KAAK;AACrC,SAAK,sBACHA,SAAQ,uBAAuB;AAAA,EACnC;AAAA,EAEA,aAAa,OACXA,UAC8B;AAC9B,UAAM,YAAY,eAAeA,SAAQ,SAAS;AAClD,QACE,UAAU,UAAU,aAAaA,SAAQ,iBAAiB,YAC1D,UAAU,UAAU,YAAYA,SAAQ,iBAAiB,SACzD;AACA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,yBAAyB,WAAWA,QAAO;AAChE,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB,MAAM;AAAA,MAClC,UAAU,aAAa;AAAA,MACvBA,SAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM;AAAA,MAC/B,UAAU,UAAU;AAAA,MACpBA,SAAQ;AAAA,IACV;AACA,UAAM,wBACJ,UAAU,aAAa,sBAAsB;AAAA,MAAI,CAAC,YAAY,UAC5D;AAAA,QACE;AAAA,QACA,wCAAwC,KAAK;AAAA,MAC/C;AAAA,IACF;AACF,UAAM,yBAAyB,sBAAsB,IAAI,CAAC,gBAAgB;AAAA,MACxE,GAAG;AAAA,MACH,OAAO,UAAU,UAAU;AAAA,IAC7B,EAAE;AACF,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,0BAA0B,qBAAqB;AAAA,MAC/CF,oBAAmB,OAAO,SAAS;AAAA,MACnC;AAAA,MACA;AAAA,MACAE;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,cAA2D;AAC7D,QAAI,KAAK,aAAa;AACpB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,uBAAuB,QAAW;AACzC,aAAO;AAAA,IACT;AACA,QAAI,KAAK,gBAAgB,KAAK,kBAAkB,GAAG;AACjD,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,eACA,gBAC2C;AAC3C,QAAI;AACF,YAAM,mBAAmB,8BAA8B,aAAa;AACpE,YAAM,yBACJ,kBAAkB,KAAK,UAAU,aAAa;AAChD,YAAM,YAAwC;AAAA,QAC5C,GAAG;AAAA,QACH,MACE,mBAAmB,SACf,iBAAiB,OACjB;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACN,aAAa,iBAAiB,YAAY,IAAI,CAAC,UAAU;AAAA,UACvD,GAAG;AAAA,UACH,OACE,KAAK,UAAU,qBACX,yBACA,KAAK;AAAA,QACb,EAAE;AAAA,MACJ;AACA,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,KAAK;AAAA,QACrB;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,UAAU;AAAA;AAAA;AAAA;AAAA,UAIhB,QACE,UAAU,YAAY,SAClB,UAAU,YAAY,IAAI,CAAC,SAAS,KAAK,KAAK,IAC9C,CAAC;AAAA,QACT;AAAA,QACA,UAAU;AAAA,MACZ;AACA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAwD;AACnE,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,WAAW,aAAa;AAAA,QACxC,CAAC,eACC,WAAW,YAAY,kBACvB,WAAW,SAAS,QACpB,WAAW,QAAQ,SAAS,kBAAkB;AAAA,MAClD;AACA,YAAM,YAAY;AAAA,QAChB;AAAA,UACE,SAAS;AAAA,UACT,OAAO,WAAW,SAAS;AAAA,UAC3B;AAAA,UACA,SAAS,CAAC,kBAAkB;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,MAAM,kBAAkB;AACvE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,MACA,QACA,MACA,SACgC;AAChC,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,WAAW,cAAc,KAAK,gBAC9B,WAAW,cAAc,KAAK,mBAAmB,WACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,0BAA0B,UAC/B,KAAK,uBAAuB,QAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAA0B;AAAA,MAC9B,kBAAkB,EAAE,eAAe,KAAK,mBAAmB,QAAS;AAAA,MACpE,eAAe,KAAK;AAAA,MACpB,SAAS,KAAK,UAAU,UAAU;AAAA,MAClC,oBAAoB,WAAW;AAAA,MAC/B,KAAK,WAAW;AAAA,IAClB;AACA,QAAI;AACJ,QAAI,YAAY,QAAW;AACzB,0BAAoB,WAAW,OAAO,SAAS,SAAS,MAAM,MAAM;AAAA,IACtE,OAAO;AACL,UAAI,WAAW,cAAc,QAAW;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,0BAAoB,WAAW,UAAU,SAAS;AAAA,QAChD;AAAA,UACE,SAAS,KAAK,UAAU,UAAU;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS,CAAC,OAAO;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,cAAc,iBAAiB;AAC/C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D;AAAA,MACA,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,MACrD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC,CAAC;AACD,SAAK,wBAAwB,UAAU,SAAS;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,wBAAqD;AACjE,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,uBAAuB,UAC5B,CAAC,KAAK,gBAAgB,KAAK,kBAAkB,GAC7C;AACA,aAAO,KAAK;AAAA,IACd;AACA,QACE,KAAK,sBAAsB,UAC3B,KAAK,kBAAkB,cAAc,KAAK,cAC1C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,UAAI;AACJ,YAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,eAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,cAAM,YAAY,MAAM,KAAK,gBAAgB;AAC7C,cAAM,eAAe,MAAM,KAAK,iBAAiB,SAAS;AAC1D,YAAI;AACF,gBAAM,aAAa,MAAM,KAAK,YAAY,WAAW,YAAY;AACjE,eAAK,qBAAqB;AAC1B,iBAAO;AAAA,QACT,SAAS,OAAO;AACd,cACE,EAAE,iBAAiB,6BACnB,MAAM,UAAU,eAChB;AACA,kBAAM;AAAA,UACR;AACA,sBAAY;AAAA,QACd;AACA,YAAI,UAAU,IAAI,UAAU;AAC1B,gBAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,QACrD;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,qBAAqB,QACjB,UAAU,UACV;AAAA,QACJ;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,kBAAkB,OAAsB;AAC9C,QACE,iBAAiB,4BACjB,MAAM,UAAU,gBAChB;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAc,kBAA4D;AACxE,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,0BAA0B;AAAA,MACpD,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM;AAAA,QACJ,UAAU,KAAK,UAAU;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAc,iBACZ,WACuC;AACvC,QACE,UAAU,aAAa,KAAK,UAAU,YACtC,UAAU,aAAa,KAAK,UAAU,aAAa,YACnD,UAAU,aAAa,KAAK,UAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,oBAAoB,IAAI,UAAU,KAAK,GAAG;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,oBAAoB,IAAI,UAAU,KAAK;AAC5C,UAAM,YAAY,IAAI;AAAA,MACpB,KAAK,IAAI,EAAE,QAAQ,IAAI,KAAK,yBAAyB;AAAA,IACvD,EACG,YAAY,EACZ,QAAQ,SAAS,GAAG;AACvB,UAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,KAAK,UAAU;AAAA,MACzB,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,MACpB,uBAAuB,KAAK;AAAA,MAC5B,2BAA2B,KAAK;AAAA,MAChC,UAAU,KAAK;AAAA,MACf,OAAO,UAAU;AAAA,MACjB;AAAA,MACA,GAAI,KAAK,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;AAAA,IACnE;AACA,UAAM,YACJ,KAAK,kBAAmB,0BAA0B,SAC9C,MAAM,KAAK,kBAAmB,eAAe;AAAA,MAC3C,GAAG;AAAA,MACH,aAAa,UAAU;AAAA,MACvB,UAAU;AAAA,MACV,OAAO,KAAK,kBAAmB;AAAA,IACjC,CAAC,IACD,MAAM,KAAK,kBAAmB,sBAAsB,KAAK;AAC/D,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,iBAAiB;AAAA,QACf,OAAO,KAAK,kBAAmB,SAAS,UAAU,eAAe,CAAC;AAAA,QAClE,WAAW,KAAK;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YACZ,WACA,cAC6B;AAC7B,SAAK;AACL,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,mBAAmB;AAAA,MAC7C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM,EAAE,aAAa;AAAA,IACvB,CAAC;AACD,UAAM,SAAS;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,yBAAyB,OAAO,UAAU;AAAA,EACxD;AAAA,EAEA,MAAc,yBACZ,OAC6B;AAC7B,UAAM,SAAS,kCAAkC,KAAK;AACtD,QAAI,OAAO,aAAa,KAAK,UAAU,UAAU;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,cAAc;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,gBAAgB;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAWF,oBAAmB,OAAO,QAAQ;AACnD,UAAM,YAAYA,oBAAmB,OAAO,SAAS;AACrD,QACE,aAAa,YACb,YAAY,WAAW,OAAO,gBAAgB,KAC9C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa;AAAA,MAAI,CAAC,YAAY,UACxD,sBAAsB,YAAY,6BAA6B,KAAK,GAAG;AAAA,IACzE;AACA,eAAW,WAAW,cAAc;AAClC,UACE,CAAC,KAAK,uBAAuB;AAAA,QAAK,CAAC,cACjC,yBAAyB,WAAW,OAAO;AAAA,MAC7C,GACA;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,OAAO,OAAO,YAAY,YAC1B,OAAO,QAAQ,MAAM,GAAG,EAAE,WAAW,GACrC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,GAAG,QAAQ,aAAa;AAC7C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D,SAAS,EAAE,eAAe,OAAO,QAAQ;AAAA,MACzC,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,IACvD,CAAC;AACD,SAAK,wBAAwB,UAAU,WAAW;AAClD,UAAM,UAAU,qBAAqB,QAAQ;AAC7C,UAAM,SAAS,KAAK,UAAU,UAAU;AACxC,QACE,CAAC,QAAQ,UAAU,SAAS,MAAM,KAClC,QAAQ,QAAQ,SAAS,MAAM,GAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,UAAU,SAAS,MAAM,KAAK,QAAQ,QAAQ,SAAS,MAAM,IACjE,2DACA;AAAA,MACN;AAAA,IACF;AACA,SAAK,wBAAwB,oBAAoB,OAAO,OAAO;AAC/D,WAAO;AAAA,EACT;AAAA,EAEQ,wBACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,UAAU;AAAA,MACzB;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kCAAwC;AAC9C,QAAI,KAAK,iCAAiC,KAAK,IAAI,EAAE,QAAQ,GAAG;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,2BACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,aAAa;AAAA,MAC5B;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,uBACN,UACA,UACA,MACA,kBACA,MACM;AACN,UAAM,WAAW,GAAG,kBAAkB,QAAQ,CAAC,GAAG,IAAI;AACtD,UAAM,QAAQ,CAAC,YAAoB,cAAc,MAAM,OAAO;AAC9D,QACE,SAAS,aAAa,YACtB,SAAS,oBAAoB,QAC7B;AACA,YAAM;AAAA,QACJ,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,IAAI,YAAY,SAAS,eAAe,CAAC,GAAG;AAChE,YAAM,MAAM,GAAG,IAAI,4CAA4C;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,4BACN,YACA,WACM;AACN,QAAI,KAAK,gBAAgB,UAAU,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,WAAW,aAAa;AAAA,MAAK,CAAC,YAC7B,yBAAyB,SAAS,SAAS;AAAA,IAC7C,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iCACN,YACA,WACkB;AAClB,UAAM,aAAa,WAAW,aAAa;AAAA,MACzC,CAAC,eACC,WAAW,YAAY,mBACvB,WAAW,QAAQ,SAAS,oBAAoB;AAAA,IACpD;AACA,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,YAAY,QAAW;AACpC,YAAM,aACJ,WAAW,QAOX;AACF,YAAM,0BAA0B,YAAY;AAAA,QAC1C,CAAC,cACC,UAAU,SAAS,UAAU,QAC7B,UAAU,QAAQ,UAAU,OAC5B,MAAM,QAAQ,UAAU,WAAW,KACnC,gBAAgB,UAAU,WAAW,MACnC,gBAAgB,UAAU,WAAW;AAAA,MAC3C;AACA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,QACE,SAAS;AAAA,QACT,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,SAAS,CAAC,oBAAoB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gBAAgB,YAAyC;AAC/D,UAAM,YAAYA,oBAAmB,WAAW,SAAS;AACzD,WACE,YAAY,KAAK,IAAI,EAAE,QAAQ,KAAK,gCAAgC;AAAA,EAExE;AAAA,EAEA,MAAc,0BACZ,SACgC;AAChC,QAAI;AACJ,UAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,aAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,aAAK,2BAA2B,UAAU,sBAAsB;AAChE,YAAI,SAAS,UAAU,KAAK;AAC1B,sBAAY,IAAI,MAAM,mBAAmB,SAAS,MAAM,EAAE;AAAA,QAC5D,WAAW,SAAS,UAAU,KAAK;AACjC,gBAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,cAAI,WAAW,QAAW;AACxB,kBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,UAC9C;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF,OAAO;AACL,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,4BACjB,MAAM,UAAU,eAChB;AACA,gBAAM;AAAA,QACR;AACA,oBAAY;AAAA,MACd;AACA,UAAI,UAAU,IAAI,UAAU;AAC1B,cAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,MACrD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qBAAqB,QACjB,UAAU,UACV;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,SACgC;AAChC,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,WAAK,2BAA2B,UAAU,oBAAoB;AAC9D,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,mBAAmB,SAAS,MAAM;AAAA,UAClC;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,YAAI,WAAW,QAAW;AACxB,gBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,QAC9C;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA0B;AAC7C,cAAM;AAAA,MACR;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,0BACpBE,UAC8B;AAC9B,SAAO,oBAAoB,OAAOA,QAAO;AAC3C;AAEA,SAAS,eAAe,OAEtB;AACA,QAAM,aAAa,kBAAkB,OAAO,+BAA+B;AAC3E,QAAM,SAAS,gBAAgB,UAAU,UAAU;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,OAAO,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,mBAAmB,IAClE,oCACA;AAAA,MACJ,OAAO,MAAM;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAKhB;AAEA,eAAe,yBACb,WACAA,UACA;AACA,MAAI;AACF,WAAO,MAAM,qCAAqC;AAAA,MAChD,cAAc,UAAU,aAAa;AAAA,MACrC,UAAUA,SAAQ;AAAA,MAClB,UAAUA,SAAQ;AAAA,MAClB,gBAAgBA,SAAQ;AAAA,MACxB,MAAMA,SAAQ,QAAQ,MAAM,oBAAI,KAAK,IAAI,EACtC,YAAY,EACZ,QAAQ,SAAS,GAAG;AAAA,MACvB,uBAAuB;AAAA,MACvB,0BAA0B;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAMH,QAAO,0BAA0B,KAAK;AAC5C,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,0BACP,OAC8B;AAC9B,QAAMA,QACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACpD,MAA6B,OAC9B;AACN,MAAIA,UAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,MAAIA,UAAS,uCAAuC;AAClD,WAAO;AAAA,EACT;AACA,MAAIA,UAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,MAAgC;AAC7E,MAAI;AACF,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,8BACP,eACoB;AACpB,MAAI,OAAO,kBAAkB,UAAU;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,6BAA6B,IAAI,aAAa;AAChE,MAAI,cAAc,QAAW;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sCACP,OACkB;AAClB,QAAM,aAAa,kBAAkB,OAAO,8BAA8B;AAC1E,SAAO,0BAA0B,UAAU;AAC7C;AAEA,SAAS,0BACP,cACQ;AACR,QAAM,YAAY,CAAC,GAAG,YAAY,EAAE;AAAA,IAAK,CAAC,MAAM,UAC9C,GAAG,KAAK,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,MAC7C,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,MAAM,IAAI;AAAA,IACjD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,OAAO,gBAAgB,SAAS,CAAC;AACtD,QAAM,QAAQ,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AACxD,QAAM,IAAI,QAAQ,CAAC;AACnB,QAAM,IAAI,MAAM,OAAO,MAAM;AAC7B,aAAO,6BAAW,qBAAO,OAAO,OAAO,CAAC,EAAE,MAAM,CAAC;AACnD;AAEA,SAAS,wBACP,YAC0B;AAC1B,QAAM,SAAS,kCAAkC,WAAW,OAAO;AACnE,QAAM,UAAU,CAAC,UAAyB;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,uBAAuB,KAAK;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,WAAW,iBAAiB,oBAAoB,WAAW,OAAO;AACpE,YAAQ,cAAc;AACxB,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,KAAK,MAAM,WAAW,QAAQ,MAAM,OAAO;AAC7C,YAAQ,UAAU;AACpB,MAAI,KAAK,MAAM,WAAW,SAAS,MAAM,OAAO;AAC9C,YAAQ,WAAW;AACrB,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,WAAW,eAAe,OAAO,WAAY,SAAQ,YAAY;AACrE,MAAI,WAAW,sBAAsB,OAAO;AAC1C,YAAQ,mBAAmB;AAC7B,MAAI,WAAW,mBAAmB,OAAO;AACvC,YAAQ,gBAAgB;AAC1B,SAAO;AAAA,IACL,cAAc,oBAAoB,WAAW,OAAO;AAAA,IACpD,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,UAAU,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IACxE,WAAW,IAAI,KAAK,OAAO,WAAW,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IAC1E,UAAU,OAAO;AAAA,IACjB,eAAe,KAAK,MAAM,OAAO,cAAc,OAAO,cAAc,GAAI;AAAA,IACxE,cAAc,OAAO;AAAA,IACrB,SAAS,WAAW;AAAA,EACtB;AACF;AAQO,SAAS,kCACd,OACoB;AACpB,SAAO;AAAA,IACL,mBAAmB,OAAO,sBAAsB,qBAAqB;AAAA,EACvE;AACF;AAEA,SAAS,kCAAkC,SAWzC;AACA,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,iBAAiB;AACzD,UAAM,UAAU;AAAA,MACd,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,eAAe,MAAM,CAAC,CAAE,CAAC,CAAC;AAAA,IAChE;AACA,UAAM,SAAS,sBAAsB,SAAS,KAAK;AACnD,UAAM,YAAY,sBAAsB,SAAS,KAAK;AACtD,UAAM,WAAW,qBAAqB,SAAS,KAAK;AACpD,UAAM,YAAY,qBAAqB,SAAS,KAAK;AACrD,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,UAAM,iBAAiB,MAAM;AAAA,MAC3B,CAACI,UACCA,UAAS,QACT,OAAOA,UAAS,YAChB,CAAC,MAAM,QAAQA,KAAI,KACnB,mCAAmCA;AAAA,IACvC;AACA,QAAI,eAAe,WAAW;AAC5B,YAAM,IAAI,MAAM,0CAA0C;AAC5D,UAAM,OAAO,eAAe,CAAC;AAC7B,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,IACF;AACA,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,kCAAkC;AACpD,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,iCAAiC;AACnD,UAAM,MAAM,QAAQ;AACpB,QAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjE,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,UAAM,eAAmC,CAAC;AAC1C,eAAW,CAAC,UAAU,YAAY,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC1D,UACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,YAAY;AAClB,YAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,UAAI,CAAC,SAAS,WAAW,YAAY,KAAK,SAAS;AACjD,cAAM,IAAI,MAAM,2BAA2B;AAC7C,YAAM,QAAQ,SAAS,MAAM,GAAG,MAAM;AACtC,YAAM,OAAO,SAAS,MAAM,SAAS,QAAQ,MAAM;AACnD,iBAAW,CAAC,QAAQ,UAAU,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC5D,cAAM,UAAU,OAAO,WAAW,gBAAgB,IAC9C,kBACA,OAAO,WAAW,eAAe,IAC/B,iBACA;AACN,YAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,UAAU;AAChB,YAAI,YAAY,OAAW,OAAM,IAAI,MAAM,0BAA0B;AACrE,cAAM,QAAQ,QAAQ,CAAC;AACvB,qBAAa;AAAA,UACX,0BAA0B;AAAA,YACxB;AAAA,YACA;AAAA,YACA;AAAA,YACA,SAAS,CAAC,MAAM;AAAA,YAChB,GAAI,UAAU,QACd,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,SAAS,IACxB,EAAE,SAAS,MAAM,IACjB,CAAC;AAAA,UACP,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAClE,UAAM,WAAW,OAAO,QAAQ,GAAG;AACnC,UAAM,YAAY,WAAW,IAAI,SAAS,OAAO,MAAM,GAAG,QAAQ;AAClE,QAAI,CAAC,UAAU,WAAW,MAAM,KAAK,CAAC,UAAU,WAAW,MAAM,GAAG;AAClE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC7G;AAAA,EACF;AACF;AAEA,SAAS,sBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,qBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,QAAQ,GAAG,sCAAsC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE;AAEA,SAAS,mBACP,OACA,QACA,OACG;AACH,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,QAAW;AACxB,UAAM,eAAe,MAAM;AAAA,EAC7B;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,uBAAuB,OAAO,MAAM,OAAO;AAAA,IACrD;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AA2CA,SAAS,qBACP,UACuC;AACvC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,yCAAyC,SAAS,MAAM;AAAA,MACxD,SAAS,UAAU,MAAM,YAAY;AAAA,MACrC;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,sBAAsB,UAAU,UAAU;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,oDAAoD,OAAO,MAAM,OAAO;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,sBACP,UACA,QACA,OACG;AACH,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,kBAAkB,SAAS,MAAM,KAAK,iBAAiB,SAAS,IAAI,CAAC;AAAA,MAC7E;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,iBAAiB,iBAAiB,SAAS,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,qCAAqC,OAAO,MAAM,OAAO;AAAA,IACnE;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAC7C,UAAM,SAAS;AACf,UAAMC,QAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAC7D,UAAM,UACJ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACxD,QAAIA,UAAS;AACX,aAAO,YAAY,SAAYA,QAAO,GAAGA,KAAI,KAAK,OAAO;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,SAAyB;AAC3D,QAAMC,UAAS,OAAa,QAAM,sBAAO,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC,CAAC;AAC3E,SAAO,IAAI,SAAS,IAAMA,OAAM,EAAE,SAAS;AAC7C;AAEA,SAAS,cAAc,SAAiD;AACtE,SAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI;AAChE;AAEA,eAAe,4BACb,UACA,WAC8B;AAC9B,SAAO,iCAAiC,UAAU,WAAW,YAAY;AAC3E;AAEA,eAAe,iCACb,UACA,WACA,MAC8B;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,UAAM,cAAc,MAAM,GAAG,IAAI,wBAAwB;AAAA,EAC3D;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,SAAS,MACb,IAAI,WAAW,IACf;AACA,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,UAAU,oBAAoB,QAAW;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,UAAU,gBAAgB,IAAI,MAAM;AAAA,EACzD,SAAS,OAAO;AACd,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,MAAI,WAAW,UAAU,WAAW,GAAG;AACrC,UAAM,cAAc,MAAM,GAAG,IAAI,oCAAoC;AAAA,EACvE;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,WAAW,WAAW,WAAW;AAC1C,UAAM,aAAa,YAAY,OAAO;AACtC,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,YAAM;AAAA,QACJ;AAAA,QACA,GAAG,IAAI,+CAA+C,OAAO;AAAA,MAC/D;AAAA,IACF;AACA,cAAU,IAAI,UAAU;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,cACP,MACA,SAC0B;AAC1B,SAAO,IAAI;AAAA,IACT,SAAS,eACL,0CACA;AAAA,IACJ;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,YAAY,EAAE,QAAQ,YAAY,EAAE;AACnD;AAEA,SAAS,WAAW,OAAwB;AAC1C,QAAM,KAAK,YAAY,KAAK;AAC5B,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MACE,MAAM,WAAW,KACjB,MAAM,MAAM,CAAC,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,GAC/D;AACA,UAAM,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM;AAC/B,WAAO,EACL,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,KACnB,MAAM,OAAO,MAAM,OACnB,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MAAM,MAAM,CAAC,MAAM,SACtC,MAAM,OAAO,MAAM,KAAK,MAAM,CAAC,MAAM,SACtC,KAAK;AAAA,EAET;AACA,MAAI,CAAC,GAAG,SAAS,GAAG,EAAG,QAAO;AAC9B,MACE,OAAO,QACP,OAAO,SACP,GAAG,WAAW,WAAW,KACzB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI;AAElB,WAAO;AACT,QAAM,SAAS,GAAG,MAAM,+BAA+B;AACvD,MAAI,WAAW,KAAM,QAAO,WAAW,OAAO,CAAC,CAAE;AACjD,QAAM,YAAY,GAAG,MAAM,0CAA0C;AACrE,MAAI,cAAc,MAAM;AACtB,UAAM,OAAO,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC9C,UAAM,MAAM,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC7C,WAAO,WAAW,GAAG,QAAQ,CAAC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,gBACP,OAGY;AACZ,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,aAAa,UAAU,UAAU;AAChD,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,MAAM,OAAO,KAAK,MAAM,SAAS,OAAO,KAAK,QAAQ;AAAA,EAChE;AACA,QAAM,WAAW,0BAA0B,UAAU,UAAU;AAC/D,MAAI,SAAS,SAAS;AACpB,WAAO;AAAA,MACL,MAAM,SAAS,KAAK,MAAM;AAAA,MAC1B,SAAS,SAAS,KAAK,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QAC0B;AAC1B,QAAM,cACJ,OAAO,SAAS,qBAChB,OAAO,SAAS,oBAChB,OAAO,SAAS;AAClB,SAAO,IAAI;AAAA,IACT,wBAAwB,OAAO,IAAI;AAAA,IACnC,OAAO,WAAW,wBAAwB,OAAO,IAAI;AAAA,IACrD,cAAc,iBAAiB;AAAA,IAC/B,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,WAAW,SAAiB,QAAwB;AAC3D,QAAMC,QAAO,KAAK,IAAI,qCAAqC,KAAK,KAAK,OAAO;AAC5E,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,MAAMA,SAAQ,MAAM,OAAO;AAAA,EAClC;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AACpD;AAEA,SAAS,kBACP,OACAF,OACS;AACT,MAAI;AACF,WAAO,cAAc,KAAK;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAASG,oBAAmB,OAAmC;AAC7D,MACE,CAAC,+EAA+E;AAAA,IAC9E;AAAA,EACF,GACA;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,QAAM,WAAW,KAAK,MAAM,KAAK;AACjC,SAAO,KAAK,MAAM,SAAS,MAAM,WAAW,SAAS;AACvD;;;A4B79DA,0BAIO;AAiBA,SAAS,sBAAsB,WAA2B;AAC/D,QAAM,aAAS,oCAAe,SAAS;AACvC,aAAO,oCAAe,gBAAgB,OAAO,QAAQ,GAAG,OAAO,IAAI;AACrE;AAEO,SAAS,wBACd,WAC0B;AAC1B,QAAM,YAAY,sBAAsB,SAAS;AACjD,aAAO,oCAAe,SAAS;AACjC;;;ACtBA,IAAAC,cAAkB;AAUlB,IAAM,yBAAyB;AASxB,IAAMC,iBAAgB,cAAE,OAAO;AAAA;AAAA,EAEpC,QAAQ,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAEvC,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAWM,IAAM,kCAAkC,cAAE,OAAO;AAAA;AAAA,EAEtD,kBAAkB,cAAE,OAAO;AAAA,IACzB,eAAe,cAAE,OAAO;AAAA,EAC1B,CAAC;AAAA;AAAA,EAED,eAAe,cAAE,OAAO;AAAA;AAAA,EAExB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,QAAQ,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAElD,oBAAoB,cAAE,OAAO;AAC/B,CAAC;AAeM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,SAAS,cACN,OAAO,EACP,MAAM,wBAAwB,0BAA0B;AAAA;AAAA,EAE3D,SAAS,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEnC,YAAY,cAAE,OAAO;AAAA;AAAA,EAErB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,kBAAkB,gCAAgC,SAAS;AAAA;AAAA,EAE3D,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE/C,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE/C,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,KAAKA,eAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5B,gBAAgB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAC/C,CAAC;AAaM,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,SAAS,cAAE,OAAO,EAAE,MAAM,wBAAwB,0BAA0B;AAAA;AAAA,EAE5E,SAAS,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEnC,YAAY,cAAE,OAAO;AAAA;AAAA,EAErB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,QAAQ,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAElD,eAAe,cAAE,OAAO;AAAA;AAAA,EAExB,kBAAkB,cAAE,OAAO;AAAA,IACzB,eAAe,cAAE,OAAO;AAAA,EAC1B,CAAC;AAAA;AAAA,EAED,oBAAoB,cAAE,OAAO;AAAA;AAAA,EAE7B,KAAK,cAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA;AAAA,EAE9B,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,WAAW,cAAE,OAAO;AACtB,CAAC;AAoCM,SAAS,6BACd,MAC+C;AAC/C,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,OAAO,MAAM;AAAA,QACtB,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;AC3LA,IAAAC,uBA4BO;;;ACdP,IAAAC,uBAAsC;;;AC+ItC,SAAS,4BAA6C;AACpD,SAAO,IAAI,MAAM,CAAC,GAAsB;AAAA,IACtC,KAAK,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAwBO,IAAM,QAAN,MAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAenC,YAAY,QAAqB;AAC/B,SAAK,MAAM,OAAO;AAClB,SAAK,QAAQ,OAAO;AACpB,SAAK,MAAM,OAAO,SAAS,OAAO,EAAE;AACpC,SAAK,SAAS,OAAO,YAAY,OAAO,EAAE;AAC1C,SAAK,WAAW,OAAO,gBAAgB,OAAO,EAAE,KAAK,0BAA0B;AAC/E,SAAK,eAAe,OAAO,kBAAkB,OAAO,EAAE;AACtD,SAAK,WAAW,OAAO,cAAc,OAAO,EAAE;AAC9C,SAAK,WAAW,OAAO;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,KAAa;AACf,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,OAAe;AACjB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,KAAiB;AACnB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,QAA2B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,UAA2B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,cAAuC;AACzC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,UAA+B;AACjC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAiD;AACrD,WAAO,KAAK,SAAS,KAAK,GAAG;AAAA,EAC/B;AACF;;;AC7QA,IAAAC,cAAkB;;;ACAlB,IAAAC,cAAkB;AAyCX,IAAM,YAAY,cAAE,OAAO;AAAA;AAAA,EAEhC,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AACxC,CAAC;AAWM,IAAM,gBAAgB,cAAE,KAAK,CAAC,QAAQ,WAAW,UAAU,CAAC;AAM5D,IAAM,gBAAgB,cAAE,OAAO;AAAA;AAAA,EAEpC,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,MAAM;AAAA;AAAA,EAEN,KAAK,UAAU,SAAS;AAAA;AAAA,EAExB,UAAU,cAAE,OAAO;AACrB,CAAC;AAWM,IAAM,wBAAwB,cAAE,OAAO;AAAA;AAAA,EAE5C,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,SAAS,cAAE,QAAQ,YAAY;AAAA;AAAA,EAE/B,OAAO,cAAE,WAAW,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,EAAE,SAAS;AACnD,CAAC;AAOM,IAAM,uBAAuB;AAAA,EAClC,eAAe;AAAA,EACf,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,SAAS;AAAA,EACT,eAAe;AAAA,EACf,SAAS;AAAA,EACT,SAAS;AAAA,EACT,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,wBAAwB;AAAA,EACxB,mBAAmB;AAAA,EACnB,kBAAkB;AACpB;AAYO,IAAM,mBAAmB,cAAE,OAAO;AAAA;AAAA,EAEvC,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAE7D,QAAQ,cAAE,OAAO,KAAK;AAAA;AAAA,EAEtB,WAAW,cAAE,QAAQ;AAAA;AAAA,EAErB,cAAc,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,oBAAoB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,cAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAKM,IAAM,yBAAyB,cAAE,OAAO;AAAA,EAC7C,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,QAAQ,cAAE,KAAK,CAAC,UAAU,WAAW,WAAW,eAAe,WAAW,CAAC;AAAA,EAC3E,QAAQ,cAAE,QAAQ;AAAA,EAClB,QAAQ,cAAE,QAAQ;AAAA,EAClB,SAAS,cAAE,QAAQ;AAAA,EACnB,SAAS,cAAE,QAAQ;AACrB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,QAAM,QAAQ,MAAM,WAAW,WAC3B,MAAM,UAAU,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,MAAM,UACzD,MAAM,WAAW,gBACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UAC1D,CAAC,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM;AACrE,MAAI,CAAC,OAAO;AACV,YAAQ,SAAS;AAAA,MACf,MAAM,cAAE,aAAa;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAIM,IAAM,oCAAoC,cAAE,OAAO;AAAA,EACxD,SAAS,cAAE,QAAQ,IAAI;AAAA,EACvB,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC,EAAE,OAAO;AAIH,IAAM,kCAAkC,cAAE,OAAO;AAAA,EACtD,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3B,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,CAAC;AACpD,CAAC,EAAE,OAAO;AAEV,IAAM,8BAA8B,cACjC,OAAO,EACP,SAAS,EAAE,QAAQ,KAAK,CAAC,EACzB,UAAU,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC;AAEhC,IAAM,gCAAgC,cAAE,OAAO;AAAA,EACpD,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,KAAK,CAAC,WAAW,UAAU,CAAC;AAAA,EACzC,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAW,cAAE,MAAM,+BAA+B;AAAA,EAClD,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3B,UAAU,4BAA4B,SAAS;AAAA,EAC/C,WAAW,4BAA4B,SAAS;AAAA,EAChD,WAAW,4BAA4B,SAAS;AAAA,EAChD,QAAQ,cAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC;AAAA,EAC9E,WAAW,4BAA4B,SAAS,EAAE,SAAS;AAAA,EAC3D,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAC1C,CAAC,EAAE,OAAO;AAEH,IAAM,8BAA8B,cAAE,OAAO;AAAA,EAClD,eAAe,cAAE,QAAQ,CAAC;AAAA,EAC1B,OAAO,cAAE,MAAM,6BAA6B;AAAA,EAC5C,YAAY,cAAE,OAAO,EAAE,SAAS;AAClC,CAAC,EAAE,OAAO;AAMH,IAAM,sCAAsC,cAAE,OAAO;AAAA,EAC1D,WAAW,cAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC,EAAE,SAAS;AAAA,EAC3D,QAAQ,cAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC,EAAE,SAAS;AAAA,EACzF,OAAO,cAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,OAAO,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC,EAAE,OAAO;AAOH,IAAM,wBAAwB,cAAE,OAAO;AAAA;AAAA,EAE5C,UAAU,cAAE,OAAO;AAAA;AAAA,EAEnB,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,MAAM,cAAE,MAAM,aAAa;AAAA;AAAA,EAE3B,YAAY;AAAA;AAAA,EAEZ,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAOM,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,OAAO,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,cAAE,QAAQ;AAAA;AAAA,EAErB,WAAW,cAAE,OAAO,KAAK;AAAA;AAAA,EAEzB,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,+BAA+B,cAAE,OAAO;AAAA;AAAA,EAEnD,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,sBAAsB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,wBAAwB,cAAE,MAAM,gBAAgB;AAMtD,IAAM,0BAA0B,cAAE,OAAO;AAAA;AAAA,EAE9C,MAAM;AAAA;AAAA,EAEN,OAAO,cAAE,MAAM,gBAAgB;AAAA;AAAA,EAE/B,MAAM;AACR,CAAC;AAWM,IAAM,4BAA4B,cAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC;AAMvE,IAAM,0BAA0B,cAAE,OAAO;AAAA;AAAA,EAE9C,WAAW,0BAA0B,SAAS;AAAA;AAAA,EAE9C,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,gBAAgB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,SAAS,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAElC,OAAO,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,QAAQ,cAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAWM,IAAM,uBAAuB,cAAE,KAAK,CAAC,SAAS,WAAW,CAAC;AAM1D,IAAM,kBAAkB,cAAE,OAAO;AAAA;AAAA,EAEtC,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,MAAM;AAAA;AAAA,EAEN,aAAa,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAWM,IAAM,oBAAoB,cAAE,KAAK,CAAC,UAAU,WAAW,MAAM,CAAC;AAM9D,IAAM,kBAAkB,cAAE,OAAO;AAAA;AAAA,EAEtC,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,YAAY;AAAA;AAAA,EAEZ,QAAQ;AAAA;AAAA,EAER,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,aAAa,cAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAOM,SAAS,0BAAkD,YAAe;AAC/E,SAAO,cAAE,OAAO;AAAA;AAAA,IAEd,MAAM;AAAA;AAAA,IAEN,YAAY;AAAA;AAAA,IAEZ,SAAS,cAAE,OAAO;AAAA;AAAA,IAElB,MAAM,cAAE,OAAO;AAAA,EACjB,CAAC;AACH;AAEO,IAAM,sBAAsB,0BAA0B,cAAE,QAAQ,CAAC;AAejE,IAAM,sBAAsB,cAAE,OAAO;AAAA;AAAA,EAE1C,SAAS,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE9B,eAAe,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEpC,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,kBAAkB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEvC,UAAU,cAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAWM,IAAM,4BAA4B,cAAE,OAAO;AAAA;AAAA,EAEhD,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,QAAQ,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,QAAQ,kBAAkB,SAAS;AAAA;AAAA,EAEnC,aAAa,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,SAAS,cAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAeM,IAAM,gCAAgC,cAAE,OAAO;AAAA;AAAA,EAEpD,OAAO,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,gBAAgB,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE3C,SAAS,cAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,QAAQ,cAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA+B,OAAO,QAAQ;AAAA,IAC/C,EAAE,SAAS,8BAA8B;AAAA,EAC3C;AAAA;AAAA,EAEA,WAAW,cAAE,QAAQ,EAAE;AAAA,IACrB,CAAC,QAAkC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACvE,EAAE,SAAS,8CAA8C;AAAA,EAC3D,EAAE,SAAS;AAAA;AAAA,EAEX,OAAO,cAAE,QAAQ,EAAE;AAAA,IACjB,CAAC,QAA8B,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,yCAAyC;AAAA,EACtD,EAAE,SAAS;AACb,CAAC;AAOM,IAAM,oBAAoB,cAAE,OAAO;AAAA;AAAA,EAExC,kBAAkB,cAAE,QAAQ,EAAE;AAAA,IAC5B,CAAC,QAAkD,OAAO,QAAQ;AAAA,IAClE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,cAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA0C,OAAO,QAAQ;AAAA,IAC1D,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,cAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAAmD,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AACF,CAAC;AAWM,IAAM,8BAA8B,cAAE,OAAO;AAAA;AAAA,EAElD,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,KAAK,cAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAqBM,IAAM,0BAA0B,cAAE,OAAO;AAAA;AAAA,EAE9C,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAC/D,CAAC;AAgBM,IAAM,mCAAmC,cAAE,OAAO;AAAA;AAAA,EAEvD,SAAS,cAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,cAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBlB,WAAW,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,CAAC,CAAC;AAAA;AAAA,EAEzE,gBAAgB,cAAE,OAAO;AAAA;AAAA,EAEzB,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAYM,IAAM,mCAAmC,cAAE,OAAO;AAAA;AAAA,EAEvD,YAAY,cAAE,OAAO;AAAA;AAAA,EAErB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,QAAQ,cAAE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,WAAW,cAAE,MAAM,uBAAuB;AAC5C,CAAC;;;ADlqBM,IAAM,oBAAoB,cAAE,OAAO;AAAA;AAAA,EAExC,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,UAAU,cAAE,SAAS;AAAA;AAAA,EAErB,aAAa,cAAE,SAAS;AAAA;AAAA,EAExB,eAAe,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,mBAAmB,cAAE,SAAS;AAAA;AAAA,EAE9B,eAAe,cAAE,SAAS;AAAA;AAAA,EAE1B,SAAS,cAAE,SAAS;AACtB,CAAC;AAcM,IAAM,2BAA2B,cAAE,OAAO;AAAA;AAAA,EAE/C,OAAO,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,SAAS,cAAE,QAAQ;AAAA;AAAA,EAEnB,QAAQ,cAAE,SAAS;AAAA;AAAA,EAEnB,OAAO,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE7B,oBAAoB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEzC,iBAAiB,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAEvC,oBAAoB,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE1C,sBAAsB,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE5C,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,gBAAgB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,kBAAkB,cAAE,SAAS,EAAE,SAAS;AAC1C,CAAC;AAaM,IAAM,8BAA8B,6BAA6B,OAAO;AAAA;AAAA,EAE7E,SAAS,cAAE,OAAO;AACpB,CAAC;AAsHM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,UAAU,cAAE,OAAO;AAAA;AAAA,EAEnB,SAAS,cAAE,MAAM,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAAA;AAAA,EAE3D,QAAQ,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE5B,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEhC,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,cAAc,cAAE;AAAA,IACd,cAAE,OAAO;AAAA,MACP,UAAU,cAAE,OAAO;AAAA,MACnB,SAAS,cAAE,OAAO;AAAA,IACpB,CAAC;AAAA,EACH;AACF,CAAC;AAQM,IAAM,kCAAkC,cAAE;AAAA,EAC/C,cAAE,OAAO;AAAA,EACT;AACF;AAQO,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAIM,IAAM,kCAAkC,cAAE,MAAM,sBAAsB;AAOtE,IAAM,kCAAkC,cAAE,OAAO;AAAA;AAAA,EAEtD,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,gCAAgC,cAAE,OAAO;AAAA;AAAA,EAEpD,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,MAAM,cAAE,KAAK,CAAC,SAAS,WAAW,CAAC,EAAE,SAAS;AAAA;AAAA,EAE9C,aAAa,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAcM,SAAS,kCACd,MACoD;AAEpD,MAAI,SAAS,QAAQ,SAAS,QAAW;AACvC,WAAO,EAAE,IAAI,MAAM,MAAM,CAAC,EAAE;AAAA,EAC9B;AAGA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO,EAAE,IAAI,MAAM,MAAM,CAAC,EAAE;AAAA,EAC9B;AAEA,QAAM,SAAS,gCAAgC,UAAU,IAAI;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,wCAAwC,OAAO,MAAM,OAAO;AAAA,QACrE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,kCACd,MACoD;AACpD,QAAM,SAAS,gCAAgC,UAAU,IAAI;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,yCAAyC,OAAO,MAAM,OAAO;AAAA,QACtE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,kCACd,MACoD;AACpD,QAAM,SAAS,gCAAgC,UAAU,IAAI;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,yCAAyC,OAAO,MAAM,OAAO;AAAA,QACtE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,gCACd,MACkD;AAClD,QAAM,SAAS,8BAA8B,UAAU,IAAI;AAC3D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,uCAAuC,OAAO,MAAM,OAAO;AAAA,QACpE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;AEhZA,IAAM,eAAe,KAAK,KAAK;AAS/B,IAAM,qBAAqB,IAAI,KAAK;AAUpC,IAAM,aAAa,IAAI,KAAK,KAAK,KAAK;AAUtC,IAAM,WAAW,IAAI,KAAK,KAAK,KAAK;AASpC,IAAM,SAAS,KAAK,KAAK,KAAK,KAAK;AASnC,IAAM,SAAS,KAAK,MAAM,KAAK,KAAK,KAAK;AAElC,IAAM,SAAS;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oCAAoC,OAAO;;;AJ1BxD,IAAM,eAAe;AAErB,SAAS,eAAe,GAAW,GAAgC;AACjE,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,WAAO,mBAAmB,GAAG,CAAC;AAAA,EAChC,QAAQ;AACN,WAAO,MAAM;AAAA,EACf;AACF;AAKO,IAAM,kBAAkB;AAAA;AAAA,EAE7B,WAAW;AAAA;AAAA,EAEX,gBAAgB;AAAA;AAAA,EAEhB,iBAAiB;AAAA;AAAA,EAEjB,eAAe;AAAA;AAAA,EAEf,cAAc;AAAA;AAAA,EAEd,eAAe;AAAA;AAAA,EAEf,iBAAiB;AACnB;AA8HO,SAAS,kBAAkB,SAAiB,SAAyB;AAC1E,SAAO,eAAe,SAAS,SAAS,QAAQ;AAClD;AAeO,SAAS,cACd,KAC4E;AAE5E,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,CAAC,EAAE,SAAS,SAASC,KAAI,IAAI;AACnC,QAAI;AACF,YAAM,gBAAgB,OAAO,OAAO;AACpC,YAAM,mBAAmB,oBAAoB,OAAO;AACpD,aAAO;AAAA,QACL,OAAO,OAAO,kBAAkB,aAAa;AAAA,QAC7C,MAAAA;AAAA,QACA,SAAS,OAAO,aAAa;AAAA,QAC7B,SAAS;AAAA,MACX;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,OAAO;AAAA;AAAA,MACP,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,cAAc,OAAeA,OAAsB;AACjE,QAAM,MAAM,YAAY,KAAK;AAC7B,MAAI,KAAK;AACP,WAAO,eAAe,IAAI,SAAS,IAAI,SAASA,KAAI;AAAA,EACtD;AAEA,SAAO,aAAa,KAAK,IAAIA,KAAI;AACnC;AAkBA,SAAS,2BACP,eACA,gBACc;AACd,QAAM,SAAuB,CAAC;AAE9B,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,aAAa,GAAG;AAEvD,UAAM,eAAe,KAAK;AAC1B,QAAI,OAAO;AACX,QAAI,UAAU;AACd,UAAM,UAAoB,CAAC;AAE3B,eAAW,OAAO,cAAc;AAC9B,cAAQ,KAAK,IAAI,OAAO;AAGxB,YAAM,gBAAgB,IAAI,SAAS;AAAA,QACjC;AAAA,MACF;AACA,UAAI,eAAe;AACjB,kBAAU,cAAc,CAAC;AACzB,eAAO,cAAc,CAAC,KAAK;AAAA,MAC7B;AAAA,IACF;AAGA,UAAM,oBAAoB,KAAK,SAAS,KAAK,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAEtF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,QAAQ;AAAA,MACnF,WAAW;AAAA,MACX,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,MACvD,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAiCO,IAAM,eAAN,MAA4C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BjD,YAAY,QAA4B;AAbxC;AAAA,SAAQ,aAAkC,oBAAI,IAAI;AAGlD;AAAA,SAAQ,YAAgE,oBAAI,IAAI;AAGhF;AAAA,SAAiB,WAAW,IAAI,KAAK;AAQnC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,qBAAqB,OAAO;AACjC,SAAK,oBAAoB,OAAO;AAChC,SAAK,uBAAuB,OAAO;AACnC,SAAK,yBAAyB,OAAO;AACrC,SAAK,WAAW,OAAO;AACvB,SAAK,iBAAiB,OAAO;AAC7B,SAAK,qBAAqB,OAAO;AACjC,SAAK,sBAAsB,OAAO;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAA2C;AACtD,QAAI,OAAO,MAAO,MAAK,QAAQ,OAAO;AACtC,QAAI,OAAO,QAAS,MAAK,UAAU,OAAO;AAC1C,QAAI,OAAO,OAAQ,MAAK,SAAS,OAAO;AACxC,QAAI,OAAO,MAAO,MAAK,UAAU,OAAO;AACxC,QAAI,OAAO,mBAAoB,MAAK,qBAAqB,OAAO;AAChE,QAAI,OAAO,gBAAiB,MAAK,oBAAoB,OAAO;AAC5D,QAAI,OAAO,mBAAoB,MAAK,uBAAuB,OAAO;AAClE,QAAI,OAAO,qBAAsB,MAAK,yBAAyB,OAAO;AACtE,QAAI,OAAO,YAAY,OAAW,MAAK,WAAW,OAAO;AACzD,QAAI,OAAO,eAAgB,MAAK,iBAAiB,OAAO;AACxD,QAAI,OAAO,iBAAkB,MAAK,qBAAqB,OAAO;AAC9D,QAAI,OAAO,kBAAmB,MAAK,sBAAsB,OAAO;AAGhE,SAAK,WAAW,MAAM;AACtB,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,oBAAwC;AACtC,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,UAA8B;AAExC,QAAI,KAAK,UAAU;AACjB,aAAO,KAAK;AAAA,IACd;AAGA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,OAAmD;AACvD,QAAI,CAAC,KAAK,SAAS;AACjB,iBAAO;AAAA,YACL,mCAAa,gBAAgB,eAAe,2BAA2B,YAAY;AAAA,MACrF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAsB,CAAC;AAG7B,YAAM,cAAc,MAAM,KAAK,gBAAgB;AAC/C,UAAI,YAAY,IAAI;AAClB,eAAO,KAAK,GAAG,YAAY,IAAI;AAAA,MACjC;AAGA,UAAI,KAAK,oBAAoB;AAC3B,cAAM,kBAAkB,KAAK,wBAAwB;AACrD,eAAO,KAAK,GAAG,eAAe;AAAA,MAChC;AAGA,YAAM,eAAe,KAAK,kBAAkB,MAAM;AAClD,iBAAW,SAAS,cAAc;AAChC,aAAK,sBAAsB,KAAK;AAAA,MAClC;AAEA,iBAAO,yBAAG,YAAY;AAAA,IACxB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,0BAA0B,OAAO,KAAK,CAAC;AAAA,UACvC;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAA8D;AAC1E,QAAI;AACF,YAAM,UAAU,KAAK,OAAO,KAAK,SAAS,SAAS,IAAI,sBAAsB;AAE7E,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,MAAM,EAAE,QAAQ,SAAS,OAAO,EAAE;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,YAAM,mBAAmB,kCAAkC,OAAO;AAClE,UAAI,CAAC,iBAAiB,IAAI;AACxB,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,iBAAiB,MAAM;AAAA,YACvB;AAAA,YACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAsB,iBAAiB,KAAK,IAAI,CAAC,UAAU;AAAA,QAC/D,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,kBAAkB,KAAK,EAAE;AAAA,QACjD,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,aAAa,CAAC,GAAG;AAAA;AAAA,MACnB,EAAE;AAEF,iBAAO,yBAAG,MAAM;AAAA,IAClB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,uCAAuC,OAAO,KAAK,CAAC;AAAA,UACpD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,0BAAuC;AAC7C,QAAI,CAAC,KAAK,oBAAoB;AAC5B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,SAAiC,oBAAI,IAAI;AAG/C,UAAM,eAAe,KAAK,mBAAmB,mBAAmB;AAEhE,eAAW,cAAc,cAAc;AACrC,YAAM,UAAU,WAAW,WAAW;AAGtC,UAAI,OAAO,IAAI,OAAO,GAAG;AACvB,cAAM,WAAW,OAAO,IAAI,OAAO;AAEnC,YAAI,SAAS,aAAa;AACxB,gBAAM,UAAU,WAAW,WAAW;AACtC,qBAAW,UAAU,SAAS;AAC5B,gBAAI,CAAC,SAAS,YAAY,SAAS,MAAM,GAAG;AAC1C,uBAAS,YAAY,KAAK,MAAM;AAAA,YAClC;AAAA,UACF;AAAA,QACF;AACA;AAAA,MACF;AAGA,UAAI,YAAY,KAAK,SAAS,SAAS;AACrC;AAAA,MACF;AAEA,YAAM,SAAS,cAAc,OAAO;AAEpC,aAAO,IAAI,SAAS;AAAA,QAClB,IAAI;AAAA,QACJ,MAAM,QAAQ,QAAQ,KAAK,kBAAkB,OAAO;AAAA,QACpD,OAAO,WAAW,WAAW,gBAAgB,QAAQ,SAAS;AAAA,QAC9D,MAAM;AAAA,QACN,aAAa,CAAC,GAAG,WAAW,WAAW,OAAO;AAAA,QAC9C,WAAW,WAAW;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,WAAO,MAAM,KAAK,OAAO,OAAO,CAAC;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,IAAoB;AAC5C,UAAM,SAAS,cAAc,EAAE;AAC/B,QAAI,QAAQ;AACV,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,WAAO,MAAM,MAAM,SAAS,CAAC,KAAK;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,QAAkC;AAC1D,UAAM,OAAO,oBAAI,IAAuB;AAExC,eAAW,SAAS,QAAQ;AAC1B,YAAM,WAAW,KAAK,IAAI,MAAM,EAAE;AAClC,UAAI,CAAC,YAAa,SAAS,SAAS,eAAe,MAAM,SAAS,SAAU;AAC1E,aAAK,IAAI,MAAM,IAAI,KAAK;AAAA,MAC1B;AAAA,IACF;AAEA,WAAO,MAAM,KAAK,KAAK,OAAO,CAAC;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAOA,OAAwD;AACnE,QAAI,CAAC,KAAK,SAAS;AACjB,iBAAO;AAAA,YACL,mCAAa,gBAAgB,eAAe,2BAA2B,YAAY;AAAA,MACrF;AAAA,IACF;AAGA,QAAI,CAACA,SAAQ,CAAC,mBAAmB,KAAKA,KAAI,GAAG;AAC3C,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,OAAO,KAAK,SAAS,SAASA,OAAM,wBAAwB;AAEjF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,MAAAA,MAAK,CAAC;AAAA,MAC/B,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,UAAUA,KAAI;AAAA,cACd;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,2BAA2B,SAAS,MAAM,MAAM,SAAS;AAAA,YACzD;AAAA,YACA,EAAE,MAAM,EAAE,QAAQ,SAAS,OAAO,EAAE;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,YAAM,mBAAmB,kCAAkC,OAAO;AAClE,UAAI,CAAC,iBAAiB,IAAI;AACxB,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,iBAAiB,MAAM;AAAA,YACvB;AAAA,YACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,YAAuB;AAAA,QAC3B,IAAI,iBAAiB,KAAK;AAAA,QAC1B,MAAM,iBAAiB,KAAK,QAAQA;AAAA,QACpC,OAAO,iBAAiB,KAAK,SAAS,KAAK,WAAW;AAAA,QACtD,MAAM;AAAA,QACN,aAAa,CAAC,GAAG;AAAA,MACnB;AAGA,WAAK,UAAU,IAAI,UAAU,IAAI,EAAE,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,CAAC;AAC1E,WAAK,sBAAsB,SAAS;AAEpC,iBAAO,yBAAG,SAAS;AAAA,IACrB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,iCAAiC,OAAO,KAAK,CAAC;AAAA,UAC9C;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,sBAAsB,OAAwB;AACpD,QAAI,CAAC,KAAK,oBAAqB;AAC/B,SAAK,QAAQ,QAAQ,KAAK,oBAAoB,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAGlE,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,IAAI,WAA2B;AAE7B,UAAM,UAAU,KAAK,eAAe,SAAS;AAG7C,UAAM,SAAS,KAAK,WAAW,IAAI,OAAO;AAC1C,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AAGA,UAAM,SAAS,cAAc,OAAO;AACpC,UAAMA,QAAO,QAAQ,QAAQ,KAAK,kBAAkB,OAAO;AAE3D,UAAM,SAAsB;AAAA,MAC1B,IAAI;AAAA,MACJ,MAAAA;AAAA,MACA,UAAU,KAAK,oBAAoB,KAAK,IAAI;AAAA,MAC5C,aAAa,KAAK,uBAAuB,KAAK,IAAI;AAAA,MAClD,eAAe,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACtD,mBAAmB,KAAK,6BAA6B,KAAK,IAAI;AAAA,MAC9D,eAAe,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACtD,SAAS,KAAK,aAAa,KAAK,IAAI;AAAA,IACtC;AAEA,UAAM,QAAQ,IAAI,MAAM,MAAM;AAC9B,SAAK,WAAW,IAAI,SAAS,KAAK;AAElC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,WAA2B;AAChD,UAAM,SAAS,cAAc,SAAS;AAEtC,QAAI,CAAC,QAAQ;AAEX,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,OAAO;AAEhB,aAAO;AAAA,IACT;AAGA,QAAI,KAAK,SAAS;AAChB,aAAO,cAAc,KAAK,SAAS,OAAO,IAAI;AAAA,IAChD;AAGA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAO,WAA2D;AACtE,UAAM,UAAU,KAAK,eAAe,SAAS;AAG7C,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO;AACzC,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,UAAU;AAC1D,iBAAO,yBAAG,IAAI;AAAA,IAChB;AAGA,UAAM,aAAa,MAAM,KAAK,aAAa,OAAO;AAClD,eAAO,yBAAG,WAAW,EAAE;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,aAAa,SAA2D;AAEpF,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO;AACzC,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,UAAU;AAC1D,iBAAO,yBAAG,OAAO,IAAI;AAAA,IACvB;AAEA,QAAI,CAAC,KAAK,SAAS;AACjB,iBAAO;AAAA,YACL,mCAAa,gBAAgB,eAAe,2BAA2B,YAAY;AAAA,MACrF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,OAAO,KAAK,SAAS,SAAS,SAAS,sBAAsB;AAElF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;AAAA,MAClC,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,YAAI,SAAS,WAAW,KAAK;AAC3B,qBAAO;AAAA,gBACL,mCAAa,gBAAgB,WAAW,oBAAoB,OAAO,IAAI,YAAY;AAAA,UACrF;AAAA,QACF;AAEA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,6BAA6B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC3D;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,YAAM,mBAAmB,gCAAgC,OAAO;AAChE,UAAI,CAAC,iBAAiB,IAAI;AACxB,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,iBAAiB,MAAM;AAAA,YACvB;AAAA,YACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAO,iBAAiB;AAC9B,YAAM,YAAuB;AAAA,QAC3B,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,kBAAkB,KAAK,EAAE;AAAA,QACjD,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK,SAAS,eAAe,KAAK,OAAO,KAAK,OAAO,IAAI,UAAU;AAAA,QACzE,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,MACzD;AAGA,WAAK,UAAU,IAAI,SAAS,EAAE,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,CAAC;AAErE,iBAAO,yBAAG,SAAS;AAAA,IACrB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,qCAAqC,OAAO,KAAK,CAAC;AAAA,UAClD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,oBAAoB,SAA6B;AACvD,QAAI,KAAK,mBAAmB;AAC1B,aAAO,KAAK,kBAAkB,OAAO;AAAA,IACvC;AAGA,WAAO,IAAI,MAAM,CAAC,GAAiB;AAAA,MACjC,KAAK,MAAM;AACT,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAAuB,SAAoC;AACjE,QAAI,KAAK,sBAAsB;AAC7B,aAAO,KAAK,qBAAqB,OAAO;AAAA,IAC1C;AAEA,WAAO,IAAI,MAAM,CAAC,GAAwB;AAAA,MACxC,KAAK,MAAM;AACT,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,yBAAyB,SAAkC;AACjE,QAAI,KAAK,wBAAwB;AAC/B,aAAO,KAAK,uBAAuB,OAAO;AAAA,IAC5C;AAEA,WAAO,IAAI,MAAM,CAAC,GAAsB;AAAA,MACtC,KAAK,MAAM;AACT,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,6BAA6B,SAA0C;AAC7E,UAAM,OAAO;AAEb,WAAO;AAAA,MACL,MAAM,OAAoD;AAExD,YAAI;AAEF,gBAAM,QAAQ;AAAA,YACZ;AAAA,cACE,wBAAwB;AAAA,gBACtB,MAAM;AAAA,gBACN,SAAS,EAAE,WAAW,UAAU;AAAA,cAClC;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,KAAK;AAAA,YACnB,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAEA,gBAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,YACzD,QAAQ;AAAA,YACR;AAAA,UACF,CAAC;AAED,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,gBAC7D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,gBAAM,mBAAmB,kCAAkC,OAAO;AAClE,cAAI,CAAC,iBAAiB,IAAI;AACxB,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,iBAAiB,MAAM;AAAA,gBACvB;AAAA,gBACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,cACtC;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,cAAc,2BAA2B,iBAAiB,MAAM,OAAO;AAC7E,qBAAO,yBAAG,WAAW;AAAA,QACvB,SAAS,OAAO;AACd,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,sCAAsC,OAAO,KAAK,CAAC;AAAA,cACnD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,eAA4D;AAEhE,YAAI;AAEF,gBAAM,QAAQ;AAAA,YACZ;AAAA,cACE,wBAAwB;AAAA,gBACtB,MAAM;AAAA,gBACN,SAAS,EAAE,WAAW,WAAW;AAAA,cACnC;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,KAAK;AAAA,YACnB,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAEA,gBAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,YACzD,QAAQ;AAAA,YACR;AAAA,UACF,CAAC;AAED,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,wCAAwC,SAAS,MAAM,MAAM,SAAS;AAAA,gBACtE;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,gBAAM,mBAAmB,kCAAkC,OAAO;AAClE,cAAI,CAAC,iBAAiB,IAAI;AACxB,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,iBAAiB,MAAM;AAAA,gBACvB;AAAA,gBACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,cACtC;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,cAAc,2BAA2B,iBAAiB,MAAM,OAAO;AAC7E,qBAAO,yBAAG,WAAW;AAAA,QACvB,SAAS,OAAO;AACd,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,+CAA+C,OAAO,KAAK,CAAC;AAAA,cAC5D;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OACJ,QAC2C;AAE3C,YAAI,KAAK,oBAAoB;AAC3B,iBAAO,KAAK,mBAAmB,EAAE,GAAG,QAAQ,QAAQ,CAAC;AAAA,QACvD;AAKA,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YAEA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OAAO,KAAkD;AAC7D,YAAI;AACF,gBAAM,UAAU,KAAK;AAAA,YACnB,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAEA,gBAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,YACzD,QAAQ;AAAA,YACR;AAAA,YACA,MAAM,KAAK,UAAU,EAAE,KAAK,QAAQ,CAAC;AAAA,UACvC,CAAC;AAED,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,gBAC9D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAEA,qBAAO,yBAAG,MAAS;AAAA,QACrB,SAAS,OAAO;AACd,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,sCAAsC,OAAO,KAAK,CAAC;AAAA,cACnD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,yBAAyB,SAAsC;AACrE,UAAM,OAAO;AAEb,WAAO;AAAA,MACL,MAAM,SACJ,QAC0C;AAE1C,YAAI,KAAK,gBAAgB;AAIvB,gBAAM,SAAS,MAAM,KAAK,eAAe,SAAS,MAAM;AACxD,cAAI,CAAC,OAAO,IAAI;AACd,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,OAAO,MAAM,WAAW;AAAA,gBACxB;AAAA,cACF;AAAA,YACF;AAAA,UACF;AACA,qBAAO,yBAAG,OAAO,IAAI;AAAA,QACvB;AAGA,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OAAmD;AAGvD,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OAAO,OAAoD;AAG/D,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAQO,SAAS,mBAAmB,QAA2C;AAC5E,SAAO,IAAI,aAAa,MAAM;AAChC;;;AD1mCO,IAAM,YAAN,MAAM,WAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwCrB,YAAY,mBAAuC,QAA0B;AAzB7E;AAAA;AAAA;AAAA,SAAQ,aAA0B,CAAC;AAYnC;AAAA;AAAA;AAAA,SAAQ,YAAmC,oBAAI,IAAI;AAKnD;AAAA;AAAA;AAAA,SAAQ,uBAAgC;AAStC,SAAK,oBAAoB;AACzB,SAAK,SAAS,UAAU,CAAC;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYO,mBACL,QACA,OACA,SACM;AACN,UAAM,kBAAkB,UAAU,KAAK,OAAO;AAC9C,UAAM,iBAAiB,SAAS,KAAK,OAAO;AAE5C,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAClD,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAGA,SAAK,kBAAkB,IAAI,oCAAe;AAAA,MACxC,QAAQ;AAAA,MACR,WAAW,KAAK,OAAO;AAAA,MACvB,OAAO,WAAW,KAAK,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAAA,MACvE,OAAO;AAAA,MACP,aAAa,KAAK,OAAO;AAAA,MACzB,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AAGD,UAAM,sBAA0D;AAAA,MAC9D,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,GAAG,KAAK,OAAO;AAAA,IACjB;AAGA,eAAW,CAACC,OAAM,YAAY,KAAK,OAAO,QAAQ,mBAAmB,GAAG;AACtE,YAAM,gBAAgB,KAAK,OAAO,iBAAiBA,KAAI,KAAK,CAAC;AAC7D,YAAM,UAAU,IAAI,aAAa,aAAa;AAC9C,cAAQ,WAAW,KAAK,eAAe;AACvC,WAAK,gBAAgB,gBAAgBA,OAAM,OAAO;AAClD,WAAK,UAAU,IAAIA,OAAM,OAAO;AAAA,IAClC;AAEA,SAAK,uBAAuB;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,iBAAkC;AAC3C,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGO,iBAAuB;AAC5B,QAAI;AACF,WAAK,iBAAiB,OAAO;AAAA,IAC/B,UAAE;AACA,WAAK,UAAU,MAAM;AACrB,WAAK,uBAAuB;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,WAA+BA,OAA6B;AACjE,WAAO,KAAK,UAAU,IAAIA,KAAI;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,KAAiB;AAC1B,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,IAAI;AACvC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,MAAmB;AAC5B,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,KAAK;AACxC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,SAAyB;AAClC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,QAAQ;AAC3C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,QAAuB;AAChC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,OAAO;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,QAA2B;AACpC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,OAAO;AAG1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,aAAiC;AAC1C,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,YAAY;AAG/C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,8BAA8B,SAAsC;AAC1E,QAAI,KAAK,iBAAiB;AACxB,WAAK,gBAAgB,WAAW,OAAO;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,yBAA+B;AACrC,QAAI,KAAK,iBAAiB;AACxB,WAAK,gBAAgB,MAAM;AAAA,IAC7B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBACN,eACuB;AACvB,QAAI,CAAC,cAAe,QAAO;AAG3B,UAAM,YAAa,cAAsB;AACzC,QAAI,CAAC,UAAW,QAAO;AAEvB,WAAO;AAAA,MACL,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,oBAAoB,UAAU;AAAA,MAC9B,KAAK,UAAU;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,OAAO,WAA4B;AACxC,SAAK,WAAW,KAAK,SAAS;AAC9B,SAAK,kBAAkB,OAAO,SAAS;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,mBAAmB,WAA4B;AACpD,WAAO,KAAK,WAAW,KAAK,CAAC,QAAQ,IAAI,cAAc,SAAS;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAW,UAAqC;AAC9C,WAAO,KAAK,kBAAkB;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,aAAsB;AAC/B,WAAO,CAAC,CAAC,KAAK,kBAAkB;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAOC,UAAiD;AACnE,UAAM,UAAU,MAAM,KAAK,kBAAkB,OAAOA,QAAO;AAG3D,UAAM,iBAAiB,KAAK,iBAAiB,OAAO;AACpD,SAAK,8BAA8B,cAAc;AAEjD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,UAAyB;AAEpC,SAAK,uBAAuB;AAE5B,UAAM,KAAK,kBAAkB,QAAQ;AAGrC,SAAK,YAAY;AAGjB,SAAK,8BAA8B,IAAI;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKO,UAA8B;AACnC,WAAO,KAAK,kBAAkB,QAAQ;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKO,UAA8B;AACnC,WAAO,KAAK,kBAAkB,QAAQ;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,YAAY,SAAkC;AACzD,WAAO,KAAK,kBAAkB,YAAY,OAAO;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,kBAAkB,SAAiB,SAAyB;AACjE,WAAO,kBAAkB,SAAS,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,oBAAyD;AACpE,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,CAAC,WAAW,CAAC,SAAS;AACxB,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,iBAAiB;AACzB,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,kBAAkB,SAAS,OAAO;AAGlD,QAAI;AACF,YAAM,UAAU,KAAK,gBAAgB;AACrC,UAAI,CAAC,SAAS;AACZ,mBAAO;AAAA,cACL;AAAA,YACE,gCAAW;AAAA,YACX;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,gBAAgB;AAAA,QACnC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,WAAW,MAAM,KAAK,gBAAgB;AAAA,QAC1C,GAAG,KAAK,gBAAgB,MAAM,CAAC,CAAC;AAAA,QAChC,EAAE,QAAQ,QAAQ,SAAS,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,EAAE;AAAA,MAC/D;AAEA,UAAI,SAAS,IAAI;AACf,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAEA,UAAI,SAAS,WAAW,KAAK;AAE3B,cAAM,gBAAgB,KAAK,gBAAgB;AAAA,UACzC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAEA,cAAM,iBAAiB,MAAM,KAAK,gBAAgB;AAAA,UAChD,GAAG,KAAK,gBAAgB,MAAM,CAAC,CAAC;AAAA,UAChC;AAAA,YACE,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,MAAM,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAAA,UACzC;AAAA,QACF;AAEA,YAAI,CAAC,eAAe,IAAI;AAEtB,cAAI,eAAe,WAAW,KAAK;AACjC,uBAAO,yBAAG,MAAS;AAAA,UACrB;AACA,gBAAMC,aAAY,MAAM,eAAe,KAAK;AAC5C,qBAAO;AAAA,gBACL;AAAA,cACE,gCAAW;AAAA,cACX,kCAAkC,eAAe,MAAM,MAAMA,UAAS;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAGA,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX,iCAAiC,SAAS,MAAM,MAAM,SAAS;AAAA,UAC/D;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX,wCAAwC,OAAO,KAAK,CAAC;AAAA,UACrD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAW,WAAuB;AAChC,QAAI,CAAC,KAAK,wBAAwB,CAAC,KAAK,iBAAiB;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,CAAC,WAAW,CAAC,SAAS;AACxB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,QAAI,KAAK,WAAW;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,gBAAgB,kBAAkB,SAAS,OAAO;AACxD,UAAM,UAAU,KAAK,gBAAgB;AACrC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAGA,UAAM,WAAW,IAAI,+BAAU,EAAE,QAAQ,GAAG,CAAC;AAC7C,UAAM,gBAAgB,IAAI,oCAAe;AAAA,MACvC,QAAQ,KAAK,gBAAgB;AAAA,MAC7B,OAAO,KAAK,gBAAgB;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B,aAAa,KAAK,OAAO;AAAA,MACzB,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AACD,kBAAc,WAAW;AAAA,MACvB,GAAG;AAAA,MACH,SAAS;AAAA,IACX,CAAC;AACD,aAAS,WAAW,aAAa;AAEjC,SAAK,YAAY;AACjB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,gBACX,MACA,SACA,KACA,SACkC;AAClC,UAAM,UAAU,WAAW,WAAW,MAAM,KAAK,UAAU;AAC3D,UAAM,aAAa,IAAI,MAAM,GAAG,EAAE,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAClE,UAAM,MAAM,GAAG,IAAI,WAAW,mBAAmB,OAAO,CAAC,OAAO,UAAU;AAE1E,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,QAAQ,MAAM,CAAC;AAErD,UAAI,CAAC,SAAS,IAAI;AAChB,YAAI,SAAS,WAAW,KAAK;AAC3B,qBAAO;AAAA,gBACL;AAAA,cACE,gCAAW;AAAA,cACX,kBAAkB,GAAG,aAAa,OAAO;AAAA,cACzC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,mBAAO;AAAA,cACL;AAAA,YACE,gCAAW;AAAA,YACX,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,MAAM,EAAE,QAAQ,SAAS,OAAO,EAAE;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,UAAI;AACJ,UAAI,aAAa,SAAS,kBAAkB,GAAG;AAC7C,eAAQ,MAAM,SAAS,KAAK;AAAA,MAC9B,OAAO;AACL,cAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,YAAI;AACF,iBAAO,KAAK,MAAM,IAAI;AAAA,QACxB,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAEA,iBAAO,yBAAG,IAAI;AAAA,IAChB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX,uCAAuC,OAAO,KAAK,CAAC;AAAA,UACpD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,aAAa,cACX,MACA,SACA,SACA,KACA,SACkC;AAClC,UAAM,UAAU,kBAAkB,SAAS,OAAO;AAClD,WAAO,WAAU,gBAAmB,MAAM,SAAS,KAAK,OAAO;AAAA,EACjE;AACF;;;AMnyBA,IAAAC,uBAUO;;;ACOP,gBAAe;AACf,IAAAC,uBAAkD;AAgF3C,IAAM,yBAAyB;AA2I/B,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO,EAAE;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAeO,IAAM,iBAAiB;AAKvB,IAAM,mBAAqC;AAG3C,IAAM,2BAA2B;AAGjC,IAAM,yBAAyB;AAG/B,IAAM,yBAAyB;AAG/B,IAAM,wBAAwB;AAE9B,IAAM,gBAAgB;AAGtB,IAAM,2BAA2B;AAejC,IAAM,wBACX,OAAO,OAAO;AAAA,EACZ,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,YAAY;AACd,CAAC;AAeI,IAAM,gCAAgC;AAGtC,IAAM,4BAA4B;AAKlC,IAAM,wBACX,OAAO;AAAA,EACL,OAAO;AAAA,IACL,OAAO,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,EAC9D;AACF;AASF,IAAM,2BAAuD;AAAA,EAC3D;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,OAAO,OAAO,OAAO,QAAQ,UAAU;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,OAAO;AAAA,EAC3B;AACF;AAKA,IAAM,wBAAoD;AAAA,EACxD;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,OAAO,OAAO,OAAO,QAAQ,UAAU;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACrC;AACF;AAQA,IAAM,sBAAkD;AAAA,EACtD;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,OAAO,OAAO,OAAO,QAAQ,UAAU;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACrC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,OAAO;AAAA,EAC3B;AACF;AAaO,SAAS,YAAY,UAA0B;AACpD,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR,mDAAmD,KAAK,UAAU,QAAQ,CAAC;AAAA,IAC7E;AAAA,EACF;AAGA,QAAM,aAAU,UAAAC,SAAoD,QAAQ;AAC5E,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AACzE,UAAM,IAAI;AAAA,MACR,4BAA4B,KAAK,UAAU,QAAQ,CAAC;AAAA,IACtD;AAAA,EACF;AACA,SAAO;AACT;AAYO,SAAS,uBACd,SACA,SACU;AACV,SAAO,QAAQ,IAAI,CAAC,MAAM;AACxB,QAAI,EAAE,SAAS,GAAG,GAAG;AAEnB,aAAO;AAAA,IACT;AACA,WAAO,GAAG,OAAO,IAAI,CAAC;AAAA,EACxB,CAAC;AACH;AAcO,SAAS,sBAAsB,OAA2C;AAC/E,MAAI,MAAM,YAAY,+BAA+B;AACnD,WAAO,gCAAgC,KAAK;AAAA,EAC9C;AACA,MAAI,MAAM,YAAY,0BAA0B;AAC9C,WAAO;AAAA,MACL;AAAA,QACE,GAAG;AAAA,QACH,SAAS,uBAAuB,MAAM,SAAS,MAAM,OAAO;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO,2BAA2B,KAAK;AACzC;AAgBA,SAAS,gCACP,OACmB;AACnB,MACE,OAAO,MAAM,SAAS,YACtB,CAAC,MAAM,KAAK,WAAW,2BAA2B,GAClD;AACA,UAAM,IAAI;AAAA,MACR,wEACU,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,IACtC;AAAA,EACF;AACA,QAAM,oBAA8B,CAAC;AACrC,aAAW,UAAU,MAAM,SAAS;AAClC,QAAI,WAAW,aAAa,WAAW,gCAAgC;AACrE,wBAAkB,KAAK,8BAA8B;AACrD;AAAA,IACF;AACA,QACE,WAAW,oBACX,WAAW,uCACX;AACA,wBAAkB,KAAK,qCAAqC;AAC5D;AAAA,IACF;AACA,QACE,WAAW,oBACX,WAAW,uCACX;AACA,wBAAkB,KAAK,qCAAqC;AAC5D;AAAA,IACF;AACA,QAAI,OAAO,SAAS,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,6BAA6B,KAAK,UAAU,MAAM,CAAC;AAAA,MACrD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,6BAA6B,KAAK,UAAU,MAAM,CAAC;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,iBAA2B,CAAC;AAClC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,mBAAmB;AACjC,QAAI,CAAC,KAAK,IAAI,CAAC,GAAG;AAChB,qBAAe,KAAK,CAAC;AACrB,WAAK,IAAI,CAAC;AAAA,IACZ;AAAA,EACF;AAKA,SAAO;AAAA,IACL;AAAA,MACE,SAAS;AAAA,MACT,OAAO;AAAA,MACP,MAAM,MAAM;AAAA,MACZ,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,IACP;AAAA,EACF;AACF;AAKO,SAAS,wBACd,SACmB;AACnB,SAAO,QAAQ,QAAQ,qBAAqB;AAC9C;AAUO,SAAS,YACd,QACA,MACA,YACQ;AACR,MAAI,YAAY;AACd,WAAO;AAAA,EACT;AACA,MAAI,WAAW,IAAI;AACjB,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,GAAG,GAAG;AACxB,WAAO,GAAG,MAAM,GAAG,IAAI;AAAA,EACzB;AACA,SAAO,GAAG,MAAM,IAAI,IAAI;AAC1B;AAWA,eAAsB,aAAa,KAAgC;AACjE,QAAM,UACJ,WACA;AACF,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,GAAG;AAC7B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,iCAAiC,GAAG,UAAU,IAAI,MAAM;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,iBAAiB,IAAI;AAC9B;AAMO,SAAS,iBAAiB,OAA0B;AACzD,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,UAAM,IAAI,wBAAwB,4BAA4B;AAAA,EAChE;AACA,QAAM,IAAI;AACV,MACE,EAAE,qBAAqB,UACvB,EAAE,qBAAqB,0BACvB;AACA,UAAM,IAAI;AAAA,MACR,qCAAqC,wBAAwB;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,EAAE,QAAQ,WACT,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,WAAW,IAC/C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,EAAE,UAAU,WACX,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,IACnD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,WAAW,QAAW;AAE1B,gBAAY,EAAE,MAAM;AAAA,EACtB;AACA,MAAI,EAAE,cAAc,QAAW;AAC7B,iCAA6B,EAAE,SAAS;AAAA,EAC1C;AACA,MAAI,EAAE,gBAAgB,QAAW;AAC/B,QAAI,CAAC,MAAM,QAAQ,EAAE,WAAW,GAAG;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,MAAE,YAAY;AAAA,MAAQ,CAAC,GAAG,MACxB,wBAAwB,GAAG,eAAe,CAAC,GAAG;AAAA,IAChD;AAAA,EACF;AACA,MAAI,EAAE,YAAY,QAAW;AAC3B,4BAAwB,EAAE,OAAO;AAAA,EACnC;AACA,SAAO;AACT;AAOO,SAAS,6BACd,WACoB;AACpB,MAAI,cAAc,QAAW;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,cAAc,MAAM;AACtB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,KAAK,SAAS,GAAG;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,SAAwB;AACvD,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,UAAM,IAAI,wBAAwB,oCAAoC;AAAA,EACxE;AAEA,aAAW,CAACC,OAAM,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,oCAAe,KAAKA,KAAI,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,oBAAoBA,KAAI,eAAe,oCAAe,MAAM;AAAA,MAC9D;AAAA,IACF;AACA,QAAI;AACF;AAAA,QACE,mBAAmBA,OAAM,IAA6B;AAAA,QACtD,EAAE,OAAO,oBAAoB,IAA6B,EAAE;AAAA,MAC9D;AAAA,IACF,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,oBAAoBA,KAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACrF;AAAA,IACF;AACA,UAAM,UAAU,sBAAsBA,OAAM,IAA6B;AACzE,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,oBAAoBA,KAAI;AAAA,MAC1B;AAAA,IACF;AACA,eAAW,UAAU,SAAS;AAC5B,UAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,cAAM,IAAI;AAAA,UACR,oBAAoBA,KAAI;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,QACT,OAAO,SAAS,YAChB,CAAC,MAAM,QAAQ,IAAI,KAClB,KAA8B,WAAW,QAC1C;AACA,kBAAa,KAA4B,MAAM;AAAA,IACjD;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,GAAY,MAAoB;AAC/D,MAAI,MAAM,QAAQ,OAAO,MAAM,UAAU;AACvC,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,WAAW,GAAG;AACnE,UAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB;AAAA,EACjE;AACA,MACE,MAAM,UAAU,WACf,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,WAAW,IAC3D;AACA,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,MAAM,SAAS,UAAU;AAClC,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,OAAO,KAAK,MAAM,QAAQ,WAAW,GAAG;AAC/D,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,aAAW,UAAU,MAAM,SAAS;AAClC,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AACA,QAAI,MAAM,YAAY,0BAA0B;AAC9C,2BAAqB,MAAM;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,MAAM,YAAY,WACnB,CAAC,MAAM,QAAQ,MAAM,OAAO,KAAK,MAAM,QAAQ;AAAA,IAAK,CAAC,WACpD,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM;AAAA,EACvE,IACA;AACA,UAAM,IAAI,wBAAwB,GAAG,IAAI,sCAAsC;AAAA,EACjF;AACA,MAAI,MAAM,WAAW,QAAW;AAC9B,gBAAY,MAAM,MAAM;AAAA,EAC1B;AACF;AAOO,SAAS,kBACd,OACkB;AAClB,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,WAAW;AAC9B,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAE7B,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,eAAe,WAAW,eAAe,OAAO;AAClD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAMA,SAAS,sBAAsB,MAA2C;AACxE,MAAI,SAAS,OAAO;AAClB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SACJ,SAAS,UACL,wBACA,SAAS,QACP,sBACA;AACR,SAAO,OAAO,IAAI,CAAC,OAAO;AAAA,IACxB,SAAS,EAAE;AAAA,IACX,OAAO,EAAE;AAAA,IACT,MAAM,EAAE;AAAA,IACR,SAAS,CAAC,GAAG,EAAE,OAAO;AAAA,IACtB,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,EACnE,EAAE;AACJ;AAcO,SAAS,gBAAgB,OAAuC;AACrE,QAAM,WAAW,iBAAiB,KAAK;AAEvC,QAAM,SACJ,SAAS,WAAW,SAAY,SAAS,SAAS,SAAS;AAC7D,QAAM,QAAQ,SAAS,SAAS;AAChC,QAAM,WAAW,YAAY,SAAS,UAAU,cAAc;AAC9D,QAAM,qBAAqB,SAAS,sBAAsB;AAC1D,QAAM,OAAO,kBAAkB,SAAS,QAAQ;AAEhD,QAAM,iBAAiB,sBAAsB,IAAI;AACjD,QAAM,kBAAkB,SAAS,eAAe,CAAC;AACjD,QAAM,gBAAgB,yBAAyB,SAAS,OAAO;AAI/D,QAAM,aAAgC;AAAA,IACpC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,QAAM,YAAkC;AAAA,IACtC,WAAW,QAAQ,CAAC,UAAU,aAAa,OAAO,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC5E;AAEA,QAAM,sBACJ,SAAS,QAAQ,SACb,CAAC,IACD;AAAA,IACE;AAAA,MACE,KAAK,SAAS;AAAA,MACd,MAAM,SAAS;AAAA,MACf;AAAA,MACA,aAAa,UAAU,IAAI,uBAAuB;AAAA,IACpD;AAAA,EACF;AAEN,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,GAAI,SAAS,QAAQ,SAAY,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,SAAsC;AACpE,QAAM,MAAgB,CAAC;AACvB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAM,CAAC,WAAmB;AAC9B,QAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,UAAI,KAAK,MAAM;AACf,WAAK,IAAI,MAAM;AAAA,IACjB;AAAA,EACF;AAEA,aAAW,UAAU,SAAS;AAC5B,QAAI,WAAW,QAAQ;AACrB,UAAI,KAAK;AACT;AAAA,IACF;AACA,QAAI,WAAW,SAAS;AACtB,UAAI,KAAK;AACT;AAAA,IACF;AACA,QAAI,WAAW,UAAU;AACvB,UAAI,KAAK;AACT;AAAA,IACF;AACA,QACE,WAAW,SACX,WAAW,SACX,WAAW,SACX,WAAW,UACX,WAAW,YACX;AACA,UAAI,MAAM;AACV;AAAA,IACF;AACA,QACE,WAAW,sBACX,WAAW,sBACX,WAAW,sBACX,WAAW,uBACX,WAAW,yBACX;AACA,UAAI,MAAM;AACV;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,UAAU,MAAM,CAAC;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,mBACP,cACA,MACQ;AACR,MAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,WAAO,KAAK,QAAQ;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,oBACP,MACoB;AACpB,MAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,WAAO,KAAK;AAAA,EACd;AACA,SAAO;AACT;AAEA,SAAS,sBACPA,OACA,MACU;AACV,MAAI,SAAS,MAAM;AACjB,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO,CAAC,IAAI;AAAA,EACd;AACA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO;AAAA,EACT;AACA,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAC7C,UAAM,IAAI;AAAA,MACR,oBAAoBA,KAAI;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,KAAK,YAAY,QAAW;AAC9B,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,MAAI,OAAO,KAAK,YAAY,UAAU;AACpC,WAAO,CAAC,KAAK,OAAO;AAAA,EACtB;AACA,MAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;AAC/B,WAAO,KAAK;AAAA,EACd;AACA,QAAM,IAAI;AAAA,IACR,oBAAoBA,KAAI;AAAA,EAC1B;AACF;AAEA,SAAS,yBACP,SACmB;AACnB,MAAI,YAAY,QAAW;AACzB,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,aAAW,CAACA,OAAM,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAM,UAAU,sBAAsBA,OAAM,IAAI;AAChD,UAAM,iBAAa;AAAA,MACjB,mBAAmBA,OAAM,IAAI;AAAA,MAC7B,EAAE,OAAO,oBAAoB,IAAI,EAAE;AAAA,IACrC;AACA,UAAM,QACJ,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,IAC5D,OACA,CAAC;AACP,YAAQ,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO;AAAA,MACP,MAAM,WAAW;AAAA,MACjB,SAAS,uBAAuB,OAAO;AAAA,MACvC,YAAY;AAAA,MACZ,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAMA,SAAS,aACP,OACA,QACA,oBACA,gBACsB;AAItB,QAAM,qBACJ,MAAM,eAAe,QACrB,MAAM,YAAY;AACpB,QAAM,eAAe,YAAY,QAAQ,MAAM,MAAM,kBAAkB;AACvE,QAAM,gBACJ,MAAM,WAAW,SAAY,YAAY,MAAM,MAAM,IAAI;AAC3D,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,OAAO,MAAM,SAAS;AAAA,IACtB,MAAM;AAAA,IACN,YAAY;AAAA,EACd,CAAC,EAAE,IAAI,CAAC,cAAc;AAAA,IACpB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS,SAAS;AAAA,IACzB,MAAM,SAAS;AAAA,IACf,SAAS,SAAS;AAAA;AAAA;AAAA;AAAA,IAIlB,GAAI,kBAAkB,SAAY,EAAE,UAAU,cAAc,IAAI,CAAC;AAAA,IACjE,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACP,EAAE;AACJ;AAEA,SAAS,2BAA2B,OAA2C;AAC7E,QAAM,SAAS,oBAAI,IAA2B;AAE9C,aAAW,UAAU,MAAM,SAAS;AAClC,UAAM,YAAY,qBAAqB,MAAM;AAC7C,eAAWC,SAAQ,UAAU,OAAO;AAClC,YAAM,UAAU,OAAO,IAAIA,KAAI,KAAK,CAAC;AACrC,UAAI,CAAC,QAAQ,SAAS,UAAU,MAAM,GAAG;AACvC,gBAAQ,KAAK,UAAU,MAAM;AAAA,MAC/B;AACA,aAAO,IAAIA,OAAM,OAAO;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAACA,OAAM,OAAO,OAAO;AAAA,IACrD,GAAG;AAAA,IACH,SAAS;AAAA,IACT,MAAM,YAAYA,OAAM,MAAM,IAAI;AAAA,IAClC;AAAA,IACA,YAAY;AAAA,EACd,EAAE;AACJ;AAEA,SAAS,qBAAqB,QAAsC;AAClE,QAAM,aAAa,qBAAqB,MAAM;AAC9C,MAAI,eAAe,UAAU,eAAe,OAAO;AACjD,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,WAAW,eAAe,OAAO;AAClD,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,YAAY,eAAe,OAAO;AACnD,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,oBAAoB;AAAA,EACzD;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,YAAY;AAC7B,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,wBAAwB;AAAA,EAC7D;AAEA,QAAM,IAAI;AAAA,IACR,wBAAwB,KAAK,UAAU,MAAM,CAAC;AAAA,EAChD;AACF;AAEA,SAAS,qBAAqB,QAAwB;AACpD,MAAI,OAAO,WAAW,GAAG,wBAAwB,GAAG,GAAG;AACrD,WAAO,OAAO,MAAM,GAAG,wBAAwB,IAAI,MAAM;AAAA,EAC3D;AACA,MAAI,OAAO,WAAW,eAAe,GAAG;AACtC,WAAO,OAAO,MAAM,gBAAgB,MAAM;AAAA,EAC5C;AACA,MAAI,OAAO,SAAS,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,MAAM,CAAC;AAAA,IAChD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAYA,OAAmB,MAAsB;AAC5D,QAAM,aAAa,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AAC1D,SAAO,GAAGA,KAAI,IAAI,UAAU;AAC9B;AAEA,SAAS,wBACP,OACoB;AACpB,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,qBAAqB,OAAyC;AACrE,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,gBACP,WACsB;AACtB,QAAM,QAAQ,oBAAI,IAAgC;AAElD,aAAW,YAAY,WAAW;AAChC,UAAM,MAAM,GAAG,SAAS,OAAO,KAAS,SAAS,KAAK,KAAS,SAAS,IAAI,KAAS,SAAS,YAAY,EAAE;AAC5G,UAAM,WAAW,MAAM,IAAI,GAAG;AAC9B,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI,KAAK,wBAAwB,QAAQ,CAAC;AAChD;AAAA,IACF;AAEA,UAAM,OAAO,IAAI,IAAI,SAAS,OAAO;AACrC,eAAW,UAAU,SAAS,SAAS;AACrC,UAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,iBAAS,QAAQ,KAAK,MAAM;AAC5B,aAAK,IAAI,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QACE,SAAS,gBAAgB,UACzB,SAAS,gBAAgB,QACzB;AACA,eAAS,cAAc,SAAS;AAAA,IAClC;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAEA,SAAS,2BAA2B,OAAmC;AACrE,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA,MAAM;AAAA,IACN,SAAS,CAAC,6BAA6B;AAAA,EACzC;AACF;AAEA,SAAS,8BACP,WACsB;AACtB,MAAI,UAAU,WAAW,GAAG;AAC1B,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,SAAS,IAAI;AAAA,IACjB,UACG,OAAO,CAAC,aAAa,SAAS,YAAY,6BAA6B,EACvE,IAAI,CAAC,aAAa,SAAS,KAAK;AAAA,EACrC;AACA,SAAO,gBAAgB;AAAA,IACrB,GAAG;AAAA,IACH,GAAG,CAAC,GAAG,MAAM,EAAE,IAAI,0BAA0B;AAAA,EAC/C,CAAC;AACH;AAEA,SAAS,6BAAmD;AAC1D,SAAO;AAAA,IACL,GAAG,CAAC,uBAAuB,SAAS,EAAE,IAAI,CAAC,UAAU;AAAA,MACnD,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,MACA,SAAS,CAAC,oBAAoB,oBAAoB,mBAAmB;AAAA,IACvE,EAAE;AAAA,IACF;AAAA,MACE,SAAS;AAAA,MACT,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SAAS,CAAC,2BAA2B;AAAA,IACvC;AAAA,EACF;AACF;AAEA,SAAS,iCAAqD;AAC5D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,sBAAsB,uBAAuB,sBAAsB;AAAA,EAC/E;AACF;AAOO,SAAS,uBACd,QACAC,WAAkC,CAAC,GACV;AACzB,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oCACJA,SAAQ,qCAAqC;AAC/C,QAAM,YAAY,OAAO,IAAI,gBAAgB;AAC7C,QAAM,WAAW,UAAU,IAAI,eAAe;AAC9C,QAAM,YAAY,SAAS,QAAQ,CAAC,UAAU,MAAM,SAAS;AAC7D,QAAM,oBAAoB,SAAS;AAAA,IAAQ,CAAC,UAC1C,MAAM,oBAAoB,IAAI,CAAC,cAAc;AAAA,MAC3C,GAAG;AAAA,MACH,aAAa,gBAAgB,SAAS,WAAW;AAAA,IACnD,EAAE;AAAA,EACJ;AAEA,MAAI,mCAAmC;AACrC,cAAU,KAAK,GAAG,2BAA2B,CAAC;AAC9C,cAAU,KAAK,+BAA+B,CAAC;AAAA,EACjD;AACA,QAAM,oCACJ,8BAA8B,SAAS;AAEzC,QAAM,mBAAmB,oBAAI,IAAwB;AACrD,aAAW,YAAY,WAAW;AAChC,UAAM,UAAU,iBAAiB,IAAI,SAAS,MAAM;AACpD,QAAI,YAAY,QAAW;AACzB,uBAAiB,IAAI,SAAS,QAAQ,CAAC,QAAQ,CAAC;AAAA,IAClD,OAAO;AACL,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,kBACJ,oCACI,CAAC,GAAG,iBAAiB,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,YAAY,OAAO;AAAA,IAC/D,KAAK,GAAG,qBAAqB,GAAG,MAAM;AAAA,IACtC;AAAA,IACA,WAAW,aAAa,IAAI,CAAC,cAAc;AAAA,MACzC,GAAG;AAAA,MACH,aAAa,SAAS,aAAa,IAAI,oBAAoB;AAAA,IAC7D,EAAE;AAAA,EACJ,EAAE,IACF,CAAC;AAEP,SAAO;AAAA,IACL;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA,UAAU,KAAK,IAAI,GAAG,SAAS,IAAI,CAAC,UAAU,MAAM,QAAQ,CAAC;AAAA,IAC7D,oBAAoB,SAAS,KAAK,CAAC,UAAU,MAAM,kBAAkB;AAAA,EACvE;AACF;AAmDO,SAAS,mCACd,WACc;AACd,QAAM,MAAoB,CAAC;AAC3B,aAAW,KAAK,WAAW;AACzB,UAAM,eAAe,sBAAsB,EAAE,OAAO;AACpD,QAAI,iBAAiB,QAAW;AAC9B,YAAM,IAAI;AAAA,QACR,oBAAoB,EAAE,OAAO,mDAA8C,OAAO,KAAK,qBAAqB,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1H;AAAA,IACF;AACA,QAAI,IAAI,YAAY,MAAM,QAAW;AACnC,UAAI,YAAY,IAAI,CAAC;AAAA,IACvB;AACA,UAAM,WAAW,IAAI,YAAY;AACjC,UAAM,WAAW,SAAS,EAAE,IAAI;AAChC,QAAI,aAAa,QAAW;AAE1B,eAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO;AAAA,IAClC,OAAO;AAEL,YAAM,OAAO,IAAI,IAAI,QAAQ;AAC7B,iBAAW,UAAU,EAAE,SAAS;AAC9B,YAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,mBAAS,KAAK,MAAM;AACpB,eAAK,IAAI,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,wCACd,WACmB;AACnB,QAAM,UAAU,oBAAI,IAAkC;AACtD,aAAW,YAAY,WAAW;AAChC,UAAM,UAAU,QAAQ,IAAI,SAAS,KAAK;AAC1C,QAAI,YAAY,QAAW;AACzB,cAAQ,IAAI,SAAS,OAAO,CAAC,QAAQ,CAAC;AAAA,IACxC,OAAO;AACL,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,MAAyB,CAAC;AAChC,aAAW,CAAC,OAAO,OAAO,KAAK,QAAQ,QAAQ,GAAG;AAChD,QAAI,KAAK,IAAI,mCAAmC,OAAO;AAAA,EACzD;AACA,SAAO;AACT;AAsBO,SAAS,uBACd,UACc;AACd,QAAM,MAA4B,CAAC,GAAG,SAAS,SAAS;AACxD,aAAW,YAAY,SAAS,qBAAqB;AACnD,eAAW,QAAQ,SAAS,aAAa;AACvC,UAAI,KAAK,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO,mCAAmC,GAAG;AAC/C;;;AD37CA,IAAAC,oBAAqC;AAWrC,IAAMC,gBAAe;AACrB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,sBAAsB;AA6FrB,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAA6B,QAA8B;AAA9B;AAwB7B,SAAS,eAAe;AAAA,MACtB,MAAM,OAAOC,WAAyC,CAAC,MAA6C;AAClG,YAAIA,SAAQ,aAAa;AACvB,gBAAM,UAAU,MAAM,KAAK,MAAM,aAAa,KAAK;AACnD,cAAI,QAAQ,MAAM,QAAQ,KAAK,SAAS,EAAG,QAAO;AAClD,cAAI,CAAC,QAAQ,MAAM,CAAC,oBAAoB,QAAQ,KAAK,EAAG,QAAO;AAE/D,gBAAM,YAAY,MAAM,KAAK,aAAa,KAAK;AAC/C,cAAI,UAAU,MAAMA,SAAQ,iBAAiB,OAAO;AAClD,kBAAM,KAAK,gCAAgC,UAAU,IAAI;AAAA,UAC3D;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,SAAS,KAAK,KAAK,EAAE,QAAQ,sBAAsB,CAAC;AACzE,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,eAAqC,CAAC;AAC5C,mBAAW,OAAO,OAAO,KAAK,MAAM;AAClC,gBAAM,SAAS,MAAM,SAAS,KAAK,IAA6B,GAAG;AACnE,cAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,uBAAa,KAAK,sBAAsB,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,QAChE;AAEA,qBAAa,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC1D,mBAAO,yBAAG,YAAY;AAAA,MACxB;AAAA,MAEA,KAAK,OAAO,UAAuD;AACjE,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,MAAM,eAAe,KAAK;AAChC,cAAM,SAAS,MAAM,SAAS,KAAK,IAA6B,GAAG;AACnE,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,mBAAO,yBAAG,sBAAsB,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,MACxD;AAAA,MAEA,UAAU,OAAO,aAAyE;AACxF,cAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAChE,cAAM,UAAU,uBAAuB,SAAS;AAChD,YAAI,QAAQ,gBAAgB,WAAW,GAAG;AACxC,qBAAO;AAAA,gBACL;AAAA,cACE;AAAA,cACA;AAAA,cACAD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,KAAK,OAAO,2BAA2B;AAE7C,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,YAAI;AACJ,mBAAW,UAAU,QAAQ,iBAAiB;AAC5C,gBAAM,eAAe,SAAS,OAAO,SAAS;AAC9C,cAAI,MAAM,KAAK,wBAAwB,OAAO,QAAQ,YAAY,GAAG;AACnE,yBAAa;AAAA,cACX,OAAO,OAAO;AAAA,cACd,WAAW,OAAO;AAAA,cAClB;AAAA,cACA,MAAM,OAAO,UAAU,CAAC,GAAG;AAAA,cAC3B,aAAa,OAAO,UAAU,CAAC,GAAG;AAAA,YACpC;AACA;AAAA,UACF;AAEA,gBAAM,SAAS;AAAA,YACb,QAAQ,OAAO;AAAA,YACf,WAAW,OAAO;AAAA,YAClB,eAAe;AAAA,YACf,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,UACrC;AACF,gBAAM,UAAU,MAAM,SAAS,KAAK,IAAI,OAAO,KAAK,MAAM;AAC1D,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,uBAAa,sBAAsB,OAAO,KAAK,MAAM;AACrD,gBAAM,KAAK,8BAA8B,UAAU;AAAA,QACnD;AAEA,mBAAO,yBAAG,UAAW;AAAA,MACvB;AAAA,MAEA,QAAQ,OAAO,UAAyC;AACtD,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,UAAU,MAAM,SAAS,KAAK,OAAO,eAAe,KAAK,CAAC;AAChE,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,cAAM,KAAK,8BAA8B,KAAK;AAC9C,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAAA,IACF;AAEA,SAAS,SAAS;AAAA,MAChB,MAAM,OAAOC,WAAmC,CAAC,MAAuC;AACtF,YAAIA,SAAQ,aAAa;AACvB,gBAAM,UAAU,MAAM,KAAK,MAAM,OAAO,KAAK;AAC7C,cAAI,QAAQ,MAAM,QAAQ,KAAK,SAAS,EAAG,QAAO;AAClD,cAAI,CAAC,QAAQ,MAAM,CAAC,oBAAoB,QAAQ,KAAK,EAAG,QAAO;AAE/D,gBAAM,YAAY,MAAM,KAAK,OAAO,eAAe;AACnD,cAAI,UAAU,MAAMA,SAAQ,iBAAiB,OAAO;AAClD,kBAAM,KAAK,0BAA0B,UAAU,IAAI;AAAA,UACrD;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,SAAS,KAAK,KAAK,EAAE,QAAQ,oBAAoB,CAAC;AACvE,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,SAAyB,CAAC;AAChC,mBAAW,OAAO,OAAO,KAAK,MAAM;AAClC,gBAAM,SAAS,MAAM,SAAS,KAAK,IAAuB,GAAG;AAC7D,cAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,iBAAO,KAAK,gBAAgB,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,QACpD;AAEA,eAAO,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,KAAK,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AACxF,mBAAO,yBAAG,MAAM;AAAA,MAClB;AAAA,MAEA,KAAK,OAAO,YAAmD;AAC7D,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,SAAS,KAAK,IAAuB,SAAS,OAAO,CAAC;AAC3E,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,mBAAO,yBAAG,gBAAgB,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC;AAAA,MAChE;AAAA,MAEA,UAAU,OAAO,UAAmE;AAClF,cAAM,KAAK,OAAO,2BAA2B;AAE7C,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,qBAAqB,KAAK;AACzC,cAAM,UAAU,MAAM,SAAS,KAAK,IAAI,SAAS,OAAO,QAAQ,GAAG,MAAM;AACzE,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,cAAM,aAAa,gBAAgB,SAAS,OAAO,QAAQ,GAAG,MAAM;AACpE,cAAM,KAAK,wBAAwB,UAAU;AAC7C,mBAAO,yBAAG,UAAU;AAAA,MACtB;AAAA,MAEA,gBAAgB,YAA6C;AAC3D,cAAM,SAAS,MAAM,KAAK,OAAO,UAAU,EAAE,KAAK;AAClD,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,aAA6B,CAAC;AACpC,mBAAW,SAAS,OAAO,MAAM;AAC/B,gBAAM,SAAS,MAAM,KAAK,OAAO,SAAS,KAAK;AAC/C,cAAI,CAAC,OAAO,GAAI,QAAO;AACvB,qBAAW,KAAK,OAAO,IAAI;AAAA,QAC7B;AACA,mBAAO,yBAAG,UAAU;AAAA,MACtB;AAAA,MAEA,QAAQ,OAAO,YAA2C;AACxD,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,UAAU,MAAM,SAAS,KAAK,OAAO,SAAS,OAAO,CAAC;AAC5D,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,cAAM,KAAK,wBAAwB,OAAO;AAC1C,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAAA,IACF;AAEA,SAAS,cAAc;AAAA,MACrB,OAAO,OACLA,WAAyC,CAAC,MACC;AAC3C,cAAM,UAAU,KAAK,OAAO,uBAAuB;AACnD,YAAI,CAAC,SAAS;AACZ,qBAAO,8BAAI;AAAA,YACT;AAAA,YACA;AAAA,YACAD;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,UAAU,MAAM,QAAQ,MAAMC,QAAO;AAC3C,eAAO,QAAQ,SAAK,yBAAG,QAAQ,IAAI,IAAI,WAAW,QAAQ,KAAK;AAAA,MACjE;AAAA,MAEA,MAAM,OACJA,WAAwC,CAAC,MACA;AACzC,YAAIA,SAAQ,aAAa;AACvB,gBAAM,UAAU,MAAM,KAAK,MAAM,YAAY,KAAKA,QAAO;AACzD,cAAI,QAAQ,MAAM,QAAQ,KAAK,SAAS,EAAG,QAAO;AAClD,cAAI,CAAC,QAAQ,MAAM,CAAC,oBAAoB,QAAQ,KAAK,EAAG,QAAO;AAE/D,gBAAM,OAAO,MAAM,KAAK,YAAY,KAAK;AAAA,YACvC,WAAWA,SAAQ;AAAA,YACnB,OAAOA,SAAQ;AAAA,UACjB,CAAC;AACD,cAAI,KAAK,MAAMA,SAAQ,iBAAiB,OAAO;AAC7C,kBAAM,KAAK,+BAA+B,KAAK,IAAI;AAAA,UACrD;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,SAAS,MAAM,KAAK,OAAO,UAAU,EAAE,KAAK;AAClD,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,eAAeA,SAAQ,QACzB,OAAO,KAAK,OAAO,CAAC,UAAU,MAAM,OAAOA,SAAQ,SAAS,MAAM,SAASA,SAAQ,KAAK,IACxF,OAAO;AAEX,cAAM,cAAmC,CAAC;AAC1C,mBAAW,SAAS,cAAc;AAChC,gBAAM,SAAS,KAAK,OAAO,UAAU,EAAE,IAAI,MAAM,EAAE,EAAE;AAErD,cAAIA,SAAQ,cAAc,YAAY;AACpC,kBAAM,UAAU,MAAM,OAAO,KAAK;AAClC,gBAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,wBAAY,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,MAAM,cAAc,GAAG,OAAO,SAAS,CAAC,CAAC;AAAA,UACjF;AAEA,cAAIA,SAAQ,cAAc,WAAW;AACnC,kBAAM,WAAW,MAAM,OAAO,aAAa;AAC3C,gBAAI,CAAC,SAAS,GAAI,QAAO,WAAW,SAAS,KAAK;AAClD,wBAAY,KAAK,GAAG,SAAS,KAAK,IAAI,CAAC,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,CAAC;AAAA,UACnF;AAAA,QACF;AAEA,oBAAY,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,KAAK,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;AAC3F,mBAAO,yBAAG,WAAW;AAAA,MACvB;AAAA,MAEA,QAAQ,OACN,UACwD;AACxD,cAAM,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAM;AACtD,cAAM,UAAU,KAAK,OAAO,uBAAuB;AACnD,YAAI,SAAS;AACX,gBAAMC,WAAU,MAAM,QAAQ,OAAO,GAAG;AACxC,iBAAOA,SAAQ,SAAK,yBAAGA,SAAQ,IAAI,IAAI,WAAWA,SAAQ,KAAK;AAAA,QACjE;AAGA,YAAI,OAAO,UAAU,UAAU;AAC7B,qBAAO,8BAAI;AAAA,YACT;AAAA,YACA;AAAA,YACAF;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK;AACjD,YAAI,CAAC,MAAM,GAAI,QAAO;AACtB,cAAM,UAAU,MAAM,KAAK,OAAO,UAAU,EAAE,IAAI,MAAM,KAAK,EAAE,EAAE,YAAY,OAAO,GAAG;AACvF,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAAA,IACF;AAEA,SAAS,QAAQ;AAAA,MACf,QAAQ,YAAuD;AAC7D,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,YAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,mBAAO,yBAAG,EAAE,UAAU,iBAAiB,CAAC;AAAA,MAC1C;AAAA,MAEA,SAAS,YAAwD;AAC/D,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,eAAe,MAAM,KAAK,aAAa,KAAK;AAClD,YAAI,CAAC,aAAa,GAAI,QAAO;AAE7B,cAAM,SAAS,MAAM,KAAK,OAAO,KAAK;AACtC,YAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,cAAM,cAAc,MAAM,KAAK,YAAY,KAAK;AAChD,YAAI,CAAC,YAAY,GAAI,QAAO;AAE5B,cAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,cAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,YAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,cAAM,aAAa;AAAA,UACjB,EAAE,KAAK,2BAA2B;AAAA,UAClC,EAAE,KAAK,gCAAgC;AAAA,UACvC,EAAE,KAAK,qBAAqB;AAAA,UAC5B,EAAE,KAAK,0BAA0B;AAAA,UACjC,EAAE,KAAK,yBAAyB;AAAA,UAChC,GAAG,aAAa,KAAK,IAAI,CAAC,SAAS;AAAA,YACjC,KACE;AAAA,YACF,QAAQ;AAAA,cACN,IAAI;AAAA,cACJ,IAAI,QAAQ;AAAA,cACZ,IAAI,eAAe;AAAA,cACnB,IAAI,aAAa;AAAA,cACjB,KAAK,UAAU,IAAI,SAAS;AAAA,YAC9B;AAAA,UACF,EAAE;AAAA,UACF,GAAG,aAAa,KAAK,IAAI,CAAC,SAAS;AAAA,YACjC,KACE;AAAA,YACF,QAAQ,CAAC,IAAI,OAAO,IAAI,gBAAgB,SAAS,IAAI,SAAS,GAAG,QAAQ;AAAA,UAC3E,EAAE;AAAA,UACF,GAAG,OAAO,KAAK,IAAI,CAAC,WAAW;AAAA,YAC7B,KACE;AAAA,YACF,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,MAAM;AAAA,cACN,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,UAAU,MAAM,WAAW;AAAA,cAChC,MAAM;AAAA,cACN,MAAM,gBAAgB;AAAA,cACtB,MAAM,aAAa;AAAA,cACnB,MAAM,WAAW,YAAY,KAAK;AAAA,YACpC;AAAA,UACF,EAAE;AAAA,UACF,GAAG,YAAY,KAAK,IAAI,CAAC,gBAAgB;AAAA,YACvC,KACE;AAAA,YACF,QAAQ;AAAA,cACN,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW,aAAa;AAAA,cACxB,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW,gBAAgB;AAAA,cAC3B,WAAW;AAAA,cACX,KAAK,UAAU,WAAW,OAAO;AAAA,cACjC,WAAW,OAAO,YAAY;AAAA,cAC9B,WAAW;AAAA,cACX,WAAW,WAAW,YAAY,KAAK;AAAA,cACvC;AAAA,YACF;AAAA,UACF,EAAE;AAAA,UACF;AAAA,YACE,KAAK;AAAA,YACL,QAAQ,CAAC,gBAAgB,UAAU,aAAa,KAAK,MAAM;AAAA,UAC7D;AAAA,UACA;AAAA,YACE,KAAK;AAAA,YACL,QAAQ,CAAC,UAAU,UAAU,OAAO,KAAK,MAAM;AAAA,UACjD;AAAA,UACA;AAAA,YACE,KAAK;AAAA,YACL,QAAQ,CAAC,eAAe,UAAU,YAAY,KAAK,MAAM;AAAA,UAC3D;AAAA,QACF;AAEA,cAAM,UAAU,MAAM,SAAS,KAAK,MAAM,UAAU;AACpD,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,mBAAO,yBAAG;AAAA,UACR,UAAU;AAAA,UACV,cAAc,aAAa,KAAK;AAAA,UAChC,QAAQ,OAAO,KAAK;AAAA,UACpB,aAAa,YAAY,KAAK;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MAEA,cAAc;AAAA,QACZ,MAAM,YAAmD;AACvD,gBAAM,WAAW,KAAK,UAAU;AAChC,cAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,gBAAM,UAAU,MAAM,SAAS,KAAK;AAAA,YAClC;AAAA,UACF;AACA,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,qBAAO,yBAAI,QAAQ,KAAK,KAA4C,IAAI,yBAAyB,CAAC;AAAA,QACpG;AAAA,MACF;AAAA,MAEA,QAAQ;AAAA,QACN,MAAM,YAA6C;AACjD,gBAAM,WAAW,KAAK,UAAU;AAChC,cAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,gBAAM,UAAU,MAAM,SAAS,KAAK;AAAA,YAClC;AAAA,UACF;AACA,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,qBAAO,yBAAI,QAAQ,KAAK,KAAsC,IAAI,mBAAmB,CAAC;AAAA,QACxF;AAAA,MACF;AAAA,MAEA,aAAa;AAAA,QACX,MAAM,OACJC,WAAwC,CAAC,MACA;AACzC,gBAAM,WAAW,KAAK,UAAU;AAChC,cAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,gBAAM,QAAkB,CAAC;AACzB,gBAAM,SAAqB,CAAC;AAC5B,cAAIA,SAAQ,aAAaA,SAAQ,cAAc,OAAO;AACpD,kBAAM,KAAK,eAAe;AAC1B,mBAAO,KAAKA,SAAQ,SAAS;AAAA,UAC/B;AACA,cAAIA,SAAQ,OAAO;AACjB,kBAAM,KAAK,kCAAkC;AAC7C,mBAAO,KAAKA,SAAQ,OAAOA,SAAQ,KAAK;AAAA,UAC1C;AAEA,gBAAM,UAAU,MAAM,SAAS,KAAK;AAAA,YAClC,8JACE,MAAM,SAAS,IAAI,UAAU,MAAM,KAAK,OAAO,CAAC,KAAK,EACvD;AAAA,YACA;AAAA,UACF;AACA,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,qBAAO,yBAAI,QAAQ,KAAK,KAA2C,IAAI,wBAAwB,CAAC;AAAA,QAClG;AAAA,MACF;AAAA,MAEA,OAAO,OACL,KACA,WACsC;AACtC,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AACzB,cAAM,UAAU,MAAM,SAAS,KAAK,MAAS,KAAK,MAAM;AACxD,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,mBAAO,yBAAG,QAAQ,IAAI;AAAA,MACxB;AAAA,MAEA,QAAQ,YAAiD;AACvD,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AACzB,cAAM,UAAU,MAAM,SAAS,KAAK;AAAA,UAClC;AAAA,QACF;AACA,YAAI,CAAC,QAAQ,IAAI;AACf,cAAI,oBAAoB,QAAQ,KAAK,GAAG;AACtC,uBAAO,yBAAG,EAAE,UAAU,kBAAkB,OAAO,WAAW,SAAS,CAAC,EAAE,CAAC;AAAA,UACzE;AACA,iBAAO,WAAW,QAAQ,KAAK;AAAA,QACjC;AACA,mBAAO,yBAAG;AAAA,UACR,UAAU;AAAA,UACV,OAAO;AAAA,UACP,SAAU,QAAQ,KAAK,KAA0C,IAAI,CAAC,CAAC,QAAQ,UAAU,KAAK,OAAO;AAAA,YACnG;AAAA,YACA;AAAA,YACA;AAAA,UACF,EAAE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EA3e4D;AAAA,EAE5D,MAAM,SAAyC;AAC7C,UAAM,OAAO,MAAM,KAAK,aAAa,KAAK;AAC1C,QAAI,CAAC,KAAK,GAAI,QAAO;AAErB,UAAM,cAAc,MAAM,KAAK,YAAY,KAAK;AAChD,QAAI,CAAC,YAAY,GAAI,QAAO;AAE5B,UAAM,SAAS,MAAM,KAAK,OAAO,KAAK;AACtC,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,eAAO,yBAAG;AAAA,MACR,KAAK,KAAK,OAAO,OAAO;AAAA,MACxB,MAAM,KAAK,OAAO,QAAQ;AAAA,MAC1B,gBAAgB,KAAK,OAAO,kBAAkB;AAAA,MAC9C,gBAAgB,KAAK,OAAO,kBAAkB;AAAA,MAC9C,cAAc,KAAK,KAAK;AAAA,MACxB,QAAQ,OAAO,KAAK;AAAA,MACpB,oBAAoB,YAAY,KAAK,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS,EAAE;AAAA,MAC9E,qBAAqB,YAAY,KAAK,OAAO,CAAC,MAAM,EAAE,cAAc,UAAU,EAAE;AAAA,IAClF,CAAC;AAAA,EACH;AAAA,EAudQ,YAAgC;AACtC,UAAM,iBAAiB,KAAK,OAAO,kBAAkB;AACrD,QAAI,CAAC,gBAAgB;AACnB,iBAAO;AAAA,YACL;AAAA,UACE;AAAA,UACA;AAAA,UACAD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,eAAO,yBAAG,KAAK,OAAO,UAAU,EAAE,IAAI,cAAc,EAAE,EAAE;AAAA,EAC1D;AAAA,EAEQ,YAAqC;AAC3C,UAAM,KAAK,KAAK,OAAO,eAAe;AACtC,QAAI,CAAC,IAAI;AACP,iBAAO;AAAA,YACL;AAAA,UACE;AAAA,UACA;AAAA,UACAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,eAAO,yBAAG,EAAE;AAAA,EACd;AAAA,EAEA,MAAc,wBAAwB,OAAe,cAAwC;AAC3F,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,UAAU,MAAM,SAAS,KAAK;AAAA,MAClC;AAAA,MACA,CAAC,OAAO,YAAY;AAAA,IACtB;AACA,WAAO,QAAQ,MAAM,QAAQ,KAAK,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,MAAc,8BAA8B,KAAwC;AAClF,UAAM,mBAAmB,MAAM,KAAK,uBAAuB,GAAG,CAAC;AAAA,EACjE;AAAA,EAEA,MAAc,uBAAuB,KAAgD;AACnF,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AAErC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,YAAY,IAAI,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1D,UAAM,eAAe,IAAI,gBAAgB,SAAS,IAAI,SAAS;AAC/D,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC;AAAA,QACE,KACE;AAAA,QACF,QAAQ;AAAA,UACN,IAAI;AAAA,UACJ,IAAI,QAAQ;AAAA,UACZ,IAAI,eAAe;AAAA,UACnB;AAAA,UACA,KAAK,UAAU,IAAI,SAAS;AAAA,QAC9B;AAAA,MACF;AAAA,MACA;AAAA,QACE,KACE;AAAA,QACF,QAAQ,CAAC,IAAI,OAAO,cAAc,SAAS;AAAA,MAC7C;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,8BAA8B,OAA8B;AACxE,UAAM,mBAAmB,MAAM,KAAK,uBAAuB,KAAK,CAAC;AAAA,EACnE;AAAA,EAEA,MAAc,uBAAuB,OAAsC;AACzE,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AACrC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC,EAAE,KAAK,6CAA6C,QAAQ,CAAC,KAAK,EAAE;AAAA,MACpE,EAAE,KAAK,kDAAkD,QAAQ,CAAC,KAAK,EAAE;AAAA,IAC3E,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,wBAAwB,OAAoC;AACxE,UAAM,mBAAmB,MAAM,KAAK,iBAAiB,KAAK,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAc,iBAAiB,OAA4C;AACzE,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AACrC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,YAAY,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC5D,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC;AAAA,QACE,KACE;AAAA,QACF,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,KAAK,UAAU,MAAM,WAAW;AAAA,UAChC,MAAM;AAAA,UACN,MAAM,gBAAgB;AAAA,UACtB;AAAA,UACA,MAAM,WAAW,YAAY,KAAK;AAAA,QACpC;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,wBAAwB,SAAgC;AACpE,UAAM,mBAAmB,MAAM,KAAK,iBAAiB,OAAO,CAAC;AAAA,EAC/D;AAAA,EAEA,MAAc,iBAAiB,SAAwC;AACrE,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AACrC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC,EAAE,KAAK,yCAAyC,QAAQ,CAAC,OAAO,EAAE;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,aAAa,OAA2C;AACpE,UAAM,SAAS,MAAM,KAAK,OAAO,UAAU,EAAE,KAAK;AAClD,QAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,UAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,cAAc,UAAU,OAAO,SAAS,UAAU,SAAS,KAAK;AAChG,QAAI,CAAC,OAAO;AACV,iBAAO;AAAA,YACL,mCAAa,mBAAmB,8BAA8B,KAAK,UAAU,KAAK,CAAC,IAAIA,aAAY;AAAA,MACrG;AAAA,IACF;AACA,eAAO,yBAAG,KAAK;AAAA,EACjB;AAAA,EAEA,MAAc,gCAAgC,cAAmD;AAC/F,UAAM,mBAAmB,YAAY;AACnC,YAAM,WAAW,KAAK,UAAU;AAChC,UAAI,CAAC,SAAS,GAAI;AAClB,YAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,UAAI,CAAC,OAAO,GAAI;AAEhB,YAAM,SAAS,KAAK,MAAM;AAAA,QACxB,EAAE,KAAK,2BAA2B;AAAA,QAClC,EAAE,KAAK,gCAAgC;AAAA,QACvC,GAAG,aAAa,IAAI,CAAC,SAAS;AAAA,UAC5B,KACE;AAAA,UACF,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,IAAI,QAAQ;AAAA,YACZ,IAAI,eAAe;AAAA,YACnB,IAAI,aAAa;AAAA,YACjB,KAAK,UAAU,IAAI,SAAS;AAAA,UAC9B;AAAA,QACF,EAAE;AAAA,QACF,GAAG,aAAa,IAAI,CAAC,SAAS;AAAA,UAC5B,KACE;AAAA,UACF,QAAQ,CAAC,IAAI,OAAO,IAAI,gBAAgB,SAAS,IAAI,SAAS,GAAG,QAAQ;AAAA,QAC3E,EAAE;AAAA,QACF;AAAA,UACE,KAAK;AAAA,UACL,QAAQ,CAAC,gBAAgB,UAAU,aAAa,MAAM;AAAA,QACxD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,0BAA0B,QAAuC;AAC7E,UAAM,mBAAmB,YAAY;AACnC,YAAM,WAAW,KAAK,UAAU;AAChC,UAAI,CAAC,SAAS,GAAI;AAClB,YAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,UAAI,CAAC,OAAO,GAAI;AAEhB,YAAM,SAAS,KAAK,MAAM;AAAA,QACxB,EAAE,KAAK,qBAAqB;AAAA,QAC5B,GAAG,OAAO,IAAI,CAAC,WAAW;AAAA,UACxB,KACE;AAAA,UACF,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN,KAAK,UAAU,MAAM,WAAW;AAAA,YAChC,MAAM;AAAA,YACN,MAAM,gBAAgB;AAAA,YACtB,MAAM,aAAa;AAAA,YACnB,MAAM,WAAW,YAAY,KAAK;AAAA,UACpC;AAAA,QACF,EAAE;AAAA,QACF;AAAA,UACE,KAAK;AAAA,UACL,QAAQ,CAAC,UAAU,UAAU,OAAO,MAAM;AAAA,QAC5C;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,+BAA+B,aAAiD;AAC5F,UAAM,mBAAmB,YAAY;AACnC,YAAM,WAAW,KAAK,UAAU;AAChC,UAAI,CAAC,SAAS,GAAI;AAClB,YAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,UAAI,CAAC,OAAO,GAAI;AAEhB,YAAM,SAAS,KAAK,MAAM;AAAA,QACxB,EAAE,KAAK,0BAA0B;AAAA,QACjC,GAAG,YAAY,IAAI,CAAC,gBAAgB;AAAA,UAClC,KACE;AAAA,UACF,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,WAAW;AAAA,YACX,WAAW;AAAA,YACX,WAAW,aAAa;AAAA,YACxB,WAAW;AAAA,YACX,WAAW;AAAA,YACX,WAAW,gBAAgB;AAAA,YAC3B,WAAW;AAAA,YACX,KAAK,UAAU,WAAW,OAAO;AAAA,YACjC,WAAW,OAAO,YAAY;AAAA,YAC9B,WAAW;AAAA,YACX,WAAW,WAAW,YAAY,KAAK;AAAA,YACvC;AAAA,UACF;AAAA,QACF,EAAE;AAAA,QACF;AAAA,UACE,KAAK;AAAA,UACL,QAAQ,CAAC,eAAe,UAAU,YAAY,MAAM;AAAA,QACtD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,mBAAmB,IAA4C;AAC3E,UAAM,WAAW,MAAM,GAAG,WAAW,MAAM;AAAA,MACzC,WAAW;AAAA,MACX,YAAY;AAAA,QACV;AAAA,UACE,IAAI;AAAA,UACJ,KAAK,CAAC,GAAG,sCAAoB;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,QAAO,WAAW,SAAS,KAAK;AAClD,eAAO,yBAAG,MAAS;AAAA,EACrB;AACF;AAYA,SAAS,eAAe,OAAuB;AAC7C,SAAO,GAAG,qBAAqB,GAAG,KAAK;AACzC;AAEA,SAAS,aAAa,KAAqB;AACzC,SAAO,IAAI,WAAW,qBAAqB,IAAI,IAAI,MAAM,sBAAsB,MAAM,IAAI;AAC3F;AAEA,SAAS,sBAAsB,KAAa,QAAqD;AAC/F,QAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,YAAY,CAAC;AACxE,QAAM,QAAQ,UAAU,CAAC;AACzB,SAAO;AAAA,IACL,OAAO,OAAO,UAAU,OAAO,SAAS,OAAO,UAAU,aAAa,GAAG;AAAA,IACzE;AAAA,IACA,WAAW,OAAO,cAAc,OAAO;AAAA,IACvC,MAAM,OAAO;AAAA,IACb,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO,iBAAiB,OAAO,gBAAgB,SAAS,SAAS;AAAA,EACjF;AACF;AAIA,SAAS,0BAA0B,KAAgD;AACjF,QAAM,CAAC,OAAOG,OAAM,aAAa,WAAW,cAAc,YAAY,IAAI;AAC1E,SAAO;AAAA,IACL;AAAA,IACA,MAAMA,SAAQ;AAAA,IACd,aAAa,eAAe;AAAA,IAC5B,WAAW,aAAa;AAAA,IACxB,WAAW,KAAK,MAAM,YAAY;AAAA,IAClC,cAAc,gBAAgB;AAAA,EAChC;AACF;AAoBA,SAAS,SAAS,SAAyB;AACzC,SAAO,GAAG,mBAAmB,GAAG,OAAO;AACzC;AAEA,SAAS,eAAe,KAAqB;AAC3C,SAAO,IAAI,WAAW,mBAAmB,IAAI,IAAI,MAAM,oBAAoB,MAAM,IAAI;AACvF;AAEA,SAAS,qBAAqB,OACV;AAClB,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,eAA6B,aAAa,QAC5C,QACA;AAAA,IACE,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ,MAAM,GAAG,MAAM,GAAG,EAAE,IAAI,KAAK,MAAM;AAAA,IACvD,UAAU,MAAM,SAAS;AAAA,IACzB,MAAO,MAAM,QAAQ;AAAA,IACrB,aAAa,MAAM,eAAe,CAAC;AAAA,IACnC,QAAQ;AAAA,IACR,WAAW,MAAM;AAAA,EACnB;AAEJ,SAAO;AAAA,IACL,UAAU,aAAa;AAAA,IACvB,MAAM,aAAa;AAAA,IACnB,WAAW,aAAa;AAAA,IACxB,MAAM,aAAa;AAAA,IACnB,aAAa,aAAa;AAAA,IAC1B,QAAQ,aAAa;AAAA,IACrB,eAAe,aAAa,gBAAgB;AAAA,IAC5C,YAAY;AAAA,IACZ,YAAY,aAAa,qBAAqB,OAC1C,aAAa,UAAU,YAAY,IACnC,aAAa;AAAA,EACnB;AACF;AAEA,SAAS,gBAAgB,KAAa,QAAyC;AAC7E,QAAM,YAAY,OAAO,cAAc,OAAO;AAC9C,SAAO;AAAA,IACL,SAAS,OAAO,YAAY,OAAO,WAAW,eAAe,GAAG;AAAA,IAChE,MAAM,OAAO,QAAQ,eAAe,GAAG,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK,eAAe,GAAG;AAAA,IAC/E,UAAU,OAAO,aAAa,OAAO,YAAY,OAAO,SAAS;AAAA,IACjE,MAAM,OAAO,QAAQ;AAAA,IACrB,aAAa,MAAM,QAAQ,OAAO,WAAW,IAAI,OAAO,cAAc,CAAC;AAAA,IACvE,QAAQ,OAAO,UAAU;AAAA,IACzB,cAAc,OAAO,iBAAiB,OAAO;AAAA,IAC7C,WAAW,OAAO,cAAc,OAAO;AAAA,IACvC,WAAW,YAAY,IAAI,KAAK,SAAS,IAAI;AAAA,EAC/C;AACF;AAIA,SAAS,oBAAoB,KAAoC;AAC/D,QAAM,CAAC,SAASA,OAAM,UAAU,MAAM,iBAAiB,QAAQ,cAAc,WAAW,SAAS,IAAI;AACrG,SAAO;AAAA,IACL;AAAA,IACA,MAAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,KAAK,MAAM,eAAe;AAAA,IACvC;AAAA,IACA,cAAc,gBAAgB;AAAA,IAC9B;AAAA,IACA,WAAW,YAAY,IAAI,KAAK,SAAS,IAAI;AAAA,EAC/C;AACF;AAEA,SAAS,SAAS,OAAwB;AACxC,QAAM,QAAQ,WAAW,KAAK;AAC9B,MAAI,OAAO;AACX,QAAM,QAAQ;AACd,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,YAAQ,OAAO,MAAM,WAAW,KAAK,CAAC;AACtC,WAAO,OAAO,QAAQ,IAAI,OAAO,KAAK;AAAA,EACxC;AACA,SAAO,KAAK,SAAS,EAAE,EAAE,SAAS,IAAI,GAAG;AAC3C;AAEA,SAAS,WAAW,OAAwB;AAC1C,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,IAAI,UAAU,EAAE,KAAK,GAAG,CAAC;AAAA,EAC5C;AACA,QAAM,SAAS;AACf,SAAO,IAAI,OAAO,KAAK,MAAM,EAC1B,KAAK,EACL,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,WAAW,OAAO,GAAG,CAAC,CAAC,EAAE,EAChE,KAAK,GAAG,CAAC;AACd;AA6BA,SAAS,yBAAyB,KAA8C;AAC9E,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,aAAa;AAAA,IACxB;AAAA,IACA;AAAA,IACA,cAAc,gBAAgB;AAAA,IAC9B;AAAA,IACA,SAAS,KAAK,MAAM,WAAW;AAAA,IAC/B,QAAQ,IAAI,KAAK,MAAM;AAAA,IACvB;AAAA,IACA,WAAW,YAAY,IAAI,KAAK,SAAS,IAAI;AAAA,EAC/C;AACF;AAEA,SAAS,cACP,YACA,OACA,WACmB;AACnB,SAAO;AAAA,IACL,KAAK,WAAW;AAAA,IAChB;AAAA,IACA,SAAS,WAAW,WAAW,MAAM;AAAA,IACrC,WAAW,MAAM;AAAA,IACjB,iBACE,cAAc,YACV,WAAW,cACX,WAAW,gBAAgB,WAAW;AAAA,IAC5C,aAAa,WAAW;AAAA,IACxB,cAAc,WAAW;AAAA,IACzB,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,QAAQ,WAAW,YACf,YACA,WAAW,OAAO,QAAQ,KAAK,KAAK,IAAI,IACtC,YACA;AAAA,IACN,WAAW,WAAW;AAAA,EACxB;AACF;AAEA,SAAS,WAAW,OAAoC;AACtD,aAAO,8BAAI,mCAAa,MAAM,MAAM,MAAM,SAASH,eAAc,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC;AAC5G;AAEA,SAAS,oBAAoB,OAA8B;AACzD,SAAO,kBAAkB,KAAK,MAAM,OAAO;AAC7C;AAEA,eAAe,mBAAmB,MAA6C;AAC7E,MAAI;AACF,UAAM,KAAK;AAAA,EACb,QAAQ;AAAA,EAGR;AACF;;;AxC1+BA,IAAAI,uBAgNO;;;A0CpUP,eAAsB,YACpB,MACA,SACiB;AACjB,QAAM,MAAM,MAAM;AAAA,IAChB,GAAG,IAAI,kBAAkB,mBAAmB,OAAO,CAAC;AAAA,EACtD;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,QAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,UAAU;AACzD,UAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,MAAM,KAAK,EAAE;AAAA,EACnE;AAEA,SAAO,IAAI,KAAK;AAClB;AAYA,eAAsB,qBACpB,MACA,SAC0B;AAC1B,QAAM,MAAM,MAAM,MAAM,GAAG,IAAI,aAAa;AAAA,IAC1C,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,IAAI;AAAA,MACZ,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,UAAU;AAAA,IACpD;AAAA,EACF;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,IAAI;AAAA,MACZ,gBAAgB,KAAK;AAAA,MACrB,WAAW,KAAK,aAAa,CAAC;AAAA,MAC9B,SAAS,KAAK,WAAW,CAAC;AAAA,IAC5B;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,MAAM,QAAQ,IAAI,QAAQ,WAAW,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,EACzE;AACF;AAYA,eAAsB,wBACpB,MACA,kBAC0B;AAC1B,QAAM,MAAM,MAAM,MAAM,GAAG,IAAI,aAAa;AAAA,IAC1C,QAAQ;AAAA,IACR,SAAS;AAAA,EACX,CAAC;AAED,MAAI,IAAI,IAAI;AACV,QAAI;AACF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,WAAW,KAAK,aAAa,CAAC;AAAA,QAC9B,SAAS,KAAK,WAAW,CAAC;AAAA,QAC1B,gBAAgB,KAAK;AAAA,MACvB;AAAA,IACF,QAAQ;AAEN,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,WAAW,CAAC;AAAA,QACZ,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,UAAU;AAAA,EACpD;AACF;;;AChGA,IAAM,mBAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AACT;AAKA,SAAS,YACPC,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AA4BO,IAAM,oBAAN,MAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa7B,YAAY,QAAiC;AAC3C,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,YAAY,OAAO;AACxB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOO,cAAc,SAA+B;AAClD,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBACZ,MACA,QACA,MACwB;AACxB,UAAM,UAAU,KAAK,OAAO,KAAK,SAAS,cAAc,MAAM,MAAM;AAEpE,WAAO,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,OAAO,QAA6D;AAExE,QAAI,CAAC,OAAO,aAAa;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,WAAW,GAAG;AAClD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B,aAAa,OAAO;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,QAAQ,YAAY;AAAA,QACnC,sBAAsB,OAAO,wBAAwB;AAAA,QACrD,WAAW,OAAO;AAAA,MACpB,CAAC;AAED,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,KAAK;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,cAAe,MAAM,SAAS,KAAK;AAEzC,YAAM,aAAyB;AAAA,QAC7B,KAAK,YAAY,OAAO;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,SAAS,KAAK,QAAQ;AAAA,QACtB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,QAAQ;AAAA,QAC9D,WAAW;AAAA,QACX,oBAAoB,EAAE,OAAO,wBAAwB;AAAA,QACrD,WAAW,oBAAI,KAAK;AAAA,MACtB;AAEA,aAAO,EAAE,IAAI,MAAM,MAAM,WAAW;AAAA,IACtC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6C,OAAO,KAAK,CAAC;AAAA,UAC1D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAO,KAA2D;AACtE,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,UAAI,CAAC,KAAK,WAAW;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,KAAK;AAAA,QACnB,KAAK;AAAA,QACL,CAAC;AAAA,UACC,UAAU,WAAW,GAAG;AAAA,UACxB,SAAS;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,iBAAiB;AAAA,QAC3B,CAAC;AAAA,MACH;AACA,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyB,GAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,IAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,kCAAkC,UAAU,MAAM,SAAS,KAAK,CAAC;AAChF,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQ,KAAK;AAC9C,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,+CAA+C,OAAO,KAAK,CAAC;AAAA,UAC5D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,KAAgD;AAC3D,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,YAAY,qBAAqB,eAAe,iBAAiB;AAAA,MAC1E;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QAC5C,UAAU,WAAW,GAAG;AAAA,QACxB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,sBAAsB;AAAA,QACpE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM,KAAK,UAAU,EAAE,IAAI,CAAC;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,MAAM,SAAS,WAAW,KAAK;AAC3C,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,oCAAoC,SAAS,MAAM,MAAM,SAAS;AAAA,YAClE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,IAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,UAAU,MAAM,SAAS,KAAK,CAAC;AACrE,YAAM,wBAAwB,OAAO,YACnC,SAAS,WAAW,MAChB,OAAO,KAAK,WAAW,eAAe,CAAC,OAAO,KAAK,SACnD,OAAO,KAAK,WAAW;AAE7B,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQ,OAAO,CAAC,uBAAuB;AACxE,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO,YAAY,qBAAqB,SAAS,mBAAmB,KAAK;AAAA,QAC3E;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,2CAA2C,OAAO,KAAK,CAAC;AAAA,UACxD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MACJC,WAAyC,CAAC,GACF;AACxC,UAAM,YAAY,oCAAoC,UAAUA,QAAO;AACvE,QAAI,CAAC,UAAU,SAAS;AACtB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,gBAAgB;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,oBAAoB,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QACtD,SAAS,KAAK;AAAA,QACd,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,UAAU,OAAO,YAAY,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,CAAC;AAC3E,cAAQ,cAAc,IAAI;AAC1B,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,qBAAqB;AAAA,QACnE,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,UAAU,IAAI;AAAA,MACrC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,4BAA4B,UAAU,MAAM,SAAS,KAAK,CAAC;AAC1E,UAAI,CAAC,OAAO,SAAS;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,OAAsC;AAC1C,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,gBAAgB,IAAI,iBAAiB,IAAI;AAErE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAclC,YAAM,cAA4B,KAAK,IAAI,CAAC,UAAU;AAAA,QACpD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,SAAS,KAA+C;AAC5D,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,cAAc,KAAK,CAAC;AAEvD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyB,GAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,mCAAmC,SAAS,MAAM,MAAM,SAAS;AAAA,YACjE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,IAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAgBlC,YAAM,QAAyB,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,QACvD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,gBAAgB,MAAc,QAA0C;AAC5E,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAE5C,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAEhB,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,QACjC;AAEA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,EAAE,IAAI,MAAM,MAAM,KAAK,QAAQ;AAAA,IACxC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC3zBA,IAAAC,cAAkB;AA6BX,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,UAAU;AAAA,IACb,CAAC,QAAQ,OAAO,IAAI,MAAM,YAAY,IAAI,EAAE,SAAS;AAAA,IACrD,EAAE,SAAS,6CAA6C;AAAA,EAC1D;AAAA;AAAA,EAEA,QAAQ,cAAE,OAAO,EAAE,IAAI,GAAG,oBAAoB;AAAA;AAAA,EAE9C,YAAY;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,IAAI,GAAG,kBAAkB;AAAA;AAAA,EAE1C,MAAM,cAAE,OAAO,EAAE,IAAI,0BAA0B;AAAA;AAAA,EAE/C,SAAS,cAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB;AAAA;AAAA,EAEhD,SAAS,cAAE,QAAQ,CAAC;AACtB,CAAC;AAWM,IAAM,uBAAuB,cAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,iBAAiB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,eAAe,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIpC,eAAe,oBAAoB,SAAS;AAC9C,CAAC;AAeM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,mCAAmC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3E,SAAS,cACN,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,gDAAgD;AAAA,EAC7D,EACC,SAAS;AAAA;AAAA,EAEZ,QAAQ,cACL,QAAQ,EACR,OAAO,CAAC,QAA+B,OAAO,QAAQ,YAAY;AAAA,IACjE,SAAS;AAAA,EACX,CAAC;AAAA;AAAA,EAEH,OAAO,cACJ,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACtC,EAAE,SAAS,yCAAyC;AAAA,EACtD,EACC,SAAS;AAAA;AAAA,EAEZ,aAAa;AAAA;AAAA,EAEb,UAAU,cACP,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACjC,EAAE,SAAS,4CAA4C;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKF,mBAAmB,cAChB,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,mDAAmD;AAAA,EAChE,EACC,SAAS;AAAA;AAAA,EAEZ,iBAAiB,cAAE,QAAQ,EAAE;AAAA,IAC3B,CAAC,QAMmB,OAAO,QAAQ;AAAA,IACnC,EAAE,SAAS,8CAA8C;AAAA,EAC3D;AAAA;AAAA,EAEA,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7B,kBAAkB,cACf,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,sBAAsB,cACnB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,YAAY,cACT,QAAQ,EACR,OAAO,CAAC,QAA4D,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IACnH,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhC,eAAe,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,wBAAwB,cACrB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC;AAwBM,SAAS,yBACd,MAC2C;AAC3C,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,uBAAuB,OAAO,MAAM,OAAO;AAAA,QACpD,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;ACtNO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAItD,YAAY,SAA4B,SAA4B;AAClE;AAAA,MACE,0DAA0D,QAAQ,MAAM;AAAA,IAC1E;AACA,SAAK,OAAO;AACZ,SAAK,UAAU;AACf,SAAK,UAAU;AAAA,EACjB;AACF;AAMO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAG7C,YAAY,WAAiB;AAC3B,UAAM,sBAAsB,UAAU,YAAY,CAAC,EAAE;AACrD,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;AAMO,IAAM,qCAAN,cAAiD,MAAM;AAAA,EAM5D,YAAY,SAA4B;AACtC;AAAA,MACE;AAAA,IACF;AAPF;AAAA,gBAAO;AAQL,SAAK,OAAO;AACZ,SAAK,UAAU,QAAQ,IAAI,UAAU;AAAA,EACvC;AACF;AA0BO,SAAS,eAAe,OAAuB;AACpD,MAAI,CAAC,MAAM,WAAW,YAAY,GAAG;AACnC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,MAAM,cAAc,MAAM,SAAS,GAAG;AACtD,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,YAAY,CAAC;AAClC;AAiCO,SAAS,mBACd,WACA,SACmB;AACnB,QAAM,UAA6B,CAAC;AAEpC,aAAW,OAAO,WAAW;AAC3B,UAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,yBAAyB,KAAK,CAAC,CAAC;AAClE,QAAI,UAAU,QAAW;AACvB,cAAQ,KAAK,WAAW,GAAG,CAAC;AAC5B;AAAA,IACF;AAAA,EAEF;AAEA,SAAO,EAAE,QAAQ,QAAQ,WAAW,GAAG,QAAQ;AACjD;AAMA,SAAS,yBACP,WACA,SACS;AACT,MAAI,UAAU,YAAY,QAAQ,SAAS;AACzC,WAAO;AAAA,EACT;AAIA,MACE,eAAe,UAAU,SAAS,sBAAsB,MACxD,eAAe,QAAQ,SAAS,sBAAsB,GACtD;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAACC,cAAa,QAAQ,MAAM,UAAU,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AAIA,QAAM,aAAa,IAAI;AAAA,IACrB,uBAAuB,UAAU,SAAS,UAAU,OAAO;AAAA,EAC7D;AACA,QAAM,iBAAiB,uBAAuB,QAAQ,SAAS,QAAQ,OAAO;AAC9E,aAAW,KAAK,YAAY;AAC1B,QAAI,CAAC,eAAe,KAAK,CAAC,kBAAkB,eAAe,eAAe,CAAC,CAAC,GAAG;AAC7E,aAAO;AAAA,IACT;AAAA,EACF;AAIA,MAAI,CAAC,kBAAkB,UAAU,SAAS,QAAQ,OAAO,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAUO,SAAS,kBACd,MACA,OACS;AACT,SAAO,yBAAyB,IAAI,MAAM,yBAAyB,KAAK;AAC1E;AASO,SAAS,yBACd,SACQ;AACR,QAAM,eAAe,CAAC,UAA2B;AAC/C,QAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACvD,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS;AACf,YAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE;AAAA,QAAI,CAAC,QACzC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC;AAAA,MACrD,EAAE,KAAK,GAAG,CAAC;AAAA,IACb;AACA,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,YAAY,WAAW,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK;AACxD,MAAI,SAAS,WAAW,KAAM,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,MAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;AAGO,SAAS,eAAe,eAAuB,iBAAkC;AACtF,MAAI,kBAAkB,OAAO,kBAAkB,gBAAiB,QAAO;AACvE,MAAI,CAAC,cAAc,SAAS,IAAI,EAAG,QAAO;AAC1C,QAAM,UAAU,cAAc,MAAM,GAAG,EAAE;AACzC,SAAO,oBAAoB,WAAW,gBAAgB,WAAW,GAAG,OAAO,GAAG;AAChF;AAWA,SAASA,cAAa,aAAqB,eAAgC;AACzE,MAAI,gBAAgB,MAAM,gBAAgB,KAAK;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS,GAAG,GAAG;AAC7B,WAAO,cAAc,WAAW,WAAW;AAAA,EAC7C;AACA,SAAO,kBAAkB;AAC3B;AAEA,SAAS,WAAW,OAAyC;AAC3D,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,EAC/D;AACF;AAgDO,SAAS,uBACd,WACA,MACmB;AACnB,QAAM,MAAM,UAAU,IAAI;AAC1B,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAgC,IAAI,IAAI,CAAC,UAAU;AACvD,UAAM,cACJ,sBAAsB,MAAM,OAAO;AAAA;AAAA;AAAA,KAIlC,MAAM,QAAQ,WAAW,YAAY,IAClC,MAAM,UACN,aAAa,MAAM,OAAO;AAChC,WAAO;AAAA,MACL,SAAS;AAAA;AAAA;AAAA;AAAA,MAIT,OAAO,eAAe,MAAM,KAAK;AAAA,MACjC,MAAM,MAAM;AAAA,MACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,MAC1B,GAAI,MAAM,YAAY,SAClB,CAAC,IACD,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B;AAAA,IACxF;AAAA,EACF,CAAC;AAID,aAAW,KAAK,CAAC,GAAG,MAAM;AACxB,UAAM,SAAS,EAAE,SAAS;AAC1B,UAAM,SAAS,EAAE,SAAS;AAC1B,QAAI,WAAW,OAAQ,QAAO,SAAS,SAAS,KAAK;AACrD,QAAI,EAAE,YAAY,EAAE,QAAS,QAAO,EAAE,UAAU,EAAE,UAAU,KAAK;AACjE,QAAI,EAAE,SAAS,EAAE,KAAM,QAAO,EAAE,OAAO,EAAE,OAAO,KAAK;AACrD,WAAO;AAAA,EACT,CAAC;AAED,SAAO;AACT;;;ACvVA,IAAAC,kBAAwB;AAoBxB,SAAS,gCACP,SACoB;AACpB,MAAI;AACJ,aAAW,UAAU,SAAS;AAC5B,UAAM,QAAQ,OAAO,QAAQ,GAAG;AAChC,QAAI,UAAU,GAAI,QAAO;AACzB,UAAM,cAAc,OAAO,MAAM,GAAG,KAAK;AACzC,UAAM,YAAY,sBAAsB,WAAW;AACnD,QAAI,cAAc,OAAW,QAAO;AACpC,QAAI,UAAU,QAAW;AACvB,cAAQ;AAAA,IACV,WAAW,UAAU,WAAW;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AASA,IAAM,uBAAuB,CAAC,oBAAoB,uBAAuB;AAMzE,IAAM,oBAAoB,OAAO;AAKjC,IAAM,gBAAgB;AAStB,SAASC,aACPC,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAKA,SAASC,iBAAgB,MAAsB;AAE7C,MAAIC;AACJ,MAAI,OAAO,SAAS,aAAa;AAC/B,IAAAA,UAAS,KAAK,SAAS,mBAAmB,IAAI,CAAC,CAAC;AAAA,EAClD,WAAW,OAAO,WAAW,aAAa;AACxC,IAAAA,UAAS,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,SAAOA,QAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACzE;AAKA,SAASC,iBAAgB,SAAyB;AAEhD,MAAID,UAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAEzD,SAAOA,QAAO,SAAS,GAAG;AACxB,IAAAA,WAAU;AAAA,EACZ;AAEA,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,mBAAmB,OAAO,KAAKA,OAAM,CAAC,CAAC;AAAA,EAChD,WAAW,OAAO,WAAW,aAAa;AACxC,WAAO,OAAO,KAAKA,SAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;AA0RO,IAAM,iBAAN,MAAgD;AAAA;AAAA;AAAA;AAAA,EAqBrD,YAAY,QAA8B;AACxC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,cAAc,OAAO;AAC1B,SAAK,WAAW,OAAO;AACvB,SAAK,oBAAoB,OAAO;AAChC,SAAK,kBAAkB,OAAO;AAC9B,SAAK,WAAW,OAAO,WAAW,IAAI,QAAQ,OAAO,EAAE;AACvD,SAAK,qBAAqB,OAAO;AACjC,SAAK,yBAAyB,OAAO;AACrC,SAAK,eAAe,OAAO;AAC3B,SAAK,aAAa,OAAO,cAAc;AACvC,SAAK,gBAAgB,OAAO;AAC5B,SAAK,yBAAyB,OAAO;AACrC,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,SAA+B;AAClD,SAAK,iBAAiB;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aAAa,QAAgM;AAClN,SAAK,iBAAiB;AACtB,QAAI,OAAO,YAAY,QAAW;AAChC,WAAK,UAAU,OAAO;AAAA,IACxB;AACA,QAAI,OAAO,sBAAsB,QAAW;AAC1C,WAAK,oBAAoB,OAAO;AAAA,IAClC;AACA,QAAI,OAAO,qBAAqB,QAAW;AACzC,WAAK,qBAAqB,OAAO;AAAA,IACnC;AACA,QAAI,OAAO,yBAAyB,QAAW;AAC7C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,kBAAkB,QAAW;AACtC,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AACA,QAAI,OAAO,2BAA2B,QAAW;AAC/C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,iBAAiB,QAAW;AACrC,WAAK,iBAAiB,OAAO;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,SAAS,QAA0E;AACvF,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAGxD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOH;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,sBAAsB,CAAC,KAAK,mBAAmB;AACvF,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,WAAW;AAClC,UAAM,kBAAkB,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AAChF,QAAI,SAAS;AAEb,UAAM,SAAsB,OAAO,UAAU;AAI7C,UAAM,WAAW,KAAK,aAClB,GAAG,KAAK,UAAU,IAAI,OAAO,IAAI,GAAG,QAAQ,QAAQ,GAAG,IACvD,OAAO;AAGX,QAAI,WAAW,UAAU;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,YAAM,eAAe,SAAS,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE,CAAC;AACvF,cAAQ,MAAM,KAAK,YAAY,iBAAiB,YAAY;AAC5D,YAAM,yBAAyB,KAAK,kBAAkB;AACtD,UAAI,uBAAwB,QAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB;AAC9E,eAAS,MAAM,KAAK,YAAY,OAAO,KAAK;AAC5C,YAAM,oBAAoB,KAAK,kBAAkB;AACjD,UAAI,kBAAmB,QAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AACpE,eAAS,KAAK,YAAY,OAAO,KAAK;AAGtC,UAAI,CAAC,OAAO,GAAG;AACb,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAASK,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6CK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,UAC7FA,gBAAe,QAAQA,OAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AAGJ,UAAM,WAAW,OAAO,MAAM,GAAG,EAAE,CAAC;AAGpC,UAAM,yBAAyB,CAC7B,WACuD;AACvD,UAAI,UAAU,OAAO,WAAW,YAAY,QAAQ,QAAQ;AAC1D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAOA,UAAM,yBAAyB,KAAK;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,wBAAwB;AAE1B,YAAM,mBAAmB,MAAM,KAAK,wBAAwB,UAAU,UAAU,SAAS,MAAM;AAC/F,YAAM,6BAA6B,KAAK,kBAAkB;AAC1D,UAAI,2BAA4B,QAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B;AACtF,YAAM,SAAS,uBAAuB,gBAAgB;AACtD,UAAI,QAAQ,UAAU,OAAO,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,mBAAa;AAAA,IACf,WAAW,KAAK,wBAAwB;AAEtC,UAAI;AACF,cAAM,iBAAiB,MAAM,KAAK,uBAAuB;AAAA,UACvD,aAAa;AAAA,UACb,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM;AAAA,UACN;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,4BAA4B,KAAK,kBAAkB;AACzD,YAAI,0BAA2B,QAAO,EAAE,IAAI,OAAO,OAAO,0BAA0B;AAEpF,YAAI,gBAAgB;AAClB,uBAAa;AACb,mBAAS;AAAA,QACX,OAAO;AACL,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOL;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAASK,MAAK;AACZ,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOL;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACAK,gBAAe,QAAQA,OAAM;AAAA,UAC/B;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,KAAK,kBAAkB;AAChD,QAAI,iBAAkB,QAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAGlE,UAAM,YAA8B;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS,KAAK,QAAQ;AAAA,MACtB,SAAS;AAAA,IACX;AAGA,UAAM,cAAc,KAAK,WAAW,WAAW,MAAM;AAGrD,UAAM,UAAU,OAAO,WAAW,KAAK;AACvC,UAAM,MAAM,UAAU,GAAG,OAAO,UAAU,WAAW,KAAK;AAE1D,UAAM,YAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,aAAa,OAAO;AAAA,IACtB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,UAAU;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,6BACN,MACA,SACA,iBACS;AAET,UAAM,UAAU,KAAK,SAAS,WAAW;AACzC,eAAW,OAAO,SAAS;AACzB,YAAM,cAAc,KAAK,SAAS,qBAAqB,IAAI,EAAE;AAC7D,iBAAW,cAAc,aAAa;AAIpC,YAAI,WAAW,YAAY,KAAK,SAAS,SAAS;AAChD;AAAA,QACF;AAKA,aAAK,WAAW,SAAS,UAAU,KAAK,GAAG;AACzC;AAAA,QACF;AAGA,YAAI,CAAC,KAAK,SAAS,kBAAkB,UAAU,GAAG;AAChD;AAAA,QACF;AAGA,YAAI,WAAW,SAAS,iBAAiB;AACvC;AAAA,QACF;AAGA,YAAI,WAAW,uBAAuB,OAAO;AAC3C;AAAA,QACF;AAGA,cAAM,iBAAiB,WAAW,QAAQ;AAC1C,YAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,GAAG;AAC3C;AAAA,QACF;AAGA,cAAM,oBAAoB,WAAW,WAAW,CAAC;AACjD,cAAM,gBAAgB,QAAQ;AAAA,UAAM,YAClC,kBAAkB,SAAS,MAAM,KAAK,kBAAkB,SAAS,GAAG;AAAA,QACtE;AACA,YAAI,CAAC,eAAe;AAClB;AAAA,QACF;AAGA,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAiD;AACvD,QAAI;AACF,WAAK,iBAAiB;AACtB,aAAO;AAAA,IACT,SAASK,MAAK;AACZ,aAAOL;AAAA,QACL,qBAAqB;AAAA,QACrB;AAAA,QACAK,gBAAe,QAAQA,OAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,YAAY,gBAAwB,eAAgC;AAE1E,QAAI,mBAAmB,MAAM,mBAAmB,KAAK;AACnD,aAAO;AAAA,IACT;AAGA,QAAI,mBAAmB,eAAe;AACpC,aAAO;AAAA,IACT;AAGA,UAAM,uBAAuB,eAAe,QAAQ,OAAO,EAAE;AAC7D,UAAM,oBAAoB,cAAc,QAAQ,OAAO,EAAE;AAEzD,QAAI,kBAAkB,WAAW,uBAAuB,GAAG,GAAG;AAC5D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,wBACZ,aACA,MACA,SACA,QACsD;AACtD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,wBAAwB;AAc/B,UAAI;AACF,YAAI,QAAQ,WAAW,GAAG;AACxB,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,eAAe,gCAAgC,OAAO;AAC5D,YAAI,iBAAiB,QAAW;AAC9B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,uDAAuD,KAAK,UAAU,OAAO,CAAC;AAAA,YAChF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,aAAa,KAAK,uBAAuB;AAAA,UAC7C,SAAS,KAAK;AAAA,UACd;AAAA,UACA,SAAS,KAAK,QAAQ;AAAA,UACtB,WAAW;AAAA,YACT,CAAC,YAAY,GAAG;AAAA,cACd,CAAC,IAAI,GAAG,CAAC,GAAG,OAAO;AAAA,YACrB;AAAA,UACF;AAAA,UACA,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,QACpD,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAGhF,cAAM,cAAc,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,aAAa;AAAA,UAC9D,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,eAAe,WAAW;AAAA,UAC5B;AAAA,QACF,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAEhF,YAAI,CAAC,YAAY,IAAI;AACnB,gBAAM,YAAY,MAAM,YAAY,KAAK;AACzC,gBAAM,8BAA8B,KAAK,kBAAkB;AAC3D,cAAI,4BAA6B,QAAO,EAAE,IAAI,OAAO,OAAO,4BAA4B;AACxF,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,8CAA8C,YAAY,MAAM,IAAI,SAAS;AAAA,YAC/E;AAAA,UACF;AAAA,QACF;AAOA,YAAI,WAAW,UAAU,WAAW,GAAG;AACrC,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,UAAU,WAAW,UAAU,CAAC;AACtC,eAAO;AAAA,UACL,KAAK,WAAW;AAAA,UAChB,aAAa,WAAW;AAAA,UACxB,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM,QAAQ;AAAA,UACd,SAAS,QAAQ;AAAA,UACjB,QAAQ,WAAW;AAAA,UACnB,WAAW;AAAA,UACX,YAAY,WAAW;AAAA,UACvB,oBAAoB;AAAA,UACpB,WAAW,oBAAI,KAAK;AAAA,QACtB;AAAA,MACF,SAASK,MAAK;AACZ,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOL;AAAA,YACL,qBAAqB;AAAA,YACrB,yCAAyCK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,YACzFA,gBAAe,QAAQA,OAAM;AAAA,UAC/B;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AAEL,YAAM,mBAA2C;AAAA,QAC/C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,sBAAsB;AAAA,MACxB;AAEA,YAAM,mBAAmB,KAAK,qBAC1B,MAAM,KAAK,mBAAmB,gBAAgB,IAC9C,MAAM,KAAK,kBAAmB,OAAO,gBAAgB;AACzD,YAAM,gCAAgC,KAAK,kBAAkB;AAC7D,UAAI,8BAA+B,QAAO,EAAE,IAAI,OAAO,OAAO,8BAA8B;AAE5F,UAAI,CAAC,iBAAiB,IAAI;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOL;AAAA,YACL,qBAAqB;AAAA,YACrB,0CAA0C,iBAAiB,MAAM,OAAO;AAAA,YACxE,iBAAiB,MAAM;AAAA,YACvB,iBAAiB,MAAM;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,iBAAiB;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QACJ,MACAM,WAA0B,CAAC,GACoB;AAC/C,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM;AAAA,MACJ,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB;AAAA,IACF,IAAIA;AAGJ,UAAM,eAAe,KAAK,yBAAyB,IAAI;AACvD,QAAI,CAAC,aAAa,IAAI;AACpB,aAAO;AAAA,IACT;AACA,UAAM,YAAY,aAAa;AAM/B,UAAM,mBAAmB,IAAI,KAAK,UAAU,WAAW,MAAM;AAC7D,QAAI,mBAAmB,oBAAI,KAAK,GAAG;AACjC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAON;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,UAAM,UAAmB;AAAA,MACvB,IAAI,YAAY,UAAU,MAAM;AAAA,MAChC,KAAK,UAAU;AAAA,MACf,MAAM;AAAA,MACN,KAAK,UAAU;AAAA,MACf,UAAU;AAAA;AAAA,IACZ;AAEA,SAAK,SAAS,UAAU,SAAS,UAAU,YAAY,aAAa;AAGpE,QAAI,mBAAmB,UAAU;AACjC,QAAI,YAAY;AAGhB,QAAI,mBAAmB,iBAAiB,KAAK,SAAS;AACpD,YAAM,QAAQ,MAAM,KAAK,sBAAsB,MAAM;AAAA,QACnD,aAAa,KAAK,QAAQ;AAAA,QAC1B,cAAc,UAAU;AAAA,MAC1B,CAAC;AACD,UAAI,CAAC,MAAM,GAAI,QAAO;AACtB,yBAAmB,MAAM,KAAK;AAC9B,kBAAY;AAAA,QACV,IAAI,WAAW,aAAa,KAAK,QAAQ,kBAAkB,CAAC;AAAA,QAC5D,KAAK,KAAK,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,IACF;AAKA,UAAM,wBAAyB,iBAE5B,kBAAkB;AACrB,UAAM,aAAa,yBAAyB,iBAAiB,cAAc,UAAU,iBAAiB,GAAG;AACzG,UAAM,gBAAgB,UAAU,SAAS,aAAa,KAAK,UACvD,KAAK,UACL;AACJ,UAAM,eAA+B;AAAA,MACnC,kBAAkB,EAAE,eAAe,WAAW;AAAA,MAC9C,eAAe,iBAAiB;AAAA,MAChC,SAAS,UAAU;AAAA,MACnB,oBAAoB,eAAe,sBAAsB,UAAU;AAAA,MACnE,KAAK,eAAe,OAAO,UAAU;AAAA,IACvC;AAEA,UAAM,YAAY,KAAK,gBAAgB;AAAA,MACrC,OAAO,CAAC,UAAU,IAAI;AAAA,MACtB,SAAS;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,YAAY,UAAU;AAAA,IACxB,CAAC;AAED,UAAM,cAA2B;AAAA,MAC/B,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,UAAU;AAAA,MACnB,MAAM,UAAU;AAAA,IAClB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,sBACJ,MACA,QACwD;AACxD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM,UAAU,KAAK,yBAAyB,IAAI;AAClD,QAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,UAAM,YAAY,QAAQ;AAC1B,SAAK,mCAAmC,UAAU,UAAU;AAE5D,UAAM,eAAe,IAAI,KAAK,UAAU,WAAW,MAAM;AACzD,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,gBAAgB,KAAK;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,cAAc,0BAA0B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,SAAS,+BAA+B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,uBAAuB,OAAO;AACrD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc,aAAa,OAAO,aAAa,KAAK,KAAK,EAAE;AACjE,QAAI,CAAC,2BAA2B,KAAK,WAAW,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,eAAe,iCAAiC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,cAAc,kBAAkB,UAAU,MAAM,KAAK,OAAO,OAAO,YAAY;AACrF,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,UAAU,WAAW,YAAY,UAAU,WAC3C,aAAa,UAAU,WAAW,WAAW,MAAM,aAAa,UAAU,MAAM,KAChF,CAAC,mBAAmB,UAAU,KAAK,UAAU,MAAM,KACnD,CAAC,uBAAuB,UAAU,WAAW,MAAM,UAAU,IAAI,GACjE;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,UAAU,WAAW,YAAY;AACpC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,cAAc;AACtD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,OAAO,QAAQ,UAAU;AACtC,QAAI,CAAC,uBAAuB,UAAU,MAAM,IAAI,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,gBAAgB,UAAU,WAAW;AAC3C,UAAM,UAAU,OAAO,WAAW,CAAC,GAAG,aAAa;AACnD,QACE,QAAQ,WAAW,KACnB,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAClC,QAAQ,SAAS,GAAG,KACpB,QAAQ,KAAK,CAAC,WAAW,CAAC,cAAc,KAAK,CAAC,iBAAiB,eAAe,cAAc,MAAM,CAAC,CAAC,GACpG;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,OAAO,UAAU;AAChC,QAAI,UAAU,OAAO,SAAS,cAAc;AAC1C,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,gCAAgC,OAAO;AACvD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,iBAAiB,UAAU,OAAO;AAChD,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,gBAAgC;AAAA,QACpC,kBAAkB,EAAE,eAAe,UAAU,WAAW,WAAW;AAAA,QACnE,eAAe,UAAU,WAAW;AAAA,QACpC,SAAS,UAAU;AAAA,QACnB,oBAAoB,UAAU;AAAA,QAC9B,KAAK,UAAU;AAAA,MACjB;AACA,YAAM,SAAS,KAAK,uBAAuB;AAAA,QACzC,SAAS;AAAA,QACT;AAAA,QACA,SAAS,UAAU;AAAA,QACnB,WAAW,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,GAAG,QAAQ,EAAE;AAAA,QAC5C,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,MACpD,CAAC;AACD,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,YAAM,gBAAgB,kBAAkB,QAAQ;AAAA,QAC9C;AAAA,QACA,WAAW,aAAa,UAAU,MAAM;AAAA,QACxC,WAAW,UAAU,WAAW;AAAA,QAChC;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB,GAAG,KAAK,YAAY;AACpB,UAAI,CAAC,eAAe;AAClB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,mBAAmB;AAAA,QACvB,QAAQ;AAAA,QACR,SAAS,EAAE,eAAe,OAAO,WAAW;AAAA,QAC5C,UAAU;AAAA,MACZ;AACA,YAAM,eAAe,MAAM,KAAK,QAAQ,IAAI,IAAI,aAAa,WAAW,EAAE,SAAS,GAAG,gBAAgB;AACtG,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,UAAI,CAAC,aAAa,IAAI;AACpB,cAAM,IAAI,MAAM,mCAAmC,aAAa,MAAM,GAAG;AAAA,MAC3E;AAEA,YAAM,UAAU,cAAc;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,UACJ,YAAY;AAAA,YACV,KAAK,OAAO;AAAA,YACZ,aAAa,cAAc;AAAA,YAC3B,cAAc,UAAU,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,YAC3C,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,SAAS,QAAQ;AAAA,YACjB,QAAQ,cAAc;AAAA,YACtB,WAAW;AAAA,YACX,oBAAoB;AAAA,YACpB,WAAW,UAAU,WAAW;AAAA,YAChC,WAAW;AAAA,YACX,kBAAkB,EAAE,eAAe,OAAO,WAAW;AAAA,YACrD,cAAc,MAAM;AAAA,YACpB,SAAS,MAAM;AAAA,YACf,MAAM;AAAA,YACN,WAAW,OAAO;AAAA,YAClB,sBAAsB;AAAA,UACxB;AAAA,UACA,QAAQ;AAAA,YACN,WAAW,UAAU,WAAW;AAAA,YAChC,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,MAAM;AAAA,YACN,WAAW,cAAc;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAASK,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mCAAmC,YAA8B;AACvE,QAAI,kBAAkB,WAAW,SAAS,MAAS,EAAG;AACtD,UAAM,UAAU,WAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK;AAC3D,UAAM,QAAyB;AAAA,MAC7B;AAAA,MACA,OAAO,WAAW;AAAA,MAClB,MAAM,WAAW;AAAA,MACjB,SAAS,CAAC,GAAG,WAAW,OAAO;AAAA,MAC/B,SAAS,WAAW,WAAW,CAAC;AAAA,IAClC;AACA,UAAM,IAAI,mCAAmC,CAAC,KAAK,CAAC;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAwB,SAAsB,UAAkB;AACzE,QAAI,WAAW,UAAU;AACvB,YAAM,IAAI,MAAM,WAAW,MAAM,gDAAgD;AAAA,IACnF;AAEA,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,UAAM,UAAUE,iBAAgB,UAAU;AAC1C,WAAO,GAAG,aAAa,GAAG,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAgC;AACzC,UAAM,SAAS,KAAK,yBAAyB,IAAI;AACjD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AAAA,IACtC;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,yBAAyB,MAAyD;AAExF,QAAI,UAAU;AAGd,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,YAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,gBAAU,MAAM,MAAM,SAAS,CAAC;AAAA,IAClC;AAGA,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,IAAI;AACxB,kBAAU,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,MAC7C,QAAQ;AACN,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOF;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,QAAQ,WAAW,aAAa,GAAG;AACtC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iDAAiD,aAAa;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,QAAQ,MAAM,cAAc,MAAM;AAErD,QAAI;AACJ,QAAI;AACF,mBAAaI,iBAAgB,UAAU;AAAA,IACzC,SAASC,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,iCAAiCK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,UACjFA,gBAAe,QAAQA,OAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,UAAU;AAAA,IAChC,SAASA,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,oCAAoCK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,UACpFA,gBAAe,QAAQA,OAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QACE,UACA,OAAO,WAAW,YAClB,gBAAgB,UAChB,OAAO,cACP,OAAO,OAAO,eAAe,YAC7B,YAAY,OAAO,cACnB,OAAO,OAAO,WAAW,WAAW,UACpC;AACA,MAAC,OAAO,WAAgC,SAAS,IAAI,KAAK,OAAO,WAAW,MAAM;AAAA,IACpF;AAGA,UAAM,mBAAmB,yBAAyB,MAAM;AACxD,QAAI,CAAC,iBAAiB,IAAI;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,iBAAiB,MAAM;AAAA,UACvB;AAAA,UACA,iBAAiB,MAAM;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,iBAAiB,KAAK;AAAA,EACjD;AACF;AAKO,SAAS,qBAAqB,QAA+C;AAClF,SAAO,IAAI,eAAe,MAAM;AAClC;AAEA,SAAS,iBAAiB,SAA8D;AACtF,QAAM,QAAQ,QAAQ,MAAM,kDAAkD;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,MAAI,CAAC,OAAO,cAAc,OAAO,EAAG,QAAO;AAC3C,SAAO,EAAE,SAAS,SAAS,MAAM,CAAC,EAAE;AACtC;AAEA,SAAS,uBAAuB,OAA8B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACH,IAAI,aAAa,MAAM,IAAI,aAAa,OACzC,IAAI,UACJ,IAAI,KACJ,QAAO;AACT,WAAO,IAAI,OAAO,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,WAAmB,YAAsB,UAAkC;AACpG,QAAM,SAAS,uBAAuB,SAAS;AAC/C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,IAAI,IAAI,WAAW,IAAI,sBAAsB,EAAE,OAAO,CAAC,UAA2B,QAAQ,KAAK,CAAC,CAAC;AACjH,MAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,QAAO;AACjC,MAAI,YAAY,uBAAuB,QAAQ,MAAM,OAAQ,QAAO;AACpE,SAAO;AACT;AAEA,SAAS,wBAAwB,MAA6B;AAC5D,MACE,oBAAoB,KAAK,IAAI,KAC7B,iBAAiB,KAAK,IAAI,KAC1B,KAAK,SAAS,IAAI,EAClB,QAAO;AACT,QAAM,gBAAgB,KAAK,QAAQ,GAAG;AACtC,MAAI,kBAAkB,MAAM,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,EAAG,QAAO;AAClF,MAAI,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,KAAM,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,EAAI,QAAO;AACxG,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAS,KAAK,CAAC,YAAY,YAAY,OAAO,YAAY,IAAI,EAAG,QAAO;AAC5E,SAAO;AACT;AAEA,SAAS,uBAAuB,QAAgB,OAAwB;AACtE,QAAM,kBAAkB,wBAAwB,MAAM;AACtD,QAAM,iBAAiB,wBAAwB,KAAK;AACpD,MAAI,oBAAoB,QAAQ,mBAAmB,KAAM,QAAO;AAChE,MAAI,oBAAoB,MAAM,oBAAoB,IAAK,QAAO;AAC9D,MAAI,oBAAoB,eAAgB,QAAO;AAC/C,MAAI,gBAAgB,SAAS,KAAK,GAAG;AACnC,WAAO,eAAe,WAAW,gBAAgB,MAAM,GAAG,EAAE,CAAC;AAAA,EAC/D;AACA,MAAI,gBAAgB,SAAS,IAAI,GAAG;AAClC,UAAM,SAAS,gBAAgB,MAAM,GAAG,EAAE;AAC1C,QAAI,CAAC,eAAe,WAAW,MAAM,EAAG,QAAO;AAC/C,UAAM,YAAY,eAAe,MAAM,OAAO,MAAM;AACpD,WAAO,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,GAAG;AAAA,EACxD;AACA,SAAO,gBAAgB,SAAS,GAAG,KAAK,eAAe,WAAW,eAAe;AACnF;AAEA,SAAS,mBAAmB,KAAU,QAAyB;AAC7D,MACE,IAAI,QAAQ,SACZ,IAAI,QAAQ,aACZ,OAAO,IAAI,MAAM,YACjB,OAAO,IAAI,MAAM,SACjB,QAAO;AACT,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,OAAO,aAAa,MAAM,EAAE,MAAM,WAAW,MAAM,CAAC;AACrF,UAAM,YAAY,SAAS,WAAW,MAAM,SAAS,CAAC,MAAM,OAAQ,SAAS,CAAC,MAAM,IAChF,SAAS,MAAM,CAAC,IAChB;AACJ,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,WAAW,qBAAqB,IAAI,CAAC;AAC3C,UAAM,aAAa,qBAAqB,IAAI,CAAC;AAC7C,UAAM,mBAAmB,wBAAQ,aAAa,UAAU;AACxD,WACE,WAAW,WAAW,MACtB,UAAU,WAAW,SAAS,UAC9B,UAAU,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC,KACzD,iBAAiB,WAAW,SAAS,UACrC,iBAAiB,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC;AAAA,EAEpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAA2B;AACvD,MAAI,UAAU,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACxD,SAAO,QAAQ,SAAS,EAAG,YAAW;AACtC,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,WAAW,KAAK,KAAK,OAAO,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC9E;AACA,SAAO,WAAW,KAAK,OAAO,KAAK,SAAS,QAAQ,CAAC;AACvD;AAEA,SAAS,kBACP,QACA,UAWA,YAC4G;AAC5G,QAAM,QAAQ,OAAO,WAAW,MAAM,GAAG;AACzC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,qBAAqB,MAAM,CAAC,CAAC,CAAC,CAAC;AAAA,EAC/E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAClF,QAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAChF,QAAM,SAAS,MAAM,QAAQ,QAAQ,GAAG,IAAI,QAAQ,MAAM,CAAC;AAC3D,QAAM,iBAAiB,OAAO,QAAQ,QAAQ,YAAY,OAAO,UAAU,QAAQ,GAAG,IAAI,QAAQ,MAAM;AACxG,QAAM,YAAY,IAAI,KAAK,iBAAiB,GAAI;AAChD,MACE,gBAAgB,SAAS,eACzB,cAAc,SAAS,aACvB,OAAO,WAAW,KAClB,OAAO,CAAC,MAAM,SAAS,aACvB,aAAa,oBAAI,KAAK,KACtB,YAAY,SAAS,aACrB,YAAY,SAAS,mBACrB,WAAW,IAAI,YAAY,EAAE,OAAO,OAAO,UAAU,GAAG,KAAK,MAAM,OAAO,IAC1E,QAAO;AAET,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,UAAU,OAAO,QAAQ,GAA8B;AAC7D,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,CAAC,aAAa,YAAY,IAAI,QAAQ,CAAC;AAC7C,QAAM,SAAS,GAAG,SAAS,OAAO,IAAI,SAAS,OAAO;AACtD,MAAI,CAAC,YAAY,WAAW,MAAM,KAAK,YAAY,MAAM,OAAO,MAAM,MAAM,SAAS,KAAM,QAAO;AAClG,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,YAAY,MAAM,QAAQ,YAAY,EAAG,QAAO;AAC7F,QAAM,gBAAgB,OAAO,KAAK,YAAuC,EAAE,KAAK;AAChF,QAAM,kBAAkB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACnD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AAET,MAAI,aAAa,OAAO,WAAW,MAAM,eAAe,OAAO,UAAU,WAAW,EAAG,QAAO;AAC9F,MAAI,OAAO,OAAO,QAAQ,MAAM,UAAU,QAAQ,EAAG,QAAO;AAC5D,QAAM,WAAW,OAAO,UAAU,CAAC;AACnC,MACE,SAAS,YAAY,SAAS,WAC9B,SAAS,UAAU,SAAS,WAC5B,SAAS,SAAS,SAAS,KAC3B,QAAO;AACT,QAAM,gBAAgB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACjD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AACT,SAAO,EAAE,aAAa,WAAW,SAAS;AAC5C;;;AC/rDA,IAAAO,uBAAsC;AAatC,IAAMC,gBAAe;AASd,IAAM,kCAAkC;AAAA;AAAA,EAE7C,eAAe;AAAA;AAAA,EAEf,gBAAgB;AAAA;AAAA,EAEhB,oBAAoB;AAAA;AAAA,EAEpB,oBAAoB;AAAA;AAAA,EAEpB,oBAAoB;AAAA;AAAA,EAEpB,YAAY;AACd;AAkLO,IAAM,wBAAN,MAA8D;AAAA,EAA9D;AAIL;AAAA;AAAA;AAAA,SAAQ,OAA6B,oBAAI,IAAI;AAK7C;AAAA;AAAA;AAAA,SAAQ,QAAyB;AAAA,MAC/B,OAAO,oBAAI,IAAI;AAAA,MACf,OAAO,oBAAI,IAAI;AAAA,MACf,cAAc,oBAAI,IAAI;AAAA,IACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,YAAY,KAAc,aAAiC;AAEzD,SAAK,KAAK,IAAI,IAAI,IAAI,GAAG;AAGzB,QAAI,CAAC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,GAAG;AACjC,WAAK,MAAM,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC;AAAA,IACjC;AAGA,eAAW,cAAc,aAAa;AACpC,WAAK,cAAc,KAAK,UAAU;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU,OAAqB;AAE7B,UAAM,cAAc,KAAK,MAAM,MAAM,IAAI,KAAK,KAAK,CAAC;AAIpD,eAAW,cAAc,aAAa;AACpC,YAAM,SAAS,KAAK,MAAM,MAAM,IAAI,WAAW,GAAG;AAClD,UAAI,CAAC,OAAQ;AACb,YAAM,YAAY,OAAO,OAAO,CAAC,UAAU,MAAM,UAAU,KAAK;AAChE,UAAI,UAAU,WAAW,GAAG;AAC1B,aAAK,MAAM,MAAM,OAAO,WAAW,GAAG;AAAA,MACxC,OAAO;AACL,aAAK,MAAM,MAAM,IAAI,WAAW,KAAK,SAAS;AAAA,MAChD;AAAA,IACF;AAGA,eAAW,CAAC,QAAQ,OAAO,KAAK,KAAK,MAAM,cAAc;AACvD,YAAM,WAAW,QAAQ;AAAA,QACvB,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,MAAe,EAAE,OAAO,KAAK;AAAA,MAC5D;AACA,UAAI,SAAS,WAAW,GAAG;AACzB,aAAK,MAAM,aAAa,OAAO,MAAM;AAAA,MACvC,OAAO;AAEL,mBAAW,SAAS,UAAU;AAC5B,gBAAM,OAAO,MAAM,KAAK,OAAO,CAAC,MAAe,EAAE,OAAO,KAAK;AAAA,QAC/D;AACA,aAAK,MAAM,aAAa,IAAI,QAAQ,SAAS,OAAO,CAAC,MAAM,EAAE,KAAK,SAAS,CAAC,CAAC;AAAA,MAC/E;AAAA,IACF;AAGA,SAAK,MAAM,MAAM,OAAO,KAAK;AAG7B,SAAK,KAAK,OAAO,KAAK;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,oBAAoB,UAAkB,QAAgC;AAEpE,UAAM,kBAAkB,KAAK,oBAAoB,UAAU,MAAM;AAEjE,QAAI,gBAAgB,WAAW,GAAG;AAChC,aAAO;AAAA,IACT;AAGA,UAAM,YAAuB,CAAC;AAE9B,eAAW,SAAS,iBAAiB;AAEnC,UAAI,CAAC,KAAK,kBAAkB,MAAM,UAAU,GAAG;AAC7C;AAAA,MACF;AAGA,iBAAW,OAAO,MAAM,MAAM;AAC5B,YAAI,CAAC,UAAU,KAAK,CAAC,MAAe,EAAE,OAAO,IAAI,EAAE,GAAG;AACpD,oBAAU,KAAK,GAAG;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,IACT;AAGA,cAAU,KAAK,CAAC,GAAY,MAAe,EAAE,WAAW,EAAE,QAAQ;AAElE,WAAO,UAAU,CAAC;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAwC;AACtC,UAAM,MAAyB,CAAC;AAChC,eAAW,WAAW,KAAK,MAAM,aAAa,OAAO,GAAG;AACtD,UAAI,KAAK,GAAG,OAAO;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,qBAAqB,OAA6B;AAChD,WAAO,KAAK,MAAM,MAAM,IAAI,KAAK,KAAK,CAAC;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,UACE,KACA,YACAC,UACM;AAEN,UAAM,aAAsBA,UAAS,aAAa,SAC9C,EAAE,GAAG,KAAK,UAAUA,SAAQ,SAAS,IACrC;AAGJ,SAAK,KAAK,IAAI,WAAW,IAAI,UAAU;AAGvC,QAAI,CAAC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,GAAG;AACxC,WAAK,MAAM,MAAM,IAAI,WAAW,IAAI,CAAC,CAAC;AAAA,IACxC;AAGA,SAAK,cAAc,YAAY,UAAU;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,kBAAkB,YAAiC;AAEjD,QAAI,WAAW,WAAW;AACxB,aAAO;AAAA,IACT;AAGA,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,WAAW,UAAU,WAAW,SAAS,KAAK;AAChD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,OAAO,OAAoC;AACzC,WAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAwB;AACtB,WAAO,MAAM,KAAK,KAAK,KAAK,OAAO,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,QAAc;AACZ,SAAK,KAAK,MAAM;AAChB,SAAK,MAAM,MAAM,MAAM;AACvB,SAAK,MAAM,MAAM,MAAM;AACvB,SAAK,MAAM,aAAa,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,iBAAiB,KAAyC;AACxD,UAAM,SAAS,KAAK,MAAM,MAAM,IAAI,GAAG;AAEvC,QAAI,CAAC,UAAU,OAAO,WAAW,GAAG;AAClC,iBAAO;AAAA,YACL;AAAA,UACE,gCAAgC;AAAA,UAChC,yBAAyB,GAAG;AAAA,UAC5BD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,eAAW,SAAS,OAAQ,OAAM,WAAW,YAAY;AACzD,eAAW,kBAAkB,KAAK,MAAM,MAAM,OAAO,GAAG;AACtD,iBAAW,cAAc,gBAAgB;AACvC,YAAI,WAAW,QAAQ,IAAK,YAAW,YAAY;AAAA,MACrD;AAAA,IACF;AAGA,eAAW,WAAW,KAAK,MAAM,aAAa,OAAO,GAAG;AACtD,iBAAW,SAAS,SAAS;AAC3B,YAAI,MAAM,WAAW,QAAQ,KAAK;AAChC,gBAAM,WAAW,YAAY;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,iBACE,iBACA,QACmB;AACnB,UAAM,UAA6B,CAAC;AAEpC,eAAW,WAAW,KAAK,MAAM,aAAa,OAAO,GAAG;AACtD,iBAAW,SAAS,SAAS;AAE3B,YAAI,UAAU,MAAM,WAAW,QAAQ;AACrC;AAAA,QACF;AAGA,YAAI,KAAK,uBAAuB,MAAM,UAAU,eAAe,GAAG;AAChE,kBAAQ,KAAK,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,cAAc,KAAc,YAA8B;AAEhE,UAAM,iBAAiB,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,CAAC;AACxD,QAAI,CAAC,eAAe,KAAK,CAAC,MAAM,KAAK,oBAAoB,GAAG,UAAU,CAAC,GAAG;AACxE,qBAAe,KAAK,UAAU;AAC9B,WAAK,MAAM,MAAM,IAAI,IAAI,IAAI,cAAc;AAAA,IAC7C;AAGA,UAAM,SAAS,KAAK,MAAM,MAAM,IAAI,WAAW,GAAG,KAAK,CAAC;AACxD,QAAI,CAAC,OAAO;AAAA,MAAK,CAAC,UAChB,MAAM,UAAU,IAAI,MAAM,KAAK,oBAAoB,MAAM,YAAY,UAAU;AAAA,IACjF,GAAG;AACD,aAAO,KAAK;AAAA,QACV;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,OAAO,IAAI;AAAA,QACX,UAAU,oBAAI,KAAK;AAAA,MACrB,CAAC;AACD,WAAK,MAAM,MAAM,IAAI,WAAW,KAAK,MAAM;AAAA,IAC7C;AAGA,eAAW,UAAU,WAAW,SAAS;AACvC,YAAM,SAAS,KAAK,kBAAkB,WAAW,MAAM,MAAM;AAC7D,YAAM,UAAU,KAAK,MAAM,aAAa,IAAI,MAAM,KAAK,CAAC;AAGxD,YAAM,gBAAgB,QAAQ;AAAA,QAAK,CAAC,MAClC,KAAK,oBAAoB,EAAE,YAAY,UAAU;AAAA,MACnD;AAEA,UAAI,eAAe;AAEjB,YAAI,CAAC,cAAc,KAAK,KAAK,CAAC,MAAe,EAAE,OAAO,IAAI,EAAE,GAAG;AAC7D,wBAAc,KAAK,KAAK,GAAG;AAE3B,wBAAc,KAAK,KAAK,CAAC,GAAY,MAAe,EAAE,WAAW,EAAE,QAAQ;AAAA,QAC7E;AAAA,MACF,OAAO;AAEL,cAAM,QAAyB;AAAA,UAC7B,UAAU,WAAW;AAAA,UACrB;AAAA,UACA,MAAM,CAAC,GAAG;AAAA,UACV;AAAA,UACA,WAAW,WAAW;AAAA,QACxB;AACA,gBAAQ,KAAK,KAAK;AAClB,aAAK,MAAM,aAAa,IAAI,QAAQ,OAAO;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,kBAAkB,UAAkB,QAAwB;AAClE,WAAO,GAAG,QAAQ,IAAI,MAAM;AAAA,EAC9B;AAAA,EAEQ,oBAAoB,MAAkB,OAA4B;AACxE,WAAO,KAAK,QAAQ,MAAM,OACxB,KAAK,YAAY,MAAM,WACvB,KAAK,SAAS,MAAM,QACpB,KAAK,QAAQ,WAAW,MAAM,QAAQ,UACtC,KAAK,QAAQ,MAAM,CAAC,WAAW,MAAM,QAAQ,SAAS,MAAM,CAAC,KAC7D,kBAAkB,KAAK,SAAS,MAAM,OAAO;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,oBACN,UACA,QACmB;AACnB,UAAM,UAA6B,CAAC;AAGpC,UAAM,WAAW,KAAK,kBAAkB,UAAU,MAAM;AACxD,UAAM,eAAe,KAAK,MAAM,aAAa,IAAI,QAAQ;AACzD,QAAI,cAAc;AAChB,cAAQ,KAAK,GAAG,YAAY;AAAA,IAC9B;AAGA,eAAW,CAAC,QAAQ,OAAO,KAAK,KAAK,MAAM,cAAc;AACvD,UAAI,WAAW,SAAU;AAEzB,iBAAW,SAAS,SAAS;AAE3B,YAAI,CAAC,KAAK,cAAc,MAAM,QAAQ,MAAM,GAAG;AAC7C;AAAA,QACF;AAGA,YAAI,KAAK,uBAAuB,UAAU,MAAM,QAAQ,GAAG;AACzD,cAAI,CAAC,QAAQ;AAAA,YAAK,CAAC,MACjB,KAAK,oBAAoB,EAAE,YAAY,MAAM,UAAU;AAAA,UACzD,GAAG;AACD,oBAAQ,KAAK,KAAK;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAc,SAAiB,QAAyB;AAC9D,WAAO,eAAe,SAAS,MAAM;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,uBAAuB,UAAkB,SAA0B;AAEzE,QAAI,YAAY,UAAU;AACxB,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,aAAO,SAAS,WAAW,MAAM;AAAA,IACnC;AAGA,QAAI,QAAQ,SAAS,IAAI,GAAG;AAC1B,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,UAAI,CAAC,SAAS,WAAW,MAAM,GAAG;AAChC,eAAO;AAAA,MACT;AACA,YAAM,YAAY,SAAS,MAAM,OAAO,MAAM;AAE9C,aAAO,CAAC,UAAU,SAAS,GAAG,KAAK,cAAc;AAAA,IACnD;AAGA,QAAI,QAAQ,SAAS,GAAG,KAAK,SAAS,WAAW,OAAO,GAAG;AACzD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBACN,eACA,eACS;AAET,WAAO,KAAK,uBAAuB,eAAe,aAAa,KACxD,KAAK,uBAAuB,eAAe,aAAa;AAAA,EACjE;AACF;AAOO,SAAS,8BAAsD;AACpE,SAAO,IAAI,sBAAsB;AACnC;;;ACrqBA,eAAe,oBACb,OAC6B;AAC7B,SAAO,OAAO,UAAU,aAAa,MAAM,IAAI;AACjD;AAEA,eAAe,sBACb,SACiC;AACjC,SAAO,OAAO,YAAY,aAAa,QAAQ,IAAI,WAAW,CAAC;AACjE;AAEA,SAAS,sBAAsB,MAA0C;AACvE,MAAI,KAAK,OAAQ,QAAO,KAAK;AAC7B,MAAI,KAAK,MAAO,QAAO,KAAK;AAC5B,MAAI,KAAK,aAAa;AACpB,WAAO,uCAAuC,KAAK,WAAW;AAAA,EAChE;AACA,SAAO;AACT;AAUO,SAAS,qCACdE,UACyB;AACzB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,iBAAiB;AAAA,IACjB,SAAS,OAAO,YAAY;AAC1B,YAAM,YAAYA,SAAQ,SAAS,WAAW;AAC9C,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,MAAM,0DAA0D;AAAA,MAC5E;AAEA,YAAM,QAAQ,MAAM,oBAAoBA,SAAQ,KAAK;AACrD,YAAM,eAAe,MAAM,sBAAsBA,SAAQ,OAAO;AAChE,YAAM,OAAkC;AAAA,QACtC,GAAG;AAAA,QACH,GAAIA,SAAQ,QAAQ,EAAE,OAAOA,SAAQ,MAAM,IAAI,CAAC;AAAA,MAClD;AAEA,YAAM,WAAW,MAAM,UAAUA,SAAQ,UAAU;AAAA,QACjD,QAAQ;AAAA,QACR,aAAaA,SAAQ;AAAA,QACrB,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAI,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AAAA,UACpD,GAAG;AAAA,QACL;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAED,UAAI;AACJ,UAAI;AACF,iBAAU,MAAM,SAAS,KAAK;AAAA,MAChC,QAAQ;AACN,iBAAS;AAAA,MACX;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO;AAAA,UACL,UAAU;AAAA,UACV,QACE,QAAQ,UACR,QAAQ,SACR,oCAAoC,SAAS,MAAM;AAAA,QACvD;AAAA,MACF;AAEA,UAAI,QAAQ,iBAAiB,QAAQ,aAAa,OAAO;AACvD,eAAO;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,sBAAsB,MAAM;AAAA,QACtC;AAAA,MACF;AAEA,UAAI,OAAO,QAAQ,cAAc,YAAY,OAAO,UAAU,SAAS,GAAG;AACxE,eAAO;AAAA,UACL,UAAU;AAAA,UACV,WAAW,OAAO;AAAA,QACpB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAyGO,IAAM,sBAAoC,EAAE,MAAM,YAAY;;;AC5M9D,IAAM,kCAAN,MAAuE;AAAA;AAAA;AAAA;AAAA,EAI5E,MAAM,uBAAyC;AAC7C,WAAO;AAAA,EACT;AACF;AAKO,IAAM,8BACX,IAAI,gCAAgC;;;ACjG/B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAE/C,YACkB,aACA,cACA,aACA,MAChB;AACA;AAAA,MACE,wBAAwB,WAAW,+CAA+C,YAAY,WAAW,WAAW,QAAQ,IAAI,QAC7H,cAAc,eACX,4BACA;AAAA,IACR;AAVgB;AACA;AACA;AACA;AALlB,gBAAO;AAAA,EAaP;AACF;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAE3C,YACkB,MACA,OAChB;AACA;AAAA,MACE,gCAAgC,IAAI;AAAA,IACtC;AALgB;AACA;AAHlB,gBAAO;AAAA,EAQP;AACF;AAEO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACkB,SACA,MACA,mBAChB;AACA;AAAA,MACE,YAAY,OAAO,qCAAqC,IAAI,yBACnC,kBAAkB,KAAK,IAAI,KAAK,MAAM;AAAA,IACjE;AAPgB;AACA;AACA;AAJlB,gBAAO;AAAA,EAUP;AACF;AAQA,eAAsB,cACpB,MACA,aACA,UAAmC,WAAW,MAAM,KAAK,UAAU,GAChD;AACnB,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,IAAI,SAAS;AAAA,MACvC,QAAQ,YAAY,QAAQ,GAAI;AAAA,IAClC,CAAC;AAAA,EACH,SAASC,MAAK;AACZ,UAAM,IAAI,kBAAkB,MAAMA,IAAY;AAAA,EAChD;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,IAAI;AAAA,EAClC;AAEA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAQlC,MAAI,gBAAgB,KAAK,UAAU;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,KAAK,YAAY,CAAC;AAAA,IAC5B,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,EACjB;AACF;;;AlD+bA,IAAAC,oBA6CO;;;AmDxkBD,SAAUC,QAAQ,GAAe,GAAa;AAClD,MAAI,MAAM,GAAG;AACX,WAAO;EACT;AAEA,MAAI,EAAE,eAAe,EAAE,YAAY;AACjC,WAAO;EACT;AAEA,WAAS,IAAI,GAAG,IAAI,EAAE,YAAY,KAAK;AACrC,QAAI,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;AACjB,aAAO;IACT;EACF;AAEA,SAAO;AACT;;;ACnBA,yBAAuB;;;ACIjB,SAAU,aAAc,KAAe;AAC3C,SAAO,IAAI,WAAW,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAClE;;;ADUM,SAAU,YAAa,OAAe,GAAC;AAC3C,SAAO,aAAa,0BAAO,YAAY,IAAI,CAAC;AAC9C;;;AEdA,IAAMC,MAAK,KAAK,IAAI,GAAG,CAAC;AACxB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AAGzB,IAAMC,OAAM;AAEZ,IAAMC,QAAO;AAEP,SAAUC,gBAAgB,OAAa;AAC3C,MAAI,QAAQT,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,OAAO,oBAAoB,QAAQ,QAAQ,OAAO,kBAAkB;AACtE,UAAM,IAAI,WAAW,yBAAyB;EAChD;AAEA,SAAO;AACT;AAEM,SAAU,iBAAkB,OAAe,KAAiB,SAAiB,GAAC;AAClF,UAAQG,gBAAe,KAAK,GAAG;IAC7B,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQF;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,iBAAW;IACb;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,iBAAW;IACb;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,iBAAW;IACb;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ;AACzB,iBAAW;AACX;IACF;IACA;AAAS,YAAM,IAAI,MAAM,aAAa;EACxC;AACA,SAAO;AACT;AA0CM,SAAU,iBAAkB,KAAiB,QAAc;AAC/D,MAAI,IAAI,IAAI,MAAM;AAClB,MAAI,MAAM;AAEV,SAAO,IAAIG;AACX,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQE;AACpB,MAAI,IAAID,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQG;AACpB,MAAI,IAAIF,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQI;AACpB,MAAI,IAAIH,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQK;AACpB,MAAI,IAAIJ,MAAK;AACX,WAAO;EACT;AAEA,QAAM,IAAI,WAAW,yBAAyB;AAChD;AAEM,SAAU,qBAAsB,KAAqB,QAAc;AACvE,MAAI,IAAI,IAAI,IAAI,MAAM;AACtB,MAAI,MAAM;AAEV,SAAO,IAAID;AACX,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQE;AACpB,MAAI,IAAID,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQG;AACpB,MAAI,IAAIF,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQI;AACpB,MAAI,IAAIH,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQK;AACpB,MAAI,IAAIJ,MAAK;AACX,WAAO;EACT;AAEA,QAAM,IAAI,WAAW,yBAAyB;AAChD;AAgBM,SAAUK,QAAQ,KAAkC,SAAiB,GAAC;AAC1E,MAAI,eAAe,YAAY;AAC7B,WAAO,iBAAiB,KAAK,MAAM;EACrC,OAAO;AACL,WAAO,qBAAqB,KAAK,MAAM;EACzC;AACF;;;ACrQA,IAAAC,sBAAuB;AAMjB,SAAU,OAAQ,QAAsBC,SAAe;AAC3D,SAAO,aAAa,2BAAO,OAAO,QAAQA,OAAM,CAAC;AACnD;;;ACRA,IAAAC,sBAAuB;;;ACIvB,SAAS,YAAaC,OAAc,QAAgBC,SAAqCC,SAAmC;AAC1H,SAAO;IACL,MAAAF;IACA;IACA,SAAS;MACP,MAAAA;MACA;MACA,QAAAC;;IAEF,SAAS;MACP,QAAAC;;;AAGN;AAEA,IAAM,SAAS,YAAY,QAAQ,KAAK,CAAC,QAAO;AAC9C,QAAM,UAAU,IAAI,YAAY,MAAM;AACtC,SAAO,MAAM,QAAQ,OAAO,GAAG;AACjC,GAAG,CAAC,QAAO;AACT,QAAM,UAAU,IAAI,YAAW;AAC/B,SAAO,QAAQ,OAAO,IAAI,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,IAAM,QAAQ,YAAY,SAAS,KAAK,CAAC,QAAO;AAC9C,MAAIC,UAAS;AAEb,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,IAAAA,WAAU,OAAO,aAAa,IAAI,CAAC,CAAC;EACtC;AACA,SAAOA;AACT,GAAG,CAAC,QAAO;AACT,QAAM,IAAI,UAAU,CAAC;AACrB,QAAM,MAAM,YAAY,IAAI,MAAM;AAElC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,QAAI,CAAC,IAAI,IAAI,WAAW,CAAC;EAC3B;AAEA,SAAO;AACT,CAAC;AAID,IAAM,QAAyD;EAC7D,MAAM;EACN,SAAS;EACT,KAAK,MAAM;EACX,QAAQ;EACR;EACA,QAAQ;EAER,GAAG;;AAGL,IAAA,gBAAe;;;AD7CT,SAAUC,YAAYC,SAAgB,WAA+B,QAAM;AAC/E,QAAMC,QAAO,cAAM,QAAQ;AAE3B,MAAIA,SAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,yBAAyB,QAAQ,GAAG;EACtD;AAEA,MAAI,aAAa,UAAU,aAAa,SAAS;AAC/C,WAAO,aAAa,2BAAO,KAAKD,SAAQ,OAAO,CAAC;EAClD;AAGA,SAAOC,MAAK,QAAQ,OAAO,GAAGA,MAAK,MAAM,GAAGD,OAAM,EAAE;AACtD;;;AE1BA,IAAAE,sBAAuB;AAYjB,SAAUC,UAAU,OAAmB,WAA+B,QAAM;AAChF,QAAMC,QAAO,cAAM,QAAQ;AAE3B,MAAIA,SAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,yBAAyB,QAAQ,GAAG;EACtD;AAEA,MAAI,aAAa,UAAU,aAAa,SAAS;AAC/C,WAAO,2BAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EAAE,SAAS,MAAM;EACtF;AAGA,SAAOA,MAAK,QAAQ,OAAO,KAAK,EAAE,UAAU,CAAC;AAC/C;;;ACtBM,IAAO,wBAAP,cAAqC,MAAK;EAA1C;;AAEJ,gCAAO;;;AADP,cADW,uBACJ,QAAO;AAIV,IAAO,kBAAP,cAA+B,MAAK;EAApC;;AAEJ,gCAAO;;;AADP,cADW,iBACJ,QAAO;AAIV,IAAO,yBAAP,cAAsC,MAAK;EAA3C;;AAEJ,gCAAO;;;AADP,cADW,wBACJ,QAAO;AAIV,IAAO,uBAAP,cAAoC,MAAK;EAAzC;;AAEJ,gCAAO;;;AADP,cADW,sBACJ,QAAO;;;ACnBhB,sBAAkD;;;ACE3C,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,eAAe;AACrB,IAAM,cAAc;AACpB,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,eAAe;AACrB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,aAAa;AACnB,IAAM,cAAc;AACpB,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,aAAa;AACnB,IAAM,YAAY;AAClB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAC1B,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,iBAAiB;AACvB,IAAM,aAAa;AACnB,IAAM,UAAU;AAChB,IAAM,WAAW;AACjB,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,yBAAyB;AAC/B,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AACpB,IAAM,mBAAmB;AACzB,IAAM,cAAc;;;AC/BrB,SAAU,cAAeC,OAAwB;AACrD,SAAO,CAAC,QAAO;AACb,WAAOC,UAAmB,KAAKD,KAAI;EACrC;AACF;AAEM,SAAU,cAAeA,OAAwB;AACrD,SAAO,CAAC,QAAO;AACb,WAAOE,YAAqB,KAAKF,KAAI;EACvC;AACF;AAEM,SAAU,WAAY,KAAe;AACzC,QAAM,OAAO,IAAI,SAAS,IAAI,MAAM;AACpC,SAAO,KAAK,UAAU,IAAI,UAAU,EAAE,SAAQ;AAChD;AAEM,SAAU,WAAY,MAAqB;AAC/C,QAAM,MAAM,IAAI,YAAY,CAAC;AAC7B,QAAM,OAAO,IAAI,SAAS,GAAG;AAC7B,OAAK,UAAU,GAAG,OAAO,SAAS,WAAW,SAAS,IAAI,IAAI,IAAI;AAElE,SAAO,IAAI,WAAW,GAAG;AAC3B;AAEM,SAAU,YAAa,KAAW;AACtC,QAAM,OAAO,IAAI,MAAM,GAAG;AAE1B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM,CAAC,qCAAqC;EAC1G;AAEA,MAAI,KAAK,CAAC,EAAE,WAAW,IAAI;AACzB,UAAM,IAAI,MAAM,+BAA+B,KAAK,CAAC,CAAC,2BAA2B;EACnF;AAGA,QAAM,MAAME,YAAqB,KAAK,CAAC,GAAG,QAAQ;AAGlD,QAAM,OAAO,SAAS,KAAK,CAAC,GAAG,EAAE;AAEjC,MAAI,OAAO,KAAK,OAAO,OAAO;AAC5B,UAAM,IAAI,MAAM,uCAAuC;EACzD;AAEA,QAAM,UAAU,WAAW,IAAI;AAE/B,SAAO,OAAiB,CAAC,KAAK,OAAO,GAAG,IAAI,SAAS,QAAQ,MAAM;AACrE;AAEM,SAAU,aAAc,KAAW;AACvC,QAAM,OAAO,IAAI,MAAM,GAAG;AAE1B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM,CAAC,qCAAqC;EAC1G;AAEA,MAAI,KAAK,CAAC,EAAE,WAAW,IAAI;AACzB,UAAM,IAAI,MAAM,+BAA+B,KAAK,CAAC,CAAC,4BAA4B;EACpF;AAGA,QAAM,MAAM,OAAO,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE;AAGvC,QAAM,OAAO,SAAS,KAAK,CAAC,GAAG,EAAE;AAEjC,MAAI,OAAO,KAAK,OAAO,OAAO;AAC5B,UAAM,IAAI,MAAM,uCAAuC;EACzD;AAEA,QAAM,UAAU,WAAW,IAAI;AAE/B,SAAO,OAAiB,CAAC,KAAK,OAAO,GAAG,IAAI,SAAS,QAAQ,MAAM;AACrE;AAEM,SAAU,YAAa,KAAe;AAC1C,QAAM,YAAY,IAAI,SAAS,GAAG,IAAI,SAAS,CAAC;AAChD,QAAM,YAAY,IAAI,SAAS,IAAI,SAAS,CAAC;AAC7C,QAAM,OAAOD,UAAmB,WAAW,QAAQ;AACnD,QAAM,OAAO,WAAW,SAAS;AACjC,SAAO,GAAG,IAAI,IAAI,IAAI;AACxB;AAIO,IAAM,aAAa,SAAU,IAAU;AAC5C,OAAK,GAAG,SAAQ,EAAG,KAAI;AAEvB,QAAM,QAAQ,IAAI,WAAW,CAAC;AAE9B,KAAG,MAAM,KAAK,EAAE,QAAQ,CAAC,MAAM,UAAS;AACtC,UAAM,QAAQ,SAAS,MAAM,EAAE;AAE/B,QAAI,MAAM,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAM;AAC7C,YAAM,IAAI,sBAAsB,kCAAkC;IACpE;AAEA,UAAM,KAAK,IAAI;EACjB,CAAC;AAED,SAAO;AACT;AAIO,IAAM,aAAa,SAAU,IAAU;AAC5C,MAAI,SAAS;AACb,OAAK,GAAG,SAAQ,EAAG,KAAI;AAEvB,QAAM,WAAW,GAAG,MAAM,KAAK,CAAC;AAEhC,MAAI;AACJ,OAAK,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACpC,UAAM,WAAO,wBAAO,SAAS,CAAC,CAAC;AAC/B,QAAI;AAEJ,QAAI,MAAM;AACR,iBAAW,WAAW,SAAS,CAAC,CAAC;AACjC,eAAS,CAAC,IAAIA,UAAmB,SAAS,SAAS,GAAG,CAAC,GAAG,QAAQ;IACpE;AAEA,QAAI,YAAY,QAAQ,EAAE,IAAI,GAAG;AAC/B,eAAS,OAAO,GAAG,GAAGA,UAAmB,SAAS,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC;IAC7E;EACF;AAEA,MAAI,SAAS,CAAC,MAAM,IAAI;AACtB,WAAO,SAAS,SAAS,GAAG;AAAE,eAAS,QAAQ,GAAG;IAAE;EACtD,WAAW,SAAS,SAAS,SAAS,CAAC,MAAM,IAAI;AAC/C,WAAO,SAAS,SAAS,GAAG;AAAE,eAAS,KAAK,GAAG;IAAE;EACnD,WAAW,SAAS,SAAS,GAAG;AAC9B,SAAK,IAAI,GAAG,IAAI,SAAS,UAAU,SAAS,CAAC,MAAM,IAAI,KAAK;IAAE;AAC9D,UAAM,OAAsC,CAAC,GAAG,CAAC;AACjD,SAAK,IAAI,IAAI,SAAS,QAAQ,IAAI,GAAG,KAAK;AACxC,WAAK,KAAK,GAAG;IACf;AACA,aAAS,OAAO,MAAM,UAAU,IAAI;EACtC;AAEA,QAAM,QAAQ,IAAI,WAAW,SAAS,EAAE;AAExC,OAAK,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACpC,QAAI,SAAS,CAAC,MAAM,IAAI;AACtB,eAAS,CAAC,IAAI;IAChB;AAEA,UAAME,QAAO,SAAS,SAAS,CAAC,GAAG,EAAE;AAErC,QAAI,MAAMA,KAAI,KAAKA,QAAO,KAAKA,QAAO,OAAQ;AAC5C,YAAM,IAAI,sBAAsB,kCAAkC;IACpE;AAEA,UAAM,QAAQ,IAAKA,SAAQ,IAAK;AAChC,UAAM,QAAQ,IAAIA,QAAO;EAC3B;AAEA,SAAO;AACT;AAGO,IAAM,cAAc,SAAU,KAAe;AAClD,MAAI,IAAI,eAAe,GAAG;AACxB,UAAM,IAAI,sBAAsB,mCAAmC;EACrE;AAEA,QAAM,SAAS,CAAA;AAEf,WAAS,IAAI,GAAG,IAAI,IAAI,YAAY,KAAK;AACvC,WAAO,KAAK,IAAI,CAAC,CAAC;EACpB;AAEA,SAAO,OAAO,KAAK,GAAG;AACxB;AAEO,IAAM,cAAc,SAAU,KAAe;AAClD,MAAI,IAAI,eAAe,IAAI;AACzB,UAAM,IAAI,sBAAsB,mCAAmC;EACrE;AAEA,QAAM,SAAmB,CAAA;AAEzB,WAAS,IAAI,GAAG,IAAI,IAAI,YAAY,KAAK,GAAG;AAC1C,UAAM,QAAQ,IAAI,CAAC;AACnB,UAAM,QAAQ,IAAI,IAAI,CAAC;AAEvB,UAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAE1F,WAAO,KAAK,KAAK;EACnB;AAEA,QAAM,KAAK,OAAO,KAAK,GAAG;AAE1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,WAAW,EAAE,GAAG;AAEpC,WAAO,IAAI,SAAS,UAAU,GAAG,IAAI,SAAS,SAAS,CAAC;EAC1D,QAAQ;AACN,UAAM,IAAI,sBAAsB,yBAAyB,EAAE,GAAG;EAChE;AACF;AAEM,SAAU,iBAAkB,KAAW;AAC3C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,WAAW,GAAG,GAAG;AAErC,WAAO,IAAI,SAAS,UAAU,GAAG,IAAI,SAAS,SAAS,CAAC;EAC1D,QAAQ;AACN,UAAM,IAAI,sBAAsB,yBAAyB,GAAG,GAAG;EACjE;AACF;AAEA,IAAM,WAAW,OAAO,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAC1D,IAAM,kBAAkB,WAAA;AACtB,MAAI,MAAM,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;AACpC,WAAS,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAO,MAAM,IAAI,GAAG,CAAC,CAAE;AAClD,SAAO;AACT,GAAE;AAEI,SAAU,SAAU,OAAa;AACrC,SAAO,eAAe,OAAO,KAAK;AACpC;AAEM,SAAU,SAAUH,OAAyB;AACjD,SAAO,CAAC,QAAO;AACb,WAAOA,MAAK,QAAQ,OAAO,GAAG;EAChC;AACF;;;AC5OM,SAAU,QAAS,OAAa;AACpC,QAAM,MAAM,SAAS,KAAK;AAE1B,MAAI,IAAI,SAAQ,MAAO,OAAO;AAC5B,UAAM,IAAI,gBAAgB,0BAA0B;EACtD;AACF;AAEM,SAAU,SAAU,OAAU;AAClC,MAAI,QAAQ,GAAG;AACb,UAAM,IAAI,gBAAgB,2CAA2C;EACvE;AACF;AAEM,SAAU,SAAU,KAAW;AACnC,SAAO,CAAC,UAAS;AACf,QAAI,QAAQ,KAAK;AACf,YAAM,IAAI,gBAAgB,0CAA0C,GAAG,EAAE;IAC3E;EACF;AACF;AAEM,SAAU,YAAa,OAAqC;AAChE,SAAO,CAAC,UAAS;AACf,eAAW,MAAM,OAAO;AACtB,SAAG,KAAK;IACV;EACF;AACF;AAEO,IAAM,eAAe,SAC1B,SACA,UACA,SAAS,KAAM,CAAC;;;AC1BX,IAAM,IAAI;AAsDjB,IAAM,WAAN,MAAc;EAAd;AACU,2CAAkB,oBAAI,IAAG;AACzB,2CAAkB,oBAAI,IAAG;;EAEjC,YAAa,KAAoB;AAC/B,QAAI;AAEJ,QAAI,OAAO,QAAQ,UAAU;AAC3B,cAAQ,KAAK,gBAAgB,IAAI,GAAG;IACtC,OAAO;AACL,cAAQ,KAAK,gBAAgB,IAAI,GAAG;IACtC;AAEA,QAAI,SAAS,MAAM;AACjB,YAAM,IAAI,qBAAqB,YAAY,GAAG,cAAc;IAC9D;AAEA,WAAO;EACT;EAEA,YAAa,OAAoB;AAC/B,SAAK,gBAAgB,IAAI,MAAM,MAAM,KAAK;AAC1C,SAAK,gBAAgB,IAAI,MAAM,MAAM,KAAK;AAE1C,UAAM,SAAS,QAAQ,WAAQ;AAC7B,WAAK,gBAAgB,IAAI,OAAO,KAAK;IACvC,CAAC;EACH;EAEA,eAAgBI,OAAY;AAC1B,UAAM,QAAQ,KAAK,gBAAgB,IAAIA,KAAI;AAE3C,QAAI,SAAS,MAAM;AACjB;IACF;AAEA,SAAK,gBAAgB,OAAO,MAAM,IAAI;AACtC,SAAK,gBAAgB,OAAO,MAAM,IAAI;AAEtC,UAAM,SAAS,QAAQ,WAAQ;AAC7B,WAAK,gBAAgB,OAAO,KAAK;IACnC,CAAC;EACH;;AAGK,IAAM,WAAW,IAAI,SAAQ;AAEpC,IAAM,SAA0B,CAAC;EAC/B,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU,CAAC,UAAS;AAClB,QAAI,KAAC,wBAAO,KAAK,GAAG;AAClB,YAAM,IAAI,gBAAgB,yBAAyB,KAAK,GAAG;IAC7D;EACF;GACC;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,eAAe;EACf,UAAU,CAAC,UAAS;AAClB,QAAI,KAAC,wBAAO,KAAK,GAAG;AAClB,YAAM,IAAI,gBAAgB,yBAAyB,KAAK,GAAG;IAC7D;EACF;GACC;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc,cAAc,QAAQ;EACpC,cAAc,cAAc,QAAQ;GACnC;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,eAAe,CAAC,QAAQ,mBAAmB,GAAG;EAC9C,eAAe,CAAC,QAAQ,mBAAmB,GAAG;GAC7C;EACD,MAAM;EACN,MAAM;EACN,SAAS,CAAC,MAAM;EAChB,MAAM;EACN,cAAc,cAAc,WAAW;EACvC,cAAc,CAAC,QAAO;AACpB,QAAI,IAAI,WAAW,GAAG,KAAK,IAAI,WAAW,GAAG,GAAG;AAC9C,aAAO,cAAc,WAAW,EAAE,GAAG;IACvC;AAEA,WAAO,IAAI,MAAM,GAAG,EAAE,UAAU;EAClC;GACC;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;GACb;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;GACb;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc,SAAS,SAAS;EAChC,cAAc;GACb;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,eAAe,CAAC,QAAQ,IAAI,mBAAmB,GAAG,CAAC;EACnD,eAAe,CAAC,QAAQ,mBAAmB,IAAI,UAAU,CAAC,CAAC;GAC1D;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;CACP;AAED,OAAO,QAAQ,WAAQ;AACrB,WAAS,YAAY,KAAK;AAC5B,CAAC;;;ACvSK,SAAU,kBAAmB,OAAiB;AAClD,QAAM,aAA0B,CAAA;AAEhC,MAAI,IAAI;AACR,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAMC,QAAcC,QAAO,OAAO,CAAC;AACnC,UAAM,QAAQ,SAAS,YAAYD,KAAI;AACvC,UAAM,aAAoBE,gBAAeF,KAAI;AAC7C,UAAM,OAAO,YAAY,OAAO,OAAO,IAAI,UAAU;AACrD,QAAI,aAAa;AAEjB,QAAI,OAAO,KAAK,MAAM,SAAS,GAAG;AAChC,mBAAoBE,gBAAe,IAAI;IACzC;AAEA,UAAM,kBAAkB,aAAa,aAAa;AAElD,UAAM,YAAuB;MAC3B,MAAAF;MACA,MAAM,MAAM;MACZ,OAAO,MAAM,SAAS,GAAG,IAAI,eAAe;;AAG9C,QAAI,OAAO,GAAG;AACZ,YAAM,cAAc,IAAI,aAAa;AACrC,YAAM,aAAa,MAAM,SAAS,aAAa,cAAc,IAAI;AAEjE,gBAAU,QAAQ,MAAM,eAAe,UAAU,KAAKG,UAAmB,UAAU;IACrF;AAEA,eAAW,KAAK,SAAS;AAEzB,SAAK;EACP;AAEA,SAAO;AACT;AAEM,SAAU,kBAAmB,YAAuB;AACxD,MAAIC,UAAS;AACb,QAAM,QAAsB,CAAA;AAE5B,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,MAAM;AAC3B,YAAM,QAAQ,SAAS,YAAY,UAAU,IAAI;AACjD,YAAM,cAAqBF,gBAAe,UAAU,IAAI;AACxD,UAAI;AACJ,UAAI,cAAc;AAClB,UAAI,oBAAoB;AAExB,UAAI,UAAU,SAAS,MAAM;AAC3B,qBAAa,MAAM,eAAe,UAAU,KAAK,KAAKG,YAAqB,UAAU,KAAK;AAC1F,sBAAc,WAAW;AAEzB,YAAI,MAAM,SAAS,GAAG;AACpB,8BAA2BH,gBAAe,WAAW;QACvD;MACF;AAEA,YAAMI,SAAQ,IAAI,WAAW,cAAc,oBAAoB,WAAW;AAG1E,UAAI,SAAS;AACb,MAAO,iBAAiB,UAAU,MAAMA,QAAO,MAAM;AACrD,gBAAU;AAGV,UAAI,cAAc,MAAM;AAEtB,YAAI,MAAM,SAAS,GAAG;AACpB,UAAO,iBAAiB,aAAaA,QAAO,MAAM;AAClD,oBAAU;QACZ;AAGA,QAAAA,OAAM,IAAI,YAAY,MAAM;MAC9B;AAEA,gBAAU,QAAQA;IACpB;AAEA,UAAM,KAAK,UAAU,KAAK;AAC1B,IAAAF,WAAU,UAAU,MAAM;EAC5B;AAEA,SAAO,OAAiB,OAAOA,OAAM;AACvC;AAEM,SAAU,mBAAoBG,SAAc;AAChD,MAAIA,QAAO,OAAO,CAAC,MAAM,KAAK;AAC5B,UAAM,IAAI,sBAAsB,sCAAsC;EACxE;AAEA,QAAM,aAA0B,CAAA;AAChC,MAAI,aAAmC;AACvC,MAAI,QAAQ;AACZ,MAAI,WAAW;AAEf,WAAS,IAAI,GAAG,IAAIA,QAAO,QAAQ,KAAK;AACtC,UAAM,OAAOA,QAAO,OAAO,CAAC;AAE5B,QAAI,SAAS,KAAK;AAChB,UAAI,eAAe,YAAY;AAC7B,oBAAYA,QAAO,OAAO,CAAC;MAC7B,OAAO;AACL,iBAASA,QAAO,OAAO,CAAC;MAC1B;IACF;AAEA,UAAM,QAAQ,MAAMA,QAAO,SAAS;AAEpC,QAAI,SAAS,OAAO,OAAO;AACzB,YAAM,QAAQ,SAAS,YAAY,QAAQ;AAE3C,UAAI,eAAe,YAAY;AAC7B,YAAI,MAAM,QAAQ,QAAQ,MAAM,SAAS,GAAG;AAE1C,qBAAW,KAAK;YACd,MAAM,MAAM;YACZ,MAAM,MAAM;WACb;AAED,kBAAQ;AACR,qBAAW;AACX,uBAAa;AAEb;QACF,WAAW,OAAO;AAChB,gBAAM,IAAI,sBAAsB,aAAa,QAAQ,oBAAoB;QAC3E;AAGA,qBAAa;MACf,WAAW,eAAe,SAAS;AACjC,cAAM,YAAuB;UAC3B,MAAM,MAAM;UACZ,MAAM,MAAM;;AAGd,YAAI,MAAM,QAAQ,QAAQ,MAAM,SAAS,GAAG;AAC1C,cAAI,UAAU,IAAI;AAChB,kBAAM,IAAI,sBAAsB,aAAa,QAAQ,oBAAoB;UAC3E;AAEA,oBAAU,QAAQ,MAAM,gBAAgB,KAAK,KAAK;QACpD;AAEA,mBAAW,KAAK,SAAS;AAEzB,gBAAQ;AACR,mBAAW;AACX,qBAAa;MACf;IACF;EACF;AAEA,MAAI,aAAa,MAAM,UAAU,IAAI;AACnC,UAAM,IAAI,sBAAsB,sBAAsB;EACxD;AAEA,SAAO;AACT;AAEM,SAAU,mBAAoB,YAAuB;AACzD,SAAO,IAAI,WAAW,QAAQ,eAAY;AACtC,QAAI,UAAU,SAAS,MAAM;AAC3B,aAAO,UAAU;IACnB;AAEA,UAAM,QAAQ,SAAS,YAAY,UAAU,IAAI;AAEjD,QAAI,SAAS,MAAM;AACjB,YAAM,IAAI,sBAAsB,yBAAyB,UAAU,IAAI,EAAE;IAC3E;AAEA,WAAO;MACL,UAAU;MACV,MAAM,gBAAgB,UAAU,KAAK,KAAK,UAAU;;EAExD,CAAC,EAAE,KAAK,GAAG,CAAC;AAChB;AAKA,SAAS,YAAa,OAAsB,OAAmB,QAAc;AAC3E,MAAI,MAAM,QAAQ,QAAQ,MAAM,SAAS,GAAG;AAC1C,WAAO;EACT;AAEA,MAAI,MAAM,OAAO,GAAG;AAClB,WAAO,MAAM,OAAO;EACtB;AAEA,SAAcN,QAAO,OAAO,MAAM;AACpC;;;ACrMA,IAAM,UAAU,uBAAO,IAAI,4BAA4B;AAChD,IAAM,SAAS,uBAAO,IAAI,yBAAyB;AAE1D,SAAS,aAAc,MAAoB;AACzC,MAAI,QAAQ,MAAM;AAChB,WAAO;EACT;AAEA,MAAI,YAAY,IAAI,GAAG;AACrB,WAAO,KAAK,cAAa;EAC3B;AAEA,MAAI,gBAAgB,YAAY;AAC9B,WAAO,kBAAkB,IAAI;EAC/B;AAEA,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO,KACJ,QAAQ,WAAW,GAAG,EACtB,QAAQ,UAAU,EAAE;AAEvB,QAAI,SAAS,IAAI;AACf,aAAO;IACT;AAEA,WAAO,mBAAmB,IAAI;EAChC;AAEA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO;EACT;AAEA,QAAM,IAAI,sBAAsB,iEAAiE;AACnG;AAxCA,IAAAO,KAAA;AAiDM,IAAO,aAAP,MAAO,WAAS;EASpB,YAAa,OAAqC,KAAKC,WAA4B,CAAA,GAAE;AARrF,wBAACD,KAAmB;AACX;AAGT;;AAEA;;AAGE,uBAAK,aAAc,aAAa,IAAI;AAEpC,QAAIC,SAAQ,aAAa,OAAO;AAC9B,MAAAC,UAAS,IAAI;IACf;EACF;EAEA,IAAI,QAAK;AACP,QAAI,mBAAK,WAAU,MAAM;AACvB,yBAAK,QAAS,kBAAkB,mBAAK,YAAW;IAClD;AAEA,WAAO,mBAAK;EACd;EAEA,WAAQ;AACN,QAAI,mBAAK,YAAW,MAAM;AACxB,yBAAK,SAAU,mBAAmB,mBAAK,YAAW;IACpD;AAEA,WAAO,mBAAK;EACd;EAEA,SAAM;AACJ,WAAO,KAAK,SAAQ;EACtB;EAEA,gBAAa;AACX,WAAO;MACL,GAAG,mBAAK,aAAY,IAAI,QAAM,EAAE,GAAG,EAAC,EAAG;;EAE3C;EAEA,YAAa,MAAoB;AAC/B,UAAM,KAAK,IAAI,WAAU,IAAI;AAE7B,WAAO,IAAI,WAAU;MACnB,GAAG,mBAAK;MACR,GAAG,GAAG,cAAa;OAClB;MACD,UAAU;KACX;EACH;EAEA,YAAa,MAAwB;AACnC,UAAM,aAAa,KAAK,SAAQ;AAChC,UAAM,IAAI,KAAK,SAAQ;AACvB,UAAM,IAAI,EAAE,YAAY,UAAU;AAElC,QAAI,IAAI,GAAG;AACT,YAAM,IAAI,uBAAuB,WAAW,KAAK,SAAQ,CAAE,iCAAiC,UAAU,EAAE;IAC1G;AAEA,WAAO,IAAI,WAAU,EAAE,MAAM,GAAG,CAAC,GAAG;MAClC,UAAU;KACX;EACH;EAEA,gBAAiBC,OAAY;AAC3B,QAAI;AAEJ,aAAS,IAAI,mBAAK,aAAY,SAAS,GAAG,IAAI,IAAI,KAAK;AACrD,UAAI,mBAAK,aAAY,CAAC,EAAE,SAASA,OAAM;AACrC,gBAAQ;AACR;MACF;IACF;AAEA,WAAO,IAAI,WAAU,mBAAK,aAAY,MAAM,GAAG,KAAK,GAAG;MACrD,UAAU;KACX;EACH;EAEA,OAAQ,MAA2B;AACjC,WAAOC,QAAiB,KAAK,OAAO,KAAK,KAAK;EAChD;;;;;;;;;;;;;EAcA,EAlGCJ,MAAA,QAkGA,QAAO,IAAC;AACP,WAAO,aAAa,KAAK,SAAQ,CAAE;EACrC;;AAnGS;AAGT;AAEA;AAPI,IAAO,YAAP;AA4GA,SAAUE,UAAU,MAAe;AACvC,OAAK,cAAa,EACf,QAAQ,eAAY;AACnB,UAAM,QAAQ,SAAS,YAAY,UAAU,IAAI;AAEjD,QAAI,UAAU,SAAS,MAAM;AAC3B;IACF;AAEA,UAAM,WAAW,UAAU,KAAK;EAClC,CAAC;AACL;;;AC6GM,SAAU,YAAa,OAAU;AACrC,SAAO,QAAQ,QAAQ,MAAM,CAAC;AAChC;AAeM,SAAU,UAAW,MAAqB;AAC9C,SAAO,IAAI,UAAe,IAAI;AAChC;;;AClQA,IAAM,oBAAoB;EACxB;EACA;EACA;EACA;EACA;;AAOF,SAAS,WAAY,IAAe;AAClC,SAAO,aAAa,OAAO,EAAE,GAAG;AAClC;AAEA,SAAS,YAAa,IAAe;AACnC,QAAM,OAAO,aAAa,OAAO,EAAE,GAAG;AAEtC,MAAI,QAAQ,MAAM;AAChB,WAAO;EACT;AAEA,SAAO,IAAI,IAAI;AACjB;AAEA,SAAS,aAAcG,OAAc,IAAe;AAClD,SAAO,GAAG,KAAK,eAAa,UAAU,SAASA,KAAI;AACrD;AAEA,SAAS,OAAQ,IAAe;AAC9B,SAAO,GAAG,KAAK,CAAC,EAAE,MAAAC,MAAI,MAAOA,UAAS,QAAQ;AAChD;AAEA,SAAS,cAAe,MAAiB,MAAiB;AACxD,QAAM,cAAc,aAAa,KAAK,IAAI;AAC1C,MAAI,eAAe,MAAM;AACvB,UAAM,IAAI,MAAM,4BAA4B,KAAK,IAAI,EAAE;EACzD;AACA,QAAM,UAAU,YAAY,MAAM,IAAI;AACtC,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO,IAAI,OAAO;EACpB;AACA,SAAO;AACT;AAEA,IAAM,eAA4C;EAChD,KAAK,CAAC,MAAM,SAAS,KAAK;EAC1B,KAAK,CAAC,MAAM,SAAQ;AAClB,QAAI,KAAK,WAAW,GAAG;AACrB,aAAO,KAAK;IACd;AACA,WAAO,IAAI,KAAK,KAAK;EACvB;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,SAAS,cAAc,MAAM,IAAI,CAAC,IAAI,KAAK,KAAK;EACzD;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,SAAS,cAAc,MAAM,IAAI,CAAC,IAAI,KAAK,KAAK;EACzD;EACA,SAAS,CAAC,MAAM,SAAS,KAAK;EAC9B,MAAM,CAAC,MAAM,SAAS,KAAK;EAC3B,MAAM,CAAC,MAAM,SAAS,KAAK;EAC3B,KAAK,CAAC,MAAM,SAAS,KAAK;EAC1B,MAAM,CAAC,MAAM,SAAQ;AACnB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,GAAG,cAAc,MAAM,IAAI,CAAC;EACrC;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,GAAG,cAAc,MAAM,IAAI,CAAC;EACrC;EACA,MAAM,CAAC,MAAM,SAAQ;AACnB,UAAM,WAAW,OAAO,IAAI;AAC5B,UAAM,MAAM,WAAW,IAAI;AAC3B,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI,YAAY,OAAO,MAAM;AAC3B,aAAO,WAAW,GAAG,GAAG,IAAI;IAC9B;AACA,UAAM,WAAW,WAAW,aAAa;AACzC,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,GAAG,QAAQ,GAAG,OAAO;EAC9B;EACA,aAAa,CAAC,MAAM,SAAQ;AAC1B,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,UAAM,UAAU,cAAc,MAAM,IAAI;AACxC,UAAM,eAAe,mBAAmB,KAAK,SAAS,EAAE;AACxD,WAAO,GAAG,OAAO,GAAG,YAAY;EAClC;EACA,KAAK,CAAC,MAAM,SAAQ;AAGlB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,cAAc,MAAM,IAAI;EACjC;EACA,KAAK,CAAC,MAAM,SAAQ;AAGlB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,cAAc,MAAM,IAAI;EACjC;EACA,OAAO,CAAC,MAAM,SAAQ;AACpB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,WAAW,OAAO;EAC3B;EACA,IAAI,CAAC,MAAM,SAAQ;AACjB,UAAM,WAAW,OAAO,IAAI;AAC5B,UAAM,MAAM,WAAW,IAAI;AAC3B,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI,YAAY,OAAO,MAAM;AAC3B,aAAO,SAAS,GAAG,GAAG,IAAI;IAC5B;AACA,UAAM,WAAW,WAAW,WAAW;AACvC,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,GAAG,QAAQ,GAAG,OAAO;EAC9B;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,SAAS,OAAO;EACzB;;AAGI,SAAU,eAAgB,OAAwC,MAAyB;AAC/F,QAAM,KAAK,UAAU,KAAK;AAC1B,QAAM,aAAa,GAAG,cAAa;AACnC,QAAM,OAAO,WAAW,IAAG;AAC3B,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,6BAA6B;EAC/C;AAEA,QAAM,cAAc,aAAa,KAAK,IAAI;AAE1C,MAAI,eAAe,MAAM;AACvB,UAAM,IAAI,MAAM,4BAA4B,KAAK,IAAI,EAAE;EACzD;AAEA,MAAI,MAAM,YAAY,MAAM,UAAU,KAAK;AAE3C,MAAI,MAAM,eAAe,SAAS,kBAAkB,SAAS,KAAK,IAAI,GAAG;AAEvE,UAAM,IAAI,QAAQ,YAAY,EAAE;AAEhC,QAAI,KAAK,UAAU,OAAO;AACxB,YAAM,WAAW,GAAG;IACtB,OAAO;AACL,YAAM,UAAU,GAAG;IACrB;EACF;AAEA,MAAI,IAAI,WAAW,SAAS,KAAK,IAAI,WAAW,UAAU,KAAK,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,QAAQ,GAAG;AAElH,UAAM,IAAI,IAAI,GAAG,EAAE,SAAQ;AAG3B,QAAI,IAAI,SAAS,GAAG,GAAG;AACrB,YAAM,IAAI,UAAU,GAAG,IAAI,SAAS,CAAC;IACvC;EACF;AAEA,SAAO;AACT;;;ACrPA,IAAM,OAAO;AAEb,IAAM,UAAU,CAAAC,aAAWA,YAAWA,SAAQ,oBAC3C,mBAAmB,IAAI,SAAS,IAAI,gBACpC;AAEH,IAAM,KAAK;AAEX,IAAM,YAAY;AAElB,IAAM,KAAK;AAAA;AAAA,KAEN,SAAS,WAAW,SAAS;AAAA,KAC7B,SAAS,WAAW,EAAE,KAAK,SAAS;AAAA,KACpC,SAAS,YAAY,EAAE,QAAQ,SAAS;AAAA,KACxC,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,KAC9D,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,KAC9D,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,KAC9D,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,aACtD,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA;AAAA,EAEjD,QAAQ,gBAAgB,EAAE,EAAE,QAAQ,OAAO,EAAE,EAAE,KAAK;AAGtD,IAAM,WAAW,IAAI,OAAO,OAAO,EAAE,UAAU,EAAE,IAAI;AACrD,IAAM,UAAU,IAAI,OAAO,IAAI,EAAE,GAAG;AACpC,IAAM,UAAU,IAAI,OAAO,IAAI,EAAE,GAAG;AAEpC,IAAM,UAAU,CAAAA,aAAWA,YAAWA,SAAQ,QAC3C,WACA,IAAI,OAAO,MAAM,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,QAAQ,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,KAAK,GAAG;AAEpH,QAAQ,KAAK,CAAAA,aAAWA,YAAWA,SAAQ,QAAQ,UAAU,IAAI,OAAO,GAAG,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,IAAI,GAAG;AAC1H,QAAQ,KAAK,CAAAA,aAAWA,YAAWA,SAAQ,QAAQ,UAAU,IAAI,OAAO,GAAG,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,IAAI,GAAG;AAE1H,IAAO,mBAAQ;;;ACnCf,qBAAe;AAEA,SAAR,gBAAiC,WAAW,EAAC,QAAO,IAAI,CAAC,GAAG;AAClE,QAAM,SAAS,IAAI,eAAAC,QAAG,OAAO,2BAA2B;AAExD,QAAM,kBAAkB,IAAI,eAAe;AAC1C,UAAM,UAAU;AAAA,MACf,WAAW,MAAM,UAAU,GAAG,UAAU;AAAA,IACzC;AAEA,WAAO,gBAAgB,SAAS,EAAC,QAAO,CAAC;AAEzC,WAAO,QAAQ;AAAA,EAChB;AAEA,SAAO,eAAe,iBAAiB,QAAQ;AAAA,IAC9C,OAAO,mBAAmB,UAAU,QAAQ,aAAa;AAAA,IACzD,cAAc;AAAA,EACf,CAAC;AAED,SAAO;AACR;AAEO,SAAS,eAAe,OAAO;AACrC,SAAO,OAAO,SAAS;AACxB;;;ACzBA,IAAM,EAAC,UAAAC,UAAQ,IAAI,OAAO;AAEX,SAAR,SAA0B,OAAO;AACvC,SAAOA,UAAS,KAAK,KAAK,MAAM;AACjC;;;ACFA,IAAM,UAAU;AAAA,EACf,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AACV;AAEe,SAAR,aAA8B,QAAQC,WAAU,CAAC,GAAG;AAC1D,MAAI,CAAC,SAAS,MAAM,GAAG;AACtB,UAAM,IAAI,UAAU,4BAA4B;AAAA,EACjD;AAEA,QAAM,QAAQ,OAAO,KAAK,OAAO,EAAE,IAAI,WACrC,OAAOA,SAAQ,IAAI,MAAM,YAAYA,SAAQ,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,EACtF,EAAE,KAAK,EAAE;AAEV,QAAMC,gBAAe,IAAI,OAAOD,SAAQ,UAAU,OAAO,QAAQ,KAAK;AAEtE,EAAAC,cAAa,YAAY,OAAOD,SAAQ,cAAc,WACrDA,SAAQ,YACR,OAAO;AAER,SAAOC;AACR;;;ACfO,SAAS,QAAQ,OAAOC,SAAQ,EAAC,QAAO,IAAI,CAAC,GAAG;AACtD,MAAI;AACH,WAAO,gBAAgB,MAAM,aAAY,KAAK,EAAE,KAAKA,OAAM,GAAG,EAAC,QAAO,CAAC,EAAE;AAAA,EAC1E,SAAS,OAAO;AACf,QAAI,eAAe,KAAK,GAAG;AAC1B,aAAO;AAAA,IACR;AAEA,UAAM;AAAA,EACP;AACD;;;ACnBA,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAEtB,IAAM,UAAU;AAAA,EACf,SAAS;AACV;AAUO,SAASC,QAAOC,SAAQ;AAC9B,MAAIA,QAAO,SAAS,eAAe;AAClC,WAAO;AAAA,EACR;AAEA,SAAO,QAAQ,iBAAQ,GAAG,EAAC,OAAO,KAAI,CAAC,GAAGA,SAAQ,OAAO;AAC1D;AAEO,SAASC,QAAOD,SAAQ;AAC9B,MAAIA,QAAO,SAAS,eAAe;AAClC,WAAO;AAAA,EACR;AAEA,SAAO,QAAQ,iBAAQ,GAAG,EAAC,OAAO,KAAI,CAAC,GAAGA,SAAQ,OAAO;AAC1D;;;ACWA,IAAM,UAAkC;EACtC,MAAM;EACN,OAAO;EACP,IAAI;EACJ,KAAK;;AAGP,IAAM,kBAAkB,CAAC,QAAQ,SAAS,MAAM,KAAK;AAyB/C,SAAU,eAAgB,QAAgB,MAA2B;AACzE,SAAO,QAAQ,CAAA;AACf,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,EAAE,QAAQ,UAAU,MAAM,KAAI,IAAK,SAAS,MAAM;AACxD,QAAM,QAAQ;IACZ,iBAAiB,UAAU,cAAc;IACzC,aAAa,MAAM,MAAM;IACzB,eAAe,MAAM;;AAGvB,MAAI,QAAQ,MAAM;AAChB,UAAM,KAAK,aAAa,IAAI,CAAC;EAC/B;AAEA,QAAM,eAAe,MAAM,MACxB,OAAO,OAAK,QAAQ,CAAC,CAAC,EAEtB,OAAO,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,GAAG,CAAA,CAAE,EAChC,KAAK,GAAG;AAEX,SAAO,UAAU,YAAY;AAC/B;AAEA,SAAS,SAAU,QAAc;AAC/B,QAAM,CAAC,MAAM,IAAI,OAAO,MAAM,GAAG;AAGjC,MAAI,CAAC,gBAAgB,SAAS,MAAM,GAAG;AACrC,aAAS,SAAS,OAAO,UAAU,OAAO,MAAM;EAClD;AAGA,MAAI,EAAE,UAAU,UAAU,MAAM,UAAU,OAAM,IAAK,IAAI,IAAI,MAAM;AAEnE,MAAI,QAAQ,QAAQ,SAAS,IAAI;AAC/B,UAAM,eAAe,gBAAgB,MAAM;AAE3C,QAAI,gBAAgB,MAAM;AACxB,aAAO;IACT;AAGA,QAAI,gBAAgB,QAAQ,aAAa,SAAS;AAEhD,aAAO;IACT;EACF;AAEA,MAAI;AAEJ,MAAI,YAAY,QAAQ,aAAa,MAAM,aAAa,KAAK;AAC3D,QAAI,SAAS,WAAW,GAAG,GAAG;AAC5B,iBAAW,SAAS,UAAU,CAAC;IACjC;AAEA,WAAO;EACT;AAEA,MAAI,UAAU,QAAQ,WAAW,IAAI;AACnC,WAAO,QAAQ;AACf,YAAQ;EACV;AAEA,SAAO,EAAE,QAAQ,UAAU,MAAM,KAAI;AACvC;AAEA,SAAS,iBAAkB,UAAkB,gBAAsB;AACjE,MAAI,YAAY,QAAQ,aAAa,IAAI;AACvC,WAAO;EACT;AAEA,MAAIE,QAAO,QAAQ,GAAG;AACpB,WAAO,CAAC,OAAO,QAAQ;EACzB;AAEA,MAAIC,QAAO,QAAQ,GAAG;AACpB,WAAO,CAAC,OAAO,QAAQ;EACzB;AAIA,MAAI,SAAS,CAAC,MAAM,KAAK;AACvB,UAAM,UAAU,SAAS,UAAU,GAAG,SAAS,SAAS,CAAC;AACzD,QAAIA,QAAO,OAAO,GAAG;AACnB,aAAO,CAAC,OAAO,OAAO;IACxB;EACF;AAEA,SAAO,CAAC,gBAAgB,QAAQ;AAClC;AAEA,SAAS,aAAc,MAAc,QAAc;AACjD,MAAI,QAAQ,QAAQ,SAAS,IAAI;AAC/B,WAAO;EACT;AAEA,MAAI,WAAW,OAAO;AACpB,WAAO,CAAC,OAAO,IAAI;EACrB;AAEA,SAAO,CAAC,OAAO,IAAI;AACrB;AAEA,SAAS,eAAgB,QAAc;AACrC,MAAI,OAAO,MAAM,aAAa,KAAK,MAAM;AACvC,WAAO;EACT;AAEA,MAAI,WAAW,SAAS;AACtB,WAAO,CAAC,WAAW;EACrB;AAEA,MAAI,WAAW,OAAO;AACpB,WAAO,CAAC,SAAS;EACnB;AAEA,SAAO,CAAC,MAAM;AAChB;AAEA,SAAS,aAAc,MAAY;AACjC,MAAI,QAAQ,QAAQ,SAAS,IAAI;AAC/B,WAAO;EACT;AAEA,SAAO,CAAC,aAAa,mBAAmB,IAAI,CAAC;AAC/C;AAEA,SAAS,gBAAiB,UAAgB;AACxC,MAAI,YAAY,QAAQ,aAAa,MAAM,QAAQ,QAAQ,KAAK,MAAM;AACpE,WAAO;EACT;AAEA,SAAO,QAAQ,QAAQ;AACzB;;;ACtMA,IAAAC,kBAAwB;AAExB,IAAAC,eAA8B;AAoBvB,IAAM,0CACX;AACK,IAAM,kCAAkC;AA8ExC,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,SAAiB;AAC3B,UAAM,sCAAsC,OAAO,EAAE;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAGtD,YAAY,SAAiB,UAAuC;AAClE,UAAM,4CAA4C,OAAO,EAAE;AAC3D,SAAK,OAAO;AACZ,SAAK,WAAW;AAAA,EAClB;AACF;AAEO,SAAS,yBACd,QACuB;AACvB,SAAO;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,YAAY,CAAC,GAAG,OAAO,UAAU;AAAA,IACjC,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,EACnB;AACF;AAEO,SAAS,yBACd,SACQ;AACR,SAAO,KAAK,UAAU;AAAA,IACpB,SAAS,QAAQ;AAAA,IACjB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,mBACpB,SACA,QACyB;AACzB,gCAA8B,OAAO;AACrC,QAAM,UAAU,yBAAyB,OAAO;AAChD,QAAM,YACJ,OAAO,SAAS,YACZ,MAAM,OAAO,YAAY,OAAO,IAChCC;AAAA,IACE,MAAM,OAAO,UAAU,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC;AAAA,EAC1D;AACN,SAAO,EAAE,GAAG,SAAS,UAAU;AACjC;AAEO,SAAS,8BACd,OACuB;AACvB,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,UAAM,IAAI,8BAA8B,2BAA2B;AAAA,EACrE;AAEA,QAAM,UAAU;AAChB,MAAI,QAAQ,YAAY,GAAG;AACzB,UAAM,IAAI,8BAA8B,mBAAmB;AAAA,EAC7D;AACA,kBAAgB,QAAQ,OAAO;AAC/B,qBAAmB,QAAQ,UAAU;AACrC,MACE,OAAO,QAAQ,eAAe,YAC9B,OAAO,MAAM,KAAK,MAAM,QAAQ,UAAU,CAAC,GAC3C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,QAAQ,aAAa,YAC5B,CAAC,OAAO,cAAc,QAAQ,QAAQ,KACtC,QAAQ,WAAW,GACnB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,QAAQ;AAAA,IACjB,YAAY,CAAC,GAAG,QAAQ,UAAU;AAAA,IAClC,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,EACpB;AACF;AAEO,SAAS,uBAAuB,OAAgC;AACrE,QAAM,UAAU,8BAA8B,KAAK;AACnD,QAAM,YAAa,MAAkC;AACrD,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,GAAG,SAAS,UAAU;AACjC;AAEA,eAAsB,qBACpB,OACkB;AAClB,QAAM,SAAS,uBAAuB,KAAK;AAC3C,QAAM,UAAU,yBAAyB,yBAAyB,MAAM,CAAC;AAEzE,MAAI,OAAO,QAAQ,WAAW,UAAU,GAAG;AACzC,WAAO,mBAAmB,OAAO,SAAS,SAAS,OAAO,SAAS;AAAA,EACrE;AACA,MAAI,OAAO,QAAQ,WAAW,UAAU,GAAG;AACzC,WAAO,sBAAsB,OAAO,SAAS,SAAS,OAAO,SAAS;AAAA,EACxE;AACA,SAAO;AACT;AAEA,eAAsB,oBACpB,aACA,SACA,UAAwB,WAAW,OACH;AAChC,QAAM,MAAM,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,iBAAiB,mBAAmB,OAAO,CAAC;AACzF,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,mCAAmC,SAAS,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,MAAI,KAAK,WAAW,QAAW;AAC7B,UAAM,IAAI,8BAA8B,kCAAkC;AAAA,EAC5E;AACA,SAAO,uBAAuB,KAAK,MAAM;AAC3C;AAEA,eAAsB,qBACpB,SACAC,WAAuC,CAAC,GACR;AAChC,kBAAgB,OAAO;AACvB,QAAM,gBAAgBA,SAAQ,iBAAiB;AAC/C,QAAM,WAAW,MAAM,QAAQ,IAAI;AAAA,IACjC,gBAAgB,SAASA,SAAQ,kBAAkB;AAAA,IACnD,kBAAkB,SAASA,SAAQ,YAAY,aAAa;AAAA,IAC5D,mBAAmB,SAASA,UAAS,aAAa;AAAA,IAClD,gBAAgB,SAASA,SAAQ,kBAAkB;AAAA,EACrD,CAAC;AAED,QAAM,SAAS,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,GAAG;AAC9D,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,6BAA6B,SAAS,QAAQ;AAAA,EAC1D;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,YAAY,CAAC,GAAG,OAAO,UAAU;AAAA,IACjC,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACjD;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AACF;AAEA,eAAsB,sBACpB,SACAA,WAAwC,CAAC,GACR;AACjC,QAAM,WAAW,MAAM,qBAAqB,SAAS;AAAA,IACnD,oBAAoB,kBAAkBA,SAAQ,aAAa;AAAA,IAC3D,YAAYA,SAAQ;AAAA,IACpB,wBACEA,SAAQ,gBAAgB,OACpB,SACCA,SAAQ,eAAe;AAAA,IAC9B,oBAAoB;AAAA,MAClBA,SAAQ,kBAAkB,OACtB,SACCA,SAAQ,iBAAiB,CAAC,+BAA+B;AAAA,IAChE;AAAA,IACA,OAAOA,SAAQ;AAAA,IACf,eAAeA,SAAQ;AAAA,EACzB,CAAC;AAED,SAAO;AAAA,IACL,OAAO,SAAS,WAAW,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC;AAAA,IACjE;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,OAAuB;AACxD,QAAM,MAAM,eAAe,UAAU,KAAK,CAAC;AAC3C,MAAI,CAAC,IAAI,WAAW,SAAS,KAAK,CAAC,IAAI,WAAW,UAAU,GAAG;AAC7D,UAAM,IAAI;AAAA,MACR,6CAA6C,KAAK;AAAA,IACpD;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAuB;AACxD,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI,8BAA8B,4BAA4B;AAAA,EACtE;AACA,SAAO,eAAe,IAAI,SAAS,CAAC,EAAE,SAAS;AACjD;AAEA,SAAS,kBAAkB,OAAmD;AAC5E,MAAI,UAAU,UAAa,MAAM,WAAW,GAAG;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM;AAAA,IAAI,CAAC,SAChB,KAAK,WAAW,GAAG,IAAI,OAAO,mBAAmB,IAAI;AAAA,EACvD;AACF;AAEA,eAAe,gBACb,SACA,YACoC;AACpC,SAAO,eAAe,YAAY,YAAY;AAC5C,QAAI,eAAe,UAAa,WAAW,WAAW,GAAG;AACvD,aAAO;AAAA,IACT;AACA,WAAO,YAAY,SAAS,YAAY,YAAY,KAAK;AAAA,EAC3D,CAAC;AACH;AAEA,eAAe,kBACb,SACA,UACA,eACoC;AACpC,SAAO,eAAe,cAAc,YAAY;AAC9C,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM,SAAS,OAAO;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,mBACb,SACAA,UACA,eACoC;AACpC,SAAO,eAAe,eAAe,YAAY;AAC/C,QAAI,CAACA,SAAQ,wBAAwB;AACnC,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM;AAAA,MACnBA,SAAQ;AAAA,MACR;AAAA,MACAA,SAAQ;AAAA,IACV;AACA,WAAO,YAAY,SAAS,eAAe,QAAQ,aAAa;AAAA,EAClE,CAAC;AACH;AAEA,eAAe,gBACb,SACA,YACoC;AACpC,SAAO,eAAe,YAAY,YAAY;AAC5C,QAAI,eAAe,UAAa,WAAW,WAAW,GAAG;AACvD,aAAO;AAAA,IACT;AACA,WAAO,YAAY,SAAS,YAAY,YAAY,KAAK;AAAA,EAC3D,CAAC;AACH;AAEA,eAAe,eACb,QACA,SACoC;AACpC,MAAI;AACF,UAAM,YAAY,MAAM,QAAQ;AAChC,WAAO,YAAY,EAAE,QAAQ,UAAU,IAAI,EAAE,OAAO;AAAA,EACtD,SAAS,OAAO;AACd,WAAO;AAAA,MACL;AAAA,MACA,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AACF;AAEA,eAAe,YACb,SACA,QACA,OACA,cACmC;AACnC,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,uBAAmB,KAAK;AACxB,WAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,KAAK,EAAE;AAAA,EAC1C;AAEA,QAAM,cAAc;AACpB,MAAI,YAAY,YAAY,KAAK,YAAY,cAAc,QAAW;AACpE,UAAM,SAAS,uBAAuB,KAAK;AAC3C,QAAI,OAAO,YAAY,SAAS;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,gBAAgB,CAAE,MAAM,qBAAqB,MAAM,GAAI;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,OAAO,UAAU,GAAG,OAAO;AAAA,EAC9D;AAEA,QAAM,iBAAiB;AACvB,MAAI,CAAC,MAAM,QAAQ,eAAe,UAAU,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,qBAAmB,eAAe,UAAU;AAC5C,MAAI,eAAe,WAAW,QAAW;AACvC,UAAM,SAAS,uBAAuB,eAAe,MAAM;AAC3D,QAAI,OAAO,YAAY,SAAS;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,gBAAgB,CAAE,MAAM,qBAAqB,MAAM,GAAI;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,eAAe,UAAU,GAAG,OAAO;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,eAAe,UAAU,EAAE;AAC9D;AAEA,SAAS,gBAAgB,SAA6C;AACpE,MAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GAAG;AACvD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,WAAW,UAAU,KAAK,CAAC,QAAQ,WAAW,UAAU,GAAG;AACtE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,8BAA8B,6BAA6B;AAAA,EACvE;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,gBAAU,IAAI;AAAA,IAChB,QAAQ;AACN,YAAM,IAAI,8BAA8B,sBAAsB,IAAI,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,eAAe,mBACb,KACA,SACA,WACkB;AAClB,QAAM,UAAU,IAAI,MAAM,GAAG,EAAE,GAAG,EAAE;AACpC,MAAI,CAAC,WAAW,CAAC,sBAAsB,KAAK,OAAO,GAAG;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,mBAAmB,KAAK,SAAS,GAAG;AACvC,UAAM,IAAI,8BAA8B,+BAA+B;AAAA,EACzE;AAEA,aAAO,4BAAc;AAAA,IACnB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBACP,KACA,SACA,WACS;AACT,QAAM,YAAYC,4BAA2B,GAAG;AAChD,QAAM,iBAAiB,gBAAgB,SAAS;AAChD,MAAI,eAAe,WAAW,IAAI;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,wBAAQ;AAAA,IACb;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,IAChC;AAAA,EACF;AACF;AAEO,SAAS,6BACd,KACA,SACA,WACS;AACT,QAAM,YAAYA,4BAA2B,GAAG;AAChD,SAAO,wBAAQ,OAAO,WAAW,SAAS,SAAS;AACrD;AAEA,SAASA,4BAA2B,KAAyB;AAC3D,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,UAAU,OAAO,UAAU;AAC/C,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,KAAM;AAC5C,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAASF,iBAAgB,OAA2B;AAClD,QAAMG,YACJ;AACF,MAAI,SAAS;AAEb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,UAAM,IAAI,MAAM,CAAC;AACjB,UAAM,IAAI,MAAM,IAAI,CAAC;AACrB,UAAM,IAAI,MAAM,IAAI,CAAC;AACrB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AAEpD,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,QAAI,IAAI,IAAI,MAAM,QAAQ;AACxB,gBAAUA,UAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,IAAI,IAAI,MAAM,QAAQ;AACxB,gBAAUA,UAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAMA,YACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AAEX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQA,UAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AAEA,SAAO,WAAW,KAAK,KAAK;AAC9B;","names":["options","base","name","import_viem","name","encode","length","i","j","decode","string","name","decoders","encode","decode","alphabet","string","encode","decode","decode","code","code","digest","decode","equals","base","baseCache","code","digest","equals","base","decode","length","cache","cid","import_zod","code","output","length","code","import_viem","code","objectHasOwn","options","code","objectHasOwn","encode","decode","textEncoder","identity_exports","identity","encode","options","identity","sha256","from","name","code","encode","options","digest","sha256","from","crypto","identity_exports","import_viem","textEncoder","objectHasOwn","requiredString","assertExactKeys","requiredValue","hasOwn","requiredArray","digest","encoded","alphabet","code","options","expectObject","assertExactKeys","hasOwn","requiredString","code","assertExactKeys","requiredValue","hasOwn","requiredString","code","objectHasOwn","hasOwn","code","parseStrictRfc3339","requestedCapabilitiesHash","options","fact","code","digest","base","parseStrictRfc3339","import_zod","EnsDataSchema","import_sdk_services","import_sdk_services","import_zod","import_zod","name","name","options","errorText","import_sdk_services","import_sdk_services","ms","name","base","options","import_bootstrap","SERVICE_NAME","options","revoked","name","import_sdk_services","code","options","import_zod","pathContains","import_ed25519","createError","code","base64UrlEncode","base64","base64UrlDecode","err","options","import_sdk_services","SERVICE_NAME","options","options","err","import_bootstrap","equals","N1","N2","N3","N4","N5","N6","N7","MSB","REST","encodingLength","REST","MSB","N4","N5","N6","N7","decode","import_node_buffer","length","import_node_buffer","name","encode","decode","string","fromString","string","base","import_node_buffer","toString","base","base","toString","fromString","word","code","code","decode","encodingLength","toString","length","fromString","bytes","string","_a","options","validate","code","equals","name","code","options","vm","toString","options","clonedRegexp","string","isIPv6","string","isIPv4","isIPv4","isIPv6","import_ed25519","import_viem","base64UrlEncode","options","ed25519PublicKeyFromDidKey","alphabet"]}
1
+ {"version":3,"sources":["../src/index.ts","../src/client-types.ts","../src/notifications.ts","../src/identity.ts","../src/requester/index.ts","../../../node_modules/multiformats/src/bases/base32.ts","../../../node_modules/multiformats/src/bytes.ts","../../../node_modules/multiformats/src/vendor/base-x.js","../../../node_modules/multiformats/src/bases/base.ts","../../../node_modules/multiformats/src/bases/base36.ts","../../../node_modules/multiformats/src/bases/base58.ts","../../../node_modules/multiformats/src/vendor/varint.js","../../../node_modules/multiformats/src/varint.ts","../../../node_modules/multiformats/src/hashes/digest.ts","../../../node_modules/multiformats/src/cid.ts","../src/policy/errors.ts","../src/policy/jcs.ts","../src/policy/capability.ts","../src/policy/signed-object.ts","../../../node_modules/multiformats/src/bases/base10.ts","../../../node_modules/multiformats/src/bases/base16.ts","../../../node_modules/multiformats/src/bases/base2.ts","../../../node_modules/multiformats/src/bases/base256emoji.ts","../../../node_modules/multiformats/src/bases/base64.ts","../../../node_modules/multiformats/src/bases/base8.ts","../../../node_modules/multiformats/src/bases/identity.ts","../../../node_modules/multiformats/src/codecs/json.ts","../../../node_modules/multiformats/src/hashes/identity.ts","../../../node_modules/multiformats/src/hashes/sha2.ts","../../../node_modules/multiformats/src/hashes/hasher.ts","../../../node_modules/multiformats/src/basics.ts","../src/policy/authoring.ts","../src/networkId.ts","../src/storage.schema.ts","../src/TinyCloud.ts","../src/spaces/SpaceService.ts","../src/spaces/Space.ts","../src/spaces/spaces.schema.ts","../src/delegations/types.schema.ts","../src/expiry.ts","../src/account/AccountService.ts","../src/manifest.ts","../src/space.ts","../src/delegations/DelegationManager.ts","../src/delegations/SharingService.schema.ts","../src/capabilities.ts","../src/delegations/SharingService.ts","../src/authorization/CapabilityKeyRegistry.ts","../src/authorization/strategies.ts","../src/authorization/spaceCreation.ts","../src/version.ts","../../../node_modules/uint8arrays/src/equals.ts","../../../node_modules/uint8arrays/src/alloc.node.ts","../../../node_modules/uint8arrays/src/util/as-uint8array.node.ts","../../../node_modules/uint8-varint/src/index.ts","../../../node_modules/uint8arrays/src/concat.node.ts","../../../node_modules/uint8arrays/src/from-string.node.ts","../../../node_modules/uint8arrays/src/util/bases.ts","../../../node_modules/uint8arrays/src/to-string.node.ts","../../../node_modules/@multiformats/multiaddr/src/errors.ts","../../../node_modules/@chainsafe/is-ip/src/is-ip.node.ts","../../../node_modules/@multiformats/multiaddr/src/constants.ts","../../../node_modules/@multiformats/multiaddr/src/utils.ts","../../../node_modules/@multiformats/multiaddr/src/validation.ts","../../../node_modules/@multiformats/multiaddr/src/registry.ts","../../../node_modules/@multiformats/multiaddr/src/components.ts","../../../node_modules/@multiformats/multiaddr/src/multiaddr.ts","../../../node_modules/@multiformats/multiaddr/src/index.ts","../../../node_modules/@multiformats/multiaddr-to-uri/src/index.ts","../../../node_modules/ip-regex/index.js","../../../node_modules/function-timeout/index.js","../../../node_modules/clone-regexp/node_modules/is-regexp/index.js","../../../node_modules/clone-regexp/index.js","../../../node_modules/super-regex/index.js","../../../node_modules/is-ip/index.js","../../../node_modules/@multiformats/uri-to-multiaddr/src/index.ts","../src/location.ts"],"sourcesContent":["/**\n * @tinycloud/sdk-core\n *\n * Core TinyCloud SDK package providing shared interfaces and the TinyCloud class.\n *\n * This package defines the platform-agnostic interfaces that both web-sdk and node-sdk\n * implement. The main TinyCloud class accepts an IUserAuthorization implementation,\n * allowing it to work in both browser and Node.js environments.\n *\n * @packageDocumentation\n */\n\n// Platform-agnostic client types (canonical definitions)\nexport {\n ClientSession,\n EnsData,\n SiweConfig,\n ServerHost,\n ClientSessionSchema,\n EnsDataSchema,\n SiweConfigSchema,\n validateClientSession,\n SiweMessage,\n} from \"./client-types\";\n\n// Notification handler\nexport {\n INotificationHandler,\n SilentNotificationHandler,\n} from \"./notifications\";\n\n// ENS resolver\nexport { IENSResolver } from \"./ens\";\n\n// WASM bindings abstraction\nexport {\n IWasmBindings,\n ISessionManager,\n type PersistedSessionProof,\n type ValidatedPersistedSessionProof,\n} from \"./wasm\";\n\n// Signer interface\nexport { ISigner, Bytes } from \"./signer\";\n\n// Identity helpers\nexport {\n IdentityParseError,\n addressStorageKey,\n canonicalizeAddress,\n canonicalizeDid,\n canonicalizeDidUrl,\n didCacheKey,\n didEquals,\n isEvmAddress,\n makePkhSpaceId,\n parsePkhDid,\n pkhDid,\n principalDid,\n principalDidEquals,\n type CanonicalAddress,\n type DidCacheKeyOptions,\n type DidEqualsOptions,\n type PkhDidParts,\n} from \"./identity\";\n\nexport {\n HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,\n LISTEN_SQL_STATEMENT_CATALOG,\n POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA,\n POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA,\n POLICY_ENGINE_DENIAL_SCHEMA,\n POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES,\n POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA,\n PORTABLE_DELEGATION_SCHEMA,\n REQUESTER_ENGINE_RETRY_ATTEMPTS,\n REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,\n REQUESTER_NEAR_EXPIRY_SECONDS,\n TranscriptRequester,\n TranscriptRequesterError,\n createTranscriptRequester,\n deriveDelegationCid,\n parseNodeNativePortableDelegation,\n type HolderKeyBindingPresentation,\n type ListenSqlStatementName,\n type PolicyEngineGrantPresentationDenialCode,\n type PortableDelegation,\n type RequesterHttpRequest,\n type RequesterHttpResponse,\n type RequesterEndpointResolution,\n type RequesterInvocationCapability,\n type RequesterSigningCapability,\n type RequesterTransport,\n type TranscriptRequesterErrorCode,\n type TranscriptRequesterErrorState,\n type TranscriptRequesterOptions,\n type TranscriptRequesterReadKvResult,\n type TranscriptRequesterReadSqlResult,\n} from \"./requester\";\n\n// Encryption network identity helpers\nexport {\n canonicalizeNetworkId,\n parseCanonicalNetworkId,\n type CanonicalParsedNetworkId,\n} from \"./networkId\";\n\n// Session storage interface and types\nexport {\n // Interface\n ISessionStorage,\n // Types (derived from Zod schemas)\n PersistedSessionData,\n PersistedTinyCloudSession,\n TinyCloudSession,\n ValidationError,\n // Validation\n validatePersistedSessionData,\n} from \"./storage\";\n\n// User authorization interface and types\nexport {\n IUserAuthorization,\n Extension,\n PartialSiweMessage,\n UserAuthorizationConfig,\n} from \"./userAuthorization\";\nexport type { SignInOptions } from \"./userAuthorization\";\n\n// Main TinyCloud class\nexport { TinyCloud, TinyCloudConfig } from \"./TinyCloud\";\n\n// Account-level app registry, delegation, and materialized index helpers\nexport { AccountService } from \"./account/AccountService\";\nexport type {\n AccountApplication,\n AccountApplicationListOptions,\n AccountDelegation,\n AccountDelegationListOptions,\n AccountDelegationRevokeOptions,\n AccountIndexEnsureResult,\n AccountIndexRebuildResult,\n AccountIndexStatus,\n AccountIndexedReadOptions,\n AccountServiceConfig,\n AccountSpace,\n AccountSpaceListOptions,\n AccountStatus,\n} from \"./account/AccountService\";\n\n// Re-export service types from sdk-services for convenience\nexport {\n // Context\n ServiceContext,\n type ServiceContextConfig,\n type IServiceContext,\n // Service types\n type IService,\n // KV Service\n KVService,\n PrefixedKVService,\n type IKVService,\n type IPrefixedKVService,\n type KVServiceConfig,\n type KVGetOptions,\n type KVPutOptions,\n type KVListOptions,\n type KVDeleteOptions,\n type KVHeadOptions,\n type KVCreateSignedReadUrlOptions,\n type KVResponse,\n type KVListResponse,\n type KVSignedReadUrlResponse,\n type KVResponseHeaders,\n // Result pattern\n type Result,\n ok,\n err,\n serviceError,\n ErrorCodes,\n type ErrorCode,\n type ServiceError,\n // Session\n type ServiceSession,\n // Platform dependencies\n type InvokeFunction,\n type InvokeAnyFunction,\n type InvokeAnyEntry,\n type FetchFunction,\n type TelemetryConfig,\n type TelemetryEventHandler,\n TinyCloudDebugLogger,\n tinyCloudDebugLogger,\n enableTinyCloudDebug,\n disableTinyCloudDebug,\n getTinyCloudDebugLogs,\n clearTinyCloudDebugLogs,\n installTinyCloudDebugGlobals,\n type TinyCloudDebugEvent,\n type TinyCloudDebugLevel,\n type TinyCloudDebugEnableOptions,\n type TinyCloudDebugTimer,\n // Retry\n type RetryPolicy,\n defaultRetryPolicy,\n // SQL Service\n SQLService,\n DatabaseHandle,\n SQLAction,\n type ISQLService,\n type IDatabaseHandle,\n type SQLServiceConfig,\n type SqlValue,\n type SqlStatement,\n type QueryOptions,\n type ExecuteOptions,\n type BatchOptions,\n type QueryResponse,\n type ExecuteResponse,\n type BatchResponse,\n type SQLActionType,\n // DuckDB Service\n DuckDbService,\n DuckDbDatabaseHandle,\n DuckDbAction,\n type IDuckDbService,\n type IDuckDbDatabaseHandle,\n type DuckDbServiceConfig,\n type DuckDbQueryOptions,\n type DuckDbExecuteOptions,\n type DuckDbBatchOptions,\n type DuckDbOptions,\n type DuckDbValue,\n type DuckDbStatement,\n type DuckDbQueryResponse,\n type DuckDbExecuteResponse,\n type DuckDbBatchResponse,\n type DuckDbActionType,\n type SchemaInfo,\n type TableInfo,\n type ColumnInfo,\n type ViewInfo,\n // Hooks Service\n HooksService,\n type IHooksService,\n type HookServiceName,\n type HookSubscription,\n type HookEvent,\n type HookStreamEvent,\n type HookWebhookScope,\n type HookWebhookRegistration,\n type HookWebhookRecord,\n type HookWebhookListOptions,\n type HookWebhookUnregisterOptions,\n type SubscribeOptions,\n type HooksServiceConfig,\n // Vault Service\n DataVaultService,\n VaultHeaders,\n VaultPublicSpaceKVActions,\n createVaultCrypto,\n type IDataVaultService,\n type VaultCrypto,\n type WasmVaultFunctions,\n type DataVaultConfig,\n type VaultPutOptions,\n type VaultGetOptions,\n type VaultListOptions,\n type VaultGrantOptions,\n type VaultEntry,\n type VaultNetworkReadResult,\n type VaultError,\n // Secrets Service\n SecretsService,\n SECRET_NAME_RE,\n canonicalizeSecretScope,\n resolveSecretListPrefix,\n resolveSecretPath,\n type ISecretsService,\n type SecretPayload,\n type SecretsError,\n type ResolvedSecretPath,\n type SecretScopeOptions,\n // Encryption Service (network-scoped)\n EncryptionService,\n DecryptTransportResponseError,\n parseNetworkId,\n buildNetworkId,\n isNetworkId,\n networkDiscoveryKey,\n NetworkIdError,\n ENCRYPTION_NETWORK_URN_PREFIX,\n NETWORK_NAME_PATTERN,\n canonicalizeEncryptionJson,\n canonicalHashHex,\n hexEncode,\n hexDecode,\n base64Encode as encryptionBase64Encode,\n base64Decode as encryptionBase64Decode,\n utf8Encode as encryptionUtf8Encode,\n utf8Decode as encryptionUtf8Decode,\n encryptToNetwork,\n decryptEnvelopeWithKey,\n validateEnvelope,\n generateRandomReceiverKey,\n deriveSignedReceiverKey,\n buildCanonicalDecryptRequest,\n buildDecryptFacts,\n buildDecryptAttenuation,\n buildDecryptInvocation,\n checkDecryptInvocationInput,\n verifyDecryptResponse,\n canonicalSignedResponse,\n openWrappedKey,\n discoverNetwork,\n ensureNetworkUsableForDecrypt,\n DEFAULT_ENCRYPTION_ALG,\n ENVELOPE_VERSION,\n DEFAULT_KEY_VERSION,\n DECRYPT_FACT_TYPE,\n DECRYPT_RESULT_TYPE,\n DECRYPT_ACTION,\n ENCRYPTION_SERVICE,\n ENCRYPTION_SERVICE_SHORT,\n encryptionError,\n type IEncryptionService,\n type EncryptionServiceConfig,\n type DecryptTransport,\n type EncryptToNetworkOptions,\n type DecryptEnvelopeOptions,\n type ParsedNetworkId,\n type BuildDecryptInvocationInput,\n type BuiltDecryptInvocation,\n type CanonicalJson,\n type DecryptCapabilityProof,\n type DecryptInvocationFact,\n type DecryptInvocationSigner,\n type DecryptRequestBody,\n type DecryptResponseBody,\n type EncryptionCrypto,\n type EncryptionError,\n type EncryptionErrorInput,\n type InlineEncryptedEnvelope,\n type NetworkDescriptor,\n type ReceiverKeyPair,\n type ReceiverKeySigner,\n type EncryptToNetworkInput,\n type EncryptToNetworkResult,\n type CanonicalDecryptRequest,\n type BuildCanonicalDecryptRequestInput,\n type BuildDecryptFactsInput,\n type RandomReceiverKeyInput,\n type SignedReceiverKeyInput,\n type VerifyDecryptResponseInput,\n type DiscoverNetworkInput,\n type DiscoveredNetwork,\n type DiscoverySource,\n type NodeDescriptorFetcher,\n type WellKnownDescriptorFetcher,\n} from \"@tinycloud/sdk-services\";\n\n// Space utilities\nexport {\n SpaceHostResult,\n fetchPeerId,\n submitHostDelegation,\n activateSessionWithHost,\n} from \"./space\";\n\n// Delegations\nexport {\n // Result pattern (aliased to avoid conflict with sdk-services Result)\n Result as DelegationResult,\n DelegationError,\n DelegationErrorCodes,\n DelegationErrorCode,\n // Delegation types\n Delegation,\n DelegationStatus,\n DelegationRevocationReceipt,\n AccountDelegationResource,\n AccountDelegationRecord,\n AccountDelegationPage,\n AccountDelegationQueryOptions,\n CreateDelegationParams,\n CreateDelegationWasmParams,\n CreateDelegationWasmResult,\n DelegatedResource,\n DelegationChain,\n DelegationApiResponse,\n // Configuration types\n DelegationManagerConfig,\n KeyProvider,\n // Classes\n DelegationManager,\n // v2 SharingService\n SharingService,\n createSharingService,\n ISharingService,\n SharingServiceConfig,\n EncodedShareData,\n ReceiveOptions,\n ShareAccess,\n DelegateReceivedShareParams,\n DelegatedShareAccess,\n // v2 types\n JWK,\n KeyType,\n KeyInfo,\n CapabilityEntry,\n DelegationRecord,\n DelegationChainV2,\n DelegationDirection,\n DelegationFilters,\n SpaceOwnership,\n SpaceInfo,\n ShareSchema,\n ShareLink,\n ShareLinkData,\n IngestOptions,\n GenerateShareParams,\n} from \"./delegations\";\n\n// Authorization (v2 spec)\nexport {\n // Class\n CapabilityKeyRegistry,\n // Interface\n ICapabilityKeyRegistry,\n // Factory\n createCapabilityKeyRegistry,\n // Types\n StoredDelegationChain,\n // Error codes\n CapabilityKeyRegistryErrorCodes,\n CapabilityKeyRegistryErrorCode,\n // SignStrategy types\n SignRequest,\n SignResponse,\n SignCallback,\n OpenKeySigningStrategyOptions,\n OpenKeySigningRequestBody,\n OpenKeySigningResponseBody,\n OpenKeyCallbackStrategy,\n AutoSignStrategy,\n AutoRejectStrategy,\n CallbackStrategy,\n EventEmitterStrategy,\n SignStrategy,\n defaultSignStrategy,\n createOpenKeyCallbackSigningStrategy,\n // Space creation handler types\n SpaceCreationContext,\n ISpaceCreationHandler,\n AutoApproveSpaceCreationHandler,\n defaultSpaceCreationHandler,\n} from \"./authorization\";\n\n// Spaces (v2 spec)\nexport {\n // Space object\n Space,\n ISpace,\n SpaceConfig,\n ISpaceScopedDelegations,\n ISpaceScopedSharing,\n // SpaceService\n SpaceService,\n ISpaceService,\n SpaceServiceConfig,\n SpaceErrorCodes,\n SpaceErrorCode,\n createSpaceService,\n // URI utilities\n parseSpaceUri,\n buildSpaceUri,\n // Public space utility\n makePublicSpaceId,\n // Delegation creation types\n SpaceDelegationParams,\n CreateDelegationFunction,\n} from \"./spaces\";\n\n// Protocol version checking\nexport {\n ProtocolMismatchError,\n VersionCheckError,\n UnsupportedFeatureError,\n checkNodeInfo,\n} from \"./version\";\nexport type { NodeInfo } from \"./version\";\n\n// Manifest types and resolution (capability chain delegation)\nexport {\n // Types\n type Manifest,\n type ManifestDefaults,\n type ManifestKnowledge,\n type ManifestSecretActions,\n type ComposeManifestOptions,\n type ComposedManifestRequest,\n type ManifestRegistryRecord,\n type PermissionEntry,\n type ResolvedCapabilities,\n type ResolvedDelegate,\n type ResourceCapability,\n type SpaceAbilitiesMap,\n // Errors\n ManifestValidationError,\n // Constants\n ACCOUNT_REGISTRY_PATH,\n ACCOUNT_REGISTRY_SPACE,\n DEFAULT_DEFAULTS,\n DEFAULT_EXPIRY,\n DEFAULT_KNOWLEDGE_ROOT,\n DEFAULT_MANIFEST_SPACE,\n DEFAULT_MANIFEST_VERSION,\n SECRETS_SPACE,\n SERVICE_LONG_TO_SHORT,\n SERVICE_SHORT_TO_LONG,\n VAULT_PERMISSION_SERVICE,\n ENCRYPTION_PERMISSION_SERVICE,\n ENCRYPTION_MANIFEST_SPACE,\n // Types\n type AbilitiesMap,\n // Functions\n applyPrefix,\n composeManifestRequest,\n expandActionShortNames,\n expandPermissionEntries,\n expandPermissionEntry,\n loadManifest,\n manifestAbilitiesUnion,\n normalizeDefaults,\n parseExpiry,\n resolveManifestKnowledgeRoot,\n resolveManifest,\n resourceCapabilitiesToAbilitiesMap,\n resourceCapabilitiesToSpaceAbilitiesMap,\n validateManifest,\n} from \"./manifest\";\n\nexport {\n ACCOUNT_INDEX_SCHEMA,\n BOOTSTRAP_ALLOWLIST,\n BOOTSTRAP_DEFAULT_SPACE,\n BOOTSTRAP_ENCRYPTION_NETWORK_NAME,\n BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,\n BOOTSTRAP_MANIFEST,\n BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,\n BOOTSTRAP_PUBLIC_SPACE,\n BOOTSTRAP_SESSION_REQUESTS,\n BOOTSTRAP_SPACE_MANIFESTS,\n BOOTSTRAP_SPACE_NAMES,\n SECRET_RECORDS_SCHEMA,\n TINYCLOUD_ACCOUNT_SPACE_MANIFEST,\n TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,\n TINYCLOUD_DEFAULT_SPACE_MANIFEST,\n TINYCLOUD_PUBLIC_SPACE_MANIFEST,\n TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,\n bootstrapEncryptionNetworkId,\n bootstrapSpaceId,\n bootstrapSteps,\n composeBootstrapSpaceManifest,\n KV,\n SQL,\n DUCKDB,\n CAPABILITIES,\n HOOKS,\n ENCRYPTION,\n SPACE,\n CAPABILITY_REGISTRY,\n type CapabilityRegistryEntry,\n type CapabilityStatus,\n type BootstrapAllowlistEntry,\n type BootstrapAllowlistKind,\n type BootstrapEncryptionNetworkStep,\n type BootstrapManifest,\n type BootstrapRawAbilityAllowlistEntry,\n type BootstrapSchemaStep,\n type BootstrapSeedApplicationsStep,\n type BootstrapSeedSpacesStep,\n type BootstrapSpaceDescriptor,\n type BootstrapSpaceName,\n type BootstrapSpaceStep,\n type BootstrapStep,\n type BootstrapStepKind,\n} from \"@tinycloud/bootstrap\";\n\n// TinyCloud location registry helpers\nexport {\n CloudLocationResolutionError,\n DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY,\n DEFAULT_LOCAL_NODE_URL,\n DEFAULT_TINYCLOUD_FALLBACK_HOST,\n DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,\n LOCAL_LINK_HOST_SUFFIX,\n LOCAL_LINK_PROBE_TIMEOUT_MS,\n LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,\n LocationRecordValidationError,\n canonicalLocationPayload,\n createInMemoryLocalNodeIdentityStore,\n createLocalStorageLocalNodeIdentityStore,\n discoverLocalTinyCloudNode,\n fetchLocationRecord,\n httpUrlToMultiaddr,\n locationPayloadForRecord,\n multiaddrToHttpUrl,\n resolveCloudLocation,\n resolveTinyCloudHosts,\n signLocationRecord,\n validateLocationRecord,\n validateLocationRecordPayload,\n verifyDidKeyEd25519Signature,\n verifyLocationRecord,\n type DiscoverLocalTinyCloudNodeOptions,\n type DiscoveredLocalTinyCloudNode,\n type LocalNodeIdentityStore,\n type LocationCandidate,\n type LocationCandidateInput,\n type LocationRecord,\n type LocationRecordPayload,\n type LocationRecordSigner,\n type LocationResolutionAttempt,\n type LocationSource,\n type ResolveCloudLocationOptions,\n type ResolveTinyCloudHostsOptions,\n type ResolvedCloudLocation,\n type ResolvedTinyCloudHosts,\n type WebStorageLike,\n} from \"./location\";\n\n// Capability subset checking and recap parsing\nexport {\n // Errors\n CaveatedDelegationUnsupportedError,\n PermissionNotInManifestError,\n SessionExpiredError,\n // Functions\n isCapabilitySubset,\n actionContains,\n canonicalizeRecapCaveats,\n parseRecapCapabilities,\n recapCaveatsEqual,\n // Types\n type ParseRecapFromSiwe,\n type SubsetCheckResult,\n type WasmRecapEntry,\n} from \"./capabilities\";\n\n// Default lifetimes for delegation flows. See `expiry.ts` for the\n// \"pick a tier, not a number\" rationale.\nexport {\n DEFAULT_SIGNED_READ_URL_EXPIRY_MS,\n EXPIRY,\n type ExpiryTier,\n} from \"./expiry\";\n\n// Policy signed-object profile core\nexport {\n ED25519_JCS_SIGNATURE_SUITE,\n EIP191_JCS_SIGNATURE_SUITE,\n POLICY_ENGINE_RECORD_SCHEMA,\n POLICY_SCHEMA,\n POLICY_STATUS_SCHEMA,\n SignatureMaterialError,\n SignatureVerificationError,\n SignedObjectCanonicalizationError,\n SignedObjectDigestError,\n SignedObjectIdError,\n SignedObjectProfileError,\n SignedObjectSchemaError,\n SigningKeyBindingError,\n UnsupportedSignatureSuiteError,\n canonicalizeSignedObjectUnsigned,\n createAndSignPolicy,\n createAndSignPolicyEngineRecord,\n createAndSignPolicyStatus,\n createAndSignSignedObject,\n deriveSignedObjectMaterial,\n jcsCanonicalize,\n normalizeJson,\n serializeJcsJson,\n signedObjectIdFor,\n toSignedObjectError,\n validatePolicyEngineRecordSigned,\n validatePolicyEngineRecordSignedShape,\n validatePolicyEngineRecordUnsigned,\n validatePolicySigned,\n validatePolicySignedShape,\n validatePolicyStatusSigned,\n validatePolicyStatusSignedShape,\n validatePolicyStatusUnsigned,\n validatePolicyUnsigned,\n verifyPolicy,\n verifyPolicyEngineRecord,\n verifyPolicyStatus,\n verifySignedObject,\n type JsonObject,\n type JsonValue,\n type Policy,\n type PolicyEngineRecord,\n type PolicyStatus,\n type SignatureSuite,\n type SignedObjectErrorCode,\n type SignedObjectKind,\n type SignedObjectMaterial,\n type SignedObjectSignature,\n type SignedObjectSigner,\n type SignedObjectVerificationResult,\n type SignedPolicyObject,\n type UnsignedPolicy,\n type UnsignedPolicyEngineRecord,\n type UnsignedPolicyObject,\n type UnsignedPolicyStatus,\n} from \"./policy\";\n","/**\n * Platform-agnostic client types for TinyCloud SDK.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport { SiweMessage } from \"siwe\";\n\nexport { SiweMessage };\n\n/** ENS data associated with a user session. */\nexport interface EnsData {\n domain?: string | null;\n avatarUrl?: string | null;\n}\n\nexport const EnsDataSchema = z.object({\n domain: z.string().nullable().optional(),\n avatarUrl: z.string().nullable().optional(),\n});\n\n/** SIWE configuration. All fields optional — callers provide only what they need to override. */\nexport interface SiweConfig {\n domain?: string;\n uri?: string;\n chainId?: number;\n statement?: string;\n nonce?: string;\n expirationTime?: string;\n notBefore?: string;\n requestId?: string;\n resources?: string[];\n}\n\nexport const SiweConfigSchema = z\n .object({\n domain: z.string().optional(),\n uri: z.string().optional(),\n chainId: z.number().optional(),\n statement: z.string().optional(),\n nonce: z.string().optional(),\n expirationTime: z.string().optional(),\n notBefore: z.string().optional(),\n requestId: z.string().optional(),\n resources: z.array(z.string()).optional(),\n })\n .passthrough();\n\n/** Representation of an active client session. */\nexport interface ClientSession {\n /** User address (may be delegated) */\n address: string;\n /** User address without delegation */\n walletAddress: string;\n /** EIP-155 chain ID */\n chainId: number;\n /** Key to identify the session */\n sessionKey: string;\n /** The SIWE message text (from SiweMessage.prepareMessage()) */\n siwe: string;\n /** The signature of the SIWE message */\n signature: string;\n /** ENS data supported by TinyCloud */\n ens?: EnsData;\n}\n\nexport const ClientSessionSchema = z.object({\n address: z.string(),\n walletAddress: z.string(),\n chainId: z.number(),\n sessionKey: z.string(),\n siwe: z.string(),\n signature: z.string(),\n ens: EnsDataSchema.optional(),\n});\n\n/** The URL of a server running tinycloud-node. */\nexport type ServerHost = string;\n\n/** Validate unknown data as a ClientSession. Returns the parsed session or null. */\nexport function validateClientSession(data: unknown): ClientSession | null {\n const result = ClientSessionSchema.safeParse(data);\n return result.success ? result.data : null;\n}\n","/**\n * Notification handler interface for TinyCloud SDK.\n *\n * Abstracts UI notifications so that web-sdk can show toasts\n * while node-sdk uses a silent no-op handler.\n *\n * @packageDocumentation\n */\n\n/**\n * Platform-agnostic notification handler.\n *\n * Implementations can provide different UX patterns:\n * - Browser: toast notifications via antd or similar\n * - Node.js: silent (default) or logging\n * - CLI: console output\n */\nexport interface INotificationHandler {\n /** Called on successful operations (e.g., \"Successfully signed in\") */\n success(message: string, description?: string): void;\n /** Called on warnings */\n warning(message: string, description?: string): void;\n /** Called on errors */\n error(category: string, message: string, description?: string): void;\n /** Optional cleanup (e.g., dismiss all active notifications) */\n cleanup?(): void;\n}\n\n/** No-op handler for environments without UI (node-sdk default). */\nexport class SilentNotificationHandler implements INotificationHandler {\n success(): void {}\n warning(): void {}\n error(): void {}\n}\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n method: \"pkh\";\n namespace: \"eip155\";\n chainId: number;\n address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"IdentityParseError\";\n }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n const fragmentIndex = input.indexOf(\"#\");\n if (fragmentIndex < 0) {\n return { did: input, fragment: \"\" };\n }\n return {\n did: input.slice(0, fragmentIndex),\n fragment: input.slice(fragmentIndex),\n };\n}\n\nfunction assertValidChainId(chainId: number): void {\n if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n }\n}\n\nexport function isEvmAddress(input: string): boolean {\n return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n if (!isEvmAddress(address)) {\n throw new IdentityParseError(`Invalid EVM address: ${address}`);\n }\n return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n assertValidChainId(chainId);\n return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n const match = did.match(PKH_DID_RE);\n if (!match) return null;\n\n const chainId = Number(match[1]);\n assertValidChainId(chainId);\n\n return {\n method: \"pkh\",\n namespace: \"eip155\",\n chainId,\n address: canonicalizeAddress(match[2]),\n };\n}\n\nexport function canonicalizeDid(did: string): string {\n const pkh = parsePkhDid(did);\n if (pkh) {\n return pkhDid(pkh.address, pkh.chainId);\n }\n if (DID_RE.test(did)) {\n return did;\n }\n throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n const { did, fragment } = splitDidUrl(didUrl);\n return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n const { did, fragment } = splitDidUrl(input);\n const pkh = parsePkhDid(did);\n const base = pkh\n ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n : canonicalizeDid(did);\n\n return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n address: string,\n chainId: number,\n name: string,\n): string {\n assertValidChainId(chainId);\n if (!name) {\n throw new IdentityParseError(\"Space name cannot be empty\");\n }\n return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","import { bytesToHex, sha256 } from \"viem\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport type {\n InvokeAnyFunction,\n InvokeFunction,\n ServiceHeaders,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport { z } from \"zod\";\nimport {\n POLICY_VERSION_V0,\n TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n OWNER_NODE_ENDPOINT_SCHEMA,\n W3C_VC_CREDENTIAL_VERIFIER,\n jcsCanonicalize,\n normalizePolicyCapability,\n normalizeJson,\n policyCapabilityContains,\n verifyPolicyEngineRecordForRequester,\n type PolicyCapability,\n type TranscriptShareBootstrap,\n} from \"../policy\";\n\nexport const REQUESTER_NEAR_EXPIRY_SECONDS = 30;\nexport const REQUESTER_ENGINE_RETRY_ATTEMPTS = 3;\nexport const REQUESTER_ENGINE_RETRY_MAX_DELAY_MS = 250;\n\nexport const POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA =\n \"xyz.tinycloud.policy-engine/challenge-request/v0\" as const;\nexport const POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA =\n \"xyz.tinycloud.policy/challenge/v0\" as const;\nexport const POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA =\n \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const POLICY_ENGINE_DENIAL_SCHEMA =\n \"xyz.tinycloud.policy-engine/denial/v0\" as const;\nexport const HOLDER_KEY_BINDING_PRESENTATION_SCHEMA =\n \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const PORTABLE_DELEGATION_SCHEMA =\n \"xyz.tinycloud.policy/portable-delegation/v0\" as const;\n\nexport const POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES = [\n \"schema-invalid\",\n \"challenge-not-found\",\n \"challenge-expired\",\n \"challenge-nonce-consumed\",\n \"presentation-expired\",\n \"presentation-audience-mismatch\",\n \"presentation-evidence-missing\",\n \"digest-mismatch\",\n \"evidence-requirement-unknown\",\n \"evidence-requirement-duplicate\",\n \"holder-signature-invalid\",\n \"holder-signature-signer-mismatch\",\n \"id-mismatch\",\n \"requested-capabilities-exceeded\",\n \"requested-capabilities-hash-mismatch\",\n \"evidence-authority-missing\",\n \"evidence-credential-invalid\",\n \"evidence-domain-invalid\",\n \"evidence-domain-missing\",\n \"evidence-freshness-expired\",\n \"evidence-freshness-unestablishable\",\n \"evidence-issuer-missing\",\n \"evidence-issuer-untrusted\",\n \"evidence-presentation-invalid\",\n \"evidence-requirements-invalid\",\n \"evidence-verifier-unsupported\",\n \"enrollment-binding-mismatch\",\n \"enrollment-expired\",\n \"enrollment-not-yet-valid\",\n \"enrollment-out-of-scope\",\n \"enrollment-revoked\",\n \"enrollment-revoked-irreversible\",\n \"enrollment-status-rollback\",\n \"signature-invalid\",\n \"signer-not-authorized\",\n \"audience-mismatch\",\n \"capability-not-contained\",\n \"evidence-invalid\",\n \"evidence-missing\",\n \"evidence-stale\",\n \"evidence-subject-mismatch\",\n \"evidence-untrusted\",\n \"grant-ttl-exceeds-policy\",\n \"holder-did-mismatch\",\n \"holder-key-not-permitted\",\n \"holder-signature-invalid\",\n \"owner-mismatch\",\n \"policy-expired\",\n \"policy-inactive\",\n \"policy-not-found\",\n \"policy-not-satisfied\",\n \"policy-revoked\",\n \"policy-status-rollback\",\n \"rate-limited\",\n] as const;\n\nexport type PolicyEngineGrantPresentationDenialCode =\n (typeof POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES)[number];\n\nexport type TranscriptRequesterErrorCode =\n | \"requester-bootstrap-malformed\"\n | \"requester-bootstrap-unknown-key\"\n | \"requester-engine-record-signature-invalid\"\n | \"requester-engine-record-owner-mismatch\"\n | \"requester-engine-record-audience-mismatch\"\n | \"requester-engine-record-endpoint-mismatch\"\n | \"requester-engine-record-invalid\"\n | \"requester-policy-engine-endpoint-invalid\"\n | \"requester-engine-unreachable\"\n | \"requester-engine-response-invalid\"\n | \"requester-renewal-required\"\n | \"requester-challenge-reused\"\n | \"requester-presentation-invalid\"\n | \"requester-delegation-invalid\"\n | \"requester-delegation-wrong-holder\"\n | \"requester-delegation-not-refresh-only\"\n | \"requester-delegation-ttl-excessive\"\n | \"requester-delegation-capability-wider\"\n | \"requester-owner-node-endpoint-invalid\"\n | \"requester-delegation-import-failed\"\n | \"requester-invocation-signer-required\"\n | \"requester-invocation-signer-mismatch\"\n | \"requester-node-denied\"\n | \"requester-node-unreachable\"\n | \"requester-node-response-invalid\"\n | \"requester-access-not-contained\"\n | \"requester-access-denied\"\n | \"requester-access-unreachable\"\n | \"requester-access-ended\"\n | `policy-engine-denied-${PolicyEngineGrantPresentationDenialCode}`;\n\nexport type TranscriptRequesterErrorState =\n | \"bootstrap-invalid\"\n | \"denied\"\n | \"unreachable\"\n | \"renewal-required\"\n | \"access-ended\"\n | \"invalid\"\n | \"not-contained\";\n\nexport class TranscriptRequesterError extends Error {\n public readonly code: TranscriptRequesterErrorCode;\n public readonly state: TranscriptRequesterErrorState;\n public readonly denialCode?: PolicyEngineGrantPresentationDenialCode;\n public readonly status?: number;\n\n constructor(\n code: TranscriptRequesterErrorCode,\n message: string,\n state: TranscriptRequesterErrorState = \"invalid\",\n denialCode?: PolicyEngineGrantPresentationDenialCode,\n status?: number,\n ) {\n super(message);\n this.name = \"TranscriptRequesterError\";\n this.code = code;\n this.state = state;\n this.denialCode = denialCode;\n this.status = status;\n }\n}\n\nexport interface RequesterHttpRequest {\n readonly method: \"POST\" | \"GET\";\n readonly url: string;\n readonly headers?: Readonly<Record<string, string>>;\n readonly body?: unknown;\n /** Endpoint requests must not follow redirects. */\n readonly redirect?: \"error\";\n /** Transport must connect only to one of these pre-resolved public addresses. */\n readonly allowedResolvedAddresses?: readonly string[];\n}\n\nexport interface RequesterHttpResponse {\n readonly status: number;\n readonly body: unknown;\n /** Required for policy-engine and owner-node requests; reports the non-redirected final URL. */\n readonly finalUrl?: string;\n /** Required for policy-engine and owner-node requests; reports the actual connected IP. */\n readonly resolvedAddress?: string;\n}\n\nexport interface RequesterEndpointResolution {\n readonly addresses: readonly string[];\n}\n\nexport interface RequesterTransport {\n request(request: RequesterHttpRequest): Promise<RequesterHttpResponse>;\n /** Resolve before egress so the requester can pin public addresses and detect rebinding. */\n resolveEndpoint?(endpoint: string): Promise<RequesterEndpointResolution>;\n}\n\nexport interface RequesterInvocationCapability {\n readonly holderDid: string;\n readonly verificationMethod: string;\n readonly jwk: object;\n readonly invoke: InvokeFunction;\n readonly invokeAny?: InvokeAnyFunction;\n}\n\nexport interface HolderKeyBindingPresentation {\n readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n readonly policyId: string;\n readonly eligibleSubjectDid: string;\n readonly holderDid: string;\n readonly holderBinding: unknown;\n readonly requestedCapabilities: readonly PolicyCapability[];\n readonly requestedCapabilitiesHash: string;\n readonly audience: string;\n readonly nonce: string;\n readonly expiresAt: string;\n readonly evidence?: readonly unknown[];\n readonly holderSignature: {\n readonly suite: string;\n readonly signerDid: string;\n readonly value: string;\n };\n}\n\nexport interface RequesterSigningCapability {\n readonly holderDid: string;\n readonly keyId: string;\n readonly suite?: string;\n readonly holderBinding?: unknown;\n readonly eligibleSubjectDid?: string;\n readonly evidence?: readonly unknown[];\n signGrantPresentation?(input: {\n readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n readonly policyId: string;\n readonly eligibleSubjectDid: string;\n readonly holderDid: string;\n readonly holderBinding: unknown;\n readonly requestedCapabilities: readonly PolicyCapability[];\n readonly requestedCapabilitiesHash: string;\n readonly audience: string;\n readonly nonce: string;\n readonly expiresAt: string;\n readonly evidence?: readonly unknown[];\n }): Promise<string> | string;\n signKeyBinding(input: {\n readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n readonly policyId?: string;\n readonly eligibleSubjectDid?: string;\n readonly holderDid: string;\n readonly holderBinding?: unknown;\n readonly requestedCapabilities?: readonly PolicyCapability[];\n readonly requestedCapabilitiesHash?: string;\n readonly audience: string;\n readonly nonce: string;\n readonly challengeId: string;\n readonly issuedAt: string;\n readonly keyId: string;\n }): Promise<string> | string;\n}\n\nexport interface PortableDelegation {\n readonly schema?: typeof PORTABLE_DELEGATION_SCHEMA;\n readonly delegationId: string;\n readonly policyId: string;\n readonly issuerDid: string;\n readonly holderDid: string;\n readonly audience?: string;\n readonly issuedAt: string;\n readonly expiresAt: string;\n readonly terminal: boolean;\n readonly maxTtlSeconds: number;\n readonly capabilities: readonly PolicyCapability[];\n readonly encoded?: string;\n}\n\nexport interface TranscriptRequesterOptions {\n readonly bootstrap: unknown;\n readonly requesterDid: string;\n readonly ownerDid: string;\n readonly audience: string;\n readonly grantIssuerDid: string;\n /** Owner-node binding from trusted TinyCloud discovery/config, never copied from bootstrap. */\n readonly trustedOwnerNode: {\n readonly endpoint: string;\n readonly spaceId: string;\n };\n readonly transport: RequesterTransport;\n readonly signingCapability?: RequesterSigningCapability;\n readonly invocationCapability?: RequesterInvocationCapability;\n readonly eligibleSubjectDid?: string;\n readonly holderBinding?: unknown;\n readonly evidence?: readonly unknown[];\n readonly presentationTtlSeconds?: number;\n readonly now?: () => Date;\n readonly sleep?: (milliseconds: number) => Promise<void>;\n readonly random?: () => number;\n readonly engineRetryAttempts?: number;\n}\n\nexport interface TranscriptRequesterReadSqlResult {\n readonly rows: readonly unknown[];\n}\n\nexport interface TranscriptRequesterReadKvResult {\n readonly value: unknown;\n}\n\nconst JsonValueSchema: z.ZodType<unknown> = z.lazy(() =>\n z.union([\n z.string(),\n z.number().finite(),\n z.boolean(),\n z.null(),\n z.array(JsonValueSchema),\n z.record(JsonValueSchema),\n ]),\n);\n\nconst Rfc3339Schema = z\n .string()\n .refine((value) => parseStrictRfc3339(value) !== undefined, {\n message: \"must be strict RFC 3339 date-time with timezone\",\n });\n\nconst SignedRecordSchema = z\n .object({\n schema: z.string(),\n engineRecordId: z.string(),\n ownerDid: z.string(),\n endpoint: z.string(),\n audience: z.string(),\n supportedPolicyVersions: z.array(z.string()),\n supportedEvidenceVerifiers: z.array(z.string()),\n grantIssuerDid: z.string(),\n expiresAt: Rfc3339Schema,\n signature: z\n .object({\n suite: z.string(),\n signerDid: z.string(),\n value: z.string(),\n })\n .strict(),\n })\n .strict();\n\nconst PolicyEngineSchema = z\n .object({\n endpoint: z.string().url(),\n audience: z.string(),\n supportedEvidenceVerifiers: z.tuple([\n z.literal(W3C_VC_CREDENTIAL_VERIFIER),\n ]),\n signedRecord: SignedRecordSchema,\n })\n .strict();\n\nconst OwnerNodeSchema = z\n .object({\n schema: z.literal(OWNER_NODE_ENDPOINT_SCHEMA),\n endpoint: z.string().url(),\n spaceId: z.string().min(1),\n })\n .strict();\n\nconst ResourceHintSchema = z\n .object({\n resourceType: z.string(),\n resourceId: z.string(),\n requestedCapabilities: z.array(JsonValueSchema).min(1),\n })\n .strict();\n\nconst BootstrapSchema = z\n .object({\n schema: z.literal(TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA),\n policyId: z.string(),\n policyEngine: PolicyEngineSchema,\n ownerNode: OwnerNodeSchema,\n resourceHint: ResourceHintSchema,\n })\n .strict();\n\nconst SignatureSchema = z\n .object({\n suite: z.string(),\n signerDid: z.string(),\n value: z.string(),\n })\n .strict();\n\nconst ChallengeSchema = z\n .object({\n schema: z.literal(POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA),\n challengeId: z.string(),\n policyId: z.string(),\n audience: z.string(),\n nonce: z.string().min(16),\n challengeExpiresAt: Rfc3339Schema,\n acceptedSuites: z.array(z.string()).min(1),\n requestedCapabilitiesTemplate: z.array(JsonValueSchema).optional(),\n signature: SignatureSchema,\n })\n .strict();\n\nconst ChallengeResponseSchema = z\n .object({ challenge: ChallengeSchema })\n .strict();\n\nconst DenialSchema = z\n .object({\n schema: z.literal(POLICY_ENGINE_DENIAL_SCHEMA),\n code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n message: z.string().optional(),\n })\n .strict();\n\nconst ErrorEnvelopeDenialSchema = z\n .object({\n error: z\n .object({\n code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n message: z.string().optional(),\n })\n .strict(),\n })\n .strict();\n\nconst WireDelegationSchema = z\n .object({\n delegationId: z.string(),\n issuanceId: z.string().min(1),\n issuerDid: z.string(),\n holderDid: z.string(),\n policyId: z.string(),\n capabilityHashHex: z.string().regex(/^[0-9a-f]{64}$/),\n revocationMode: z.literal(\"refresh_only\"),\n issuedAt: Rfc3339Schema,\n expiresAt: Rfc3339Schema,\n terminal: z.boolean(),\n encoded: z.string(),\n })\n .strict();\n\nconst ResolveResponseSchema = z\n .object({ delegation: WireDelegationSchema })\n .strict();\nconst DelegateReceiptSchema = z\n .object({\n cid: z.string().min(1),\n activated: z.array(z.string()),\n skipped: z.array(z.string()),\n })\n .strict();\n\nconst SqlReadResponseSchema = z\n .object({ rows: z.array(JsonValueSchema) })\n .strict();\nconst KvReadResponseSchema = z.object({ value: JsonValueSchema }).strict();\n\nexport const LISTEN_SQL_STATEMENT_CATALOG = [\n {\n name: \"listen.getConversation\",\n sql: \"SELECT id, title, source, source_id, source_url, started_at, ended_at, duration_secs, summary, metadata, transcript_json, transcript_text, created_at, updated_at FROM conversation WHERE id = ?\",\n fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n },\n {\n name: \"listen.listParticipants\",\n sql: \"SELECT id, name, email, speaker_label FROM participant WHERE conversation_id = ? ORDER BY COALESCE(speaker_label, name), id\",\n fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n },\n] as const;\n\nexport type ListenSqlStatementName =\n (typeof LISTEN_SQL_STATEMENT_CATALOG)[number][\"name\"];\ntype ListenSqlStatement = (typeof LISTEN_SQL_STATEMENT_CATALOG)[number];\ntype ResolvedListenSqlStatement = {\n readonly name: string;\n readonly sql: string;\n readonly fixedParams: readonly {\n readonly index: number;\n readonly value: unknown;\n }[];\n};\n\nexport function listenTranscriptScopedStatementName(\n statementName: ListenSqlStatementName,\n conversationId: string,\n): string {\n if (conversationId.length === 0) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"conversation ID must be non-empty for a scoped Listen SQL read\",\n \"not-contained\",\n );\n }\n return `${statementName}@${encodeURIComponent(conversationId)}`;\n}\ntype NormalizedWireDelegation = PortableDelegation & {\n readonly encoded: string;\n};\n\nconst LISTEN_SQL_STATEMENT_BY_NAME: ReadonlyMap<string, ListenSqlStatement> =\n new Map(\n LISTEN_SQL_STATEMENT_CATALOG.map((statement) => [\n statement.name,\n statement,\n ]),\n );\n\nexport class TranscriptRequester {\n private readonly bootstrap: TranscriptShareBootstrap;\n private readonly requesterDid: string;\n private readonly ownerDid: string;\n private readonly audience: string;\n private readonly grantIssuerDid: string;\n private readonly transport: RequesterTransport;\n private readonly signingCapability?: RequesterSigningCapability;\n private readonly invocationCapability?: RequesterInvocationCapability;\n private readonly policyEngineRecordExpiresAtMs: number;\n private readonly policyEngineAddresses: ReadonlySet<string>;\n private readonly ownerNodeAddresses: ReadonlySet<string>;\n private readonly now: () => Date;\n private readonly sleep: (milliseconds: number) => Promise<void>;\n private readonly random: () => number;\n private readonly engineRetryAttempts: number;\n private readonly requestedCapabilities: readonly PolicyCapability[];\n private readonly nativeAuthorityCeiling: readonly PolicyCapability[];\n private readonly requestedCapabilitiesHash: string;\n private readonly eligibleSubjectDid: string;\n private readonly holderBinding: unknown;\n private readonly evidence?: readonly unknown[];\n private readonly presentationTtlSeconds: number;\n private readonly usedChallengeNonces = new Set<string>();\n private importedDelegation?: PortableDelegation;\n private importedDelegationCid?: string;\n private accessEnded = false;\n\n private constructor(\n bootstrap: TranscriptShareBootstrap,\n requestedCapabilities: readonly PolicyCapability[],\n nativeAuthorityCeiling: readonly PolicyCapability[],\n requestedCapabilitiesHash: string,\n policyEngineRecordExpiresAtMs: number,\n policyEngineAddresses: ReadonlySet<string>,\n ownerNodeAddresses: ReadonlySet<string>,\n options: TranscriptRequesterOptions,\n ) {\n this.bootstrap = bootstrap;\n this.requestedCapabilities = requestedCapabilities;\n this.nativeAuthorityCeiling = nativeAuthorityCeiling;\n this.requestedCapabilitiesHash = requestedCapabilitiesHash;\n this.requesterDid = options.requesterDid;\n this.ownerDid = options.ownerDid;\n this.audience = options.audience;\n this.grantIssuerDid = options.grantIssuerDid;\n this.transport = options.transport;\n this.signingCapability = options.signingCapability;\n this.invocationCapability = options.invocationCapability;\n this.policyEngineRecordExpiresAtMs = policyEngineRecordExpiresAtMs;\n this.policyEngineAddresses = policyEngineAddresses;\n this.ownerNodeAddresses = ownerNodeAddresses;\n this.eligibleSubjectDid =\n options.eligibleSubjectDid ??\n options.signingCapability?.eligibleSubjectDid ??\n options.requesterDid;\n this.holderBinding = options.holderBinding ??\n options.signingCapability?.holderBinding ?? {\n type: \"enrolled-agent\",\n enrollment: {\n schema: \"xyz.tinycloud.policy/holder-enrollment/v0\",\n holderDid: options.requesterDid,\n },\n };\n this.evidence = options.evidence ?? options.signingCapability?.evidence;\n this.presentationTtlSeconds = Math.min(\n Math.max(options.presentationTtlSeconds ?? 60, 1),\n 300,\n );\n this.now = options.now ?? (() => new Date());\n this.sleep =\n options.sleep ??\n ((milliseconds) =>\n new Promise((resolve) => setTimeout(resolve, milliseconds)));\n this.random = options.random ?? Math.random;\n this.engineRetryAttempts =\n options.engineRetryAttempts ?? REQUESTER_ENGINE_RETRY_ATTEMPTS;\n }\n\n static async create(\n options: TranscriptRequesterOptions,\n ): Promise<TranscriptRequester> {\n const bootstrap = parseBootstrap(options.bootstrap);\n if (\n bootstrap.ownerNode.endpoint !== options.trustedOwnerNode.endpoint ||\n bootstrap.ownerNode.spaceId !== options.trustedOwnerNode.spaceId\n ) {\n throw endpointError(\n \"owner-node\",\n \"bootstrap owner-node binding does not match trusted discovery/config\",\n );\n }\n const record = await verifyRecordBeforeEgress(bootstrap, options);\n if (record.endpoint !== bootstrap.policyEngine.endpoint) {\n throw new TranscriptRequesterError(\n \"requester-engine-record-endpoint-mismatch\",\n \"policy engine record endpoint does not match bootstrap endpoint\",\n \"bootstrap-invalid\",\n );\n }\n if (record.audience !== bootstrap.policyEngine.audience) {\n throw new TranscriptRequesterError(\n \"requester-engine-record-audience-mismatch\",\n \"policy engine record audience does not match bootstrap audience\",\n \"bootstrap-invalid\",\n );\n }\n const policyEngineAddresses = await validateAndResolvePublicEndpoint(\n bootstrap.policyEngine.endpoint,\n options.transport,\n \"policy-engine\",\n );\n const ownerNodeAddresses = await validateAndResolveOwnerNode(\n bootstrap.ownerNode.endpoint,\n options.transport,\n );\n const requestedCapabilities =\n bootstrap.resourceHint.requestedCapabilities.map((capability, index) =>\n parsePolicyCapability(\n capability,\n `$.resourceHint.requestedCapabilities[${index}]`,\n ),\n );\n const nativeAuthorityCeiling = requestedCapabilities.map((capability) => ({\n ...capability,\n space: bootstrap.ownerNode.spaceId,\n }));\n return new TranscriptRequester(\n bootstrap,\n requestedCapabilities,\n nativeAuthorityCeiling,\n requestedCapabilitiesHash(requestedCapabilities),\n parseStrictRfc3339(record.expiresAt)!,\n policyEngineAddresses,\n ownerNodeAddresses,\n options,\n );\n }\n\n get accessState(): \"active\" | \"needs-renewal\" | \"access-ended\" {\n if (this.accessEnded) {\n return \"access-ended\";\n }\n if (this.importedDelegation === undefined) {\n return \"needs-renewal\";\n }\n if (this.requiresRenewal(this.importedDelegation)) {\n return \"needs-renewal\";\n }\n return \"active\";\n }\n\n async readSql(\n statementName: ListenSqlStatementName,\n conversationId?: string,\n ): Promise<TranscriptRequesterReadSqlResult> {\n try {\n const catalogStatement = listenSqlStatementFromCatalog(statementName);\n const selectedConversationId =\n conversationId ?? this.bootstrap.resourceHint.resourceId;\n const statement: ResolvedListenSqlStatement = {\n ...catalogStatement,\n name:\n conversationId === undefined\n ? catalogStatement.name\n : listenTranscriptScopedStatementName(\n statementName,\n conversationId,\n ),\n fixedParams: catalogStatement.fixedParams.map((item) => ({\n ...item,\n value:\n item.value === \"{conversationId}\"\n ? selectedConversationId\n : item.value,\n })),\n };\n const delegation = await this.ensureFreshDelegation();\n const requested = this.sqlAccessCapabilityForDelegation(\n delegation,\n statement,\n );\n this.assertContainedByDelegation(delegation, requested);\n const response = await this.nativeInvoke(\n \"sql\",\n requested.path,\n \"tinycloud.sql/read\",\n {\n action: \"executeStatement\",\n name: statement.name,\n // The native constrained-SQL route injects caveat-pinned values and\n // rejects callers that supply those indices. Uncaveated reads must\n // resolve the catalog placeholder themselves.\n params:\n requested.caveats === undefined\n ? statement.fixedParams.map((item) => item.value)\n : [],\n },\n requested.caveats,\n );\n return parseNodeDataResponse(\n response,\n SqlReadResponseSchema,\n \"SQL read\",\n ) as TranscriptRequesterReadSqlResult;\n } catch (error) {\n this.recordAccessEnded(error);\n throw error;\n }\n }\n\n async readKv(path: string): Promise<TranscriptRequesterReadKvResult> {\n try {\n const delegation = await this.ensureFreshDelegation();\n const grantedKv = delegation.capabilities.find(\n (capability) =>\n capability.service === \"tinycloud.kv\" &&\n capability.path === path &&\n capability.actions.includes(\"tinycloud.kv/get\"),\n );\n const requested = parsePolicyCapability(\n {\n service: \"tinycloud.kv\",\n space: grantedKv?.space ?? \"applications\",\n path,\n actions: [\"tinycloud.kv/get\"],\n },\n \"$.kvRead\",\n );\n this.assertContainedByDelegation(delegation, requested);\n const response = await this.nativeInvoke(\"kv\", path, \"tinycloud.kv/get\");\n return parseNodeDataResponse(\n response,\n KvReadResponseSchema,\n \"KV read\",\n ) as TranscriptRequesterReadKvResult;\n } catch (error) {\n this.recordAccessEnded(error);\n throw error;\n }\n }\n\n private async nativeInvoke(\n service: \"sql\" | \"kv\",\n path: string,\n action: \"tinycloud.sql/read\" | \"tinycloud.kv/get\",\n body?: unknown,\n caveats?: Record<string, unknown>,\n ): Promise<RequesterHttpResponse> {\n const capability = this.invocationCapability;\n if (capability === undefined) {\n throw new TranscriptRequesterError(\n \"requester-invocation-signer-required\",\n \"holder invocation capability is required for native reads\",\n );\n }\n if (\n capability.holderDid !== this.requesterDid ||\n capability.holderDid !== this.signingCapability?.holderDid\n ) {\n throw new TranscriptRequesterError(\n \"requester-invocation-signer-mismatch\",\n \"invocation signer must be the presentation key-binding holder\",\n );\n }\n if (\n this.importedDelegationCid === undefined ||\n this.importedDelegation === undefined\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n \"native read requires a confirmed delegation import\",\n );\n }\n const session: ServiceSession = {\n delegationHeader: { Authorization: this.importedDelegation.encoded! },\n delegationCid: this.importedDelegationCid,\n spaceId: this.bootstrap.ownerNode.spaceId,\n verificationMethod: capability.verificationMethod,\n jwk: capability.jwk,\n };\n let invocationHeaders: ServiceHeaders;\n if (caveats === undefined) {\n invocationHeaders = capability.invoke(session, service, path, action);\n } else {\n if (capability.invokeAny === undefined) {\n throw new TranscriptRequesterError(\n \"requester-invocation-signer-required\",\n \"holder invocation capability must support caveated native reads\",\n );\n }\n invocationHeaders = capability.invokeAny(session, [\n {\n spaceId: this.bootstrap.ownerNode.spaceId,\n service,\n path,\n action,\n caveats: [caveats],\n },\n ]);\n }\n const headers = headersRecord(invocationHeaders);\n const response = await this.transport.request({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/invoke`,\n headers,\n redirect: \"error\",\n allowedResolvedAddresses: [...this.ownerNodeAddresses],\n ...(body === undefined ? {} : { body }),\n });\n this.assertOwnerNodeResponse(response, \"/invoke\");\n return response;\n }\n\n private async ensureFreshDelegation(): Promise<PortableDelegation> {\n if (this.accessEnded) {\n throw new TranscriptRequesterError(\n \"requester-access-ended\",\n \"requester access has ended\",\n \"access-ended\",\n );\n }\n if (\n this.importedDelegation !== undefined &&\n !this.requiresRenewal(this.importedDelegation)\n ) {\n return this.importedDelegation;\n }\n if (\n this.signingCapability === undefined ||\n this.signingCapability.holderDid !== this.requesterDid\n ) {\n throw new TranscriptRequesterError(\n \"requester-renewal-required\",\n \"a permitted requester signing capability is required for access-triggered renewal\",\n \"renewal-required\",\n );\n }\n try {\n let lastError: unknown;\n const attempts = Math.max(1, this.engineRetryAttempts);\n for (let attempt = 0; attempt < attempts; attempt++) {\n const challenge = await this.obtainChallenge();\n const presentation = await this.mintPresentation(challenge);\n try {\n const delegation = await this.resolveOnce(challenge, presentation);\n this.importedDelegation = delegation;\n return delegation;\n } catch (error) {\n if (\n !(error instanceof TranscriptRequesterError) ||\n error.state !== \"unreachable\"\n ) {\n throw error;\n }\n lastError = error;\n }\n if (attempt + 1 < attempts) {\n await this.sleep(retryDelay(attempt, this.random()));\n }\n }\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n lastError instanceof Error\n ? lastError.message\n : \"policy engine unreachable\",\n \"unreachable\",\n );\n } catch (error) {\n this.recordAccessEnded(error);\n throw error;\n }\n }\n\n private recordAccessEnded(error: unknown): void {\n if (\n error instanceof TranscriptRequesterError &&\n error.state === \"access-ended\"\n ) {\n this.accessEnded = true;\n }\n }\n\n private async obtainChallenge(): Promise<z.infer<typeof ChallengeSchema>> {\n this.assertPolicyEngineRecordCurrent();\n const response = await this.challengeRequestWithRetry({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/challenge`,\n redirect: \"error\",\n allowedResolvedAddresses: [...this.policyEngineAddresses],\n body: {\n policyId: this.bootstrap.policyId,\n },\n });\n return parseEngineSuccess(\n response.body,\n ChallengeResponseSchema,\n \"challenge response\",\n ).challenge;\n }\n\n private async mintPresentation(\n challenge: z.infer<typeof ChallengeSchema>,\n ): Promise<HolderKeyBindingPresentation> {\n if (\n challenge.policyId !== this.bootstrap.policyId ||\n challenge.audience !== this.bootstrap.policyEngine.audience ||\n challenge.audience !== this.audience\n ) {\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n \"challenge response binding does not match requester context\",\n );\n }\n if (this.usedChallengeNonces.has(challenge.nonce)) {\n throw new TranscriptRequesterError(\n \"requester-challenge-reused\",\n \"challenge nonce was already used by this requester\",\n );\n }\n this.usedChallengeNonces.add(challenge.nonce);\n const expiresAt = new Date(\n this.now().getTime() + this.presentationTtlSeconds * 1000,\n )\n .toISOString()\n .replace(\".000Z\", \"Z\");\n const input = {\n schema: HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,\n policyId: this.bootstrap.policyId,\n eligibleSubjectDid: this.eligibleSubjectDid,\n holderDid: this.requesterDid,\n holderBinding: this.holderBinding,\n requestedCapabilities: this.requestedCapabilities,\n requestedCapabilitiesHash: this.requestedCapabilitiesHash,\n audience: this.audience,\n nonce: challenge.nonce,\n expiresAt,\n ...(this.evidence === undefined ? {} : { evidence: this.evidence }),\n } as const;\n const signature =\n this.signingCapability!.signGrantPresentation === undefined\n ? await this.signingCapability!.signKeyBinding({\n ...input,\n challengeId: challenge.challengeId,\n issuedAt: expiresAt,\n keyId: this.signingCapability!.keyId,\n })\n : await this.signingCapability!.signGrantPresentation(input);\n if (typeof signature !== \"string\" || signature.length === 0) {\n throw new TranscriptRequesterError(\n \"requester-presentation-invalid\",\n \"signing capability returned an invalid holder key-binding signature\",\n );\n }\n return {\n ...input,\n holderSignature: {\n suite: this.signingCapability!.suite ?? challenge.acceptedSuites[0]!,\n signerDid: this.requesterDid,\n value: signature,\n },\n };\n }\n\n private async resolveOnce(\n challenge: z.infer<typeof ChallengeSchema>,\n presentation: HolderKeyBindingPresentation,\n ): Promise<PortableDelegation> {\n void challenge;\n this.assertPolicyEngineRecordCurrent();\n const response = await this.resolveRequestOnce({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/resolve`,\n redirect: \"error\",\n allowedResolvedAddresses: [...this.policyEngineAddresses],\n body: { presentation },\n });\n const parsed = parseEngineSuccess(\n response.body,\n ResolveResponseSchema,\n \"resolve response\",\n );\n return this.importPortableDelegation(parsed.delegation);\n }\n\n private async importPortableDelegation(\n input: unknown,\n ): Promise<PortableDelegation> {\n const parsed = parseNodeNativePortableDelegation(input);\n if (parsed.policyId !== this.bootstrap.policyId) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n \"portable delegation policy id does not match bootstrap\",\n );\n }\n if (parsed.holderDid !== this.requesterDid) {\n throw new TranscriptRequesterError(\n \"requester-delegation-wrong-holder\",\n \"portable delegation is not targeted at the requester DID\",\n );\n }\n if (parsed.issuerDid !== this.grantIssuerDid) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n \"portable delegation issuer does not match the verified grant issuer DID\",\n );\n }\n if (parsed.maxTtlSeconds > 300) {\n throw new TranscriptRequesterError(\n \"requester-delegation-ttl-excessive\",\n \"portable delegation TTL exceeds 300 seconds\",\n );\n }\n const issuedAt = parseStrictRfc3339(parsed.issuedAt)!;\n const expiresAt = parseStrictRfc3339(parsed.expiresAt)!;\n if (\n expiresAt <= issuedAt ||\n expiresAt - issuedAt > parsed.maxTtlSeconds * 1000\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-ttl-excessive\",\n \"portable delegation expires outside its maxTtlSeconds bound\",\n );\n }\n const capabilities = parsed.capabilities.map((capability, index) =>\n parsePolicyCapability(capability, `$.delegation.capabilities[${index}]`),\n );\n for (const granted of capabilities) {\n if (\n !this.nativeAuthorityCeiling.some((requested) =>\n policyCapabilityContains(requested, granted),\n )\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-capability-wider\",\n \"portable delegation grants a capability outside the bootstrap requested set\",\n );\n }\n }\n if (\n typeof parsed.encoded !== \"string\" ||\n parsed.encoded.split(\".\").length !== 3\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n \"portable delegation is not a compact-JWS UCAN\",\n );\n }\n const delegation = { ...parsed, capabilities } as PortableDelegation;\n const response = await this.transport.request({\n method: \"POST\",\n url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/delegate`,\n headers: { Authorization: parsed.encoded },\n redirect: \"error\",\n allowedResolvedAddresses: [...this.ownerNodeAddresses],\n });\n this.assertOwnerNodeResponse(response, \"/delegate\");\n const receipt = parseDelegateReceipt(response);\n const target = this.bootstrap.ownerNode.spaceId;\n if (\n !receipt.activated.includes(target) ||\n receipt.skipped.includes(target)\n ) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n receipt.activated.includes(target) && receipt.skipped.includes(target)\n ? \"owner node returned a contradictory delegation receipt\"\n : \"owner node did not activate the target owner space\",\n );\n }\n this.importedDelegationCid = deriveDelegationCid(parsed.encoded);\n return delegation;\n }\n\n private assertOwnerNodeResponse(\n response: RequesterHttpResponse,\n path: string,\n ): void {\n this.assertEndpointResponse(\n response,\n this.bootstrap.ownerNode.endpoint,\n path,\n this.ownerNodeAddresses,\n \"owner-node\",\n );\n }\n\n private assertPolicyEngineRecordCurrent(): void {\n if (this.policyEngineRecordExpiresAtMs <= this.now().getTime()) {\n throw new TranscriptRequesterError(\n \"requester-engine-record-invalid\",\n \"verified policy engine record has expired\",\n \"bootstrap-invalid\",\n );\n }\n }\n\n private assertPolicyEngineResponse(\n response: RequesterHttpResponse,\n path: string,\n ): void {\n this.assertEndpointResponse(\n response,\n this.bootstrap.policyEngine.endpoint,\n path,\n this.policyEngineAddresses,\n \"policy-engine\",\n );\n }\n\n private assertEndpointResponse(\n response: RequesterHttpResponse,\n endpoint: string,\n path: string,\n allowedAddresses: ReadonlySet<string>,\n kind: \"owner-node\" | \"policy-engine\",\n ): void {\n const expected = `${trimTrailingSlash(endpoint)}${path}`;\n const error = (message: string) => endpointError(kind, message);\n if (\n response.finalUrl !== expected ||\n response.resolvedAddress === undefined\n ) {\n throw error(\n `${kind} transport metadata is missing or indicates a redirect`,\n );\n }\n if (!allowedAddresses.has(normalizeIp(response.resolvedAddress))) {\n throw error(`${kind} address changed after endpoint validation`);\n }\n }\n\n private assertContainedByDelegation(\n delegation: PortableDelegation,\n requested: PolicyCapability,\n ): void {\n if (this.requiresRenewal(delegation)) {\n throw new TranscriptRequesterError(\n \"requester-renewal-required\",\n \"delegation requires renewal before access\",\n \"renewal-required\",\n );\n }\n if (\n !delegation.capabilities.some((granted) =>\n policyCapabilityContains(granted, requested),\n )\n ) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"requested access is outside the imported delegation capabilities\",\n \"not-contained\",\n );\n }\n }\n\n private sqlAccessCapabilityForDelegation(\n delegation: PortableDelegation,\n statement: ResolvedListenSqlStatement,\n ): PolicyCapability {\n const grantedSql = delegation.capabilities.find(\n (capability) =>\n capability.service === \"tinycloud.sql\" &&\n capability.actions.includes(\"tinycloud.sql/read\"),\n );\n if (grantedSql === undefined) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"delegation has no SQL read grant\",\n \"not-contained\",\n );\n }\n if (grantedSql.caveats !== undefined) {\n const statements = (\n grantedSql.caveats as {\n statements?: readonly {\n name?: unknown;\n sql?: unknown;\n fixedParams?: unknown;\n }[];\n }\n ).statements;\n const matchesCatalogSelection = statements?.some(\n (candidate) =>\n candidate.name === statement.name &&\n candidate.sql === statement.sql &&\n Array.isArray(candidate.fixedParams) &&\n jcsCanonicalize(candidate.fixedParams) ===\n jcsCanonicalize(statement.fixedParams),\n );\n if (!matchesCatalogSelection) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"SQL statement is outside the delegated catalog-derived statement caveat\",\n \"not-contained\",\n );\n }\n return grantedSql;\n }\n return parsePolicyCapability(\n {\n service: \"tinycloud.sql\",\n space: grantedSql.space,\n path: grantedSql.path,\n actions: [\"tinycloud.sql/read\"],\n },\n \"$.sqlRead\",\n );\n }\n\n private requiresRenewal(delegation: PortableDelegation): boolean {\n const expiresAt = parseStrictRfc3339(delegation.expiresAt)!;\n return (\n expiresAt - this.now().getTime() <= REQUESTER_NEAR_EXPIRY_SECONDS * 1000\n );\n }\n\n private async challengeRequestWithRetry(\n request: RequesterHttpRequest,\n ): Promise<RequesterHttpResponse> {\n let lastError: unknown;\n const attempts = Math.max(1, this.engineRetryAttempts);\n for (let attempt = 0; attempt < attempts; attempt++) {\n try {\n const response = await this.transport.request(request);\n this.assertPolicyEngineResponse(response, \"/policy/v0/challenge\");\n if (response.status >= 500) {\n lastError = new Error(`engine returned ${response.status}`);\n } else if (response.status >= 400) {\n const denial = parseDenialBody(response.body);\n if (denial !== undefined) {\n throw errorForDenial(denial, response.status);\n }\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n \"policy engine returned an invalid denial body\",\n );\n } else {\n return response;\n }\n } catch (error) {\n if (\n error instanceof TranscriptRequesterError &&\n error.state !== \"unreachable\"\n ) {\n throw error;\n }\n lastError = error;\n }\n if (attempt + 1 < attempts) {\n await this.sleep(retryDelay(attempt, this.random()));\n }\n }\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n lastError instanceof Error\n ? lastError.message\n : \"policy engine unreachable\",\n \"unreachable\",\n );\n }\n\n private async resolveRequestOnce(\n request: RequesterHttpRequest,\n ): Promise<RequesterHttpResponse> {\n try {\n const response = await this.transport.request(request);\n this.assertPolicyEngineResponse(response, \"/policy/v0/resolve\");\n if (response.status >= 500) {\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n `engine returned ${response.status}`,\n \"unreachable\",\n );\n }\n if (response.status >= 400) {\n const denial = parseDenialBody(response.body);\n if (denial !== undefined) {\n throw errorForDenial(denial, response.status);\n }\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n \"policy engine returned an invalid denial body\",\n );\n }\n return response;\n } catch (error) {\n if (error instanceof TranscriptRequesterError) {\n throw error;\n }\n throw new TranscriptRequesterError(\n \"requester-engine-unreachable\",\n error instanceof Error ? error.message : \"policy engine unreachable\",\n \"unreachable\",\n );\n }\n }\n}\n\nexport async function createTranscriptRequester(\n options: TranscriptRequesterOptions,\n): Promise<TranscriptRequester> {\n return TranscriptRequester.create(options);\n}\n\nfunction parseBootstrap(input: unknown): TranscriptShareBootstrap & {\n readonly resourceHint: { readonly requestedCapabilities: readonly unknown[] };\n} {\n const normalized = normalizeExternal(input, \"requester-bootstrap-malformed\");\n const parsed = BootstrapSchema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n parsed.error.issues.some((issue) => issue.code === \"unrecognized_keys\")\n ? \"requester-bootstrap-unknown-key\"\n : \"requester-bootstrap-malformed\",\n parsed.error.message,\n \"bootstrap-invalid\",\n );\n }\n return parsed.data as TranscriptShareBootstrap & {\n readonly resourceHint: {\n readonly requestedCapabilities: readonly unknown[];\n };\n };\n}\n\nasync function verifyRecordBeforeEgress(\n bootstrap: TranscriptShareBootstrap,\n options: TranscriptRequesterOptions,\n) {\n try {\n return await verifyPolicyEngineRecordForRequester({\n signedRecord: bootstrap.policyEngine.signedRecord,\n ownerDid: options.ownerDid,\n audience: options.audience,\n grantIssuerDid: options.grantIssuerDid,\n now: (options.now ?? (() => new Date()))()\n .toISOString()\n .replace(\".000Z\", \"Z\"),\n requiredPolicyVersion: POLICY_VERSION_V0,\n requiredEvidenceVerifier: W3C_VC_CREDENTIAL_VERIFIER,\n });\n } catch (error) {\n const code = errorCodeForRecordFailure(error);\n throw new TranscriptRequesterError(\n code,\n error instanceof Error ? error.message : String(error),\n \"bootstrap-invalid\",\n );\n }\n}\n\nfunction errorCodeForRecordFailure(\n error: unknown,\n): TranscriptRequesterErrorCode {\n const code =\n typeof error === \"object\" && error !== null && \"code\" in error\n ? (error as { code?: unknown }).code\n : undefined;\n if (code === \"policy-engine-record-signature-invalid\") {\n return \"requester-engine-record-signature-invalid\";\n }\n if (code === \"policy-engine-record-owner-mismatch\") {\n return \"requester-engine-record-owner-mismatch\";\n }\n if (code === \"policy-engine-record-audience-mismatch\") {\n return \"requester-engine-record-audience-mismatch\";\n }\n return \"requester-engine-record-invalid\";\n}\n\nfunction parsePolicyCapability(input: unknown, path: string): PolicyCapability {\n try {\n return normalizePolicyCapabilityForRequester(\n input,\n ) as unknown as PolicyCapability;\n } catch (error) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n `${path}: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n}\n\nfunction listenSqlStatementFromCatalog(\n statementName: unknown,\n): ListenSqlStatement {\n if (typeof statementName !== \"string\") {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"SQL statement name must be a string from the canonical Listen statement catalog\",\n \"not-contained\",\n );\n }\n const statement = LISTEN_SQL_STATEMENT_BY_NAME.get(statementName);\n if (statement === undefined) {\n throw new TranscriptRequesterError(\n \"requester-access-not-contained\",\n \"SQL statement is not in the canonical Listen statement catalog\",\n \"not-contained\",\n );\n }\n return statement;\n}\n\nfunction normalizePolicyCapabilityForRequester(\n input: unknown,\n): PolicyCapability {\n const normalized = normalizeExternal(input, \"requester-delegation-invalid\");\n return normalizePolicyCapability(normalized);\n}\n\nfunction requestedCapabilitiesHash(\n capabilities: readonly PolicyCapability[],\n): string {\n const canonical = [...capabilities].sort((left, right) =>\n `${left.service}\\0${left.space}\\0${left.path}`.localeCompare(\n `${right.service}\\0${right.space}\\0${right.path}`,\n ),\n );\n const encoder = new TextEncoder();\n const domain = encoder.encode(\n \"xyz.tinycloud.policy/RequestedCapabilities/v0\\0\",\n );\n const body = encoder.encode(jcsCanonicalize(canonical));\n const bytes = new Uint8Array(domain.length + body.length);\n bytes.set(domain, 0);\n bytes.set(body, domain.length);\n return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nfunction normalizeWireDelegation(\n delegation: z.infer<typeof WireDelegationSchema>,\n): NormalizedWireDelegation {\n const signed = delegationAuthorityFromCompactJws(delegation.encoded);\n const invalid = (field: string): never => {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n `portable delegation ${field} does not match its signed compact-JWS authority`,\n );\n };\n if (delegation.delegationId !== deriveDelegationCid(delegation.encoded))\n invalid(\"delegationId\");\n if (delegation.issuerDid !== signed.issuerDid) invalid(\"issuerDid\");\n if (delegation.holderDid !== signed.holderDid) invalid(\"holderDid\");\n if (delegation.policyId !== signed.policyId) invalid(\"policyId\");\n if (Date.parse(delegation.issuedAt) !== signed.issuedAtMs)\n invalid(\"issuedAt\");\n if (Date.parse(delegation.expiresAt) !== signed.expiresAtMs)\n invalid(\"expiresAt\");\n if (delegation.terminal !== signed.terminal) invalid(\"terminal\");\n if (delegation.issuanceId !== signed.issuanceId) invalid(\"issuanceId\");\n if (delegation.capabilityHashHex !== signed.capabilityHashHex)\n invalid(\"capabilityHashHex\");\n if (delegation.revocationMode !== signed.revocationMode)\n invalid(\"revocationMode\");\n return {\n delegationId: deriveDelegationCid(delegation.encoded),\n issuerDid: signed.issuerDid,\n holderDid: signed.holderDid,\n policyId: signed.policyId,\n issuedAt: new Date(signed.issuedAtMs).toISOString().replace(\".000Z\", \"Z\"),\n expiresAt: new Date(signed.expiresAtMs).toISOString().replace(\".000Z\", \"Z\"),\n terminal: signed.terminal,\n maxTtlSeconds: Math.ceil((signed.expiresAtMs - signed.issuedAtMs) / 1000),\n capabilities: signed.capabilities,\n encoded: delegation.encoded,\n };\n}\n\n/**\n * Parse a frozen policy-engine delegation response and derive its authority\n * exclusively from the signed compact-JWS payload. This performs no egress or\n * node import and is suitable for constrained runners that cannot honestly\n * satisfy the public-endpoint transport profile.\n */\nexport function parseNodeNativePortableDelegation(\n input: unknown,\n): PortableDelegation {\n return normalizeWireDelegation(\n parseEngineSuccess(input, WireDelegationSchema, \"portable delegation\"),\n );\n}\n\nfunction delegationAuthorityFromCompactJws(encoded: string): {\n issuerDid: string;\n holderDid: string;\n policyId: string;\n issuanceId: string;\n capabilityHashHex: string;\n revocationMode: \"refresh_only\";\n issuedAtMs: number;\n expiresAtMs: number;\n terminal: boolean;\n capabilities: PolicyCapability[];\n} {\n try {\n const parts = encoded.split(\".\");\n if (parts.length !== 3) throw new Error(\"not compact JWS\");\n const payload = normalizeJson(\n JSON.parse(new TextDecoder().decode(base64UrlBytes(parts[1]!))),\n ) as Record<string, unknown>;\n const issuer = requiredPayloadString(payload, \"iss\");\n const holderDid = requiredPayloadString(payload, \"aud\");\n const issuedAt = requiredPayloadEpoch(payload, \"nbf\");\n const expiresAt = requiredPayloadEpoch(payload, \"exp\");\n const facts = payload.fct;\n if (!Array.isArray(facts)) throw new Error(\"UCAN fct is absent\");\n const authorityFacts = facts.filter(\n (fact) =>\n fact !== null &&\n typeof fact === \"object\" &&\n !Array.isArray(fact) &&\n \"xyz.tinycloud.policy/policyId\" in fact,\n ) as Record<string, unknown>[];\n if (authorityFacts.length !== 1)\n throw new Error(\"UCAN policy authority fact is not unique\");\n const fact = authorityFacts[0]!;\n const policyId = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/policyId\",\n );\n const issuanceId = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/issuanceId\",\n );\n const capabilityHashHex = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/capabilityHashHex\",\n );\n if (!/^[0-9a-f]{64}$/.test(capabilityHashHex)) {\n throw new Error(\n \"UCAN capability hash is not 64 lowercase hex characters\",\n );\n }\n const revocationMode = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/revocationMode\",\n );\n const delegationMode = requiredPayloadString(\n fact,\n \"xyz.tinycloud.policy/delegationMode\",\n );\n if (revocationMode !== \"refresh_only\")\n throw new Error(\"unsupported UCAN revocation mode\");\n if (delegationMode !== \"terminal\")\n throw new Error(\"UCAN delegation is not terminal\");\n const att = payload.att;\n if (att === null || typeof att !== \"object\" || Array.isArray(att)) {\n throw new Error(\"UCAN att is absent\");\n }\n const capabilities: PolicyCapability[] = [];\n for (const [resource, rawAbilities] of Object.entries(att)) {\n if (\n rawAbilities === null ||\n typeof rawAbilities !== \"object\" ||\n Array.isArray(rawAbilities)\n ) {\n throw new Error(\"UCAN att abilities are invalid\");\n }\n const abilities = rawAbilities as Record<string, unknown>;\n const marker = resource.indexOf(\"/sql/\");\n if (!resource.startsWith(\"tinycloud:\") || marker < 0)\n throw new Error(\"unsupported UCAN resource\");\n const space = resource.slice(0, marker);\n const path = resource.slice(marker + \"/sql/\".length);\n for (const [action, rawCaveats] of Object.entries(abilities)) {\n const service = action.startsWith(\"tinycloud.sql/\")\n ? \"tinycloud.sql\"\n : action.startsWith(\"tinycloud.kv/\")\n ? \"tinycloud.kv\"\n : undefined;\n if (!Array.isArray(rawCaveats) || rawCaveats.length !== 1) {\n throw new Error(\"UCAN ability must have exactly one caveat branch\");\n }\n const caveats = rawCaveats;\n if (service === undefined) throw new Error(\"unsupported UCAN ability\");\n const first = caveats[0];\n capabilities.push(\n normalizePolicyCapability({\n service,\n space,\n path,\n actions: [action],\n ...(first !== null &&\n typeof first === \"object\" &&\n !Array.isArray(first) &&\n Object.keys(first).length > 0\n ? { caveats: first }\n : {}),\n }),\n );\n }\n }\n if (capabilities.length === 0) throw new Error(\"UCAN att is empty\");\n const fragment = issuer.indexOf(\"#\");\n const issuerDid = fragment < 0 ? issuer : issuer.slice(0, fragment);\n if (!issuerDid.startsWith(\"did:\") || !holderDid.startsWith(\"did:\")) {\n throw new Error(\"UCAN issuer or audience is not a DID\");\n }\n return {\n issuerDid,\n holderDid,\n policyId,\n issuanceId,\n capabilityHashHex,\n revocationMode,\n issuedAtMs: issuedAt * 1000,\n expiresAtMs: expiresAt * 1000,\n terminal: true,\n capabilities,\n };\n } catch (error) {\n throw new TranscriptRequesterError(\n \"requester-delegation-invalid\",\n `node-native compact-JWS capabilities are invalid: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n}\n\nfunction requiredPayloadString(\n payload: Record<string, unknown>,\n key: string,\n): string {\n const value = payload[key];\n if (typeof value !== \"string\" || value.length === 0) {\n throw new Error(`UCAN ${key} is not a non-empty string`);\n }\n return value;\n}\n\nfunction requiredPayloadEpoch(\n payload: Record<string, unknown>,\n key: string,\n): number {\n const value = payload[key];\n if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n throw new Error(`UCAN ${key} is not a non-negative integer epoch`);\n }\n return value;\n}\n\nfunction base64UrlBytes(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\");\n const binary = atob(padded);\n return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction parseEngineSuccess<T>(\n input: unknown,\n schema: z.ZodType<T>,\n label: string,\n): T {\n const normalized = normalizeExternal(\n input,\n \"requester-engine-response-invalid\",\n );\n const denial = parseDenialBody(normalized);\n if (denial !== undefined) {\n throw errorForDenial(denial);\n }\n const parsed = schema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n `${label} failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction parseDataResponse<T>(\n response: RequesterHttpResponse,\n schema: z.ZodType<T>,\n label: string,\n): T {\n if (response.status >= 500) {\n throw new TranscriptRequesterError(\n \"requester-access-unreachable\",\n `${label} endpoint returned ${response.status}`,\n \"unreachable\",\n );\n }\n if (response.status >= 400) {\n const normalized = normalizeExternal(\n response.body,\n \"requester-access-denied\",\n );\n const denial = parseDenialBody(normalized);\n if (denial !== undefined) {\n throw errorForDenial(denial, response.status);\n }\n throw new TranscriptRequesterError(\n \"requester-access-denied\",\n `${label} denied`,\n \"denied\",\n );\n }\n const normalized = normalizeExternal(\n response.body,\n \"requester-engine-response-invalid\",\n );\n const parsed = schema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-engine-response-invalid\",\n `${label} response failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction parseDelegateReceipt(\n response: RequesterHttpResponse,\n): z.infer<typeof DelegateReceiptSchema> {\n if (response.status !== 200) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n `owner node delegation import returned ${response.status}`,\n response.status >= 500 ? \"invalid\" : \"denied\",\n undefined,\n response.status,\n );\n }\n const normalized = normalizeExternal(\n response.body,\n \"requester-delegation-import-failed\",\n );\n const parsed = DelegateReceiptSchema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-delegation-import-failed\",\n `owner node delegation receipt failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction parseNodeDataResponse<T>(\n response: RequesterHttpResponse,\n schema: z.ZodType<T>,\n label: string,\n): T {\n if (response.status >= 500) {\n throw new TranscriptRequesterError(\n \"requester-node-unreachable\",\n `${label} node returned ${response.status}: ${nodeErrorMessage(response.body)}`,\n \"unreachable\",\n undefined,\n response.status,\n );\n }\n if (response.status >= 400) {\n throw new TranscriptRequesterError(\n \"requester-node-denied\",\n `${label} node denied: ${nodeErrorMessage(response.body)}`,\n \"denied\",\n undefined,\n response.status,\n );\n }\n const normalized = normalizeExternal(\n response.body,\n \"requester-node-response-invalid\",\n );\n const parsed = schema.safeParse(normalized);\n if (!parsed.success) {\n throw new TranscriptRequesterError(\n \"requester-node-response-invalid\",\n `${label} node response failed validation: ${parsed.error.message}`,\n );\n }\n return parsed.data;\n}\n\nfunction nodeErrorMessage(body: unknown): string {\n if (typeof body === \"string\") return body;\n if (body !== null && typeof body === \"object\") {\n const record = body as Record<string, unknown>;\n const code = typeof record.code === \"string\" ? record.code : undefined;\n const message =\n typeof record.message === \"string\" ? record.message : undefined;\n if (code !== undefined)\n return message === undefined ? code : `${code}: ${message}`;\n }\n return \"native node refusal\";\n}\n\nexport function deriveDelegationCid(encoded: string): string {\n const digest = createDigest(0x1e, blake3(new TextEncoder().encode(encoded)));\n return CID.createV1(0x55, digest).toString();\n}\n\nfunction headersRecord(headers: ServiceHeaders): Record<string, string> {\n return Array.isArray(headers) ? Object.fromEntries(headers) : headers;\n}\n\nasync function validateAndResolveOwnerNode(\n endpoint: string,\n transport: RequesterTransport,\n): Promise<ReadonlySet<string>> {\n return validateAndResolvePublicEndpoint(endpoint, transport, \"owner-node\");\n}\n\nasync function validateAndResolvePublicEndpoint(\n endpoint: string,\n transport: RequesterTransport,\n kind: \"owner-node\" | \"policy-engine\",\n): Promise<ReadonlySet<string>> {\n let url: URL;\n try {\n url = new URL(endpoint);\n } catch {\n throw endpointError(kind, `${kind} endpoint is not a URL`);\n }\n if (\n url.protocol !== \"https:\" ||\n url.username !== \"\" ||\n url.password !== \"\" ||\n url.hash !== \"\" ||\n url.search !