@xyo-network/event-kit-protocol 0.1.8 → 1.0.0

package/dist/neutral/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/admissionTypes.ts", "../../src/admissionCore.ts", "../../src/types.ts", "../../src/admitAndEnqueue.ts", "../../src/canonicalJson.ts", "../../src/endpointChallenge.ts", "../../src/handshakeConstruction.ts", "../../src/wakeSubscriptionHpke.ts", "../../src/wakeSubscriptionEncoding.ts", "../../src/lifecycleSelection.ts", "../../src/memoryStatementGrantGraph.ts", "../../src/memoryWakeInbox.ts", "../../src/memoryWakeQueue.ts", "../../src/publisherSubscription.ts", "../../src/sourceWakeIdentity.ts", "../../src/sourceWakeActivation.ts", "../../src/statementGraphWakeGrantAuthorizer.ts", "../../src/grantEvidence.ts", "../../src/verifyWakeRequest.ts", "../../src/wakeQueue.ts"],
-  "sourcesContent": ["import type {\n  ChainId,\n  DeploymentId,\n  Hash,\n  NormalizedAddress,\n  WakeId,\n  WakeJwtAudience,\n  WakeJwtId,\n} from '@xyo-network/event-kit-schemas'\n\nimport type { AdmittedWake } from './types.ts'\n\n/** Replay records survive token expiry by this amount to cover receiver skew. */\nexport const EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS = 60\n\nexport interface WakeGrantAuthorizationRequest {\n  /** Must match the independently pinned grant viewer. */\n  readonly authorizationChainId: ChainId\n  readonly controller: NormalizedAddress\n  readonly deploymentId: DeploymentId\n  /** Required by D-006's activation adapter to select the accepted tuple's exact grant. */\n  readonly exactGrantHash?: Hash\n  readonly expectedHead: number\n  readonly filterHash: Hash\n  readonly publisher: NormalizedAddress\n  readonly queueId?: string\n  readonly sourceHash: Hash\n  readonly subscriptionHash: Hash\n}\n\n/** Concrete grant evidence required for every enabled decision. */\nexport interface WakeGrantEvidence {\n  readonly assertedAtBlock: number\n  /** Checked for every authorization decision. */\n  readonly authorizationChainId: ChainId\n  readonly controller: NormalizedAddress\n  readonly deploymentId: DeploymentId\n  readonly filterHash: Hash\n  readonly id: string\n  readonly objectHash?: Hash\n  readonly queueId?: string\n  readonly sourceHash: Hash\n  readonly subscriptionHash: Hash\n  readonly target: NormalizedAddress\n}\n\nexport interface WakeGrantAuthorizationDisabled {\n  readonly atBlock: number\n  readonly enabled: false\n  /** Optional diagnostics. The core rejects disagreement with its trusted input. */\n  readonly expectedHead?: number\n  /** Optional diagnostics. The core recomputes lag instead of trusting this value. */\n  readonly lag?: number\n}\n\nexport interface WakeGrantAuthorizationEnabled {\n  readonly atBlock: number\n  readonly enabled: true\n  /** Optional diagnostics. The core rejects disagreement with its trusted input. */\n  readonly expectedHead?: number\n  readonly grant: WakeGrantEvidence\n  /** Optional diagnostics. The core recomputes lag instead of trusting this value. */\n  readonly lag?: number\n}\n\nexport type WakeGrantAuthorizationDecision\n  = | WakeGrantAuthorizationDisabled\n    | WakeGrantAuthorizationEnabled\n\n/**\n * Stateful Statement Graph authorization port. Implementations must evaluate\n * the exact controller, scope, publisher, and expected finalized head supplied\n * for this request.\n */\nexport interface WakeGrantAuthorizer {\n  authorizePublisher: (\n    request: WakeGrantAuthorizationRequest,\n  ) => Promise<WakeGrantAuthorizationDecision>\n}\n\n/** Normalized grant snapshot accepted by the protocol core. */\nexport interface AuthorizedWakeGrant {\n  readonly atBlock: number\n  readonly expectedHead: number\n  readonly grant: WakeGrantEvidence\n  readonly lag: number\n}\n\nexport interface WakeAdmissionAttempt {\n  readonly audience: WakeJwtAudience\n  readonly eventHash: Hash\n  readonly jwtId: WakeJwtId\n  readonly publisher: NormalizedAddress\n  /** Token replay record retention deadline (`exp + 60`). */\n  readonly retainJwtUntil: number\n  readonly wakeId: WakeId\n}\n\n/** Stable receipt bound to both durable admission indexes. */\nexport interface WakeAdmissionReceipt {\n  readonly audience: WakeJwtAudience\n  readonly eventHash: Hash\n  readonly id: string\n  readonly publisher: NormalizedAddress\n  readonly wakeId: WakeId\n}\n\nexport type WakeAttemptResolution\n  = | { readonly kind: 'new' }\n    | { readonly kind: 'duplicate'; readonly receipt: WakeAdmissionReceipt }\n    | { readonly kind: 'jwt-id-collision' }\n    | { readonly kind: 'wake-id-collision' }\n\nexport type WakeCommitResult\n  = | { readonly kind: 'enqueued'; readonly receipt: WakeAdmissionReceipt }\n    | { readonly kind: 'duplicate'; readonly receipt: WakeAdmissionReceipt }\n    | { readonly kind: 'jwt-id-collision' }\n    | { readonly kind: 'wake-id-collision' }\n\n/**\n * Durable linearizable admission boundary.\n *\n * `resolveAttempt` must atomically bind a fresh JWT id to an existing matching\n * wake receipt. It must not consume either identity when returning `new`.\n *\n * `commitAuthorized` must atomically recheck both identities, persist both\n * mappings and their stable receipt, and durably enqueue the wake (or write a\n * transactional outbox record). A separate fallible enqueue is nonconforming.\n */\nexport interface AtomicWakeInbox<TWake = AdmittedWake> {\n  commitAuthorized: (input: {\n    readonly attempt: WakeAdmissionAttempt\n    readonly grant: AuthorizedWakeGrant\n    readonly wake: TWake\n  }) => Promise<WakeCommitResult>\n  resolveAttempt: (attempt: WakeAdmissionAttempt) => Promise<WakeAttemptResolution>\n}\n", "import type {\n  AtomicWakeInbox,\n  AuthorizedWakeGrant,\n  WakeAdmissionAttempt,\n  WakeAdmissionReceipt,\n  WakeCommitResult,\n  WakeGrantAuthorizationDecision,\n  WakeGrantAuthorizer,\n  WakeGrantEvidence,\n} from './admissionTypes.ts'\nimport { EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS } from './admissionTypes.ts'\nimport type { AdmittedWake } from './types.ts'\nimport type { VerifiedAdmissionWake } from './verifiedAdmissionWake.ts'\n\nexport interface AdmissionCoreInput<TWake = AdmittedWake> {\n  /** Independently trusted finalized XL1 head for this admission attempt. */\n  readonly expectedHead: number\n  readonly grants: WakeGrantAuthorizer\n  readonly inbox: AtomicWakeInbox<TWake>\n  readonly verified: VerifiedAdmissionWake\n  readonly wake: TWake\n}\n\nexport type AdmitAndEnqueueFailureReason\n  = | 'grant-missing'\n    | 'grant-unavailable'\n    | 'grant-view-invalid'\n    | 'grant-view-stale'\n    | 'inbox-unavailable'\n    | 'jwt-id-collision'\n    | 'wake-id-collision'\n\nexport interface AdmitAndEnqueueFailure {\n  readonly details?: readonly string[]\n  readonly ok: false\n  readonly reason: AdmitAndEnqueueFailureReason\n}\n\nexport interface AdmitAndEnqueueSuccess<TWake = AdmittedWake> {\n  readonly disposition: 'duplicate' | 'enqueued'\n  readonly ok: true\n  readonly receipt: WakeAdmissionReceipt\n  readonly wake: TWake\n}\n\nexport type AdmitAndEnqueueResult<TWake = AdmittedWake> = AdmitAndEnqueueFailure | AdmitAndEnqueueSuccess<TWake>\n\n/**\n * Performs D-002 durable replay/idempotency resolution, live grant\n * authorization, and atomic enqueue after pure request verification.\n */\nexport async function admitVerifiedWake<TWake>(input: AdmissionCoreInput<TWake>): Promise<AdmitAndEnqueueResult<TWake>> {\n  const attemptResult = createAttempt(input.verified)\n  if (!attemptResult.ok) return attemptResult.failure\n  const { attempt } = attemptResult\n  const { wake } = input\n\n  const prior = await resolvePriorAttempt(input.inbox, attempt, wake)\n  if (!prior.pending) return prior.result\n\n  if (!isNonnegativeSafeInteger(input.expectedHead)) {\n    return reject('grant-view-invalid', ['expectedHead must be a nonnegative safe integer'])\n  }\n\n  const authorization = await authorize(input)\n  if (!authorization.ok) return authorization.failure\n  return await commitAuthorizedWake(input.inbox, attempt, authorization.grant, wake)\n}\n\ntype PriorAttemptResult<TWake> = {\n  readonly pending: true\n} | {\n  readonly pending: false\n  readonly result: AdmitAndEnqueueResult<TWake>\n}\n\nasync function resolvePriorAttempt<TWake>(\n  inbox: AtomicWakeInbox<TWake>,\n  attempt: WakeAdmissionAttempt,\n  wake: TWake,\n): Promise<PriorAttemptResult<TWake>> {\n  let resolution\n  try {\n    resolution = await inbox.resolveAttempt(attempt)\n  } catch (error) {\n    return completed(reject('inbox-unavailable', [errorMessage(error)]))\n  }\n\n  if (!isRecord(resolution) || typeof resolution.kind !== 'string') {\n    return completed(reject('inbox-unavailable', ['inbox returned an invalid attempt resolution']))\n  }\n  if (resolution.kind === 'jwt-id-collision' || resolution.kind === 'wake-id-collision') {\n    return completed(reject(resolution.kind))\n  }\n  if (resolution.kind === 'duplicate') {\n    const receiptFailure = validateReceipt(resolution.receipt, attempt)\n    return completed(receiptFailure\n      ?? success('duplicate', snapshotReceipt(resolution.receipt), wake))\n  }\n  if (resolution.kind !== 'new') {\n    return completed(reject('inbox-unavailable', ['inbox returned an unknown attempt resolution']))\n  }\n  return Object.freeze({ pending: true })\n}\n\nasync function commitAuthorizedWake<TWake>(\n  inbox: AtomicWakeInbox<TWake>,\n  attempt: WakeAdmissionAttempt,\n  grant: AuthorizedWakeGrant,\n  wake: TWake,\n): Promise<AdmitAndEnqueueResult<TWake>> {\n  let committed: WakeCommitResult\n  try {\n    committed = await inbox.commitAuthorized({\n      attempt,\n      grant,\n      wake,\n    })\n  } catch (error) {\n    return reject('inbox-unavailable', [errorMessage(error)])\n  }\n\n  if (!isRecord(committed) || typeof committed.kind !== 'string') {\n    return reject('inbox-unavailable', ['inbox returned an invalid commit result'])\n  }\n  if (committed.kind === 'jwt-id-collision' || committed.kind === 'wake-id-collision') {\n    return reject(committed.kind)\n  }\n  if (committed.kind !== 'duplicate' && committed.kind !== 'enqueued') {\n    return reject('inbox-unavailable', ['inbox returned an unknown commit result'])\n  }\n\n  const receiptFailure = validateReceipt(committed.receipt, attempt)\n  if (receiptFailure !== undefined) return receiptFailure\n  return success(committed.kind, snapshotReceipt(committed.receipt), wake)\n}\n\nfunction completed<TWake>(result: AdmitAndEnqueueResult<TWake>): PriorAttemptResult<TWake> {\n  return Object.freeze({ pending: false, result })\n}\n\ntype AttemptResult = {\n  readonly attempt: WakeAdmissionAttempt\n  readonly ok: true\n} | {\n  readonly failure: AdmitAndEnqueueFailure\n  readonly ok: false\n}\n\nfunction createAttempt(verified: VerifiedAdmissionWake): AttemptResult {\n  if (verified.expiresAt > Number.MAX_SAFE_INTEGER - EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS) {\n    return {\n      failure: reject('inbox-unavailable', ['JWT expiry cannot be represented through the replay-retention window']),\n      ok: false,\n    }\n  }\n\n  return {\n    attempt: Object.freeze({\n      audience: verified.audience,\n      eventHash: verified.eventHash,\n      jwtId: verified.jwtId,\n      publisher: verified.publisher,\n      retainJwtUntil: verified.expiresAt + EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,\n      wakeId: verified.wakeId,\n    }),\n    ok: true,\n  }\n}\n\ntype AuthorizationResult = {\n  readonly grant: AuthorizedWakeGrant\n  readonly ok: true\n} | {\n  readonly failure: AdmitAndEnqueueFailure\n  readonly ok: false\n}\n\nasync function authorize<TWake>(\n  input: AdmissionCoreInput<TWake>,\n): Promise<AuthorizationResult> {\n  const { route } = input.verified\n  let decision: WakeGrantAuthorizationDecision\n  try {\n    decision = await input.grants.authorizePublisher({\n      controller: route.controller,\n      authorizationChainId: route.authorizationChainId,\n      sourceHash: route.sourceHash,\n      filterHash: route.filterHash,\n      subscriptionHash: route.subscriptionHash,\n      deploymentId: route.deploymentId,\n      expectedHead: input.expectedHead,\n      publisher: input.verified.publisher,\n      ...(route.queueId === undefined ? {} : { queueId: route.queueId }),\n    })\n  } catch (error) {\n    return { failure: reject('grant-unavailable', [errorMessage(error)]), ok: false }\n  }\n\n  const viewFailure = validateGrantView(decision, input.expectedHead, route.maxGrantLagBlocks)\n  if (viewFailure !== undefined) return { failure: viewFailure, ok: false }\n  if (!decision.enabled) return { failure: reject('grant-missing'), ok: false }\n\n  const evidenceFailure = validateGrantEvidence(decision.grant, input.verified, decision.atBlock)\n  if (evidenceFailure !== undefined) return { failure: evidenceFailure, ok: false }\n\n  const grant: AuthorizedWakeGrant = Object.freeze({\n    atBlock: decision.atBlock,\n    expectedHead: input.expectedHead,\n    grant: snapshotGrantEvidence(decision.grant),\n    lag: input.expectedHead - decision.atBlock,\n  })\n  return { grant, ok: true }\n}\n\nfunction validateGrantView(\n  decision: WakeGrantAuthorizationDecision,\n  expectedHead: number,\n  maxGrantLagBlocks: number,\n): AdmitAndEnqueueFailure | undefined {\n  if (!isRecord(decision)\n    || !Object.hasOwn(decision, 'enabled')\n    || typeof decision.enabled !== 'boolean'\n    || !Object.hasOwn(decision, 'atBlock')) {\n    return reject('grant-view-invalid', ['grant authorizer returned an invalid decision'])\n  }\n  if (!isNonnegativeSafeInteger(decision.atBlock)) {\n    return reject('grant-view-invalid', ['grant atBlock must be a nonnegative safe integer'])\n  }\n  if (decision.atBlock > expectedHead) {\n    return reject('grant-view-invalid', ['grant view is ahead of the trusted finalized head'])\n  }\n\n  const lag = expectedHead - decision.atBlock\n  if (decision.expectedHead !== undefined && decision.expectedHead !== expectedHead) {\n    return reject('grant-view-invalid', ['grant diagnostic expectedHead disagrees with the trusted head'])\n  }\n  if (decision.lag !== undefined && decision.lag !== lag) {\n    return reject('grant-view-invalid', ['grant diagnostic lag disagrees with the recomputed lag'])\n  }\n  if (lag > maxGrantLagBlocks) {\n    return reject('grant-view-stale', [`grantLag=${lag} max=${maxGrantLagBlocks}`])\n  }\n  return undefined\n}\n\nfunction validateGrantEvidence(\n  evidence: WakeGrantEvidence,\n  verified: VerifiedAdmissionWake,\n  atBlock: number,\n): AdmitAndEnqueueFailure | undefined {\n  if (!isRecord(evidence)) return reject('grant-view-invalid', ['enabled grant decision omitted evidence'])\n  const requiredFields = [\n    'assertedAtBlock',\n    'authorizationChainId',\n    'filterHash',\n    'sourceHash',\n    'subscriptionHash',\n    'controller',\n    'deploymentId',\n    'id',\n    'target',\n  ] as const\n  if (requiredFields.some(field => !Object.hasOwn(evidence, field))) {\n    return reject('grant-view-invalid', ['enabled grant evidence requires own canonical fields'])\n  }\n  if (typeof evidence.id !== 'string' || evidence.id.length === 0) {\n    return reject('grant-view-invalid', ['enabled grant evidence requires a non-empty id'])\n  }\n  if (!isNonnegativeSafeInteger(evidence.assertedAtBlock) || evidence.assertedAtBlock > atBlock) {\n    return reject('grant-view-invalid', ['grant assertion block must be at or before the evaluated snapshot'])\n  }\n  if (evidence.controller !== verified.route.controller) {\n    return reject('grant-view-invalid', ['grant controller does not match the configured controller'])\n  }\n  if (evidence.authorizationChainId !== verified.route.authorizationChainId\n    || evidence.sourceHash !== verified.route.sourceHash\n    || evidence.filterHash !== verified.route.filterHash\n    || evidence.subscriptionHash !== verified.route.subscriptionHash) {\n    return reject('grant-view-invalid', ['grant authorization chain or source does not match the configured route'])\n  }\n  if (evidence.target !== verified.publisher) {\n    return reject('grant-view-invalid', ['grant target does not match the verified publisher'])\n  }\n  const evidenceHasQueue = Object.hasOwn(evidence, 'queueId')\n  const routeHasQueue = Object.hasOwn(verified.route, 'queueId')\n  if (evidence.deploymentId !== verified.route.deploymentId\n    || evidenceHasQueue !== routeHasQueue\n    || evidence.queueId !== verified.route.queueId) {\n    return reject('grant-view-invalid', ['grant scope does not exactly match the configured route'])\n  }\n  return undefined\n}\n\nfunction validateReceipt(\n  receipt: WakeAdmissionReceipt,\n  attempt: WakeAdmissionAttempt,\n): AdmitAndEnqueueFailure | undefined {\n  const requiredFields = [\n    'audience',\n    'eventHash',\n    'id',\n    'publisher',\n    'wakeId',\n  ] as const\n  if (!isRecord(receipt)\n    || requiredFields.some(field => !Object.hasOwn(receipt, field))\n    || typeof receipt.id !== 'string'\n    || receipt.id.length === 0) {\n    return reject('inbox-unavailable', ['inbox returned an invalid receipt'])\n  }\n  if (receipt.audience !== attempt.audience\n    || receipt.publisher !== attempt.publisher\n    || receipt.eventHash !== attempt.eventHash\n    || receipt.wakeId !== attempt.wakeId) {\n    return reject('inbox-unavailable', ['inbox receipt is not bound to the verified attempt'])\n  }\n  return undefined\n}\n\nfunction snapshotGrantEvidence(evidence: WakeGrantEvidence): WakeGrantEvidence {\n  return Object.freeze({\n    assertedAtBlock: evidence.assertedAtBlock,\n    authorizationChainId: evidence.authorizationChainId,\n    sourceHash: evidence.sourceHash,\n    filterHash: evidence.filterHash,\n    subscriptionHash: evidence.subscriptionHash,\n    ...(evidence.objectHash === undefined ? {} : { objectHash: evidence.objectHash }),\n    controller: evidence.controller,\n    deploymentId: evidence.deploymentId,\n    id: evidence.id,\n    ...(evidence.queueId === undefined ? {} : { queueId: evidence.queueId }),\n    target: evidence.target,\n  })\n}\n\nfunction snapshotReceipt(receipt: WakeAdmissionReceipt): WakeAdmissionReceipt {\n  return Object.freeze({\n    audience: receipt.audience,\n    eventHash: receipt.eventHash,\n    id: receipt.id,\n    publisher: receipt.publisher,\n    wakeId: receipt.wakeId,\n  })\n}\n\nfunction success<TWake>(\n  disposition: AdmitAndEnqueueSuccess['disposition'],\n  receipt: WakeAdmissionReceipt,\n  wake: TWake,\n): AdmitAndEnqueueSuccess<TWake> {\n  return Object.freeze({\n    disposition, ok: true, receipt, wake,\n  })\n}\n\nfunction reject(\n  reason: AdmitAndEnqueueFailureReason,\n  details?: readonly string[],\n): AdmitAndEnqueueFailure {\n  if (details === undefined) return Object.freeze({ ok: false, reason })\n  return Object.freeze({\n    details: Object.freeze([...details]), ok: false, reason,\n  })\n}\n\nfunction isNonnegativeSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n", "import {\n  DeploymentIdZod,\n  HashZod,\n  NonnegativeJsonSafeIntegerZod,\n  NormalizedAddressZod,\n  WakeEnvelopeZod,\n  WakeIdZod,\n  WakeJwtAudienceZod,\n  WakeJwtIdZod,\n} from '@xyo-network/event-kit-schemas'\nimport { PayloadBuilder } from '@xyo-network/sdk'\nimport { z } from 'zod'\n\nexport const AdmittedWakeZod = z.strictObject({\n  audience: WakeJwtAudienceZod,\n  deploymentId: DeploymentIdZod,\n  event: WakeEnvelopeZod,\n  eventHash: HashZod,\n  fromPosition: NonnegativeJsonSafeIntegerZod,\n  toPosition: NonnegativeJsonSafeIntegerZod,\n  jti: WakeJwtIdZod,\n  publisher: NormalizedAddressZod,\n  queueId: z.string().min(1).max(255).optional(),\n  wakeId: WakeIdZod,\n}).refine(\n  wake => wake.deploymentId === wake.event.deploymentId\n    && wake.queueId === wake.event.queueId\n    && wake.wakeId === wake.event.wakeId\n    && wake.fromPosition === wake.event.fromPosition\n    && wake.toPosition === wake.event.toPosition,\n  'Persisted admission metadata must exactly match its signed envelope',\n)\nexport type AdmittedWake = z.infer<typeof AdmittedWakeZod>\n\n/** Persisted-shape and content integrity check. Does not replace live HTTP admission. */\nexport async function parseAdmittedWake(value: unknown): Promise<AdmittedWake> {\n  const wake = AdmittedWakeZod.parse(value)\n  if (await PayloadBuilder.dataHash(wake.event) !== wake.eventHash) {\n    throw new TypeError('Persisted wake content does not match its admitted event hash')\n  }\n  return wake\n}\n", "import type { AdmitAndEnqueueResult } from './admissionCore.ts'\nimport { admitVerifiedWake } from './admissionCore.ts'\nimport type {\n  AtomicWakeInbox,\n  WakeGrantAuthorizer,\n} from './admissionTypes.ts'\nimport type { AdmittedWake } from './types.ts'\nimport { AdmittedWakeZod } from './types.ts'\nimport type { VerifiedWakeRequest } from './verifyWakeRequest.ts'\n\nexport type {\n  AdmitAndEnqueueFailure, AdmitAndEnqueueFailureReason, AdmitAndEnqueueResult, AdmitAndEnqueueSuccess,\n} from './admissionCore.ts'\n\nexport interface AdmitAndEnqueueInput {\n  readonly expectedHead: number\n  readonly grants: WakeGrantAuthorizer\n  readonly inbox: AtomicWakeInbox<AdmittedWake>\n  readonly verified: VerifiedWakeRequest\n}\n\n/** Atomic replay/grant/enqueue boundary; the expected head is always XL1 authorization finality. */\nexport async function admitAndEnqueue(\n  input: AdmitAndEnqueueInput,\n): Promise<AdmitAndEnqueueResult<AdmittedWake>> {\n  const { verified } = input\n  const wake = AdmittedWakeZod.parse({\n    audience: verified.audience,\n    deploymentId: verified.deploymentId,\n    event: verified.event,\n    eventHash: verified.eventHash,\n    fromPosition: verified.fromPosition,\n    toPosition: verified.toPosition,\n    jti: verified.jwtId,\n    publisher: verified.publisher,\n    ...(verified.queueId === undefined ? {} : { queueId: verified.queueId }),\n    wakeId: verified.wakeId,\n  })\n  return await admitVerifiedWake({ ...input, wake })\n}\n", "const textEncoder = new TextEncoder()\n\nfunction hasUnpairedSurrogate(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const codePoint = value.codePointAt(index)\n    if (codePoint === undefined || (codePoint >= 0xd8_00 && codePoint <= 0xdf_ff)) return true\n    if (codePoint > 0xff_ff) index += 1\n  }\n  return false\n}\n\nfunction canonicalize(value: unknown): string {\n  if (value === null) return 'null'\n\n  switch (typeof value) {\n    case 'boolean':\n      return value ? 'true' : 'false'\n    case 'number': {\n      if (!Number.isFinite(value)) throw new TypeError('Canonical JSON numbers must be finite')\n      return JSON.stringify(value)\n    }\n    case 'string': {\n      if (hasUnpairedSurrogate(value)) throw new TypeError('Canonical JSON strings must be valid Unicode')\n      return JSON.stringify(value)\n    }\n    case 'object': {\n      if (Array.isArray(value)) return `[${value.map(item => canonicalize(item)).join(',')}]`\n      const prototype = Reflect.getPrototypeOf(value)\n      if (prototype !== Object.prototype && prototype !== null) {\n        throw new TypeError('Canonical JSON objects must be plain records')\n      }\n      const record = value as Record<string, unknown>\n      const members = Object.keys(record).sort().map((key) => {\n        if (hasUnpairedSurrogate(key)) throw new TypeError('Canonical JSON keys must be valid Unicode')\n        const member = record[key]\n        if (member === undefined) throw new TypeError('Canonical JSON does not permit undefined members')\n        return `${JSON.stringify(key)}:${canonicalize(member)}`\n      })\n      return `{${members.join(',')}}`\n    }\n    default:\n      throw new TypeError(`Canonical JSON cannot encode ${typeof value}`)\n  }\n}\n\n/** RFC 8785 JSON Canonicalization Scheme for I-JSON-compatible values. */\nexport function canonicalJson(value: unknown): string {\n  return canonicalize(value)\n}\n\n/** UTF-8 bytes of {@link canonicalJson}. */\nexport function canonicalJsonBytes(value: unknown): Uint8Array {\n  return textEncoder.encode(canonicalize(value))\n}\n", "import type {\n  Base64Url32Bytes,\n  ChainId,\n  EndpointChallenge,\n  EndpointChallengeResponse,\n  HandshakeId,\n  Hash,\n  NormalizedAddress,\n  SourceWakeEventKind,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  Base64Url32BytesZod,\n  bytesToCanonicalBase64Url,\n  canonicalBase64UrlToBytes,\n  EndpointChallengeResponseSchema,\n  EndpointChallengeResponseZod,\n  EndpointChallengeSchema,\n  EndpointChallengeZod,\n  generateChallengeNonce,\n  generateHandshakeId,\n  MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS,\n} from '@xyo-network/event-kit-schemas'\nimport { PayloadBuilder } from '@xyo-network/sdk'\n\nexport interface CreateEndpointChallengeInput {\n  chainId: ChainId\n  encryptionKey: Hash\n  eventKind: SourceWakeEventKind\n  grant: Hash\n  issuedAt: number\n  keyId: HandshakeId\n  lifetimeSeconds?: number\n  publisher: NormalizedAddress\n  service: Hash\n  subscriber: NormalizedAddress\n  subscription: Hash\n}\n\nexport interface VerifyEndpointChallengeResponseInput {\n  challenge: EndpointChallenge\n  nowSeconds: number\n  response: EndpointChallengeResponse\n  secret: Base64Url32Bytes\n}\n\ntype VerifyEndpointChallengeProofInput = Omit<VerifyEndpointChallengeResponseInput, 'nowSeconds'>\n\nfunction hashBytes(hash: Hash): Uint8Array<ArrayBuffer> {\n  return Uint8Array.from({ length: 32 }, (_, index) => Number.parseInt(hash.slice(index * 2, index * 2 + 2), 16))\n}\n\nasync function hmacProof(secret: Base64Url32Bytes, challengeHash: Hash): Promise<Base64Url32Bytes> {\n  const secretBytes = canonicalBase64UrlToBytes(Base64Url32BytesZod.parse(secret))\n  if (secretBytes?.length !== 32) throw new TypeError('Expected 32-byte challenge secret')\n  const cryptoKey = await globalThis.crypto.subtle.importKey(\n    'raw',\n    Uint8Array.from(secretBytes),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  const signature = await globalThis.crypto.subtle.sign('HMAC', cryptoKey, hashBytes(challengeHash))\n  return Base64Url32BytesZod.parse(bytesToCanonicalBase64Url(new Uint8Array(signature)))\n}\n\nfunction equalProof(left: Base64Url32Bytes, right: Base64Url32Bytes): boolean {\n  const leftBytes = canonicalBase64UrlToBytes(left)\n  const rightBytes = canonicalBase64UrlToBytes(right)\n  if (leftBytes?.length !== 32 || rightBytes?.length !== 32) return false\n  let difference = 0\n  for (let index = 0; index < 32; index += 1) difference |= leftBytes[index] ^ rightBytes[index]\n  return difference === 0\n}\n\nexport async function endpointChallengeHash(challenge: EndpointChallenge): Promise<Hash> {\n  const parsed = EndpointChallengeZod.parse(challenge)\n  return await PayloadBuilder.dataHash(parsed)\n}\n\n/** Construct a fresh, strict challenge request without exposing the expected proof. */\nexport function createEndpointChallenge(input: CreateEndpointChallengeInput): EndpointChallenge {\n  const lifetimeSeconds = input.lifetimeSeconds ?? MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS\n  if (!Number.isSafeInteger(lifetimeSeconds) || lifetimeSeconds < 1) {\n    throw new RangeError('Challenge lifetime must be a positive safe integer')\n  }\n  if (!Number.isSafeInteger(input.issuedAt) || input.issuedAt < 0) {\n    throw new RangeError('Challenge issuedAt must be a nonnegative safe integer')\n  }\n  if (input.issuedAt > Number.MAX_SAFE_INTEGER - lifetimeSeconds) {\n    throw new RangeError('Challenge expiry exceeds the JSON safe-integer range')\n  }\n\n  return EndpointChallengeZod.parse(new PayloadBuilder({ schema: EndpointChallengeSchema })\n    .fields({\n      challengeId: generateHandshakeId(),\n      chainId: input.chainId,\n      publisher: input.publisher,\n      subscriber: input.subscriber,\n      service: input.service,\n      encryptionKey: input.encryptionKey,\n      keyId: input.keyId,\n      subscription: input.subscription,\n      grant: input.grant,\n      eventKind: input.eventKind,\n      nonce: generateChallengeNonce(),\n      issuedAt: input.issuedAt,\n      expiresAt: input.issuedAt + lifetimeSeconds,\n    })\n    .build())\n}\n\n/** Build the endpoint's HMAC-SHA256 proof over the raw 32-byte challenge data hash. */\nexport async function createEndpointChallengeResponse(\n  challenge: EndpointChallenge,\n  secret: Base64Url32Bytes,\n): Promise<EndpointChallengeResponse> {\n  const challengeHash = await endpointChallengeHash(challenge)\n  return EndpointChallengeResponseZod.parse(new PayloadBuilder({ schema: EndpointChallengeResponseSchema })\n    .fields({\n      challenge: challengeHash,\n      proof: await hmacProof(secret, challengeHash),\n    })\n    .build())\n}\n\n/**\n * Cryptographic proof/binding check without authorizing a new time-bounded\n * decision. This remains package-internal and exists only so an exact durable\n * verified decision can be resumed after its Unix window closes.