== \"\"\n ) {\n throw endpointError(\n kind,\n `${kind} endpoint must use HTTPS without credentials, query, or fragment`,\n );\n }\n if (transport.resolveEndpoint === undefined) {\n throw endpointError(\n kind,\n `${kind} endpoint resolution metadata is required`,\n );\n }\n let resolution: RequesterEndpointResolution;\n try {\n resolution = await transport.resolveEndpoint(url.origin);\n } catch (error) {\n throw endpointError(\n kind,\n `${kind} endpoint resolution failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n if (resolution.addresses.length === 0) {\n throw endpointError(kind, `${kind} endpoint resolved to no addresses`);\n }\n const addresses = new Set<string>();\n for (const address of resolution.addresses) {\n const normalized = normalizeIp(address);\n if (!isPublicIp(normalized)) {\n throw endpointError(\n kind,\n `${kind} endpoint resolved to a non-public address: ${address}`,\n );\n }\n addresses.add(normalized);\n }\n return addresses;\n}\n\nfunction endpointError(\n kind: \"owner-node\" | \"policy-engine\",\n message: string,\n): TranscriptRequesterError {\n return new TranscriptRequesterError(\n kind === \"owner-node\"\n ? \"requester-owner-node-endpoint-invalid\"\n : \"requester-policy-engine-endpoint-invalid\",\n message,\n \"bootstrap-invalid\",\n );\n}\n\nfunction normalizeIp(value: string): string {\n return value.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction isPublicIp(value: string): boolean {\n const ip = normalizeIp(value);\n const parts = ip.split(\".\");\n if (\n parts.length === 4 &&\n parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n ) {\n const [a, b] = parts.map(Number) as [number, number, number, number];\n return !(\n a === 0 ||\n a === 10 ||\n a === 127 ||\n (a === 100 && b >= 64 && b <= 127) ||\n (a === 169 && b === 254) ||\n (a === 172 && b >= 16 && b <= 31) ||\n (a === 192 && b === 0) ||\n (a === 192 && b === 168) ||\n (a === 198 && (b === 18 || b === 19)) ||\n (a === 198 && b === 51 && parts[2] === \"100\") ||\n (a === 203 && b === 0 && parts[2] === \"113\") ||\n a >= 224\n );\n }\n if (!ip.includes(\":\")) return false;\n if (\n ip === \"::\" ||\n ip === \"::1\" ||\n ip.startsWith(\"2001:db8:\") ||\n ip.startsWith(\"fe8\") ||\n ip.startsWith(\"fe9\") ||\n ip.startsWith(\"fea\") ||\n ip.startsWith(\"feb\") ||\n ip.startsWith(\"fc\") ||\n ip.startsWith(\"fd\") ||\n ip.startsWith(\"ff\")\n )\n return false;\n const mapped = ip.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n if (mapped !== null) return isPublicIp(mapped[1]!);\n const mappedHex = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n if (mappedHex !== null) {\n const high = Number.parseInt(mappedHex[1]!, 16);\n const low = Number.parseInt(mappedHex[2]!, 16);\n return isPublicIp(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);\n }\n return true;\n}\n\nfunction parseDenialBody(\n input: unknown,\n):\n | { code: PolicyEngineGrantPresentationDenialCode; message?: string }\n | undefined {\n const normalized = normalizeExternal(\n input,\n \"requester-engine-response-invalid\",\n );\n const direct = DenialSchema.safeParse(normalized);\n if (direct.success) {\n return { code: direct.data.code, message: direct.data.message };\n }\n const envelope = ErrorEnvelopeDenialSchema.safeParse(normalized);\n if (envelope.success) {\n return {\n code: envelope.data.error.code,\n message: envelope.data.error.message,\n };\n }\n return undefined;\n}\n\nfunction errorForDenial(\n denial: { code: PolicyEngineGrantPresentationDenialCode; message?: string },\n status?: number,\n): TranscriptRequesterError {\n const accessEnded =\n denial.code === \"policy-inactive\" ||\n denial.code === \"policy-revoked\" ||\n denial.code === \"policy-expired\";\n return new TranscriptRequesterError(\n `policy-engine-denied-${denial.code}`,\n denial.message ?? `policy engine denied ${denial.code}`,\n accessEnded ? \"access-ended\" : \"denied\",\n denial.code,\n status,\n );\n}\n\nfunction retryDelay(attempt: number, random: number): number {\n const base = Math.min(REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, 50 * 2 ** attempt);\n return Math.min(\n REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,\n Math.floor(base * (0.5 + random)),\n );\n}\n\nfunction trimTrailingSlash(value: string): string {\n return value.endsWith(\"/\") ? value.slice(0, -1) : value;\n}\n\nfunction normalizeExternal(\n input: unknown,\n code: TranscriptRequesterErrorCode,\n): unknown {\n try {\n return normalizeJson(input);\n } catch (error) {\n throw new TranscriptRequesterError(\n code,\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction parseStrictRfc3339(value: string): number | undefined {\n if (\n !/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/.test(\n value,\n )\n ) {\n return undefined;\n }\n const parsed = Date.parse(value);\n if (Number.isNaN(parsed)) {\n return undefined;\n }\n const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n const reparsed = Date.parse(value);\n return Date.parse(canonical) === reparsed ? parsed : undefined;\n}\n","import { rfc4648 } from './base.js'\n\nexport const base32 = rfc4648({\n prefix: 'b',\n name: 'base32',\n alphabet: 'abcdefghijklmnopqrstuvwxyz234567',\n bitsPerChar: 5\n})\n\nexport const base32upper = rfc4648({\n prefix: 'B',\n name: 'base32upper',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567',\n bitsPerChar: 5\n})\n\nexport const base32pad = rfc4648({\n prefix: 'c',\n name: 'base32pad',\n alphabet: 'abcdefghijklmnopqrstuvwxyz234567=',\n bitsPerChar: 5\n})\n\nexport const base32padupper = rfc4648({\n prefix: 'C',\n name: 'base32padupper',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=',\n bitsPerChar: 5\n})\n\nexport const base32hex = rfc4648({\n prefix: 'v',\n name: 'base32hex',\n alphabet: '0123456789abcdefghijklmnopqrstuv',\n bitsPerChar: 5\n})\n\nexport const base32hexupper = rfc4648({\n prefix: 'V',\n name: 'base32hexupper',\n alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV',\n bitsPerChar: 5\n})\n\nexport const base32hexpad = rfc4648({\n prefix: 't',\n name: 'base32hexpad',\n alphabet: '0123456789abcdefghijklmnopqrstuv=',\n bitsPerChar: 5\n})\n\nexport const base32hexpadupper = rfc4648({\n prefix: 'T',\n name: 'base32hexpadupper',\n alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV=',\n bitsPerChar: 5\n})\n\nexport const base32z = rfc4648({\n prefix: 'h',\n name: 'base32z',\n alphabet: 'ybndrfg8ejkmcpqxot1uwisza345h769',\n bitsPerChar: 5\n})\n","export const empty = new Uint8Array(0)\n\nexport function toHex (d: Uint8Array): string {\n return d.reduce((hex, byte) => hex + byte.toString(16).padStart(2, '0'), '')\n}\n\nexport function fromHex (hex: string): Uint8Array {\n const hexes = hex.match(/../g)\n return hexes != null ? new Uint8Array(hexes.map(b => parseInt(b, 16))) : empty\n}\n\nexport function equals (aa: Uint8Array, bb: Uint8Array): boolean {\n if (aa === bb) { return true }\n if (aa.byteLength !== bb.byteLength) {\n return false\n }\n\n for (let ii = 0; ii < aa.byteLength; ii++) {\n if (aa[ii] !== bb[ii]) {\n return false\n }\n }\n\n return true\n}\n\nexport function coerce (o: ArrayBufferView | ArrayBuffer | Uint8Array): Uint8Array {\n if (o instanceof Uint8Array && o.constructor.name === 'Uint8Array') { return o }\n if (o instanceof ArrayBuffer) { return new Uint8Array(o) }\n if (ArrayBuffer.isView(o)) {\n return new Uint8Array(o.buffer, o.byteOffset, o.byteLength)\n }\n throw new Error('Unknown type, must be binary type')\n}\n\nexport function isBinary (o: unknown): o is ArrayBuffer | ArrayBufferView {\n return o instanceof ArrayBuffer || ArrayBuffer.isView(o)\n}\n\nexport function fromString (str: string): Uint8Array {\n return new TextEncoder().encode(str)\n}\n\nexport function toString (b: Uint8Array): string {\n return new TextDecoder().decode(b)\n}\n","/* eslint-disable */\n// base-x encoding / decoding\n// Copyright (c) 2018 base-x contributors\n// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)\n// Distributed under the MIT software license, see the accompanying\n// file LICENSE or http://www.opensource.org/licenses/mit-license.php.\n/**\n * @param {string} ALPHABET\n * @param {any} name\n */\nfunction base (ALPHABET, name) {\n if (ALPHABET.length >= 255) { throw new TypeError('Alphabet too long') }\n var BASE_MAP = new Uint8Array(256);\n for (var j = 0; j < BASE_MAP.length; j++) {\n BASE_MAP[j] = 255;\n }\n for (var i = 0; i < ALPHABET.length; i++) {\n var x = ALPHABET.charAt(i);\n var xc = x.charCodeAt(0);\n if (BASE_MAP[xc] !== 255) { throw new TypeError(x + ' is ambiguous') }\n BASE_MAP[xc] = i;\n }\n var BASE = ALPHABET.length;\n var LEADER = ALPHABET.charAt(0);\n var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up\n var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up\n /**\n * @param {any[] | Iterable<number>} source\n */\n function encode (source) {\n // @ts-ignore\n if (source instanceof Uint8Array) ; else if (ArrayBuffer.isView(source)) {\n source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n } else if (Array.isArray(source)) {\n source = Uint8Array.from(source);\n }\n if (!(source instanceof Uint8Array)) { throw new TypeError('Expected Uint8Array') }\n if (source.length === 0) { return '' }\n // Skip & count leading zeroes.\n var zeroes = 0;\n var length = 0;\n var pbegin = 0;\n var pend = source.length;\n while (pbegin !== pend && source[pbegin] === 0) {\n pbegin++;\n zeroes++;\n }\n // Allocate enough space in big-endian base58 representation.\n var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;\n var b58 = new Uint8Array(size);\n // Process the bytes.\n while (pbegin !== pend) {\n var carry = source[pbegin];\n // Apply \"b58 = b58 * 256 + ch\".\n var i = 0;\n for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {\n carry += (256 * b58[it1]) >>> 0;\n b58[it1] = (carry % BASE) >>> 0;\n carry = (carry / BASE) >>> 0;\n }\n if (carry !== 0) { throw new Error('Non-zero carry') }\n length = i;\n pbegin++;\n }\n // Skip leading zeroes in base58 result.\n var it2 = size - length;\n while (it2 !== size && b58[it2] === 0) {\n it2++;\n }\n // Translate the result into a string.\n var str = LEADER.repeat(zeroes);\n for (; it2 < size; ++it2) { str += ALPHABET.charAt(b58[it2]); }\n return str\n }\n /**\n * @param {string | string[]} source\n */\n function decodeUnsafe (source) {\n if (typeof source !== 'string') { throw new TypeError('Expected String') }\n if (source.length === 0) { return new Uint8Array() }\n var psz = 0;\n // Skip leading spaces.\n if (source[psz] === ' ') { return }\n // Skip and count leading '1's.\n var zeroes = 0;\n var length = 0;\n while (source[psz] === LEADER) {\n zeroes++;\n psz++;\n }\n // Allocate enough space in big-endian base256 representation.\n var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.\n var b256 = new Uint8Array(size);\n // Process the characters.\n while (source[psz]) {\n // Decode character\n var carry = BASE_MAP[source.charCodeAt(psz)];\n // Invalid character\n if (carry === 255) { return }\n var i = 0;\n for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {\n carry += (BASE * b256[it3]) >>> 0;\n b256[it3] = (carry % 256) >>> 0;\n carry = (carry / 256) >>> 0;\n }\n if (carry !== 0) { throw new Error('Non-zero carry') }\n length = i;\n psz++;\n }\n // Skip trailing spaces.\n if (source[psz] === ' ') { return }\n // Skip leading zeroes in b256.\n var it4 = size - length;\n while (it4 !== size && b256[it4] === 0) {\n it4++;\n }\n var vch = new Uint8Array(zeroes + (size - it4));\n var j = zeroes;\n while (it4 !== size) {\n vch[j++] = b256[it4++];\n }\n return vch\n }\n /**\n * @param {string | string[]} string\n */\n function decode (string) {\n var buffer = decodeUnsafe(string);\n if (buffer) { return buffer }\n throw new Error(`Non-${name} character`)\n }\n return {\n encode: encode,\n decodeUnsafe: decodeUnsafe,\n decode: decode\n }\n}\nvar src = base;\n\nvar _brrp__multiformats_scope_baseX = src;\n\nexport default _brrp__multiformats_scope_baseX;\n","import { coerce } from '../bytes.js'\nimport basex from '../vendor/base-x.js'\nimport type { BaseCodec, BaseDecoder, BaseEncoder, CombobaseDecoder, Multibase, MultibaseCodec, MultibaseDecoder, MultibaseEncoder, UnibaseDecoder } from './interface.js'\n\ninterface EncodeFn { (bytes: Uint8Array): string }\ninterface DecodeFn { (text: string): Uint8Array }\n\n/**\n * Class represents both BaseEncoder and MultibaseEncoder meaning it\n * can be used to encode to multibase or base encode without multibase\n * prefix.\n */\nclass Encoder<Base extends string, Prefix extends string> implements MultibaseEncoder<Prefix>, BaseEncoder {\n readonly name: Base\n readonly prefix: Prefix\n readonly baseEncode: EncodeFn\n\n constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn) {\n this.name = name\n this.prefix = prefix\n this.baseEncode = baseEncode\n }\n\n encode (bytes: Uint8Array): Multibase<Prefix> {\n if (bytes instanceof Uint8Array) {\n return `${this.prefix}${this.baseEncode(bytes)}`\n } else {\n throw Error('Unknown type, must be binary type')\n }\n }\n}\n\n/**\n * Class represents both BaseDecoder and MultibaseDecoder so it could be used\n * to decode multibases (with matching prefix) or just base decode strings\n * with corresponding base encoding.\n */\nclass Decoder<Base extends string, Prefix extends string> implements MultibaseDecoder<Prefix>, UnibaseDecoder<Prefix>, BaseDecoder {\n readonly name: Base\n readonly prefix: Prefix\n readonly baseDecode: DecodeFn\n private readonly prefixCodePoint: number\n\n constructor (name: Base, prefix: Prefix, baseDecode: DecodeFn) {\n this.name = name\n this.prefix = prefix\n const prefixCodePoint = prefix.codePointAt(0)\n /* c8 ignore next 3 */\n if (prefixCodePoint === undefined) {\n throw new Error('Invalid prefix character')\n }\n this.prefixCodePoint = prefixCodePoint\n this.baseDecode = baseDecode\n }\n\n decode (text: string): Uint8Array {\n if (typeof text === 'string') {\n if (text.codePointAt(0) !== this.prefixCodePoint) {\n throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`)\n }\n return this.baseDecode(text.slice(this.prefix.length))\n } else {\n throw Error('Can only multibase decode strings')\n }\n }\n\n or<OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n return or(this, decoder)\n }\n}\n\ntype Decoders<Prefix extends string> = Record<Prefix, UnibaseDecoder<Prefix>>\n\nclass ComposedDecoder<Prefix extends string> implements MultibaseDecoder<Prefix>, CombobaseDecoder<Prefix> {\n readonly decoders: Decoders<Prefix>\n\n constructor (decoders: Decoders<Prefix>) {\n this.decoders = decoders\n }\n\n or <OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n return or(this, decoder)\n }\n\n decode (input: string): Uint8Array {\n const prefix = input[0] as Prefix\n const decoder = this.decoders[prefix]\n if (decoder != null) {\n return decoder.decode(input)\n } else {\n throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`)\n }\n }\n}\n\nexport function or <L extends string, R extends string> (left: UnibaseDecoder<L> | CombobaseDecoder<L>, right: UnibaseDecoder<R> | CombobaseDecoder<R>): ComposedDecoder<L | R> {\n return new ComposedDecoder({\n ...(left.decoders ?? { [(left as UnibaseDecoder<L>).prefix]: left }),\n ...(right.decoders ?? { [(right as UnibaseDecoder<R>).prefix]: right })\n } as Decoders<L | R>)\n}\n\nexport class Codec<Base extends string, Prefix extends string> implements MultibaseCodec<Prefix>, MultibaseEncoder<Prefix>, MultibaseDecoder<Prefix>, BaseCodec, BaseEncoder, BaseDecoder {\n readonly name: Base\n readonly prefix: Prefix\n readonly baseEncode: EncodeFn\n readonly baseDecode: DecodeFn\n readonly encoder: Encoder<Base, Prefix>\n readonly decoder: Decoder<Base, Prefix>\n\n constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn, baseDecode: DecodeFn) {\n this.name = name\n this.prefix = prefix\n this.baseEncode = baseEncode\n this.baseDecode = baseDecode\n this.encoder = new Encoder(name, prefix, baseEncode)\n this.decoder = new Decoder(name, prefix, baseDecode)\n }\n\n encode (input: Uint8Array): string {\n return this.encoder.encode(input)\n }\n\n decode (input: string): Uint8Array {\n return this.decoder.decode(input)\n }\n}\n\nexport function from <Base extends string, Prefix extends string> ({ name, prefix, encode, decode }: { name: Base, prefix: Prefix, encode: EncodeFn, decode: DecodeFn }): Codec<Base, Prefix> {\n return new Codec(name, prefix, encode, decode)\n}\n\nexport function baseX <Base extends string, Prefix extends string> ({ name, prefix, alphabet }: { name: Base, prefix: Prefix, alphabet: string }): Codec<Base, Prefix> {\n const { encode, decode } = basex(alphabet, name)\n return from({\n prefix,\n name,\n encode,\n decode: (text: string): Uint8Array => coerce(decode(text))\n })\n}\n\nfunction decode (string: string, alphabetIdx: Record<string, number>, bitsPerChar: number, name: string): Uint8Array {\n // Count the padding bytes:\n let end = string.length\n while (string[end - 1] === '=') {\n --end\n }\n\n // Allocate the output:\n const out = new Uint8Array((end * bitsPerChar / 8) | 0)\n\n // Parse the data:\n let bits = 0 // Number of bits currently in the buffer\n let buffer = 0 // Bits waiting to be written out, MSB first\n let written = 0 // Next byte to write\n for (let i = 0; i < end; ++i) {\n // Read one character from the string:\n const value = alphabetIdx[string[i]]\n if (value === undefined) {\n throw new SyntaxError(`Non-${name} character`)\n }\n\n // Append the bits to the buffer:\n buffer = (buffer << bitsPerChar) | value\n bits += bitsPerChar\n\n // Write out some bits if the buffer has a byte's worth:\n if (bits >= 8) {\n bits -= 8\n out[written++] = 0xff & (buffer >> bits)\n }\n }\n\n // Verify that we have received just enough bits:\n if (bits >= bitsPerChar || (0xff & (buffer << (8 - bits))) !== 0) {\n throw new SyntaxError('Unexpected end of data')\n }\n\n return out\n}\n\nfunction encode (data: Uint8Array, alphabet: string, bitsPerChar: number): string {\n const pad = alphabet[alphabet.length - 1] === '='\n const mask = (1 << bitsPerChar) - 1\n let out = ''\n\n let bits = 0 // Number of bits currently in the buffer\n let buffer = 0 // Bits waiting to be written out, MSB first\n for (let i = 0; i < data.length; ++i) {\n // Slurp data into the buffer:\n buffer = (buffer << 8) | data[i]\n bits += 8\n\n // Write out as much as we can:\n while (bits > bitsPerChar) {\n bits -= bitsPerChar\n out += alphabet[mask & (buffer >> bits)]\n }\n }\n\n // Partial character:\n if (bits !== 0) {\n out += alphabet[mask & (buffer << (bitsPerChar - bits))]\n }\n\n // Add padding characters until we hit a byte boundary:\n if (pad) {\n while (((out.length * bitsPerChar) & 7) !== 0) {\n out += '='\n }\n }\n\n return out\n}\n\nfunction createAlphabetIdx (alphabet: string): Record<string, number> {\n // Build the character lookup table:\n const alphabetIdx: Record<string, number> = {}\n for (let i = 0; i < alphabet.length; ++i) {\n alphabetIdx[alphabet[i]] = i\n }\n return alphabetIdx\n}\n\n/**\n * RFC4648 Factory\n */\nexport function rfc4648 <Base extends string, Prefix extends string> ({ name, prefix, bitsPerChar, alphabet }: { name: Base, prefix: Prefix, bitsPerChar: number, alphabet: string }): Codec<Base, Prefix> {\n const alphabetIdx = createAlphabetIdx(alphabet)\n return from({\n prefix,\n name,\n encode (input: Uint8Array): string {\n return encode(input, alphabet, bitsPerChar)\n },\n decode (input: string): Uint8Array {\n return decode(input, alphabetIdx, bitsPerChar, name)\n }\n })\n}\n","import { baseX } from './base.js'\n\nexport const base36 = baseX({\n prefix: 'k',\n name: 'base36',\n alphabet: '0123456789abcdefghijklmnopqrstuvwxyz'\n})\n\nexport const base36upper = baseX({\n prefix: 'K',\n name: 'base36upper',\n alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'\n})\n","import { baseX } from './base.js'\n\nexport const base58btc = baseX({\n name: 'base58btc',\n prefix: 'z',\n alphabet: '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'\n})\n\nexport const base58flickr = baseX({\n name: 'base58flickr',\n prefix: 'Z',\n alphabet: '123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ'\n})\n","/* eslint-disable */\nvar encode_1 = encode;\n\nvar MSB = 0x80\n , REST = 0x7F\n , MSBALL = ~REST\n , INT = Math.pow(2, 31);\n\n/**\n * @param {number} num\n * @param {number[]} out\n * @param {number} offset\n */\nfunction encode(num, out, offset) {\n out = out || [];\n offset = offset || 0;\n var oldOffset = offset;\n\n while(num >= INT) {\n out[offset++] = (num & 0xFF) | MSB;\n num /= 128;\n }\n while(num & MSBALL) {\n out[offset++] = (num & 0xFF) | MSB;\n num >>>= 7;\n }\n out[offset] = num | 0;\n \n // @ts-ignore\n encode.bytes = offset - oldOffset + 1;\n \n return out\n}\n\nvar decode = read;\n\nvar MSB$1 = 0x80\n , REST$1 = 0x7F;\n\n/**\n * @param {string | any[]} buf\n * @param {number} offset\n */\nfunction read(buf, offset) {\n var res = 0\n , offset = offset || 0\n , shift = 0\n , counter = offset\n , b\n , l = buf.length;\n\n do {\n if (counter >= l) {\n // @ts-ignore\n read.bytes = 0;\n throw new RangeError('Could not decode varint')\n }\n b = buf[counter++];\n res += shift < 28\n ? (b & REST$1) << shift\n : (b & REST$1) * Math.pow(2, shift);\n shift += 7;\n } while (b >= MSB$1)\n\n // @ts-ignore\n read.bytes = counter - offset;\n\n return res\n}\n\nvar N1 = Math.pow(2, 7);\nvar N2 = Math.pow(2, 14);\nvar N3 = Math.pow(2, 21);\nvar N4 = Math.pow(2, 28);\nvar N5 = Math.pow(2, 35);\nvar N6 = Math.pow(2, 42);\nvar N7 = Math.pow(2, 49);\nvar N8 = Math.pow(2, 56);\nvar N9 = Math.pow(2, 63);\n\nvar length = function (/** @type {number} */ value) {\n return (\n value < N1 ? 1\n : value < N2 ? 2\n : value < N3 ? 3\n : value < N4 ? 4\n : value < N5 ? 5\n : value < N6 ? 6\n : value < N7 ? 7\n : value < N8 ? 8\n : value < N9 ? 9\n : 10\n )\n};\n\nvar varint = {\n encode: encode_1\n , decode: decode\n , encodingLength: length\n};\n\nvar _brrp_varint = varint;\n\nexport default _brrp_varint;\n","import varint from './vendor/varint.js'\n\nexport function decode (data: Uint8Array, offset = 0): [number, number] {\n const code = varint.decode(data, offset)\n return [code, varint.decode.bytes]\n}\n\nexport function encodeTo (int: number, target: Uint8Array, offset = 0): Uint8Array {\n varint.encode(int, target, offset)\n return target\n}\n\nexport function encodingLength (int: number): number {\n return varint.encodingLength(int)\n}\n","import { coerce, equals as equalBytes } from '../bytes.js'\nimport * as varint from '../varint.js'\nimport type { MultihashDigest } from './interface.js'\n\n/**\n * Creates a multihash digest.\n */\nexport function create <Code extends number> (code: Code, digest: Uint8Array): Digest<Code, number> {\n const size = digest.byteLength\n const sizeOffset = varint.encodingLength(code)\n const digestOffset = sizeOffset + varint.encodingLength(size)\n\n const bytes = new Uint8Array(digestOffset + size)\n varint.encodeTo(code, bytes, 0)\n varint.encodeTo(size, bytes, sizeOffset)\n bytes.set(digest, digestOffset)\n\n return new Digest(code, size, digest, bytes)\n}\n\n/**\n * Turns bytes representation of multihash digest into an instance.\n */\nexport function decode (multihash: Uint8Array): MultihashDigest {\n const bytes = coerce(multihash)\n const [code, sizeOffset] = varint.decode(bytes)\n const [size, digestOffset] = varint.decode(bytes.subarray(sizeOffset))\n const digest = bytes.subarray(sizeOffset + digestOffset)\n\n if (digest.byteLength !== size) {\n throw new Error('Incorrect length')\n }\n\n return new Digest(code, size, digest, bytes)\n}\n\nexport function equals (a: MultihashDigest, b: unknown): b is MultihashDigest {\n if (a === b) {\n return true\n } else {\n const data = b as { code?: unknown, size?: unknown, bytes?: unknown }\n\n return (\n a.code === data.code &&\n a.size === data.size &&\n data.bytes instanceof Uint8Array &&\n equalBytes(a.bytes, data.bytes)\n )\n }\n}\n\n/**\n * Represents a multihash digest which carries information about the\n * hashing algorithm and an actual hash digest.\n */\nexport class Digest<Code extends number, Size extends number> implements MultihashDigest {\n readonly code: Code\n readonly size: Size\n readonly digest: Uint8Array\n readonly bytes: Uint8Array\n\n /**\n * Creates a multihash digest.\n */\n constructor (code: Code, size: Size, digest: Uint8Array, bytes: Uint8Array) {\n this.code = code\n this.size = size\n this.digest = digest\n this.bytes = bytes\n }\n}\n\n/**\n * Used to check that the passed multihash has the passed code\n */\nexport function hasCode <T extends number> (digest: MultihashDigest, code: T): digest is MultihashDigest<T> {\n return digest.code === code\n}\n","import { base32 } from './bases/base32.js'\nimport { base36 } from './bases/base36.js'\nimport { base58btc } from './bases/base58.js'\nimport { coerce } from './bytes.js'\nimport * as Digest from './hashes/digest.js'\nimport * as varint from './varint.js'\nimport type * as API from './link/interface.js'\n\n// This way TS will also expose all the types from module\nexport * from './link/interface.js'\n\nexport function format <T extends API.Link<unknown, number, number, API.Version>, Prefix extends string> (link: T, base?: API.MultibaseEncoder<Prefix>): API.ToString<T, Prefix> {\n const { bytes, version } = link\n switch (version) {\n case 0:\n return toStringV0(\n bytes,\n baseCache(link),\n base as API.MultibaseEncoder<'z'> ?? base58btc.encoder\n )\n default:\n return toStringV1(\n bytes,\n baseCache(link),\n (base ?? base32.encoder) as API.MultibaseEncoder<Prefix>\n )\n }\n}\n\nexport function toJSON <Link extends API.UnknownLink> (link: Link): API.LinkJSON<Link> {\n return {\n '/': format(link)\n }\n}\n\nexport function fromJSON <Link extends API.UnknownLink> (json: API.LinkJSON<Link>): CID<unknown, number, number, API.Version> {\n return CID.parse(json['/'])\n}\n\nconst cache = new WeakMap<API.UnknownLink, Map<string, string>>()\n\nfunction baseCache (cid: API.UnknownLink): Map<string, string> {\n const baseCache = cache.get(cid)\n if (baseCache == null) {\n const baseCache = new Map()\n cache.set(cid, baseCache)\n return baseCache\n }\n return baseCache\n}\n\nexport class CID<Data = unknown, Format extends number = number, Alg extends number = number, Version extends API.Version = API.Version> implements API.Link<Data, Format, Alg, Version> {\n readonly code: Format\n readonly version: Version\n readonly multihash: API.MultihashDigest<Alg>\n readonly bytes: Uint8Array\n readonly '/': Uint8Array\n\n /**\n * @param version - Version of the CID\n * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n * @param multihash - (Multi)hash of the of the content.\n */\n constructor (version: Version, code: Format, multihash: API.MultihashDigest<Alg>, bytes: Uint8Array) {\n this.code = code\n this.version = version\n this.multihash = multihash\n this.bytes = bytes\n\n // flag to serializers that this is a CID and\n // should be treated specially\n this['/'] = bytes\n }\n\n /**\n * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`\n * please either use `CID.asCID(cid)` or switch to new signalling mechanism\n *\n * @deprecated\n */\n get asCID (): this {\n return this\n }\n\n // ArrayBufferView\n get byteOffset (): number {\n return this.bytes.byteOffset\n }\n\n // ArrayBufferView\n get byteLength (): number {\n return this.bytes.byteLength\n }\n\n toV0 (): CID<Data, API.DAG_PB, API.SHA_256, 0> {\n switch (this.version) {\n case 0: {\n return this as CID<Data, API.DAG_PB, API.SHA_256, 0>\n }\n case 1: {\n const { code, multihash } = this\n\n if (code !== DAG_PB_CODE) {\n throw new Error('Cannot convert a non dag-pb CID to CIDv0')\n }\n\n // sha2-256\n if (multihash.code !== SHA_256_CODE) {\n throw new Error('Cannot convert non sha2-256 multihash CID to CIDv0')\n }\n\n return (\n CID.createV0(\n multihash as API.MultihashDigest<API.SHA_256>\n )\n )\n }\n default: {\n throw Error(\n `Can not convert CID version ${this.version} to version 0. This is a bug please report`\n )\n }\n }\n }\n\n toV1 (): CID<Data, Format, Alg, 1> {\n switch (this.version) {\n case 0: {\n const { code, digest } = this.multihash\n const multihash = Digest.create(code, digest)\n return (\n CID.createV1(this.code, multihash)\n )\n }\n case 1: {\n return this as CID<Data, Format, Alg, 1>\n }\n default: {\n throw Error(\n `Can not convert CID version ${this.version} to version 1. This is a bug please report`\n )\n }\n }\n }\n\n equals (other: unknown): other is CID<Data, Format, Alg, Version> {\n return CID.equals(this, other)\n }\n\n static equals <Data, Format extends number, Alg extends number, Version extends API.Version>(self: API.Link<Data, Format, Alg, Version>, other: unknown): other is CID {\n const unknown = other as { code?: unknown, version?: unknown, multihash?: unknown }\n return (\n unknown != null &&\n self.code === unknown.code &&\n self.version === unknown.version &&\n Digest.equals(self.multihash, unknown.multihash)\n )\n }\n\n toString (base?: API.MultibaseEncoder<string>): string {\n return format(this, base)\n }\n\n toJSON (): API.LinkJSON<this> {\n return { '/': format(this) }\n }\n\n link (): this {\n return this\n }\n\n readonly [Symbol.toStringTag] = 'CID';\n\n // Legacy\n\n [Symbol.for('nodejs.util.inspect.custom')] (): string {\n return `CID(${this.toString()})`\n }\n\n /**\n * Takes any input `value` and returns a `CID` instance if it was\n * a `CID` otherwise returns `null`. If `value` is instanceof `CID`\n * it will return value back. If `value` is not instance of this CID\n * class, but is compatible CID it will return new instance of this\n * `CID` class. Otherwise returns null.\n *\n * This allows two different incompatible versions of CID library to\n * co-exist and interop as long as binary interface is compatible.\n */\n static asCID <Data, Format extends number, Alg extends number, Version extends API.Version, U>(input: API.Link<Data, Format, Alg, Version> | U): CID<Data, Format, Alg, Version> | null {\n if (input == null) {\n return null\n }\n\n const value = input as any\n if (value instanceof CID) {\n // If value is instance of CID then we're all set.\n return value\n } else if ((value['/'] != null && value['/'] === value.bytes) || value.asCID === value) {\n // If value isn't instance of this CID class but `this.asCID === this` or\n // `value['/'] === value.bytes` is true it is CID instance coming from a\n // different implementation (diff version or duplicate). In that case we\n // rebase it to this `CID` implementation so caller is guaranteed to get\n // instance with expected API.\n const { version, code, multihash, bytes } = value\n return new CID(\n version,\n code,\n multihash as API.MultihashDigest<Alg>,\n bytes ?? encodeCID(version, code, multihash.bytes)\n )\n } else if (value[cidSymbol] === true) {\n // If value is a CID from older implementation that used to be tagged via\n // symbol we still rebase it to the this `CID` implementation by\n // delegating that to a constructor.\n const { version, multihash, code } = value\n const digest = Digest.decode(multihash) as API.MultihashDigest<Alg>\n return CID.create(version, code, digest)\n } else {\n // Otherwise value is not a CID (or an incompatible version of it) in\n // which case we return `null`.\n return null\n }\n }\n\n /**\n * @param version - Version of the CID\n * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n * @param digest - (Multi)hash of the of the content.\n */\n static create <Data, Format extends number, Alg extends number, Version extends API.Version>(version: Version, code: Format, digest: API.MultihashDigest<Alg>): CID<Data, Format, Alg, Version> {\n if (typeof code !== 'number') {\n throw new Error('String codecs are no longer supported')\n }\n\n if (!(digest.bytes instanceof Uint8Array)) {\n throw new Error('Invalid digest')\n }\n\n switch (version) {\n case 0: {\n if (code !== DAG_PB_CODE) {\n throw new Error(\n `Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`\n )\n } else {\n return new CID(version, code, digest, digest.bytes)\n }\n }\n case 1: {\n const bytes = encodeCID(version, code, digest.bytes)\n return new CID(version, code, digest, bytes)\n }\n default: {\n throw new Error('Invalid version')\n }\n }\n }\n\n /**\n * Simplified version of `create` for CIDv0.\n */\n static createV0 <T = unknown>(digest: API.MultihashDigest<typeof SHA_256_CODE>): CID<T, typeof DAG_PB_CODE, typeof SHA_256_CODE, 0> {\n return CID.create(0, DAG_PB_CODE, digest)\n }\n\n /**\n * Simplified version of `create` for CIDv1.\n *\n * @param code - Content encoding format code.\n * @param digest - Multihash of the content.\n */\n static createV1 <Data, Code extends number, Alg extends number>(code: Code, digest: API.MultihashDigest<Alg>): CID<Data, Code, Alg, 1> {\n return CID.create(1, code, digest)\n }\n\n /**\n * Decoded a CID from its binary representation. The byte array must contain\n * only the CID with no additional bytes.\n *\n * An error will be thrown if the bytes provided do not contain a valid\n * binary representation of a CID.\n */\n static decode <Data, Code extends number, Alg extends number, Version extends API.Version>(bytes: API.ByteView<API.Link<Data, Code, Alg, Version>>): CID<Data, Code, Alg, Version> {\n const [cid, remainder] = CID.decodeFirst(bytes)\n if (remainder.length !== 0) {\n throw new Error('Incorrect length')\n }\n return cid\n }\n\n /**\n * Decoded a CID from its binary representation at the beginning of a byte\n * array.\n *\n * Returns an array with the first element containing the CID and the second\n * element containing the remainder of the original byte array. The remainder\n * will be a zero-length byte array if the provided bytes only contained a\n * binary CID representation.\n */\n static decodeFirst <T, C extends number, A extends number, V extends API.Version>(bytes: API.ByteView<API.Link<T, C, A, V>>): [CID<T, C, A, V>, Uint8Array] {\n const specs = CID.inspectBytes(bytes)\n const prefixSize = specs.size - specs.multihashSize\n const multihashBytes = coerce(\n bytes.subarray(prefixSize, prefixSize + specs.multihashSize)\n )\n if (multihashBytes.byteLength !== specs.multihashSize) {\n throw new Error('Incorrect length')\n }\n const digestBytes = multihashBytes.subarray(\n specs.multihashSize - specs.digestSize\n )\n const digest = new Digest.Digest(\n specs.multihashCode,\n specs.digestSize,\n digestBytes,\n multihashBytes\n )\n const cid =\n specs.version === 0\n ? CID.createV0(digest as API.MultihashDigest<API.SHA_256>)\n : CID.createV1(specs.codec, digest)\n return [cid as CID<T, C, A, V>, bytes.subarray(specs.size)]\n }\n\n /**\n * Inspect the initial bytes of a CID to determine its properties.\n *\n * Involves decoding up to 4 varints. Typically this will require only 4 to 6\n * bytes but for larger multicodec code values and larger multihash digest\n * lengths these varints can be quite large. It is recommended that at least\n * 10 bytes be made available in the `initialBytes` argument for a complete\n * inspection.\n */\n static inspectBytes <T, C extends number, A extends number, V extends API.Version>(initialBytes: API.ByteView<API.Link<T, C, A, V>>): { version: V, codec: C, multihashCode: A, digestSize: number, multihashSize: number, size: number } {\n let offset = 0\n const next = (): number => {\n const [i, length] = varint.decode(initialBytes.subarray(offset))\n offset += length\n return i\n }\n\n let version = next() as V\n let codec = DAG_PB_CODE as C\n if (version as number === 18) {\n // CIDv0\n version = 0 as V\n offset = 0\n } else {\n codec = next() as C\n }\n\n if (version !== 0 && version !== 1) {\n throw new RangeError(`Invalid CID version ${version}`)\n }\n\n const prefixSize = offset\n const multihashCode = next() as A // multihash code\n const digestSize = next() // multihash length\n const size = offset + digestSize\n const multihashSize = size - prefixSize\n\n return { version, codec, multihashCode, digestSize, multihashSize, size }\n }\n\n /**\n * Takes cid in a string representation and creates an instance. If `base`\n * decoder is not provided will use a default from the configuration. It will\n * throw an error if encoding of the CID is not compatible with supplied (or\n * a default decoder).\n */\n static parse <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version>(source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): CID<Data, Code, Alg, Version> {\n const [prefix, bytes] = parseCIDtoBytes(source, base)\n\n const cid = CID.decode(bytes)\n\n if (cid.version === 0 && source[0] !== 'Q') {\n throw Error('Version 0 CID string must not include multibase prefix')\n }\n\n // Cache string representation to avoid computing it on `this.toString()`\n baseCache(cid).set(prefix, source)\n\n return cid\n }\n}\n\nfunction parseCIDtoBytes <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version> (source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): [Prefix, API.ByteView<API.Link<Data, Code, Alg, Version>>] {\n switch (source[0]) {\n // CIDv0 is parsed differently\n case 'Q': {\n const decoder = base ?? base58btc\n return [\n base58btc.prefix as Prefix,\n decoder.decode(`${base58btc.prefix}${source}`)\n ]\n }\n case base58btc.prefix: {\n const decoder = base ?? base58btc\n return [base58btc.prefix as Prefix, decoder.decode(source)]\n }\n case base32.prefix: {\n const decoder = base ?? base32\n return [base32.prefix as Prefix, decoder.decode(source)]\n }\n case base36.prefix: {\n const decoder = base ?? base36\n return [base36.prefix as Prefix, decoder.decode(source)]\n }\n default: {\n if (base == null) {\n throw Error(\n 'To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided'\n )\n }\n return [source[0] as Prefix, base.decode(source)]\n }\n }\n}\n\nfunction toStringV0 (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<'z'>): string {\n const { prefix } = base\n if (prefix !== base58btc.prefix) {\n throw Error(`Cannot string encode V0 in ${base.name} encoding`)\n }\n\n const cid = cache.get(prefix)\n if (cid == null) {\n const cid = base.encode(bytes).slice(1)\n cache.set(prefix, cid)\n return cid\n } else {\n return cid\n }\n}\n\nfunction toStringV1 <Prefix extends string> (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<Prefix>): string {\n const { prefix } = base\n const cid = cache.get(prefix)\n if (cid == null) {\n const cid = base.encode(bytes)\n cache.set(prefix, cid)\n return cid\n } else {\n return cid\n }\n}\n\nconst DAG_PB_CODE = 0x70\nconst SHA_256_CODE = 0x12\n\nfunction encodeCID (version: API.Version, code: number, multihash: Uint8Array): Uint8Array {\n const codeOffset = varint.encodingLength(version)\n const hashOffset = codeOffset + varint.encodingLength(code)\n const bytes = new Uint8Array(hashOffset + multihash.byteLength)\n varint.encodeTo(version, bytes, 0)\n varint.encodeTo(code, bytes, codeOffset)\n bytes.set(multihash, hashOffset)\n return bytes\n}\n\nconst cidSymbol = Symbol.for('@ipld/js-cid/CID')\n","export type SignedObjectErrorCode =\n | \"schema-invalid\"\n | \"canonicalization-mismatch\"\n | \"digest-mismatch\"\n | \"id-mismatch\"\n | \"signing-key-binding\"\n | \"signature-material-invalid\"\n | \"signature-suite-unsupported\"\n | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n public readonly code: SignedObjectErrorCode;\n\n constructor(code: SignedObjectErrorCode, message: string) {\n super(message);\n this.name = \"SignedObjectProfileError\";\n this.code = code;\n }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"schema-invalid\", message);\n this.name = \"SignedObjectSchemaError\";\n }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"canonicalization-mismatch\", message);\n this.name = \"SignedObjectCanonicalizationError\";\n }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"digest-mismatch\", message);\n this.name = \"SignedObjectDigestError\";\n }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"id-mismatch\", message);\n this.name = \"SignedObjectIdError\";\n }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signing-key-binding\", message);\n this.name = \"SigningKeyBindingError\";\n }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signature-material-invalid\", message);\n this.name = \"SignatureMaterialError\";\n }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signature-suite-unsupported\", message);\n this.name = \"UnsupportedSignatureSuiteError\";\n }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n constructor(message: string) {\n super(\"signature-invalid\", message);\n this.name = \"SignatureVerificationError\";\n }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n if (error instanceof SignedObjectProfileError) {\n return error;\n }\n return new SignedObjectProfileError(\n \"schema-invalid\",\n error instanceof Error ? error.message : String(error),\n );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n | null\n | boolean\n | number\n | string\n | JsonValue[]\n | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted lexicographically by their raw UTF-16 code units,\n * as required by RFC 8785 section 3.2.3, before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n if (input === null) {\n return null;\n }\n\n switch (typeof input) {\n case \"boolean\":\n return input;\n case \"number\":\n if (!Number.isFinite(input)) {\n throw new SignedObjectCanonicalizationError(\n `${path} must be a finite JSON number`,\n );\n }\n return input;\n case \"string\":\n assertUnicodeScalarString(input, path);\n return input;\n case \"object\":\n return normalizeJsonObjectOrArray(input, path);\n case \"bigint\":\n case \"function\":\n case \"symbol\":\n case \"undefined\":\n default:\n throw new SignedObjectCanonicalizationError(\n `${path} is not a JSON value`,\n );\n }\n}\n\nexport function serialize(value: JsonValue): string {\n if (value === null) {\n return \"null\";\n }\n\n switch (typeof value) {\n case \"boolean\":\n return value ? \"true\" : \"false\";\n case \"number\": {\n const encoded = JSON.stringify(value);\n if (encoded === undefined) {\n throw new SignedObjectCanonicalizationError(\n \"number could not be serialized as JSON\",\n );\n }\n return encoded;\n }\n case \"string\":\n return JSON.stringify(value);\n case \"object\":\n if (Array.isArray(value)) {\n return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n }\n return serializeObject(value);\n default:\n throw new SignedObjectCanonicalizationError(\n `unsupported JSON value type ${typeof value}`,\n );\n }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n assertNoSymbolKeys(input, path);\n\n if (Array.isArray(input)) {\n for (const key of Object.getOwnPropertyNames(input)) {\n if (key === \"length\") {\n continue;\n }\n if (!isArrayIndexKey(key, input.length)) {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} is not allowed on a JSON array`,\n );\n }\n const descriptor = Object.getOwnPropertyDescriptor(input, key);\n if (descriptor?.enumerable !== true) {\n throw new SignedObjectCanonicalizationError(\n `${path}[${key}] must be an enumerable JSON array item`,\n );\n }\n if (!(\"value\" in descriptor)) {\n throw new SignedObjectCanonicalizationError(\n `${path}[${key}] must be a JSON data property`,\n );\n }\n }\n const output: JsonValue[] = [];\n for (let index = 0; index < input.length; index++) {\n if (!objectHasOwn(input, index)) {\n throw new SignedObjectCanonicalizationError(\n `${path}[${index}] must not be a sparse array hole`,\n );\n }\n output.push(normalizeJson(input[index], `${path}[${index}]`));\n }\n return output;\n }\n\n const proto = Object.getPrototypeOf(input);\n if (proto !== Object.prototype && proto !== null) {\n throw new SignedObjectCanonicalizationError(\n `${path} must be a plain JSON object`,\n );\n }\n\n const output = Object.create(null) as MutableJsonObject;\n for (const key of Object.getOwnPropertyNames(input)) {\n assertUnicodeScalarString(key, `${path} key`);\n if (key === \"__proto__\" || key === \"constructor\") {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} is not allowed`,\n );\n }\n const descriptor = Object.getOwnPropertyDescriptor(input, key);\n if (descriptor?.enumerable !== true) {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} must be an enumerable JSON object property`,\n );\n }\n if (!(\"value\" in descriptor)) {\n throw new SignedObjectCanonicalizationError(\n `${path}.${key} must be a JSON data property`,\n );\n }\n const value = descriptor.value;\n output[key] = normalizeJson(value, `${path}.${key}`);\n }\n return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n if (Object.getOwnPropertySymbols(input).length > 0) {\n throw new SignedObjectCanonicalizationError(\n `${path} must not have symbol properties`,\n );\n }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n if (!/^(0|[1-9]\\d*)$/.test(key)) {\n return false;\n }\n const index = Number(key);\n return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n const keys = Object.keys(value).sort(compareUtf16CodeUnits);\n const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n return `{${parts.join(\",\")}}`;\n}\n\nfunction compareUtf16CodeUnits(a: string, b: string): number {\n const max = Math.min(a.length, b.length);\n for (let index = 0; index < max; index++) {\n const leftCodeUnit = a.charCodeAt(index);\n const rightCodeUnit = b.charCodeAt(index);\n if (leftCodeUnit !== rightCodeUnit) {\n return leftCodeUnit - rightCodeUnit;\n }\n }\n return a.length - b.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n for (let index = 0; index < value.length; index++) {\n const code = value.charCodeAt(index);\n if (code >= 0xd800 && code <= 0xdbff) {\n const next = value.charCodeAt(index + 1);\n if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n throw new SignedObjectCanonicalizationError(\n `${path} contains a lone high surrogate`,\n );\n }\n index++;\n continue;\n }\n if (code >= 0xdc00 && code <= 0xdfff) {\n throw new SignedObjectCanonicalizationError(\n `${path} contains a lone low surrogate`,\n );\n }\n }\n}\n","import { CAPABILITY_REGISTRY } from \"@tinycloud/bootstrap\";\nimport { bytesToHex, sha256 } from \"viem\";\nimport { jcsCanonicalize, normalizeJson, type JsonValue } from \"./jcs\";\n\nconst POLICY_CAPABILITY_DOMAIN = \"xyz.tinycloud.policy/PolicyCapability/v0\";\nconst textEncoder = new TextEncoder();\n\nexport type PolicyCapabilityErrorCode =\n | \"policy-capability-malformed\"\n | \"policy-capability-unknown-key\"\n | \"policy-capability-malformed-service\"\n | \"policy-capability-malformed-space\"\n | \"policy-capability-malformed-path\"\n | \"policy-capability-malformed-action\"\n | \"policy-capability-empty-actions\"\n | \"policy-capability-malformed-caveats\";\n\nexport class PolicyCapabilityError extends Error {\n public readonly code: PolicyCapabilityErrorCode;\n\n constructor(code: PolicyCapabilityErrorCode, message: string) {\n super(message);\n this.name = \"PolicyCapabilityError\";\n this.code = code;\n }\n}\n\nexport interface PolicyCapability {\n readonly service: \"tinycloud.kv\" | \"tinycloud.sql\" | \"tinycloud.vfs\";\n readonly space: string;\n readonly path: string;\n readonly actions: readonly string[];\n readonly caveats?: JsonObject;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\ninterface NormalizeOptions {\n readonly allowPrefixPaths?: boolean;\n readonly requireCanonical?: boolean;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nconst CEILING_SERVICES = new Set([\"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.vfs\"]);\nconst GRANTABLE_ACTIONS = new Map<string, ReadonlySet<string>>();\n\nfor (const entry of CAPABILITY_REGISTRY) {\n if (!CEILING_SERVICES.has(entry.service)) {\n continue;\n }\n if (entry.aliasOf !== undefined || entry.implies !== undefined || entry.urn.endsWith(\"/*\")) {\n continue;\n }\n const existing = GRANTABLE_ACTIONS.get(entry.service);\n if (existing === undefined) {\n GRANTABLE_ACTIONS.set(entry.service, new Set([entry.urn]));\n continue;\n }\n (existing as Set<string>).add(entry.urn);\n}\n\n/**\n * Strict authoring validator for resolved Listen-adapter PolicyCapability JSON.\n * It accepts only concrete service/space/path/action/caveat forms and rejects\n * manifest-shaped permission payloads before any Policy is signed.\n */\nexport function normalizePolicyCapability(input: unknown): PolicyCapability {\n return normalizePolicyCapabilityWithOptions(input, { requireCanonical: true });\n}\n\n/**\n * Frozen-vector canonicalizer for the m1-b-01a policy-capability vectors.\n * Prefix paths are allowed here only to preserve behavioral conformance with\n * the vendored engine vectors; authoring uses normalizePolicyCapability.\n */\nexport function canonicalizePolicyCapability(input: unknown): PolicyCapability {\n return normalizePolicyCapabilityWithOptions(input, { allowPrefixPaths: true });\n}\n\nexport function policyCapabilityDigestHex(input: unknown): string {\n const canonical = canonicalizePolicyCapability(input);\n const jcs = textEncoder.encode(jcsCanonicalize(canonical));\n const domain = textEncoder.encode(`${POLICY_CAPABILITY_DOMAIN}\\0`);\n const bytes = new Uint8Array(domain.length + jcs.length);\n bytes.set(domain, 0);\n bytes.set(jcs, domain.length);\n return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nexport function policyCapabilityContains(authority: unknown, request: unknown): boolean {\n let auth: PolicyCapability;\n let req: PolicyCapability;\n try {\n auth = canonicalizePolicyCapability(authority);\n req = canonicalizePolicyCapability(request);\n } catch {\n return false;\n }\n if (auth.service !== req.service || auth.space !== req.space) {\n return false;\n }\n if (!pathContains(auth.path, req.path)) {\n return false;\n }\n const authActions = new Set(auth.actions);\n for (const action of req.actions) {\n if (!authActions.has(action)) {\n return false;\n }\n }\n return caveatsContain(auth.caveats, req.caveats);\n}\n\nfunction normalizePolicyCapabilityWithOptions(\n input: unknown,\n options: NormalizeOptions,\n): PolicyCapability {\n const object = expectObject(input, \"$\");\n assertExactKeys(object, [\"service\", \"space\", \"path\", \"actions\", \"caveats\"], \"$\");\n const service = requiredString(object, \"service\", \"$\", \"policy-capability-malformed-service\");\n if (!CEILING_SERVICES.has(service)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-service\",\n \"$.service is outside the frozen permissionsCeiling vocabulary\",\n );\n }\n const space = requiredString(object, \"space\", \"$\", \"policy-capability-malformed-space\");\n validateConcreteSpace(space);\n const canonicalSpace = space.normalize(\"NFC\");\n if (options.requireCanonical && canonicalSpace !== space) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-space\",\n \"$.space must already be canonical NFC\",\n );\n }\n const rawPath = requiredString(object, \"path\", \"$\", \"policy-capability-malformed-path\");\n validateRawPath(rawPath, options);\n const path = normalizePath(rawPath);\n if (options.requireCanonical && path !== rawPath) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path must already be canonical\",\n );\n }\n validateRawPath(path, options);\n const actions = normalizeActions(\n requiredArray(object, \"actions\", \"$\", \"policy-capability-malformed-action\"),\n service,\n options,\n );\n const output = Object.create(null) as {\n service: PolicyCapability[\"service\"];\n space: string;\n path: string;\n actions: string[];\n caveats?: JsonObject;\n };\n output.service = service as PolicyCapability[\"service\"];\n output.space = canonicalSpace;\n output.path = path;\n output.actions = actions;\n if (hasOwn(object, \"caveats\")) {\n output.caveats = validateCaveats(\n requiredValue(object, \"caveats\", \"$\", \"policy-capability-malformed-caveats\"),\n output.service,\n );\n }\n return output;\n}\n\nfunction expectObject(input: unknown, path: string): JsonObject {\n try {\n const normalized = normalizeJson(input);\n if (normalized === null || typeof normalized !== \"object\" || Array.isArray(normalized)) {\n throw new PolicyCapabilityError(\"policy-capability-malformed\", `${path} must be an object`);\n }\n return normalized as JsonObject;\n } catch (error) {\n if (error instanceof PolicyCapabilityError) {\n throw error;\n }\n throw new PolicyCapabilityError(\n \"policy-capability-malformed\",\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new PolicyCapabilityError(\n key === \"id\" || key === \"scope\" ? \"policy-capability-malformed\" : \"policy-capability-unknown-key\",\n `${path} has unknown field ${key}`,\n );\n }\n }\n}\n\nfunction requiredValue(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyCapabilityErrorCode,\n): JsonValue {\n if (!hasOwn(object, key)) {\n throw new PolicyCapabilityError(code, `${path}.${key} is required`);\n }\n return object[key];\n}\n\nfunction requiredString(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyCapabilityErrorCode,\n): string {\n const value = requiredValue(object, key, path, code);\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyCapabilityError(code, `${path}.${key} must be a non-empty string`);\n }\n return value;\n}\n\nfunction requiredArray(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyCapabilityErrorCode,\n): readonly JsonValue[] {\n const value = requiredValue(object, key, path, code);\n if (!Array.isArray(value)) {\n throw new PolicyCapabilityError(code, `${path}.${key} must be an array`);\n }\n return value;\n}\n\nfunction validateConcreteSpace(space: string): void {\n if (space === \"*\" || space.includes(\"*\") || space.includes(\"?\") || space.includes(\"/\")) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-space\",\n \"$.space must be concrete\",\n );\n }\n}\n\nfunction validateRawPath(path: string, options: NormalizeOptions): void {\n if (path.length === 0) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is empty\");\n }\n if (!options.allowPrefixPaths && path.endsWith(\"/\")) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path must be an exact concrete path, not a prefix\",\n );\n }\n if (path.endsWith(\"/*\") || path.includes(\"**\")) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is a prefix form\");\n }\n const segments = path.split(\"/\");\n for (let index = 0; index < segments.length; index++) {\n const segment = segments[index]!;\n const isTrailingPrefixSegment =\n options.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;\n if (segment.length === 0 && !isTrailingPrefixSegment) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path has an empty segment\");\n }\n if (segment === \".\" || segment === \"..\") {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path has a traversal segment\",\n );\n }\n if (segment === \"*\" || segment === \"?\" || segment.includes(\"*\") || segment.includes(\"?\")) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-path\",\n \"$.path has a wildcard segment\",\n );\n }\n }\n}\n\nfunction normalizePath(path: string): string {\n return decodeUnreserved(path).normalize(\"NFC\");\n}\n\nfunction decodeUnreserved(path: string): string {\n return path.replace(/%[0-9A-Fa-f]{2}/g, (encoded) => {\n const char = String.fromCharCode(Number.parseInt(encoded.slice(1), 16));\n return /^[A-Za-z0-9._~-]$/.test(char) ? char : encoded.toUpperCase();\n });\n}\n\nfunction normalizeActions(\n actions: readonly JsonValue[],\n service: string,\n options: NormalizeOptions,\n): string[] {\n const accepted = GRANTABLE_ACTIONS.get(service);\n if (accepted === undefined) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-service\",\n \"$.service is unsupported\",\n );\n }\n const unique = new Set<string>();\n const rawActions: string[] = [];\n for (let index = 0; index < actions.length; index++) {\n const action = actions[index];\n if (typeof action !== \"string\" || action.length === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-action\",\n `$.actions[${index}] must be a non-empty action URN`,\n );\n }\n if (!action.startsWith(`${service}/`) || action.includes(\"*\") || !accepted.has(action)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-action\",\n `$.actions[${index}] is not a grantable action URN`,\n );\n }\n rawActions.push(action);\n unique.add(action);\n }\n if (unique.size === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-empty-actions\",\n \"$.actions must not be empty\",\n );\n }\n const normalizedActions = [...unique].sort();\n if (\n options.requireCanonical &&\n (rawActions.length !== normalizedActions.length ||\n rawActions.some((action, index) => action !== normalizedActions[index]))\n ) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-action\",\n \"$.actions must already be sorted, deduplicated canonical action URNs\",\n );\n }\n return normalizedActions;\n}\n\nfunction validateCaveats(input: JsonValue, service: PolicyCapability[\"service\"]): JsonObject {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats must be an object\",\n );\n }\n if (service === \"tinycloud.sql\") {\n return validateSqlCaveats(input as JsonObject);\n }\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats are not defined for this service\",\n );\n}\n\nfunction validateSqlCaveats(input: JsonObject): JsonObject {\n assertCaveatKeys(input, [\"mode\", \"readOnly\", \"statements\"], \"$.caveats\");\n const mode = caveatString(input, \"mode\", \"$.caveats\");\n if (mode !== \"constrained-statements\") {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats.mode is unsupported\",\n );\n }\n if (requiredCaveat(input, \"readOnly\", \"$.caveats\") !== true) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats.readOnly must be true\",\n );\n }\n const statements = requiredCaveat(input, \"statements\", \"$.caveats\");\n if (!Array.isArray(statements) || statements.length === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n \"$.caveats.statements must be a non-empty array\",\n );\n }\n for (let index = 0; index < statements.length; index++) {\n validateSqlStatement(statements[index], `$.caveats.statements[${index}]`);\n }\n return input;\n}\n\nfunction validateSqlStatement(input: JsonValue, path: string): void {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n }\n const object = input as JsonObject;\n assertCaveatKeys(object, [\"name\", \"sql\", \"fixedParams\"], path);\n caveatString(object, \"name\", path);\n caveatString(object, \"sql\", path);\n const fixedParams = requiredCaveat(object, \"fixedParams\", path);\n if (!Array.isArray(fixedParams)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.fixedParams must be an array`,\n );\n }\n for (let index = 0; index < fixedParams.length; index++) {\n validateFixedParam(fixedParams[index], `${path}.fixedParams[${index}]`);\n }\n}\n\nfunction validateFixedParam(input: JsonValue, path: string): void {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n }\n const object = input as JsonObject;\n assertCaveatKeys(object, [\"index\", \"value\"], path);\n const index = requiredCaveat(object, \"index\", path);\n if (typeof index !== \"number\" || !Number.isSafeInteger(index) || index < 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.index must be a non-negative integer`,\n );\n }\n requiredCaveat(object, \"value\", path);\n}\n\nfunction assertCaveatKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path} has unknown field ${key}`,\n );\n }\n }\n}\n\nfunction requiredCaveat(object: JsonObject, key: string, path: string): JsonValue {\n if (!hasOwn(object, key)) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.${key} is required`,\n );\n }\n return object[key];\n}\n\nfunction caveatString(object: JsonObject, key: string, path: string): string {\n const value = requiredCaveat(object, key, path);\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyCapabilityError(\n \"policy-capability-malformed-caveats\",\n `${path}.${key} must be a non-empty string`,\n );\n }\n return value;\n}\n\nfunction pathContains(authority: string, request: string): boolean {\n if (authority === request) {\n return true;\n }\n return authority.endsWith(\"/\") && request.startsWith(authority);\n}\n\nfunction caveatsContain(authority: JsonObject | undefined, request: JsonObject | undefined): boolean {\n if (authority === undefined) {\n return request === undefined;\n }\n if (request === undefined) {\n return Object.keys(authority).length === 0;\n }\n if (authority.mode !== \"constrained-statements\" || request.mode !== \"constrained-statements\") {\n return false;\n }\n const authorityStatements = Array.isArray(authority.statements) ? authority.statements : [];\n const requestStatements = Array.isArray(request.statements) ? request.statements : [];\n return requestStatements.every((statement) =>\n authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement)),\n );\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n return objectHasOwn(object, key);\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n SignatureMaterialError,\n SignatureVerificationError,\n SignedObjectDigestError,\n SignedObjectIdError,\n SignedObjectProfileError,\n SignedObjectSchemaError,\n SigningKeyBindingError,\n UnsupportedSignatureSuiteError,\n toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n | typeof ED25519_JCS_SIGNATURE_SUITE\n | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n suite: SignatureSuite;\n signerDid: string;\n value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n readonly schema: typeof POLICY_SCHEMA;\n readonly policyId: string;\n readonly ownerDid: string;\n readonly signingKeyDid: string;\n readonly createdAt: string;\n readonly expiresAt?: string;\n readonly resource: JsonObject;\n readonly when: JsonObject;\n readonly grant: JsonObject;\n readonly disclosure?: JsonObject;\n readonly audit?: JsonObject;\n readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n readonly schema: typeof POLICY_STATUS_SCHEMA;\n readonly statusId: string;\n readonly policyId: string;\n readonly ownerDid: string;\n readonly sequence: number;\n readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n readonly effectiveAt: string;\n readonly reasonCode?: string;\n readonly signingKeyDid: string;\n readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n readonly engineRecordId: string;\n readonly ownerDid: string;\n readonly endpoint: string;\n readonly audience: string;\n readonly supportedPolicyVersions: string[];\n readonly supportedEvidenceVerifiers: string[];\n readonly grantIssuerDid: string;\n readonly expiresAt: string;\n readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n PolicyEngineRecord,\n \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n | Policy\n | PolicyStatus\n | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n | UnsignedPolicy\n | UnsignedPolicyStatus\n | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n readonly suite: SignatureSuite;\n readonly signerDid: string;\n signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n readonly kind: SignedObjectKind;\n readonly idField: string;\n readonly id: string;\n readonly domain: string;\n readonly unsigned: JsonObject;\n readonly jcs: string;\n readonly jcsBytes: Uint8Array;\n readonly digest: Uint8Array;\n readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n readonly kind: SignedObjectKind;\n readonly schema: string;\n readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n readonly idPrefix: string;\n readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n Policy: {\n kind: \"Policy\",\n schema: POLICY_SCHEMA,\n idField: \"policyId\",\n idPrefix: \"pol_\",\n domain: POLICY_SCHEMA,\n },\n PolicyStatus: {\n kind: \"PolicyStatus\",\n schema: POLICY_STATUS_SCHEMA,\n idField: \"statusId\",\n idPrefix: \"polst_\",\n domain: POLICY_STATUS_SCHEMA,\n },\n PolicyEngineRecord: {\n kind: \"PolicyEngineRecord\",\n schema: POLICY_ENGINE_RECORD_SCHEMA,\n idField: \"engineRecordId\",\n idPrefix: \"peng_\",\n domain: POLICY_ENGINE_RECORD_SCHEMA,\n },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n const descriptor = descriptorForUnsigned(input);\n const unsigned = validateUnsignedForDescriptor(input, descriptor);\n return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n const normalized = expectJsonObject(normalizeJson(input), \"$\");\n const descriptor = descriptorForUnsigned(normalized);\n const stripped = stripOwnIdAndSignature(normalized, descriptor);\n const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n if (descriptor.kind === \"Policy\") {\n validatePolicyPermissionsCeilingForSigning(unsigned);\n }\n assertSupportedSignatureSuite(signer.suite);\n requireStringType(signer.signerDid, \"$.signer.signerDid\");\n assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n const material = materialForUnsigned(unsigned, descriptor);\n const signatureValue = encodeSignatureValue(\n await signer.signDigest(material.digest),\n signer.suite,\n );\n const signature = validateSignature({\n suite: signer.suite,\n signerDid: signer.signerDid,\n value: signatureValue,\n });\n return {\n ...unsigned,\n [descriptor.idField]: material.id,\n signature,\n } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<Policy> {\n return createAndSignSignedObject(input, signer).then((object) =>\n validatePolicySignedShape(object),\n );\n}\n\nexport function createAndSignPolicyStatus(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n return createAndSignSignedObject(input, signer).then((object) =>\n validatePolicyStatusSignedShape(object),\n );\n}\n\nexport function createAndSignPolicyEngineRecord(\n input: unknown,\n signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n return createAndSignSignedObject(input, signer).then((object) =>\n validatePolicyEngineRecordSignedShape(object),\n );\n}\n\nexport async function verifySignedObject(\n input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n const signed = validateSignedObjectShape(input);\n const signedJson = signed as unknown as JsonObject;\n const descriptor = descriptorForSchema(signed.schema);\n const signature = validateSignature(signed.signature);\n assertSigningKeyBindingForVerify(signedJson, signature);\n const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n const material = materialForUnsigned(unsigned, descriptor);\n assertIdMatches(signedJson, material, descriptor);\n if (!(await verifySignature(signature, material.digest))) {\n throw new SignatureVerificationError(\"signature verification failed\");\n }\n return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n const result = await verifySignedObject(input);\n return {\n object: validatePolicySignedShape(result.object),\n material: result.material,\n };\n}\n\nexport async function verifyPolicyStatus(\n input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n const result = await verifySignedObject(input);\n return {\n object: validatePolicyStatusSignedShape(result.object),\n material: result.material,\n };\n}\n\nexport async function verifyPolicyEngineRecord(\n input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n const result = await verifySignedObject(input);\n return {\n object: validatePolicyEngineRecordSignedShape(result.object),\n material: result.material,\n };\n}\n\nexport async function validatePolicySigned(\n input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n try {\n const result = await verifyPolicy(input);\n return { ok: true, object: result.object, material: result.material };\n } catch (error) {\n return { ok: false, error: toSignedObjectError(error) };\n }\n}\n\nexport async function validatePolicyStatusSigned(\n input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n try {\n const result = await verifyPolicyStatus(input);\n return { ok: true, object: result.object, material: result.material };\n } catch (error) {\n return { ok: false, error: toSignedObjectError(error) };\n }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n try {\n const result = await verifyPolicyEngineRecord(input);\n return { ok: true, object: result.object, material: result.material };\n } catch (error) {\n return { ok: false, error: toSignedObjectError(error) };\n }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n input: unknown,\n): UnsignedPolicyEngineRecord {\n return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n input: unknown,\n): PolicyEngineRecord {\n return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n const normalized = expectJsonObject(normalizeJson(input), \"$\");\n const schema = requiredString(normalized, \"schema\", \"$\");\n const descriptor = descriptorForSchema(schema);\n switch (descriptor.kind) {\n case \"Policy\":\n return validatePolicySignedShape(normalized);\n case \"PolicyStatus\":\n return validatePolicyStatusSignedShape(normalized);\n case \"PolicyEngineRecord\":\n return validatePolicyEngineRecordSignedShape(normalized);\n }\n}\n\nfunction validateUnsignedForDescriptor(\n input: unknown,\n descriptor: ObjectDescriptor,\n): JsonObject {\n switch (descriptor.kind) {\n case \"Policy\":\n return validatePolicyUnsigned(input) as unknown as JsonObject;\n case \"PolicyStatus\":\n return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n case \"PolicyEngineRecord\":\n return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n assertExactKeys(\n object,\n signed\n ? [\n \"schema\",\n \"policyId\",\n \"ownerDid\",\n \"signingKeyDid\",\n \"createdAt\",\n \"expiresAt\",\n \"resource\",\n \"when\",\n \"grant\",\n \"disclosure\",\n \"audit\",\n \"signature\",\n ]\n : [\n \"schema\",\n \"ownerDid\",\n \"signingKeyDid\",\n \"createdAt\",\n \"expiresAt\",\n \"resource\",\n \"when\",\n \"grant\",\n \"disclosure\",\n \"audit\",\n ],\n \"$\",\n );\n expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n if (signed) {\n requiredString(object, \"policyId\", \"$\");\n validateSignature(requiredValue(object, \"signature\", \"$\"));\n }\n requiredString(object, \"ownerDid\", \"$\");\n requiredString(object, \"signingKeyDid\", \"$\");\n requiredDateString(object, \"createdAt\", \"$\");\n optionalDateString(object, \"expiresAt\", \"$\");\n validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n if (hasOwn(object, \"disclosure\")) {\n validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n }\n if (hasOwn(object, \"audit\")) {\n validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n }\n return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n assertExactKeys(\n object,\n signed\n ? [\n \"schema\",\n \"statusId\",\n \"policyId\",\n \"ownerDid\",\n \"sequence\",\n \"disposition\",\n \"effectiveAt\",\n \"reasonCode\",\n \"signingKeyDid\",\n \"signature\",\n ]\n : [\n \"schema\",\n \"policyId\",\n \"ownerDid\",\n \"sequence\",\n \"disposition\",\n \"effectiveAt\",\n \"reasonCode\",\n \"signingKeyDid\",\n ],\n \"$\",\n );\n expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n if (signed) {\n requiredString(object, \"statusId\", \"$\");\n validateSignature(requiredValue(object, \"signature\", \"$\"));\n }\n requiredString(object, \"policyId\", \"$\");\n requiredString(object, \"ownerDid\", \"$\");\n requiredInteger(object, \"sequence\", \"$\", 0);\n expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n \"active\",\n \"suspended\",\n \"revoked\",\n ], \"$.disposition\");\n requiredDateString(object, \"effectiveAt\", \"$\");\n optionalString(object, \"reasonCode\", \"$\");\n requiredString(object, \"signingKeyDid\", \"$\");\n return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n input: unknown,\n signed: boolean,\n): JsonObject {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n assertExactKeys(\n object,\n signed\n ? [\n \"schema\",\n \"engineRecordId\",\n \"ownerDid\",\n \"endpoint\",\n \"audience\",\n \"supportedPolicyVersions\",\n \"supportedEvidenceVerifiers\",\n \"grantIssuerDid\",\n \"expiresAt\",\n \"signature\",\n ]\n : [\n \"schema\",\n \"ownerDid\",\n \"endpoint\",\n \"audience\",\n \"supportedPolicyVersions\",\n \"supportedEvidenceVerifiers\",\n \"grantIssuerDid\",\n \"expiresAt\",\n ],\n \"$\",\n );\n expectConst(\n requiredString(object, \"schema\", \"$\"),\n POLICY_ENGINE_RECORD_SCHEMA,\n \"$.schema\",\n );\n if (signed) {\n requiredString(object, \"engineRecordId\", \"$\");\n validateSignature(requiredValue(object, \"signature\", \"$\"));\n }\n requiredString(object, \"ownerDid\", \"$\");\n requiredString(object, \"endpoint\", \"$\");\n requiredString(object, \"audience\", \"$\");\n requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n expectConst(value, \"v0\", path),\n );\n requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n requiredString(object, \"grantIssuerDid\", \"$\");\n requiredDateString(object, \"expiresAt\", \"$\");\n return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n const object = expectJsonObject(input, \"$.signature\");\n assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n const suite = requiredString(object, \"suite\", \"$.signature\");\n assertSupportedSignatureSuite(suite);\n const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n const value = requiredString(object, \"value\", \"$.signature\");\n decodeSignatureValue(value, suite);\n return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n requiredString(object, \"resourceType\", path);\n requiredString(object, \"resourceId\", path);\n const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n for (let index = 0; index < ceiling.length; index++) {\n validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n for (let index = 0; index < ceiling.length; index++) {\n validatePolicyCapabilityForSigning(\n ceiling[index],\n `$.resource.permissionsCeiling[${index}]`,\n );\n }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n try {\n const canonical = canonicalizePolicyCapability(object);\n if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n }\n } catch (error) {\n if (error instanceof SignedObjectSchemaError) {\n throw error;\n }\n throw new SignedObjectSchemaError(\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n try {\n const canonical = normalizePolicyCapability(object);\n if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n }\n } catch (error) {\n if (error instanceof SignedObjectSchemaError) {\n throw error;\n }\n throw new SignedObjectSchemaError(\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n const keys = Object.keys(object);\n if (keys.length !== 1) {\n throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n }\n const key = keys[0];\n if (key === \"allOf\" || key === \"anyOf\") {\n const values = requiredArray(object, key, path, 1);\n for (let index = 0; index < values.length; index++) {\n validateExpression(values[index], `${path}.${key}[${index}]`);\n }\n return;\n }\n if (key === \"subject\") {\n const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n assertExactKeys(subject, [\"did\"], `${path}.subject`);\n requiredString(subject, \"did\", `${path}.subject`);\n return;\n }\n if (key === \"evidence\") {\n validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n return;\n }\n throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(\n object,\n [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n path,\n );\n requiredString(object, \"requirementId\", path);\n requiredString(object, \"verifier\", path);\n requiredValue(object, \"requirements\", path);\n if (hasOwn(object, \"authority\")) {\n const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n assertExactKeys(\n authority,\n [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n `${path}.authority`,\n );\n optionalString(authority, \"profile\", `${path}.authority`);\n if (hasOwn(authority, \"acceptedIssuers\")) {\n requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n }\n optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n }\n if (hasOwn(object, \"freshness\")) {\n const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n requiredInteger(object, \"maxTtlSeconds\", path, 1);\n expectOneOf(requiredString(object, \"delegationMode\", path), [\n \"terminal\",\n \"attenuable\",\n ], `${path}.delegationMode`);\n expectOneOf(requiredString(object, \"revocation\", path), [\n \"refresh_only\",\n \"active_cutoff\",\n ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"denial\"], path);\n expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n const object = expectJsonObject(input, path);\n assertExactKeys(object, [\"issuance\"], path);\n expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n unsigned: JsonObject,\n descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n const jcs = jcsCanonicalize(unsigned);\n const jcsBytes = textEncoder.encode(jcs);\n const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n return {\n kind: descriptor.kind,\n idField: descriptor.idField,\n id,\n domain: descriptor.domain,\n unsigned,\n jcs,\n jcsBytes,\n digest,\n digestHex: bytesToHex(digest).slice(2),\n };\n}\n\nfunction assertIdMatches(\n signed: JsonObject,\n material: SignedObjectMaterial,\n descriptor: ObjectDescriptor,\n): void {\n const actual = requiredString(signed, descriptor.idField, \"$\");\n if (actual === material.id) {\n return;\n }\n if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n throw new SignedObjectDigestError(\n `${descriptor.idField} was not derived from the signed object digest`,\n );\n }\n throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n unsigned: JsonObject,\n signerDid: string,\n): void {\n if (!hasOwn(unsigned, \"signingKeyDid\")) {\n return;\n }\n const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n if (signingKeyDid !== signerDid) {\n throw new SigningKeyBindingError(\n `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n );\n }\n}\n\nfunction assertSigningKeyBindingForVerify(\n signed: JsonObject,\n signature: SignedObjectSignature,\n): void {\n if (!hasOwn(signed, \"signingKeyDid\")) {\n return;\n }\n const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n if (signature.signerDid !== signingKeyDid) {\n throw new SigningKeyBindingError(\n `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n );\n }\n}\n\nfunction assertSignerDidMatchesSuite(\n signerDid: string,\n suite: SignatureSuite,\n): void {\n if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n ed25519PublicKeyFromDidKey(signerDid);\n return;\n }\n if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n parseDidPkh(signerDid);\n return;\n }\n throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n signature: SignedObjectSignature,\n digest: Uint8Array,\n): Promise<boolean> {\n if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n try {\n return ed25519.verify(signatureBytes, digest, publicKey);\n } catch {\n throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n }\n }\n\n if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n const pkh = parseDidPkh(signature.signerDid);\n const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n try {\n return verifyMessage({\n address: pkh.address,\n message: { raw: digest },\n signature: bytesToHex(signatureBytes),\n });\n } catch {\n throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n }\n }\n\n throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n if (!did.startsWith(\"did:key:\")) {\n throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n }\n const identifier = did.slice(\"did:key:\".length);\n if (!identifier.startsWith(\"z\")) {\n throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n }\n let bytes: Uint8Array;\n try {\n bytes = bases.base58btc.decode(identifier);\n } catch {\n throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n }\n if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n return bytes.slice(2);\n }\n throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n let parsed: ReturnType<typeof parsePkhDid>;\n try {\n parsed = parsePkhDid(did);\n } catch {\n throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n }\n if (!parsed) {\n throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n }\n return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n }\n const bytes = base64UrlDecode(value);\n if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n }\n if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n if (bytes.length !== 65) {\n throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n }\n const v = bytes[64];\n if (v !== 27 && v !== 28) {\n throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n }\n }\n return bytes;\n}\n\nfunction encodeSignatureValue(\n value: Uint8Array | string,\n suite: SignatureSuite,\n): string {\n if (typeof value === \"string\") {\n const encoded = value.startsWith(\"0x\")\n ? base64UrlEncode(hexToBytes(value))\n : value;\n decodeSignatureValue(encoded, suite);\n return encoded;\n }\n const encoded = base64UrlEncode(value);\n decodeSignatureValue(encoded, suite);\n return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n object: JsonObject,\n descriptor: ObjectDescriptor,\n): JsonObject {\n const output = Object.create(null) as { [key: string]: JsonValue };\n for (const [key, value] of Object.entries(object)) {\n if (key === descriptor.idField || key === \"signature\") {\n continue;\n }\n output[key] = value;\n }\n return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n const object = expectJsonObject(normalizeJson(input), \"$\");\n return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new SignedObjectSchemaError(`${path} must be an object`);\n }\n return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n }\n }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n if (!hasOwn(object, key)) {\n throw new SignedObjectSchemaError(`${path}.${key} is required`);\n }\n return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n if (!hasOwn(object, key)) {\n return;\n }\n requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n if (typeof value !== \"string\" || value.length === 0) {\n throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n }\n return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n if (!hasOwn(object, key)) {\n return;\n }\n if (typeof requiredValue(object, key, path) !== \"boolean\") {\n throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n }\n}\n\nfunction requiredInteger(\n object: JsonObject,\n key: string,\n path: string,\n minimum: number,\n): number {\n const value = requiredValue(object, key, path);\n if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n throw new SignedObjectSchemaError(\n `${path}.${key} must be an integer >= ${minimum}`,\n );\n }\n return value;\n}\n\nfunction requiredArray(\n object: JsonObject,\n key: string,\n path: string,\n minimum: number,\n): readonly JsonValue[] {\n const value = requiredValue(object, key, path);\n if (!Array.isArray(value) || value.length < minimum) {\n throw new SignedObjectSchemaError(\n `${path}.${key} must be an array with at least ${minimum} item(s)`,\n );\n }\n return value;\n}\n\nfunction requiredStringArray(\n object: JsonObject,\n key: string,\n path: string,\n check?: (value: string, path: string) => void,\n): void {\n const values = requiredArray(object, key, path, 0);\n for (let index = 0; index < values.length; index++) {\n const itemPath = `${path}.${key}[${index}]`;\n const value = requireStringType(values[index], itemPath);\n check?.(value, itemPath);\n }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n if (!hasOwn(object, key)) {\n return;\n }\n assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n const match = value.match(\n /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n );\n if (!match) {\n throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n }\n const parsed = Date.parse(value);\n if (Number.isNaN(parsed)) {\n throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n }\n const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n if (canonical !== value) {\n throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n if (actual !== expected) {\n throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n }\n return expected;\n}\n\nfunction expectOneOf<T extends string>(\n actual: string,\n allowed: readonly T[],\n path: string,\n): T {\n for (const value of allowed) {\n if (actual === value) {\n return value;\n }\n }\n throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n const output = new Uint8Array(left.length + right.length);\n output.set(left, 0);\n output.set(right, left.length);\n return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n let output = \"\";\n let buffer = 0;\n let bits = 0;\n for (const byte of bytes) {\n buffer = (buffer << 8) | byte;\n bits += 8;\n while (bits >= 5) {\n bits -= 5;\n output += BASE32_ALPHABET[(buffer >> bits) & 31];\n }\n }\n if (bits > 0) {\n output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n }\n return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n let output = \"\";\n for (let index = 0; index < bytes.length; index += 3) {\n const a = bytes[index];\n const b = bytes[index + 1];\n const c = bytes[index + 2];\n const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n output += alphabet[(triplet >> 18) & 63];\n output += alphabet[(triplet >> 12) & 63];\n if (index + 1 < bytes.length) {\n output += alphabet[(triplet >> 6) & 63];\n }\n if (index + 2 < bytes.length) {\n output += alphabet[triplet & 63];\n }\n }\n return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n if (value.length % 4 === 1) {\n throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n }\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n const bytes: number[] = [];\n let buffer = 0;\n let bits = 0;\n for (const char of value) {\n const index = alphabet.indexOf(char);\n if (index < 0) {\n throw new SignatureMaterialError(\"signature value is not base64url\");\n }\n buffer = (buffer << 6) | index;\n bits += 6;\n if (bits >= 8) {\n bits -= 8;\n bytes.push((buffer >> bits) & 0xff);\n }\n }\n const decoded = Uint8Array.from(bytes);\n if (base64UrlEncode(decoded) !== value) {\n throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n }\n return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n const hex = value.slice(2);\n if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n throw new SignatureMaterialError(\"hex signature must have even length\");\n }\n const output = new Uint8Array(hex.length / 2);\n for (let index = 0; index < output.length; index++) {\n output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n }\n return output;\n}\n","import { baseX } from './base.js'\n\nexport const base10 = baseX({\n prefix: '9',\n name: 'base10',\n alphabet: '0123456789'\n})\n","import { rfc4648 } from './base.js'\n\nexport const base16 = rfc4648({\n prefix: 'f',\n name: 'base16',\n alphabet: '0123456789abcdef',\n bitsPerChar: 4\n})\n\nexport const base16upper = rfc4648({\n prefix: 'F',\n name: 'base16upper',\n alphabet: '0123456789ABCDEF',\n bitsPerChar: 4\n})\n","import { rfc4648 } from './base.js'\n\nexport const base2 = rfc4648({\n prefix: '0',\n name: 'base2',\n alphabet: '01',\n bitsPerChar: 1\n})\n","import { from } from './base.js'\n\nconst alphabet = Array.from('🚀🪐☄🛰🌌🌑🌒🌓🌔🌕🌖🌗🌘🌍🌏🌎🐉☀💻🖥💾💿😂❤😍🤣😊🙏💕😭😘👍😅👏😁🔥🥰💔💖💙😢🤔😆🙄💪😉☺👌🤗💜😔😎😇🌹🤦🎉💞✌✨🤷😱😌🌸🙌😋💗💚😏💛🙂💓🤩😄😀🖤😃💯🙈👇🎶😒🤭❣😜💋👀😪😑💥🙋😞😩😡🤪👊🥳😥🤤👉💃😳✋😚😝😴🌟😬🙃🍀🌷😻😓⭐✅🥺🌈😈🤘💦✔😣🏃💐☹🎊💘😠☝😕🌺🎂🌻😐🖕💝🙊😹🗣💫💀👑🎵🤞😛🔴😤🌼😫⚽🤙☕🏆🤫👈😮🙆🍻🍃🐶💁😲🌿🧡🎁⚡🌞🎈❌✊👋😰🤨😶🤝🚶💰🍓💢🤟🙁🚨💨🤬✈🎀🍺🤓😙💟🌱😖👶🥴▶➡❓💎💸⬇😨🌚🦋😷🕺⚠🙅😟😵👎🤲🤠🤧📌🔵💅🧐🐾🍒😗🤑🌊🤯🐷☎💧😯💆👆🎤🙇🍑❄🌴💣🐸💌📍🥀🤢👅💡💩👐📸👻🤐🤮🎼🥵🚩🍎🍊👼💍📣🥂')\nconst alphabetBytesToChars: string[] = (alphabet.reduce<string[]>((p, c, i) => { p[i] = c; return p }, ([])))\nconst alphabetCharsToBytes: number[] = (alphabet.reduce<number[]>((p, c, i) => {\n const codePoint = c.codePointAt(0)\n if (codePoint == null) {\n throw new Error(`Invalid character: ${c}`)\n }\n p[codePoint] = i\n return p\n}, ([])))\n\nfunction encode (data: Uint8Array): string {\n return data.reduce((p, c) => {\n p += alphabetBytesToChars[c]\n return p\n }, '')\n}\n\nfunction decode (str: string): Uint8Array {\n const byts = []\n for (const char of str) {\n const codePoint = char.codePointAt(0)\n if (codePoint == null) {\n throw new Error(`Invalid character: ${char}`)\n }\n const byt = alphabetCharsToBytes[codePoint]\n if (byt == null) {\n throw new Error(`Non-base256emoji character: ${char}`)\n }\n byts.push(byt)\n }\n return new Uint8Array(byts)\n}\n\nexport const base256emoji = from({\n prefix: '🚀',\n name: 'base256emoji',\n encode,\n decode\n})\n","import { rfc4648 } from './base.js'\n\nexport const base64 = rfc4648({\n prefix: 'm',\n name: 'base64',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',\n bitsPerChar: 6\n})\n\nexport const base64pad = rfc4648({\n prefix: 'M',\n name: 'base64pad',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',\n bitsPerChar: 6\n})\n\nexport const base64url = rfc4648({\n prefix: 'u',\n name: 'base64url',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',\n bitsPerChar: 6\n})\n\nexport const base64urlpad = rfc4648({\n prefix: 'U',\n name: 'base64urlpad',\n alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=',\n bitsPerChar: 6\n})\n","import { rfc4648 } from './base.js'\n\nexport const base8 = rfc4648({\n prefix: '7',\n name: 'base8',\n alphabet: '01234567',\n bitsPerChar: 3\n})\n","import { fromString, toString } from '../bytes.js'\nimport { from } from './base.js'\n\nexport const identity = from({\n prefix: '\\x00',\n name: 'identity',\n encode: (buf) => toString(buf),\n decode: (str) => fromString(str)\n})\n","import type { ArrayBufferView, ByteView } from './interface.js'\n\nconst textEncoder = new TextEncoder()\nconst textDecoder = new TextDecoder()\n\nexport const name = 'json'\nexport const code = 0x0200\n\nexport function encode <T> (node: T): ByteView<T> {\n return textEncoder.encode(JSON.stringify(node))\n}\n\nexport function decode <T> (data: ByteView<T> | ArrayBufferView<T>): T {\n return JSON.parse(textDecoder.decode(data))\n}\n","import { coerce } from '../bytes.js'\nimport * as Digest from './digest.js'\nimport type { DigestOptions } from './hasher.js'\n\nconst code: 0x0 = 0x0\nconst name = 'identity'\n\nconst encode: (input: Uint8Array) => Uint8Array = coerce\n\nfunction digest (input: Uint8Array, options?: DigestOptions): Digest.Digest<typeof code, number> {\n if (options?.truncate != null && options.truncate !== input.byteLength) {\n if (options.truncate < 0 || options.truncate > input.byteLength) {\n throw new Error(`Invalid truncate option, must be less than or equal to ${input.byteLength}`)\n }\n\n input = input.subarray(0, options.truncate)\n }\n\n return Digest.create(code, encode(input))\n}\n\nexport const identity = { code, name, encode, digest }\n","import crypto from 'crypto'\nimport { coerce } from '../bytes.js'\nimport { from } from './hasher.js'\n\nexport const sha256 = from({\n name: 'sha2-256',\n code: 0x12,\n encode: (input) => coerce(crypto.createHash('sha256').update(input).digest())\n})\n\nexport const sha512 = from({\n name: 'sha2-512',\n code: 0x13,\n encode: input => coerce(crypto.createHash('sha512').update(input).digest())\n})\n","import * as Digest from './digest.js'\nimport type { MultihashHasher } from './interface.js'\n\ntype Await<T> = Promise<T> | T\n\nconst DEFAULT_MIN_DIGEST_LENGTH = 20\n\nexport interface HasherInit <Name extends string, Code extends number> {\n name: Name\n code: Code\n encode(input: Uint8Array): Await<Uint8Array>\n\n /**\n * The minimum length a hash is allowed to be truncated to in bytes\n *\n * @default 20\n */\n minDigestLength?: number\n\n /**\n * The maximum length a hash is allowed to be truncated to in bytes. If not\n * specified it will be inferred from the length of the digest.\n */\n maxDigestLength?: number\n}\n\nexport function from <Name extends string, Code extends number> ({ name, code, encode, minDigestLength, maxDigestLength }: HasherInit<Name, Code>): Hasher<Name, Code> {\n return new Hasher(name, code, encode, minDigestLength, maxDigestLength)\n}\n\nexport interface DigestOptions {\n /**\n * Truncate the returned digest to this number of bytes.\n *\n * This may cause the digest method to throw/reject if the passed value is\n * greater than the digest length or below a threshold under which the risk of\n * hash collisions is significant.\n *\n * The actual value of this threshold can depend on the hashing algorithm in\n * use.\n */\n truncate?: number\n}\n\n/**\n * Hasher represents a hashing algorithm implementation that produces as\n * `MultihashDigest`.\n */\nexport class Hasher<Name extends string, Code extends number> implements MultihashHasher<Code> {\n readonly name: Name\n readonly code: Code\n readonly encode: (input: Uint8Array) => Await<Uint8Array>\n readonly minDigestLength: number\n readonly maxDigestLength?: number\n\n constructor (name: Name, code: Code, encode: (input: Uint8Array) => Await<Uint8Array>, minDigestLength?: number, maxDigestLength?: number) {\n this.name = name\n this.code = code\n this.encode = encode\n this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH\n this.maxDigestLength = maxDigestLength\n }\n\n digest (input: Uint8Array, options?: DigestOptions): Await<Digest.Digest<Code, number>> {\n if (options?.truncate != null) {\n if (options.truncate < this.minDigestLength) {\n throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`)\n }\n\n if (this.maxDigestLength != null && options.truncate > this.maxDigestLength) {\n throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`)\n }\n }\n\n if (input instanceof Uint8Array) {\n const result = this.encode(input)\n\n if (result instanceof Uint8Array) {\n return createDigest(result, this.code, options?.truncate)\n }\n\n return result.then(digest => createDigest(digest, this.code, options?.truncate))\n } else {\n throw Error('Unknown type, must be binary type')\n /* c8 ignore next 1 */\n }\n }\n}\n\n/**\n * Create a Digest from the passed uint8array and code, optionally truncating it\n * first.\n */\nfunction createDigest <Code extends number> (digest: Uint8Array, code: Code, truncate?: number): Digest.Digest<Code, number> {\n if (truncate != null && truncate !== digest.byteLength) {\n if (truncate > digest.byteLength) {\n throw new Error(`Invalid truncate option, must be less than or equal to ${digest.byteLength}`)\n }\n\n digest = digest.subarray(0, truncate)\n }\n\n return Digest.create(code, digest)\n}\n","import * as base10 from './bases/base10.js'\nimport * as base16 from './bases/base16.js'\nimport * as base2 from './bases/base2.js'\nimport * as base256emoji from './bases/base256emoji.js'\nimport * as base32 from './bases/base32.js'\nimport * as base36 from './bases/base36.js'\nimport * as base58 from './bases/base58.js'\nimport * as base64 from './bases/base64.js'\nimport * as base8 from './bases/base8.js'\nimport * as identityBase from './bases/identity.js'\nimport * as json from './codecs/json.js'\nimport * as raw from './codecs/raw.js'\nimport * as identity from './hashes/identity.js'\nimport * as sha2 from './hashes/sha2.js'\nimport { CID, hasher, digest, varint, bytes } from './index.js'\n\nexport const bases = { ...identityBase, ...base2, ...base8, ...base10, ...base16, ...base32, ...base36, ...base58, ...base64, ...base256emoji }\nexport const hashes = { ...sha2, ...identity }\nexport const codecs = { raw, json }\n\nexport { CID, hasher, digest, varint, bytes }\n","import {\n POLICY_ENGINE_RECORD_SCHEMA,\n POLICY_SCHEMA,\n createAndSignPolicy,\n createAndSignPolicyEngineRecord,\n validatePolicyEngineRecordSignedShape,\n verifyPolicyEngineRecord,\n type Policy,\n type PolicyEngineRecord,\n type SignedObjectSigner,\n type UnsignedPolicyEngineRecord,\n} from \"./signed-object\";\nimport {\n PolicyCapabilityError,\n normalizePolicyCapability,\n type JsonObject,\n type PolicyCapability,\n} from \"./capability\";\nimport { normalizeJson, type JsonValue } from \"./jcs\";\nimport { SignedObjectProfileError, SignedObjectSchemaError } from \"./errors\";\n\nexport const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA =\n \"xyz.tinycloud.exchange/transcript-bootstrap/v0\" as const;\nexport const OWNER_NODE_ENDPOINT_SCHEMA =\n \"xyz.tinycloud.exchange/owner-node-endpoint/v1\" as const;\nexport const POLICY_VERSION_V0 = \"v0\" as const;\nexport const W3C_VC_CREDENTIAL_VERIFIER = \"w3c.vc/credential/v1\" as const;\n\nexport type PolicyAuthoringErrorCode =\n | PolicyCapabilityError[\"code\"]\n | \"policy-authoring-malformed\"\n | \"policy-authoring-unknown-key\"\n | \"policy-engine-record-absent\"\n | \"policy-engine-record-date-invalid\"\n | \"policy-engine-record-signature-invalid\"\n | \"policy-engine-record-audience-mismatch\"\n | \"policy-engine-record-expired\"\n | \"policy-engine-record-owner-mismatch\"\n | \"policy-engine-record-grant-issuer-mismatch\"\n | \"policy-engine-record-policy-version-unsupported\"\n | \"policy-engine-record-evidence-verifier-unsupported\"\n | \"transcript-share-bootstrap-malformed\";\n\nexport class PolicyAuthoringError extends Error {\n public readonly code: PolicyAuthoringErrorCode;\n\n constructor(code: PolicyAuthoringErrorCode, message: string) {\n super(message);\n this.name = \"PolicyAuthoringError\";\n this.code = code;\n }\n}\n\nexport interface CreateTranscriptSharePolicyInput {\n readonly ownerDid: string;\n readonly signingKeyDid: string;\n readonly createdAt: string;\n readonly expiresAt?: string;\n readonly resourceType: string;\n readonly resourceId: string;\n readonly permissionsCeiling: readonly unknown[];\n readonly when: JsonObject;\n readonly grant: JsonObject;\n readonly disclosure?: JsonObject;\n readonly audit?: JsonObject;\n}\n\nexport interface TranscriptShareBootstrap {\n readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;\n readonly policyId: string;\n readonly policyEngine: {\n readonly endpoint: string;\n readonly audience: string;\n readonly supportedEvidenceVerifiers: readonly [\n typeof W3C_VC_CREDENTIAL_VERIFIER,\n ];\n readonly signedRecord: PolicyEngineRecord;\n };\n /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */\n readonly ownerNode: {\n readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;\n readonly endpoint: string;\n readonly spaceId: string;\n };\n readonly resourceHint: JsonObject;\n}\n\nexport interface ComposeTranscriptShareBootstrapInput {\n readonly policyId: string;\n readonly policyEngineRecord: PolicyEngineRecord;\n readonly ownerNodeEndpoint: string;\n readonly ownerSpaceId: string;\n readonly resourceHint: JsonObject;\n}\n\nexport interface CreatePolicyEngineRecordInput {\n readonly ownerDid: string;\n readonly endpoint: string;\n readonly audience: string;\n readonly grantIssuerDid: string;\n readonly expiresAt: string;\n readonly supportedPolicyVersions?: readonly string[];\n readonly supportedEvidenceVerifiers?: readonly string[];\n}\n\nexport interface VerifyPolicyEngineRecordOptions {\n readonly signedRecord: unknown;\n readonly ownerDid: string;\n readonly audience: string;\n readonly grantIssuerDid: string;\n readonly now: string;\n readonly requiredPolicyVersion?: string;\n readonly requiredEvidenceVerifier?: string;\n}\n\n/**\n * Author a transcript-sharing Policy from already-resolved Listen-adapter\n * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the\n * SDK does not expand or invent permissions while signing authority-bearing\n * objects.\n */\nexport async function createAndSignTranscriptSharePolicy(\n input: CreateTranscriptSharePolicyInput,\n signer: SignedObjectSigner,\n): Promise<Policy> {\n const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n assertExactKeys(\n normalized,\n [\n \"ownerDid\",\n \"signingKeyDid\",\n \"createdAt\",\n \"expiresAt\",\n \"resourceType\",\n \"resourceId\",\n \"permissionsCeiling\",\n \"when\",\n \"grant\",\n \"disclosure\",\n \"audit\",\n ],\n \"$\",\n );\n const permissions = requiredArray(normalized, \"permissionsCeiling\", \"$\");\n if (permissions.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n \"$.permissionsCeiling must not be empty\",\n );\n }\n const ceiling: PolicyCapability[] = [];\n for (let index = 0; index < permissions.length; index++) {\n ceiling.push(\n wrapCapabilityError(() => normalizePolicyCapability(permissions[index])),\n );\n }\n return createAndSignPolicy(\n {\n schema: POLICY_SCHEMA,\n ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n signingKeyDid: requiredString(normalized, \"signingKeyDid\", \"$\"),\n createdAt: requiredString(normalized, \"createdAt\", \"$\"),\n ...(hasOwn(normalized, \"expiresAt\")\n ? { expiresAt: requiredString(normalized, \"expiresAt\", \"$\") }\n : {}),\n resource: {\n resourceType: requiredString(normalized, \"resourceType\", \"$\"),\n resourceId: requiredString(normalized, \"resourceId\", \"$\"),\n permissionsCeiling: ceiling,\n },\n when: requiredObject(normalized, \"when\", \"$\"),\n grant: requiredObject(normalized, \"grant\", \"$\"),\n ...(hasOwn(normalized, \"disclosure\")\n ? { disclosure: requiredObject(normalized, \"disclosure\", \"$\") }\n : {}),\n ...(hasOwn(normalized, \"audit\")\n ? { audit: requiredObject(normalized, \"audit\", \"$\") }\n : {}),\n },\n signer,\n ).catch((error) => {\n throw wrapSignedObjectError(error);\n });\n}\n\nexport function createUnsignedPolicyEngineRecord(\n input: CreatePolicyEngineRecordInput,\n): UnsignedPolicyEngineRecord {\n const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n assertExactKeys(\n normalized,\n [\n \"ownerDid\",\n \"endpoint\",\n \"audience\",\n \"grantIssuerDid\",\n \"expiresAt\",\n \"supportedPolicyVersions\",\n \"supportedEvidenceVerifiers\",\n ],\n \"$\",\n );\n const supportedPolicyVersions = hasOwn(normalized, \"supportedPolicyVersions\")\n ? requiredStringArray(normalized, \"supportedPolicyVersions\", \"$\")\n : [POLICY_VERSION_V0];\n validateSupportedPolicyVersions(\n supportedPolicyVersions,\n \"$.supportedPolicyVersions\",\n );\n const supportedEvidenceVerifiers = hasOwn(\n normalized,\n \"supportedEvidenceVerifiers\",\n )\n ? requiredStringArray(normalized, \"supportedEvidenceVerifiers\", \"$\")\n : [W3C_VC_CREDENTIAL_VERIFIER];\n validateSupportedEvidenceVerifiers(\n supportedEvidenceVerifiers,\n \"$.supportedEvidenceVerifiers\",\n );\n const expiresAt = fieldString(\n normalized,\n \"expiresAt\",\n \"$\",\n \"policy-engine-record-date-invalid\",\n );\n parseStrictRfc3339(expiresAt, \"$.expiresAt\");\n\n return {\n schema: POLICY_ENGINE_RECORD_SCHEMA,\n ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n endpoint: validatePolicyEngineEndpoint(\n requiredString(normalized, \"endpoint\", \"$\"),\n ),\n audience: requiredString(normalized, \"audience\", \"$\"),\n supportedPolicyVersions,\n supportedEvidenceVerifiers,\n grantIssuerDid: requiredString(normalized, \"grantIssuerDid\", \"$\"),\n expiresAt,\n };\n}\n\nexport async function createAndSignRequesterPolicyEngineRecord(\n input: CreatePolicyEngineRecordInput,\n signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n return createAndSignPolicyEngineRecord(\n createUnsignedPolicyEngineRecord(input),\n signer,\n ).catch((error) => {\n throw wrapSignedObjectError(error);\n });\n}\n\n/**\n * Compose the SDK-level transcript-share bootstrap record. This record is not\n * an invitation and is not authority; it only tells a requester where to ask\n * and which policy id to reference.\n */\nexport function composeTranscriptShareBootstrap(\n input: ComposeTranscriptShareBootstrapInput,\n): TranscriptShareBootstrap {\n const normalized = expectObject(\n input,\n \"$\",\n \"transcript-share-bootstrap-malformed\",\n );\n assertExactKeys(\n normalized,\n [\n \"policyId\",\n \"policyEngineRecord\",\n \"ownerNodeEndpoint\",\n \"ownerSpaceId\",\n \"resourceHint\",\n ],\n \"$\",\n );\n const signedRecord = expectPolicyEngineRecord(\n requiredValue(normalized, \"policyEngineRecord\", \"$\"),\n );\n if (\n !signedRecord.supportedEvidenceVerifiers.includes(\n W3C_VC_CREDENTIAL_VERIFIER,\n )\n ) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"policy engine record does not support the bootstrap evidence verifier\",\n );\n }\n return {\n schema: TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n policyId: requiredString(normalized, \"policyId\", \"$\"),\n policyEngine: {\n endpoint: signedRecord.endpoint,\n audience: signedRecord.audience,\n supportedEvidenceVerifiers: [W3C_VC_CREDENTIAL_VERIFIER],\n signedRecord,\n },\n ownerNode: {\n schema: OWNER_NODE_ENDPOINT_SCHEMA,\n endpoint: validateOwnerNodeEndpoint(\n requiredString(normalized, \"ownerNodeEndpoint\", \"$\"),\n ),\n spaceId: requiredString(normalized, \"ownerSpaceId\", \"$\"),\n },\n resourceHint: requiredObject(normalized, \"resourceHint\", \"$\"),\n };\n}\n\nfunction validateOwnerNodeEndpoint(value: string): string {\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"$.ownerNodeEndpoint must be a URL\",\n );\n }\n if (\n url.protocol !== \"https:\" ||\n url.username !== \"\" ||\n url.password !== \"\" ||\n url.hash !== \"\" ||\n url.search !== \"\"\n ) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"$.ownerNodeEndpoint must be an HTTPS URL without credentials, query, or fragment\",\n );\n }\n return url.toString().replace(/\\/$/, \"\");\n}\n\nfunction validatePolicyEngineEndpoint(value: string): string {\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n \"$.endpoint must be a URL\",\n );\n }\n if (\n url.protocol !== \"https:\" ||\n url.username !== \"\" ||\n url.password !== \"\" ||\n url.hash !== \"\" ||\n url.search !== \"\"\n ) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n \"$.endpoint must be an HTTPS URL without credentials, query, or fragment\",\n );\n }\n return url.toString().replace(/\\/$/, \"\");\n}\n\n/**\n * Requester-side authentication gate for policy-engine endpoints. A requester\n * MUST NOT send credential evidence or call /resolve unless this verification\n * succeeds.\n */\nexport async function verifyPolicyEngineRecordForRequester(\n options: VerifyPolicyEngineRecordOptions,\n): Promise<PolicyEngineRecord> {\n const normalized = expectObject(options, \"$\", \"policy-authoring-malformed\");\n assertExactKeys(\n normalized,\n [\n \"signedRecord\",\n \"ownerDid\",\n \"audience\",\n \"grantIssuerDid\",\n \"now\",\n \"requiredPolicyVersion\",\n \"requiredEvidenceVerifier\",\n ],\n \"$\",\n );\n if (!hasOwn(normalized, \"signedRecord\")) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-absent\",\n \"$.signedRecord must be present\",\n );\n }\n const signedRecord = normalized[\"signedRecord\"];\n if (\n signedRecord === null ||\n typeof signedRecord !== \"object\" ||\n Array.isArray(signedRecord)\n ) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-absent\",\n \"$.signedRecord must be present\",\n );\n }\n const recordObject = signedRecord as JsonObject;\n const expiresAt = fieldString(\n recordObject,\n \"expiresAt\",\n \"$.signedRecord\",\n \"policy-engine-record-date-invalid\",\n );\n const now = fieldString(\n normalized,\n \"now\",\n \"$\",\n \"policy-engine-record-date-invalid\",\n );\n const expiresMs = parseStrictRfc3339(expiresAt, \"$.signedRecord.expiresAt\");\n const nowMs = parseStrictRfc3339(now, \"$.now\");\n if (expiresMs <= nowMs) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-expired\",\n \"$.signedRecord.expiresAt is expired\",\n );\n }\n\n let verified: PolicyEngineRecord;\n try {\n verified = (await verifyPolicyEngineRecord(recordObject)).object;\n } catch (error) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-signature-invalid\",\n error instanceof Error ? error.message : String(error),\n );\n }\n if (verified.signature.signerDid !== verified.ownerDid) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-signature-invalid\",\n \"$.signedRecord.signature.signerDid must match ownerDid for the direct-owner requester profile\",\n );\n }\n\n const expectedOwnerDid = requiredString(normalized, \"ownerDid\", \"$\");\n if (verified.ownerDid !== expectedOwnerDid) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-owner-mismatch\",\n \"$.signedRecord.ownerDid does not match\",\n );\n }\n const expectedAudience = requiredString(normalized, \"audience\", \"$\");\n if (verified.audience !== expectedAudience) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-audience-mismatch\",\n \"$.signedRecord.audience does not match\",\n );\n }\n const expectedGrantIssuerDid = requiredString(\n normalized,\n \"grantIssuerDid\",\n \"$\",\n );\n if (verified.grantIssuerDid !== expectedGrantIssuerDid) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-grant-issuer-mismatch\",\n \"$.signedRecord.grantIssuerDid does not match\",\n );\n }\n const requiredPolicyVersion = hasOwn(normalized, \"requiredPolicyVersion\")\n ? requiredString(normalized, \"requiredPolicyVersion\", \"$\")\n : POLICY_VERSION_V0;\n if (!verified.supportedPolicyVersions.includes(requiredPolicyVersion)) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-policy-version-unsupported\",\n \"$.signedRecord.supportedPolicyVersions does not include the required version\",\n );\n }\n const requiredEvidenceVerifier = hasOwn(\n normalized,\n \"requiredEvidenceVerifier\",\n )\n ? requiredString(normalized, \"requiredEvidenceVerifier\", \"$\")\n : W3C_VC_CREDENTIAL_VERIFIER;\n if (!verified.supportedEvidenceVerifiers.includes(requiredEvidenceVerifier)) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-evidence-verifier-unsupported\",\n \"$.signedRecord.supportedEvidenceVerifiers does not include the required verifier\",\n );\n }\n return verified;\n}\n\nfunction expectObject(\n input: unknown,\n path: string,\n code: PolicyAuthoringErrorCode,\n): JsonObject {\n try {\n const normalized = normalizeJson(input);\n if (\n normalized === null ||\n typeof normalized !== \"object\" ||\n Array.isArray(normalized)\n ) {\n throw new PolicyAuthoringError(code, `${path} must be an object`);\n }\n return normalized as JsonObject;\n } catch (error) {\n if (error instanceof PolicyAuthoringError) {\n throw error;\n }\n throw new PolicyAuthoringError(\n code,\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction expectPolicyEngineRecord(input: JsonValue): PolicyEngineRecord {\n if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n \"$.policyEngineRecord must be an object\",\n );\n }\n try {\n return validatePolicyEngineRecordSignedShape(input);\n } catch (error) {\n throw new PolicyAuthoringError(\n \"transcript-share-bootstrap-malformed\",\n error instanceof Error ? error.message : String(error),\n );\n }\n}\n\nfunction assertExactKeys(\n object: JsonObject,\n allowed: readonly string[],\n path: string,\n): void {\n const allowedSet = new Set(allowed);\n for (const key of Object.keys(object)) {\n if (!allowedSet.has(key)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-unknown-key\",\n `${path} has unknown field ${key}`,\n );\n }\n }\n}\n\nfunction requiredValue(\n object: JsonObject,\n key: string,\n path: string,\n): JsonValue {\n if (!hasOwn(object, key)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} is required`,\n );\n }\n return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n const value = requiredValue(object, key, path);\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} must be a non-empty string`,\n );\n }\n return value;\n}\n\nfunction fieldString(\n object: JsonObject,\n key: string,\n path: string,\n code: PolicyAuthoringErrorCode,\n): string {\n if (!hasOwn(object, key)) {\n throw new PolicyAuthoringError(code, `${path}.${key} is required`);\n }\n const value = object[key];\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyAuthoringError(\n code,\n `${path}.${key} must be a non-empty string`,\n );\n }\n return value;\n}\n\nfunction requiredObject(\n object: JsonObject,\n key: string,\n path: string,\n): JsonObject {\n const value = requiredValue(object, key, path);\n if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} must be an object`,\n );\n }\n return value as JsonObject;\n}\n\nfunction requiredArray(\n object: JsonObject,\n key: string,\n path: string,\n): readonly JsonValue[] {\n const value = requiredValue(object, key, path);\n if (!Array.isArray(value)) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key} must be an array`,\n );\n }\n return value;\n}\n\nfunction requiredStringArray(\n object: JsonObject,\n key: string,\n path: string,\n): string[] {\n const values = requiredArray(object, key, path);\n return values.map((value, index) => {\n if (typeof value !== \"string\" || value.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}.${key}[${index}] must be a non-empty string`,\n );\n }\n return value;\n });\n}\n\nfunction validateSupportedPolicyVersions(\n values: readonly string[],\n path: string,\n): void {\n if (values.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path} must not be empty`,\n );\n }\n for (let index = 0; index < values.length; index++) {\n if (values[index] !== POLICY_VERSION_V0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}[${index}] is unsupported`,\n );\n }\n }\n}\n\nfunction validateSupportedEvidenceVerifiers(\n values: readonly string[],\n path: string,\n): void {\n if (values.length === 0) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path} must not be empty`,\n );\n }\n for (let index = 0; index < values.length; index++) {\n if (values[index] !== W3C_VC_CREDENTIAL_VERIFIER) {\n throw new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n `${path}[${index}] is unsupported`,\n );\n }\n }\n}\n\nfunction wrapCapabilityError<T>(fn: () => T): T {\n try {\n return fn();\n } catch (error) {\n if (error instanceof PolicyCapabilityError) {\n throw new PolicyAuthoringError(error.code, error.message);\n }\n throw error;\n }\n}\n\nfunction wrapSignedObjectError(error: unknown): Error {\n if (error instanceof PolicyAuthoringError) {\n return error;\n }\n if (\n error instanceof SignedObjectSchemaError ||\n error instanceof SignedObjectProfileError\n ) {\n return new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n error.message,\n );\n }\n return new PolicyAuthoringError(\n \"policy-authoring-malformed\",\n error instanceof Error ? error.message : String(error),\n );\n}\n\nfunction parseStrictRfc3339(value: string, path: string): number {\n const match = value.match(\n /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?Z$/,\n );\n if (!match) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-date-invalid\",\n `${path} must be strict RFC 3339`,\n );\n }\n const parsed = Date.parse(value);\n if (Number.isNaN(parsed)) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-date-invalid\",\n `${path} must be parseable`,\n );\n }\n const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n if (canonical !== value) {\n throw new PolicyAuthoringError(\n \"policy-engine-record-date-invalid\",\n `${path} must be normalizable`,\n );\n }\n return parsed;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n (\n Object as ObjectConstructor & {\n hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n }\n ).hasOwn ??\n (Object.prototype.hasOwnProperty.call.bind(\n Object.prototype.hasOwnProperty,\n ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n return objectHasOwn(object, key);\n}\n","import {\n buildNetworkId,\n parseNetworkId,\n type ParsedNetworkId,\n} from \"@tinycloud/sdk-services\";\n\nimport { canonicalizeDid } from \"./identity\";\n\nexport interface CanonicalParsedNetworkId extends ParsedNetworkId {\n /** Owner DID canonicalized with TinyCloud identity rules. */\n ownerDid: string;\n}\n\n/**\n * Canonicalize a TinyCloud encryption network id.\n *\n * Network ids embed an owner DID. For `did:pkh:eip155` owners, address casing\n * can vary between SIWE/session tokens and delegated network resources. This\n * helper parses the network id, canonicalizes the owner DID, and rebuilds the\n * URN so comparisons can use one stable representation.\n */\nexport function canonicalizeNetworkId(networkId: string): string {\n const parsed = parseNetworkId(networkId);\n return buildNetworkId(canonicalizeDid(parsed.ownerDid), parsed.name);\n}\n\nexport function parseCanonicalNetworkId(\n networkId: string,\n): CanonicalParsedNetworkId {\n const canonical = canonicalizeNetworkId(networkId);\n return parseNetworkId(canonical) as CanonicalParsedNetworkId;\n}\n","/**\n * Zod schemas for session persistence types.\n *\n * This is the source of truth for session-related types. TypeScript types\n * are derived from these schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type { Result, ServiceError } from \"@tinycloud/sdk-services\";\n\n// =============================================================================\n// Shared Patterns\n// =============================================================================\n\n/**\n * Ethereum address pattern (checksummed or lowercase).\n */\nconst ethereumAddressPattern = /^0x[a-fA-F0-9]{40}$/;\n\n// =============================================================================\n// ENS Data Schema\n// =============================================================================\n\n/**\n * Schema for ENS data associated with a session.\n */\nexport const EnsDataSchema = z.object({\n /** ENS name/domain. */\n domain: z.string().nullable().optional(),\n /** ENS avatar URL. */\n avatarUrl: z.string().nullable().optional(),\n});\n\nexport type EnsData = z.infer<typeof EnsDataSchema>;\n\n// =============================================================================\n// Persisted TinyCloud Session Schema\n// =============================================================================\n\n/**\n * Schema for TinyCloud-specific session data that's persisted.\n */\nexport const PersistedTinyCloudSessionSchema = z.object({\n /** The delegation header containing the UCAN */\n delegationHeader: z.object({\n Authorization: z.string(),\n }),\n /** The delegation CID */\n delegationCid: z.string(),\n /** The space ID for this session */\n spaceId: z.string(),\n /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */\n spaces: z.record(z.string(), z.string()).optional(),\n /** The verification method DID */\n verificationMethod: z.string(),\n});\n\nexport type PersistedTinyCloudSession = z.infer<\n typeof PersistedTinyCloudSessionSchema\n>;\n\n// =============================================================================\n// Persisted Session Data Schema\n// =============================================================================\n\n/**\n * Schema for full persisted session data.\n *\n * Contains all data needed to restore a session without re-authentication.\n */\nexport const PersistedSessionDataSchema = z.object({\n /** User's Ethereum address */\n address: z\n .string()\n .regex(ethereumAddressPattern, \"Invalid Ethereum address\"),\n /** EIP-155 Chain ID */\n chainId: z.number().int().positive(),\n /** Session key in JWK format (stringified) */\n sessionKey: z.string(),\n /** The signed SIWE message */\n siwe: z.string(),\n /** User's signature of the SIWE message */\n signature: z.string(),\n /** TinyCloud delegation data if available */\n tinycloudSession: PersistedTinyCloudSessionSchema.optional(),\n /** Session expiration timestamp (ISO 8601 with timezone offset) */\n expiresAt: z.string().datetime({ offset: true }),\n /** Session creation timestamp (ISO 8601 with timezone offset) */\n createdAt: z.string().datetime({ offset: true }),\n /** Schema version for migrations */\n version: z.string(),\n /** Optional ENS data */\n ens: EnsDataSchema.optional(),\n /**\n * TinyCloud hosts this session was created against. Persisted so a\n * restored session resolves to the same node without re-running the\n * registry/fallback resolution (or the wallet sign-in flow). Optional\n * for backward compatibility with sessions persisted before this field\n * existed — those restore and lazily re-resolve their hosts.\n */\n tinycloudHosts: z.array(z.string()).optional(),\n});\n\nexport type PersistedSessionData = z.infer<typeof PersistedSessionDataSchema>;\n\n// =============================================================================\n// TinyCloud Session Schema (Runtime)\n// =============================================================================\n\n/**\n * Schema for full TinyCloud session with delegation data.\n *\n * This is the runtime session type used for making invocations and delegations.\n */\nexport const TinyCloudSessionSchema = z.object({\n /** User's Ethereum address */\n address: z.string().regex(ethereumAddressPattern, \"Invalid Ethereum address\"),\n /** EIP-155 Chain ID */\n chainId: z.number().int().positive(),\n /** Session key ID */\n sessionKey: z.string(),\n /** The space ID for this session */\n spaceId: z.string(),\n /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */\n spaces: z.record(z.string(), z.string()).optional(),\n /** The delegation CID */\n delegationCid: z.string(),\n /** The delegation header for API calls */\n delegationHeader: z.object({\n Authorization: z.string(),\n }),\n /** The verification method DID */\n verificationMethod: z.string(),\n /** The session key JWK (required for invoke operations) */\n jwk: z.object({}).passthrough(),\n /** The signed SIWE message */\n siwe: z.string(),\n /** User's signature of the SIWE message */\n signature: z.string(),\n});\n\nexport type TinyCloudSession = z.infer<typeof TinyCloudSessionSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validation error type for schema validation failures.\n */\nexport interface ValidationError extends ServiceError {\n code: \"VALIDATION_ERROR\";\n meta?: {\n issues: z.ZodIssue[];\n path?: string;\n };\n}\n\n/**\n * Validate persisted session data against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validatePersistedSessionData(JSON.parse(rawData));\n * if (result.ok) {\n * // result.data is typed as PersistedSessionData\n * console.log(result.data.address);\n * } else {\n * console.error(result.error.message);\n * }\n * ```\n */\nexport function validatePersistedSessionData(\n data: unknown\n): Result<PersistedSessionData, ValidationError> {\n const result = PersistedSessionDataSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"session\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate TinyCloud session against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateTinyCloudSession(\n data: unknown\n): Result<TinyCloudSession, ValidationError> {\n const result = TinyCloudSessionSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"session\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate persisted TinyCloud session against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validatePersistedTinyCloudSession(\n data: unknown\n): Result<PersistedTinyCloudSession, ValidationError> {\n const result = PersistedTinyCloudSessionSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"session\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n","import {\n IUserAuthorization,\n ClientSession,\n Extension,\n SignInOptions,\n} from \"./userAuthorization\";\nimport {\n ServiceContext,\n IService,\n IServiceContext,\n IKVService,\n KVService,\n ISQLService,\n SQLService,\n IDuckDbService,\n DuckDbService,\n IDataVaultService,\n IEncryptionService,\n IHooksService,\n HooksService,\n ServiceSession,\n InvokeFunction,\n InvokeAnyFunction,\n FetchFunction,\n RetryPolicy,\n defaultRetryPolicy,\n TelemetryConfig,\n ServiceConstructor,\n Result,\n ok,\n err,\n serviceError,\n ServiceError,\n ErrorCodes,\n} from \"@tinycloud/sdk-services\";\nimport { makePublicSpaceId } from \"./spaces/SpaceService\";\n\n/**\n * Configuration for the TinyCloud SDK.\n */\nexport interface TinyCloudConfig {\n /** Whether to automatically resolve ENS names */\n resolveEns?: boolean;\n\n // === Service Configuration ===\n\n /**\n * TinyCloud host URLs.\n * Required when using services.\n */\n hosts?: string[];\n\n /**\n * Platform-specific invoke function from WASM binding.\n * Required when using services.\n */\n invoke?: InvokeFunction;\n\n /**\n * Optional multi-resource invoke function for aggregated capability requests.\n */\n invokeAny?: InvokeAnyFunction;\n\n /**\n * Custom fetch implementation.\n * Defaults to globalThis.fetch.\n */\n fetch?: FetchFunction;\n\n /**\n * Service constructors to register.\n * Built-in services (like KVService) are registered by default unless overridden.\n *\n * @example\n * ```typescript\n * services: {\n * kv: KVService, // default\n * files: MyFileService, // custom\n * }\n * ```\n */\n services?: Record<string, ServiceConstructor>;\n\n /**\n * Per-service configuration.\n *\n * @example\n * ```typescript\n * serviceConfigs: {\n * kv: { prefix: 'myapp' },\n * files: { maxSize: 10_000_000 },\n * }\n * ```\n */\n serviceConfigs?: Record<string, Record<string, unknown>>;\n\n /**\n * Retry policy for service operations.\n */\n retryPolicy?: Partial<RetryPolicy>;\n\n /**\n * Default-off telemetry for service operation timing.\n */\n telemetry?: TelemetryConfig;\n}\n\n/**\n * TinyCloud SDK - Unified entry point for web and node.\n *\n * This class provides the main SDK interface. Platform-specific behavior\n * is injected through the IUserAuthorization implementation:\n * - WebUserAuthorization for browser environments\n * - NodeUserAuthorization for Node.js environments\n *\n * @example\n * ```typescript\n * // Web usage\n * import { TinyCloud } from '@tinycloud/sdk-core';\n * import { WebUserAuthorization } from '@tinycloud/web-sdk';\n *\n * const auth = new WebUserAuthorization({ ... });\n * const tc = new TinyCloud(auth);\n * await tc.signIn();\n * const result = await tc.kv.put('key', 'value');\n *\n * // Node usage\n * import { TinyCloud } from '@tinycloud/sdk-core';\n * import { NodeUserAuthorization, PrivateKeySigner } from '@tinycloud/node-sdk';\n *\n * const signer = new PrivateKeySigner(process.env.PRIVATE_KEY);\n * const auth = new NodeUserAuthorization({\n * signStrategy: { type: 'auto-sign' },\n * signer,\n * domain: 'api.myapp.com'\n * });\n * const tc = new TinyCloud(auth);\n * await tc.signIn();\n * ```\n */\nexport class TinyCloud {\n /**\n * User authorization handler.\n * Provides authentication and signing capabilities.\n */\n public readonly userAuthorization: IUserAuthorization;\n\n /**\n * SDK configuration.\n */\n private config: TinyCloudConfig;\n\n /**\n * Registered extensions.\n */\n private extensions: Extension[] = [];\n\n // === Service Infrastructure ===\n\n /**\n * Service context providing platform dependencies to services.\n */\n private _serviceContext?: ServiceContext;\n\n /**\n * Registered services by name.\n */\n private _services: Map<string, IService> = new Map();\n\n /**\n * Whether services have been initialized.\n */\n private _servicesInitialized: boolean = false;\n\n /**\n * Create a new TinyCloud SDK instance.\n *\n * @param userAuthorization - Platform-specific authorization implementation\n * @param config - Optional SDK configuration\n */\n constructor(userAuthorization: IUserAuthorization, config?: TinyCloudConfig) {\n this.userAuthorization = userAuthorization;\n this.config = config || {};\n }\n\n // === Service Management ===\n\n /**\n * Initialize services with platform dependencies.\n * Must be called before using services.\n *\n * @param invoke - Platform-specific invoke function from WASM binding\n * @param hosts - TinyCloud host URLs (optional, uses config.hosts)\n * @param fetchFn - Custom fetch implementation (optional)\n */\n public initializeServices(\n invoke?: InvokeFunction,\n hosts?: string[],\n fetchFn?: FetchFunction,\n ): void {\n const effectiveInvoke = invoke ?? this.config.invoke;\n const effectiveHosts = hosts ?? this.config.hosts;\n\n if (!effectiveInvoke) {\n throw new Error(\n \"invoke function is required to initialize services. \" +\n \"Provide it via config.invoke or initializeServices().\",\n );\n }\n\n if (!effectiveHosts || effectiveHosts.length === 0) {\n throw new Error(\n \"hosts are required to initialize services. \" +\n \"Provide them via config.hosts or initializeServices().\",\n );\n }\n\n // Create service context\n this._serviceContext = new ServiceContext({\n invoke: effectiveInvoke,\n invokeAny: this.config.invokeAny,\n fetch: fetchFn ?? this.config.fetch ?? globalThis.fetch.bind(globalThis),\n hosts: effectiveHosts,\n retryPolicy: this.config.retryPolicy,\n telemetry: this.config.telemetry,\n });\n\n // Register default services (can be overridden via config.services)\n const serviceConstructors: Record<string, ServiceConstructor> = {\n kv: KVService,\n sql: SQLService,\n duckdb: DuckDbService,\n hooks: HooksService,\n ...this.config.services,\n };\n\n // Create and register services\n for (const [name, ServiceClass] of Object.entries(serviceConstructors)) {\n const serviceConfig = this.config.serviceConfigs?.[name] ?? {};\n const service = new ServiceClass(serviceConfig);\n service.initialize(this._serviceContext);\n this._serviceContext.registerService(name, service);\n this._services.set(name, service);\n }\n\n this._servicesInitialized = true;\n }\n\n /**\n * Get the service context.\n * @throws Error if services are not initialized\n */\n public get serviceContext(): IServiceContext {\n if (!this._serviceContext) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first.\",\n );\n }\n return this._serviceContext;\n }\n\n /** @internal Retire this service graph after its owner replaces a session. */\n public retireServices(): void {\n try {\n this._serviceContext?.retire();\n } finally {\n this._services.clear();\n this._servicesInitialized = false;\n }\n }\n\n /**\n * Get a registered service by name.\n *\n * @param name - Service name (e.g., 'kv')\n * @returns The service instance or undefined\n */\n public getService<T extends IService>(name: string): T | undefined {\n return this._services.get(name) as T | undefined;\n }\n\n /**\n * Get the KV service.\n * @throws Error if services are not initialized\n */\n public get kv(): IKVService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"kv\") as IKVService | undefined;\n if (!service) {\n throw new Error(\"KV service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the SQL service.\n * @throws Error if services are not initialized\n */\n public get sql(): ISQLService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"sql\") as ISQLService | undefined;\n if (!service) {\n throw new Error(\"SQL service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the DuckDB service.\n * @throws Error if services are not initialized\n */\n public get duckdb(): IDuckDbService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"duckdb\") as IDuckDbService | undefined;\n if (!service) {\n throw new Error(\"DuckDB service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the Hooks service.\n * @throws Error if services are not initialized\n */\n public get hooks(): IHooksService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"hooks\") as IHooksService | undefined;\n if (!service) {\n throw new Error(\"Hooks service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the Data Vault service.\n * @throws Error if services are not initialized or vault service is not registered\n */\n public get vault(): IDataVaultService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"vault\") as\n | IDataVaultService\n | undefined;\n if (!service) {\n throw new Error(\"Vault service is not registered.\");\n }\n return service;\n }\n\n /**\n * Get the Encryption service.\n * @throws Error if services are not initialized or encryption service is not registered\n */\n public get encryption(): IEncryptionService {\n if (!this._servicesInitialized) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n const service = this._services.get(\"encryption\") as\n | IEncryptionService\n | undefined;\n if (!service) {\n throw new Error(\"Encryption service is not registered.\");\n }\n return service;\n }\n\n /**\n * Notify services of session change.\n * Called internally after sign-in and sign-out.\n *\n * @param session - The new session, or null if signed out\n */\n private notifyServicesOfSessionChange(session: ServiceSession | null): void {\n if (this._serviceContext) {\n this._serviceContext.setSession(session);\n }\n }\n\n /**\n * Abort all pending service operations.\n * Called internally before sign-out.\n */\n private abortServiceOperations(): void {\n if (this._serviceContext) {\n this._serviceContext.abort();\n }\n }\n\n /**\n * Convert ClientSession to ServiceSession.\n * Returns null if session lacks required fields.\n */\n private toServiceSession(\n clientSession: ClientSession | undefined,\n ): ServiceSession | null {\n if (!clientSession) return null;\n\n // TinyCloudSession contains the required fields\n const tcSession = (clientSession as any).tinycloudSession;\n if (!tcSession) return null;\n\n return {\n delegationHeader: tcSession.delegationHeader,\n delegationCid: tcSession.delegationCid,\n spaceId: tcSession.spaceId,\n verificationMethod: tcSession.verificationMethod,\n jwk: tcSession.jwk,\n };\n }\n\n /**\n * Add an extension to the SDK.\n * Extensions can add capabilities and lifecycle hooks.\n */\n public extend(extension: Extension): void {\n this.extensions.push(extension);\n this.userAuthorization.extend(extension);\n }\n\n /**\n * Check if an extension is enabled.\n * @param namespace - The extension namespace to check\n */\n public isExtensionEnabled(namespace: string): boolean {\n return this.extensions.some((ext) => ext.namespace === namespace);\n }\n\n // === Authentication Methods (delegate to userAuthorization) ===\n\n /**\n * Get the current session, if signed in.\n */\n public get session(): ClientSession | undefined {\n return this.userAuthorization.session;\n }\n\n /**\n * Check if the user is signed in.\n */\n public get isSignedIn(): boolean {\n return !!this.userAuthorization.session;\n }\n\n /**\n * Sign in and create a new session.\n * Notifies services of the new session after successful sign-in.\n * @param options - Optional per-call SIWE overrides for this sign-in only\n * @returns The new session\n */\n public async signIn(options?: SignInOptions): Promise<ClientSession> {\n const session = await this.userAuthorization.signIn(options);\n\n // Notify services of the new session\n const serviceSession = this.toServiceSession(session);\n this.notifyServicesOfSessionChange(serviceSession);\n\n return session;\n }\n\n /**\n * Sign out and clear the current session.\n * Aborts pending service operations and notifies services.\n */\n public async signOut(): Promise<void> {\n // Abort all pending operations before sign-out\n this.abortServiceOperations();\n\n await this.userAuthorization.signOut();\n\n // Clear cached public KV service\n this._publicKV = undefined;\n\n // Clear session from services\n this.notifyServicesOfSessionChange(null);\n }\n\n /**\n * Get the current wallet address.\n */\n public address(): string | undefined {\n return this.userAuthorization.address();\n }\n\n /**\n * Get the current chain ID.\n */\n public chainId(): number | undefined {\n return this.userAuthorization.chainId();\n }\n\n /**\n * Sign a message with the connected wallet.\n * @param message - Message to sign\n */\n public async signMessage(message: string): Promise<string> {\n return this.userAuthorization.signMessage(message);\n }\n\n // === Public Space Methods ===\n\n /**\n * Cached public KV service instance.\n */\n private _publicKV?: IKVService;\n\n /**\n * Construct the deterministic public space ID for a given address and chain ID.\n *\n * @param address - Ethereum address (0x-prefixed)\n * @param chainId - Chain ID (e.g., 1 for mainnet)\n * @returns The public space ID\n */\n static makePublicSpaceId(address: string, chainId: number): string {\n return makePublicSpaceId(address, chainId);\n }\n\n /**\n * Ensure the user's public space exists.\n * Creates it via spaces.create('public') if it doesn't.\n * Called automatically by modules that need to publish data.\n *\n * Requires the user to be signed in and services to be initialized.\n */\n public async ensurePublicSpace(): Promise<Result<void, ServiceError>> {\n const address = this.address();\n const chainId = this.chainId();\n if (!address || !chainId) {\n return err(\n serviceError(\n ErrorCodes.AUTH_REQUIRED,\n \"Must be signed in to ensure public space\",\n \"public-space\",\n ),\n );\n }\n\n if (!this._serviceContext) {\n return err(\n serviceError(\n ErrorCodes.AUTH_REQUIRED,\n \"Services not initialized. Call initializeServices() or signIn() first.\",\n \"public-space\",\n ),\n );\n }\n\n const spaceId = makePublicSpaceId(address, chainId);\n\n // Check if it already exists via invoke\n try {\n const session = this._serviceContext.session;\n if (!session) {\n return err(\n serviceError(\n ErrorCodes.AUTH_REQUIRED,\n \"No active session\",\n \"public-space\",\n ),\n );\n }\n\n const headers = this._serviceContext.invoke(\n session,\n \"space\",\n spaceId,\n \"tinycloud.space/info\",\n );\n\n const response = await this._serviceContext.fetch(\n `${this._serviceContext.hosts[0]}/invoke`,\n { method: \"POST\", headers, body: JSON.stringify({ spaceId }) },\n );\n\n if (response.ok) {\n return ok(undefined);\n }\n\n if (response.status === 404) {\n // Space doesn't exist — create it\n const createHeaders = this._serviceContext.invoke(\n session,\n \"space\",\n \"public\",\n \"tinycloud.space/create\",\n );\n\n const createResponse = await this._serviceContext.fetch(\n `${this._serviceContext.hosts[0]}/invoke`,\n {\n method: \"POST\",\n headers: createHeaders,\n body: JSON.stringify({ name: \"public\" }),\n },\n );\n\n if (!createResponse.ok) {\n // 409 means it already exists — that's fine\n if (createResponse.status === 409) {\n return ok(undefined);\n }\n const errorText = await createResponse.text();\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Failed to create public space: ${createResponse.status} - ${errorText}`,\n \"public-space\",\n ),\n );\n }\n\n return ok(undefined);\n }\n\n // Other error from info check\n const errorText = await response.text();\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Failed to check public space: ${response.status} - ${errorText}`,\n \"public-space\",\n ),\n );\n } catch (error) {\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Network error ensuring public space: ${String(error)}`,\n \"public-space\",\n { cause: error instanceof Error ? error : undefined },\n ),\n );\n }\n }\n\n /**\n * Get a KVService scoped to the user's own public space.\n * Writes require authentication (owner/delegate).\n *\n * @throws Error if not signed in or services not initialized\n */\n public get publicKV(): IKVService {\n if (!this._servicesInitialized || !this._serviceContext) {\n throw new Error(\n \"Services not initialized. Call initializeServices() first, \" +\n \"or use TinyCloudWeb/TinyCloudNode which handles this automatically.\",\n );\n }\n\n const address = this.address();\n const chainId = this.chainId();\n if (!address || !chainId) {\n throw new Error(\"Must be signed in to access publicKV.\");\n }\n\n // Return cached instance if available\n if (this._publicKV) {\n return this._publicKV;\n }\n\n const publicSpaceId = makePublicSpaceId(address, chainId);\n const session = this._serviceContext.session;\n if (!session) {\n throw new Error(\"No active session. Sign in first.\");\n }\n\n // Create a KV service with a context that targets the public space\n const publicKV = new KVService({ prefix: \"\" });\n const publicContext = new ServiceContext({\n invoke: this._serviceContext.invoke,\n fetch: this._serviceContext.fetch,\n hosts: this._serviceContext.hosts,\n retryPolicy: this.config.retryPolicy,\n telemetry: this.config.telemetry,\n });\n publicContext.setSession({\n ...session,\n spaceId: publicSpaceId,\n });\n publicKV.initialize(publicContext);\n\n this._publicKV = publicKV;\n return this._publicKV;\n }\n\n /**\n * Read from any user's public space (unauthenticated).\n * Uses the public REST endpoint — no session needed.\n *\n * @param host - TinyCloud server URL (e.g., \"https://node.tinycloud.xyz\")\n * @param spaceId - Full public space ID\n * @param key - Key to read\n * @param fetchFn - Optional custom fetch function\n * @returns The data at the key\n */\n static async readPublicSpace<T = unknown>(\n host: string,\n spaceId: string,\n key: string,\n fetchFn?: FetchFunction,\n ): Promise<Result<T, ServiceError>> {\n const doFetch = fetchFn ?? globalThis.fetch.bind(globalThis);\n const encodedKey = key.split(\"/\").map(encodeURIComponent).join(\"/\");\n const url = `${host}/public/${encodeURIComponent(spaceId)}/kv/${encodedKey}`;\n\n try {\n const response = await doFetch(url, { method: \"GET\" });\n\n if (!response.ok) {\n if (response.status === 404) {\n return err(\n serviceError(\n ErrorCodes.NOT_FOUND,\n `Key not found: ${key} in space ${spaceId}`,\n \"public-space\",\n ),\n );\n }\n const errorText = await response.text();\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Failed to read public space: ${response.status} - ${errorText}`,\n \"public-space\",\n { meta: { status: response.status } },\n ),\n );\n }\n\n const contentType = response.headers.get(\"content-type\");\n let data: T;\n if (contentType?.includes(\"application/json\")) {\n data = (await response.json()) as T;\n } else {\n const text = await response.text();\n // Try parsing as JSON, fall back to raw text\n try {\n data = JSON.parse(text) as T;\n } catch {\n data = text as unknown as T;\n }\n }\n\n return ok(data);\n } catch (error) {\n return err(\n serviceError(\n ErrorCodes.NETWORK_ERROR,\n `Network error reading public space: ${String(error)}`,\n \"public-space\",\n { cause: error instanceof Error ? error : undefined },\n ),\n );\n }\n }\n\n /**\n * Read from any user's public space by address (unauthenticated).\n * Convenience method that constructs the space ID from address and chain ID.\n *\n * @param host - TinyCloud server URL\n * @param address - Ethereum address (0x-prefixed)\n * @param chainId - Chain ID (e.g., 1 for mainnet)\n * @param key - Key to read\n * @param fetchFn - Optional custom fetch function\n * @returns The data at the key\n */\n static async readPublicKey<T = unknown>(\n host: string,\n address: string,\n chainId: number,\n key: string,\n fetchFn?: FetchFunction,\n ): Promise<Result<T, ServiceError>> {\n const spaceId = makePublicSpaceId(address, chainId);\n return TinyCloud.readPublicSpace<T>(host, spaceId, key, fetchFn);\n }\n}\n","/**\n * SpaceService - Global singleton for managing spaces (owned and delegated).\n *\n * SpaceService provides a unified interface for discovering, creating,\n * and accessing spaces. It handles both owned spaces (created by the user)\n * and delegated spaces (shared by other users).\n *\n * @packageDocumentation\n */\n\nimport type {\n IDataVaultService,\n ISecretsService,\n IKVService,\n Result,\n ServiceError,\n ServiceSession,\n FetchFunction,\n InvokeFunction,\n} from \"@tinycloud/sdk-services\";\nimport { ok, err, serviceError } from \"@tinycloud/sdk-services\";\nimport type {\n SpaceInfo,\n SpaceOwnership,\n Delegation,\n CreateDelegationParams,\n ShareLink,\n GenerateShareParams,\n} from \"../delegations/types\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry\";\nimport type { ISharingService } from \"../delegations/SharingService\";\nimport {\n Space,\n type ISpace,\n type ISpaceScopedDelegations,\n type ISpaceScopedSharing,\n type SpaceConfig,\n} from \"./Space\";\nimport {\n validateServerDelegationsResponse,\n validateServerOwnedSpacesResponse,\n validateServerCreateSpaceResponse,\n validateServerSpaceInfoResponse,\n type ServerDelegationsResponse,\n} from \"./spaces.schema.js\";\nimport { EXPIRY } from \"../expiry\";\nimport {\n canonicalizeAddress,\n makePkhSpaceId,\n parsePkhDid,\n pkhDid,\n principalDidEquals,\n} from \"../identity\";\n\n// =============================================================================\n// Service Name and Error Codes\n// =============================================================================\n\nconst SERVICE_NAME = \"space\";\n\nfunction ownerDidEquals(a: string, b: string | undefined): boolean {\n if (!b) return false;\n try {\n return principalDidEquals(a, b);\n } catch {\n return a === b;\n }\n}\n\n/**\n * Error codes for SpaceService operations.\n */\nexport const SpaceErrorCodes = {\n /** Space not found */\n NOT_FOUND: \"SPACE_NOT_FOUND\",\n /** Space already exists */\n ALREADY_EXISTS: \"SPACE_ALREADY_EXISTS\",\n /** Creation failed */\n CREATION_FAILED: \"SPACE_CREATION_FAILED\",\n /** Authentication required */\n AUTH_REQUIRED: \"AUTH_REQUIRED\",\n /** Invalid space name or URI */\n INVALID_NAME: \"INVALID_SPACE_NAME\",\n /** Network error */\n NETWORK_ERROR: \"NETWORK_ERROR\",\n /** Not initialized */\n NOT_INITIALIZED: \"NOT_INITIALIZED\",\n} as const;\n\nexport type SpaceErrorCode = (typeof SpaceErrorCodes)[keyof typeof SpaceErrorCodes];\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Parameters for creating a space-scoped delegation.\n * Extends CreateDelegationParams with the spaceId.\n */\nexport interface SpaceDelegationParams extends Omit<CreateDelegationParams, \"spaceId\"> {\n /** The space ID to create the delegation for */\n spaceId: string;\n}\n\n/**\n * Function type for creating delegations.\n * Platform SDKs provide this to handle SIWE-based delegation creation.\n */\nexport type CreateDelegationFunction = (\n params: SpaceDelegationParams\n) => Promise<Result<Delegation, ServiceError>>;\n\n/**\n * Configuration for SpaceService.\n */\nexport interface SpaceServiceConfig {\n /** TinyCloud host URLs */\n hosts: string[];\n /** Active session for authentication */\n session: ServiceSession;\n /** Platform-specific invoke function */\n invoke: InvokeFunction;\n /** Optional custom fetch implementation */\n fetch?: FetchFunction;\n /** Optional capability key registry for delegated space discovery */\n capabilityRegistry?: ICapabilityKeyRegistry;\n /** Factory function to create a space-scoped KV service */\n createKVService?: (spaceId: string) => IKVService;\n /** Factory function to create a space-scoped Data Vault service */\n createVaultService?: (spaceId: string) => IDataVaultService;\n /** Factory function to create a space-scoped secrets service */\n createSecretsService?: (spaceId: string) => ISecretsService;\n /** User's PKH DID (derived from address or provided explicitly) */\n userDid?: string;\n /** Optional SharingService for v2 sharing links (client-side) */\n sharingService?: ISharingService;\n /**\n * Factory function to create delegations using SIWE-based flow.\n * Platform SDKs (web-sdk, node-sdk) provide this using their WASM bindings.\n * Required for space.delegations.create() to work.\n */\n createDelegation?: CreateDelegationFunction;\n /** Optional best-effort hook after the SDK discovers or creates a space. */\n onSpaceRegistered?: (space: SpaceInfo) => void | Promise<void>;\n}\n\n/**\n * Interface for SpaceService.\n */\nexport interface ISpaceService {\n /**\n * List all spaces the user has access to (owned + delegated).\n */\n list(): Promise<Result<SpaceInfo[], ServiceError>>;\n\n /**\n * Create a new space.\n *\n * @param name - The name for the new space\n */\n create(name: string): Promise<Result<SpaceInfo, ServiceError>>;\n\n /**\n * Get a Space object by name or full URI.\n *\n * For owned spaces, use the short name: `sdk.space('default')`\n * For delegated spaces, use the full URI: `sdk.space('tinycloud:pkh:eip155:1:0x...:photos')`\n *\n * @param nameOrUri - Short name or full URI\n */\n get(nameOrUri: string): ISpace;\n\n /**\n * Check if a space exists and the user has access.\n *\n * @param nameOrUri - Short name or full URI\n */\n exists(nameOrUri: string): Promise<Result<boolean, ServiceError>>;\n\n /**\n * Get the current user's primary space ID.\n */\n getCurrentSpaceId(): string | undefined;\n\n /**\n * Update the service configuration.\n */\n updateConfig(config: Partial<SpaceServiceConfig>): void;\n}\n\n// =============================================================================\n// Public Space Utilities\n// =============================================================================\n\n/**\n * Construct the deterministic public space ID for a given address and chain ID.\n *\n * Public space IDs follow the format:\n * `tinycloud:pkh:eip155:{chainId}:{address}:public`\n *\n * Given an address and chain ID, any client can construct this ID\n * to discover and read a user's public data without prior interaction.\n *\n * @param address - Ethereum address (0x-prefixed)\n * @param chainId - Chain ID (e.g., 1 for mainnet)\n * @returns The full public space ID URI\n *\n * @example\n * ```typescript\n * const spaceId = makePublicSpaceId('0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045', 1);\n * // => \"tinycloud:pkh:eip155:1:0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045:public\"\n * ```\n */\nexport function makePublicSpaceId(address: string, chainId: number): string {\n return makePkhSpaceId(address, chainId, \"public\");\n}\n\n// =============================================================================\n// Space URI Utilities\n// =============================================================================\n\n/**\n * Parse a space URI to extract components.\n *\n * Full URI format: `tinycloud:pkh:eip155:{chainId}:{address}:{name}`\n * Short name format: `{name}`\n *\n * @param uri - The space URI or short name\n * @returns Parsed components or null if invalid\n */\nexport function parseSpaceUri(\n uri: string\n): { owner: string; name: string; chainId?: string; address?: string } | null {\n // Full URI format: tinycloud:pkh:eip155:{chainId}:{address}:{name}\n const fullUriMatch = uri.match(\n /^tinycloud:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40}):(.+)$/\n );\n if (fullUriMatch) {\n const [, chainId, address, name] = fullUriMatch;\n try {\n const chainIdNumber = Number(chainId);\n const canonicalAddress = canonicalizeAddress(address);\n return {\n owner: pkhDid(canonicalAddress, chainIdNumber),\n name,\n chainId: String(chainIdNumber),\n address: canonicalAddress,\n };\n } catch {\n return null;\n }\n }\n\n // Short name format - just return the name, owner will be inferred\n if (/^[a-zA-Z0-9_-]+$/.test(uri)) {\n return {\n owner: \"\", // Will be filled in from session\n name: uri,\n };\n }\n\n return null;\n}\n\n/**\n * Build a full space URI from components.\n *\n * @param owner - Owner DID (did:pkh:eip155:{chainId}:{address})\n * @param name - Space name\n * @returns Full space URI\n */\nexport function buildSpaceUri(owner: string, name: string): string {\n const pkh = parsePkhDid(owner);\n if (pkh) {\n return makePkhSpaceId(pkh.address, pkh.chainId, name);\n }\n // Fallback - shouldn't happen with valid PKH DIDs\n return `tinycloud:${owner}:${name}`;\n}\n\n// =============================================================================\n// Server Response Transformation\n// =============================================================================\n\n/**\n * Transform validated server delegation response to SDK's Delegation[] format.\n *\n * Server returns { [cid: string]: DelegationInfo } where:\n * - Key is the delegation CID\n * - Value is DelegationInfo with delegator, delegate, capabilities, etc.\n *\n * SDK expects Delegation[] with cid field included.\n *\n * @param validatedData - Pre-validated server response from validateServerDelegationsResponse()\n * @param defaultSpaceId - Default space ID to use if not extractable from resource\n */\nfunction transformServerDelegations(\n validatedData: ServerDelegationsResponse,\n defaultSpaceId: string\n): Delegation[] {\n const result: Delegation[] = [];\n\n for (const [cid, info] of Object.entries(validatedData)) {\n // Extract path from capabilities (use first capability's resource path)\n const capabilities = info.capabilities;\n let path = \"\";\n let spaceId = defaultSpaceId;\n const actions: string[] = [];\n\n for (const cap of capabilities) {\n actions.push(cap.ability);\n // Parse resource to extract space and path\n // Resource format: tinycloud:pkh:eip155:{chainId}:{address}:{spaceName}/{service}/{path}\n const resourceMatch = cap.resource.match(\n /^(tinycloud:pkh:eip155:\\d+:0x[a-fA-F0-9]+:[^/]+)\\/[^/]+\\/(.*)$/\n );\n if (resourceMatch) {\n spaceId = resourceMatch[1];\n path = resourceMatch[2] || \"\";\n }\n }\n\n // Extract first string parent CID (server may return byte arrays for some CIDs)\n const firstStringParent = info.parents?.find((p): p is string => typeof p === 'string');\n\n result.push({\n cid,\n delegateDID: info.delegate,\n delegatorDID: info.delegator,\n spaceId,\n path,\n actions,\n expiry: info.expiry ? new Date(info.expiry) : new Date(Date.now() + EXPIRY.SHARE_MS),\n isRevoked: false,\n createdAt: info.issued_at ? new Date(info.issued_at) : undefined,\n parentCid: firstStringParent,\n });\n }\n\n return result;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * SpaceService - Global singleton for managing spaces.\n *\n * @example\n * ```typescript\n * const spaceService = new SpaceService({\n * hosts: ['https://node.tinycloud.xyz'],\n * session,\n * invoke,\n * });\n *\n * // List all accessible spaces\n * const result = await spaceService.list();\n * if (result.ok) {\n * for (const space of result.data) {\n * console.log(`${space.name} (${space.type})`);\n * }\n * }\n *\n * // Create a new space\n * const createResult = await spaceService.create('photos');\n *\n * // Get a space object for operations\n * const space = spaceService.get('photos');\n * await space.kv.put('album/vacation', { photos: [...] });\n * ```\n */\nexport class SpaceService implements ISpaceService {\n private hosts: string[];\n private session: ServiceSession;\n private invoke: InvokeFunction;\n private fetchFn: FetchFunction;\n private capabilityRegistry?: ICapabilityKeyRegistry;\n private createKVServiceFn?: (spaceId: string) => IKVService;\n private createVaultServiceFn?: (spaceId: string) => IDataVaultService;\n private createSecretsServiceFn?: (spaceId: string) => ISecretsService;\n private _userDid?: string;\n private sharingService?: ISharingService;\n private createDelegationFn?: CreateDelegationFunction;\n private onSpaceRegisteredFn?: (space: SpaceInfo) => void | Promise<void>;\n\n /** Cache of created Space objects */\n private spaceCache: Map<string, ISpace> = new Map();\n\n /** Cache of space info */\n private infoCache: Map<string, { info: SpaceInfo; cachedAt: number }> = new Map();\n\n /** Cache TTL in milliseconds (5 minutes) */\n private readonly cacheTTL = 5 * 60 * 1000;\n\n /**\n * Create a new SpaceService instance.\n *\n * @param config - Service configuration\n */\n constructor(config: SpaceServiceConfig) {\n this.hosts = config.hosts;\n this.session = config.session;\n this.invoke = config.invoke;\n this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n this.capabilityRegistry = config.capabilityRegistry;\n this.createKVServiceFn = config.createKVService;\n this.createVaultServiceFn = config.createVaultService;\n this.createSecretsServiceFn = config.createSecretsService;\n this._userDid = config.userDid;\n this.sharingService = config.sharingService;\n this.createDelegationFn = config.createDelegation;\n this.onSpaceRegisteredFn = config.onSpaceRegistered;\n }\n\n /**\n * Update the service configuration.\n */\n updateConfig(config: Partial<SpaceServiceConfig>): void {\n if (config.hosts) this.hosts = config.hosts;\n if (config.session) this.session = config.session;\n if (config.invoke) this.invoke = config.invoke;\n if (config.fetch) this.fetchFn = config.fetch;\n if (config.capabilityRegistry) this.capabilityRegistry = config.capabilityRegistry;\n if (config.createKVService) this.createKVServiceFn = config.createKVService;\n if (config.createVaultService) this.createVaultServiceFn = config.createVaultService;\n if (config.createSecretsService) this.createSecretsServiceFn = config.createSecretsService;\n if (config.userDid !== undefined) this._userDid = config.userDid;\n if (config.sharingService) this.sharingService = config.sharingService;\n if (config.createDelegation) this.createDelegationFn = config.createDelegation;\n if (config.onSpaceRegistered) this.onSpaceRegisteredFn = config.onSpaceRegistered;\n\n // Clear caches when config changes\n this.spaceCache.clear();\n this.infoCache.clear();\n }\n\n /**\n * Get the current user's primary space ID.\n */\n getCurrentSpaceId(): string | undefined {\n return this.session?.spaceId;\n }\n\n /**\n * Get the primary host URL.\n */\n private get host(): string {\n return this.hosts[0];\n }\n\n /**\n * Get the current user's PKH DID.\n */\n private get userDid(): string | undefined {\n // Return explicitly set user DID, or try to derive from verificationMethod\n if (this._userDid) {\n return this._userDid;\n }\n // verificationMethod might be did:key format - cannot derive PKH from it\n // The caller should provide userDid explicitly for full functionality\n return undefined;\n }\n\n // ===========================================================================\n // List Spaces\n // ===========================================================================\n\n /**\n * List all spaces the user has access to.\n *\n * Combines owned spaces (from the server) with delegated spaces\n * (from the capability registry).\n */\n async list(): Promise<Result<SpaceInfo[], ServiceError>> {\n if (!this.session) {\n return err(\n serviceError(SpaceErrorCodes.AUTH_REQUIRED, \"Authentication required\", SERVICE_NAME)\n );\n }\n\n try {\n const spaces: SpaceInfo[] = [];\n\n // 1. Get owned spaces from the server\n const ownedResult = await this.listOwnedSpaces();\n if (ownedResult.ok) {\n spaces.push(...ownedResult.data);\n }\n\n // 2. Get delegated spaces from capability registry\n if (this.capabilityRegistry) {\n const delegatedSpaces = this.discoverDelegatedSpaces();\n spaces.push(...delegatedSpaces);\n }\n\n // Remove duplicates (prefer owned over delegated)\n const uniqueSpaces = this.deduplicateSpaces(spaces);\n for (const space of uniqueSpaces) {\n this.notifySpaceRegistered(space);\n }\n\n return ok(uniqueSpaces);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list spaces: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n /**\n * List owned spaces from the server.\n */\n private async listOwnedSpaces(): Promise<Result<SpaceInfo[], ServiceError>> {\n try {\n const headers = this.invoke(this.session, \"space\", \"\", \"tinycloud.space/list\");\n\n const response = await this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list owned spaces: ${response.status} - ${errorText}`,\n SERVICE_NAME,\n { meta: { status: response.status } }\n )\n );\n }\n\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerOwnedSpacesResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const spaces: SpaceInfo[] = validationResult.data.map((item) => ({\n id: item.id,\n name: item.name ?? this.extractNameFromId(item.id),\n owner: item.owner,\n type: \"owned\" as SpaceOwnership,\n permissions: [\"*\"], // Full permissions for owned spaces\n }));\n\n return ok(spaces);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error listing owned spaces: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n /**\n * Discover delegated spaces from the capability registry.\n */\n private discoverDelegatedSpaces(): SpaceInfo[] {\n if (!this.capabilityRegistry) {\n return [];\n }\n\n const spaces: Map<string, SpaceInfo> = new Map();\n\n // Get all capabilities and extract unique space IDs\n const capabilities = this.capabilityRegistry.getAllCapabilities();\n\n for (const capability of capabilities) {\n const spaceId = capability.delegation.spaceId;\n\n // Skip if we already have this space\n if (spaces.has(spaceId)) {\n const existing = spaces.get(spaceId)!;\n // Merge permissions\n if (existing.permissions) {\n const actions = capability.delegation.actions;\n for (const action of actions) {\n if (!existing.permissions.includes(action)) {\n existing.permissions.push(action);\n }\n }\n }\n continue;\n }\n\n // Skip if this is the user's own space\n if (spaceId === this.session?.spaceId) {\n continue;\n }\n\n const parsed = parseSpaceUri(spaceId);\n\n spaces.set(spaceId, {\n id: spaceId,\n name: parsed?.name ?? this.extractNameFromId(spaceId),\n owner: capability.delegation.delegatorDID ?? parsed?.owner ?? \"\",\n type: \"delegated\",\n permissions: [...capability.delegation.actions],\n expiresAt: capability.expiresAt,\n });\n }\n\n return Array.from(spaces.values());\n }\n\n /**\n * Extract space name from a full space ID.\n */\n private extractNameFromId(id: string): string {\n const parsed = parseSpaceUri(id);\n if (parsed) {\n return parsed.name;\n }\n // Fallback: take last segment\n const parts = id.split(\":\");\n return parts[parts.length - 1] || id;\n }\n\n /**\n * Deduplicate spaces, preferring owned over delegated.\n */\n private deduplicateSpaces(spaces: SpaceInfo[]): SpaceInfo[] {\n const seen = new Map<string, SpaceInfo>();\n\n for (const space of spaces) {\n const existing = seen.get(space.id);\n if (!existing || (existing.type === \"delegated\" && space.type === \"owned\")) {\n seen.set(space.id, space);\n }\n }\n\n return Array.from(seen.values());\n }\n\n // ===========================================================================\n // Create Space\n // ===========================================================================\n\n /**\n * Create a new space.\n *\n * @param name - The name for the new space\n */\n async create(name: string): Promise<Result<SpaceInfo, ServiceError>> {\n if (!this.session) {\n return err(\n serviceError(SpaceErrorCodes.AUTH_REQUIRED, \"Authentication required\", SERVICE_NAME)\n );\n }\n\n // Validate name\n if (!name || !/^[a-zA-Z0-9_-]+$/.test(name)) {\n return err(\n serviceError(\n SpaceErrorCodes.INVALID_NAME,\n \"Space name must contain only alphanumeric characters, underscores, and hyphens\",\n SERVICE_NAME\n )\n );\n }\n\n try {\n const headers = this.invoke(this.session, \"space\", name, \"tinycloud.space/create\");\n\n const response = await this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ name }),\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n\n if (response.status === 409) {\n return err(\n serviceError(\n SpaceErrorCodes.ALREADY_EXISTS,\n `Space \"${name}\" already exists`,\n SERVICE_NAME\n )\n );\n }\n\n return err(\n serviceError(\n SpaceErrorCodes.CREATION_FAILED,\n `Failed to create space: ${response.status} - ${errorText}`,\n SERVICE_NAME,\n { meta: { status: response.status } }\n )\n );\n }\n\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerCreateSpaceResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.CREATION_FAILED,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const spaceInfo: SpaceInfo = {\n id: validationResult.data.id,\n name: validationResult.data.name || name,\n owner: validationResult.data.owner || this.userDid || \"\",\n type: \"owned\",\n permissions: [\"*\"],\n };\n\n // Cache the info\n this.infoCache.set(spaceInfo.id, { info: spaceInfo, cachedAt: Date.now() });\n this.notifySpaceRegistered(spaceInfo);\n\n return ok(spaceInfo);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error creating space: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n private notifySpaceRegistered(space: SpaceInfo): void {\n if (!this.onSpaceRegisteredFn) return;\n void Promise.resolve(this.onSpaceRegisteredFn(space)).catch(() => {\n // Account-space registration is an index maintenance side effect; it must\n // not make the canonical space operation fail.\n });\n }\n\n // ===========================================================================\n // Get Space\n // ===========================================================================\n\n /**\n * Get a Space object by name or full URI.\n *\n * @param nameOrUri - Short name or full URI\n */\n get(nameOrUri: string): ISpace {\n // Resolve the full space ID\n const spaceId = this.resolveSpaceId(nameOrUri);\n\n // Check cache\n const cached = this.spaceCache.get(spaceId);\n if (cached) {\n return cached;\n }\n\n // Create new Space object\n const parsed = parseSpaceUri(spaceId);\n const name = parsed?.name ?? this.extractNameFromId(spaceId);\n\n const config: SpaceConfig = {\n id: spaceId,\n name,\n createKV: this.createSpaceScopedKV.bind(this),\n createVault: this.createSpaceScopedVault.bind(this),\n createSecrets: this.createSpaceScopedSecrets.bind(this),\n createDelegations: this.createSpaceScopedDelegations.bind(this),\n createSharing: this.createSpaceScopedSharing.bind(this),\n getInfo: this.getSpaceInfo.bind(this),\n };\n\n const space = new Space(config);\n this.spaceCache.set(spaceId, space);\n\n return space;\n }\n\n /**\n * Resolve a name or URI to a full space ID.\n */\n private resolveSpaceId(nameOrUri: string): string {\n const parsed = parseSpaceUri(nameOrUri);\n\n if (!parsed) {\n // Invalid format, return as-is\n return nameOrUri;\n }\n\n if (parsed.owner) {\n // Full URI - return as-is\n return nameOrUri;\n }\n\n // Short name - build full URI from user's DID\n if (this.userDid) {\n return buildSpaceUri(this.userDid, parsed.name);\n }\n\n // No user DID available, return as-is\n return nameOrUri;\n }\n\n // ===========================================================================\n // Exists Check\n // ===========================================================================\n\n /**\n * Check if a space exists and the user has access.\n */\n async exists(nameOrUri: string): Promise<Result<boolean, ServiceError>> {\n const spaceId = this.resolveSpaceId(nameOrUri);\n\n // Check info cache first\n const cached = this.infoCache.get(spaceId);\n if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {\n return ok(true);\n }\n\n // Query the server\n const infoResult = await this.getSpaceInfo(spaceId);\n return ok(infoResult.ok);\n }\n\n // ===========================================================================\n // Space Info\n // ===========================================================================\n\n /**\n * Get space info from server or cache.\n */\n private async getSpaceInfo(spaceId: string): Promise<Result<SpaceInfo, ServiceError>> {\n // Check cache\n const cached = this.infoCache.get(spaceId);\n if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {\n return ok(cached.info);\n }\n\n if (!this.session) {\n return err(\n serviceError(SpaceErrorCodes.AUTH_REQUIRED, \"Authentication required\", SERVICE_NAME)\n );\n }\n\n try {\n const headers = this.invoke(this.session, \"space\", spaceId, \"tinycloud.space/info\");\n\n const response = await this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ spaceId }),\n });\n\n if (!response.ok) {\n if (response.status === 404) {\n return err(\n serviceError(SpaceErrorCodes.NOT_FOUND, `Space not found: ${spaceId}`, SERVICE_NAME)\n );\n }\n\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to get space info: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerSpaceInfoResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const data = validationResult.data;\n const spaceInfo: SpaceInfo = {\n id: data.id,\n name: data.name ?? this.extractNameFromId(data.id),\n owner: data.owner,\n type: data.type ?? (ownerDidEquals(data.owner, this.userDid) ? \"owned\" : \"delegated\"),\n permissions: data.permissions,\n expiresAt: data.expiresAt ? new Date(data.expiresAt) : undefined,\n };\n\n // Cache the info\n this.infoCache.set(spaceId, { info: spaceInfo, cachedAt: Date.now() });\n\n return ok(spaceInfo);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error getting space info: ${String(error)}`,\n SERVICE_NAME,\n { cause: error instanceof Error ? error : undefined }\n )\n );\n }\n }\n\n // ===========================================================================\n // Space-Scoped Service Factories\n // ===========================================================================\n\n /**\n * Create a space-scoped KV service.\n */\n private createSpaceScopedKV(spaceId: string): IKVService {\n if (this.createKVServiceFn) {\n return this.createKVServiceFn(spaceId);\n }\n\n // Return a proxy that throws a helpful error\n return new Proxy({} as IKVService, {\n get: () => {\n throw new Error(\n \"KV service factory not configured. Provide createKVService in SpaceServiceConfig.\"\n );\n },\n });\n }\n\n /**\n * Create a space-scoped Data Vault service.\n */\n private createSpaceScopedVault(spaceId: string): IDataVaultService {\n if (this.createVaultServiceFn) {\n return this.createVaultServiceFn(spaceId);\n }\n\n return new Proxy({} as IDataVaultService, {\n get: () => {\n throw new Error(\n \"Vault service factory not configured. Provide createVaultService in SpaceServiceConfig.\"\n );\n },\n });\n }\n\n /**\n * Create a space-scoped secrets service.\n */\n private createSpaceScopedSecrets(spaceId: string): ISecretsService {\n if (this.createSecretsServiceFn) {\n return this.createSecretsServiceFn(spaceId);\n }\n\n return new Proxy({} as ISecretsService, {\n get: () => {\n throw new Error(\n \"Secrets service factory not configured. Provide createSecretsService in SpaceServiceConfig.\"\n );\n },\n });\n }\n\n /**\n * Create space-scoped delegation operations.\n */\n private createSpaceScopedDelegations(spaceId: string): ISpaceScopedDelegations {\n const self = this;\n\n return {\n async list(): Promise<Result<Delegation[], ServiceError>> {\n // List outgoing delegations (created by user) using tinycloud.capabilities/read\n try {\n // Facts contain the query params for the capabilities/read capability\n const facts = [\n {\n capabilitiesReadParams: {\n type: \"list\",\n filters: { direction: \"created\" },\n },\n },\n ];\n\n // The capabilities/read endpoint requires path=\"all\" to match server routing\n const headers = self.invoke(\n self.session,\n \"capabilities\",\n \"all\",\n \"tinycloud.capabilities/read\",\n facts\n );\n\n const response = await self.fetchFn(`${self.host}/invoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list delegations: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n // Server returns { [cid: string]: DelegationInfo } - validate and transform to Delegation[]\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerDelegationsResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const delegations = transformServerDelegations(validationResult.data, spaceId);\n return ok(delegations);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error listing delegations: ${String(error)}`,\n SERVICE_NAME\n )\n );\n }\n },\n\n async listReceived(): Promise<Result<Delegation[], ServiceError>> {\n // List incoming delegations (received by user) using tinycloud.capabilities/read\n try {\n // Facts contain the query params for the capabilities/read capability\n const facts = [\n {\n capabilitiesReadParams: {\n type: \"list\",\n filters: { direction: \"received\" },\n },\n },\n ];\n\n // The capabilities/read endpoint requires path=\"all\" to match server routing\n const headers = self.invoke(\n self.session,\n \"capabilities\",\n \"all\",\n \"tinycloud.capabilities/read\",\n facts\n );\n\n const response = await self.fetchFn(`${self.host}/invoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to list received delegations: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n // Server returns { [cid: string]: DelegationInfo } - validate and transform to Delegation[]\n const rawData = await response.json();\n\n // Validate server response\n const validationResult = validateServerDelegationsResponse(rawData);\n if (!validationResult.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n validationResult.error.message,\n SERVICE_NAME,\n { meta: validationResult.error.meta }\n )\n );\n }\n\n const delegations = transformServerDelegations(validationResult.data, spaceId);\n return ok(delegations);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error listing received delegations: ${String(error)}`,\n SERVICE_NAME\n )\n );\n }\n },\n\n async create(\n params: Omit<CreateDelegationParams, \"spaceId\">\n ): Promise<Result<Delegation, ServiceError>> {\n // Use the platform-provided createDelegation function (SIWE-based flow)\n if (self.createDelegationFn) {\n return self.createDelegationFn({ ...params, spaceId });\n }\n\n // Fallback: return error if no createDelegation function provided\n // The old invoke-based approach doesn't work because /delegate expects\n // SIWE delegation headers, not invocation headers\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"Delegation creation requires a createDelegation function. \" +\n \"This should be provided by the platform SDK (web-sdk or node-sdk).\",\n SERVICE_NAME\n )\n );\n },\n\n async revoke(cid: string): Promise<Result<void, ServiceError>> {\n try {\n const headers = self.invoke(\n self.session,\n \"delegation\",\n cid,\n \"tinycloud.delegation/revoke\"\n );\n\n const response = await self.fetchFn(`${self.host}/revoke`, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ cid, spaceId }),\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Failed to revoke delegation: ${response.status} - ${errorText}`,\n SERVICE_NAME\n )\n );\n }\n\n return ok(undefined);\n } catch (error) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n `Network error revoking delegation: ${String(error)}`,\n SERVICE_NAME\n )\n );\n }\n },\n };\n }\n\n /**\n * Create space-scoped sharing operations.\n *\n * When a SharingService is configured, delegates to client-side v2 sharing.\n * V2 sharing links are self-contained with embedded private keys - no server tracking.\n */\n private createSpaceScopedSharing(spaceId: string): ISpaceScopedSharing {\n const self = this;\n\n return {\n async generate(\n params: Omit<GenerateShareParams, \"spaceId\">\n ): Promise<Result<ShareLink, ServiceError>> {\n // Use v2 SharingService when available (client-side sharing links)\n if (self.sharingService) {\n // Note: SharingService uses session.spaceId for the space.\n // For space-scoped sharing on delegated spaces, ensure the session\n // is configured for the correct space before calling generate().\n const result = await self.sharingService.generate(params);\n if (!result.ok) {\n return err(\n serviceError(\n SpaceErrorCodes.NETWORK_ERROR,\n result.error.message || \"Failed to generate share link\",\n SERVICE_NAME\n )\n );\n }\n return ok(result.data);\n }\n\n // Fallback: return error since server endpoint doesn't exist\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"SharingService not configured. V2 sharing requires a SharingService instance.\",\n SERVICE_NAME\n )\n );\n },\n\n async list(): Promise<Result<ShareLink[], ServiceError>> {\n // V2 sharing links are self-contained (not server-tracked)\n // This operation is not supported in the v2 spec\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"Listing share links is not supported in v2. Share links are self-contained tokens that are not tracked on the server.\",\n SERVICE_NAME\n )\n );\n },\n\n async revoke(token: string): Promise<Result<void, ServiceError>> {\n // V2 sharing links are revoked by revoking the underlying delegation\n // This requires the delegation CID, not the share token\n return err(\n serviceError(\n SpaceErrorCodes.NOT_INITIALIZED,\n \"Revoking share links by token is not supported in v2. To revoke access, revoke the underlying delegation using space.delegations.revoke(cid).\",\n SERVICE_NAME\n )\n );\n },\n };\n }\n}\n\n/**\n * Create a new SpaceService instance.\n *\n * @param config - Service configuration\n * @returns A new SpaceService instance\n */\nexport function createSpaceService(config: SpaceServiceConfig): ISpaceService {\n return new SpaceService(config);\n}\n","/**\n * Space - Represents a scoped access point to a TinyCloud space.\n *\n * The Space object provides scoped access to services within a specific space,\n * whether owned by the user or delegated from another user.\n *\n * @packageDocumentation\n */\n\nimport type {\n IDataVaultService,\n ISecretsService,\n IKVService,\n Result,\n ServiceError,\n} from \"@tinycloud/sdk-services\";\nimport type { SpaceInfo } from \"../delegations/types\";\n\n/**\n * Interface for space-scoped delegation operations.\n *\n * Provides delegation management scoped to a specific space.\n */\nexport interface ISpaceScopedDelegations {\n /**\n * List delegations created by the user in this space (outgoing).\n */\n list(): Promise<Result<import(\"../delegations/types\").Delegation[], ServiceError>>;\n\n /**\n * List delegations received by the user for this space (incoming).\n */\n listReceived(): Promise<Result<import(\"../delegations/types\").Delegation[], ServiceError>>;\n\n /**\n * Create a delegation within this space.\n */\n create(\n params: Omit<import(\"../delegations/types\").CreateDelegationParams, \"spaceId\">\n ): Promise<Result<import(\"../delegations/types\").Delegation, ServiceError>>;\n\n /**\n * Revoke a delegation within this space.\n */\n revoke(cid: string): Promise<Result<void, ServiceError>>;\n}\n\n/**\n * Interface for space-scoped sharing operations.\n *\n * Provides sharing link management scoped to a specific space.\n */\nexport interface ISpaceScopedSharing {\n /**\n * Generate a sharing link for a resource in this space.\n */\n generate(\n params: Omit<import(\"../delegations/types\").GenerateShareParams, \"spaceId\">\n ): Promise<Result<import(\"../delegations/types\").ShareLink, ServiceError>>;\n\n /**\n * List active sharing links in this space.\n */\n list(): Promise<Result<import(\"../delegations/types\").ShareLink[], ServiceError>>;\n\n /**\n * Revoke a sharing link.\n */\n revoke(token: string): Promise<Result<void, ServiceError>>;\n}\n\n/**\n * Interface for a Space object.\n *\n * Provides scoped access to services within a specific space.\n */\nexport interface ISpace {\n /**\n * The space identifier.\n */\n readonly id: string;\n\n /**\n * The short name of the space.\n */\n readonly name: string;\n\n /**\n * KV operations scoped to this space.\n */\n readonly kv: IKVService;\n\n /**\n * Data Vault operations scoped to this space.\n */\n readonly vault: IDataVaultService;\n\n /**\n * Secrets operations scoped to this space.\n */\n readonly secrets: ISecretsService;\n\n /**\n * Delegation operations scoped to this space.\n */\n readonly delegations: ISpaceScopedDelegations;\n\n /**\n * Sharing operations scoped to this space.\n */\n readonly sharing: ISpaceScopedSharing;\n\n /**\n * Get space metadata.\n */\n info(): Promise<Result<SpaceInfo, ServiceError>>;\n}\n\n/**\n * Configuration for creating a Space object.\n */\nexport interface SpaceConfig {\n /**\n * The space identifier (full URI).\n */\n id: string;\n\n /**\n * The short name of the space.\n */\n name: string;\n\n /**\n * Factory function to create a space-scoped KV service.\n */\n createKV: (spaceId: string) => IKVService;\n\n /**\n * Factory function to create a space-scoped Data Vault service.\n */\n createVault: (spaceId: string) => IDataVaultService;\n\n /**\n * Factory function to create a space-scoped secrets service.\n */\n createSecrets?: (spaceId: string) => ISecretsService;\n\n /**\n * Factory function to create space-scoped delegations.\n */\n createDelegations: (spaceId: string) => ISpaceScopedDelegations;\n\n /**\n * Factory function to create space-scoped sharing.\n */\n createSharing: (spaceId: string) => ISpaceScopedSharing;\n\n /**\n * Function to get space info.\n */\n getInfo: (spaceId: string) => Promise<Result<SpaceInfo, ServiceError>>;\n}\n\nfunction unavailableSecretsService(): ISecretsService {\n return new Proxy({} as ISecretsService, {\n get: () => {\n throw new Error(\n \"Secrets service factory not configured. Provide createSecrets in SpaceConfig.\"\n );\n },\n });\n}\n\n/**\n * Space - Provides scoped access to services within a specific space.\n *\n * @example\n * ```typescript\n * const space = sdk.space('default');\n *\n * // KV operations scoped to this space\n * await space.kv.put('key', 'value');\n * const result = await space.kv.get('key');\n *\n * // Delegation operations scoped to this space\n * await space.delegations.create({\n * delegateDID: 'did:pkh:eip155:1:0x...',\n * path: '/shared/',\n * actions: ['tinycloud.kv/get']\n * });\n *\n * // Get space metadata\n * const info = await space.info();\n * ```\n */\nexport class Space implements ISpace {\n private readonly _id: string;\n private readonly _name: string;\n private readonly _kv: IKVService;\n private readonly _vault: IDataVaultService;\n private readonly _secrets: ISecretsService;\n private readonly _delegations: ISpaceScopedDelegations;\n private readonly _sharing: ISpaceScopedSharing;\n private readonly _getInfo: (spaceId: string) => Promise<Result<SpaceInfo, ServiceError>>;\n\n /**\n * Create a new Space instance.\n *\n * @param config - Space configuration\n */\n constructor(config: SpaceConfig) {\n this._id = config.id;\n this._name = config.name;\n this._kv = config.createKV(config.id);\n this._vault = config.createVault(config.id);\n this._secrets = config.createSecrets?.(config.id) ?? unavailableSecretsService();\n this._delegations = config.createDelegations(config.id);\n this._sharing = config.createSharing(config.id);\n this._getInfo = config.getInfo;\n }\n\n /**\n * The space identifier (full URI).\n */\n get id(): string {\n return this._id;\n }\n\n /**\n * The short name of the space.\n */\n get name(): string {\n return this._name;\n }\n\n /**\n * KV operations scoped to this space.\n */\n get kv(): IKVService {\n return this._kv;\n }\n\n /**\n * Data Vault operations scoped to this space.\n */\n get vault(): IDataVaultService {\n return this._vault;\n }\n\n /**\n * Secrets operations scoped to this space.\n */\n get secrets(): ISecretsService {\n return this._secrets;\n }\n\n /**\n * Delegation operations scoped to this space.\n */\n get delegations(): ISpaceScopedDelegations {\n return this._delegations;\n }\n\n /**\n * Sharing operations scoped to this space.\n */\n get sharing(): ISpaceScopedSharing {\n return this._sharing;\n }\n\n /**\n * Get space metadata.\n *\n * @returns Result containing space information\n */\n async info(): Promise<Result<SpaceInfo, ServiceError>> {\n return this._getInfo(this._id);\n }\n}\n","/**\n * Zod schemas for Space and SpaceService configuration types.\n *\n * These schemas provide runtime validation for space management types.\n * Types are derived from schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type { Result, ServiceError } from \"@tinycloud/sdk-services\";\nimport { CreateDelegationParamsSchema } from \"../delegations/types.schema.js\";\n\n// =============================================================================\n// Validation Error Type\n// =============================================================================\n\n/**\n * Validation error type for schema validation failures.\n */\nexport interface ValidationError extends ServiceError {\n code: \"VALIDATION_ERROR\";\n meta?: {\n issues: z.ZodIssue[];\n path?: string;\n };\n}\n\n// =============================================================================\n// SpaceConfig Schema\n// =============================================================================\n\n/**\n * Configuration for creating a Space object.\n *\n * Contains the space identifier, name, and factory functions for creating\n * space-scoped services.\n */\nexport const SpaceConfigSchema = z.object({\n /** The space identifier (full URI) */\n id: z.string(),\n /** The short name of the space */\n name: z.string(),\n /** Factory function to create a space-scoped KV service */\n createKV: z.function(),\n /** Factory function to create a space-scoped Data Vault service */\n createVault: z.function(),\n /** Optional factory function to create a space-scoped secrets service */\n createSecrets: z.function().optional(),\n /** Factory function to create space-scoped delegations */\n createDelegations: z.function(),\n /** Factory function to create space-scoped sharing */\n createSharing: z.function(),\n /** Function to get space info */\n getInfo: z.function(),\n});\n\nexport type SpaceConfig = z.infer<typeof SpaceConfigSchema>;\n\n// =============================================================================\n// SpaceServiceConfig Schema\n// =============================================================================\n\n/**\n * Configuration for SpaceService.\n *\n * Contains all the dependencies needed for the SpaceService to manage\n * spaces, including hosts, session, and factory functions.\n */\nexport const SpaceServiceConfigSchema = z.object({\n /** TinyCloud host URLs */\n hosts: z.array(z.string()),\n /** Active session for authentication */\n session: z.unknown(),\n /** Platform-specific invoke function */\n invoke: z.function(),\n /** Optional custom fetch implementation */\n fetch: z.function().optional(),\n /** Optional capability key registry for delegated space discovery */\n capabilityRegistry: z.unknown().optional(),\n /** Factory function to create a space-scoped KV service */\n createKVService: z.function().optional(),\n /** Factory function to create a space-scoped Data Vault service */\n createVaultService: z.function().optional(),\n /** Factory function to create a space-scoped secrets service */\n createSecretsService: z.function().optional(),\n /** User's PKH DID (derived from address or provided explicitly) */\n userDid: z.string().optional(),\n /** Optional SharingService for v2 sharing links (client-side) */\n sharingService: z.unknown().optional(),\n /** Factory function to create delegations using SIWE-based flow */\n createDelegation: z.function().optional(),\n});\n\nexport type SpaceServiceConfig = z.infer<typeof SpaceServiceConfigSchema>;\n\n// =============================================================================\n// SpaceDelegationParams Schema\n// =============================================================================\n\n/**\n * Parameters for creating a space-scoped delegation.\n *\n * Extends CreateDelegationParams with the spaceId field.\n */\nexport const SpaceDelegationParamsSchema = CreateDelegationParamsSchema.extend({\n /** The space ID to create the delegation for */\n spaceId: z.string(),\n});\n\nexport type SpaceDelegationParams = z.infer<typeof SpaceDelegationParamsSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validate a SpaceConfig object against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validateSpaceConfig(config);\n * if (result.ok) {\n * const space = new Space(result.data);\n * } else {\n * console.error(\"Invalid config:\", result.error.message);\n * }\n * ```\n */\nexport function validateSpaceConfig(\n data: unknown\n): Result<SpaceConfig, ValidationError> {\n const result = SpaceConfigSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate a SpaceServiceConfig object against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validateSpaceServiceConfig(config);\n * if (result.ok) {\n * const service = new SpaceService(result.data);\n * } else {\n * console.error(\"Invalid config:\", result.error.message);\n * }\n * ```\n */\nexport function validateSpaceServiceConfig(\n data: unknown\n): Result<SpaceServiceConfig, ValidationError> {\n const result = SpaceServiceConfigSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate a SpaceDelegationParams object against the schema.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const result = validateSpaceDelegationParams(params);\n * if (result.ok) {\n * await createDelegation(result.data);\n * } else {\n * console.error(\"Invalid params:\", result.error.message);\n * }\n * ```\n */\nexport function validateSpaceDelegationParams(\n data: unknown\n): Result<SpaceDelegationParams, ValidationError> {\n const result = SpaceDelegationParamsSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: result.error.message,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n// =============================================================================\n// Server Response Schemas\n// =============================================================================\n\n/**\n * Server's DelegationInfo structure (from capabilities/read response).\n * This schema validates the shape of delegation data received from the server.\n */\nexport const ServerDelegationInfoSchema = z.object({\n /** DID of the delegator */\n delegator: z.string(),\n /** DID of the delegate */\n delegate: z.string(),\n /** Parent delegation CIDs - accepts string or byte array format from server */\n parents: z.array(z.union([z.string(), z.array(z.number())])),\n /** Expiration time (ISO8601 string) */\n expiry: z.string().optional(),\n /** Not-before time (ISO8601 string) */\n not_before: z.string().optional(),\n /** Issued-at time (ISO8601 string) */\n issued_at: z.string().optional(),\n /** Capabilities granted by this delegation */\n capabilities: z.array(\n z.object({\n resource: z.string(),\n ability: z.string(),\n })\n ),\n});\n\nexport type ServerDelegationInfo = z.infer<typeof ServerDelegationInfoSchema>;\n\n/**\n * Server response for capabilities/read endpoint.\n * Returns a record mapping CID -> DelegationInfo.\n */\nexport const ServerDelegationsResponseSchema = z.record(\n z.string(),\n ServerDelegationInfoSchema\n);\n\nexport type ServerDelegationsResponse = z.infer<typeof ServerDelegationsResponseSchema>;\n\n/**\n * Server response for space/list endpoint.\n * Returns an array of owned space info.\n */\nexport const ServerOwnedSpaceSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Space name (optional, can be derived from id) */\n name: z.string().optional(),\n /** Owner DID */\n owner: z.string(),\n /** Creation timestamp */\n createdAt: z.string().optional(),\n});\n\nexport type ServerOwnedSpace = z.infer<typeof ServerOwnedSpaceSchema>;\n\nexport const ServerOwnedSpacesResponseSchema = z.array(ServerOwnedSpaceSchema);\n\nexport type ServerOwnedSpacesResponse = z.infer<typeof ServerOwnedSpacesResponseSchema>;\n\n/**\n * Server response for space/create endpoint.\n */\nexport const ServerCreateSpaceResponseSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Space name */\n name: z.string(),\n /** Owner DID */\n owner: z.string(),\n /** Creation timestamp */\n createdAt: z.string().optional(),\n});\n\nexport type ServerCreateSpaceResponse = z.infer<typeof ServerCreateSpaceResponseSchema>;\n\n/**\n * Server response for space/info endpoint.\n */\nexport const ServerSpaceInfoResponseSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Space name (optional) */\n name: z.string().optional(),\n /** Owner DID */\n owner: z.string(),\n /** Ownership type */\n type: z.enum([\"owned\", \"delegated\"]).optional(),\n /** Permissions the user has in this space */\n permissions: z.array(z.string()).optional(),\n /** Expiration for delegated access */\n expiresAt: z.string().optional(),\n});\n\nexport type ServerSpaceInfoResponse = z.infer<typeof ServerSpaceInfoResponseSchema>;\n\n// =============================================================================\n// Server Response Validation Helpers\n// =============================================================================\n\n/**\n * Validate server delegations response (capabilities/read).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerDelegationsResponse(\n data: unknown\n): Result<ServerDelegationsResponse, ValidationError> {\n // Handle null/undefined as empty response\n if (data === null || data === undefined) {\n return { ok: true, data: {} };\n }\n\n // Handle array format (legacy compatibility) - return as-is, validation happens elsewhere\n if (Array.isArray(data)) {\n return { ok: true, data: {} };\n }\n\n const result = ServerDelegationsResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server delegations response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate server owned spaces response (space/list).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerOwnedSpacesResponse(\n data: unknown\n): Result<ServerOwnedSpacesResponse, ValidationError> {\n const result = ServerOwnedSpacesResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server owned spaces response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate server create space response (space/create).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerCreateSpaceResponse(\n data: unknown\n): Result<ServerCreateSpaceResponse, ValidationError> {\n const result = ServerCreateSpaceResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server create space response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validate server space info response (space/info).\n *\n * @param data - Unknown data from server\n * @returns Result with validated data or validation error\n */\nexport function validateServerSpaceInfoResponse(\n data: unknown\n): Result<ServerSpaceInfoResponse, ValidationError> {\n const result = ServerSpaceInfoResponseSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: \"VALIDATION_ERROR\",\n message: `Invalid server space info response: ${result.error.message}`,\n service: \"space\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n","/**\n * Zod schemas for delegation management types.\n *\n * These schemas provide runtime validation for delegation, capability key management,\n * and sharing link functionality. Types are derived from schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n FetchFunction,\n InvokeAnyFunction,\n InvokeFunction,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\n\n// =============================================================================\n// Result Type (Generic)\n// =============================================================================\n\n/**\n * Creates a Result schema for a given data type and error type.\n * Result types provide explicit error handling instead of throwing.\n */\nexport function createResultSchema<T extends z.ZodTypeAny, E extends z.ZodTypeAny>(\n dataSchema: T,\n errorSchema: E\n) {\n return z.discriminatedUnion(\"ok\", [\n z.object({ ok: z.literal(true), data: dataSchema }),\n z.object({ ok: z.literal(false), error: errorSchema }),\n ]);\n}\n\n/**\n * Result type pattern for delegation operations.\n */\nexport type Result<T, E = DelegationError> =\n | { ok: true; data: T }\n | { ok: false; error: E };\n\n// =============================================================================\n// JWK Type (JSON Web Key)\n// =============================================================================\n\n/**\n * JSON Web Key representation for cryptographic keys.\n * Follows the JWK specification (RFC 7517).\n */\nexport const JWKSchema = z.object({\n /** Key type (e.g., \"EC\", \"RSA\", \"OKP\") */\n kty: z.string(),\n /** Curve for EC/OKP keys (e.g., \"P-256\", \"Ed25519\") */\n crv: z.string().optional(),\n /** X coordinate for EC keys, public key for OKP */\n x: z.string().optional(),\n /** Y coordinate for EC keys */\n y: z.string().optional(),\n /** Private key value (d parameter) */\n d: z.string().optional(),\n /** Public exponent for RSA keys */\n e: z.string().optional(),\n /** Modulus for RSA keys */\n n: z.string().optional(),\n /** Key ID */\n kid: z.string().optional(),\n /** Algorithm */\n alg: z.string().optional(),\n /** Key use (e.g., \"sig\", \"enc\") */\n use: z.string().optional(),\n /** Key operations (e.g., [\"sign\", \"verify\"]) */\n key_ops: z.array(z.string()).optional(),\n});\n\nexport type JWK = z.infer<typeof JWKSchema>;\n\n// =============================================================================\n// Key Management Types\n// =============================================================================\n\n/**\n * Type of key in the capability registry.\n */\nexport const KeyTypeSchema = z.enum([\"main\", \"session\", \"ingested\"]);\nexport type KeyType = z.infer<typeof KeyTypeSchema>;\n\n/**\n * Information about a cryptographic key used for delegations.\n */\nexport const KeyInfoSchema = z.object({\n /** Unique identifier for this key */\n id: z.string(),\n /** DID associated with this key */\n did: z.string(),\n /** Type of key determining its authority level */\n type: KeyTypeSchema,\n /** Private key in JWK format */\n jwk: JWKSchema.optional(),\n /** Priority for key selection (lower = higher priority) */\n priority: z.number(),\n});\n\nexport type KeyInfo = z.infer<typeof KeyInfoSchema>;\n\n// =============================================================================\n// Error Types\n// =============================================================================\n\n/**\n * Error type for delegation operations.\n */\nexport const DelegationErrorSchema = z.object({\n /** Error code for programmatic handling */\n code: z.string(),\n /** Human-readable error message */\n message: z.string(),\n /** The service that produced the error */\n service: z.literal(\"delegation\"),\n /** Original error if wrapping another error */\n cause: z.instanceof(Error).optional(),\n /** Additional metadata about the error */\n meta: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type DelegationError = z.infer<typeof DelegationErrorSchema>;\n\n/**\n * Error codes for delegation operations.\n */\nexport const DelegationErrorCodes = {\n AUTH_REQUIRED: \"AUTH_REQUIRED\",\n AUTH_EXPIRED: \"AUTH_EXPIRED\",\n NOT_INITIALIZED: \"NOT_INITIALIZED\",\n NOT_FOUND: \"NOT_FOUND\",\n REVOKED: \"REVOKED\",\n NETWORK_ERROR: \"NETWORK_ERROR\",\n TIMEOUT: \"TIMEOUT\",\n ABORTED: \"ABORTED\",\n INVALID_INPUT: \"INVALID_INPUT\",\n PERMISSION_DENIED: \"PERMISSION_DENIED\",\n CREATION_FAILED: \"CREATION_FAILED\",\n REVOCATION_FAILED: \"REVOCATION_FAILED\",\n INVALID_TOKEN: \"INVALID_TOKEN\",\n KV_SERVICE_UNAVAILABLE: \"KV_SERVICE_UNAVAILABLE\",\n DATA_FETCH_FAILED: \"DATA_FETCH_FAILED\",\n VALIDATION_ERROR: \"VALIDATION_ERROR\",\n} as const;\n\nexport type DelegationErrorCode =\n (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];\n\n// =============================================================================\n// Delegation Types\n// =============================================================================\n\n/**\n * Represents a delegation from one DID to another.\n */\nexport const DelegationSchema = z.object({\n /** Content identifier (CID) of the delegation */\n cid: z.string(),\n /** DID of the delegate (the party receiving the delegation) */\n delegateDID: z.string(),\n /** Space ID this delegation applies to */\n spaceId: z.string(),\n /** Resource path this delegation grants access to */\n path: z.string(),\n /** Actions this delegation authorizes */\n actions: z.array(z.string()),\n /** Exact ReCap caveats that constrain every action in this scope. */\n caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n /** When this delegation expires (accepts Date or ISO string from JSON) */\n expiry: z.coerce.date(),\n /** Whether this delegation has been revoked */\n isRevoked: z.boolean(),\n /** DID of the delegator (the party granting the delegation) */\n delegatorDID: z.string().optional(),\n /** When this delegation was created (accepts Date or ISO string from JSON) */\n createdAt: z.coerce.date().optional(),\n /** Parent delegation CID if this is a sub-delegation */\n parentCid: z.string().optional(),\n /** Whether sub-delegation is allowed */\n allowSubDelegation: z.boolean().optional(),\n /** Authorization header (UCAN bearer token) */\n authHeader: z.string().optional(),\n});\n\nexport type Delegation = z.infer<typeof DelegationSchema>;\n\n/** Node-confirmed lifecycle state for one delegation. */\nexport const DelegationStatusSchema = z.object({\n cid: z.string().min(1),\n status: z.enum([\"active\", \"revoked\", \"expired\", \"unavailable\", \"not_found\"]),\n exists: z.boolean(),\n active: z.boolean(),\n revoked: z.boolean(),\n expired: z.boolean(),\n}).strict().superRefine((value, context) => {\n const valid = value.status === \"active\"\n ? value.exists && value.active && !value.revoked && !value.expired\n : value.status === \"revoked\"\n ? value.exists && !value.active && value.revoked && !value.expired\n : value.status === \"expired\"\n ? value.exists && !value.active && !value.revoked && value.expired\n : value.status === \"unavailable\"\n ? value.exists && !value.active && !value.revoked && !value.expired\n : !value.exists && !value.active && !value.revoked && !value.expired;\n if (!valid) {\n context.addIssue({\n code: z.ZodIssueCode.custom,\n message: \"delegation status flags do not match status\",\n });\n }\n});\n\nexport type DelegationStatus = z.infer<typeof DelegationStatusSchema>;\n\nexport const DelegationRevocationReceiptSchema = z.object({\n revoked: z.literal(true),\n cid: z.string().min(1),\n}).strict();\n\nexport type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;\n\nexport const AccountDelegationResourceSchema = z.object({\n resource: z.string().min(1),\n actions: z.array(z.string()),\n caveats: z.array(z.record(z.string(), z.unknown())),\n}).strict();\n\nconst AccountDelegationDateSchema = z\n .string()\n .datetime({ offset: true })\n .transform((value) => new Date(value));\n\nexport const AccountDelegationRecordSchema = z.object({\n cid: z.string().min(1),\n direction: z.enum([\"granted\", \"received\"]),\n delegatorDid: z.string().min(1),\n delegateDid: z.string().min(1),\n resources: z.array(AccountDelegationResourceSchema),\n parents: z.array(z.string()),\n issuedAt: AccountDelegationDateSchema.nullable(),\n notBefore: AccountDelegationDateSchema.nullable(),\n expiresAt: AccountDelegationDateSchema.nullable(),\n status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]),\n revokedAt: AccountDelegationDateSchema.nullable().optional(),\n revokedBy: z.string().optional(),\n revokedAncestorCid: z.string().optional(),\n}).strict();\n\nexport const AccountDelegationPageSchema = z.object({\n schemaVersion: z.literal(2),\n items: z.array(AccountDelegationRecordSchema),\n nextCursor: z.string().optional(),\n}).strict();\n\nexport type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;\nexport type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;\nexport type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;\n\nexport const AccountDelegationQueryOptionsSchema = z.object({\n direction: z.enum([\"granted\", \"received\", \"all\"]).optional(),\n status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]).optional(),\n space: z.string().trim().min(1).optional(),\n limit: z.number().int().min(1).max(100).optional(),\n cursor: z.string().min(1).optional(),\n}).strict();\n\nexport type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;\n\n/**\n * Entry in the capability registry mapping a capability to available keys.\n */\nexport const CapabilityEntrySchema = z.object({\n /** Resource URI this capability applies to */\n resource: z.string(),\n /** Action this capability authorizes */\n action: z.string(),\n /** Keys that can exercise this capability, ordered by priority */\n keys: z.array(KeyInfoSchema),\n /** The delegation that grants this capability */\n delegation: DelegationSchema,\n /** When this capability expires (accepts Date or ISO string from JSON) */\n expiresAt: z.coerce.date().optional(),\n});\n\nexport type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;\n\n/**\n * Persistent record of a delegation stored in the system.\n */\nexport const DelegationRecordSchema = z.object({\n /** Content identifier (CID) of the delegation */\n cid: z.string(),\n /** Space ID this delegation applies to */\n spaceId: z.string(),\n /** DID of the delegator (grantor) */\n delegator: z.string(),\n /** DID of the delegatee (recipient) */\n delegatee: z.string(),\n /** Key ID used to sign/exercise this delegation */\n keyId: z.string().optional(),\n /** Resource path pattern this delegation grants access to */\n path: z.string(),\n /** Actions this delegation authorizes */\n actions: z.array(z.string()),\n /** When this delegation expires (accepts Date or ISO string from JSON) */\n expiry: z.coerce.date().optional(),\n /** When this delegation becomes valid (not before) (accepts Date or ISO string) */\n notBefore: z.coerce.date().optional(),\n /** Whether this delegation has been revoked */\n isRevoked: z.boolean(),\n /** When this delegation was created (accepts Date or ISO string from JSON) */\n createdAt: z.coerce.date(),\n /** Parent delegation CID if this is a sub-delegation */\n parentCid: z.string().optional(),\n});\n\nexport type DelegationRecord = z.infer<typeof DelegationRecordSchema>;\n\n/**\n * Parameters for creating a new delegation.\n */\nexport const CreateDelegationParamsSchema = z.object({\n /** DID of the delegate (the party receiving the delegation) */\n delegateDID: z.string(),\n /** Resource path this delegation grants access to */\n path: z.string(),\n /** Actions to authorize */\n actions: z.array(z.string()),\n /** When this delegation expires (accepts Date or ISO string) */\n expiry: z.coerce.date().optional(),\n /** Whether to disable sub-delegation */\n disableSubDelegation: z.boolean().optional(),\n /** Optional statement for the SIWE message */\n statement: z.string().optional(),\n});\n\nexport type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;\n\n/**\n * A chain of delegations from root to leaf (array format).\n */\nexport const DelegationChainSchema = z.array(DelegationSchema);\nexport type DelegationChain = z.infer<typeof DelegationChainSchema>;\n\n/**\n * Structured delegation chain (v2 spec).\n */\nexport const DelegationChainV2Schema = z.object({\n /** The root delegation from the original authority */\n root: DelegationSchema,\n /** Intermediate delegations in the chain (may be empty) */\n chain: z.array(DelegationSchema),\n /** The final delegation to the current user */\n leaf: DelegationSchema,\n});\n\nexport type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;\n\n// =============================================================================\n// Filtering and Query Types\n// =============================================================================\n\n/**\n * Direction of delegation to filter by.\n */\nexport const DelegationDirectionSchema = z.enum([\"granted\", \"received\", \"all\"]);\nexport type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;\n\n/**\n * Filters for listing delegations.\n */\nexport const DelegationFiltersSchema = z.object({\n /** Filter by delegation direction */\n direction: DelegationDirectionSchema.optional(),\n /** Filter by resource path pattern */\n path: z.string().optional(),\n /** Filter by required actions */\n actions: z.array(z.string()).optional(),\n /** Include revoked delegations */\n includeRevoked: z.boolean().optional(),\n /** Filter by delegator DID */\n delegator: z.string().optional(),\n /** Filter by delegatee DID */\n delegatee: z.string().optional(),\n /** Only include delegations valid at this time */\n validAt: z.coerce.date().optional(),\n /** Maximum number of results to return */\n limit: z.number().optional(),\n /** Cursor for pagination */\n cursor: z.string().optional(),\n});\n\nexport type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;\n\n// =============================================================================\n// Space Types\n// =============================================================================\n\n/**\n * Type of space ownership.\n */\nexport const SpaceOwnershipSchema = z.enum([\"owned\", \"delegated\"]);\nexport type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;\n\n/**\n * Information about a space the user has access to.\n */\nexport const SpaceInfoSchema = z.object({\n /** Space identifier */\n id: z.string(),\n /** Human-readable name for the space */\n name: z.string().optional(),\n /** DID of the space owner */\n owner: z.string(),\n /** Whether user owns or has delegated access */\n type: SpaceOwnershipSchema,\n /** Permissions the user has in this space */\n permissions: z.array(z.string()).optional(),\n /** When the access expires (for delegated spaces) */\n expiresAt: z.coerce.date().optional(),\n});\n\nexport type SpaceInfo = z.infer<typeof SpaceInfoSchema>;\n\n// =============================================================================\n// Share Link Types\n// =============================================================================\n\n/**\n * Schema for encoding share link data.\n */\nexport const ShareSchemaSchema = z.enum([\"base64\", \"compact\", \"ipfs\"]);\nexport type ShareSchema = z.infer<typeof ShareSchemaSchema>;\n\n/**\n * A shareable link containing delegation credentials.\n */\nexport const ShareLinkSchema = z.object({\n /** Unique token identifying this share link */\n token: z.string(),\n /** Full URL for sharing */\n url: z.string(),\n /** The delegation this link grants access to */\n delegation: DelegationSchema,\n /** Encoding schema used for the link */\n schema: ShareSchemaSchema,\n /** When this share link expires */\n expiresAt: z.coerce.date().optional(),\n /** Human-readable description of what is being shared */\n description: z.string().optional(),\n});\n\nexport type ShareLink = z.infer<typeof ShareLinkSchema>;\n\n/**\n * Data retrieved from a share link.\n */\nexport function createShareLinkDataSchema<T extends z.ZodTypeAny>(dataSchema: T) {\n return z.object({\n /** The retrieved data */\n data: dataSchema,\n /** The delegation that authorized this access */\n delegation: DelegationSchema,\n /** The space the data belongs to */\n spaceId: z.string(),\n /** The resource path that was accessed */\n path: z.string(),\n });\n}\n\nexport const ShareLinkDataSchema = createShareLinkDataSchema(z.unknown());\nexport type ShareLinkData<T = unknown> = {\n data: T;\n delegation: Delegation;\n spaceId: string;\n path: string;\n};\n\n// =============================================================================\n// Ingestion Types\n// =============================================================================\n\n/**\n * Options for ingesting an external delegation.\n */\nexport const IngestOptionsSchema = z.object({\n /** Whether to persist the delegation to storage */\n persist: z.boolean().optional(),\n /** Whether to validate the full delegation chain */\n validateChain: z.boolean().optional(),\n /** Name for the ingested key */\n keyName: z.string().optional(),\n /** Whether to create a session key for this delegation */\n createSessionKey: z.boolean().optional(),\n /** Override the priority for the ingested key */\n priority: z.number().optional(),\n});\n\nexport type IngestOptions = z.infer<typeof IngestOptionsSchema>;\n\n// =============================================================================\n// Parameter Types\n// =============================================================================\n\n/**\n * Parameters for generating a share link.\n */\nexport const GenerateShareParamsSchema = z.object({\n /** Resource path to share */\n path: z.string(),\n /** Actions to authorize */\n actions: z.array(z.string()).optional(),\n /** When the share link expires */\n expiry: z.coerce.date().optional(),\n /** Encoding schema for the link */\n schema: ShareSchemaSchema.optional(),\n /** Human-readable description */\n description: z.string().optional(),\n /** Base URL for the share link */\n baseUrl: z.string().optional(),\n});\n\nexport type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;\n\n// =============================================================================\n// Configuration Types\n// =============================================================================\n\n// Note: These types include functions and external types which cannot be fully validated at runtime.\n// We use z.unknown().refine() for runtime type checking while preserving TypeScript types.\n\n/**\n * Configuration for DelegationManager.\n * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.\n */\nexport const DelegationManagerConfigSchema = z.object({\n /** TinyCloud host URLs */\n hosts: z.array(z.string()),\n /** Account space used by account-wide delegation history queries */\n accountSpaceId: z.string().min(1).optional(),\n /** Active session for authentication */\n session: z.unknown().refine(\n (val): val is ServiceSession => val !== null && typeof val === \"object\",\n { message: \"Expected a ServiceSession object\" }\n ),\n /** Platform-specific invoke function */\n invoke: z.unknown().refine(\n (val): val is InvokeFunction => typeof val === \"function\",\n { message: \"Expected an invoke function\" }\n ),\n /** Platform-specific invoke function for raw resource URIs */\n invokeAny: z.unknown().refine(\n (val): val is InvokeAnyFunction => val === undefined || typeof val === \"function\",\n { message: \"Expected an invokeAny function or undefined\" }\n ).optional(),\n /** Optional custom fetch implementation */\n fetch: z.unknown().refine(\n (val): val is FetchFunction => val === undefined || typeof val === \"function\",\n { message: \"Expected a fetch function or undefined\" }\n ).optional(),\n});\n\nexport type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;\n\n/**\n * Provider interface for cryptographic key operations.\n */\nexport const KeyProviderSchema = z.object({\n /** Generate a new session key, returns key ID */\n createSessionKey: z.unknown().refine(\n (val): val is (name: string) => Promise<string> => typeof val === \"function\",\n { message: \"Expected a function\" }\n ),\n /** Get JWK for a key */\n getJWK: z.unknown().refine(\n (val): val is (keyId: string) => object => typeof val === \"function\",\n { message: \"Expected a function\" }\n ),\n /** Get DID for a key */\n getDID: z.unknown().refine(\n (val): val is (keyId: string) => Promise<string> => typeof val === \"function\",\n { message: \"Expected a function\" }\n ),\n});\n\nexport type KeyProvider = z.infer<typeof KeyProviderSchema>;\n\n// =============================================================================\n// API Response Types\n// =============================================================================\n\n/**\n * Response from the delegation API.\n */\nexport const DelegationApiResponseSchema = z.object({\n /** SIWE message content */\n siwe: z.string(),\n /** Signature of the SIWE message */\n signature: z.string(),\n /** Delegation version */\n version: z.number(),\n /** CID of the created delegation */\n cid: z.string().optional(),\n});\n\nexport type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;\n\n// =============================================================================\n// WASM Delegation Types\n// =============================================================================\n\n/**\n * A single (service, space, path, actions) entry inside a\n * createDelegation WASM result.\n *\n * Mirrors the Rust `DelegatedResource` struct in\n * `tinycloud-sdk-wasm/src/session.rs`. Field names match the manifest\n * {@link PermissionEntry} shape so callers can reconstruct what they sent\n * without having to re-parse the UCAN.\n *\n * `service` is the short form (e.g. `\"kv\"`, `\"sql\"`) as returned by the\n * Rust layer. The SDK layer translates to the long form\n * (`\"tinycloud.kv\"`) when comparing against manifests.\n */\nexport const DelegatedResourceSchema = z.object({\n /** Short-form service name, e.g. \"kv\", \"sql\", \"duckdb\", \"capabilities\", \"hooks\". */\n service: z.string(),\n /** Full space id string, e.g. \"tinycloud:pkh:eip155:1:0x....:default\". */\n space: z.string(),\n /** Resource path; empty string when the resource URI had no path segment. */\n path: z.string(),\n /** Full-URN ability strings, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n actions: z.array(z.string()),\n /** Exact ReCap caveats that constrain every action in this scope. */\n caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n});\n\nexport type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;\n\n/**\n * Input parameters for the createDelegation WASM function.\n *\n * A single call may encode multiple `(service, path, actions)` entries\n * via the `abilities` map — the underlying UCAN will contain one\n * attenuation entry per `(service, path)` pair, all signed by the same\n * session key in one blob.\n *\n * The `abilities` shape is identical to what `prepareSession` accepts\n * (`Record<shortService, Record<path, actionURNs[]>>`), so manifest\n * resolution can feed both sides from one data structure.\n */\nexport const CreateDelegationWasmParamsSchema = z.object({\n /** The session containing delegation credentials */\n session: z.unknown().refine(\n (val): val is ServiceSession => val !== null && typeof val === \"object\",\n { message: \"Expected a ServiceSession object\" }\n ),\n /** DID of the delegate */\n delegateDID: z.string(),\n /** Space ID this delegation applies to */\n spaceId: z.string(),\n /**\n * Multi-resource abilities map: short-service → path → full-URN actions.\n * Matches the shape accepted by `prepareSession`.\n *\n * Example:\n * ```\n * {\n * kv: {\n * \"com.listen.app/\": [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]\n * },\n * sql: {\n * \"com.listen.app/data.sqlite\": [\"tinycloud.sql/read\"]\n * }\n * }\n * ```\n */\n abilities: z.record(z.string(), z.record(z.string(), z.array(z.string()))),\n /** Expiration time in seconds since Unix epoch */\n expirationSecs: z.number(),\n /** Optional not-before time in seconds since Unix epoch */\n notBeforeSecs: z.number().optional(),\n});\n\nexport type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;\n\n/**\n * Result from the createDelegation WASM function.\n *\n * A single UCAN may cover multiple resources. The `resources` array\n * describes every `(service, space, path, actions)` entry granted, in\n * deterministic (service, path) lexicographic order (the Rust side sorts\n * the HashMap entries before signing).\n */\nexport const CreateDelegationWasmResultSchema = z.object({\n /** Base64url-encoded UCAN delegation */\n delegation: z.string(),\n /** CID of the delegation */\n cid: z.string(),\n /** DID of the delegate */\n delegateDID: z.string(),\n /** Expiration time */\n expiry: z.coerce.date(),\n /**\n * All (service, space, path, actions) entries granted by this delegation.\n * Always non-empty on success.\n */\n resources: z.array(DelegatedResourceSchema),\n});\n\nexport type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates a Delegation object and returns a Result.\n */\nexport function validateDelegation(data: unknown): Result<Delegation, DelegationError> {\n const result = DelegationSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates a CreateDelegationParams object and returns a Result.\n */\nexport function validateCreateDelegationParams(\n data: unknown\n): Result<CreateDelegationParams, DelegationError> {\n const result = CreateDelegationParamsSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates a DelegationFilters object and returns a Result.\n */\nexport function validateDelegationFilters(\n data: unknown\n): Result<DelegationFilters, DelegationError> {\n const result = DelegationFiltersSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates a ShareLink object and returns a Result.\n */\nexport function validateShareLink(data: unknown): Result<ShareLink, DelegationError> {\n const result = ShareLinkSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Generic validation function factory.\n */\nexport function createValidator<T>(\n schema: z.ZodType<T>\n): (data: unknown) => Result<T, DelegationError> {\n return (data: unknown): Result<T, DelegationError> => {\n const result = schema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: result.error.message,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n };\n}\n","/**\n * Default lifetimes for the various delegation shapes the SDK mints.\n *\n * The SDK has many delegation flows (session sign-in, runtime grants,\n * share links, manifest installs, public-space sub-delegations, …) and\n * each one used to pick its own number freehand. That made it hard to\n * tell whether a chosen value was deliberate or copy-pasted, and made\n * silent inconsistencies easy to ship.\n *\n * Every default below answers two questions:\n * - Who recovers if the delegation leaks? (re-auth, revocation, no one)\n * - Who is the principal at use time? (issuer, third party)\n *\n * The five tiers fall out of those answers. Pick a tier, not a number,\n * when introducing a new delegation surface.\n *\n * @packageDocumentation\n */\n\n/**\n * Auto-refreshable, never user-visible. The SDK can re-derive these\n * transparently from the active session. Lifetime exists only to bound\n * replay if the wire format leaks.\n *\n * Use for: public-space sub-delegations, internal capability re-derivations.\n */\nconst EPHEMERAL_MS = 60 * 60 * 1000; // 1 hour\n\n/**\n * Short-lived bearer URLs for direct KV reads. Anyone holding the URL can\n * read the object until expiry, so the default is deliberately shorter than\n * delegation-style tiers. Callers can request a different TTL per URL.\n *\n * Use for: KV signed read URLs.\n */\nconst SIGNED_READ_URL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * The user's currently-active sign-in session. Recovery is trivial\n * (re-sign-in). Length tracks how long the user/agent is expected to\n * be working without re-prompt.\n *\n * Use for: TinyCloudNode session expiry, runtime permission grants\n * (which are capped by the session anyway).\n */\nconst SESSION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Ad-hoc third-party delegations the caller often forgets to revoke.\n * Default sized so a forgotten share link prunes itself within a week\n * rather than living forever; callers pass longer for known recipients.\n *\n * Use for: SharingService share links, DelegationManager defaults,\n * SpaceService server-response fallback.\n */\nconst SHARE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Manifest-declared delegations for installed apps. Long enough that\n * monthly re-prompts feel like maintenance, short enough that\n * abandoning an app prunes its access.\n *\n * Use for: manifest `expiry` defaults.\n */\nconst APP_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\n/**\n * Hard ceiling for caller-supplied expiry. Effectively \"forever\" — the\n * constant exists primarily to guard against integer overflow / typo'd\n * input, not as a security policy lever. Long-lived API-token-style\n * delegations are a first-class use case; revocation is the right\n * control for them.\n */\nconst MAX_MS = 10 * 365 * 24 * 60 * 60 * 1000; // 10 years\n\nexport const EXPIRY = {\n EPHEMERAL_MS,\n SIGNED_READ_URL_MS,\n SESSION_MS,\n SHARE_MS,\n APP_MS,\n MAX_MS,\n} as const;\n\nexport const DEFAULT_SIGNED_READ_URL_EXPIRY_MS = EXPIRY.SIGNED_READ_URL_MS;\n\nexport type ExpiryTier = keyof typeof EXPIRY;\n","import {\n err,\n ok,\n serviceError,\n type IDatabaseHandle,\n type IKVService,\n type QueryResponse,\n type Result,\n type ServiceError,\n type SqlValue,\n} from \"@tinycloud/sdk-services\";\nimport {\n ACCOUNT_REGISTRY_PATH,\n composeManifestRequest,\n type Manifest,\n} from \"../manifest\";\nimport { ACCOUNT_INDEX_SCHEMA } from \"@tinycloud/bootstrap\";\nimport type {\n AccountDelegationPage,\n AccountDelegationQueryOptions,\n Delegation,\n DelegationRevocationReceipt,\n SpaceInfo,\n} from \"../delegations/types\";\nimport type { DelegationManager } from \"../delegations/DelegationManager\";\nimport type { ISpaceService } from \"../spaces/SpaceService\";\n\nconst SERVICE_NAME = \"account\";\nconst ACCOUNT_INDEX_DB = \"account\";\nconst ACCOUNT_INDEX_NAMESPACE = \"tinycloud.account.index\";\nconst ACCOUNT_SPACES_PATH = \"spaces/\";\n\nexport interface AccountApplication {\n appId: string;\n manifests: Manifest[];\n updatedAt?: string;\n name?: string;\n description?: string;\n manifestHash?: string;\n}\n\nexport interface AccountSpace {\n spaceId: string;\n name: string;\n ownerDid: string;\n type: \"owned\" | \"delegated\" | \"discovered\";\n permissions: string[];\n status: \"active\" | \"archived\";\n registeredAt?: string;\n updatedAt?: string;\n expiresAt?: Date;\n}\n\nexport interface AccountDelegation {\n cid: string;\n direction: \"granted\" | \"received\";\n spaceId: string;\n spaceName?: string;\n counterpartyDid: string;\n delegateDid: string;\n delegatorDid?: string;\n path: string;\n actions: string[];\n expiry: Date;\n status: \"active\" | \"expired\" | \"revoked\";\n createdAt?: Date;\n}\n\nexport interface AccountStatus {\n did: string;\n host: string;\n primarySpaceId?: string;\n accountSpaceId?: string;\n applications: number;\n spaces: number;\n grantedDelegations: number;\n receivedDelegations: number;\n}\n\nexport interface AccountIndexRebuildResult {\n database: string;\n applications: number;\n spaces: number;\n delegations: number;\n syncedAt: string;\n}\n\nexport interface AccountIndexEnsureResult {\n database: string;\n}\n\nexport interface AccountIndexedReadOptions {\n preferIndex?: boolean;\n refreshIndex?: boolean;\n}\n\nexport type AccountApplicationListOptions = AccountIndexedReadOptions;\n\nexport type AccountSpaceListOptions = AccountIndexedReadOptions;\n\nexport interface AccountDelegationListOptions {\n direction?: \"granted\" | \"received\" | \"all\";\n space?: string;\n preferIndex?: boolean;\n refreshIndex?: boolean;\n}\n\nexport interface AccountDelegationRevokeOptions {\n cid: string;\n space: string;\n}\n\nexport interface AccountServiceConfig {\n getDid: () => string;\n getHost: () => string;\n getPrimarySpaceId: () => string | undefined;\n getAccountSpaceId: () => string | undefined;\n getSpaces: () => ISpaceService;\n getDelegationManager?: () => Pick<DelegationManager, \"query\" | \"revoke\">;\n getAccountDb?: () => IDatabaseHandle | undefined;\n ensureAccountSpaceHosted?: () => Promise<void>;\n}\n\nexport class AccountService {\n constructor(private readonly config: AccountServiceConfig) {}\n\n async status(): Promise<Result<AccountStatus>> {\n const apps = await this.applications.list();\n if (!apps.ok) return apps;\n\n const delegations = await this.delegations.list();\n if (!delegations.ok) return delegations;\n\n const spaces = await this.spaces.list();\n if (!spaces.ok) return spaces;\n\n return ok({\n did: this.config.getDid(),\n host: this.config.getHost(),\n primarySpaceId: this.config.getPrimarySpaceId(),\n accountSpaceId: this.config.getAccountSpaceId(),\n applications: apps.data.length,\n spaces: spaces.data.length,\n grantedDelegations: delegations.data.filter((d) => d.direction === \"granted\").length,\n receivedDelegations: delegations.data.filter((d) => d.direction === \"received\").length,\n });\n }\n\n readonly applications = {\n list: async (options: AccountApplicationListOptions = {}): Promise<Result<AccountApplication[]>> => {\n if (options.preferIndex) {\n const indexed = await this.index.applications.list();\n if (indexed.ok && indexed.data.length > 0) return indexed;\n if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;\n\n const canonical = await this.applications.list();\n if (canonical.ok && options.refreshIndex !== false) {\n await this.replaceApplicationsIndexQuietly(canonical.data);\n }\n return canonical;\n }\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const listed = await kvResult.data.list({ prefix: ACCOUNT_REGISTRY_PATH });\n if (!listed.ok) return accountErr(listed.error);\n\n const applications: AccountApplication[] = [];\n for (const key of listed.data.keys) {\n const loaded = await kvResult.data.get<StoredApplicationRecord>(key);\n if (!loaded.ok) return accountErr(loaded.error);\n applications.push(applicationFromRecord(key, loaded.data.data));\n }\n\n applications.sort((a, b) => a.appId.localeCompare(b.appId));\n return ok(applications);\n },\n\n get: async (appId: string): Promise<Result<AccountApplication>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const key = applicationKey(appId);\n const loaded = await kvResult.data.get<StoredApplicationRecord>(key);\n if (!loaded.ok) return accountErr(loaded.error);\n return ok(applicationFromRecord(key, loaded.data.data));\n },\n\n register: async (manifest: Manifest | Manifest[]): Promise<Result<AccountApplication>> => {\n const manifests = Array.isArray(manifest) ? manifest : [manifest];\n const request = composeManifestRequest(manifests);\n if (request.registryRecords.length === 0) {\n return err(\n serviceError(\n \"INVALID_MANIFEST\",\n \"Manifest did not produce an account application registry record\",\n SERVICE_NAME,\n ),\n );\n }\n\n await this.config.ensureAccountSpaceHosted?.();\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n let registered: AccountApplication | undefined;\n for (const record of request.registryRecords) {\n const manifestHash = hashJson(record.manifests);\n if (await this.indexHasApplicationHash(record.app_id, manifestHash)) {\n registered = {\n appId: record.app_id,\n manifests: record.manifests,\n manifestHash,\n name: record.manifests[0]?.name,\n description: record.manifests[0]?.description,\n };\n continue;\n }\n\n const stored = {\n app_id: record.app_id,\n manifests: record.manifests,\n manifest_hash: manifestHash,\n updated_at: new Date().toISOString(),\n };\n const written = await kvResult.data.put(record.key, stored);\n if (!written.ok) return accountErr(written.error);\n registered = applicationFromRecord(record.key, stored);\n await this.upsertApplicationIndexQuietly(registered);\n }\n\n return ok(registered!);\n },\n\n remove: async (appId: string): Promise<Result<void>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const removed = await kvResult.data.delete(applicationKey(appId));\n if (!removed.ok) return accountErr(removed.error);\n await this.deleteApplicationIndexQuietly(appId);\n return ok(undefined);\n },\n };\n\n readonly spaces = {\n list: async (options: AccountSpaceListOptions = {}): Promise<Result<AccountSpace[]>> => {\n if (options.preferIndex) {\n const indexed = await this.index.spaces.list();\n if (indexed.ok && indexed.data.length > 0) return indexed;\n if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;\n\n const canonical = await this.spaces.syncAccessible();\n if (canonical.ok && options.refreshIndex !== false) {\n await this.replaceSpacesIndexQuietly(canonical.data);\n }\n return canonical;\n }\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const listed = await kvResult.data.list({ prefix: ACCOUNT_SPACES_PATH });\n if (!listed.ok) return accountErr(listed.error);\n\n const spaces: AccountSpace[] = [];\n for (const key of listed.data.keys) {\n const loaded = await kvResult.data.get<StoredSpaceRecord>(key);\n if (!loaded.ok) return accountErr(loaded.error);\n spaces.push(spaceFromRecord(key, loaded.data.data));\n }\n\n spaces.sort((a, b) => a.name.localeCompare(b.name) || a.spaceId.localeCompare(b.spaceId));\n return ok(spaces);\n },\n\n get: async (spaceId: string): Promise<Result<AccountSpace>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const loaded = await kvResult.data.get<StoredSpaceRecord>(spaceKey(spaceId));\n if (!loaded.ok) return accountErr(loaded.error);\n return ok(spaceFromRecord(spaceKey(spaceId), loaded.data.data));\n },\n\n register: async (space: SpaceInfo | AccountSpace): Promise<Result<AccountSpace>> => {\n await this.config.ensureAccountSpaceHosted?.();\n\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const stored = spaceRecordFromInput(space);\n const written = await kvResult.data.put(spaceKey(stored.space_id), stored);\n if (!written.ok) return accountErr(written.error);\n\n const registered = spaceFromRecord(spaceKey(stored.space_id), stored);\n await this.upsertSpaceIndexQuietly(registered);\n return ok(registered);\n },\n\n syncAccessible: async (): Promise<Result<AccountSpace[]>> => {\n const listed = await this.config.getSpaces().list();\n if (!listed.ok) return accountErr(listed.error);\n\n const registered: AccountSpace[] = [];\n for (const space of listed.data) {\n const result = await this.spaces.register(space);\n if (!result.ok) return result;\n registered.push(result.data);\n }\n return ok(registered);\n },\n\n remove: async (spaceId: string): Promise<Result<void>> => {\n const kvResult = this.accountKV();\n if (!kvResult.ok) return kvResult;\n\n const removed = await kvResult.data.delete(spaceKey(spaceId));\n if (!removed.ok) return accountErr(removed.error);\n await this.deleteSpaceIndexQuietly(spaceId);\n return ok(undefined);\n },\n };\n\n readonly delegations = {\n query: async (\n options: AccountDelegationQueryOptions = {},\n ): Promise<Result<AccountDelegationPage>> => {\n const manager = this.config.getDelegationManager?.();\n if (!manager) {\n return err(serviceError(\n \"NOT_INITIALIZED\",\n \"Delegation history requires an authenticated delegation manager\",\n SERVICE_NAME,\n ));\n }\n const queried = await manager.query(options);\n return queried.ok ? ok(queried.data) : accountErr(queried.error);\n },\n\n list: async (\n options: AccountDelegationListOptions = {},\n ): Promise<Result<AccountDelegation[]>> => {\n if (options.preferIndex) {\n const indexed = await this.index.delegations.list(options);\n if (indexed.ok && indexed.data.length > 0) return indexed;\n if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;\n\n const live = await this.delegations.list({\n direction: options.direction,\n space: options.space,\n });\n if (live.ok && options.refreshIndex !== false) {\n await this.replaceDelegationsIndexQuietly(live.data);\n }\n return live;\n }\n\n const spaces = await this.config.getSpaces().list();\n if (!spaces.ok) return accountErr(spaces.error);\n\n const targetSpaces = options.space\n ? spaces.data.filter((space) => space.id === options.space || space.name === options.space)\n : spaces.data;\n\n const delegations: AccountDelegation[] = [];\n for (const space of targetSpaces) {\n const scoped = this.config.getSpaces().get(space.id).delegations;\n\n if (options.direction !== \"received\") {\n const granted = await scoped.list();\n if (!granted.ok) return accountErr(granted.error);\n delegations.push(...granted.data.map((d) => mapDelegation(d, space, \"granted\")));\n }\n\n if (options.direction !== \"granted\") {\n const received = await scoped.listReceived();\n if (!received.ok) return accountErr(received.error);\n delegations.push(...received.data.map((d) => mapDelegation(d, space, \"received\")));\n }\n }\n\n delegations.sort((a, b) => a.spaceId.localeCompare(b.spaceId) || a.cid.localeCompare(b.cid));\n return ok(delegations);\n },\n\n revoke: async (\n input: string | AccountDelegationRevokeOptions,\n ): Promise<Result<DelegationRevocationReceipt | void>> => {\n const cid = typeof input === \"string\" ? input : input.cid;\n const manager = this.config.getDelegationManager?.();\n if (manager) {\n const revoked = await manager.revoke(cid);\n return revoked.ok ? ok(revoked.data) : accountErr(revoked.error);\n }\n\n // Deprecated compatibility path for callers constructing AccountService directly.\n if (typeof input === \"string\") {\n return err(serviceError(\n \"NOT_INITIALIZED\",\n \"CID-only revocation requires an authenticated delegation manager\",\n SERVICE_NAME,\n ));\n }\n const space = await this.resolveSpace(input.space);\n if (!space.ok) return space;\n const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(cid);\n if (!revoked.ok) return accountErr(revoked.error);\n return ok(undefined);\n },\n };\n\n readonly index = {\n ensure: async (): Promise<Result<AccountIndexEnsureResult>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n return ok({ database: ACCOUNT_INDEX_DB });\n },\n\n rebuild: async (): Promise<Result<AccountIndexRebuildResult>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const applications = await this.applications.list();\n if (!applications.ok) return applications;\n\n const spaces = await this.spaces.list();\n if (!spaces.ok) return spaces;\n\n const delegations = await this.delegations.list();\n if (!delegations.ok) return delegations;\n\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const statements = [\n { sql: \"DELETE FROM applications\" },\n { sql: \"DELETE FROM application_state\" },\n { sql: \"DELETE FROM spaces\" },\n { sql: \"DELETE FROM delegations\" },\n { sql: \"DELETE FROM sync_state\" },\n ...applications.data.map((app) => ({\n sql:\n \"INSERT INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)\",\n params: [\n app.appId,\n app.name ?? null,\n app.description ?? null,\n app.updatedAt ?? syncedAt,\n JSON.stringify(app.manifests),\n ],\n })),\n ...applications.data.map((app) => ({\n sql:\n \"INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)\",\n params: [app.appId, app.manifestHash ?? hashJson(app.manifests), syncedAt],\n })),\n ...spaces.data.map((space) => ({\n sql:\n \"INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n space.spaceId,\n space.name,\n space.ownerDid,\n space.type,\n JSON.stringify(space.permissions),\n space.status,\n space.registeredAt ?? syncedAt,\n space.updatedAt ?? syncedAt,\n space.expiresAt?.toISOString() ?? null,\n ],\n })),\n ...delegations.data.map((delegation) => ({\n sql:\n \"INSERT INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n delegation.cid,\n delegation.direction,\n delegation.spaceId,\n delegation.spaceName ?? null,\n delegation.counterpartyDid,\n delegation.delegateDid,\n delegation.delegatorDid ?? null,\n delegation.path,\n JSON.stringify(delegation.actions),\n delegation.expiry.toISOString(),\n delegation.status,\n delegation.createdAt?.toISOString() ?? null,\n syncedAt,\n ],\n })),\n {\n sql: \"INSERT INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"applications\", syncedAt, applications.data.length],\n },\n {\n sql: \"INSERT INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"spaces\", syncedAt, spaces.data.length],\n },\n {\n sql: \"INSERT INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"delegations\", syncedAt, delegations.data.length],\n },\n ];\n\n const rebuilt = await dbResult.data.batch(statements);\n if (!rebuilt.ok) return accountErr(rebuilt.error);\n\n return ok({\n database: ACCOUNT_INDEX_DB,\n applications: applications.data.length,\n spaces: spaces.data.length,\n delegations: delegations.data.length,\n syncedAt,\n });\n },\n\n applications: {\n list: async (): Promise<Result<AccountApplication[]>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const queried = await dbResult.data.query<string | null>(\n \"SELECT applications.app_id, name, description, updated_at, manifest_json, application_state.manifest_hash FROM applications LEFT JOIN application_state ON applications.app_id = application_state.app_id ORDER BY applications.app_id\",\n );\n if (!queried.ok) return accountErr(queried.error);\n\n return ok((queried.data.rows as unknown as IndexedApplicationRow[]).map(indexedApplicationFromRow));\n },\n },\n\n spaces: {\n list: async (): Promise<Result<AccountSpace[]>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const queried = await dbResult.data.query<string | null>(\n \"SELECT space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at FROM spaces ORDER BY name, space_id\",\n );\n if (!queried.ok) return accountErr(queried.error);\n\n return ok((queried.data.rows as unknown as IndexedSpaceRow[]).map(indexedSpaceFromRow));\n },\n },\n\n delegations: {\n list: async (\n options: AccountDelegationListOptions = {},\n ): Promise<Result<AccountDelegation[]>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n\n const where: string[] = [];\n const params: SqlValue[] = [];\n if (options.direction && options.direction !== \"all\") {\n where.push(\"direction = ?\");\n params.push(options.direction);\n }\n if (options.space) {\n where.push(\"(space_id = ? OR space_name = ?)\");\n params.push(options.space, options.space);\n }\n\n const queried = await dbResult.data.query<string | null>(\n `SELECT cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at FROM delegations${\n where.length > 0 ? ` WHERE ${where.join(\" AND \")}` : \"\"\n } ORDER BY space_id, cid`,\n params,\n );\n if (!queried.ok) return accountErr(queried.error);\n\n return ok((queried.data.rows as unknown as IndexedDelegationRow[]).map(indexedDelegationFromRow));\n },\n },\n\n query: async <T = Record<string, unknown>>(\n sql: string,\n params?: SqlValue[],\n ): Promise<Result<QueryResponse<T>>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n const queried = await dbResult.data.query<T>(sql, params);\n if (!queried.ok) return accountErr(queried.error);\n return ok(queried.data);\n },\n\n status: async (): Promise<Result<AccountIndexStatus>> => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return dbResult;\n const queried = await dbResult.data.query<string | number>(\n \"SELECT source, synced_at, count FROM sync_state ORDER BY source\",\n );\n if (!queried.ok) {\n if (isMissingIndexError(queried.error)) {\n return ok({ database: ACCOUNT_INDEX_DB, state: \"missing\", sources: [] });\n }\n return accountErr(queried.error);\n }\n return ok({\n database: ACCOUNT_INDEX_DB,\n state: \"ready\",\n sources: (queried.data.rows as unknown as IndexedSyncStateRow[]).map(([source, syncedAt, count]) => ({\n source,\n syncedAt,\n count,\n })),\n });\n },\n };\n\n private accountKV(): Result<IKVService> {\n const accountSpaceId = this.config.getAccountSpaceId();\n if (!accountSpaceId) {\n return err(\n serviceError(\n \"ACCOUNT_SPACE_UNAVAILABLE\",\n \"Account space is unavailable. Sign in with a wallet-backed profile first.\",\n SERVICE_NAME,\n ),\n );\n }\n return ok(this.config.getSpaces().get(accountSpaceId).kv);\n }\n\n private accountDb(): Result<IDatabaseHandle> {\n const db = this.config.getAccountDb?.();\n if (!db) {\n return err(\n serviceError(\n \"ACCOUNT_INDEX_UNAVAILABLE\",\n \"Account index database is unavailable. Sign in with a wallet-backed profile first.\",\n SERVICE_NAME,\n ),\n );\n }\n return ok(db);\n }\n\n private async indexHasApplicationHash(appId: string, manifestHash: string): Promise<boolean> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return false;\n\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return false;\n\n const queried = await dbResult.data.query<string>(\n \"SELECT 1 FROM application_state WHERE app_id = ? AND manifest_hash = ? LIMIT 1\",\n [appId, manifestHash],\n );\n return queried.ok && queried.data.rows.length > 0;\n }\n\n private async upsertApplicationIndexQuietly(app: AccountApplication): Promise<void> {\n await ignoreIndexFailure(() => this.upsertApplicationIndex(app));\n }\n\n private async upsertApplicationIndex(app: AccountApplication): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const updatedAt = app.updatedAt ?? new Date().toISOString();\n const manifestHash = app.manifestHash ?? hashJson(app.manifests);\n const written = await dbResult.data.batch([\n {\n sql:\n \"INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)\",\n params: [\n app.appId,\n app.name ?? null,\n app.description ?? null,\n updatedAt,\n JSON.stringify(app.manifests),\n ],\n },\n {\n sql:\n \"INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)\",\n params: [app.appId, manifestHash, updatedAt],\n },\n ]);\n if (!written.ok) return accountErr(written.error);\n return ok(undefined);\n }\n\n private async deleteApplicationIndexQuietly(appId: string): Promise<void> {\n await ignoreIndexFailure(() => this.deleteApplicationIndex(appId));\n }\n\n private async deleteApplicationIndex(appId: string): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const deleted = await dbResult.data.batch([\n { sql: \"DELETE FROM applications WHERE app_id = ?\", params: [appId] },\n { sql: \"DELETE FROM application_state WHERE app_id = ?\", params: [appId] },\n ]);\n if (!deleted.ok) return accountErr(deleted.error);\n return ok(undefined);\n }\n\n private async upsertSpaceIndexQuietly(space: AccountSpace): Promise<void> {\n await ignoreIndexFailure(() => this.upsertSpaceIndex(space));\n }\n\n private async upsertSpaceIndex(space: AccountSpace): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const updatedAt = space.updatedAt ?? new Date().toISOString();\n const written = await dbResult.data.batch([\n {\n sql:\n \"INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n space.spaceId,\n space.name,\n space.ownerDid,\n space.type,\n JSON.stringify(space.permissions),\n space.status,\n space.registeredAt ?? updatedAt,\n updatedAt,\n space.expiresAt?.toISOString() ?? null,\n ],\n },\n ]);\n if (!written.ok) return accountErr(written.error);\n return ok(undefined);\n }\n\n private async deleteSpaceIndexQuietly(spaceId: string): Promise<void> {\n await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));\n }\n\n private async deleteSpaceIndex(spaceId: string): Promise<Result<void>> {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return ok(undefined);\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return schema;\n\n const deleted = await dbResult.data.batch([\n { sql: \"DELETE FROM spaces WHERE space_id = ?\", params: [spaceId] },\n ]);\n if (!deleted.ok) return accountErr(deleted.error);\n return ok(undefined);\n }\n\n private async resolveSpace(space: string): Promise<Result<SpaceInfo>> {\n const listed = await this.config.getSpaces().list();\n if (!listed.ok) return accountErr(listed.error);\n\n const found = listed.data.find((candidate) => candidate.id === space || candidate.name === space);\n if (!found) {\n return err(\n serviceError(\"SPACE_NOT_FOUND\", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME),\n );\n }\n return ok(found);\n }\n\n private async replaceApplicationsIndexQuietly(applications: AccountApplication[]): Promise<void> {\n await ignoreIndexFailure(async () => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return;\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return;\n\n await dbResult.data.batch([\n { sql: \"DELETE FROM applications\" },\n { sql: \"DELETE FROM application_state\" },\n ...applications.map((app) => ({\n sql:\n \"INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)\",\n params: [\n app.appId,\n app.name ?? null,\n app.description ?? null,\n app.updatedAt ?? syncedAt,\n JSON.stringify(app.manifests),\n ],\n })),\n ...applications.map((app) => ({\n sql:\n \"INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)\",\n params: [app.appId, app.manifestHash ?? hashJson(app.manifests), syncedAt],\n })),\n {\n sql: \"INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"applications\", syncedAt, applications.length],\n },\n ]);\n });\n }\n\n private async replaceSpacesIndexQuietly(spaces: AccountSpace[]): Promise<void> {\n await ignoreIndexFailure(async () => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return;\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return;\n\n await dbResult.data.batch([\n { sql: \"DELETE FROM spaces\" },\n ...spaces.map((space) => ({\n sql:\n \"INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n space.spaceId,\n space.name,\n space.ownerDid,\n space.type,\n JSON.stringify(space.permissions),\n space.status,\n space.registeredAt ?? syncedAt,\n space.updatedAt ?? syncedAt,\n space.expiresAt?.toISOString() ?? null,\n ],\n })),\n {\n sql: \"INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"spaces\", syncedAt, spaces.length],\n },\n ]);\n });\n }\n\n private async replaceDelegationsIndexQuietly(delegations: AccountDelegation[]): Promise<void> {\n await ignoreIndexFailure(async () => {\n const dbResult = this.accountDb();\n if (!dbResult.ok) return;\n const syncedAt = new Date().toISOString();\n const schema = await this.ensureAccountIndex(dbResult.data);\n if (!schema.ok) return;\n\n await dbResult.data.batch([\n { sql: \"DELETE FROM delegations\" },\n ...delegations.map((delegation) => ({\n sql:\n \"INSERT OR REPLACE INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\",\n params: [\n delegation.cid,\n delegation.direction,\n delegation.spaceId,\n delegation.spaceName ?? null,\n delegation.counterpartyDid,\n delegation.delegateDid,\n delegation.delegatorDid ?? null,\n delegation.path,\n JSON.stringify(delegation.actions),\n delegation.expiry.toISOString(),\n delegation.status,\n delegation.createdAt?.toISOString() ?? null,\n syncedAt,\n ],\n })),\n {\n sql: \"INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)\",\n params: [\"delegations\", syncedAt, delegations.length],\n },\n ]);\n });\n }\n\n private async ensureAccountIndex(db: IDatabaseHandle): Promise<Result<void>> {\n const migrated = await db.migrations.apply({\n namespace: ACCOUNT_INDEX_NAMESPACE,\n migrations: [\n {\n id: \"001_initial\",\n sql: [...ACCOUNT_INDEX_SCHEMA],\n },\n ],\n });\n if (!migrated.ok) return accountErr(migrated.error);\n return ok(undefined);\n }\n}\n\ninterface StoredApplicationRecord {\n app_id?: string;\n appId?: string;\n manifests?: Manifest[];\n manifest_hash?: string;\n manifestHash?: string;\n updated_at?: string;\n updatedAt?: string;\n}\n\nfunction applicationKey(appId: string): string {\n return `${ACCOUNT_REGISTRY_PATH}${appId}`;\n}\n\nfunction appIdFromKey(key: string): string {\n return key.startsWith(ACCOUNT_REGISTRY_PATH) ? key.slice(ACCOUNT_REGISTRY_PATH.length) : key;\n}\n\nfunction applicationFromRecord(key: string, record: StoredApplicationRecord): AccountApplication {\n const manifests = Array.isArray(record.manifests) ? record.manifests : [];\n const first = manifests[0];\n return {\n appId: record.app_id ?? record.appId ?? first?.app_id ?? appIdFromKey(key),\n manifests,\n updatedAt: record.updated_at ?? record.updatedAt,\n name: first?.name,\n description: first?.description,\n manifestHash: record.manifest_hash ?? record.manifestHash ?? hashJson(manifests),\n };\n}\n\ntype IndexedApplicationRow = [string, string | null, string | null, string | null, string, string | null];\n\nfunction indexedApplicationFromRow(row: IndexedApplicationRow): AccountApplication {\n const [appId, name, description, updatedAt, manifestJson, manifestHash] = row;\n return {\n appId,\n name: name ?? undefined,\n description: description ?? undefined,\n updatedAt: updatedAt ?? undefined,\n manifests: JSON.parse(manifestJson) as Manifest[],\n manifestHash: manifestHash ?? undefined,\n };\n}\n\ninterface StoredSpaceRecord {\n space_id?: string;\n spaceId?: string;\n name?: string;\n owner_did?: string;\n ownerDid?: string;\n owner?: string;\n type?: \"owned\" | \"delegated\" | \"discovered\";\n permissions?: string[];\n status?: \"active\" | \"archived\";\n registered_at?: string;\n registeredAt?: string;\n updated_at?: string;\n updatedAt?: string;\n expires_at?: string;\n expiresAt?: string | Date;\n}\n\nfunction spaceKey(spaceId: string): string {\n return `${ACCOUNT_SPACES_PATH}${spaceId}`;\n}\n\nfunction spaceIdFromKey(key: string): string {\n return key.startsWith(ACCOUNT_SPACES_PATH) ? key.slice(ACCOUNT_SPACES_PATH.length) : key;\n}\n\nfunction spaceRecordFromInput(space: SpaceInfo | AccountSpace): Required<Pick<StoredSpaceRecord, \"space_id\" | \"name\" | \"owner_did\" | \"type\" | \"permissions\" | \"status\" | \"updated_at\">> &\n StoredSpaceRecord {\n const now = new Date().toISOString();\n const accountSpace: AccountSpace = \"spaceId\" in space\n ? space\n : {\n spaceId: space.id,\n name: space.name ?? space.id.split(\":\").pop() ?? space.id,\n ownerDid: space.owner ?? \"\",\n type: (space.type ?? \"discovered\") as AccountSpace[\"type\"],\n permissions: space.permissions ?? [],\n status: \"active\" as const,\n expiresAt: space.expiresAt,\n };\n\n return {\n space_id: accountSpace.spaceId,\n name: accountSpace.name,\n owner_did: accountSpace.ownerDid,\n type: accountSpace.type,\n permissions: accountSpace.permissions,\n status: accountSpace.status,\n registered_at: accountSpace.registeredAt ?? now,\n updated_at: now,\n expires_at: accountSpace.expiresAt instanceof Date\n ? accountSpace.expiresAt.toISOString()\n : accountSpace.expiresAt,\n };\n}\n\nfunction spaceFromRecord(key: string, record: StoredSpaceRecord): AccountSpace {\n const expiresAt = record.expires_at ?? record.expiresAt;\n return {\n spaceId: record.space_id ?? record.spaceId ?? spaceIdFromKey(key),\n name: record.name ?? spaceIdFromKey(key).split(\":\").pop() ?? spaceIdFromKey(key),\n ownerDid: record.owner_did ?? record.ownerDid ?? record.owner ?? \"\",\n type: record.type ?? \"discovered\",\n permissions: Array.isArray(record.permissions) ? record.permissions : [],\n status: record.status ?? \"active\",\n registeredAt: record.registered_at ?? record.registeredAt,\n updatedAt: record.updated_at ?? record.updatedAt,\n expiresAt: expiresAt ? new Date(expiresAt) : undefined,\n };\n}\n\ntype IndexedSpaceRow = [string, string, string, \"owned\" | \"delegated\" | \"discovered\", string, \"active\" | \"archived\", string | null, string, string | null];\n\nfunction indexedSpaceFromRow(row: IndexedSpaceRow): AccountSpace {\n const [spaceId, name, ownerDid, type, permissionsJson, status, registeredAt, updatedAt, expiresAt] = row;\n return {\n spaceId,\n name,\n ownerDid,\n type,\n permissions: JSON.parse(permissionsJson) as string[],\n status,\n registeredAt: registeredAt ?? undefined,\n updatedAt,\n expiresAt: expiresAt ? new Date(expiresAt) : undefined,\n };\n}\n\nfunction hashJson(value: unknown): string {\n const input = stableJson(value);\n let hash = 0xcbf29ce484222325n;\n const prime = 0x100000001b3n;\n for (let index = 0; index < input.length; index += 1) {\n hash ^= BigInt(input.charCodeAt(index));\n hash = BigInt.asUintN(64, hash * prime);\n }\n return hash.toString(16).padStart(16, \"0\");\n}\n\nfunction stableJson(value: unknown): string {\n if (value === null || typeof value !