\n */\nexport async function verifyEndpointChallengeProof(\n  input: VerifyEndpointChallengeProofInput,\n): Promise<boolean> {\n  try {\n    const challenge = EndpointChallengeZod.parse(input.challenge)\n    const response = EndpointChallengeResponseZod.parse(input.response)\n    const challengeHash = await endpointChallengeHash(challenge)\n    if (response.challenge !== challengeHash) return false\n    return equalProof(response.proof, await hmacProof(input.secret, challengeHash))\n  } catch {\n    return false\n  }\n}\n\n/** Pure proof/time check. Durable one-time consumption belongs to the runtime admission path. */\nexport async function verifyEndpointChallengeResponse(\n  input: VerifyEndpointChallengeResponseInput,\n): Promise<boolean> {\n  try {\n    const challenge = EndpointChallengeZod.parse(input.challenge)\n    if (!Number.isSafeInteger(input.nowSeconds)\n      || input.nowSeconds < challenge.issuedAt\n      || input.nowSeconds >= challenge.expiresAt) return false\n    return await verifyEndpointChallengeProof(input)\n  } catch {\n    return false\n  }\n}\n", "import type {\n  Base64Url32Bytes,\n  ChainId,\n  EncryptedWakeSubscription,\n  EndpointChallenge,\n  EndpointChallengeResponse,\n  HandshakeId,\n  Hash,\n  NormalizedAddress,\n  PublisherEncryptionKey,\n  PublisherEncryptionKeyRevocation,\n  PublisherService,\n  PublisherServiceRevocation,\n  WakeGrantObject,\n  WakeGrantRevocation,\n  WakeSource,\n  WakeSubscriptionAcceptance,\n  WakeSubscriptionAcceptanceRevocation,\n  WakeSubscriptionPlaintext,\n  WakeSubscriptionRevocation,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  bytesToCanonicalBase64Url,\n  EncryptedWakeSubscriptionSchema,\n  EncryptedWakeSubscriptionZod,\n  ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,\n  EndpointChallengeResponseZod,\n  EndpointChallengeZod,\n  generateGrantId,\n  generateHandshakeId,\n  HashZod,\n  MAX_SUBSCRIPTION_PLAINTEXT_BYTES,\n  PublisherEncryptionKeyRevocationSchema,\n  PublisherEncryptionKeyRevocationZod,\n  PublisherEncryptionKeySchema,\n  PublisherEncryptionKeyZod,\n  PublisherServiceRevocationSchema,\n  PublisherServiceRevocationZod,\n  PublisherServiceSchema,\n  PublisherServiceZod,\n  SOURCE_WAKE_EVENT_KIND,\n  SOURCE_WAKE_FILTER_PROFILE,\n  WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  WAKE_WALLET_JWT_DELIVERY_PROFILE,\n  WakeGrantObjectSchema,\n  WakeGrantObjectZod,\n  WakeGrantRevocationSchema,\n  WakeGrantRevocationZod,\n  WakeSubscriptionAcceptanceRevocationSchema,\n  WakeSubscriptionAcceptanceRevocationZod,\n  WakeSubscriptionAcceptanceSchema,\n  WakeSubscriptionAcceptanceZod,\n  WakeSubscriptionCleartextZod,\n  WakeSubscriptionPlaintextSchema,\n  WakeSubscriptionPlaintextZod,\n  WakeSubscriptionRevocationSchema,\n  WakeSubscriptionRevocationZod,\n} from '@xyo-network/event-kit-schemas'\nimport { PayloadBuilder } from '@xyo-network/sdk'\n\nimport type {\n  WakeSubscriptionPrivateKey,\n  WakeSubscriptionPublicKey,\n} from './wakeSubscriptionHpke.ts'\nimport {\n  encryptWakeSubscription,\n  generateWakeSubscriptionEncryptionKeyPair,\n} from './wakeSubscriptionHpke.ts'\n\nexport type EventKitHandshakePublicObject\n  = | EncryptedWakeSubscription\n    | EndpointChallenge\n    | EndpointChallengeResponse\n    | PublisherEncryptionKey\n    | PublisherEncryptionKeyRevocation\n    | PublisherService\n    | PublisherServiceRevocation\n    | WakeGrantObject\n    | WakeGrantRevocation\n    | WakeSubscriptionAcceptance\n    | WakeSubscriptionAcceptanceRevocation\n    | WakeSubscriptionRevocation\n\nexport interface HashedHandshakeObject<T extends EventKitHandshakePublicObject> {\n  readonly body: T\n  readonly objectHash: Hash\n}\n\nexport interface CreatePublisherEncryptionKeyInput {\n  readonly expiresAtBlock?: number\n  readonly keyId?: HandshakeId\n  readonly publicKey: Base64Url32Bytes\n  readonly validFromBlock: number\n}\n\nexport interface GeneratePublisherEncryptionKeyInput {\n  readonly expiresAtBlock?: number\n  readonly validFromBlock: number\n}\n\nexport interface GeneratedPublisherEncryptionKey {\n  readonly descriptor: PublisherEncryptionKey\n  readonly descriptorHash: Hash\n  readonly privateKey: WakeSubscriptionPrivateKey\n  readonly publicKey: WakeSubscriptionPublicKey\n}\n\nexport interface CreatePublisherServiceInput {\n  readonly authorizationChainId: ChainId\n  readonly encryptionKeys: readonly Hash[]\n  readonly expiresAtBlock?: number\n  readonly maxPositionsPerWake: number\n  readonly maxSubscriptionLifetimeBlocks: number\n  readonly preferredEncryptionKey: Hash\n  readonly revision?: number\n  readonly serviceId?: HandshakeId\n  readonly sources: readonly WakeSource[]\n  readonly supersedes?: Hash\n  readonly validFromBlock: number\n}\n\nexport interface CreateWakeGrantInput {\n  readonly deploymentId: string\n  readonly grantId?: string\n  readonly publisher: NormalizedAddress\n  readonly queueId?: string\n}\n\nexport interface CreateWakeSubscriptionPlaintextInput {\n  readonly audience: string\n  readonly challengeSecret?: Base64Url32Bytes\n  readonly deploymentId: string\n  readonly endpoint: string\n  readonly fromPosition: number\n  readonly maxPositionsPerWake: number\n  readonly queueId?: string | null\n  readonly source: WakeSource\n}\n\nexport interface CreateEncryptedWakeSubscriptionInput {\n  readonly chainId: ChainId\n  readonly expiresAtBlock: number\n  readonly grant: Hash\n  readonly plaintext: WakeSubscriptionPlaintext\n  readonly publisher: NormalizedAddress\n  readonly publisherKey: WakeSubscriptionPublicKey\n  readonly revision?: number\n  readonly service: Hash\n  readonly subscriber: NormalizedAddress\n  readonly subscriptionId?: HandshakeId\n  readonly supersedes?: Hash\n}\n\nexport interface CreateWakeSubscriptionAcceptanceInput {\n  readonly challenge: Hash\n  readonly encryptionKey: Hash\n  readonly grant: Hash\n  readonly response: Hash\n  readonly service: Hash\n  readonly subscription: Hash\n}\n\ninterface StrictParser<T> {\n  safeParse: (value: unknown) => { readonly data: T; readonly success: true } | { readonly success: false }\n}\n\nconst publicObjectParsers: readonly StrictParser<EventKitHandshakePublicObject>[] = [\n  PublisherServiceZod,\n  PublisherEncryptionKeyZod,\n  PublisherServiceRevocationZod,\n  PublisherEncryptionKeyRevocationZod,\n  EncryptedWakeSubscriptionZod,\n  WakeGrantObjectZod,\n  WakeGrantRevocationZod,\n  WakeSubscriptionRevocationZod,\n  WakeSubscriptionAcceptanceZod,\n  WakeSubscriptionAcceptanceRevocationZod,\n  EndpointChallengeZod,\n  EndpointChallengeResponseZod,\n]\n\nfunction parseHandshakePublicObject(value: unknown): EventKitHandshakePublicObject {\n  for (const parser of publicObjectParsers) {\n    const parsed = parser.safeParse(value)\n    if (parsed.success) return parsed.data\n  }\n\n  throw new TypeError('Expected a strict Event Kit handshake public object')\n}\n\n/** Canonical XYO data hash after strict validation of a public handshake object. */\nexport async function handshakeObjectHash(object: EventKitHandshakePublicObject): Promise<Hash> {\n  return HashZod.parse(await PayloadBuilder.dataHash(parseHandshakePublicObject(object)))\n}\n\nexport async function withHandshakeObjectHash<T extends EventKitHandshakePublicObject>(\n  body: T,\n): Promise<HashedHandshakeObject<T>> {\n  return Object.freeze({ body, objectHash: await handshakeObjectHash(body) })\n}\n\n/** Build one strict publisher X25519 key descriptor. */\nexport function createPublisherEncryptionKey(input: CreatePublisherEncryptionKeyInput): PublisherEncryptionKey {\n  return PublisherEncryptionKeyZod.parse(new PayloadBuilder({ schema: PublisherEncryptionKeySchema })\n    .fields({\n      keyId: input.keyId ?? generateHandshakeId(),\n      profile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n      publicKey: input.publicKey,\n      validFromBlock: input.validFromBlock,\n      ...(input.expiresAtBlock === undefined ? {} : { expiresAtBlock: input.expiresAtBlock }),\n    })\n    .build())\n}\n\n/** Generate dedicated encryption material and bind both halves to its descriptor hash. */\nexport async function generatePublisherEncryptionKey(\n  input: GeneratePublisherEncryptionKeyInput,\n): Promise<GeneratedPublisherEncryptionKey> {\n  const material = await generateWakeSubscriptionEncryptionKeyPair()\n  const descriptor = createPublisherEncryptionKey({\n    ...input,\n    publicKey: material.publicKey,\n  })\n  const descriptorHash = await handshakeObjectHash(descriptor)\n  return Object.freeze({\n    descriptor,\n    descriptorHash,\n    privateKey: Object.freeze({\n      encryptionKey: descriptorHash,\n      keyId: descriptor.keyId,\n      privateKey: material.privateKey,\n    }),\n    publicKey: Object.freeze({\n      encryptionKey: descriptorHash,\n      keyId: descriptor.keyId,\n      publicKey: descriptor.publicKey,\n    }),\n  })\n}\n\n/** Advertise exact source identities on one independent XL1 authorization chain. */\nexport function createPublisherService(input: CreatePublisherServiceInput): PublisherService {\n  return PublisherServiceZod.parse(new PayloadBuilder({ schema: PublisherServiceSchema })\n    .fields({\n      authorizationChainId: input.authorizationChainId,\n      serviceId: input.serviceId ?? generateHandshakeId(),\n      revision: input.revision ?? 1,\n      ...(input.supersedes === undefined ? {} : { supersedes: input.supersedes }),\n      validFromBlock: input.validFromBlock,\n      ...(input.expiresAtBlock === undefined ? {} : { expiresAtBlock: input.expiresAtBlock }),\n      events: input.sources.map(source => ({\n        kind: SOURCE_WAKE_EVENT_KIND, filterProfile: SOURCE_WAKE_FILTER_PROFILE, source,\n      })),\n      deliveryProfile: WAKE_WALLET_JWT_DELIVERY_PROFILE,\n      challengeProfile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,\n      encryptionProfile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n      encryptionKeys: [...input.encryptionKeys],\n      preferredEncryptionKey: input.preferredEncryptionKey,\n      limits: {\n        maxPositionsPerWake: input.maxPositionsPerWake,\n        maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,\n        maxPlaintextBytes: MAX_SUBSCRIPTION_PLAINTEXT_BYTES,\n      },\n      retirementPolicy: 'existing-acceptances-continue',\n    })\n    .build())\n}\n\n/** Build a fresh exact D-002 enqueue grant for one publisher and route scope. */\nexport function createWakeGrant(input: CreateWakeGrantInput): WakeGrantObject {\n  return WakeGrantObjectZod.parse(new PayloadBuilder({ schema: WakeGrantObjectSchema })\n    .fields({\n      grantId: input.grantId ?? generateGrantId(),\n      deploymentId: input.deploymentId,\n      publisher: input.publisher,\n      ...(input.queueId === undefined ? {} : { queueId: input.queueId }),\n      permissions: ['enqueue'],\n    })\n    .build())\n}\n\n/** Generate a new 32-byte endpoint challenge secret when one is not supplied. */\nexport function createWakeSubscriptionPlaintext(\n  input: CreateWakeSubscriptionPlaintextInput,\n): WakeSubscriptionPlaintext {\n  const secretBytes = new Uint8Array(32)\n  if (input.challengeSecret === undefined) {\n    // The XYO SDK has no generic CSPRNG wrapper; Web Crypto is shared by Node and browsers.\n    globalThis.crypto.getRandomValues(secretBytes)\n  }\n  const challengeSecret = input.challengeSecret ?? bytesToCanonicalBase64Url(secretBytes)\n\n  return WakeSubscriptionPlaintextZod.parse(new PayloadBuilder({ schema: WakeSubscriptionPlaintextSchema })\n    .fields({\n      endpoint: input.endpoint,\n      audience: input.audience,\n      deploymentId: input.deploymentId,\n      queueId: input.queueId ?? null,\n      filter: {\n        schema: SOURCE_WAKE_FILTER_PROFILE,\n        source: input.source,\n        fromPosition: input.fromPosition,\n        maxPositionsPerWake: input.maxPositionsPerWake,\n      },\n      challenge: {\n        profile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,\n        secret: challengeSecret,\n      },\n    })\n    .build())\n}\n\n/** Construct and encrypt one strict subscription with fresh HPKE ephemeral material. */\nexport async function createEncryptedWakeSubscription(\n  input: CreateEncryptedWakeSubscriptionInput,\n): Promise<EncryptedWakeSubscription> {\n  const cleartext = WakeSubscriptionCleartextZod.parse(\n    new PayloadBuilder({ schema: EncryptedWakeSubscriptionSchema })\n      .fields({\n        subscriptionId: input.subscriptionId ?? generateHandshakeId(),\n        revision: input.revision ?? 1,\n        ...(input.supersedes === undefined ? {} : { supersedes: input.supersedes }),\n        chainId: input.chainId,\n        publisher: input.publisher,\n        service: input.service,\n        encryptionKey: input.publisherKey.encryptionKey,\n        keyId: input.publisherKey.keyId,\n        grant: input.grant,\n        eventKind: SOURCE_WAKE_EVENT_KIND,\n        expiresAtBlock: input.expiresAtBlock,\n      })\n      .build(),\n  )\n\n  return await encryptWakeSubscription({\n    plaintext: input.plaintext,\n    publisherKey: input.publisherKey,\n    subscriber: input.subscriber,\n    subscription: cleartext,\n  })\n}\n\nexport function createWakeSubscriptionAcceptance(\n  input: CreateWakeSubscriptionAcceptanceInput,\n): WakeSubscriptionAcceptance {\n  return WakeSubscriptionAcceptanceZod.parse(new PayloadBuilder({ schema: WakeSubscriptionAcceptanceSchema })\n    .fields({\n      challenge: input.challenge,\n      encryptionKey: input.encryptionKey,\n      grant: input.grant,\n      response: input.response,\n      service: input.service,\n      subscription: input.subscription,\n    })\n    .build())\n}\n\nexport function createPublisherServiceRevocation(service: Hash): PublisherServiceRevocation {\n  return PublisherServiceRevocationZod.parse(new PayloadBuilder({ schema: PublisherServiceRevocationSchema })\n    .fields({ service })\n    .build())\n}\n\nexport function createPublisherEncryptionKeyRevocation(key: Hash): PublisherEncryptionKeyRevocation {\n  return PublisherEncryptionKeyRevocationZod.parse(\n    new PayloadBuilder({ schema: PublisherEncryptionKeyRevocationSchema }).fields({ key }).build(),\n  )\n}\n\nexport function createWakeGrantRevocation(grant: Hash): WakeGrantRevocation {\n  return WakeGrantRevocationZod.parse(new PayloadBuilder({ schema: WakeGrantRevocationSchema })\n    .fields({ grant })\n    .build())\n}\n\nexport function createWakeSubscriptionRevocation(subscription: Hash): WakeSubscriptionRevocation {\n  return WakeSubscriptionRevocationZod.parse(new PayloadBuilder({ schema: WakeSubscriptionRevocationSchema })\n    .fields({ subscription })\n    .build())\n}\n\nexport function createWakeSubscriptionAcceptanceRevocation(\n  acceptance: Hash,\n): WakeSubscriptionAcceptanceRevocation {\n  return WakeSubscriptionAcceptanceRevocationZod.parse(\n    new PayloadBuilder({ schema: WakeSubscriptionAcceptanceRevocationSchema }).fields({ acceptance }).build(),\n  )\n}\n", "import {\n  Aes128Gcm,\n  CipherSuite,\n  DhkemX25519HkdfSha256,\n  HkdfSha256,\n} from '@hpke/core'\nimport type {\n  Base64Url32Bytes,\n  EncryptedWakeSubscription,\n  HandshakeId,\n  Hash,\n  NormalizedAddress,\n  WakeSubscriptionCleartext,\n  WakeSubscriptionPlaintext,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  Base64Url32BytesZod,\n  bytesToCanonicalBase64Url,\n  canonicalBase64UrlToBytes,\n  EncryptedWakeSubscriptionZod,\n  HandshakeIdZod,\n  HashZod,\n  NormalizedAddressZod,\n  WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  WakeSubscriptionCleartextZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport {\n  wakeSubscriptionAadBytes,\n  wakeSubscriptionPlaintextBytes,\n  wakeSubscriptionPlaintextFromBytes,\n} from './wakeSubscriptionEncoding.ts'\n\nconst suite = new CipherSuite({\n  kem: new DhkemX25519HkdfSha256(),\n  kdf: new HkdfSha256(),\n  aead: new Aes128Gcm(),\n})\nconst hpkeInfo = new TextEncoder().encode(WAKE_SUBSCRIPTION_HPKE_PROFILE)\ntype HpkeKey = Awaited<ReturnType<typeof suite.kem.deserializePublicKey>>\n\ninterface InternalHpkeKeyPair {\n  privateKey: HpkeKey\n  publicKey: HpkeKey\n}\n\nfunction asInternalHpkeKeyPair(value: unknown): InternalHpkeKeyPair {\n  if (typeof value !== 'object' || value === null || !('privateKey' in value) || !('publicKey' in value)) {\n    throw new TypeError('HPKE implementation returned an invalid key pair')\n  }\n  return {\n    privateKey: value.privateKey as HpkeKey,\n    publicKey: value.publicKey as HpkeKey,\n  }\n}\n\nexport interface WakeSubscriptionEncryptionKeyPair {\n  /** Raw 32-byte X25519 private key encoded as canonical unpadded base64url. */\n  privateKey: Base64Url32Bytes\n  /** Raw 32-byte X25519 public key encoded as canonical unpadded base64url. */\n  publicKey: Base64Url32Bytes\n}\n\nexport interface WakeSubscriptionPublicKey {\n  /** Canonical hash of the publisher-authored key descriptor. */\n  encryptionKey: Hash\n  /** Stable key identifier copied from that descriptor. */\n  keyId: HandshakeId\n  /** Raw X25519 public key from that descriptor. */\n  publicKey: Base64Url32Bytes\n}\n\nexport interface WakeSubscriptionPrivateKey {\n  /** Canonical hash of the publisher-authored key descriptor. */\n  encryptionKey: Hash\n  /** Stable key identifier copied from that descriptor. */\n  keyId: HandshakeId\n  /** Raw X25519 private key held off-chain by the publisher. */\n  privateKey: Base64Url32Bytes\n}\n\nexport interface EncryptWakeSubscriptionInput {\n  plaintext: WakeSubscriptionPlaintext\n  publisherKey: WakeSubscriptionPublicKey\n  subscriber: NormalizedAddress\n  subscription: WakeSubscriptionCleartext\n}\n\nexport interface DecryptWakeSubscriptionInput {\n  publisherKey: WakeSubscriptionPrivateKey\n  subscriber: NormalizedAddress\n  subscription: EncryptedWakeSubscription\n}\n\n/** Deliberately carries no low-level cause that could become a decryption oracle. */\nexport class WakeSubscriptionDecryptionError extends Error {\n  override readonly name = 'WakeSubscriptionDecryptionError'\n\n  constructor() {\n    super('Wake subscription cryptographic validation failed')\n  }\n}\n\nfunction parsePublicKey(value: WakeSubscriptionPublicKey): WakeSubscriptionPublicKey {\n  return {\n    encryptionKey: HashZod.parse(value.encryptionKey),\n    keyId: HandshakeIdZod.parse(value.keyId),\n    publicKey: Base64Url32BytesZod.parse(value.publicKey),\n  }\n}\n\nfunction parsePrivateKey(value: WakeSubscriptionPrivateKey): WakeSubscriptionPrivateKey {\n  return {\n    encryptionKey: HashZod.parse(value.encryptionKey),\n    keyId: HandshakeIdZod.parse(value.keyId),\n    privateKey: Base64Url32BytesZod.parse(value.privateKey),\n  }\n}\n\nfunction decoded32(value: Base64Url32Bytes): Uint8Array {\n  const decoded = canonicalBase64UrlToBytes(value)\n  if (decoded?.length !== 32) throw new TypeError('Expected 32 canonical bytes')\n  return decoded\n}\n\n/** Generate a dedicated X25519 encryption key; never reuse the publisher signing key. */\nexport async function generateWakeSubscriptionEncryptionKeyPair(): Promise<WakeSubscriptionEncryptionKeyPair> {\n  const generated: unknown = await suite.kem.generateKeyPair()\n  const keyPair = asInternalHpkeKeyPair(generated)\n  const [publicKey, privateKey] = await Promise.all([\n    suite.kem.serializePublicKey(keyPair.publicKey),\n    suite.kem.serializePrivateKey(keyPair.privateKey),\n  ])\n  return {\n    publicKey: Base64Url32BytesZod.parse(bytesToCanonicalBase64Url(new Uint8Array(publicKey))),\n    privateKey: Base64Url32BytesZod.parse(bytesToCanonicalBase64Url(new Uint8Array(privateKey))),\n  }\n}\n\n/**\n * One-shot RFC 9180 Base-mode encryption with X25519/HKDF-SHA256/AES-128-GCM.\n * Ephemeral key material is always generated inside the HPKE implementation.\n */\nexport async function encryptWakeSubscription(\n  input: EncryptWakeSubscriptionInput,\n): Promise<EncryptedWakeSubscription> {\n  const subscription = WakeSubscriptionCleartextZod.parse(input.subscription)\n  const subscriber = NormalizedAddressZod.parse(input.subscriber)\n  const publisherKey = parsePublicKey(input.publisherKey)\n  if (\n    subscription.encryptionKey !== publisherKey.encryptionKey\n    || subscription.keyId !== publisherKey.keyId\n  ) {\n    throw new TypeError('Subscription key reference does not match the supplied publisher key')\n  }\n\n  const recipientPublicKey = await suite.kem.deserializePublicKey(decoded32(publisherKey.publicKey))\n  const { ct, enc } = await suite.seal(\n    { recipientPublicKey, info: hpkeInfo },\n    wakeSubscriptionPlaintextBytes(input.plaintext),\n    wakeSubscriptionAadBytes(subscription, subscriber),\n  )\n\n  return EncryptedWakeSubscriptionZod.parse({\n    ...subscription,\n    encryption: {\n      profile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n      enc: bytesToCanonicalBase64Url(new Uint8Array(enc)),\n      ciphertext: bytesToCanonicalBase64Url(new Uint8Array(ct)),\n    },\n  })\n}\n\n/**\n * One-shot decryption. All malformed inputs, key mismatches, authentication\n * failures, and noncanonical plaintexts collapse to the same public error.\n */\nexport async function decryptWakeSubscription(\n  input: DecryptWakeSubscriptionInput,\n): Promise<WakeSubscriptionPlaintext> {\n  try {\n    const subscription = EncryptedWakeSubscriptionZod.parse(input.subscription)\n    const subscriber = NormalizedAddressZod.parse(input.subscriber)\n    const publisherKey = parsePrivateKey(input.publisherKey)\n    if (\n      subscription.encryptionKey !== publisherKey.encryptionKey\n      || subscription.keyId !== publisherKey.keyId\n    ) throw new TypeError('Key reference mismatch')\n\n    const recipientKey = await suite.kem.deserializePrivateKey(decoded32(publisherKey.privateKey))\n    const plaintext = await suite.open(\n      {\n        recipientKey,\n        enc: decoded32(subscription.encryption.enc),\n        info: hpkeInfo,\n      },\n      canonicalBase64UrlToBytes(subscription.encryption.ciphertext) ?? new Uint8Array(),\n      wakeSubscriptionAadBytes(subscription, subscriber),\n    )\n    const parsed = wakeSubscriptionPlaintextFromBytes(new Uint8Array(plaintext))\n    return parsed\n  } catch {\n    throw new WakeSubscriptionDecryptionError()\n  }\n}\n", "import type {\n  EncryptedWakeSubscription,\n  NormalizedAddress,\n  WakeSubscriptionCleartext,\n  WakeSubscriptionPlaintext,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  EncryptedWakeSubscriptionZod,\n  MAX_SUBSCRIPTION_PLAINTEXT_BYTES,\n  NormalizedAddressZod,\n  WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  WakeSubscriptionCleartextZod,\n  WakeSubscriptionPlaintextZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport { canonicalJsonBytes } from './canonicalJson.ts'\n\nconst textDecoder = new TextDecoder('utf-8', { fatal: true })\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.length !== right.length) return false\n  let difference = 0\n  for (let index = 0; index < left.length; index += 1) difference |= left[index] ^ right[index]\n  return difference === 0\n}\n\nfunction cleartextFromEncrypted(subscription: EncryptedWakeSubscription): WakeSubscriptionCleartext {\n  const { encryption: _encryption, ...cleartext } = subscription\n  return cleartext\n}\n\n/**\n * Canonical HPKE additional authenticated data. `subscriber` is the finalized\n * Statement Graph claim source and therefore cannot be inferred from the\n * subscription body itself.\n */\nexport function wakeSubscriptionAadBytes(\n  subscription: WakeSubscriptionCleartext | EncryptedWakeSubscription,\n  subscriber: NormalizedAddress,\n): Uint8Array {\n  const parsedSubscriber = NormalizedAddressZod.parse(subscriber)\n  const parsedSubscription = 'encryption' in subscription\n    ? cleartextFromEncrypted(EncryptedWakeSubscriptionZod.parse(subscription))\n    : WakeSubscriptionCleartextZod.parse(subscription)\n\n  return canonicalJsonBytes({\n    schema: parsedSubscription.schema,\n    chainId: parsedSubscription.chainId,\n    subscriber: parsedSubscriber,\n    publisher: parsedSubscription.publisher,\n    service: parsedSubscription.service,\n    encryptionKey: parsedSubscription.encryptionKey,\n    keyId: parsedSubscription.keyId,\n    grant: parsedSubscription.grant,\n    subscriptionId: parsedSubscription.subscriptionId,\n    revision: parsedSubscription.revision,\n    supersedes: parsedSubscription.supersedes ?? null,\n    eventKind: parsedSubscription.eventKind,\n    expiresAtBlock: parsedSubscription.expiresAtBlock,\n    profile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  })\n}\n\n/** Validate and encode the encrypted subscription plaintext as canonical JCS UTF-8. */\nexport function wakeSubscriptionPlaintextBytes(plaintext: WakeSubscriptionPlaintext): Uint8Array {\n  const parsed = WakeSubscriptionPlaintextZod.parse(plaintext)\n  const encoded = canonicalJsonBytes(parsed)\n  if (encoded.length > MAX_SUBSCRIPTION_PLAINTEXT_BYTES) {\n    throw new RangeError(`Wake subscription plaintext exceeds ${MAX_SUBSCRIPTION_PLAINTEXT_BYTES} bytes`)\n  }\n  return encoded\n}\n\n/** Decode only strict UTF-8 whose bytes are already the canonical plaintext encoding. */\nexport function wakeSubscriptionPlaintextFromBytes(encoded: Uint8Array): WakeSubscriptionPlaintext {\n  if (encoded.length > MAX_SUBSCRIPTION_PLAINTEXT_BYTES) {\n    throw new RangeError(`Wake subscription plaintext exceeds ${MAX_SUBSCRIPTION_PLAINTEXT_BYTES} bytes`)\n  }\n  const decoded = textDecoder.decode(encoded)\n  const parsed = WakeSubscriptionPlaintextZod.parse(JSON.parse(decoded) as unknown)\n  if (!equalBytes(encoded, canonicalJsonBytes(parsed))) {\n    throw new TypeError('Wake subscription plaintext is not canonically encoded')\n  }\n  return parsed\n}\n", "/**\n * Finalized lifecycle evidence shared by service and subscription revisions.\n * Claim sources are already canonical Statement Graph sources; they are\n * compared exactly and are never inferred from fields inside object bodies.\n */\nexport interface LifecycleRevisionEvidence {\n  readonly claimedAtBlock: number\n  readonly objectHash: string\n  readonly revision: number\n  readonly revokedAtBlock?: number\n  readonly source: string\n  readonly supersedes?: string\n}\n\nexport interface PublisherServiceLifecycleRevision extends LifecycleRevisionEvidence {\n  readonly encryptionKeys: readonly string[]\n  readonly eventKinds: readonly string[]\n  readonly expiresAtBlock?: number\n  readonly preferredEncryptionKey: string\n  readonly serviceId: string\n  readonly validFromBlock: number\n}\n\nexport interface PublisherEncryptionKeyLifecycle {\n  readonly claimedAtBlock: number\n  readonly expiresAtBlock?: number\n  readonly keyId: string\n  readonly objectHash: string\n  readonly revokedAtBlock?: number\n  readonly source: string\n  readonly validFromBlock: number\n}\n\nexport interface WakeSubscriptionLifecycleRevision extends LifecycleRevisionEvidence {\n  readonly expiresAtBlock: number\n  readonly subscriptionId: string\n}\n\nexport interface PublisherAcceptanceLifecycle {\n  readonly acceptanceBlock: number\n  readonly objectHash: string\n  readonly revokedAtBlock?: number\n  readonly source: string\n  readonly subscription: string\n}\n\nexport interface PublisherServiceSelectionInput {\n  readonly eventKind: string\n  readonly finalizedHead: number\n  readonly publisherSource: string\n  readonly serviceId?: string\n  readonly services: readonly PublisherServiceLifecycleRevision[]\n}\n\nexport interface PublisherServiceSelectionSuccess {\n  readonly ok: true\n  readonly service: PublisherServiceLifecycleRevision\n}\n\nexport type PublisherServiceSelectionFailureReason\n  = | 'ambiguous-service'\n    | 'invalid-revision-chain'\n    | 'service-not-found'\n\nexport interface PublisherServiceSelectionFailure {\n  readonly ok: false\n  readonly reason: PublisherServiceSelectionFailureReason\n}\n\nexport type PublisherServiceSelection = PublisherServiceSelectionFailure | PublisherServiceSelectionSuccess\n\nexport interface PreferredEncryptionKeyInput {\n  readonly finalizedHead: number\n  readonly keys: readonly PublisherEncryptionKeyLifecycle[]\n  readonly service: PublisherServiceLifecycleRevision\n}\n\nexport interface PreferredEncryptionKeySuccess {\n  readonly key: PublisherEncryptionKeyLifecycle\n  readonly ok: true\n}\n\nexport type PreferredEncryptionKeyFailureReason\n  = | 'ambiguous-key'\n    | 'preferred-key-inactive'\n    | 'preferred-key-not-found'\n    | 'preferred-key-not-referenced'\n\nexport interface PreferredEncryptionKeyFailure {\n  readonly ok: false\n  readonly reason: PreferredEncryptionKeyFailureReason\n}\n\nexport type PreferredEncryptionKeyResolution = PreferredEncryptionKeyFailure | PreferredEncryptionKeySuccess\n\nexport interface SubscriptionActivationInput {\n  readonly acceptances: readonly PublisherAcceptanceLifecycle[]\n  readonly finalizedHead: number\n  readonly publisherSource: string\n  readonly subscriberSource: string\n  readonly subscriptionId: string\n  readonly subscriptions: readonly WakeSubscriptionLifecycleRevision[]\n}\n\nexport interface SubscriptionActivationSuccess {\n  readonly acceptance: PublisherAcceptanceLifecycle\n  readonly activeFromBlock: number\n  readonly ok: true\n  readonly pendingReplacement: boolean\n  readonly subscription: WakeSubscriptionLifecycleRevision\n}\n\nexport type SubscriptionActivationFailureReason\n  = | 'ambiguous-acceptance'\n    | 'invalid-revision-chain'\n    | 'subscription-inactive'\n    | 'subscription-not-found'\n    | 'subscription-pending'\n\nexport interface SubscriptionActivationFailure {\n  readonly ok: false\n  readonly reason: SubscriptionActivationFailureReason\n}\n\nexport type SubscriptionActivation = SubscriptionActivationFailure | SubscriptionActivationSuccess\n\ninterface LinearChainSuccess<T extends LifecycleRevisionEvidence> {\n  readonly chain: readonly T[]\n  readonly ok: true\n}\n\ninterface LinearChainFailure {\n  readonly ok: false\n}\n\ntype LinearChain<T extends LifecycleRevisionEvidence> = LinearChainFailure | LinearChainSuccess<T>\n\ninterface AcceptedSubscription {\n  readonly acceptance: PublisherAcceptanceLifecycle\n  readonly activeFromBlock: number\n  readonly subscription: WakeSubscriptionLifecycleRevision\n}\n\nfunction isNonnegativeSafeInteger(value: number): boolean {\n  return Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isVisible(claimedAtBlock: number, finalizedHead: number): boolean {\n  return isNonnegativeSafeInteger(claimedAtBlock) && claimedAtBlock <= finalizedHead\n}\n\nfunction isRevoked(revokedAtBlock: number | undefined, finalizedHead: number): boolean {\n  return revokedAtBlock !