== \"object\") {\n return JSON.stringify(value);\n }\n if (Array.isArray(value)) {\n return `[${value.map(stableJson).join(\",\")}]`;\n }\n const object = value as Record<string, unknown>;\n return `{${Object.keys(object)\n .sort()\n .map((key) => `${JSON.stringify(key)}:${stableJson(object[key])}`)\n .join(\",\")}}`;\n}\n\nexport interface AccountIndexStatus {\n database: string;\n state: \"ready\" | \"missing\";\n sources: Array<{\n source: string;\n syncedAt: string;\n count: number;\n }>;\n}\n\ntype IndexedSyncStateRow = [string, string, number];\n\ntype IndexedDelegationRow = [\n string,\n \"granted\" | \"received\",\n string,\n string | null,\n string,\n string,\n string | null,\n string,\n string,\n string,\n \"active\" | \"expired\" | \"revoked\",\n string | null,\n];\n\nfunction indexedDelegationFromRow(row: IndexedDelegationRow): AccountDelegation {\n const [\n cid,\n direction,\n spaceId,\n spaceName,\n counterpartyDid,\n delegateDid,\n delegatorDid,\n path,\n actionsJson,\n expiry,\n status,\n createdAt,\n ] = row;\n return {\n cid,\n direction,\n spaceId,\n spaceName: spaceName ?? undefined,\n counterpartyDid,\n delegateDid,\n delegatorDid: delegatorDid ?? undefined,\n path,\n actions: JSON.parse(actionsJson) as string[],\n expiry: new Date(expiry),\n status,\n createdAt: createdAt ? new Date(createdAt) : undefined,\n };\n}\n\nfunction mapDelegation(\n delegation: Delegation,\n space: SpaceInfo,\n direction: \"granted\" | \"received\",\n): AccountDelegation {\n return {\n cid: delegation.cid,\n direction,\n spaceId: delegation.spaceId || space.id,\n spaceName: space.name,\n counterpartyDid:\n direction === \"granted\"\n ? delegation.delegateDID\n : delegation.delegatorDID ?? delegation.delegateDID,\n delegateDid: delegation.delegateDID,\n delegatorDid: delegation.delegatorDID,\n path: delegation.path,\n actions: delegation.actions,\n expiry: delegation.expiry,\n status: delegation.isRevoked\n ? \"revoked\"\n : delegation.expiry.getTime() <= Date.now()\n ? \"expired\"\n : \"active\",\n createdAt: delegation.createdAt,\n };\n}\n\nfunction accountErr(error: ServiceError): Result<never> {\n return err(serviceError(error.code, error.message, SERVICE_NAME, { cause: error.cause, meta: error.meta }));\n}\n\nfunction isMissingIndexError(error: ServiceError): boolean {\n return /no such table:/i.test(error.message);\n}\n\nasync function ignoreIndexFailure(task: () => Promise<unknown>): Promise<void> {\n try {\n await task();\n } catch {\n // The account index is a cache. Canonical reads/writes must not fail\n // because a best-effort cache update could not be applied.\n }\n}\n","/**\n * TinyCloud App Manifest\n *\n * A declarative description of an app's identity and the capabilities it\n * needs. The manifest drives the SIWE recap at sign-in time, enabling a\n * single wallet prompt that covers the app's own permissions plus any\n * pre-declared delegations.\n *\n * The SDK does NOT fetch external manifests. Apps compose their own manifest\n * (optionally including backend or agent addenda) before handing it to the\n * SDK.\n *\n * Canonical spec: `.claude/specs/manifest.md`.\n *\n * @packageDocumentation\n */\n\nimport ms from \"ms\";\nimport { resolveSecretPath, SECRET_NAME_RE } from \"@tinycloud/sdk-services\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * A single permission entry inside a manifest. This is the shape apps write\n * in their `manifest.json` and the shape we compare against when performing\n * the capability-subset derivability check in the delegation flow.\n *\n * `service` uses the long form (e.g. `\"tinycloud.kv\"`, `\"tinycloud.sql\"`).\n * `\"tinycloud.vault\"` is an SDK-only shorthand that expands to the KV\n * resources the vault service uses; it is never encoded as a recap service.\n */\nexport interface PermissionEntry {\n /** Service namespace, e.g. \"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.duckdb\", \"tinycloud.capabilities\". */\n service: string;\n /** Space name or full space URI. Defaults to \"applications\" inside manifests. */\n space?: string;\n /**\n * Service-specific path.\n * - tinycloud.kv: hierarchical prefix. \"/\" = all, \"foo/\" = prefix match, \"foo\" = exact key\n * - tinycloud.sql: database name/file (e.g. \"data.sqlite\") or \"/\" for all\n * - tinycloud.duckdb: database name/file\n * - tinycloud.capabilities: capability key URI or \"/\" for all\n */\n path: string;\n /**\n * Short action names (e.g. \"get\", \"put\", \"read\", \"schema\"). The SDK expands\n * these to full URNs (e.g. `tinycloud.kv/get`) during resolution.\n * Already-expanded URNs are passed through unchanged.\n */\n actions: string[];\n /** Exact ReCap caveat branches when this authority came from a signed ReCap. */\n caveats?: Record<string, unknown>[];\n /** When true, the manifest prefix is NOT prepended to `path`. Default false. */\n skipPrefix?: boolean;\n /** Per-entry expiry override, ms-format. */\n expiry?: string;\n /** User/agent-facing context for why this permission is requested. */\n description?: string;\n}\n\nexport type ManifestSecretActions =\n | true\n | string\n | string[]\n | {\n /** Actual vault secret name. Defaults to the manifest object key. */\n name?: string;\n /** Optional scoped secret namespace. Omit for global secrets. */\n scope?: string;\n actions?: string | string[];\n expiry?: string;\n description?: string;\n };\n\n/**\n * The valid values for `Manifest.defaults`.\n *\n * - `false` → no auto-included permissions\n * - `true` → standard tier (KV + SQL read/write + capabilities:read)\n * - `\"admin\"` → standard + SQL schema\n * - `\"all\"` → everything the SDK supports (including DuckDB)\n *\n * Unknown string values silently fall back to `true`. Values are normalized\n * (lowercase + trim) before matching.\n */\nexport type ManifestDefaults = boolean | \"admin\" | \"all\";\n\n/**\n * Agent-readable app knowledge bundle pointer.\n *\n * - `true` means the default root: `knowledge/index.md`\n * - string values must point at a markdown root under `knowledge/`\n */\nexport type ManifestKnowledge = true | string;\n\n/** Default root used when `manifest.knowledge === true`. */\nexport const DEFAULT_KNOWLEDGE_ROOT = \"knowledge/index.md\";\n\n/**\n * The raw manifest shape an app declares. See `.claude/specs/manifest.md`.\n */\nexport interface Manifest {\n /** Schema version. Optional, defaults to 1. */\n manifest_version?: 1;\n /** Application identifier / namespace prefix. Required. */\n app_id: string;\n /** Display name. Required. */\n name: string;\n /** Description of what the app or delegate does. Optional. */\n description?: string;\n /** DID of this manifest's delegate target. Optional. Required only for delegation materialization. */\n did?: string;\n /** URL to app icon. Optional. */\n icon?: string;\n /** App version string. Optional. */\n appVersion?: string;\n /** Default expiry for permissions. ms-format (\"30d\", \"2h\", \"1y\"). Default \"30d\". */\n expiry?: string;\n /** Space name or full space URI. Optional, defaults to \"applications\". */\n space?: string;\n /**\n * Path prefix auto-prepended to permission paths. Optional, defaults to\n * `app_id`. Set to `\"\"` to disable entirely. Individual permissions can opt\n * out with `skipPrefix: true`.\n */\n prefix?: string;\n /**\n * Default permission set to auto-include. Optional, defaults to `true`.\n * See {@link ManifestDefaults}.\n */\n defaults?: ManifestDefaults | string;\n /** Whether to include the public-space companion delegation. Default `true`. */\n includePublicSpace?: boolean;\n /** Agent-readable knowledge bundle root. `true` means `knowledge/index.md`. */\n knowledge?: ManifestKnowledge;\n /**\n * Additional permissions beyond the defaults. Use for cross-space access,\n * DuckDB (opt-in), or `skipPrefix: true` entries.\n */\n permissions?: PermissionEntry[];\n /**\n * Secret name shorthand. Entries resolve to encrypted vault KV resources in\n * the `secrets` space.\n */\n secrets?: Record<string, ManifestSecretActions>;\n}\n\n/**\n * A resolved permission entry with fully-expanded paths and action URNs.\n * This is the shape the delegation flow compares against parsed recap\n * capabilities, and the shape the session-key delegation path actually uses.\n */\nexport interface ResourceCapability {\n /** Long-form service, e.g. \"tinycloud.kv\". */\n service: string;\n /** Space name or URI. Short names are resolved to full SpaceIds at sign-in time. */\n space: string;\n /** Path with the manifest prefix applied (or skipped per `skipPrefix`). */\n path: string;\n /** Full-URN actions, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n actions: string[];\n /** Per-entry expiry override in milliseconds. */\n expiryMs?: number;\n /** User/agent-facing context copied from the source permission entry. */\n description?: string;\n}\n\n/**\n * A resolved delegation entry with fully-expanded permissions.\n */\nexport interface ResolvedDelegate {\n /** DID of the delegate. */\n did: string;\n /** Informational display name. Optional. */\n name?: string;\n /** Expiry in milliseconds (per-delegation > manifest default > 30 days). */\n expiryMs: number;\n /** Fully resolved permissions. */\n permissions: ResourceCapability[];\n}\n\n/**\n * The output of {@link resolveManifest}: a fully-expanded capability set\n * ready to drive the SIWE recap.\n */\nexport interface ResolvedCapabilities {\n /** Application identifier copied from manifest.app_id. */\n app_id: string;\n /** Delegate DID copied from manifest.did, when present. */\n did?: string;\n /** Effective default space for this manifest. */\n space: string;\n /** All session-key resources with paths fully resolved (prefix applied). */\n resources: ResourceCapability[];\n /** Default expiry for the session, in milliseconds. */\n expiryMs: number;\n /** Whether to include the public-space companion. */\n includePublicSpace: boolean;\n /** Delegate targets derived from manifests that declare `did`. */\n additionalDelegates: ResolvedDelegate[];\n}\n\nexport interface ManifestRegistryRecord {\n /** KV key inside the account space. */\n key: string;\n /** App id this record describes. */\n app_id: string;\n /** Latest manifest payloads composed for this app id. */\n manifests: Manifest[];\n}\n\nexport interface ComposeManifestOptions {\n /** Include implicit account-space registry permissions. Default true. */\n includeAccountRegistryPermissions?: boolean;\n}\n\nexport interface ComposedManifestRequest {\n /** Validated manifests that were composed. */\n manifests: Manifest[];\n /** Full permission union requested from the user in one SIWE. */\n resources: ResourceCapability[];\n /** Delegations that can be materialized after sign-in. */\n delegationTargets: ResolvedDelegate[];\n /** Account-space registry records to write after successful sign-in. */\n registryRecords: ManifestRegistryRecord[];\n /** Effective session expiry, using the longest composed manifest expiry. */\n expiryMs: number;\n /** Whether to include the public-space companion behavior. */\n includePublicSpace: boolean;\n}\n\n/**\n * Thrown when the manifest fails validation (missing id/name, bad expiry,\n * empty actions on a permission, etc).\n */\nexport class ManifestValidationError extends Error {\n constructor(message: string) {\n super(`Manifest validation failed: ${message}`);\n this.name = \"ManifestValidationError\";\n }\n}\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/**\n * Default expiry when neither the manifest, delegation, nor permission\n * specifies one. APP tier — see `expiry.ts`. Spec: 30 days.\n *\n * Kept as an ms-format string because the manifest schema stores expiry\n * as a string and the parser is shared between this default and\n * caller-provided values; converting `EXPIRY.APP_MS` back to a string\n * here would duplicate that same `30d` literal in another form.\n */\nexport const DEFAULT_EXPIRY = \"30d\";\n\n/**\n * Default `defaults` value when the manifest omits it. Spec: standard tier.\n */\nexport const DEFAULT_DEFAULTS: ManifestDefaults = true;\n\n/** Default manifest schema version. */\nexport const DEFAULT_MANIFEST_VERSION = 1;\n\n/** Default space for manifest-declared app data. */\nexport const DEFAULT_MANIFEST_SPACE = \"applications\";\n\n/** Account-space name used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_SPACE = \"account\";\n\n/** Account-space KV prefix used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_PATH = \"applications/\";\n\nexport const SECRETS_SPACE = \"secrets\";\n\n/** SDK-only permission service for encrypted vault resources. */\nexport const VAULT_PERMISSION_SERVICE = \"tinycloud.vault\";\n\ntype VaultKVBase = \"vault\";\n\ninterface VaultActionExpansion {\n bases: readonly VaultKVBase[];\n action: string;\n}\n\n/**\n * Known services and their short-form (recap URI) names. The TinyCloud\n * node encodes the recap resource URI with the short service name, while\n * action URNs and manifest entries use the long `tinycloud.<short>` form.\n * This table is the canonical bridge between the two.\n */\nexport const SERVICE_SHORT_TO_LONG: Readonly<Record<string, string>> =\n Object.freeze({\n kv: \"tinycloud.kv\",\n sql: \"tinycloud.sql\",\n duckdb: \"tinycloud.duckdb\",\n capabilities: \"tinycloud.capabilities\",\n hooks: \"tinycloud.hooks\",\n encryption: \"tinycloud.encryption\",\n delegation: \"tinycloud.delegation\",\n });\n\n/**\n * Manifest service identifier for TinyCloud encryption network grants.\n *\n * Encryption permissions live on a network id URN\n * (`urn:tinycloud:encryption:<ownerDid>:<network>`), not on a space.\n * The `path` field is the literal networkId; `actions` are\n * `[\"decrypt\"]` (expanded to `[\"tinycloud.encryption/decrypt\"]`).\n *\n * Apps should omit `space` for encryption permissions. The SDK may emit\n * an internal `\"encryption\"` compatibility label after expansion so the\n * older `PermissionEntry`/`ResourceCapability` shape can still carry the\n * raw network URN through subset checks.\n */\nexport const ENCRYPTION_PERMISSION_SERVICE = \"tinycloud.encryption\";\n\n/** Synthetic space label used by encryption manifest entries. */\nexport const ENCRYPTION_MANIFEST_SPACE = \"encryption\";\n\n/**\n * Inverse of {@link SERVICE_SHORT_TO_LONG}.\n */\nexport const SERVICE_LONG_TO_SHORT: Readonly<Record<string, string>> =\n Object.freeze(\n Object.fromEntries(\n Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s]),\n ),\n );\n\n/**\n * Default permission entries for the `true` / standard tier.\n *\n * `tinycloud.capabilities/read` is added separately for every requested\n * space, without the app path prefix. That keeps capability introspection\n * space-scoped instead of app-data scoped.\n */\nconst DEFAULT_STANDARD_ENTRIES: readonly PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n },\n {\n service: \"tinycloud.sql\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\"],\n },\n];\n\n/**\n * Default permission entries for the `\"admin\"` tier: standard + sql/schema.\n */\nconst DEFAULT_ADMIN_ENTRIES: readonly PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n },\n {\n service: \"tinycloud.sql\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\", \"schema\"],\n },\n];\n\n/**\n * Default permission entries for the `\"all\"` tier: admin + DuckDB.\n *\n * DuckDB is opt-in and only appears in this tier or in explicit manifest\n * `permissions` entries.\n */\nconst DEFAULT_ALL_ENTRIES: readonly PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n },\n {\n service: \"tinycloud.sql\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\", \"schema\"],\n },\n {\n service: \"tinycloud.duckdb\",\n space: DEFAULT_MANIFEST_SPACE,\n path: \"/\",\n actions: [\"read\", \"write\"],\n },\n];\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Parse an ms-format duration string (e.g. \"30d\", \"2h\", \"1y\") into\n * milliseconds.\n *\n * @throws {ManifestValidationError} on empty string, non-string input, or\n * any input `ms()` cannot parse.\n */\nexport function parseExpiry(duration: string): number {\n if (typeof duration !== \"string\" || duration.length === 0) {\n throw new ManifestValidationError(\n `expiry must be a non-empty duration string (got ${JSON.stringify(duration)})`,\n );\n }\n // `ms` returns `undefined` for unparseable input and can return a number\n // or a string depending on the call signature; cast explicitly.\n const parsed = (ms as unknown as (v: string) => number | undefined)(duration);\n if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n throw new ManifestValidationError(\n `invalid expiry duration: ${JSON.stringify(duration)}`,\n );\n }\n return parsed;\n}\n\n/**\n * Expand a list of action short names (or already-expanded URNs) into full\n * ability URNs of the form `<service>/<action>`.\n *\n * Examples:\n * `expandActionShortNames(\"tinycloud.kv\", [\"get\", \"put\"])`\n * → `[\"tinycloud.kv/get\", \"tinycloud.kv/put\"]`\n * `expandActionShortNames(\"tinycloud.kv\", [\"tinycloud.kv/get\"])`\n * → `[\"tinycloud.kv/get\"]` (passed through unchanged)\n */\nexport function expandActionShortNames(\n service: string,\n actions: readonly string[],\n): string[] {\n return actions.map((a) => {\n if (a.includes(\"/\")) {\n // Already a full URN — pass through.\n return a;\n }\n return `${service}/${a}`;\n });\n}\n\n/**\n * Expand SDK virtual permission services into concrete recap-capable services.\n *\n * Today this handles `\"tinycloud.vault\"`, which is backed by inline\n * network-encrypted KV records:\n * - read/get: `vault/<path>` with `tinycloud.kv/get`\n * - write/put: `vault/<path>` with `tinycloud.kv/put`\n * - delete/del: `vault/<path>` with `tinycloud.kv/del`\n * - list: `vault/<path>` with `tinycloud.kv/list`\n * - head: `vault/<path>` with `tinycloud.kv/get`\n * - metadata: `vault/<path>` with `tinycloud.kv/metadata`\n */\nexport function expandPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n if (entry.service === ENCRYPTION_PERMISSION_SERVICE) {\n return expandEncryptionPermissionEntry(entry);\n }\n if (entry.service !== VAULT_PERMISSION_SERVICE) {\n return [\n {\n ...entry,\n actions: expandActionShortNames(entry.service, entry.actions),\n },\n ];\n }\n\n return expandVaultPermissionEntry(entry);\n}\n\n/**\n * Expand a `tinycloud.encryption` manifest entry.\n *\n * - `path` MUST be a networkId URN (`urn:tinycloud:encryption:...`).\n * The manifest prefix is always skipped — network ids are top-level\n * owner-scoped resources, not space-scoped paths.\n * - `actions` must be `decrypt`, `network.create`, or `network.revoke`\n * (or their already-expanded `tinycloud.encryption/*` forms).\n *\n * The returned entry uses an internal `space = \"encryption\"` compatibility\n * label so old manifest grouping code does not collapse it into the app's\n * data space, and `skipPrefix` is forced to `true` so the prefix application\n * step is a no-op.\n */\nfunction expandEncryptionPermissionEntry(\n entry: PermissionEntry,\n): PermissionEntry[] {\n if (\n typeof entry.path !== \"string\" ||\n !entry.path.startsWith(\"urn:tinycloud:encryption:\")\n ) {\n throw new ManifestValidationError(\n `tinycloud.encryption entries require path to be a networkId URN ` +\n `(got ${JSON.stringify(entry.path)})`,\n );\n }\n const normalizedActions: string[] = [];\n for (const action of entry.actions) {\n if (action === \"decrypt\" || action === \"tinycloud.encryption/decrypt\") {\n normalizedActions.push(\"tinycloud.encryption/decrypt\");\n continue;\n }\n if (\n action === \"network.create\" ||\n action === \"tinycloud.encryption/network.create\"\n ) {\n normalizedActions.push(\"tinycloud.encryption/network.create\");\n continue;\n }\n if (\n action === \"network.revoke\" ||\n action === \"tinycloud.encryption/network.revoke\"\n ) {\n normalizedActions.push(\"tinycloud.encryption/network.revoke\");\n continue;\n }\n if (action.includes(\"/\")) {\n throw new ManifestValidationError(\n `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n );\n }\n throw new ManifestValidationError(\n `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n );\n }\n // Dedupe while preserving order\n const dedupedActions: string[] = [];\n const seen = new Set<string>();\n for (const a of normalizedActions) {\n if (!seen.has(a)) {\n dedupedActions.push(a);\n seen.add(a);\n }\n }\n // Encryption resources are network-scoped, not space-scoped. We\n // always emit the synthetic \"encryption\" space label so manifest\n // grouping can deal with it uniformly without collapsing the\n // networkId URN into an app data space.\n return [\n {\n service: ENCRYPTION_PERMISSION_SERVICE,\n space: ENCRYPTION_MANIFEST_SPACE,\n path: entry.path,\n actions: dedupedActions,\n skipPrefix: true,\n ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n },\n ];\n}\n\n/**\n * Expand a list of permission entries using {@link expandPermissionEntry}.\n */\nexport function expandPermissionEntries(\n entries: readonly PermissionEntry[],\n): PermissionEntry[] {\n return entries.flatMap(expandPermissionEntry);\n}\n\n/**\n * Apply the manifest prefix to a permission path per the spec rules.\n *\n * - `skipPrefix: true` → path is returned as-is\n * - `prefix === \"\"` → path is returned as-is\n * - path starts with \"/\" → `prefix + path` (e.g. \"com.listen.app\" + \"/\" → \"com.listen.app/\")\n * - otherwise → `prefix + \"/\" + path` (e.g. \"com.listen.app\" + \"data.sqlite\" → \"com.listen.app/data.sqlite\")\n */\nexport function applyPrefix(\n prefix: string,\n path: string,\n skipPrefix: boolean,\n): string {\n if (skipPrefix) {\n return path;\n }\n if (prefix === \"\") {\n return path;\n }\n if (path.startsWith(\"/\")) {\n return `${prefix}${path}`;\n }\n return `${prefix}/${path}`;\n}\n\n/**\n * Fetch and parse a manifest from a URL (browser) or file path (node).\n * The runtime decides the fetch strategy via `globalThis.fetch`; this is\n * platform-agnostic. Callers that want custom loading should JSON.parse a\n * Manifest themselves and skip this helper.\n *\n * @throws if the fetch fails, the JSON is invalid, or the manifest fails\n * validation.\n */\nexport async function loadManifest(url: string): Promise<Manifest> {\n const fetchFn: typeof fetch | undefined = (\n globalThis as { fetch?: typeof fetch }\n ).fetch;\n if (typeof fetchFn !== \"function\") {\n throw new ManifestValidationError(\n \"loadManifest requires a global fetch; pass the manifest object directly on runtimes without fetch\",\n );\n }\n const res = await fetchFn(url);\n if (!res.ok) {\n throw new ManifestValidationError(\n `failed to fetch manifest from ${url}: HTTP ${res.status}`,\n );\n }\n const json = (await res.json()) as unknown;\n return validateManifest(json);\n}\n\n/**\n * Validate a manifest-shaped object and return it strongly-typed.\n * Throws {@link ManifestValidationError} on any hard failure.\n */\nexport function validateManifest(input: unknown): Manifest {\n if (input === null || typeof input !== \"object\") {\n throw new ManifestValidationError(\"manifest must be an object\");\n }\n const m = input as Manifest;\n if (\n m.manifest_version !== undefined &&\n m.manifest_version !== DEFAULT_MANIFEST_VERSION\n ) {\n throw new ManifestValidationError(\n `manifest.manifest_version must be ${DEFAULT_MANIFEST_VERSION}`,\n );\n }\n if (typeof m.app_id !== \"string\" || m.app_id.length === 0) {\n throw new ManifestValidationError(\n \"manifest.app_id is required and must be a non-empty string\",\n );\n }\n if (typeof m.name !== \"string\" || m.name.length === 0) {\n throw new ManifestValidationError(\n \"manifest.name is required and must be a non-empty string\",\n );\n }\n if (\n m.did !== undefined &&\n (typeof m.did !== \"string\" || m.did.length === 0)\n ) {\n throw new ManifestValidationError(\n \"manifest.did must be a non-empty DID string\",\n );\n }\n if (\n m.space !== undefined &&\n (typeof m.space !== \"string\" || m.space.length === 0)\n ) {\n throw new ManifestValidationError(\n \"manifest.space must be a non-empty string\",\n );\n }\n if (m.expiry !== undefined) {\n // Will throw with a clear error if invalid.\n parseExpiry(m.expiry);\n }\n if (m.knowledge !== undefined) {\n resolveManifestKnowledgeRoot(m.knowledge);\n }\n if (m.permissions !== undefined) {\n if (!Array.isArray(m.permissions)) {\n throw new ManifestValidationError(\n \"manifest.permissions must be an array\",\n );\n }\n m.permissions.forEach((p, i) =>\n validatePermissionEntry(p, `permissions[${i}]`),\n );\n }\n if (m.secrets !== undefined) {\n validateManifestSecrets(m.secrets);\n }\n return m;\n}\n\n/**\n * Resolve a manifest knowledge pointer to its root markdown file.\n *\n * This is metadata only; app knowledge does not create capabilities.\n */\nexport function resolveManifestKnowledgeRoot(\n knowledge: Manifest[\"knowledge\"] | undefined,\n): string | undefined {\n if (knowledge === undefined) {\n return undefined;\n }\n if (knowledge === true) {\n return DEFAULT_KNOWLEDGE_ROOT;\n }\n if (typeof knowledge !== \"string\" || knowledge.length === 0) {\n throw new ManifestValidationError(\n \"manifest.knowledge must be true or a knowledge/*.md root path\",\n );\n }\n if (!/^knowledge\\/.+\\.md$/.test(knowledge)) {\n throw new ManifestValidationError(\n \"manifest.knowledge must be true or a knowledge/*.md root path\",\n );\n }\n return knowledge;\n}\n\nfunction validateManifestSecrets(secrets: unknown): void {\n if (secrets === null || typeof secrets !== \"object\" || Array.isArray(secrets)) {\n throw new ManifestValidationError(\"manifest.secrets must be an object\");\n }\n\n for (const [name, spec] of Object.entries(secrets)) {\n if (!SECRET_NAME_RE.test(name)) {\n throw new ManifestValidationError(\n `manifest.secrets.${name} must match ${SECRET_NAME_RE.source}`,\n );\n }\n try {\n resolveSecretPath(\n secretNameFromSpec(name, spec as ManifestSecretActions),\n { scope: secretScopeFromSpec(spec as ManifestSecretActions) },\n );\n } catch (error) {\n throw new ManifestValidationError(\n `manifest.secrets.${name}: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n const actions = secretActionsFromSpec(name, spec as ManifestSecretActions);\n if (actions.length === 0) {\n throw new ManifestValidationError(\n `manifest.secrets.${name} actions must be non-empty`,\n );\n }\n for (const action of actions) {\n if (typeof action !== \"string\" || action.length === 0) {\n throw new ManifestValidationError(\n `manifest.secrets.${name} actions must be non-empty strings`,\n );\n }\n }\n if (\n spec !== null &&\n typeof spec === \"object\" &&\n !Array.isArray(spec) &&\n (spec as { expiry?: unknown }).expiry !== undefined\n ) {\n parseExpiry((spec as { expiry: string }).expiry);\n }\n }\n}\n\nfunction validatePermissionEntry(p: unknown, path: string): void {\n if (p === null || typeof p !== \"object\") {\n throw new ManifestValidationError(`${path} must be an object`);\n }\n const entry = p as PermissionEntry;\n if (typeof entry.service !== \"string\" || entry.service.length === 0) {\n throw new ManifestValidationError(`${path}.service is required`);\n }\n if (\n entry.space !== undefined &&\n (typeof entry.space !== \"string\" || entry.space.length === 0)\n ) {\n throw new ManifestValidationError(\n `${path}.space must be a non-empty string`,\n );\n }\n if (typeof entry.path !== \"string\") {\n throw new ManifestValidationError(\n `${path}.path is required (use \"\" or \"/\" for root)`,\n );\n }\n if (!Array.isArray(entry.actions) || entry.actions.length === 0) {\n throw new ManifestValidationError(\n `${path}.actions must be a non-empty array`,\n );\n }\n for (const action of entry.actions) {\n if (typeof action !== \"string\" || action.length === 0) {\n throw new ManifestValidationError(\n `${path}.actions must contain non-empty strings`,\n );\n }\n if (entry.service === VAULT_PERMISSION_SERVICE) {\n vaultActionExpansion(action);\n }\n }\n if (entry.caveats !== undefined &&\n (!Array.isArray(entry.caveats) || entry.caveats.some((caveat) =>\n caveat === null || typeof caveat !== \"object\" || Array.isArray(caveat)\n ))\n ) {\n throw new ManifestValidationError(`${path}.caveats must be an array of objects`);\n }\n if (entry.expiry !== undefined) {\n parseExpiry(entry.expiry);\n }\n}\n\n/**\n * Normalize a `defaults` value: lowercase + trim, then match against known\n * tiers. Unknown string values silently fall back to `true` (standard).\n * Boolean values pass through.\n */\nexport function normalizeDefaults(\n value: Manifest[\"defaults\"] | undefined,\n): ManifestDefaults {\n if (value === undefined) {\n return DEFAULT_DEFAULTS;\n }\n if (typeof value === \"boolean\") {\n return value;\n }\n if (typeof value !== \"string\") {\n // Spec says unknown values silently fall back to `true`.\n return true;\n }\n const normalized = value.trim().toLowerCase();\n if (normalized === \"admin\" || normalized === \"all\") {\n return normalized;\n }\n // Anything else, including \"true\"/\"false\"/\"standard\"/garbage, falls back\n // to the standard tier per spec.\n return true;\n}\n\n/**\n * Return the default permission entries for the given tier. Entries are\n * deep-cloned so callers can mutate them without affecting the constants.\n */\nfunction defaultEntriesForTier(tier: ManifestDefaults): PermissionEntry[] {\n if (tier === false) {\n return [];\n }\n const source =\n tier === \"admin\"\n ? DEFAULT_ADMIN_ENTRIES\n : tier === \"all\"\n ? DEFAULT_ALL_ENTRIES\n : DEFAULT_STANDARD_ENTRIES;\n return source.map((e) => ({\n service: e.service,\n space: e.space,\n path: e.path,\n actions: [...e.actions],\n ...(e.skipPrefix !== undefined ? { skipPrefix: e.skipPrefix } : {}),\n }));\n}\n\n/**\n * Resolve a raw manifest into a {@link ResolvedCapabilities} object: expand\n * shortform actions, apply the prefix, merge defaults, and compute effective\n * expiries. Pure function — does no I/O.\n *\n * Resolution semantics (spec):\n * - `prefix` defaults to `app_id`; set to `\"\"` to disable prefix application entirely.\n * - `space` defaults to `applications`; per-permission `space` overrides it.\n * - `defaults` defaults to `true` (standard tier); unknown string values fall back to `true`.\n * - Per-entry expiry overrides per-delegation overrides manifest > `DEFAULT_EXPIRY`.\n * - Default entries use `skipPrefix: false` so they inherit the manifest prefix.\n */\nexport function resolveManifest(input: Manifest): ResolvedCapabilities {\n const manifest = validateManifest(input);\n\n const prefix =\n manifest.prefix !== undefined ? manifest.prefix : manifest.app_id;\n const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;\n const expiryMs = parseExpiry(manifest.expiry ?? DEFAULT_EXPIRY);\n const includePublicSpace = manifest.includePublicSpace ?? true;\n const tier = normalizeDefaults(manifest.defaults);\n\n const defaultEntries = defaultEntriesForTier(tier);\n const explicitEntries = manifest.permissions ?? [];\n const secretEntries = secretEntriesForManifest(manifest.secrets);\n\n // Merge order: defaults first, then explicit entries, so explicit entries\n // for the same (service, space, path) tuple override defaults.\n const allEntries: PermissionEntry[] = [\n ...defaultEntries,\n ...explicitEntries,\n ...secretEntries,\n ];\n\n const resources: ResourceCapability[] = withCapabilitiesReadForSpaces(\n allEntries.flatMap((entry) => resolveEntry(entry, prefix, expiryMs, space)),\n );\n\n const additionalDelegates: ResolvedDelegate[] =\n manifest.did === undefined\n ? []\n : [\n {\n did: manifest.did,\n name: manifest.name,\n expiryMs,\n permissions: resources.map(cloneResourceCapability),\n },\n ];\n\n return {\n app_id: manifest.app_id,\n ...(manifest.did !== undefined ? { did: manifest.did } : {}),\n space,\n resources,\n expiryMs,\n includePublicSpace,\n additionalDelegates,\n };\n}\n\nfunction normalizeSecretActions(actions: readonly string[]): string[] {\n const out: string[] = [];\n const seen = new Set<string>();\n const add = (action: string) => {\n if (!seen.has(action)) {\n out.push(action);\n seen.add(action);\n }\n };\n\n for (const action of actions) {\n if (action === \"read\") {\n add(\"get\");\n continue;\n }\n if (action === \"write\") {\n add(\"put\");\n continue;\n }\n if (action === \"delete\") {\n add(\"del\");\n continue;\n }\n if (\n action === \"get\" ||\n action === \"put\" ||\n action === \"del\" ||\n action === \"list\" ||\n action === \"metadata\"\n ) {\n add(action);\n continue;\n }\n if (\n action === \"tinycloud.kv/get\" ||\n action === \"tinycloud.kv/put\" ||\n action === \"tinycloud.kv/del\" ||\n action === \"tinycloud.kv/list\" ||\n action === \"tinycloud.kv/metadata\"\n ) {\n add(action);\n continue;\n }\n throw new ManifestValidationError(\n `unknown secret action ${JSON.stringify(action)}; expected read, write, delete, list, or metadata`,\n );\n }\n\n return out;\n}\n\nfunction secretNameFromSpec(\n fallbackName: string,\n spec: ManifestSecretActions,\n): string {\n if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n return spec.name ?? fallbackName;\n }\n return fallbackName;\n}\n\nfunction secretScopeFromSpec(\n spec: ManifestSecretActions,\n): string | undefined {\n if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n return spec.scope;\n }\n return undefined;\n}\n\nfunction secretActionsFromSpec(\n name: string,\n spec: ManifestSecretActions,\n): string[] {\n if (spec === true) {\n return [\"read\"];\n }\n if (typeof spec === \"string\") {\n return [spec];\n }\n if (Array.isArray(spec)) {\n return spec;\n }\n if (spec === null || typeof spec !== \"object\") {\n throw new ManifestValidationError(\n `manifest.secrets.${name} must be true, a string action, an actions array, or an object`,\n );\n }\n if (spec.actions === undefined) {\n return [\"read\"];\n }\n if (typeof spec.actions === \"string\") {\n return [spec.actions];\n }\n if (Array.isArray(spec.actions)) {\n return spec.actions;\n }\n throw new ManifestValidationError(\n `manifest.secrets.${name}.actions must be a string or array`,\n );\n}\n\nfunction secretEntriesForManifest(\n secrets: Manifest[\"secrets\"] | undefined,\n): PermissionEntry[] {\n if (secrets === undefined) {\n return [];\n }\n\n const entries: PermissionEntry[] = [];\n for (const [name, spec] of Object.entries(secrets)) {\n const actions = secretActionsFromSpec(name, spec);\n const secretPath = resolveSecretPath(\n secretNameFromSpec(name, spec),\n { scope: secretScopeFromSpec(spec) },\n );\n const extra: { expiry?: string; description?: string } =\n spec !== true && typeof spec === \"object\" && !Array.isArray(spec)\n ? spec\n : {};\n entries.push({\n service: VAULT_PERMISSION_SERVICE,\n space: SECRETS_SPACE,\n path: secretPath.vaultKey,\n actions: normalizeSecretActions(actions),\n skipPrefix: true,\n ...(extra.expiry !== undefined ? { expiry: extra.expiry } : {}),\n ...(extra.description !== undefined\n ? { description: extra.description }\n : {}),\n });\n }\n return entries;\n}\n\n/**\n * Expand a single permission entry into a {@link ResourceCapability}:\n * apply the prefix to the path and expand short actions into full URNs.\n */\nfunction resolveEntry(\n entry: PermissionEntry,\n prefix: string,\n _inheritedExpiryMs: number,\n inheritedSpace: string,\n): ResourceCapability[] {\n // Encryption permissions reference a networkId URN as their resource\n // — the manifest prefix is meaningless against a top-level\n // owner-scoped resource and would corrupt the URN. Always skip.\n const skipPrefixForEntry =\n entry.skipPrefix === true ||\n entry.service === ENCRYPTION_PERMISSION_SERVICE;\n const resolvedPath = applyPrefix(prefix, entry.path, skipPrefixForEntry);\n const entryExpiryMs =\n entry.expiry !== undefined ? parseExpiry(entry.expiry) : undefined;\n return expandPermissionEntry({\n ...entry,\n space: entry.space ?? inheritedSpace,\n path: resolvedPath,\n skipPrefix: true,\n }).map((expanded) => ({\n service: expanded.service,\n space: expanded.space ?? inheritedSpace,\n path: expanded.path,\n actions: expanded.actions,\n // Only populate `expiryMs` when the entry had its own expiry override.\n // When absent, callers use the parent (delegation or manifest) expiry\n // which is carried on ResolvedDelegate.expiryMs / ResolvedCapabilities.expiryMs.\n ...(entryExpiryMs !== undefined ? { expiryMs: entryExpiryMs } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n }));\n}\n\nfunction expandVaultPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n const byBase = new Map<VaultKVBase, string[]>();\n\n for (const action of entry.actions) {\n const expansion = vaultActionExpansion(action);\n for (const base of expansion.bases) {\n const actions = byBase.get(base) ?? [];\n if (!actions.includes(expansion.action)) {\n actions.push(expansion.action);\n }\n byBase.set(base, actions);\n }\n }\n\n return [...byBase.entries()].map(([base, actions]) => ({\n ...entry,\n service: \"tinycloud.kv\",\n path: vaultKVPath(base, entry.path),\n actions,\n skipPrefix: true,\n }));\n}\n\nfunction vaultActionExpansion(action: string): VaultActionExpansion {\n const normalized = normalizeVaultAction(action);\n if (normalized === \"read\" || normalized === \"get\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n }\n if (normalized === \"write\" || normalized === \"put\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/put\" };\n }\n if (normalized === \"delete\" || normalized === \"del\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/del\" };\n }\n if (normalized === \"list\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/list\" };\n }\n if (normalized === \"head\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n }\n if (normalized === \"metadata\") {\n return { bases: [\"vault\"], action: \"tinycloud.kv/metadata\" };\n }\n\n throw new ManifestValidationError(\n `unknown vault action ${JSON.stringify(action)}; expected read, write, delete, get, put, del, list, head, or metadata`,\n );\n}\n\nfunction normalizeVaultAction(action: string): string {\n if (action.startsWith(`${VAULT_PERMISSION_SERVICE}/`)) {\n return action.slice(`${VAULT_PERMISSION_SERVICE}/`.length);\n }\n if (action.startsWith(\"tinycloud.kv/\")) {\n return action.slice(\"tinycloud.kv/\".length);\n }\n if (action.includes(\"/\")) {\n throw new ManifestValidationError(\n `unknown vault action ${JSON.stringify(action)}; expected a tinycloud.vault or tinycloud.kv action`,\n );\n }\n return action;\n}\n\nfunction vaultKVPath(base: VaultKVBase, path: string): string {\n const normalized = path.startsWith(\"/\") ? path.slice(1) : path;\n return `${base}/${normalized}`;\n}\n\nfunction cloneResourceCapability(\n entry: ResourceCapability,\n): ResourceCapability {\n return {\n service: entry.service,\n space: entry.space,\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.expiryMs !== undefined ? { expiryMs: entry.expiryMs } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n };\n}\n\nfunction clonePermissionEntry(entry: PermissionEntry): PermissionEntry {\n return {\n service: entry.service,\n ...(entry.space !== undefined ? { space: entry.space } : {}),\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.caveats !== undefined\n ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n : {}),\n ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n ...(entry.description !== undefined\n ? { description: entry.description }\n : {}),\n };\n}\n\nfunction dedupeResources(\n resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n const byKey = new Map<string, ResourceCapability>();\n\n for (const resource of resources) {\n const key = `${resource.service}\\u0000${resource.space}\\u0000${resource.path}\\u0000${resource.expiryMs ?? \"\"}`;\n const existing = byKey.get(key);\n if (existing === undefined) {\n byKey.set(key, cloneResourceCapability(resource));\n continue;\n }\n\n const seen = new Set(existing.actions);\n for (const action of resource.actions) {\n if (!seen.has(action)) {\n existing.actions.push(action);\n seen.add(action);\n }\n }\n if (\n existing.description === undefined &&\n resource.description !== undefined\n ) {\n existing.description = resource.description;\n }\n }\n\n return [...byKey.values()];\n}\n\nfunction capabilitiesReadPermission(space: string): ResourceCapability {\n return {\n service: \"tinycloud.capabilities\",\n space,\n path: \"\",\n actions: [\"tinycloud.capabilities/read\"],\n };\n}\n\nfunction withCapabilitiesReadForSpaces(\n resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n if (resources.length === 0) {\n return [];\n }\n\n const spaces = new Set(\n resources\n .filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE)\n .map((resource) => resource.space),\n );\n return dedupeResources([\n ...resources,\n ...[...spaces].map(capabilitiesReadPermission),\n ]);\n}\n\nfunction accountRegistryPermissions(): ResourceCapability[] {\n return [\n ...[ACCOUNT_REGISTRY_PATH, \"spaces/\"].map((path) => ({\n service: \"tinycloud.kv\",\n space: ACCOUNT_REGISTRY_SPACE,\n path,\n actions: [\"tinycloud.kv/get\", \"tinycloud.kv/put\", \"tinycloud.kv/list\"],\n })),\n {\n service: \"tinycloud.delegation\",\n space: ACCOUNT_REGISTRY_SPACE,\n path: \"\",\n actions: [\"tinycloud.delegation/list\"],\n },\n ];\n}\n\nfunction accountRegistryIndexPermission(): ResourceCapability {\n return {\n service: \"tinycloud.sql\",\n space: ACCOUNT_REGISTRY_SPACE,\n path: \"account\",\n actions: [\"tinycloud.sql/read\", \"tinycloud.sql/write\", \"tinycloud.sql/schema\"],\n };\n}\n\n/**\n * Compose one or more manifests into the single capability request that should\n * be signed. Fetching manifests is intentionally out of band; callers pass the\n * already-loaded manifest objects.\n */\nexport function composeManifestRequest(\n inputs: readonly Manifest[],\n options: ComposeManifestOptions = {},\n): ComposedManifestRequest {\n if (!Array.isArray(inputs) || inputs.length === 0) {\n throw new ManifestValidationError(\n \"composeManifestRequest requires at least one manifest\",\n );\n }\n\n const includeAccountRegistryPermissions =\n options.includeAccountRegistryPermissions ?? true;\n const manifests = inputs.map(validateManifest);\n const resolved = manifests.map(resolveManifest);\n const resources = resolved.flatMap((entry) => entry.resources);\n const delegationTargets = resolved.flatMap((entry) =>\n entry.additionalDelegates.map((delegate) => ({\n ...delegate,\n permissions: dedupeResources(delegate.permissions),\n })),\n );\n\n if (includeAccountRegistryPermissions) {\n resources.push(...accountRegistryPermissions());\n resources.push(accountRegistryIndexPermission());\n }\n const resourcesWithImplicitCapabilities =\n withCapabilitiesReadForSpaces(resources);\n\n const manifestsByAppId = new Map<string, Manifest[]>();\n for (const manifest of manifests) {\n const current = manifestsByAppId.get(manifest.app_id);\n if (current === undefined) {\n manifestsByAppId.set(manifest.app_id, [manifest]);\n } else {\n current.push(manifest);\n }\n }\n\n const registryRecords: ManifestRegistryRecord[] =\n includeAccountRegistryPermissions\n ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({\n key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,\n app_id,\n manifests: appManifests.map((manifest) => ({\n ...manifest,\n permissions: manifest.permissions?.map(clonePermissionEntry),\n })),\n }))\n : [];\n\n return {\n manifests,\n resources: resourcesWithImplicitCapabilities,\n delegationTargets,\n registryRecords,\n expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),\n includePublicSpace: resolved.some((entry) => entry.includePublicSpace),\n };\n}\n\n// ---------------------------------------------------------------------------\n// Abilities map construction (bridge to WASM prepareSession / createDelegation)\n// ---------------------------------------------------------------------------\n\n/**\n * The shape `prepareSession` and the multi-resource `createDelegation` WASM\n * export both accept:\n *\n * ```\n * { [shortService]: { [path]: [fullUrnAction, ...] } }\n * ```\n *\n * - `shortService` is the recap-level service segment (`\"kv\"`, `\"sql\"`,\n * `\"duckdb\"`, `\"capabilities\"`, `\"hooks\"`) — not the manifest long form.\n * - `path` is the fully-resolved path (prefix already applied). An empty\n * string means \"no path segment\" on the resource URI.\n * - Action strings are full URNs like `\"tinycloud.kv/get\"`.\n *\n * This is a single source of truth for both the session's own recap (at\n * sign-in) and the delegations it can derive (post sign-in). We re-use it\n * for both so one manifest drives both sides.\n */\nexport type AbilitiesMap = Record<string, Record<string, string[]>>;\n\n/**\n * Per-space abilities map accepted by the newer WASM session config:\n *\n * ```\n * { [spaceIdOrName]: { [shortService]: { [path]: [fullUrnAction, ...] } } }\n * ```\n */\nexport type SpaceAbilitiesMap = Record<string, AbilitiesMap>;\n\n/**\n * Convert a list of {@link ResourceCapability} entries (manifest\n * long-form service, full-URN actions) into the {@link AbilitiesMap}\n * shape the WASM layer expects.\n *\n * When multiple entries target the same `(service, path)` pair, their\n * action lists are merged and deduped. Entries whose service has no\n * short-form mapping in {@link SERVICE_LONG_TO_SHORT} are rejected with\n * a {@link ManifestValidationError} — the SDK does not silently drop\n * unknown services because the recap encoding would lose them.\n *\n * Paths are kept verbatim: this function does NOT collapse\n * `\"com.listen.app/\"` and `\"com.listen.app\"` or reinterpret empty /\n * slash strings. Callers that care about path canonicalization should\n * normalize before calling.\n */\nexport function resourceCapabilitiesToAbilitiesMap(\n resources: readonly ResourceCapability[],\n): AbilitiesMap {\n const out: AbilitiesMap = {};\n for (const r of resources) {\n const shortService = SERVICE_LONG_TO_SHORT[r.service];\n if (shortService === undefined) {\n throw new ManifestValidationError(\n `unknown service '${r.service}' — no short-form mapping. Known services: ${Object.keys(SERVICE_LONG_TO_SHORT).join(\", \")}`,\n );\n }\n if (out[shortService] === undefined) {\n out[shortService] = {};\n }\n const pathsMap = out[shortService];\n const existing = pathsMap[r.path];\n if (existing === undefined) {\n // Copy so downstream mutation can't leak back into the input.\n pathsMap[r.path] = [...r.actions];\n } else {\n // Merge + dedupe while preserving first-seen order.\n const seen = new Set(existing);\n for (const action of r.actions) {\n if (!seen.has(action)) {\n existing.push(action);\n seen.add(action);\n }\n }\n }\n }\n return out;\n}\n\n/**\n * Group resolved capabilities by `space`, then convert each group into a WASM\n * abilities map. Short space names are left as-is here; platform layers that\n * know the wallet address and chain id turn them into full SpaceIds.\n */\nexport function resourceCapabilitiesToSpaceAbilitiesMap(\n resources: readonly ResourceCapability[],\n): SpaceAbilitiesMap {\n const grouped = new Map<string, ResourceCapability[]>();\n for (const resource of resources) {\n const entries = grouped.get(resource.space);\n if (entries === undefined) {\n grouped.set(resource.space, [resource]);\n } else {\n entries.push(resource);\n }\n }\n\n const out: SpaceAbilitiesMap = {};\n for (const [space, entries] of grouped.entries()) {\n out[space] = resourceCapabilitiesToAbilitiesMap(entries);\n }\n return out;\n}\n\n/**\n * Build the {@link AbilitiesMap} that a session should be signed with,\n * given a {@link ResolvedCapabilities} (i.e. the output of\n * {@link resolveManifest}).\n *\n * The resulting map is the **union** of:\n * 1. the app's own resources (`resolved.resources`), and\n * 2. every permission declared in every `additionalDelegates[*]` entry.\n *\n * The union is what makes the manifest's delegations ergonomic: at\n * sign-in, the session key acquires recap coverage for both the app's\n * runtime needs and every downstream delegation target. Post sign-in,\n * `delegateTo(backendDID, backendPermissions)` can then issue the\n * sub-delegation via the session key (no wallet prompt) because the\n * caps are already part of the granted set.\n *\n * Duplicate `(service, path, action)` triples across resources and\n * delegations are merged and deduped — the session SIWE doesn't need\n * them repeated.\n */\nexport function manifestAbilitiesUnion(\n resolved: ResolvedCapabilities,\n): AbilitiesMap {\n const all: ResourceCapability[] = [...resolved.resources];\n for (const delegate of resolved.additionalDelegates) {\n for (const perm of delegate.permissions) {\n all.push(perm);\n }\n }\n return resourceCapabilitiesToAbilitiesMap(all);\n}\n","/**\n * Shared space utilities for TinyCloud.\n *\n * These functions are platform-agnostic and can be used by both\n * web-sdk and node-sdk for space hosting and session activation.\n */\n\n/**\n * Result of a space hosting or session activation attempt.\n */\nexport interface SpaceHostResult {\n /** Whether the operation succeeded (2xx status) */\n success: boolean;\n /** HTTP status code */\n status: number;\n /** Error message if failed */\n error?: string;\n /** Space IDs that were successfully activated */\n activated?: string[];\n /** Space IDs that were skipped (e.g., space doesn't exist yet) */\n skipped?: string[];\n /** Raw node receipt CID. This identifies the commit event, not the delegation. */\n commitEventCid?: string;\n}\n\n/**\n * Fetch the peer ID from TinyCloud server for space hosting.\n *\n * The peer ID identifies the TinyCloud server instance that will host the space.\n *\n * @param host - TinyCloud server URL (e.g., \"https://node.tinycloud.xyz\")\n * @param spaceId - The space ID to host\n * @returns The peer ID string\n * @throws Error if the request fails\n */\nexport async function fetchPeerId(\n host: string,\n spaceId: string\n): Promise<string> {\n const res = await fetch(\n `${host}/peer/generate/${encodeURIComponent(spaceId)}`\n );\n\n if (!res.ok) {\n const error = await res.text().catch(() => res.statusText);\n throw new Error(`Failed to get peer ID: ${res.status} - ${error}`);\n }\n\n return res.text();\n}\n\n/**\n * Submit a space hosting delegation to TinyCloud server.\n *\n * This registers a new space with the server, allowing the user\n * to store data in it.\n *\n * @param host - TinyCloud server URL\n * @param headers - Delegation headers (from siweToDelegationHeaders)\n * @returns Result indicating success/failure\n */\nexport async function submitHostDelegation(\n host: string,\n headers: Record<string, string>\n): Promise<SpaceHostResult> {\n const res = await fetch(`${host}/delegate`, {\n method: \"POST\",\n headers,\n });\n\n if (!res.ok) {\n return {\n success: false,\n status: res.status,\n error: await res.text().catch(() => res.statusText),\n };\n }\n try {\n const body = await res.json() as { cid?: string; activated?: string[]; skipped?: string[] };\n return {\n success: true,\n status: res.status,\n commitEventCid: body.cid,\n activated: body.activated ?? [],\n skipped: body.skipped ?? [],\n };\n } catch {\n return { success: true, status: res.status, activated: [], skipped: [] };\n }\n}\n\n/**\n * Activate a session with TinyCloud server.\n *\n * This submits the session delegation to the server, enabling the session\n * key to perform operations on behalf of the user.\n *\n * @param host - TinyCloud server URL\n * @param delegationHeader - Session delegation header (from session.delegationHeader)\n * @returns Result indicating success/failure (404 means space doesn't exist)\n */\nexport async function activateSessionWithHost(\n host: string,\n delegationHeader: { Authorization: string }\n): Promise<SpaceHostResult> {\n const res = await fetch(`${host}/delegate`, {\n method: \"POST\",\n headers: delegationHeader,\n });\n\n if (res.ok) {\n try {\n const body = await res.json() as { cid?: string; activated?: string[]; skipped?: string[] };\n return {\n success: true,\n status: res.status,\n activated: body.activated ?? [],\n skipped: body.skipped ?? [],\n commitEventCid: body.cid,\n };\n } catch {\n // Fallback for older servers that return plain text CID\n return {\n success: true,\n status: res.status,\n activated: [],\n skipped: [],\n };\n }\n }\n\n return {\n success: false,\n status: res.status,\n error: await res.text().catch(() => res.statusText),\n };\n}\n","/**\n * DelegationManager - Handles delegation CRUD operations.\n *\n * This class manages the creation, revocation, listing, and querying\n * of delegations within TinyCloud. It extracts and improves upon the\n * delegation functionality previously in ITinyCloudStorage.\n *\n * @packageDocumentation\n */\n\nimport type {\n FetchFunction,\n FetchResponse,\n InvokeAnyFunction,\n InvokeFunction,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n Result,\n DelegationError,\n DelegationErrorCodes,\n Delegation,\n DelegationStatus,\n DelegationStatusSchema,\n DelegationRevocationReceipt,\n DelegationRevocationReceiptSchema,\n AccountDelegationPage,\n AccountDelegationPageSchema,\n AccountDelegationQueryOptionsSchema,\n AccountDelegationQueryOptions,\n CreateDelegationParams,\n DelegationChain,\n DelegationManagerConfig,\n DelegationApiResponse,\n} from \"./types\";\nimport { EXPIRY } from \"../expiry\";\n\n/**\n * Delegation action constants.\n */\nconst DelegationAction = {\n CREATE: \"tinycloud.delegation/create\",\n REVOKE: \"tinycloud.delegation/revoke\",\n STATUS: \"tinycloud.delegation/status\",\n LIST: \"tinycloud.delegation/list\",\n GET: \"tinycloud.delegation/get\",\n CHECK: \"tinycloud.delegation/check\",\n} as const;\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n code: string,\n message: string,\n cause?: Error,\n meta?: Record<string, unknown>\n): DelegationError {\n return {\n code,\n message,\n service: \"delegation\",\n cause,\n meta,\n };\n}\n\n/**\n * DelegationManager handles all delegation-related operations.\n *\n * @example\n * ```typescript\n * import { DelegationManager } from \"@tinycloud/sdk-core/delegations\";\n *\n * const delegations = new DelegationManager({\n * hosts: [\"https://node.tinycloud.xyz\"],\n * session,\n * invoke,\n * });\n *\n * // Create a delegation\n * const result = await delegations.create({\n * delegateDID: \"did:pkh:eip155:1:0x...\",\n * path: \"shared/\",\n * actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n * expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours\n * });\n *\n * if (result.ok) {\n * console.log(\"Created delegation:\", result.data.cid);\n * }\n * ```\n */\nexport class DelegationManager {\n private hosts: string[];\n private session: ServiceSession;\n private invoke: InvokeFunction;\n private invokeAny?: InvokeAnyFunction;\n private fetchFn: FetchFunction;\n private accountSpaceId?: string;\n\n /**\n * Creates a new DelegationManager instance.\n *\n * @param config - Configuration including hosts, session, and invoke function\n */\n constructor(config: DelegationManagerConfig) {\n this.hosts = config.hosts;\n this.session = config.session;\n this.invoke = config.invoke;\n this.invokeAny = config.invokeAny;\n this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n this.accountSpaceId = config.accountSpaceId;\n }\n\n /**\n * Updates the session (e.g., after re-authentication).\n *\n * @param session - New session to use for operations\n */\n public updateSession(session: ServiceSession): void {\n this.session = session;\n }\n\n /**\n * Gets the primary host URL.\n */\n private get host(): string {\n return this.hosts[0];\n }\n\n /**\n * Executes an invoke operation against the delegation API.\n */\n private async invokeOperation(\n path: string,\n action: string,\n body?: string\n ): Promise<FetchResponse> {\n const headers = this.invoke(this.session, \"delegation\", path, action);\n\n return this.fetchFn(`${this.host}/invoke`, {\n method: \"POST\",\n headers,\n body,\n });\n }\n\n /**\n * Creates a new delegation.\n *\n * Delegates specific permissions to another DID for a given path.\n * The delegatee can then use these permissions to access resources\n * within the specified scope.\n *\n * @param params - Parameters for the delegation\n * @returns Result containing the created Delegation or an error\n *\n * @example\n * ```typescript\n * const result = await manager.create({\n * delegateDID: bob.did,\n * path: \"documents/shared/\",\n * actions: [\"tinycloud.kv/get\", \"tinycloud.kv/put\"],\n * expiry: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days\n * });\n * ```\n */\n async create(params: CreateDelegationParams): Promise<Result<Delegation>> {\n // Validate inputs\n if (!params.delegateDID) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"delegateDID is required\"\n ),\n };\n }\n\n if (!params.path) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"path is required\"\n ),\n };\n }\n\n if (!params.actions || params.actions.length === 0) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"at least one action is required\"\n ),\n };\n }\n\n try {\n const body = JSON.stringify({\n delegateDID: params.delegateDID,\n path: params.path,\n actions: params.actions,\n expiry: params.expiry?.toISOString(),\n disableSubDelegation: params.disableSubDelegation ?? false,\n statement: params.statement,\n });\n\n const response = await this.invokeOperation(\n params.path,\n DelegationAction.CREATE,\n body\n );\n\n if (!response.ok) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to create delegation: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, path: params.path }\n ),\n };\n }\n\n const apiResponse = (await response.json()) as DelegationApiResponse;\n\n const delegation: Delegation = {\n cid: apiResponse.cid ?? \"\",\n delegateDID: params.delegateDID,\n spaceId: this.session.spaceId,\n path: params.path,\n actions: params.actions,\n expiry: params.expiry ?? new Date(Date.now() + EXPIRY.SHARE_MS),\n isRevoked: false,\n allowSubDelegation: !(params.disableSubDelegation ?? false),\n createdAt: new Date(),\n };\n\n return { ok: true, data: delegation };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation creation: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Revokes an existing delegation.\n *\n * Once revoked, the delegation can no longer be used to access resources.\n * This also invalidates any sub-delegations derived from this delegation.\n *\n * @param cid - The CID of the delegation to revoke\n * @returns Result indicating success or an error\n *\n * @example\n * ```typescript\n * const result = await manager.revoke(\"bafy...\");\n * if (result.ok) {\n * console.log(\"Delegation revoked successfully\");\n * }\n * ```\n */\n async revoke(cid: string): Promise<Result<DelegationRevocationReceipt>> {\n if (!cid) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"cid is required\"\n ),\n };\n }\n\n try {\n if (!this.invokeAny) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Revocation requires an invokeAny function that can sign the target CID\"\n ),\n };\n }\n\n const headers = this.invokeAny(\n this.session,\n [{\n resource: `urn:cid:${cid}`,\n service: \"delegation\",\n path: \"\",\n action: DelegationAction.REVOKE,\n }],\n );\n const response = await this.fetchFn(`${this.host}/revoke`, {\n method: \"POST\",\n headers,\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n\n if (response.status === 404) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_FOUND,\n `Delegation not found: ${cid}`\n ),\n };\n }\n\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.REVOCATION_FAILED,\n `Failed to revoke delegation: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, cid }\n ),\n };\n }\n\n const parsed = DelegationRevocationReceiptSchema.safeParse(await response.json());\n if (!parsed.success || parsed.data.cid !== cid) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.REVOCATION_FAILED,\n \"Node returned an invalid delegation revocation receipt\",\n undefined,\n { cid },\n ),\n };\n }\n return { ok: true, data: parsed.data };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation revocation: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Reads the node-confirmed lifecycle state of one delegation without\n * exposing delegation metadata.\n */\n async status(cid: string): Promise<Result<DelegationStatus>> {\n if (!cid) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.INVALID_INPUT, \"cid is required\"),\n };\n }\n if (!this.invokeAny) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Delegation status requires an invokeAny function that can sign the target CID\"\n ),\n };\n }\n\n try {\n const headers = this.invokeAny(this.session, [{\n resource: `urn:cid:${cid}`,\n service: \"delegation\",\n path: \"\",\n action: DelegationAction.STATUS,\n }]);\n const response = await this.fetchFn(`${this.host}/delegation/status`, {\n method: \"POST\",\n headers: { ...headers, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ cid }),\n });\n if (!response.ok && response.status !== 404) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to get delegation status: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, cid }\n ),\n };\n }\n const parsed = DelegationStatusSchema.safeParse(await response.json());\n const responseStatusMatches = parsed.success && (\n response.status === 404\n ? parsed.data.status === \"not_found\" && !parsed.data.exists\n : parsed.data.status !== \"not_found\"\n );\n if (!parsed.success || parsed.data.cid !== cid || !responseStatusMatches) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Node returned an invalid delegation status response\",\n undefined,\n { cid }\n ),\n };\n }\n return { ok: true, data: parsed.data };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.ABORTED, \"Request aborted\", error),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation status: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /** Query lifecycle-complete delegation history for the authenticated account. */\n async query(\n options: AccountDelegationQueryOptions = {},\n ): Promise<Result<AccountDelegationPage>> {\n const validated = AccountDelegationQueryOptionsSchema.safeParse(options);\n if (!validated.success) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"Invalid delegation query options\",\n undefined,\n { issues: validated.error.issues },\n ),\n };\n }\n if (!this.invokeAny) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Delegation query requires an invokeAny function\",\n ),\n };\n }\n if (!this.accountSpaceId) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Delegation query requires an account space\",\n ),\n };\n }\n try {\n const invocationHeaders = this.invokeAny(this.session, [{\n spaceId: this.accountSpaceId,\n service: \"delegation\",\n path: \"\",\n action: DelegationAction.LIST,\n }]);\n const headers = Object.fromEntries(new Headers(invocationHeaders).entries());\n headers[\"content-type\"] = \"application/json\";\n const response = await this.fetchFn(`${this.host}/delegation/query`, {\n method: \"POST\",\n headers,\n body: JSON.stringify(validated.data),\n });\n if (!response.ok) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to query delegations: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status },\n ),\n };\n }\n const parsed = AccountDelegationPageSchema.safeParse(await response.json());\n if (!parsed.success) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Node returned an invalid delegation query response\",\n ),\n };\n }\n return { ok: true, data: parsed.data };\n } catch (error) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation query: ${String(error)}`,\n error instanceof Error ? error : undefined,\n ),\n };\n }\n }\n\n /**\n * Lists all delegations for the current session's space.\n *\n * Returns both delegations created by the current user (as delegator)\n * and delegations granted to the current user (as delegatee).\n *\n * @returns Result containing an array of Delegations or an error\n *\n * @example\n * ```typescript\n * const result = await manager.list();\n * if (result.ok) {\n * for (const delegation of result.data) {\n * console.log(`${delegation.cid}: ${delegation.path} -> ${delegation.delegateDID}`);\n * }\n * }\n * ```\n */\n async list(): Promise<Result<Delegation[]>> {\n try {\n const response = await this.invokeOperation(\"\", DelegationAction.LIST);\n\n if (!response.ok) {\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to list delegations: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status }\n ),\n };\n }\n\n const data = (await response.json()) as Array<{\n cid: string;\n delegateDID: string;\n delegatorDID?: string;\n spaceId: string;\n path: string;\n actions: string[];\n expiry: string;\n isRevoked: boolean;\n createdAt?: string;\n parentCid?: string;\n allowSubDelegation?: boolean;\n }>;\n\n const delegations: Delegation[] = data.map((item) => ({\n cid: item.cid,\n delegateDID: item.delegateDID,\n delegatorDID: item.delegatorDID,\n spaceId: item.spaceId,\n path: item.path,\n actions: item.actions,\n expiry: new Date(item.expiry),\n isRevoked: item.isRevoked,\n createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n parentCid: item.parentCid,\n allowSubDelegation: item.allowSubDelegation,\n }));\n\n return { ok: true, data: delegations };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during delegation list: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Gets the full delegation chain for a given delegation.\n *\n * Returns the chain of delegations from the root (original delegator)\n * to the specified delegation, including all intermediate sub-delegations.\n *\n * @param cid - The CID of the delegation to get the chain for\n * @returns Result containing the DelegationChain or an error\n *\n * @example\n * ```typescript\n * const result = await manager.getChain(\"bafy...\");\n * if (result.ok) {\n * console.log(\"Chain length:\", result.data.length);\n * for (const delegation of result.data) {\n * console.log(`- ${delegation.delegatorDID} -> ${delegation.delegateDID}`);\n * }\n * }\n * ```\n */\n async getChain(cid: string): Promise<Result<DelegationChain>> {\n if (!cid) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"cid is required\"\n ),\n };\n }\n\n try {\n const body = JSON.stringify({ cid, includeChain: true });\n\n const response = await this.invokeOperation(\n cid,\n DelegationAction.GET,\n body\n );\n\n if (!response.ok) {\n const errorText = await response.text();\n\n if (response.status === 404) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_FOUND,\n `Delegation not found: ${cid}`\n ),\n };\n }\n\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to get delegation chain: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, cid }\n ),\n };\n }\n\n const data = (await response.json()) as {\n chain: Array<{\n cid: string;\n delegateDID: string;\n delegatorDID?: string;\n spaceId: string;\n path: string;\n actions: string[];\n expiry: string;\n isRevoked: boolean;\n createdAt?: string;\n parentCid?: string;\n allowSubDelegation?: boolean;\n }>;\n };\n\n const chain: DelegationChain = data.chain.map((item) => ({\n cid: item.cid,\n delegateDID: item.delegateDID,\n delegatorDID: item.delegatorDID,\n spaceId: item.spaceId,\n path: item.path,\n actions: item.actions,\n expiry: new Date(item.expiry),\n isRevoked: item.isRevoked,\n createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n parentCid: item.parentCid,\n allowSubDelegation: item.allowSubDelegation,\n }));\n\n return { ok: true, data: chain };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during chain retrieval: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n\n /**\n * Checks if the current session has permission for a given path and action.\n *\n * This can be used to verify permissions before attempting an operation,\n * or to implement custom access control logic.\n *\n * @param path - The resource path to check\n * @param action - The action to check (e.g., \"tinycloud.kv/get\")\n * @returns Result containing a boolean indicating permission or an error\n *\n * @example\n * ```typescript\n * const result = await manager.checkPermission(\"documents/private/\", \"tinycloud.kv/put\");\n * if (result.ok && result.data) {\n * console.log(\"Permission granted\");\n * } else {\n * console.log(\"Permission denied\");\n * }\n * ```\n */\n async checkPermission(path: string, action: string): Promise<Result<boolean>> {\n if (!path) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"path is required\"\n ),\n };\n }\n\n if (!action) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"action is required\"\n ),\n };\n }\n\n try {\n const body = JSON.stringify({ path, action });\n\n const response = await this.invokeOperation(\n path,\n DelegationAction.CHECK,\n body\n );\n\n if (!response.ok) {\n // 403 means permission denied, which is a valid result\n if (response.status === 403) {\n return { ok: true, data: false };\n }\n\n const errorText = await response.text();\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Failed to check permission: ${response.status} - ${errorText}`,\n undefined,\n { status: response.status, path, action }\n ),\n };\n }\n\n const data = (await response.json()) as { allowed: boolean };\n return { ok: true, data: data.allowed };\n } catch (error) {\n if (error instanceof Error && error.name === \"AbortError\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.ABORTED,\n \"Request aborted\",\n error\n ),\n };\n }\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NETWORK_ERROR,\n `Network error during permission check: ${String(error)}`,\n error instanceof Error ? error : undefined\n ),\n };\n }\n }\n}\n","/**\n * Zod schemas for SharingService types.\n *\n * These schemas provide runtime validation for sharing link data,\n * receive options, and service configuration.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n FetchFunction,\n IKVService,\n InvokeFunction,\n ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n JWKSchema,\n DelegationSchema,\n KeyProviderSchema,\n IngestOptionsSchema,\n type Result,\n type DelegationError,\n DelegationErrorCodes,\n} from \"./types.schema.js\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry.js\";\nimport type { DelegationManager } from \"./DelegationManager.js\";\n\n// =============================================================================\n// EncodedShareData Schema\n// =============================================================================\n\n/**\n * Schema for data encoded in a sharing link.\n *\n * This is the primary validation point for external share link data.\n * The link is base64-decoded and JSON-parsed, then validated against this schema.\n */\nexport const EncodedShareDataSchema = z.object({\n /** Private key in JWK format (must include d parameter) */\n key: JWKSchema.refine(\n (jwk) => typeof jwk.d === \"string\" && jwk.d.length > 0,\n { message: \"JWK must include private key (d parameter)\" }\n ),\n /** DID of the key */\n keyDid: z.string().min(1, \"keyDid is required\"),\n /** The delegation granting access */\n delegation: DelegationSchema,\n /** Resource path this link grants access to */\n path: z.string().min(1, \"path is required\"),\n /** TinyCloud host URL */\n host: z.string().url(\"host must be a valid URL\"),\n /** Space ID */\n spaceId: z.string().min(1, \"spaceId is required\"),\n /** Schema version (must be 1) */\n version: z.literal(1),\n});\n\nexport type EncodedShareData = z.infer<typeof EncodedShareDataSchema>;\n\n// =============================================================================\n// ReceiveOptions Schema\n// =============================================================================\n\n/**\n * Schema for options when receiving a sharing link.\n */\nexport const ReceiveOptionsSchema = z.object({\n /**\n * Whether to automatically create a sub-delegation to the current session key.\n * Default: true\n */\n autoSubdelegate: z.boolean().optional(),\n /**\n * Whether to use the current session key for operations (requires autoSubdelegate).\n * Default: true\n */\n useSessionKey: z.boolean().optional(),\n /**\n * Ingestion options passed to CapabilityKeyRegistry.\n */\n ingestOptions: IngestOptionsSchema.optional(),\n});\n\nexport type ReceiveOptions = z.infer<typeof ReceiveOptionsSchema>;\n\n// =============================================================================\n// SharingServiceConfig Schema\n// =============================================================================\n\n/**\n * Schema for SharingService configuration.\n *\n * Note: Function fields use z.function() for shape validation only.\n * External types (ServiceSession, DelegationManager, ICapabilityKeyRegistry)\n * use z.unknown() with runtime type refinement.\n */\nexport const SharingServiceConfigSchema = z.object({\n /** TinyCloud host URLs */\n hosts: z.array(z.string().url()).min(1, \"At least one host URL is required\"),\n /**\n * Active session for authentication.\n * Required for generate(), optional for receive().\n */\n session: z\n .unknown()\n .refine(\n (val): val is ServiceSession =>\n val === undefined || (val !== null && typeof val === \"object\"),\n { message: \"Expected a ServiceSession object or undefined\" }\n )\n .optional(),\n /** Platform-specific invoke function */\n invoke: z\n .unknown()\n .refine((val): val is InvokeFunction => typeof val === \"function\", {\n message: \"Expected an invoke function\",\n }),\n /** Optional custom fetch implementation */\n fetch: z\n .unknown()\n .refine(\n (val): val is FetchFunction =>\n val === undefined || typeof val === \"function\",\n { message: \"Expected a fetch function or undefined\" }\n )\n .optional(),\n /** Key provider for cryptographic operations */\n keyProvider: KeyProviderSchema,\n /** Capability key registry for key/delegation management */\n registry: z\n .unknown()\n .refine(\n (val): val is ICapabilityKeyRegistry =>\n val !== null && typeof val === \"object\",\n { message: \"Expected an ICapabilityKeyRegistry object\" }\n ),\n /**\n * Delegation manager for creating delegations.\n * Required for generate(), optional for receive().\n */\n delegationManager: z\n .unknown()\n .refine(\n (val): val is DelegationManager =>\n val === undefined || (val !== null && typeof val === \"object\"),\n { message: \"Expected a DelegationManager object or undefined\" }\n )\n .optional(),\n /** Factory for creating KV service instances */\n createKVService: z.unknown().refine(\n (val): val is (config: {\n hosts: string[];\n session: ServiceSession;\n invoke: InvokeFunction;\n fetch?: FetchFunction;\n pathPrefix?: string;\n }) => IKVService => typeof val === \"function\",\n { message: \"Expected a createKVService factory function\" }\n ),\n /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n baseUrl: z.string().optional(),\n /**\n * Custom delegation creation function.\n */\n createDelegation: z\n .unknown()\n .refine((val) => val === undefined || typeof val === \"function\", {\n message: \"Expected a createDelegation function or undefined\",\n })\n .optional(),\n /**\n * WASM function for client-side delegation creation.\n */\n createDelegationWasm: z\n .unknown()\n .refine((val) => val === undefined || typeof val === \"function\", {\n message: \"Expected a createDelegationWasm function or undefined\",\n })\n .optional(),\n /** CID computation used to verify transportable child delegations. */\n computeCid: z\n .unknown()\n .refine((val): val is (data: Uint8Array, codec: bigint) => string => val === undefined || typeof val === \"function\", {\n message: \"Expected a computeCid function or undefined\",\n })\n .optional(),\n /**\n * Path prefix for KV operations.\n */\n pathPrefix: z.string().optional(),\n /**\n * Session expiry time.\n */\n sessionExpiry: z.date().optional(),\n /**\n * Callback to create a DIRECT delegation from wallet to share key.\n * This is the preferred method for long-lived share links because it\n * bypasses the session delegation chain entirely.\n */\n onRootDelegationNeeded: z\n .unknown()\n .refine((val) => val === undefined || typeof val === \"function\", {\n message: \"Expected an onRootDelegationNeeded function or undefined\",\n })\n .optional(),\n});\n\nexport type SharingServiceConfig = z.infer<typeof SharingServiceConfigSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates encoded share data from a decoded link.\n *\n * @param data - Unknown data to validate (from JSON.parse)\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const parsed = JSON.parse(base64UrlDecode(linkData));\n * const result = validateEncodedShareData(parsed);\n * if (!result.ok) {\n * return result; // Forward the error\n * }\n * const shareData = result.data;\n * ```\n */\nexport function validateEncodedShareData(\n data: unknown\n): Result<EncodedShareData, DelegationError> {\n const result = EncodedShareDataSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: `Invalid share data: ${result.error.message}`,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates receive options.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateReceiveOptions(\n data: unknown\n): Result<ReceiveOptions, DelegationError> {\n const result = ReceiveOptionsSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: `Invalid receive options: ${result.error.message}`,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n\n/**\n * Validates SharingService configuration.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateSharingServiceConfig(\n data: unknown\n): Result<SharingServiceConfig, DelegationError> {\n const result = SharingServiceConfigSchema.safeParse(data);\n if (!result.success) {\n return {\n ok: false,\n error: {\n code: DelegationErrorCodes.VALIDATION_ERROR,\n message: `Invalid SharingService config: ${result.error.message}`,\n service: \"delegation\",\n meta: { issues: result.error.issues },\n },\n };\n }\n return { ok: true, data: result.data };\n}\n","/**\n * Capability subset checking and recap parsing.\n *\n * This module powers the capability-chain delegation flow. The key decision\n * a `delegateTo` call has to make is: \"are the requested capabilities a\n * subset of what the current session already grants?\"\n *\n * - If yes → issue the delegation via the session-key UCAN path (no wallet prompt).\n * - If no → raise {@link PermissionNotInManifestError} so the caller can\n * trigger an escalation flow via `requestPermissions`.\n *\n * Canonical spec: `.claude/specs/capability-chain.md`.\n *\n * @packageDocumentation\n */\n\nimport {\n DEFAULT_MANIFEST_SPACE,\n type PermissionEntry,\n SERVICE_SHORT_TO_LONG,\n expandActionShortNames,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a `delegateTo` call requests capabilities that the current\n * session does not already grant. The caller can catch this and trigger\n * `requestPermissions(missing)` to show an escalation modal.\n */\nexport class PermissionNotInManifestError extends Error {\n public readonly missing: PermissionEntry[];\n public readonly granted: PermissionEntry[];\n\n constructor(missing: PermissionEntry[], granted: PermissionEntry[]) {\n super(\n `Requested capabilities exceed current session. Missing ${missing.length} entries.`\n );\n this.name = \"PermissionNotInManifestError\";\n this.missing = missing;\n this.granted = granted;\n }\n}\n\n/**\n * Thrown when the current session has expired (or will expire within the\n * safety margin). The caller should trigger a fresh sign-in.\n */\nexport class SessionExpiredError extends Error {\n public readonly expiredAt: Date;\n\n constructor(expiredAt: Date) {\n super(`Session expired at ${expiredAt.toISOString()}`);\n this.name = \"SessionExpiredError\";\n this.expiredAt = expiredAt;\n }\n}\n\n/**\n * Thrown when the installed WASM delegation boundary cannot encode every\n * constrained ReCap branch in a requested child delegation.\n */\nexport class CaveatedDelegationUnsupportedError extends Error {\n /** Stable machine-readable error code for fail-closed caveated delegation. */\n code = \"CAVEATED_DELEGATION_UNSUPPORTED\" as const;\n /** Requested entries whose constrained ReCap branches cannot be preserved. */\n entries: PermissionEntry[];\n\n constructor(entries: PermissionEntry[]) {\n super(\n \"Cannot create a caveated delegation because this WASM delegation boundary cannot preserve every ReCap caveat branch exactly.\"\n );\n this.name = \"CaveatedDelegationUnsupportedError\";\n this.entries = entries.map(cloneEntry);\n }\n}\n\n// ---------------------------------------------------------------------------\n// Space normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize a space identifier to its short-name form.\n *\n * Recap resource URIs in a signed SIWE encode the space as a full URI of the\n * form `tinycloud:pkh:eip155:{chainId}:{address}:{name}` (e.g.\n * `tinycloud:pkh:eip155:1:0xd559...:default`). Manifest permissions and\n * backend-advertised permissions use the short `{name}` form (e.g.\n * `\"default\"`).\n *\n * Strict string comparison between these two forms would always fail, so we\n * normalize both sides to the short name before comparing. The trailing\n * segment after the last `:` in a `tinycloud:` URI is the space name.\n *\n * Short names (`\"default\"`, `\"work-space\"`) are returned unchanged.\n * Any non-`tinycloud:` string is returned unchanged. A malformed URI with a\n * trailing colon is returned unchanged (so the check degrades to a strict\n * mismatch rather than collapsing to an empty string).\n *\n * @internal\n */\nexport function normalizeSpace(space: string): string {\n if (!space.startsWith(\"tinycloud:\")) {\n return space;\n }\n const lastColon = space.lastIndexOf(\":\");\n if (lastColon === -1 || lastColon === space.length - 1) {\n return space;\n }\n return space.slice(lastColon + 1);\n}\n\n// ---------------------------------------------------------------------------\n// Subset check\n// ---------------------------------------------------------------------------\n\nexport interface SubsetCheckResult {\n /** True when every requested entry is covered by a granted entry. */\n subset: boolean;\n /** Entries the granted set does not cover (empty when `subset` is true). */\n missing: PermissionEntry[];\n}\n\n/**\n * Check whether `requested` is a strict subset of `granted`.\n *\n * Matching rules for each `requested[i]`:\n * - `service` matches exactly.\n * - `space` matches exactly.\n * - Path containment:\n * - If `granted.path` ends with `/`, it covers any `requested.path` that\n * starts with `granted.path`.\n * - Otherwise, the paths must match exactly.\n * - Action containment: every requested URN must be matched exactly or by a\n * service-scoped wildcard such as `tinycloud.kv/*`.\n *\n * Any `requested` entry that does not find a matching `granted` entry is\n * added to `missing` and the overall result is non-subset.\n *\n * Both sides are expected to be in the canonical long-form shape (service\n * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}\n * or `expandActionShortNames` to normalize inputs first.\n */\nexport function isCapabilitySubset(\n requested: readonly PermissionEntry[],\n granted: readonly PermissionEntry[]\n): SubsetCheckResult {\n const missing: PermissionEntry[] = [];\n\n for (const req of requested) {\n const match = granted.find((g) => canonicalizeEntryMatches(req, g));\n if (match === undefined) {\n missing.push(cloneEntry(req));\n continue;\n }\n // `match` is confirmed to cover `req`; nothing to record.\n }\n\n return { subset: missing.length === 0, missing };\n}\n\n/**\n * Returns true when `granted` fully covers `requested` — same service, same\n * space, path containment per spec, and action set containment.\n */\nfunction canonicalizeEntryMatches(\n requested: PermissionEntry,\n granted: PermissionEntry\n): boolean {\n if (requested.service !== granted.service) {\n return false;\n }\n // Normalize both sides so callers passing short names (`\"default\"`) match\n // recap-parsed full URIs (`\"tinycloud:pkh:eip155:1:0xd559...:default\"`) and\n // vice versa. Idempotent for short names.\n if (\n normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !==\n normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)\n ) {\n return false;\n }\n if (!pathContains(granted.path, requested.path)) {\n return false;\n }\n // Normalize actions to full URN form on both sides before set comparison,\n // so a caller passing short names (\"get\") against a granted entry with\n // full URNs still behaves correctly.\n const reqActions = new Set(\n expandActionShortNames(requested.service, requested.actions)\n );\n const grantedActions = expandActionShortNames(granted.service, granted.actions);\n for (const a of reqActions) {\n if (!grantedActions.some((grantedAction) => actionContains(grantedAction, a))) {\n return false;\n }\n }\n // There is no safe general partial ordering for arbitrary ReCap caveat\n // objects. A caveated authority therefore only covers the same caveat set;\n // treating it as uncaveated would authorize a broader child delegation.\n if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {\n return false;\n }\n return true;\n}\n\n/**\n * Compare ReCap caveat branch sets without losing signed branch structure.\n *\n * ReCap represents an unconstrained ability as `[{}]`, while SDK callers can\n * represent that same authority as `undefined` or `[]`. Those three forms are\n * equivalent. Every other branch, including an unconstrained branch mixed\n * with a constrained one, remains part of the canonical comparison.\n */\nexport function recapCaveatsEqual(\n left: readonly Record<string, unknown>[] | undefined,\n right: readonly Record<string, unknown>[] | undefined,\n): boolean {\n return canonicalizeRecapCaveats(left) === canonicalizeRecapCaveats(right);\n}\n\n/**\n * Canonicalize a ReCap caveat branch set for exact equality checks.\n *\n * Object keys and branch order do not affect equality. A lone unconstrained\n * branch is normalized to the SDK's empty-caveat representation, but an\n * unconstrained branch in a mixed set is deliberately retained.\n */\nexport function canonicalizeRecapCaveats(\n caveats: readonly Record<string, unknown>[] | undefined,\n): string {\n const canonicalize = (value: unknown): string => {\n if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n return JSON.stringify(value);\n }\n if (typeof value === \"number\") {\n if (Number.isFinite(value)) return JSON.stringify(value);\n throw new Error(\"ReCap caveats must contain only JSON values.\");\n }\n if (Array.isArray(value)) return `[${value.map(canonicalize).join(\",\")}]`;\n if (typeof value === \"object\") {\n const object = value as Record<string, unknown>;\n const prototype = Object.getPrototypeOf(object);\n if (prototype !== Object.prototype && prototype !== null) {\n throw new Error(\"ReCap caveats must contain only JSON values.\");\n }\n return `{${Object.keys(object).sort().map((key) =>\n `${JSON.stringify(key)}:${canonicalize(object[key])}`,\n ).join(\",\")}}`;\n }\n throw new Error(\"ReCap caveats must contain only JSON values.\");\n };\n const branches = (caveats ?? []).map(canonicalize).sort();\n if (branches.length === 0 || (branches.length === 1 && branches[0] === \"{}\")) {\n return \"[]\";\n }\n return `[${branches.join(\",\")}]`;\n}\n\n/** Return whether a granted action pattern covers one requested action. */\nexport function actionContains(grantedAction: string, requestedAction: string): boolean {\n if (grantedAction === \"*\" || grantedAction === requestedAction) return true;\n if (!grantedAction.endsWith(\"/*\")) return false;\n const service = grantedAction.slice(0, -2);\n return requestedAction === service || requestedAction.startsWith(`${service}/`);\n}\n\n/**\n * Path containment per spec:\n * - `granted.path` ends with `/` → prefix match (requested starts with granted)\n * - otherwise → exact string match\n *\n * The empty string is treated as \"no path constraint\" and matches anything.\n * The single-character `\"/\"` also matches anything (it is a trailing-slash\n * prefix of zero-length).\n */\nfunction pathContains(grantedPath: string, requestedPath: string): boolean {\n if (grantedPath === \"\" || grantedPath === \"/\") {\n return true;\n }\n if (grantedPath.endsWith(\"/\")) {\n return requestedPath.startsWith(grantedPath);\n }\n return requestedPath === grantedPath;\n}\n\nfunction cloneEntry(entry: PermissionEntry): PermissionEntry {\n return {\n service: entry.service,\n ...(entry.space !== undefined ? { space: entry.space } : {}),\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.caveats !== undefined\n ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n : {}),\n ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n };\n}\n\n// ---------------------------------------------------------------------------\n// Recap parsing (WASM wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * The raw shape returned from the WASM `parseRecapFromSiwe` export. The\n * Rust layer encodes the service in the short form (e.g. `\"kv\"`) because\n * that is what the SIWE recap resource URI actually contains. We normalize\n * to the manifest long form (`\"tinycloud.kv\"`) in {@link parseRecapCapabilities}.\n *\n * @internal\n */\nexport interface WasmRecapEntry {\n service: string;\n space: string;\n path: string;\n actions: string[];\n /** Exact ReCap caveats shared by every action in this entry. */\n caveats?: Record<string, unknown>[];\n}\n\n/**\n * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed\n * SIWE message string and returns an array of raw recap entries. Throws if\n * the SIWE is malformed or the recap statement has been tampered.\n *\n * Exposed as an interface so the SDK can inject the web or node binding\n * without `capabilities.ts` needing to know which.\n */\nexport type ParseRecapFromSiwe = (siweString: string) => WasmRecapEntry[];\n\n/**\n * Parse a signed SIWE message into an array of {@link PermissionEntry}\n * objects in the canonical long-form manifest shape.\n *\n * This is a thin wrapper around the WASM `parseRecapFromSiwe` export that:\n * 1. Normalizes short-form services (`\"kv\"`) to long-form (`\"tinycloud.kv\"`).\n * 2. Returns entries in a deterministic order (sorted by space, then service,\n * then path) so downstream equality checks are stable.\n *\n * Returns an empty array when the SIWE has no recap resource (plain auth\n * SIWE); this matches the WASM function's behavior and the spec.\n *\n * @param parseWasm The WASM `parseRecapFromSiwe` binding.\n * @param siwe The signed SIWE message string (exactly what `session.siwe` stores).\n */\nexport function parseRecapCapabilities(\n parseWasm: ParseRecapFromSiwe,\n siwe: string\n): PermissionEntry[] {\n const raw = parseWasm(siwe);\n if (!Array.isArray(raw)) {\n throw new Error(\n \"parseRecapFromSiwe returned a non-array value; wasm binding may be out of sync\"\n );\n }\n const normalized: PermissionEntry[] = raw.map((entry) => {\n const longService =\n SERVICE_SHORT_TO_LONG[entry.service] ??\n // Unknown short names pass through. If the recap already contained a\n // long-form service (e.g. a future tinycloud-node version emits long\n // form directly), don't double-prefix.\n (entry.service.startsWith(\"tinycloud.\")\n ? entry.service\n : `tinycloud.${entry.service}`);\n return {\n service: longService,\n // The Rust layer emits the space as a full `tinycloud:pkh:...:name`\n // URI (the recap target URI). Normalize to the short name so the\n // returned entries match the shape manifests use.\n space: normalizeSpace(entry.space),\n path: entry.path,\n actions: [...entry.actions],\n ...(entry.caveats === undefined\n ? {}\n : { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }),\n };\n });\n\n // Sort for determinism (callers do equality checks on arrays of entries\n // in tests; deterministic ordering keeps those stable).\n normalized.sort((a, b) => {\n const aSpace = a.space ?? DEFAULT_MANIFEST_SPACE;\n const bSpace = b.space ?? DEFAULT_MANIFEST_SPACE;\n if (aSpace !== bSpace) return aSpace < bSpace ? -1 : 1;\n if (a.service !== b.service) return a.service < b.service ? -1 : 1;\n if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n return 0;\n });\n\n return normalized;\n}\n","/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * This service implements the v2 sharing specification, which embeds private keys\n * directly in sharing links. This allows recipients to exercise delegations\n * without requiring prior session setup.\n *\n * Key differences from v1 SharingLinks:\n * - Private keys are embedded in the link (not just tokens)\n * - Recipients can optionally sub-delegate to their own session key\n * - Pre-configured KV service returned for immediate use\n *\n * @packageDocumentation\n */\n\nimport type {\n IKVService,\n ServiceSession,\n InvokeFunction,\n FetchFunction,\n} from \"@tinycloud/sdk-services\";\nimport type {\n Result,\n DelegationError,\n Delegation,\n KeyInfo,\n KeyProvider,\n GenerateShareParams,\n ShareLink,\n ShareLinkData,\n ShareSchema,\n JWK,\n IngestOptions,\n CreateDelegationParams,\n CreateDelegationWasmParams,\n CreateDelegationWasmResult,\n} from \"./types\";\nimport { DelegationErrorCodes } from \"./types\";\nimport type { DelegationManager } from \"./DelegationManager\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry\";\nimport { validateEncodedShareData } from \"./SharingService.schema.js\";\nimport { SERVICE_LONG_TO_SHORT, type PermissionEntry } from \"../manifest\";\nimport { principalDid } from \"../identity\";\nimport {\n actionContains,\n CaveatedDelegationUnsupportedError,\n recapCaveatsEqual,\n} from \"../capabilities\";\nimport { bases } from \"multiformats/basics\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\n\n// ---------------------------------------------------------------------------\n// Local helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Infer the short-form service name (`\"kv\"`, `\"sql\"`, etc) that all of the\n * given full-URN action strings belong to.\n *\n * SharingService issues single-service delegations (KV-only, SQL-only, …) —\n * the multi-resource WASM `createDelegation` call requires the service\n * segment explicitly because it's keyed separately from the action list.\n * This helper extracts the namespace half (`\"tinycloud.kv\"`) from each URN,\n * maps it to the short form via {@link SERVICE_LONG_TO_SHORT}, and returns\n * `undefined` if the actions are not all from the same known service.\n *\n * Returning `undefined` is intentional: the caller must surface a clear\n * error rather than guessing.\n */\nfunction inferShortServiceFromActionUrns(\n actions: readonly string[]\n): string | undefined {\n let short: string | undefined;\n for (const action of actions) {\n const slash = action.indexOf(\"/\");\n if (slash === -1) return undefined;\n const longService = action.slice(0, slash);\n const candidate = SERVICE_LONG_TO_SHORT[longService];\n if (candidate === undefined) return undefined;\n if (short === undefined) {\n short = candidate;\n } else if (short !== candidate) {\n return undefined;\n }\n }\n return short;\n}\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * Default actions for read-only sharing links.\n */\nconst DEFAULT_READ_ACTIONS = [\"tinycloud.kv/get\", \"tinycloud.kv/metadata\"];\n\n/**\n * Default expiry for share links — SHARE tier (see ../expiry.ts).\n */\nimport { EXPIRY } from \"../expiry\";\nconst DEFAULT_EXPIRY_MS = EXPIRY.SHARE_MS;\n\n/**\n * Prefix for the base64 schema.\n */\nconst BASE64_PREFIX = \"tc1:\";\n\n// =============================================================================\n// Helper Functions\n// =============================================================================\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n code: string,\n message: string,\n cause?: Error,\n meta?: Record<string, unknown>\n): DelegationError {\n return {\n code,\n message,\n service: \"delegation\",\n cause,\n meta,\n };\n}\n\n/**\n * Base64 encode for URLs (URL-safe base64).\n */\nfunction base64UrlEncode(data: string): string {\n // Use btoa for browser, Buffer for Node.js\n let base64: string;\n if (typeof btoa !== \"undefined\") {\n base64 = btoa(unescape(encodeURIComponent(data)));\n } else if (typeof Buffer !== \"undefined\") {\n base64 = Buffer.from(data, \"utf-8\").toString(\"base64\");\n } else {\n throw new Error(\"No base64 encoding available\");\n }\n // Make URL-safe\n return base64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Base64 decode for URLs (URL-safe base64).\n */\nfunction base64UrlDecode(encoded: string): string {\n // Restore standard base64\n let base64 = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n // Add padding if needed\n while (base64.length % 4) {\n base64 += \"=\";\n }\n // Decode\n if (typeof atob !== \"undefined\") {\n return decodeURIComponent(escape(atob(base64)));\n } else if (typeof Buffer !== \"undefined\") {\n return Buffer.from(base64, \"base64\").toString(\"utf-8\");\n } else {\n throw new Error(\"No base64 decoding available\");\n }\n}\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Data encoded in a sharing link.\n */\nexport interface EncodedShareData {\n /** Private key in JWK format (includes d parameter) */\n key: JWK;\n /** DID of the key */\n keyDid: string;\n /** The delegation granting access */\n delegation: Delegation;\n /** Resource path this link grants access to */\n path: string;\n /** TinyCloud host URL */\n host: string;\n /** Space ID */\n spaceId: string;\n /** Schema version */\n version: 1;\n}\n\n/**\n * Options for receiving a sharing link.\n */\nexport interface ReceiveOptions {\n /**\n * Whether to automatically create a sub-delegation to the current session key.\n * Default: true\n */\n autoSubdelegate?: boolean;\n /**\n * Whether to use the current session key for operations (requires autoSubdelegate).\n * Default: true\n */\n useSessionKey?: boolean;\n /**\n * Ingestion options passed to CapabilityKeyRegistry.\n */\n ingestOptions?: IngestOptions;\n}\n\n/**\n * Result of receiving a sharing link.\n */\nexport interface ShareAccess {\n /** The delegation that was received/created */\n delegation: Delegation;\n /** Key info for the received key */\n key: KeyInfo;\n /** Pre-configured KV service for the shared path */\n kv: IKVService;\n /** The space ID */\n spaceId: string;\n /** The path prefix for this share */\n path: string;\n}\n\n/**\n * Parameters for attenuating a received share to another principal.\n *\n * Omitted path/actions/expiry inherit the received share's exact values. Any\n * supplied value must be equal to or an attenuated subset of the parent.\n */\nexport interface DelegateReceivedShareParams {\n /** DID that may exercise the child delegation. */\n delegateDID: string;\n /** Equal to or below the shared path. Defaults to the shared path. */\n path?: string;\n /** Subset of the shared actions. Defaults to all shared actions. */\n actions?: string[];\n /** No later than the sharing-link expiry. Defaults to the parent expiry. */\n expiry?: Date;\n /** Optional node origin that further narrows the configured-host allowlist. */\n expectedHost?: string;\n}\n\n/**\n * A transport-ready child delegation with non-secret source lineage.\n *\n * `delegation.delegationHeader` is a live bearer credential. Treat it like a\n * secret: do not log it or persist it outside secure credential storage.\n * Only `source` is safe to retain as non-secret lineage metadata.\n */\nexport interface DelegatedShareAccess {\n delegation: Delegation & {\n delegationHeader: { Authorization: string };\n ownerAddress: string;\n chainId: number;\n host: string;\n resources: Array<{ service: string; space: string; path: string; actions: string[] }>;\n disableSubDelegation: boolean;\n };\n source: {\n parentCid: string;\n spaceId: string;\n path: string;\n host: string;\n expiresAt: Date;\n };\n}\n\n/**\n * Configuration for SharingService.\n */\nexport interface SharingServiceConfig {\n /** TinyCloud host URLs */\n hosts: string[];\n /**\n * Active session for authentication.\n * Required for generate(), optional for receive().\n */\n session?: ServiceSession;\n /** Platform-specific invoke function */\n invoke: InvokeFunction;\n /** Optional custom fetch implementation */\n fetch?: FetchFunction;\n /** Key provider for cryptographic operations */\n keyProvider: KeyProvider;\n /** Capability key registry for key/delegation management */\n registry: ICapabilityKeyRegistry;\n /**\n * Delegation manager for creating delegations (used if createDelegation not provided).\n * Required for generate(), optional for receive().\n */\n delegationManager?: DelegationManager;\n /** Factory for creating KV service instances */\n createKVService: (config: {\n hosts: string[];\n session: ServiceSession;\n invoke: InvokeFunction;\n fetch?: FetchFunction;\n pathPrefix?: string;\n }) => IKVService;\n /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n baseUrl?: string;\n /**\n * Custom delegation creation function. When provided, this is used instead\n * of delegationManager.create(). This allows platforms to use their own\n * delegation creation logic (e.g., SIWE-based /delegate endpoint).\n */\n createDelegation?: (params: CreateDelegationParams) => Promise<Result<Delegation, DelegationError>>;\n /**\n * WASM function for client-side delegation creation.\n * When provided, this is preferred over server-side creation (createDelegation/delegationManager).\n * Creates UCAN delegations directly without requiring server roundtrip.\n */\n createDelegationWasm?: (params: CreateDelegationWasmParams) => CreateDelegationWasmResult;\n /** Compute a CID for serialized delegation bytes. Required for share attenuation. */\n computeCid?: (data: Uint8Array, codec: bigint) => string;\n /**\n * Path prefix for KV operations.\n * When set, paths passed to generate() are prefixed with this value.\n * This ensures the share path matches the session's authorized paths.\n */\n pathPrefix?: string;\n /**\n * Session expiry time.\n * When set, sharing link expiry is clamped to not exceed this value\n * unless onRootDelegationNeeded is provided and returns a new delegation.\n */\n sessionExpiry?: Date;\n /**\n * Callback to create a DIRECT delegation from the root (wallet) to a share key.\n * This bypasses the session delegation chain, allowing share links with\n * expiry longer than the current session.\n *\n * When provided and share expiry > session expiry:\n * 1. SharingService creates the ephemeral share key\n * 2. This callback is invoked with the share key DID\n * 3. The callback signs a direct PKH -> share key delegation with the wallet\n * 4. The returned delegation is used for the share link\n *\n * This is the CORRECT solution for long-lived share links because:\n * - It creates a fresh delegation chain: PKH -> share key\n * - Not constrained by session expiry (no sub-delegation from session key)\n *\n * @param params - Parameters for creating the root delegation\n * @returns The delegation from wallet to share key, or undefined to fall back to session extension\n */\n onRootDelegationNeeded?: (params: {\n /** DID of the share key to delegate to */\n shareKeyDID: string;\n /** Space ID */\n spaceId: string;\n /** Path to grant access to */\n path: string;\n /** Actions to grant */\n actions: string[];\n /** Requested expiry time */\n requestedExpiry: Date;\n }) => Promise<Delegation | undefined>;\n /** Reject operations after the host session/service graph has been retired. */\n assertActive?: () => void;\n}\n\n/**\n * Interface for the SharingService.\n */\nexport interface ISharingService {\n /**\n * Generate a sharing link with an embedded private key.\n *\n * This creates a new session key, delegates to it, and encodes\n * the key and delegation into a shareable link.\n */\n generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;\n\n /**\n * Receive and activate a sharing link.\n *\n * Decodes the link, ingests the key into the registry, and optionally\n * creates a sub-delegation to the current session key.\n */\n receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;\n\n /**\n * Consume a sharing link locally and create an attenuated child delegation.\n * The raw link and embedded private JWK are never returned. The returned\n * child delegation is itself a sensitive bearer credential.\n */\n delegateReceivedShare(\n link: string,\n params: DelegateReceivedShareParams\n ): Promise<Result<DelegatedShareAccess, DelegationError>>;\n\n /**\n * Encode sharing data into a link string.\n */\n encodeLink(data: EncodedShareData, schema?: ShareSchema): string;\n\n /**\n * Decode a link string into sharing data.\n */\n decodeLink(link: string): EncodedShareData;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * @example\n * ```typescript\n * import { SharingService } from \"@tinycloud/sdk-core/delegations\";\n *\n * const sharing = new SharingService({\n * hosts: [\"https://node.tinycloud.xyz\"],\n * session,\n * invoke,\n * keyProvider,\n * registry,\n * delegationManager,\n * createKVService,\n * baseUrl: \"https://share.myapp.com\"\n * });\n *\n * // Generate a sharing link\n * const result = await sharing.generate({\n * path: \"/kv/documents/report.pdf\",\n * actions: [\"tinycloud.kv/get\"],\n * expiry: new Date(\"2024-12-31\")\n * });\n *\n * if (result.ok) {\n * console.log(\"Share this URL:\", result.data.url);\n * }\n *\n * // Receive a sharing link\n * const receiveResult = await sharing.receive(shareUrl);\n * if (receiveResult.ok) {\n * // Use the pre-configured KV service\n * const data = await receiveResult.data.kv.get(\"report.pdf\");\n * }\n * ```\n */\nexport class SharingService implements ISharingService {\n private hosts: string[];\n private session?: ServiceSession;\n private invoke: InvokeFunction;\n private fetchFn: FetchFunction;\n private keyProvider: KeyProvider;\n private registry: ICapabilityKeyRegistry;\n private delegationManager?: DelegationManager;\n private createKVService: SharingServiceConfig[\"createKVService\"];\n private baseUrl: string;\n private createDelegationFn?: SharingServiceConfig[\"createDelegation\"];\n private createDelegationWasmFn?: SharingServiceConfig[\"createDelegationWasm\"];\n private computeCidFn?: SharingServiceConfig[\"computeCid\"];\n private pathPrefix: string;\n private sessionExpiry?: Date;\n private onRootDelegationNeeded?: SharingServiceConfig[\"onRootDelegationNeeded\"];\n private assertActiveFn?: SharingServiceConfig[\"assertActive\"];\n\n /**\n * Creates a new SharingService instance.\n */\n constructor(config: SharingServiceConfig) {\n this.hosts = config.hosts;\n this.session = config.session;\n this.invoke = config.invoke;\n this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n this.keyProvider = config.keyProvider;\n this.registry = config.registry;\n this.delegationManager = config.delegationManager;\n this.createKVService = config.createKVService;\n this.baseUrl = (config.baseUrl ?? \"\").replace(/\\/$/, \"\"); // Remove trailing slash\n this.createDelegationFn = config.createDelegation;\n this.createDelegationWasmFn = config.createDelegationWasm;\n this.computeCidFn = config.computeCid;\n this.pathPrefix = config.pathPrefix ?? \"\";\n this.sessionExpiry = config.sessionExpiry;\n this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n this.assertActiveFn = config.assertActive;\n }\n\n /**\n * Gets the primary host URL.\n */\n private get host(): string {\n return this.hosts[0];\n }\n\n /**\n * Updates the session (e.g., after re-authentication).\n */\n public updateSession(session: ServiceSession): void {\n this.assertActiveFn?.();\n this.session = session;\n }\n\n /**\n * Updates the service configuration.\n * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.\n */\n public updateConfig(config: Partial<Pick<SharingServiceConfig, \"session\" | \"delegationManager\" | \"createDelegation\" | \"createDelegationWasm\" | \"sessionExpiry\" | \"onRootDelegationNeeded\" | \"assertActive\">>): void {\n this.assertActiveFn?.();\n if (config.session !== undefined) {\n this.session = config.session;\n }\n if (config.delegationManager !== undefined) {\n this.delegationManager = config.delegationManager;\n }\n if (config.createDelegation !== undefined) {\n this.createDelegationFn = config.createDelegation;\n }\n if (config.createDelegationWasm !== undefined) {\n this.createDelegationWasmFn = config.createDelegationWasm;\n }\n if (config.sessionExpiry !== undefined) {\n this.sessionExpiry = config.sessionExpiry;\n }\n if (config.onRootDelegationNeeded !== undefined) {\n this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n }\n if (config.assertActive !== undefined) {\n this.assertActiveFn = config.assertActive;\n }\n }\n\n /**\n * Generate a sharing link with an embedded private key.\n *\n * Flow:\n * 1. Spawn new session key (unique per share)\n * 2. Create delegation from current session to spawned key\n * 3. Package: { key (with private!), delegation, path, host }\n * 4. Encode based on schema (base64 for now)\n * 5. Return link string\n */\n async generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n // Require session for generating (not for receiving)\n if (!this.session) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Session required for generating sharing links. Call signIn() first.\"\n ),\n };\n }\n\n // Require delegation capability\n if (!this.createDelegationWasmFn && !this.createDelegationFn && !this.delegationManager) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"DelegationManager, createDelegation, or createDelegationWasm function required for generating sharing links.\"\n ),\n };\n }\n\n // Validate path\n if (!params.path) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"path is required\"\n ),\n };\n }\n\n const actions = params.actions ?? DEFAULT_READ_ACTIONS;\n const requestedExpiry = params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS);\n let expiry = requestedExpiry;\n\n const schema: ShareSchema = params.schema ?? \"base64\";\n\n // Build full path with prefix (matches how KVService stores data)\n // If pathPrefix is \"demo-app\" and path is \"hello\", fullPath is \"demo-app/hello\"\n const fullPath = this.pathPrefix\n ? `${this.pathPrefix}/${params.path}`.replace(/\\/+/g, \"/\") // Normalize slashes\n : params.path;\n\n // Only base64 schema is implemented in v1\n if (schema !== \"base64\") {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n `Schema '${schema}' not implemented. Only 'base64' is supported.`\n ),\n };\n }\n\n // Step 1: Spawn a new session key unique to this share\n // We create this FIRST so we can pass its DID to onRootDelegationNeeded if needed\n let keyId: string;\n let keyDid: string;\n let keyJwk: JWK;\n\n try {\n const shareKeyName = `share:${Date.now()}:${Math.random().toString(36).substring(2, 10)}`;\n keyId = await this.keyProvider.createSessionKey(shareKeyName);\n const keyCreationActiveError = this.retiredGraphError();\n if (keyCreationActiveError) return { ok: false, error: keyCreationActiveError };\n keyDid = await this.keyProvider.getDID(keyId);\n const keyDidActiveError = this.retiredGraphError();\n if (keyDidActiveError) return { ok: false, error: keyDidActiveError };\n keyJwk = this.keyProvider.getJWK(keyId) as JWK;\n\n // Ensure the private key is included\n if (!keyJwk.d) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"KeyProvider did not return private key (d parameter) in JWK\"\n ),\n };\n }\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to generate session key for share: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n\n // Step 2: Check if any existing key can satisfy this delegation\n // Only prompt for root delegation if NO existing key in the registry can handle it\n let delegation: Delegation;\n // Strip fragment from DID URL to get plain DID for UCAN audience\n // getDID() returns \"did:key:z6Mk...#z6Mk...\" but audience needs \"did:key:z6Mk...\"\n const plainDID = keyDid.split('#')[0];\n\n // Helper to handle delegation result (returns early on error)\n const handleDelegationResult = (\n result: Awaited<ReturnType<typeof this.createSessionDelegation>>\n ): Delegation | { ok: false; error: DelegationError } => {\n if (result && typeof result === 'object' && 'ok' in result) {\n return result as { ok: false; error: DelegationError };\n }\n return result as Delegation;\n };\n\n // Check if any key in the registry can satisfy this delegation request\n // A key can satisfy the request if it has a delegation that:\n // 1. Covers the required path and actions\n // 2. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n // 3. Allows sub-delegation\n const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(\n fullPath,\n actions,\n requestedExpiry\n );\n\n if (canSatisfyFromRegistry) {\n // An existing key can satisfy this request - use session delegation (no prompt)\n const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);\n const childDelegationActiveError = this.retiredGraphError();\n if (childDelegationActiveError) return { ok: false, error: childDelegationActiveError };\n const parsed = handleDelegationResult(delegationResult);\n if ('ok' in parsed && parsed.ok === false) {\n return parsed;\n }\n delegation = parsed as Delegation;\n } else if (this.onRootDelegationNeeded) {\n // No existing key can satisfy the request - try root delegation\n try {\n const rootDelegation = await this.onRootDelegationNeeded({\n shareKeyDID: plainDID,\n spaceId: this.session.spaceId,\n path: fullPath,\n actions,\n requestedExpiry,\n });\n const rootDelegationActiveError = this.retiredGraphError();\n if (rootDelegationActiveError) return { ok: false, error: rootDelegationActiveError };\n\n if (rootDelegation) {\n delegation = rootDelegation;\n expiry = requestedExpiry;\n } else {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"The active session ReCap does not authorize this sharing delegation.\",\n ),\n };\n }\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"The active session ReCap does not authorize this sharing delegation.\",\n err instanceof Error ? err : undefined,\n ),\n };\n }\n } else {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"The active session ReCap does not authorize this sharing delegation.\",\n ),\n };\n }\n\n const finalActiveError = this.retiredGraphError();\n if (finalActiveError) return { ok: false, error: finalActiveError };\n\n // Step 3: Package the share data\n const shareData: EncodedShareData = {\n key: keyJwk,\n keyDid,\n delegation,\n path: fullPath,\n host: this.host,\n spaceId: this.session.spaceId,\n version: 1,\n };\n\n // Step 4: Encode the link\n const encodedData = this.encodeLink(shareData, schema);\n\n // Step 5: Build the full URL\n const baseUrl = params.baseUrl ?? this.baseUrl;\n const url = baseUrl ? `${baseUrl}/share/${encodedData}` : encodedData;\n\n const shareLink: ShareLink = {\n token: encodedData,\n url,\n delegation,\n schema,\n expiresAt: expiry,\n description: params.description,\n };\n\n return { ok: true, data: shareLink };\n }\n\n /**\n * Check if any key in the registry can satisfy the delegation request.\n * A key can satisfy if it has a delegation that:\n * 1. Covers the required path (exact match or parent path)\n * 2. Has all required actions\n * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n * 4. Allows sub-delegation\n * @internal\n */\n private findSuitableKeyForDelegation(\n path: string,\n actions: string[],\n requestedExpiry: Date\n ): boolean {\n // Check registry for keys with sufficient capabilities\n const allKeys = this.registry.getAllKeys();\n for (const key of allKeys) {\n const delegations = this.registry.getDelegationsForKey(key.id);\n for (const delegation of delegations) {\n // A registry can contain capabilities for several spaces. A share\n // created by this service may only spend authority for its own\n // session space.\n if (delegation.spaceId !== this.session?.spaceId) {\n continue;\n }\n\n // SharingService cannot reproduce arbitrary signed ReCap caveats when\n // issuing a child delegation. Treat caveated authority as unusable\n // here rather than minting a broader child capability.\n if ((delegation.caveats?.length ?? 0) > 0) {\n continue;\n }\n\n // Check if delegation is valid and not expired\n if (!this.registry.isDelegationValid(delegation)) {\n continue;\n }\n\n // Check if delegation has sufficient expiry\n if (delegation.expiry < requestedExpiry) {\n continue;\n }\n\n // Check if delegation allows sub-delegation\n if (delegation.allowSubDelegation === false) {\n continue;\n }\n\n // Check if delegation covers the path (exact match or parent path)\n const delegationPath = delegation.path || '';\n if (!this.pathMatches(delegationPath, path)) {\n continue;\n }\n\n // Check if delegation has all required actions\n const delegationActions = delegation.actions || [];\n const hasAllActions = actions.every(action =>\n delegationActions.includes(action) || delegationActions.includes('*')\n );\n if (!hasAllActions) {\n continue;\n }\n\n // Found a suitable key\n return true;\n }\n }\n\n return false;\n }\n\n private retiredGraphError(): DelegationError | undefined {\n try {\n this.assertActiveFn?.();\n return undefined;\n } catch (err) {\n return createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"The session service graph has been retired.\",\n err instanceof Error ? err : undefined,\n );\n }\n }\n\n /**\n * Check if a delegation path matches/covers the requested path.\n * A delegation path covers the request if:\n * - It's an exact match\n * - It's a parent path (e.g., delegation for \"\" covers \"foo/bar\")\n * - It uses wildcards that match\n * @internal\n */\n private pathMatches(delegationPath: string, requestedPath: string): boolean {\n // Empty delegation path covers everything\n if (delegationPath === '' || delegationPath === '*') {\n return true;\n }\n\n // Exact match\n if (delegationPath === requestedPath) {\n return true;\n }\n\n // Check if delegation path is a parent of requested path\n const normalizedDelegation = delegationPath.replace(/\\/$/, '');\n const normalizedRequest = requestedPath.replace(/\\/$/, '');\n\n if (normalizedRequest.startsWith(normalizedDelegation + '/')) {\n return true;\n }\n\n return false;\n }\n\n /**\n * Create a delegation from the current session to a share key.\n * This is the fallback path when root delegation is not available.\n * @internal\n */\n private async createSessionDelegation(\n delegateDID: string,\n path: string,\n actions: string[],\n expiry: Date\n ): Promise<Delegation | Result<never, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n if (!this.session) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Session required for creating delegation\"\n ),\n };\n }\n\n if (this.createDelegationWasmFn) {\n // Client-side delegation creation via WASM.\n //\n // SharingService always issues single-resource delegations (one\n // path, one action list). The multi-resource WASM API takes an\n // `abilities` map shaped `Record<shortService, Record<path,\n // actions[]>>`, so we infer the short service from the first\n // action URN (every action in a share call shares the same\n // service namespace by construction — KV-only, SQL-only, etc).\n //\n // The result comes back with a `resources` array; for a\n // single-entry call it always has exactly one entry, and we\n // mirror that entry's `path` + `actions` back into the flat\n // Delegation shape that the rest of SharingService works with.\n try {\n if (actions.length === 0) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.VALIDATION_ERROR,\n \"createDelegation requires at least one action\"\n ),\n };\n }\n const shortService = inferShortServiceFromActionUrns(actions);\n if (shortService === undefined) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.VALIDATION_ERROR,\n `createDelegation: cannot infer service from actions ${JSON.stringify(actions)} — expected full URNs like \"tinycloud.kv/get\"`\n ),\n };\n }\n\n const wasmResult = this.createDelegationWasmFn({\n session: this.session,\n delegateDID,\n spaceId: this.session.spaceId,\n abilities: {\n [shortService]: {\n [path]: [...actions],\n },\n },\n expirationSecs: Math.floor(expiry.getTime() / 1000),\n });\n const childSigningActiveError = this.retiredGraphError();\n if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n\n // Register the delegation with the server\n const registerRes = await this.fetchFn(`${this.host}/delegate`, {\n method: \"POST\",\n headers: {\n Authorization: wasmResult.delegation,\n },\n });\n const registrationActiveError = this.retiredGraphError();\n if (registrationActiveError) return { ok: false, error: registrationActiveError };\n\n if (!registerRes.ok) {\n const errorText = await registerRes.text();\n const registrationTextActiveError = this.retiredGraphError();\n if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to register delegation with server: ${registerRes.status} ${errorText}`\n ),\n };\n }\n\n // Single-entry call → resources[0] is authoritative for the\n // flat Delegation shape. We assert length here because a\n // zero-length result would mean the Rust side dropped our\n // single input — that's a protocol bug, not a runtime\n // condition to silently coerce.\n if (wasmResult.resources.length === 0) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"createDelegation WASM returned empty resources array for a single-entry request\"\n ),\n };\n }\n const primary = wasmResult.resources[0];\n return {\n cid: wasmResult.cid,\n delegateDID: wasmResult.delegateDID,\n spaceId: this.session.spaceId,\n path: primary.path,\n actions: primary.actions,\n expiry: wasmResult.expiry,\n isRevoked: false,\n authHeader: wasmResult.delegation,\n allowSubDelegation: true,\n createdAt: new Date(),\n };\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to create delegation via WASM: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n } else {\n // Server-side delegation creation (fallback)\n const delegationParams: CreateDelegationParams = {\n delegateDID,\n path,\n actions,\n expiry,\n disableSubDelegation: false,\n };\n\n const delegationResult = this.createDelegationFn\n ? await this.createDelegationFn(delegationParams)\n : await this.delegationManager!.create(delegationParams);\n const delegationCreationActiveError = this.retiredGraphError();\n if (delegationCreationActiveError) return { ok: false, error: delegationCreationActiveError };\n\n if (!delegationResult.ok) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n `Failed to create delegation for share: ${delegationResult.error.message}`,\n delegationResult.error.cause,\n delegationResult.error.meta\n ),\n };\n }\n\n return delegationResult.data;\n }\n }\n\n /**\n * Receive and activate a sharing link.