== undefined && revokedAtBlock <= finalizedHead\n}\n\nfunction isUnrevokedEvidence(\n  claimedAtBlock: number,\n  revokedAtBlock: number | undefined,\n  finalizedHead: number,\n): boolean {\n  return isVisible(claimedAtBlock, finalizedHead)\n    && (revokedAtBlock === undefined || (isNonnegativeSafeInteger(revokedAtBlock) && revokedAtBlock >= claimedAtBlock))\n    && !isRevoked(revokedAtBlock, finalizedHead)\n}\n\nfunction isInsideExclusiveWindow(\n  finalizedHead: number,\n  validFromBlock: number,\n  expiresAtBlock?: number,\n): boolean {\n  if (!isNonnegativeSafeInteger(validFromBlock) || finalizedHead < validFromBlock) return false\n  return expiresAtBlock === undefined\n    || (isNonnegativeSafeInteger(expiresAtBlock) && expiresAtBlock > validFromBlock && finalizedHead < expiresAtBlock)\n}\n\nfunction isRevisionShapeValid(revision: LifecycleRevisionEvidence): boolean {\n  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1) return false\n  if (!isNonnegativeSafeInteger(revision.claimedAtBlock)) return false\n  if (revision.revokedAtBlock !== undefined\n    && (!isNonnegativeSafeInteger(revision.revokedAtBlock) || revision.revokedAtBlock < revision.claimedAtBlock)) return false\n  return revision.revision === 1\n    ? revision.supersedes === undefined\n    : revision.supersedes !== undefined\n}\n\nfunction resolveLinearChain<T extends LifecycleRevisionEvidence>(\n  revisions: readonly T[],\n  finalizedHead: number,\n): LinearChain<T> {\n  const visible = revisions.filter(revision => isVisible(revision.claimedAtBlock, finalizedHead))\n  if (visible.length === 0) return { ok: true, chain: [] }\n  if (visible.some(revision => !isRevisionShapeValid(revision))) return { ok: false }\n\n  const byHash = new Map<string, T>()\n  const childByParent = new Map<string, T>()\n  let root: T | undefined\n\n  for (const revision of visible) {\n    if (byHash.has(revision.objectHash)) return { ok: false }\n    byHash.set(revision.objectHash, revision)\n    if (revision.revision === 1) {\n      if (root !== undefined) return { ok: false }\n      root = revision\n    }\n  }\n  if (root === undefined) return { ok: false }\n\n  for (const revision of visible) {\n    if (revision.revision === 1) continue\n    const parentHash = revision.supersedes\n    if (parentHash === undefined || childByParent.has(parentHash)) return { ok: false }\n    const parent = byHash.get(parentHash)\n    if (parent === undefined\n      || revision.revision !== parent.revision + 1\n      || revision.claimedAtBlock < parent.claimedAtBlock) return { ok: false }\n    childByParent.set(parentHash, revision)\n  }\n\n  const chain: T[] = [root]\n  let current = root\n  while (childByParent.has(current.objectHash)) {\n    const child = childByParent.get(current.objectHash)\n    if (child === undefined) return { ok: false }\n    chain.push(child)\n    current = child\n  }\n  return chain.length === visible.length ? { ok: true, chain } : { ok: false }\n}\n\nfunction groupServicesByIdentity(\n  services: readonly PublisherServiceLifecycleRevision[],\n  input: PublisherServiceSelectionInput,\n): ReadonlyMap<string, readonly PublisherServiceLifecycleRevision[]> {\n  const groups = new Map<string, PublisherServiceLifecycleRevision[]>()\n  for (const service of services) {\n    if (service.source !== input.publisherSource) continue\n    if (input.serviceId !== undefined && service.serviceId !== input.serviceId) continue\n    const group = groups.get(service.serviceId) ?? []\n    group.push(service)\n    groups.set(service.serviceId, group)\n  }\n  return groups\n}\n\nfunction authoritativeService(\n  chain: readonly PublisherServiceLifecycleRevision[],\n  finalizedHead: number,\n): PublisherServiceLifecycleRevision | undefined {\n  let authoritative: PublisherServiceLifecycleRevision | undefined\n  for (const service of chain) {\n    if (service.validFromBlock <= finalizedHead) authoritative = service\n  }\n  return authoritative\n}\n\nfunction isActiveService(service: PublisherServiceLifecycleRevision, finalizedHead: number): boolean {\n  return isUnrevokedEvidence(service.claimedAtBlock, service.revokedAtBlock, finalizedHead)\n    && isInsideExclusiveWindow(finalizedHead, service.validFromBlock, service.expiresAtBlock)\n}\n\n/** Selects exactly one active service; response order never breaks ambiguity. */\nexport function selectPublisherService(input: PublisherServiceSelectionInput): PublisherServiceSelection {\n  const groups = groupServicesByIdentity(input.services, input)\n  const selectable: PublisherServiceLifecycleRevision[] = []\n\n  for (const revisions of groups.values()) {\n    if (input.serviceId === undefined && !revisions.some(service => service.eventKinds.includes(input.eventKind))) {\n      continue\n    }\n    const resolution = resolveLinearChain(revisions, input.finalizedHead)\n    if (!resolution.ok) return { ok: false, reason: 'invalid-revision-chain' }\n    const service = authoritativeService(resolution.chain, input.finalizedHead)\n    if (service?.eventKinds.includes(input.eventKind) && isActiveService(service, input.finalizedHead)) {\n      selectable.push(service)\n    }\n  }\n\n  if (selectable.length === 0) return { ok: false, reason: 'service-not-found' }\n  if (selectable.length > 1) return { ok: false, reason: 'ambiguous-service' }\n  return { ok: true, service: selectable[0] }\n}\n\n/** Resolves the exact preferred descriptor; another active key is never a fallback. */\nexport function resolvePreferredEncryptionKey(\n  input: PreferredEncryptionKeyInput,\n): PreferredEncryptionKeyResolution {\n  const preferredHash = input.service.preferredEncryptionKey\n  if (!input.service.encryptionKeys.includes(preferredHash)) {\n    return { ok: false, reason: 'preferred-key-not-referenced' }\n  }\n\n  const exact = input.keys.filter(key => key.source === input.service.source\n    && key.objectHash === preferredHash\n    && isVisible(key.claimedAtBlock, input.finalizedHead))\n  if (exact.length === 0) return { ok: false, reason: 'preferred-key-not-found' }\n  if (exact.length > 1) return { ok: false, reason: 'ambiguous-key' }\n\n  const key = exact[0]\n  const sameStableIdentity = input.keys.filter(candidate => candidate.source === key.source\n    && candidate.keyId === key.keyId\n    && candidate.objectHash !== key.objectHash\n    && isVisible(candidate.claimedAtBlock, input.finalizedHead))\n  if (sameStableIdentity.length > 0) return { ok: false, reason: 'ambiguous-key' }\n  if (!isUnrevokedEvidence(key.claimedAtBlock, key.revokedAtBlock, input.finalizedHead)\n    || !isInsideExclusiveWindow(input.finalizedHead, key.validFromBlock, key.expiresAtBlock)) {\n    return { ok: false, reason: 'preferred-key-inactive' }\n  }\n  return { ok: true, key }\n}\n\nfunction acceptanceFor(\n  subscription: WakeSubscriptionLifecycleRevision,\n  input: SubscriptionActivationInput,\n): PublisherAcceptanceLifecycle[] {\n  return input.acceptances.filter(acceptance => acceptance.source === input.publisherSource\n    && acceptance.subscription === subscription.objectHash\n    && isVisible(acceptance.acceptanceBlock, input.finalizedHead))\n}\n\nfunction acceptedSubscription(\n  subscription: WakeSubscriptionLifecycleRevision,\n  input: SubscriptionActivationInput,\n): AcceptedSubscription | 'ambiguous' | undefined {\n  const acceptances = acceptanceFor(subscription, input)\n  if (acceptances.length > 1) return 'ambiguous'\n  const acceptance = acceptances[0]\n  if (acceptance === undefined || !isNonnegativeSafeInteger(acceptance.acceptanceBlock)) return undefined\n  if (!Number.isSafeInteger(subscription.expiresAtBlock) || subscription.expiresAtBlock < 1) return undefined\n  if (acceptance.acceptanceBlock <= subscription.claimedAtBlock\n    || acceptance.acceptanceBlock >= Number.MAX_SAFE_INTEGER) return undefined\n  const activeFromBlock = acceptance.acceptanceBlock + 1\n  if (activeFromBlock >= subscription.expiresAtBlock) return undefined\n  return {\n    acceptance, activeFromBlock, subscription,\n  }\n}\n\nfunction isActiveAcceptedSubscription(\n  accepted: AcceptedSubscription,\n  finalizedHead: number,\n): boolean {\n  return isUnrevokedEvidence(\n    accepted.subscription.claimedAtBlock,\n    accepted.subscription.revokedAtBlock,\n    finalizedHead,\n  )\n  && isUnrevokedEvidence(\n    accepted.acceptance.acceptanceBlock,\n    accepted.acceptance.revokedAtBlock,\n    finalizedHead,\n  )\n  && finalizedHead < accepted.subscription.expiresAtBlock\n}\n\n/**\n * Selects the highest revision whose acceptance cutover has arrived. A newer\n * pending revision leaves the prior activation in place; after cutover, an\n * inactive replacement never falls back to an older accepted revision.\n */\nexport function selectSubscriptionActivation(input: SubscriptionActivationInput): SubscriptionActivation {\n  const revisions = input.subscriptions.filter(subscription => subscription.source === input.subscriberSource\n    && subscription.subscriptionId === input.subscriptionId)\n  const resolution = resolveLinearChain(revisions, input.finalizedHead)\n  if (!resolution.ok) return { ok: false, reason: 'invalid-revision-chain' }\n  if (resolution.chain.length === 0) return { ok: false, reason: 'subscription-not-found' }\n\n  let selected: AcceptedSubscription | undefined\n  for (const subscription of resolution.chain) {\n    const accepted = acceptedSubscription(subscription, input)\n    if (accepted === 'ambiguous') return { ok: false, reason: 'ambiguous-acceptance' }\n    if (accepted !== undefined && accepted.activeFromBlock <= input.finalizedHead) selected = accepted\n  }\n  if (selected === undefined) return { ok: false, reason: 'subscription-pending' }\n  const latest = resolution.chain.at(-1)\n  if (!isActiveAcceptedSubscription(selected, input.finalizedHead)) {\n    // Exact-hash revocation or expiry of the prior accepted revision must not\n    // hide a fresh successor that still needs its own acceptance.\n    if (latest?.objectHash !== selected.subscription.objectHash) {\n      return { ok: false, reason: 'subscription-pending' }\n    }\n    return { ok: false, reason: 'subscription-inactive' }\n  }\n\n  return {\n    acceptance: selected.acceptance,\n    activeFromBlock: selected.activeFromBlock,\n    ok: true,\n    pendingReplacement: latest?.objectHash !== selected.subscription.objectHash,\n    subscription: selected.subscription,\n  }\n}\n", "import type {\n  WakeGrantObject,\n  WakeGrantRevocation,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  normalizeAddress,\n  WakeGrantObjectSchema,\n  WakeGrantRevocationSchema,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  StatementGrantClaim,\n  StatementGrantObject,\n  StatementGraphGrantReadModel,\n} from './statementGraphPorts.ts'\n\nexport interface MemoryStatementGrantGraph extends StatementGraphGrantReadModel {\n  /**\n   * Claim a grant object. Statement Graph v2 is append-only, so a repeat claim\n   * is redundant: it advances `lastBlock` and leaves `firstBlock` frozen.\n   */\n  claim: (input: {\n    block: number\n    /** Claim event hash; must be 64 lowercase hex. */\n    eventHash: string\n    grant: WakeGrantObject\n    objectHash: string\n    source: string\n    /** Defaults to `grant.publisher`. */\n    subject?: string\n  }) => void\n  /**\n   * Claim a revocation object negating `grant`. There is no revoke verb in v2 \u2014\n   * negation is another claim, and Event Kit reads it as the disabling signal.\n   */\n  revoke: (input: {\n    block: number\n    eventHash: string\n    grantObjectHash: string\n    objectHash: string\n    source: string\n    /** Defaults to the subject of the referenced grant Claim. */\n    subject?: string\n  }) => void\n  setHead: (block: number) => void\n}\n\n/**\n * In-memory Statement Graph v2 stand-in for grant/negation tests.\n * Not a full fold \u2014 enough to exercise the Event Kit allowlist adapter.\n */\nexport function createMemoryStatementGrantGraph(initialHead = 0): MemoryStatementGrantGraph {\n  let head = initialHead\n  const claims = new Map<string, StatementGrantClaim>()\n  const objects = new Map<string, StatementGrantObject>()\n\n  function claimKey(source: string, subject: string, objectHash: string): string {\n    return `${normalizeAddress(source)}|${normalizeAddress(subject)}|${objectHash}`\n  }\n\n  function materialize(input: {\n    block: number\n    declaredSchema: string\n    eventHash: string\n    objectHash: string\n    params: Readonly<Record<string, unknown>>\n    source: string\n    subject: string\n  }): void {\n    const source = normalizeAddress(input.source)\n    const subject = normalizeAddress(input.subject)\n    objects.set(input.objectHash, Object.freeze({\n      assurance: 'resolved',\n      declaredSchema: input.declaredSchema,\n      objectHash: input.objectHash,\n      params: Object.freeze({ ...input.params }),\n    }))\n\n    const key = claimKey(source, subject, input.objectHash)\n    const existing = claims.get(key)\n    claims.set(key, Object.freeze(existing === undefined\n      ? {\n          declaredObjectSchema: input.declaredSchema,\n          firstBlock: input.block,\n          firstEventHash: input.eventHash,\n          lastBlock: input.block,\n          objectHash: input.objectHash,\n          source,\n          subject,\n        }\n      // Redundant claim: first-wins on identity, only the moving clock advances.\n      : { ...existing, lastBlock: Math.max(existing.lastBlock, input.block) }))\n    if (input.block > head) head = input.block\n  }\n\n  return {\n    async head(): Promise<number> {\n      return head\n    },\n\n    setHead(block: number): void {\n      head = block\n    },\n\n    async claims(source, query): Promise<readonly StatementGrantClaim[]> {\n      const normalizedSource = normalizeAddress(source)\n      const records: StatementGrantClaim[] = []\n      for (const record of claims.values()) {\n        if (record.source !== normalizedSource) continue\n        if (query?.subject !== undefined && record.subject !== normalizeAddress(query.subject)) continue\n        if (query?.objectHash !== undefined && record.objectHash !== query.objectHash) continue\n        if (query?.declaredObjectSchemaPrefix !== undefined\n          && !record.declaredObjectSchema.startsWith(query.declaredObjectSchemaPrefix)) {\n          continue\n        }\n        records.push(record)\n      }\n      return records\n    },\n\n    async object(objectHash): Promise<StatementGrantObject | undefined> {\n      return objects.get(objectHash)\n    },\n\n    claim(input): void {\n      if (input.grant.schema !== WakeGrantObjectSchema) {\n        throw new Error(`expected ${WakeGrantObjectSchema}`)\n      }\n      const { schema: _schema, ...params } = input.grant\n      materialize({\n        block: input.block,\n        declaredSchema: WakeGrantObjectSchema,\n        eventHash: input.eventHash,\n        objectHash: input.objectHash,\n        params: {\n          ...params,\n          permissions: Object.freeze([...params.permissions]),\n        },\n        source: input.source,\n        subject: input.subject ?? input.grant.publisher,\n      })\n    },\n\n    revoke(input): void {\n      const revocation: Omit<WakeGrantRevocation, 'schema'> = { grant: input.grantObjectHash }\n      const source = normalizeAddress(input.source)\n      const subjects = [...claims.values()]\n        .filter(claim => claim.source === source && claim.objectHash === input.grantObjectHash)\n        .map(claim => claim.subject)\n      const uniqueSubjects = [...new Set(subjects)]\n      if (input.subject === undefined && uniqueSubjects.length > 1) {\n        throw new Error(`cannot infer one subject for ambiguous grant Claim ${input.grantObjectHash}`)\n      }\n      const subject = input.subject ?? uniqueSubjects[0]\n      if (subject === undefined) {\n        throw new Error(`cannot infer subject for unknown grant Claim ${input.grantObjectHash}`)\n      }\n      materialize({\n        block: input.block,\n        declaredSchema: WakeGrantRevocationSchema,\n        eventHash: input.eventHash,\n        objectHash: input.objectHash,\n        params: revocation,\n        source: input.source,\n        subject,\n      })\n    },\n  }\n}\n", "import type {\n  Hash,\n  WakeId,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  AtomicWakeInbox,\n  WakeAdmissionAttempt,\n  WakeAdmissionReceipt,\n  WakeAttemptResolution,\n  WakeCommitResult,\n} from './admissionTypes.ts'\nimport type { AdmittedWake } from './types.ts'\n\nexport interface MemoryWakeInboxOptions<TWake = AdmittedWake> {\n  /**\n   * Durable-sink stand-in invoked inside the atomic commit. A throw leaves both\n   * identities unconsumed, so the publisher may retry the same `wakeId` with a\n   * fresh `jti` instead of losing the wake to a burned replay key.\n   */\n  readonly enqueue?: (wake: TWake) => Promise<void> | void\n  /** Trusted clock in Unix seconds, used to drop expired token records. */\n  readonly nowSeconds?: () => number\n}\n\nexport interface MemoryWakeInbox<TWake = AdmittedWake> extends AtomicWakeInbox<TWake> {\n  /** Wakes handed to `enqueue`, in commit order. */\n  readonly queued: readonly TWake[]\n  /** Live `(aud, iss, jti)` replay records. */\n  readonly tokenRecordCount: number\n  /** Live `(aud, iss, wakeId)` logical records. */\n  readonly wakeRecordCount: number\n}\n\ninterface ReceiptBinding {\n  readonly eventHash: Hash\n  readonly receipt: WakeAdmissionReceipt\n  readonly wakeId: WakeId\n}\n\ninterface TokenBinding extends ReceiptBinding {\n  readonly retainJwtUntil: number\n}\n\n/** The already-recorded outcomes, common to both the resolve and commit unions. */\ntype RecordedResolution = Exclude<WakeAttemptResolution, { readonly kind: 'new' }>\n\n/**\n * Single-process linearizable `AtomicWakeInbox` for structural tests and local\n * rehearsal.\n *\n * Writes are ordered so a failing sink cannot consume `jti` or `wakeId` without\n * a recoverable receipt. It is **not** durable: process death between enqueue\n * and record commit redelivers the wake, and no state survives restart. The\n * historical core implementation-plan Gate 5 requires a durable adapter; this\n * is local evidence only.\n */\nexport function createMemoryWakeInbox<TWake = AdmittedWake>(\n  options: MemoryWakeInboxOptions<TWake> = {},\n): MemoryWakeInbox<TWake> {\n  const tokenRecords = new Map<string, TokenBinding>()\n  const wakeRecords = new Map<string, ReceiptBinding>()\n  const queued: TWake[] = []\n  let receiptSequence = 0\n  let tail: Promise<unknown> = Promise.resolve()\n\n  /**\n   * Serializes the critical section. Both entry points read, decide, and write\n   * across an `await`, so without this a concurrent commit could pass its\n   * recheck before the winning commit records either identity.\n   */\n  function exclusive<T>(work: () => Promise<T>): Promise<T> {\n    const run = tail.then(work, work)\n    // allSettled never rejects, so a failed section still releases the lock.\n    tail = Promise.allSettled([run])\n    return run\n  }\n\n  function pruneExpiredTokens(): void {\n    const { nowSeconds } = options\n    if (nowSeconds === undefined) return\n    const now = nowSeconds()\n    for (const [key, binding] of tokenRecords) {\n      if (binding.retainJwtUntil <= now) tokenRecords.delete(key)\n    }\n  }\n\n  /** Resolves an attempt against both indexes, binding a fresh `jti` to a known wake. */\n  function matchRecorded(attempt: WakeAdmissionAttempt): RecordedResolution | undefined {\n    const tokenBinding = tokenRecords.get(tokenKey(attempt))\n    if (tokenBinding !== undefined) {\n      return tokenBinding.eventHash === attempt.eventHash && tokenBinding.wakeId === attempt.wakeId\n        ? { kind: 'duplicate', receipt: tokenBinding.receipt }\n        : { kind: 'jwt-id-collision' }\n    }\n\n    const wakeBinding = wakeRecords.get(wakeKey(attempt))\n    if (wakeBinding === undefined) return undefined\n    if (wakeBinding.eventHash !== attempt.eventHash) return { kind: 'wake-id-collision' }\n    tokenRecords.set(tokenKey(attempt), { ...wakeBinding, retainJwtUntil: attempt.retainJwtUntil })\n    return { kind: 'duplicate', receipt: wakeBinding.receipt }\n  }\n\n  return {\n    get queued(): readonly TWake[] {\n      return queued\n    },\n\n    get tokenRecordCount(): number {\n      return tokenRecords.size\n    },\n\n    get wakeRecordCount(): number {\n      return wakeRecords.size\n    },\n\n    async resolveAttempt(attempt: WakeAdmissionAttempt): Promise<WakeAttemptResolution> {\n      return await exclusive(async () => {\n        pruneExpiredTokens()\n        return matchRecorded(attempt) ?? { kind: 'new' }\n      })\n    },\n\n    async commitAuthorized({ attempt, wake }: {\n      readonly attempt: WakeAdmissionAttempt\n      readonly wake: TWake\n    }): Promise<WakeCommitResult> {\n      return await exclusive(async () => {\n        pruneExpiredTokens()\n        const recorded = matchRecorded(attempt)\n        if (recorded !== undefined) return recorded\n\n        const receipt: WakeAdmissionReceipt = Object.freeze({\n          audience: attempt.audience,\n          eventHash: attempt.eventHash,\n          id: `receipt-${receiptSequence += 1}`,\n          publisher: attempt.publisher,\n          wakeId: attempt.wakeId,\n        })\n\n        // Hand the wake to the sink before consuming either identity. A throw here\n        // must leave the attempt retryable rather than strand it without a receipt.\n        await options.enqueue?.(wake)\n        queued.push(wake)\n\n        const binding: ReceiptBinding = {\n          eventHash: attempt.eventHash,\n          receipt,\n          wakeId: attempt.wakeId,\n        }\n        tokenRecords.set(tokenKey(attempt), { ...binding, retainJwtUntil: attempt.retainJwtUntil })\n        wakeRecords.set(wakeKey(attempt), binding)\n        return { kind: 'enqueued', receipt }\n      })\n    },\n  }\n}\n\n/** Opaque audiences may contain any character, so keys are JSON-encoded rather than joined. */\nfunction tokenKey(attempt: WakeAdmissionAttempt): string {\n  return JSON.stringify([attempt.audience, attempt.publisher, attempt.jwtId])\n}\n\nfunction wakeKey(attempt: WakeAdmissionAttempt): string {\n  return JSON.stringify([attempt.audience, attempt.publisher, attempt.wakeId])\n}\n", "import type { AdmittedWake } from './types.ts'\nimport type {\n  LeasedWake,\n  WakeQueue,\n} from './wakeQueue.ts'\n\nexport interface MemoryWakeQueue<TWake = AdmittedWake> extends WakeQueue<TWake> {\n  /** Entries currently leased and not yet acked or released. */\n  inflightCount: () => Promise<number>\n}\n\ninterface Entry<TWake> {\n  readonly sequence: number\n  readonly wake: TWake\n}\n\n/**\n * In-process `WakeQueue`.\n *\n * Structural evidence only: nothing survives process death, so `recoverInflight`\n * can reclaim a lease abandoned within this process but cannot help after a\n * restart. Use the filesystem or SQLite provider where durability matters.\n */\nexport function createMemoryWakeQueue<TWake = AdmittedWake>(): MemoryWakeQueue<TWake> {\n  const pending: Entry<TWake>[] = []\n  const inflight = new Map<number, Entry<TWake>>()\n  let sequence = 0\n\n  return {\n    async append(wake: TWake): Promise<void> {\n      pending.push({ sequence: sequence += 1, wake })\n    },\n\n    async claim(): Promise<LeasedWake<TWake> | undefined> {\n      const entry = pending.shift()\n      if (entry === undefined) return undefined\n      inflight.set(entry.sequence, entry)\n\n      return {\n        wake: entry.wake,\n        async ack(): Promise<void> {\n          inflight.delete(entry.sequence)\n        },\n        async release(): Promise<void> {\n          if (!inflight.delete(entry.sequence)) return\n          // Restore arrival order rather than appending to the tail.\n          pending.push(entry)\n          pending.sort((left, right) => left.sequence - right.sequence)\n        },\n      }\n    },\n\n    async inflightCount(): Promise<number> {\n      return inflight.size\n    },\n\n    async pendingCount(): Promise<number> {\n      return pending.length\n    },\n\n    async recoverInflight(): Promise<number> {\n      const recovered = inflight.size\n      for (const entry of inflight.values()) pending.push(entry)\n      inflight.clear()\n      pending.sort((left, right) => left.sequence - right.sequence)\n      return recovered\n    },\n  }\n}\n", "/* eslint-disable max-lines -- Publisher-side validation and challenge completion share one auditable security boundary. */\nimport type {\n  ChainId,\n  EncryptedWakeSubscription,\n  EndpointChallenge,\n  EndpointChallengeResponse,\n  Hash,\n  NormalizedAddress,\n  PublisherEncryptionKey,\n  PublisherService,\n  WakeGrantObject,\n  WakeSubscriptionAcceptance,\n  WakeSubscriptionPlaintext,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  ChainIdZod,\n  EncryptedWakeSubscriptionZod,\n  EndpointChallengeZod,\n  HashZod,\n  hasMatchingHandshakeProfile,\n  NormalizedAddressZod,\n  PublisherEncryptionKeyZod,\n  PublisherServiceZod,\n  WakeGrantObjectZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport {\n  createEndpointChallenge,\n  endpointChallengeHash,\n  verifyEndpointChallengeProof,\n  verifyEndpointChallengeResponse,\n} from './endpointChallenge.ts'\nimport type { HashedHandshakeObject } from './handshakeConstruction.ts'\nimport {\n  createWakeSubscriptionAcceptance,\n  handshakeObjectHash,\n} from './handshakeConstruction.ts'\nimport type {\n  BeginPublisherEndpointChallengeAttemptResult,\n  CompletePublisherEndpointChallengeResult,\n  PublisherEncryptionKeyStore,\n  PublisherEndpointChallengeRecord,\n  PublisherEndpointChallengeStore,\n} from './publisherHandshakeStores.ts'\nimport { wakeSourcesEqual } from './sourceWakeIdentity.ts'\nimport { decryptWakeSubscription } from './wakeSubscriptionHpke.ts'\n\n/**\n * Finalized, publisher-scoped read-model output for one exact subscriber\n * fan-out Claim. The caller remains responsible for finalized Claim authority,\n * service/key selection, lifecycle revocations, and revalidation before\n * publishing acceptance; this boundary independently recomputes immutable\n * body hashes and enforces publisher-private constraints.\n */\nexport interface PublisherSubscriptionCandidate {\n  readonly chainId: ChainId\n  readonly finalizedHead: number\n  readonly grant: HashedHandshakeObject<WakeGrantObject>\n  readonly key: HashedHandshakeObject<PublisherEncryptionKey>\n  readonly keys: PublisherEncryptionKeyStore\n  readonly publisher: NormalizedAddress\n  readonly service: HashedHandshakeObject<PublisherService>\n  /** Finalized fan-out Claim source; this is the subscriber identity used in HPKE AAD. */\n  readonly subscriber: NormalizedAddress\n  readonly subscription: HashedHandshakeObject<EncryptedWakeSubscription>\n  /** Finalized block containing the exact service/grant/subscription fan-out Claim. */\n  readonly tupleBlock: number\n  /** All object hashes in that one fan-out Claim. */\n  readonly tupleObjectHashes: readonly Hash[]\n  /** Publisher subject under which the finalized fan-out Claim was discovered. */\n  readonly tupleSubject: NormalizedAddress\n}\n\nexport type PublisherSubscriptionValidationFailureReason\n  = | 'body-hash-mismatch'\n    | 'decryption-failed'\n    | 'grant-binding-invalid'\n    | 'grant-scope-invalid'\n    | 'key-binding-invalid'\n    | 'key-inactive'\n    | 'key-store-unavailable'\n    | 'malformed-candidate'\n    | 'private-key-not-found'\n    | 'service-inactive'\n    | 'service-limit-invalid'\n    | 'subscription-binding-invalid'\n    | 'subscription-expiry-invalid'\n    | 'tuple-binding-invalid'\n\nexport interface PublisherSubscriptionValidationFailure {\n  readonly ok: false\n  readonly reason: PublisherSubscriptionValidationFailureReason\n}\n\nexport interface PublisherEndpointChallengeContext {\n  readonly chainId: ChainId\n  readonly encryptionKey: Hash\n  readonly eventKind: EncryptedWakeSubscription['eventKind']\n  readonly grant: Hash\n  readonly keyId: EncryptedWakeSubscription['keyId']\n  readonly publisher: NormalizedAddress\n  readonly service: Hash\n  readonly subscriber: NormalizedAddress\n  readonly subscription: Hash\n}\n\nexport interface ValidatedPublisherSubscription {\n  readonly context: PublisherEndpointChallengeContext\n  readonly finalizedHead: number\n  readonly grant: HashedHandshakeObject<WakeGrantObject>\n  readonly key: HashedHandshakeObject<PublisherEncryptionKey>\n  readonly ok: true\n  readonly plaintext: WakeSubscriptionPlaintext\n  readonly service: HashedHandshakeObject<PublisherService>\n  readonly subscription: HashedHandshakeObject<EncryptedWakeSubscription>\n  readonly tupleBlock: number\n}\n\nexport type PublisherSubscriptionValidation\n  = | PublisherSubscriptionValidationFailure\n    | ValidatedPublisherSubscription\n\nexport interface IssuePublisherEndpointChallengeApiInput {\n  readonly issuedAt: number\n  readonly lifetimeSeconds?: number\n  readonly store: PublisherEndpointChallengeStore\n  readonly subscription: ValidatedPublisherSubscription\n}\n\nexport type IssuePublisherEndpointChallengeApiResult\n  = | { readonly ok: false; readonly reason: 'challenge-collision' | 'challenge-store-invalid' | 'challenge-store-unavailable' }\n    | {\n      readonly challenge: EndpointChallenge\n      readonly challengeHash: Hash\n      readonly disposition: 'duplicate' | 'issued'\n      readonly ok: true\n    }\n\nexport interface BeginPublisherEndpointChallengeAttemptApiInput {\n  readonly challengeHash: Hash\n  readonly nowSeconds: number\n  readonly store: PublisherEndpointChallengeStore\n}\n\nexport type BeginPublisherEndpointChallengeAttemptApiResult\n  = | BeginPublisherEndpointChallengeAttemptResult\n    | { readonly kind: 'store-invalid' | 'store-unavailable' }\n\nexport interface CompletePublisherEndpointChallengeApiInput {\n  readonly challenge: EndpointChallenge\n  /**\n   * Publisher-local Unix second for the one-time proof-verification and\n   * acceptance decision. Finalized replay cannot and does not re-evaluate this\n   * value from XL1 block time.\n   */\n  readonly nowSeconds: number\n  readonly response: EndpointChallengeResponse\n  readonly store: PublisherEndpointChallengeStore\n  readonly subscription: ValidatedPublisherSubscription\n}\n\nexport type CompletePublisherEndpointChallengeFailureReason\n  = | 'challenge-context-invalid'\n    | 'challenge-expired'\n    | 'challenge-not-attempted'\n    | 'challenge-not-found'\n    | 'challenge-response-collision'\n    | 'challenge-store-invalid'\n    | 'challenge-store-unavailable'\n    | 'invalid-proof'\n\nexport interface CompletePublisherEndpointChallengeFailure {\n  readonly ok: false\n  readonly reason: CompletePublisherEndpointChallengeFailureReason\n}\n\nexport interface CompletePublisherEndpointChallengeSuccess {\n  readonly acceptance: WakeSubscriptionAcceptance\n  readonly acceptanceHash: Hash\n  readonly challengeHash: Hash\n  readonly disposition: 'duplicate' | 'verified'\n  readonly ok: true\n  readonly responseHash: Hash\n}\n\nexport type CompletePublisherEndpointChallengeApiResult\n  = | CompletePublisherEndpointChallengeFailure\n    | CompletePublisherEndpointChallengeSuccess\n\nfunction rejectPublisherSubscription(\n  reason: PublisherSubscriptionValidationFailureReason,\n): PublisherSubscriptionValidationFailure {\n  return Object.freeze({ ok: false, reason })\n}\n\nfunction isNonnegativeSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isActiveAt(\n  value: { readonly expiresAtBlock?: number; readonly validFromBlock: number },\n  block: number,\n): boolean {\n  return value.validFromBlock <= block\n    && (value.expiresAtBlock === undefined || block < value.expiresAtBlock)\n}\n\nfunction occursExactlyOnce(hashes: readonly Hash[], expected: Hash): boolean {\n  return hashes.filter(hash => hash === expected).length === 1\n}\n\nfunction hasExactGrantBinding(grant: WakeGrantObject, publisher: NormalizedAddress): boolean {\n  return grant.publisher === publisher\n    && grant.permissions.length === 1\n    && grant.permissions[0] === 'enqueue'\n}\n\nfunction hasExactQueueScope(grant: WakeGrantObject, plaintext: WakeSubscriptionPlaintext): boolean {\n  const grantQueue = Object.hasOwn(grant, 'queueId') ? grant.queueId : null\n  return plaintext.deploymentId === grant.deploymentId && plaintext.queueId === grantQueue\n}\n\nfunction hasExactSubscriptionBinding(\n  candidate: PublisherSubscriptionCandidate,\n  subscription: EncryptedWakeSubscription,\n): boolean {\n  return subscription.chainId === candidate.chainId\n    && subscription.publisher === candidate.publisher\n    && subscription.service === candidate.service.objectHash\n    && subscription.encryptionKey === candidate.key.objectHash\n    && subscription.keyId === candidate.key.body.keyId\n    && subscription.grant === candidate.grant.objectHash\n}\n\nfunction hasExactKeyBinding(\n  service: PublisherService,\n  key: HashedHandshakeObject<PublisherEncryptionKey>,\n  subscription: EncryptedWakeSubscription,\n): boolean {\n  return service.encryptionKeys.includes(key.objectHash)\n    && service.preferredEncryptionKey === key.objectHash\n    && key.body.keyId === subscription.keyId\n    && key.objectHash === subscription.encryptionKey\n}\n\nfunction expiryWithinServicePolicy(\n  subscription: EncryptedWakeSubscription,\n  service: PublisherService,\n  tupleBlock: number,\n): boolean {\n  return subscription.expiresAtBlock > tupleBlock\n    && subscription.expiresAtBlock - tupleBlock <= service.limits.maxSubscriptionLifetimeBlocks\n}\n\ninterface ParsedPublisherSubscriptionCandidate {\n  readonly chainId: ChainId\n  readonly grant: WakeGrantObject\n  readonly key: PublisherEncryptionKey\n  readonly publisher: NormalizedAddress\n  readonly service: PublisherService\n  readonly subscriber: NormalizedAddress\n  readonly subscription: EncryptedWakeSubscription\n  readonly tupleObjectHashes: readonly Hash[]\n  readonly tupleSubject: NormalizedAddress\n}\n\nfunction parsePublisherSubscriptionCandidate(\n  candidate: PublisherSubscriptionCandidate,\n): ParsedPublisherSubscriptionCandidate | undefined {\n  try {\n    return {\n      chainId: ChainIdZod.parse(candidate.chainId),\n      grant: WakeGrantObjectZod.parse(candidate.grant.body),\n      key: PublisherEncryptionKeyZod.parse(candidate.key.body),\n      publisher: NormalizedAddressZod.parse(candidate.publisher),\n      service: PublisherServiceZod.parse(candidate.service.body),\n      subscriber: NormalizedAddressZod.parse(candidate.subscriber),\n      subscription: EncryptedWakeSubscriptionZod.parse(candidate.subscription.body),\n      tupleObjectHashes: candidate.tupleObjectHashes.map(hash => HashZod.parse(hash)),\n      tupleSubject: NormalizedAddressZod.parse(candidate.tupleSubject),\n    }\n  } catch {\n    return undefined\n  }\n}\n\nfunction tupleBindingIsValid(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): boolean {\n  return isNonnegativeSafeInteger(candidate.tupleBlock)\n    && isNonnegativeSafeInteger(candidate.finalizedHead)\n    && candidate.finalizedHead >= candidate.tupleBlock\n    && parsed.tupleSubject === parsed.publisher\n    && occursExactlyOnce(parsed.tupleObjectHashes, candidate.service.objectHash)\n    && occursExactlyOnce(parsed.tupleObjectHashes, candidate.grant.objectHash)\n    && occursExactlyOnce(parsed.tupleObjectHashes, candidate.subscription.objectHash)\n}\n\nasync function bodyHashesAreValid(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): Promise<boolean> {\n  const canonicalHashes = await Promise.all([\n    handshakeObjectHash(parsed.service),\n    handshakeObjectHash(parsed.key),\n    handshakeObjectHash(parsed.grant),\n    handshakeObjectHash(parsed.subscription),\n  ])\n  return canonicalHashes[0] === candidate.service.objectHash\n    && canonicalHashes[1] === candidate.key.objectHash\n    && canonicalHashes[2] === candidate.grant.objectHash\n    && canonicalHashes[3] === candidate.subscription.objectHash\n}\n\nfunction publicBindingFailure(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): PublisherSubscriptionValidationFailureReason | undefined {\n  if (!hasMatchingHandshakeProfile(parsed.service, parsed.subscription, parsed.chainId)) return 'subscription-binding-invalid'\n  if (!hasExactGrantBinding(parsed.grant, parsed.publisher)) return 'grant-binding-invalid'\n  if (!hasExactSubscriptionBinding(candidate, parsed.subscription)) return 'subscription-binding-invalid'\n  const hashedKey = { body: parsed.key, objectHash: candidate.key.objectHash }\n  if (!hasExactKeyBinding(parsed.service, hashedKey, parsed.subscription)) return 'key-binding-invalid'\n  if (!isActiveAt(parsed.service, candidate.tupleBlock)\n    || !isActiveAt(parsed.service, candidate.finalizedHead)) return 'service-inactive'\n  if (!isActiveAt(parsed.key, candidate.tupleBlock)\n    || !isActiveAt(parsed.key, candidate.finalizedHead)) return 'key-inactive'\n  if (!expiryWithinServicePolicy(parsed.subscription, parsed.service, candidate.tupleBlock)\n    || parsed.subscription.expiresAtBlock - candidate.finalizedHead <= 2) return 'subscription-expiry-invalid'\n  return undefined\n}\n\nasync function decryptCandidate(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): Promise<PublisherSubscriptionValidationFailure | { readonly plaintext: WakeSubscriptionPlaintext }> {\n  let privateKey\n  try {\n    privateKey = await candidate.keys.getPrivateKey({\n      encryptionKey: candidate.key.objectHash,\n      keyId: parsed.key.keyId,\n      publisher: parsed.publisher,\n    })\n  } catch {\n    return rejectPublisherSubscription('key-store-unavailable')\n  }\n  if (privateKey === undefined) return rejectPublisherSubscription('private-key-not-found')\n  if (privateKey.encryptionKey !== candidate.key.objectHash || privateKey.keyId !== parsed.key.keyId) {\n    return rejectPublisherSubscription('key-binding-invalid')\n  }\n\n  try {\n    return {\n      plaintext: await decryptWakeSubscription({\n        publisherKey: privateKey,\n        subscriber: parsed.subscriber,\n        subscription: parsed.subscription,\n      }),\n    }\n  } catch {\n    return rejectPublisherSubscription('decryption-failed')\n  }\n}\n\nfunction validatedPublisherSubscription(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n  plaintext: WakeSubscriptionPlaintext,\n): ValidatedPublisherSubscription {\n  return Object.freeze({\n    context: Object.freeze({\n      chainId: parsed.chainId,\n      encryptionKey: candidate.key.objectHash,\n      eventKind: parsed.subscription.eventKind,\n      grant: candidate.grant.objectHash,\n      keyId: parsed.subscription.keyId,\n      publisher: parsed.publisher,\n      service: candidate.service.objectHash,\n      subscriber: parsed.subscriber,\n      subscription: candidate.subscription.objectHash,\n    }),\n    finalizedHead: candidate.finalizedHead,\n    grant: Object.freeze({ body: parsed.grant, objectHash: candidate.grant.objectHash }),\n    key: Object.freeze({ body: parsed.key, objectHash: candidate.key.objectHash }),\n    ok: true,\n    plaintext,\n    service: Object.freeze({ body: parsed.service, objectHash: candidate.service.objectHash }),\n    subscription: Object.freeze({ body: parsed.subscription, objectHash: candidate.subscription.objectHash }),\n    tupleBlock: candidate.tupleBlock,\n  })\n}\n\n/**\n * Validate one read-model-qualified finalized public tuple, resolve exactly\n * one dedicated private key, decrypt once, and enforce the private grant and\n * filter scope. No algorithm, key, service, or AAD fallback is attempted after\n * failure. Callers must resolve the finalized lifecycle again after challenge\n * and before publishing acceptance.\n */\nexport async function validateAndDecryptPublisherSubscription(\n  candidate: PublisherSubscriptionCandidate,\n): Promise<PublisherSubscriptionValidation> {\n  const parsed = parsePublisherSubscriptionCandidate(candidate)\n  if (parsed === undefined) return rejectPublisherSubscription('malformed-candidate')\n  if (!tupleBindingIsValid(candidate, parsed)) return rejectPublisherSubscription('tuple-binding-invalid')\n  if (!await bodyHashesAreValid(candidate, parsed)) return rejectPublisherSubscription('body-hash-mismatch')\n  const publicFailure = publicBindingFailure(candidate, parsed)\n  if (publicFailure !== undefined) return rejectPublisherSubscription(publicFailure)\n  const decrypted = await decryptCandidate(candidate, parsed)\n  if ('ok' in decrypted) return decrypted\n  if (!hasExactQueueScope(parsed.grant, decrypted.plaintext)) {\n    return rejectPublisherSubscription('grant-scope-invalid')\n  }\n  if (!filterWithinServicePolicy(parsed.service, decrypted.plaintext)) {\n    return rejectPublisherSubscription('service-limit-invalid')\n  }\n  return validatedPublisherSubscription(candidate, parsed, decrypted.plaintext)\n}\n\n/** Exact challenge tuple comparison; every context field is mandatory. */\nexport function endpointChallengeMatchesPublisherContext(\n  challenge: EndpointChallenge,\n  context: PublisherEndpointChallengeContext,\n): boolean {\n  const parsed = EndpointChallengeZod.safeParse(challenge)\n  if (!parsed.success) return false\n  return parsed.data.chainId === context.chainId\n    && parsed.data.publisher === context.publisher\n    && parsed.data.subscriber === context.subscriber\n    && parsed.data.service === context.service\n    && parsed.data.encryptionKey === context.encryptionKey\n    && parsed.data.keyId === context.keyId\n    && parsed.data.subscription === context.subscription\n    && parsed.data.grant === context.grant\n    && parsed.data.eventKind === context.eventKind\n}\n\nasync function challengeRecordMatches(\n  record: PublisherEndpointChallengeRecord,\n  challenge: EndpointChallenge,\n  challengeHash: Hash,\n  responseHash?: Hash,\n): Promise<boolean> {\n  if (record.challengeHash !== challengeHash\n    || await endpointChallengeHash(record.challenge) !== challengeHash\n    || await endpointChallengeHash(challenge) !== challengeHash) return false\n  return responseHash === undefined || record.responseHash === responseHash\n}\n\n/** Create and durably issue a fresh challenge for one validated tuple. */\nexport async function issuePublisherEndpointChallenge(\n  input: IssuePublisherEndpointChallengeApiInput,\n): Promise<IssuePublisherEndpointChallengeApiResult> {\n  const context = input.subscription.context\n  const common = {\n    ...context,\n    issuedAt: input.issuedAt,\n    ...(input.lifetimeSeconds === undefined ? {} : { lifetimeSeconds: input.lifetimeSeconds }),\n  }\n  const challenge = createEndpointChallenge(common)\n  const challengeHash = await endpointChallengeHash(challenge)\n  try {\n    const result = await input.store.issue({ challenge, challengeHash })\n    if (result.kind === 'collision') return { ok: false, reason: 'challenge-collision' }\n    if ((result.kind !== 'duplicate' && result.kind !== 'issued')\n      || !await challengeRecordMatches(result.record, challenge, challengeHash)) {\n      return { ok: false, reason: 'challenge-store-invalid' }\n    }\n    return Object.freeze({\n      challenge,\n      challengeHash,\n      disposition: result.kind,\n      ok: true,\n    })\n  } catch {\n    return { ok: false, reason: 'challenge-store-unavailable' }\n  }\n}\n\n/** Claim the one permitted outbound challenge attempt before any HTTP call. */\nexport async function beginPublisherEndpointChallengeAttempt(\n  input: BeginPublisherEndpointChallengeAttemptApiInput,\n): Promise<BeginPublisherEndpointChallengeAttemptApiResult> {\n  if (!isNonnegativeSafeInteger(input.nowSeconds)) return { kind: 'store-invalid' }\n  try {\n    const result = await input.store.beginAttempt({\n      challengeHash: HashZod.parse(input.challengeHash),\n      nowSeconds: input.nowSeconds,\n    })\n    if (!['already-attempted', 'expired', 'missing', 'started', 'verified'].includes(result.kind)) {\n      return { kind: 'store-invalid' }\n    }\n    if (result.kind !== 'missing'\n      && !await challengeRecordMatches(\n        result.record,\n        result.record.challenge,\n        HashZod.parse(input.challengeHash),\n      )) return { kind: 'store-invalid' }\n    if ((result.kind === 'started' || result.kind === 'already-attempted')\n      && result.record.state !== 'attempted') return { kind: 'store-invalid' }\n    if (result.kind === 'verified' && result.record.state !== 'verified') return { kind: 'store-invalid' }\n    return result\n  } catch {\n    return { kind: 'store-unavailable' }\n  }\n}\n\nfunction completeFailure(\n  reason: CompletePublisherEndpointChallengeFailureReason,\n): CompletePublisherEndpointChallengeFailure {\n  return Object.freeze({ ok: false, reason })\n}\n\ntype VerifiedPublisherEndpointChallengeResult = Extract<\n  CompletePublisherEndpointChallengeResult,\n  { readonly kind: 'duplicate' | 'verified' }\n>\n\nasync function validateChallengeCompletion(\n  input: CompletePublisherEndpointChallengeApiInput,\n  result: CompletePublisherEndpointChallengeResult,\n  challengeHash: Hash,\n  responseHash: Hash,\n  insideDecisionWindow: boolean,\n  proofValid: boolean,\n): Promise<CompletePublisherEndpointChallengeFailure | VerifiedPublisherEndpointChallengeResult> {\n  if (!insideDecisionWindow && result.kind !== 'duplicate') {\n    return completeFailure(result.kind === 'collision'\n      ? 'challenge-response-collision'\n      : 'challenge-expired')\n  }\n  if (!proofValid) return completeFailure('invalid-proof')\n  if (result.kind === 'missing') return completeFailure('challenge-not-found')\n  if (result.kind === 'expired') return completeFailure('challenge-expired')\n  if (result.kind === 'not-attempted') return completeFailure('challenge-not-attempted')\n  if (result.kind === 'collision') return completeFailure('challenge-response-collision')\n  if ((result.kind !== 'duplicate' && result.kind !== 'verified')\n    || !await challengeRecordMatches(result.record, input.challenge, challengeHash, responseHash)) {\n    return completeFailure('challenge-store-invalid')\n  }\n  return result\n}\n\n/**\n * Verify exact tuple context and proof in its Unix-time window, atomically\n * consume the durable challenge, then construct the exact publisher acceptance\n * object. Publishing that object attests to this in-window decision; later\n * finalization does not re-run a wall-clock check.\n */\nexport async function completePublisherEndpointChallenge(\n  input: CompletePublisherEndpointChallengeApiInput,\n): Promise<CompletePublisherEndpointChallengeApiResult> {\n  if (!endpointChallengeMatchesPublisherContext(input.challenge, input.subscription.context)) {\n    return completeFailure('challenge-context-invalid')\n  }\n  if (!isNonnegativeSafeInteger(input.nowSeconds)) return completeFailure('challenge-expired')\n  const insideDecisionWindow = input.challenge.issuedAt <= input.nowSeconds\n    && input.nowSeconds < input.challenge.expiresAt\n  const proofInput = {\n    challenge: input.challenge,\n    response: input.response,\n    secret: input.subscription.plaintext.challenge.secret,\n  }\n  const proofValid = insideDecisionWindow\n    ? await verifyEndpointChallengeResponse({ ...proofInput, nowSeconds: input.nowSeconds })\n    : await verifyEndpointChallengeProof(proofInput)\n  if (insideDecisionWindow && !proofValid) return completeFailure('invalid-proof')\n\n  const [challengeHash, responseHash] = await Promise.all([\n    endpointChallengeHash(input.challenge),\n    handshakeObjectHash(input.response),\n  ])\n  try {\n    const result = await input.store.completeVerified({\n      challengeHash,\n      nowSeconds: input.nowSeconds,\n      responseHash,\n    })\n    const completion = await validateChallengeCompletion(\n      input,\n      result,\n      challengeHash,\n      responseHash,\n      insideDecisionWindow,\n      proofValid,\n    )\n    if ('ok' in completion) return completion\n\n    const acceptance = createWakeSubscriptionAcceptance({\n      challenge: challengeHash,\n      encryptionKey: input.subscription.context.encryptionKey,\n      grant: input.subscription.context.grant,\n      response: responseHash,\n      service: input.subscription.context.service,\n      subscription: input.subscription.context.subscription,\n    })\n    return Object.freeze({\n      acceptance,\n      acceptanceHash: await handshakeObjectHash(acceptance),\n      challengeHash,\n      disposition: completion.kind,\n      ok: true,\n      responseHash,\n    })\n  } catch {\n    return completeFailure('challenge-store-unavailable')\n  }\n}\n\nfunction filterWithinServicePolicy(service: PublisherService, plaintext: WakeSubscriptionPlaintext): boolean {\n  const filter = plaintext.filter\n  return filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake\n    && service.events.some(event => wakeSourcesEqual(event.source, filter.source))\n}\n", "import type {\n  Hash,\n  SourceWakeSubscriptionFilter,\n  WakeSource,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  SourceWakeSubscriptionFilterZod,\n  WakeSourceSchema,\n  WakeSourceZod,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  asSchema,\n  PayloadBuilder,\n} from '@xyo-network/sdk'\n\nimport { canonicalJson } from './canonicalJson.ts'\n\n/** Canonical identity includes the source kind and its entire pinned identity. */\nexport async function wakeSourceHash(source: WakeSource): Promise<Hash> {\n  return await PayloadBuilder.dataHash({ schema: WakeSourceSchema, ...WakeSourceZod.parse(source) })\n}\n\nexport function wakeSourcesEqual(left: WakeSource, right: WakeSource): boolean {\n  return canonicalJson(WakeSourceZod.parse(left)) === canonicalJson(WakeSourceZod.parse(right))\n}\n\nexport async function sourceWakeFilterHash(filter: SourceWakeSubscriptionFilter): Promise<Hash> {\n  const parsed = SourceWakeSubscriptionFilterZod.parse(filter)\n  return await PayloadBuilder.dataHash({ ...parsed, schema: asSchema(parsed.schema, true) })\n}\n", "import {\n  ChainIdZod,\n  DeploymentIdZod,\n  HashZod,\n  NonnegativeJsonSafeIntegerZod,\n  NormalizedAddressZod,\n  PositiveJsonSafeIntegerZod,\n} from '@xyo-network/event-kit-schemas'\nimport { z } from 'zod'\n\nimport type { WakeGrantAuthorizationRequest } from './admissionTypes.ts'\n\n/** Exact, active, finalized D-005 tuple; source time never substitutes for atBlock. */\nexport const SourceWakeSubscriptionActivationZod = z.strictObject({\n  atBlock: NonnegativeJsonSafeIntegerZod,\n  activeFromBlock: NonnegativeJsonSafeIntegerZod,\n  expiresAtBlock: PositiveJsonSafeIntegerZod,\n  authorizationChainId: ChainIdZod,\n  controller: NormalizedAddressZod,\n  publisher: NormalizedAddressZod,\n  deploymentId: DeploymentIdZod,\n  queueId: z.string().min(1).max(255).optional(),\n  sourceHash: HashZod,\n  filterHash: HashZod,\n  subscriptionHash: HashZod,\n  serviceHash: HashZod,\n  grantHash: HashZod,\n}).refine(\n  value => value.activeFromBlock <= value.atBlock && value.atBlock < value.expiresAtBlock,\n  'Subscription must be active at the exact finalized authorization snapshot',\n)\nexport type SourceWakeSubscriptionActivation = z.infer<typeof SourceWakeSubscriptionActivationZod>\n\nexport interface SourceWakeSubscriptionActivationReader {\n  /** Undefined means no matching active subscription; never fabricate activation from a grant alone. */\n  readonly read: (request: WakeGrantAuthorizationRequest) => Promise<SourceWakeSubscriptionActivation | undefined>\n}\n", "import type {\n  ChainId,\n  WakeSource,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  ChainIdZod,\n  WakeSourceZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  WakeGrantAuthorizationDecision,\n  WakeGrantAuthorizationRequest,\n  WakeGrantAuthorizer,\n} from './admissionTypes.ts'\nimport { createDeploymentGrantAuthorizer } from './grantEvidence.ts'\nimport type { SourceWakeSubscriptionActivationReader } from './sourceWakeActivation.ts'\nimport { SourceWakeSubscriptionActivationZod } from './sourceWakeActivation.ts'\nimport { wakeSourceHash } from './sourceWakeIdentity.ts'\nimport type { StatementGraphGrantReadModel } from './statementGraphPorts.ts'\n\nexport interface StatementGraphWakeGrantAuthorizerOptions {\n  readonly activation: SourceWakeSubscriptionActivationReader\n  /** Independently pinned network session identity, never copied from a request. */\n  readonly authorizationChainId: ChainId\n  readonly source: WakeSource\n  readonly viewer: StatementGraphGrantReadModel\n}\n\n/**\n * Existing grants authorize deployment/queue. The accepted subscription and\n * immutable receiver binding narrow the permitted source without relabeling\n * another chain's Statement Graph as authorization evidence.\n */\nexport function createStatementGraphWakeGrantAuthorizer(\n  options: StatementGraphWakeGrantAuthorizerOptions,\n): WakeGrantAuthorizer {\n  const authorizationChainId = ChainIdZod.parse(options.authorizationChainId)\n  const source = WakeSourceZod.parse(options.source)\n  const grants = createDeploymentGrantAuthorizer({ viewer: options.viewer })\n  return Object.freeze({\n    async authorizePublisher(request: WakeGrantAuthorizationRequest): Promise<WakeGrantAuthorizationDecision> {\n      const sourceHash = await wakeSourceHash(source)\n      if (request.authorizationChainId !== authorizationChainId || request.sourceHash !== sourceHash) {\n        throw new TypeError('Grant request does not match the independently pinned authorization chain and source')\n      }\n      const read = await options.activation.read(request)\n      if (read === undefined) return { enabled: false, atBlock: request.expectedHead }\n      const activation = SourceWakeSubscriptionActivationZod.parse(read)\n      if (activation.atBlock !== request.expectedHead\n        || activation.authorizationChainId !== authorizationChainId\n        || activation.sourceHash !== sourceHash\n        || activation.filterHash !== request.filterHash\n        || activation.subscriptionHash !== request.subscriptionHash\n        || activation.controller !== request.controller\n        || activation.publisher !== request.publisher\n        || activation.deploymentId !== request.deploymentId\n        || activation.queueId !== request.queueId) {\n        throw new TypeError('Finalized subscription activation does not match the exact admission binding')\n      }\n      const decision = await grants.authorizePublisher({ ...request, exactGrantHash: activation.grantHash })\n      if (decision.atBlock !== activation.atBlock) {\n        throw new TypeError('Grant and active subscription snapshots do not identify the same finalized authorization head')\n      }\n      return decision.enabled\n        ? Object.freeze({\n            ...decision,\n            grant: Object.freeze({\n              ...decision.grant,\n              authorizationChainId,\n              sourceHash,\n              filterHash: activation.filterHash,\n              subscriptionHash: activation.subscriptionHash,\n            }),\n          })\n        : decision\n    },\n  })\n}\n", "import type { WakeGrantObject } from '@xyo-network/event-kit-schemas'\nimport {\n  asWakeGrantObject,\n  asWakeGrantRevocation,\n  DeploymentIdZod,\n  HashZod,\n  NormalizedAddressZod,\n  WakeGrantObjectSchema,\n  WakeGrantRevocationSchema,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  WakeGrantAuthorizationDecision,\n  WakeGrantAuthorizationRequest,\n  WakeGrantAuthorizer,\n  WakeGrantEvidence,\n} from './admissionTypes.ts'\nimport type {\n  StatementGrantClaim,\n  StatementGraphGrantReadModel,\n} from './statementGraphPorts.ts'\n\nexport interface DeploymentGrantAuthorizerOptions {\n  readonly viewer: StatementGraphGrantReadModel\n}\n\n/**\n * Adapts a canonical Statement Graph v2 read model to the evidence-bearing\n * D-002 grant authorization port. Each decision is bound to one stable head.\n *\n * v2 is append-only with no lifecycle `state`, so this layer owns two things\n * the protocol used to:\n *\n * - **Aboutness.** The requested publisher must match both the Claim's\n *   `subject` and the grant object's `publisher` field.\n * - **Negation.** A grant is disabled by a further claim, by the *same pinned\n *   controller*, of a revocation object referencing that grant's hash.\n *   Revocations from any other source are ignored.