\n *\n * Flow:\n * 1. Decode link -> extract { key, delegation, path, host }\n * 2. Ingest key into CapabilityKeyRegistry\n * 3. If autoSubdelegate (default true) + useSessionKey:\n * - Create sub-delegation from ingested key -> current session\n * - Register sub-delegation capabilities\n * 4. Return ShareAccess with pre-configured KV service\n */\n async receive(\n link: string,\n options: ReceiveOptions = {}\n ): Promise<Result<ShareAccess, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n const {\n autoSubdelegate = true,\n useSessionKey = true,\n ingestOptions,\n } = options;\n\n // Step 1: Decode and validate the link\n const decodeResult = this.decodeLinkWithValidation(link);\n if (!decodeResult.ok) {\n return decodeResult;\n }\n const shareData = decodeResult.data;\n\n // Schema validation ensures key.d and delegation exist, but we need\n // to check business rules (expiry, revocation) separately\n\n // Check delegation expiry\n const delegationExpiry = new Date(shareData.delegation.expiry);\n if (delegationExpiry < new Date()) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.AUTH_EXPIRED,\n \"Sharing link has expired\"\n ),\n };\n }\n\n // Check delegation revocation\n if (shareData.delegation.isRevoked) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.REVOKED,\n \"Sharing link has been revoked\"\n ),\n };\n }\n\n // Step 2: Create KeyInfo and ingest into registry\n const keyInfo: KeyInfo = {\n id: `ingested:${shareData.keyDid}`,\n did: shareData.keyDid,\n type: \"ingested\",\n jwk: shareData.key,\n priority: 2, // Ingested keys have lowest priority\n };\n\n this.registry.ingestKey(keyInfo, shareData.delegation, ingestOptions);\n\n // The delegation and key to use for operations\n let activeDelegation = shareData.delegation;\n let activeKey = keyInfo;\n\n // Step 3: Auto-subdelegate if requested\n if (autoSubdelegate && useSessionKey && this.session) {\n const child = await this.delegateReceivedShare(link, {\n delegateDID: this.session.verificationMethod,\n expectedHost: shareData.host,\n });\n if (!child.ok) return child;\n activeDelegation = child.data.delegation;\n activeKey = {\n id: `session:${principalDid(this.session.verificationMethod)}`,\n did: this.session.verificationMethod,\n type: \"session\",\n priority: 0,\n };\n }\n\n // Step 4: Create pre-configured KV service for the shared path\n // Construct session from share data - no need for existing session\n // Use the authHeader if available, otherwise fall back to constructing from CID\n const portableAuthorization = (activeDelegation as Delegation & {\n delegationHeader?: { Authorization?: string };\n }).delegationHeader?.Authorization;\n const authHeader = portableAuthorization ?? activeDelegation.authHeader ?? `Bearer ${activeDelegation.cid}`;\n const activeSession = activeKey.type === \"session\" && this.session\n ? this.session\n : undefined;\n const shareSession: ServiceSession = {\n delegationHeader: { Authorization: authHeader },\n delegationCid: activeDelegation.cid,\n spaceId: shareData.spaceId,\n verificationMethod: activeSession?.verificationMethod ?? shareData.keyDid,\n jwk: activeSession?.jwk ?? shareData.key,\n };\n\n const kvService = this.createKVService({\n hosts: [shareData.host],\n session: shareSession,\n invoke: this.invoke,\n fetch: this.fetchFn,\n pathPrefix: shareData.path,\n });\n\n const shareAccess: ShareAccess = {\n delegation: activeDelegation,\n key: activeKey,\n kv: kvService,\n spaceId: shareData.spaceId,\n path: shareData.path,\n };\n\n return { ok: true, data: shareAccess };\n }\n\n /**\n * Create a constrained child delegation from a received sharing link.\n *\n * This is the safe handoff for a browser delegating shared input to an\n * agent or service: the bearer link is decoded and used only in this SDK\n * instance, while the recipient receives a child UCAN without the embedded\n * private key. The child UCAN is a sensitive bearer credential and must not\n * be logged or stored insecurely.\n */\n async delegateReceivedShare(\n link: string,\n params: DelegateReceivedShareParams\n ): Promise<Result<DelegatedShareAccess, DelegationError>> {\n const activeError = this.retiredGraphError();\n if (activeError) return { ok: false, error: activeError };\n\n const decoded = this.decodeLinkWithValidation(link);\n if (!decoded.ok) return decoded;\n const shareData = decoded.data;\n this.assertDelegationCaveatsPreservable(shareData.delegation);\n\n const parentExpiry = new Date(shareData.delegation.expiry);\n const now = new Date();\n if (parentExpiry <= now) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.AUTH_EXPIRED, \"Sharing link has expired\"),\n };\n }\n if (shareData.delegation.isRevoked) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.REVOKED, \"Sharing link has been revoked\"),\n };\n }\n if (shareData.delegation.allowSubDelegation === false) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Sharing link does not allow delegation\"\n ),\n };\n }\n const delegateDID = principalDid(params.delegateDID?.trim() ?? \"\");\n if (!/^did:(?:key|pkh):[^\\s]+$/.test(delegateDID)) {\n return {\n ok: false,\n error: createError(DelegationErrorCodes.INVALID_INPUT, \"A valid delegateDID is required\"),\n };\n }\n const trustedHost = trustedNodeOrigin(shareData.host, this.hosts, params.expectedHost);\n if (!trustedHost) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Sharing-link host is not a configured TinyCloud host\"\n ),\n };\n }\n if (\n shareData.delegation.spaceId !== shareData.spaceId ||\n principalDid(shareData.delegation.delegateDID) !== principalDid(shareData.keyDid) ||\n !shareKeyMatchesDid(shareData.key, shareData.keyDid) ||\n !capabilityPathContains(shareData.delegation.path, shareData.path)\n ) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Sharing-link metadata does not match its parent delegation\"\n ),\n };\n }\n if (!shareData.delegation.authHeader) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Sharing link is missing its signed parent delegation\"\n ),\n };\n }\n if (!this.createDelegationWasmFn || !this.computeCidFn) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.NOT_INITIALIZED,\n \"Client-side delegation and CID support are required\"\n ),\n };\n }\n\n const path = params.path ?? shareData.path;\n if (!capabilityPathContains(shareData.path, path)) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Requested path exceeds the sharing-link capability\"\n ),\n };\n }\n\n const parentActions = shareData.delegation.actions;\n const actions = params.actions ?? [...parentActions];\n if (\n actions.length === 0 ||\n new Set(actions).size !== actions.length ||\n actions.includes(\"*\") ||\n actions.some((action) => !parentActions.some((parentAction) => actionContains(parentAction, action)))\n ) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Requested actions exceed the sharing-link capability\"\n ),\n };\n }\n\n const expiry = params.expiry ?? parentExpiry;\n if (expiry <= now || expiry > parentExpiry) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.PERMISSION_DENIED,\n \"Child delegation expiry must be active and no later than the sharing link\"\n ),\n };\n }\n\n const service = inferShortServiceFromActionUrns(actions);\n if (!service) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_INPUT,\n \"Sharing-link actions must belong to one known TinyCloud service\"\n ),\n };\n }\n\n const owner = ownerFromSpaceId(shareData.spaceId);\n if (!owner) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Sharing link has an unsupported owner space\"\n ),\n };\n }\n\n try {\n const parentSession: ServiceSession = {\n delegationHeader: { Authorization: shareData.delegation.authHeader },\n delegationCid: shareData.delegation.cid,\n spaceId: shareData.spaceId,\n verificationMethod: shareData.keyDid,\n jwk: shareData.key,\n };\n const result = this.createDelegationWasmFn({\n session: parentSession,\n delegateDID,\n spaceId: shareData.spaceId,\n abilities: { [service]: { [path]: actions } },\n expirationSecs: Math.floor(expiry.getTime() / 1000),\n });\n const childSigningActiveError = this.retiredGraphError();\n if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n const verifiedChild = verifySignedChild(result, {\n delegateDID,\n issuerDID: principalDid(shareData.keyDid),\n parentCid: shareData.delegation.cid,\n service,\n spaceId: shareData.spaceId,\n path,\n actions,\n expiresAt: expiry,\n parentExpiresAt: parentExpiry,\n }, this.computeCidFn);\n if (!verifiedChild) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"Delegation signer returned a child outside the requested capability\"\n ),\n };\n }\n\n const registrationInit = {\n method: \"POST\",\n headers: { Authorization: result.delegation },\n redirect: \"error\" as const,\n };\n const registration = await this.fetchFn(new URL(\"/delegate\", trustedHost).toString(), registrationInit);\n const registrationActiveError = this.retiredGraphError();\n if (registrationActiveError) return { ok: false, error: registrationActiveError };\n if (!registration.ok) {\n throw new Error(`node rejected child delegation (${registration.status})`);\n }\n\n const primary = verifiedChild.resource;\n return {\n ok: true,\n data: {\n delegation: {\n cid: result.cid,\n delegateDID: verifiedChild.delegateDID,\n delegatorDID: shareData.keyDid.split(\"#\")[0],\n spaceId: shareData.spaceId,\n path: primary.path,\n actions: primary.actions,\n expiry: verifiedChild.expiresAt,\n isRevoked: false,\n allowSubDelegation: false,\n parentCid: shareData.delegation.cid,\n createdAt: now,\n delegationHeader: { Authorization: result.delegation },\n ownerAddress: owner.address,\n chainId: owner.chainId,\n host: trustedHost,\n resources: result.resources,\n disableSubDelegation: true,\n },\n source: {\n parentCid: shareData.delegation.cid,\n spaceId: shareData.spaceId,\n path: primary.path,\n host: trustedHost,\n expiresAt: verifiedChild.expiresAt,\n },\n },\n };\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.CREATION_FAILED,\n \"Failed to create or register the child delegation\"\n ),\n };\n }\n }\n\n /**\n * The child-delegation WASM boundary accepts action-only abilities. Reject\n * every constrained parent branch before that boundary can broaden it.\n */\n private assertDelegationCaveatsPreservable(delegation: Delegation): void {\n if (recapCaveatsEqual(delegation.caveats, undefined)) return;\n const service = delegation.actions[0]?.split(\"/\", 1)[0] ?? \"tinycloud.unknown\";\n const entry: PermissionEntry = {\n service,\n space: delegation.spaceId,\n path: delegation.path,\n actions: [...delegation.actions],\n caveats: delegation.caveats ?? [],\n };\n throw new CaveatedDelegationUnsupportedError([entry]);\n }\n\n /**\n * Encode sharing data into a link string.\n *\n * @param data - The share data to encode\n * @param schema - The encoding schema (default: \"base64\")\n * @returns Encoded link string\n */\n encodeLink(data: EncodedShareData, schema: ShareSchema = \"base64\"): string {\n if (schema !== \"base64\") {\n throw new Error(`Schema '${schema}' not implemented. Only 'base64' is supported.`);\n }\n\n const jsonString = JSON.stringify(data);\n const encoded = base64UrlEncode(jsonString);\n return `${BASE64_PREFIX}${encoded}`;\n }\n\n /**\n * Decode a link string into sharing data.\n *\n * @param link - The encoded link string (may include URL prefix)\n * @returns Decoded share data\n * @throws Error if link format is invalid or data fails validation\n */\n decodeLink(link: string): EncodedShareData {\n const result = this.decodeLinkWithValidation(link);\n if (!result.ok) {\n throw new Error(result.error.message);\n }\n return result.data;\n }\n\n /**\n * Decode and validate a link string into sharing data.\n *\n * Internal method that returns a Result instead of throwing.\n * Used by receive() for proper error handling.\n *\n * @param link - The encoded link string (may include URL prefix)\n * @returns Result with decoded share data or validation error\n */\n private decodeLinkWithValidation(link: string): Result<EncodedShareData, DelegationError> {\n // Extract the encoded data from the link\n let encoded = link;\n\n // Handle full URL format: https://share.example.com/share/tc1:...\n if (link.includes(\"/share/\")) {\n const parts = link.split(\"/share/\");\n encoded = parts[parts.length - 1];\n }\n\n // Handle query parameter format: ?share=tc1:...\n if (link.includes(\"?share=\")) {\n try {\n const url = new URL(link);\n encoded = url.searchParams.get(\"share\") ?? encoded;\n } catch {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n \"Invalid URL format in sharing link\"\n ),\n };\n }\n }\n\n // Remove the schema prefix\n if (!encoded.startsWith(BASE64_PREFIX)) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n `Invalid sharing link format. Expected prefix '${BASE64_PREFIX}'`\n ),\n };\n }\n\n const base64Data = encoded.slice(BASE64_PREFIX.length);\n\n let jsonString: string;\n try {\n jsonString = base64UrlDecode(base64Data);\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n `Failed to decode base64 data: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(jsonString);\n } catch (err) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n `Failed to parse share data JSON: ${err instanceof Error ? err.message : String(err)}`,\n err instanceof Error ? err : undefined\n ),\n };\n }\n\n // Convert delegation expiry to Date before validation if it's a string\n // This is needed because JSON.parse doesn't restore Date objects\n if (\n parsed &&\n typeof parsed === \"object\" &&\n \"delegation\" in parsed &&\n parsed.delegation &&\n typeof parsed.delegation === \"object\" &&\n \"expiry\" in parsed.delegation &&\n typeof parsed.delegation.expiry === \"string\"\n ) {\n (parsed.delegation as { expiry: Date }).expiry = new Date(parsed.delegation.expiry);\n }\n\n // Validate against schema\n const validationResult = validateEncodedShareData(parsed);\n if (!validationResult.ok) {\n return {\n ok: false,\n error: createError(\n DelegationErrorCodes.INVALID_TOKEN,\n validationResult.error.message,\n undefined,\n validationResult.error.meta\n ),\n };\n }\n\n return { ok: true, data: validationResult.data };\n }\n}\n\n/**\n * Create a new SharingService instance.\n */\nexport function createSharingService(config: SharingServiceConfig): ISharingService {\n return new SharingService(config);\n}\n\nfunction ownerFromSpaceId(spaceId: string): { chainId: number; address: string } | null {\n const match = spaceId.match(/^tinycloud:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40}):/);\n if (!match) return null;\n const chainId = Number(match[1]);\n if (!Number.isSafeInteger(chainId)) return null;\n return { chainId, address: match[2] };\n}\n\nfunction parseTrustedNodeOrigin(value: string): string | null {\n try {\n const url = new URL(value);\n if (\n ![\"http:\", \"https:\"].includes(url.protocol) ||\n url.username ||\n url.password ||\n (url.pathname !== \"\" && url.pathname !== \"/\") ||\n url.search ||\n url.hash\n ) return null;\n return url.origin.toLowerCase();\n } catch {\n return null;\n }\n}\n\nfunction trustedNodeOrigin(candidate: string, configured: string[], expected?: string): string | null {\n const origin = parseTrustedNodeOrigin(candidate);\n if (!origin) return null;\n const allowed = new Set(configured.map(parseTrustedNodeOrigin).filter((value): value is string => Boolean(value)));\n if (!allowed.has(origin)) return null;\n if (expected && parseTrustedNodeOrigin(expected) !== origin) return null;\n return origin;\n}\n\nfunction canonicalCapabilityPath(path: string): string | null {\n if (\n /[\\u0000-\\u001f\\\\]/.test(path) ||\n /%(?:2e|2f|5c)/i.test(path) ||\n path.includes(\"//\")\n ) return null;\n const wildcardIndex = path.indexOf(\"*\");\n if (wildcardIndex !== -1 && !path.endsWith(\"/*\") && !path.endsWith(\"/**\")) return null;\n if (path.slice(0, -3).includes(\"*\") || (path.endsWith(\"/*\") && path.slice(0, -2).includes(\"*\"))) return null;\n const segments = path.split(\"/\");\n if (segments.some((segment) => segment === \".\" || segment === \"..\")) return null;\n return path;\n}\n\nfunction capabilityPathContains(parent: string, child: string): boolean {\n const canonicalParent = canonicalCapabilityPath(parent);\n const canonicalChild = canonicalCapabilityPath(child);\n if (canonicalParent === null || canonicalChild === null) return false;\n if (canonicalParent === \"\" || canonicalParent === \"/\") return true;\n if (canonicalParent === canonicalChild) return true;\n if (canonicalParent.endsWith(\"/**\")) {\n return canonicalChild.startsWith(canonicalParent.slice(0, -2));\n }\n if (canonicalParent.endsWith(\"/*\")) {\n const prefix = canonicalParent.slice(0, -1);\n if (!canonicalChild.startsWith(prefix)) return false;\n const remainder = canonicalChild.slice(prefix.length);\n return remainder.length > 0 && !remainder.includes(\"/\");\n }\n return canonicalParent.endsWith(\"/\") && canonicalChild.startsWith(canonicalParent);\n}\n\nfunction shareKeyMatchesDid(key: JWK, didUrl: string): boolean {\n if (\n key.kty !== \"OKP\" ||\n key.crv !== \"Ed25519\" ||\n typeof key.x !== \"string\" ||\n typeof key.d !== \"string\"\n ) return false;\n try {\n const didBytes = bases.base58btc.decode(principalDid(didUrl).slice(\"did:key:\".length));\n const publicKey = didBytes.length === 34 && didBytes[0] === 0xed && didBytes[1] === 0x01\n ? didBytes.slice(2)\n : null;\n if (!publicKey) return false;\n const jwkBytes = decodeBase64UrlBytes(key.x);\n const privateKey = decodeBase64UrlBytes(key.d);\n const derivedPublicKey = ed25519.getPublicKey(privateKey);\n return (\n privateKey.length === 32 &&\n publicKey.length === jwkBytes.length &&\n publicKey.every((byte, index) => byte === jwkBytes[index]) &&\n derivedPublicKey.length === jwkBytes.length &&\n derivedPublicKey.every((byte, index) => byte === jwkBytes[index])\n );\n } catch {\n return false;\n }\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n let encoded = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n while (encoded.length % 4) encoded += \"=\";\n if (typeof atob !== \"undefined\") {\n return Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));\n }\n return Uint8Array.from(Buffer.from(encoded, \"base64\"));\n}\n\nfunction verifySignedChild(\n result: CreateDelegationWasmResult,\n expected: {\n delegateDID: string;\n issuerDID: string;\n parentCid: string;\n service: string;\n spaceId: string;\n path: string;\n actions: string[];\n expiresAt: Date;\n parentExpiresAt: Date;\n },\n computeCid: NonNullable<SharingServiceConfig[\"computeCid\"]>,\n): { delegateDID: string; expiresAt: Date; resource: CreateDelegationWasmResult[\"resources\"][number] } | null {\n const parts = result.delegation.split(\".\");\n if (parts.length !== 3) return null;\n let payload: Record<string, unknown>;\n try {\n payload = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(parts[1]))) as Record<string, unknown>;\n } catch {\n return null;\n }\n const delegateDID = typeof payload.aud === \"string\" ? principalDid(payload.aud) : \"\";\n const issuerDID = typeof payload.iss === \"string\" ? principalDid(payload.iss) : \"\";\n const proofs = Array.isArray(payload.prf) ? payload.prf : [];\n const expirationSecs = typeof payload.exp === \"number\" && Number.isInteger(payload.exp) ? payload.exp : 0;\n const expiresAt = new Date(expirationSecs * 1000);\n if (\n delegateDID !== expected.delegateDID ||\n issuerDID !== expected.issuerDID ||\n proofs.length !== 1 ||\n proofs[0] !== expected.parentCid ||\n expiresAt <= new Date() ||\n expiresAt > expected.expiresAt ||\n expiresAt > expected.parentExpiresAt ||\n computeCid(new TextEncoder().encode(result.delegation), 0x55n) !== result.cid\n ) return null;\n\n const att = payload.att;\n if (!att || typeof att !== \"object\" || Array.isArray(att)) return null;\n const entries = Object.entries(att as Record<string, unknown>);\n if (entries.length !== 1) return null;\n const [resourceUri, abilityValue] = entries[0];\n const prefix = `${expected.spaceId}/${expected.service}/`;\n if (!resourceUri.startsWith(prefix) || resourceUri.slice(prefix.length) !== expected.path) return null;\n if (!abilityValue || typeof abilityValue !== \"object\" || Array.isArray(abilityValue)) return null;\n const signedActions = Object.keys(abilityValue as Record<string, unknown>).sort();\n const expectedActions = [...expected.actions].sort();\n if (\n signedActions.length !== expectedActions.length ||\n !signedActions.every((action, index) => action === expectedActions[index])\n ) return null;\n\n if (principalDid(result.delegateDID) !== delegateDID || result.resources.length !== 1) return null;\n if (result.expiry.getTime() !== expiresAt.getTime()) return null;\n const resource = result.resources[0];\n if (\n resource.service !== expected.service ||\n resource.space !== expected.spaceId ||\n resource.path !== expected.path\n ) return null;\n const actualActions = [...resource.actions].sort();\n if (\n actualActions.length !== expectedActions.length ||\n !actualActions.every((action, index) => action === expectedActions[index])\n ) return null;\n return { delegateDID, expiresAt, resource };\n}\n","/**\n * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.\n *\n * The registry maintains mappings between:\n * - Keys and their associated delegations\n * - Capabilities (resource/action pairs) and the keys that can exercise them\n *\n * This enables automatic key selection when performing operations, choosing\n * the most appropriate key based on priority and validity.\n *\n * @packageDocumentation\n */\n\nimport type { Result, ServiceError } from \"@tinycloud/sdk-services\";\nimport { ok, err, serviceError } from \"@tinycloud/sdk-services\";\nimport type {\n KeyInfo,\n CapabilityEntry,\n Delegation,\n IngestOptions,\n} from \"../delegations/types\";\nimport { actionContains, recapCaveatsEqual } from \"../capabilities\";\n\n// =============================================================================\n// Service Name\n// =============================================================================\n\nconst SERVICE_NAME = \"capability-key-registry\";\n\n// =============================================================================\n// Error Codes\n// =============================================================================\n\n/**\n * Error codes specific to CapabilityKeyRegistry operations.\n */\nexport const CapabilityKeyRegistryErrorCodes = {\n /** Key not found in registry */\n KEY_NOT_FOUND: \"KEY_NOT_FOUND\",\n /** No key available for the requested capability */\n NO_CAPABLE_KEY: \"NO_CAPABLE_KEY\",\n /** Delegation has expired */\n DELEGATION_EXPIRED: \"DELEGATION_EXPIRED\",\n /** Delegation has been revoked */\n DELEGATION_REVOKED: \"DELEGATION_REVOKED\",\n /** Invalid delegation data */\n INVALID_DELEGATION: \"INVALID_DELEGATION\",\n /** Key already registered */\n KEY_EXISTS: \"KEY_EXISTS\",\n} as const;\n\nexport type CapabilityKeyRegistryErrorCode =\n (typeof CapabilityKeyRegistryErrorCodes)[keyof typeof CapabilityKeyRegistryErrorCodes];\n\n// =============================================================================\n// Storage Types\n// =============================================================================\n\n/**\n * Stored delegation with chain information.\n */\nexport interface StoredDelegationChain {\n /** The delegation itself */\n delegation: Delegation;\n /** Parent delegation CID if this is a sub-delegation */\n parentCid?: string;\n /** Key ID used to sign/exercise this delegation */\n keyId: string;\n /** When this was stored */\n storedAt: Date;\n}\n\n/**\n * Internal delegation store structure.\n */\ninterface DelegationStore {\n /** Delegations indexed by key ID */\n byKey: Map<string, Delegation[]>;\n /** Delegations indexed by CID. A single signed ReCap can carry many scopes. */\n byCid: Map<string, StoredDelegationChain[]>;\n /** Capability entries indexed by \"resource|action\" key */\n byCapability: Map<string, CapabilityEntry[]>;\n}\n\n// =============================================================================\n// Interface\n// =============================================================================\n\n/**\n * Interface for the CapabilityKeyRegistry.\n *\n * Tracks keys and their capabilities for automatic key selection.\n */\nexport interface ICapabilityKeyRegistry {\n /**\n * Register a key with its associated delegations.\n *\n * @param key - Key information\n * @param delegations - Delegations granted to this key\n */\n registerKey(key: KeyInfo, delegations: Delegation[]): void;\n\n /**\n * Remove a key and all its associated delegations.\n *\n * @param keyId - The key ID to remove\n */\n removeKey(keyId: string): void;\n\n /**\n * Get a key that can exercise the specified capability.\n *\n * Uses the key selection algorithm:\n * 1. Filter keys that have the required capability\n * 2. Check delegation validity (not expired, not revoked)\n * 3. Sort by priority (session=0, main=1, ingested=2)\n * 4. Return highest priority valid key\n *\n * @param resource - Resource URI (e.g., \"tinycloud://space-id/kv/my-data\")\n * @param action - Action to perform (e.g., \"tinycloud.kv/get\")\n * @returns The best matching key, or null if none available\n */\n getKeyForCapability(resource: string, action: string): KeyInfo | null;\n\n /**\n * Get all registered capabilities.\n *\n * @returns All capability entries in the registry\n */\n getAllCapabilities(): CapabilityEntry[];\n\n /**\n * Get all delegations for a specific key.\n *\n * @param keyId - The key ID\n * @returns Array of delegations for this key\n */\n getDelegationsForKey(keyId: string): Delegation[];\n\n /**\n * Ingest a key and delegation from an external source (e.g., sharing link).\n *\n * @param key - Key information to ingest\n * @param delegation - Delegation to associate with the key\n * @param options - Ingestion options\n */\n ingestKey(\n key: KeyInfo,\n delegation: Delegation,\n options?: IngestOptions\n ): void;\n\n /**\n * Check if a delegation is currently valid.\n *\n * @param delegation - The delegation to check\n * @returns true if valid, false if expired or revoked\n */\n isDelegationValid(delegation: Delegation): boolean;\n\n /**\n * Get a key by its ID.\n *\n * @param keyId - The key ID\n * @returns The key info, or undefined if not found\n */\n getKey(keyId: string): KeyInfo | undefined;\n\n /**\n * Get all registered keys.\n *\n * @returns Array of all registered keys\n */\n getAllKeys(): KeyInfo[];\n\n /**\n * Clear all registered keys and delegations.\n */\n clear(): void;\n\n /**\n * Revoke a delegation by CID.\n *\n * @param cid - The delegation CID to revoke\n * @returns Result indicating success or failure\n */\n revokeDelegation(cid: string): Result<void, ServiceError>;\n\n /**\n * Find capabilities that match a resource path pattern.\n *\n * @param resourcePattern - Resource pattern (supports wildcards)\n * @param action - Optional action filter\n * @returns Matching capability entries\n */\n findCapabilities(\n resourcePattern: string,\n action?: string\n ): CapabilityEntry[];\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.\n *\n * @example\n * ```typescript\n * const registry = new CapabilityKeyRegistry();\n *\n * // Register a session key with its delegations\n * registry.registerKey(sessionKey, [rootDelegation]);\n *\n * // Get the best key for an operation\n * const key = registry.getKeyForCapability(\n * \"tinycloud://my-space/kv/data\",\n * \"tinycloud.kv/get\"\n * );\n *\n * if (key) {\n * // Use this key for the operation\n * console.log(\"Using key:\", key.id);\n * }\n * ```\n */\nexport class CapabilityKeyRegistry implements ICapabilityKeyRegistry {\n /**\n * Registry of all keys indexed by ID.\n */\n private keys: Map<string, KeyInfo> = new Map();\n\n /**\n * Delegation storage.\n */\n private store: DelegationStore = {\n byKey: new Map(),\n byCid: new Map(),\n byCapability: new Map(),\n };\n\n // ===========================================================================\n // Key Management\n // ===========================================================================\n\n /**\n * Register a key with its associated delegations.\n *\n * @param key - Key information\n * @param delegations - Delegations granted to this key\n */\n registerKey(key: KeyInfo, delegations: Delegation[]): void {\n // Store the key\n this.keys.set(key.id, key);\n\n // Initialize delegation storage for this key\n if (!this.store.byKey.has(key.id)) {\n this.store.byKey.set(key.id, []);\n }\n\n // Process each delegation\n for (const delegation of delegations) {\n this.addDelegation(key, delegation);\n }\n }\n\n /**\n * Remove a key and all its associated delegations.\n *\n * @param keyId - The key ID to remove\n */\n removeKey(keyId: string): void {\n // Get delegations for this key\n const delegations = this.store.byKey.get(keyId) || [];\n\n // Remove this key's entries without dropping other scopes from the same\n // signed ReCap.\n for (const delegation of delegations) {\n const chains = this.store.byCid.get(delegation.cid);\n if (!chains) continue;\n const remaining = chains.filter((chain) => chain.keyId !== keyId);\n if (remaining.length === 0) {\n this.store.byCid.delete(delegation.cid);\n } else {\n this.store.byCid.set(delegation.cid, remaining);\n }\n }\n\n // Remove from byCapability\n for (const [capKey, entries] of this.store.byCapability) {\n const filtered = entries.filter(\n (entry) => !entry.keys.some((k: KeyInfo) => k.id === keyId)\n );\n if (filtered.length === 0) {\n this.store.byCapability.delete(capKey);\n } else {\n // Remove this key from entries that have multiple keys\n for (const entry of filtered) {\n entry.keys = entry.keys.filter((k: KeyInfo) => k.id !== keyId);\n }\n this.store.byCapability.set(capKey, filtered.filter((e) => e.keys.length > 0));\n }\n }\n\n // Remove from byKey\n this.store.byKey.delete(keyId);\n\n // Remove the key itself\n this.keys.delete(keyId);\n }\n\n // ===========================================================================\n // Capability Lookup\n // ===========================================================================\n\n /**\n * Get a key that can exercise the specified capability.\n *\n * Key selection algorithm:\n * 1. Filter keys that have the required capability\n * 2. Check delegation validity (not expired, not revoked)\n * 3. Sort by priority (session=0, main=1, ingested=2)\n * 4. Return highest priority valid key\n *\n * @param resource - Resource URI\n * @param action - Action to perform\n * @returns The best matching key, or null if none available\n */\n getKeyForCapability(resource: string, action: string): KeyInfo | null {\n // Find matching capabilities\n const matchingEntries = this.findMatchingEntries(resource, action);\n\n if (matchingEntries.length === 0) {\n return null;\n }\n\n // Collect all valid keys from matching entries\n const validKeys: KeyInfo[] = [];\n\n for (const entry of matchingEntries) {\n // Check if the delegation is valid\n if (!this.isDelegationValid(entry.delegation)) {\n continue;\n }\n\n // Add keys from this entry\n for (const key of entry.keys) {\n if (!validKeys.some((k: KeyInfo) => k.id === key.id)) {\n validKeys.push(key);\n }\n }\n }\n\n if (validKeys.length === 0) {\n return null;\n }\n\n // Sort by priority (lower is better)\n validKeys.sort((a: KeyInfo, b: KeyInfo) => a.priority - b.priority);\n\n return validKeys[0];\n }\n\n /**\n * Get all registered capabilities.\n *\n * @returns All capability entries in the registry\n */\n getAllCapabilities(): CapabilityEntry[] {\n const all: CapabilityEntry[] = [];\n for (const entries of this.store.byCapability.values()) {\n all.push(...entries);\n }\n return all;\n }\n\n // ===========================================================================\n // Delegation Tracking\n // ===========================================================================\n\n /**\n * Get all delegations for a specific key.\n *\n * @param keyId - The key ID\n * @returns Array of delegations for this key\n */\n getDelegationsForKey(keyId: string): Delegation[] {\n return this.store.byKey.get(keyId) || [];\n }\n\n // ===========================================================================\n // Ingestion\n // ===========================================================================\n\n /**\n * Ingest a key and delegation from an external source.\n *\n * @param key - Key information to ingest\n * @param delegation - Delegation to associate with the key\n * @param options - Ingestion options\n */\n ingestKey(\n key: KeyInfo,\n delegation: Delegation,\n options?: IngestOptions\n ): void {\n // Apply priority override if specified\n const keyToStore: KeyInfo = options?.priority !== undefined\n ? { ...key, priority: options.priority }\n : key;\n\n // Store the key\n this.keys.set(keyToStore.id, keyToStore);\n\n // Initialize delegation storage\n if (!this.store.byKey.has(keyToStore.id)) {\n this.store.byKey.set(keyToStore.id, []);\n }\n\n // Add the delegation\n this.addDelegation(keyToStore, delegation);\n }\n\n // ===========================================================================\n // Validation\n // ===========================================================================\n\n /**\n * Check if a delegation is currently valid.\n *\n * @param delegation - The delegation to check\n * @returns true if valid, false if expired or revoked\n */\n isDelegationValid(delegation: Delegation): boolean {\n // Check if revoked\n if (delegation.isRevoked) {\n return false;\n }\n\n // Check expiry\n const now = new Date();\n if (delegation.expiry && delegation.expiry < now) {\n return false;\n }\n\n return true;\n }\n\n // ===========================================================================\n // Key Access\n // ===========================================================================\n\n /**\n * Get a key by its ID.\n *\n * @param keyId - The key ID\n * @returns The key info, or undefined if not found\n */\n getKey(keyId: string): KeyInfo | undefined {\n return this.keys.get(keyId);\n }\n\n /**\n * Get all registered keys.\n *\n * @returns Array of all registered keys\n */\n getAllKeys(): KeyInfo[] {\n return Array.from(this.keys.values());\n }\n\n // ===========================================================================\n // Clear\n // ===========================================================================\n\n /**\n * Clear all registered keys and delegations.\n */\n clear(): void {\n this.keys.clear();\n this.store.byKey.clear();\n this.store.byCid.clear();\n this.store.byCapability.clear();\n }\n\n // ===========================================================================\n // Revocation\n // ===========================================================================\n\n /**\n * Revoke a delegation by CID.\n *\n * @param cid - The delegation CID to revoke\n * @returns Result indicating success or failure\n */\n revokeDelegation(cid: string): Result<void, ServiceError> {\n const stored = this.store.byCid.get(cid);\n\n if (!stored || stored.length === 0) {\n return err(\n serviceError(\n CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,\n `Delegation not found: ${cid}`,\n SERVICE_NAME\n )\n );\n }\n\n // A CID identifies the signed delegation as a whole, including every\n // scope reconstructed from its ReCap.\n for (const chain of stored) chain.delegation.isRevoked = true;\n for (const keyDelegations of this.store.byKey.values()) {\n for (const delegation of keyDelegations) {\n if (delegation.cid === cid) delegation.isRevoked = true;\n }\n }\n\n // Update in byCapability\n for (const entries of this.store.byCapability.values()) {\n for (const entry of entries) {\n if (entry.delegation.cid === cid) {\n entry.delegation.isRevoked = true;\n }\n }\n }\n\n return ok(undefined);\n }\n\n // ===========================================================================\n // Search\n // ===========================================================================\n\n /**\n * Find capabilities that match a resource path pattern.\n *\n * @param resourcePattern - Resource pattern (supports wildcards)\n * @param action - Optional action filter\n * @returns Matching capability entries\n */\n findCapabilities(\n resourcePattern: string,\n action?: string\n ): CapabilityEntry[] {\n const results: CapabilityEntry[] = [];\n\n for (const entries of this.store.byCapability.values()) {\n for (const entry of entries) {\n // Check action match if specified\n if (action && entry.action !== action) {\n continue;\n }\n\n // Check resource pattern match\n if (this.matchesResourcePattern(entry.resource, resourcePattern)) {\n results.push(entry);\n }\n }\n }\n\n return results;\n }\n\n // ===========================================================================\n // Private Methods\n // ===========================================================================\n\n /**\n * Add a delegation to the store.\n *\n * @param key - The key associated with this delegation\n * @param delegation - The delegation to add\n */\n private addDelegation(key: KeyInfo, delegation: Delegation): void {\n // Add to byKey\n const keyDelegations = this.store.byKey.get(key.id) || [];\n if (!keyDelegations.some((d) => this.sameDelegationScope(d, delegation))) {\n keyDelegations.push(delegation);\n this.store.byKey.set(key.id, keyDelegations);\n }\n\n // Add to byCid\n const chains = this.store.byCid.get(delegation.cid) ?? [];\n if (!chains.some((chain) =>\n chain.keyId === key.id && this.sameDelegationScope(chain.delegation, delegation)\n )) {\n chains.push({\n delegation,\n parentCid: delegation.parentCid,\n keyId: key.id,\n storedAt: new Date(),\n });\n this.store.byCid.set(delegation.cid, chains);\n }\n\n // Add to byCapability for each action\n for (const action of delegation.actions) {\n const capKey = this.makeCapabilityKey(delegation.path, action);\n const entries = this.store.byCapability.get(capKey) || [];\n\n // Check if we already have an entry for this exact delegation\n const existingEntry = entries.find((e) =>\n this.sameDelegationScope(e.delegation, delegation)\n );\n\n if (existingEntry) {\n // Add this key if not already present\n if (!existingEntry.keys.some((k: KeyInfo) => k.id === key.id)) {\n existingEntry.keys.push(key);\n // Re-sort by priority\n existingEntry.keys.sort((a: KeyInfo, b: KeyInfo) => a.priority - b.priority);\n }\n } else {\n // Create new capability entry\n const entry: CapabilityEntry = {\n resource: delegation.path,\n action,\n keys: [key],\n delegation,\n expiresAt: delegation.expiry,\n };\n entries.push(entry);\n this.store.byCapability.set(capKey, entries);\n }\n }\n }\n\n /**\n * Create a capability key for indexing.\n *\n * @param resource - Resource path\n * @param action - Action\n * @returns Combined key string\n */\n private makeCapabilityKey(resource: string, action: string): string {\n return `${resource}|${action}`;\n }\n\n private sameDelegationScope(left: Delegation, right: Delegation): boolean {\n return left.cid === right.cid &&\n left.spaceId === right.spaceId &&\n left.path === right.path &&\n left.actions.length === right.actions.length &&\n left.actions.every((action) => right.actions.includes(action)) &&\n recapCaveatsEqual(left.caveats, right.caveats);\n }\n\n /**\n * Find capability entries that match a resource and action.\n *\n * @param resource - Resource to match\n * @param action - Action to match\n * @returns Matching entries\n */\n private findMatchingEntries(\n resource: string,\n action: string\n ): CapabilityEntry[] {\n const results: CapabilityEntry[] = [];\n\n // Exact match\n const exactKey = this.makeCapabilityKey(resource, action);\n const exactEntries = this.store.byCapability.get(exactKey);\n if (exactEntries) {\n results.push(...exactEntries);\n }\n\n // Wildcard matches - check all entries for patterns that match this resource\n for (const [capKey, entries] of this.store.byCapability) {\n if (capKey === exactKey) continue; // Already handled\n\n for (const entry of entries) {\n // Check if the entry's action matches\n if (!this.actionMatches(entry.action, action)) {\n continue;\n }\n\n // Check if the entry's resource pattern matches the requested resource\n if (this.resourceMatchesPattern(resource, entry.resource)) {\n if (!results.some((r) =>\n this.sameDelegationScope(r.delegation, entry.delegation)\n )) {\n results.push(entry);\n }\n }\n }\n }\n\n return results;\n }\n\n /**\n * Check if an action pattern matches a specific action.\n *\n * @param pattern - Action pattern (may include wildcard like \"tinycloud.kv/*\")\n * @param action - Specific action to check\n * @returns true if pattern matches action\n */\n private actionMatches(pattern: string, action: string): boolean {\n return actionContains(pattern, action);\n }\n\n /**\n * Check if a resource matches a pattern.\n *\n * Patterns support:\n * - Exact match: \"/kv/data\" matches \"/kv/data\"\n * - Wildcard suffix: \"/kv/*\" matches \"/kv/anything\"\n * - Double wildcard: \"/kv/**\" matches \"/kv/any/nested/path\"\n *\n * @param resource - The specific resource being accessed\n * @param pattern - The pattern from the delegation\n * @returns true if resource matches pattern\n */\n private resourceMatchesPattern(resource: string, pattern: string): boolean {\n // Exact match\n if (pattern === resource) {\n return true;\n }\n\n // Double wildcard (**) - matches any nested path\n if (pattern.endsWith(\"/**\")) {\n const prefix = pattern.slice(0, -3);\n return resource.startsWith(prefix);\n }\n\n // Single wildcard (*) - matches one path segment\n if (pattern.endsWith(\"/*\")) {\n const prefix = pattern.slice(0, -2);\n if (!resource.startsWith(prefix)) {\n return false;\n }\n const remainder = resource.slice(prefix.length);\n // Should be a single segment (no more slashes except possibly trailing)\n return !remainder.includes(\"/\") || remainder === \"/\";\n }\n\n // Prefix match for paths ending with /\n if (pattern.endsWith(\"/\") && resource.startsWith(pattern)) {\n return true;\n }\n\n return false;\n }\n\n /**\n * Check if a specific resource matches a resource pattern for searching.\n *\n * @param entryResource - The resource from a capability entry\n * @param searchPattern - The pattern to search for\n * @returns true if entry resource matches search pattern\n */\n private matchesResourcePattern(\n entryResource: string,\n searchPattern: string\n ): boolean {\n // Use the same logic as resourceMatchesPattern\n return this.resourceMatchesPattern(entryResource, searchPattern) ||\n this.resourceMatchesPattern(searchPattern, entryResource);\n }\n}\n\n/**\n * Create a new CapabilityKeyRegistry instance.\n *\n * @returns A new registry instance\n */\nexport function createCapabilityKeyRegistry(): ICapabilityKeyRegistry {\n return new CapabilityKeyRegistry();\n}\n","/**\n * SignStrategy types for TinyCloud authorization.\n *\n * These types define how sign requests are handled across different\n * SDK implementations (web-sdk, node-sdk). The pattern allows for\n * automatic signing, rejection, callback-based approval, or event-driven\n * workflows.\n *\n * @packageDocumentation\n */\n\n/**\n * Sign request passed to callback or event handlers.\n */\nexport interface SignRequest {\n /** Ethereum address of the signer */\n address: string;\n /** Chain ID for the signing context */\n chainId: number;\n /** Message to be signed */\n message: string;\n /** Type of sign operation */\n type: \"siwe\" | \"message\";\n /**\n * What the signature is for. Lets strategies apply different policies to\n * account-bootstrap signatures (which may be auto-signed server-side)\n * versus the user-initiated sign-in. Absent on requests from older SDKs.\n */\n purpose?: \"sign-in\" | \"bootstrap-session\" | \"bootstrap-host\" | \"message\";\n}\n\n/**\n * Sign response from callback or event handlers.\n */\nexport interface SignResponse {\n /** Whether the sign request was approved */\n approved: boolean;\n /** The signature if approved */\n signature?: string;\n /** Reason for rejection if not approved */\n reason?: string;\n}\n\n/**\n * Callback handler type for sign requests.\n */\nexport type SignCallback = (request: SignRequest) => Promise<SignResponse>;\n\nexport interface OpenKeySigningStrategyOptions {\n /**\n * OpenKey signing endpoint URL.\n *\n * The SDK sends `POST endpoint` with JSON:\n * `{ address, chainId, message, type, keyId? }`.\n *\n * Expected successful response shape:\n * `{ signature: \"0x...\" }` or `{ approved: true, signature: \"0x...\" }`.\n *\n * Explicit-approval-needed response shape:\n * `{ approved: false, reason?: string }` or\n * `{ needsApproval: true, reason?: string, approvalUrl?: string }`.\n */\n endpoint: string;\n /** Optional OpenKey managed key id. */\n keyId?: string;\n /** Optional bearer token or async token supplier. */\n token?: string | (() => string | Promise<string | undefined>) | undefined;\n /** Extra headers to include on every request. */\n headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);\n /** Fetch implementation. Defaults to `globalThis.fetch`. */\n fetch?: typeof fetch;\n /** Request credentials mode for browser integrations. */\n credentials?: \"include\" | \"omit\" | \"same-origin\";\n}\n\nexport interface OpenKeySigningRequestBody extends SignRequest {\n keyId?: string;\n}\n\nexport interface OpenKeySigningResponseBody {\n approved?: boolean;\n signature?: string;\n reason?: string;\n error?: string;\n needsApproval?: boolean;\n approvalUrl?: string;\n}\n\nexport interface OpenKeyCallbackStrategy extends CallbackStrategy {\n /** Marker used by SDK runtimes to choose the bootstrap-safe initial SIWE. */\n openKeyAutoSign: true;\n}\n\nasync function resolveOpenKeyToken(\n token: OpenKeySigningStrategyOptions[\"token\"],\n): Promise<string | undefined> {\n return typeof token === \"function\" ? token() : token;\n}\n\nasync function resolveOpenKeyHeaders(\n headers: OpenKeySigningStrategyOptions[\"headers\"],\n): Promise<Record<string, string>> {\n return typeof headers === \"function\" ? headers() : headers ?? {};\n}\n\nfunction openKeyApprovalReason(body: OpenKeySigningResponseBody): string {\n if (body.reason) return body.reason;\n if (body.error) return body.error;\n if (body.approvalUrl) {\n return `OpenKey explicit approval required: ${body.approvalUrl}`;\n }\n return \"OpenKey explicit approval required\";\n}\n\n/**\n * Create a callback signing strategy that delegates message signing to OpenKey.\n *\n * The helper deliberately returns the existing `CallbackStrategy` shape. When\n * OpenKey's policy gate says a request needs explicit approval, the callback\n * returns `{ approved: false, reason }`; `NodeUserAuthorization` then surfaces\n * that reason as the sign-in/signing error.\n */\nexport function createOpenKeyCallbackSigningStrategy(\n options: OpenKeySigningStrategyOptions,\n): OpenKeyCallbackStrategy {\n return {\n type: \"callback\",\n openKeyAutoSign: true,\n handler: async (request) => {\n const fetchImpl = options.fetch ?? globalThis.fetch;\n if (!fetchImpl) {\n throw new Error(\"OpenKey signing strategy requires a fetch implementation\");\n }\n\n const token = await resolveOpenKeyToken(options.token);\n const extraHeaders = await resolveOpenKeyHeaders(options.headers);\n const body: OpenKeySigningRequestBody = {\n ...request,\n ...(options.keyId ? { keyId: options.keyId } : {}),\n };\n\n const response = await fetchImpl(options.endpoint, {\n method: \"POST\",\n credentials: options.credentials,\n headers: {\n \"content-type\": \"application/json\",\n ...(token ? { authorization: `Bearer ${token}` } : {}),\n ...extraHeaders,\n },\n body: JSON.stringify(body),\n });\n\n let parsed: OpenKeySigningResponseBody | undefined;\n try {\n parsed = (await response.json()) as OpenKeySigningResponseBody;\n } catch {\n parsed = undefined;\n }\n\n if (!response.ok) {\n return {\n approved: false,\n reason:\n parsed?.reason ??\n parsed?.error ??\n `OpenKey signing failed with HTTP ${response.status}`,\n };\n }\n\n if (parsed?.needsApproval || parsed?.approved === false) {\n return {\n approved: false,\n reason: openKeyApprovalReason(parsed),\n };\n }\n\n if (typeof parsed?.signature === \"string\" && parsed.signature.length > 0) {\n return {\n approved: true,\n signature: parsed.signature,\n };\n }\n\n return {\n approved: false,\n reason: \"OpenKey signing response did not include a signature\",\n };\n },\n };\n}\n\n/**\n * Auto-sign strategy: automatically signs all requests.\n *\n * Use cases:\n * - Trusted backend services\n * - Automated scripts\n * - CI/CD pipelines\n *\n * @example\n * ```typescript\n * const strategy: AutoSignStrategy = { type: 'auto-sign' };\n * ```\n */\nexport interface AutoSignStrategy {\n type: \"auto-sign\";\n}\n\n/**\n * Auto-reject strategy: rejects all sign requests.\n *\n * Use cases:\n * - Read-only applications\n * - Testing rejection flows\n *\n * @example\n * ```typescript\n * const strategy: AutoRejectStrategy = { type: 'auto-reject' };\n * ```\n */\nexport interface AutoRejectStrategy {\n type: \"auto-reject\";\n}\n\n/**\n * Callback strategy: delegates sign decisions to a callback function.\n *\n * Use cases:\n * - CLI applications with user prompts\n * - Custom approval workflows\n * - Interactive sign flows\n *\n * @example\n * ```typescript\n * const strategy: CallbackStrategy = {\n * type: 'callback',\n * handler: async (req) => {\n * const approved = await promptUser(`Sign message for ${req.address}?`);\n * return { approved, signature: approved ? await signer.sign(req.message) : undefined };\n * }\n * };\n * ```\n */\nexport interface CallbackStrategy {\n type: \"callback\";\n handler: SignCallback;\n}\n\n/**\n * Event emitter strategy: emits sign requests as events.\n *\n * Uses EventTarget for cross-platform compatibility (browser + Node.js).\n *\n * Events emitted:\n * - 'sign-request': When a sign request is received\n *\n * Use cases:\n * - Async approval workflows\n * - External signing services\n * - Multi-step authorization flows\n *\n * @example\n * ```typescript\n * const emitter = new EventTarget();\n * const strategy: EventEmitterStrategy = { type: 'event-emitter', emitter };\n *\n * emitter.addEventListener('sign-request', async (event) => {\n * const { request, respond } = (event as CustomEvent).detail;\n * const approved = await externalApprovalService.check(request);\n * respond({ approved, signature: approved ? await sign(request.message) : undefined });\n * });\n * ```\n */\nexport interface EventEmitterStrategy {\n type: \"event-emitter\";\n emitter: EventTarget;\n /** Timeout in milliseconds for waiting on event response (default: 60000) */\n timeout?: number;\n}\n\n/**\n * Sign strategy union type.\n *\n * Determines how sign requests are handled in UserAuthorization implementations.\n */\nexport type SignStrategy =\n | AutoSignStrategy\n | AutoRejectStrategy\n | CallbackStrategy\n | EventEmitterStrategy;\n\n/**\n * Default sign strategy is auto-sign for convenience.\n */\nexport const defaultSignStrategy: SignStrategy = { type: \"auto-sign\" };\n","/**\n * Space creation handler types for TinyCloud authorization.\n *\n * These types abstract space creation confirmation, allowing different\n * implementations for web (modal) vs node (auto-approve) environments.\n *\n * @packageDocumentation\n */\n\n/**\n * Context passed to space creation handlers.\n */\nexport interface SpaceCreationContext {\n /** The unique identifier for the space being created */\n spaceId: string;\n /** Ethereum address of the user creating the space */\n address: string;\n /** Chain ID for the creation context */\n chainId: number;\n /** Host URL where the space will be created */\n host: string;\n}\n\n/**\n * Interface for handling space creation confirmation.\n *\n * Implementations can provide different UX patterns:\n * - Auto-approve for backend services\n * - Modal confirmation for web apps\n * - CLI prompts for terminal apps\n *\n * @example\n * ```typescript\n * class ModalSpaceCreationHandler implements ISpaceCreationHandler {\n * async confirmSpaceCreation(context: SpaceCreationContext): Promise<boolean> {\n * return await showConfirmationModal(`Create space ${context.spaceId}?`);\n * }\n *\n * onSpaceCreated(context: SpaceCreationContext): void {\n * showToast(`Space ${context.spaceId} created!`);\n * }\n *\n * onSpaceCreationFailed(context: SpaceCreationContext, error: Error): void {\n * showErrorModal(`Failed to create space: ${error.message}`);\n * }\n * }\n * ```\n */\nexport interface ISpaceCreationHandler {\n /**\n * Called when a new space needs to be created.\n * Returns true if space should be created, false to skip.\n *\n * @param context - Information about the space to be created\n * @returns Promise resolving to true to proceed, false to cancel\n */\n confirmSpaceCreation(context: SpaceCreationContext): Promise<boolean>;\n\n /**\n * Called after successful space creation.\n * Optional - implement to show success UI or perform cleanup.\n *\n * @param context - Information about the created space\n */\n onSpaceCreated?(context: SpaceCreationContext): void;\n\n /**\n * Called if space creation fails.\n * Optional - implement to show error UI or perform recovery.\n *\n * @param context - Information about the space that failed to create\n * @param error - The error that occurred\n */\n onSpaceCreationFailed?(context: SpaceCreationContext, error: Error): void;\n}\n\n/**\n * Default handler that auto-approves all space creation.\n *\n * Use cases:\n * - Backend services\n * - Automated scripts\n * - Node.js applications without UI\n *\n * @example\n * ```typescript\n * const handler = new AutoApproveSpaceCreationHandler();\n * const config = { spaceCreationHandler: handler };\n * ```\n */\nexport class AutoApproveSpaceCreationHandler implements ISpaceCreationHandler {\n /**\n * Always returns true to auto-approve space creation.\n */\n async confirmSpaceCreation(): Promise<boolean> {\n return true;\n }\n}\n\n/**\n * Default space creation handler that auto-approves all requests.\n */\nexport const defaultSpaceCreationHandler: ISpaceCreationHandler =\n new AutoApproveSpaceCreationHandler();\n","/**\n * Protocol version checking for SDK-to-node compatibility.\n *\n * @packageDocumentation\n */\n\nexport class ProtocolMismatchError extends Error {\n name = \"ProtocolMismatchError\" as const;\n constructor(\n public readonly sdkProtocol: number,\n public readonly nodeProtocol: number,\n public readonly nodeVersion: string,\n public readonly host: string\n ) {\n super(\n `SDK protocol version ${sdkProtocol} is incompatible with node protocol version ${nodeProtocol} (node v${nodeVersion}) at ${host}. ` +\n (sdkProtocol < nodeProtocol\n ? \"Please update your SDK.\"\n : \"Please update the TinyCloud node.\")\n );\n }\n}\n\nexport class VersionCheckError extends Error {\n name = \"VersionCheckError\" as const;\n constructor(\n public readonly host: string,\n public readonly cause?: Error\n ) {\n super(\n `Failed to fetch node info at ${host}. Ensure the node is running and the /info endpoint is accessible.`\n );\n }\n}\n\nexport class UnsupportedFeatureError extends Error {\n name = \"UnsupportedFeatureError\" as const;\n constructor(\n public readonly feature: string,\n public readonly host: string,\n public readonly availableFeatures: string[]\n ) {\n super(\n `Feature \"${feature}\" is not supported by the node at ${host}. ` +\n `Available features: ${availableFeatures.join(\", \") || \"none\"}.`\n );\n }\n}\n\nexport interface NodeInfo {\n features: string[];\n nodeId?: string;\n quotaUrl?: string;\n}\n\nexport async function checkNodeInfo(\n host: string,\n sdkProtocol: number,\n fetchFn: typeof globalThis.fetch = globalThis.fetch.bind(globalThis)\n): Promise<NodeInfo> {\n let response: Response;\n try {\n response = await fetchFn(`${host}/info`, {\n signal: AbortSignal.timeout(5000),\n });\n } catch (err) {\n throw new VersionCheckError(host, err as Error);\n }\n\n if (!response.ok) {\n throw new VersionCheckError(host);\n }\n\n const data = (await response.json()) as {\n protocol: number;\n version: string;\n features: string[];\n nodeId?: string;\n quota_url?: string;\n };\n\n if (sdkProtocol !== data.protocol) {\n throw new ProtocolMismatchError(\n sdkProtocol,\n data.protocol,\n data.version,\n host\n );\n }\n\n return {\n features: data.features ?? [],\n nodeId: data.nodeId,\n quotaUrl: data.quota_url,\n };\n}\n","/**\n * Returns true if the two passed Uint8Arrays have the same content\n */\nexport function equals (a: Uint8Array, b: Uint8Array): boolean {\n if (a === b) {\n return true\n }\n\n if (a.byteLength !== b.byteLength) {\n return false\n }\n\n for (let i = 0; i < a.byteLength; i++) {\n if (a[i] !== b[i]) {\n return false\n }\n }\n\n return true\n}\n","import { Buffer } from 'node:buffer'\nimport { asUint8Array } from '#util/as-uint8array'\n\n/**\n * Returns a `Uint8Array` of the requested size. Referenced memory will\n * be initialized to 0.\n */\nexport function alloc (size: number = 0): Uint8Array {\n return asUint8Array(Buffer.alloc(size))\n}\n\n/**\n * Where possible returns a Uint8Array of the requested size that references\n * uninitialized memory. Only use if you are certain you will immediately\n * overwrite every value in the returned `Uint8Array`.\n */\nexport function allocUnsafe (size: number = 0): Uint8Array {\n return asUint8Array(Buffer.allocUnsafe(size))\n}\n","/**\n * To guarantee Uint8Array semantics, convert nodejs Buffers\n * into vanilla Uint8Arrays\n */\nexport function asUint8Array (buf: Uint8Array): Uint8Array {\n return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength)\n}\n","/* eslint-disable no-fallthrough */\nimport { allocUnsafe } from 'uint8arrays/alloc'\nimport type { Uint8ArrayList } from 'uint8arraylist'\n\nconst N1 = Math.pow(2, 7)\nconst N2 = Math.pow(2, 14)\nconst N3 = Math.pow(2, 21)\nconst N4 = Math.pow(2, 28)\nconst N5 = Math.pow(2, 35)\nconst N6 = Math.pow(2, 42)\nconst N7 = Math.pow(2, 49)\n\n/** Most significant bit of a byte */\nconst MSB = 0x80\n/** Rest of the bits in a byte */\nconst REST = 0x7f\n\nexport function encodingLength (value: number): number {\n if (value < N1) {\n return 1\n }\n\n if (value < N2) {\n return 2\n }\n\n if (value < N3) {\n return 3\n }\n\n if (value < N4) {\n return 4\n }\n\n if (value < N5) {\n return 5\n }\n\n if (value < N6) {\n return 6\n }\n\n if (value < N7) {\n return 7\n }\n\n if (Number.MAX_SAFE_INTEGER != null && value > Number.MAX_SAFE_INTEGER) {\n throw new RangeError('Could not encode varint')\n }\n\n return 8\n}\n\nexport function encodeUint8Array (value: number, buf: Uint8Array, offset: number = 0): Uint8Array {\n switch (encodingLength(value)) {\n case 8: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 7: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 6: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 5: {\n buf[offset++] = (value & 0xFF) | MSB\n value /= 128\n }\n case 4: {\n buf[offset++] = (value & 0xFF) | MSB\n value >>>= 7\n }\n case 3: {\n buf[offset++] = (value & 0xFF) | MSB\n value >>>= 7\n }\n case 2: {\n buf[offset++] = (value & 0xFF) | MSB\n value >>>= 7\n }\n case 1: {\n buf[offset++] = (value & 0xFF)\n value >>>= 7\n break\n }\n default: throw new Error('unreachable')\n }\n return buf\n}\n\nexport function encodeUint8ArrayList (value: number, buf: Uint8ArrayList, offset: number = 0): Uint8ArrayList {\n switch (encodingLength(value)) {\n case 8: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 7: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 6: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 5: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value /= 128\n }\n case 4: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value >>>= 7\n }\n case 3: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value >>>= 7\n }\n case 2: {\n buf.set(offset++, (value & 0xFF) | MSB)\n value >>>= 7\n }\n case 1: {\n buf.set(offset++, (value & 0xFF))\n value >>>= 7\n break\n }\n default: throw new Error('unreachable')\n }\n return buf\n}\n\nexport function decodeUint8Array (buf: Uint8Array, offset: number): number {\n let b = buf[offset]\n let res = 0\n\n res += b & REST\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 1]\n res += (b & REST) << 7\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 2]\n res += (b & REST) << 14\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 3]\n res += (b & REST) << 21\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 4]\n res += (b & REST) * N4\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 5]\n res += (b & REST) * N5\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 6]\n res += (b & REST) * N6\n if (b < MSB) {\n return res\n }\n\n b = buf[offset + 7]\n res += (b & REST) * N7\n if (b < MSB) {\n return res\n }\n\n throw new RangeError('Could not decode varint')\n}\n\nexport function decodeUint8ArrayList (buf: Uint8ArrayList, offset: number): number {\n let b = buf.get(offset)\n let res = 0\n\n res += b & REST\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 1)\n res += (b & REST) << 7\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 2)\n res += (b & REST) << 14\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 3)\n res += (b & REST) << 21\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 4)\n res += (b & REST) * N4\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 5)\n res += (b & REST) * N5\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 6)\n res += (b & REST) * N6\n if (b < MSB) {\n return res\n }\n\n b = buf.get(offset + 7)\n res += (b & REST) * N7\n if (b < MSB) {\n return res\n }\n\n throw new RangeError('Could not decode varint')\n}\n\nexport function encode (value: number): Uint8Array\nexport function encode (value: number, buf: Uint8Array, offset?: number): Uint8Array\nexport function encode (value: number, buf: Uint8ArrayList, offset?: number): Uint8ArrayList\nexport function encode <T extends Uint8Array | Uint8ArrayList = Uint8Array> (value: number, buf?: T, offset: number = 0): T {\n if (buf == null) {\n buf = allocUnsafe(encodingLength(value)) as T\n }\n if (buf instanceof Uint8Array) {\n return encodeUint8Array(value, buf, offset) as T\n } else {\n return encodeUint8ArrayList(value, buf, offset) as T\n }\n}\n\nexport function decode (buf: Uint8ArrayList | Uint8Array, offset: number = 0): number {\n if (buf instanceof Uint8Array) {\n return decodeUint8Array(buf, offset)\n } else {\n return decodeUint8ArrayList(buf, offset)\n }\n}\n","import { Buffer } from 'node:buffer'\nimport { asUint8Array } from '#util/as-uint8array'\n\n/**\n * Returns a new Uint8Array created by concatenating the passed Uint8Arrays\n */\nexport function concat (arrays: Uint8Array[], length?: number): Uint8Array {\n return asUint8Array(Buffer.concat(arrays, length))\n}\n","import { Buffer } from 'node:buffer'\nimport bases, { type SupportedEncodings } from './util/bases.js'\nimport { asUint8Array } from '#util/as-uint8array'\n\nexport type { SupportedEncodings }\n\n/**\n * Create a `Uint8Array` from the passed string\n *\n * Supports `utf8`, `utf-8`, `hex`, and any encoding supported by the multiformats module.\n *\n * Also `ascii` which is similar to node's 'binary' encoding.\n */\nexport function fromString (string: string, encoding: SupportedEncodings = 'utf8'): Uint8Array {\n const base = bases[encoding]\n\n if (base == null) {\n throw new Error(`Unsupported encoding \"${encoding}\"`)\n }\n\n if (encoding === 'utf8' || encoding === 'utf-8') {\n return asUint8Array(Buffer.from(string, 'utf-8'))\n }\n\n // add multibase prefix\n return base.decoder.decode(`${base.prefix}${string}`) // eslint-disable-line @typescript-eslint/restrict-template-expressions\n}\n","import { bases } from 'multiformats/basics'\nimport type { MultibaseCodec } from 'multiformats'\nimport { allocUnsafe } from '#alloc'\n\nfunction createCodec (name: string, prefix: string, encode: (buf: Uint8Array) => string, decode: (str: string) => Uint8Array): MultibaseCodec<any> {\n return {\n name,\n prefix,\n encoder: {\n name,\n prefix,\n encode\n },\n decoder: {\n decode\n }\n }\n}\n\nconst string = createCodec('utf8', 'u', (buf) => {\n const decoder = new TextDecoder('utf8')\n return 'u' + decoder.decode(buf)\n}, (str) => {\n const encoder = new TextEncoder()\n return encoder.encode(str.substring(1))\n})\n\nconst ascii = createCodec('ascii', 'a', (buf) => {\n let string = 'a'\n\n for (let i = 0; i < buf.length; i++) {\n string += String.fromCharCode(buf[i])\n }\n return string\n}, (str) => {\n str = str.substring(1)\n const buf = allocUnsafe(str.length)\n\n for (let i = 0; i < str.length; i++) {\n buf[i] = str.charCodeAt(i)\n }\n\n return buf\n})\n\nexport type SupportedEncodings = 'utf8' | 'utf-8' | 'hex' | 'latin1' | 'ascii' | 'binary' | keyof typeof bases\n\nconst BASES: Record<SupportedEncodings, MultibaseCodec<any>> = {\n utf8: string,\n 'utf-8': string,\n hex: bases.base16,\n latin1: ascii,\n ascii,\n binary: ascii,\n\n ...bases\n}\n\nexport default BASES\n","import { Buffer } from 'node:buffer'\nimport bases, { type SupportedEncodings } from './util/bases.js'\n\nexport type { SupportedEncodings }\n\n/**\n * Turns a `Uint8Array` into a string.\n *\n * Supports `utf8`, `utf-8` and any encoding supported by the multibase module.\n *\n * Also `ascii` which is similar to node's 'binary' encoding.\n */\nexport function toString (array: Uint8Array, encoding: SupportedEncodings = 'utf8'): string {\n const base = bases[encoding]\n\n if (base == null) {\n throw new Error(`Unsupported encoding \"${encoding}\"`)\n }\n\n if (encoding === 'utf8' || encoding === 'utf-8') {\n return Buffer.from(array.buffer, array.byteOffset, array.byteLength).toString('utf8')\n }\n\n // strip multibase prefix\n return base.encoder.encode(array).substring(1)\n}\n","/**\n * Thrown when an invalid multiaddr is encountered\n */\nexport class InvalidMultiaddrError extends Error {\n static name = 'InvalidMultiaddrError'\n name = 'InvalidMultiaddrError'\n}\n\nexport class ValidationError extends Error {\n static name = 'ValidationError'\n name = 'ValidationError'\n}\n\nexport class InvalidParametersError extends Error {\n static name = 'InvalidParametersError'\n name = 'InvalidParametersError'\n}\n\nexport class UnknownProtocolError extends Error {\n static name = 'UnknownProtocolError'\n name = 'UnknownProtocolError'\n}\n","import { isIPv4, isIPv6, isIP as ipVersion } from \"node:net\";\n\nexport { isIPv4, isIPv6, ipVersion };\n\n/** Check if `input` is IPv4 or IPv6. */\nexport function isIP(input: string): boolean {\n return Boolean(ipVersion(input));\n}\n","// the values here come from https://github.com/multiformats/multiaddr/blob/master/protocols.csv\n\nexport const CODE_IP4 = 4\nexport const CODE_TCP = 6\nexport const CODE_UDP = 273\nexport const CODE_DCCP = 33\nexport const CODE_IP6 = 41\nexport const CODE_IP6ZONE = 42\nexport const CODE_IPCIDR = 43\nexport const CODE_DNS = 53\nexport const CODE_DNS4 = 54\nexport const CODE_DNS6 = 55\nexport const CODE_DNSADDR = 56\nexport const CODE_SCTP = 132\nexport const CODE_UDT = 301\nexport const CODE_UTP = 302\nexport const CODE_UNIX = 400\nexport const CODE_P2P = 421 // also IPFS\nexport const CODE_ONION = 444\nexport const CODE_ONION3 = 445\nexport const CODE_GARLIC64 = 446\nexport const CODE_GARLIC32 = 447\nexport const CODE_TLS = 448\nexport const CODE_SNI = 449\nexport const CODE_NOISE = 454\nexport const CODE_QUIC = 460\nexport const CODE_QUIC_V1 = 461\nexport const CODE_WEBTRANSPORT = 465\nexport const CODE_CERTHASH = 466\nexport const CODE_HTTP = 480\nexport const CODE_HTTP_PATH = 481\nexport const CODE_HTTPS = 443\nexport const CODE_WS = 477\nexport const CODE_WSS = 478\nexport const CODE_P2P_WEBSOCKET_STAR = 479\nexport const CODE_P2P_STARDUST = 277\nexport const CODE_P2P_WEBRTC_STAR = 275\nexport const CODE_P2P_WEBRTC_DIRECT = 276\nexport const CODE_WEBRTC_DIRECT = 280\nexport const CODE_WEBRTC = 281\nexport const CODE_P2P_CIRCUIT = 290\nexport const CODE_MEMORY = 777\n","import { isIPv4 } from '@chainsafe/is-ip'\nimport { base32 } from 'multiformats/bases/base32'\nimport { bases } from 'multiformats/basics'\nimport { concat as uint8ArrayConcat } from 'uint8arrays/concat'\nimport { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'\nimport { toString as uint8ArrayToString } from 'uint8arrays/to-string'\nimport { InvalidMultiaddrError } from './errors.ts'\nimport type { MultibaseCodec } from 'multiformats'\nimport type { SupportedEncodings } from 'uint8arrays/to-string'\n\nexport function bytesToString (base: SupportedEncodings): (buf: Uint8Array) => string {\n return (buf) => {\n return uint8ArrayToString(buf, base)\n }\n}\n\nexport function stringToBytes (base: SupportedEncodings): (value: string) => Uint8Array {\n return (buf) => {\n return uint8ArrayFromString(buf, base)\n }\n}\n\nexport function bytes2port (buf: Uint8Array): string {\n const view = new DataView(buf.buffer)\n return view.getUint16(buf.byteOffset).toString()\n}\n\nexport function port2bytes (port: string | number): Uint8Array {\n const buf = new ArrayBuffer(2)\n const view = new DataView(buf)\n view.setUint16(0, typeof port === 'string' ? parseInt(port) : port)\n\n return new Uint8Array(buf)\n}\n\nexport function onion2bytes (str: string): Uint8Array {\n const addr = str.split(':')\n\n if (addr.length !== 2) {\n throw new Error(`failed to parse onion addr: [\"'${addr.join('\", \"')}'\"]' does not contain a port number`)\n }\n\n if (addr[0].length !== 16) {\n throw new Error(`failed to parse onion addr: ${addr[0]} not a Tor onion address.`)\n }\n\n // onion addresses do not include the multibase prefix, add it before decoding\n const buf = uint8ArrayFromString(addr[0], 'base32')\n\n // onion port number\n const port = parseInt(addr[1], 10)\n\n if (port < 1 || port > 65536) {\n throw new Error('Port number is not in range(1, 65536)')\n }\n\n const portBuf = port2bytes(port)\n\n return uint8ArrayConcat([buf, portBuf], buf.length + portBuf.length)\n}\n\nexport function onion32bytes (str: string): Uint8Array {\n const addr = str.split(':')\n\n if (addr.length !== 2) {\n throw new Error(`failed to parse onion addr: [\"'${addr.join('\", \"')}'\"]' does not contain a port number`)\n }\n\n if (addr[0].length !== 56) {\n throw new Error(`failed to parse onion addr: ${addr[0]} not a Tor onion3 address.`)\n }\n\n // onion addresses do not include the multibase prefix, add it before decoding\n const buf = base32.decode(`b${addr[0]}`)\n\n // onion port number\n const port = parseInt(addr[1], 10)\n\n if (port < 1 || port > 65536) {\n throw new Error('Port number is not in range(1, 65536)')\n }\n\n const portBuf = port2bytes(port)\n\n return uint8ArrayConcat([buf, portBuf], buf.length + portBuf.length)\n}\n\nexport function bytes2onion (buf: Uint8Array): string {\n const addrBytes = buf.subarray(0, buf.length - 2)\n const portBytes = buf.subarray(buf.length - 2)\n const addr = uint8ArrayToString(addrBytes, 'base32')\n const port = bytes2port(portBytes)\n return `${addr}:${port}`\n}\n\n// Copied from https://github.com/indutny/node-ip/blob/master/lib/ip.js#L7\n// but with buf/offset args removed because we don't use them\nexport const ip4ToBytes = function (ip: string): Uint8Array {\n ip = ip.toString().trim()\n\n const bytes = new Uint8Array(4)\n\n ip.split(/\\./g).forEach((byte, index) => {\n const value = parseInt(byte, 10)\n\n if (isNaN(value) || value < 0 || value > 0xff) {\n throw new InvalidMultiaddrError('Invalid byte value in IP address')\n }\n\n bytes[index] = value\n })\n\n return bytes\n}\n\n// Copied from https://github.com/indutny/node-ip/blob/master/lib/ip.js#L7\n// but with buf/offset args removed because we don't use them\nexport const ip6ToBytes = function (ip: string): Uint8Array {\n let offset = 0\n ip = ip.toString().trim()\n\n const sections = ip.split(':', 8)\n\n let i\n for (i = 0; i < sections.length; i++) {\n const isv4 = isIPv4(sections[i])\n let v4Buffer: Uint8Array | undefined\n\n if (isv4) {\n v4Buffer = ip4ToBytes(sections[i])\n sections[i] = uint8ArrayToString(v4Buffer.subarray(0, 2), 'base16')\n }\n\n if (v4Buffer != null && ++i < 8) {\n sections.splice(i, 0, uint8ArrayToString(v4Buffer.subarray(2, 4), 'base16'))\n }\n }\n\n if (sections[0] === '') {\n while (sections.length < 8) { sections.unshift('0') }\n } else if (sections[sections.length - 1] === '') {\n while (sections.length < 8) { sections.push('0') }\n } else if (sections.length < 8) {\n for (i = 0; i < sections.length && sections[i] !== ''; i++) { }\n const argv: [number, number, ...string[]] = [i, 1]\n for (i = 9 - sections.length; i > 0; i--) {\n argv.push('0')\n }\n sections.splice.apply(sections, argv)\n }\n\n const bytes = new Uint8Array(offset + 16)\n\n for (i = 0; i < sections.length; i++) {\n if (sections[i] === '') {\n sections[i] = '0'\n }\n\n const word = parseInt(sections[i], 16)\n\n if (isNaN(word) || word < 0 || word > 0xffff) {\n throw new InvalidMultiaddrError('Invalid byte value in IP address')\n }\n\n bytes[offset++] = (word >> 8) & 0xff\n bytes[offset++] = word & 0xff\n }\n\n return bytes\n}\n\n// Copied from https://github.com/indutny/node-ip/blob/master/lib/ip.js#L63\nexport const ip4ToString = function (buf: Uint8Array): string {\n if (buf.byteLength !== 4) {\n throw new InvalidMultiaddrError('IPv4 address was incorrect length')\n }\n\n const result = []\n\n for (let i = 0; i < buf.byteLength; i++) {\n result.push(buf[i])\n }\n\n return result.join('.')\n}\n\nexport const ip6ToString = function (buf: Uint8Array): string {\n if (buf.byteLength !== 16) {\n throw new InvalidMultiaddrError('IPv6 address was incorrect length')\n }\n\n const result: string[] = []\n\n for (let i = 0; i < buf.byteLength; i += 2) {\n const byte1 = buf[i]\n const byte2 = buf[i + 1]\n\n const tuple = `${byte1.toString(16).padStart(2, '0')}${byte2.toString(16).padStart(2, '0')}`\n\n result.push(tuple)\n }\n\n const ip = result.join(':')\n\n try {\n const url = new URL(`http://[${ip}]`)\n\n return url.hostname.substring(1, url.hostname.length - 1)\n } catch {\n throw new InvalidMultiaddrError(`Invalid IPv6 address \"${ip}\"`)\n }\n}\n\nexport function ip6StringToValue (str: string): string {\n try {\n const url = new URL(`http://[${str}]`)\n\n return url.hostname.substring(1, url.hostname.length - 1)\n } catch {\n throw new InvalidMultiaddrError(`Invalid IPv6 address \"${str}\"`)\n }\n}\n\nconst decoders = Object.values(bases).map((c) => c.decoder)\nconst anybaseDecoder = (function () {\n let acc = decoders[0].or(decoders[1])\n decoders.slice(2).forEach((d) => (acc = acc.or(d)))\n return acc\n})()\n\nexport function mb2bytes (mbstr: string): Uint8Array {\n return anybaseDecoder.decode(mbstr)\n}\n\nexport function bytes2mb (base: MultibaseCodec<any>): (buf: Uint8Array) => string {\n return (buf) => {\n return base.encoder.encode(buf)\n }\n}\n","import { ValidationError } from './errors.ts'\n\nexport function integer (value: string): void {\n const int = parseInt(value)\n\n if (int.toString() !== value) {\n throw new ValidationError('Value must be an integer')\n }\n}\n\nexport function positive (value: any): void {\n if (value < 0) {\n throw new ValidationError('Value must be a positive integer, or zero')\n }\n}\n\nexport function maxValue (max: number): (value: any) => void {\n return (value) => {\n if (value > max) {\n throw new ValidationError(`Value must be smaller than or equal to ${max}`)\n }\n }\n}\n\nexport function validate (...funcs: Array<(value: string) => void>): (value: string) => void {\n return (value) => {\n for (const fn of funcs) {\n fn(value)\n }\n }\n}\n\nexport const validatePort = validate(\n integer,\n positive,\n maxValue(65_535)\n)\n","import { isIPv4, isIPv6 } from '@chainsafe/is-ip'\nimport { CID } from 'multiformats'\nimport { base64url } from 'multiformats/bases/base64'\nimport { CODE_CERTHASH, CODE_DCCP, CODE_DNS, CODE_DNS4, CODE_DNS6, CODE_DNSADDR, CODE_GARLIC32, CODE_GARLIC64, CODE_HTTP, CODE_HTTP_PATH, CODE_HTTPS, CODE_IP4, CODE_IP6, CODE_IP6ZONE, CODE_IPCIDR, CODE_MEMORY, CODE_NOISE, CODE_ONION, CODE_ONION3, CODE_P2P, CODE_P2P_CIRCUIT, CODE_P2P_STARDUST, CODE_P2P_WEBRTC_DIRECT, CODE_P2P_WEBRTC_STAR, CODE_P2P_WEBSOCKET_STAR, CODE_QUIC, CODE_QUIC_V1, CODE_SCTP, CODE_SNI, CODE_TCP, CODE_TLS, CODE_UDP, CODE_UDT, CODE_UNIX, CODE_UTP, CODE_WEBRTC, CODE_WEBRTC_DIRECT, CODE_WEBTRANSPORT, CODE_WS, CODE_WSS } from './constants.ts'\nimport { UnknownProtocolError, ValidationError } from './errors.ts'\nimport { bytes2mb, bytes2onion, bytes2port, bytesToString, ip4ToBytes, ip4ToString, ip6StringToValue, ip6ToBytes, ip6ToString, mb2bytes, onion2bytes, onion32bytes, port2bytes, stringToBytes } from './utils.ts'\nimport { validatePort } from './validation.ts'\nimport type { Registry as RegistryInterface } from './index.ts'\n\nexport const V = -1\n\nexport interface ProtocolCodec {\n /**\n * A numeric code that will be used in the binary representation of the tuple.\n */\n code: number\n\n /**\n * A string name that will be used in the string representation of the addr.\n */\n name: string\n\n /**\n * Size defines the expected length of the address part of the tuple - valid\n * values are `-1` (or the `V` constant) for variable length (this will be\n * varint encoded in the binary representation), `0` for no address part or a\n * number that represents a fixed-length address.\n */\n size?: number\n\n /**\n * If specified this protocol codec will also be used to decode tuples with\n * these names from string multiaddrs.\n */\n aliases?: string[]\n\n /**\n * Where the multiaddr has been encoded as a string, decode the value if\n * necessary, unescaping any escaped values\n */\n stringToValue?(value: string): string\n\n /**\n * To encode the multiaddr as a string, escape any necessary values\n */\n valueToString?(value: string): string\n\n /**\n * To encode the multiaddr as bytes, convert the value to bytes\n */\n valueToBytes?(value: string): Uint8Array\n\n /**\n * To decode bytes to a multiaddr, convert the value bytes to a string\n */\n bytesToValue?(bytes: Uint8Array): string\n\n /**\n * Perform any necessary validation on the string value\n */\n validate?(value: string): void\n}\n\nclass Registry implements RegistryInterface {\n private protocolsByCode = new Map<number, ProtocolCodec>()\n private protocolsByName = new Map<string, ProtocolCodec>()\n\n getProtocol (key: string | number): ProtocolCodec {\n let codec: ProtocolCodec | undefined\n\n if (typeof key === 'string') {\n codec = this.protocolsByName.get(key)\n } else {\n codec = this.protocolsByCode.get(key)\n }\n\n if (codec == null) {\n throw new UnknownProtocolError(`Protocol ${key} was unknown`)\n }\n\n return codec\n }\n\n addProtocol (codec: ProtocolCodec): void {\n this.protocolsByCode.set(codec.code, codec)\n this.protocolsByName.set(codec.name, codec)\n\n codec.aliases?.forEach(alias => {\n this.protocolsByName.set(alias, codec)\n })\n }\n\n removeProtocol (code: number): void {\n const codec = this.protocolsByCode.get(code)\n\n if (codec == null) {\n return\n }\n\n this.protocolsByCode.delete(codec.code)\n this.protocolsByName.delete(codec.name)\n\n codec.aliases?.forEach(alias => {\n this.protocolsByName.delete(alias)\n })\n }\n}\n\nexport const registry = new Registry()\n\nconst codecs: ProtocolCodec[] = [{\n code: CODE_IP4,\n name: 'ip4',\n size: 32,\n valueToBytes: ip4ToBytes,\n bytesToValue: ip4ToString,\n validate: (value) => {\n if (!isIPv4(value)) {\n throw new ValidationError(`Invalid IPv4 address \"${value}\"`)\n }\n }\n}, {\n code: CODE_TCP,\n name: 'tcp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_UDP,\n name: 'udp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_DCCP,\n name: 'dccp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_IP6,\n name: 'ip6',\n size: 128,\n valueToBytes: ip6ToBytes,\n bytesToValue: ip6ToString,\n stringToValue: ip6StringToValue,\n validate: (value) => {\n if (!isIPv6(value)) {\n throw new ValidationError(`Invalid IPv6 address \"${value}\"`)\n }\n }\n}, {\n code: CODE_IP6ZONE,\n name: 'ip6zone',\n size: V\n}, {\n code: CODE_IPCIDR,\n name: 'ipcidr',\n size: 8,\n bytesToValue: bytesToString('base10'),\n valueToBytes: stringToBytes('base10')\n}, {\n code: CODE_DNS,\n name: 'dns',\n size: V\n}, {\n code: CODE_DNS4,\n name: 'dns4',\n size: V\n}, {\n code: CODE_DNS6,\n name: 'dns6',\n size: V\n}, {\n code: CODE_DNSADDR,\n name: 'dnsaddr',\n size: V\n}, {\n code: CODE_SCTP,\n name: 'sctp',\n size: 16,\n valueToBytes: port2bytes,\n bytesToValue: bytes2port,\n validate: validatePort\n}, {\n code: CODE_UDT,\n name: 'udt'\n}, {\n code: CODE_UTP,\n name: 'utp'\n}, {\n code: CODE_UNIX,\n name: 'unix',\n size: V,\n stringToValue: (str) => decodeURIComponent(str),\n valueToString: (val) => encodeURIComponent(val)\n}, {\n code: CODE_P2P,\n name: 'p2p',\n aliases: ['ipfs'],\n size: V,\n bytesToValue: bytesToString('base58btc'),\n valueToBytes: (val) => {\n if (val.startsWith('Q') || val.startsWith('1')) {\n return stringToBytes('base58btc')(val)\n }\n\n return CID.parse(val).multihash.bytes\n }\n}, {\n code: CODE_ONION,\n name: 'onion',\n size: 96,\n bytesToValue: bytes2onion,\n valueToBytes: onion2bytes\n}, {\n code: CODE_ONION3,\n name: 'onion3',\n size: 296,\n bytesToValue: bytes2onion,\n valueToBytes: onion32bytes\n}, {\n code: CODE_GARLIC64,\n name: 'garlic64',\n size: V\n}, {\n code: CODE_GARLIC32,\n name: 'garlic32',\n size: V\n}, {\n code: CODE_TLS,\n name: 'tls'\n}, {\n code: CODE_SNI,\n name: 'sni',\n size: V\n}, {\n code: CODE_NOISE,\n name: 'noise'\n}, {\n code: CODE_QUIC,\n name: 'quic'\n}, {\n code: CODE_QUIC_V1,\n name: 'quic-v1'\n}, {\n code: CODE_WEBTRANSPORT,\n name: 'webtransport'\n}, {\n code: CODE_CERTHASH,\n name: 'certhash',\n size: V,\n bytesToValue: bytes2mb(base64url),\n valueToBytes: mb2bytes\n}, {\n code: CODE_HTTP,\n name: 'http'\n}, {\n code: CODE_HTTP_PATH,\n name: 'http-path',\n size: V,\n stringToValue: (str) => `/${decodeURIComponent(str)}`,\n valueToString: (val) => encodeURIComponent(val.substring(1))\n}, {\n code: CODE_HTTPS,\n name: 'https'\n}, {\n code: CODE_WS,\n name: 'ws'\n}, {\n code: CODE_WSS,\n name: 'wss'\n}, {\n code: CODE_P2P_WEBSOCKET_STAR,\n name: 'p2p-websocket-star'\n}, {\n code: CODE_P2P_STARDUST,\n name: 'p2p-stardust'\n}, {\n code: CODE_P2P_WEBRTC_STAR,\n name: 'p2p-webrtc-star'\n}, {\n code: CODE_P2P_WEBRTC_DIRECT,\n name: 'p2p-webrtc-direct'\n}, {\n code: CODE_WEBRTC_DIRECT,\n name: 'webrtc-direct'\n}, {\n code: CODE_WEBRTC,\n name: 'webrtc'\n}, {\n code: CODE_P2P_CIRCUIT,\n name: 'p2p-circuit'\n}, {\n code: CODE_MEMORY,\n name: 'memory',\n size: V\n}]\n\ncodecs.forEach(codec => {\n registry.addProtocol(codec)\n})\n","import * as varint from 'uint8-varint'\nimport { concat as uint8ArrayConcat } from 'uint8arrays/concat'\nimport { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'\nimport { toString as uint8ArrayToString } from 'uint8arrays/to-string'\nimport { InvalidMultiaddrError } from './errors.ts'\nimport { registry, V } from './registry.ts'\nimport type { Component } from './index.js'\nimport type { ProtocolCodec } from './registry.ts'\n\nexport function bytesToComponents (bytes: Uint8Array): Component[] {\n const components: Component[] = []\n\n let i = 0\n while (i < bytes.length) {\n const code = varint.decode(bytes, i)\n const codec = registry.getProtocol(code)\n const codeLength = varint.encodingLength(code)\n const size = sizeForAddr(codec, bytes, i + codeLength)\n let sizeLength = 0\n\n if (size > 0 && codec.size === V) {\n sizeLength = varint.encodingLength(size)\n }\n\n const componentLength = codeLength + sizeLength + size\n\n const component: Component = {\n code,\n name: codec.name,\n bytes: bytes.subarray(i, i + componentLength)\n }\n\n if (size > 0) {\n const valueOffset = i + codeLength + sizeLength\n const valueBytes = bytes.subarray(valueOffset, valueOffset + size)\n\n component.value = codec.bytesToValue?.(valueBytes) ?? uint8ArrayToString(valueBytes)\n }\n\n components.push(component)\n\n i += componentLength\n }\n\n return components\n}\n\nexport function componentsToBytes (components: Component[]): Uint8Array {\n let length = 0\n const bytes: Uint8Array[] = []\n\n for (const component of components) {\n if (component.bytes == null) {\n const codec = registry.getProtocol(component.code)\n const codecLength = varint.encodingLength(component.code)\n let valueBytes: Uint8Array | undefined\n let valueLength = 0\n let valueLengthLength = 0\n\n if (component.value != null) {\n valueBytes = codec.valueToBytes?.(component.value) ?? uint8ArrayFromString(component.value)\n valueLength = valueBytes.byteLength\n\n if (codec.size === V) {\n valueLengthLength = varint.encodingLength(valueLength)\n }\n }\n\n const bytes = new Uint8Array(codecLength + valueLengthLength + valueLength)\n\n // encode the protocol code\n let offset = 0\n varint.encodeUint8Array(component.code, bytes, offset)\n offset += codecLength\n\n // if there is a value\n if (valueBytes != null) {\n // if the value has variable length, encode the length\n if (codec.size === V) {\n varint.encodeUint8Array(valueLength, bytes, offset)\n offset += valueLengthLength\n }\n\n // finally encode the value\n bytes.set(valueBytes, offset)\n }\n\n component.bytes = bytes\n }\n\n bytes.push(component.bytes)\n length += component.bytes.byteLength\n }\n\n return uint8ArrayConcat(bytes, length)\n}\n\nexport function stringToComponents (string: string): Component[] {\n if (string.charAt(0) !== '/') {\n throw new InvalidMultiaddrError('String multiaddr must start with \"/\"')\n }\n\n const components: Component[] = []\n let collecting: 'protocol' | 'value' = 'protocol'\n let value = ''\n let protocol = ''\n\n for (let i = 1; i < string.length; i++) {\n const char = string.charAt(i)\n\n if (char !== '/') {\n if (collecting === 'protocol') {\n protocol += string.charAt(i)\n } else {\n value += string.charAt(i)\n }\n }\n\n const ended = i === string.length - 1\n\n if (char === '/' || ended) {\n const codec = registry.getProtocol(protocol)\n\n if (collecting === 'protocol') {\n if (codec.size == null || codec.size === 0) {\n // a protocol without an address, eg. `/tls`\n components.push({\n code: codec.code,\n name: codec.name\n })\n\n value = ''\n protocol = ''\n collecting = 'protocol'\n\n continue\n } else if (ended) {\n throw new InvalidMultiaddrError(`Component ${protocol} was missing value`)\n }\n\n // continue collecting value\n collecting = 'value'\n } else if (collecting === 'value') {\n const component: Component = {\n code: codec.code,\n name: codec.name\n }\n\n if (codec.size != null && codec.size !== 0) {\n if (value === '') {\n throw new InvalidMultiaddrError(`Component ${protocol} was missing value`)\n }\n\n component.value = codec.stringToValue?.(value) ?? value\n }\n\n components.push(component)\n\n value = ''\n protocol = ''\n collecting = 'protocol'\n }\n }\n }\n\n if (protocol !== '' && value !== '') {\n throw new InvalidMultiaddrError('Incomplete multiaddr')\n }\n\n return components\n}\n\nexport function componentsToString (components: Component[]): string {\n return `/${components.flatMap(component => {\n if (component.value == null) {\n return component.name\n }\n\n const codec = registry.getProtocol(component.code)\n\n if (codec == null) {\n throw new InvalidMultiaddrError(`Unknown protocol code ${component.code}`)\n }\n\n return [\n component.name,\n codec.valueToString?.(component.value) ?? component.value\n ]\n }).join('/')}`\n}\n\n/**\n * For the passed address, return the serialized size\n */\nfunction sizeForAddr (codec: ProtocolCodec, bytes: Uint8Array, offset: number): number {\n if (codec.size == null || codec.size === 0) {\n return 0\n }\n\n if (codec.size > 0) {\n return codec.size / 8\n }\n\n return varint.decode(bytes, offset)\n}\n","import { equals as uint8ArrayEquals } from 'uint8arrays/equals'\nimport { bytesToComponents, componentsToBytes, componentsToString, stringToComponents } from './components.js'\nimport { InvalidMultiaddrError, InvalidParametersError } from './errors.ts'\nimport { registry } from './registry.ts'\nimport { isMultiaddr } from './index.js'\nimport type { MultiaddrInput, Multiaddr as MultiaddrInterface, Component } from './index.js'\n\nconst inspect = Symbol.for('nodejs.util.inspect.custom')\nexport const symbol = Symbol.for('@multiformats/multiaddr')\n\nfunction toComponents (addr: MultiaddrInput): Component[] {\n if (addr == null) {\n addr = '/'\n }\n\n if (isMultiaddr(addr)) {\n return addr.getComponents()\n }\n\n if (addr instanceof Uint8Array) {\n return bytesToComponents(addr)\n }\n\n if (typeof addr === 'string') {\n addr = addr\n .replace(/\\/(\\/)+/, '/')\n .replace(/(\\/)+$/, '')\n\n if (addr === '') {\n addr = '/'\n }\n\n return stringToComponents(addr)\n }\n\n if (Array.isArray(addr)) {\n return addr\n }\n\n throw new InvalidMultiaddrError('Must be a string, Uint8Array, Component[], or another Multiaddr')\n}\n\ninterface MultiaddrOptions {\n validate?: boolean\n}\n\n/**\n * Creates a {@link Multiaddr} from a {@link MultiaddrInput}\n */\nexport class Multiaddr implements MultiaddrInterface {\n [symbol]: boolean = true\n readonly #components: Component[]\n\n // cache string representation\n #string: string | undefined\n // cache byte representation\n #bytes: Uint8Array | undefined\n\n constructor (addr: MultiaddrInput | Component[] = '/', options: MultiaddrOptions = {}) {\n this.#components = toComponents(addr)\n\n if (options.validate !== false) {\n validate(this)\n }\n }\n\n get bytes (): Uint8Array {\n if (this.#bytes == null) {\n this.#bytes = componentsToBytes(this.#components)\n }\n\n return this.#bytes\n }\n\n toString (): string {\n if (this.#string == null) {\n this.#string = componentsToString(this.#components)\n }\n\n return this.#string\n }\n\n toJSON (): string {\n return this.toString()\n }\n\n getComponents (): Component[] {\n return [\n ...this.#components.map(c => ({ ...c }))\n ]\n }\n\n encapsulate (addr: MultiaddrInput): MultiaddrInterface {\n const ma = new Multiaddr(addr)\n\n return new Multiaddr([\n ...this.#components,\n ...ma.getComponents()\n ], {\n validate: false\n })\n }\n\n decapsulate (addr: Multiaddr | string): MultiaddrInterface {\n const addrString = addr.toString()\n const s = this.toString()\n const i = s.lastIndexOf(addrString)\n\n if (i < 0) {\n throw new InvalidParametersError(`Address ${this.toString()} does not contain subaddress: ${addrString}`)\n }\n\n return new Multiaddr(s.slice(0, i), {\n validate: false\n })\n }\n\n decapsulateCode (code: number): Multiaddr {\n let index\n\n for (let i = this.#components.length - 1; i > -1; i--) {\n if (this.#components[i].code === code) {\n index = i\n break\n }\n }\n\n return new Multiaddr(this.#components.slice(0, index), {\n validate: false\n })\n }\n\n equals (addr: { bytes: Uint8Array }): boolean {\n return uint8ArrayEquals(this.bytes, addr.bytes)\n }\n\n /**\n * Returns Multiaddr as a human-readable string\n * https://nodejs.org/api/util.html#utilinspectcustom\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * console.info(multiaddr('/ip4/127.0.0.1/tcp/4001'))\n * // 'Multiaddr(/ip4/127.0.0.1/tcp/4001)'\n * ```\n */\n [inspect] (): string {\n return `Multiaddr(${this.toString()})`\n }\n}\n\n/**\n * Ensures all multiaddr tuples are correct. Throws if any invalid protocols or\n * values are encountered.\n */\nexport function validate (addr: Multiaddr): void {\n addr.getComponents()\n .forEach(component => {\n const codec = registry.getProtocol(component.code)\n\n if (component.value == null) {\n return\n }\n\n codec.validate?.(component.value)\n })\n}\n","/**\n * @packageDocumentation\n *\n * A standard way to represent addresses that\n *\n * - support any standard network protocol\n * - have a binary packed format\n * - have a nice string representation\n * - encapsulate well\n *\n * @example\n *\n * ```TypeScript\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const addr = multiaddr('/ip4/127.0.0.1/udp/1234')\n * // Multiaddr(/ip4/127.0.0.1/udp/1234)\n *\n * addr.bytes\n * // <Uint8Array 04 7f 00 00 01 11 04 d2>\n *\n * addr.toString()\n * // '/ip4/127.0.0.1/udp/1234'\n *\n * addr.getComponents()\n * // [\n * // { code: 4, name: 'ip4', value: '127.0.0.1' },\n * // { code: 273, name: 'udp', value: '1234' }\n * // ]\n *\n * addr.encapsulate('/sctp/5678')\n * // Multiaddr(/ip4/127.0.0.1/udp/1234/sctp/5678)\n * ```\n *\n * @example Adding custom protocols\n *\n * To add application-specific or experimental protocols, add a protocol codec\n * to the protocol registry:\n *\n * ```ts\n * import { registry, V, multiaddr } from '@multiformats/multiaddr'\n * import type { ProtocolCodec } from '@multiformats/multiaddr'\n *\n * const maWithCustomTuple = '/custom-protocol/hello'\n *\n * // throws UnknownProtocolError\n * multiaddr(maWithCustomTuple)\n *\n * const protocol: ProtocolCodec = {\n * code: 2059,\n * name: 'custom-protocol',\n * size: V\n * // V means variable length, can also be 0, a positive integer (e.g. a fixed\n * // length or omitted\n * }\n *\n * registry.addProtocol(protocol)\n *\n * // does not throw UnknownProtocolError\n * multiaddr(maWithCustomTuple)\n *\n * // protocols can also be removed\n * registry.removeProtocol(protocol.code)\n * ```\n */\n\nimport { Multiaddr as MultiaddrClass, symbol } from './multiaddr.js'\nimport { registry, V } from './registry.ts'\nimport type { ProtocolCodec } from './registry.ts'\n\n/**\n * The protocol registry stores protocol codecs that allow transformation of\n * multiaddr tuples from bytes to string and back again, and also validation of\n * the address values.\n */\nexport interface Registry {\n /**\n * Retrieve a protocol definition by it's code or name\n */\n getProtocol (key: string | number): ProtocolCodec\n\n /**\n * Add a new protocol definition\n */\n addProtocol (codec: ProtocolCodec): void\n\n /**\n * Remove a protocol definition by it's code\n */\n removeProtocol (code: number): void\n}\n\n/**\n * These types can be parsed into a {@link Multiaddr} object\n */\nexport type MultiaddrInput = string | Multiaddr | Uint8Array | null | Component[]\n\n/**\n * A Component is a section of a multiaddr with a name/code, possibly with a\n * value.\n *\n * Component names/codes are defined in the protocol table.\n *\n * @see https://github.com/multiformats/multiaddr/blob/master/protocols.csv\n */\nexport interface Component {\n /**\n * The code of the component as defined in the protocol table\n */\n code: number\n\n /**\n * The name of the component as defined in the protocol table\n */\n name: string\n\n /**\n * The component value, if one is present\n */\n value?: string\n\n /**\n * The bytes that make up the component. This will be set if the multiaddr\n * was parsed from a `Uint8Array`, or if `.bytes` has been accessed on it.\n */\n bytes?: Uint8Array\n}\n\nexport interface Multiaddr {\n bytes: Uint8Array\n\n /**\n * Returns Multiaddr as a String\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/4001').toString()\n * // '/ip4/127.0.0.1/tcp/4001'\n * ```\n */\n toString(): string\n\n /**\n * Returns Multiaddr as a JSON encoded object\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * JSON.stringify(multiaddr('/ip4/127.0.0.1/tcp/4001'))\n * // '/ip4/127.0.0.1/tcp/4001'\n * ```\n */\n toJSON(): string\n\n /**\n * Returns the components that make up this Multiaddr\n *\n * @example\n * ```ts\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/4001').getComponents()\n * // [{ name: 'ip4', code: 4, value: '127.0.0.1' }, { name: 'tcp', code: 6, value: '4001' }]\n * ```\n */\n getComponents(): Component[]\n\n /**\n * Encapsulates a Multiaddr in another Multiaddr\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const mh1 = multiaddr('/ip4/8.8.8.8/tcp/1080')\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080)\n *\n * const mh2 = multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n *\n * const mh3 = mh1.encapsulate(mh2)\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080/ip4/127.0.0.1/tcp/4001)\n *\n * mh3.toString()\n * // '/ip4/8.8.8.8/tcp/1080/ip4/127.0.0.1/tcp/4001'\n * ```\n *\n * @param {MultiaddrInput} addr - Multiaddr to add into this Multiaddr\n */\n encapsulate(addr: MultiaddrInput): Multiaddr\n\n /**\n * Decapsulates a Multiaddr from another Multiaddr\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const mh1 = multiaddr('/ip4/8.8.8.8/tcp/1080')\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080)\n *\n * const mh2 = multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n *\n * const mh3 = mh1.encapsulate(mh2)\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080/ip4/127.0.0.1/tcp/4001)\n *\n * mh3.decapsulate(mh2).toString()\n * // '/ip4/8.8.8.8/tcp/1080'\n * ```\n *\n * @param {Multiaddr | string} addr - Multiaddr to remove from this Multiaddr\n */\n decapsulate(addr: Multiaddr | string): Multiaddr\n\n /**\n * A more reliable version of `decapsulate` if you are targeting a specific\n * code, such as 421 (the `p2p` protocol code). The last index of the code\n * will be removed from the `Multiaddr`, and a new instance will be returned.\n * If the code is not present, the original `Multiaddr` is returned.\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const addr = multiaddr('/ip4/0.0.0.0/tcp/8080/p2p/QmcgpsyWgH8Y8ajJz1Cu72KnS5uo2Aa2LpzU7kinSupNKC')\n * // Multiaddr(/ip4/0.0.0.0/tcp/8080/p2p/QmcgpsyWgH8Y8ajJz1Cu72KnS5uo2Aa2LpzU7kinSupNKC)\n *\n * addr.decapsulateCode(421).toString()\n * // '/ip4/0.0.0.0/tcp/8080'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/8080').decapsulateCode(421).toString()\n * // '/ip4/127.0.0.1/tcp/8080'\n * ```\n */\n decapsulateCode(code: number): Multiaddr\n\n /**\n * Checks if two Multiaddrs are the same\n *\n * @example\n * ```js\n * import { multiaddr } from '@multiformats/multiaddr'\n *\n * const mh1 = multiaddr('/ip4/8.8.8.8/tcp/1080')\n * // Multiaddr(/ip4/8.8.8.8/tcp/1080)\n *\n * const mh2 = multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n *\n * mh1.equals(mh1)\n * // true\n *\n * mh1.equals(mh2)\n * // false\n * ```\n */\n equals(addr: { bytes: Uint8Array }): boolean\n}\n\n/**\n * Check if object is a {@link Multiaddr} instance\n *\n * @example\n *\n * ```js\n * import { isMultiaddr, multiaddr } from '@multiformats/multiaddr'\n *\n * isMultiaddr(5)\n * // false\n * isMultiaddr(multiaddr('/ip4/127.0.0.1'))\n * // true\n * ```\n */\nexport function isMultiaddr (value: any): value is Multiaddr {\n return Boolean(value?.[symbol])\n}\n\n/**\n * A function that takes a {@link MultiaddrInput} and returns a {@link Multiaddr}\n *\n * @example\n * ```js\n * import { multiaddr } from '@libp2p/multiaddr'\n *\n * multiaddr('/ip4/127.0.0.1/tcp/4001')\n * // Multiaddr(/ip4/127.0.0.1/tcp/4001)\n * ```\n *\n * @param {MultiaddrInput} [addr] - If String or Uint8Array, needs to adhere to the address format of a [multiaddr](https://github.com/multiformats/multiaddr#string-format)\n */\nexport function multiaddr (addr?: MultiaddrInput): Multiaddr {\n return new MultiaddrClass(addr)\n}\n\n/**\n * Export all table.csv codes. These are all named exports so can be tree-shaken\n * out by bundlers.\n */\nexport * from './constants.ts'\nexport { registry, V }\nexport type { ProtocolCodec }\n","/**\n * @packageDocumentation\n *\n * This module allows easy conversion of Multiaddrs to string URIs.\n *\n * @example Converting multiaddrs to string URIs\n *\n * ```js\n * import { multiaddrToUri } from '@multiformats/multiaddr-to-uri'\n *\n * console.log(multiaddrToUri('/dnsaddr/protocol.ai/https'))\n * // -> https://protocol.ai\n *\n * console.log(multiaddrToUri('/ip4/127.0.0.1/tcp/8080'))\n * // -> http://127.0.0.1:8080\n *\n * console.log(multiaddrToUri('/ip4/127.0.0.1/tcp/8080', { assumeHttp: false }))\n * // -> tcp://127.0.0.1:8080\n * ```\n *\n * Note:\n *\n * - When `/tcp` is the last (terminating) protocol HTTP is assumed by default (implicit `assumeHttp: true`)\n * - this means produced URIs will start with `http://` instead of `tcp://`\n * - passing `{ assumeHttp: false }` disables this behavior\n * - Might be lossy - e.g. a DNSv6 multiaddr\n * - Can throw if the passed multiaddr:\n * - is not a valid multiaddr\n * - is not supported as a URI e.g. circuit\n */\n\nimport { CODE_TCP, CODE_DNS, CODE_DNS4, CODE_DNS6, CODE_DNSADDR, multiaddr, CODE_TLS, CODE_IP6 } from '@multiformats/multiaddr'\nimport type { Component, Multiaddr } from '@multiformats/multiaddr'\n\nexport interface MultiaddrToUriOpts {\n assumeHttp?: boolean\n}\n\nconst ASSUME_HTTP_CODES = [\n CODE_TCP,\n CODE_DNS,\n CODE_DNSADDR,\n CODE_DNS4,\n CODE_DNS6\n]\n\ninterface Interpreter {\n (head: Component, rest: Component[]): string | undefined\n}\n\nfunction extractSNI (ma: Component[]): string | undefined {\n return extractTuple('sni', ma)?.value\n}\n\nfunction extractPort (ma: Component[]): string {\n const port = extractTuple('tcp', ma)?.value\n\n if (port == null) {\n return ''\n }\n\n return `:${port}`\n}\n\nfunction extractTuple (name: string, ma: Component[]): Component | undefined {\n return ma.find(component => component.name === name)\n}\n\nfunction hasTLS (ma: Component[]): boolean {\n return ma.some(({ code }) => code === CODE_TLS)\n}\n\nfunction interpretNext (head: Component, rest: Component[]): string | undefined {\n const interpreter = interpreters[head.name]\n if (interpreter == null) {\n throw new Error(`Can't interpret protocol ${head.name}`)\n }\n const restVal = interpreter(head, rest)\n if (head.code === CODE_IP6) {\n return `[${restVal}]`\n }\n return restVal\n}\n\nconst interpreters: Record<string, Interpreter> = {\n ip4: (head, rest) => head.value,\n ip6: (head, rest) => {\n if (rest.length === 0) {\n return head.value\n }\n return `[${head.value}]`\n },\n tcp: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `tcp://${interpretNext(tail, rest)}:${head.value}`\n },\n udp: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `udp://${interpretNext(tail, rest)}:${head.value}`\n },\n dnsaddr: (head, rest) => head.value,\n dns4: (head, rest) => head.value,\n dns6: (head, rest) => head.value,\n dns: (head, rest) => head.value,\n ipfs: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `${interpretNext(tail, rest)}`\n },\n p2p: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return `${interpretNext(tail, rest)}`\n },\n http: (head, rest) => {\n const maHasTLS = hasTLS(rest)\n const sni = extractSNI(rest)\n const port = extractPort(rest)\n if (maHasTLS && sni != null) {\n return `https://${sni}${port}`\n }\n const protocol = maHasTLS ? 'https://' : 'http://'\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base as http, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `${protocol}${baseVal}`\n },\n 'http-path': (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n const baseVal = interpretNext(tail, rest)\n const decodedValue = decodeURIComponent(head.value ?? '')\n return `${baseVal}${decodedValue}`\n },\n tls: (head, rest) => {\n // Noop, the parent context knows that it's tls. We don't need to do\n // anything here\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return interpretNext(tail, rest)\n },\n sni: (head, rest) => {\n // Noop, the parent context uses the sni information, we don't need to do\n // anything here\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n return interpretNext(tail, rest)\n },\n https: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base as http, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `https://${baseVal}`\n },\n ws: (head, rest) => {\n const maHasTLS = hasTLS(rest)\n const sni = extractSNI(rest)\n const port = extractPort(rest)\n if (maHasTLS && sni != null) {\n return `wss://${sni}${port}`\n }\n const protocol = maHasTLS ? 'wss://' : 'ws://'\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `${protocol}${baseVal}`\n },\n wss: (head, rest) => {\n const tail = rest.pop()\n if (tail == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n let baseVal = interpretNext(tail, rest)\n // We are reinterpreting the base as http, so we need to remove the tcp:// if it's there\n baseVal = baseVal?.replace('tcp://', '')\n return `wss://${baseVal}`\n }\n}\n\nexport function multiaddrToUri (input: Multiaddr | string | Uint8Array, opts?: MultiaddrToUriOpts): string {\n const ma = multiaddr(input)\n const components = ma.getComponents()\n const head = components.pop()\n if (head == null) {\n throw new Error('Unexpected end of multiaddr')\n }\n\n const interpreter = interpreters[head.name]\n\n if (interpreter == null) {\n throw new Error(`No interpreter found for ${head.name}`)\n }\n\n let uri = interpreter(head, components) ?? ''\n\n if (opts?.assumeHttp !== false && ASSUME_HTTP_CODES.includes(head.code)) {\n // strip any declared protocol\n uri = uri.replace(/^.*:\\/\\//, '')\n\n if (head.value === '443') {\n uri = `https://${uri}`\n } else {\n uri = `http://${uri}`\n }\n }\n\n if (uri.startsWith('http://') || uri.startsWith('https://') || uri.startsWith('ws://') || uri.startsWith('wss://')) {\n // this will strip default ports while keeping paths intact\n uri = new URL(uri).toString()\n\n // strip trailing slash, e.g. http://127.0.0.1/ -> http://127.0.0.1\n if (uri.endsWith('/')) {\n uri = uri.substring(0, uri.length - 1)\n }\n }\n\n return uri\n}\n","const word = '[a-fA-F\\\\d:]';\n\nconst boundry = options => options && options.includeBoundaries\n\t? `(?:(?<=\\\\s|^)(?=${word})|(?<=${word})(?=\\\\s|$))`\n\t: '';\n\nconst v4 = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]\\\\d|\\\\d)(?:\\\\.(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]\\\\d|\\\\d)){3}';\n\nconst v6segment = '[a-fA-F\\\\d]{1,4}';\n\nconst v6 = `\n(?:\n(?:${v6segment}:){7}(?:${v6segment}|:)| // 1:2:3:4:5:6:7:: 1:2:3:4:5:6:7:8\n(?:${v6segment}:){6}(?:${v4}|:${v6segment}|:)| // 1:2:3:4:5:6:: 1:2:3:4:5:6::8 1:2:3:4:5:6::8 1:2:3:4:5:6::1.2.3.4\n(?:${v6segment}:){5}(?::${v4}|(?::${v6segment}){1,2}|:)| // 1:2:3:4:5:: 1:2:3:4:5::7:8 1:2:3:4:5::8 1:2:3:4:5::7:1.2.3.4\n(?:${v6segment}:){4}(?:(?::${v6segment}){0,1}:${v4}|(?::${v6segment}){1,3}|:)| // 1:2:3:4:: 1:2:3:4::6:7:8 1:2:3:4::8 1:2:3:4::6:7:1.2.3.4\n(?:${v6segment}:){3}(?:(?::${v6segment}){0,2}:${v4}|(?::${v6segment}){1,4}|:)| // 1:2:3:: 1:2:3::5:6:7:8 1:2:3::8 1:2:3::5:6:7:1.2.3.4\n(?:${v6segment}:){2}(?:(?::${v6segment}){0,3}:${v4}|(?::${v6segment}){1,5}|:)| // 1:2:: 1:2::4:5:6:7:8 1:2::8 1:2::4:5:6:7:1.2.3.4\n(?:${v6segment}:){1}(?:(?::${v6segment}){0,4}:${v4}|(?::${v6segment}){1,6}|:)| // 1:: 1::3:4:5:6:7:8 1::8 1::3:4:5:6:7:1.2.3.4\n(?::(?:(?::${v6segment}){0,5}:${v4}|(?::${v6segment}){1,7}|:)) // ::2:3:4:5:6:7:8 ::2:3:4:5:6:7:8 ::8 ::1.2.3.4\n)(?:%[0-9a-zA-Z]{1,})? // %eth0 %1\n`.replace(/\\s*\\/\\/.*$/gm, '').replace(/\\n/g, '').trim();\n\n// Pre-compile only the exact regexes because adding a global flag make regexes stateful\nconst v46Exact = new RegExp(`(?:^${v4}$)|(?:^${v6}$)`);\nconst v4exact = new RegExp(`^${v4}$`);\nconst v6exact = new RegExp(`^${v6}$`);\n\nconst ipRegex = options => options && options.exact\n\t? v46Exact\n\t: new RegExp(`(?:${boundry(options)}${v4}${boundry(options)})|(?:${boundry(options)}${v6}${boundry(options)})`, 'g');\n\nipRegex.v4 = options => options && options.exact ? v4exact : new RegExp(`${boundry(options)}${v4}${boundry(options)}`, 'g');\nipRegex.v6 = options => options && options.exact ? v6exact : new RegExp(`${boundry(options)}${v6}${boundry(options)}`, 'g');\n\nexport default ipRegex;\n","import vm from 'node:vm';\n\nexport default function functionTimeout(function_, {timeout} = {}) {\n\tconst script = new vm.Script('returnValue = function_()');\n\n\tconst wrappedFunction = (...arguments_) => {\n\t\tconst context = {\n\t\t\tfunction_: () => function_(...arguments_),\n\t\t};\n\n\t\tscript.runInNewContext(context, {timeout});\n\n\t\treturn context.returnValue;\n\t};\n\n\tObject.defineProperty(wrappedFunction, 'name', {\n\t\tvalue: `functionTimeout(${function_.name || '<anonymous>'})`,\n\t\tconfigurable: true,\n\t});\n\n\treturn wrappedFunction;\n}\n\nexport function isTimeoutError(error) {\n\treturn error?.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT';\n}\n","const {toString} = Object.prototype;\n\nexport default function isRegexp(value) {\n\treturn toString.call(value) === '[object RegExp]';\n}\n","import isRegexp from 'is-regexp';\n\nconst flagMap = {\n\tglobal: 'g',\n\tignoreCase: 'i',\n\tmultiline: 'm',\n\tdotAll: 's',\n\tsticky: 'y',\n\tunicode: 'u'\n};\n\nexport default function clonedRegexp(regexp, options = {}) {\n\tif (!isRegexp(regexp)) {\n\t\tthrow new TypeError('Expected a RegExp instance');\n\t}\n\n\tconst flags = Object.keys(flagMap).map(flag => (\n\t\t(typeof options[flag] === 'boolean' ? options[flag] : regexp[flag]) ? flagMap[flag] : ''\n\t)).join('');\n\n\tconst clonedRegexp = new RegExp(options.source || regexp.source, flags);\n\n\tclonedRegexp.lastIndex = typeof options.lastIndex === 'number' ?\n\t\toptions.lastIndex :\n\t\tregexp.lastIndex;\n\n\treturn clonedRegexp;\n}\n","import functionTimeout, {isTimeoutError} from 'function-timeout';\nimport timeSpan from 'time-span';\nimport cloneRegexp from 'clone-regexp'; // TODO: Use `structuredClone` instead when targeting Node.js 18.\n\nconst resultToMatch = result => ({\n\tmatch: result[0],\n\tindex: result.index,\n\tgroups: result.slice(1),\n\tnamedGroups: result.groups ?? {},\n\tinput: result.input,\n});\n\nexport function isMatch(regex, string, {timeout} = {}) {\n\ttry {\n\t\treturn functionTimeout(() => cloneRegexp(regex).test(string), {timeout})();\n\t} catch (error) {\n\t\tif (isTimeoutError(error)) {\n\t\t\treturn false;\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n\nexport function firstMatch(regex, string, {timeout} = {}) {\n\ttry {\n\t\tconst result = functionTimeout(() => cloneRegexp(regex).exec(string), {timeout})();\n\n\t\tif (result === null) {\n\t\t\treturn;\n\t\t}\n\n\t\treturn resultToMatch(result);\n\t} catch (error) {\n\t\tif (isTimeoutError(error)) {\n\t\t\treturn;\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n\nexport function matches(regex, string, {timeout = Number.POSITIVE_INFINITY, matchTimeout = Number.POSITIVE_INFINITY} = {}) {\n\tif (!regex.global) {\n\t\tthrow new Error('The regex must have the global flag, otherwise, use `firstMatch()` instead');\n\t}\n\n\treturn {\n\t\t* [Symbol.iterator]() {\n\t\t\ttry {\n\t\t\t\tconst matches = string.matchAll(regex); // The regex is only executed when iterated over.\n\n\t\t\t\twhile (true) {\n\t\t\t\t\tconst nextMatch = functionTimeout(() => matches.next(), {timeout: (timeout !== Number.POSITIVE_INFINITY || matchTimeout !== Number.POSITIVE_INFINITY) ? Math.min(timeout, matchTimeout) : undefined}); // `matches.next` must be called within an arrow function so that it doesn't loose its context.\n\n\t\t\t\t\tconst end = timeSpan();\n\t\t\t\t\tconst {value, done} = nextMatch();\n\t\t\t\t\ttimeout -= Math.ceil(end());\n\n\t\t\t\t\tif (done) {\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tyield resultToMatch(value);\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tif (!isTimeoutError(error)) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t};\n}\n","import ipRegex from 'ip-regex';\nimport {isMatch} from 'super-regex';\n\nconst maxIPv4Length = 15;\nconst maxIPv6Length = 45;\n\nconst options = {\n\ttimeout: 400,\n};\n\nexport function isIP(string) {\n\tif (string.length > maxIPv6Length) {\n\t\treturn false;\n\t}\n\n\treturn isMatch(ipRegex({exact: true}), string, options);\n}\n\nexport function isIPv6(string) {\n\tif (string.length > maxIPv6Length) {\n\t\treturn false;\n\t}\n\n\treturn isMatch(ipRegex.v6({exact: true}), string, options);\n}\n\nexport function isIPv4(string) {\n\tif (string.length > maxIPv4Length) {\n\t\treturn false;\n\t}\n\n\treturn isMatch(ipRegex.v4({exact: true}), string, options);\n}\n\nexport function ipVersion(string) {\n\tif (isIPv6(string)) {\n\t\treturn 6;\n\t}\n\n\tif (isIPv4(string)) {\n\t\treturn 4;\n\t}\n}\n","/**\n * @packageDocumentation\n *\n * ```typescript\n * import { uriToMultiaddr } from '@multiformats/uri-to-multiaddr'\n *\n * console.log(uriToMultiaddr('https://protocol.ai'))\n * // -> /dns4/protocol.ai/tcp/443/https\n * ```\n *\n * Domain names can represent one of\n *\n * - `/dns4` - domain resolves to an ipv4 address (**default**)\n * - `/dns6` - domain resolves to an ipv6 address\n * - `/dnsaddr` - domain has a [DNSLink](https://docs.ipfs.io/guides/concepts/dnslink/) TXT record pointing to an IPFS CID\n *\n * This library assumes `/dns4` when it finds a domain name in the input string.\n * It makes no attempt query DNS. To override the default assumption, you can pass\n * in an options object as the second parameter to override it:\n *\n * ```typescript\n * import { uriToMultiaddr } from '@multiformats/uri-to-multiaddr'\n *\n * console.log(uriToMultiaddr('https://protocol.ai'), { defaultDnsType: 'dns6' })\n * // -> /dns6/protocol.ai/tcp/443/https\n * ```\n *\n * See [test.js](./test.js) for the currently supported conversions.\n *\n * **Note**: `uri-to-multiaddr` will throw if the passed URI:\n *\n * - is not a valid, according the WHATWG URL spec implementation used.\n * - is not supported yet\n *\n * ## Related\n *\n * - [@multiformats/multiaddr-to-uri](https://github.com/multiformats/js-multiaddr-to-uri) - convert it back again\n */\n\nimport { multiaddr } from '@multiformats/multiaddr'\nimport { isIPv4, isIPv6 } from 'is-ip'\nimport type { Multiaddr } from '@multiformats/multiaddr'\n\nconst portFor: Record<string, string> = {\n http: '80',\n https: '443',\n ws: '80',\n wss: '443'\n}\n\nconst BROWSER_SCHEMES = ['http', 'https', 'ws', 'wss']\n\nexport interface MultiaddrFromUriOpts {\n /**\n * If a URI contains a domain name, by default the `/dns/` tuple will be used\n * to define it. If you wish to use `/dnsaddr` or something more specific like\n * `/dns4` or `/dns6`, pass it as an option here.\n *\n * @default 'dns'\n */\n defaultDnsType?: 'dns' | 'dns4' | 'dns6' | 'dnsaddr'\n}\n\n/**\n * Convert a URI to a multiaddr\n *\n * http://foobar.com => /dns/foobar.com/tcp/80/http\n * https://foobar.com => /dns/foobar.com/tcp/443/https\n * https://foobar.com:5001 => /dns/foobar.com/tcp/5001/https\n * https://127.0.0.1:8080 => /ip4/127.0.0.1/tcp/8080/https\n * http://[::1]:8080 => /ip6/::1/tcp/8080/http\n * tcp://foobar.com:8080 => /dns/foobar.com/tcp/8080\n * udp://foobar.com:8080 => /dns/foobar.com/udp/8080\n */\n\nexport function uriToMultiaddr (uriStr: string, opts?: MultiaddrFromUriOpts): Multiaddr {\n opts = opts ?? {}\n const defaultDnsType = opts.defaultDnsType ?? 'dns'\n const { scheme, hostname, port, path } = parseUri(uriStr)\n const parts = [\n tupleForHostname(hostname, defaultDnsType),\n tupleForPort(port, scheme),\n tupleForScheme(scheme)\n ]\n\n if (path != null) {\n parts.push(tupleForPath(path))\n }\n\n const multiaddrStr = '/' + parts\n .filter(x => Boolean(x))\n // @ts-expect-error ts cannot see we filter falsy values\n .reduce((a, b) => a.concat(b), [])\n .join('/')\n\n return multiaddr(multiaddrStr)\n}\n\nfunction parseUri (uriStr: string): { scheme: string, hostname: string, port: string, path?: string } {\n const [scheme] = uriStr.split(':')\n\n // browsers will only parse URLs with schemes they understand\n if (!BROWSER_SCHEMES.includes(scheme)) {\n uriStr = 'http' + uriStr.substring(scheme.length)\n }\n\n // Use the WHATWG URL global, in node >= 10 and the browser\n let { protocol, hostname, port, pathname, search } = new URL(uriStr)\n\n if (port == null || port === '') {\n const protocolPort = portForProtocol(scheme)\n\n if (protocolPort != null) {\n port = protocolPort\n }\n\n // browsers will omit the port when it's common\n if (protocolPort == null && protocol === 'http:') {\n // we overrode the protocol with http, set the port to 80\n port = '80'\n }\n }\n\n let path: string | undefined\n\n if (pathname != null && pathname !== '' && pathname !== '/') {\n if (pathname.startsWith('/')) {\n pathname = pathname.substring(1)\n }\n\n path = pathname\n }\n\n if (search != null && search !== '') {\n path = path ?? ''\n path += search\n }\n\n return { scheme, hostname, port, path }\n}\n\nfunction tupleForHostname (hostname: string, defaultDnsType: string): [string, string] | undefined {\n if (hostname == null || hostname === '') {\n return undefined\n }\n\n if (isIPv4(hostname)) {\n return ['ip4', hostname]\n }\n\n if (isIPv6(hostname)) {\n return ['ip6', hostname]\n }\n\n // literal ipv6 in url should be wrapped in square brackets [x:y:z]\n // https://www.ietf.org/rfc/rfc2732.txt\n if (hostname[0] === '[') {\n const trimmed = hostname.substring(1, hostname.length - 1)\n if (isIPv6(trimmed)) {\n return ['ip6', trimmed]\n }\n }\n // assumes that any non-ip hostname is a dns4 address.\n return [defaultDnsType, hostname]\n}\n\nfunction tupleForPort (port: string, scheme: string): [string, string] | undefined {\n if (port == null || port === '') {\n return undefined\n }\n\n if (scheme === 'udp') {\n return ['udp', port]\n }\n\n return ['tcp', port]\n}\n\nfunction tupleForScheme (scheme: string): [string] | undefined {\n if (scheme.match(/^tcp$|^udp$/) != null) {\n return undefined\n }\n\n if (scheme === 'https') {\n return ['/tls/http']\n }\n\n if (scheme === 'wss') {\n return ['/tls/ws']\n }\n\n return [scheme]\n}\n\nfunction tupleForPath (path: string): [string, string] | undefined {\n if (path == null || path === '') {\n return undefined\n }\n\n return ['http-path', encodeURIComponent(path)]\n}\n\nfunction portForProtocol (protocol: string): string | undefined {\n if (protocol == null || protocol === '' || portFor[protocol] == null) {\n return undefined\n }\n\n return portFor[protocol]\n}\n","/**\n * TinyCloud location registry helpers.\n *\n * The registry maps a DID to one or more multiaddrs. Registry records are\n * signed by the DID subject; centralized storage is only a discovery cache.\n */\n\nimport { multiaddr } from \"@multiformats/multiaddr\";\nimport { multiaddrToUri } from \"@multiformats/multiaddr-to-uri\";\nimport { uriToMultiaddr } from \"@multiformats/uri-to-multiaddr\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { verifyMessage } from \"viem\";\n\nexport interface LocationRecordPayload {\n version: 1;\n subject: string;\n multiaddrs: string[];\n updated_at: string;\n sequence: number;\n}\n\nexport interface LocationRecord extends LocationRecordPayload {\n signature: string;\n}\n\n/**\n * Where a resolved TinyCloud host came from, ordered highest to lowest\n * priority. `local-loopback` and `local-link` are probed + identity-verified\n * (see {@link discoverLocalTinyCloudNode}); the rest are resolved the same\n * way they always have been (no liveness probing). New local-discovery\n * sources (e.g. a future `tunnel` or `mdns` source) slot in next to\n * `local-link` without touching the unprobed sources below them.\n */\nexport type LocationSource =\n | \"explicit\"\n | \"local-loopback\"\n | \"local-link\"\n | \"blockchain\"\n | \"centralized\"\n | \"fallback\";\n\nexport const DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL =\n \"https://registry.tinycloud.xyz\";\nexport const DEFAULT_TINYCLOUD_FALLBACK_HOST = \"https://node.tinycloud.xyz\";\n\n/** Default local loopback node URL probed before registry/fallback resolution. */\nexport const DEFAULT_LOCAL_NODE_URL = \"http://127.0.0.1:8000\";\n/** Probe timeout for the local loopback candidate. No retries. */\nexport const LOCAL_LOOPBACK_PROBE_TIMEOUT_MS = 250;\n/** Probe timeout for local.tinycloud.link candidates. No retries. */\nexport const LOCAL_LINK_PROBE_TIMEOUT_MS = 750;\n/** Hostname suffix identifying a local-link tunnel candidate. */\nexport const LOCAL_LINK_HOST_SUFFIX = \".local.tinycloud.link\";\n\nexport interface LocationCandidate {\n source: LocationSource;\n multiaddrs: string[];\n record?: LocationRecord;\n}\n\nexport interface LocationResolutionAttempt {\n source: LocationSource;\n candidate?: LocationCandidate;\n error?: Error;\n}\n\nexport interface ResolvedCloudLocation {\n subject: string;\n source: LocationSource;\n multiaddrs: string[];\n record?: LocationRecord;\n attempts: LocationResolutionAttempt[];\n resolvedAt: string;\n}\n\nexport interface ResolveCloudLocationOptions {\n /** Highest-priority location supplied directly by the caller. */\n explicitMultiaddrs?: string[];\n /** Optional blockchain resolver adapter. */\n blockchain?: (\n subject: string,\n ) => Promise<LocationCandidateInput | null | undefined>;\n /** Centralized location registry base URL, e.g. https://registry.tinycloud.xyz. */\n centralizedRegistryUrl?: string;\n /** Lowest-priority fallback location. */\n fallbackMultiaddrs?: string[];\n /** Custom fetch implementation. Defaults to globalThis.fetch. */\n fetch?: typeof fetch;\n /** Verify centralized/blockchain record signatures. Default true. */\n verifyRecords?: boolean;\n}\n\nexport interface ResolvedTinyCloudHosts {\n hosts: string[];\n location: ResolvedCloudLocation;\n}\n\n/**\n * Trust-on-first-use pin store for locally-discovered node identities, keyed\n * by candidate URL. The first successful `/info` check for a URL with no\n * existing pin adopts and pins that node's DID; every later check for the\n * same URL must match the pin. Implementations: CLI (profile store), web\n * (localStorage), node-sdk (config-provided callback, else in-memory).\n */\nexport interface LocalNodeIdentityStore {\n get(url: string): string | undefined | Promise<string | undefined>;\n set(url: string, nodeDid: string): void | Promise<void>;\n}\n\n/** In-memory {@link LocalNodeIdentityStore}. Does not persist across process restarts. */\nexport function createInMemoryLocalNodeIdentityStore(): LocalNodeIdentityStore {\n const pins = new Map<string, string>();\n return {\n get: (url) => pins.get(url),\n set: (url, nodeDid) => {\n pins.set(url, nodeDid);\n },\n };\n}\n\n/**\n * Minimal subset of the DOM `Storage` interface. Declared locally so\n * sdk-core (no DOM lib) doesn't need to depend on browser types.\n */\nexport interface WebStorageLike {\n getItem(key: string): string | null;\n setItem(key: string, value: string): void;\n removeItem(key: string): void;\n}\n\n/** Default namespaced key {@link createLocalStorageLocalNodeIdentityStore} stores its pins under. */\nexport const DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY = \"tinycloud.localNodePins.v1\";\n\nfunction defaultWebStorage(): WebStorageLike | undefined {\n try {\n return (globalThis as unknown as { localStorage?: WebStorageLike }).localStorage;\n } catch {\n // Some sandboxed environments (e.g. private-browsing Safari, locked-down\n // iframes) throw on access instead of leaving it undefined.\n return undefined;\n }\n}\n\n/**\n * `localStorage`-backed {@link LocalNodeIdentityStore}, namespaced under a\n * single JSON blob (default key {@link DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY}).\n * Falls back to an in-memory store when `localStorage` is unavailable (SSR,\n * Node.js, sandboxed contexts that throw on access, etc.), so callers never\n * have to branch on environment. Corrupt stored JSON is reset rather than\n * thrown.\n */\nexport function createLocalStorageLocalNodeIdentityStore(\n storage?: WebStorageLike,\n storageKey: string = DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY,\n): LocalNodeIdentityStore {\n const backing = storage ?? defaultWebStorage();\n if (!backing) {\n return createInMemoryLocalNodeIdentityStore();\n }\n\n const readPins = (): Record<string, string> => {\n const raw = backing.getItem(storageKey);\n if (!raw) return {};\n try {\n const parsed: unknown = JSON.parse(raw);\n if (parsed !== null && typeof parsed === \"object\" && !Array.isArray(parsed)) {\n return parsed as Record<string, string>;\n }\n } catch {\n // Corrupt JSON below: reset rather than crash.\n }\n backing.removeItem(storageKey);\n return {};\n };\n\n return {\n get: (url) => readPins()[url],\n set: (url, nodeDid) => {\n const pins = readPins();\n pins[url] = nodeDid;\n backing.setItem(storageKey, JSON.stringify(pins));\n },\n };\n}\n\nexport interface DiscoverLocalTinyCloudNodeOptions {\n /**\n * Subject DID used to look up the registry LocationRecord for\n * `*.local.tinycloud.link` multiaddrs (source `local-link`). Omit to skip\n * that lookup — the local-loopback and `localLinkName` candidates don't\n * need it.\n */\n subject?: string;\n /** Enable local-node auto-discovery. Default true. */\n autoDiscoverLocalNode?: boolean;\n /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */\n localNodeUrl?: string;\n /** Known `*.local.tinycloud.link` subdomain name, probed directly. */\n localLinkName?: string;\n /** Centralized location registry URL, used for the `local-link` registry lookup. Default https://registry.tinycloud.xyz. */\n registryUrl?: string | null;\n /** Expected local node DID. Wins over any pinned value; a mismatch rejects the candidate. */\n expectedNodeDid?: string;\n /** Pin store for trust-on-first-use identity verification. Defaults to an in-memory store. */\n identityStore?: LocalNodeIdentityStore;\n /** Verify the registry LocationRecord signature before trusting its `local-link` multiaddrs. Default true. */\n verifyRecords?: boolean;\n /** Custom fetch implementation. Defaults to globalThis.fetch. */\n fetch?: typeof fetch;\n}\n\nexport interface DiscoveredLocalTinyCloudNode {\n source: Extract<LocationSource, \"local-loopback\" | \"local-link\">;\n url: string;\n nodeDid: string;\n}\n\nexport interface ResolveTinyCloudHostsOptions {\n /** Highest-priority TinyCloud HTTP host URLs or multiaddrs supplied directly. */\n explicitHosts?: string[];\n /** Optional blockchain resolver adapter. */\n blockchain?: ResolveCloudLocationOptions[\"blockchain\"];\n /** Centralized location registry URL. Default https://registry.tinycloud.xyz. */\n registryUrl?: string | null;\n /** Lowest-priority fallback HTTP host URLs or multiaddrs. Default hosted TinyCloud node. */\n fallbackHosts?: string[] | null;\n /** Custom fetch implementation. Defaults to globalThis.fetch. */\n fetch?: typeof fetch;\n /** Verify centralized/blockchain record signatures. Default true. */\n verifyRecords?: boolean;\n /**\n * Probe for a locally-running TinyCloud node before falling back to\n * registry/hosted resolution. Default true. Setting false restores the\n * exact pre-TC-106 resolution order (registry → fallback).