\n */\nexport function createDeploymentGrantAuthorizer(\n  options: DeploymentGrantAuthorizerOptions,\n): WakeGrantAuthorizer {\n  const { viewer } = options\n\n  return Object.freeze({\n    async authorizePublisher(request: WakeGrantAuthorizationRequest): Promise<WakeGrantAuthorizationDecision> {\n      assertValidRequest(request)\n\n      const atBlock = await readHead(viewer)\n      if (atBlock > request.expectedHead) {\n        throw new Error(`Statement Graph head ${atBlock} is ahead of expected head ${request.expectedHead}`)\n      }\n\n      const claims = await viewer.claims(request.controller, {\n        declaredObjectSchemaPrefix: WakeGrantObjectSchema,\n        ...(request.exactGrantHash === undefined ? {} : { objectHash: request.exactGrantHash }),\n        subject: request.publisher,\n      })\n      const revokedGrantHashes = await readRevocations(viewer, request.controller, request.publisher, atBlock)\n\n      let evidence: WakeGrantEvidence | undefined\n      for (const claim of claims) {\n        evidence = await resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes)\n        if (evidence !== undefined) break\n      }\n\n      const completedAtBlock = await readHead(viewer)\n      if (completedAtBlock !== atBlock) {\n        throw new Error(`Statement Graph head changed during authorization [${atBlock} -> ${completedAtBlock}]`)\n      }\n\n      const lag = request.expectedHead - atBlock\n      if (evidence === undefined) {\n        return Object.freeze({\n          atBlock,\n          enabled: false,\n          expectedHead: request.expectedHead,\n          lag,\n        })\n      }\n      return Object.freeze({\n        atBlock,\n        enabled: true,\n        expectedHead: request.expectedHead,\n        grant: evidence,\n        lag,\n      })\n    },\n  })\n}\n\n/**\n * Collects the grant hashes the pinned controller has negated at or before\n * `atBlock`. A revocation claimed after the evaluated snapshot is not yet in\n * effect, matching how a grant claimed after the snapshot does not yet enable.\n */\nasync function readRevocations(\n  viewer: StatementGraphGrantReadModel,\n  controller: string,\n  subject: string,\n  atBlock: number,\n): Promise<ReadonlySet<string>> {\n  const revoked = new Set<string>()\n  const claims = await viewer.claims(controller, {\n    declaredObjectSchemaPrefix: WakeGrantRevocationSchema,\n    subject,\n  })\n\n  for (const claim of claims) {\n    if (!isLiveClaim(claim, controller, subject, WakeGrantRevocationSchema, atBlock)) continue\n    const object = await viewer.object(claim.objectHash)\n    if (object?.assurance !== 'resolved') continue\n    if (object.declaredSchema !== WakeGrantRevocationSchema || object.objectHash !== claim.objectHash) continue\n    if (!isRecord(object.params) || Object.hasOwn(object.params, 'schema')) continue\n    const revocation = asWakeGrantRevocation({ ...object.params, schema: object.declaredSchema })\n    if (revocation !== undefined) revoked.add(revocation.grant)\n  }\n  return revoked\n}\n\nasync function resolveEvidence(\n  viewer: StatementGraphGrantReadModel,\n  claim: StatementGrantClaim,\n  request: WakeGrantAuthorizationRequest,\n  atBlock: number,\n  revokedGrantHashes: ReadonlySet<string>,\n): Promise<WakeGrantEvidence | undefined> {\n  if (!isLiveClaim(claim, request.controller, request.publisher, WakeGrantObjectSchema, atBlock)) return undefined\n  if (revokedGrantHashes.has(claim.objectHash)) return undefined\n  if (request.exactGrantHash !== undefined && claim.objectHash !== request.exactGrantHash) return undefined\n\n  const object = await viewer.object(claim.objectHash)\n  const grant = parseExactGrantObject(object, claim.objectHash)\n  if (grant === undefined) return undefined\n  if (grant.publisher !== request.publisher) return undefined\n  if (grant.deploymentId !== request.deploymentId) return undefined\n  if (grant.queueId !== request.queueId) return undefined\n  if (!grant.permissions.includes('enqueue')) return undefined\n\n  return Object.freeze({\n    assertedAtBlock: claim.firstBlock,\n    authorizationChainId: request.authorizationChainId,\n    sourceHash: request.sourceHash,\n    filterHash: request.filterHash,\n    subscriptionHash: request.subscriptionHash,\n    controller: request.controller,\n    deploymentId: grant.deploymentId,\n    id: claim.firstEventHash,\n    ...(request.exactGrantHash === undefined ? {} : { objectHash: claim.objectHash }),\n    ...(grant.queueId === undefined ? {} : { queueId: grant.queueId }),\n    target: grant.publisher,\n  })\n}\n\nfunction isLiveClaim(\n  claim: StatementGrantClaim,\n  controller: string,\n  subject: string,\n  declaredObjectSchema: string,\n  atBlock: number,\n): boolean {\n  if (claim.source !== controller) return false\n  if (claim.subject !== subject) return false\n  if (claim.declaredObjectSchema !== declaredObjectSchema) return false\n  if (!isNonnegativeSafeInteger(claim.firstBlock) || claim.firstBlock > atBlock) return false\n  if (!isNonnegativeSafeInteger(claim.lastBlock) || claim.lastBlock < claim.firstBlock) return false\n  if (!HashZod.safeParse(claim.firstEventHash).success) return false\n  return HashZod.safeParse(claim.objectHash).success\n}\n\nfunction parseExactGrantObject(\n  object: Awaited<ReturnType<StatementGraphGrantReadModel['object']>>,\n  expectedObjectHash: string,\n): WakeGrantObject | undefined {\n  if (object?.assurance !== 'resolved') return undefined\n  if (object.declaredSchema !== WakeGrantObjectSchema || object.objectHash !== expectedObjectHash) return undefined\n  if (!isRecord(object.params) || Object.hasOwn(object.params, 'schema')) return undefined\n  return asWakeGrantObject({\n    ...object.params,\n    schema: object.declaredSchema,\n  })\n}\n\nfunction assertValidRequest(request: WakeGrantAuthorizationRequest): void {\n  if (request.exactGrantHash !== undefined && !HashZod.safeParse(request.exactGrantHash).success) {\n    throw new TypeError('Exact grant hash must be canonical lowercase hexadecimal')\n  }\n  if (!NormalizedAddressZod.safeParse(request.controller).success) {\n    throw new TypeError('Grant controller must be a normalized address')\n  }\n  if (!NormalizedAddressZod.safeParse(request.publisher).success) {\n    throw new TypeError('Grant publisher must be a normalized address')\n  }\n  if (!DeploymentIdZod.safeParse(request.deploymentId).success) {\n    throw new TypeError('Grant deploymentId must contain 1 to 255 characters')\n  }\n  if (request.queueId !== undefined && (request.queueId.length === 0 || request.queueId.length > 255)) {\n    throw new TypeError('Grant queueId must contain 1 to 255 characters when configured')\n  }\n  if (!isNonnegativeSafeInteger(request.expectedHead)) {\n    throw new RangeError('Grant expectedHead must be a nonnegative safe integer')\n  }\n}\n\nasync function readHead(viewer: StatementGraphGrantReadModel): Promise<number> {\n  const head = await viewer.head()\n  if (!isNonnegativeSafeInteger(head)) {\n    throw new RangeError('Statement Graph head must be a nonnegative safe integer')\n  }\n  return head\n}\n\nfunction isNonnegativeSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n", "import type {\n  Hash,\n  NormalizedAddress,\n  WakeEnvelope,\n  WakeJwtHeader,\n  WakeJwtId,\n  WakeJwtPayload,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  ChainIdZod,\n  DeploymentIdZod,\n  HashZod,\n  MAX_POSITIONS_PER_SUBSCRIPTION_WAKE,\n  NonnegativeJsonSafeIntegerZod,\n  NormalizedAddressZod,\n  PositiveJsonSafeIntegerZod,\n  SOURCE_WAKE_FILTER_PROFILE,\n  WakeEnvelopeZod,\n  WakeJwtAudienceZod,\n  WakeJwtHeaderZod,\n  WakeJwtPayloadZod,\n  WakeJwtSchema,\n  WakeSourceZod,\n} from '@xyo-network/event-kit-schemas'\nimport type {\n  JwtHeader,\n  JwtPayload,\n} from '@xyo-network/sdk'\nimport {\n  Account,\n  PayloadBuilder,\n} from '@xyo-network/sdk'\nimport { z } from 'zod'\n\nimport {\n  sourceWakeFilterHash,\n  wakeSourceHash,\n  wakeSourcesEqual,\n} from './sourceWakeIdentity.ts'\nimport type { VerifiedAdmissionWake } from './verifiedAdmissionWake.ts'\n\n/** D-002 maximum accepted JWT lifetime. */\nexport const EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300\n/** D-002 maximum accepted publisher clock lead. */\nexport const EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60\n\nexport const WakeAdmissionRouteZod = z.strictObject({\n  audience: WakeJwtAudienceZod,\n  authorizationChainId: ChainIdZod,\n  controller: NormalizedAddressZod,\n  deploymentId: DeploymentIdZod,\n  queueId: z.string().min(1).max(255).optional(),\n  source: WakeSourceZod,\n  filterHash: HashZod,\n  subscriptionHash: HashZod,\n  fromPosition: NonnegativeJsonSafeIntegerZod,\n  maxPositionsPerWake: PositiveJsonSafeIntegerZod.max(MAX_POSITIONS_PER_SUBSCRIPTION_WAKE),\n  maxGrantLagBlocks: NonnegativeJsonSafeIntegerZod,\n})\nexport type WakeAdmissionRoute = z.infer<typeof WakeAdmissionRouteZod>\n\nexport type VerifyWakeRequestRejectionReason\n  = | 'configuration-invalid'\n    | 'event-hash-failed'\n    | 'event-hash-mismatch'\n    | 'event-malformed'\n    | 'event-target-mismatch'\n    | 'range-invalid'\n    | 'range-too-large'\n    | 'wake-id-invalid'\n    | 'jwt-audience-mismatch'\n    | 'jwt-claims-invalid'\n    | 'jwt-expired'\n    | 'jwt-future-iat'\n    | 'jwt-header-invalid'\n    | 'jwt-identity-invalid'\n    | 'jwt-invalid'\n    | 'jwt-lifetime-invalid'\n    | 'jwt-malformed'\n    | 'jwt-nbf-not-allowed'\n    | 'jwt-schema-mismatch'\n    | 'event-source-mismatch'\n    | 'event-authorization-chain-mismatch'\n    | 'event-filter-mismatch'\n    | 'range-before-floor'\n\nexport interface VerifiedWakeRequest extends VerifiedAdmissionWake {\n  readonly deploymentId: string\n  readonly event: WakeEnvelope\n  readonly fromPosition: number\n  readonly issuedAt: number\n  readonly queueId?: string\n  readonly route: WakeAdmissionRoute & { readonly sourceHash: Hash }\n  readonly toPosition: number\n  readonly tokenIssuedAt: number\n}\n\nexport interface VerifyWakeRequestInput {\n  readonly body: unknown\n  readonly jwt: string\n  readonly nowSeconds: number\n  readonly route: WakeAdmissionRoute\n}\n\nexport interface VerifyWakeRequestSuccess {\n  readonly ok: true\n  readonly verified: VerifiedWakeRequest\n}\n\nexport interface VerifyWakeRequestFailure {\n  readonly details?: readonly string[]\n  readonly ok: false\n  readonly reason: VerifyWakeRequestRejectionReason\n}\n\nexport type VerifyWakeRequestResult = VerifyWakeRequestFailure | VerifyWakeRequestSuccess\n\ninterface VerifiedJwtProfile {\n  readonly eventHash: Hash\n  readonly expiresAt: number\n  readonly issuedAt: number\n  readonly jwtId: WakeJwtId\n  readonly publisher: NormalizedAddress\n}\n\ntype JwtProfileResult = VerifyWakeRequestFailure | {\n  readonly jwt: VerifiedJwtProfile\n  readonly ok: true\n}\n\ntype StrictJwtWireResult = VerifyWakeRequestFailure | {\n  readonly header: WakeJwtHeader\n  readonly ok: true\n  readonly payload: WakeJwtPayload\n}\n\n/** Source-aware strict Payload verification, reusing the exact D-002 JWT verifier. */\nexport async function verifyWakeRequest(input: VerifyWakeRequestInput): Promise<VerifyWakeRequestResult> {\n  const routeResult = WakeAdmissionRouteZod.safeParse(input.route)\n  if (!routeResult.success || !NonnegativeJsonSafeIntegerZod.safeParse(input.nowSeconds).success) {\n    return { ok: false, reason: 'configuration-invalid' }\n  }\n  const eventResult = WakeEnvelopeZod.safeParse(input.body)\n  if (!eventResult.success) return malformedWake(input.body, eventResult.error.issues)\n  const route = routeResult.data\n  if (route.filterHash !== await sourceWakeFilterHash({\n    schema: SOURCE_WAKE_FILTER_PROFILE,\n    source: route.source,\n    fromPosition: route.fromPosition,\n    maxPositionsPerWake: route.maxPositionsPerWake,\n  })) return { ok: false, reason: 'configuration-invalid' }\n  const event = Object.freeze({ ...eventResult.data, source: Object.freeze(eventResult.data.source) })\n  if (event.authorizationChainId !== route.authorizationChainId) {\n    return { ok: false, reason: 'event-authorization-chain-mismatch' }\n  }\n  if (!wakeSourcesEqual(event.source, route.source)) return { ok: false, reason: 'event-source-mismatch' }\n  if (event.filterHash !== route.filterHash) return { ok: false, reason: 'event-filter-mismatch' }\n  if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {\n    return { ok: false, reason: 'event-target-mismatch' }\n  }\n  if (event.fromPosition < route.fromPosition) return { ok: false, reason: 'range-before-floor' }\n  if (event.toPosition - event.fromPosition >= route.maxPositionsPerWake) return { ok: false, reason: 'range-too-large' }\n\n  const jwt = await verifyJwtProfile(input.jwt, route.audience, input.nowSeconds)\n  if (!jwt.ok) return jwt\n  let eventHash: Hash\n  try {\n    eventHash = await PayloadBuilder.dataHash(event)\n  } catch {\n    return { ok: false, reason: 'event-hash-failed' }\n  }\n  if (eventHash !== jwt.jwt.eventHash) return { ok: false, reason: 'event-hash-mismatch' }\n  const sourceHash = await wakeSourceHash(route.source)\n  return Object.freeze({\n    ok: true,\n    verified: Object.freeze({\n      audience: route.audience,\n      deploymentId: event.deploymentId,\n      event,\n      eventHash,\n      expiresAt: jwt.jwt.expiresAt,\n      fromPosition: event.fromPosition,\n      issuedAt: event.issuedAt,\n      jwtId: jwt.jwt.jwtId,\n      publisher: jwt.jwt.publisher,\n      ...(event.queueId === undefined ? {} : { queueId: event.queueId }),\n      route: Object.freeze({\n        ...route, source: Object.freeze(route.source), sourceHash,\n      }),\n      toPosition: event.toPosition,\n      tokenIssuedAt: jwt.jwt.issuedAt,\n      wakeId: event.wakeId,\n    }),\n  })\n}\n\nasync function verifyJwtProfile(token: string, audience: string, nowSeconds: number): Promise<JwtProfileResult> {\n  let verified: Awaited<ReturnType<typeof Account.verifyJwt>>\n  try {\n    verified = await Account.verifyJwt(token, { audience, now: nowSeconds })\n  } catch (error) {\n    return reject('jwt-malformed', [errorMessage(error)])\n  }\n\n  if (!verified.ok) {\n    if (Object.hasOwn(verified.payload ?? {}, 'nbf')) return reject('jwt-nbf-not-allowed')\n    return reject(classifySdkJwtFailure(verified.reasons), verified.reasons)\n  }\n\n  const wireResult = parseStrictJwtWire(verified.header, verified.payload, audience)\n  if (!wireResult.ok) return wireResult\n\n  const { header: strictHeader, payload: strictPayload } = wireResult\n  if (strictHeader.kid !== strictPayload.iss) return reject('jwt-identity-invalid')\n  if (strictPayload.exp <= nowSeconds) return reject('jwt-expired')\n  if (strictPayload.exp - strictPayload.iat > EVENT_KIT_MAX_JWT_LIFETIME_SECONDS) return reject('jwt-lifetime-invalid')\n  if (strictPayload.iat - nowSeconds > EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return reject('jwt-future-iat')\n\n  const jwt: VerifiedJwtProfile = Object.freeze({\n    eventHash: strictPayload.eventHash,\n    expiresAt: strictPayload.exp,\n    issuedAt: strictPayload.iat,\n    jwtId: strictPayload.jti,\n    publisher: strictPayload.iss,\n  })\n  return Object.freeze({ jwt, ok: true })\n}\n\nfunction parseStrictJwtWire(header: JwtHeader, payload: JwtPayload, audience: string): StrictJwtWireResult {\n  const headerResult = WakeJwtHeaderZod.safeParse(header)\n  if (!headerResult.success) {\n    if (!NormalizedAddressZod.safeParse(header.kid).success) return reject('jwt-identity-invalid')\n    return reject('jwt-header-invalid', zodDetails(headerResult.error.issues))\n  }\n  if (Object.hasOwn(payload, 'nbf')) return reject('jwt-nbf-not-allowed')\n  if (!NormalizedAddressZod.safeParse(payload.iss).success) return reject('jwt-identity-invalid')\n  if (payload.schema !== WakeJwtSchema) return reject('jwt-schema-mismatch')\n  if (payload.aud !== audience) return reject('jwt-audience-mismatch')\n  if (!isNonnegativeSafeInteger(payload.iat) || !isNonnegativeSafeInteger(payload.exp) || payload.exp <= payload.iat) {\n    return reject('jwt-lifetime-invalid')\n  }\n\n  const payloadResult = WakeJwtPayloadZod.safeParse(payload)\n  if (!payloadResult.success) return reject('jwt-claims-invalid', zodDetails(payloadResult.error.issues))\n  return Object.freeze({\n    header: headerResult.data,\n    ok: true,\n    payload: payloadResult.data,\n  })\n}\n\nfunction classifySdkJwtFailure(reasons: readonly string[]): VerifyWakeRequestRejectionReason {\n  if (reasons.some(reason => reason.startsWith('audience mismatch:'))) return 'jwt-audience-mismatch'\n  if (reasons.some(reason => reason.startsWith('expired:'))) return 'jwt-expired'\n  if (reasons.some(reason => reason.startsWith('unsupported alg:') || reason.startsWith('unsupported typ:'))) {\n    return 'jwt-header-invalid'\n  }\n  if (reasons.some(reason => (\n    reason.startsWith('invalid public key:')\n    || reason.startsWith('public key does not derive to kid:')\n    || reason === 'header.kid does not match payload.iss'\n  ))) {\n    return 'jwt-identity-invalid'\n  }\n  return 'jwt-invalid'\n}\n\nfunction malformedWake(\n  body: unknown,\n  issues: readonly { readonly message: string; readonly path: readonly PropertyKey[] }[],\n): VerifyWakeRequestFailure {\n  const details = zodDetails(issues)\n  if (hasInvertedSafeRange(body)) return reject('range-invalid', details)\n  if (isRecord(body) && Object.hasOwn(body, 'wakeId')\n    && issues.some(issue => issue.path[0] === 'wakeId')) return reject('wake-id-invalid', details)\n  return reject('event-malformed', details)\n}\n\nfunction hasInvertedSafeRange(value: unknown): boolean {\n  if (!isRecord(value)) return false\n  const { fromPosition, toPosition } = value\n  return typeof fromPosition === 'number'\n    && typeof toPosition === 'number'\n    && isNonnegativeSafeInteger(fromPosition)\n    && isNonnegativeSafeInteger(toPosition)\n    && fromPosition > toPosition\n}\n\nfunction isNonnegativeSafeInteger(value: number): boolean {\n  return Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction zodDetails(issues: readonly { readonly message: string; readonly path: readonly PropertyKey[] }[]): readonly string[] {\n  return issues.map((issue) => {\n    const path = issue.path.map(String).join('.') || '<root>'\n    return `${path}: ${issue.message}`\n  })\n}\n\nfunction reject(\n  reason: VerifyWakeRequestRejectionReason,\n  details?: readonly string[],\n): VerifyWakeRequestFailure {\n  if (details === undefined) return Object.freeze({ ok: false, reason })\n  return Object.freeze({\n    details: Object.freeze([...details]),\n    ok: false,\n    reason,\n  })\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n", "import type { AdmittedWake } from './types.ts'\n\n/**\n * One wake leased to exactly one consumer.\n *\n * The lease is held until `ack` or `release`. A consumer that dies holding it\n * leaves the entry recoverable rather than lost, which is why the queue port is\n * lease-based rather than push-based: a fire-and-forget handoff has no way to\n * reclaim work whose consumer never finished.\n */\nexport interface LeasedWake<TWake = AdmittedWake> {\n  /** Removes the entry permanently. Call only once the handler committed. */\n  readonly ack: () => Promise<void>\n  /** Returns the entry for another attempt. */\n  readonly release: () => Promise<void>\n  readonly wake: TWake\n}\n\n/**\n * Provider-agnostic durable wake queue.\n *\n * Implementations back this with a filesystem directory, SQLite, Postgres, or a\n * cloud queue. Delivery is at-least-once: a consumer MUST be idempotent, since\n * a lease that is never acked is redelivered.\n *\n * Every implementation must satisfy the shared conformance suite in\n * `@xyo-network/event-kit-testing`.\n */\nexport interface WakeQueue<TWake = AdmittedWake> {\n  /** Durably appends a wake. Resolves only once the entry survives a crash. */\n  append: (wake: TWake) => Promise<void>\n  /** Leases the next pending entry, or `undefined` when none remain. */\n  claim: () => Promise<LeasedWake<TWake> | undefined>\n  /** Entries waiting to be claimed. Excludes leases already held. */\n  pendingCount: () => Promise<number>\n  /**\n   * Returns every in-flight entry to pending and reports how many moved.\n   * Run at startup: entries held by a process that died are otherwise stranded.\n   */\n  recoverInflight: () => Promise<number>\n}\n\nexport type WakeHandler<TWake = AdmittedWake> = (wake: TWake) => Promise<void> | void\n\n/**\n * Drains the queue serially until empty, acking each wake the handler accepts.\n *\n * A handler that throws releases its lease, so the wake is retried rather than\n * dropped, and the error propagates. Push-style consumption composes over the\n * lease port; the reverse does not.\n */\nexport async function drainQueue<TWake = AdmittedWake>(queue: WakeQueue<TWake>, handler: WakeHandler<TWake>): Promise<number> {\n  let handled = 0\n  for (;;) {\n    const leased = await queue.claim()\n    if (leased === undefined) return handled\n\n    try {\n      await handler(leased.wake)\n    } catch (error) {\n      await leased.release()\n      throw error\n    }\n    await leased.ack()\n    handled += 1\n  }\n}\n"],
-  "mappings": ";AAaO,IAAM,0CAA0C;;;ACsCvD,eAAsB,kBAAyB,OAAyE;AACtH,QAAM,gBAAgB,cAAc,MAAM,QAAQ;AAClD,MAAI,CAAC,cAAc,GAAI,QAAO,cAAc;AAC5C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,EAAE,KAAK,IAAI;AAEjB,QAAM,QAAQ,MAAM,oBAAoB,MAAM,OAAO,SAAS,IAAI;AAClE,MAAI,CAAC,MAAM,QAAS,QAAO,MAAM;AAEjC,MAAI,CAAC,yBAAyB,MAAM,YAAY,GAAG;AACjD,WAAO,OAAO,sBAAsB,CAAC,iDAAiD,CAAC;AAAA,EACzF;AAEA,QAAM,gBAAgB,MAAM,UAAU,KAAK;AAC3C,MAAI,CAAC,cAAc,GAAI,QAAO,cAAc;AAC5C,SAAO,MAAM,qBAAqB,MAAM,OAAO,SAAS,cAAc,OAAO,IAAI;AACnF;AASA,eAAe,oBACb,OACA,SACA,MACoC;AACpC,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,MAAM,eAAe,OAAO;AAAA,EACjD,SAAS,OAAO;AACd,WAAO,UAAU,OAAO,qBAAqB,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC;AAAA,EACrE;AAEA,MAAI,CAAC,SAAS,UAAU,KAAK,OAAO,WAAW,SAAS,UAAU;AAChE,WAAO,UAAU,OAAO,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;AAAA,EAChG;AACA,MAAI,WAAW,SAAS,sBAAsB,WAAW,SAAS,qBAAqB;AACrF,WAAO,UAAU,OAAO,WAAW,IAAI,CAAC;AAAA,EAC1C;AACA,MAAI,WAAW,SAAS,aAAa;AACnC,UAAM,iBAAiB,gBAAgB,WAAW,SAAS,OAAO;AAClE,WAAO,UAAU,kBACZ,QAAQ,aAAa,gBAAgB,WAAW,OAAO,GAAG,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,WAAW,SAAS,OAAO;AAC7B,WAAO,UAAU,OAAO,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;AAAA,EAChG;AACA,SAAO,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACxC;AAEA,eAAe,qBACb,OACA,SACA,OACA,MACuC;AACvC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,MAAM,iBAAiB;AAAA,MACvC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,OAAO,qBAAqB,CAAC,aAAa,KAAK,CAAC,CAAC;AAAA,EAC1D;AAEA,MAAI,CAAC,SAAS,SAAS,KAAK,OAAO,UAAU,SAAS,UAAU;AAC9D,WAAO,OAAO,qBAAqB,CAAC,yCAAyC,CAAC;AAAA,EAChF;AACA,MAAI,UAAU,SAAS,sBAAsB,UAAU,SAAS,qBAAqB;AACnF,WAAO,OAAO,UAAU,IAAI;AAAA,EAC9B;AACA,MAAI,UAAU,SAAS,eAAe,UAAU,SAAS,YAAY;AACnE,WAAO,OAAO,qBAAqB,CAAC,yCAAyC,CAAC;AAAA,EAChF;AAEA,QAAM,iBAAiB,gBAAgB,UAAU,SAAS,OAAO;AACjE,MAAI,mBAAmB,OAAW,QAAO;AACzC,SAAO,QAAQ,UAAU,MAAM,gBAAgB,UAAU,OAAO,GAAG,IAAI;AACzE;AAEA,SAAS,UAAiB,QAAiE;AACzF,SAAO,OAAO,OAAO,EAAE,SAAS,OAAO,OAAO,CAAC;AACjD;AAUA,SAAS,cAAc,UAAgD;AACrE,MAAI,SAAS,YAAY,OAAO,mBAAmB,yCAAyC;AAC1F,WAAO;AAAA,MACL,SAAS,OAAO,qBAAqB,CAAC,sEAAsE,CAAC;AAAA,MAC7G,IAAI;AAAA,IACN;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,OAAO,OAAO;AAAA,MACrB,UAAU,SAAS;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,OAAO,SAAS;AAAA,MAChB,WAAW,SAAS;AAAA,MACpB,gBAAgB,SAAS,YAAY;AAAA,MACrC,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,IACD,IAAI;AAAA,EACN;AACF;AAUA,eAAe,UACb,OAC8B;AAC9B,QAAM,EAAE,MAAM,IAAI,MAAM;AACxB,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,MAAM,OAAO,mBAAmB;AAAA,MAC/C,YAAY,MAAM;AAAA,MAClB,sBAAsB,MAAM;AAAA,MAC5B,YAAY,MAAM;AAAA,MAClB,YAAY,MAAM;AAAA,MAClB,kBAAkB,MAAM;AAAA,MACxB,cAAc,MAAM;AAAA,MACpB,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM,SAAS;AAAA,MAC1B,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,EAAE,SAAS,OAAO,qBAAqB,CAAC,aAAa,KAAK,CAAC,CAAC,GAAG,IAAI,MAAM;AAAA,EAClF;AAEA,QAAM,cAAc,kBAAkB,UAAU,MAAM,cAAc,MAAM,iBAAiB;AAC3F,MAAI,gBAAgB,OAAW,QAAO,EAAE,SAAS,aAAa,IAAI,MAAM;AACxE,MAAI,CAAC,SAAS,QAAS,QAAO,EAAE,SAAS,OAAO,eAAe,GAAG,IAAI,MAAM;AAE5E,QAAM,kBAAkB,sBAAsB,SAAS,OAAO,MAAM,UAAU,SAAS,OAAO;AAC9F,MAAI,oBAAoB,OAAW,QAAO,EAAE,SAAS,iBAAiB,IAAI,MAAM;AAEhF,QAAM,QAA6B,OAAO,OAAO;AAAA,IAC/C,SAAS,SAAS;AAAA,IAClB,cAAc,MAAM;AAAA,IACpB,OAAO,sBAAsB,SAAS,KAAK;AAAA,IAC3C,KAAK,MAAM,eAAe,SAAS;AAAA,EACrC,CAAC;AACD,SAAO,EAAE,OAAO,IAAI,KAAK;AAC3B;AAEA,SAAS,kBACP,UACA,cACA,mBACoC;AACpC,MAAI,CAAC,SAAS,QAAQ,KACjB,CAAC,OAAO,OAAO,UAAU,SAAS,KAClC,OAAO,SAAS,YAAY,aAC5B,CAAC,OAAO,OAAO,UAAU,SAAS,GAAG;AACxC,WAAO,OAAO,sBAAsB,CAAC,+CAA+C,CAAC;AAAA,EACvF;AACA,MAAI,CAAC,yBAAyB,SAAS,OAAO,GAAG;AAC/C,WAAO,OAAO,sBAAsB,CAAC,kDAAkD,CAAC;AAAA,EAC1F;AACA,MAAI,SAAS,UAAU,cAAc;AACnC,WAAO,OAAO,sBAAsB,CAAC,mDAAmD,CAAC;AAAA,EAC3F;AAEA,QAAM,MAAM,eAAe,SAAS;AACpC,MAAI,SAAS,iBAAiB,UAAa,SAAS,iBAAiB,cAAc;AACjF,WAAO,OAAO,sBAAsB,CAAC,+DAA+D,CAAC;AAAA,EACvG;AACA,MAAI,SAAS,QAAQ,UAAa,SAAS,QAAQ,KAAK;AACtD,WAAO,OAAO,sBAAsB,CAAC,wDAAwD,CAAC;AAAA,EAChG;AACA,MAAI,MAAM,mBAAmB;AAC3B,WAAO,OAAO,oBAAoB,CAAC,YAAY,GAAG,QAAQ,iBAAiB,EAAE,CAAC;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,sBACP,UACA,UACA,SACoC;AACpC,MAAI,CAAC,SAAS,QAAQ,EAAG,QAAO,OAAO,sBAAsB,CAAC,yCAAyC,CAAC;AACxG,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,eAAe,KAAK,WAAS,CAAC,OAAO,OAAO,UAAU,KAAK,CAAC,GAAG;AACjE,WAAO,OAAO,sBAAsB,CAAC,sDAAsD,CAAC;AAAA,EAC9F;AACA,MAAI,OAAO,SAAS,OAAO,YAAY,SAAS,GAAG,WAAW,GAAG;AAC/D,WAAO,OAAO,sBAAsB,CAAC,gDAAgD,CAAC;AAAA,EACxF;AACA,MAAI,CAAC,yBAAyB,SAAS,eAAe,KAAK,SAAS,kBAAkB,SAAS;AAC7F,WAAO,OAAO,sBAAsB,CAAC,mEAAmE,CAAC;AAAA,EAC3G;AACA,MAAI,SAAS,eAAe,SAAS,MAAM,YAAY;AACrD,WAAO,OAAO,sBAAsB,CAAC,2DAA2D,CAAC;AAAA,EACnG;AACA,MAAI,SAAS,yBAAyB,SAAS,MAAM,wBAChD,SAAS,eAAe,SAAS,MAAM,cACvC,SAAS,eAAe,SAAS,MAAM,cACvC,SAAS,qBAAqB,SAAS,MAAM,kBAAkB;AAClE,WAAO,OAAO,sBAAsB,CAAC,yEAAyE,CAAC;AAAA,EACjH;AACA,MAAI,SAAS,WAAW,SAAS,WAAW;AAC1C,WAAO,OAAO,sBAAsB,CAAC,oDAAoD,CAAC;AAAA,EAC5F;AACA,QAAM,mBAAmB,OAAO,OAAO,UAAU,SAAS;AAC1D,QAAM,gBAAgB,OAAO,OAAO,SAAS,OAAO,SAAS;AAC7D,MAAI,SAAS,iBAAiB,SAAS,MAAM,gBACxC,qBAAqB,iBACrB,SAAS,YAAY,SAAS,MAAM,SAAS;AAChD,WAAO,OAAO,sBAAsB,CAAC,yDAAyD,CAAC;AAAA,EACjG;AACA,SAAO;AACT;AAEA,SAAS,gBACP,SACA,SACoC;AACpC,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS,OAAO,KAChB,eAAe,KAAK,WAAS,CAAC,OAAO,OAAO,SAAS,KAAK,CAAC,KAC3D,OAAO,QAAQ,OAAO,YACtB,QAAQ,GAAG,WAAW,GAAG;AAC5B,WAAO,OAAO,qBAAqB,CAAC,mCAAmC,CAAC;AAAA,EAC1E;AACA,MAAI,QAAQ,aAAa,QAAQ,YAC5B,QAAQ,cAAc,QAAQ,aAC9B,QAAQ,cAAc,QAAQ,aAC9B,QAAQ,WAAW,QAAQ,QAAQ;AACtC,WAAO,OAAO,qBAAqB,CAAC,oDAAoD,CAAC;AAAA,EAC3F;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAgD;AAC7E,SAAO,OAAO,OAAO;AAAA,IACnB,iBAAiB,SAAS;AAAA,IAC1B,sBAAsB,SAAS;AAAA,IAC/B,YAAY,SAAS;AAAA,IACrB,YAAY,SAAS;AAAA,IACrB,kBAAkB,SAAS;AAAA,IAC3B,GAAI,SAAS,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,SAAS,WAAW;AAAA,IAC/E,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS;AAAA,IACvB,IAAI,SAAS;AAAA,IACb,GAAI,SAAS,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,IACtE,QAAQ,SAAS;AAAA,EACnB,CAAC;AACH;AAEA,SAAS,gBAAgB,SAAqD;AAC5E,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,IAAI,QAAQ;AAAA,IACZ,WAAW,QAAQ;AAAA,IACnB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;AAEA,SAAS,QACP,aACA,SACA,MAC+B;AAC/B,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IAAa,IAAI;AAAA,IAAM;AAAA,IAAS;AAAA,EAClC,CAAC;AACH;AAEA,SAAS,OACP,QACA,SACwB;AACxB,MAAI,YAAY,OAAW,QAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AACrE,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC;AAAA,IAAG,IAAI;AAAA,IAAO;AAAA,EACnD,CAAC;AACH;AAEA,SAAS,yBAAyB,OAAiC;AACjE,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,aAAa,OAAwB;AAC5C,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;;ACxXA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,SAAS;AAEX,IAAM,kBAAkB,EAAE,aAAa;AAAA,EAC5C,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO;AAAA,EACP,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,WAAW;AAAA,EACX,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,QAAQ;AACV,CAAC,EAAE;AAAA,EACD,UAAQ,KAAK,iBAAiB,KAAK,MAAM,gBACpC,KAAK,YAAY,KAAK,MAAM,WAC5B,KAAK,WAAW,KAAK,MAAM,UAC3B,KAAK,iBAAiB,KAAK,MAAM,gBACjC,KAAK,eAAe,KAAK,MAAM;AAAA,EACpC;AACF;AAIA,eAAsB,kBAAkB,OAAuC;AAC7E,QAAM,OAAO,gBAAgB,MAAM,KAAK;AACxC,MAAI,MAAM,eAAe,SAAS,KAAK,KAAK,MAAM,KAAK,WAAW;AAChE,UAAM,IAAI,UAAU,+DAA+D;AAAA,EACrF;AACA,SAAO;AACT;;;ACnBA,eAAsB,gBACpB,OAC8C;AAC9C,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,OAAO,gBAAgB,MAAM;AAAA,IACjC,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,IACvB,OAAO,SAAS;AAAA,IAChB,WAAW,SAAS;AAAA,IACpB,cAAc,SAAS;AAAA,IACvB,YAAY,SAAS;AAAA,IACrB,KAAK,SAAS;AAAA,IACd,WAAW,SAAS;AAAA,IACpB,GAAI,SAAS,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,IACtE,QAAQ,SAAS;AAAA,EACnB,CAAC;AACD,SAAO,MAAM,kBAAkB,EAAE,GAAG,OAAO,KAAK,CAAC;AACnD;;;ACvCA,IAAM,cAAc,IAAI,YAAY;AAEpC,SAAS,qBAAqB,OAAwB;AACpD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,YAAY,MAAM,YAAY,KAAK;AACzC,QAAI,cAAc,UAAc,aAAa,SAAW,aAAa,MAAU,QAAO;AACtF,QAAI,YAAY,MAAS,UAAS;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,UAAU,KAAM,QAAO;AAE3B,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,UAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,UAAU,uCAAuC;AACxF,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,IACA,KAAK,UAAU;AACb,UAAI,qBAAqB,KAAK,EAAG,OAAM,IAAI,UAAU,8CAA8C;AACnG,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,IACA,KAAK,UAAU;AACb,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,UAAQ,aAAa,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AACpF,YAAM,YAAY,QAAQ,eAAe,KAAK;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,UAAU,8CAA8C;AAAA,MACpE;AACA,YAAM,SAAS;AACf,YAAM,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ;AACtD,YAAI,qBAAqB,GAAG,EAAG,OAAM,IAAI,UAAU,2CAA2C;AAC9F,cAAM,SAAS,OAAO,GAAG;AACzB,YAAI,WAAW,OAAW,OAAM,IAAI,UAAU,kDAAkD;AAChG,eAAO,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,MAAM,CAAC;AAAA,MACvD,CAAC;AACD,aAAO,IAAI,QAAQ,KAAK,GAAG,CAAC;AAAA,IAC9B;AAAA,IACA;AACE,YAAM,IAAI,UAAU,gCAAgC,OAAO,KAAK,EAAE;AAAA,EACtE;AACF;AAGO,SAAS,cAAc,OAAwB;AACpD,SAAO,aAAa,KAAK;AAC3B;AAGO,SAAS,mBAAmB,OAA4B;AAC7D,SAAO,YAAY,OAAO,aAAa,KAAK,CAAC;AAC/C;;;AC3CA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAAA,uBAAsB;AAyB/B,SAAS,UAAU,MAAqC;AACtD,SAAO,WAAW,KAAK,EAAE,QAAQ,GAAG,GAAG,CAAC,GAAG,UAAU,OAAO,SAAS,KAAK,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;AAChH;AAEA,eAAe,UAAU,QAA0B,eAAgD;AACjG,QAAM,cAAc,0BAA0B,oBAAoB,MAAM,MAAM,CAAC;AAC/E,MAAI,aAAa,WAAW,GAAI,OAAM,IAAI,UAAU,mCAAmC;AACvF,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,IAC/C;AAAA,IACA,WAAW,KAAK,WAAW;AAAA,IAC3B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO,KAAK,QAAQ,WAAW,UAAU,aAAa,CAAC;AACjG,SAAO,oBAAoB,MAAM,0BAA0B,IAAI,WAAW,SAAS,CAAC,CAAC;AACvF;AAEA,SAAS,WAAW,MAAwB,OAAkC;AAC5E,QAAM,YAAY,0BAA0B,IAAI;AAChD,QAAM,aAAa,0BAA0B,KAAK;AAClD,MAAI,WAAW,WAAW,MAAM,YAAY,WAAW,GAAI,QAAO;AAClE,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,EAAG,eAAc,UAAU,KAAK,IAAI,WAAW,KAAK;AAC7F,SAAO,eAAe;AACxB;AAEA,eAAsB,sBAAsB,WAA6C;AACvF,QAAM,SAAS,qBAAqB,MAAM,SAAS;AACnD,SAAO,MAAMA,gBAAe,SAAS,MAAM;AAC7C;AAGO,SAAS,wBAAwB,OAAwD;AAC9F,QAAM,kBAAkB,MAAM,mBAAmB;AACjD,MAAI,CAAC,OAAO,cAAc,eAAe,KAAK,kBAAkB,GAAG;AACjE,UAAM,IAAI,WAAW,oDAAoD;AAAA,EAC3E;AACA,MAAI,CAAC,OAAO,cAAc,MAAM,QAAQ,KAAK,MAAM,WAAW,GAAG;AAC/D,UAAM,IAAI,WAAW,uDAAuD;AAAA,EAC9E;AACA,MAAI,MAAM,WAAW,OAAO,mBAAmB,iBAAiB;AAC9D,UAAM,IAAI,WAAW,sDAAsD;AAAA,EAC7E;AAEA,SAAO,qBAAqB,MAAM,IAAIA,gBAAe,EAAE,QAAQ,wBAAwB,CAAC,EACrF,OAAO;AAAA,IACN,aAAa,oBAAoB;AAAA,IACjC,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,eAAe,MAAM;AAAA,IACrB,OAAO,MAAM;AAAA,IACb,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,OAAO,uBAAuB;AAAA,IAC9B,UAAU,MAAM;AAAA,IAChB,WAAW,MAAM,WAAW;AAAA,EAC9B,CAAC,EACA,MAAM,CAAC;AACZ;AAGA,eAAsB,gCACpB,WACA,QACoC;AACpC,QAAM,gBAAgB,MAAM,sBAAsB,SAAS;AAC3D,SAAO,6BAA6B,MAAM,IAAIA,gBAAe,EAAE,QAAQ,gCAAgC,CAAC,EACrG,OAAO;AAAA,IACN,WAAW;AAAA,IACX,OAAO,MAAM,UAAU,QAAQ,aAAa;AAAA,EAC9C,CAAC,EACA,MAAM,CAAC;AACZ;AAOA,eAAsB,6BACpB,OACkB;AAClB,MAAI;AACF,UAAM,YAAY,qBAAqB,MAAM,MAAM,SAAS;AAC5D,UAAM,WAAW,6BAA6B,MAAM,MAAM,QAAQ;AAClE,UAAM,gBAAgB,MAAM,sBAAsB,SAAS;AAC3D,QAAI,SAAS,cAAc,cAAe,QAAO;AACjD,WAAO,WAAW,SAAS,OAAO,MAAM,UAAU,MAAM,QAAQ,aAAa,CAAC;AAAA,EAChF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,gCACpB,OACkB;AAClB,MAAI;AACF,UAAM,YAAY,qBAAqB,MAAM,MAAM,SAAS;AAC5D,QAAI,CAAC,OAAO,cAAc,MAAM,UAAU,KACrC,MAAM,aAAa,UAAU,YAC7B,MAAM,cAAc,UAAU,UAAW,QAAO;AACrD,WAAO,MAAM,6BAA6B,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACxIA;AAAA,EACE,6BAAAC;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA,uBAAAC;AAAA,EACA,WAAAC;AAAA,EACA,oCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAAC,uBAAsB;;;AC1D/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP;AAAA,EACE,uBAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,kCAAAC;AAAA,EACA,gCAAAC;AAAA,OACK;;;ACnBP;AAAA,EACE;AAAA,EACA;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,IAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAE5D,SAAS,WAAW,MAAkB,OAA4B;AAChE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,EAAG,eAAc,KAAK,KAAK,IAAI,MAAM,KAAK;AAC5F,SAAO,eAAe;AACxB;AAEA,SAAS,uBAAuB,cAAoE;AAClG,QAAM,EAAE,YAAY,aAAa,GAAG,UAAU,IAAI;AAClD,SAAO;AACT;AAOO,SAAS,yBACd,cACA,YACY;AACZ,QAAM,mBAAmBC,sBAAqB,MAAM,UAAU;AAC9D,QAAM,qBAAqB,gBAAgB,eACvC,uBAAuB,6BAA6B,MAAM,YAAY,CAAC,IACvE,6BAA6B,MAAM,YAAY;AAEnD,SAAO,mBAAmB;AAAA,IACxB,QAAQ,mBAAmB;AAAA,IAC3B,SAAS,mBAAmB;AAAA,IAC5B,YAAY;AAAA,IACZ,WAAW,mBAAmB;AAAA,IAC9B,SAAS,mBAAmB;AAAA,IAC5B,eAAe,mBAAmB;AAAA,IAClC,OAAO,mBAAmB;AAAA,IAC1B,OAAO,mBAAmB;AAAA,IAC1B,gBAAgB,mBAAmB;AAAA,IACnC,UAAU,mBAAmB;AAAA,IAC7B,YAAY,mBAAmB,cAAc;AAAA,IAC7C,WAAW,mBAAmB;AAAA,IAC9B,gBAAgB,mBAAmB;AAAA,IACnC,SAAS;AAAA,EACX,CAAC;AACH;AAGO,SAAS,+BAA+B,WAAkD;AAC/F,QAAM,SAAS,6BAA6B,MAAM,SAAS;AAC3D,QAAM,UAAU,mBAAmB,MAAM;AACzC,MAAI,QAAQ,SAAS,kCAAkC;AACrD,UAAM,IAAI,WAAW,uCAAuC,gCAAgC,QAAQ;AAAA,EACtG;AACA,SAAO;AACT;AAGO,SAAS,mCAAmC,SAAgD;AACjG,MAAI,QAAQ,SAAS,kCAAkC;AACrD,UAAM,IAAI,WAAW,uCAAuC,gCAAgC,QAAQ;AAAA,EACtG;AACA,QAAM,UAAU,YAAY,OAAO,OAAO;AAC1C,QAAM,SAAS,6BAA6B,MAAM,KAAK,MAAM,OAAO,CAAY;AAChF,MAAI,CAAC,WAAW,SAAS,mBAAmB,MAAM,CAAC,GAAG;AACpD,UAAM,IAAI,UAAU,wDAAwD;AAAA,EAC9E;AACA,SAAO;AACT;;;ADnDA,IAAM,QAAQ,IAAI,YAAY;AAAA,EAC5B,KAAK,IAAI,sBAAsB;AAAA,EAC/B,KAAK,IAAI,WAAW;AAAA,EACpB,MAAM,IAAI,UAAU;AACtB,CAAC;AACD,IAAM,WAAW,IAAI,YAAY,EAAE,OAAOC,+BAA8B;AAQxE,SAAS,sBAAsB,OAAqC;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,gBAAgB,UAAU,EAAE,eAAe,QAAQ;AACtG,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,SAAO;AAAA,IACL,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB;AACF;AAyCO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EACvC,OAAO;AAAA,EAEzB,cAAc;AACZ,UAAM,mDAAmD;AAAA,EAC3D;AACF;AAEA,SAAS,eAAe,OAA6D;AACnF,SAAO;AAAA,IACL,eAAeC,SAAQ,MAAM,MAAM,aAAa;AAAA,IAChD,OAAO,eAAe,MAAM,MAAM,KAAK;AAAA,IACvC,WAAWC,qBAAoB,MAAM,MAAM,SAAS;AAAA,EACtD;AACF;AAEA,SAAS,gBAAgB,OAA+D;AACtF,SAAO;AAAA,IACL,eAAeD,SAAQ,MAAM,MAAM,aAAa;AAAA,IAChD,OAAO,eAAe,MAAM,MAAM,KAAK;AAAA,IACvC,YAAYC,qBAAoB,MAAM,MAAM,UAAU;AAAA,EACxD;AACF;AAEA,SAAS,UAAU,OAAqC;AACtD,QAAM,UAAUC,2BAA0B,KAAK;AAC/C,MAAI,SAAS,WAAW,GAAI,OAAM,IAAI,UAAU,6BAA6B;AAC7E,SAAO;AACT;AAGA,eAAsB,4CAAwF;AAC5G,QAAM,YAAqB,MAAM,MAAM,IAAI,gBAAgB;AAC3D,QAAM,UAAU,sBAAsB,SAAS;AAC/C,QAAM,CAAC,WAAW,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,IAChD,MAAM,IAAI,mBAAmB,QAAQ,SAAS;AAAA,IAC9C,MAAM,IAAI,oBAAoB,QAAQ,UAAU;AAAA,EAClD,CAAC;AACD,SAAO;AAAA,IACL,WAAWD,qBAAoB,MAAME,2BAA0B,IAAI,WAAW,SAAS,CAAC,CAAC;AAAA,IACzF,YAAYF,qBAAoB,MAAME,2BAA0B,IAAI,WAAW,UAAU,CAAC,CAAC;AAAA,EAC7F;AACF;AAMA,eAAsB,wBACpB,OACoC;AACpC,QAAM,eAAeC,8BAA6B,MAAM,MAAM,YAAY;AAC1E,QAAM,aAAaC,sBAAqB,MAAM,MAAM,UAAU;AAC9D,QAAM,eAAe,eAAe,MAAM,YAAY;AACtD,MACE,aAAa,kBAAkB,aAAa,iBACzC,aAAa,UAAU,aAAa,OACvC;AACA,UAAM,IAAI,UAAU,sEAAsE;AAAA,EAC5F;AAEA,QAAM,qBAAqB,MAAM,MAAM,IAAI,qBAAqB,UAAU,aAAa,SAAS,CAAC;AACjG,QAAM,EAAE,IAAI,IAAI,IAAI,MAAM,MAAM;AAAA,IAC9B,EAAE,oBAAoB,MAAM,SAAS;AAAA,IACrC,+BAA+B,MAAM,SAAS;AAAA,IAC9C,yBAAyB,cAAc,UAAU;AAAA,EACnD;AAEA,SAAOC,8BAA6B,MAAM;AAAA,IACxC,GAAG;AAAA,IACH,YAAY;AAAA,MACV,SAASP;AAAA,MACT,KAAKI,2BAA0B,IAAI,WAAW,GAAG,CAAC;AAAA,MAClD,YAAYA,2BAA0B,IAAI,WAAW,EAAE,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAMA,eAAsB,wBACpB,OACoC;AACpC,MAAI;AACF,UAAM,eAAeG,8BAA6B,MAAM,MAAM,YAAY;AAC1E,UAAM,aAAaD,sBAAqB,MAAM,MAAM,UAAU;AAC9D,UAAM,eAAe,gBAAgB,MAAM,YAAY;AACvD,QACE,aAAa,kBAAkB,aAAa,iBACzC,aAAa,UAAU,aAAa,MACvC,OAAM,IAAI,UAAU,wBAAwB;AAE9C,UAAM,eAAe,MAAM,MAAM,IAAI,sBAAsB,UAAU,aAAa,UAAU,CAAC;AAC7F,UAAM,YAAY,MAAM,MAAM;AAAA,MAC5B;AAAA,QACE;AAAA,QACA,KAAK,UAAU,aAAa,WAAW,GAAG;AAAA,QAC1C,MAAM;AAAA,MACR;AAAA,MACAH,2BAA0B,aAAa,WAAW,UAAU,KAAK,IAAI,WAAW;AAAA,MAChF,yBAAyB,cAAc,UAAU;AAAA,IACnD;AACA,UAAM,SAAS,mCAAmC,IAAI,WAAW,SAAS,CAAC;AAC3E,WAAO;AAAA,EACT,QAAQ;AACN,UAAM,IAAI,gCAAgC;AAAA,EAC5C;AACF;;;ADtCA,IAAM,sBAA8E;AAAA,EAClF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACAK;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACAC;AAAA,EACAC;AACF;AAEA,SAAS,2BAA2B,OAA+C;AACjF,aAAW,UAAU,qBAAqB;AACxC,UAAM,SAAS,OAAO,UAAU,KAAK;AACrC,QAAI,OAAO,QAAS,QAAO,OAAO;AAAA,EACpC;AAEA,QAAM,IAAI,UAAU,qDAAqD;AAC3E;AAGA,eAAsB,oBAAoB,QAAsD;AAC9F,SAAOC,SAAQ,MAAM,MAAMC,gBAAe,SAAS,2BAA2B,MAAM,CAAC,CAAC;AACxF;AAEA,eAAsB,wBACpB,MACmC;AACnC,SAAO,OAAO,OAAO,EAAE,MAAM,YAAY,MAAM,oBAAoB,IAAI,EAAE,CAAC;AAC5E;AAGO,SAAS,6BAA6B,OAAkE;AAC7G,SAAO,0BAA0B,MAAM,IAAIA,gBAAe,EAAE,QAAQ,6BAA6B,CAAC,EAC/F,OAAO;AAAA,IACN,OAAO,MAAM,SAASC,qBAAoB;AAAA,IAC1C,SAASC;AAAA,IACT,WAAW,MAAM;AAAA,IACjB,gBAAgB,MAAM;AAAA,IACtB,GAAI,MAAM,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;AAAA,EACvF,CAAC,EACA,MAAM,CAAC;AACZ;AAGA,eAAsB,+BACpB,OAC0C;AAC1C,QAAM,WAAW,MAAM,0CAA0C;AACjE,QAAM,aAAa,6BAA6B;AAAA,IAC9C,GAAG;AAAA,IACH,WAAW,SAAS;AAAA,EACtB,CAAC;AACD,QAAM,iBAAiB,MAAM,oBAAoB,UAAU;AAC3D,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,YAAY,OAAO,OAAO;AAAA,MACxB,eAAe;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,YAAY,SAAS;AAAA,IACvB,CAAC;AAAA,IACD,WAAW,OAAO,OAAO;AAAA,MACvB,eAAe;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,CAAC;AACH;AAGO,SAAS,uBAAuB,OAAsD;AAC3F,SAAO,oBAAoB,MAAM,IAAIF,gBAAe,EAAE,QAAQ,uBAAuB,CAAC,EACnF,OAAO;AAAA,IACN,sBAAsB,MAAM;AAAA,IAC5B,WAAW,MAAM,aAAaC,qBAAoB;AAAA,IAClD,UAAU,MAAM,YAAY;AAAA,IAC5B,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IACzE,gBAAgB,MAAM;AAAA,IACtB,GAAI,MAAM,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;AAAA,IACrF,QAAQ,MAAM,QAAQ,IAAI,aAAW;AAAA,MACnC,MAAM;AAAA,MAAwB,eAAe;AAAA,MAA4B;AAAA,IAC3E,EAAE;AAAA,IACF,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,mBAAmBC;AAAA,IACnB,gBAAgB,CAAC,GAAG,MAAM,cAAc;AAAA,IACxC,wBAAwB,MAAM;AAAA,IAC9B,QAAQ;AAAA,MACN,qBAAqB,MAAM;AAAA,MAC3B,+BAA+B,MAAM;AAAA,MACrC,mBAAmBC;AAAA,IACrB;AAAA,IACA,kBAAkB;AAAA,EACpB,CAAC,EACA,MAAM,CAAC;AACZ;AAGO,SAAS,gBAAgB,OAA8C;AAC5E,SAAO,mBAAmB,MAAM,IAAIH,gBAAe,EAAE,QAAQ,sBAAsB,CAAC,EACjF,OAAO;AAAA,IACN,SAAS,MAAM,WAAW,gBAAgB;AAAA,IAC1C,cAAc,MAAM;AAAA,IACpB,WAAW,MAAM;AAAA,IACjB,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAChE,aAAa,CAAC,SAAS;AAAA,EACzB,CAAC,EACA,MAAM,CAAC;AACZ;AAGO,SAAS,gCACd,OAC2B;AAC3B,QAAM,cAAc,IAAI,WAAW,EAAE;AACrC,MAAI,MAAM,oBAAoB,QAAW;AAEvC,eAAW,OAAO,gBAAgB,WAAW;AAAA,EAC/C;AACA,QAAM,kBAAkB,MAAM,mBAAmBI,2BAA0B,WAAW;AAEtF,SAAOC,8BAA6B,MAAM,IAAIL,gBAAe,EAAE,QAAQ,gCAAgC,CAAC,EACrG,OAAO;AAAA,IACN,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,cAAc,MAAM;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,MAAM;AAAA,MACd,cAAc,MAAM;AAAA,MACpB,qBAAqB,MAAM;AAAA,IAC7B;AAAA,IACA,WAAW;AAAA,MACT,SAAS;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,EACF,CAAC,EACA,MAAM,CAAC;AACZ;AAGA,eAAsB,gCACpB,OACoC;AACpC,QAAM,YAAYM,8BAA6B;AAAA,IAC7C,IAAIN,gBAAe,EAAE,QAAQ,gCAAgC,CAAC,EAC3D,OAAO;AAAA,MACN,gBAAgB,MAAM,kBAAkBC,qBAAoB;AAAA,MAC5D,UAAU,MAAM,YAAY;AAAA,MAC5B,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,MACzE,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM;AAAA,MACf,eAAe,MAAM,aAAa;AAAA,MAClC,OAAO,MAAM,aAAa;AAAA,MAC1B,OAAO,MAAM;AAAA,MACb,WAAW;AAAA,MACX,gBAAgB,MAAM;AAAA,IACxB,CAAC,EACA,MAAM;AAAA,EACX;AAEA,SAAO,MAAM,wBAAwB;AAAA,IACnC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB,cAAc;AAAA,EAChB,CAAC;AACH;AAEO,SAAS,iCACd,OAC4B;AAC5B,SAAO,8BAA8B,MAAM,IAAID,gBAAe,EAAE,QAAQ,iCAAiC,CAAC,EACvG,OAAO;AAAA,IACN,WAAW,MAAM;AAAA,IACjB,eAAe,MAAM;AAAA,IACrB,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,EACtB,CAAC,EACA,MAAM,CAAC;AACZ;AAEO,SAAS,iCAAiC,SAA2C;AAC1F,SAAO,8BAA8B,MAAM,IAAIA,gBAAe,EAAE,QAAQ,iCAAiC,CAAC,EACvG,OAAO,EAAE,QAAQ,CAAC,EAClB,MAAM,CAAC;AACZ;AAEO,SAAS,uCAAuC,KAA6C;AAClG,SAAO,oCAAoC;AAAA,IACzC,IAAIA,gBAAe,EAAE,QAAQ,uCAAuC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM;AAAA,EAC/F;AACF;AAEO,SAAS,0BAA0B,OAAkC;AAC1E,SAAO,uBAAuB,MAAM,IAAIA,gBAAe,EAAE,QAAQ,0BAA0B,CAAC,EACzF,OAAO,EAAE,MAAM,CAAC,EAChB,MAAM,CAAC;AACZ;AAEO,SAAS,iCAAiC,cAAgD;AAC/F,SAAO,8BAA8B,MAAM,IAAIA,gBAAe,EAAE,QAAQ,iCAAiC,CAAC,EACvG,OAAO,EAAE,aAAa,CAAC,EACvB,MAAM,CAAC;AACZ;AAEO,SAAS,2CACd,YACsC;AACtC,SAAO,wCAAwC;AAAA,IAC7C,IAAIA,gBAAe,EAAE,QAAQ,2CAA2C,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;AAAA,EAC1G;AACF;;;AGpPA,SAASO,0BAAyB,OAAwB;AACxD,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS;AACjD;AAEA,SAAS,UAAU,gBAAwB,eAAgC;AACzE,SAAOA,0BAAyB,cAAc,KAAK,kBAAkB;AACvE;AAEA,SAAS,UAAU,gBAAoC,eAAgC;AACrF,SAAO,mBAAmB,UAAa,kBAAkB;AAC3D;AAEA,SAAS,oBACP,gBACA,gBACA,eACS;AACT,SAAO,UAAU,gBAAgB,aAAa,MACxC,mBAAmB,UAAcA,0BAAyB,cAAc,KAAK,kBAAkB,mBAChG,CAAC,UAAU,gBAAgB,aAAa;AAC/C;AAEA,SAAS,wBACP,eACA,gBACA,gBACS;AACT,MAAI,CAACA,0BAAyB,cAAc,KAAK,gBAAgB,eAAgB,QAAO;AACxF,SAAO,mBAAmB,UACpBA,0BAAyB,cAAc,KAAK,iBAAiB,kBAAkB,gBAAgB;AACvG;AAEA,SAAS,qBAAqB,UAA8C;AAC1E,MAAI,CAAC,OAAO,cAAc,SAAS,QAAQ,KAAK,SAAS,WAAW,EAAG,QAAO;AAC9E,MAAI,CAACA,0BAAyB,SAAS,cAAc,EAAG,QAAO;AAC/D,MAAI,SAAS,mBAAmB,WAC1B,CAACA,0BAAyB,SAAS,cAAc,KAAK,SAAS,iBAAiB,SAAS,gBAAiB,QAAO;AACvH,SAAO,SAAS,aAAa,IACzB,SAAS,eAAe,SACxB,SAAS,eAAe;AAC9B;AAEA,SAAS,mBACP,WACA,eACgB;AAChB,QAAM,UAAU,UAAU,OAAO,cAAY,UAAU,SAAS,gBAAgB,aAAa,CAAC;AAC9F,MAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,IAAI,MAAM,OAAO,CAAC,EAAE;AACvD,MAAI,QAAQ,KAAK,cAAY,CAAC,qBAAqB,QAAQ,CAAC,EAAG,QAAO,EAAE,IAAI,MAAM;AAElF,QAAM,SAAS,oBAAI,IAAe;AAClC,QAAM,gBAAgB,oBAAI,IAAe;AACzC,MAAI;AAEJ,aAAW,YAAY,SAAS;AAC9B,QAAI,OAAO,IAAI,SAAS,UAAU,EAAG,QAAO,EAAE,IAAI,MAAM;AACxD,WAAO,IAAI,SAAS,YAAY,QAAQ;AACxC,QAAI,SAAS,aAAa,GAAG;AAC3B,UAAI,SAAS,OAAW,QAAO,EAAE,IAAI,MAAM;AAC3C,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,SAAS,OAAW,QAAO,EAAE,IAAI,MAAM;AAE3C,aAAW,YAAY,SAAS;AAC9B,QAAI,SAAS,aAAa,EAAG;AAC7B,UAAM,aAAa,SAAS;AAC5B,QAAI,eAAe,UAAa,cAAc,IAAI,UAAU,EAAG,QAAO,EAAE,IAAI,MAAM;AAClF,UAAM,SAAS,OAAO,IAAI,UAAU;AACpC,QAAI,WAAW,UACV,SAAS,aAAa,OAAO,WAAW,KACxC,SAAS,iBAAiB,OAAO,eAAgB,QAAO,EAAE,IAAI,MAAM;AACzE,kBAAc,IAAI,YAAY,QAAQ;AAAA,EACxC;AAEA,QAAM,QAAa,CAAC,IAAI;AACxB,MAAI,UAAU;AACd,SAAO,cAAc,IAAI,QAAQ,UAAU,GAAG;AAC5C,UAAM,QAAQ,cAAc,IAAI,QAAQ,UAAU;AAClD,QAAI,UAAU,OAAW,QAAO,EAAE,IAAI,MAAM;AAC5C,UAAM,KAAK,KAAK;AAChB,cAAU;AAAA,EACZ;AACA,SAAO,MAAM,WAAW,QAAQ,SAAS,EAAE,IAAI,MAAM,MAAM,IAAI,EAAE,IAAI,MAAM;AAC7E;AAEA,SAAS,wBACP,UACA,OACmE;AACnE,QAAM,SAAS,oBAAI,IAAiD;AACpE,aAAW,WAAW,UAAU;AAC9B,QAAI,QAAQ,WAAW,MAAM,gBAAiB;AAC9C,QAAI,MAAM,cAAc,UAAa,QAAQ,cAAc,MAAM,UAAW;AAC5E,UAAM,QAAQ,OAAO,IAAI,QAAQ,SAAS,KAAK,CAAC;AAChD,UAAM,KAAK,OAAO;AAClB,WAAO,IAAI,QAAQ,WAAW,KAAK;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,eAC+C;AAC/C,MAAI;AACJ,aAAW,WAAW,OAAO;AAC3B,QAAI,QAAQ,kBAAkB,cAAe,iBAAgB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAA4C,eAAgC;AACnG,SAAO,oBAAoB,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,KACnF,wBAAwB,eAAe,QAAQ,gBAAgB,QAAQ,cAAc;AAC5F;AAGO,SAAS,uBAAuB,OAAkE;AACvG,QAAM,SAAS,wBAAwB,MAAM,UAAU,KAAK;AAC5D,QAAM,aAAkD,CAAC;AAEzD,aAAW,aAAa,OAAO,OAAO,GAAG;AACvC,QAAI,MAAM,cAAc,UAAa,CAAC,UAAU,KAAK,CAAAC,aAAWA,SAAQ,WAAW,SAAS,MAAM,SAAS,CAAC,GAAG;AAC7G;AAAA,IACF;AACA,UAAM,aAAa,mBAAmB,WAAW,MAAM,aAAa;AACpE,QAAI,CAAC,WAAW,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AACzE,UAAM,UAAU,qBAAqB,WAAW,OAAO,MAAM,aAAa;AAC1E,QAAI,SAAS,WAAW,SAAS,MAAM,SAAS,KAAK,gBAAgB,SAAS,MAAM,aAAa,GAAG;AAClG,iBAAW,KAAK,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,WAAW,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAC7E,MAAI,WAAW,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAC3E,SAAO,EAAE,IAAI,MAAM,SAAS,WAAW,CAAC,EAAE;AAC5C;AAGO,SAAS,8BACd,OACkC;AAClC,QAAM,gBAAgB,MAAM,QAAQ;AACpC,MAAI,CAAC,MAAM,QAAQ,eAAe,SAAS,aAAa,GAAG;AACzD,WAAO,EAAE,IAAI,OAAO,QAAQ,+BAA+B;AAAA,EAC7D;AAEA,QAAM,QAAQ,MAAM,KAAK,OAAO,CAAAC,SAAOA,KAAI,WAAW,MAAM,QAAQ,UAC/DA,KAAI,eAAe,iBACnB,UAAUA,KAAI,gBAAgB,MAAM,aAAa,CAAC;AACvD,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,0BAA0B;AAC9E,MAAI,MAAM,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAElE,QAAM,MAAM,MAAM,CAAC;AACnB,QAAM,qBAAqB,MAAM,KAAK,OAAO,eAAa,UAAU,WAAW,IAAI,UAC9E,UAAU,UAAU,IAAI,SACxB,UAAU,eAAe,IAAI,cAC7B,UAAU,UAAU,gBAAgB,MAAM,aAAa,CAAC;AAC7D,MAAI,mBAAmB,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAC/E,MAAI,CAAC,oBAAoB,IAAI,gBAAgB,IAAI,gBAAgB,MAAM,aAAa,KAC/E,CAAC,wBAAwB,MAAM,eAAe,IAAI,gBAAgB,IAAI,cAAc,GAAG;AAC1F,WAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AAAA,EACvD;AACA,SAAO,EAAE,IAAI,MAAM,IAAI;AACzB;AAEA,SAAS,cACP,cACA,OACgC;AAChC,SAAO,MAAM,YAAY,OAAO,gBAAc,WAAW,WAAW,MAAM,mBACrE,WAAW,iBAAiB,aAAa,cACzC,UAAU,WAAW,iBAAiB,MAAM,aAAa,CAAC;AACjE;AAEA,SAAS,qBACP,cACA,OACgD;AAChD,QAAM,cAAc,cAAc,cAAc,KAAK;AACrD,MAAI,YAAY,SAAS,EAAG,QAAO;AACnC,QAAM,aAAa,YAAY,CAAC;AAChC,MAAI,eAAe,UAAa,CAACF,0BAAyB,WAAW,eAAe,EAAG,QAAO;AAC9F,MAAI,CAAC,OAAO,cAAc,aAAa,cAAc,KAAK,aAAa,iBAAiB,EAAG,QAAO;AAClG,MAAI,WAAW,mBAAmB,aAAa,kBAC1C,WAAW,mBAAmB,OAAO,iBAAkB,QAAO;AACnE,QAAM,kBAAkB,WAAW,kBAAkB;AACrD,MAAI,mBAAmB,aAAa,eAAgB,QAAO;AAC3D,SAAO;AAAA,IACL;AAAA,IAAY;AAAA,IAAiB;AAAA,EAC/B;AACF;AAEA,SAAS,6BACP,UACA,eACS;AACT,SAAO;AAAA,IACL,SAAS,aAAa;AAAA,IACtB,SAAS,aAAa;AAAA,IACtB;AAAA,EACF,KACG;AAAA,IACD,SAAS,WAAW;AAAA,IACpB,SAAS,WAAW;AAAA,IACpB;AAAA,EACF,KACG,gBAAgB,SAAS,aAAa;AAC3C;AAOO,SAAS,6BAA6B,OAA4D;AACvG,QAAM,YAAY,MAAM,cAAc,OAAO,kBAAgB,aAAa,WAAW,MAAM,oBACtF,aAAa,mBAAmB,MAAM,cAAc;AACzD,QAAM,aAAa,mBAAmB,WAAW,MAAM,aAAa;AACpE,MAAI,CAAC,WAAW,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AACzE,MAAI,WAAW,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AAExF,MAAI;AACJ,aAAW,gBAAgB,WAAW,OAAO;AAC3C,UAAM,WAAW,qBAAqB,cAAc,KAAK;AACzD,QAAI,aAAa,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AACjF,QAAI,aAAa,UAAa,SAAS,mBAAmB,MAAM,cAAe,YAAW;AAAA,EAC5F;AACA,MAAI,aAAa,OAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AAC/E,QAAM,SAAS,WAAW,MAAM,GAAG,EAAE;AACrC,MAAI,CAAC,6BAA6B,UAAU,MAAM,aAAa,GAAG;AAGhE,QAAI,QAAQ,eAAe,SAAS,aAAa,YAAY;AAC3D,aAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AAAA,IACrD;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAAA,EACtD;AAEA,SAAO;AAAA,IACL,YAAY,SAAS;AAAA,IACrB,iBAAiB,SAAS;AAAA,IAC1B,IAAI;AAAA,IACJ,oBAAoB,QAAQ,eAAe,SAAS,aAAa;AAAA,IACjE,cAAc,SAAS;AAAA,EACzB;AACF;;;AClYA;AAAA,EACE;AAAA,EACA,yBAAAG;AAAA,EACA,6BAAAC;AAAA,OACK;AA2CA,SAAS,gCAAgC,cAAc,GAA8B;AAC1F,MAAI,OAAO;AACX,QAAM,SAAS,oBAAI,IAAiC;AACpD,QAAM,UAAU,oBAAI,IAAkC;AAEtD,WAAS,SAAS,QAAgB,SAAiB,YAA4B;AAC7E,WAAO,GAAG,iBAAiB,MAAM,CAAC,IAAI,iBAAiB,OAAO,CAAC,IAAI,UAAU;AAAA,EAC/E;AAEA,WAAS,YAAY,OAQZ;AACP,UAAM,SAAS,iBAAiB,MAAM,MAAM;AAC5C,UAAM,UAAU,iBAAiB,MAAM,OAAO;AAC9C,YAAQ,IAAI,MAAM,YAAY,OAAO,OAAO;AAAA,MAC1C,WAAW;AAAA,MACX,gBAAgB,MAAM;AAAA,MACtB,YAAY,MAAM;AAAA,MAClB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;AAAA,IAC3C,CAAC,CAAC;AAEF,UAAM,MAAM,SAAS,QAAQ,SAAS,MAAM,UAAU;AACtD,UAAM,WAAW,OAAO,IAAI,GAAG;AAC/B,WAAO,IAAI,KAAK,OAAO,OAAO,aAAa,SACvC;AAAA,MACE,sBAAsB,MAAM;AAAA,MAC5B,YAAY,MAAM;AAAA,MAClB,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,IACF,IAEA,EAAE,GAAG,UAAU,WAAW,KAAK,IAAI,SAAS,WAAW,MAAM,KAAK,EAAE,CAAC,CAAC;AAC1E,QAAI,MAAM,QAAQ,KAAM,QAAO,MAAM;AAAA,EACvC;AAEA,SAAO;AAAA,IACL,MAAM,OAAwB;AAC5B,aAAO;AAAA,IACT;AAAA,IAEA,QAAQ,OAAqB;AAC3B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,QAAQ,OAAgD;AACnE,YAAM,mBAAmB,iBAAiB,MAAM;AAChD,YAAM,UAAiC,CAAC;AACxC,iBAAW,UAAU,OAAO,OAAO,GAAG;AACpC,YAAI,OAAO,WAAW,iBAAkB;AACxC,YAAI,OAAO,YAAY,UAAa,OAAO,YAAY,iBAAiB,MAAM,OAAO,EAAG;AACxF,YAAI,OAAO,eAAe,UAAa,OAAO,eAAe,MAAM,WAAY;AAC/E,YAAI,OAAO,+BAA+B,UACrC,CAAC,OAAO,qBAAqB,WAAW,MAAM,0BAA0B,GAAG;AAC9E;AAAA,QACF;AACA,gBAAQ,KAAK,MAAM;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,YAAuD;AAClE,aAAO,QAAQ,IAAI,UAAU;AAAA,IAC/B;AAAA,IAEA,MAAM,OAAa;AACjB,UAAI,MAAM,MAAM,WAAWD,wBAAuB;AAChD,cAAM,IAAI,MAAM,YAAYA,sBAAqB,EAAE;AAAA,MACrD;AACA,YAAM,EAAE,QAAQ,SAAS,GAAG,OAAO,IAAI,MAAM;AAC7C,kBAAY;AAAA,QACV,OAAO,MAAM;AAAA,QACb,gBAAgBA;AAAA,QAChB,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,aAAa,OAAO,OAAO,CAAC,GAAG,OAAO,WAAW,CAAC;AAAA,QACpD;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,SAAS,MAAM,WAAW,MAAM,MAAM;AAAA,MACxC,CAAC;AAAA,IACH;AAAA,IAEA,OAAO,OAAa;AAClB,YAAM,aAAkD,EAAE,OAAO,MAAM,gBAAgB;AACvF,YAAM,SAAS,iBAAiB,MAAM,MAAM;AAC5C,YAAM,WAAW,CAAC,GAAG,OAAO,OAAO,CAAC,EACjC,OAAO,WAAS,MAAM,WAAW,UAAU,MAAM,eAAe,MAAM,eAAe,EACrF,IAAI,WAAS,MAAM,OAAO;AAC7B,YAAM,iBAAiB,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC;AAC5C,UAAI,MAAM,YAAY,UAAa,eAAe,SAAS,GAAG;AAC5D,cAAM,IAAI,MAAM,sDAAsD,MAAM,eAAe,EAAE;AAAA,MAC/F;AACA,YAAM,UAAU,MAAM,WAAW,eAAe,CAAC;AACjD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI,MAAM,gDAAgD,MAAM,eAAe,EAAE;AAAA,MACzF;AACA,kBAAY;AAAA,QACV,OAAO,MAAM;AAAA,QACb,gBAAgBC;AAAA,QAChB,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,QAAQ;AAAA,QACR,QAAQ,MAAM;AAAA,QACd;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC/GO,SAAS,sBACd,UAAyC,CAAC,GAClB;AACxB,QAAM,eAAe,oBAAI,IAA0B;AACnD,QAAM,cAAc,oBAAI,IAA4B;AACpD,QAAM,SAAkB,CAAC;AACzB,MAAI,kBAAkB;AACtB,MAAI,OAAyB,QAAQ,QAAQ;AAO7C,WAAS,UAAa,MAAoC;AACxD,UAAM,MAAM,KAAK,KAAK,MAAM,IAAI;AAEhC,WAAO,QAAQ,WAAW,CAAC,GAAG,CAAC;AAC/B,WAAO;AAAA,EACT;AAEA,WAAS,qBAA2B;AAClC,UAAM,EAAE,WAAW,IAAI;AACvB,QAAI,eAAe,OAAW;AAC9B,UAAM,MAAM,WAAW;AACvB,eAAW,CAAC,KAAK,OAAO,KAAK,cAAc;AACzC,UAAI,QAAQ,kBAAkB,IAAK,cAAa,OAAO,GAAG;AAAA,IAC5D;AAAA,EACF;AAGA,WAAS,cAAc,SAA+D;AACpF,UAAM,eAAe,aAAa,IAAI,SAAS,OAAO,CAAC;AACvD,QAAI,iBAAiB,QAAW;AAC9B,aAAO,aAAa,cAAc,QAAQ,aAAa,aAAa,WAAW,QAAQ,SACnF,EAAE,MAAM,aAAa,SAAS,aAAa,QAAQ,IACnD,EAAE,MAAM,mBAAmB;AAAA,IACjC;AAEA,UAAM,cAAc,YAAY,IAAI,QAAQ,OAAO,CAAC;AACpD,QAAI,gBAAgB,OAAW,QAAO;AACtC,QAAI,YAAY,cAAc,QAAQ,UAAW,QAAO,EAAE,MAAM,oBAAoB;AACpF,iBAAa,IAAI,SAAS,OAAO,GAAG,EAAE,GAAG,aAAa,gBAAgB,QAAQ,eAAe,CAAC;AAC9F,WAAO,EAAE,MAAM,aAAa,SAAS,YAAY,QAAQ;AAAA,EAC3D;AAEA,SAAO;AAAA,IACL,IAAI,SAA2B;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,IAAI,mBAA2B;AAC7B,aAAO,aAAa;AAAA,IACtB;AAAA,IAEA,IAAI,kBAA0B;AAC5B,aAAO,YAAY;AAAA,IACrB;AAAA,IAEA,MAAM,eAAe,SAA+D;AAClF,aAAO,MAAM,UAAU,YAAY;AACjC,2BAAmB;AACnB,eAAO,cAAc,OAAO,KAAK,EAAE,MAAM,MAAM;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,EAAE,SAAS,KAAK,GAGT;AAC5B,aAAO,MAAM,UAAU,YAAY;AACjC,2BAAmB;AACnB,cAAM,WAAW,cAAc,OAAO;AACtC,YAAI,aAAa,OAAW,QAAO;AAEnC,cAAM,UAAgC,OAAO,OAAO;AAAA,UAClD,UAAU,QAAQ;AAAA,UAClB,WAAW,QAAQ;AAAA,UACnB,IAAI,WAAW,mBAAmB,CAAC;AAAA,UACnC,WAAW,QAAQ;AAAA,UACnB,QAAQ,QAAQ;AAAA,QAClB,CAAC;AAID,cAAM,QAAQ,UAAU,IAAI;AAC5B,eAAO,KAAK,IAAI;AAEhB,cAAM,UAA0B;AAAA,UAC9B,WAAW,QAAQ;AAAA,UACnB;AAAA,UACA,QAAQ,QAAQ;AAAA,QAClB;AACA,qBAAa,IAAI,SAAS,OAAO,GAAG,EAAE,GAAG,SAAS,gBAAgB,QAAQ,eAAe,CAAC;AAC1F,oBAAY,IAAI,QAAQ,OAAO,GAAG,OAAO;AACzC,eAAO,EAAE,MAAM,YAAY,QAAQ;AAAA,MACrC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGA,SAAS,SAAS,SAAuC;AACvD,SAAO,KAAK,UAAU,CAAC,QAAQ,UAAU,QAAQ,WAAW,QAAQ,KAAK,CAAC;AAC5E;AAEA,SAAS,QAAQ,SAAuC;AACtD,SAAO,KAAK,UAAU,CAAC,QAAQ,UAAU,QAAQ,WAAW,QAAQ,MAAM,CAAC;AAC7E;;;AC9IO,SAAS,wBAAsE;AACpF,QAAM,UAA0B,CAAC;AACjC,QAAM,WAAW,oBAAI,IAA0B;AAC/C,MAAI,WAAW;AAEf,SAAO;AAAA,IACL,MAAM,OAAO,MAA4B;AACvC,cAAQ,KAAK,EAAE,UAAU,YAAY,GAAG,KAAK,CAAC;AAAA,IAChD;AAAA,IAEA,MAAM,QAAgD;AACpD,YAAM,QAAQ,QAAQ,MAAM;AAC5B,UAAI,UAAU,OAAW,QAAO;AAChC,eAAS,IAAI,MAAM,UAAU,KAAK;AAElC,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,MAAM,MAAqB;AACzB,mBAAS,OAAO,MAAM,QAAQ;AAAA,QAChC;AAAA,QACA,MAAM,UAAyB;AAC7B,cAAI,CAAC,SAAS,OAAO,MAAM,QAAQ,EAAG;AAEtC,kBAAQ,KAAK,KAAK;AAClB,kBAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,WAAW,MAAM,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAiC;AACrC,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,eAAgC;AACpC,aAAO,QAAQ;AAAA,IACjB;AAAA,IAEA,MAAM,kBAAmC;AACvC,YAAM,YAAY,SAAS;AAC3B,iBAAW,SAAS,SAAS,OAAO,EAAG,SAAQ,KAAK,KAAK;AACzD,eAAS,MAAM;AACf,cAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,WAAW,MAAM,QAAQ;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACtDA;AAAA,EACE;AAAA,EACA,gCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,wBAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,uBAAAC;AAAA,EACA,sBAAAC;AAAA,OACK;;;ACnBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA,kBAAAC;AAAA,OACK;AAKP,eAAsB,eAAe,QAAmC;AACtE,SAAO,MAAMC,gBAAe,SAAS,EAAE,QAAQ,kBAAkB,GAAG,cAAc,MAAM,MAAM,EAAE,CAAC;AACnG;AAEO,SAAS,iBAAiB,MAAkB,OAA4B;AAC7E,SAAO,cAAc,cAAc,MAAM,IAAI,CAAC,MAAM,cAAc,cAAc,MAAM,KAAK,CAAC;AAC9F;AAEA,eAAsB,qBAAqB,QAAqD;AAC9F,QAAM,SAAS,gCAAgC,MAAM,MAAM;AAC3D,SAAO,MAAMA,gBAAe,SAAS,EAAE,GAAG,QAAQ,QAAQ,SAAS,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC3F;;;ADgKA,SAAS,4BACP,QACwC;AACxC,SAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AAC5C;AAEA,SAASC,0BAAyB,OAAiC;AACjE,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAAS,WACP,OACA,OACS;AACT,SAAO,MAAM,kBAAkB,UACzB,MAAM,mBAAmB,UAAa,QAAQ,MAAM;AAC5D;AAEA,SAAS,kBAAkB,QAAyB,UAAyB;AAC3E,SAAO,OAAO,OAAO,UAAQ,SAAS,QAAQ,EAAE,WAAW;AAC7D;AAEA,SAAS,qBAAqB,OAAwB,WAAuC;AAC3F,SAAO,MAAM,cAAc,aACtB,MAAM,YAAY,WAAW,KAC7B,MAAM,YAAY,CAAC,MAAM;AAChC;AAEA,SAAS,mBAAmB,OAAwB,WAA+C;AACjG,QAAM,aAAa,OAAO,OAAO,OAAO,SAAS,IAAI,MAAM,UAAU;AACrE,SAAO,UAAU,iBAAiB,MAAM,gBAAgB,UAAU,YAAY;AAChF;AAEA,SAAS,4BACP,WACA,cACS;AACT,SAAO,aAAa,YAAY,UAAU,WACrC,aAAa,cAAc,UAAU,aACrC,aAAa,YAAY,UAAU,QAAQ,cAC3C,aAAa,kBAAkB,UAAU,IAAI,cAC7C,aAAa,UAAU,UAAU,IAAI,KAAK,SAC1C,aAAa,UAAU,UAAU,MAAM;AAC9C;AAEA,SAAS,mBACP,SACA,KACA,cACS;AACT,SAAO,QAAQ,eAAe,SAAS,IAAI,UAAU,KAChD,QAAQ,2BAA2B,IAAI,cACvC,IAAI,KAAK,UAAU,aAAa,SAChC,IAAI,eAAe,aAAa;AACvC;AAEA,SAAS,0BACP,cACA,SACA,YACS;AACT,SAAO,aAAa,iBAAiB,cAChC,aAAa,iBAAiB,cAAc,QAAQ,OAAO;AAClE;AAcA,SAAS,oCACP,WACkD;AAClD,MAAI;AACF,WAAO;AAAA,MACL,SAAS,WAAW,MAAM,UAAU,OAAO;AAAA,MAC3C,OAAOC,oBAAmB,MAAM,UAAU,MAAM,IAAI;AAAA,MACpD,KAAKC,2BAA0B,MAAM,UAAU,IAAI,IAAI;AAAA,MACvD,WAAWC,sBAAqB,MAAM,UAAU,SAAS;AAAA,MACzD,SAASC,qBAAoB,MAAM,UAAU,QAAQ,IAAI;AAAA,MACzD,YAAYD,sBAAqB,MAAM,UAAU,UAAU;AAAA,MAC3D,cAAcE,8BAA6B,MAAM,UAAU,aAAa,IAAI;AAAA,MAC5E,mBAAmB,UAAU,kBAAkB,IAAI,UAAQC,SAAQ,MAAM,IAAI,CAAC;AAAA,MAC9E,cAAcH,sBAAqB,MAAM,UAAU,YAAY;AAAA,IACjE;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBACP,WACA,QACS;AACT,SAAOH,0BAAyB,UAAU,UAAU,KAC/CA,0BAAyB,UAAU,aAAa,KAChD,UAAU,iBAAiB,UAAU,cACrC,OAAO,iBAAiB,OAAO,aAC/B,kBAAkB,OAAO,mBAAmB,UAAU,QAAQ,UAAU,KACxE,kBAAkB,OAAO,mBAAmB,UAAU,MAAM,UAAU,KACtE,kBAAkB,OAAO,mBAAmB,UAAU,aAAa,UAAU;AACpF;AAEA,eAAe,mBACb,WACA,QACkB;AAClB,QAAM,kBAAkB,MAAM,QAAQ,IAAI;AAAA,IACxC,oBAAoB,OAAO,OAAO;AAAA,IAClC,oBAAoB,OAAO,GAAG;AAAA,IAC9B,oBAAoB,OAAO,KAAK;AAAA,IAChC,oBAAoB,OAAO,YAAY;AAAA,EACzC,CAAC;AACD,SAAO,gBAAgB,CAAC,MAAM,UAAU,QAAQ,cAC3C,gBAAgB,CAAC,MAAM,UAAU,IAAI,cACrC,gBAAgB,CAAC,MAAM,UAAU,MAAM,cACvC,gBAAgB,CAAC,MAAM,UAAU,aAAa;AACrD;AAEA,SAAS,qBACP,WACA,QAC0D;AAC1D,MAAI,CAAC,4BAA4B,OAAO,SAAS,OAAO,cAAc,OAAO,OAAO,EAAG,QAAO;AAC9F,MAAI,CAAC,qBAAqB,OAAO,OAAO,OAAO,SAAS,EAAG,QAAO;AAClE,MAAI,CAAC,4BAA4B,WAAW,OAAO,YAAY,EAAG,QAAO;AACzE,QAAM,YAAY,EAAE,MAAM,OAAO,KAAK,YAAY,UAAU,IAAI,WAAW;AAC3E,MAAI,CAAC,mBAAmB,OAAO,SAAS,WAAW,OAAO,YAAY,EAAG,QAAO;AAChF,MAAI,CAAC,WAAW,OAAO,SAAS,UAAU,UAAU,KAC/C,CAAC,WAAW,OAAO,SAAS,UAAU,aAAa,EAAG,QAAO;AAClE,MAAI,CAAC,WAAW,OAAO,KAAK,UAAU,UAAU,KAC3C,CAAC,WAAW,OAAO,KAAK,UAAU,aAAa,EAAG,QAAO;AAC9D,MAAI,CAAC,0BAA0B,OAAO,cAAc,OAAO,SAAS,UAAU,UAAU,KACnF,OAAO,aAAa,iBAAiB,UAAU,iBAAiB,EAAG,QAAO;AAC/E,SAAO;AACT;AAEA,eAAe,iBACb,WACA,QACqG;AACrG,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,UAAU,KAAK,cAAc;AAAA,MAC9C,eAAe,UAAU,IAAI;AAAA,MAC7B,OAAO,OAAO,IAAI;AAAA,MAClB,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,4BAA4B,uBAAuB;AAAA,EAC5D;AACA,MAAI,eAAe,OAAW,QAAO,4BAA4B,uBAAuB;AACxF,MAAI,WAAW,kBAAkB,UAAU,IAAI,cAAc,WAAW,UAAU,OAAO,IAAI,OAAO;AAClG,WAAO,4BAA4B,qBAAqB;AAAA,EAC1D;AAEA,MAAI;AACF,WAAO;AAAA,MACL,WAAW,MAAM,wBAAwB;AAAA,QACvC,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,WAAO,4BAA4B,mBAAmB;AAAA,EACxD;AACF;AAEA,SAAS,+BACP,WACA,QACA,WACgC;AAChC,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,OAAO,OAAO;AAAA,MACrB,SAAS,OAAO;AAAA,MAChB,eAAe,UAAU,IAAI;AAAA,MAC7B,WAAW,OAAO,aAAa;AAAA,MAC/B,OAAO,UAAU,MAAM;AAAA,MACvB,OAAO,OAAO,aAAa;AAAA,MAC3B,WAAW,OAAO;AAAA,MAClB,SAAS,UAAU,QAAQ;AAAA,MAC3B,YAAY,OAAO;AAAA,MACnB,cAAc,UAAU,aAAa;AAAA,IACvC,CAAC;AAAA,IACD,eAAe,UAAU;AAAA,IACzB,OAAO,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,YAAY,UAAU,MAAM,WAAW,CAAC;AAAA,IACnF,KAAK,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,YAAY,UAAU,IAAI,WAAW,CAAC;AAAA,IAC7E,IAAI;AAAA,IACJ;AAAA,IACA,SAAS,OAAO,OAAO,EAAE,MAAM,OAAO,SAAS,YAAY,UAAU,QAAQ,WAAW,CAAC;AAAA,IACzF,cAAc,OAAO,OAAO,EAAE,MAAM,OAAO,cAAc,YAAY,UAAU,aAAa,WAAW,CAAC;AAAA,IACxG,YAAY,UAAU;AAAA,EACxB,CAAC;AACH;AASA,eAAsB,wCACpB,WAC0C;AAC1C,QAAM,SAAS,oCAAoC,SAAS;AAC5D,MAAI,WAAW,OAAW,QAAO,4BAA4B,qBAAqB;AAClF,MAAI,CAAC,oBAAoB,WAAW,MAAM,EAAG,QAAO,4BAA4B,uBAAuB;AACvG,MAAI,CAAC,MAAM,mBAAmB,WAAW,MAAM,EAAG,QAAO,4BAA4B,oBAAoB;AACzG,QAAM,gBAAgB,qBAAqB,WAAW,MAAM;AAC5D,MAAI,kBAAkB,OAAW,QAAO,4BAA4B,aAAa;AACjF,QAAM,YAAY,MAAM,iBAAiB,WAAW,MAAM;AAC1D,MAAI,QAAQ,UAAW,QAAO;AAC9B,MAAI,CAAC,mBAAmB,OAAO,OAAO,UAAU,SAAS,GAAG;AAC1D,WAAO,4BAA4B,qBAAqB;AAAA,EAC1D;AACA,MAAI,CAAC,0BAA0B,OAAO,SAAS,UAAU,SAAS,GAAG;AACnE,WAAO,4BAA4B,uBAAuB;AAAA,EAC5D;AACA,SAAO,+BAA+B,WAAW,QAAQ,UAAU,SAAS;AAC9E;AAGO,SAAS,yCACd,WACA,SACS;AACT,QAAM,SAASO,sBAAqB,UAAU,SAAS;AACvD,MAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,SAAO,OAAO,KAAK,YAAY,QAAQ,WAClC,OAAO,KAAK,cAAc,QAAQ,aAClC,OAAO,KAAK,eAAe,QAAQ,cACnC,OAAO,KAAK,YAAY,QAAQ,WAChC,OAAO,KAAK,kBAAkB,QAAQ,iBACtC,OAAO,KAAK,UAAU,QAAQ,SAC9B,OAAO,KAAK,iBAAiB,QAAQ,gBACrC,OAAO,KAAK,UAAU,QAAQ,SAC9B,OAAO,KAAK,cAAc,QAAQ;AACzC;AAEA,eAAe,uBACb,QACA,WACA,eACA,cACkB;AAClB,MAAI,OAAO,kBAAkB,iBACxB,MAAM,sBAAsB,OAAO,SAAS,MAAM,iBAClD,MAAM,sBAAsB,SAAS,MAAM,cAAe,QAAO;AACtE,SAAO,iBAAiB,UAAa,OAAO,iBAAiB;AAC/D;AAGA,eAAsB,gCACpB,OACmD;AACnD,QAAM,UAAU,MAAM,aAAa;AACnC,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,EAC1F;AACA,QAAM,YAAY,wBAAwB,MAAM;AAChD,QAAM,gBAAgB,MAAM,sBAAsB,SAAS;AAC3D,