\n */\n autoDiscoverLocalNode?: boolean;\n /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */\n localNodeUrl?: string;\n /** Known `*.local.tinycloud.link` subdomain name, probed directly. */\n localLinkName?: string;\n /** Expected local node DID. Wins over any pinned value; a mismatch rejects the candidate. */\n expectedNodeDid?: string;\n /** Pin store for trust-on-first-use local node identity verification. Defaults to an in-memory store. */\n localNodeIdentityStore?: LocalNodeIdentityStore;\n}\n\nexport type LocationCandidateInput =\n | string[]\n | LocationRecord\n | {\n multiaddrs: string[];\n record?: LocationRecord;\n };\n\nexport type LocationRecordSigner =\n | {\n type: \"did:pkh\";\n signMessage(message: string): Promise<string>;\n }\n | {\n type: \"did:key\";\n signBytes(bytes: Uint8Array): Promise<Uint8Array>;\n };\n\nexport class LocationRecordValidationError extends Error {\n constructor(message: string) {\n super(`Location record validation failed: ${message}`);\n this.name = \"LocationRecordValidationError\";\n }\n}\n\nexport class CloudLocationResolutionError extends Error {\n public readonly attempts: LocationResolutionAttempt[];\n\n constructor(subject: string, attempts: LocationResolutionAttempt[]) {\n super(`Unable to resolve TinyCloud location for ${subject}`);\n this.name = \"CloudLocationResolutionError\";\n this.attempts = attempts;\n }\n}\n\nexport function locationPayloadForRecord(\n record: LocationRecord,\n): LocationRecordPayload {\n return {\n version: record.version,\n subject: record.subject,\n multiaddrs: [...record.multiaddrs],\n updated_at: record.updated_at,\n sequence: record.sequence,\n };\n}\n\nexport function canonicalLocationPayload(\n payload: LocationRecordPayload,\n): string {\n return JSON.stringify({\n version: payload.version,\n subject: payload.subject,\n multiaddrs: payload.multiaddrs,\n updated_at: payload.updated_at,\n sequence: payload.sequence,\n });\n}\n\nexport async function signLocationRecord(\n payload: LocationRecordPayload,\n signer: LocationRecordSigner,\n): Promise<LocationRecord> {\n validateLocationRecordPayload(payload);\n const message = canonicalLocationPayload(payload);\n const signature =\n signer.type === \"did:pkh\"\n ? await signer.signMessage(message)\n : base64UrlEncode(\n await signer.signBytes(new TextEncoder().encode(message)),\n );\n return { ...payload, signature };\n}\n\nexport function validateLocationRecordPayload(\n input: unknown,\n): LocationRecordPayload {\n if (input === null || typeof input !== \"object\") {\n throw new LocationRecordValidationError(\"payload must be an object\");\n }\n\n const payload = input as Partial<LocationRecordPayload>;\n if (payload.version !== 1) {\n throw new LocationRecordValidationError(\"version must be 1\");\n }\n validateSubject(payload.subject);\n validateMultiaddrs(payload.multiaddrs);\n if (\n typeof payload.updated_at !== \"string\" ||\n Number.isNaN(Date.parse(payload.updated_at))\n ) {\n throw new LocationRecordValidationError(\n \"updated_at must be an ISO timestamp\",\n );\n }\n if (\n typeof payload.sequence !== \"number\" ||\n !Number.isSafeInteger(payload.sequence) ||\n payload.sequence < 0\n ) {\n throw new LocationRecordValidationError(\n \"sequence must be a non-negative safe integer\",\n );\n }\n\n return {\n version: 1,\n subject: payload.subject,\n multiaddrs: [...payload.multiaddrs],\n updated_at: payload.updated_at,\n sequence: payload.sequence,\n };\n}\n\nexport function validateLocationRecord(input: unknown): LocationRecord {\n const payload = validateLocationRecordPayload(input);\n const signature = (input as Partial<LocationRecord>).signature;\n if (typeof signature !== \"string\" || signature.length === 0) {\n throw new LocationRecordValidationError(\n \"signature must be a non-empty string\",\n );\n }\n return { ...payload, signature };\n}\n\nexport async function verifyLocationRecord(\n input: LocationRecord,\n): Promise<boolean> {\n const record = validateLocationRecord(input);\n const payload = canonicalLocationPayload(locationPayloadForRecord(record));\n\n if (record.subject.startsWith(\"did:pkh:\")) {\n return verifyPkhSignature(record.subject, payload, record.signature);\n }\n if (record.subject.startsWith(\"did:key:\")) {\n return verifyDidKeySignature(record.subject, payload, record.signature);\n }\n return false;\n}\n\nexport async function fetchLocationRecord(\n registryUrl: string,\n subject: string,\n fetchFn: typeof fetch = globalThis.fetch,\n): Promise<LocationRecord | null> {\n const url = `${registryUrl.replace(/\\/$/, \"\")}/v1/locations/${encodeURIComponent(subject)}`;\n const response = await fetchFn(url);\n if (response.status === 404) {\n return null;\n }\n if (!response.ok) {\n throw new Error(`location registry returned HTTP ${response.status}`);\n }\n const body = (await response.json()) as { record?: unknown };\n if (body.record === undefined) {\n throw new LocationRecordValidationError(\"registry response missing record\");\n }\n return validateLocationRecord(body.record);\n}\n\nexport async function resolveCloudLocation(\n subject: string,\n options: ResolveCloudLocationOptions = {},\n): Promise<ResolvedCloudLocation> {\n validateSubject(subject);\n const verifyRecords = options.verifyRecords ?? true;\n const attempts = await Promise.all([\n resolveExplicit(subject, options.explicitMultiaddrs),\n resolveBlockchain(subject, options.blockchain, verifyRecords),\n resolveCentralized(subject, options, verifyRecords),\n resolveFallback(subject, options.fallbackMultiaddrs),\n ]);\n\n const winner = attempts.find((attempt) => attempt.candidate)?.candidate;\n if (!winner) {\n throw new CloudLocationResolutionError(subject, attempts);\n }\n\n return {\n subject,\n source: winner.source,\n multiaddrs: [...winner.multiaddrs],\n ...(winner.record ? { record: winner.record } : {}),\n attempts,\n resolvedAt: new Date().toISOString(),\n };\n}\n\nexport async function resolveTinyCloudHosts(\n subject: string,\n options: ResolveTinyCloudHostsOptions = {},\n): Promise<ResolvedTinyCloudHosts> {\n const hasExplicitHosts =\n options.explicitHosts !== undefined && options.explicitHosts.length > 0;\n\n // Shared for the lifetime of this single resolve call only (no cross-call\n // caching): local discovery's registry lookup and the centralized\n // resolution below can both request the same subject's LocationRecord from\n // the same registry URL, so memoizing here avoids firing that request twice.\n const fetchFn = memoizeFetch(options.fetch ?? globalThis.fetch);\n\n // Explicit config wins outright — same as before TC-106, no local probe.\n if (!hasExplicitHosts && (options.autoDiscoverLocalNode ?? true)) {\n const local = await discoverLocalTinyCloudNode({\n subject,\n autoDiscoverLocalNode: true,\n localNodeUrl: options.localNodeUrl,\n localLinkName: options.localLinkName,\n registryUrl: options.registryUrl,\n expectedNodeDid: options.expectedNodeDid,\n identityStore: options.localNodeIdentityStore,\n verifyRecords: options.verifyRecords,\n fetch: fetchFn,\n });\n if (local) {\n const multiaddrs = [httpUrlToMultiaddr(local.url)];\n const candidate: LocationCandidate = { source: local.source, multiaddrs };\n const location: ResolvedCloudLocation = {\n subject,\n source: local.source,\n multiaddrs,\n attempts: [{ source: local.source, candidate }],\n resolvedAt: new Date().toISOString(),\n };\n return { hosts: [local.url], location };\n }\n }\n\n const location = await resolveCloudLocation(subject, {\n explicitMultiaddrs: hostsToMultiaddrs(options.explicitHosts),\n blockchain: options.blockchain,\n centralizedRegistryUrl:\n options.registryUrl === null\n ? undefined\n : (options.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL),\n fallbackMultiaddrs: hostsToMultiaddrs(\n options.fallbackHosts === null\n ? undefined\n : (options.fallbackHosts ?? [DEFAULT_TINYCLOUD_FALLBACK_HOST]),\n ),\n fetch: fetchFn,\n verifyRecords: options.verifyRecords,\n });\n\n return {\n hosts: location.multiaddrs.map((addr) => multiaddrToHttpUrl(addr)),\n location,\n };\n}\n\n/**\n * Wrap a fetch implementation so identical (same-URL) requests within its\n * lifetime share one in-flight/completed response instead of firing twice.\n * Scoped to the caller — a fresh wrapper is created per {@link\n * resolveTinyCloudHosts} call, so nothing is cached across calls. Each\n * request's `Response` body is cloned on the way out so every caller gets an\n * independently readable body regardless of read order.\n */\nfunction memoizeFetch(fetchFn: typeof fetch): typeof fetch {\n const cache = new Map<string, Promise<Response>>();\n return (async (input, init) => {\n const key = String(input);\n let cached = cache.get(key);\n if (!cached) {\n cached = fetchFn(input, init);\n cache.set(key, cached);\n }\n const response = await cached;\n return response.clone();\n }) as typeof fetch;\n}\n\n/**\n * Probe for a locally-running TinyCloud node and verify its identity before\n * trusting it. Tries, in order: the local loopback URL, the explicit\n * `localLinkName` candidate (if given), then any `*.local.tinycloud.link`\n * multiaddr found in the subject's registry LocationRecord (if `subject` and\n * a registry are given). Each candidate is probed with `GET {url}/healthz`\n * (short timeout, no retries) — any failure (refused, timeout, NXDOMAIN,\n * offline) silently skips to the next candidate, no error, no log above\n * debug level. A candidate that answers healthy is then identity-checked via\n * `GET {url}/info`: if an expected DID is known (explicit or previously\n * pinned), the node's `nodeId` DID must match or the candidate is rejected;\n * if no expectation exists yet, the DID is trusted and pinned (TOFU).\n *\n * Returns `null` (never throws) when no local node is found or verified —\n * callers fall through to their normal remote resolution.\n */\nexport async function discoverLocalTinyCloudNode(\n options: DiscoverLocalTinyCloudNodeOptions = {},\n): Promise<DiscoveredLocalTinyCloudNode | null> {\n if ((options.autoDiscoverLocalNode ?? true) === false) {\n return null;\n }\n\n const fetchFn = options.fetch ?? globalThis.fetch;\n const identityStore =\n options.identityStore ?? defaultLocalNodeIdentityStore;\n\n // Cheap, static candidates first — no network round trip beyond the probe\n // itself. The registry lookup below is only reached if these don't pan\n // out, so the common case (a node running at the default loopback) never\n // pays for an extra registry request.\n const staticCandidates: LocalNodeCandidate[] = [\n {\n source: \"local-loopback\",\n url: options.localNodeUrl ?? DEFAULT_LOCAL_NODE_URL,\n timeoutMs: LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,\n },\n ];\n if (options.localLinkName) {\n if (isValidDnsLabel(options.localLinkName)) {\n staticCandidates.push({\n source: \"local-link\",\n url: `https://${options.localLinkName}${LOCAL_LINK_HOST_SUFFIX}`,\n timeoutMs: LOCAL_LINK_PROBE_TIMEOUT_MS,\n });\n } else {\n debugLog(\n `localLinkName \"${options.localLinkName}\" is not a valid DNS label; skipping`,\n );\n }\n }\n\n for (const candidate of staticCandidates) {\n const adopted = await probeAndVerifyLocalCandidate(\n candidate,\n fetchFn,\n identityStore,\n options.expectedNodeDid,\n );\n if (adopted) {\n return adopted;\n }\n }\n\n const registryCandidates = await fetchRegistryLocalLinkCandidates(\n options,\n fetchFn,\n staticCandidates,\n );\n for (const candidate of registryCandidates) {\n const adopted = await probeAndVerifyLocalCandidate(\n candidate,\n fetchFn,\n identityStore,\n options.expectedNodeDid,\n );\n if (adopted) {\n return adopted;\n }\n }\n\n return null;\n}\n\nconst defaultLocalNodeIdentityStore = createInMemoryLocalNodeIdentityStore();\n\nfunction debugLog(message: string): void {\n console.debug(`[tinycloud:location] ${message}`);\n}\n\ninterface LocalNodeCandidate {\n source: Extract<LocationSource, \"local-loopback\" | \"local-link\">;\n url: string;\n timeoutMs: number;\n}\n\nasync function probeAndVerifyLocalCandidate(\n candidate: LocalNodeCandidate,\n fetchFn: typeof fetch,\n identityStore: LocalNodeIdentityStore,\n expectedNodeDid: string | undefined,\n): Promise<DiscoveredLocalTinyCloudNode | null> {\n const healthy = await probeHealthz(candidate.url, candidate.timeoutMs, fetchFn);\n if (!healthy) {\n return null;\n }\n\n const info = await fetchLocalNodeInfo(candidate.url, candidate.timeoutMs, fetchFn);\n if (!info?.nodeDid) {\n debugLog(`local node at ${candidate.url} did not report a nodeId DID; skipping`);\n return null;\n }\n\n const pinnedNodeDid = await identityStore.get(candidate.url);\n const expected = expectedNodeDid ?? pinnedNodeDid;\n if (expected !== undefined && expected !== info.nodeDid) {\n debugLog(\n `local node DID mismatch at ${candidate.url}: expected ${expected}, got ${info.nodeDid}`,\n );\n return null;\n }\n if (pinnedNodeDid === undefined || expectedNodeDid !== undefined) {\n // TOFU pin (no prior pin), or an explicit `expectedNodeDid` just\n // confirmed the match — refresh the stored pin so a later call that\n // omits `expectedNodeDid` doesn't fall back to a stale pinned DID.\n await identityStore.set(candidate.url, info.nodeDid);\n }\n\n return { source: candidate.source, url: candidate.url, nodeDid: info.nodeDid };\n}\n\n/**\n * Look up the subject's registry LocationRecord and extract any\n * `*.local.tinycloud.link` multiaddrs as additional local-link candidates.\n * Only called once the cheap static candidates have failed. Never throws —\n * registry failures here are opportunistic and fall through to the\n * unchanged remote resolution that runs when local discovery finds nothing.\n */\nasync function fetchRegistryLocalLinkCandidates(\n options: DiscoverLocalTinyCloudNodeOptions,\n fetchFn: typeof fetch,\n existingCandidates: LocalNodeCandidate[],\n): Promise<LocalNodeCandidate[]> {\n if (!options.subject || options.registryUrl === null) {\n return [];\n }\n\n const registryUrl = options.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL;\n try {\n const record = await fetchLocationRecord(registryUrl, options.subject, fetchFn);\n if (!record) {\n return [];\n }\n\n const shouldVerify = options.verifyRecords ?? true;\n if (shouldVerify && !(await verifyLocationRecord(record))) {\n debugLog(\n `registry record signature invalid for ${options.subject}; skipping local-link lookup`,\n );\n return [];\n }\n\n return extractLocalLinkUrls(record)\n .filter((url) => !existingCandidates.some((c) => c.url === url))\n .map((url) => ({\n source: \"local-link\" as const,\n url,\n timeoutMs: LOCAL_LINK_PROBE_TIMEOUT_MS,\n }));\n } catch {\n return [];\n }\n}\n\n/** Extract `https://*.local.tinycloud.link` URLs from a LocationRecord's multiaddrs. */\nfunction extractLocalLinkUrls(record: LocationRecord | null): string[] {\n if (!record) {\n return [];\n }\n const urls: string[] = [];\n for (const addr of record.multiaddrs) {\n let url: string;\n try {\n url = multiaddrToHttpUrl(addr);\n } catch {\n continue;\n }\n if (isLocalLinkUrl(url)) {\n urls.push(url);\n }\n }\n return urls;\n}\n\n/** Single DNS label: lowercase alphanumeric, optional interior hyphens, 2-32 chars. */\nconst DNS_LABEL_REGEX = /^[a-z0-9]([a-z0-9-]{1,30}[a-z0-9])?$/;\n\nfunction isValidDnsLabel(value: string): boolean {\n return DNS_LABEL_REGEX.test(value);\n}\n\nfunction isLocalLinkUrl(url: string): boolean {\n try {\n const parsed = new URL(url);\n return (\n parsed.protocol === \"https:\" && parsed.hostname.endsWith(LOCAL_LINK_HOST_SUFFIX)\n );\n } catch {\n return false;\n }\n}\n\nasync function probeHealthz(\n url: string,\n timeoutMs: number,\n fetchFn: typeof fetch,\n): Promise<boolean> {\n try {\n const response = await fetchFn(`${url.replace(/\\/$/, \"\")}/healthz`, {\n signal: AbortSignal.timeout(timeoutMs),\n });\n return response.ok;\n } catch {\n return false;\n }\n}\n\nasync function fetchLocalNodeInfo(\n url: string,\n timeoutMs: number,\n fetchFn: typeof fetch,\n): Promise<{ nodeDid?: string } | null> {\n try {\n const response = await fetchFn(`${url.replace(/\\/$/, \"\")}/info`, {\n signal: AbortSignal.timeout(timeoutMs),\n });\n if (!response.ok) {\n return null;\n }\n const body = (await response.json()) as { nodeId?: string };\n return { nodeDid: body.nodeId };\n } catch {\n return null;\n }\n}\n\nexport function multiaddrToHttpUrl(input: string): string {\n const uri = multiaddrToUri(multiaddr(input));\n if (!uri.startsWith(\"http://\") && !uri.startsWith(\"https://\")) {\n throw new LocationRecordValidationError(\n `multiaddr does not resolve to http/https: ${input}`,\n );\n }\n return uri;\n}\n\nexport function httpUrlToMultiaddr(input: string): string {\n const url = new URL(input);\n if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n throw new LocationRecordValidationError(\"URL must use http or https\");\n }\n return uriToMultiaddr(url.toString()).toString();\n}\n\nfunction hostsToMultiaddrs(hosts: string[] | undefined): string[] | undefined {\n if (hosts === undefined || hosts.length === 0) {\n return undefined;\n }\n return hosts.map((host) =>\n host.startsWith(\"/\") ? host : httpUrlToMultiaddr(host),\n );\n}\n\nasync function resolveExplicit(\n subject: string,\n multiaddrs: string[] | undefined,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"explicit\", async () => {\n if (multiaddrs === undefined || multiaddrs.length === 0) {\n return null;\n }\n return toCandidate(subject, \"explicit\", multiaddrs, false);\n });\n}\n\nasync function resolveBlockchain(\n subject: string,\n resolver: ResolveCloudLocationOptions[\"blockchain\"],\n verifyRecords: boolean,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"blockchain\", async () => {\n if (!resolver) {\n return null;\n }\n return toCandidate(\n subject,\n \"blockchain\",\n await resolver(subject),\n verifyRecords,\n );\n });\n}\n\nasync function resolveCentralized(\n subject: string,\n options: ResolveCloudLocationOptions,\n verifyRecords: boolean,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"centralized\", async () => {\n if (!options.centralizedRegistryUrl) {\n return null;\n }\n const record = await fetchLocationRecord(\n options.centralizedRegistryUrl,\n subject,\n options.fetch,\n );\n return toCandidate(subject, \"centralized\", record, verifyRecords);\n });\n}\n\nasync function resolveFallback(\n subject: string,\n multiaddrs: string[] | undefined,\n): Promise<LocationResolutionAttempt> {\n return resolveAttempt(\"fallback\", async () => {\n if (multiaddrs === undefined || multiaddrs.length === 0) {\n return null;\n }\n return toCandidate(subject, \"fallback\", multiaddrs, false);\n });\n}\n\nasync function resolveAttempt(\n source: LocationSource,\n resolve: () => Promise<LocationCandidate | null>,\n): Promise<LocationResolutionAttempt> {\n try {\n const candidate = await resolve();\n return candidate ? { source, candidate } : { source };\n } catch (error) {\n return {\n source,\n error: error instanceof Error ? error : new Error(String(error)),\n };\n }\n}\n\nasync function toCandidate(\n subject: string,\n source: LocationSource,\n input: LocationCandidateInput | null | undefined,\n verifyRecord: boolean,\n): Promise<LocationCandidate | null> {\n if (input === null || input === undefined) {\n return null;\n }\n\n if (Array.isArray(input)) {\n validateMultiaddrs(input);\n return { source, multiaddrs: [...input] };\n }\n\n const maybeRecord = input as Partial<LocationRecord>;\n if (maybeRecord.version === 1 && maybeRecord.signature !== undefined) {\n const record = validateLocationRecord(input);\n if (record.subject !== subject) {\n throw new LocationRecordValidationError(\n \"location record subject does not match requested subject\",\n );\n }\n if (verifyRecord && !(await verifyLocationRecord(record))) {\n throw new LocationRecordValidationError(\n \"location record signature is invalid\",\n );\n }\n return { source, multiaddrs: [...record.multiaddrs], record };\n }\n\n const candidateInput = input as { multiaddrs?: unknown; record?: unknown };\n if (!Array.isArray(candidateInput.multiaddrs)) {\n throw new LocationRecordValidationError(\n \"candidate multiaddrs must be an array\",\n );\n }\n validateMultiaddrs(candidateInput.multiaddrs);\n if (candidateInput.record !== undefined) {\n const record = validateLocationRecord(candidateInput.record);\n if (record.subject !== subject) {\n throw new LocationRecordValidationError(\n \"location record subject does not match requested subject\",\n );\n }\n if (verifyRecord && !(await verifyLocationRecord(record))) {\n throw new LocationRecordValidationError(\n \"location record signature is invalid\",\n );\n }\n return { source, multiaddrs: [...candidateInput.multiaddrs], record };\n }\n return { source, multiaddrs: [...candidateInput.multiaddrs] };\n}\n\nfunction validateSubject(subject: unknown): asserts subject is string {\n if (typeof subject !== \"string\" || subject.length === 0) {\n throw new LocationRecordValidationError(\n \"subject must be a non-empty string\",\n );\n }\n if (!subject.startsWith(\"did:pkh:\") && !subject.startsWith(\"did:key:\")) {\n throw new LocationRecordValidationError(\n \"subject must be did:pkh or did:key\",\n );\n }\n}\n\nfunction validateMultiaddrs(input: unknown): asserts input is string[] {\n if (!Array.isArray(input)) {\n throw new LocationRecordValidationError(\"multiaddrs must be an array\");\n }\n for (const addr of input) {\n if (typeof addr !== \"string\" || addr.length === 0) {\n throw new LocationRecordValidationError(\n \"multiaddr entries must be non-empty strings\",\n );\n }\n try {\n multiaddr(addr);\n } catch {\n throw new LocationRecordValidationError(`invalid multiaddr: ${addr}`);\n }\n }\n}\n\nasync function verifyPkhSignature(\n did: string,\n payload: string,\n signature: string,\n): Promise<boolean> {\n const address = did.split(\":\").at(-1);\n if (!address || !/^0x[a-fA-F0-9]{40}$/.test(address)) {\n throw new LocationRecordValidationError(\n \"did:pkh subject must end with an EVM address\",\n );\n }\n if (!/^0x[0-9a-fA-F]+$/.test(signature)) {\n throw new LocationRecordValidationError(\"did:pkh signature must be hex\");\n }\n\n return verifyMessage({\n address: address as `0x${string}`,\n message: payload,\n signature: signature as `0x${string}`,\n });\n}\n\nfunction verifyDidKeySignature(\n did: string,\n payload: string,\n signature: string,\n): boolean {\n const publicKey = ed25519PublicKeyFromDidKey(did);\n const signatureBytes = decodeBase64Url(signature);\n if (signatureBytes.length !== 64) {\n throw new LocationRecordValidationError(\n \"did:key signature must be a base64url Ed25519 signature\",\n );\n }\n return ed25519.verify(\n signatureBytes,\n new TextEncoder().encode(payload),\n publicKey,\n );\n}\n\nexport function verifyDidKeyEd25519Signature(\n did: string,\n payload: Uint8Array,\n signature: Uint8Array,\n): boolean {\n const publicKey = ed25519PublicKeyFromDidKey(did);\n return ed25519.verify(signature, payload, publicKey);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n const identifier = did.slice(\"did:key:\".length);\n if (!identifier.startsWith(\"z\")) {\n throw new LocationRecordValidationError(\n \"did:key must use base58btc multibase\",\n );\n }\n\n const bytes = bases.base58btc.decode(identifier);\n if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n return bytes.slice(2);\n }\n if (bytes.length === 33 && bytes[0] === 0xed) {\n return bytes.slice(1);\n }\n throw new LocationRecordValidationError(\n \"did:key must be an Ed25519 public key\",\n );\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n let output = \"\";\n\n for (let i = 0; i < bytes.length; i += 3) {\n const a = bytes[i];\n const b = bytes[i + 1];\n const c = bytes[i + 2];\n const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n\n output += alphabet[(triplet >> 18) & 63];\n output += alphabet[(triplet >> 12) & 63];\n if (i + 1 < bytes.length) {\n output += alphabet[(triplet >> 6) & 63];\n }\n if (i + 2 < bytes.length) {\n output += alphabet[triplet & 63];\n }\n }\n\n return output;\n}\n\nfunction decodeBase64Url(value: string): Uint8Array {\n const alphabet =\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n const bytes: number[] = [];\n let buffer = 0;\n let bits = 0;\n\n for (const char of value) {\n const index = alphabet.indexOf(char);\n if (index < 0) {\n throw new LocationRecordValidationError(\n \"did:key signature must be base64url\",\n );\n }\n\n buffer = (buffer << 6) | index;\n bits += 6;\n if (bits >= 8) {\n bits -= 8;\n bytes.push((buffer >> bits) & 0xff);\n }\n }\n\n return Uint8Array.from(bytes);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMA,iBAAkB;AAClB,kBAA4B;AAUrB,IAAM,gBAAgB,aAAE,OAAO;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,WAAW,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAeM,IAAM,mBAAmB,aAC7B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,gBAAgB,aAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAC1C,CAAC,EACA,YAAY;AAoBR,IAAM,sBAAsB,aAAE,OAAO;AAAA,EAC1C,SAAS,aAAE,OAAO;AAAA,EAClB,eAAe,aAAE,OAAO;AAAA,EACxB,SAAS,aAAE,OAAO;AAAA,EAClB,YAAY,aAAE,OAAO;AAAA,EACrB,MAAM,aAAE,OAAO;AAAA,EACf,WAAW,aAAE,OAAO;AAAA,EACpB,KAAK,cAAc,SAAS;AAC9B,CAAC;AAMM,SAAS,sBAAsB,MAAqC;AACzE,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;;;ACvDO,IAAM,4BAAN,MAAgE;AAAA,EACrE,UAAgB;AAAA,EAAC;AAAA,EACjB,UAAgB;AAAA,EAAC;AAAA,EACjB,QAAc;AAAA,EAAC;AACjB;;;ACjCA,kBAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AACnB,IAAM,SAAS;AAEf,SAAS,YAAY,OAAkD;AACrE,QAAM,gBAAgB,MAAM,QAAQ,GAAG;AACvC,MAAI,gBAAgB,GAAG;AACrB,WAAO,EAAE,KAAK,OAAO,UAAU,GAAG;AAAA,EACpC;AACA,SAAO;AAAA,IACL,KAAK,MAAM,MAAM,GAAG,aAAa;AAAA,IACjC,UAAU,MAAM,MAAM,aAAa;AAAA,EACrC;AACF;AAEA,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,uBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,wBAAW,OAAO;AAC3B;AAEO,SAAS,kBAAkB,SAAmC;AACnE,SAAO,oBAAoB,OAAO,EAAE,YAAY;AAClD;AAEO,SAAS,OAAO,SAAiB,UAAkB,GAAW;AACnE,qBAAmB,OAAO;AAC1B,SAAO,kBAAkB,OAAO,IAAI,oBAAoB,OAAO,CAAC;AAClE;AAEO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;AAEO,SAAS,gBAAgB,KAAqB;AACnD,QAAM,MAAM,YAAY,GAAG;AAC3B,MAAI,KAAK;AACP,WAAO,OAAO,IAAI,SAAS,IAAI,OAAO;AAAA,EACxC;AACA,MAAI,OAAO,KAAK,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,mBAAmB,gBAAgB,GAAG,EAAE;AACpD;AAEO,SAAS,mBAAmB,QAAwB;AACzD,QAAM,EAAE,KAAK,SAAS,IAAI,YAAY,MAAM;AAC5C,SAAO,GAAG,gBAAgB,GAAG,CAAC,GAAG,QAAQ;AAC3C;AAEO,SAAS,aAAa,QAAwB;AACnD,SAAO,gBAAgB,YAAY,MAAM,EAAE,GAAG;AAChD;AAEO,SAAS,UAAU,GAAW,GAAWA,WAA4B,CAAC,GAAY;AACvF,QAAM,eAAeA,SAAQ,iBAAiB,eAAe;AAC7D,SAAO,aAAa,CAAC,MAAM,aAAa,CAAC;AAC3C;AAEO,SAAS,mBAAmB,GAAW,GAAoB;AAChE,SAAO,UAAU,GAAG,GAAG,EAAE,gBAAgB,KAAK,CAAC;AACjD;AAEO,SAAS,YAAY,OAAeA,WAA8B,CAAC,GAAW;AACnF,QAAM,EAAE,KAAK,SAAS,IAAI,YAAY,KAAK;AAC3C,QAAM,MAAM,YAAY,GAAG;AAC3B,QAAMC,QAAO,MACT,kBAAkB,IAAI,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,KAC/D,gBAAgB,GAAG;AAEvB,SAAOD,SAAQ,mBAAmB,GAAGC,KAAI,GAAG,QAAQ,KAAKA;AAC3D;AAEO,SAAS,eACd,SACA,SACAC,OACQ;AACR,qBAAmB,OAAO;AAC1B,MAAI,CAACA,OAAM;AACT,UAAM,IAAI,mBAAmB,4BAA4B;AAAA,EAC3D;AACA,SAAO,wBAAwB,OAAO,IAAI,oBAAoB,OAAO,CAAC,IAAIA,KAAI;AAChF;;;AClIA,IAAAC,eAAmC;AACnC,oBAAuB;;;ACDvB;;;;;;;;;;;;;;ACAO,IAAM,QAAQ,IAAI,WAAW,CAAC;AAW/B,SAAU,OAAQ,IAAgB,IAAc;AACpD,MAAI,OAAO,IAAI;AAAE,WAAO;EAAK;AAC7B,MAAI,GAAG,eAAe,GAAG,YAAY;AACnC,WAAO;EACT;AAEA,WAAS,KAAK,GAAG,KAAK,GAAG,YAAY,MAAM;AACzC,QAAI,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG;AACrB,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEM,SAAU,OAAQ,GAA6C;AACnE,MAAI,aAAa,cAAc,EAAE,YAAY,SAAS,cAAc;AAAE,WAAO;EAAE;AAC/E,MAAI,aAAa,aAAa;AAAE,WAAO,IAAI,WAAW,CAAC;EAAE;AACzD,MAAI,YAAY,OAAO,CAAC,GAAG;AACzB,WAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU;EAC5D;AACA,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAMM,SAAU,WAAY,KAAW;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,GAAG;AACrC;AAEM,SAAU,SAAU,GAAa;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,CAAC;AACnC;;;ACnCA,SAAS,KAAM,UAAUC,OAAI;AAC3B,MAAI,SAAS,UAAU,KAAK;AAAE,UAAM,IAAI,UAAU,mBAAmB;EAAE;AACvE,MAAI,WAAW,IAAI,WAAW,GAAG;AACjC,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,aAAS,CAAC,IAAI;EAChB;AACA,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,QAAI,IAAI,SAAS,OAAO,CAAC;AACzB,QAAI,KAAK,EAAE,WAAW,CAAC;AACvB,QAAI,SAAS,EAAE,MAAM,KAAK;AAAE,YAAM,IAAI,UAAU,IAAI,eAAe;IAAE;AACrE,aAAS,EAAE,IAAI;EACjB;AACA,MAAI,OAAO,SAAS;AACpB,MAAI,SAAS,SAAS,OAAO,CAAC;AAC9B,MAAI,SAAS,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,GAAG;AAC1C,MAAI,UAAU,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI;AAI3C,WAASC,QAAQ,QAAM;AAErB,QAAI,kBAAkB;AAAY;aAAW,YAAY,OAAO,MAAM,GAAG;AACvE,eAAS,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;IAC7E,WAAW,MAAM,QAAQ,MAAM,GAAG;AAChC,eAAS,WAAW,KAAK,MAAM;IACjC;AACA,QAAI,EAAE,kBAAkB,aAAa;AAAE,YAAM,IAAI,UAAU,qBAAqB;IAAE;AAClF,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO;IAAG;AAErC,QAAI,SAAS;AACb,QAAIC,UAAS;AACb,QAAI,SAAS;AACb,QAAI,OAAO,OAAO;AAClB,WAAO,WAAW,QAAQ,OAAO,MAAM,MAAM,GAAG;AAC9C;AACA;IACF;AAEA,QAAI,QAAS,OAAO,UAAU,UAAU,MAAO;AAC/C,QAAI,MAAM,IAAI,WAAW,IAAI;AAE7B,WAAO,WAAW,MAAM;AACtB,UAAI,QAAQ,OAAO,MAAM;AAEzB,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,MAAM,IAAI,GAAG,MAAO;AAC9B,YAAI,GAAG,IAAK,QAAQ,SAAU;AAC9B,gBAAS,QAAQ,SAAU;MAC7B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,GAAG;AACrC;IACF;AAEA,QAAI,MAAM,OAAO,OAAO,MAAM;AAC9B,WAAO,MAAM,MAAM,EAAE,KAAK;AAAE,aAAO,SAAS,OAAO,IAAI,GAAG,CAAC;IAAG;AAC9D,WAAO;EACT;AAIA,WAAS,aAAc,QAAM;AAC3B,QAAI,OAAO,WAAW,UAAU;AAAE,YAAM,IAAI,UAAU,iBAAiB;IAAE;AACzE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,IAAI,WAAU;IAAG;AACnD,QAAI,MAAM;AAEV,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,SAAS;AACb,QAAIA,UAAS;AACb,WAAO,OAAO,GAAG,MAAM,QAAQ;AAC7B;AACA;IACF;AAEA,QAAI,QAAU,OAAO,SAAS,OAAO,SAAU,MAAO;AACtD,QAAI,OAAO,IAAI,WAAW,IAAI;AAE9B,WAAO,OAAO,GAAG,GAAG;AAElB,UAAI,QAAQ,SAAS,OAAO,WAAW,GAAG,CAAC;AAE3C,UAAI,UAAU,KAAK;AAAE;MAAO;AAC5B,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,OAAO,KAAK,GAAG,MAAO;AAChC,aAAK,GAAG,IAAK,QAAQ,QAAS;AAC9B,gBAAS,QAAQ,QAAS;MAC5B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,KAAK,GAAG,MAAM,GAAG;AACtC;IACF;AACA,QAAI,MAAM,IAAI,WAAW,UAAU,OAAO,IAAI;AAC9C,QAAIE,KAAI;AACR,WAAO,QAAQ,MAAM;AACnB,UAAIA,IAAG,IAAI,KAAK,KAAK;IACvB;AACA,WAAO;EACT;AAIA,WAASC,QAAQC,SAAM;AACrB,QAAI,SAAS,aAAaA,OAAM;AAChC,QAAI,QAAQ;AAAE,aAAO;IAAO;AAC5B,UAAM,IAAI,MAAM,OAAON,KAAI,YAAY;EACzC;AACA,SAAO;IACL,QAAQC;IACR;IACA,QAAQI;;AAEZ;AACA,IAAI,MAAM;AAEV,IAAI,kCAAkC;AAEtC,IAAA,iBAAe;;;ACjIf,IAAM,UAAN,MAAa;EAKX,YAAaE,OAAY,QAAgB,YAAoB;AAJpD;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;EACpB;EAEA,OAAQ,OAAiB;AACvB,QAAI,iBAAiB,YAAY;AAC/B,aAAO,GAAG,KAAK,MAAM,GAAG,KAAK,WAAW,KAAK,CAAC;IAChD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;;AAQF,IAAM,UAAN,MAAa;EAMX,YAAaA,OAAY,QAAgB,YAAoB;AALpD;AACA;AACA;AACQ;AAGf,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,UAAM,kBAAkB,OAAO,YAAY,CAAC;AAE5C,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI,MAAM,0BAA0B;IAC5C;AACA,SAAK,kBAAkB;AACvB,SAAK,aAAa;EACpB;EAEA,OAAQ,MAAY;AAClB,QAAI,OAAO,SAAS,UAAU;AAC5B,UAAI,KAAK,YAAY,CAAC,MAAM,KAAK,iBAAiB;AAChD,cAAM,MAAM,qCAAqC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,+CAA+C,KAAK,MAAM,EAAE;MACjJ;AACA,aAAO,KAAK,WAAW,KAAK,MAAM,KAAK,OAAO,MAAM,CAAC;IACvD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;EAEA,GAAgC,SAAmE;AACjG,WAAO,GAAG,MAAM,OAAO;EACzB;;AAKF,IAAM,kBAAN,MAAqB;EAGnB,YAAaC,WAA0B;AAF9B;AAGP,SAAK,WAAWA;EAClB;EAEA,GAAiC,SAAmE;AAClG,WAAO,GAAG,MAAM,OAAO;EACzB;EAEA,OAAQ,OAAa;AACnB,UAAM,SAAS,MAAM,CAAC;AACtB,UAAM,UAAU,KAAK,SAAS,MAAM;AACpC,QAAI,WAAW,MAAM;AACnB,aAAO,QAAQ,OAAO,KAAK;IAC7B,OAAO;AACL,YAAM,WAAW,qCAAqC,KAAK,UAAU,KAAK,CAAC,+BAA+B,OAAO,KAAK,KAAK,QAAQ,CAAC,gBAAgB;IACtJ;EACF;;AAGI,SAAU,GAAyC,MAA+C,OAA8C;AACpJ,SAAO,IAAI,gBAAgB;IACzB,GAAI,KAAK,YAAY,EAAE,CAAE,KAA2B,MAAM,GAAG,KAAI;IACjE,GAAI,MAAM,YAAY,EAAE,CAAE,MAA4B,MAAM,GAAG,MAAK;GAClD;AACtB;AAEM,IAAO,QAAP,MAAY;EAQhB,YAAaD,OAAY,QAAgB,YAAsB,YAAoB;AAP1E;AACA;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAClB,SAAK,aAAa;AAClB,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;AACnD,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;EACrD;EAEA,OAAQ,OAAiB;AACvB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;EAEA,OAAQ,OAAa;AACnB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;;AAGI,SAAU,KAAmD,EAAE,MAAAA,OAAM,QAAQ,QAAAE,SAAQ,QAAAC,QAAM,GAAsE;AACrK,SAAO,IAAI,MAAMH,OAAM,QAAQE,SAAQC,OAAM;AAC/C;AAEM,SAAU,MAAoD,EAAE,MAAAH,OAAM,QAAQ,UAAAI,UAAQ,GAAoD;AAC9I,QAAM,EAAE,QAAAF,SAAQ,QAAAC,QAAM,IAAK,eAAMC,WAAUJ,KAAI;AAC/C,SAAO,KAAK;IACV;IACA,MAAAA;IACA,QAAAE;IACA,QAAQ,CAAC,SAA6B,OAAOC,QAAO,IAAI,CAAC;GAC1D;AACH;AAEA,SAAS,OAAQE,SAAgB,aAAqC,aAAqBL,OAAY;AAErG,MAAI,MAAMK,QAAO;AACjB,SAAOA,QAAO,MAAM,CAAC,MAAM,KAAK;AAC9B,MAAE;EACJ;AAGA,QAAM,MAAM,IAAI,WAAY,MAAM,cAAc,IAAK,CAAC;AAGtD,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,KAAK,EAAE,GAAG;AAE5B,UAAM,QAAQ,YAAYA,QAAO,CAAC,CAAC;AACnC,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,YAAY,OAAOL,KAAI,YAAY;IAC/C;AAGA,aAAU,UAAU,cAAe;AACnC,YAAQ;AAGR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,UAAI,SAAS,IAAI,MAAQ,UAAU;IACrC;EACF;AAGA,MAAI,QAAQ,gBAAgB,MAAQ,UAAW,IAAI,UAAY,GAAG;AAChE,UAAM,IAAI,YAAY,wBAAwB;EAChD;AAEA,SAAO;AACT;AAEA,SAAS,OAAQ,MAAkBI,WAAkB,aAAmB;AACtE,QAAM,MAAMA,UAASA,UAAS,SAAS,CAAC,MAAM;AAC9C,QAAM,QAAQ,KAAK,eAAe;AAClC,MAAI,MAAM;AAEV,MAAI,OAAO;AACX,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;AAEpC,aAAU,UAAU,IAAK,KAAK,CAAC;AAC/B,YAAQ;AAGR,WAAO,OAAO,aAAa;AACzB,cAAQ;AACR,aAAOA,UAAS,OAAQ,UAAU,IAAK;IACzC;EACF;AAGA,MAAI,SAAS,GAAG;AACd,WAAOA,UAAS,OAAQ,UAAW,cAAc,IAAM;EACzD;AAGA,MAAI,KAAK;AACP,YAAS,IAAI,SAAS,cAAe,OAAO,GAAG;AAC7C,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAmBA,WAAgB;AAE1C,QAAM,cAAsC,CAAA;AAC5C,WAAS,IAAI,GAAG,IAAIA,UAAS,QAAQ,EAAE,GAAG;AACxC,gBAAYA,UAAS,CAAC,CAAC,IAAI;EAC7B;AACA,SAAO;AACT;AAKM,SAAU,QAAsD,EAAE,MAAAJ,OAAM,QAAQ,aAAa,UAAAI,UAAQ,GAAyE;AAClL,QAAM,cAAc,kBAAkBA,SAAQ;AAC9C,SAAO,KAAK;IACV;IACA,MAAAJ;IACA,OAAQ,OAAiB;AACvB,aAAO,OAAO,OAAOI,WAAU,WAAW;IAC5C;IACA,OAAQ,OAAa;AACnB,aAAO,OAAO,OAAO,aAAa,aAAaJ,KAAI;IACrD;GACD;AACH;;;AH9OO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,oBAAoB,QAAQ;EACvC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,UAAU,QAAQ;EAC7B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AI/DD;;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;AAEM,IAAM,cAAc,MAAM;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACZD;;;;;AAEO,IAAM,YAAY,MAAM;EAC7B,MAAM;EACN,QAAQ;EACR,UAAU;CACX;AAEM,IAAM,eAAe,MAAM;EAChC,MAAM;EACN,QAAQ;EACR,UAAU;CACX;;;ACXD,IAAI,WAAWM;AAEf,IAAI,MAAM;AAAV,IACI,OAAO;AADX,IAEI,SAAS,CAAC;AAFd,IAGI,MAAM,KAAK,IAAI,GAAG,EAAE;AAOxB,SAASA,QAAO,KAAK,KAAK,QAAM;AAC9B,QAAM,OAAO,CAAA;AACb,WAAS,UAAU;AACnB,MAAI,YAAY;AAEhB,SAAM,OAAO,KAAK;AAChB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,WAAO;EACT;AACA,SAAM,MAAM,QAAQ;AAClB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,aAAS;EACX;AACA,MAAI,MAAM,IAAI,MAAM;AAGpB,EAAAA,QAAO,QAAQ,SAAS,YAAY;AAEpC,SAAO;AACT;AAEA,IAAIC,UAAS;AAEb,IAAI,QAAQ;AAAZ,IACI,SAAS;AAMb,SAAS,KAAK,KAAK,QAAM;AACvB,MAAI,MAAS,GACT,SAAS,UAAU,GACnB,QAAS,GACT,UAAU,QACV,GACA,IAAI,IAAI;AAEZ,KAAG;AACD,QAAI,WAAW,GAAG;AAEhB,WAAK,QAAQ;AACb,YAAM,IAAI,WAAW,yBAAyB;IAChD;AACA,QAAI,IAAI,SAAS;AACjB,WAAO,QAAQ,MACV,IAAI,WAAW,SACf,IAAI,UAAU,KAAK,IAAI,GAAG,KAAK;AACpC,aAAS;EACX,SAAS,KAAK;AAGd,OAAK,QAAQ,UAAU;AAEvB,SAAO;AACT;AAEA,IAAI,KAAK,KAAK,IAAI,GAAI,CAAC;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AAEvB,IAAI,SAAS,SAAgC,OAAK;AAChD,SACE,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACA;AAEjB;AAEA,IAAI,SAAS;EACT,QAAQ;EACR,QAAQA;EACR,gBAAgB;;AAGpB,IAAI,eAAe;AAEnB,IAAA,iBAAe;;;ACrGT,SAAUC,QAAQ,MAAkB,SAAS,GAAC;AAClD,QAAMC,QAAO,eAAO,OAAO,MAAM,MAAM;AACvC,SAAO,CAACA,OAAM,eAAO,OAAO,KAAK;AACnC;AAEM,SAAU,SAAU,KAAa,QAAoB,SAAS,GAAC;AACnE,iBAAO,OAAO,KAAK,QAAQ,MAAM;AACjC,SAAO;AACT;AAEM,SAAU,eAAgB,KAAW;AACzC,SAAO,eAAO,eAAe,GAAG;AAClC;;;ACPM,SAAU,OAA8BC,OAAYC,SAAkB;AAC1E,QAAM,OAAOA,QAAO;AACpB,QAAM,aAAoB,eAAeD,KAAI;AAC7C,QAAM,eAAe,aAAoB,eAAe,IAAI;AAE5D,QAAM,QAAQ,IAAI,WAAW,eAAe,IAAI;AAChD,EAAO,SAASA,OAAM,OAAO,CAAC;AAC9B,EAAO,SAAS,MAAM,OAAO,UAAU;AACvC,QAAM,IAAIC,SAAQ,YAAY;AAE9B,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQ,KAAK;AAC7C;AAKM,SAAUC,QAAQ,WAAqB;AAC3C,QAAM,QAAQ,OAAO,SAAS;AAC9B,QAAM,CAACF,OAAM,UAAU,IAAWE,QAAO,KAAK;AAC9C,QAAM,CAAC,MAAM,YAAY,IAAWA,QAAO,MAAM,SAAS,UAAU,CAAC;AACrE,QAAMD,UAAS,MAAM,SAAS,aAAa,YAAY;AAEvD,MAAIA,QAAO,eAAe,MAAM;AAC9B,UAAM,IAAI,MAAM,kBAAkB;EACpC;AAEA,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQ,KAAK;AAC7C;AAEM,SAAUE,QAAQ,GAAoB,GAAU;AACpD,MAAI,MAAM,GAAG;AACX,WAAO;EACT,OAAO;AACL,UAAM,OAAO;AAEb,WACE,EAAE,SAAS,KAAK,QAChB,EAAE,SAAS,KAAK,QAChB,KAAK,iBAAiB,cACtB,OAAW,EAAE,OAAO,KAAK,KAAK;EAElC;AACF;AAMM,IAAO,SAAP,MAAa;;;;EASjB,YAAaH,OAAY,MAAYC,SAAoB,OAAiB;AARjE;AACA;AACA;AACA;AAMP,SAAK,OAAOD;AACZ,SAAK,OAAO;AACZ,SAAK,SAASC;AACd,SAAK,QAAQ;EACf;;;;AC1DI,SAAU,OAA0F,MAASG,OAAmC;AACpJ,QAAM,EAAE,OAAO,QAAO,IAAK;AAC3B,UAAQ,SAAS;IACf,KAAK;AACH,aAAO,WACL,OACA,UAAU,IAAI,GACdA,SAAqC,UAAU,OAAO;IAE1D;AACE,aAAO,WACL,OACA,UAAU,IAAI,GACbA,SAAQ,OAAO,OAAwC;EAE9D;AACF;AAYA,IAAM,QAAQ,oBAAI,QAAO;AAEzB,SAAS,UAAW,KAAoB;AACtC,QAAMC,aAAY,MAAM,IAAI,GAAG;AAC/B,MAAIA,cAAa,MAAM;AACrB,UAAMA,aAAY,oBAAI,IAAG;AACzB,UAAM,IAAI,KAAKA,UAAS;AACxB,WAAOA;EACT;AACA,SAAOA;AACT;AAjDA;AAmDM,IAAO,MAAP,MAAO,KAAG;;;;;;EAYd,YAAa,SAAkBC,OAAc,WAAqC,OAAiB;AAX1F;AACA;AACA;AACA;AACA;AAmHA,wBAAC,IAAsB;AA3G9B,SAAK,OAAOA;AACZ,SAAK,UAAU;AACf,SAAK,YAAY;AACjB,SAAK,QAAQ;AAIb,SAAK,GAAG,IAAI;EACd;;;;;;;EAQA,IAAI,QAAK;AACP,WAAO;EACT;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,eAAO;MACT;MACA,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,UAAS,IAAK;AAE5B,YAAIA,UAAS,aAAa;AACxB,gBAAM,IAAI,MAAM,0CAA0C;QAC5D;AAGA,YAAI,UAAU,SAAS,cAAc;AACnC,gBAAM,IAAI,MAAM,oDAAoD;QACtE;AAEA,eACE,KAAI,SACF,SAA6C;MAGnD;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,QAAAC,QAAM,IAAK,KAAK;AAC9B,cAAM,YAAmB,OAAOD,OAAMC,OAAM;AAC5C,eACE,KAAI,SAAS,KAAK,MAAM,SAAS;MAErC;MACA,KAAK,GAAG;AACN,eAAO;MACT;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAQ,OAAc;AACpB,WAAO,KAAI,OAAO,MAAM,KAAK;EAC/B;EAEA,OAAO,OAAsF,MAA4C,OAAc;AACrJ,UAAM,UAAU;AAChB,WACE,WAAW,QACX,KAAK,SAAS,QAAQ,QACtB,KAAK,YAAY,QAAQ,WAClBC,QAAO,KAAK,WAAW,QAAQ,SAAS;EAEnD;EAEA,SAAUC,OAAmC;AAC3C,WAAO,OAAO,MAAMA,KAAI;EAC1B;EAEA,SAAM;AACJ,WAAO,EAAE,KAAK,OAAO,IAAI,EAAC;EAC5B;EAEA,OAAI;AACF,WAAO;EACT;;EAMA,EAJU,YAAO,aAIhB,uBAAO,IAAI,4BAA4B,EAAC,IAAC;AACxC,WAAO,OAAO,KAAK,SAAQ,CAAE;EAC/B;;;;;;;;;;;EAYA,OAAO,MAAwF,OAA+C;AAC5I,QAAI,SAAS,MAAM;AACjB,aAAO;IACT;AAEA,UAAM,QAAQ;AACd,QAAI,iBAAiB,MAAK;AAExB,aAAO;IACT,WAAY,MAAM,GAAG,KAAK,QAAQ,MAAM,GAAG,MAAM,MAAM,SAAU,MAAM,UAAU,OAAO;AAMtF,YAAM,EAAE,SAAS,MAAAH,OAAM,WAAW,MAAK,IAAK;AAC5C,aAAO,IAAI,KACT,SACAA,OACA,WACA,SAAS,UAAU,SAASA,OAAM,UAAU,KAAK,CAAC;IAEtD,WAAW,MAAM,SAAS,MAAM,MAAM;AAIpC,YAAM,EAAE,SAAS,WAAW,MAAAA,MAAI,IAAK;AACrC,YAAMC,UAAgBG,QAAO,SAAS;AACtC,aAAO,KAAI,OAAO,SAASJ,OAAMC,OAAM;IACzC,OAAO;AAGL,aAAO;IACT;EACF;;;;;;EAOA,OAAO,OAAsF,SAAkBD,OAAcC,SAAgC;AAC3J,QAAI,OAAOD,UAAS,UAAU;AAC5B,YAAM,IAAI,MAAM,uCAAuC;IACzD;AAEA,QAAI,EAAEC,QAAO,iBAAiB,aAAa;AACzC,YAAM,IAAI,MAAM,gBAAgB;IAClC;AAEA,YAAQ,SAAS;MACf,KAAK,GAAG;AACN,YAAID,UAAS,aAAa;AACxB,gBAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB;QAEzE,OAAO;AACL,iBAAO,IAAI,KAAI,SAASA,OAAMC,SAAQA,QAAO,KAAK;QACpD;MACF;MACA,KAAK,GAAG;AACN,cAAM,QAAQ,UAAU,SAASD,OAAMC,QAAO,KAAK;AACnD,eAAO,IAAI,KAAI,SAASD,OAAMC,SAAQ,KAAK;MAC7C;MACA,SAAS;AACP,cAAM,IAAI,MAAM,iBAAiB;MACnC;IACF;EACF;;;;EAKA,OAAO,SAAuBA,SAAgD;AAC5E,WAAO,KAAI,OAAO,GAAG,aAAaA,OAAM;EAC1C;;;;;;;EAQA,OAAO,SAAyDD,OAAYC,SAAgC;AAC1G,WAAO,KAAI,OAAO,GAAGD,OAAMC,OAAM;EACnC;;;;;;;;EASA,OAAO,OAAoF,OAAuD;AAChJ,UAAM,CAAC,KAAK,SAAS,IAAI,KAAI,YAAY,KAAK;AAC9C,QAAI,UAAU,WAAW,GAAG;AAC1B,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,WAAO;EACT;;;;;;;;;;EAWA,OAAO,YAA2E,OAAyC;AACzH,UAAM,QAAQ,KAAI,aAAa,KAAK;AACpC,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,UAAM,iBAAiB,OACrB,MAAM,SAAS,YAAY,aAAa,MAAM,aAAa,CAAC;AAE9D,QAAI,eAAe,eAAe,MAAM,eAAe;AACrD,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,UAAM,cAAc,eAAe,SACjC,MAAM,gBAAgB,MAAM,UAAU;AAExC,UAAMA,UAAS,IAAW,OACxB,MAAM,eACN,MAAM,YACN,aACA,cAAc;AAEhB,UAAM,MACJ,MAAM,YAAY,IACd,KAAI,SAASA,OAA0C,IACvD,KAAI,SAAS,MAAM,OAAOA,OAAM;AACtC,WAAO,CAAC,KAAwB,MAAM,SAAS,MAAM,IAAI,CAAC;EAC5D;;;;;;;;;;EAWA,OAAO,aAA4E,cAAgD;AACjI,QAAI,SAAS;AACb,UAAM,OAAO,MAAa;AACxB,YAAM,CAAC,GAAGI,OAAM,IAAWD,QAAO,aAAa,SAAS,MAAM,CAAC;AAC/D,gBAAUC;AACV,aAAO;IACT;AAEA,QAAI,UAAU,KAAI;AAClB,QAAI,QAAQ;AACZ,QAAI,YAAsB,IAAI;AAE5B,gBAAU;AACV,eAAS;IACX,OAAO;AACL,cAAQ,KAAI;IACd;AAEA,QAAI,YAAY,KAAK,YAAY,GAAG;AAClC,YAAM,IAAI,WAAW,uBAAuB,OAAO,EAAE;IACvD;AAEA,UAAM,aAAa;AACnB,UAAM,gBAAgB,KAAI;AAC1B,UAAM,aAAa,KAAI;AACvB,UAAM,OAAO,SAAS;AACtB,UAAM,gBAAgB,OAAO;AAE7B,WAAO,EAAE,SAAS,OAAO,eAAe,YAAY,eAAe,KAAI;EACzE;;;;;;;EAQA,OAAO,MAA0G,QAAkEF,OAAmC;AACpN,UAAM,CAAC,QAAQ,KAAK,IAAI,gBAAgB,QAAQA,KAAI;AAEpD,UAAM,MAAM,KAAI,OAAO,KAAK;AAE5B,QAAI,IAAI,YAAY,KAAK,OAAO,CAAC,MAAM,KAAK;AAC1C,YAAM,MAAM,wDAAwD;IACtE;AAGA,cAAU,GAAG,EAAE,IAAI,QAAQ,MAAM;AAEjC,WAAO;EACT;;AAGF,SAAS,gBAAqH,QAAkEA,OAAmC;AACjO,UAAQ,OAAO,CAAC,GAAG;;IAEjB,KAAK,KAAK;AACR,YAAM,UAAUA,SAAQ;AACxB,aAAO;QACL,UAAU;QACV,QAAQ,OAAO,GAAG,UAAU,MAAM,GAAG,MAAM,EAAE;;IAEjD;IACA,KAAK,UAAU,QAAQ;AACrB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,UAAU,QAAkB,QAAQ,OAAO,MAAM,CAAC;IAC5D;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,SAAS;AACP,UAAIA,SAAQ,MAAM;AAChB,cAAM,MACJ,yFAAyF;MAE7F;AACA,aAAO,CAAC,OAAO,CAAC,GAAaA,MAAK,OAAO,MAAM,CAAC;IAClD;EACF;AACF;AAEA,SAAS,WAAY,OAAmBG,QAA4BH,OAA+B;AACjG,QAAM,EAAE,OAAM,IAAKA;AACnB,MAAI,WAAW,UAAU,QAAQ;AAC/B,UAAM,MAAM,8BAA8BA,MAAK,IAAI,WAAW;EAChE;AAEA,QAAM,MAAMG,OAAM,IAAI,MAAM;AAC5B,MAAI,OAAO,MAAM;AACf,UAAMC,OAAMJ,MAAK,OAAO,KAAK,EAAE,MAAM,CAAC;AACtC,IAAAG,OAAM,IAAI,QAAQC,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAO;EACT;AACF;AAEA,SAAS,WAAoC,OAAmBD,QAA4BH,OAAkC;AAC5H,QAAM,EAAE,OAAM,IAAKA;AACnB,QAAM,MAAMG,OAAM,IAAI,MAAM;AAC5B,MAAI,OAAO,MAAM;AACf,UAAMC,OAAMJ,MAAK,OAAO,KAAK;AAC7B,IAAAG,OAAM,IAAI,QAAQC,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAO;EACT;AACF;AAEA,IAAM,cAAc;AACpB,IAAM,eAAe;AAErB,SAAS,UAAW,SAAsBP,OAAc,WAAqB;AAC3E,QAAM,aAAoB,eAAe,OAAO;AAChD,QAAM,aAAa,aAAoB,eAAeA,KAAI;AAC1D,QAAM,QAAQ,IAAI,WAAW,aAAa,UAAU,UAAU;AAC9D,EAAO,SAAS,SAAS,OAAO,CAAC;AACjC,EAAO,SAASA,OAAM,OAAO,UAAU;AACvC,QAAM,IAAI,WAAW,UAAU;AAC/B,SAAO;AACT;AAEA,IAAM,YAAY,uBAAO,IAAI,kBAAkB;;;AVnc/C,IAAAQ,cAAkB;;;AWAX,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAYC,OAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,kBAAkB,OAAO;AAC/B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,yBAAyB;AAAA,EAChE,YAAY,SAAiB;AAC3B,UAAM,eAAe,OAAO;AAC5B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,uBAAuB,OAAO;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,8BAA8B,OAAO;AAC3C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iCAAN,cAA6C,yBAAyB;AAAA,EAC3E,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO;AAC5C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,yBAAyB;AAAA,EACvE,YAAY,SAAiB;AAC3B,UAAM,qBAAqB,OAAO;AAClC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,oBAAoB,OAA0C;AAC5E,MAAI,iBAAiB,0BAA0B;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,IAAI;AAAA,IACT;AAAA,IACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EACvD;AACF;;;ACzEA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAWK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAaC,SAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQA;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,qBAAqB;AAC1D,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,sBAAsB,GAAW,GAAmB;AAC3D,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,eAAe,EAAE,WAAW,KAAK;AACvC,UAAM,gBAAgB,EAAE,WAAW,KAAK;AACxC,QAAI,iBAAiB,eAAe;AAClC,aAAO,eAAe;AAAA,IACxB;AAAA,EACF;AACA,SAAO,EAAE,SAAS,EAAE;AACtB;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAMC,QAAO,MAAM,WAAW,KAAK;AACnC,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACxNA,uBAAoC;AACpC,IAAAC,eAAmC;AAInC,IAAM,cAAc,IAAI,YAAY;AAY7B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAYC,OAAiC,SAAiB;AAC5D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAiBA,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,IAAM,mBAAmB,oBAAI,IAAI,CAAC,gBAAgB,iBAAiB,eAAe,CAAC;AACnF,IAAM,oBAAoB,oBAAI,IAAiC;AAE/D,WAAW,SAAS,sCAAqB;AACvC,MAAI,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAAG;AACxC;AAAA,EACF;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,YAAY,UAAa,MAAM,IAAI,SAAS,IAAI,GAAG;AAC1F;AAAA,EACF;AACA,QAAM,WAAW,kBAAkB,IAAI,MAAM,OAAO;AACpD,MAAI,aAAa,QAAW;AAC1B,sBAAkB,IAAI,MAAM,SAAS,oBAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD;AAAA,EACF;AACA,EAAC,SAAyB,IAAI,MAAM,GAAG;AACzC;AAOO,SAAS,0BAA0B,OAAkC;AAC1E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAOO,SAAS,6BAA6B,OAAkC;AAC7E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAYO,SAAS,yBAAyB,WAAoB,SAA2B;AACtF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,6BAA6B,SAAS;AAC7C,UAAM,6BAA6B,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,IAAI,OAAO;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,GAAG;AACtC,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI,IAAI,KAAK,OAAO;AACxC,aAAW,UAAU,IAAI,SAAS;AAChC,QAAI,CAAC,YAAY,IAAI,MAAM,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,eAAe,KAAK,SAAS,IAAI,OAAO;AACjD;AAEA,SAAS,qCACP,OACAC,UACkB;AAClB,QAAM,SAAS,aAAa,OAAO,GAAG;AACtC,kBAAgB,QAAQ,CAAC,WAAW,SAAS,QAAQ,WAAW,SAAS,GAAG,GAAG;AAC/E,QAAM,UAAU,eAAe,QAAQ,WAAW,KAAK,qCAAqC;AAC5F,MAAI,CAAC,iBAAiB,IAAI,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,eAAe,QAAQ,SAAS,KAAK,mCAAmC;AACtF,wBAAsB,KAAK;AAC3B,QAAM,iBAAiB,MAAM,UAAU,KAAK;AAC5C,MAAIA,SAAQ,oBAAoB,mBAAmB,OAAO;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,eAAe,QAAQ,QAAQ,KAAK,kCAAkC;AACtF,kBAAgB,SAASA,QAAO;AAChC,QAAM,OAAO,cAAc,OAAO;AAClC,MAAIA,SAAQ,oBAAoB,SAAS,SAAS;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,MAAMA,QAAO;AAC7B,QAAM,UAAU;AAAA,IACd,cAAc,QAAQ,WAAW,KAAK,oCAAoC;AAAA,IAC1E;AAAA,IACAA;AAAA,EACF;AACA,QAAM,SAAS,uBAAO,OAAO,IAAI;AAOjC,SAAO,UAAU;AACjB,SAAO,QAAQ;AACf,SAAO,OAAO;AACd,SAAO,UAAU;AACjB,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,WAAO,UAAU;AAAA,MACf,cAAc,QAAQ,WAAW,KAAK,qCAAqC;AAAA,MAC3E,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,MAA0B;AAC9D,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AACtF,YAAM,IAAI,sBAAsB,+BAA+B,GAAG,IAAI,oBAAoB;AAAA,IAC5F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB;AAC1C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,QAAQ,QAAQ,QAAQ,UAAU,gCAAgC;AAAA,QAClE,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cACP,QACA,KACA,MACAC,OACW;AACX,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACpE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,eACP,QACA,KACA,MACAA,OACQ;AACR,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAMA,KAAI;AACnD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,6BAA6B;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,cACP,QACA,KACA,MACAA,OACsB;AACtB,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAMA,KAAI;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,mBAAmB;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAqB;AAClD,MAAI,UAAU,OAAO,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AACtF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,MAAcD,UAAiC;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,sBAAsB,oCAAoC,iBAAiB;AAAA,EACvF;AACA,MAAI,CAACA,SAAQ,oBAAoB,KAAK,SAAS,GAAG,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG;AAC9C,UAAM,IAAI,sBAAsB,oCAAoC,yBAAyB;AAAA,EAC/F;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS;AACpD,UAAM,UAAU,SAAS,KAAK;AAC9B,UAAM,0BACJA,SAAQ,oBAAoB,UAAU,SAAS,SAAS,KAAK,QAAQ,WAAW;AAClF,QAAI,QAAQ,WAAW,KAAK,CAAC,yBAAyB;AACpD,YAAM,IAAI,sBAAsB,oCAAoC,6BAA6B;AAAA,IACnG;AACA,QAAI,YAAY,OAAO,YAAY,MAAM;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,YAAY,OAAO,YAAY,OAAO,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACxF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,iBAAiB,IAAI,EAAE,UAAU,KAAK;AAC/C;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,CAAC,YAAY;AACnD,UAAM,OAAO,OAAO,aAAa,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC;AACtE,WAAO,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,YAAY;AAAA,EACrE,CAAC;AACH;AAEA,SAAS,iBACP,SACA,SACAA,UACU;AACV,QAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,aAAuB,CAAC;AAC9B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,UAAM,SAAS,QAAQ,KAAK;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW,GAAG,OAAO,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,eAAW,KAAK,MAAM;AACtB,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,CAAC,GAAG,MAAM,EAAE,KAAK;AAC3C,MACEA,SAAQ,qBACP,WAAW,WAAW,kBAAkB,UACvC,WAAW,KAAK,CAAC,QAAQ,UAAU,WAAW,kBAAkB,KAAK,CAAC,IACxE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAkB,SAAkD;AAC3F,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,iBAAiB;AAC/B,WAAO,mBAAmB,KAAmB;AAAA,EAC/C;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA+B;AACzD,mBAAiB,OAAO,CAAC,QAAQ,YAAY,YAAY,GAAG,WAAW;AACvE,QAAM,OAAO,aAAa,OAAO,QAAQ,WAAW;AACpD,MAAI,SAAS,0BAA0B;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,OAAO,YAAY,WAAW,MAAM,MAAM;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,eAAe,OAAO,cAAc,WAAW;AAClE,MAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS;AACtD,yBAAqB,WAAW,KAAK,GAAG,wBAAwB,KAAK,GAAG;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAkB,MAAoB;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,QAAQ,OAAO,aAAa,GAAG,IAAI;AAC7D,eAAa,QAAQ,QAAQ,IAAI;AACjC,eAAa,QAAQ,OAAO,IAAI;AAChC,QAAM,cAAc,eAAe,QAAQ,eAAe,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,uBAAmB,YAAY,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAAA,EACxE;AACF;AAEA,SAAS,mBAAmB,OAAkB,MAAoB;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,SAAS,OAAO,GAAG,IAAI;AACjD,QAAM,QAAQ,eAAe,QAAQ,SAAS,IAAI;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,iBAAe,QAAQ,SAAS,IAAI;AACtC;AAEA,SAAS,iBAAiB,QAAoB,SAA4B,MAAoB;AAC5F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAyB;AAChF,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,QAAoB,KAAa,MAAsB;AAC3E,QAAM,QAAQ,eAAe,QAAQ,KAAK,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,WAAmB,SAA0B;AACjE,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,SAAO,UAAU,SAAS,GAAG,KAAK,QAAQ,WAAW,SAAS;AAChE;AAEA,SAAS,eAAe,WAAmC,SAA0C;AACnG,MAAI,cAAc,QAAW;AAC3B,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,KAAK,SAAS,EAAE,WAAW;AAAA,EAC3C;AACA,MAAI,UAAU,SAAS,4BAA4B,QAAQ,SAAS,0BAA0B;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,sBAAsB,MAAM,QAAQ,UAAU,UAAU,IAAI,UAAU,aAAa,CAAC;AAC1F,QAAM,oBAAoB,MAAM,QAAQ,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC;AACpF,SAAO,kBAAkB;AAAA,IAAM,CAAC,cAC9B,oBAAoB,KAAK,CAAC,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,SAAS,OAAO,QAAoB,KAAsB;AACxD,SAAOE,cAAa,QAAQ,GAAG;AACjC;;;AC3eA,qBAAwB;;;ACAxB;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACND;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACdD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAEA,IAAM,WAAW,MAAM,KAAK,orEAAwe;AACpgB,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAAG,IAAE,CAAC,IAAI;AAAG,SAAO;AAAE,GAAI,CAAA,CAAG;AAC3G,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAC5E,QAAM,YAAY,EAAE,YAAY,CAAC;AACjC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,MAAM,sBAAsB,CAAC,EAAE;EAC3C;AACA,IAAE,SAAS,IAAI;AACf,SAAO;AACT,GAAI,CAAA,CAAG;AAEP,SAASC,QAAQ,MAAgB;AAC/B,SAAO,KAAK,OAAO,CAAC,GAAG,MAAK;AAC1B,SAAK,qBAAqB,CAAC;AAC3B,WAAO;EACT,GAAG,EAAE;AACP;AAEA,SAASC,QAAQ,KAAW;AAC1B,QAAM,OAAO,CAAA;AACb,aAAW,QAAQ,KAAK;AACtB,UAAM,YAAY,KAAK,YAAY,CAAC;AACpC,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI,MAAM,sBAAsB,IAAI,EAAE;IAC9C;AACA,UAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAI,OAAO,MAAM;AACf,YAAM,IAAI,MAAM,+BAA+B,IAAI,EAAE;IACvD;AACA,SAAK,KAAK,GAAG;EACf;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAEO,IAAM,eAAe,KAAK;EAC/B,QAAQ;EACR,MAAM;EACN,QAAAD;EACA,QAAAC;CACD;;;ACzCD;;;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AC5BD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAGO,IAAM,WAAW,KAAK;EAC3B,QAAQ;EACR,MAAM;EACN,QAAQ,CAAC,QAAQ,SAAS,GAAG;EAC7B,QAAQ,CAAC,QAAQ,WAAW,GAAG;CAChC;;;ACND,IAAMC,eAAc,IAAI,YAAW;AACnC,IAAM,cAAc,IAAI,YAAW;;;ACHnC,IAAAC,oBAAA;SAAAA,mBAAA;kBAAAC;;AAIA,IAAM,OAAY;AAClB,IAAM,OAAO;AAEb,IAAMC,UAA4C;AAElD,SAAS,OAAQ,OAAmBC,UAAuB;AACzD,MAAIA,UAAS,YAAY,QAAQA,SAAQ,aAAa,MAAM,YAAY;AACtE,QAAIA,SAAQ,WAAW,KAAKA,SAAQ,WAAW,MAAM,YAAY;AAC/D,YAAM,IAAI,MAAM,0DAA0D,MAAM,UAAU,EAAE;IAC9F;AAEA,YAAQ,MAAM,SAAS,GAAGA,SAAQ,QAAQ;EAC5C;AAEA,SAAc,OAAO,MAAMD,QAAO,KAAK,CAAC;AAC1C;AAEO,IAAME,YAAW,EAAE,MAAM,MAAM,QAAAF,SAAQ,OAAM;;;ACrBpD;;gBAAAG;EAAA;;oBAAmB;;;ACKnB,IAAM,4BAA4B;AAqB5B,SAAUC,MAAiD,EAAE,MAAAC,OAAM,MAAAC,OAAM,QAAAC,SAAQ,iBAAiB,gBAAe,GAA0B;AAC/I,SAAO,IAAI,OAAOF,OAAMC,OAAMC,SAAQ,iBAAiB,eAAe;AACxE;AAoBM,IAAO,SAAP,MAAa;EAOjB,YAAaF,OAAYC,OAAYC,SAAkD,iBAA0B,iBAAwB;AANhI;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOF;AACZ,SAAK,OAAOC;AACZ,SAAK,SAASC;AACd,SAAK,kBAAkB,mBAAmB;AAC1C,SAAK,kBAAkB;EACzB;EAEA,OAAQ,OAAmBC,UAAuB;AAChD,QAAIA,UAAS,YAAY,MAAM;AAC7B,UAAIA,SAAQ,WAAW,KAAK,iBAAiB;AAC3C,cAAM,IAAI,MAAM,6DAA6D,KAAK,eAAe,EAAE;MACrG;AAEA,UAAI,KAAK,mBAAmB,QAAQA,SAAQ,WAAW,KAAK,iBAAiB;AAC3E,cAAM,IAAI,MAAM,0DAA0D,KAAK,eAAe,EAAE;MAClG;IACF;AAEA,QAAI,iBAAiB,YAAY;AAC/B,YAAM,SAAS,KAAK,OAAO,KAAK;AAEhC,UAAI,kBAAkB,YAAY;AAChC,eAAO,aAAa,QAAQ,KAAK,MAAMA,UAAS,QAAQ;MAC1D;AAEA,aAAO,OAAO,KAAK,CAAAC,YAAU,aAAaA,SAAQ,KAAK,MAAMD,UAAS,QAAQ,CAAC;IACjF,OAAO;AACL,YAAM,MAAM,mCAAmC;IAEjD;EACF;;AAOF,SAAS,aAAoCC,SAAoBH,OAAY,UAAiB;AAC5F,MAAI,YAAY,QAAQ,aAAaG,QAAO,YAAY;AACtD,QAAI,WAAWA,QAAO,YAAY;AAChC,YAAM,IAAI,MAAM,0DAA0DA,QAAO,UAAU,EAAE;IAC/F;AAEA,IAAAA,UAASA,QAAO,SAAS,GAAG,QAAQ;EACtC;AAEA,SAAc,OAAOH,OAAMG,OAAM;AACnC;;;ADnGO,IAAMC,UAASC,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,CAAC,UAAU,OAAO,cAAAC,QAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAM,CAAE;CAC7E;AAEM,IAAM,SAASD,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,WAAS,OAAO,cAAAC,QAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAM,CAAE;CAC3E;;;AEEM,IAAM,QAAQ,EAAE,GAAG,kBAAc,GAAG,eAAO,GAAG,eAAO,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,qBAAY;AACtI,IAAM,SAAS,EAAE,GAAG,cAAM,GAAGC,kBAAQ;;;AZf5C,IAAAC,eAAkD;AAgB3C,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AAC7B,IAAM,8BACX;AAEK,IAAM,8BAA8B;AACpC,IAAM,6BACX;AA0GF,IAAM,cAA0D;AAAA,EAC9D,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AACxB,IAAM,eAAe;AACrB,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEK,SAAS,iCAAiC,OAAwB;AACvE,SAAO,gBAAgB,KAAK;AAC9B;AAEO,SAAS,2BAA2B,OAAsC;AAC/E,QAAM,aAAa,sBAAsB,KAAK;AAC9C,QAAM,WAAW,8BAA8B,OAAO,UAAU;AAChE,SAAO,oBAAoB,UAAU,UAAU;AACjD;AAEO,SAAS,kBAAkB,OAAwB;AACxD,SAAO,2BAA2B,KAAK,EAAE;AAC3C;AAEA,eAAsB,0BACpB,OACA,QAC6B;AAC7B,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,aAAa,sBAAsB,UAAU;AACnD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,8BAA8B,UAAU,UAAU;AACnE,MAAI,WAAW,SAAS,UAAU;AAChC,+CAA2C,QAAQ;AAAA,EACrD;AACA,gCAA8B,OAAO,KAAK;AAC1C,oBAAkB,OAAO,WAAW,oBAAoB;AACxD,8BAA4B,OAAO,WAAW,OAAO,KAAK;AAC1D,mCAAiC,UAAU,OAAO,SAAS;AAC3D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,QAAM,iBAAiB;AAAA,IACrB,MAAM,OAAO,WAAW,SAAS,MAAM;AAAA,IACvC,OAAO;AAAA,EACT;AACA,QAAM,YAAY,kBAAkB;AAAA,IAClC,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,OAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,WAAW,OAAO,GAAG,SAAS;AAAA,IAC/B;AAAA,EACF;AACF;AAEO,SAAS,oBACd,OACA,QACiB;AACjB,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,0BAA0B,MAAM;AAAA,EAClC;AACF;AAEO,SAAS,0BACd,OACA,QACuB;AACvB,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,gCAAgC,MAAM;AAAA,EACxC;AACF;AAEO,SAAS,gCACd,OACA,QAC6B;AAC7B,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,sCAAsC,MAAM;AAAA,EAC9C;AACF;AAEA,eAAsB,mBACpB,OACyE;AACzE,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,aAAa;AACnB,QAAM,aAAa,oBAAoB,OAAO,MAAM;AACpD,QAAM,YAAY,kBAAkB,OAAO,SAAS;AACpD,mCAAiC,YAAY,SAAS;AACtD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,kBAAgB,YAAY,UAAU,UAAU;AAChD,MAAI,CAAE,MAAM,gBAAgB,WAAW,SAAS,MAAM,GAAI;AACxD,UAAM,IAAI,2BAA2B,+BAA+B;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,QAAQ,SAAS;AACpC;AAEA,eAAsB,aACpB,OAC6D;AAC7D,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,0BAA0B,OAAO,MAAM;AAAA,IAC/C,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,mBACpB,OACmE;AACnE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,gCAAgC,OAAO,MAAM;AAAA,IACrD,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,yBACpB,OACyE;AACzE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,sCAAsC,OAAO,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,qBACpB,OACiD;AACjD,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,KAAK;AACvC,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEA,eAAsB,2BACpB,OACuD;AACvD,MAAI;AACF,UAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEA,eAAsB,iCACpB,OAC6D;AAC7D,MAAI;AACF,UAAM,SAAS,MAAM,yBAAyB,KAAK;AACnD,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEO,SAAS,uBAAuB,OAAgC;AACrE,SAAO,oBAAoB,OAAO,KAAK;AACzC;AAEO,SAAS,6BAA6B,OAAsC;AACjF,SAAO,0BAA0B,OAAO,KAAK;AAC/C;AAEO,SAAS,mCACd,OAC4B;AAC5B,SAAO,gCAAgC,OAAO,KAAK;AACrD;AAEO,SAAS,0BAA0B,OAAwB;AAChE,SAAO,oBAAoB,OAAO,IAAI;AACxC;AAEO,SAAS,gCAAgC,OAA8B;AAC5E,SAAO,0BAA0B,OAAO,IAAI;AAC9C;AAEO,SAAS,sCACd,OACoB;AACpB,SAAO,gCAAgC,OAAO,IAAI;AACpD;AAEA,SAAS,0BAA0B,OAAoC;AACrE,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,SAASC,gBAAe,YAAY,UAAU,GAAG;AACvD,QAAM,aAAa,oBAAoB,MAAM;AAC7C,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,0BAA0B,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,gCAAgC,UAAU;AAAA,IACnD,KAAK;AACH,aAAO,sCAAsC,UAAU;AAAA,EAC3D;AACF;AAEA,SAAS,8BACP,OACA,YACY;AACZ,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,uBAAuB,KAAK;AAAA,IACrC,KAAK;AACH,aAAO,6BAA6B,KAAK;AAAA,IAC3C,KAAK;AACH,aAAO,mCAAmC,KAAK;AAAA,EACnD;AACF;AAEA,SAAS,oBAAoB,OAAgB,QAA6B;AACxE,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYD,gBAAe,QAAQ,UAAU,GAAG,GAAG,eAAe,UAAU;AAC5E,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,yBAAuBE,eAAc,QAAQ,YAAY,GAAG,GAAG,YAAY;AAC3E,qBAAmBA,eAAc,QAAQ,QAAQ,GAAG,GAAG,QAAQ;AAC/D,gBAAcA,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAC5D,MAAIC,QAAO,QAAQ,YAAY,GAAG;AAChC,uBAAmBD,eAAc,QAAQ,cAAc,GAAG,GAAG,cAAc;AAAA,EAC7E;AACA,MAAIC,QAAO,QAAQ,OAAO,GAAG;AAC3B,kBAAcD,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgB,QAA6B;AAC9E,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAD;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYD,gBAAe,QAAQ,UAAU,GAAG,GAAG,sBAAsB,UAAU;AACnF,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,kBAAgB,QAAQ,YAAY,KAAK,CAAC;AAC1C,cAAYA,gBAAe,QAAQ,eAAe,GAAG,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG,eAAe;AAClB,qBAAmB,QAAQ,eAAe,GAAG;AAC7C,iBAAe,QAAQ,cAAc,GAAG;AACxC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,gCACP,OACA,QACY;AACZ,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA;AAAA,IACED,gBAAe,QAAQ,UAAU,GAAG;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC;AAAA,IAAoB;AAAA,IAAQ;AAAA,IAA2B;AAAA,IAAK,CAAC,OAAO,SAClE,YAAY,OAAO,MAAM,IAAI;AAAA,EAC/B;AACA,sBAAoB,QAAQ,8BAA8B,GAAG;AAC7D,EAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuC;AAChE,QAAM,SAAS,iBAAiB,OAAO,aAAa;AACpD,EAAAC,iBAAgB,QAAQ,CAAC,SAAS,aAAa,OAAO,GAAG,aAAa;AACtE,QAAM,QAAQD,gBAAe,QAAQ,SAAS,aAAa;AAC3D,gCAA8B,KAAK;AACnC,QAAM,YAAYA,gBAAe,QAAQ,aAAa,aAAa;AACnE,QAAM,QAAQA,gBAAe,QAAQ,SAAS,aAAa;AAC3D,uBAAqB,OAAO,KAAK;AACjC,SAAO,EAAE,OAAO,WAAW,MAAM;AACnC;AAEA,SAAS,uBAAuB,OAAgB,MAAoB;AAClE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,gBAAgB,cAAc,oBAAoB,GAAG,IAAI;AAClF,EAAAD,gBAAe,QAAQ,gBAAgB,IAAI;AAC3C,EAAAA,gBAAe,QAAQ,cAAc,IAAI;AACzC,QAAM,UAAUI,eAAc,QAAQ,sBAAsB,MAAM,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,6BAAyB,QAAQ,KAAK,GAAG,GAAG,IAAI,uBAAuB,KAAK,GAAG;AAAA,EACjF;AACF;AAEA,SAAS,2CAA2C,OAAyB;AAC3E,QAAM,WAAW,iBAAiBF,eAAc,OAAO,YAAY,GAAG,GAAG,YAAY;AACrF,QAAM,UAAUE,eAAc,UAAU,sBAAsB,cAAc,CAAC;AAC7E,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD;AAAA,MACE,QAAQ,KAAK;AAAA,MACb,iCAAiC,KAAK;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,OAAgB,MAAoB;AACpE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,6BAA6B,MAAM;AACrD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,0CAA0C;AAAA,IACrF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,mCAAmC,OAAgB,MAAoB;AAC9E,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,0BAA0B,MAAM;AAClD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,iDAAiD;AAAA,IAC5F;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,wBAAwB,GAAG,IAAI,uCAAuC;AAAA,EAClF;AACA,QAAM,MAAM,KAAK,CAAC;AAClB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,SAASA,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,aAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,yBAAmB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK,GAAG;AAAA,IAC9D;AACA;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,iBAAiBF,eAAc,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,UAAU;AAC1F,IAAAD,iBAAgB,SAAS,CAAC,KAAK,GAAG,GAAG,IAAI,UAAU;AACnD,IAAAD,gBAAe,SAAS,OAAO,GAAG,IAAI,UAAU;AAChD;AAAA,EACF;AACA,MAAI,QAAQ,YAAY;AACtB,gCAA4BE,eAAc,QAAQ,YAAY,IAAI,GAAG,GAAG,IAAI,WAAW;AACvF;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,+BAA+B,GAAG,EAAE;AAC/E;AAEA,SAAS,4BAA4B,OAAgB,MAAoB;AACvE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD;AAAA,IACE;AAAA,IACA,CAAC,iBAAiB,YAAY,gBAAgB,aAAa,WAAW;AAAA,IACtE;AAAA,EACF;AACA,EAAAD,gBAAe,QAAQ,iBAAiB,IAAI;AAC5C,EAAAA,gBAAe,QAAQ,YAAY,IAAI;AACvC,EAAAE,eAAc,QAAQ,gBAAgB,IAAI;AAC1C,MAAIC,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBD,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAD;AAAA,MACE;AAAA,MACA,CAAC,WAAW,mBAAmB,4BAA4B;AAAA,MAC3D,GAAG,IAAI;AAAA,IACT;AACA,mBAAe,WAAW,WAAW,GAAG,IAAI,YAAY;AACxD,QAAIE,QAAO,WAAW,iBAAiB,GAAG;AACxC,0BAAoB,WAAW,mBAAmB,GAAG,IAAI,YAAY;AAAA,IACvE;AACA,oBAAgB,WAAW,8BAA8B,GAAG,IAAI,YAAY;AAAA,EAC9E;AACA,MAAIA,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBD,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAD,iBAAgB,WAAW,CAAC,qBAAqB,GAAG,GAAG,IAAI,YAAY;AACvE,oBAAgB,WAAW,uBAAuB,GAAG,IAAI,cAAc,CAAC;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAA,iBAAgB,QAAQ,CAAC,UAAU,iBAAiB,kBAAkB,YAAY,GAAG,IAAI;AACzF,cAAYD,gBAAe,QAAQ,UAAU,IAAI,GAAG,uBAAuB,GAAG,IAAI,SAAS;AAC3F,kBAAgB,QAAQ,iBAAiB,MAAM,CAAC;AAChD,cAAYA,gBAAe,QAAQ,kBAAkB,IAAI,GAAG;AAAA,IAC1D;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,iBAAiB;AAC3B,cAAYA,gBAAe,QAAQ,cAAc,IAAI,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,aAAa;AACzB;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,QAAQ,GAAG,IAAI;AACxC,cAAYD,gBAAe,QAAQ,UAAU,IAAI,GAAG,CAAC,QAAQ,QAAQ,OAAO,GAAG,GAAG,IAAI,SAAS;AACjG;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,UAAU,GAAG,IAAI;AAC1C,cAAYD,gBAAe,QAAQ,YAAY,IAAI,GAAG,CAAC,OAAO,YAAY,MAAM,GAAG,GAAG,IAAI,WAAW;AACvG;AAEA,SAAS,oBACP,UACA,YACsB;AACtB,QAAM,MAAM,gBAAgB,QAAQ;AACpC,QAAM,WAAWF,aAAY,OAAO,GAAG;AACvC,QAAMO,UAAS,YAAY,YAAYP,aAAY,OAAO,GAAG,WAAW,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC9F,QAAM,KAAK,GAAG,WAAW,QAAQ,GAAG,iBAAiBO,OAAM,CAAC;AAC5D,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAAA;AAAA,IACA,eAAW,yBAAWA,OAAM,EAAE,MAAM,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,gBACP,QACA,UACA,YACM;AACN,QAAM,SAASL,gBAAe,QAAQ,WAAW,SAAS,GAAG;AAC7D,MAAI,WAAW,SAAS,IAAI;AAC1B;AAAA,EACF;AACA,MAAI,IAAI,OAAO,IAAI,WAAW,QAAQ,eAAe,EAAE,KAAK,MAAM,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,OAAO;AAAA,IACvB;AAAA,EACF;AACA,QAAM,IAAI,oBAAoB,GAAG,WAAW,OAAO,mBAAmB,WAAW,QAAQ,EAAE;AAC7F;AAEA,SAAS,iCACP,UACA,WACM;AACN,MAAI,CAACG,QAAO,UAAU,eAAe,GAAG;AACtC;AAAA,EACF;AACA,QAAM,gBAAgBH,gBAAe,UAAU,iBAAiB,GAAG;AACnE,MAAI,kBAAkB,WAAW;AAC/B,UAAM,IAAI;AAAA,MACR,cAAc,SAAS,iCAAiC,aAAa;AAAA,IACvE;AAAA,EACF;AACF;AAEA,SAAS,iCACP,QACA,WACM;AACN,MAAI,CAACG,QAAO,QAAQ,eAAe,GAAG;AACpC;AAAA,EACF;AACA,QAAM,gBAAgBH,gBAAe,QAAQ,iBAAiB,GAAG;AACjE,MAAI,UAAU,cAAc,eAAe;AACzC,UAAM,IAAI;AAAA,MACR,uBAAuB,UAAU,SAAS,iCAAiC,aAAa;AAAA,IAC1F;AAAA,EACF;AACF;AAEA,SAAS,4BACP,WACA,OACM;AACN,MAAI,UAAU,6BAA6B;AACzC,+BAA2B,SAAS;AACpC;AAAA,EACF;AACA,MAAI,UAAU,4BAA4B;AACxC,gBAAY,SAAS;AACrB;AAAA,EACF;AACA,QAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAClF;AAEA,eAAe,gBACb,WACAK,SACkB;AAClB,MAAI,UAAU,UAAU,6BAA6B;AACnD,UAAM,YAAY,2BAA2B,UAAU,SAAS;AAChE,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,aAAO,uBAAQ,OAAO,gBAAgBA,SAAQ,SAAS;AAAA,IACzD,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,UAAU,UAAU,4BAA4B;AAClD,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,iBAAO,4BAAc;AAAA,QACnB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,KAAKA,QAAO;AAAA,QACvB,eAAW,yBAAW,cAAc;AAAA,MACtC,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,QAAM,IAAI,+BAA+B,gCAAgC,UAAU,KAAK,EAAE;AAC5F;AAEA,SAAS,2BAA2B,KAAyB;AAC3D,MAAI,CAAC,IAAI,WAAW,UAAU,GAAG;AAC/B,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI,uBAAuB,sCAAsC;AAAA,EACzE;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,UAAU,OAAO,UAAU;AAAA,EAC3C,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI,uBAAuB,yCAAyC;AAC5E;AAEA,SAAS,YAAY,KAAyC;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,YAAY,GAAG;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ;AACnC;AAEA,SAAS,qBAAqB,OAAe,OAAmC;AAC9E,MAAI,MAAM,WAAW,KAAK,CAAC,aAAa,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG,GAAG;AAC1E,UAAM,IAAI,uBAAuB,mDAAmD;AAAA,EACtF;AACA,QAAM,QAAQ,gBAAgB,KAAK;AACnC,MAAI,UAAU,+BAA+B,MAAM,WAAW,IAAI;AAChE,UAAM,IAAI,uBAAuB,oCAAoC;AAAA,EACvE;AACA,MAAI,UAAU,4BAA4B;AACxC,QAAI,MAAM,WAAW,IAAI;AACvB,YAAM,IAAI,uBAAuB,oCAAoC;AAAA,IACvE;AACA,UAAM,IAAI,MAAM,EAAE;AAClB,QAAI,MAAM,MAAM,MAAM,IAAI;AACxB,YAAM,IAAI,uBAAuB,gDAAgD;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,OACQ;AACR,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAMC,WAAU,MAAM,WAAW,IAAI,IACjC,gBAAgB,WAAW,KAAK,CAAC,IACjC;AACJ,yBAAqBA,UAAS,KAAK;AACnC,WAAOA;AAAA,EACT;AACA,QAAM,UAAU,gBAAgB,KAAK;AACrC,uBAAqB,SAAS,KAAK;AACnC,SAAO;AACT;AAEA,SAAS,uBACP,QACA,YACY;AACZ,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW,WAAW,QAAQ,aAAa;AACrD;AAAA,IACF;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAkC;AAC/D,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,SAAO,oBAAoBN,gBAAe,QAAQ,UAAU,GAAG,CAAC;AAClE;AAEA,SAAS,oBAAoB,QAAkC;AAC7D,MAAI,WAAW,cAAe,QAAO,YAAY;AACjD,MAAI,WAAW,qBAAsB,QAAO,YAAY;AACxD,MAAI,WAAW,4BAA6B,QAAO,YAAY;AAC/D,QAAM,IAAI,wBAAwB,qCAAqC,MAAM,EAAE;AACjF;AAEA,SAAS,iBAAiB,OAAgB,MAA0B;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAASC,iBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB,GAAG,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAASC,eAAc,QAAoB,KAAa,MAAyB;AAC/E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EAChE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASH,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,SAAO,kBAAkBE,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AAC7E;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAoB;AAC3E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,oBAAkBD,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACtE;AAEA,SAAS,kBAAkB,OAAkB,MAAsB;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,wBAAwB,GAAG,IAAI,6BAA6B;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAoB,KAAa,MAAoB;AAC5E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,MAAI,OAAOD,eAAc,QAAQ,KAAK,IAAI,MAAM,WAAW;AACzD,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,oBAAoB;AAAA,EACtE;AACF;AAEA,SAAS,gBACP,QACA,KACA,MACA,SACQ;AACR,QAAM,QAAQA,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,SAAS;AAChF,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,0BAA0B,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASE,eACP,QACA,KACA,MACA,SACsB;AACtB,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS;AACnD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,mCAAmC,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBACP,QACA,KACA,MACA,OACM;AACN,QAAM,SAASE,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,WAAW,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AACxC,UAAM,QAAQ,kBAAkB,OAAO,KAAK,GAAG,QAAQ;AACvD,YAAQ,OAAO,QAAQ;AAAA,EACzB;AACF;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,gBAAcJ,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,MAAI,CAACG,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,gBAAcH,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,cAAc,OAAe,MAAoB;AACxD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B;AAAA,EACrE;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,yCAAyC;AAAA,EACpF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,4CAA4C;AAAA,EACvF;AACF;AAEA,SAAS,YAA8B,QAAgB,UAAa,MAAiB;AACnF,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,YAAY,QAAQ,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,SACA,MACG;AACH,aAAW,SAAS,SAAS;AAC3B,QAAI,WAAW,OAAO;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B,MAAM,EAAE;AAC7E;AAEA,SAASG,QAAO,QAAoB,KAAsB;AACxD,SAAOJ,cAAa,QAAQ,GAAG;AACjC;AAEA,SAAS,8BAA8B,OAAgD;AACrF,MAAI,UAAU,+BAA+B,UAAU,4BAA4B;AACjF,UAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,YAAY,OAA+B;AAClD,aAAO,qBAAO,OAAO,OAAO;AAC9B;AAEA,SAAS,YAAY,MAAkB,OAA+B;AACpE,QAAM,SAAS,IAAI,WAAW,KAAK,SAAS,MAAM,MAAM;AACxD,SAAO,IAAI,MAAM,CAAC;AAClB,SAAO,IAAI,OAAO,KAAK,MAAM;AAC7B,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,gBAAU,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IACjD;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,cAAU,gBAAiB,UAAW,IAAI,OAAS,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAMQ,YACJ;AACF,MAAI,SAAS;AACb,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK;AACrB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACpD,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAUA,UAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAUA,UAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,QAAMA,YACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQA,UAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI,uBAAuB,kCAAkC;AAAA,IACrE;AACA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,WAAW,KAAK,KAAK;AACrC,MAAI,gBAAgB,OAAO,MAAM,OAAO;AACtC,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,QAAM,MAAM,MAAM,MAAM,CAAC;AACzB,MAAI,IAAI,SAAS,MAAM,KAAK,CAAC,iBAAiB,KAAK,GAAG,GAAG;AACvD,UAAM,IAAI,uBAAuB,qCAAqC;AAAA,EACxE;AACA,QAAM,SAAS,IAAI,WAAW,IAAI,SAAS,CAAC;AAC5C,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,WAAO,KAAK,IAAI,OAAO,SAAS,IAAI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;;;AarlCO,IAAM,oCACX;AACK,IAAM,6BACX;AACK,IAAM,oBAAoB;AAC1B,IAAM,6BAA6B;AAiBnC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAYC,OAAgC,SAAiB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AA0TA,eAAsB,qCACpBC,UAC6B;AAC7B,QAAM,aAAaC,cAAaD,UAAS,KAAK,4BAA4B;AAC1E,EAAAE;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAACC,QAAO,YAAY,cAAc,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,WAAW,cAAc;AAC9C,MACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe;AACrB,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,mBAAmB,WAAW,0BAA0B;AAC1E,QAAM,QAAQ,mBAAmB,KAAK,OAAO;AAC7C,MAAI,aAAa,OAAO;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,yBAAyB,YAAY,GAAG;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,SAAS,UAAU,cAAc,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmBC,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmBA,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,wBAAwB;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,wBAAwBD,QAAO,YAAY,uBAAuB,IACpEC,gBAAe,YAAY,yBAAyB,GAAG,IACvD;AACJ,MAAI,CAAC,SAAS,wBAAwB,SAAS,qBAAqB,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,2BAA2BD;AAAA,IAC/B;AAAA,IACA;AAAA,EACF,IACIC,gBAAe,YAAY,4BAA4B,GAAG,IAC1D;AACJ,MAAI,CAAC,SAAS,2BAA2B,SAAS,wBAAwB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASH,cACP,OACA,MACAI,OACY;AACZ,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QACE,eAAe,QACf,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,GACxB;AACA,YAAM,IAAI,qBAAqBA,OAAM,GAAG,IAAI,oBAAoB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAASC,iBACP,QACA,SACA,MACM;AACN,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASC,eACP,QACA,KACA,MACW;AACX,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,KACA,MACAG,OACQ;AACR,MAAI,CAACF,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,qBAAqBE,OAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACnE;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAuHA,SAAS,mBAAmB,OAAe,MAAsB;AAC/D,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAMC,gBAEF,OAGA,UACD,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,SAASC,QAAO,QAAoB,KAAsB;AACxD,SAAOD,cAAa,QAAQ,GAAG;AACjC;;;A3BhtBO,IAAM,gCAAgC;AACtC,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAE5C,IAAM,yCACX;AACK,IAAM,0CACX;AACK,IAAM,uCACX;AACK,IAAM,8BACX;AACK,IAAM,yCACX;AACK,IAAM,6BACX;AAEK,IAAM,gDAAgD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA8CO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAMlD,YACEE,OACA,SACA,QAAuC,WACvC,YACA,QACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AACZ,SAAK,QAAQ;AACb,SAAK,aAAa;AAClB,SAAK,SAAS;AAAA,EAChB;AACF;AA8IA,IAAM,kBAAsC,cAAE;AAAA,EAAK,MACjD,cAAE,MAAM;AAAA,IACN,cAAE,OAAO;AAAA,IACT,cAAE,OAAO,EAAE,OAAO;AAAA,IAClB,cAAE,QAAQ;AAAA,IACV,cAAE,KAAK;AAAA,IACP,cAAE,MAAM,eAAe;AAAA,IACvB,cAAE,OAAO,eAAe;AAAA,EAC1B,CAAC;AACH;AAEA,IAAM,gBAAgB,cACnB,OAAO,EACP,OAAO,CAAC,UAAUC,oBAAmB,KAAK,MAAM,QAAW;AAAA,EAC1D,SAAS;AACX,CAAC;AAEH,IAAM,qBAAqB,cACxB,OAAO;AAAA,EACN,QAAQ,cAAE,OAAO;AAAA,EACjB,gBAAgB,cAAE,OAAO;AAAA,EACzB,UAAU,cAAE,OAAO;AAAA,EACnB,UAAU,cAAE,OAAO;AAAA,EACnB,UAAU,cAAE,OAAO;AAAA,EACnB,yBAAyB,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3C,4BAA4B,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC9C,gBAAgB,cAAE,OAAO;AAAA,EACzB,WAAW;AAAA,EACX,WAAW,cACR,OAAO;AAAA,IACN,OAAO,cAAE,OAAO;AAAA,IAChB,WAAW,cAAE,OAAO;AAAA,IACpB,OAAO,cAAE,OAAO;AAAA,EAClB,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,cACxB,OAAO;AAAA,EACN,UAAU,cAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,cAAE,OAAO;AAAA,EACnB,4BAA4B,cAAE,MAAM;AAAA,IAClC,cAAE,QAAQ,0BAA0B;AAAA,EACtC,CAAC;AAAA,EACD,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,0BAA0B;AAAA,EAC5C,UAAU,cAAE,OAAO,EAAE,IAAI;AAAA,EACzB,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,cACxB,OAAO;AAAA,EACN,cAAc,cAAE,OAAO;AAAA,EACvB,YAAY,cAAE,OAAO;AAAA,EACrB,uBAAuB,cAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AACvD,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,iCAAiC;AAAA,EACnD,UAAU,cAAE,OAAO;AAAA,EACnB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,OAAO,cAAE,OAAO;AAAA,EAChB,WAAW,cAAE,OAAO;AAAA,EACpB,OAAO,cAAE,OAAO;AAClB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,cACrB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,uCAAuC;AAAA,EACzD,aAAa,cAAE,OAAO;AAAA,EACtB,UAAU,cAAE,OAAO;AAAA,EACnB,UAAU,cAAE,OAAO;AAAA,EACnB,OAAO,cAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,oBAAoB;AAAA,EACpB,gBAAgB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,+BAA+B,cAAE,MAAM,eAAe,EAAE,SAAS;AAAA,EACjE,WAAW;AACb,CAAC,EACA,OAAO;AAEV,IAAM,0BAA0B,cAC7B,OAAO,EAAE,WAAW,gBAAgB,CAAC,EACrC,OAAO;AAEV,IAAM,eAAe,cAClB,OAAO;AAAA,EACN,QAAQ,cAAE,QAAQ,2BAA2B;AAAA,EAC7C,MAAM,cAAE,KAAK,6CAA6C;AAAA,EAC1D,SAAS,cAAE,OAAO,EAAE,SAAS;AAC/B,CAAC,EACA,OAAO;AAEV,IAAM,4BAA4B,cAC/B,OAAO;AAAA,EACN,OAAO,cACJ,OAAO;AAAA,IACN,MAAM,cAAE,KAAK,6CAA6C;AAAA,IAC1D,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,uBAAuB,cAC1B,OAAO;AAAA,EACN,cAAc,cAAE,OAAO;AAAA,EACvB,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,WAAW,cAAE,OAAO;AAAA,EACpB,WAAW,cAAE,OAAO;AAAA,EACpB,UAAU,cAAE,OAAO;AAAA,EACnB,mBAAmB,cAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACpD,gBAAgB,cAAE,QAAQ,cAAc;AAAA,EACxC,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU,cAAE,QAAQ;AAAA,EACpB,SAAS,cAAE,OAAO;AACpB,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,cAC3B,OAAO,EAAE,YAAY,qBAAqB,CAAC,EAC3C,OAAO;AACV,IAAM,wBAAwB,cAC3B,OAAO;AAAA,EACN,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC7B,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAC7B,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,cAC3B,OAAO,EAAE,MAAM,cAAE,MAAM,eAAe,EAAE,CAAC,EACzC,OAAO;AACV,IAAM,uBAAuB,cAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC,EAAE,OAAO;AAElE,IAAM,+BAA+B;AAAA,EAC1C;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AACF;AAcO,SAAS,oCACd,eACA,gBACQ;AACR,MAAI,eAAe,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,GAAG,aAAa,IAAI,mBAAmB,cAAc,CAAC;AAC/D;AAKA,IAAM,+BACJ,IAAI;AAAA,EACF,6BAA6B,IAAI,CAAC,cAAc;AAAA,IAC9C,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEK,IAAM,sBAAN,MAAM,qBAAoB;AAAA,EA4BvB,YACN,WACA,uBACA,wBACAC,4BACA,+BACA,uBACA,oBACAC,UACA;AAdF,SAAiB,sBAAsB,oBAAI,IAAY;AAGvD,SAAQ,cAAc;AAYpB,SAAK,YAAY;AACjB,SAAK,wBAAwB;AAC7B,SAAK,yBAAyB;AAC9B,SAAK,4BAA4BD;AACjC,SAAK,eAAeC,SAAQ;AAC5B,SAAK,WAAWA,SAAQ;AACxB,SAAK,WAAWA,SAAQ;AACxB,SAAK,iBAAiBA,SAAQ;AAC9B,SAAK,YAAYA,SAAQ;AACzB,SAAK,oBAAoBA,SAAQ;AACjC,SAAK,uBAAuBA,SAAQ;AACpC,SAAK,gCAAgC;AACrC,SAAK,wBAAwB;AAC7B,SAAK,qBAAqB;AAC1B,SAAK,qBACHA,SAAQ,sBACRA,SAAQ,mBAAmB,sBAC3BA,SAAQ;AACV,SAAK,gBAAgBA,SAAQ,iBAC3BA,SAAQ,mBAAmB,iBAAiB;AAAA,MAC1C,MAAM;AAAA,MACN,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAWA,SAAQ;AAAA,MACrB;AAAA,IACF;AACF,SAAK,WAAWA,SAAQ,YAAYA,SAAQ,mBAAmB;AAC/D,SAAK,yBAAyB,KAAK;AAAA,MACjC,KAAK,IAAIA,SAAQ,0BAA0B,IAAI,CAAC;AAAA,MAChD;AAAA,IACF;AACA,SAAK,MAAMA,SAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,QACHA,SAAQ,UACP,CAAC,iBACA,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,YAAY,CAAC;AAC9D,SAAK,SAASA,SAAQ,UAAU,KAAK;AACrC,SAAK,sBACHA,SAAQ,uBAAuB;AAAA,EACnC;AAAA,EAEA,aAAa,OACXA,UAC8B;AAC9B,UAAM,YAAY,eAAeA,SAAQ,SAAS;AAClD,QACE,UAAU,UAAU,aAAaA,SAAQ,iBAAiB,YAC1D,UAAU,UAAU,YAAYA,SAAQ,iBAAiB,SACzD;AACA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,yBAAyB,WAAWA,QAAO;AAChE,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB,MAAM;AAAA,MAClC,UAAU,aAAa;AAAA,MACvBA,SAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM;AAAA,MAC/B,UAAU,UAAU;AAAA,MACpBA,SAAQ;AAAA,IACV;AACA,UAAM,wBACJ,UAAU,aAAa,sBAAsB;AAAA,MAAI,CAAC,YAAY,UAC5D;AAAA,QACE;AAAA,QACA,wCAAwC,KAAK;AAAA,MAC/C;AAAA,IACF;AACF,UAAM,yBAAyB,sBAAsB,IAAI,CAAC,gBAAgB;AAAA,MACxE,GAAG;AAAA,MACH,OAAO,UAAU,UAAU;AAAA,IAC7B,EAAE;AACF,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,0BAA0B,qBAAqB;AAAA,MAC/CF,oBAAmB,OAAO,SAAS;AAAA,MACnC;AAAA,MACA;AAAA,MACAE;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,cAA2D;AAC7D,QAAI,KAAK,aAAa;AACpB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,uBAAuB,QAAW;AACzC,aAAO;AAAA,IACT;AACA,QAAI,KAAK,gBAAgB,KAAK,kBAAkB,GAAG;AACjD,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,eACA,gBAC2C;AAC3C,QAAI;AACF,YAAM,mBAAmB,8BAA8B,aAAa;AACpE,YAAM,yBACJ,kBAAkB,KAAK,UAAU,aAAa;AAChD,YAAM,YAAwC;AAAA,QAC5C,GAAG;AAAA,QACH,MACE,mBAAmB,SACf,iBAAiB,OACjB;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACN,aAAa,iBAAiB,YAAY,IAAI,CAAC,UAAU;AAAA,UACvD,GAAG;AAAA,UACH,OACE,KAAK,UAAU,qBACX,yBACA,KAAK;AAAA,QACb,EAAE;AAAA,MACJ;AACA,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,KAAK;AAAA,QACrB;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,UAAU;AAAA;AAAA;AAAA;AAAA,UAIhB,QACE,UAAU,YAAY,SAClB,UAAU,YAAY,IAAI,CAAC,SAAS,KAAK,KAAK,IAC9C,CAAC;AAAA,QACT;AAAA,QACA,UAAU;AAAA,MACZ;AACA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAwD;AACnE,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,WAAW,aAAa;AAAA,QACxC,CAAC,eACC,WAAW,YAAY,kBACvB,WAAW,SAAS,QACpB,WAAW,QAAQ,SAAS,kBAAkB;AAAA,MAClD;AACA,YAAM,YAAY;AAAA,QAChB;AAAA,UACE,SAAS;AAAA,UACT,OAAO,WAAW,SAAS;AAAA,UAC3B;AAAA,UACA,SAAS,CAAC,kBAAkB;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,MAAM,kBAAkB;AACvE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,MACA,QACA,MACA,SACgC;AAChC,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,WAAW,cAAc,KAAK,gBAC9B,WAAW,cAAc,KAAK,mBAAmB,WACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,0BAA0B,UAC/B,KAAK,uBAAuB,QAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAA0B;AAAA,MAC9B,kBAAkB,EAAE,eAAe,KAAK,mBAAmB,QAAS;AAAA,MACpE,eAAe,KAAK;AAAA,MACpB,SAAS,KAAK,UAAU,UAAU;AAAA,MAClC,oBAAoB,WAAW;AAAA,MAC/B,KAAK,WAAW;AAAA,IAClB;AACA,QAAI;AACJ,QAAI,YAAY,QAAW;AACzB,0BAAoB,WAAW,OAAO,SAAS,SAAS,MAAM,MAAM;AAAA,IACtE,OAAO;AACL,UAAI,WAAW,cAAc,QAAW;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,0BAAoB,WAAW,UAAU,SAAS;AAAA,QAChD;AAAA,UACE,SAAS,KAAK,UAAU,UAAU;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS,CAAC,OAAO;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,cAAc,iBAAiB;AAC/C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D;AAAA,MACA,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,MACrD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC,CAAC;AACD,SAAK,wBAAwB,UAAU,SAAS;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,wBAAqD;AACjE,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,uBAAuB,UAC5B,CAAC,KAAK,gBAAgB,KAAK,kBAAkB,GAC7C;AACA,aAAO,KAAK;AAAA,IACd;AACA,QACE,KAAK,sBAAsB,UAC3B,KAAK,kBAAkB,cAAc,KAAK,cAC1C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,UAAI;AACJ,YAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,eAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,cAAM,YAAY,MAAM,KAAK,gBAAgB;AAC7C,cAAM,eAAe,MAAM,KAAK,iBAAiB,SAAS;AAC1D,YAAI;AACF,gBAAM,aAAa,MAAM,KAAK,YAAY,WAAW,YAAY;AACjE,eAAK,qBAAqB;AAC1B,iBAAO;AAAA,QACT,SAAS,OAAO;AACd,cACE,EAAE,iBAAiB,6BACnB,MAAM,UAAU,eAChB;AACA,kBAAM;AAAA,UACR;AACA,sBAAY;AAAA,QACd;AACA,YAAI,UAAU,IAAI,UAAU;AAC1B,gBAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,QACrD;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,qBAAqB,QACjB,UAAU,UACV;AAAA,QACJ;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,kBAAkB,OAAsB;AAC9C,QACE,iBAAiB,4BACjB,MAAM,UAAU,gBAChB;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAc,kBAA4D;AACxE,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,0BAA0B;AAAA,MACpD,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM;AAAA,QACJ,UAAU,KAAK,UAAU;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAc,iBACZ,WACuC;AACvC,QACE,UAAU,aAAa,KAAK,UAAU,YACtC,UAAU,aAAa,KAAK,UAAU,aAAa,YACnD,UAAU,aAAa,KAAK,UAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,oBAAoB,IAAI,UAAU,KAAK,GAAG;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,oBAAoB,IAAI,UAAU,KAAK;AAC5C,UAAM,YAAY,IAAI;AAAA,MACpB,KAAK,IAAI,EAAE,QAAQ,IAAI,KAAK,yBAAyB;AAAA,IACvD,EACG,YAAY,EACZ,QAAQ,SAAS,GAAG;AACvB,UAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,KAAK,UAAU;AAAA,MACzB,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,MACpB,uBAAuB,KAAK;AAAA,MAC5B,2BAA2B,KAAK;AAAA,MAChC,UAAU,KAAK;AAAA,MACf,OAAO,UAAU;AAAA,MACjB;AAAA,MACA,GAAI,KAAK,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;AAAA,IACnE;AACA,UAAM,YACJ,KAAK,kBAAmB,0BAA0B,SAC9C,MAAM,KAAK,kBAAmB,eAAe;AAAA,MAC3C,GAAG;AAAA,MACH,aAAa,UAAU;AAAA,MACvB,UAAU;AAAA,MACV,OAAO,KAAK,kBAAmB;AAAA,IACjC,CAAC,IACD,MAAM,KAAK,kBAAmB,sBAAsB,KAAK;AAC/D,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,iBAAiB;AAAA,QACf,OAAO,KAAK,kBAAmB,SAAS,UAAU,eAAe,CAAC;AAAA,QAClE,WAAW,KAAK;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YACZ,WACA,cAC6B;AAC7B,SAAK;AACL,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,mBAAmB;AAAA,MAC7C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM,EAAE,aAAa;AAAA,IACvB,CAAC;AACD,UAAM,SAAS;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,yBAAyB,OAAO,UAAU;AAAA,EACxD;AAAA,EAEA,MAAc,yBACZ,OAC6B;AAC7B,UAAM,SAAS,kCAAkC,KAAK;AACtD,QAAI,OAAO,aAAa,KAAK,UAAU,UAAU;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,cAAc;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,gBAAgB;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAWF,oBAAmB,OAAO,QAAQ;AACnD,UAAM,YAAYA,oBAAmB,OAAO,SAAS;AACrD,QACE,aAAa,YACb,YAAY,WAAW,OAAO,gBAAgB,KAC9C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa;AAAA,MAAI,CAAC,YAAY,UACxD,sBAAsB,YAAY,6BAA6B,KAAK,GAAG;AAAA,IACzE;AACA,eAAW,WAAW,cAAc;AAClC,UACE,CAAC,KAAK,uBAAuB;AAAA,QAAK,CAAC,cACjC,yBAAyB,WAAW,OAAO;AAAA,MAC7C,GACA;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,OAAO,OAAO,YAAY,YAC1B,OAAO,QAAQ,MAAM,GAAG,EAAE,WAAW,GACrC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,GAAG,QAAQ,aAAa;AAC7C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D,SAAS,EAAE,eAAe,OAAO,QAAQ;AAAA,MACzC,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,IACvD,CAAC;AACD,SAAK,wBAAwB,UAAU,WAAW;AAClD,UAAM,UAAU,qBAAqB,QAAQ;AAC7C,UAAM,SAAS,KAAK,UAAU,UAAU;AACxC,QACE,CAAC,QAAQ,UAAU,SAAS,MAAM,KAClC,QAAQ,QAAQ,SAAS,MAAM,GAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,UAAU,SAAS,MAAM,KAAK,QAAQ,QAAQ,SAAS,MAAM,IACjE,2DACA;AAAA,MACN;AAAA,IACF;AACA,SAAK,wBAAwB,oBAAoB,OAAO,OAAO;AAC/D,WAAO;AAAA,EACT;AAAA,EAEQ,wBACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,UAAU;AAAA,MACzB;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kCAAwC;AAC9C,QAAI,KAAK,iCAAiC,KAAK,IAAI,EAAE,QAAQ,GAAG;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,2BACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,aAAa;AAAA,MAC5B;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,uBACN,UACA,UACA,MACA,kBACA,MACM;AACN,UAAM,WAAW,GAAG,kBAAkB,QAAQ,CAAC,GAAG,IAAI;AACtD,UAAM,QAAQ,CAAC,YAAoB,cAAc,MAAM,OAAO;AAC9D,QACE,SAAS,aAAa,YACtB,SAAS,oBAAoB,QAC7B;AACA,YAAM;AAAA,QACJ,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,IAAI,YAAY,SAAS,eAAe,CAAC,GAAG;AAChE,YAAM,MAAM,GAAG,IAAI,4CAA4C;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,4BACN,YACA,WACM;AACN,QAAI,KAAK,gBAAgB,UAAU,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,WAAW,aAAa;AAAA,MAAK,CAAC,YAC7B,yBAAyB,SAAS,SAAS;AAAA,IAC7C,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iCACN,YACA,WACkB;AAClB,UAAM,aAAa,WAAW,aAAa;AAAA,MACzC,CAAC,eACC,WAAW,YAAY,mBACvB,WAAW,QAAQ,SAAS,oBAAoB;AAAA,IACpD;AACA,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,YAAY,QAAW;AACpC,YAAM,aACJ,WAAW,QAOX;AACF,YAAM,0BAA0B,YAAY;AAAA,QAC1C,CAAC,cACC,UAAU,SAAS,UAAU,QAC7B,UAAU,QAAQ,UAAU,OAC5B,MAAM,QAAQ,UAAU,WAAW,KACnC,gBAAgB,UAAU,WAAW,MACnC,gBAAgB,UAAU,WAAW;AAAA,MAC3C;AACA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,QACE,SAAS;AAAA,QACT,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,SAAS,CAAC,oBAAoB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gBAAgB,YAAyC;AAC/D,UAAM,YAAYA,oBAAmB,WAAW,SAAS;AACzD,WACE,YAAY,KAAK,IAAI,EAAE,QAAQ,KAAK,gCAAgC;AAAA,EAExE;AAAA,EAEA,MAAc,0BACZ,SACgC;AAChC,QAAI;AACJ,UAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,aAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,aAAK,2BAA2B,UAAU,sBAAsB;AAChE,YAAI,SAAS,UAAU,KAAK;AAC1B,sBAAY,IAAI,MAAM,mBAAmB,SAAS,MAAM,EAAE;AAAA,QAC5D,WAAW,SAAS,UAAU,KAAK;AACjC,gBAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,cAAI,WAAW,QAAW;AACxB,kBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,UAC9C;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF,OAAO;AACL,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,4BACjB,MAAM,UAAU,eAChB;AACA,gBAAM;AAAA,QACR;AACA,oBAAY;AAAA,MACd;AACA,UAAI,UAAU,IAAI,UAAU;AAC1B,cAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,MACrD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qBAAqB,QACjB,UAAU,UACV;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,SACgC;AAChC,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,WAAK,2BAA2B,UAAU,oBAAoB;AAC9D,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,mBAAmB,SAAS,MAAM;AAAA,UAClC;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,YAAI,WAAW,QAAW;AACxB,gBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,QAC9C;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA0B;AAC7C,cAAM;AAAA,MACR;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,0BACpBE,UAC8B;AAC9B,SAAO,oBAAoB,OAAOA,QAAO;AAC3C;AAEA,SAAS,eAAe,OAEtB;AACA,QAAM,aAAa,kBAAkB,OAAO,+BAA+B;AAC3E,QAAM,SAAS,gBAAgB,UAAU,UAAU;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,OAAO,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,mBAAmB,IAClE,oCACA;AAAA,MACJ,OAAO,MAAM;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAKhB;AAEA,eAAe,yBACb,WACAA,UACA;AACA,MAAI;AACF,WAAO,MAAM,qCAAqC;AAAA,MAChD,cAAc,UAAU,aAAa;AAAA,MACrC,UAAUA,SAAQ;AAAA,MAClB,UAAUA,SAAQ;AAAA,MAClB,gBAAgBA,SAAQ;AAAA,MACxB,MAAMA,SAAQ,QAAQ,MAAM,oBAAI,KAAK,IAAI,EACtC,YAAY,EACZ,QAAQ,SAAS,GAAG;AAAA,MACvB,uBAAuB;AAAA,MACvB,0BAA0B;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAMH,QAAO,0BAA0B,KAAK;AAC5C,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,0BACP,OAC8B;AAC9B,QAAMA,QACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACpD,MAA6B,OAC9B;AACN,MAAIA,UAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,MAAIA,UAAS,uCAAuC;AAClD,WAAO;AAAA,EACT;AACA,MAAIA,UAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,MAAgC;AAC7E,MAAI;AACF,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,8BACP,eACoB;AACpB,MAAI,OAAO,kBAAkB,UAAU;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,6BAA6B,IAAI,aAAa;AAChE,MAAI,cAAc,QAAW;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sCACP,OACkB;AAClB,QAAM,aAAa,kBAAkB,OAAO,8BAA8B;AAC1E,SAAO,0BAA0B,UAAU;AAC7C;AAEA,SAAS,0BACP,cACQ;AACR,QAAM,YAAY,CAAC,GAAG,YAAY,EAAE;AAAA,IAAK,CAAC,MAAM,UAC9C,GAAG,KAAK,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,MAC7C,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,MAAM,IAAI;AAAA,IACjD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,OAAO,gBAAgB,SAAS,CAAC;AACtD,QAAM,QAAQ,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AACxD,QAAM,IAAI,QAAQ,CAAC;AACnB,QAAM,IAAI,MAAM,OAAO,MAAM;AAC7B,aAAO,6BAAW,qBAAO,OAAO,OAAO,CAAC,EAAE,MAAM,CAAC;AACnD;AAEA,SAAS,wBACP,YAC0B;AAC1B,QAAM,SAAS,kCAAkC,WAAW,OAAO;AACnE,QAAM,UAAU,CAAC,UAAyB;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,uBAAuB,KAAK;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,WAAW,iBAAiB,oBAAoB,WAAW,OAAO;AACpE,YAAQ,cAAc;AACxB,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,KAAK,MAAM,WAAW,QAAQ,MAAM,OAAO;AAC7C,YAAQ,UAAU;AACpB,MAAI,KAAK,MAAM,WAAW,SAAS,MAAM,OAAO;AAC9C,YAAQ,WAAW;AACrB,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,WAAW,eAAe,OAAO,WAAY,SAAQ,YAAY;AACrE,MAAI,WAAW,sBAAsB,OAAO;AAC1C,YAAQ,mBAAmB;AAC7B,MAAI,WAAW,mBAAmB,OAAO;AACvC,YAAQ,gBAAgB;AAC1B,SAAO;AAAA,IACL,cAAc,oBAAoB,WAAW,OAAO;AAAA,IACpD,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,UAAU,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IACxE,WAAW,IAAI,KAAK,OAAO,WAAW,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IAC1E,UAAU,OAAO;AAAA,IACjB,eAAe,KAAK,MAAM,OAAO,cAAc,OAAO,cAAc,GAAI;AAAA,IACxE,cAAc,OAAO;AAAA,IACrB,SAAS,WAAW;AAAA,EACtB;AACF;AAQO,SAAS,kCACd,OACoB;AACpB,SAAO;AAAA,IACL,mBAAmB,OAAO,sBAAsB,qBAAqB;AAAA,EACvE;AACF;AAEA,SAAS,kCAAkC,SAWzC;AACA,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,iBAAiB;AACzD,UAAM,UAAU;AAAA,MACd,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,eAAe,MAAM,CAAC,CAAE,CAAC,CAAC;AAAA,IAChE;AACA,UAAM,SAAS,sBAAsB,SAAS,KAAK;AACnD,UAAM,YAAY,sBAAsB,SAAS,KAAK;AACtD,UAAM,WAAW,qBAAqB,SAAS,KAAK;AACpD,UAAM,YAAY,qBAAqB,SAAS,KAAK;AACrD,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,UAAM,iBAAiB,MAAM;AAAA,MAC3B,CAACI,UACCA,UAAS,QACT,OAAOA,UAAS,YAChB,CAAC,MAAM,QAAQA,KAAI,KACnB,mCAAmCA;AAAA,IACvC;AACA,QAAI,eAAe,WAAW;AAC5B,YAAM,IAAI,MAAM,0CAA0C;AAC5D,UAAM,OAAO,eAAe,CAAC;AAC7B,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,IACF;AACA,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,kCAAkC;AACpD,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,iCAAiC;AACnD,UAAM,MAAM,QAAQ;AACpB,QAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjE,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,UAAM,eAAmC,CAAC;AAC1C,eAAW,CAAC,UAAU,YAAY,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC1D,UACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,YAAY;AAClB,YAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,UAAI,CAAC,SAAS,WAAW,YAAY,KAAK,SAAS;AACjD,cAAM,IAAI,MAAM,2BAA2B;AAC7C,YAAM,QAAQ,SAAS,MAAM,GAAG,MAAM;AACtC,YAAM,OAAO,SAAS,MAAM,SAAS,QAAQ,MAAM;AACnD,iBAAW,CAAC,QAAQ,UAAU,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC5D,cAAM,UAAU,OAAO,WAAW,gBAAgB,IAC9C,kBACA,OAAO,WAAW,eAAe,IAC/B,iBACA;AACN,YAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,UAAU;AAChB,YAAI,YAAY,OAAW,OAAM,IAAI,MAAM,0BAA0B;AACrE,cAAM,QAAQ,QAAQ,CAAC;AACvB,qBAAa;AAAA,UACX,0BAA0B;AAAA,YACxB;AAAA,YACA;AAAA,YACA;AAAA,YACA,SAAS,CAAC,MAAM;AAAA,YAChB,GAAI,UAAU,QACd,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,SAAS,IACxB,EAAE,SAAS,MAAM,IACjB,CAAC;AAAA,UACP,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAClE,UAAM,WAAW,OAAO,QAAQ,GAAG;AACnC,UAAM,YAAY,WAAW,IAAI,SAAS,OAAO,MAAM,GAAG,QAAQ;AAClE,QAAI,CAAC,UAAU,WAAW,MAAM,KAAK,CAAC,UAAU,WAAW,MAAM,GAAG;AAClE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC7G;AAAA,EACF;AACF;AAEA,SAAS,sBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,qBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,QAAQ,GAAG,sCAAsC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE;AAEA,SAAS,mBACP,OACA,QACA,OACG;AACH,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,QAAW;AACxB,UAAM,eAAe,MAAM;AAAA,EAC7B;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,uBAAuB,OAAO,MAAM,OAAO;AAAA,IACrD;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AA2CA,SAAS,qBACP,UACuC;AACvC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,yCAAyC,SAAS,MAAM;AAAA,MACxD,SAAS,UAAU,MAAM,YAAY;AAAA,MACrC;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,sBAAsB,UAAU,UAAU;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,oDAAoD,OAAO,MAAM,OAAO;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,sBACP,UACA,QACA,OACG;AACH,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,kBAAkB,SAAS,MAAM,KAAK,iBAAiB,SAAS,IAAI,CAAC;AAAA,MAC7E;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,iBAAiB,iBAAiB,SAAS,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,qCAAqC,OAAO,MAAM,OAAO;AAAA,IACnE;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAC7C,UAAM,SAAS;AACf,UAAMC,QAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAC7D,UAAM,UACJ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACxD,QAAIA,UAAS;AACX,aAAO,YAAY,SAAYA,QAAO,GAAGA,KAAI,KAAK,OAAO;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,SAAyB;AAC3D,QAAMC,UAAS,OAAa,QAAM,sBAAO,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC,CAAC;AAC3E,SAAO,IAAI,SAAS,IAAMA,OAAM,EAAE,SAAS;AAC7C;AAEA,SAAS,cAAc,SAAiD;AACtE,SAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI;AAChE;AAEA,eAAe,4BACb,UACA,WAC8B;AAC9B,SAAO,iCAAiC,UAAU,WAAW,YAAY;AAC3E;AAEA,eAAe,iCACb,UACA,WACA,MAC8B;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,UAAM,cAAc,MAAM,GAAG,IAAI,wBAAwB;AAAA,EAC3D;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,SAAS,MACb,IAAI,WAAW,IACf;AACA,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,UAAU,oBAAoB,QAAW;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,UAAU,gBAAgB,IAAI,MAAM;AAAA,EACzD,SAAS,OAAO;AACd,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,MAAI,WAAW,UAAU,WAAW,GAAG;AACrC,UAAM,cAAc,MAAM,GAAG,IAAI,oCAAoC;AAAA,EACvE;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,WAAW,WAAW,WAAW;AAC1C,UAAM,aAAa,YAAY,OAAO;AACtC,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,YAAM;AAAA,QACJ;AAAA,QACA,GAAG,IAAI,+CAA+C,OAAO;AAAA,MAC/D;AAAA,IACF;AACA,cAAU,IAAI,UAAU;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,cACP,MACA,SAC0B;AAC1B,SAAO,IAAI;AAAA,IACT,SAAS,eACL,0CACA;AAAA,IACJ;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,YAAY,EAAE,QAAQ,YAAY,EAAE;AACnD;AAEA,SAAS,WAAW,OAAwB;AAC1C,QAAM,KAAK,YAAY,KAAK;AAC5B,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MACE,MAAM,WAAW,KACjB,MAAM,MAAM,CAAC,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,GAC/D;AACA,UAAM,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM;AAC/B,WAAO,EACL,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,KACnB,MAAM,OAAO,MAAM,OACnB,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MAAM,MAAM,CAAC,MAAM,SACtC,MAAM,OAAO,MAAM,KAAK,MAAM,CAAC,MAAM,SACtC,KAAK;AAAA,EAET;AACA,MAAI,CAAC,GAAG,SAAS,GAAG,EAAG,QAAO;AAC9B,MACE,OAAO,QACP,OAAO,SACP,GAAG,WAAW,WAAW,KACzB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI;AAElB,WAAO;AACT,QAAM,SAAS,GAAG,MAAM,+BAA+B;AACvD,MAAI,WAAW,KAAM,QAAO,WAAW,OAAO,CAAC,CAAE;AACjD,QAAM,YAAY,GAAG,MAAM,0CAA0C;AACrE,MAAI,cAAc,MAAM;AACtB,UAAM,OAAO,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC9C,UAAM,MAAM,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC7C,WAAO,WAAW,GAAG,QAAQ,CAAC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,gBACP,OAGY;AACZ,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,aAAa,UAAU,UAAU;AAChD,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,MAAM,OAAO,KAAK,MAAM,SAAS,OAAO,KAAK,QAAQ;AAAA,EAChE;AACA,QAAM,WAAW,0BAA0B,UAAU,UAAU;AAC/D,MAAI,SAAS,SAAS;AACpB,WAAO;AAAA,MACL,MAAM,SAAS,KAAK,MAAM;AAAA,MAC1B,SAAS,SAAS,KAAK,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QAC0B;AAC1B,QAAM,cACJ,OAAO,SAAS,qBAChB,OAAO,SAAS,oBAChB,OAAO,SAAS;AAClB,SAAO,IAAI;AAAA,IACT,wBAAwB,OAAO,IAAI;AAAA,IACnC,OAAO,WAAW,wBAAwB,OAAO,IAAI;AAAA,IACrD,cAAc,iBAAiB;AAAA,IAC/B,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,WAAW,SAAiB,QAAwB;AAC3D,QAAMC,QAAO,KAAK,IAAI,qCAAqC,KAAK,KAAK,OAAO;AAC5E,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,MAAMA,SAAQ,MAAM,OAAO;AAAA,EAClC;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AACpD;AAEA,SAAS,kBACP,OACAF,OACS;AACT,MAAI;AACF,WAAO,cAAc,KAAK;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAASG,oBAAmB,OAAmC;AAC7D,MACE,CAAC,+EAA+E;AAAA,IAC9E;AAAA,EACF,GACA;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,QAAM,WAAW,KAAK,MAAM,KAAK;AACjC,SAAO,KAAK,MAAM,SAAS,MAAM,WAAW,SAAS;AACvD;;;A4B79DA,0BAIO;AAiBA,SAAS,sBAAsB,WAA2B;AAC/D,QAAM,aAAS,oCAAe,SAAS;AACvC,aAAO,oCAAe,gBAAgB,OAAO,QAAQ,GAAG,OAAO,IAAI;AACrE;AAEO,SAAS,wBACd,WAC0B;AAC1B,QAAM,YAAY,sBAAsB,SAAS;AACjD,aAAO,oCAAe,SAAS;AACjC;;;ACtBA,IAAAC,cAAkB;AAUlB,IAAM,yBAAyB;AASxB,IAAMC,iBAAgB,cAAE,OAAO;AAAA;AAAA,EAEpC,QAAQ,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAEvC,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAWM,IAAM,kCAAkC,cAAE,OAAO;AAAA;AAAA,EAEtD,kBAAkB,cAAE,OAAO;AAAA,IACzB,eAAe,cAAE,OAAO;AAAA,EAC1B,CAAC;AAAA;AAAA,EAED,eAAe,cAAE,OAAO;AAAA;AAAA,EAExB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,QAAQ,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAElD,oBAAoB,cAAE,OAAO;AAC/B,CAAC;AAeM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,SAAS,cACN,OAAO,EACP,MAAM,wBAAwB,0BAA0B;AAAA;AAAA,EAE3D,SAAS,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEnC,YAAY,cAAE,OAAO;AAAA;AAAA,EAErB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,kBAAkB,gCAAgC,SAAS;AAAA;AAAA,EAE3D,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE/C,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE/C,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,KAAKA,eAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5B,gBAAgB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAC/C,CAAC;AAaM,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,SAAS,cAAE,OAAO,EAAE,MAAM,wBAAwB,0BAA0B;AAAA;AAAA,EAE5E,SAAS,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEnC,YAAY,cAAE,OAAO;AAAA;AAAA,EAErB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,QAAQ,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAElD,eAAe,cAAE,OAAO;AAAA;AAAA,EAExB,kBAAkB,cAAE,OAAO;AAAA,IACzB,eAAe,cAAE,OAAO;AAAA,EAC1B,CAAC;AAAA;AAAA,EAED,oBAAoB,cAAE,OAAO;AAAA;AAAA,EAE7B,KAAK,cAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA;AAAA,EAE9B,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,WAAW,cAAE,OAAO;AACtB,CAAC;AAoCM,SAAS,6BACd,MAC+C;AAC/C,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,OAAO,MAAM;AAAA,QACtB,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;AC3LA,IAAAC,uBA4BO;;;ACdP,IAAAC,uBAAsC;;;AC+ItC,SAAS,4BAA6C;AACpD,SAAO,IAAI,MAAM,CAAC,GAAsB;AAAA,IACtC,KAAK,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAwBO,IAAM,QAAN,MAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAenC,YAAY,QAAqB;AAC/B,SAAK,MAAM,OAAO;AAClB,SAAK,QAAQ,OAAO;AACpB,SAAK,MAAM,OAAO,SAAS,OAAO,EAAE;AACpC,SAAK,SAAS,OAAO,YAAY,OAAO,EAAE;AAC1C,SAAK,WAAW,OAAO,gBAAgB,OAAO,EAAE,KAAK,0BAA0B;AAC/E,SAAK,eAAe,OAAO,kBAAkB,OAAO,EAAE;AACtD,SAAK,WAAW,OAAO,cAAc,OAAO,EAAE;AAC9C,SAAK,WAAW,OAAO;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,KAAa;AACf,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,OAAe;AACjB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,KAAiB;AACnB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,QAA2B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,UAA2B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,cAAuC;AACzC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,UAA+B;AACjC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAiD;AACrD,WAAO,KAAK,SAAS,KAAK,GAAG;AAAA,EAC/B;AACF;;;AC7QA,IAAAC,cAAkB;;;ACAlB,IAAAC,cAAkB;AAyCX,IAAM,YAAY,cAAE,OAAO;AAAA;AAAA,EAEhC,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AACxC,CAAC;AAWM,IAAM,gBAAgB,cAAE,KAAK,CAAC,QAAQ,WAAW,UAAU,CAAC;AAM5D,IAAM,gBAAgB,cAAE,OAAO;AAAA;AAAA,EAEpC,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,MAAM;AAAA;AAAA,EAEN,KAAK,UAAU,SAAS;AAAA;AAAA,EAExB,UAAU,cAAE,OAAO;AACrB,CAAC;AAWM,IAAM,wBAAwB,cAAE,OAAO;AAAA;AAAA,EAE5C,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,SAAS,cAAE,QAAQ,YAAY;AAAA;AAAA,EAE/B,OAAO,cAAE,WAAW,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,EAAE,SAAS;AACnD,CAAC;AAOM,IAAM,uBAAuB;AAAA,EAClC,eAAe;AAAA,EACf,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,SAAS;AAAA,EACT,eAAe;AAAA,EACf,SAAS;AAAA,EACT,SAAS;AAAA,EACT,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,wBAAwB;AAAA,EACxB,mBAAmB;AAAA,EACnB,kBAAkB;AACpB;AAYO,IAAM,mBAAmB,cAAE,OAAO;AAAA;AAAA,EAEvC,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAE7D,QAAQ,cAAE,OAAO,KAAK;AAAA;AAAA,EAEtB,WAAW,cAAE,QAAQ;AAAA;AAAA,EAErB,cAAc,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,oBAAoB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,cAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAKM,IAAM,yBAAyB,cAAE,OAAO;AAAA,EAC7C,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,QAAQ,cAAE,KAAK,CAAC,UAAU,WAAW,WAAW,eAAe,WAAW,CAAC;AAAA,EAC3E,QAAQ,cAAE,QAAQ;AAAA,EAClB,QAAQ,cAAE,QAAQ;AAAA,EAClB,SAAS,cAAE,QAAQ;AAAA,EACnB,SAAS,cAAE,QAAQ;AACrB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,QAAM,QAAQ,MAAM,WAAW,WAC3B,MAAM,UAAU,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,MAAM,UACzD,MAAM,WAAW,gBACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UAC1D,CAAC,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM;AACrE,MAAI,CAAC,OAAO;AACV,YAAQ,SAAS;AAAA,MACf,MAAM,cAAE,aAAa;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAIM,IAAM,oCAAoC,cAAE,OAAO;AAAA,EACxD,SAAS,cAAE,QAAQ,IAAI;AAAA,EACvB,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC,EAAE,OAAO;AAIH,IAAM,kCAAkC,cAAE,OAAO;AAAA,EACtD,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3B,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,CAAC;AACpD,CAAC,EAAE,OAAO;AAEV,IAAM,8BAA8B,cACjC,OAAO,EACP,SAAS,EAAE,QAAQ,KAAK,CAAC,EACzB,UAAU,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC;AAEhC,IAAM,gCAAgC,cAAE,OAAO;AAAA,EACpD,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,KAAK,CAAC,WAAW,UAAU,CAAC;AAAA,EACzC,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAW,cAAE,MAAM,+BAA+B;AAAA,EAClD,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3B,UAAU,4BAA4B,SAAS;AAAA,EAC/C,WAAW,4BAA4B,SAAS;AAAA,EAChD,WAAW,4BAA4B,SAAS;AAAA,EAChD,QAAQ,cAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC;AAAA,EAC9E,WAAW,4BAA4B,SAAS,EAAE,SAAS;AAAA,EAC3D,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAC1C,CAAC,EAAE,OAAO;AAEH,IAAM,8BAA8B,cAAE,OAAO;AAAA,EAClD,eAAe,cAAE,QAAQ,CAAC;AAAA,EAC1B,OAAO,cAAE,MAAM,6BAA6B;AAAA,EAC5C,YAAY,cAAE,OAAO,EAAE,SAAS;AAClC,CAAC,EAAE,OAAO;AAMH,IAAM,sCAAsC,cAAE,OAAO;AAAA,EAC1D,WAAW,cAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC,EAAE,SAAS;AAAA,EAC3D,QAAQ,cAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC,EAAE,SAAS;AAAA,EACzF,OAAO,cAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,OAAO,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC,EAAE,OAAO;AAOH,IAAM,wBAAwB,cAAE,OAAO;AAAA;AAAA,EAE5C,UAAU,cAAE,OAAO;AAAA;AAAA,EAEnB,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,MAAM,cAAE,MAAM,aAAa;AAAA;AAAA,EAE3B,YAAY;AAAA;AAAA,EAEZ,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAOM,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,OAAO,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,cAAE,QAAQ;AAAA;AAAA,EAErB,WAAW,cAAE,OAAO,KAAK;AAAA;AAAA,EAEzB,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,+BAA+B,cAAE,OAAO;AAAA;AAAA,EAEnD,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,sBAAsB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,wBAAwB,cAAE,MAAM,gBAAgB;AAMtD,IAAM,0BAA0B,cAAE,OAAO;AAAA;AAAA,EAE9C,MAAM;AAAA;AAAA,EAEN,OAAO,cAAE,MAAM,gBAAgB;AAAA;AAAA,EAE/B,MAAM;AACR,CAAC;AAWM,IAAM,4BAA4B,cAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC;AAMvE,IAAM,0BAA0B,cAAE,OAAO;AAAA;AAAA,EAE9C,WAAW,0BAA0B,SAAS;AAAA;AAAA,EAE9C,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,gBAAgB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,SAAS,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAElC,OAAO,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,QAAQ,cAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAWM,IAAM,uBAAuB,cAAE,KAAK,CAAC,SAAS,WAAW,CAAC;AAM1D,IAAM,kBAAkB,cAAE,OAAO;AAAA;AAAA,EAEtC,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,MAAM;AAAA;AAAA,EAEN,aAAa,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAWM,IAAM,oBAAoB,cAAE,KAAK,CAAC,UAAU,WAAW,MAAM,CAAC;AAM9D,IAAM,kBAAkB,cAAE,OAAO;AAAA;AAAA,EAEtC,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,YAAY;AAAA;AAAA,EAEZ,QAAQ;AAAA;AAAA,EAER,WAAW,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,aAAa,cAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAOM,SAAS,0BAAkD,YAAe;AAC/E,SAAO,cAAE,OAAO;AAAA;AAAA,IAEd,MAAM;AAAA;AAAA,IAEN,YAAY;AAAA;AAAA,IAEZ,SAAS,cAAE,OAAO;AAAA;AAAA,IAElB,MAAM,cAAE,OAAO;AAAA,EACjB,CAAC;AACH;AAEO,IAAM,sBAAsB,0BAA0B,cAAE,QAAQ,CAAC;AAejE,IAAM,sBAAsB,cAAE,OAAO;AAAA;AAAA,EAE1C,SAAS,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE9B,eAAe,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEpC,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,kBAAkB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEvC,UAAU,cAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAWM,IAAM,4BAA4B,cAAE,OAAO;AAAA;AAAA,EAEhD,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,QAAQ,cAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,QAAQ,kBAAkB,SAAS;AAAA;AAAA,EAEnC,aAAa,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,SAAS,cAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAeM,IAAM,gCAAgC,cAAE,OAAO;AAAA;AAAA,EAEpD,OAAO,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,gBAAgB,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE3C,SAAS,cAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,QAAQ,cAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA+B,OAAO,QAAQ;AAAA,IAC/C,EAAE,SAAS,8BAA8B;AAAA,EAC3C;AAAA;AAAA,EAEA,WAAW,cAAE,QAAQ,EAAE;AAAA,IACrB,CAAC,QAAkC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACvE,EAAE,SAAS,8CAA8C;AAAA,EAC3D,EAAE,SAAS;AAAA;AAAA,EAEX,OAAO,cAAE,QAAQ,EAAE;AAAA,IACjB,CAAC,QAA8B,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,yCAAyC;AAAA,EACtD,EAAE,SAAS;AACb,CAAC;AAOM,IAAM,oBAAoB,cAAE,OAAO;AAAA;AAAA,EAExC,kBAAkB,cAAE,QAAQ,EAAE;AAAA,IAC5B,CAAC,QAAkD,OAAO,QAAQ;AAAA,IAClE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,cAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA0C,OAAO,QAAQ;AAAA,IAC1D,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,cAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAAmD,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AACF,CAAC;AAWM,IAAM,8BAA8B,cAAE,OAAO;AAAA;AAAA,EAElD,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,KAAK,cAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAqBM,IAAM,0BAA0B,cAAE,OAAO;AAAA;AAAA,EAE9C,SAAS,cAAE,OAAO;AAAA;AAAA,EAElB,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAC/D,CAAC;AAgBM,IAAM,mCAAmC,cAAE,OAAO;AAAA;AAAA,EAEvD,SAAS,cAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,cAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBlB,WAAW,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,CAAC,CAAC;AAAA;AAAA,EAEzE,gBAAgB,cAAE,OAAO;AAAA;AAAA,EAEzB,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAYM,IAAM,mCAAmC,cAAE,OAAO;AAAA;AAAA,EAEvD,YAAY,cAAE,OAAO;AAAA;AAAA,EAErB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,aAAa,cAAE,OAAO;AAAA;AAAA,EAEtB,QAAQ,cAAE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,WAAW,cAAE,MAAM,uBAAuB;AAC5C,CAAC;;;ADlqBM,IAAM,oBAAoB,cAAE,OAAO;AAAA;AAAA,EAExC,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,UAAU,cAAE,SAAS;AAAA;AAAA,EAErB,aAAa,cAAE,SAAS;AAAA;AAAA,EAExB,eAAe,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,mBAAmB,cAAE,SAAS;AAAA;AAAA,EAE9B,eAAe,cAAE,SAAS;AAAA;AAAA,EAE1B,SAAS,cAAE,SAAS;AACtB,CAAC;AAcM,IAAM,2BAA2B,cAAE,OAAO;AAAA;AAAA,EAE/C,OAAO,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,SAAS,cAAE,QAAQ;AAAA;AAAA,EAEnB,QAAQ,cAAE,SAAS;AAAA;AAAA,EAEnB,OAAO,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE7B,oBAAoB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEzC,iBAAiB,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAEvC,oBAAoB,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE1C,sBAAsB,cAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE5C,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,gBAAgB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,kBAAkB,cAAE,SAAS,EAAE,SAAS;AAC1C,CAAC;AAaM,IAAM,8BAA8B,6BAA6B,OAAO;AAAA;AAAA,EAE7E,SAAS,cAAE,OAAO;AACpB,CAAC;AAsHM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,WAAW,cAAE,OAAO;AAAA;AAAA,EAEpB,UAAU,cAAE,OAAO;AAAA;AAAA,EAEnB,SAAS,cAAE,MAAM,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAAA;AAAA,EAE3D,QAAQ,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE5B,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEhC,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,cAAc,cAAE;AAAA,IACd,cAAE,OAAO;AAAA,MACP,UAAU,cAAE,OAAO;AAAA,MACnB,SAAS,cAAE,OAAO;AAAA,IACpB,CAAC;AAAA,EACH;AACF,CAAC;AAQM,IAAM,kCAAkC,cAAE;AAAA,EAC/C,cAAE,OAAO;AAAA,EACT;AACF;AAQO,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAIM,IAAM,kCAAkC,cAAE,MAAM,sBAAsB;AAOtE,IAAM,kCAAkC,cAAE,OAAO;AAAA;AAAA,EAEtD,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO;AAAA;AAAA,EAEf,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,gCAAgC,cAAE,OAAO;AAAA;AAAA,EAEpD,IAAI,cAAE,OAAO;AAAA;AAAA,EAEb,MAAM,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,cAAE,OAAO;AAAA;AAAA,EAEhB,MAAM,cAAE,KAAK,CAAC,SAAS,WAAW,CAAC,EAAE,SAAS;AAAA;AAAA,EAE9C,aAAa,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,WAAW,cAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAcM,SAAS,kCACd,MACoD;AAEpD,MAAI,SAAS,QAAQ,SAAS,QAAW;AACvC,WAAO,EAAE,IAAI,MAAM,MAAM,CAAC,EAAE;AAAA,EAC9B;AAGA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO,EAAE,IAAI,MAAM,MAAM,CAAC,EAAE;AAAA,EAC9B;AAEA,QAAM,SAAS,gCAAgC,UAAU,IAAI;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,wCAAwC,OAAO,MAAM,OAAO;AAAA,QACrE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,kCACd,MACoD;AACpD,QAAM,SAAS,gCAAgC,UAAU,IAAI;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,yCAAyC,OAAO,MAAM,OAAO;AAAA,QACtE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,kCACd,MACoD;AACpD,QAAM,SAAS,gCAAgC,UAAU,IAAI;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,yCAAyC,OAAO,MAAM,OAAO;AAAA,QACtE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,gCACd,MACkD;AAClD,QAAM,SAAS,8BAA8B,UAAU,IAAI;AAC3D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,uCAAuC,OAAO,MAAM,OAAO;AAAA,QACpE,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;AEhZA,IAAM,eAAe,KAAK,KAAK;AAS/B,IAAM,qBAAqB,IAAI,KAAK;AAUpC,IAAM,aAAa,IAAI,KAAK,KAAK,KAAK;AAUtC,IAAM,WAAW,IAAI,KAAK,KAAK,KAAK;AASpC,IAAM,SAAS,KAAK,KAAK,KAAK,KAAK;AASnC,IAAM,SAAS,KAAK,MAAM,KAAK,KAAK,KAAK;AAElC,IAAM,SAAS;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oCAAoC,OAAO;;;AJ1BxD,IAAM,eAAe;AAErB,SAAS,eAAe,GAAW,GAAgC;AACjE,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,WAAO,mBAAmB,GAAG,CAAC;AAAA,EAChC,QAAQ;AACN,WAAO,MAAM;AAAA,EACf;AACF;AAKO,IAAM,kBAAkB;AAAA;AAAA,EAE7B,WAAW;AAAA;AAAA,EAEX,gBAAgB;AAAA;AAAA,EAEhB,iBAAiB;AAAA;AAAA,EAEjB,eAAe;AAAA;AAAA,EAEf,cAAc;AAAA;AAAA,EAEd,eAAe;AAAA;AAAA,EAEf,iBAAiB;AACnB;AA8HO,SAAS,kBAAkB,SAAiB,SAAyB;AAC1E,SAAO,eAAe,SAAS,SAAS,QAAQ;AAClD;AAeO,SAAS,cACd,KAC4E;AAE5E,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,CAAC,EAAE,SAAS,SAASC,KAAI,IAAI;AACnC,QAAI;AACF,YAAM,gBAAgB,OAAO,OAAO;AACpC,YAAM,mBAAmB,oBAAoB,OAAO;AACpD,aAAO;AAAA,QACL,OAAO,OAAO,kBAAkB,aAAa;AAAA,QAC7C,MAAAA;AAAA,QACA,SAAS,OAAO,aAAa;AAAA,QAC7B,SAAS;AAAA,MACX;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,OAAO;AAAA;AAAA,MACP,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,cAAc,OAAeA,OAAsB;AACjE,QAAM,MAAM,YAAY,KAAK;AAC7B,MAAI,KAAK;AACP,WAAO,eAAe,IAAI,SAAS,IAAI,SAASA,KAAI;AAAA,EACtD;AAEA,SAAO,aAAa,KAAK,IAAIA,KAAI;AACnC;AAkBA,SAAS,2BACP,eACA,gBACc;AACd,QAAM,SAAuB,CAAC;AAE9B,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,aAAa,GAAG;AAEvD,UAAM,eAAe,KAAK;AAC1B,QAAI,OAAO;AACX,QAAI,UAAU;AACd,UAAM,UAAoB,CAAC;AAE3B,eAAW,OAAO,cAAc;AAC9B,cAAQ,KAAK,IAAI,OAAO;AAGxB,YAAM,gBAAgB,IAAI,SAAS;AAAA,QACjC;AAAA,MACF;AACA,UAAI,eAAe;AACjB,kBAAU,cAAc,CAAC;AACzB,eAAO,cAAc,CAAC,KAAK;AAAA,MAC7B;AAAA,IACF;AAGA,UAAM,oBAAoB,KAAK,SAAS,KAAK,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAEtF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,QAAQ;AAAA,MACnF,WAAW;AAAA,MACX,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,MACvD,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAiCO,IAAM,eAAN,MAA4C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BjD,YAAY,QAA4B;AAbxC;AAAA,SAAQ,aAAkC,oBAAI,IAAI;AAGlD;AAAA,SAAQ,YAAgE,oBAAI,IAAI;AAGhF;AAAA,SAAiB,WAAW,IAAI,KAAK;AAQnC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,qBAAqB,OAAO;AACjC,SAAK,oBAAoB,OAAO;AAChC,SAAK,uBAAuB,OAAO;AACnC,SAAK,yBAAyB,OAAO;AACrC,SAAK,WAAW,OAAO;AACvB,SAAK,iBAAiB,OAAO;AAC7B,SAAK,qBAAqB,OAAO;AACjC,SAAK,sBAAsB,OAAO;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAA2C;AACtD,QAAI,OAAO,MAAO,MAAK,QAAQ,OAAO;AACtC,QAAI,OAAO,QAAS,MAAK,UAAU,OAAO;AAC1C,QAAI,OAAO,OAAQ,MAAK,SAAS,OAAO;AACxC,QAAI,OAAO,MAAO,MAAK,UAAU,OAAO;AACxC,QAAI,OAAO,mBAAoB,MAAK,qBAAqB,OAAO;AAChE,QAAI,OAAO,gBAAiB,MAAK,oBAAoB,OAAO;AAC5D,QAAI,OAAO,mBAAoB,MAAK,uBAAuB,OAAO;AAClE,QAAI,OAAO,qBAAsB,MAAK,yBAAyB,OAAO;AACtE,QAAI,OAAO,YAAY,OAAW,MAAK,WAAW,OAAO;AACzD,QAAI,OAAO,eAAgB,MAAK,iBAAiB,OAAO;AACxD,QAAI,OAAO,iBAAkB,MAAK,qBAAqB,OAAO;AAC9D,QAAI,OAAO,kBAAmB,MAAK,sBAAsB,OAAO;AAGhE,SAAK,WAAW,MAAM;AACtB,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,oBAAwC;AACtC,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,UAA8B;AAExC,QAAI,KAAK,UAAU;AACjB,aAAO,KAAK;AAAA,IACd;AAGA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,OAAmD;AACvD,QAAI,CAAC,KAAK,SAAS;AACjB,iBAAO;AAAA,YACL,mCAAa,gBAAgB,eAAe,2BAA2B,YAAY;AAAA,MACrF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAsB,CAAC;AAG7B,YAAM,cAAc,MAAM,KAAK,gBAAgB;AAC/C,UAAI,YAAY,IAAI;AAClB,eAAO,KAAK,GAAG,YAAY,IAAI;AAAA,MACjC;AAGA,UAAI,KAAK,oBAAoB;AAC3B,cAAM,kBAAkB,KAAK,wBAAwB;AACrD,eAAO,KAAK,GAAG,eAAe;AAAA,MAChC;AAGA,YAAM,eAAe,KAAK,kBAAkB,MAAM;AAClD,iBAAW,SAAS,cAAc;AAChC,aAAK,sBAAsB,KAAK;AAAA,MAClC;AAEA,iBAAO,yBAAG,YAAY;AAAA,IACxB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,0BAA0B,OAAO,KAAK,CAAC;AAAA,UACvC;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAA8D;AAC1E,QAAI;AACF,YAAM,UAAU,KAAK,OAAO,KAAK,SAAS,SAAS,IAAI,sBAAsB;AAE7E,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,MAAM,EAAE,QAAQ,SAAS,OAAO,EAAE;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,YAAM,mBAAmB,kCAAkC,OAAO;AAClE,UAAI,CAAC,iBAAiB,IAAI;AACxB,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,iBAAiB,MAAM;AAAA,YACvB;AAAA,YACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAsB,iBAAiB,KAAK,IAAI,CAAC,UAAU;AAAA,QAC/D,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,kBAAkB,KAAK,EAAE;AAAA,QACjD,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,aAAa,CAAC,GAAG;AAAA;AAAA,MACnB,EAAE;AAEF,iBAAO,yBAAG,MAAM;AAAA,IAClB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,uCAAuC,OAAO,KAAK,CAAC;AAAA,UACpD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,0BAAuC;AAC7C,QAAI,CAAC,KAAK,oBAAoB;AAC5B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,SAAiC,oBAAI,IAAI;AAG/C,UAAM,eAAe,KAAK,mBAAmB,mBAAmB;AAEhE,eAAW,cAAc,cAAc;AACrC,YAAM,UAAU,WAAW,WAAW;AAGtC,UAAI,OAAO,IAAI,OAAO,GAAG;AACvB,cAAM,WAAW,OAAO,IAAI,OAAO;AAEnC,YAAI,SAAS,aAAa;AACxB,gBAAM,UAAU,WAAW,WAAW;AACtC,qBAAW,UAAU,SAAS;AAC5B,gBAAI,CAAC,SAAS,YAAY,SAAS,MAAM,GAAG;AAC1C,uBAAS,YAAY,KAAK,MAAM;AAAA,YAClC;AAAA,UACF;AAAA,QACF;AACA;AAAA,MACF;AAGA,UAAI,YAAY,KAAK,SAAS,SAAS;AACrC;AAAA,MACF;AAEA,YAAM,SAAS,cAAc,OAAO;AAEpC,aAAO,IAAI,SAAS;AAAA,QAClB,IAAI;AAAA,QACJ,MAAM,QAAQ,QAAQ,KAAK,kBAAkB,OAAO;AAAA,QACpD,OAAO,WAAW,WAAW,gBAAgB,QAAQ,SAAS;AAAA,QAC9D,MAAM;AAAA,QACN,aAAa,CAAC,GAAG,WAAW,WAAW,OAAO;AAAA,QAC9C,WAAW,WAAW;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,WAAO,MAAM,KAAK,OAAO,OAAO,CAAC;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,IAAoB;AAC5C,UAAM,SAAS,cAAc,EAAE;AAC/B,QAAI,QAAQ;AACV,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,WAAO,MAAM,MAAM,SAAS,CAAC,KAAK;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,QAAkC;AAC1D,UAAM,OAAO,oBAAI,IAAuB;AAExC,eAAW,SAAS,QAAQ;AAC1B,YAAM,WAAW,KAAK,IAAI,MAAM,EAAE;AAClC,UAAI,CAAC,YAAa,SAAS,SAAS,eAAe,MAAM,SAAS,SAAU;AAC1E,aAAK,IAAI,MAAM,IAAI,KAAK;AAAA,MAC1B;AAAA,IACF;AAEA,WAAO,MAAM,KAAK,KAAK,OAAO,CAAC;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAOA,OAAwD;AACnE,QAAI,CAAC,KAAK,SAAS;AACjB,iBAAO;AAAA,YACL,mCAAa,gBAAgB,eAAe,2BAA2B,YAAY;AAAA,MACrF;AAAA,IACF;AAGA,QAAI,CAACA,SAAQ,CAAC,mBAAmB,KAAKA,KAAI,GAAG;AAC3C,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,OAAO,KAAK,SAAS,SAASA,OAAM,wBAAwB;AAEjF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,MAAAA,MAAK,CAAC;AAAA,MAC/B,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,UAAUA,KAAI;AAAA,cACd;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,2BAA2B,SAAS,MAAM,MAAM,SAAS;AAAA,YACzD;AAAA,YACA,EAAE,MAAM,EAAE,QAAQ,SAAS,OAAO,EAAE;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,YAAM,mBAAmB,kCAAkC,OAAO;AAClE,UAAI,CAAC,iBAAiB,IAAI;AACxB,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,iBAAiB,MAAM;AAAA,YACvB;AAAA,YACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,YAAuB;AAAA,QAC3B,IAAI,iBAAiB,KAAK;AAAA,QAC1B,MAAM,iBAAiB,KAAK,QAAQA;AAAA,QACpC,OAAO,iBAAiB,KAAK,SAAS,KAAK,WAAW;AAAA,QACtD,MAAM;AAAA,QACN,aAAa,CAAC,GAAG;AAAA,MACnB;AAGA,WAAK,UAAU,IAAI,UAAU,IAAI,EAAE,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,CAAC;AAC1E,WAAK,sBAAsB,SAAS;AAEpC,iBAAO,yBAAG,SAAS;AAAA,IACrB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,iCAAiC,OAAO,KAAK,CAAC;AAAA,UAC9C;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,sBAAsB,OAAwB;AACpD,QAAI,CAAC,KAAK,oBAAqB;AAC/B,SAAK,QAAQ,QAAQ,KAAK,oBAAoB,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAGlE,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,IAAI,WAA2B;AAE7B,UAAM,UAAU,KAAK,eAAe,SAAS;AAG7C,UAAM,SAAS,KAAK,WAAW,IAAI,OAAO;AAC1C,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AAGA,UAAM,SAAS,cAAc,OAAO;AACpC,UAAMA,QAAO,QAAQ,QAAQ,KAAK,kBAAkB,OAAO;AAE3D,UAAM,SAAsB;AAAA,MAC1B,IAAI;AAAA,MACJ,MAAAA;AAAA,MACA,UAAU,KAAK,oBAAoB,KAAK,IAAI;AAAA,MAC5C,aAAa,KAAK,uBAAuB,KAAK,IAAI;AAAA,MAClD,eAAe,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACtD,mBAAmB,KAAK,6BAA6B,KAAK,IAAI;AAAA,MAC9D,eAAe,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACtD,SAAS,KAAK,aAAa,KAAK,IAAI;AAAA,IACtC;AAEA,UAAM,QAAQ,IAAI,MAAM,MAAM;AAC9B,SAAK,WAAW,IAAI,SAAS,KAAK;AAElC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,WAA2B;AAChD,UAAM,SAAS,cAAc,SAAS;AAEtC,QAAI,CAAC,QAAQ;AAEX,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,OAAO;AAEhB,aAAO;AAAA,IACT;AAGA,QAAI,KAAK,SAAS;AAChB,aAAO,cAAc,KAAK,SAAS,OAAO,IAAI;AAAA,IAChD;AAGA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAO,WAA2D;AACtE,UAAM,UAAU,KAAK,eAAe,SAAS;AAG7C,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO;AACzC,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,UAAU;AAC1D,iBAAO,yBAAG,IAAI;AAAA,IAChB;AAGA,UAAM,aAAa,MAAM,KAAK,aAAa,OAAO;AAClD,eAAO,yBAAG,WAAW,EAAE;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,aAAa,SAA2D;AAEpF,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO;AACzC,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,UAAU;AAC1D,iBAAO,yBAAG,OAAO,IAAI;AAAA,IACvB;AAEA,QAAI,CAAC,KAAK,SAAS;AACjB,iBAAO;AAAA,YACL,mCAAa,gBAAgB,eAAe,2BAA2B,YAAY;AAAA,MACrF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,OAAO,KAAK,SAAS,SAAS,SAAS,sBAAsB;AAElF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;AAAA,MAClC,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,YAAI,SAAS,WAAW,KAAK;AAC3B,qBAAO;AAAA,gBACL,mCAAa,gBAAgB,WAAW,oBAAoB,OAAO,IAAI,YAAY;AAAA,UACrF;AAAA,QACF;AAEA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,6BAA6B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC3D;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,YAAM,mBAAmB,gCAAgC,OAAO;AAChE,UAAI,CAAC,iBAAiB,IAAI;AACxB,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB,iBAAiB,MAAM;AAAA,YACvB;AAAA,YACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAO,iBAAiB;AAC9B,YAAM,YAAuB;AAAA,QAC3B,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,kBAAkB,KAAK,EAAE;AAAA,QACjD,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK,SAAS,eAAe,KAAK,OAAO,KAAK,OAAO,IAAI,UAAU;AAAA,QACzE,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,MACzD;AAGA,WAAK,UAAU,IAAI,SAAS,EAAE,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,CAAC;AAErE,iBAAO,yBAAG,SAAS;AAAA,IACrB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gBAAgB;AAAA,UAChB,qCAAqC,OAAO,KAAK,CAAC;AAAA,UAClD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,oBAAoB,SAA6B;AACvD,QAAI,KAAK,mBAAmB;AAC1B,aAAO,KAAK,kBAAkB,OAAO;AAAA,IACvC;AAGA,WAAO,IAAI,MAAM,CAAC,GAAiB;AAAA,MACjC,KAAK,MAAM;AACT,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAAuB,SAAoC;AACjE,QAAI,KAAK,sBAAsB;AAC7B,aAAO,KAAK,qBAAqB,OAAO;AAAA,IAC1C;AAEA,WAAO,IAAI,MAAM,CAAC,GAAwB;AAAA,MACxC,KAAK,MAAM;AACT,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,yBAAyB,SAAkC;AACjE,QAAI,KAAK,wBAAwB;AAC/B,aAAO,KAAK,uBAAuB,OAAO;AAAA,IAC5C;AAEA,WAAO,IAAI,MAAM,CAAC,GAAsB;AAAA,MACtC,KAAK,MAAM;AACT,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,6BAA6B,SAA0C;AAC7E,UAAM,OAAO;AAEb,WAAO;AAAA,MACL,MAAM,OAAoD;AAExD,YAAI;AAEF,gBAAM,QAAQ;AAAA,YACZ;AAAA,cACE,wBAAwB;AAAA,gBACtB,MAAM;AAAA,gBACN,SAAS,EAAE,WAAW,UAAU;AAAA,cAClC;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,KAAK;AAAA,YACnB,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAEA,gBAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,YACzD,QAAQ;AAAA,YACR;AAAA,UACF,CAAC;AAED,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,gBAC7D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,gBAAM,mBAAmB,kCAAkC,OAAO;AAClE,cAAI,CAAC,iBAAiB,IAAI;AACxB,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,iBAAiB,MAAM;AAAA,gBACvB;AAAA,gBACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,cACtC;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,cAAc,2BAA2B,iBAAiB,MAAM,OAAO;AAC7E,qBAAO,yBAAG,WAAW;AAAA,QACvB,SAAS,OAAO;AACd,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,sCAAsC,OAAO,KAAK,CAAC;AAAA,cACnD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,eAA4D;AAEhE,YAAI;AAEF,gBAAM,QAAQ;AAAA,YACZ;AAAA,cACE,wBAAwB;AAAA,gBACtB,MAAM;AAAA,gBACN,SAAS,EAAE,WAAW,WAAW;AAAA,cACnC;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,KAAK;AAAA,YACnB,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAEA,gBAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,YACzD,QAAQ;AAAA,YACR;AAAA,UACF,CAAC;AAED,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,wCAAwC,SAAS,MAAM,MAAM,SAAS;AAAA,gBACtE;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,UAAU,MAAM,SAAS,KAAK;AAGpC,gBAAM,mBAAmB,kCAAkC,OAAO;AAClE,cAAI,CAAC,iBAAiB,IAAI;AACxB,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,iBAAiB,MAAM;AAAA,gBACvB;AAAA,gBACA,EAAE,MAAM,iBAAiB,MAAM,KAAK;AAAA,cACtC;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,cAAc,2BAA2B,iBAAiB,MAAM,OAAO;AAC7E,qBAAO,yBAAG,WAAW;AAAA,QACvB,SAAS,OAAO;AACd,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,+CAA+C,OAAO,KAAK,CAAC;AAAA,cAC5D;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OACJ,QAC2C;AAE3C,YAAI,KAAK,oBAAoB;AAC3B,iBAAO,KAAK,mBAAmB,EAAE,GAAG,QAAQ,QAAQ,CAAC;AAAA,QACvD;AAKA,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YAEA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OAAO,KAAkD;AAC7D,YAAI;AACF,gBAAM,UAAU,KAAK;AAAA,YACnB,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAEA,gBAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,YACzD,QAAQ;AAAA,YACR;AAAA,YACA,MAAM,KAAK,UAAU,EAAE,KAAK,QAAQ,CAAC;AAAA,UACvC,CAAC;AAED,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,gBAC9D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAEA,qBAAO,yBAAG,MAAS;AAAA,QACrB,SAAS,OAAO;AACd,qBAAO;AAAA,gBACL;AAAA,cACE,gBAAgB;AAAA,cAChB,sCAAsC,OAAO,KAAK,CAAC;AAAA,cACnD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,yBAAyB,SAAsC;AACrE,UAAM,OAAO;AAEb,WAAO;AAAA,MACL,MAAM,SACJ,QAC0C;AAE1C,YAAI,KAAK,gBAAgB;AAIvB,gBAAM,SAAS,MAAM,KAAK,eAAe,SAAS,MAAM;AACxD,cAAI,CAAC,OAAO,IAAI;AACd,uBAAO;AAAA,kBACL;AAAA,gBACE,gBAAgB;AAAA,gBAChB,OAAO,MAAM,WAAW;AAAA,gBACxB;AAAA,cACF;AAAA,YACF;AAAA,UACF;AACA,qBAAO,yBAAG,OAAO,IAAI;AAAA,QACvB;AAGA,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OAAmD;AAGvD,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OAAO,OAAoD;AAG/D,mBAAO;AAAA,cACL;AAAA,YACE,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAQO,SAAS,mBAAmB,QAA2C;AAC5E,SAAO,IAAI,aAAa,MAAM;AAChC;;;AD1mCO,IAAM,YAAN,MAAM,WAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwCrB,YAAY,mBAAuC,QAA0B;AAzB7E;AAAA;AAAA;AAAA,SAAQ,aAA0B,CAAC;AAYnC;AAAA;AAAA;AAAA,SAAQ,YAAmC,oBAAI,IAAI;AAKnD;AAAA;AAAA;AAAA,SAAQ,uBAAgC;AAStC,SAAK,oBAAoB;AACzB,SAAK,SAAS,UAAU,CAAC;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYO,mBACL,QACA,OACA,SACM;AACN,UAAM,kBAAkB,UAAU,KAAK,OAAO;AAC9C,UAAM,iBAAiB,SAAS,KAAK,OAAO;AAE5C,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAClD,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAGA,SAAK,kBAAkB,IAAI,oCAAe;AAAA,MACxC,QAAQ;AAAA,MACR,WAAW,KAAK,OAAO;AAAA,MACvB,OAAO,WAAW,KAAK,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAAA,MACvE,OAAO;AAAA,MACP,aAAa,KAAK,OAAO;AAAA,MACzB,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AAGD,UAAM,sBAA0D;AAAA,MAC9D,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,GAAG,KAAK,OAAO;AAAA,IACjB;AAGA,eAAW,CAACC,OAAM,YAAY,KAAK,OAAO,QAAQ,mBAAmB,GAAG;AACtE,YAAM,gBAAgB,KAAK,OAAO,iBAAiBA,KAAI,KAAK,CAAC;AAC7D,YAAM,UAAU,IAAI,aAAa,aAAa;AAC9C,cAAQ,WAAW,KAAK,eAAe;AACvC,WAAK,gBAAgB,gBAAgBA,OAAM,OAAO;AAClD,WAAK,UAAU,IAAIA,OAAM,OAAO;AAAA,IAClC;AAEA,SAAK,uBAAuB;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,iBAAkC;AAC3C,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGO,iBAAuB;AAC5B,QAAI;AACF,WAAK,iBAAiB,OAAO;AAAA,IAC/B,UAAE;AACA,WAAK,UAAU,MAAM;AACrB,WAAK,uBAAuB;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,WAA+BA,OAA6B;AACjE,WAAO,KAAK,UAAU,IAAIA,KAAI;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,KAAiB;AAC1B,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,IAAI;AACvC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,MAAmB;AAC5B,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,KAAK;AACxC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,SAAyB;AAClC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,QAAQ;AAC3C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,QAAuB;AAChC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,OAAO;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,QAA2B;AACpC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,OAAO;AAG1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,aAAiC;AAC1C,