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,MAAM,MAAM,EAAE,WAAW,cAAc,CAAC;AACnE,QAAI,OAAO,SAAS,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AACnF,QAAK,OAAO,SAAS,eAAe,OAAO,SAAS,YAC/C,CAAC,MAAM,uBAAuB,OAAO,QAAQ,WAAW,aAAa,GAAG;AAC3E,aAAO,EAAE,IAAI,OAAO,QAAQ,0BAA0B;AAAA,IACxD;AACA,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,IAAI;AAAA,IACN,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AAAA,EAC5D;AACF;AAGA,eAAsB,uCACpB,OAC0D;AAC1D,MAAI,CAACP,0BAAyB,MAAM,UAAU,EAAG,QAAO,EAAE,MAAM,gBAAgB;AAChF,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,MAAM,aAAa;AAAA,MAC5C,eAAeM,SAAQ,MAAM,MAAM,aAAa;AAAA,MAChD,YAAY,MAAM;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,CAAC,qBAAqB,WAAW,WAAW,WAAW,UAAU,EAAE,SAAS,OAAO,IAAI,GAAG;AAC7F,aAAO,EAAE,MAAM,gBAAgB;AAAA,IACjC;AACA,QAAI,OAAO,SAAS,aACf,CAAC,MAAM;AAAA,MACR,OAAO;AAAA,MACP,OAAO,OAAO;AAAA,MACdA,SAAQ,MAAM,MAAM,aAAa;AAAA,IACnC,EAAG,QAAO,EAAE,MAAM,gBAAgB;AACpC,SAAK,OAAO,SAAS,aAAa,OAAO,SAAS,wBAC7C,OAAO,OAAO,UAAU,YAAa,QAAO,EAAE,MAAM,gBAAgB;AACzE,QAAI,OAAO,SAAS,cAAc,OAAO,OAAO,UAAU,WAAY,QAAO,EAAE,MAAM,gBAAgB;AACrG,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,EAAE,MAAM,oBAAoB;AAAA,EACrC;AACF;AAEA,SAAS,gBACP,QAC2C;AAC3C,SAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AAC5C;AAOA,eAAe,4BACb,OACA,QACA,eACA,cACA,sBACA,YAC+F;AAC/F,MAAI,CAAC,wBAAwB,OAAO,SAAS,aAAa;AACxD,WAAO,gBAAgB,OAAO,SAAS,cACnC,iCACA,mBAAmB;AAAA,EACzB;AACA,MAAI,CAAC,WAAY,QAAO,gBAAgB,eAAe;AACvD,MAAI,OAAO,SAAS,UAAW,QAAO,gBAAgB,qBAAqB;AAC3E,MAAI,OAAO,SAAS,UAAW,QAAO,gBAAgB,mBAAmB;AACzE,MAAI,OAAO,SAAS,gBAAiB,QAAO,gBAAgB,yBAAyB;AACrF,MAAI,OAAO,SAAS,YAAa,QAAO,gBAAgB,8BAA8B;AACtF,MAAK,OAAO,SAAS,eAAe,OAAO,SAAS,cAC/C,CAAC,MAAM,uBAAuB,OAAO,QAAQ,MAAM,WAAW,eAAe,YAAY,GAAG;AAC/F,WAAO,gBAAgB,yBAAyB;AAAA,EAClD;AACA,SAAO;AACT;AAQA,eAAsB,mCACpB,OACsD;AACtD,MAAI,CAAC,yCAAyC,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;AAC1F,WAAO,gBAAgB,2BAA2B;AAAA,EACpD;AACA,MAAI,CAACN,0BAAyB,MAAM,UAAU,EAAG,QAAO,gBAAgB,mBAAmB;AAC3F,QAAM,uBAAuB,MAAM,UAAU,YAAY,MAAM,cAC1D,MAAM,aAAa,MAAM,UAAU;AACxC,QAAM,aAAa;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,aAAa,UAAU,UAAU;AAAA,EACjD;AACA,QAAM,aAAa,uBACf,MAAM,gCAAgC,EAAE,GAAG,YAAY,YAAY,MAAM,WAAW,CAAC,IACrF,MAAM,6BAA6B,UAAU;AACjD,MAAI,wBAAwB,CAAC,WAAY,QAAO,gBAAgB,eAAe;AAE/E,QAAM,CAAC,eAAe,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,IACtD,sBAAsB,MAAM,SAAS;AAAA,IACrC,oBAAoB,MAAM,QAAQ;AAAA,EACpC,CAAC;AACD,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,MAAM,iBAAiB;AAAA,MAChD;AAAA,MACA,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AACD,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,WAAY,QAAO;AAE/B,UAAM,aAAa,iCAAiC;AAAA,MAClD,WAAW;AAAA,MACX,eAAe,MAAM,aAAa,QAAQ;AAAA,MAC1C,OAAO,MAAM,aAAa,QAAQ;AAAA,MAClC,UAAU;AAAA,MACV,SAAS,MAAM,aAAa,QAAQ;AAAA,MACpC,cAAc,MAAM,aAAa,QAAQ;AAAA,IAC3C,CAAC;AACD,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA,gBAAgB,MAAM,oBAAoB,UAAU;AAAA,MACpD;AAAA,MACA,aAAa,WAAW;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,gBAAgB,6BAA6B;AAAA,EACtD;AACF;AAEA,SAAS,0BAA0B,SAA2B,WAA+C;AAC3G,QAAM,SAAS,UAAU;AACzB,SAAO,OAAO,uBAAuB,QAAQ,OAAO,uBAC/C,QAAQ,OAAO,KAAK,WAAS,iBAAiB,MAAM,QAAQ,OAAO,MAAM,CAAC;AACjF;;;AEtmBA;AAAA,EACE,cAAAQ;AAAA,EACA,mBAAAC;AAAA,EACA,WAAAC;AAAA,EACA,iCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAAC,UAAS;AAKX,IAAM,sCAAsCA,GAAE,aAAa;AAAA,EAChE,SAASF;AAAA,EACT,iBAAiBA;AAAA,EACjB,gBAAgB;AAAA,EAChB,sBAAsBH;AAAA,EACtB,YAAYI;AAAA,EACZ,WAAWA;AAAA,EACX,cAAcH;AAAA,EACd,SAASI,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAYH;AAAA,EACZ,YAAYA;AAAA,EACZ,kBAAkBA;AAAA,EAClB,aAAaA;AAAA,EACb,WAAWA;AACb,CAAC,EAAE;AAAA,EACD,WAAS,MAAM,mBAAmB,MAAM,WAAW,MAAM,UAAU,MAAM;AAAA,EACzE;AACF;;;AC1BA;AAAA,EACE,cAAAI;AAAA,EACA,iBAAAC;AAAA,OACK;;;ACNP;AAAA,EACE;AAAA,EACA;AAAA,EACA,mBAAAC;AAAA,EACA,WAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,yBAAAC;AAAA,EACA,6BAAAC;AAAA,OACK;AA8BA,SAAS,gCACd,SACqB;AACrB,QAAM,EAAE,OAAO,IAAI;AAEnB,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,mBAAmB,SAAiF;AACxG,yBAAmB,OAAO;AAE1B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,UAAU,QAAQ,cAAc;AAClC,cAAM,IAAI,MAAM,wBAAwB,OAAO,8BAA8B,QAAQ,YAAY,EAAE;AAAA,MACrG;AAEA,YAAM,SAAS,MAAM,OAAO,OAAO,QAAQ,YAAY;AAAA,QACrD,4BAA4BD;AAAA,QAC5B,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,eAAe;AAAA,QACrF,SAAS,QAAQ;AAAA,MACnB,CAAC;AACD,YAAM,qBAAqB,MAAM,gBAAgB,QAAQ,QAAQ,YAAY,QAAQ,WAAW,OAAO;AAEvG,UAAI;AACJ,iBAAW,SAAS,QAAQ;AAC1B,mBAAW,MAAM,gBAAgB,QAAQ,OAAO,SAAS,SAAS,kBAAkB;AACpF,YAAI,aAAa,OAAW;AAAA,MAC9B;AAEA,YAAM,mBAAmB,MAAM,SAAS,MAAM;AAC9C,UAAI,qBAAqB,SAAS;AAChC,cAAM,IAAI,MAAM,sDAAsD,OAAO,OAAO,gBAAgB,GAAG;AAAA,MACzG;AAEA,YAAM,MAAM,QAAQ,eAAe;AACnC,UAAI,aAAa,QAAW;AAC1B,eAAO,OAAO,OAAO;AAAA,UACnB;AAAA,UACA,SAAS;AAAA,UACT,cAAc,QAAQ;AAAA,UACtB;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO,OAAO,OAAO;AAAA,QACnB;AAAA,QACA,SAAS;AAAA,QACT,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAOA,eAAe,gBACb,QACA,YACA,SACA,SAC8B;AAC9B,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,SAAS,MAAM,OAAO,OAAO,YAAY;AAAA,IAC7C,4BAA4BC;AAAA,IAC5B;AAAA,EACF,CAAC;AAED,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,YAAY,OAAO,YAAY,SAASA,4BAA2B,OAAO,EAAG;AAClF,UAAM,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU;AACnD,QAAI,QAAQ,cAAc,WAAY;AACtC,QAAI,OAAO,mBAAmBA,8BAA6B,OAAO,eAAe,MAAM,WAAY;AACnG,QAAI,CAACC,UAAS,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,QAAQ,QAAQ,EAAG;AACxE,UAAM,aAAa,sBAAsB,EAAE,GAAG,OAAO,QAAQ,QAAQ,OAAO,eAAe,CAAC;AAC5F,QAAI,eAAe,OAAW,SAAQ,IAAI,WAAW,KAAK;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,eAAe,gBACb,QACA,OACA,SACA,SACA,oBACwC;AACxC,MAAI,CAAC,YAAY,OAAO,QAAQ,YAAY,QAAQ,WAAWF,wBAAuB,OAAO,EAAG,QAAO;AACvG,MAAI,mBAAmB,IAAI,MAAM,UAAU,EAAG,QAAO;AACrD,MAAI,QAAQ,mBAAmB,UAAa,MAAM,eAAe,QAAQ,eAAgB,QAAO;AAEhG,QAAM,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU;AACnD,QAAM,QAAQ,sBAAsB,QAAQ,MAAM,UAAU;AAC5D,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,MAAM,cAAc,QAAQ,UAAW,QAAO;AAClD,MAAI,MAAM,iBAAiB,QAAQ,aAAc,QAAO;AACxD,MAAI,MAAM,YAAY,QAAQ,QAAS,QAAO;AAC9C,MAAI,CAAC,MAAM,YAAY,SAAS,SAAS,EAAG,QAAO;AAEnD,SAAO,OAAO,OAAO;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,sBAAsB,QAAQ;AAAA,IAC9B,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,kBAAkB,QAAQ;AAAA,IAC1B,YAAY,QAAQ;AAAA,IACpB,cAAc,MAAM;AAAA,IACpB,IAAI,MAAM;AAAA,IACV,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IAC/E,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAChE,QAAQ,MAAM;AAAA,EAChB,CAAC;AACH;AAEA,SAAS,YACP,OACA,YACA,SACA,sBACA,SACS;AACT,MAAI,MAAM,WAAW,WAAY,QAAO;AACxC,MAAI,MAAM,YAAY,QAAS,QAAO;AACtC,MAAI,MAAM,yBAAyB,qBAAsB,QAAO;AAChE,MAAI,CAACG,0BAAyB,MAAM,UAAU,KAAK,MAAM,aAAa,QAAS,QAAO;AACtF,MAAI,CAACA,0BAAyB,MAAM,SAAS,KAAK,MAAM,YAAY,MAAM,WAAY,QAAO;AAC7F,MAAI,CAACL,SAAQ,UAAU,MAAM,cAAc,EAAE,QAAS,QAAO;AAC7D,SAAOA,SAAQ,UAAU,MAAM,UAAU,EAAE;AAC7C;AAEA,SAAS,sBACP,QACA,oBAC6B;AAC7B,MAAI,QAAQ,cAAc,WAAY,QAAO;AAC7C,MAAI,OAAO,mBAAmBE,0BAAyB,OAAO,eAAe,mBAAoB,QAAO;AACxG,MAAI,CAACE,UAAS,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAC/E,SAAO,kBAAkB;AAAA,IACvB,GAAG,OAAO;AAAA,IACV,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,mBAAmB,SAA8C;AACxE,MAAI,QAAQ,mBAAmB,UAAa,CAACJ,SAAQ,UAAU,QAAQ,cAAc,EAAE,SAAS;AAC9F,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AACA,MAAI,CAACC,sBAAqB,UAAU,QAAQ,UAAU,EAAE,SAAS;AAC/D,UAAM,IAAI,UAAU,+CAA+C;AAAA,EACrE;AACA,MAAI,CAACA,sBAAqB,UAAU,QAAQ,SAAS,EAAE,SAAS;AAC9D,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,MAAI,CAACF,iBAAgB,UAAU,QAAQ,YAAY,EAAE,SAAS;AAC5D,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,MAAI,QAAQ,YAAY,WAAc,QAAQ,QAAQ,WAAW,KAAK,QAAQ,QAAQ,SAAS,MAAM;AACnG,UAAM,IAAI,UAAU,gEAAgE;AAAA,EACtF;AACA,MAAI,CAACM,0BAAyB,QAAQ,YAAY,GAAG;AACnD,UAAM,IAAI,WAAW,uDAAuD;AAAA,EAC9E;AACF;AAEA,eAAe,SAAS,QAAuD;AAC7E,QAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,MAAI,CAACA,0BAAyB,IAAI,GAAG;AACnC,UAAM,IAAI,WAAW,yDAAyD;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAASA,0BAAyB,OAAiC;AACjE,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAASD,UAAS,OAA4D;AAC5E,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;ADzLO,SAAS,wCACd,SACqB;AACrB,QAAM,uBAAuBE,YAAW,MAAM,QAAQ,oBAAoB;AAC1E,QAAM,SAASC,eAAc,MAAM,QAAQ,MAAM;AACjD,QAAM,SAAS,gCAAgC,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACzE,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,mBAAmB,SAAiF;AACxG,YAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,UAAI,QAAQ,yBAAyB,wBAAwB,QAAQ,eAAe,YAAY;AAC9F,cAAM,IAAI,UAAU,sFAAsF;AAAA,MAC5G;AACA,YAAM,OAAO,MAAM,QAAQ,WAAW,KAAK,OAAO;AAClD,UAAI,SAAS,OAAW,QAAO,EAAE,SAAS,OAAO,SAAS,QAAQ,aAAa;AAC/E,YAAM,aAAa,oCAAoC,MAAM,IAAI;AACjE,UAAI,WAAW,YAAY,QAAQ,gBAC9B,WAAW,yBAAyB,wBACpC,WAAW,eAAe,cAC1B,WAAW,eAAe,QAAQ,cAClC,WAAW,qBAAqB,QAAQ,oBACxC,WAAW,eAAe,QAAQ,cAClC,WAAW,cAAc,QAAQ,aACjC,WAAW,iBAAiB,QAAQ,gBACpC,WAAW,YAAY,QAAQ,SAAS;AAC3C,cAAM,IAAI,UAAU,8EAA8E;AAAA,MACpG;AACA,YAAM,WAAW,MAAM,OAAO,mBAAmB,EAAE,GAAG,SAAS,gBAAgB,WAAW,UAAU,CAAC;AACrG,UAAI,SAAS,YAAY,WAAW,SAAS;AAC3C,cAAM,IAAI,UAAU,+FAA+F;AAAA,MACrH;AACA,aAAO,SAAS,UACZ,OAAO,OAAO;AAAA,QACZ,GAAG;AAAA,QACH,OAAO,OAAO,OAAO;AAAA,UACnB,GAAG,SAAS;AAAA,UACZ;AAAA,UACA;AAAA,UACA,YAAY,WAAW;AAAA,UACvB,kBAAkB,WAAW;AAAA,QAC/B,CAAC;AAAA,MACH,CAAC,IACD;AAAA,IACN;AAAA,EACF,CAAC;AACH;;;AErEA;AAAA,EACE,cAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,iCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,8BAAAC;AAAA,EACA,8BAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,sBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,OACK;AAKP;AAAA,EACE;AAAA,EACA,kBAAAC;AAAA,OACK;AACP,SAAS,KAAAC,UAAS;AAUX,IAAM,qCAAqC;AAE3C,IAAM,mCAAmC;AAEzC,IAAM,wBAAwBC,GAAE,aAAa;AAAA,EAClD,UAAUC;AAAA,EACV,sBAAsBC;AAAA,EACtB,YAAYC;AAAA,EACZ,cAAcC;AAAA,EACd,SAASJ,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,QAAQK;AAAA,EACR,YAAYC;AAAA,EACZ,kBAAkBA;AAAA,EAClB,cAAcC;AAAA,EACd,qBAAqBC,4BAA2B,IAAI,mCAAmC;AAAA,EACvF,mBAAmBD;AACrB,CAAC;AA+ED,eAAsB,kBAAkB,OAAiE;AACvG,QAAM,cAAc,sBAAsB,UAAU,MAAM,KAAK;AAC/D,MAAI,CAAC,YAAY,WAAW,CAACA,+BAA8B,UAAU,MAAM,UAAU,EAAE,SAAS;AAC9F,WAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAAA,EACtD;AACA,QAAM,cAAcE,iBAAgB,UAAU,MAAM,IAAI;AACxD,MAAI,CAAC,YAAY,QAAS,QAAO,cAAc,MAAM,MAAM,YAAY,MAAM,MAAM;AACnF,QAAM,QAAQ,YAAY;AAC1B,MAAI,MAAM,eAAe,MAAM,qBAAqB;AAAA,IAClD,QAAQC;AAAA,IACR,QAAQ,MAAM;AAAA,IACd,cAAc,MAAM;AAAA,IACpB,qBAAqB,MAAM;AAAA,EAC7B,CAAC,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AACxD,QAAM,QAAQ,OAAO,OAAO,EAAE,GAAG,YAAY,MAAM,QAAQ,OAAO,OAAO,YAAY,KAAK,MAAM,EAAE,CAAC;AACnG,MAAI,MAAM,yBAAyB,MAAM,sBAAsB;AAC7D,WAAO,EAAE,IAAI,OAAO,QAAQ,qCAAqC;AAAA,EACnE;AACA,MAAI,CAAC,iBAAiB,MAAM,QAAQ,MAAM,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AACvG,MAAI,MAAM,eAAe,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAC/F,MAAI,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,YAAY,MAAM,SAAS;AAChF,WAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAAA,EACtD;AACA,MAAI,MAAM,eAAe,MAAM,aAAc,QAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAC9F,MAAI,MAAM,aAAa,MAAM,gBAAgB,MAAM,oBAAqB,QAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;AAEtH,QAAM,MAAM,MAAM,iBAAiB,MAAM,KAAK,MAAM,UAAU,MAAM,UAAU;AAC9E,MAAI,CAAC,IAAI,GAAI,QAAO;AACpB,MAAI;AACJ,MAAI;AACF,gBAAY,MAAMC,gBAAe,SAAS,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AACA,MAAI,cAAc,IAAI,IAAI,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AACvF,QAAM,aAAa,MAAM,eAAe,MAAM,MAAM;AACpD,SAAO,OAAO,OAAO;AAAA,IACnB,IAAI;AAAA,IACJ,UAAU,OAAO,OAAO;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,cAAc,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,WAAW,IAAI,IAAI;AAAA,MACnB,cAAc,MAAM;AAAA,MACpB,UAAU,MAAM;AAAA,MAChB,OAAO,IAAI,IAAI;AAAA,MACf,WAAW,IAAI,IAAI;AAAA,MACnB,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,MAChE,OAAO,OAAO,OAAO;AAAA,QACnB,GAAG;AAAA,QAAO,QAAQ,OAAO,OAAO,MAAM,MAAM;AAAA,QAAG;AAAA,MACjD,CAAC;AAAA,MACD,YAAY,MAAM;AAAA,MAClB,eAAe,IAAI,IAAI;AAAA,MACvB,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAe,iBAAiB,OAAe,UAAkB,YAA+C;AAC9G,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,UAAU,OAAO,EAAE,UAAU,KAAK,WAAW,CAAC;AAAA,EACzE,SAAS,OAAO;AACd,WAAOC,QAAO,iBAAiB,CAACC,cAAa,KAAK,CAAC,CAAC;AAAA,EACtD;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,OAAO,OAAO,SAAS,WAAW,CAAC,GAAG,KAAK,EAAG,QAAOD,QAAO,qBAAqB;AACrF,WAAOA,QAAO,sBAAsB,SAAS,OAAO,GAAG,SAAS,OAAO;AAAA,EACzE;AAEA,QAAM,aAAa,mBAAmB,SAAS,QAAQ,SAAS,SAAS,QAAQ;AACjF,MAAI,CAAC,WAAW,GAAI,QAAO;AAE3B,QAAM,EAAE,QAAQ,cAAc,SAAS,cAAc,IAAI;AACzD,MAAI,aAAa,QAAQ,cAAc,IAAK,QAAOA,QAAO,sBAAsB;AAChF,MAAI,cAAc,OAAO,WAAY,QAAOA,QAAO,aAAa;AAChE,MAAI,cAAc,MAAM,cAAc,MAAM,mCAAoC,QAAOA,QAAO,sBAAsB;AACpH,MAAI,cAAc,MAAM,aAAa,iCAAkC,QAAOA,QAAO,gBAAgB;AAErG,QAAM,MAA0B,OAAO,OAAO;AAAA,IAC5C,WAAW,cAAc;AAAA,IACzB,WAAW,cAAc;AAAA,IACzB,UAAU,cAAc;AAAA,IACxB,OAAO,cAAc;AAAA,IACrB,WAAW,cAAc;AAAA,EAC3B,CAAC;AACD,SAAO,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;AACxC;AAEA,SAAS,mBAAmB,QAAmB,SAAqB,UAAuC;AACzG,QAAM,eAAe,iBAAiB,UAAU,MAAM;AACtD,MAAI,CAAC,aAAa,SAAS;AACzB,QAAI,CAACT,sBAAqB,UAAU,OAAO,GAAG,EAAE,QAAS,QAAOS,QAAO,sBAAsB;AAC7F,WAAOA,QAAO,sBAAsB,WAAW,aAAa,MAAM,MAAM,CAAC;AAAA,EAC3E;AACA,MAAI,OAAO,OAAO,SAAS,KAAK,EAAG,QAAOA,QAAO,qBAAqB;AACtE,MAAI,CAACT,sBAAqB,UAAU,QAAQ,GAAG,EAAE,QAAS,QAAOS,QAAO,sBAAsB;AAC9F,MAAI,QAAQ,WAAW,cAAe,QAAOA,QAAO,qBAAqB;AACzE,MAAI,QAAQ,QAAQ,SAAU,QAAOA,QAAO,uBAAuB;AACnE,MAAI,CAACE,0BAAyB,QAAQ,GAAG,KAAK,CAACA,0BAAyB,QAAQ,GAAG,KAAK,QAAQ,OAAO,QAAQ,KAAK;AAClH,WAAOF,QAAO,sBAAsB;AAAA,EACtC;AAEA,QAAM,gBAAgB,kBAAkB,UAAU,OAAO;AACzD,MAAI,CAAC,cAAc,QAAS,QAAOA,QAAO,sBAAsB,WAAW,cAAc,MAAM,MAAM,CAAC;AACtG,SAAO,OAAO,OAAO;AAAA,IACnB,QAAQ,aAAa;AAAA,IACrB,IAAI;AAAA,IACJ,SAAS,cAAc;AAAA,EACzB,CAAC;AACH;AAEA,SAAS,sBAAsB,SAA8D;AAC3F,MAAI,QAAQ,KAAK,YAAU,OAAO,WAAW,oBAAoB,CAAC,EAAG,QAAO;AAC5E,MAAI,QAAQ,KAAK,YAAU,OAAO,WAAW,UAAU,CAAC,EAAG,QAAO;AAClE,MAAI,QAAQ,KAAK,YAAU,OAAO,WAAW,kBAAkB,KAAK,OAAO,WAAW,kBAAkB,CAAC,GAAG;AAC1G,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,KAAK,YACf,OAAO,WAAW,qBAAqB,KACpC,OAAO,WAAW,oCAAoC,KACtD,WAAW,uCACf,GAAG;AACF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,cACP,MACA,QAC0B;AAC1B,QAAM,UAAU,WAAW,MAAM;AACjC,MAAI,qBAAqB,IAAI,EAAG,QAAOA,QAAO,iBAAiB,OAAO;AACtE,MAAIG,UAAS,IAAI,KAAK,OAAO,OAAO,MAAM,QAAQ,KAC7C,OAAO,KAAK,WAAS,MAAM,KAAK,CAAC,MAAM,QAAQ,EAAG,QAAOH,QAAO,mBAAmB,OAAO;AAC/F,SAAOA,QAAO,mBAAmB,OAAO;AAC1C;AAEA,SAAS,qBAAqB,OAAyB;AACrD,MAAI,CAACG,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,EAAE,cAAc,WAAW,IAAI;AACrC,SAAO,OAAO,iBAAiB,YAC1B,OAAO,eAAe,YACtBD,0BAAyB,YAAY,KACrCA,0BAAyB,UAAU,KACnC,eAAe;AACtB;AAEA,SAASA,0BAAyB,OAAwB;AACxD,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS;AACjD;AAEA,SAASC,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,WAAW,QAA2G;AAC7H,SAAO,OAAO,IAAI,CAAC,UAAU;AAC3B,UAAM,OAAO,MAAM,KAAK,IAAI,MAAM,EAAE,KAAK,GAAG,KAAK;AACjD,WAAO,GAAG,IAAI,KAAK,MAAM,OAAO;AAAA,EAClC,CAAC;AACH;AAEA,SAASH,QACP,QACA,SAC0B;AAC1B,MAAI,YAAY,OAAW,QAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AACrE,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC;AAAA,IACnC,IAAI;AAAA,IACJ;AAAA,EACF,CAAC;AACH;AAEA,SAASC,cAAa,OAAwB;AAC5C,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;;AC1QA,eAAsB,WAAiC,OAAyB,SAA8C;AAC5H,MAAI,UAAU;AACd,aAAS;AACP,UAAM,SAAS,MAAM,MAAM,MAAM;AACjC,QAAI,WAAW,OAAW,QAAO;AAEjC,QAAI;AACF,YAAM,QAAQ,OAAO,IAAI;AAAA,IAC3B,SAAS,OAAO;AACd,YAAM,OAAO,QAAQ;AACrB,YAAM;AAAA,IACR;AACA,UAAM,OAAO,IAAI;AACjB,eAAW;AAAA,EACb;AACF;",
-  "names": ["PayloadBuilder", "bytesToCanonicalBase64Url", "EncryptedWakeSubscriptionZod", "EndpointChallengeResponseZod", "EndpointChallengeZod", "generateHandshakeId", "HashZod", "MAX_SUBSCRIPTION_PLAINTEXT_BYTES", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "WakeSubscriptionCleartextZod", "WakeSubscriptionPlaintextZod", "PayloadBuilder", "Base64Url32BytesZod", "bytesToCanonicalBase64Url", "canonicalBase64UrlToBytes", "EncryptedWakeSubscriptionZod", "HashZod", "NormalizedAddressZod", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "WakeSubscriptionCleartextZod", "NormalizedAddressZod", "NormalizedAddressZod", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "HashZod", "Base64Url32BytesZod", "canonicalBase64UrlToBytes", "bytesToCanonicalBase64Url", "WakeSubscriptionCleartextZod", "NormalizedAddressZod", "EncryptedWakeSubscriptionZod", "EncryptedWakeSubscriptionZod", "EndpointChallengeZod", "EndpointChallengeResponseZod", "HashZod", "PayloadBuilder", "generateHandshakeId", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "MAX_SUBSCRIPTION_PLAINTEXT_BYTES", "bytesToCanonicalBase64Url", "WakeSubscriptionPlaintextZod", "WakeSubscriptionCleartextZod", "isNonnegativeSafeInteger", "service", "key", "WakeGrantObjectSchema", "WakeGrantRevocationSchema", "EncryptedWakeSubscriptionZod", "EndpointChallengeZod", "HashZod", "NormalizedAddressZod", "PublisherEncryptionKeyZod", "PublisherServiceZod", "WakeGrantObjectZod", "PayloadBuilder", "PayloadBuilder", "isNonnegativeSafeInteger", "WakeGrantObjectZod", "PublisherEncryptionKeyZod", "NormalizedAddressZod", "PublisherServiceZod", "EncryptedWakeSubscriptionZod", "HashZod", "EndpointChallengeZod", "ChainIdZod", "DeploymentIdZod", "HashZod", "NonnegativeJsonSafeIntegerZod", "NormalizedAddressZod", "z", "ChainIdZod", "WakeSourceZod", "DeploymentIdZod", "HashZod", "NormalizedAddressZod", "WakeGrantObjectSchema", "WakeGrantRevocationSchema", "isRecord", "isNonnegativeSafeInteger", "ChainIdZod", "WakeSourceZod", "ChainIdZod", "DeploymentIdZod", "HashZod", "NonnegativeJsonSafeIntegerZod", "NormalizedAddressZod", "PositiveJsonSafeIntegerZod", "SOURCE_WAKE_FILTER_PROFILE", "WakeEnvelopeZod", "WakeJwtAudienceZod", "WakeSourceZod", "PayloadBuilder", "z", "z", "WakeJwtAudienceZod", "ChainIdZod", "NormalizedAddressZod", "DeploymentIdZod", "WakeSourceZod", "HashZod", "NonnegativeJsonSafeIntegerZod", "PositiveJsonSafeIntegerZod", "WakeEnvelopeZod", "SOURCE_WAKE_FILTER_PROFILE", "PayloadBuilder", "reject", "errorMessage", "isNonnegativeSafeInteger", "isRecord"]
+  "sourcesContent": ["import type {\n  ChainId,\n  DeploymentId,\n  Hash,\n  NormalizedAddress,\n  WakeId,\n  WakeJwtAudience,\n  WakeJwtId,\n} from '@xyo-network/event-kit-schemas'\n\nimport type { AdmittedWake } from './types.ts'\n\n/** Replay records survive token expiry by this amount to cover receiver skew. */\nexport const EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS = 60\n\nexport interface WakeGrantAuthorizationRequest {\n  /** Must match the independently pinned grant viewer. */\n  readonly authorizationChainId: ChainId\n  readonly controller: NormalizedAddress\n  readonly deploymentId: DeploymentId\n  /** Required by D-006's activation adapter to select the accepted tuple's exact grant. */\n  readonly exactGrantHash?: Hash\n  readonly expectedHead: number\n  readonly filterHash: Hash\n  readonly publisher: NormalizedAddress\n  readonly queueId?: string\n  readonly sourceHash: Hash\n  readonly subscriptionHash: Hash\n}\n\n/** Concrete grant evidence required for every enabled decision. */\nexport interface WakeGrantEvidence {\n  readonly assertedAtBlock: number\n  /** Checked for every authorization decision. */\n  readonly authorizationChainId: ChainId\n  readonly controller: NormalizedAddress\n  readonly deploymentId: DeploymentId\n  readonly filterHash: Hash\n  readonly id: string\n  readonly objectHash?: Hash\n  readonly queueId?: string\n  readonly sourceHash: Hash\n  readonly subscriptionHash: Hash\n  readonly target: NormalizedAddress\n}\n\nexport interface WakeGrantAuthorizationDisabled {\n  readonly atBlock: number\n  readonly enabled: false\n  /** Optional diagnostics. The core rejects disagreement with its trusted input. */\n  readonly expectedHead?: number\n  /** Optional diagnostics. The core recomputes lag instead of trusting this value. */\n  readonly lag?: number\n}\n\nexport interface WakeGrantAuthorizationEnabled {\n  readonly atBlock: number\n  readonly enabled: true\n  /** Optional diagnostics. The core rejects disagreement with its trusted input. */\n  readonly expectedHead?: number\n  readonly grant: WakeGrantEvidence\n  /** Optional diagnostics. The core recomputes lag instead of trusting this value. */\n  readonly lag?: number\n}\n\nexport type WakeGrantAuthorizationDecision\n  = | WakeGrantAuthorizationDisabled\n    | WakeGrantAuthorizationEnabled\n\n/**\n * Stateful Statement Graph authorization port. Implementations must evaluate\n * the exact controller, scope, publisher, and expected finalized head supplied\n * for this request.\n */\nexport interface WakeGrantAuthorizer {\n  authorizePublisher: (\n    request: WakeGrantAuthorizationRequest,\n  ) => Promise<WakeGrantAuthorizationDecision>\n}\n\n/** Normalized grant snapshot accepted by the protocol core. */\nexport interface AuthorizedWakeGrant {\n  readonly atBlock: number\n  readonly expectedHead: number\n  readonly grant: WakeGrantEvidence\n  readonly lag: number\n}\n\nexport interface WakeAdmissionAttempt {\n  readonly audience: WakeJwtAudience\n  readonly eventHash: Hash\n  readonly jwtId: WakeJwtId\n  readonly publisher: NormalizedAddress\n  /** Token replay record retention deadline (`exp + 60`). */\n  readonly retainJwtUntil: number\n  readonly wakeId: WakeId\n}\n\n/** Stable receipt bound to both durable admission indexes. */\nexport interface WakeAdmissionReceipt {\n  readonly audience: WakeJwtAudience\n  readonly eventHash: Hash\n  readonly id: string\n  readonly publisher: NormalizedAddress\n  readonly wakeId: WakeId\n}\n\nexport type WakeAttemptResolution\n  = | { readonly kind: 'new' }\n    | { readonly kind: 'duplicate'; readonly receipt: WakeAdmissionReceipt }\n    | { readonly kind: 'jwt-id-collision' }\n    | { readonly kind: 'wake-id-collision' }\n\nexport type WakeCommitResult\n  = | { readonly kind: 'enqueued'; readonly receipt: WakeAdmissionReceipt }\n    | { readonly kind: 'duplicate'; readonly receipt: WakeAdmissionReceipt }\n    | { readonly kind: 'jwt-id-collision' }\n    | { readonly kind: 'wake-id-collision' }\n\n/**\n * Durable linearizable admission boundary.\n *\n * `resolveAttempt` must atomically bind a fresh JWT id to an existing matching\n * wake receipt. It must not consume either identity when returning `new`.\n *\n * `commitAuthorized` must atomically recheck both identities, persist both\n * mappings and their stable receipt, and durably enqueue the wake (or write a\n * transactional outbox record). A separate fallible enqueue is nonconforming.\n */\nexport interface AtomicWakeInbox<TWake = AdmittedWake> {\n  commitAuthorized: (input: {\n    readonly attempt: WakeAdmissionAttempt\n    readonly grant: AuthorizedWakeGrant\n    readonly wake: TWake\n  }) => Promise<WakeCommitResult>\n  resolveAttempt: (attempt: WakeAdmissionAttempt) => Promise<WakeAttemptResolution>\n}\n", "import type {\n  AtomicWakeInbox,\n  AuthorizedWakeGrant,\n  WakeAdmissionAttempt,\n  WakeAdmissionReceipt,\n  WakeCommitResult,\n  WakeGrantAuthorizationDecision,\n  WakeGrantAuthorizer,\n  WakeGrantEvidence,\n} from './admissionTypes.ts'\nimport { EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS } from './admissionTypes.ts'\nimport type { AdmittedWake } from './types.ts'\nimport type { VerifiedAdmissionWake } from './verifiedAdmissionWake.ts'\n\nexport interface AdmissionCoreInput<TWake = AdmittedWake> {\n  /** Independently trusted finalized XL1 head for this admission attempt. */\n  readonly expectedHead: number\n  readonly grants: WakeGrantAuthorizer\n  readonly inbox: AtomicWakeInbox<TWake>\n  readonly verified: VerifiedAdmissionWake\n  readonly wake: TWake\n}\n\nexport type AdmitAndEnqueueFailureReason\n  = | 'grant-missing'\n    | 'grant-unavailable'\n    | 'grant-view-invalid'\n    | 'grant-view-stale'\n    | 'inbox-unavailable'\n    | 'jwt-id-collision'\n    | 'wake-id-collision'\n\nexport interface AdmitAndEnqueueFailure {\n  readonly details?: readonly string[]\n  readonly ok: false\n  readonly reason: AdmitAndEnqueueFailureReason\n}\n\nexport interface AdmitAndEnqueueSuccess<TWake = AdmittedWake> {\n  readonly disposition: 'duplicate' | 'enqueued'\n  readonly ok: true\n  readonly receipt: WakeAdmissionReceipt\n  readonly wake: TWake\n}\n\nexport type AdmitAndEnqueueResult<TWake = AdmittedWake> = AdmitAndEnqueueFailure | AdmitAndEnqueueSuccess<TWake>\n\n/**\n * Performs D-002 durable replay/idempotency resolution, live grant\n * authorization, and atomic enqueue after pure request verification.\n */\nexport async function admitVerifiedWake<TWake>(input: AdmissionCoreInput<TWake>): Promise<AdmitAndEnqueueResult<TWake>> {\n  const attemptResult = createAttempt(input.verified)\n  if (!attemptResult.ok) return attemptResult.failure\n  const { attempt } = attemptResult\n  const { wake } = input\n\n  const prior = await resolvePriorAttempt(input.inbox, attempt, wake)\n  if (!prior.pending) return prior.result\n\n  if (!isNonnegativeSafeInteger(input.expectedHead)) {\n    return reject('grant-view-invalid', ['expectedHead must be a nonnegative safe integer'])\n  }\n\n  const authorization = await authorize(input)\n  if (!authorization.ok) return authorization.failure\n  return await commitAuthorizedWake(input.inbox, attempt, authorization.grant, wake)\n}\n\ntype PriorAttemptResult<TWake> = {\n  readonly pending: true\n} | {\n  readonly pending: false\n  readonly result: AdmitAndEnqueueResult<TWake>\n}\n\nasync function resolvePriorAttempt<TWake>(\n  inbox: AtomicWakeInbox<TWake>,\n  attempt: WakeAdmissionAttempt,\n  wake: TWake,\n): Promise<PriorAttemptResult<TWake>> {\n  let resolution\n  try {\n    resolution = await inbox.resolveAttempt(attempt)\n  } catch (error) {\n    return completed(reject('inbox-unavailable', [errorMessage(error)]))\n  }\n\n  if (!isRecord(resolution) || typeof resolution.kind !== 'string') {\n    return completed(reject('inbox-unavailable', ['inbox returned an invalid attempt resolution']))\n  }\n  if (resolution.kind === 'jwt-id-collision' || resolution.kind === 'wake-id-collision') {\n    return completed(reject(resolution.kind))\n  }\n  if (resolution.kind === 'duplicate') {\n    const receiptFailure = validateReceipt(resolution.receipt, attempt)\n    return completed(receiptFailure\n      ?? success('duplicate', snapshotReceipt(resolution.receipt), wake))\n  }\n  if (resolution.kind !== 'new') {\n    return completed(reject('inbox-unavailable', ['inbox returned an unknown attempt resolution']))\n  }\n  return Object.freeze({ pending: true })\n}\n\nasync function commitAuthorizedWake<TWake>(\n  inbox: AtomicWakeInbox<TWake>,\n  attempt: WakeAdmissionAttempt,\n  grant: AuthorizedWakeGrant,\n  wake: TWake,\n): Promise<AdmitAndEnqueueResult<TWake>> {\n  let committed: WakeCommitResult\n  try {\n    committed = await inbox.commitAuthorized({\n      attempt,\n      grant,\n      wake,\n    })\n  } catch (error) {\n    return reject('inbox-unavailable', [errorMessage(error)])\n  }\n\n  if (!isRecord(committed) || typeof committed.kind !== 'string') {\n    return reject('inbox-unavailable', ['inbox returned an invalid commit result'])\n  }\n  if (committed.kind === 'jwt-id-collision' || committed.kind === 'wake-id-collision') {\n    return reject(committed.kind)\n  }\n  if (committed.kind !== 'duplicate' && committed.kind !== 'enqueued') {\n    return reject('inbox-unavailable', ['inbox returned an unknown commit result'])\n  }\n\n  const receiptFailure = validateReceipt(committed.receipt, attempt)\n  if (receiptFailure !== undefined) return receiptFailure\n  return success(committed.kind, snapshotReceipt(committed.receipt), wake)\n}\n\nfunction completed<TWake>(result: AdmitAndEnqueueResult<TWake>): PriorAttemptResult<TWake> {\n  return Object.freeze({ pending: false, result })\n}\n\ntype AttemptResult = {\n  readonly attempt: WakeAdmissionAttempt\n  readonly ok: true\n} | {\n  readonly failure: AdmitAndEnqueueFailure\n  readonly ok: false\n}\n\nfunction createAttempt(verified: VerifiedAdmissionWake): AttemptResult {\n  if (verified.expiresAt > Number.MAX_SAFE_INTEGER - EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS) {\n    return {\n      failure: reject('inbox-unavailable', ['JWT expiry cannot be represented through the replay-retention window']),\n      ok: false,\n    }\n  }\n\n  return {\n    attempt: Object.freeze({\n      audience: verified.audience,\n      eventHash: verified.eventHash,\n      jwtId: verified.jwtId,\n      publisher: verified.publisher,\n      retainJwtUntil: verified.expiresAt + EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,\n      wakeId: verified.wakeId,\n    }),\n    ok: true,\n  }\n}\n\ntype AuthorizationResult = {\n  readonly grant: AuthorizedWakeGrant\n  readonly ok: true\n} | {\n  readonly failure: AdmitAndEnqueueFailure\n  readonly ok: false\n}\n\nasync function authorize<TWake>(\n  input: AdmissionCoreInput<TWake>,\n): Promise<AuthorizationResult> {\n  const { route } = input.verified\n  let decision: WakeGrantAuthorizationDecision\n  try {\n    decision = await input.grants.authorizePublisher({\n      controller: route.controller,\n      authorizationChainId: route.authorizationChainId,\n      sourceHash: route.sourceHash,\n      filterHash: route.filterHash,\n      subscriptionHash: route.subscriptionHash,\n      deploymentId: route.deploymentId,\n      expectedHead: input.expectedHead,\n      publisher: input.verified.publisher,\n      ...