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,IAAI,YAAY;AAG/C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,8BAA8B,SAAsC;AAC1E,QAAI,KAAK,iBAAiB;AACxB,WAAK,gBAAgB,WAAW,OAAO;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,yBAA+B;AACrC,QAAI,KAAK,iBAAiB;AACxB,WAAK,gBAAgB,MAAM;AAAA,IAC7B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBACN,eACuB;AACvB,QAAI,CAAC,cAAe,QAAO;AAG3B,UAAM,YAAa,cAAsB;AACzC,QAAI,CAAC,UAAW,QAAO;AAEvB,WAAO;AAAA,MACL,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,oBAAoB,UAAU;AAAA,MAC9B,KAAK,UAAU;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,OAAO,WAA4B;AACxC,SAAK,WAAW,KAAK,SAAS;AAC9B,SAAK,kBAAkB,OAAO,SAAS;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,mBAAmB,WAA4B;AACpD,WAAO,KAAK,WAAW,KAAK,CAAC,QAAQ,IAAI,cAAc,SAAS;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAW,UAAqC;AAC9C,WAAO,KAAK,kBAAkB;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,aAAsB;AAC/B,WAAO,CAAC,CAAC,KAAK,kBAAkB;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAOC,UAAiD;AACnE,UAAM,UAAU,MAAM,KAAK,kBAAkB,OAAOA,QAAO;AAG3D,UAAM,iBAAiB,KAAK,iBAAiB,OAAO;AACpD,SAAK,8BAA8B,cAAc;AAEjD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,UAAyB;AAEpC,SAAK,uBAAuB;AAE5B,UAAM,KAAK,kBAAkB,QAAQ;AAGrC,SAAK,YAAY;AAGjB,SAAK,8BAA8B,IAAI;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKO,UAA8B;AACnC,WAAO,KAAK,kBAAkB,QAAQ;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKO,UAA8B;AACnC,WAAO,KAAK,kBAAkB,QAAQ;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,YAAY,SAAkC;AACzD,WAAO,KAAK,kBAAkB,YAAY,OAAO;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,kBAAkB,SAAiB,SAAyB;AACjE,WAAO,kBAAkB,SAAS,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,oBAAyD;AACpE,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,CAAC,WAAW,CAAC,SAAS;AACxB,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,iBAAiB;AACzB,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,kBAAkB,SAAS,OAAO;AAGlD,QAAI;AACF,YAAM,UAAU,KAAK,gBAAgB;AACrC,UAAI,CAAC,SAAS;AACZ,mBAAO;AAAA,cACL;AAAA,YACE,gCAAW;AAAA,YACX;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,gBAAgB;AAAA,QACnC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,WAAW,MAAM,KAAK,gBAAgB;AAAA,QAC1C,GAAG,KAAK,gBAAgB,MAAM,CAAC,CAAC;AAAA,QAChC,EAAE,QAAQ,QAAQ,SAAS,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,EAAE;AAAA,MAC/D;AAEA,UAAI,SAAS,IAAI;AACf,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAEA,UAAI,SAAS,WAAW,KAAK;AAE3B,cAAM,gBAAgB,KAAK,gBAAgB;AAAA,UACzC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAEA,cAAM,iBAAiB,MAAM,KAAK,gBAAgB;AAAA,UAChD,GAAG,KAAK,gBAAgB,MAAM,CAAC,CAAC;AAAA,UAChC;AAAA,YACE,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,MAAM,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAAA,UACzC;AAAA,QACF;AAEA,YAAI,CAAC,eAAe,IAAI;AAEtB,cAAI,eAAe,WAAW,KAAK;AACjC,uBAAO,yBAAG,MAAS;AAAA,UACrB;AACA,gBAAMC,aAAY,MAAM,eAAe,KAAK;AAC5C,qBAAO;AAAA,gBACL;AAAA,cACE,gCAAW;AAAA,cACX,kCAAkC,eAAe,MAAM,MAAMA,UAAS;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAGA,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX,iCAAiC,SAAS,MAAM,MAAM,SAAS;AAAA,UAC/D;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX,wCAAwC,OAAO,KAAK,CAAC;AAAA,UACrD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAW,WAAuB;AAChC,QAAI,CAAC,KAAK,wBAAwB,CAAC,KAAK,iBAAiB;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,CAAC,WAAW,CAAC,SAAS;AACxB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,QAAI,KAAK,WAAW;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,gBAAgB,kBAAkB,SAAS,OAAO;AACxD,UAAM,UAAU,KAAK,gBAAgB;AACrC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAGA,UAAM,WAAW,IAAI,+BAAU,EAAE,QAAQ,GAAG,CAAC;AAC7C,UAAM,gBAAgB,IAAI,oCAAe;AAAA,MACvC,QAAQ,KAAK,gBAAgB;AAAA,MAC7B,OAAO,KAAK,gBAAgB;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B,aAAa,KAAK,OAAO;AAAA,MACzB,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AACD,kBAAc,WAAW;AAAA,MACvB,GAAG;AAAA,MACH,SAAS;AAAA,IACX,CAAC;AACD,aAAS,WAAW,aAAa;AAEjC,SAAK,YAAY;AACjB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,gBACX,MACA,SACA,KACA,SACkC;AAClC,UAAM,UAAU,WAAW,WAAW,MAAM,KAAK,UAAU;AAC3D,UAAM,aAAa,IAAI,MAAM,GAAG,EAAE,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAClE,UAAM,MAAM,GAAG,IAAI,WAAW,mBAAmB,OAAO,CAAC,OAAO,UAAU;AAE1E,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,QAAQ,MAAM,CAAC;AAErD,UAAI,CAAC,SAAS,IAAI;AAChB,YAAI,SAAS,WAAW,KAAK;AAC3B,qBAAO;AAAA,gBACL;AAAA,cACE,gCAAW;AAAA,cACX,kBAAkB,GAAG,aAAa,OAAO;AAAA,cACzC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,mBAAO;AAAA,cACL;AAAA,YACE,gCAAW;AAAA,YACX,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,MAAM,EAAE,QAAQ,SAAS,OAAO,EAAE;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,UAAI;AACJ,UAAI,aAAa,SAAS,kBAAkB,GAAG;AAC7C,eAAQ,MAAM,SAAS,KAAK;AAAA,MAC9B,OAAO;AACL,cAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,YAAI;AACF,iBAAO,KAAK,MAAM,IAAI;AAAA,QACxB,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAEA,iBAAO,yBAAG,IAAI;AAAA,IAChB,SAAS,OAAO;AACd,iBAAO;AAAA,YACL;AAAA,UACE,gCAAW;AAAA,UACX,uCAAuC,OAAO,KAAK,CAAC;AAAA,UACpD;AAAA,UACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,aAAa,cACX,MACA,SACA,SACA,KACA,SACkC;AAClC,UAAM,UAAU,kBAAkB,SAAS,OAAO;AAClD,WAAO,WAAU,gBAAmB,MAAM,SAAS,KAAK,OAAO;AAAA,EACjE;AACF;;;AMnyBA,IAAAC,uBAUO;;;ACOP,gBAAe;AACf,IAAAC,uBAAkD;AAgF3C,IAAM,yBAAyB;AA2I/B,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO,EAAE;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAeO,IAAM,iBAAiB;AAKvB,IAAM,mBAAqC;AAG3C,IAAM,2BAA2B;AAGjC,IAAM,yBAAyB;AAG/B,IAAM,yBAAyB;AAG/B,IAAM,wBAAwB;AAE9B,IAAM,gBAAgB;AAGtB,IAAM,2BAA2B;AAejC,IAAM,wBACX,OAAO,OAAO;AAAA,EACZ,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,YAAY;AACd,CAAC;AAeI,IAAM,gCAAgC;AAGtC,IAAM,4BAA4B;AAKlC,IAAM,wBACX,OAAO;AAAA,EACL,OAAO;AAAA,IACL,OAAO,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,EAC9D;AACF;AASF,IAAM,2BAAuD;AAAA,EAC3D;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,OAAO,OAAO,OAAO,QAAQ,UAAU;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,OAAO;AAAA,EAC3B;AACF;AAKA,IAAM,wBAAoD;AAAA,EACxD;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,OAAO,OAAO,OAAO,QAAQ,UAAU;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACrC;AACF;AAQA,IAAM,sBAAkD;AAAA,EACtD;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,OAAO,OAAO,OAAO,QAAQ,UAAU;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACrC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,OAAO;AAAA,EAC3B;AACF;AAaO,SAAS,YAAY,UAA0B;AACpD,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR,mDAAmD,KAAK,UAAU,QAAQ,CAAC;AAAA,IAC7E;AAAA,EACF;AAGA,QAAM,aAAU,UAAAC,SAAoD,QAAQ;AAC5E,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AACzE,UAAM,IAAI;AAAA,MACR,4BAA4B,KAAK,UAAU,QAAQ,CAAC;AAAA,IACtD;AAAA,EACF;AACA,SAAO;AACT;AAYO,SAAS,uBACd,SACA,SACU;AACV,SAAO,QAAQ,IAAI,CAAC,MAAM;AACxB,QAAI,EAAE,SAAS,GAAG,GAAG;AAEnB,aAAO;AAAA,IACT;AACA,WAAO,GAAG,OAAO,IAAI,CAAC;AAAA,EACxB,CAAC;AACH;AAcO,SAAS,sBAAsB,OAA2C;AAC/E,MAAI,MAAM,YAAY,+BAA+B;AACnD,WAAO,gCAAgC,KAAK;AAAA,EAC9C;AACA,MAAI,MAAM,YAAY,0BAA0B;AAC9C,WAAO;AAAA,MACL;AAAA,QACE,GAAG;AAAA,QACH,SAAS,uBAAuB,MAAM,SAAS,MAAM,OAAO;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO,2BAA2B,KAAK;AACzC;AAgBA,SAAS,gCACP,OACmB;AACnB,MACE,OAAO,MAAM,SAAS,YACtB,CAAC,MAAM,KAAK,WAAW,2BAA2B,GAClD;AACA,UAAM,IAAI;AAAA,MACR,wEACU,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,IACtC;AAAA,EACF;AACA,QAAM,oBAA8B,CAAC;AACrC,aAAW,UAAU,MAAM,SAAS;AAClC,QAAI,WAAW,aAAa,WAAW,gCAAgC;AACrE,wBAAkB,KAAK,8BAA8B;AACrD;AAAA,IACF;AACA,QACE,WAAW,oBACX,WAAW,uCACX;AACA,wBAAkB,KAAK,qCAAqC;AAC5D;AAAA,IACF;AACA,QACE,WAAW,oBACX,WAAW,uCACX;AACA,wBAAkB,KAAK,qCAAqC;AAC5D;AAAA,IACF;AACA,QAAI,OAAO,SAAS,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,6BAA6B,KAAK,UAAU,MAAM,CAAC;AAAA,MACrD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,6BAA6B,KAAK,UAAU,MAAM,CAAC;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,iBAA2B,CAAC;AAClC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,mBAAmB;AACjC,QAAI,CAAC,KAAK,IAAI,CAAC,GAAG;AAChB,qBAAe,KAAK,CAAC;AACrB,WAAK,IAAI,CAAC;AAAA,IACZ;AAAA,EACF;AAKA,SAAO;AAAA,IACL;AAAA,MACE,SAAS;AAAA,MACT,OAAO;AAAA,MACP,MAAM,MAAM;AAAA,MACZ,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,IACP;AAAA,EACF;AACF;AAKO,SAAS,wBACd,SACmB;AACnB,SAAO,QAAQ,QAAQ,qBAAqB;AAC9C;AAUO,SAAS,YACd,QACA,MACA,YACQ;AACR,MAAI,YAAY;AACd,WAAO;AAAA,EACT;AACA,MAAI,WAAW,IAAI;AACjB,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,GAAG,GAAG;AACxB,WAAO,GAAG,MAAM,GAAG,IAAI;AAAA,EACzB;AACA,SAAO,GAAG,MAAM,IAAI,IAAI;AAC1B;AAWA,eAAsB,aAAa,KAAgC;AACjE,QAAM,UACJ,WACA;AACF,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,GAAG;AAC7B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,iCAAiC,GAAG,UAAU,IAAI,MAAM;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,iBAAiB,IAAI;AAC9B;AAMO,SAAS,iBAAiB,OAA0B;AACzD,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,UAAM,IAAI,wBAAwB,4BAA4B;AAAA,EAChE;AACA,QAAM,IAAI;AACV,MACE,EAAE,qBAAqB,UACvB,EAAE,qBAAqB,0BACvB;AACA,UAAM,IAAI;AAAA,MACR,qCAAqC,wBAAwB;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,EAAE,QAAQ,WACT,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,WAAW,IAC/C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,EAAE,UAAU,WACX,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,IACnD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,WAAW,QAAW;AAE1B,gBAAY,EAAE,MAAM;AAAA,EACtB;AACA,MAAI,EAAE,cAAc,QAAW;AAC7B,iCAA6B,EAAE,SAAS;AAAA,EAC1C;AACA,MAAI,EAAE,gBAAgB,QAAW;AAC/B,QAAI,CAAC,MAAM,QAAQ,EAAE,WAAW,GAAG;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,MAAE,YAAY;AAAA,MAAQ,CAAC,GAAG,MACxB,wBAAwB,GAAG,eAAe,CAAC,GAAG;AAAA,IAChD;AAAA,EACF;AACA,MAAI,EAAE,YAAY,QAAW;AAC3B,4BAAwB,EAAE,OAAO;AAAA,EACnC;AACA,SAAO;AACT;AAOO,SAAS,6BACd,WACoB;AACpB,MAAI,cAAc,QAAW;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,cAAc,MAAM;AACtB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,KAAK,SAAS,GAAG;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,SAAwB;AACvD,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,UAAM,IAAI,wBAAwB,oCAAoC;AAAA,EACxE;AAEA,aAAW,CAACC,OAAM,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,oCAAe,KAAKA,KAAI,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,oBAAoBA,KAAI,eAAe,oCAAe,MAAM;AAAA,MAC9D;AAAA,IACF;AACA,QAAI;AACF;AAAA,QACE,mBAAmBA,OAAM,IAA6B;AAAA,QACtD,EAAE,OAAO,oBAAoB,IAA6B,EAAE;AAAA,MAC9D;AAAA,IACF,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,oBAAoBA,KAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACrF;AAAA,IACF;AACA,UAAM,UAAU,sBAAsBA,OAAM,IAA6B;AACzE,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,oBAAoBA,KAAI;AAAA,MAC1B;AAAA,IACF;AACA,eAAW,UAAU,SAAS;AAC5B,UAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,cAAM,IAAI;AAAA,UACR,oBAAoBA,KAAI;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,QACT,OAAO,SAAS,YAChB,CAAC,MAAM,QAAQ,IAAI,KAClB,KAA8B,WAAW,QAC1C;AACA,kBAAa,KAA4B,MAAM;AAAA,IACjD;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,GAAY,MAAoB;AAC/D,MAAI,MAAM,QAAQ,OAAO,MAAM,UAAU;AACvC,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,WAAW,GAAG;AACnE,UAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB;AAAA,EACjE;AACA,MACE,MAAM,UAAU,WACf,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,WAAW,IAC3D;AACA,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,MAAM,SAAS,UAAU;AAClC,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,OAAO,KAAK,MAAM,QAAQ,WAAW,GAAG;AAC/D,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,aAAW,UAAU,MAAM,SAAS;AAClC,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AACA,QAAI,MAAM,YAAY,0BAA0B;AAC9C,2BAAqB,MAAM;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,MAAM,YAAY,WACnB,CAAC,MAAM,QAAQ,MAAM,OAAO,KAAK,MAAM,QAAQ;AAAA,IAAK,CAAC,WACpD,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM;AAAA,EACvE,IACA;AACA,UAAM,IAAI,wBAAwB,GAAG,IAAI,sCAAsC;AAAA,EACjF;AACA,MAAI,MAAM,WAAW,QAAW;AAC9B,gBAAY,MAAM,MAAM;AAAA,EAC1B;AACF;AAOO,SAAS,kBACd,OACkB;AAClB,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,WAAW;AAC9B,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAE7B,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,eAAe,WAAW,eAAe,OAAO;AAClD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAMA,SAAS,sBAAsB,MAA2C;AACxE,MAAI,SAAS,OAAO;AAClB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SACJ,SAAS,UACL,wBACA,SAAS,QACP,sBACA;AACR,SAAO,OAAO,IAAI,CAAC,OAAO;AAAA,IACxB,SAAS,EAAE;AAAA,IACX,OAAO,EAAE;AAAA,IACT,MAAM,EAAE;AAAA,IACR,SAAS,CAAC,GAAG,EAAE,OAAO;AAAA,IACtB,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,EACnE,EAAE;AACJ;AAcO,SAAS,gBAAgB,OAAuC;AACrE,QAAM,WAAW,iBAAiB,KAAK;AAEvC,QAAM,SACJ,SAAS,WAAW,SAAY,SAAS,SAAS,SAAS;AAC7D,QAAM,QAAQ,SAAS,SAAS;AAChC,QAAM,WAAW,YAAY,SAAS,UAAU,cAAc;AAC9D,QAAM,qBAAqB,SAAS,sBAAsB;AAC1D,QAAM,OAAO,kBAAkB,SAAS,QAAQ;AAEhD,QAAM,iBAAiB,sBAAsB,IAAI;AACjD,QAAM,kBAAkB,SAAS,eAAe,CAAC;AACjD,QAAM,gBAAgB,yBAAyB,SAAS,OAAO;AAI/D,QAAM,aAAgC;AAAA,IACpC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,QAAM,YAAkC;AAAA,IACtC,WAAW,QAAQ,CAAC,UAAU,aAAa,OAAO,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC5E;AAEA,QAAM,sBACJ,SAAS,QAAQ,SACb,CAAC,IACD;AAAA,IACE;AAAA,MACE,KAAK,SAAS;AAAA,MACd,MAAM,SAAS;AAAA,MACf;AAAA,MACA,aAAa,UAAU,IAAI,uBAAuB;AAAA,IACpD;AAAA,EACF;AAEN,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,GAAI,SAAS,QAAQ,SAAY,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,SAAsC;AACpE,QAAM,MAAgB,CAAC;AACvB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAM,CAAC,WAAmB;AAC9B,QAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,UAAI,KAAK,MAAM;AACf,WAAK,IAAI,MAAM;AAAA,IACjB;AAAA,EACF;AAEA,aAAW,UAAU,SAAS;AAC5B,QAAI,WAAW,QAAQ;AACrB,UAAI,KAAK;AACT;AAAA,IACF;AACA,QAAI,WAAW,SAAS;AACtB,UAAI,KAAK;AACT;AAAA,IACF;AACA,QAAI,WAAW,UAAU;AACvB,UAAI,KAAK;AACT;AAAA,IACF;AACA,QACE,WAAW,SACX,WAAW,SACX,WAAW,SACX,WAAW,UACX,WAAW,YACX;AACA,UAAI,MAAM;AACV;AAAA,IACF;AACA,QACE,WAAW,sBACX,WAAW,sBACX,WAAW,sBACX,WAAW,uBACX,WAAW,yBACX;AACA,UAAI,MAAM;AACV;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,UAAU,MAAM,CAAC;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,mBACP,cACA,MACQ;AACR,MAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,WAAO,KAAK,QAAQ;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,oBACP,MACoB;AACpB,MAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,WAAO,KAAK;AAAA,EACd;AACA,SAAO;AACT;AAEA,SAAS,sBACPA,OACA,MACU;AACV,MAAI,SAAS,MAAM;AACjB,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO,CAAC,IAAI;AAAA,EACd;AACA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO;AAAA,EACT;AACA,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAC7C,UAAM,IAAI;AAAA,MACR,oBAAoBA,KAAI;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,KAAK,YAAY,QAAW;AAC9B,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,MAAI,OAAO,KAAK,YAAY,UAAU;AACpC,WAAO,CAAC,KAAK,OAAO;AAAA,EACtB;AACA,MAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;AAC/B,WAAO,KAAK;AAAA,EACd;AACA,QAAM,IAAI;AAAA,IACR,oBAAoBA,KAAI;AAAA,EAC1B;AACF;AAEA,SAAS,yBACP,SACmB;AACnB,MAAI,YAAY,QAAW;AACzB,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,aAAW,CAACA,OAAM,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAM,UAAU,sBAAsBA,OAAM,IAAI;AAChD,UAAM,iBAAa;AAAA,MACjB,mBAAmBA,OAAM,IAAI;AAAA,MAC7B,EAAE,OAAO,oBAAoB,IAAI,EAAE;AAAA,IACrC;AACA,UAAM,QACJ,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,IAC5D,OACA,CAAC;AACP,YAAQ,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO;AAAA,MACP,MAAM,WAAW;AAAA,MACjB,SAAS,uBAAuB,OAAO;AAAA,MACvC,YAAY;AAAA,MACZ,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAMA,SAAS,aACP,OACA,QACA,oBACA,gBACsB;AAItB,QAAM,qBACJ,MAAM,eAAe,QACrB,MAAM,YAAY;AACpB,QAAM,eAAe,YAAY,QAAQ,MAAM,MAAM,kBAAkB;AACvE,QAAM,gBACJ,MAAM,WAAW,SAAY,YAAY,MAAM,MAAM,IAAI;AAC3D,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,OAAO,MAAM,SAAS;AAAA,IACtB,MAAM;AAAA,IACN,YAAY;AAAA,EACd,CAAC,EAAE,IAAI,CAAC,cAAc;AAAA,IACpB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS,SAAS;AAAA,IACzB,MAAM,SAAS;AAAA,IACf,SAAS,SAAS;AAAA;AAAA;AAAA;AAAA,IAIlB,GAAI,kBAAkB,SAAY,EAAE,UAAU,cAAc,IAAI,CAAC;AAAA,IACjE,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACP,EAAE;AACJ;AAEA,SAAS,2BAA2B,OAA2C;AAC7E,QAAM,SAAS,oBAAI,IAA2B;AAE9C,aAAW,UAAU,MAAM,SAAS;AAClC,UAAM,YAAY,qBAAqB,MAAM;AAC7C,eAAWC,SAAQ,UAAU,OAAO;AAClC,YAAM,UAAU,OAAO,IAAIA,KAAI,KAAK,CAAC;AACrC,UAAI,CAAC,QAAQ,SAAS,UAAU,MAAM,GAAG;AACvC,gBAAQ,KAAK,UAAU,MAAM;AAAA,MAC/B;AACA,aAAO,IAAIA,OAAM,OAAO;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAACA,OAAM,OAAO,OAAO;AAAA,IACrD,GAAG;AAAA,IACH,SAAS;AAAA,IACT,MAAM,YAAYA,OAAM,MAAM,IAAI;AAAA,IAClC;AAAA,IACA,YAAY;AAAA,EACd,EAAE;AACJ;AAEA,SAAS,qBAAqB,QAAsC;AAClE,QAAM,aAAa,qBAAqB,MAAM;AAC9C,MAAI,eAAe,UAAU,eAAe,OAAO;AACjD,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,WAAW,eAAe,OAAO;AAClD,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,YAAY,eAAe,OAAO;AACnD,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,oBAAoB;AAAA,EACzD;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,mBAAmB;AAAA,EACxD;AACA,MAAI,eAAe,YAAY;AAC7B,WAAO,EAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,wBAAwB;AAAA,EAC7D;AAEA,QAAM,IAAI;AAAA,IACR,wBAAwB,KAAK,UAAU,MAAM,CAAC;AAAA,EAChD;AACF;AAEA,SAAS,qBAAqB,QAAwB;AACpD,MAAI,OAAO,WAAW,GAAG,wBAAwB,GAAG,GAAG;AACrD,WAAO,OAAO,MAAM,GAAG,wBAAwB,IAAI,MAAM;AAAA,EAC3D;AACA,MAAI,OAAO,WAAW,eAAe,GAAG;AACtC,WAAO,OAAO,MAAM,gBAAgB,MAAM;AAAA,EAC5C;AACA,MAAI,OAAO,SAAS,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,MAAM,CAAC;AAAA,IAChD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAYA,OAAmB,MAAsB;AAC5D,QAAM,aAAa,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AAC1D,SAAO,GAAGA,KAAI,IAAI,UAAU;AAC9B;AAEA,SAAS,wBACP,OACoB;AACpB,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,qBAAqB,OAAyC;AACrE,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,GAAI,MAAM,gBAAgB,SACtB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,gBACP,WACsB;AACtB,QAAM,QAAQ,oBAAI,IAAgC;AAElD,aAAW,YAAY,WAAW;AAChC,UAAM,MAAM,GAAG,SAAS,OAAO,KAAS,SAAS,KAAK,KAAS,SAAS,IAAI,KAAS,SAAS,YAAY,EAAE;AAC5G,UAAM,WAAW,MAAM,IAAI,GAAG;AAC9B,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI,KAAK,wBAAwB,QAAQ,CAAC;AAChD;AAAA,IACF;AAEA,UAAM,OAAO,IAAI,IAAI,SAAS,OAAO;AACrC,eAAW,UAAU,SAAS,SAAS;AACrC,UAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,iBAAS,QAAQ,KAAK,MAAM;AAC5B,aAAK,IAAI,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QACE,SAAS,gBAAgB,UACzB,SAAS,gBAAgB,QACzB;AACA,eAAS,cAAc,SAAS;AAAA,IAClC;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAEA,SAAS,2BAA2B,OAAmC;AACrE,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA,MAAM;AAAA,IACN,SAAS,CAAC,6BAA6B;AAAA,EACzC;AACF;AAEA,SAAS,8BACP,WACsB;AACtB,MAAI,UAAU,WAAW,GAAG;AAC1B,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,SAAS,IAAI;AAAA,IACjB,UACG,OAAO,CAAC,aAAa,SAAS,YAAY,6BAA6B,EACvE,IAAI,CAAC,aAAa,SAAS,KAAK;AAAA,EACrC;AACA,SAAO,gBAAgB;AAAA,IACrB,GAAG;AAAA,IACH,GAAG,CAAC,GAAG,MAAM,EAAE,IAAI,0BAA0B;AAAA,EAC/C,CAAC;AACH;AAEA,SAAS,6BAAmD;AAC1D,SAAO;AAAA,IACL,GAAG,CAAC,uBAAuB,SAAS,EAAE,IAAI,CAAC,UAAU;AAAA,MACnD,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,MACA,SAAS,CAAC,oBAAoB,oBAAoB,mBAAmB;AAAA,IACvE,EAAE;AAAA,IACF;AAAA,MACE,SAAS;AAAA,MACT,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SAAS,CAAC,2BAA2B;AAAA,IACvC;AAAA,EACF;AACF;AAEA,SAAS,iCAAqD;AAC5D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,sBAAsB,uBAAuB,sBAAsB;AAAA,EAC/E;AACF;AAOO,SAAS,uBACd,QACAC,WAAkC,CAAC,GACV;AACzB,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oCACJA,SAAQ,qCAAqC;AAC/C,QAAM,YAAY,OAAO,IAAI,gBAAgB;AAC7C,QAAM,WAAW,UAAU,IAAI,eAAe;AAC9C,QAAM,YAAY,SAAS,QAAQ,CAAC,UAAU,MAAM,SAAS;AAC7D,QAAM,oBAAoB,SAAS;AAAA,IAAQ,CAAC,UAC1C,MAAM,oBAAoB,IAAI,CAAC,cAAc;AAAA,MAC3C,GAAG;AAAA,MACH,aAAa,gBAAgB,SAAS,WAAW;AAAA,IACnD,EAAE;AAAA,EACJ;AAEA,MAAI,mCAAmC;AACrC,cAAU,KAAK,GAAG,2BAA2B,CAAC;AAC9C,cAAU,KAAK,+BAA+B,CAAC;AAAA,EACjD;AACA,QAAM,oCACJ,8BAA8B,SAAS;AAEzC,QAAM,mBAAmB,oBAAI,IAAwB;AACrD,aAAW,YAAY,WAAW;AAChC,UAAM,UAAU,iBAAiB,IAAI,SAAS,MAAM;AACpD,QAAI,YAAY,QAAW;AACzB,uBAAiB,IAAI,SAAS,QAAQ,CAAC,QAAQ,CAAC;AAAA,IAClD,OAAO;AACL,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,kBACJ,oCACI,CAAC,GAAG,iBAAiB,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,YAAY,OAAO;AAAA,IAC/D,KAAK,GAAG,qBAAqB,GAAG,MAAM;AAAA,IACtC;AAAA,IACA,WAAW,aAAa,IAAI,CAAC,cAAc;AAAA,MACzC,GAAG;AAAA,MACH,aAAa,SAAS,aAAa,IAAI,oBAAoB;AAAA,IAC7D,EAAE;AAAA,EACJ,EAAE,IACF,CAAC;AAEP,SAAO;AAAA,IACL;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA,UAAU,KAAK,IAAI,GAAG,SAAS,IAAI,CAAC,UAAU,MAAM,QAAQ,CAAC;AAAA,IAC7D,oBAAoB,SAAS,KAAK,CAAC,UAAU,MAAM,kBAAkB;AAAA,EACvE;AACF;AAmDO,SAAS,mCACd,WACc;AACd,QAAM,MAAoB,CAAC;AAC3B,aAAW,KAAK,WAAW;AACzB,UAAM,eAAe,sBAAsB,EAAE,OAAO;AACpD,QAAI,iBAAiB,QAAW;AAC9B,YAAM,IAAI;AAAA,QACR,oBAAoB,EAAE,OAAO,mDAA8C,OAAO,KAAK,qBAAqB,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1H;AAAA,IACF;AACA,QAAI,IAAI,YAAY,MAAM,QAAW;AACnC,UAAI,YAAY,IAAI,CAAC;AAAA,IACvB;AACA,UAAM,WAAW,IAAI,YAAY;AACjC,UAAM,WAAW,SAAS,EAAE,IAAI;AAChC,QAAI,aAAa,QAAW;AAE1B,eAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO;AAAA,IAClC,OAAO;AAEL,YAAM,OAAO,IAAI,IAAI,QAAQ;AAC7B,iBAAW,UAAU,EAAE,SAAS;AAC9B,YAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,mBAAS,KAAK,MAAM;AACpB,eAAK,IAAI,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,wCACd,WACmB;AACnB,QAAM,UAAU,oBAAI,IAAkC;AACtD,aAAW,YAAY,WAAW;AAChC,UAAM,UAAU,QAAQ,IAAI,SAAS,KAAK;AAC1C,QAAI,YAAY,QAAW;AACzB,cAAQ,IAAI,SAAS,OAAO,CAAC,QAAQ,CAAC;AAAA,IACxC,OAAO;AACL,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,MAAyB,CAAC;AAChC,aAAW,CAAC,OAAO,OAAO,KAAK,QAAQ,QAAQ,GAAG;AAChD,QAAI,KAAK,IAAI,mCAAmC,OAAO;AAAA,EACzD;AACA,SAAO;AACT;AAsBO,SAAS,uBACd,UACc;AACd,QAAM,MAA4B,CAAC,GAAG,SAAS,SAAS;AACxD,aAAW,YAAY,SAAS,qBAAqB;AACnD,eAAW,QAAQ,SAAS,aAAa;AACvC,UAAI,KAAK,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO,mCAAmC,GAAG;AAC/C;;;AD37CA,IAAAC,oBAAqC;AAWrC,IAAMC,gBAAe;AACrB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,sBAAsB;AA6FrB,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAA6B,QAA8B;AAA9B;AAwB7B,SAAS,eAAe;AAAA,MACtB,MAAM,OAAOC,WAAyC,CAAC,MAA6C;AAClG,YAAIA,SAAQ,aAAa;AACvB,gBAAM,UAAU,MAAM,KAAK,MAAM,aAAa,KAAK;AACnD,cAAI,QAAQ,MAAM,QAAQ,KAAK,SAAS,EAAG,QAAO;AAClD,cAAI,CAAC,QAAQ,MAAM,CAAC,oBAAoB,QAAQ,KAAK,EAAG,QAAO;AAE/D,gBAAM,YAAY,MAAM,KAAK,aAAa,KAAK;AAC/C,cAAI,UAAU,MAAMA,SAAQ,iBAAiB,OAAO;AAClD,kBAAM,KAAK,gCAAgC,UAAU,IAAI;AAAA,UAC3D;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,SAAS,KAAK,KAAK,EAAE,QAAQ,sBAAsB,CAAC;AACzE,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,eAAqC,CAAC;AAC5C,mBAAW,OAAO,OAAO,KAAK,MAAM;AAClC,gBAAM,SAAS,MAAM,SAAS,KAAK,IAA6B,GAAG;AACnE,cAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,uBAAa,KAAK,sBAAsB,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,QAChE;AAEA,qBAAa,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC1D,mBAAO,yBAAG,YAAY;AAAA,MACxB;AAAA,MAEA,KAAK,OAAO,UAAuD;AACjE,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,MAAM,eAAe,KAAK;AAChC,cAAM,SAAS,MAAM,SAAS,KAAK,IAA6B,GAAG;AACnE,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,mBAAO,yBAAG,sBAAsB,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,MACxD;AAAA,MAEA,UAAU,OAAO,aAAyE;AACxF,cAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAChE,cAAM,UAAU,uBAAuB,SAAS;AAChD,YAAI,QAAQ,gBAAgB,WAAW,GAAG;AACxC,qBAAO;AAAA,gBACL;AAAA,cACE;AAAA,cACA;AAAA,cACAD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,KAAK,OAAO,2BAA2B;AAE7C,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,YAAI;AACJ,mBAAW,UAAU,QAAQ,iBAAiB;AAC5C,gBAAM,eAAe,SAAS,OAAO,SAAS;AAC9C,cAAI,MAAM,KAAK,wBAAwB,OAAO,QAAQ,YAAY,GAAG;AACnE,yBAAa;AAAA,cACX,OAAO,OAAO;AAAA,cACd,WAAW,OAAO;AAAA,cAClB;AAAA,cACA,MAAM,OAAO,UAAU,CAAC,GAAG;AAAA,cAC3B,aAAa,OAAO,UAAU,CAAC,GAAG;AAAA,YACpC;AACA;AAAA,UACF;AAEA,gBAAM,SAAS;AAAA,YACb,QAAQ,OAAO;AAAA,YACf,WAAW,OAAO;AAAA,YAClB,eAAe;AAAA,YACf,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,UACrC;AACF,gBAAM,UAAU,MAAM,SAAS,KAAK,IAAI,OAAO,KAAK,MAAM;AAC1D,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,uBAAa,sBAAsB,OAAO,KAAK,MAAM;AACrD,gBAAM,KAAK,8BAA8B,UAAU;AAAA,QACnD;AAEA,mBAAO,yBAAG,UAAW;AAAA,MACvB;AAAA,MAEA,QAAQ,OAAO,UAAyC;AACtD,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,UAAU,MAAM,SAAS,KAAK,OAAO,eAAe,KAAK,CAAC;AAChE,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,cAAM,KAAK,8BAA8B,KAAK;AAC9C,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAAA,IACF;AAEA,SAAS,SAAS;AAAA,MAChB,MAAM,OAAOC,WAAmC,CAAC,MAAuC;AACtF,YAAIA,SAAQ,aAAa;AACvB,gBAAM,UAAU,MAAM,KAAK,MAAM,OAAO,KAAK;AAC7C,cAAI,QAAQ,MAAM,QAAQ,KAAK,SAAS,EAAG,QAAO;AAClD,cAAI,CAAC,QAAQ,MAAM,CAAC,oBAAoB,QAAQ,KAAK,EAAG,QAAO;AAE/D,gBAAM,YAAY,MAAM,KAAK,OAAO,eAAe;AACnD,cAAI,UAAU,MAAMA,SAAQ,iBAAiB,OAAO;AAClD,kBAAM,KAAK,0BAA0B,UAAU,IAAI;AAAA,UACrD;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,SAAS,KAAK,KAAK,EAAE,QAAQ,oBAAoB,CAAC;AACvE,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,SAAyB,CAAC;AAChC,mBAAW,OAAO,OAAO,KAAK,MAAM;AAClC,gBAAM,SAAS,MAAM,SAAS,KAAK,IAAuB,GAAG;AAC7D,cAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,iBAAO,KAAK,gBAAgB,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,QACpD;AAEA,eAAO,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,KAAK,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AACxF,mBAAO,yBAAG,MAAM;AAAA,MAClB;AAAA,MAEA,KAAK,OAAO,YAAmD;AAC7D,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,SAAS,KAAK,IAAuB,SAAS,OAAO,CAAC;AAC3E,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAC9C,mBAAO,yBAAG,gBAAgB,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC;AAAA,MAChE;AAAA,MAEA,UAAU,OAAO,UAAmE;AAClF,cAAM,KAAK,OAAO,2BAA2B;AAE7C,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,qBAAqB,KAAK;AACzC,cAAM,UAAU,MAAM,SAAS,KAAK,IAAI,SAAS,OAAO,QAAQ,GAAG,MAAM;AACzE,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,cAAM,aAAa,gBAAgB,SAAS,OAAO,QAAQ,GAAG,MAAM;AACpE,cAAM,KAAK,wBAAwB,UAAU;AAC7C,mBAAO,yBAAG,UAAU;AAAA,MACtB;AAAA,MAEA,gBAAgB,YAA6C;AAC3D,cAAM,SAAS,MAAM,KAAK,OAAO,UAAU,EAAE,KAAK;AAClD,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,aAA6B,CAAC;AACpC,mBAAW,SAAS,OAAO,MAAM;AAC/B,gBAAM,SAAS,MAAM,KAAK,OAAO,SAAS,KAAK;AAC/C,cAAI,CAAC,OAAO,GAAI,QAAO;AACvB,qBAAW,KAAK,OAAO,IAAI;AAAA,QAC7B;AACA,mBAAO,yBAAG,UAAU;AAAA,MACtB;AAAA,MAEA,QAAQ,OAAO,YAA2C;AACxD,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,UAAU,MAAM,SAAS,KAAK,OAAO,SAAS,OAAO,CAAC;AAC5D,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,cAAM,KAAK,wBAAwB,OAAO;AAC1C,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAAA,IACF;AAEA,SAAS,cAAc;AAAA,MACrB,OAAO,OACLA,WAAyC,CAAC,MACC;AAC3C,cAAM,UAAU,KAAK,OAAO,uBAAuB;AACnD,YAAI,CAAC,SAAS;AACZ,qBAAO,8BAAI;AAAA,YACT;AAAA,YACA;AAAA,YACAD;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,UAAU,MAAM,QAAQ,MAAMC,QAAO;AAC3C,eAAO,QAAQ,SAAK,yBAAG,QAAQ,IAAI,IAAI,WAAW,QAAQ,KAAK;AAAA,MACjE;AAAA,MAEA,MAAM,OACJA,WAAwC,CAAC,MACA;AACzC,YAAIA,SAAQ,aAAa;AACvB,gBAAM,UAAU,MAAM,KAAK,MAAM,YAAY,KAAKA,QAAO;AACzD,cAAI,QAAQ,MAAM,QAAQ,KAAK,SAAS,EAAG,QAAO;AAClD,cAAI,CAAC,QAAQ,MAAM,CAAC,oBAAoB,QAAQ,KAAK,EAAG,QAAO;AAE/D,gBAAM,OAAO,MAAM,KAAK,YAAY,KAAK;AAAA,YACvC,WAAWA,SAAQ;AAAA,YACnB,OAAOA,SAAQ;AAAA,UACjB,CAAC;AACD,cAAI,KAAK,MAAMA,SAAQ,iBAAiB,OAAO;AAC7C,kBAAM,KAAK,+BAA+B,KAAK,IAAI;AAAA,UACrD;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,SAAS,MAAM,KAAK,OAAO,UAAU,EAAE,KAAK;AAClD,YAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,cAAM,eAAeA,SAAQ,QACzB,OAAO,KAAK,OAAO,CAAC,UAAU,MAAM,OAAOA,SAAQ,SAAS,MAAM,SAASA,SAAQ,KAAK,IACxF,OAAO;AAEX,cAAM,cAAmC,CAAC;AAC1C,mBAAW,SAAS,cAAc;AAChC,gBAAM,SAAS,KAAK,OAAO,UAAU,EAAE,IAAI,MAAM,EAAE,EAAE;AAErD,cAAIA,SAAQ,cAAc,YAAY;AACpC,kBAAM,UAAU,MAAM,OAAO,KAAK;AAClC,gBAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,wBAAY,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,MAAM,cAAc,GAAG,OAAO,SAAS,CAAC,CAAC;AAAA,UACjF;AAEA,cAAIA,SAAQ,cAAc,WAAW;AACnC,kBAAM,WAAW,MAAM,OAAO,aAAa;AAC3C,gBAAI,CAAC,SAAS,GAAI,QAAO,WAAW,SAAS,KAAK;AAClD,wBAAY,KAAK,GAAG,SAAS,KAAK,IAAI,CAAC,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,CAAC;AAAA,UACnF;AAAA,QACF;AAEA,oBAAY,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,KAAK,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;AAC3F,mBAAO,yBAAG,WAAW;AAAA,MACvB;AAAA,MAEA,QAAQ,OACN,UACwD;AACxD,cAAM,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAM;AACtD,cAAM,UAAU,KAAK,OAAO,uBAAuB;AACnD,YAAI,SAAS;AACX,gBAAMC,WAAU,MAAM,QAAQ,OAAO,GAAG;AACxC,iBAAOA,SAAQ,SAAK,yBAAGA,SAAQ,IAAI,IAAI,WAAWA,SAAQ,KAAK;AAAA,QACjE;AAGA,YAAI,OAAO,UAAU,UAAU;AAC7B,qBAAO,8BAAI;AAAA,YACT;AAAA,YACA;AAAA,YACAF;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK;AACjD,YAAI,CAAC,MAAM,GAAI,QAAO;AACtB,cAAM,UAAU,MAAM,KAAK,OAAO,UAAU,EAAE,IAAI,MAAM,KAAK,EAAE,EAAE,YAAY,OAAO,GAAG;AACvF,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,mBAAO,yBAAG,MAAS;AAAA,MACrB;AAAA,IACF;AAEA,SAAS,QAAQ;AAAA,MACf,QAAQ,YAAuD;AAC7D,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,YAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,mBAAO,yBAAG,EAAE,UAAU,iBAAiB,CAAC;AAAA,MAC1C;AAAA,MAEA,SAAS,YAAwD;AAC/D,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,cAAM,eAAe,MAAM,KAAK,aAAa,KAAK;AAClD,YAAI,CAAC,aAAa,GAAI,QAAO;AAE7B,cAAM,SAAS,MAAM,KAAK,OAAO,KAAK;AACtC,YAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,cAAM,cAAc,MAAM,KAAK,YAAY,KAAK;AAChD,YAAI,CAAC,YAAY,GAAI,QAAO;AAE5B,cAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,cAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,YAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,cAAM,aAAa;AAAA,UACjB,EAAE,KAAK,2BAA2B;AAAA,UAClC,EAAE,KAAK,gCAAgC;AAAA,UACvC,EAAE,KAAK,qBAAqB;AAAA,UAC5B,EAAE,KAAK,0BAA0B;AAAA,UACjC,EAAE,KAAK,yBAAyB;AAAA,UAChC,GAAG,aAAa,KAAK,IAAI,CAAC,SAAS;AAAA,YACjC,KACE;AAAA,YACF,QAAQ;AAAA,cACN,IAAI;AAAA,cACJ,IAAI,QAAQ;AAAA,cACZ,IAAI,eAAe;AAAA,cACnB,IAAI,aAAa;AAAA,cACjB,KAAK,UAAU,IAAI,SAAS;AAAA,YAC9B;AAAA,UACF,EAAE;AAAA,UACF,GAAG,aAAa,KAAK,IAAI,CAAC,SAAS;AAAA,YACjC,KACE;AAAA,YACF,QAAQ,CAAC,IAAI,OAAO,IAAI,gBAAgB,SAAS,IAAI,SAAS,GAAG,QAAQ;AAAA,UAC3E,EAAE;AAAA,UACF,GAAG,OAAO,KAAK,IAAI,CAAC,WAAW;AAAA,YAC7B,KACE;AAAA,YACF,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,MAAM;AAAA,cACN,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,UAAU,MAAM,WAAW;AAAA,cAChC,MAAM;AAAA,cACN,MAAM,gBAAgB;AAAA,cACtB,MAAM,aAAa;AAAA,cACnB,MAAM,WAAW,YAAY,KAAK;AAAA,YACpC;AAAA,UACF,EAAE;AAAA,UACF,GAAG,YAAY,KAAK,IAAI,CAAC,gBAAgB;AAAA,YACvC,KACE;AAAA,YACF,QAAQ;AAAA,cACN,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW,aAAa;AAAA,cACxB,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW,gBAAgB;AAAA,cAC3B,WAAW;AAAA,cACX,KAAK,UAAU,WAAW,OAAO;AAAA,cACjC,WAAW,OAAO,YAAY;AAAA,cAC9B,WAAW;AAAA,cACX,WAAW,WAAW,YAAY,KAAK;AAAA,cACvC;AAAA,YACF;AAAA,UACF,EAAE;AAAA,UACF;AAAA,YACE,KAAK;AAAA,YACL,QAAQ,CAAC,gBAAgB,UAAU,aAAa,KAAK,MAAM;AAAA,UAC7D;AAAA,UACA;AAAA,YACE,KAAK;AAAA,YACL,QAAQ,CAAC,UAAU,UAAU,OAAO,KAAK,MAAM;AAAA,UACjD;AAAA,UACA;AAAA,YACE,KAAK;AAAA,YACL,QAAQ,CAAC,eAAe,UAAU,YAAY,KAAK,MAAM;AAAA,UAC3D;AAAA,QACF;AAEA,cAAM,UAAU,MAAM,SAAS,KAAK,MAAM,UAAU;AACpD,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,mBAAO,yBAAG;AAAA,UACR,UAAU;AAAA,UACV,cAAc,aAAa,KAAK;AAAA,UAChC,QAAQ,OAAO,KAAK;AAAA,UACpB,aAAa,YAAY,KAAK;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MAEA,cAAc;AAAA,QACZ,MAAM,YAAmD;AACvD,gBAAM,WAAW,KAAK,UAAU;AAChC,cAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,gBAAM,UAAU,MAAM,SAAS,KAAK;AAAA,YAClC;AAAA,UACF;AACA,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,qBAAO,yBAAI,QAAQ,KAAK,KAA4C,IAAI,yBAAyB,CAAC;AAAA,QACpG;AAAA,MACF;AAAA,MAEA,QAAQ;AAAA,QACN,MAAM,YAA6C;AACjD,gBAAM,WAAW,KAAK,UAAU;AAChC,cAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,gBAAM,UAAU,MAAM,SAAS,KAAK;AAAA,YAClC;AAAA,UACF;AACA,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,qBAAO,yBAAI,QAAQ,KAAK,KAAsC,IAAI,mBAAmB,CAAC;AAAA,QACxF;AAAA,MACF;AAAA,MAEA,aAAa;AAAA,QACX,MAAM,OACJC,WAAwC,CAAC,MACA;AACzC,gBAAM,WAAW,KAAK,UAAU;AAChC,cAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,gBAAM,QAAkB,CAAC;AACzB,gBAAM,SAAqB,CAAC;AAC5B,cAAIA,SAAQ,aAAaA,SAAQ,cAAc,OAAO;AACpD,kBAAM,KAAK,eAAe;AAC1B,mBAAO,KAAKA,SAAQ,SAAS;AAAA,UAC/B;AACA,cAAIA,SAAQ,OAAO;AACjB,kBAAM,KAAK,kCAAkC;AAC7C,mBAAO,KAAKA,SAAQ,OAAOA,SAAQ,KAAK;AAAA,UAC1C;AAEA,gBAAM,UAAU,MAAM,SAAS,KAAK;AAAA,YAClC,8JACE,MAAM,SAAS,IAAI,UAAU,MAAM,KAAK,OAAO,CAAC,KAAK,EACvD;AAAA,YACA;AAAA,UACF;AACA,cAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAEhD,qBAAO,yBAAI,QAAQ,KAAK,KAA2C,IAAI,wBAAwB,CAAC;AAAA,QAClG;AAAA,MACF;AAAA,MAEA,OAAO,OACL,KACA,WACsC;AACtC,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AACzB,cAAM,UAAU,MAAM,SAAS,KAAK,MAAS,KAAK,MAAM;AACxD,YAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,mBAAO,yBAAG,QAAQ,IAAI;AAAA,MACxB;AAAA,MAEA,QAAQ,YAAiD;AACvD,cAAM,WAAW,KAAK,UAAU;AAChC,YAAI,CAAC,SAAS,GAAI,QAAO;AACzB,cAAM,UAAU,MAAM,SAAS,KAAK;AAAA,UAClC;AAAA,QACF;AACA,YAAI,CAAC,QAAQ,IAAI;AACf,cAAI,oBAAoB,QAAQ,KAAK,GAAG;AACtC,uBAAO,yBAAG,EAAE,UAAU,kBAAkB,OAAO,WAAW,SAAS,CAAC,EAAE,CAAC;AAAA,UACzE;AACA,iBAAO,WAAW,QAAQ,KAAK;AAAA,QACjC;AACA,mBAAO,yBAAG;AAAA,UACR,UAAU;AAAA,UACV,OAAO;AAAA,UACP,SAAU,QAAQ,KAAK,KAA0C,IAAI,CAAC,CAAC,QAAQ,UAAU,KAAK,OAAO;AAAA,YACnG;AAAA,YACA;AAAA,YACA;AAAA,UACF,EAAE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EA3e4D;AAAA,EAE5D,MAAM,SAAyC;AAC7C,UAAM,OAAO,MAAM,KAAK,aAAa,KAAK;AAC1C,QAAI,CAAC,KAAK,GAAI,QAAO;AAErB,UAAM,cAAc,MAAM,KAAK,YAAY,KAAK;AAChD,QAAI,CAAC,YAAY,GAAI,QAAO;AAE5B,UAAM,SAAS,MAAM,KAAK,OAAO,KAAK;AACtC,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,eAAO,yBAAG;AAAA,MACR,KAAK,KAAK,OAAO,OAAO;AAAA,MACxB,MAAM,KAAK,OAAO,QAAQ;AAAA,MAC1B,gBAAgB,KAAK,OAAO,kBAAkB;AAAA,MAC9C,gBAAgB,KAAK,OAAO,kBAAkB;AAAA,MAC9C,cAAc,KAAK,KAAK;AAAA,MACxB,QAAQ,OAAO,KAAK;AAAA,MACpB,oBAAoB,YAAY,KAAK,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS,EAAE;AAAA,MAC9E,qBAAqB,YAAY,KAAK,OAAO,CAAC,MAAM,EAAE,cAAc,UAAU,EAAE;AAAA,IAClF,CAAC;AAAA,EACH;AAAA,EAudQ,YAAgC;AACtC,UAAM,iBAAiB,KAAK,OAAO,kBAAkB;AACrD,QAAI,CAAC,gBAAgB;AACnB,iBAAO;AAAA,YACL;AAAA,UACE;AAAA,UACA;AAAA,UACAD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,eAAO,yBAAG,KAAK,OAAO,UAAU,EAAE,IAAI,cAAc,EAAE,EAAE;AAAA,EAC1D;AAAA,EAEQ,YAAqC;AAC3C,UAAM,KAAK,KAAK,OAAO,eAAe;AACtC,QAAI,CAAC,IAAI;AACP,iBAAO;AAAA,YACL;AAAA,UACE;AAAA,UACA;AAAA,UACAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,eAAO,yBAAG,EAAE;AAAA,EACd;AAAA,EAEA,MAAc,wBAAwB,OAAe,cAAwC;AAC3F,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,UAAU,MAAM,SAAS,KAAK;AAAA,MAClC;AAAA,MACA,CAAC,OAAO,YAAY;AAAA,IACtB;AACA,WAAO,QAAQ,MAAM,QAAQ,KAAK,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,MAAc,8BAA8B,KAAwC;AAClF,UAAM,mBAAmB,MAAM,KAAK,uBAAuB,GAAG,CAAC;AAAA,EACjE;AAAA,EAEA,MAAc,uBAAuB,KAAgD;AACnF,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AAErC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,YAAY,IAAI,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1D,UAAM,eAAe,IAAI,gBAAgB,SAAS,IAAI,SAAS;AAC/D,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC;AAAA,QACE,KACE;AAAA,QACF,QAAQ;AAAA,UACN,IAAI;AAAA,UACJ,IAAI,QAAQ;AAAA,UACZ,IAAI,eAAe;AAAA,UACnB;AAAA,UACA,KAAK,UAAU,IAAI,SAAS;AAAA,QAC9B;AAAA,MACF;AAAA,MACA;AAAA,QACE,KACE;AAAA,QACF,QAAQ,CAAC,IAAI,OAAO,cAAc,SAAS;AAAA,MAC7C;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,8BAA8B,OAA8B;AACxE,UAAM,mBAAmB,MAAM,KAAK,uBAAuB,KAAK,CAAC;AAAA,EACnE;AAAA,EAEA,MAAc,uBAAuB,OAAsC;AACzE,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AACrC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC,EAAE,KAAK,6CAA6C,QAAQ,CAAC,KAAK,EAAE;AAAA,MACpE,EAAE,KAAK,kDAAkD,QAAQ,CAAC,KAAK,EAAE;AAAA,IAC3E,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,wBAAwB,OAAoC;AACxE,UAAM,mBAAmB,MAAM,KAAK,iBAAiB,KAAK,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAc,iBAAiB,OAA4C;AACzE,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AACrC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,YAAY,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC5D,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC;AAAA,QACE,KACE;AAAA,QACF,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,KAAK,UAAU,MAAM,WAAW;AAAA,UAChC,MAAM;AAAA,UACN,MAAM,gBAAgB;AAAA,UACtB;AAAA,UACA,MAAM,WAAW,YAAY,KAAK;AAAA,QACpC;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,wBAAwB,SAAgC;AACpE,UAAM,mBAAmB,MAAM,KAAK,iBAAiB,OAAO,CAAC;AAAA,EAC/D;AAAA,EAEA,MAAc,iBAAiB,SAAwC;AACrE,UAAM,WAAW,KAAK,UAAU;AAChC,QAAI,CAAC,SAAS,GAAI,YAAO,yBAAG,MAAS;AACrC,UAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,MACxC,EAAE,KAAK,yCAAyC,QAAQ,CAAC,OAAO,EAAE;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,WAAW,QAAQ,KAAK;AAChD,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA,EAEA,MAAc,aAAa,OAA2C;AACpE,UAAM,SAAS,MAAM,KAAK,OAAO,UAAU,EAAE,KAAK;AAClD,QAAI,CAAC,OAAO,GAAI,QAAO,WAAW,OAAO,KAAK;AAE9C,UAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,cAAc,UAAU,OAAO,SAAS,UAAU,SAAS,KAAK;AAChG,QAAI,CAAC,OAAO;AACV,iBAAO;AAAA,YACL,mCAAa,mBAAmB,8BAA8B,KAAK,UAAU,KAAK,CAAC,IAAIA,aAAY;AAAA,MACrG;AAAA,IACF;AACA,eAAO,yBAAG,KAAK;AAAA,EACjB;AAAA,EAEA,MAAc,gCAAgC,cAAmD;AAC/F,UAAM,mBAAmB,YAAY;AACnC,YAAM,WAAW,KAAK,UAAU;AAChC,UAAI,CAAC,SAAS,GAAI;AAClB,YAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,UAAI,CAAC,OAAO,GAAI;AAEhB,YAAM,SAAS,KAAK,MAAM;AAAA,QACxB,EAAE,KAAK,2BAA2B;AAAA,QAClC,EAAE,KAAK,gCAAgC;AAAA,QACvC,GAAG,aAAa,IAAI,CAAC,SAAS;AAAA,UAC5B,KACE;AAAA,UACF,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,IAAI,QAAQ;AAAA,YACZ,IAAI,eAAe;AAAA,YACnB,IAAI,aAAa;AAAA,YACjB,KAAK,UAAU,IAAI,SAAS;AAAA,UAC9B;AAAA,QACF,EAAE;AAAA,QACF,GAAG,aAAa,IAAI,CAAC,SAAS;AAAA,UAC5B,KACE;AAAA,UACF,QAAQ,CAAC,IAAI,OAAO,IAAI,gBAAgB,SAAS,IAAI,SAAS,GAAG,QAAQ;AAAA,QAC3E,EAAE;AAAA,QACF;AAAA,UACE,KAAK;AAAA,UACL,QAAQ,CAAC,gBAAgB,UAAU,aAAa,MAAM;AAAA,QACxD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,0BAA0B,QAAuC;AAC7E,UAAM,mBAAmB,YAAY;AACnC,YAAM,WAAW,KAAK,UAAU;AAChC,UAAI,CAAC,SAAS,GAAI;AAClB,YAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,UAAI,CAAC,OAAO,GAAI;AAEhB,YAAM,SAAS,KAAK,MAAM;AAAA,QACxB,EAAE,KAAK,qBAAqB;AAAA,QAC5B,GAAG,OAAO,IAAI,CAAC,WAAW;AAAA,UACxB,KACE;AAAA,UACF,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN,KAAK,UAAU,MAAM,WAAW;AAAA,YAChC,MAAM;AAAA,YACN,MAAM,gBAAgB;AAAA,YACtB,MAAM,aAAa;AAAA,YACnB,MAAM,WAAW,YAAY,KAAK;AAAA,UACpC;AAAA,QACF,EAAE;AAAA,QACF;AAAA,UACE,KAAK;AAAA,UACL,QAAQ,CAAC,UAAU,UAAU,OAAO,MAAM;AAAA,QAC5C;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,+BAA+B,aAAiD;AAC5F,UAAM,mBAAmB,YAAY;AACnC,YAAM,WAAW,KAAK,UAAU;AAChC,UAAI,CAAC,SAAS,GAAI;AAClB,YAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,mBAAmB,SAAS,IAAI;AAC1D,UAAI,CAAC,OAAO,GAAI;AAEhB,YAAM,SAAS,KAAK,MAAM;AAAA,QACxB,EAAE,KAAK,0BAA0B;AAAA,QACjC,GAAG,YAAY,IAAI,CAAC,gBAAgB;AAAA,UAClC,KACE;AAAA,UACF,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,WAAW;AAAA,YACX,WAAW;AAAA,YACX,WAAW,aAAa;AAAA,YACxB,WAAW;AAAA,YACX,WAAW;AAAA,YACX,WAAW,gBAAgB;AAAA,YAC3B,WAAW;AAAA,YACX,KAAK,UAAU,WAAW,OAAO;AAAA,YACjC,WAAW,OAAO,YAAY;AAAA,YAC9B,WAAW;AAAA,YACX,WAAW,WAAW,YAAY,KAAK;AAAA,YACvC;AAAA,UACF;AAAA,QACF,EAAE;AAAA,QACF;AAAA,UACE,KAAK;AAAA,UACL,QAAQ,CAAC,eAAe,UAAU,YAAY,MAAM;AAAA,QACtD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,mBAAmB,IAA4C;AAC3E,UAAM,WAAW,MAAM,GAAG,WAAW,MAAM;AAAA,MACzC,WAAW;AAAA,MACX,YAAY;AAAA,QACV;AAAA,UACE,IAAI;AAAA,UACJ,KAAK,CAAC,GAAG,sCAAoB;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,QAAO,WAAW,SAAS,KAAK;AAClD,eAAO,yBAAG,MAAS;AAAA,EACrB;AACF;AAYA,SAAS,eAAe,OAAuB;AAC7C,SAAO,GAAG,qBAAqB,GAAG,KAAK;AACzC;AAEA,SAAS,aAAa,KAAqB;AACzC,SAAO,IAAI,WAAW,qBAAqB,IAAI,IAAI,MAAM,sBAAsB,MAAM,IAAI;AAC3F;AAEA,SAAS,sBAAsB,KAAa,QAAqD;AAC/F,QAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,YAAY,CAAC;AACxE,QAAM,QAAQ,UAAU,CAAC;AACzB,SAAO;AAAA,IACL,OAAO,OAAO,UAAU,OAAO,SAAS,OAAO,UAAU,aAAa,GAAG;AAAA,IACzE;AAAA,IACA,WAAW,OAAO,cAAc,OAAO;AAAA,IACvC,MAAM,OAAO;AAAA,IACb,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO,iBAAiB,OAAO,gBAAgB,SAAS,SAAS;AAAA,EACjF;AACF;AAIA,SAAS,0BAA0B,KAAgD;AACjF,QAAM,CAAC,OAAOG,OAAM,aAAa,WAAW,cAAc,YAAY,IAAI;AAC1E,SAAO;AAAA,IACL;AAAA,IACA,MAAMA,SAAQ;AAAA,IACd,aAAa,eAAe;AAAA,IAC5B,WAAW,aAAa;AAAA,IACxB,WAAW,KAAK,MAAM,YAAY;AAAA,IAClC,cAAc,gBAAgB;AAAA,EAChC;AACF;AAoBA,SAAS,SAAS,SAAyB;AACzC,SAAO,GAAG,mBAAmB,GAAG,OAAO;AACzC;AAEA,SAAS,eAAe,KAAqB;AAC3C,SAAO,IAAI,WAAW,mBAAmB,IAAI,IAAI,MAAM,oBAAoB,MAAM,IAAI;AACvF;AAEA,SAAS,qBAAqB,OACV;AAClB,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,eAA6B,aAAa,QAC5C,QACA;AAAA,IACE,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ,MAAM,GAAG,MAAM,GAAG,EAAE,IAAI,KAAK,MAAM;AAAA,IACvD,UAAU,MAAM,SAAS;AAAA,IACzB,MAAO,MAAM,QAAQ;AAAA,IACrB,aAAa,MAAM,eAAe,CAAC;AAAA,IACnC,QAAQ;AAAA,IACR,WAAW,MAAM;AAAA,EACnB;AAEJ,SAAO;AAAA,IACL,UAAU,aAAa;AAAA,IACvB,MAAM,aAAa;AAAA,IACnB,WAAW,aAAa;AAAA,IACxB,MAAM,aAAa;AAAA,IACnB,aAAa,aAAa;AAAA,IAC1B,QAAQ,aAAa;AAAA,IACrB,eAAe,aAAa,gBAAgB;AAAA,IAC5C,YAAY;AAAA,IACZ,YAAY,aAAa,qBAAqB,OAC1C,aAAa,UAAU,YAAY,IACnC,aAAa;AAAA,EACnB;AACF;AAEA,SAAS,gBAAgB,KAAa,QAAyC;AAC7E,QAAM,YAAY,OAAO,cAAc,OAAO;AAC9C,SAAO;AAAA,IACL,SAAS,OAAO,YAAY,OAAO,WAAW,eAAe,GAAG;AAAA,IAChE,MAAM,OAAO,QAAQ,eAAe,GAAG,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK,eAAe,GAAG;AAAA,IAC/E,UAAU,OAAO,aAAa,OAAO,YAAY,OAAO,SAAS;AAAA,IACjE,MAAM,OAAO,QAAQ;AAAA,IACrB,aAAa,MAAM,QAAQ,OAAO,WAAW,IAAI,OAAO,cAAc,CAAC;AAAA,IACvE,QAAQ,OAAO,UAAU;AAAA,IACzB,cAAc,OAAO,iBAAiB,OAAO;AAAA,IAC7C,WAAW,OAAO,cAAc,OAAO;AAAA,IACvC,WAAW,YAAY,IAAI,KAAK,SAAS,IAAI;AAAA,EAC/C;AACF;AAIA,SAAS,oBAAoB,KAAoC;AAC/D,QAAM,CAAC,SAASA,OAAM,UAAU,MAAM,iBAAiB,QAAQ,cAAc,WAAW,SAAS,IAAI;AACrG,SAAO;AAAA,IACL;AAAA,IACA,MAAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,KAAK,MAAM,eAAe;AAAA,IACvC;AAAA,IACA,cAAc,gBAAgB;AAAA,IAC9B;AAAA,IACA,WAAW,YAAY,IAAI,KAAK,SAAS,IAAI;AAAA,EAC/C;AACF;AAEA,SAAS,SAAS,OAAwB;AACxC,QAAM,QAAQ,WAAW,KAAK;AAC9B,MAAI,OAAO;AACX,QAAM,QAAQ;AACd,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,YAAQ,OAAO,MAAM,WAAW,KAAK,CAAC;AACtC,WAAO,OAAO,QAAQ,IAAI,OAAO,KAAK;AAAA,EACxC;AACA,SAAO,KAAK,SAAS,EAAE,EAAE,SAAS,IAAI,GAAG;AAC3C;AAEA,SAAS,WAAW,OAAwB;AAC1C,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,IAAI,UAAU,EAAE,KAAK,GAAG,CAAC;AAAA,EAC5C;AACA,QAAM,SAAS;AACf,SAAO,IAAI,OAAO,KAAK,MAAM,EAC1B,KAAK,EACL,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,WAAW,OAAO,GAAG,CAAC,CAAC,EAAE,EAChE,KAAK,GAAG,CAAC;AACd;AA6BA,SAAS,yBAAyB,KAA8C;AAC9E,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,aAAa;AAAA,IACxB;AAAA,IACA;AAAA,IACA,cAAc,gBAAgB;AAAA,IAC9B;AAAA,IACA,SAAS,KAAK,MAAM,WAAW;AAAA,IAC/B,QAAQ,IAAI,KAAK,MAAM;AAAA,IACvB;AAAA,IACA,WAAW,YAAY,IAAI,KAAK,SAAS,IAAI;AAAA,EAC/C;AACF;AAEA,SAAS,cACP,YACA,OACA,WACmB;AACnB,SAAO;AAAA,IACL,KAAK,WAAW;AAAA,IAChB;AAAA,IACA,SAAS,WAAW,WAAW,MAAM;AAAA,IACrC,WAAW,MAAM;AAAA,IACjB,iBACE,cAAc,YACV,WAAW,cACX,WAAW,gBAAgB,WAAW;AAAA,IAC5C,aAAa,WAAW;AAAA,IACxB,cAAc,WAAW;AAAA,IACzB,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,QAAQ,WAAW,YACf,YACA,WAAW,OAAO,QAAQ,KAAK,KAAK,IAAI,IACtC,YACA;AAAA,IACN,WAAW,WAAW;AAAA,EACxB;AACF;AAEA,SAAS,WAAW,OAAoC;AACtD,aAAO,8BAAI,mCAAa,MAAM,MAAM,MAAM,SAASH,eAAc,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC;AAC5G;AAEA,SAAS,oBAAoB,OAA8B;AACzD,SAAO,kBAAkB,KAAK,MAAM,OAAO;AAC7C;AAEA,eAAe,mBAAmB,MAA6C;AAC7E,MAAI;AACF,UAAM,KAAK;AAAA,EACb,QAAQ;AAAA,EAGR;AACF;;;AxC1+BA,IAAAI,uBAgNO;;;A0CpUP,eAAsB,YACpB,MACA,SACiB;AACjB,QAAM,MAAM,MAAM;AAAA,IAChB,GAAG,IAAI,kBAAkB,mBAAmB,OAAO,CAAC;AAAA,EACtD;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,QAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,UAAU;AACzD,UAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,MAAM,KAAK,EAAE;AAAA,EACnE;AAEA,SAAO,IAAI,KAAK;AAClB;AAYA,eAAsB,qBACpB,MACA,SAC0B;AAC1B,QAAM,MAAM,MAAM,MAAM,GAAG,IAAI,aAAa;AAAA,IAC1C,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,IAAI;AAAA,MACZ,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,UAAU;AAAA,IACpD;AAAA,EACF;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,IAAI;AAAA,MACZ,gBAAgB,KAAK;AAAA,MACrB,WAAW,KAAK,aAAa,CAAC;AAAA,MAC9B,SAAS,KAAK,WAAW,CAAC;AAAA,IAC5B;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,MAAM,QAAQ,IAAI,QAAQ,WAAW,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,EACzE;AACF;AAYA,eAAsB,wBACpB,MACA,kBAC0B;AAC1B,QAAM,MAAM,MAAM,MAAM,GAAG,IAAI,aAAa;AAAA,IAC1C,QAAQ;AAAA,IACR,SAAS;AAAA,EACX,CAAC;AAED,MAAI,IAAI,IAAI;AACV,QAAI;AACF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,WAAW,KAAK,aAAa,CAAC;AAAA,QAC9B,SAAS,KAAK,WAAW,CAAC;AAAA,QAC1B,gBAAgB,KAAK;AAAA,MACvB;AAAA,IACF,QAAQ;AAEN,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,WAAW,CAAC;AAAA,QACZ,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,UAAU;AAAA,EACpD;AACF;;;AChGA,IAAM,mBAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AACT;AAKA,SAAS,YACPC,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AA4BO,IAAM,oBAAN,MAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa7B,YAAY,QAAiC;AAC3C,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,YAAY,OAAO;AACxB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOO,cAAc,SAA+B;AAClD,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBACZ,MACA,QACA,MACwB;AACxB,UAAM,UAAU,KAAK,OAAO,KAAK,SAAS,cAAc,MAAM,MAAM;AAEpE,WAAO,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,OAAO,QAA6D;AAExE,QAAI,CAAC,OAAO,aAAa;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,WAAW,GAAG;AAClD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B,aAAa,OAAO;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,QAAQ,YAAY;AAAA,QACnC,sBAAsB,OAAO,wBAAwB;AAAA,QACrD,WAAW,OAAO;AAAA,MACpB,CAAC;AAED,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,KAAK;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,cAAe,MAAM,SAAS,KAAK;AAEzC,YAAM,aAAyB;AAAA,QAC7B,KAAK,YAAY,OAAO;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,SAAS,KAAK,QAAQ;AAAA,QACtB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,QAAQ;AAAA,QAC9D,WAAW;AAAA,QACX,oBAAoB,EAAE,OAAO,wBAAwB;AAAA,QACrD,WAAW,oBAAI,KAAK;AAAA,MACtB;AAEA,aAAO,EAAE,IAAI,MAAM,MAAM,WAAW;AAAA,IACtC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6C,OAAO,KAAK,CAAC;AAAA,UAC1D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAO,KAA2D;AACtE,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,UAAI,CAAC,KAAK,WAAW;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,KAAK;AAAA,QACnB,KAAK;AAAA,QACL,CAAC;AAAA,UACC,UAAU,WAAW,GAAG;AAAA,UACxB,SAAS;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,iBAAiB;AAAA,QAC3B,CAAC;AAAA,MACH;AACA,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyB,GAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,IAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,kCAAkC,UAAU,MAAM,SAAS,KAAK,CAAC;AAChF,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQ,KAAK;AAC9C,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,+CAA+C,OAAO,KAAK,CAAC;AAAA,UAC5D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,KAAgD;AAC3D,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,YAAY,qBAAqB,eAAe,iBAAiB;AAAA,MAC1E;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QAC5C,UAAU,WAAW,GAAG;AAAA,QACxB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,sBAAsB;AAAA,QACpE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM,KAAK,UAAU,EAAE,IAAI,CAAC;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,MAAM,SAAS,WAAW,KAAK;AAC3C,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,oCAAoC,SAAS,MAAM,MAAM,SAAS;AAAA,YAClE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,IAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,UAAU,MAAM,SAAS,KAAK,CAAC;AACrE,YAAM,wBAAwB,OAAO,YACnC,SAAS,WAAW,MAChB,OAAO,KAAK,WAAW,eAAe,CAAC,OAAO,KAAK,SACnD,OAAO,KAAK,WAAW;AAE7B,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQ,OAAO,CAAC,uBAAuB;AACxE,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO,YAAY,qBAAqB,SAAS,mBAAmB,KAAK;AAAA,QAC3E;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,2CAA2C,OAAO,KAAK,CAAC;AAAA,UACxD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MACJC,WAAyC,CAAC,GACF;AACxC,UAAM,YAAY,oCAAoC,UAAUA,QAAO;AACvE,QAAI,CAAC,UAAU,SAAS;AACtB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,gBAAgB;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,oBAAoB,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QACtD,SAAS,KAAK;AAAA,QACd,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,UAAU,OAAO,YAAY,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,CAAC;AAC3E,cAAQ,cAAc,IAAI;AAC1B,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,qBAAqB;AAAA,QACnE,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,UAAU,IAAI;AAAA,MACrC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,4BAA4B,UAAU,MAAM,SAAS,KAAK,CAAC;AAC1E,UAAI,CAAC,OAAO,SAAS;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,OAAsC;AAC1C,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,gBAAgB,IAAI,iBAAiB,IAAI;AAErE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAclC,YAAM,cAA4B,KAAK,IAAI,CAAC,UAAU;AAAA,QACpD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,SAAS,KAA+C;AAC5D,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,cAAc,KAAK,CAAC;AAEvD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyB,GAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,mCAAmC,SAAS,MAAM,MAAM,SAAS;AAAA,YACjE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,IAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAgBlC,YAAM,QAAyB,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,QACvD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,gBAAgB,MAAc,QAA0C;AAC5E,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAE5C,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAEhB,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,QACjC;AAEA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,EAAE,IAAI,MAAM,MAAM,KAAK,QAAQ;AAAA,IACxC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC3zBA,IAAAC,cAAkB;AA6BX,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,UAAU;AAAA,IACb,CAAC,QAAQ,OAAO,IAAI,MAAM,YAAY,IAAI,EAAE,SAAS;AAAA,IACrD,EAAE,SAAS,6CAA6C;AAAA,EAC1D;AAAA;AAAA,EAEA,QAAQ,cAAE,OAAO,EAAE,IAAI,GAAG,oBAAoB;AAAA;AAAA,EAE9C,YAAY;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,IAAI,GAAG,kBAAkB;AAAA;AAAA,EAE1C,MAAM,cAAE,OAAO,EAAE,IAAI,0BAA0B;AAAA;AAAA,EAE/C,SAAS,cAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB;AAAA;AAAA,EAEhD,SAAS,cAAE,QAAQ,CAAC;AACtB,CAAC;AAWM,IAAM,uBAAuB,cAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,iBAAiB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,eAAe,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIpC,eAAe,oBAAoB,SAAS;AAC9C,CAAC;AAeM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,mCAAmC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3E,SAAS,cACN,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,gDAAgD;AAAA,EAC7D,EACC,SAAS;AAAA;AAAA,EAEZ,QAAQ,cACL,QAAQ,EACR,OAAO,CAAC,QAA+B,OAAO,QAAQ,YAAY;AAAA,IACjE,SAAS;AAAA,EACX,CAAC;AAAA;AAAA,EAEH,OAAO,cACJ,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACtC,EAAE,SAAS,yCAAyC;AAAA,EACtD,EACC,SAAS;AAAA;AAAA,EAEZ,aAAa;AAAA;AAAA,EAEb,UAAU,cACP,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACjC,EAAE,SAAS,4CAA4C;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKF,mBAAmB,cAChB,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,mDAAmD;AAAA,EAChE,EACC,SAAS;AAAA;AAAA,EAEZ,iBAAiB,cAAE,QAAQ,EAAE;AAAA,IAC3B,CAAC,QAMmB,OAAO,QAAQ;AAAA,IACnC,EAAE,SAAS,8CAA8C;AAAA,EAC3D;AAAA;AAAA,EAEA,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7B,kBAAkB,cACf,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,sBAAsB,cACnB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,YAAY,cACT,QAAQ,EACR,OAAO,CAAC,QAA4D,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IACnH,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhC,eAAe,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,wBAAwB,cACrB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC;AAwBM,SAAS,yBACd,MAC2C;AAC3C,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,uBAAuB,OAAO,MAAM,OAAO;AAAA,QACpD,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;ACtNO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAItD,YAAY,SAA4B,SAA4B;AAClE;AAAA,MACE,0DAA0D,QAAQ,MAAM;AAAA,IAC1E;AACA,SAAK,OAAO;AACZ,SAAK,UAAU;AACf,SAAK,UAAU;AAAA,EACjB;AACF;AAMO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAG7C,YAAY,WAAiB;AAC3B,UAAM,sBAAsB,UAAU,YAAY,CAAC,EAAE;AACrD,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;AAMO,IAAM,qCAAN,cAAiD,MAAM;AAAA,EAM5D,YAAY,SAA4B;AACtC;AAAA,MACE;AAAA,IACF;AAPF;AAAA,gBAAO;AAQL,SAAK,OAAO;AACZ,SAAK,UAAU,QAAQ,IAAI,UAAU;AAAA,EACvC;AACF;AA0BO,SAAS,eAAe,OAAuB;AACpD,MAAI,CAAC,MAAM,WAAW,YAAY,GAAG;AACnC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,MAAM,cAAc,MAAM,SAAS,GAAG;AACtD,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,YAAY,CAAC;AAClC;AAiCO,SAAS,mBACd,WACA,SACmB;AACnB,QAAM,UAA6B,CAAC;AAEpC,aAAW,OAAO,WAAW;AAC3B,UAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,yBAAyB,KAAK,CAAC,CAAC;AAClE,QAAI,UAAU,QAAW;AACvB,cAAQ,KAAK,WAAW,GAAG,CAAC;AAC5B;AAAA,IACF;AAAA,EAEF;AAEA,SAAO,EAAE,QAAQ,QAAQ,WAAW,GAAG,QAAQ;AACjD;AAMA,SAAS,yBACP,WACA,SACS;AACT,MAAI,UAAU,YAAY,QAAQ,SAAS;AACzC,WAAO;AAAA,EACT;AAIA,MACE,eAAe,UAAU,SAAS,sBAAsB,MACxD,eAAe,QAAQ,SAAS,sBAAsB,GACtD;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAACC,cAAa,QAAQ,MAAM,UAAU,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AAIA,QAAM,aAAa,IAAI;AAAA,IACrB,uBAAuB,UAAU,SAAS,UAAU,OAAO;AAAA,EAC7D;AACA,QAAM,iBAAiB,uBAAuB,QAAQ,SAAS,QAAQ,OAAO;AAC9E,aAAW,KAAK,YAAY;AAC1B,QAAI,CAAC,eAAe,KAAK,CAAC,kBAAkB,eAAe,eAAe,CAAC,CAAC,GAAG;AAC7E,aAAO;AAAA,IACT;AAAA,EACF;AAIA,MAAI,CAAC,kBAAkB,UAAU,SAAS,QAAQ,OAAO,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAUO,SAAS,kBACd,MACA,OACS;AACT,SAAO,yBAAyB,IAAI,MAAM,yBAAyB,KAAK;AAC1E;AASO,SAAS,yBACd,SACQ;AACR,QAAM,eAAe,CAAC,UAA2B;AAC/C,QAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACvD,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS;AACf,YAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE;AAAA,QAAI,CAAC,QACzC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC;AAAA,MACrD,EAAE,KAAK,GAAG,CAAC;AAAA,IACb;AACA,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,YAAY,WAAW,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK;AACxD,MAAI,SAAS,WAAW,KAAM,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,MAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;AAGO,SAAS,eAAe,eAAuB,iBAAkC;AACtF,MAAI,kBAAkB,OAAO,kBAAkB,gBAAiB,QAAO;AACvE,MAAI,CAAC,cAAc,SAAS,IAAI,EAAG,QAAO;AAC1C,QAAM,UAAU,cAAc,MAAM,GAAG,EAAE;AACzC,SAAO,oBAAoB,WAAW,gBAAgB,WAAW,GAAG,OAAO,GAAG;AAChF;AAWA,SAASA,cAAa,aAAqB,eAAgC;AACzE,MAAI,gBAAgB,MAAM,gBAAgB,KAAK;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS,GAAG,GAAG;AAC7B,WAAO,cAAc,WAAW,WAAW;AAAA,EAC7C;AACA,SAAO,kBAAkB;AAC3B;AAEA,SAAS,WAAW,OAAyC;AAC3D,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,EAC/D;AACF;AAgDO,SAAS,uBACd,WACA,MACmB;AACnB,QAAM,MAAM,UAAU,IAAI;AAC1B,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAgC,IAAI,IAAI,CAAC,UAAU;AACvD,UAAM,cACJ,sBAAsB,MAAM,OAAO;AAAA;AAAA;AAAA,KAIlC,MAAM,QAAQ,WAAW,YAAY,IAClC,MAAM,UACN,aAAa,MAAM,OAAO;AAChC,WAAO;AAAA,MACL,SAAS;AAAA;AAAA;AAAA;AAAA,MAIT,OAAO,eAAe,MAAM,KAAK;AAAA,MACjC,MAAM,MAAM;AAAA,MACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,MAC1B,GAAI,MAAM,YAAY,SAClB,CAAC,IACD,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B;AAAA,IACxF;AAAA,EACF,CAAC;AAID,aAAW,KAAK,CAAC,GAAG,MAAM;AACxB,UAAM,SAAS,EAAE,SAAS;AAC1B,UAAM,SAAS,EAAE,SAAS;AAC1B,QAAI,WAAW,OAAQ,QAAO,SAAS,SAAS,KAAK;AACrD,QAAI,EAAE,YAAY,EAAE,QAAS,QAAO,EAAE,UAAU,EAAE,UAAU,KAAK;AACjE,QAAI,EAAE,SAAS,EAAE,KAAM,QAAO,EAAE,OAAO,EAAE,OAAO,KAAK;AACrD,WAAO;AAAA,EACT,CAAC;AAED,SAAO;AACT;;;ACvVA,IAAAC,kBAAwB;AAoBxB,SAAS,gCACP,SACoB;AACpB,MAAI;AACJ,aAAW,UAAU,SAAS;AAC5B,UAAM,QAAQ,OAAO,QAAQ,GAAG;AAChC,QAAI,UAAU,GAAI,QAAO;AACzB,UAAM,cAAc,OAAO,MAAM,GAAG,KAAK;AACzC,UAAM,YAAY,sBAAsB,WAAW;AACnD,QAAI,cAAc,OAAW,QAAO;AACpC,QAAI,UAAU,QAAW;AACvB,cAAQ;AAAA,IACV,WAAW,UAAU,WAAW;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AASA,IAAM,uBAAuB,CAAC,oBAAoB,uBAAuB;AAMzE,IAAM,oBAAoB,OAAO;AAKjC,IAAM,gBAAgB;AAStB,SAASC,aACPC,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAKA,SAASC,iBAAgB,MAAsB;AAE7C,MAAIC;AACJ,MAAI,OAAO,SAAS,aAAa;AAC/B,IAAAA,UAAS,KAAK,SAAS,mBAAmB,IAAI,CAAC,CAAC;AAAA,EAClD,WAAW,OAAO,WAAW,aAAa;AACxC,IAAAA,UAAS,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,SAAOA,QAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACzE;AAKA,SAASC,iBAAgB,SAAyB;AAEhD,MAAID,UAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAEzD,SAAOA,QAAO,SAAS,GAAG;AACxB,IAAAA,WAAU;AAAA,EACZ;AAEA,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,mBAAmB,OAAO,KAAKA,OAAM,CAAC,CAAC;AAAA,EAChD,WAAW,OAAO,WAAW,aAAa;AACxC,WAAO,OAAO,KAAKA,SAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;AA0RO,IAAM,iBAAN,MAAgD;AAAA;AAAA;AAAA;AAAA,EAqBrD,YAAY,QAA8B;AACxC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,cAAc,OAAO;AAC1B,SAAK,WAAW,OAAO;AACvB,SAAK,oBAAoB,OAAO;AAChC,SAAK,kBAAkB,OAAO;AAC9B,SAAK,WAAW,OAAO,WAAW,IAAI,QAAQ,OAAO,EAAE;AACvD,SAAK,qBAAqB,OAAO;AACjC,SAAK,yBAAyB,OAAO;AACrC,SAAK,eAAe,OAAO;AAC3B,SAAK,aAAa,OAAO,cAAc;AACvC,SAAK,gBAAgB,OAAO;AAC5B,SAAK,yBAAyB,OAAO;AACrC,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,SAA+B;AAClD,SAAK,iBAAiB;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aAAa,QAAgM;AAClN,SAAK,iBAAiB;AACtB,QAAI,OAAO,YAAY,QAAW;AAChC,WAAK,UAAU,OAAO;AAAA,IACxB;AACA,QAAI,OAAO,sBAAsB,QAAW;AAC1C,WAAK,oBAAoB,OAAO;AAAA,IAClC;AACA,QAAI,OAAO,qBAAqB,QAAW;AACzC,WAAK,qBAAqB,OAAO;AAAA,IACnC;AACA,QAAI,OAAO,yBAAyB,QAAW;AAC7C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,kBAAkB,QAAW;AACtC,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AACA,QAAI,OAAO,2BAA2B,QAAW;AAC/C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,iBAAiB,QAAW;AACrC,WAAK,iBAAiB,OAAO;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,SAAS,QAA0E;AACvF,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAGxD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOH;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,sBAAsB,CAAC,KAAK,mBAAmB;AACvF,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,WAAW;AAClC,UAAM,kBAAkB,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AAChF,QAAI,SAAS;AAEb,UAAM,SAAsB,OAAO,UAAU;AAI7C,UAAM,WAAW,KAAK,aAClB,GAAG,KAAK,UAAU,IAAI,OAAO,IAAI,GAAG,QAAQ,QAAQ,GAAG,IACvD,OAAO;AAGX,QAAI,WAAW,UAAU;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,YAAM,eAAe,SAAS,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE,CAAC;AACvF,cAAQ,MAAM,KAAK,YAAY,iBAAiB,YAAY;AAC5D,YAAM,yBAAyB,KAAK,kBAAkB;AACtD,UAAI,uBAAwB,QAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB;AAC9E,eAAS,MAAM,KAAK,YAAY,OAAO,KAAK;AAC5C,YAAM,oBAAoB,KAAK,kBAAkB;AACjD,UAAI,kBAAmB,QAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AACpE,eAAS,KAAK,YAAY,OAAO,KAAK;AAGtC,UAAI,CAAC,OAAO,GAAG;AACb,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAASK,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6CK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,UAC7FA,gBAAe,QAAQA,OAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AAGJ,UAAM,WAAW,OAAO,MAAM,GAAG,EAAE,CAAC;AAGpC,UAAM,yBAAyB,CAC7B,WACuD;AACvD,UAAI,UAAU,OAAO,WAAW,YAAY,QAAQ,QAAQ;AAC1D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAOA,UAAM,yBAAyB,KAAK;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,wBAAwB;AAE1B,YAAM,mBAAmB,MAAM,KAAK,wBAAwB,UAAU,UAAU,SAAS,MAAM;AAC/F,YAAM,6BAA6B,KAAK,kBAAkB;AAC1D,UAAI,2BAA4B,QAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B;AACtF,YAAM,SAAS,uBAAuB,gBAAgB;AACtD,UAAI,QAAQ,UAAU,OAAO,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,mBAAa;AAAA,IACf,WAAW,KAAK,wBAAwB;AAEtC,UAAI;AACF,cAAM,iBAAiB,MAAM,KAAK,uBAAuB;AAAA,UACvD,aAAa;AAAA,UACb,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM;AAAA,UACN;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,4BAA4B,KAAK,kBAAkB;AACzD,YAAI,0BAA2B,QAAO,EAAE,IAAI,OAAO,OAAO,0BAA0B;AAEpF,YAAI,gBAAgB;AAClB,uBAAa;AACb,mBAAS;AAAA,QACX,OAAO;AACL,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOL;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAASK,MAAK;AACZ,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOL;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACAK,gBAAe,QAAQA,OAAM;AAAA,UAC/B;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,KAAK,kBAAkB;AAChD,QAAI,iBAAkB,QAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAGlE,UAAM,YAA8B;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS,KAAK,QAAQ;AAAA,MACtB,SAAS;AAAA,IACX;AAGA,UAAM,cAAc,KAAK,WAAW,WAAW,MAAM;AAGrD,UAAM,UAAU,OAAO,WAAW,KAAK;AACvC,UAAM,MAAM,UAAU,GAAG,OAAO,UAAU,WAAW,KAAK;AAE1D,UAAM,YAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,aAAa,OAAO;AAAA,IACtB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,UAAU;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,6BACN,MACA,SACA,iBACS;AAET,UAAM,UAAU,KAAK,SAAS,WAAW;AACzC,eAAW,OAAO,SAAS;AACzB,YAAM,cAAc,KAAK,SAAS,qBAAqB,IAAI,EAAE;AAC7D,iBAAW,cAAc,aAAa;AAIpC,YAAI,WAAW,YAAY,KAAK,SAAS,SAAS;AAChD;AAAA,QACF;AAKA,aAAK,WAAW,SAAS,UAAU,KAAK,GAAG;AACzC;AAAA,QACF;AAGA,YAAI,CAAC,KAAK,SAAS,kBAAkB,UAAU,GAAG;AAChD;AAAA,QACF;AAGA,YAAI,WAAW,SAAS,iBAAiB;AACvC;AAAA,QACF;AAGA,YAAI,WAAW,uBAAuB,OAAO;AAC3C;AAAA,QACF;AAGA,cAAM,iBAAiB,WAAW,QAAQ;AAC1C,YAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,GAAG;AAC3C;AAAA,QACF;AAGA,cAAM,oBAAoB,WAAW,WAAW,CAAC;AACjD,cAAM,gBAAgB,QAAQ;AAAA,UAAM,YAClC,kBAAkB,SAAS,MAAM,KAAK,kBAAkB,SAAS,GAAG;AAAA,QACtE;AACA,YAAI,CAAC,eAAe;AAClB;AAAA,QACF;AAGA,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAiD;AACvD,QAAI;AACF,WAAK,iBAAiB;AACtB,aAAO;AAAA,IACT,SAASK,MAAK;AACZ,aAAOL;AAAA,QACL,qBAAqB;AAAA,QACrB;AAAA,QACAK,gBAAe,QAAQA,OAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,YAAY,gBAAwB,eAAgC;AAE1E,QAAI,mBAAmB,MAAM,mBAAmB,KAAK;AACnD,aAAO;AAAA,IACT;AAGA,QAAI,mBAAmB,eAAe;AACpC,aAAO;AAAA,IACT;AAGA,UAAM,uBAAuB,eAAe,QAAQ,OAAO,EAAE;AAC7D,UAAM,oBAAoB,cAAc,QAAQ,OAAO,EAAE;AAEzD,QAAI,kBAAkB,WAAW,uBAAuB,GAAG,GAAG;AAC5D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,wBACZ,aACA,MACA,SACA,QACsD;AACtD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,wBAAwB;AAc/B,UAAI;AACF,YAAI,QAAQ,WAAW,GAAG;AACxB,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,eAAe,gCAAgC,OAAO;AAC5D,YAAI,iBAAiB,QAAW;AAC9B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,uDAAuD,KAAK,UAAU,OAAO,CAAC;AAAA,YAChF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,aAAa,KAAK,uBAAuB;AAAA,UAC7C,SAAS,KAAK;AAAA,UACd;AAAA,UACA,SAAS,KAAK,QAAQ;AAAA,UACtB,WAAW;AAAA,YACT,CAAC,YAAY,GAAG;AAAA,cACd,CAAC,IAAI,GAAG,CAAC,GAAG,OAAO;AAAA,YACrB;AAAA,UACF;AAAA,UACA,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,QACpD,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAGhF,cAAM,cAAc,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,aAAa;AAAA,UAC9D,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,eAAe,WAAW;AAAA,UAC5B;AAAA,QACF,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAEhF,YAAI,CAAC,YAAY,IAAI;AACnB,gBAAM,YAAY,MAAM,YAAY,KAAK;AACzC,gBAAM,8BAA8B,KAAK,kBAAkB;AAC3D,cAAI,4BAA6B,QAAO,EAAE,IAAI,OAAO,OAAO,4BAA4B;AACxF,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,8CAA8C,YAAY,MAAM,IAAI,SAAS;AAAA,YAC/E;AAAA,UACF;AAAA,QACF;AAOA,YAAI,WAAW,UAAU,WAAW,GAAG;AACrC,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,UAAU,WAAW,UAAU,CAAC;AACtC,eAAO;AAAA,UACL,KAAK,WAAW;AAAA,UAChB,aAAa,WAAW;AAAA,UACxB,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM,QAAQ;AAAA,UACd,SAAS,QAAQ;AAAA,UACjB,QAAQ,WAAW;AAAA,UACnB,WAAW;AAAA,UACX,YAAY,WAAW;AAAA,UACvB,oBAAoB;AAAA,UACpB,WAAW,oBAAI,KAAK;AAAA,QACtB;AAAA,MACF,SAASK,MAAK;AACZ,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOL;AAAA,YACL,qBAAqB;AAAA,YACrB,yCAAyCK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,YACzFA,gBAAe,QAAQA,OAAM;AAAA,UAC/B;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AAEL,YAAM,mBAA2C;AAAA,QAC/C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,sBAAsB;AAAA,MACxB;AAEA,YAAM,mBAAmB,KAAK,qBAC1B,MAAM,KAAK,mBAAmB,gBAAgB,IAC9C,MAAM,KAAK,kBAAmB,OAAO,gBAAgB;AACzD,YAAM,gCAAgC,KAAK,kBAAkB;AAC7D,UAAI,8BAA+B,QAAO,EAAE,IAAI,OAAO,OAAO,8BAA8B;AAE5F,UAAI,CAAC,iBAAiB,IAAI;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOL;AAAA,YACL,qBAAqB;AAAA,YACrB,0CAA0C,iBAAiB,MAAM,OAAO;AAAA,YACxE,iBAAiB,MAAM;AAAA,YACvB,iBAAiB,MAAM;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,iBAAiB;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QACJ,MACAM,WAA0B,CAAC,GACoB;AAC/C,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM;AAAA,MACJ,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB;AAAA,IACF,IAAIA;AAGJ,UAAM,eAAe,KAAK,yBAAyB,IAAI;AACvD,QAAI,CAAC,aAAa,IAAI;AACpB,aAAO;AAAA,IACT;AACA,UAAM,YAAY,aAAa;AAM/B,UAAM,mBAAmB,IAAI,KAAK,UAAU,WAAW,MAAM;AAC7D,QAAI,mBAAmB,oBAAI,KAAK,GAAG;AACjC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAON;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,UAAM,UAAmB;AAAA,MACvB,IAAI,YAAY,UAAU,MAAM;AAAA,MAChC,KAAK,UAAU;AAAA,MACf,MAAM;AAAA,MACN,KAAK,UAAU;AAAA,MACf,UAAU;AAAA;AAAA,IACZ;AAEA,SAAK,SAAS,UAAU,SAAS,UAAU,YAAY,aAAa;AAGpE,QAAI,mBAAmB,UAAU;AACjC,QAAI,YAAY;AAGhB,QAAI,mBAAmB,iBAAiB,KAAK,SAAS;AACpD,YAAM,QAAQ,MAAM,KAAK,sBAAsB,MAAM;AAAA,QACnD,aAAa,KAAK,QAAQ;AAAA,QAC1B,cAAc,UAAU;AAAA,MAC1B,CAAC;AACD,UAAI,CAAC,MAAM,GAAI,QAAO;AACtB,yBAAmB,MAAM,KAAK;AAC9B,kBAAY;AAAA,QACV,IAAI,WAAW,aAAa,KAAK,QAAQ,kBAAkB,CAAC;AAAA,QAC5D,KAAK,KAAK,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,IACF;AAKA,UAAM,wBAAyB,iBAE5B,kBAAkB;AACrB,UAAM,aAAa,yBAAyB,iBAAiB,cAAc,UAAU,iBAAiB,GAAG;AACzG,UAAM,gBAAgB,UAAU,SAAS,aAAa,KAAK,UACvD,KAAK,UACL;AACJ,UAAM,eAA+B;AAAA,MACnC,kBAAkB,EAAE,eAAe,WAAW;AAAA,MAC9C,eAAe,iBAAiB;AAAA,MAChC,SAAS,UAAU;AAAA,MACnB,oBAAoB,eAAe,sBAAsB,UAAU;AAAA,MACnE,KAAK,eAAe,OAAO,UAAU;AAAA,IACvC;AAEA,UAAM,YAAY,KAAK,gBAAgB;AAAA,MACrC,OAAO,CAAC,UAAU,IAAI;AAAA,MACtB,SAAS;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,YAAY,UAAU;AAAA,IACxB,CAAC;AAED,UAAM,cAA2B;AAAA,MAC/B,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,UAAU;AAAA,MACnB,MAAM,UAAU;AAAA,IAClB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,sBACJ,MACA,QACwD;AACxD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM,UAAU,KAAK,yBAAyB,IAAI;AAClD,QAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,UAAM,YAAY,QAAQ;AAC1B,SAAK,mCAAmC,UAAU,UAAU;AAE5D,UAAM,eAAe,IAAI,KAAK,UAAU,WAAW,MAAM;AACzD,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,gBAAgB,KAAK;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,cAAc,0BAA0B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,SAAS,+BAA+B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,uBAAuB,OAAO;AACrD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc,aAAa,OAAO,aAAa,KAAK,KAAK,EAAE;AACjE,QAAI,CAAC,2BAA2B,KAAK,WAAW,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,eAAe,iCAAiC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,cAAc,kBAAkB,UAAU,MAAM,KAAK,OAAO,OAAO,YAAY;AACrF,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,UAAU,WAAW,YAAY,UAAU,WAC3C,aAAa,UAAU,WAAW,WAAW,MAAM,aAAa,UAAU,MAAM,KAChF,CAAC,mBAAmB,UAAU,KAAK,UAAU,MAAM,KACnD,CAAC,uBAAuB,UAAU,WAAW,MAAM,UAAU,IAAI,GACjE;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,UAAU,WAAW,YAAY;AACpC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,cAAc;AACtD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,OAAO,QAAQ,UAAU;AACtC,QAAI,CAAC,uBAAuB,UAAU,MAAM,IAAI,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,gBAAgB,UAAU,WAAW;AAC3C,UAAM,UAAU,OAAO,WAAW,CAAC,GAAG,aAAa;AACnD,QACE,QAAQ,WAAW,KACnB,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAClC,QAAQ,SAAS,GAAG,KACpB,QAAQ,KAAK,CAAC,WAAW,CAAC,cAAc,KAAK,CAAC,iBAAiB,eAAe,cAAc,MAAM,CAAC,CAAC,GACpG;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,OAAO,UAAU;AAChC,QAAI,UAAU,OAAO,SAAS,cAAc;AAC1C,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,gCAAgC,OAAO;AACvD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,iBAAiB,UAAU,OAAO;AAChD,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,gBAAgC;AAAA,QACpC,kBAAkB,EAAE,eAAe,UAAU,WAAW,WAAW;AAAA,QACnE,eAAe,UAAU,WAAW;AAAA,QACpC,SAAS,UAAU;AAAA,QACnB,oBAAoB,UAAU;AAAA,QAC9B,KAAK,UAAU;AAAA,MACjB;AACA,YAAM,SAAS,KAAK,uBAAuB;AAAA,QACzC,SAAS;AAAA,QACT;AAAA,QACA,SAAS,UAAU;AAAA,QACnB,WAAW,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,GAAG,QAAQ,EAAE;AAAA,QAC5C,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,MACpD,CAAC;AACD,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,YAAM,gBAAgB,kBAAkB,QAAQ;AAAA,QAC9C;AAAA,QACA,WAAW,aAAa,UAAU,MAAM;AAAA,QACxC,WAAW,UAAU,WAAW;AAAA,QAChC;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB,GAAG,KAAK,YAAY;AACpB,UAAI,CAAC,eAAe;AAClB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,mBAAmB;AAAA,QACvB,QAAQ;AAAA,QACR,SAAS,EAAE,eAAe,OAAO,WAAW;AAAA,QAC5C,UAAU;AAAA,MACZ;AACA,YAAM,eAAe,MAAM,KAAK,QAAQ,IAAI,IAAI,aAAa,WAAW,EAAE,SAAS,GAAG,gBAAgB;AACtG,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,UAAI,CAAC,aAAa,IAAI;AACpB,cAAM,IAAI,MAAM,mCAAmC,aAAa,MAAM,GAAG;AAAA,MAC3E;AAEA,YAAM,UAAU,cAAc;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,UACJ,YAAY;AAAA,YACV,KAAK,OAAO;AAAA,YACZ,aAAa,cAAc;AAAA,YAC3B,cAAc,UAAU,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,YAC3C,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,SAAS,QAAQ;AAAA,YACjB,QAAQ,cAAc;AAAA,YACtB,WAAW;AAAA,YACX,oBAAoB;AAAA,YACpB,WAAW,UAAU,WAAW;AAAA,YAChC,WAAW;AAAA,YACX,kBAAkB,EAAE,eAAe,OAAO,WAAW;AAAA,YACrD,cAAc,MAAM;AAAA,YACpB,SAAS,MAAM;AAAA,YACf,MAAM;AAAA,YACN,WAAW,OAAO;AAAA,YAClB,sBAAsB;AAAA,UACxB;AAAA,UACA,QAAQ;AAAA,YACN,WAAW,UAAU,WAAW;AAAA,YAChC,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,MAAM;AAAA,YACN,WAAW,cAAc;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAASK,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mCAAmC,YAA8B;AACvE,QAAI,kBAAkB,WAAW,SAAS,MAAS,EAAG;AACtD,UAAM,UAAU,WAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK;AAC3D,UAAM,QAAyB;AAAA,MAC7B;AAAA,MACA,OAAO,WAAW;AAAA,MAClB,MAAM,WAAW;AAAA,MACjB,SAAS,CAAC,GAAG,WAAW,OAAO;AAAA,MAC/B,SAAS,WAAW,WAAW,CAAC;AAAA,IAClC;AACA,UAAM,IAAI,mCAAmC,CAAC,KAAK,CAAC;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAwB,SAAsB,UAAkB;AACzE,QAAI,WAAW,UAAU;AACvB,YAAM,IAAI,MAAM,WAAW,MAAM,gDAAgD;AAAA,IACnF;AAEA,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,UAAM,UAAUE,iBAAgB,UAAU;AAC1C,WAAO,GAAG,aAAa,GAAG,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAgC;AACzC,UAAM,SAAS,KAAK,yBAAyB,IAAI;AACjD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AAAA,IACtC;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,yBAAyB,MAAyD;AAExF,QAAI,UAAU;AAGd,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,YAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,gBAAU,MAAM,MAAM,SAAS,CAAC;AAAA,IAClC;AAGA,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,IAAI;AACxB,kBAAU,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,MAC7C,QAAQ;AACN,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOF;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,QAAQ,WAAW,aAAa,GAAG;AACtC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iDAAiD,aAAa;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,QAAQ,MAAM,cAAc,MAAM;AAErD,QAAI;AACJ,QAAI;AACF,mBAAaI,iBAAgB,UAAU;AAAA,IACzC,SAASC,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,iCAAiCK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,UACjFA,gBAAe,QAAQA,OAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,UAAU;AAAA,IAChC,SAASA,MAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,oCAAoCK,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG,CAAC;AAAA,UACpFA,gBAAe,QAAQA,OAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QACE,UACA,OAAO,WAAW,YAClB,gBAAgB,UAChB,OAAO,cACP,OAAO,OAAO,eAAe,YAC7B,YAAY,OAAO,cACnB,OAAO,OAAO,WAAW,WAAW,UACpC;AACA,MAAC,OAAO,WAAgC,SAAS,IAAI,KAAK,OAAO,WAAW,MAAM;AAAA,IACpF;AAGA,UAAM,mBAAmB,yBAAyB,MAAM;AACxD,QAAI,CAAC,iBAAiB,IAAI;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOL;AAAA,UACL,qBAAqB;AAAA,UACrB,iBAAiB,MAAM;AAAA,UACvB;AAAA,UACA,iBAAiB,MAAM;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,iBAAiB,KAAK;AAAA,EACjD;AACF;AAKO,SAAS,qBAAqB,QAA+C;AAClF,SAAO,IAAI,eAAe,MAAM;AAClC;AAEA,SAAS,iBAAiB,SAA8D;AACtF,QAAM,QAAQ,QAAQ,MAAM,kDAAkD;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,MAAI,CAAC,OAAO,cAAc,OAAO,EAAG,QAAO;AAC3C,SAAO,EAAE,SAAS,SAAS,MAAM,CAAC,EAAE;AACtC;AAEA,SAAS,uBAAuB,OAA8B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACH,IAAI,aAAa,MAAM,IAAI,aAAa,OACzC,IAAI,UACJ,IAAI,KACJ,QAAO;AACT,WAAO,IAAI,OAAO,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,WAAmB,YAAsB,UAAkC;AACpG,QAAM,SAAS,uBAAuB,SAAS;AAC/C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,IAAI,IAAI,WAAW,IAAI,sBAAsB,EAAE,OAAO,CAAC,UAA2B,QAAQ,KAAK,CAAC,CAAC;AACjH,MAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,QAAO;AACjC,MAAI,YAAY,uBAAuB,QAAQ,MAAM,OAAQ,QAAO;AACpE,SAAO;AACT;AAEA,SAAS,wBAAwB,MAA6B;AAC5D,MACE,oBAAoB,KAAK,IAAI,KAC7B,iBAAiB,KAAK,IAAI,KAC1B,KAAK,SAAS,IAAI,EAClB,QAAO;AACT,QAAM,gBAAgB,KAAK,QAAQ,GAAG;AACtC,MAAI,kBAAkB,MAAM,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,EAAG,QAAO;AAClF,MAAI,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,KAAM,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,EAAI,QAAO;AACxG,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAS,KAAK,CAAC,YAAY,YAAY,OAAO,YAAY,IAAI,EAAG,QAAO;AAC5E,SAAO;AACT;AAEA,SAAS,uBAAuB,QAAgB,OAAwB;AACtE,QAAM,kBAAkB,wBAAwB,MAAM;AACtD,QAAM,iBAAiB,wBAAwB,KAAK;AACpD,MAAI,oBAAoB,QAAQ,mBAAmB,KAAM,QAAO;AAChE,MAAI,oBAAoB,MAAM,oBAAoB,IAAK,QAAO;AAC9D,MAAI,oBAAoB,eAAgB,QAAO;AAC/C,MAAI,gBAAgB,SAAS,KAAK,GAAG;AACnC,WAAO,eAAe,WAAW,gBAAgB,MAAM,GAAG,EAAE,CAAC;AAAA,EAC/D;AACA,MAAI,gBAAgB,SAAS,IAAI,GAAG;AAClC,UAAM,SAAS,gBAAgB,MAAM,GAAG,EAAE;AAC1C,QAAI,CAAC,eAAe,WAAW,MAAM,EAAG,QAAO;AAC/C,UAAM,YAAY,eAAe,MAAM,OAAO,MAAM;AACpD,WAAO,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,GAAG;AAAA,EACxD;AACA,SAAO,gBAAgB,SAAS,GAAG,KAAK,eAAe,WAAW,eAAe;AACnF;AAEA,SAAS,mBAAmB,KAAU,QAAyB;AAC7D,MACE,IAAI,QAAQ,SACZ,IAAI,QAAQ,aACZ,OAAO,IAAI,MAAM,YACjB,OAAO,IAAI,MAAM,SACjB,QAAO;AACT,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,OAAO,aAAa,MAAM,EAAE,MAAM,WAAW,MAAM,CAAC;AACrF,UAAM,YAAY,SAAS,WAAW,MAAM,SAAS,CAAC,MAAM,OAAQ,SAAS,CAAC,MAAM,IAChF,SAAS,MAAM,CAAC,IAChB;AACJ,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,WAAW,qBAAqB,IAAI,CAAC;AAC3C,UAAM,aAAa,qBAAqB,IAAI,CAAC;AAC7C,UAAM,mBAAmB,wBAAQ,aAAa,UAAU;AACxD,WACE,WAAW,WAAW,MACtB,UAAU,WAAW,SAAS,UAC9B,UAAU,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC,KACzD,iBAAiB,WAAW,SAAS,UACrC,iBAAiB,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC;AAAA,EAEpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAA2B;AACvD,MAAI,UAAU,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACxD,SAAO,QAAQ,SAAS,EAAG,YAAW;AACtC,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,WAAW,KAAK,KAAK,OAAO,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC9E;AACA,SAAO,WAAW,KAAK,OAAO,KAAK,SAAS,QAAQ,CAAC;AACvD;AAEA,SAAS,kBACP,QACA,UAWA,YAC4G;AAC5G,QAAM,QAAQ,OAAO,WAAW,MAAM,GAAG;AACzC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,qBAAqB,MAAM,CAAC,CAAC,CAAC,CAAC;AAAA,EAC/E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAClF,QAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAChF,QAAM,SAAS,MAAM,QAAQ,QAAQ,GAAG,IAAI,QAAQ,MAAM,CAAC;AAC3D,QAAM,iBAAiB,OAAO,QAAQ,QAAQ,YAAY,OAAO,UAAU,QAAQ,GAAG,IAAI,QAAQ,MAAM;AACxG,QAAM,YAAY,IAAI,KAAK,iBAAiB,GAAI;AAChD,MACE,gBAAgB,SAAS,eACzB,cAAc,SAAS,aACvB,OAAO,WAAW,KAClB,OAAO,CAAC,MAAM,SAAS,aACvB,aAAa,oBAAI,KAAK,KACtB,YAAY,SAAS,aACrB,YAAY,SAAS,mBACrB,WAAW,IAAI,YAAY,EAAE,OAAO,OAAO,UAAU,GAAG,KAAK,MAAM,OAAO,IAC1E,QAAO;AAET,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,UAAU,OAAO,QAAQ,GAA8B;AAC7D,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,CAAC,aAAa,YAAY,IAAI,QAAQ,CAAC;AAC7C,QAAM,SAAS,GAAG,SAAS,OAAO,IAAI,SAAS,OAAO;AACtD,MAAI,CAAC,YAAY,WAAW,MAAM,KAAK,YAAY,MAAM,OAAO,MAAM,MAAM,SAAS,KAAM,QAAO;AAClG,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,YAAY,MAAM,QAAQ,YAAY,EAAG,QAAO;AAC7F,QAAM,gBAAgB,OAAO,KAAK,YAAuC,EAAE,KAAK;AAChF,QAAM,kBAAkB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACnD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AAET,MAAI,aAAa,OAAO,WAAW,MAAM,eAAe,OAAO,UAAU,WAAW,EAAG,QAAO;AAC9F,MAAI,OAAO,OAAO,QAAQ,MAAM,UAAU,QAAQ,EAAG,QAAO;AAC5D,QAAM,WAAW,OAAO,UAAU,CAAC;AACnC,MACE,SAAS,YAAY,SAAS,WAC9B,SAAS,UAAU,SAAS,WAC5B,SAAS,SAAS,SAAS,KAC3B,QAAO;AACT,QAAM,gBAAgB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACjD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AACT,SAAO,EAAE,aAAa,WAAW,SAAS;AAC5C;;;AC/rDA,IAAAO,uBAAsC;AAatC,IAAMC,gBAAe;AASd,IAAM,kCAAkC;AAAA;AAAA,EAE7C,eAAe;AAAA;AAAA,EAEf,gBAAgB;AAAA;AAAA,EAEhB,oBAAoB;AAAA;AAAA,EAEpB,oBAAoB;AAAA;AAAA,EAEpB,oBAAoB;AAAA;AAAA,EAEpB,YAAY;AACd;AAkLO,IAAM,wBAAN,MAA8D;AAAA,EAA9D;AAIL;AAAA;AAAA;AAAA,SAAQ,OAA6B,oBAAI,IAAI;AAK7C;AAAA;AAAA;AAAA,SAAQ,QAAyB;AAAA,MAC/B,OAAO,oBAAI,IAAI;AAAA,MACf,OAAO,oBAAI,IAAI;AAAA,MACf,cAAc,oBAAI,IAAI;AAAA,IACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,YAAY,KAAc,aAAiC;AAEzD,SAAK,KAAK,IAAI,IAAI,IAAI,GAAG;AAGzB,QAAI,CAAC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,GAAG;AACjC,WAAK,MAAM,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC;AAAA,IACjC;AAGA,eAAW,cAAc,aAAa;AACpC,WAAK,cAAc,KAAK,UAAU;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU,OAAqB;AAE7B,UAAM,cAAc,KAAK,MAAM,MAAM,IAAI,KAAK,KAAK,CAAC;AAIpD,eAAW,cAAc,aAAa;AACpC,YAAM,SAAS,KAAK,MAAM,MAAM,IAAI,WAAW,GAAG;AAClD,UAAI,CAAC,OAAQ;AACb,YAAM,YAAY,OAAO,OAAO,CAAC,UAAU,MAAM,UAAU,KAAK;AAChE,UAAI,UAAU,WAAW,GAAG;AAC1B,aAAK,MAAM,MAAM,OAAO,WAAW,GAAG;AAAA,MACxC,OAAO;AACL,aAAK,MAAM,MAAM,IAAI,WAAW,KAAK,SAAS;AAAA,MAChD;AAAA,IACF;AAGA,eAAW,CAAC,QAAQ,OAAO,KAAK,KAAK,MAAM,cAAc;AACvD,YAAM,WAAW,QAAQ;AAAA,QACvB,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,MAAe,EAAE,OAAO,KAAK;AAAA,MAC5D;AACA,UAAI,SAAS,WAAW,GAAG;AACzB,aAAK,MAAM,aAAa,OAAO,MAAM;AAAA,MACvC,OAAO;AAEL,mBAAW,SAAS,UAAU;AAC5B,gBAAM,OAAO,MAAM,KAAK,OAAO,CAAC,MAAe,EAAE,OAAO,KAAK;AAAA,QAC/D;AACA,aAAK,MAAM,aAAa,IAAI,QAAQ,SAAS,OAAO,CAAC,MAAM,EAAE,KAAK,SAAS,CAAC,CAAC;AAAA,MAC/E;AAAA,IACF;AAGA,SAAK,MAAM,MAAM,OAAO,KAAK;AAG7B,SAAK,KAAK,OAAO,KAAK;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,oBAAoB,UAAkB,QAAgC;AAEpE,UAAM,kBAAkB,KAAK,oBAAoB,UAAU,MAAM;AAEjE,QAAI,gBAAgB,WAAW,GAAG;AAChC,aAAO;AAAA,IACT;AAGA,UAAM,YAAuB,CAAC;AAE9B,eAAW,SAAS,iBAAiB;AAEnC,UAAI,CAAC,KAAK,kBAAkB,MAAM,UAAU,GAAG;AAC7C;AAAA,MACF;AAGA,iBAAW,OAAO,MAAM,MAAM;AAC5B,YAAI,CAAC,UAAU,KAAK,CAAC,MAAe,EAAE,OAAO,IAAI,EAAE,GAAG;AACpD,oBAAU,KAAK,GAAG;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,IACT;AAGA,cAAU,KAAK,CAAC,GAAY,MAAe,EAAE,WAAW,EAAE,QAAQ;AAElE,WAAO,UAAU,CAAC;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAwC;AACtC,UAAM,MAAyB,CAAC;AAChC,eAAW,WAAW,KAAK,MAAM,aAAa,OAAO,GAAG;AACtD,UAAI,KAAK,GAAG,OAAO;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,qBAAqB,OAA6B;AAChD,WAAO,KAAK,MAAM,MAAM,IAAI,KAAK,KAAK,CAAC;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,UACE,KACA,YACAC,UACM;AAEN,UAAM,aAAsBA,UAAS,aAAa,SAC9C,EAAE,GAAG,KAAK,UAAUA,SAAQ,SAAS,IACrC;AAGJ,SAAK,KAAK,IAAI,WAAW,IAAI,UAAU;AAGvC,QAAI,CAAC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,GAAG;AACxC,WAAK,MAAM,MAAM,IAAI,WAAW,IAAI,CAAC,CAAC;AAAA,IACxC;AAGA,SAAK,cAAc,YAAY,UAAU;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,kBAAkB,YAAiC;AAEjD,QAAI,WAAW,WAAW;AACxB,aAAO;AAAA,IACT;AAGA,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,WAAW,UAAU,WAAW,SAAS,KAAK;AAChD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,OAAO,OAAoC;AACzC,WAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAwB;AACtB,WAAO,MAAM,KAAK,KAAK,KAAK,OAAO,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,QAAc;AACZ,SAAK,KAAK,MAAM;AAChB,SAAK,MAAM,MAAM,MAAM;AACvB,SAAK,MAAM,MAAM,MAAM;AACvB,SAAK,MAAM,aAAa,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,iBAAiB,KAAyC;AACxD,UAAM,SAAS,KAAK,MAAM,MAAM,IAAI,GAAG;AAEvC,QAAI,CAAC,UAAU,OAAO,WAAW,GAAG;AAClC,iBAAO;AAAA,YACL;AAAA,UACE,gCAAgC;AAAA,UAChC,yBAAyB,GAAG;AAAA,UAC5BD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,eAAW,SAAS,OAAQ,OAAM,WAAW,YAAY;AACzD,eAAW,kBAAkB,KAAK,MAAM,MAAM,OAAO,GAAG;AACtD,iBAAW,cAAc,gBAAgB;AACvC,YAAI,WAAW,QAAQ,IAAK,YAAW,YAAY;AAAA,MACrD;AAAA,IACF;AAGA,eAAW,WAAW,KAAK,MAAM,aAAa,OAAO,GAAG;AACtD,iBAAW,SAAS,SAAS;AAC3B,YAAI,MAAM,WAAW,QAAQ,KAAK;AAChC,gBAAM,WAAW,YAAY;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,eAAO,yBAAG,MAAS;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,iBACE,iBACA,QACmB;AACnB,UAAM,UAA6B,CAAC;AAEpC,eAAW,WAAW,KAAK,MAAM,aAAa,OAAO,GAAG;AACtD,iBAAW,SAAS,SAAS;AAE3B,YAAI,UAAU,MAAM,WAAW,QAAQ;AACrC;AAAA,QACF;AAGA,YAAI,KAAK,uBAAuB,MAAM,UAAU,eAAe,GAAG;AAChE,kBAAQ,KAAK,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,cAAc,KAAc,YAA8B;AAEhE,UAAM,iBAAiB,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,CAAC;AACxD,QAAI,CAAC,eAAe,KAAK,CAAC,MAAM,KAAK,oBAAoB,GAAG,UAAU,CAAC,GAAG;AACxE,qBAAe,KAAK,UAAU;AAC9B,WAAK,MAAM,MAAM,IAAI,IAAI,IAAI,cAAc;AAAA,IAC7C;AAGA,UAAM,SAAS,KAAK,MAAM,MAAM,IAAI,WAAW,GAAG,KAAK,CAAC;AACxD,QAAI,CAAC,OAAO;AAAA,MAAK,CAAC,UAChB,MAAM,UAAU,IAAI,MAAM,KAAK,oBAAoB,MAAM,YAAY,UAAU;AAAA,IACjF,GAAG;AACD,aAAO,KAAK;AAAA,QACV;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,OAAO,IAAI;AAAA,QACX,UAAU,oBAAI,KAAK;AAAA,MACrB,CAAC;AACD,WAAK,MAAM,MAAM,IAAI,WAAW,KAAK,MAAM;AAAA,IAC7C;AAGA,eAAW,UAAU,WAAW,SAAS;AACvC,YAAM,SAAS,KAAK,kBAAkB,WAAW,MAAM,MAAM;AAC7D,YAAM,UAAU,KAAK,MAAM,aAAa,IAAI,MAAM,KAAK,CAAC;AAGxD,YAAM,gBAAgB,QAAQ;AAAA,QAAK,CAAC,MAClC,KAAK,oBAAoB,EAAE,YAAY,UAAU;AAAA,MACnD;AAEA,UAAI,eAAe;AAEjB,YAAI,CAAC,cAAc,KAAK,KAAK,CAAC,MAAe,EAAE,OAAO,IAAI,EAAE,GAAG;AAC7D,wBAAc,KAAK,KAAK,GAAG;AAE3B,wBAAc,KAAK,KAAK,CAAC,GAAY,MAAe,EAAE,WAAW,EAAE,QAAQ;AAAA,QAC7E;AAAA,MACF,OAAO;AAEL,cAAM,QAAyB;AAAA,UAC7B,UAAU,WAAW;AAAA,UACrB;AAAA,UACA,MAAM,CAAC,GAAG;AAAA,UACV;AAAA,UACA,WAAW,WAAW;AAAA,QACxB;AACA,gBAAQ,KAAK,KAAK;AAClB,aAAK,MAAM,aAAa,IAAI,QAAQ,OAAO;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,kBAAkB,UAAkB,QAAwB;AAClE,WAAO,GAAG,QAAQ,IAAI,MAAM;AAAA,EAC9B;AAAA,EAEQ,oBAAoB,MAAkB,OAA4B;AACxE,WAAO,KAAK,QAAQ,MAAM,OACxB,KAAK,YAAY,MAAM,WACvB,KAAK,SAAS,MAAM,QACpB,KAAK,QAAQ,WAAW,MAAM,QAAQ,UACtC,KAAK,QAAQ,MAAM,CAAC,WAAW,MAAM,QAAQ,SAAS,MAAM,CAAC,KAC7D,kBAAkB,KAAK,SAAS,MAAM,OAAO;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,oBACN,UACA,QACmB;AACnB,UAAM,UAA6B,CAAC;AAGpC,UAAM,WAAW,KAAK,kBAAkB,UAAU,MAAM;AACxD,UAAM,eAAe,KAAK,MAAM,aAAa,IAAI,QAAQ;AACzD,QAAI,cAAc;AAChB,cAAQ,KAAK,GAAG,YAAY;AAAA,IAC9B;AAGA,eAAW,CAAC,QAAQ,OAAO,KAAK,KAAK,MAAM,cAAc;AACvD,UAAI,WAAW,SAAU;AAEzB,iBAAW,SAAS,SAAS;AAE3B,YAAI,CAAC,KAAK,cAAc,MAAM,QAAQ,MAAM,GAAG;AAC7C;AAAA,QACF;AAGA,YAAI,KAAK,uBAAuB,UAAU,MAAM,QAAQ,GAAG;AACzD,cAAI,CAAC,QAAQ;AAAA,YAAK,CAAC,MACjB,KAAK,oBAAoB,EAAE,YAAY,MAAM,UAAU;AAAA,UACzD,GAAG;AACD,oBAAQ,KAAK,KAAK;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAc,SAAiB,QAAyB;AAC9D,WAAO,eAAe,SAAS,MAAM;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,uBAAuB,UAAkB,SAA0B;AAEzE,QAAI,YAAY,UAAU;AACxB,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,aAAO,SAAS,WAAW,MAAM;AAAA,IACnC;AAGA,QAAI,QAAQ,SAAS,IAAI,GAAG;AAC1B,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,UAAI,CAAC,SAAS,WAAW,MAAM,GAAG;AAChC,eAAO;AAAA,MACT;AACA,YAAM,YAAY,SAAS,MAAM,OAAO,MAAM;AAE9C,aAAO,CAAC,UAAU,SAAS,GAAG,KAAK,cAAc;AAAA,IACnD;AAGA,QAAI,QAAQ,SAAS,GAAG,KAAK,SAAS,WAAW,OAAO,GAAG;AACzD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBACN,eACA,eACS;AAET,WAAO,KAAK,uBAAuB,eAAe,aAAa,KACxD,KAAK,uBAAuB,eAAe,aAAa;AAAA,EACjE;AACF;AAOO,SAAS,8BAAsD;AACpE,SAAO,IAAI,sBAAsB;AACnC;;;ACrqBA,eAAe,oBACb,OAC6B;AAC7B,SAAO,OAAO,UAAU,aAAa,MAAM,IAAI;AACjD;AAEA,eAAe,sBACb,SACiC;AACjC,SAAO,OAAO,YAAY,aAAa,QAAQ,IAAI,WAAW,CAAC;AACjE;AAEA,SAAS,sBAAsB,MAA0C;AACvE,MAAI,KAAK,OAAQ,QAAO,KAAK;AAC7B,MAAI,KAAK,MAAO,QAAO,KAAK;AAC5B,MAAI,KAAK,aAAa;AACpB,WAAO,uCAAuC,KAAK,WAAW;AAAA,EAChE;AACA,SAAO;AACT;AAUO,SAAS,qCACdE,UACyB;AACzB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,iBAAiB;AAAA,IACjB,SAAS,OAAO,YAAY;AAC1B,YAAM,YAAYA,SAAQ,SAAS,WAAW;AAC9C,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,MAAM,0DAA0D;AAAA,MAC5E;AAEA,YAAM,QAAQ,MAAM,oBAAoBA,SAAQ,KAAK;AACrD,YAAM,eAAe,MAAM,sBAAsBA,SAAQ,OAAO;AAChE,YAAM,OAAkC;AAAA,QACtC,GAAG;AAAA,QACH,GAAIA,SAAQ,QAAQ,EAAE,OAAOA,SAAQ,MAAM,IAAI,CAAC;AAAA,MAClD;AAEA,YAAM,WAAW,MAAM,UAAUA,SAAQ,UAAU;AAAA,QACjD,QAAQ;AAAA,QACR,aAAaA,SAAQ;AAAA,QACrB,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAI,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AAAA,UACpD,GAAG;AAAA,QACL;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAED,UAAI;AACJ,UAAI;AACF,iBAAU,MAAM,SAAS,KAAK;AAAA,MAChC,QAAQ;AACN,iBAAS;AAAA,MACX;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO;AAAA,UACL,UAAU;AAAA,UACV,QACE,QAAQ,UACR,QAAQ,SACR,oCAAoC,SAAS,MAAM;AAAA,QACvD;AAAA,MACF;AAEA,UAAI,QAAQ,iBAAiB,QAAQ,aAAa,OAAO;AACvD,eAAO;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,sBAAsB,MAAM;AAAA,QACtC;AAAA,MACF;AAEA,UAAI,OAAO,QAAQ,cAAc,YAAY,OAAO,UAAU,SAAS,GAAG;AACxE,eAAO;AAAA,UACL,UAAU;AAAA,UACV,WAAW,OAAO;AAAA,QACpB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAyGO,IAAM,sBAAoC,EAAE,MAAM,YAAY;;;AC5M9D,IAAM,kCAAN,MAAuE;AAAA;AAAA;AAAA;AAAA,EAI5E,MAAM,uBAAyC;AAC7C,WAAO;AAAA,EACT;AACF;AAKO,IAAM,8BACX,IAAI,gCAAgC;;;ACjG/B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAE/C,YACkB,aACA,cACA,aACA,MAChB;AACA;AAAA,MACE,wBAAwB,WAAW,+CAA+C,YAAY,WAAW,WAAW,QAAQ,IAAI,QAC7H,cAAc,eACX,4BACA;AAAA,IACR;AAVgB;AACA;AACA;AACA;AALlB,gBAAO;AAAA,EAaP;AACF;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAE3C,YACkB,MACA,OAChB;AACA;AAAA,MACE,gCAAgC,IAAI;AAAA,IACtC;AALgB;AACA;AAHlB,gBAAO;AAAA,EAQP;AACF;AAEO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACkB,SACA,MACA,mBAChB;AACA;AAAA,MACE,YAAY,OAAO,qCAAqC,IAAI,yBACnC,kBAAkB,KAAK,IAAI,KAAK,MAAM;AAAA,IACjE;AAPgB;AACA;AACA;AAJlB,gBAAO;AAAA,EAUP;AACF;AAQA,eAAsB,cACpB,MACA,aACA,UAAmC,WAAW,MAAM,KAAK,UAAU,GAChD;AACnB,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,IAAI,SAAS;AAAA,MACvC,QAAQ,YAAY,QAAQ,GAAI;AAAA,IAClC,CAAC;AAAA,EACH,SAASC,MAAK;AACZ,UAAM,IAAI,kBAAkB,MAAMA,IAAY;AAAA,EAChD;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,IAAI;AAAA,EAClC;AAEA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAQlC,MAAI,gBAAgB,KAAK,UAAU;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,KAAK,YAAY,CAAC;AAAA,IAC5B,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,EACjB;AACF;;;AlD+bA,IAAAC,oBA6CO;;;AmDxkBD,SAAUC,QAAQ,GAAe,GAAa;AAClD,MAAI,MAAM,GAAG;AACX,WAAO;EACT;AAEA,MAAI,EAAE,eAAe,EAAE,YAAY;AACjC,WAAO;EACT;AAEA,WAAS,IAAI,GAAG,IAAI,EAAE,YAAY,KAAK;AACrC,QAAI,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;AACjB,aAAO;IACT;EACF;AAEA,SAAO;AACT;;;ACnBA,yBAAuB;;;ACIjB,SAAU,aAAc,KAAe;AAC3C,SAAO,IAAI,WAAW,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAClE;;;ADUM,SAAU,YAAa,OAAe,GAAC;AAC3C,SAAO,aAAa,0BAAO,YAAY,IAAI,CAAC;AAC9C;;;AEdA,IAAMC,MAAK,KAAK,IAAI,GAAG,CAAC;AACxB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AACzB,IAAMC,MAAK,KAAK,IAAI,GAAG,EAAE;AAGzB,IAAMC,OAAM;AAEZ,IAAMC,QAAO;AAEP,SAAUC,gBAAgB,OAAa;AAC3C,MAAI,QAAQT,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,QAAQC,KAAI;AACd,WAAO;EACT;AAEA,MAAI,OAAO,oBAAoB,QAAQ,QAAQ,OAAO,kBAAkB;AACtE,UAAM,IAAI,WAAW,yBAAyB;EAChD;AAEA,SAAO;AACT;AAEM,SAAU,iBAAkB,OAAe,KAAiB,SAAiB,GAAC;AAClF,UAAQG,gBAAe,KAAK,GAAG;IAC7B,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQF;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,eAAS;IACX;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,iBAAW;IACb;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,iBAAW;IACb;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ,MAAQA;AACjC,iBAAW;IACb;IACA,KAAK,GAAG;AACN,UAAI,QAAQ,IAAK,QAAQ;AACzB,iBAAW;AACX;IACF;IACA;AAAS,YAAM,IAAI,MAAM,aAAa;EACxC;AACA,SAAO;AACT;AA0CM,SAAU,iBAAkB,KAAiB,QAAc;AAC/D,MAAI,IAAI,IAAI,MAAM;AAClB,MAAI,MAAM;AAEV,SAAO,IAAIG;AACX,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQE;AACpB,MAAI,IAAID,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQG;AACpB,MAAI,IAAIF,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQI;AACpB,MAAI,IAAIH,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,SAAS,CAAC;AAClB,UAAQ,IAAID,SAAQK;AACpB,MAAI,IAAIJ,MAAK;AACX,WAAO;EACT;AAEA,QAAM,IAAI,WAAW,yBAAyB;AAChD;AAEM,SAAU,qBAAsB,KAAqB,QAAc;AACvE,MAAI,IAAI,IAAI,IAAI,MAAM;AACtB,MAAI,MAAM;AAEV,SAAO,IAAID;AACX,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,UAAS;AACrB,MAAI,IAAIC,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQE;AACpB,MAAI,IAAID,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQG;AACpB,MAAI,IAAIF,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQI;AACpB,MAAI,IAAIH,MAAK;AACX,WAAO;EACT;AAEA,MAAI,IAAI,IAAI,SAAS,CAAC;AACtB,UAAQ,IAAID,SAAQK;AACpB,MAAI,IAAIJ,MAAK;AACX,WAAO;EACT;AAEA,QAAM,IAAI,WAAW,yBAAyB;AAChD;AAgBM,SAAUK,QAAQ,KAAkC,SAAiB,GAAC;AAC1E,MAAI,eAAe,YAAY;AAC7B,WAAO,iBAAiB,KAAK,MAAM;EACrC,OAAO;AACL,WAAO,qBAAqB,KAAK,MAAM;EACzC;AACF;;;ACrQA,IAAAC,sBAAuB;AAMjB,SAAU,OAAQ,QAAsBC,SAAe;AAC3D,SAAO,aAAa,2BAAO,OAAO,QAAQA,OAAM,CAAC;AACnD;;;ACRA,IAAAC,sBAAuB;;;ACIvB,SAAS,YAAaC,OAAc,QAAgBC,SAAqCC,SAAmC;AAC1H,SAAO;IACL,MAAAF;IACA;IACA,SAAS;MACP,MAAAA;MACA;MACA,QAAAC;;IAEF,SAAS;MACP,QAAAC;;;AAGN;AAEA,IAAM,SAAS,YAAY,QAAQ,KAAK,CAAC,QAAO;AAC9C,QAAM,UAAU,IAAI,YAAY,MAAM;AACtC,SAAO,MAAM,QAAQ,OAAO,GAAG;AACjC,GAAG,CAAC,QAAO;AACT,QAAM,UAAU,IAAI,YAAW;AAC/B,SAAO,QAAQ,OAAO,IAAI,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,IAAM,QAAQ,YAAY,SAAS,KAAK,CAAC,QAAO;AAC9C,MAAIC,UAAS;AAEb,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,IAAAA,WAAU,OAAO,aAAa,IAAI,CAAC,CAAC;EACtC;AACA,SAAOA;AACT,GAAG,CAAC,QAAO;AACT,QAAM,IAAI,UAAU,CAAC;AACrB,QAAM,MAAM,YAAY,IAAI,MAAM;AAElC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,QAAI,CAAC,IAAI,IAAI,WAAW,CAAC;EAC3B;AAEA,SAAO;AACT,CAAC;AAID,IAAM,QAAyD;EAC7D,MAAM;EACN,SAAS;EACT,KAAK,MAAM;EACX,QAAQ;EACR;EACA,QAAQ;EAER,GAAG;;AAGL,IAAA,gBAAe;;;AD7CT,SAAUC,YAAYC,SAAgB,WAA+B,QAAM;AAC/E,QAAMC,QAAO,cAAM,QAAQ;AAE3B,MAAIA,SAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,yBAAyB,QAAQ,GAAG;EACtD;AAEA,MAAI,aAAa,UAAU,aAAa,SAAS;AAC/C,WAAO,aAAa,2BAAO,KAAKD,SAAQ,OAAO,CAAC;EAClD;AAGA,SAAOC,MAAK,QAAQ,OAAO,GAAGA,MAAK,MAAM,GAAGD,OAAM,EAAE;AACtD;;;AE1BA,IAAAE,sBAAuB;AAYjB,SAAUC,UAAU,OAAmB,WAA+B,QAAM;AAChF,QAAMC,QAAO,cAAM,QAAQ;AAE3B,MAAIA,SAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,yBAAyB,QAAQ,GAAG;EACtD;AAEA,MAAI,aAAa,UAAU,aAAa,SAAS;AAC/C,WAAO,2BAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EAAE,SAAS,MAAM;EACtF;AAGA,SAAOA,MAAK,QAAQ,OAAO,KAAK,EAAE,UAAU,CAAC;AAC/C;;;ACtBM,IAAO,wBAAP,cAAqC,MAAK;EAA1C;;AAEJ,gCAAO;;;AADP,cADW,uBACJ,QAAO;AAIV,IAAO,kBAAP,cAA+B,MAAK;EAApC;;AAEJ,gCAAO;;;AADP,cADW,iBACJ,QAAO;AAIV,IAAO,yBAAP,cAAsC,MAAK;EAA3C;;AAEJ,gCAAO;;;AADP,cADW,wBACJ,QAAO;AAIV,IAAO,uBAAP,cAAoC,MAAK;EAAzC;;AAEJ,gCAAO;;;AADP,cADW,sBACJ,QAAO;;;ACnBhB,sBAAkD;;;ACE3C,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,eAAe;AACrB,IAAM,cAAc;AACpB,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,eAAe;AACrB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,aAAa;AACnB,IAAM,cAAc;AACpB,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,aAAa;AACnB,IAAM,YAAY;AAClB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAC1B,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,iBAAiB;AACvB,IAAM,aAAa;AACnB,IAAM,UAAU;AAChB,IAAM,WAAW;AACjB,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,yBAAyB;AAC/B,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AACpB,IAAM,mBAAmB;AACzB,IAAM,cAAc;;;AC/BrB,SAAU,cAAeC,OAAwB;AACrD,SAAO,CAAC,QAAO;AACb,WAAOC,UAAmB,KAAKD,KAAI;EACrC;AACF;AAEM,SAAU,cAAeA,OAAwB;AACrD,SAAO,CAAC,QAAO;AACb,WAAOE,YAAqB,KAAKF,KAAI;EACvC;AACF;AAEM,SAAU,WAAY,KAAe;AACzC,QAAM,OAAO,IAAI,SAAS,IAAI,MAAM;AACpC,SAAO,KAAK,UAAU,IAAI,UAAU,EAAE,SAAQ;AAChD;AAEM,SAAU,WAAY,MAAqB;AAC/C,QAAM,MAAM,IAAI,YAAY,CAAC;AAC7B,QAAM,OAAO,IAAI,SAAS,GAAG;AAC7B,OAAK,UAAU,GAAG,OAAO,SAAS,WAAW,SAAS,IAAI,IAAI,IAAI;AAElE,SAAO,IAAI,WAAW,GAAG;AAC3B;AAEM,SAAU,YAAa,KAAW;AACtC,QAAM,OAAO,IAAI,MAAM,GAAG;AAE1B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM,CAAC,qCAAqC;EAC1G;AAEA,MAAI,KAAK,CAAC,EAAE,WAAW,IAAI;AACzB,UAAM,IAAI,MAAM,+BAA+B,KAAK,CAAC,CAAC,2BAA2B;EACnF;AAGA,QAAM,MAAME,YAAqB,KAAK,CAAC,GAAG,QAAQ;AAGlD,QAAM,OAAO,SAAS,KAAK,CAAC,GAAG,EAAE;AAEjC,MAAI,OAAO,KAAK,OAAO,OAAO;AAC5B,UAAM,IAAI,MAAM,uCAAuC;EACzD;AAEA,QAAM,UAAU,WAAW,IAAI;AAE/B,SAAO,OAAiB,CAAC,KAAK,OAAO,GAAG,IAAI,SAAS,QAAQ,MAAM;AACrE;AAEM,SAAU,aAAc,KAAW;AACvC,QAAM,OAAO,IAAI,MAAM,GAAG;AAE1B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM,CAAC,qCAAqC;EAC1G;AAEA,MAAI,KAAK,CAAC,EAAE,WAAW,IAAI;AACzB,UAAM,IAAI,MAAM,+BAA+B,KAAK,CAAC,CAAC,4BAA4B;EACpF;AAGA,QAAM,MAAM,OAAO,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE;AAGvC,QAAM,OAAO,SAAS,KAAK,CAAC,GAAG,EAAE;AAEjC,MAAI,OAAO,KAAK,OAAO,OAAO;AAC5B,UAAM,IAAI,MAAM,uCAAuC;EACzD;AAEA,QAAM,UAAU,WAAW,IAAI;AAE/B,SAAO,OAAiB,CAAC,KAAK,OAAO,GAAG,IAAI,SAAS,QAAQ,MAAM;AACrE;AAEM,SAAU,YAAa,KAAe;AAC1C,QAAM,YAAY,IAAI,SAAS,GAAG,IAAI,SAAS,CAAC;AAChD,QAAM,YAAY,IAAI,SAAS,IAAI,SAAS,CAAC;AAC7C,QAAM,OAAOD,UAAmB,WAAW,QAAQ;AACnD,QAAM,OAAO,WAAW,SAAS;AACjC,SAAO,GAAG,IAAI,IAAI,IAAI;AACxB;AAIO,IAAM,aAAa,SAAU,IAAU;AAC5C,OAAK,GAAG,SAAQ,EAAG,KAAI;AAEvB,QAAM,QAAQ,IAAI,WAAW,CAAC;AAE9B,KAAG,MAAM,KAAK,EAAE,QAAQ,CAAC,MAAM,UAAS;AACtC,UAAM,QAAQ,SAAS,MAAM,EAAE;AAE/B,QAAI,MAAM,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAM;AAC7C,YAAM,IAAI,sBAAsB,kCAAkC;IACpE;AAEA,UAAM,KAAK,IAAI;EACjB,CAAC;AAED,SAAO;AACT;AAIO,IAAM,aAAa,SAAU,IAAU;AAC5C,MAAI,SAAS;AACb,OAAK,GAAG,SAAQ,EAAG,KAAI;AAEvB,QAAM,WAAW,GAAG,MAAM,KAAK,CAAC;AAEhC,MAAI;AACJ,OAAK,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACpC,UAAM,WAAO,wBAAO,SAAS,CAAC,CAAC;AAC/B,QAAI;AAEJ,QAAI,MAAM;AACR,iBAAW,WAAW,SAAS,CAAC,CAAC;AACjC,eAAS,CAAC,IAAIA,UAAmB,SAAS,SAAS,GAAG,CAAC,GAAG,QAAQ;IACpE;AAEA,QAAI,YAAY,QAAQ,EAAE,IAAI,GAAG;AAC/B,eAAS,OAAO,GAAG,GAAGA,UAAmB,SAAS,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC;IAC7E;EACF;AAEA,MAAI,SAAS,CAAC,MAAM,IAAI;AACtB,WAAO,SAAS,SAAS,GAAG;AAAE,eAAS,QAAQ,GAAG;IAAE;EACtD,WAAW,SAAS,SAAS,SAAS,CAAC,MAAM,IAAI;AAC/C,WAAO,SAAS,SAAS,GAAG;AAAE,eAAS,KAAK,GAAG;IAAE;EACnD,WAAW,SAAS,SAAS,GAAG;AAC9B,SAAK,IAAI,GAAG,IAAI,SAAS,UAAU,SAAS,CAAC,MAAM,IAAI,KAAK;IAAE;AAC9D,UAAM,OAAsC,CAAC,GAAG,CAAC;AACjD,SAAK,IAAI,IAAI,SAAS,QAAQ,IAAI,GAAG,KAAK;AACxC,WAAK,KAAK,GAAG;IACf;AACA,aAAS,OAAO,MAAM,UAAU,IAAI;EACtC;AAEA,QAAM,QAAQ,IAAI,WAAW,SAAS,EAAE;AAExC,OAAK,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACpC,QAAI,SAAS,CAAC,MAAM,IAAI;AACtB,eAAS,CAAC,IAAI;IAChB;AAEA,UAAME,QAAO,SAAS,SAAS,CAAC,GAAG,EAAE;AAErC,QAAI,MAAMA,KAAI,KAAKA,QAAO,KAAKA,QAAO,OAAQ;AAC5C,YAAM,IAAI,sBAAsB,kCAAkC;IACpE;AAEA,UAAM,QAAQ,IAAKA,SAAQ,IAAK;AAChC,UAAM,QAAQ,IAAIA,QAAO;EAC3B;AAEA,SAAO;AACT;AAGO,IAAM,cAAc,SAAU,KAAe;AAClD,MAAI,IAAI,eAAe,GAAG;AACxB,UAAM,IAAI,sBAAsB,mCAAmC;EACrE;AAEA,QAAM,SAAS,CAAA;AAEf,WAAS,IAAI,GAAG,IAAI,IAAI,YAAY,KAAK;AACvC,WAAO,KAAK,IAAI,CAAC,CAAC;EACpB;AAEA,SAAO,OAAO,KAAK,GAAG;AACxB;AAEO,IAAM,cAAc,SAAU,KAAe;AAClD,MAAI,IAAI,eAAe,IAAI;AACzB,UAAM,IAAI,sBAAsB,mCAAmC;EACrE;AAEA,QAAM,SAAmB,CAAA;AAEzB,WAAS,IAAI,GAAG,IAAI,IAAI,YAAY,KAAK,GAAG;AAC1C,UAAM,QAAQ,IAAI,CAAC;AACnB,UAAM,QAAQ,IAAI,IAAI,CAAC;AAEvB,UAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAE1F,WAAO,KAAK,KAAK;EACnB;AAEA,QAAM,KAAK,OAAO,KAAK,GAAG;AAE1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,WAAW,EAAE,GAAG;AAEpC,WAAO,IAAI,SAAS,UAAU,GAAG,IAAI,SAAS,SAAS,CAAC;EAC1D,QAAQ;AACN,UAAM,IAAI,sBAAsB,yBAAyB,EAAE,GAAG;EAChE;AACF;AAEM,SAAU,iBAAkB,KAAW;AAC3C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,WAAW,GAAG,GAAG;AAErC,WAAO,IAAI,SAAS,UAAU,GAAG,IAAI,SAAS,SAAS,CAAC;EAC1D,QAAQ;AACN,UAAM,IAAI,sBAAsB,yBAAyB,GAAG,GAAG;EACjE;AACF;AAEA,IAAM,WAAW,OAAO,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAC1D,IAAM,kBAAkB,WAAA;AACtB,MAAI,MAAM,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;AACpC,WAAS,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAO,MAAM,IAAI,GAAG,CAAC,CAAE;AAClD,SAAO;AACT,GAAE;AAEI,SAAU,SAAU,OAAa;AACrC,SAAO,eAAe,OAAO,KAAK;AACpC;AAEM,SAAU,SAAUH,OAAyB;AACjD,SAAO,CAAC,QAAO;AACb,WAAOA,MAAK,QAAQ,OAAO,GAAG;EAChC;AACF;;;AC5OM,SAAU,QAAS,OAAa;AACpC,QAAM,MAAM,SAAS,KAAK;AAE1B,MAAI,IAAI,SAAQ,MAAO,OAAO;AAC5B,UAAM,IAAI,gBAAgB,0BAA0B;EACtD;AACF;AAEM,SAAU,SAAU,OAAU;AAClC,MAAI,QAAQ,GAAG;AACb,UAAM,IAAI,gBAAgB,2CAA2C;EACvE;AACF;AAEM,SAAU,SAAU,KAAW;AACnC,SAAO,CAAC,UAAS;AACf,QAAI,QAAQ,KAAK;AACf,YAAM,IAAI,gBAAgB,0CAA0C,GAAG,EAAE;IAC3E;EACF;AACF;AAEM,SAAU,YAAa,OAAqC;AAChE,SAAO,CAAC,UAAS;AACf,eAAW,MAAM,OAAO;AACtB,SAAG,KAAK;IACV;EACF;AACF;AAEO,IAAM,eAAe,SAC1B,SACA,UACA,SAAS,KAAM,CAAC;;;AC1BX,IAAM,IAAI;AAsDjB,IAAM,WAAN,MAAc;EAAd;AACU,2CAAkB,oBAAI,IAAG;AACzB,2CAAkB,oBAAI,IAAG;;EAEjC,YAAa,KAAoB;AAC/B,QAAI;AAEJ,QAAI,OAAO,QAAQ,UAAU;AAC3B,cAAQ,KAAK,gBAAgB,IAAI,GAAG;IACtC,OAAO;AACL,cAAQ,KAAK,gBAAgB,IAAI,GAAG;IACtC;AAEA,QAAI,SAAS,MAAM;AACjB,YAAM,IAAI,qBAAqB,YAAY,GAAG,cAAc;IAC9D;AAEA,WAAO;EACT;EAEA,YAAa,OAAoB;AAC/B,SAAK,gBAAgB,IAAI,MAAM,MAAM,KAAK;AAC1C,SAAK,gBAAgB,IAAI,MAAM,MAAM,KAAK;AAE1C,UAAM,SAAS,QAAQ,WAAQ;AAC7B,WAAK,gBAAgB,IAAI,OAAO,KAAK;IACvC,CAAC;EACH;EAEA,eAAgBI,OAAY;AAC1B,UAAM,QAAQ,KAAK,gBAAgB,IAAIA,KAAI;AAE3C,QAAI,SAAS,MAAM;AACjB;IACF;AAEA,SAAK,gBAAgB,OAAO,MAAM,IAAI;AACtC,SAAK,gBAAgB,OAAO,MAAM,IAAI;AAEtC,UAAM,SAAS,QAAQ,WAAQ;AAC7B,WAAK,gBAAgB,OAAO,KAAK;IACnC,CAAC;EACH;;AAGK,IAAM,WAAW,IAAI,SAAQ;AAEpC,IAAM,SAA0B,CAAC;EAC/B,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU,CAAC,UAAS;AAClB,QAAI,KAAC,wBAAO,KAAK,GAAG;AAClB,YAAM,IAAI,gBAAgB,yBAAyB,KAAK,GAAG;IAC7D;EACF;GACC;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,eAAe;EACf,UAAU,CAAC,UAAS;AAClB,QAAI,KAAC,wBAAO,KAAK,GAAG;AAClB,YAAM,IAAI,gBAAgB,yBAAyB,KAAK,GAAG;IAC7D;EACF;GACC;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc,cAAc,QAAQ;EACpC,cAAc,cAAc,QAAQ;GACnC;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;EACd,UAAU;GACT;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,eAAe,CAAC,QAAQ,mBAAmB,GAAG;EAC9C,eAAe,CAAC,QAAQ,mBAAmB,GAAG;GAC7C;EACD,MAAM;EACN,MAAM;EACN,SAAS,CAAC,MAAM;EAChB,MAAM;EACN,cAAc,cAAc,WAAW;EACvC,cAAc,CAAC,QAAO;AACpB,QAAI,IAAI,WAAW,GAAG,KAAK,IAAI,WAAW,GAAG,GAAG;AAC9C,aAAO,cAAc,WAAW,EAAE,GAAG;IACvC;AAEA,WAAO,IAAI,MAAM,GAAG,EAAE,UAAU;EAClC;GACC;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;GACb;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc;EACd,cAAc;GACb;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,cAAc,SAAS,SAAS;EAChC,cAAc;GACb;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;EACN,eAAe,CAAC,QAAQ,IAAI,mBAAmB,GAAG,CAAC;EACnD,eAAe,CAAC,QAAQ,mBAAmB,IAAI,UAAU,CAAC,CAAC;GAC1D;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;GACL;EACD,MAAM;EACN,MAAM;EACN,MAAM;CACP;AAED,OAAO,QAAQ,WAAQ;AACrB,WAAS,YAAY,KAAK;AAC5B,CAAC;;;ACvSK,SAAU,kBAAmB,OAAiB;AAClD,QAAM,aAA0B,CAAA;AAEhC,MAAI,IAAI;AACR,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAMC,QAAcC,QAAO,OAAO,CAAC;AACnC,UAAM,QAAQ,SAAS,YAAYD,KAAI;AACvC,UAAM,aAAoBE,gBAAeF,KAAI;AAC7C,UAAM,OAAO,YAAY,OAAO,OAAO,IAAI,UAAU;AACrD,QAAI,aAAa;AAEjB,QAAI,OAAO,KAAK,MAAM,SAAS,GAAG;AAChC,mBAAoBE,gBAAe,IAAI;IACzC;AAEA,UAAM,kBAAkB,aAAa,aAAa;AAElD,UAAM,YAAuB;MAC3B,MAAAF;MACA,MAAM,MAAM;MACZ,OAAO,MAAM,SAAS,GAAG,IAAI,eAAe;;AAG9C,QAAI,OAAO,GAAG;AACZ,YAAM,cAAc,IAAI,aAAa;AACrC,YAAM,aAAa,MAAM,SAAS,aAAa,cAAc,IAAI;AAEjE,gBAAU,QAAQ,MAAM,eAAe,UAAU,KAAKG,UAAmB,UAAU;IACrF;AAEA,eAAW,KAAK,SAAS;AAEzB,SAAK;EACP;AAEA,SAAO;AACT;AAEM,SAAU,kBAAmB,YAAuB;AACxD,MAAIC,UAAS;AACb,QAAM,QAAsB,CAAA;AAE5B,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,MAAM;AAC3B,YAAM,QAAQ,SAAS,YAAY,UAAU,IAAI;AACjD,YAAM,cAAqBF,gBAAe,UAAU,IAAI;AACxD,UAAI;AACJ,UAAI,cAAc;AAClB,UAAI,oBAAoB;AAExB,UAAI,UAAU,SAAS,MAAM;AAC3B,qBAAa,MAAM,eAAe,UAAU,KAAK,KAAKG,YAAqB,UAAU,KAAK;AAC1F,sBAAc,WAAW;AAEzB,YAAI,MAAM,SAAS,GAAG;AACpB,8BAA2BH,gBAAe,WAAW;QACvD;MACF;AAEA,YAAMI,SAAQ,IAAI,WAAW,cAAc,oBAAoB,WAAW;AAG1E,UAAI,SAAS;AACb,MAAO,iBAAiB,UAAU,MAAMA,QAAO,MAAM;AACrD,gBAAU;AAGV,UAAI,cAAc,MAAM;AAEtB,YAAI,MAAM,SAAS,GAAG;AACpB,UAAO,iBAAiB,aAAaA,QAAO,MAAM;AAClD,oBAAU;QACZ;AAGA,QAAAA,OAAM,IAAI,YAAY,MAAM;MAC9B;AAEA,gBAAU,QAAQA;IACpB;AAEA,UAAM,KAAK,UAAU,KAAK;AAC1B,IAAAF,WAAU,UAAU,MAAM;EAC5B;AAEA,SAAO,OAAiB,OAAOA,OAAM;AACvC;AAEM,SAAU,mBAAoBG,SAAc;AAChD,MAAIA,QAAO,OAAO,CAAC,MAAM,KAAK;AAC5B,UAAM,IAAI,sBAAsB,sCAAsC;EACxE;AAEA,QAAM,aAA0B,CAAA;AAChC,MAAI,aAAmC;AACvC,MAAI,QAAQ;AACZ,MAAI,WAAW;AAEf,WAAS,IAAI,GAAG,IAAIA,QAAO,QAAQ,KAAK;AACtC,UAAM,OAAOA,QAAO,OAAO,CAAC;AAE5B,QAAI,SAAS,KAAK;AAChB,UAAI,eAAe,YAAY;AAC7B,oBAAYA,QAAO,OAAO,CAAC;MAC7B,OAAO;AACL,iBAASA,QAAO,OAAO,CAAC;MAC1B;IACF;AAEA,UAAM,QAAQ,MAAMA,QAAO,SAAS;AAEpC,QAAI,SAAS,OAAO,OAAO;AACzB,YAAM,QAAQ,SAAS,YAAY,QAAQ;AAE3C,UAAI,eAAe,YAAY;AAC7B,YAAI,MAAM,QAAQ,QAAQ,MAAM,SAAS,GAAG;AAE1C,qBAAW,KAAK;YACd,MAAM,MAAM;YACZ,MAAM,MAAM;WACb;AAED,kBAAQ;AACR,qBAAW;AACX,uBAAa;AAEb;QACF,WAAW,OAAO;AAChB,gBAAM,IAAI,sBAAsB,aAAa,QAAQ,oBAAoB;QAC3E;AAGA,qBAAa;MACf,WAAW,eAAe,SAAS;AACjC,cAAM,YAAuB;UAC3B,MAAM,MAAM;UACZ,MAAM,MAAM;;AAGd,YAAI,MAAM,QAAQ,QAAQ,MAAM,SAAS,GAAG;AAC1C,cAAI,UAAU,IAAI;AAChB,kBAAM,IAAI,sBAAsB,aAAa,QAAQ,oBAAoB;UAC3E;AAEA,oBAAU,QAAQ,MAAM,gBAAgB,KAAK,KAAK;QACpD;AAEA,mBAAW,KAAK,SAAS;AAEzB,gBAAQ;AACR,mBAAW;AACX,qBAAa;MACf;IACF;EACF;AAEA,MAAI,aAAa,MAAM,UAAU,IAAI;AACnC,UAAM,IAAI,sBAAsB,sBAAsB;EACxD;AAEA,SAAO;AACT;AAEM,SAAU,mBAAoB,YAAuB;AACzD,SAAO,IAAI,WAAW,QAAQ,eAAY;AACtC,QAAI,UAAU,SAAS,MAAM;AAC3B,aAAO,UAAU;IACnB;AAEA,UAAM,QAAQ,SAAS,YAAY,UAAU,IAAI;AAEjD,QAAI,SAAS,MAAM;AACjB,YAAM,IAAI,sBAAsB,yBAAyB,UAAU,IAAI,EAAE;IAC3E;AAEA,WAAO;MACL,UAAU;MACV,MAAM,gBAAgB,UAAU,KAAK,KAAK,UAAU;;EAExD,CAAC,EAAE,KAAK,GAAG,CAAC;AAChB;AAKA,SAAS,YAAa,OAAsB,OAAmB,QAAc;AAC3E,MAAI,MAAM,QAAQ,QAAQ,MAAM,SAAS,GAAG;AAC1C,WAAO;EACT;AAEA,MAAI,MAAM,OAAO,GAAG;AAClB,WAAO,MAAM,OAAO;EACtB;AAEA,SAAcN,QAAO,OAAO,MAAM;AACpC;;;ACrMA,IAAM,UAAU,uBAAO,IAAI,4BAA4B;AAChD,IAAM,SAAS,uBAAO,IAAI,yBAAyB;AAE1D,SAAS,aAAc,MAAoB;AACzC,MAAI,QAAQ,MAAM;AAChB,WAAO;EACT;AAEA,MAAI,YAAY,IAAI,GAAG;AACrB,WAAO,KAAK,cAAa;EAC3B;AAEA,MAAI,gBAAgB,YAAY;AAC9B,WAAO,kBAAkB,IAAI;EAC/B;AAEA,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO,KACJ,QAAQ,WAAW,GAAG,EACtB,QAAQ,UAAU,EAAE;AAEvB,QAAI,SAAS,IAAI;AACf,aAAO;IACT;AAEA,WAAO,mBAAmB,IAAI;EAChC;AAEA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO;EACT;AAEA,QAAM,IAAI,sBAAsB,iEAAiE;AACnG;AAxCA,IAAAO,KAAA;AAiDM,IAAO,aAAP,MAAO,WAAS;EASpB,YAAa,OAAqC,KAAKC,WAA4B,CAAA,GAAE;AARrF,wBAACD,KAAmB;AACX;AAGT;;AAEA;;AAGE,uBAAK,aAAc,aAAa,IAAI;AAEpC,QAAIC,SAAQ,aAAa,OAAO;AAC9B,MAAAC,UAAS,IAAI;IACf;EACF;EAEA,IAAI,QAAK;AACP,QAAI,mBAAK,WAAU,MAAM;AACvB,yBAAK,QAAS,kBAAkB,mBAAK,YAAW;IAClD;AAEA,WAAO,mBAAK;EACd;EAEA,WAAQ;AACN,QAAI,mBAAK,YAAW,MAAM;AACxB,yBAAK,SAAU,mBAAmB,mBAAK,YAAW;IACpD;AAEA,WAAO,mBAAK;EACd;EAEA,SAAM;AACJ,WAAO,KAAK,SAAQ;EACtB;EAEA,gBAAa;AACX,WAAO;MACL,GAAG,mBAAK,aAAY,IAAI,QAAM,EAAE,GAAG,EAAC,EAAG;;EAE3C;EAEA,YAAa,MAAoB;AAC/B,UAAM,KAAK,IAAI,WAAU,IAAI;AAE7B,WAAO,IAAI,WAAU;MACnB,GAAG,mBAAK;MACR,GAAG,GAAG,cAAa;OAClB;MACD,UAAU;KACX;EACH;EAEA,YAAa,MAAwB;AACnC,UAAM,aAAa,KAAK,SAAQ;AAChC,UAAM,IAAI,KAAK,SAAQ;AACvB,UAAM,IAAI,EAAE,YAAY,UAAU;AAElC,QAAI,IAAI,GAAG;AACT,YAAM,IAAI,uBAAuB,WAAW,KAAK,SAAQ,CAAE,iCAAiC,UAAU,EAAE;IAC1G;AAEA,WAAO,IAAI,WAAU,EAAE,MAAM,GAAG,CAAC,GAAG;MAClC,UAAU;KACX;EACH;EAEA,gBAAiBC,OAAY;AAC3B,QAAI;AAEJ,aAAS,IAAI,mBAAK,aAAY,SAAS,GAAG,IAAI,IAAI,KAAK;AACrD,UAAI,mBAAK,aAAY,CAAC,EAAE,SAASA,OAAM;AACrC,gBAAQ;AACR;MACF;IACF;AAEA,WAAO,IAAI,WAAU,mBAAK,aAAY,MAAM,GAAG,KAAK,GAAG;MACrD,UAAU;KACX;EACH;EAEA,OAAQ,MAA2B;AACjC,WAAOC,QAAiB,KAAK,OAAO,KAAK,KAAK;EAChD;;;;;;;;;;;;;EAcA,EAlGCJ,MAAA,QAkGA,QAAO,IAAC;AACP,WAAO,aAAa,KAAK,SAAQ,CAAE;EACrC;;AAnGS;AAGT;AAEA;AAPI,IAAO,YAAP;AA4GA,SAAUE,UAAU,MAAe;AACvC,OAAK,cAAa,EACf,QAAQ,eAAY;AACnB,UAAM,QAAQ,SAAS,YAAY,UAAU,IAAI;AAEjD,QAAI,UAAU,SAAS,MAAM;AAC3B;IACF;AAEA,UAAM,WAAW,UAAU,KAAK;EAClC,CAAC;AACL;;;AC6GM,SAAU,YAAa,OAAU;AACrC,SAAO,QAAQ,QAAQ,MAAM,CAAC;AAChC;AAeM,SAAU,UAAW,MAAqB;AAC9C,SAAO,IAAI,UAAe,IAAI;AAChC;;;AClQA,IAAM,oBAAoB;EACxB;EACA;EACA;EACA;EACA;;AAOF,SAAS,WAAY,IAAe;AAClC,SAAO,aAAa,OAAO,EAAE,GAAG;AAClC;AAEA,SAAS,YAAa,IAAe;AACnC,QAAM,OAAO,aAAa,OAAO,EAAE,GAAG;AAEtC,MAAI,QAAQ,MAAM;AAChB,WAAO;EACT;AAEA,SAAO,IAAI,IAAI;AACjB;AAEA,SAAS,aAAcG,OAAc,IAAe;AAClD,SAAO,GAAG,KAAK,eAAa,UAAU,SAASA,KAAI;AACrD;AAEA,SAAS,OAAQ,IAAe;AAC9B,SAAO,GAAG,KAAK,CAAC,EAAE,MAAAC,MAAI,MAAOA,UAAS,QAAQ;AAChD;AAEA,SAAS,cAAe,MAAiB,MAAiB;AACxD,QAAM,cAAc,aAAa,KAAK,IAAI;AAC1C,MAAI,eAAe,MAAM;AACvB,UAAM,IAAI,MAAM,4BAA4B,KAAK,IAAI,EAAE;EACzD;AACA,QAAM,UAAU,YAAY,MAAM,IAAI;AACtC,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO,IAAI,OAAO;EACpB;AACA,SAAO;AACT;AAEA,IAAM,eAA4C;EAChD,KAAK,CAAC,MAAM,SAAS,KAAK;EAC1B,KAAK,CAAC,MAAM,SAAQ;AAClB,QAAI,KAAK,WAAW,GAAG;AACrB,aAAO,KAAK;IACd;AACA,WAAO,IAAI,KAAK,KAAK;EACvB;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,SAAS,cAAc,MAAM,IAAI,CAAC,IAAI,KAAK,KAAK;EACzD;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,SAAS,cAAc,MAAM,IAAI,CAAC,IAAI,KAAK,KAAK;EACzD;EACA,SAAS,CAAC,MAAM,SAAS,KAAK;EAC9B,MAAM,CAAC,MAAM,SAAS,KAAK;EAC3B,MAAM,CAAC,MAAM,SAAS,KAAK;EAC3B,KAAK,CAAC,MAAM,SAAS,KAAK;EAC1B,MAAM,CAAC,MAAM,SAAQ;AACnB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,GAAG,cAAc,MAAM,IAAI,CAAC;EACrC;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,GAAG,cAAc,MAAM,IAAI,CAAC;EACrC;EACA,MAAM,CAAC,MAAM,SAAQ;AACnB,UAAM,WAAW,OAAO,IAAI;AAC5B,UAAM,MAAM,WAAW,IAAI;AAC3B,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI,YAAY,OAAO,MAAM;AAC3B,aAAO,WAAW,GAAG,GAAG,IAAI;IAC9B;AACA,UAAM,WAAW,WAAW,aAAa;AACzC,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,GAAG,QAAQ,GAAG,OAAO;EAC9B;EACA,aAAa,CAAC,MAAM,SAAQ;AAC1B,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,UAAM,UAAU,cAAc,MAAM,IAAI;AACxC,UAAM,eAAe,mBAAmB,KAAK,SAAS,EAAE;AACxD,WAAO,GAAG,OAAO,GAAG,YAAY;EAClC;EACA,KAAK,CAAC,MAAM,SAAQ;AAGlB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,cAAc,MAAM,IAAI;EACjC;EACA,KAAK,CAAC,MAAM,SAAQ;AAGlB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,WAAO,cAAc,MAAM,IAAI;EACjC;EACA,OAAO,CAAC,MAAM,SAAQ;AACpB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,WAAW,OAAO;EAC3B;EACA,IAAI,CAAC,MAAM,SAAQ;AACjB,UAAM,WAAW,OAAO,IAAI;AAC5B,UAAM,MAAM,WAAW,IAAI;AAC3B,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI,YAAY,OAAO,MAAM;AAC3B,aAAO,SAAS,GAAG,GAAG,IAAI;IAC5B;AACA,UAAM,WAAW,WAAW,WAAW;AACvC,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,GAAG,QAAQ,GAAG,OAAO;EAC9B;EACA,KAAK,CAAC,MAAM,SAAQ;AAClB,UAAM,OAAO,KAAK,IAAG;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,6BAA6B;IAC/C;AACA,QAAI,UAAU,cAAc,MAAM,IAAI;AAEtC,cAAU,SAAS,QAAQ,UAAU,EAAE;AACvC,WAAO,SAAS,OAAO;EACzB;;AAGI,SAAU,eAAgB,OAAwC,MAAyB;AAC/F,QAAM,KAAK,UAAU,KAAK;AAC1B,QAAM,aAAa,GAAG,cAAa;AACnC,QAAM,OAAO,WAAW,IAAG;AAC3B,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,6BAA6B;EAC/C;AAEA,QAAM,cAAc,aAAa,KAAK,IAAI;AAE1C,MAAI,eAAe,MAAM;AACvB,UAAM,IAAI,MAAM,4BAA4B,KAAK,IAAI,EAAE;EACzD;AAEA,MAAI,MAAM,YAAY,MAAM,UAAU,KAAK;AAE3C,MAAI,MAAM,eAAe,SAAS,kBAAkB,SAAS,KAAK,IAAI,GAAG;AAEvE,UAAM,IAAI,QAAQ,YAAY,EAAE;AAEhC,QAAI,KAAK,UAAU,OAAO;AACxB,YAAM,WAAW,GAAG;IACtB,OAAO;AACL,YAAM,UAAU,GAAG;IACrB;EACF;AAEA,MAAI,IAAI,WAAW,SAAS,KAAK,IAAI,WAAW,UAAU,KAAK,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,QAAQ,GAAG;AAElH,UAAM,IAAI,IAAI,GAAG,EAAE,SAAQ;AAG3B,QAAI,IAAI,SAAS,GAAG,GAAG;AACrB,YAAM,IAAI,UAAU,GAAG,IAAI,SAAS,CAAC;IACvC;EACF;AAEA,SAAO;AACT;;;ACrPA,IAAM,OAAO;AAEb,IAAM,UAAU,CAAAC,aAAWA,YAAWA,SAAQ,oBAC3C,mBAAmB,IAAI,SAAS,IAAI,gBACpC;AAEH,IAAM,KAAK;AAEX,IAAM,YAAY;AAElB,IAAM,KAAK;AAAA;AAAA,KAEN,SAAS,WAAW,SAAS;AAAA,KAC7B,SAAS,WAAW,EAAE,KAAK,SAAS;AAAA,KACpC,SAAS,YAAY,EAAE,QAAQ,SAAS;AAAA,KACxC,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,KAC9D,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,KAC9D,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,KAC9D,SAAS,eAAe,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA,aACtD,SAAS,UAAU,EAAE,QAAQ,SAAS;AAAA;AAAA,EAEjD,QAAQ,gBAAgB,EAAE,EAAE,QAAQ,OAAO,EAAE,EAAE,KAAK;AAGtD,IAAM,WAAW,IAAI,OAAO,OAAO,EAAE,UAAU,EAAE,IAAI;AACrD,IAAM,UAAU,IAAI,OAAO,IAAI,EAAE,GAAG;AACpC,IAAM,UAAU,IAAI,OAAO,IAAI,EAAE,GAAG;AAEpC,IAAM,UAAU,CAAAA,aAAWA,YAAWA,SAAQ,QAC3C,WACA,IAAI,OAAO,MAAM,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,QAAQ,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,KAAK,GAAG;AAEpH,QAAQ,KAAK,CAAAA,aAAWA,YAAWA,SAAQ,QAAQ,UAAU,IAAI,OAAO,GAAG,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,IAAI,GAAG;AAC1H,QAAQ,KAAK,CAAAA,aAAWA,YAAWA,SAAQ,QAAQ,UAAU,IAAI,OAAO,GAAG,QAAQA,QAAO,CAAC,GAAG,EAAE,GAAG,QAAQA,QAAO,CAAC,IAAI,GAAG;AAE1H,IAAO,mBAAQ;;;ACnCf,qBAAe;AAEA,SAAR,gBAAiC,WAAW,EAAC,QAAO,IAAI,CAAC,GAAG;AAClE,QAAM,SAAS,IAAI,eAAAC,QAAG,OAAO,2BAA2B;AAExD,QAAM,kBAAkB,IAAI,eAAe;AAC1C,UAAM,UAAU;AAAA,MACf,WAAW,MAAM,UAAU,GAAG,UAAU;AAAA,IACzC;AAEA,WAAO,gBAAgB,SAAS,EAAC,QAAO,CAAC;AAEzC,WAAO,QAAQ;AAAA,EAChB;AAEA,SAAO,eAAe,iBAAiB,QAAQ;AAAA,IAC9C,OAAO,mBAAmB,UAAU,QAAQ,aAAa;AAAA,IACzD,cAAc;AAAA,EACf,CAAC;AAED,SAAO;AACR;AAEO,SAAS,eAAe,OAAO;AACrC,SAAO,OAAO,SAAS;AACxB;;;ACzBA,IAAM,EAAC,UAAAC,UAAQ,IAAI,OAAO;AAEX,SAAR,SAA0B,OAAO;AACvC,SAAOA,UAAS,KAAK,KAAK,MAAM;AACjC;;;ACFA,IAAM,UAAU;AAAA,EACf,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AACV;AAEe,SAAR,aAA8B,QAAQC,WAAU,CAAC,GAAG;AAC1D,MAAI,CAAC,SAAS,MAAM,GAAG;AACtB,UAAM,IAAI,UAAU,4BAA4B;AAAA,EACjD;AAEA,QAAM,QAAQ,OAAO,KAAK,OAAO,EAAE,IAAI,WACrC,OAAOA,SAAQ,IAAI,MAAM,YAAYA,SAAQ,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,EACtF,EAAE,KAAK,EAAE;AAEV,QAAMC,gBAAe,IAAI,OAAOD,SAAQ,UAAU,OAAO,QAAQ,KAAK;AAEtE,EAAAC,cAAa,YAAY,OAAOD,SAAQ,cAAc,WACrDA,SAAQ,YACR,OAAO;AAER,SAAOC;AACR;;;ACfO,SAAS,QAAQ,OAAOC,SAAQ,EAAC,QAAO,IAAI,CAAC,GAAG;AACtD,MAAI;AACH,WAAO,gBAAgB,MAAM,aAAY,KAAK,EAAE,KAAKA,OAAM,GAAG,EAAC,QAAO,CAAC,EAAE;AAAA,EAC1E,SAAS,OAAO;AACf,QAAI,eAAe,KAAK,GAAG;AAC1B,aAAO;AAAA,IACR;AAEA,UAAM;AAAA,EACP;AACD;;;ACnBA,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAEtB,IAAM,UAAU;AAAA,EACf,SAAS;AACV;AAUO,SAASC,QAAOC,SAAQ;AAC9B,MAAIA,QAAO,SAAS,eAAe;AAClC,WAAO;AAAA,EACR;AAEA,SAAO,QAAQ,iBAAQ,GAAG,EAAC,OAAO,KAAI,CAAC,GAAGA,SAAQ,OAAO;AAC1D;AAEO,SAASC,QAAOD,SAAQ;AAC9B,MAAIA,QAAO,SAAS,eAAe;AAClC,WAAO;AAAA,EACR;AAEA,SAAO,QAAQ,iBAAQ,GAAG,EAAC,OAAO,KAAI,CAAC,GAAGA,SAAQ,OAAO;AAC1D;;;ACWA,IAAM,UAAkC;EACtC,MAAM;EACN,OAAO;EACP,IAAI;EACJ,KAAK;;AAGP,IAAM,kBAAkB,CAAC,QAAQ,SAAS,MAAM,KAAK;AAyB/C,SAAU,eAAgB,QAAgB,MAA2B;AACzE,SAAO,QAAQ,CAAA;AACf,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,EAAE,QAAQ,UAAU,MAAM,KAAI,IAAK,SAAS,MAAM;AACxD,QAAM,QAAQ;IACZ,iBAAiB,UAAU,cAAc;IACzC,aAAa,MAAM,MAAM;IACzB,eAAe,MAAM;;AAGvB,MAAI,QAAQ,MAAM;AAChB,UAAM,KAAK,aAAa,IAAI,CAAC;EAC/B;AAEA,QAAM,eAAe,MAAM,MACxB,OAAO,OAAK,QAAQ,CAAC,CAAC,EAEtB,OAAO,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,GAAG,CAAA,CAAE,EAChC,KAAK,GAAG;AAEX,SAAO,UAAU,YAAY;AAC/B;AAEA,SAAS,SAAU,QAAc;AAC/B,QAAM,CAAC,MAAM,IAAI,OAAO,MAAM,GAAG;AAGjC,MAAI,CAAC,gBAAgB,SAAS,MAAM,GAAG;AACrC,aAAS,SAAS,OAAO,UAAU,OAAO,MAAM;EAClD;AAGA,MAAI,EAAE,UAAU,UAAU,MAAM,UAAU,OAAM,IAAK,IAAI,IAAI,MAAM;AAEnE,MAAI,QAAQ,QAAQ,SAAS,IAAI;AAC/B,UAAM,eAAe,gBAAgB,MAAM;AAE3C,QAAI,gBAAgB,MAAM;AACxB,aAAO;IACT;AAGA,QAAI,gBAAgB,QAAQ,aAAa,SAAS;AAEhD,aAAO;IACT;EACF;AAEA,MAAI;AAEJ,MAAI,YAAY,QAAQ,aAAa,MAAM,aAAa,KAAK;AAC3D,QAAI,SAAS,WAAW,GAAG,GAAG;AAC5B,iBAAW,SAAS,UAAU,CAAC;IACjC;AAEA,WAAO;EACT;AAEA,MAAI,UAAU,QAAQ,WAAW,IAAI;AACnC,WAAO,QAAQ;AACf,YAAQ;EACV;AAEA,SAAO,EAAE,QAAQ,UAAU,MAAM,KAAI;AACvC;AAEA,SAAS,iBAAkB,UAAkB,gBAAsB;AACjE,MAAI,YAAY,QAAQ,aAAa,IAAI;AACvC,WAAO;EACT;AAEA,MAAIE,QAAO,QAAQ,GAAG;AACpB,WAAO,CAAC,OAAO,QAAQ;EACzB;AAEA,MAAIC,QAAO,QAAQ,GAAG;AACpB,WAAO,CAAC,OAAO,QAAQ;EACzB;AAIA,MAAI,SAAS,CAAC,MAAM,KAAK;AACvB,UAAM,UAAU,SAAS,UAAU,GAAG,SAAS,SAAS,CAAC;AACzD,QAAIA,QAAO,OAAO,GAAG;AACnB,aAAO,CAAC,OAAO,OAAO;IACxB;EACF;AAEA,SAAO,CAAC,gBAAgB,QAAQ;AAClC;AAEA,SAAS,aAAc,MAAc,QAAc;AACjD,MAAI,QAAQ,QAAQ,SAAS,IAAI;AAC/B,WAAO;EACT;AAEA,MAAI,WAAW,OAAO;AACpB,WAAO,CAAC,OAAO,IAAI;EACrB;AAEA,SAAO,CAAC,OAAO,IAAI;AACrB;AAEA,SAAS,eAAgB,QAAc;AACrC,MAAI,OAAO,MAAM,aAAa,KAAK,MAAM;AACvC,WAAO;EACT;AAEA,MAAI,WAAW,SAAS;AACtB,WAAO,CAAC,WAAW;EACrB;AAEA,MAAI,WAAW,OAAO;AACpB,WAAO,CAAC,SAAS;EACnB;AAEA,SAAO,CAAC,MAAM;AAChB;AAEA,SAAS,aAAc,MAAY;AACjC,MAAI,QAAQ,QAAQ,SAAS,IAAI;AAC/B,WAAO;EACT;AAEA,SAAO,CAAC,aAAa,mBAAmB,IAAI,CAAC;AAC/C;AAEA,SAAS,gBAAiB,UAAgB;AACxC,MAAI,YAAY,QAAQ,aAAa,MAAM,QAAQ,QAAQ,KAAK,MAAM;AACpE,WAAO;EACT;AAEA,SAAO,QAAQ,QAAQ;AACzB;;;ACtMA,IAAAC,kBAAwB;AAExB,IAAAC,eAA8B;AA8BvB,IAAM,0CACX;AACK,IAAM,kCAAkC;AAGxC,IAAM,yBAAyB;AAE/B,IAAM,kCAAkC;AAExC,IAAM,8BAA8B;AAEpC,IAAM,yBAAyB;AA0D/B,SAAS,uCAA+D;AAC7E,QAAM,OAAO,oBAAI,IAAoB;AACrC,SAAO;AAAA,IACL,KAAK,CAAC,QAAQ,KAAK,IAAI,GAAG;AAAA,IAC1B,KAAK,CAAC,KAAK,YAAY;AACrB,WAAK,IAAI,KAAK,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAaO,IAAM,qCAAqC;AAElD,SAAS,oBAAgD;AACvD,MAAI;AACF,WAAQ,WAA4D;AAAA,EACtE,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,yCACd,SACA,aAAqB,oCACG;AACxB,QAAM,UAAU,WAAW,kBAAkB;AAC7C,MAAI,CAAC,SAAS;AACZ,WAAO,qCAAqC;AAAA,EAC9C;AAEA,QAAM,WAAW,MAA8B;AAC7C,UAAM,MAAM,QAAQ,QAAQ,UAAU;AACtC,QAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC3E,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AAAA,IAER;AACA,YAAQ,WAAW,UAAU;AAC7B,WAAO,CAAC;AAAA,EACV;AAEA,SAAO;AAAA,IACL,KAAK,CAAC,QAAQ,SAAS,EAAE,GAAG;AAAA,IAC5B,KAAK,CAAC,KAAK,YAAY;AACrB,YAAM,OAAO,SAAS;AACtB,WAAK,GAAG,IAAI;AACZ,cAAQ,QAAQ,YAAY,KAAK,UAAU,IAAI,CAAC;AAAA,IAClD;AAAA,EACF;AACF;AAiFO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,SAAiB;AAC3B,UAAM,sCAAsC,OAAO,EAAE;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAGtD,YAAY,SAAiB,UAAuC;AAClE,UAAM,4CAA4C,OAAO,EAAE;AAC3D,SAAK,OAAO;AACZ,SAAK,WAAW;AAAA,EAClB;AACF;AAEO,SAAS,yBACd,QACuB;AACvB,SAAO;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,YAAY,CAAC,GAAG,OAAO,UAAU;AAAA,IACjC,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,EACnB;AACF;AAEO,SAAS,yBACd,SACQ;AACR,SAAO,KAAK,UAAU;AAAA,IACpB,SAAS,QAAQ;AAAA,IACjB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,mBACpB,SACA,QACyB;AACzB,gCAA8B,OAAO;AACrC,QAAM,UAAU,yBAAyB,OAAO;AAChD,QAAM,YACJ,OAAO,SAAS,YACZ,MAAM,OAAO,YAAY,OAAO,IAChCC;AAAA,IACE,MAAM,OAAO,UAAU,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC;AAAA,EAC1D;AACN,SAAO,EAAE,GAAG,SAAS,UAAU;AACjC;AAEO,SAAS,8BACd,OACuB;AACvB,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,UAAM,IAAI,8BAA8B,2BAA2B;AAAA,EACrE;AAEA,QAAM,UAAU;AAChB,MAAI,QAAQ,YAAY,GAAG;AACzB,UAAM,IAAI,8BAA8B,mBAAmB;AAAA,EAC7D;AACA,kBAAgB,QAAQ,OAAO;AAC/B,qBAAmB,QAAQ,UAAU;AACrC,MACE,OAAO,QAAQ,eAAe,YAC9B,OAAO,MAAM,KAAK,MAAM,QAAQ,UAAU,CAAC,GAC3C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,QAAQ,aAAa,YAC5B,CAAC,OAAO,cAAc,QAAQ,QAAQ,KACtC,QAAQ,WAAW,GACnB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,QAAQ;AAAA,IACjB,YAAY,CAAC,GAAG,QAAQ,UAAU;AAAA,IAClC,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,EACpB;AACF;AAEO,SAAS,uBAAuB,OAAgC;AACrE,QAAM,UAAU,8BAA8B,KAAK;AACnD,QAAM,YAAa,MAAkC;AACrD,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,GAAG,SAAS,UAAU;AACjC;AAEA,eAAsB,qBACpB,OACkB;AAClB,QAAM,SAAS,uBAAuB,KAAK;AAC3C,QAAM,UAAU,yBAAyB,yBAAyB,MAAM,CAAC;AAEzE,MAAI,OAAO,QAAQ,WAAW,UAAU,GAAG;AACzC,WAAO,mBAAmB,OAAO,SAAS,SAAS,OAAO,SAAS;AAAA,EACrE;AACA,MAAI,OAAO,QAAQ,WAAW,UAAU,GAAG;AACzC,WAAO,sBAAsB,OAAO,SAAS,SAAS,OAAO,SAAS;AAAA,EACxE;AACA,SAAO;AACT;AAEA,eAAsB,oBACpB,aACA,SACA,UAAwB,WAAW,OACH;AAChC,QAAM,MAAM,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,iBAAiB,mBAAmB,OAAO,CAAC;AACzF,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,mCAAmC,SAAS,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,MAAI,KAAK,WAAW,QAAW;AAC7B,UAAM,IAAI,8BAA8B,kCAAkC;AAAA,EAC5E;AACA,SAAO,uBAAuB,KAAK,MAAM;AAC3C;AAEA,eAAsB,qBACpB,SACAC,WAAuC,CAAC,GACR;AAChC,kBAAgB,OAAO;AACvB,QAAM,gBAAgBA,SAAQ,iBAAiB;AAC/C,QAAM,WAAW,MAAM,QAAQ,IAAI;AAAA,IACjC,gBAAgB,SAASA,SAAQ,kBAAkB;AAAA,IACnD,kBAAkB,SAASA,SAAQ,YAAY,aAAa;AAAA,IAC5D,mBAAmB,SAASA,UAAS,aAAa;AAAA,IAClD,gBAAgB,SAASA,SAAQ,kBAAkB;AAAA,EACrD,CAAC;AAED,QAAM,SAAS,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,GAAG;AAC9D,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,6BAA6B,SAAS,QAAQ;AAAA,EAC1D;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,YAAY,CAAC,GAAG,OAAO,UAAU;AAAA,IACjC,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACjD;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AACF;AAEA,eAAsB,sBACpB,SACAA,WAAwC,CAAC,GACR;AACjC,QAAM,mBACJA,SAAQ,kBAAkB,UAAaA,SAAQ,cAAc,SAAS;AAMxE,QAAM,UAAU,aAAaA,SAAQ,SAAS,WAAW,KAAK;AAG9D,MAAI,CAAC,qBAAqBA,SAAQ,yBAAyB,OAAO;AAChE,UAAM,QAAQ,MAAM,2BAA2B;AAAA,MAC7C;AAAA,MACA,uBAAuB;AAAA,MACvB,cAAcA,SAAQ;AAAA,MACtB,eAAeA,SAAQ;AAAA,MACvB,aAAaA,SAAQ;AAAA,MACrB,iBAAiBA,SAAQ;AAAA,MACzB,eAAeA,SAAQ;AAAA,MACvB,eAAeA,SAAQ;AAAA,MACvB,OAAO;AAAA,IACT,CAAC;AACD,QAAI,OAAO;AACT,YAAM,aAAa,CAAC,mBAAmB,MAAM,GAAG,CAAC;AACjD,YAAM,YAA+B,EAAE,QAAQ,MAAM,QAAQ,WAAW;AACxE,YAAMC,YAAkC;AAAA,QACtC;AAAA,QACA,QAAQ,MAAM;AAAA,QACd;AAAA,QACA,UAAU,CAAC,EAAE,QAAQ,MAAM,QAAQ,UAAU,CAAC;AAAA,QAC9C,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC;AACA,aAAO,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,UAAAA,UAAS;AAAA,IACxC;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,SAAS;AAAA,IACnD,oBAAoB,kBAAkBD,SAAQ,aAAa;AAAA,IAC3D,YAAYA,SAAQ;AAAA,IACpB,wBACEA,SAAQ,gBAAgB,OACpB,SACCA,SAAQ,eAAe;AAAA,IAC9B,oBAAoB;AAAA,MAClBA,SAAQ,kBAAkB,OACtB,SACCA,SAAQ,iBAAiB,CAAC,+BAA+B;AAAA,IAChE;AAAA,IACA,OAAO;AAAA,IACP,eAAeA,SAAQ;AAAA,EACzB,CAAC;AAED,SAAO;AAAA,IACL,OAAO,SAAS,WAAW,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC;AAAA,IACjE;AAAA,EACF;AACF;AAUA,SAAS,aAAa,SAAqC;AACzD,QAAME,SAAQ,oBAAI,IAA+B;AACjD,UAAQ,OAAO,OAAO,SAAS;AAC7B,UAAM,MAAM,OAAO,KAAK;AACxB,QAAI,SAASA,OAAM,IAAI,GAAG;AAC1B,QAAI,CAAC,QAAQ;AACX,eAAS,QAAQ,OAAO,IAAI;AAC5B,MAAAA,OAAM,IAAI,KAAK,MAAM;AAAA,IACvB;AACA,UAAM,WAAW,MAAM;AACvB,WAAO,SAAS,MAAM;AAAA,EACxB;AACF;AAkBA,eAAsB,2BACpBF,WAA6C,CAAC,GACA;AAC9C,OAAKA,SAAQ,yBAAyB,UAAU,OAAO;AACrD,WAAO;AAAA,EACT;AAEA,QAAM,UAAUA,SAAQ,SAAS,WAAW;AAC5C,QAAM,gBACJA,SAAQ,iBAAiB;AAM3B,QAAM,mBAAyC;AAAA,IAC7C;AAAA,MACE,QAAQ;AAAA,MACR,KAAKA,SAAQ,gBAAgB;AAAA,MAC7B,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAIA,SAAQ,eAAe;AACzB,QAAI,gBAAgBA,SAAQ,aAAa,GAAG;AAC1C,uBAAiB,KAAK;AAAA,QACpB,QAAQ;AAAA,QACR,KAAK,WAAWA,SAAQ,aAAa,GAAG,sBAAsB;AAAA,QAC9D,WAAW;AAAA,MACb,CAAC;AAAA,IACH,OAAO;AACL;AAAA,QACE,kBAAkBA,SAAQ,aAAa;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAEA,aAAW,aAAa,kBAAkB;AACxC,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACAA,SAAQ;AAAA,IACV;AACA,QAAI,SAAS;AACX,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,qBAAqB,MAAM;AAAA,IAC/BA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,aAAa,oBAAoB;AAC1C,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACAA,SAAQ;AAAA,IACV;AACA,QAAI,SAAS;AACX,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEA,IAAM,gCAAgC,qCAAqC;AAE3E,SAAS,SAAS,SAAuB;AACvC,UAAQ,MAAM,wBAAwB,OAAO,EAAE;AACjD;AAQA,eAAe,6BACb,WACA,SACA,eACA,iBAC8C;AAC9C,QAAM,UAAU,MAAM,aAAa,UAAU,KAAK,UAAU,WAAW,OAAO;AAC9E,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,MAAM,mBAAmB,UAAU,KAAK,UAAU,WAAW,OAAO;AACjF,MAAI,CAAC,MAAM,SAAS;AAClB,aAAS,iBAAiB,UAAU,GAAG,wCAAwC;AAC/E,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,MAAM,cAAc,IAAI,UAAU,GAAG;AAC3D,QAAM,WAAW,mBAAmB;AACpC,MAAI,aAAa,UAAa,aAAa,KAAK,SAAS;AACvD;AAAA,MACE,8BAA8B,UAAU,GAAG,cAAc,QAAQ,SAAS,KAAK,OAAO;AAAA,IACxF;AACA,WAAO;AAAA,EACT;AACA,MAAI,kBAAkB,UAAa,oBAAoB,QAAW;AAIhE,UAAM,cAAc,IAAI,UAAU,KAAK,KAAK,OAAO;AAAA,EACrD;AAEA,SAAO,EAAE,QAAQ,UAAU,QAAQ,KAAK,UAAU,KAAK,SAAS,KAAK,QAAQ;AAC/E;AASA,eAAe,iCACbA,UACA,SACA,oBAC+B;AAC/B,MAAI,CAACA,SAAQ,WAAWA,SAAQ,gBAAgB,MAAM;AACpD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,cAAcA,SAAQ,eAAe;AAC3C,MAAI;AACF,UAAM,SAAS,MAAM,oBAAoB,aAAaA,SAAQ,SAAS,OAAO;AAC9E,QAAI,CAAC,QAAQ;AACX,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,eAAeA,SAAQ,iBAAiB;AAC9C,QAAI,gBAAgB,CAAE,MAAM,qBAAqB,MAAM,GAAI;AACzD;AAAA,QACE,yCAAyCA,SAAQ,OAAO;AAAA,MAC1D;AACA,aAAO,CAAC;AAAA,IACV;AAEA,WAAO,qBAAqB,MAAM,EAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG,CAAC,EAC9D,IAAI,CAAC,SAAS;AAAA,MACb,QAAQ;AAAA,MACR;AAAA,MACA,WAAW;AAAA,IACb,EAAE;AAAA,EACN,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGA,SAAS,qBAAqB,QAAyC;AACrE,MAAI,CAAC,QAAQ;AACX,WAAO,CAAC;AAAA,EACV;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,QAAQ,OAAO,YAAY;AACpC,QAAI;AACJ,QAAI;AACF,YAAM,mBAAmB,IAAI;AAAA,IAC/B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,eAAe,GAAG,GAAG;AACvB,WAAK,KAAK,GAAG;AAAA,IACf;AAAA,EACF;AACA,SAAO;AACT;AAGA,IAAM,kBAAkB;AAExB,SAAS,gBAAgB,OAAwB;AAC/C,SAAO,gBAAgB,KAAK,KAAK;AACnC;AAEA,SAAS,eAAe,KAAsB;AAC5C,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WACE,OAAO,aAAa,YAAY,OAAO,SAAS,SAAS,sBAAsB;AAAA,EAEnF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,KACA,WACA,SACkB;AAClB,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,GAAG,IAAI,QAAQ,OAAO,EAAE,CAAC,YAAY;AAAA,MAClE,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AACD,WAAO,SAAS;AAAA,EAClB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBACb,KACA,WACA,SACsC;AACtC,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,GAAG,IAAI,QAAQ,OAAO,EAAE,CAAC,SAAS;AAAA,MAC/D,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,IACT;AACA,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,EAAE,SAAS,KAAK,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mBAAmB,OAAuB;AACxD,QAAM,MAAM,eAAe,UAAU,KAAK,CAAC;AAC3C,MAAI,CAAC,IAAI,WAAW,SAAS,KAAK,CAAC,IAAI,WAAW,UAAU,GAAG;AAC7D,UAAM,IAAI;AAAA,MACR,6CAA6C,KAAK;AAAA,IACpD;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAuB;AACxD,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI,8BAA8B,4BAA4B;AAAA,EACtE;AACA,SAAO,eAAe,IAAI,SAAS,CAAC,EAAE,SAAS;AACjD;AAEA,SAAS,kBAAkB,OAAmD;AAC5E,MAAI,UAAU,UAAa,MAAM,WAAW,GAAG;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM;AAAA,IAAI,CAAC,SAChB,KAAK,WAAW,GAAG,IAAI,OAAO,mBAAmB,IAAI;AAAA,EACvD;AACF;AAEA,eAAe,gBACb,SACA,YACoC;AACpC,SAAO,eAAe,YAAY,YAAY;AAC5C,QAAI,eAAe,UAAa,WAAW,WAAW,GAAG;AACvD,aAAO;AAAA,IACT;AACA,WAAO,YAAY,SAAS,YAAY,YAAY,KAAK;AAAA,EAC3D,CAAC;AACH;AAEA,eAAe,kBACb,SACA,UACA,eACoC;AACpC,SAAO,eAAe,cAAc,YAAY;AAC9C,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM,SAAS,OAAO;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,mBACb,SACAA,UACA,eACoC;AACpC,SAAO,eAAe,eAAe,YAAY;AAC/C,QAAI,CAACA,SAAQ,wBAAwB;AACnC,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM;AAAA,MACnBA,SAAQ;AAAA,MACR;AAAA,MACAA,SAAQ;AAAA,IACV;AACA,WAAO,YAAY,SAAS,eAAe,QAAQ,aAAa;AAAA,EAClE,CAAC;AACH;AAEA,eAAe,gBACb,SACA,YACoC;AACpC,SAAO,eAAe,YAAY,YAAY;AAC5C,QAAI,eAAe,UAAa,WAAW,WAAW,GAAG;AACvD,aAAO;AAAA,IACT;AACA,WAAO,YAAY,SAAS,YAAY,YAAY,KAAK;AAAA,EAC3D,CAAC;AACH;AAEA,eAAe,eACb,QACA,SACoC;AACpC,MAAI;AACF,UAAM,YAAY,MAAM,QAAQ;AAChC,WAAO,YAAY,EAAE,QAAQ,UAAU,IAAI,EAAE,OAAO;AAAA,EACtD,SAAS,OAAO;AACd,WAAO;AAAA,MACL;AAAA,MACA,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AACF;AAEA,eAAe,YACb,SACA,QACA,OACA,cACmC;AACnC,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,uBAAmB,KAAK;AACxB,WAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,KAAK,EAAE;AAAA,EAC1C;AAEA,QAAM,cAAc;AACpB,MAAI,YAAY,YAAY,KAAK,YAAY,cAAc,QAAW;AACpE,UAAM,SAAS,uBAAuB,KAAK;AAC3C,QAAI,OAAO,YAAY,SAAS;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,gBAAgB,CAAE,MAAM,qBAAqB,MAAM,GAAI;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,OAAO,UAAU,GAAG,OAAO;AAAA,EAC9D;AAEA,QAAM,iBAAiB;AACvB,MAAI,CAAC,MAAM,QAAQ,eAAe,UAAU,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,qBAAmB,eAAe,UAAU;AAC5C,MAAI,eAAe,WAAW,QAAW;AACvC,UAAM,SAAS,uBAAuB,eAAe,MAAM;AAC3D,QAAI,OAAO,YAAY,SAAS;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,gBAAgB,CAAE,MAAM,qBAAqB,MAAM,GAAI;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,eAAe,UAAU,GAAG,OAAO;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,YAAY,CAAC,GAAG,eAAe,UAAU,EAAE;AAC9D;AAEA,SAAS,gBAAgB,SAA6C;AACpE,MAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GAAG;AACvD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,WAAW,UAAU,KAAK,CAAC,QAAQ,WAAW,UAAU,GAAG;AACtE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,8BAA8B,6BAA6B;AAAA,EACvE;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,gBAAU,IAAI;AAAA,IAChB,QAAQ;AACN,YAAM,IAAI,8BAA8B,sBAAsB,IAAI,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,eAAe,mBACb,KACA,SACA,WACkB;AAClB,QAAM,UAAU,IAAI,MAAM,GAAG,EAAE,GAAG,EAAE;AACpC,MAAI,CAAC,WAAW,CAAC,sBAAsB,KAAK,OAAO,GAAG;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,mBAAmB,KAAK,SAAS,GAAG;AACvC,UAAM,IAAI,8BAA8B,+BAA+B;AAAA,EACzE;AAEA,aAAO,4BAAc;AAAA,IACnB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBACP,KACA,SACA,WACS;AACT,QAAM,YAAYG,4BAA2B,GAAG;AAChD,QAAM,iBAAiB,gBAAgB,SAAS;AAChD,MAAI,eAAe,WAAW,IAAI;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,wBAAQ;AAAA,IACb;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,IAChC;AAAA,EACF;AACF;AAEO,SAAS,6BACd,KACA,SACA,WACS;AACT,QAAM,YAAYA,4BAA2B,GAAG;AAChD,SAAO,wBAAQ,OAAO,WAAW,SAAS,SAAS;AACrD;AAEA,SAASA,4BAA2B,KAAyB;AAC3D,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,UAAU,OAAO,UAAU;AAC/C,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,KAAM;AAC5C,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAASJ,iBAAgB,OAA2B;AAClD,QAAMK,YACJ;AACF,MAAI,SAAS;AAEb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,UAAM,IAAI,MAAM,CAAC;AACjB,UAAM,IAAI,MAAM,IAAI,CAAC;AACrB,UAAM,IAAI,MAAM,IAAI,CAAC;AACrB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AAEpD,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,QAAI,IAAI,IAAI,MAAM,QAAQ;AACxB,gBAAUA,UAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,IAAI,IAAI,MAAM,QAAQ;AACxB,gBAAUA,UAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAMA,YACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AAEX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQA,UAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AAEA,SAAO,WAAW,KAAK,KAAK;AAC9B;","names":["options","base","name","import_viem","name","encode","length","i","j","decode","string","name","decoders","encode","decode","alphabet","string","encode","decode","decode","code","code","digest","decode","equals","base","baseCache","code","digest","equals","base","decode","length","cache","cid","import_zod","code","output","length","code","import_viem","code","objectHasOwn","options","code","objectHasOwn","encode","decode","textEncoder","identity_exports","identity","encode","options","identity","sha256","from","name","code","encode","options","digest","sha256","from","crypto","identity_exports","import_viem","textEncoder","objectHasOwn","requiredString","assertExactKeys","requiredValue","hasOwn","requiredArray","digest","encoded","alphabet","code","options","expectObject","assertExactKeys","hasOwn","requiredString","code","assertExactKeys","requiredValue","hasOwn","requiredString","code","objectHasOwn","hasOwn","code","parseStrictRfc3339","requestedCapabilitiesHash","options","fact","code","digest","base","parseStrictRfc3339","import_zod","EnsDataSchema","import_sdk_services","import_sdk_services","import_zod","import_zod","name","name","options","errorText","import_sdk_services","import_sdk_services","ms","name","base","options","import_bootstrap","SERVICE_NAME","options","revoked","name","import_sdk_services","code","options","import_zod","pathContains","import_ed25519","createError","code","base64UrlEncode","base64","base64UrlDecode","err","options","import_sdk_services","SERVICE_NAME","options","options","err","import_bootstrap","equals","N1","N2","N3","N4","N5","N6","N7","MSB","REST","encodingLength","REST","MSB","N4","N5","N6","N7","decode","import_node_buffer","length","import_node_buffer","name","encode","decode","string","fromString","string","base","import_node_buffer","toString","base","base","toString","fromString","word","code","code","decode","encodingLength","toString","length","fromString","bytes","string","_a","options","validate","code","equals","name","code","options","vm","toString","options","clonedRegexp","string","isIPv6","string","isIPv4","isIPv4","isIPv6","import_ed25519","import_viem","base64UrlEncode","options","location","cache","ed25519PublicKeyFromDidKey","alphabet"]}