(route.queueId === undefined ? {} : { queueId: route.queueId }),\n    })\n  } catch (error) {\n    return { failure: reject('grant-unavailable', [errorMessage(error)]), ok: false }\n  }\n\n  const viewFailure = validateGrantView(decision, input.expectedHead, route.maxGrantLagBlocks)\n  if (viewFailure !== undefined) return { failure: viewFailure, ok: false }\n  if (!decision.enabled) return { failure: reject('grant-missing'), ok: false }\n\n  const evidenceFailure = validateGrantEvidence(decision.grant, input.verified, decision.atBlock)\n  if (evidenceFailure !== undefined) return { failure: evidenceFailure, ok: false }\n\n  const grant: AuthorizedWakeGrant = Object.freeze({\n    atBlock: decision.atBlock,\n    expectedHead: input.expectedHead,\n    grant: snapshotGrantEvidence(decision.grant),\n    lag: input.expectedHead - decision.atBlock,\n  })\n  return { grant, ok: true }\n}\n\nfunction validateGrantView(\n  decision: WakeGrantAuthorizationDecision,\n  expectedHead: number,\n  maxGrantLagBlocks: number,\n): AdmitAndEnqueueFailure | undefined {\n  if (!isRecord(decision)\n    || !Object.hasOwn(decision, 'enabled')\n    || typeof decision.enabled !== 'boolean'\n    || !Object.hasOwn(decision, 'atBlock')) {\n    return reject('grant-view-invalid', ['grant authorizer returned an invalid decision'])\n  }\n  if (!isNonnegativeSafeInteger(decision.atBlock)) {\n    return reject('grant-view-invalid', ['grant atBlock must be a nonnegative safe integer'])\n  }\n  if (decision.atBlock > expectedHead) {\n    return reject('grant-view-invalid', ['grant view is ahead of the trusted finalized head'])\n  }\n  if (decision.expectedHead !== undefined && decision.expectedHead !== expectedHead) {\n    return reject('grant-view-invalid', ['grant diagnostic expectedHead disagrees with the trusted head'])\n  }\n\n  const lag = expectedHead - decision.atBlock\n  if (decision.lag !== undefined && decision.lag !== lag) {\n    return reject('grant-view-invalid', ['grant diagnostic lag disagrees with the recomputed lag'])\n  }\n  if (lag > maxGrantLagBlocks) {\n    return reject('grant-view-stale', [`grantLag=${lag} max=${maxGrantLagBlocks}`])\n  }\n  return undefined\n}\n\nfunction validateGrantEvidence(\n  evidence: WakeGrantEvidence,\n  verified: VerifiedAdmissionWake,\n  atBlock: number,\n): AdmitAndEnqueueFailure | undefined {\n  if (!isRecord(evidence)) return reject('grant-view-invalid', ['enabled grant decision omitted evidence'])\n  const requiredFields = [\n    'assertedAtBlock',\n    'authorizationChainId',\n    'filterHash',\n    'sourceHash',\n    'subscriptionHash',\n    'controller',\n    'deploymentId',\n    'id',\n    'target',\n  ] as const\n  if (requiredFields.some(field => !Object.hasOwn(evidence, field))) {\n    return reject('grant-view-invalid', ['enabled grant evidence requires own canonical fields'])\n  }\n  if (typeof evidence.id !== 'string' || evidence.id.length === 0) {\n    return reject('grant-view-invalid', ['enabled grant evidence requires a non-empty id'])\n  }\n  if (!isNonnegativeSafeInteger(evidence.assertedAtBlock) || evidence.assertedAtBlock > atBlock) {\n    return reject('grant-view-invalid', ['grant assertion block must be at or before the evaluated snapshot'])\n  }\n  if (evidence.controller !== verified.route.controller) {\n    return reject('grant-view-invalid', ['grant controller does not match the configured controller'])\n  }\n  if (evidence.authorizationChainId !== verified.route.authorizationChainId\n    || evidence.sourceHash !== verified.route.sourceHash\n    || evidence.filterHash !== verified.route.filterHash\n    || evidence.subscriptionHash !== verified.route.subscriptionHash) {\n    return reject('grant-view-invalid', ['grant authorization chain or source does not match the configured route'])\n  }\n  if (evidence.target !== verified.publisher) {\n    return reject('grant-view-invalid', ['grant target does not match the verified publisher'])\n  }\n  const evidenceHasQueue = Object.hasOwn(evidence, 'queueId')\n  const routeHasQueue = Object.hasOwn(verified.route, 'queueId')\n  if (evidence.deploymentId !== verified.route.deploymentId\n    || evidenceHasQueue !== routeHasQueue\n    || evidence.queueId !== verified.route.queueId) {\n    return reject('grant-view-invalid', ['grant scope does not exactly match the configured route'])\n  }\n  return undefined\n}\n\nfunction validateReceipt(\n  receipt: WakeAdmissionReceipt,\n  attempt: WakeAdmissionAttempt,\n): AdmitAndEnqueueFailure | undefined {\n  const requiredFields = [\n    'audience',\n    'eventHash',\n    'id',\n    'publisher',\n    'wakeId',\n  ] as const\n  if (!isRecord(receipt)\n    || requiredFields.some(field => !Object.hasOwn(receipt, field))\n    || typeof receipt.id !== 'string'\n    || receipt.id.length === 0) {\n    return reject('inbox-unavailable', ['inbox returned an invalid receipt'])\n  }\n  if (receipt.audience !== attempt.audience\n    || receipt.publisher !== attempt.publisher\n    || receipt.eventHash !== attempt.eventHash\n    || receipt.wakeId !== attempt.wakeId) {\n    return reject('inbox-unavailable', ['inbox receipt is not bound to the verified attempt'])\n  }\n  return undefined\n}\n\nfunction snapshotGrantEvidence(evidence: WakeGrantEvidence): WakeGrantEvidence {\n  return Object.freeze({\n    assertedAtBlock: evidence.assertedAtBlock,\n    authorizationChainId: evidence.authorizationChainId,\n    sourceHash: evidence.sourceHash,\n    filterHash: evidence.filterHash,\n    subscriptionHash: evidence.subscriptionHash,\n    ...(evidence.objectHash === undefined ? {} : { objectHash: evidence.objectHash }),\n    controller: evidence.controller,\n    deploymentId: evidence.deploymentId,\n    id: evidence.id,\n    ...(evidence.queueId === undefined ? {} : { queueId: evidence.queueId }),\n    target: evidence.target,\n  })\n}\n\nfunction snapshotReceipt(receipt: WakeAdmissionReceipt): WakeAdmissionReceipt {\n  return Object.freeze({\n    audience: receipt.audience,\n    eventHash: receipt.eventHash,\n    id: receipt.id,\n    publisher: receipt.publisher,\n    wakeId: receipt.wakeId,\n  })\n}\n\nfunction success<TWake>(\n  disposition: AdmitAndEnqueueSuccess['disposition'],\n  receipt: WakeAdmissionReceipt,\n  wake: TWake,\n): AdmitAndEnqueueSuccess<TWake> {\n  return Object.freeze({\n    disposition, ok: true, receipt, wake,\n  })\n}\n\nfunction reject(\n  reason: AdmitAndEnqueueFailureReason,\n  details?: readonly string[],\n): AdmitAndEnqueueFailure {\n  if (details === undefined) return Object.freeze({ ok: false, reason })\n  return Object.freeze({\n    details: Object.freeze([...details]), ok: false, reason,\n  })\n}\n\nfunction isNonnegativeSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n", "import {\n  DeploymentIdZod,\n  HashZod,\n  NonnegativeJsonSafeIntegerZod,\n  NormalizedAddressZod,\n  WakeEnvelopeZod,\n  WakeIdZod,\n  WakeJwtAudienceZod,\n  WakeJwtIdZod,\n} from '@xyo-network/event-kit-schemas'\nimport { PayloadBuilder } from '@xyo-network/sdk'\nimport { z } from 'zod'\n\nexport const AdmittedWakeZod = z.strictObject({\n  audience: WakeJwtAudienceZod,\n  deploymentId: DeploymentIdZod,\n  event: WakeEnvelopeZod,\n  eventHash: HashZod,\n  fromPosition: NonnegativeJsonSafeIntegerZod,\n  toPosition: NonnegativeJsonSafeIntegerZod,\n  jti: WakeJwtIdZod,\n  publisher: NormalizedAddressZod,\n  queueId: z.string().min(1).max(255).optional(),\n  wakeId: WakeIdZod,\n}).refine(\n  wake => wake.deploymentId === wake.event.deploymentId\n    && wake.queueId === wake.event.queueId\n    && wake.wakeId === wake.event.wakeId\n    && wake.fromPosition === wake.event.fromPosition\n    && wake.toPosition === wake.event.toPosition,\n  'Persisted admission metadata must exactly match its signed envelope',\n)\nexport type AdmittedWake = z.infer<typeof AdmittedWakeZod>\n\n/** Persisted-shape and content integrity check. Does not replace live HTTP admission. */\nexport async function parseAdmittedWake(value: unknown): Promise<AdmittedWake> {\n  const wake = AdmittedWakeZod.parse(value)\n  if (await PayloadBuilder.dataHash(wake.event) !== wake.eventHash) {\n    throw new TypeError('Persisted wake content does not match its admitted event hash')\n  }\n  return wake\n}\n", "import type { AdmitAndEnqueueResult } from './admissionCore.ts'\nimport { admitVerifiedWake } from './admissionCore.ts'\nimport type {\n  AtomicWakeInbox,\n  WakeGrantAuthorizer,\n} from './admissionTypes.ts'\nimport type { AdmittedWake } from './types.ts'\nimport { AdmittedWakeZod } from './types.ts'\nimport type { VerifiedWakeRequest } from './verifyWakeRequest.ts'\n\nexport type {\n  AdmitAndEnqueueFailure, AdmitAndEnqueueFailureReason, AdmitAndEnqueueResult, AdmitAndEnqueueSuccess,\n} from './admissionCore.ts'\n\nexport interface AdmitAndEnqueueInput {\n  readonly expectedHead: number\n  readonly grants: WakeGrantAuthorizer\n  readonly inbox: AtomicWakeInbox<AdmittedWake>\n  readonly verified: VerifiedWakeRequest\n}\n\n/** Atomic replay/grant/enqueue boundary; the expected head is always XL1 authorization finality. */\nexport async function admitAndEnqueue(\n  input: AdmitAndEnqueueInput,\n): Promise<AdmitAndEnqueueResult<AdmittedWake>> {\n  const { verified } = input\n  const wake = AdmittedWakeZod.parse({\n    audience: verified.audience,\n    deploymentId: verified.deploymentId,\n    event: verified.event,\n    eventHash: verified.eventHash,\n    fromPosition: verified.fromPosition,\n    toPosition: verified.toPosition,\n    jti: verified.jwtId,\n    publisher: verified.publisher,\n    ...(verified.queueId === undefined ? {} : { queueId: verified.queueId }),\n    wakeId: verified.wakeId,\n  })\n  return await admitVerifiedWake({ ...input, wake })\n}\n", "const textEncoder = new TextEncoder()\n\nfunction hasUnpairedSurrogate(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const codePoint = value.codePointAt(index)\n    if (codePoint === undefined || (codePoint >= 0xd8_00 && codePoint <= 0xdf_ff)) return true\n    if (codePoint > 0xff_ff) index += 1\n  }\n  return false\n}\n\nfunction canonicalize(value: unknown): string {\n  if (value === null) return 'null'\n\n  switch (typeof value) {\n    case 'boolean':\n      return value ? 'true' : 'false'\n    case 'number': {\n      if (!Number.isFinite(value)) throw new TypeError('Canonical JSON numbers must be finite')\n      return JSON.stringify(value)\n    }\n    case 'string': {\n      if (hasUnpairedSurrogate(value)) throw new TypeError('Canonical JSON strings must be valid Unicode')\n      return JSON.stringify(value)\n    }\n    case 'object': {\n      if (Array.isArray(value)) return `[${value.map(item => canonicalize(item)).join(',')}]`\n      const prototype = Reflect.getPrototypeOf(value)\n      if (prototype !== Object.prototype && prototype !== null) {\n        throw new TypeError('Canonical JSON objects must be plain records')\n      }\n      const record = value as Record<string, unknown>\n      const members = Object.keys(record).toSorted().map((key) => {\n        if (hasUnpairedSurrogate(key)) throw new TypeError('Canonical JSON keys must be valid Unicode')\n        const member = record[key]\n        if (member === undefined) throw new TypeError('Canonical JSON does not permit undefined members')\n        return `${JSON.stringify(key)}:${canonicalize(member)}`\n      })\n      return `{${members.join(',')}}`\n    }\n    default:\n      throw new TypeError(`Canonical JSON cannot encode ${typeof value}`)\n  }\n}\n\n/** RFC 8785 JSON Canonicalization Scheme for I-JSON-compatible values. */\nexport function canonicalJson(value: unknown): string {\n  return canonicalize(value)\n}\n\n/** UTF-8 bytes of {@link canonicalJson}. */\nexport function canonicalJsonBytes(value: unknown): Uint8Array {\n  return textEncoder.encode(canonicalize(value))\n}\n", "import type {\n  Base64Url32Bytes,\n  ChainId,\n  EndpointChallenge,\n  EndpointChallengeResponse,\n  HandshakeId,\n  Hash,\n  NormalizedAddress,\n  SourceWakeEventKind,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  Base64Url32BytesZod,\n  bytesToCanonicalBase64Url,\n  canonicalBase64UrlToBytes,\n  EndpointChallengeResponseSchema,\n  EndpointChallengeResponseZod,\n  EndpointChallengeSchema,\n  EndpointChallengeZod,\n  generateChallengeNonce,\n  generateHandshakeId,\n  MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS,\n} from '@xyo-network/event-kit-schemas'\nimport { PayloadBuilder } from '@xyo-network/sdk'\n\nexport interface CreateEndpointChallengeInput {\n  chainId: ChainId\n  encryptionKey: Hash\n  eventKind: SourceWakeEventKind\n  grant: Hash\n  issuedAt: number\n  keyId: HandshakeId\n  lifetimeSeconds?: number\n  publisher: NormalizedAddress\n  service: Hash\n  subscriber: NormalizedAddress\n  subscription: Hash\n}\n\nexport interface VerifyEndpointChallengeResponseInput {\n  challenge: EndpointChallenge\n  nowSeconds: number\n  response: EndpointChallengeResponse\n  secret: Base64Url32Bytes\n}\n\ntype VerifyEndpointChallengeProofInput = Omit<VerifyEndpointChallengeResponseInput, 'nowSeconds'>\n\nfunction hashBytes(hash: Hash): Uint8Array<ArrayBuffer> {\n  return Uint8Array.from({ length: 32 }, (_, index) => Number.parseInt(hash.slice(index * 2, index * 2 + 2), 16))\n}\n\nasync function hmacProof(secret: Base64Url32Bytes, challengeHash: Hash): Promise<Base64Url32Bytes> {\n  const secretBytes = canonicalBase64UrlToBytes(Base64Url32BytesZod.parse(secret))\n  if (secretBytes?.length !== 32) throw new TypeError('Expected 32-byte challenge secret')\n  const cryptoKey = await globalThis.crypto.subtle.importKey(\n    'raw',\n    Uint8Array.from(secretBytes),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  const signature = await globalThis.crypto.subtle.sign('HMAC', cryptoKey, hashBytes(challengeHash))\n  return Base64Url32BytesZod.parse(bytesToCanonicalBase64Url(new Uint8Array(signature)))\n}\n\nfunction equalProof(left: Base64Url32Bytes, right: Base64Url32Bytes): boolean {\n  const leftBytes = canonicalBase64UrlToBytes(left)\n  const rightBytes = canonicalBase64UrlToBytes(right)\n  if (leftBytes?.length !== 32 || rightBytes?.length !== 32) return false\n  let difference = 0\n  for (let index = 0; index < 32; index += 1) difference |= leftBytes[index] ^ rightBytes[index]\n  return difference === 0\n}\n\nexport async function endpointChallengeHash(challenge: EndpointChallenge): Promise<Hash> {\n  const parsed = EndpointChallengeZod.parse(challenge)\n  return await PayloadBuilder.dataHash(parsed)\n}\n\n/** Construct a fresh, strict challenge request without exposing the expected proof. */\nexport function createEndpointChallenge(input: CreateEndpointChallengeInput): EndpointChallenge {\n  const lifetimeSeconds = input.lifetimeSeconds ?? MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS\n  if (!Number.isSafeInteger(lifetimeSeconds) || lifetimeSeconds < 1) {\n    throw new RangeError('Challenge lifetime must be a positive safe integer')\n  }\n  if (!Number.isSafeInteger(input.issuedAt) || input.issuedAt < 0) {\n    throw new RangeError('Challenge issuedAt must be a nonnegative safe integer')\n  }\n  if (input.issuedAt > Number.MAX_SAFE_INTEGER - lifetimeSeconds) {\n    throw new RangeError('Challenge expiry exceeds the JSON safe-integer range')\n  }\n\n  const builder = new PayloadBuilder({ schema: EndpointChallengeSchema })\n  return EndpointChallengeZod.parse(builder.fields({\n    challengeId: generateHandshakeId(),\n    chainId: input.chainId,\n    publisher: input.publisher,\n    subscriber: input.subscriber,\n    service: input.service,\n    encryptionKey: input.encryptionKey,\n    keyId: input.keyId,\n    subscription: input.subscription,\n    grant: input.grant,\n    eventKind: input.eventKind,\n    nonce: generateChallengeNonce(),\n    issuedAt: input.issuedAt,\n    expiresAt: input.issuedAt + lifetimeSeconds,\n  }).build())\n}\n\n/** Build the endpoint's HMAC-SHA256 proof over the raw 32-byte challenge data hash. */\nexport async function createEndpointChallengeResponse(\n  challenge: EndpointChallenge,\n  secret: Base64Url32Bytes,\n): Promise<EndpointChallengeResponse> {\n  const challengeHash = await endpointChallengeHash(challenge)\n  const builder = new PayloadBuilder({ schema: EndpointChallengeResponseSchema })\n  return EndpointChallengeResponseZod.parse(builder.fields({\n    challenge: challengeHash,\n    proof: await hmacProof(secret, challengeHash),\n  }).build())\n}\n\n/**\n * Cryptographic proof/binding check without authorizing a new time-bounded\n * decision. This remains package-internal and exists only so an exact durable\n * verified decision can be resumed after its Unix window closes.\n */\nexport async function verifyEndpointChallengeProof(\n  input: VerifyEndpointChallengeProofInput,\n): Promise<boolean> {\n  try {\n    const challenge = EndpointChallengeZod.parse(input.challenge)\n    const response = EndpointChallengeResponseZod.parse(input.response)\n    const challengeHash = await endpointChallengeHash(challenge)\n    if (response.challenge !== challengeHash) return false\n    return equalProof(response.proof, await hmacProof(input.secret, challengeHash))\n  } catch {\n    return false\n  }\n}\n\n/** Pure proof/time check. Durable one-time consumption belongs to the runtime admission path. */\nexport async function verifyEndpointChallengeResponse(\n  input: VerifyEndpointChallengeResponseInput,\n): Promise<boolean> {\n  try {\n    const challenge = EndpointChallengeZod.parse(input.challenge)\n    if (!Number.isSafeInteger(input.nowSeconds)\n      || input.nowSeconds < challenge.issuedAt\n      || input.nowSeconds >= challenge.expiresAt) return false\n    return await verifyEndpointChallengeProof(input)\n  } catch {\n    return false\n  }\n}\n", "import type {\n  Base64Url32Bytes,\n  ChainId,\n  EncryptedWakeSubscription,\n  EndpointChallenge,\n  EndpointChallengeResponse,\n  HandshakeId,\n  Hash,\n  NormalizedAddress,\n  PublisherEncryptionKey,\n  PublisherEncryptionKeyRevocation,\n  PublisherService,\n  PublisherServiceRevocation,\n  WakeGrantObject,\n  WakeGrantRevocation,\n  WakeSource,\n  WakeSubscriptionAcceptance,\n  WakeSubscriptionAcceptanceRevocation,\n  WakeSubscriptionPlaintext,\n  WakeSubscriptionRevocation,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  bytesToCanonicalBase64Url,\n  EncryptedWakeSubscriptionSchema,\n  EncryptedWakeSubscriptionZod,\n  ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,\n  EndpointChallengeResponseZod,\n  EndpointChallengeZod,\n  generateGrantId,\n  generateHandshakeId,\n  HashZod,\n  MAX_SUBSCRIPTION_PLAINTEXT_BYTES,\n  PublisherEncryptionKeyRevocationSchema,\n  PublisherEncryptionKeyRevocationZod,\n  PublisherEncryptionKeySchema,\n  PublisherEncryptionKeyZod,\n  PublisherServiceRevocationSchema,\n  PublisherServiceRevocationZod,\n  PublisherServiceSchema,\n  PublisherServiceZod,\n  SOURCE_WAKE_EVENT_KIND,\n  SOURCE_WAKE_FILTER_PROFILE,\n  WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  WAKE_WALLET_JWT_DELIVERY_PROFILE,\n  WakeGrantObjectSchema,\n  WakeGrantObjectZod,\n  WakeGrantRevocationSchema,\n  WakeGrantRevocationZod,\n  WakeSubscriptionAcceptanceRevocationSchema,\n  WakeSubscriptionAcceptanceRevocationZod,\n  WakeSubscriptionAcceptanceSchema,\n  WakeSubscriptionAcceptanceZod,\n  WakeSubscriptionCleartextZod,\n  WakeSubscriptionPlaintextSchema,\n  WakeSubscriptionPlaintextZod,\n  WakeSubscriptionRevocationSchema,\n  WakeSubscriptionRevocationZod,\n} from '@xyo-network/event-kit-schemas'\nimport { PayloadBuilder } from '@xyo-network/sdk'\n\nimport type {\n  WakeSubscriptionPrivateKey,\n  WakeSubscriptionPublicKey,\n} from './wakeSubscriptionHpke.ts'\nimport {\n  encryptWakeSubscription,\n  generateWakeSubscriptionEncryptionKeyPair,\n} from './wakeSubscriptionHpke.ts'\n\nexport type EventKitHandshakePublicObject\n  = | EncryptedWakeSubscription\n    | EndpointChallenge\n    | EndpointChallengeResponse\n    | PublisherEncryptionKey\n    | PublisherEncryptionKeyRevocation\n    | PublisherService\n    | PublisherServiceRevocation\n    | WakeGrantObject\n    | WakeGrantRevocation\n    | WakeSubscriptionAcceptance\n    | WakeSubscriptionAcceptanceRevocation\n    | WakeSubscriptionRevocation\n\nexport interface HashedHandshakeObject<T extends EventKitHandshakePublicObject> {\n  readonly body: T\n  readonly objectHash: Hash\n}\n\nexport interface CreatePublisherEncryptionKeyInput {\n  readonly expiresAtBlock?: number\n  readonly keyId?: HandshakeId\n  readonly publicKey: Base64Url32Bytes\n  readonly validFromBlock: number\n}\n\nexport interface GeneratePublisherEncryptionKeyInput {\n  readonly expiresAtBlock?: number\n  readonly validFromBlock: number\n}\n\nexport interface GeneratedPublisherEncryptionKey {\n  readonly descriptor: PublisherEncryptionKey\n  readonly descriptorHash: Hash\n  readonly privateKey: WakeSubscriptionPrivateKey\n  readonly publicKey: WakeSubscriptionPublicKey\n}\n\nexport interface CreatePublisherServiceInput {\n  readonly authorizationChainId: ChainId\n  readonly encryptionKeys: readonly Hash[]\n  readonly expiresAtBlock?: number\n  readonly maxPositionsPerWake: number\n  readonly maxSubscriptionLifetimeBlocks: number\n  readonly preferredEncryptionKey: Hash\n  readonly revision?: number\n  readonly serviceId?: HandshakeId\n  readonly sources: readonly WakeSource[]\n  readonly supersedes?: Hash\n  readonly validFromBlock: number\n}\n\nexport interface CreateWakeGrantInput {\n  readonly deploymentId: string\n  readonly grantId?: string\n  readonly publisher: NormalizedAddress\n  readonly queueId?: string\n}\n\nexport interface CreateWakeSubscriptionPlaintextInput {\n  readonly audience: string\n  readonly challengeSecret?: Base64Url32Bytes\n  readonly deploymentId: string\n  readonly endpoint: string\n  readonly fromPosition: number\n  readonly maxPositionsPerWake: number\n  readonly queueId?: string | null\n  readonly source: WakeSource\n}\n\nexport interface CreateEncryptedWakeSubscriptionInput {\n  readonly chainId: ChainId\n  readonly expiresAtBlock: number\n  readonly grant: Hash\n  readonly plaintext: WakeSubscriptionPlaintext\n  readonly publisher: NormalizedAddress\n  readonly publisherKey: WakeSubscriptionPublicKey\n  readonly revision?: number\n  readonly service: Hash\n  readonly subscriber: NormalizedAddress\n  readonly subscriptionId?: HandshakeId\n  readonly supersedes?: Hash\n}\n\nexport interface CreateWakeSubscriptionAcceptanceInput {\n  readonly challenge: Hash\n  readonly encryptionKey: Hash\n  readonly grant: Hash\n  readonly response: Hash\n  readonly service: Hash\n  readonly subscription: Hash\n}\n\ninterface StrictParser<T> {\n  safeParse: (value: unknown) => { readonly data: T; readonly success: true } | { readonly success: false }\n}\n\nconst publicObjectParsers: readonly StrictParser<EventKitHandshakePublicObject>[] = [\n  PublisherServiceZod,\n  PublisherEncryptionKeyZod,\n  PublisherServiceRevocationZod,\n  PublisherEncryptionKeyRevocationZod,\n  EncryptedWakeSubscriptionZod,\n  WakeGrantObjectZod,\n  WakeGrantRevocationZod,\n  WakeSubscriptionRevocationZod,\n  WakeSubscriptionAcceptanceZod,\n  WakeSubscriptionAcceptanceRevocationZod,\n  EndpointChallengeZod,\n  EndpointChallengeResponseZod,\n]\n\nfunction parseHandshakePublicObject(value: unknown): EventKitHandshakePublicObject {\n  for (const parser of publicObjectParsers) {\n    const parsed = parser.safeParse(value)\n    if (parsed.success) return parsed.data\n  }\n\n  throw new TypeError('Expected a strict Event Kit handshake public object')\n}\n\n/** Canonical XYO data hash after strict validation of a public handshake object. */\nexport async function handshakeObjectHash(object: EventKitHandshakePublicObject): Promise<Hash> {\n  return HashZod.parse(await PayloadBuilder.dataHash(parseHandshakePublicObject(object)))\n}\n\nexport async function withHandshakeObjectHash<T extends EventKitHandshakePublicObject>(\n  body: T,\n): Promise<HashedHandshakeObject<T>> {\n  return Object.freeze({ body, objectHash: await handshakeObjectHash(body) })\n}\n\n/** Build one strict publisher X25519 key descriptor. */\nexport function createPublisherEncryptionKey(input: CreatePublisherEncryptionKeyInput): PublisherEncryptionKey {\n  const builder = new PayloadBuilder({ schema: PublisherEncryptionKeySchema })\n  return PublisherEncryptionKeyZod.parse(builder.fields({\n    keyId: input.keyId ?? generateHandshakeId(),\n    profile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n    publicKey: input.publicKey,\n    validFromBlock: input.validFromBlock,\n    ...(input.expiresAtBlock === undefined ? {} : { expiresAtBlock: input.expiresAtBlock }),\n  }).build())\n}\n\n/** Generate dedicated encryption material and bind both halves to its descriptor hash. */\nexport async function generatePublisherEncryptionKey(\n  input: GeneratePublisherEncryptionKeyInput,\n): Promise<GeneratedPublisherEncryptionKey> {\n  const material = await generateWakeSubscriptionEncryptionKeyPair()\n  const descriptor = createPublisherEncryptionKey({\n    ...input,\n    publicKey: material.publicKey,\n  })\n  const descriptorHash = await handshakeObjectHash(descriptor)\n  return Object.freeze({\n    descriptor,\n    descriptorHash,\n    privateKey: Object.freeze({\n      encryptionKey: descriptorHash,\n      keyId: descriptor.keyId,\n      privateKey: material.privateKey,\n    }),\n    publicKey: Object.freeze({\n      encryptionKey: descriptorHash,\n      keyId: descriptor.keyId,\n      publicKey: descriptor.publicKey,\n    }),\n  })\n}\n\n/** Advertise exact source identities on one independent XL1 authorization chain. */\nexport function createPublisherService(input: CreatePublisherServiceInput): PublisherService {\n  const builder = new PayloadBuilder({ schema: PublisherServiceSchema })\n  return PublisherServiceZod.parse(builder.fields({\n    authorizationChainId: input.authorizationChainId,\n    serviceId: input.serviceId ?? generateHandshakeId(),\n    revision: input.revision ?? 1,\n    ...(input.supersedes === undefined ? {} : { supersedes: input.supersedes }),\n    validFromBlock: input.validFromBlock,\n    ...(input.expiresAtBlock === undefined ? {} : { expiresAtBlock: input.expiresAtBlock }),\n    events: input.sources.map(source => ({\n      kind: SOURCE_WAKE_EVENT_KIND, filterProfile: SOURCE_WAKE_FILTER_PROFILE, source,\n    })),\n    deliveryProfile: WAKE_WALLET_JWT_DELIVERY_PROFILE,\n    challengeProfile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,\n    encryptionProfile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n    encryptionKeys: [...input.encryptionKeys],\n    preferredEncryptionKey: input.preferredEncryptionKey,\n    limits: {\n      maxPositionsPerWake: input.maxPositionsPerWake,\n      maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,\n      maxPlaintextBytes: MAX_SUBSCRIPTION_PLAINTEXT_BYTES,\n    },\n    retirementPolicy: 'existing-acceptances-continue',\n  }).build())\n}\n\n/** Build a fresh exact D-002 enqueue grant for one publisher and route scope. */\nexport function createWakeGrant(input: CreateWakeGrantInput): WakeGrantObject {\n  const builder = new PayloadBuilder({ schema: WakeGrantObjectSchema })\n  return WakeGrantObjectZod.parse(builder.fields({\n    grantId: input.grantId ?? generateGrantId(),\n    deploymentId: input.deploymentId,\n    publisher: input.publisher,\n    ...(input.queueId === undefined ? {} : { queueId: input.queueId }),\n    permissions: ['enqueue'],\n  }).build())\n}\n\n/** Generate a new 32-byte endpoint challenge secret when one is not supplied. */\nexport function createWakeSubscriptionPlaintext(\n  input: CreateWakeSubscriptionPlaintextInput,\n): WakeSubscriptionPlaintext {\n  const secretBytes = new Uint8Array(32)\n  if (input.challengeSecret === undefined) {\n    // The XYO SDK has no generic CSPRNG wrapper; Web Crypto is shared by Node and browsers.\n    globalThis.crypto.getRandomValues(secretBytes)\n  }\n  const challengeSecret = input.challengeSecret ?? bytesToCanonicalBase64Url(secretBytes)\n\n  const builder = new PayloadBuilder({ schema: WakeSubscriptionPlaintextSchema })\n  return WakeSubscriptionPlaintextZod.parse(builder.fields({\n    endpoint: input.endpoint,\n    audience: input.audience,\n    deploymentId: input.deploymentId,\n    queueId: input.queueId ?? null,\n    filter: {\n      schema: SOURCE_WAKE_FILTER_PROFILE,\n      source: input.source,\n      fromPosition: input.fromPosition,\n      maxPositionsPerWake: input.maxPositionsPerWake,\n    },\n    challenge: {\n      profile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,\n      secret: challengeSecret,\n    },\n  }).build())\n}\n\n/** Construct and encrypt one strict subscription with fresh HPKE ephemeral material. */\nexport async function createEncryptedWakeSubscription(\n  input: CreateEncryptedWakeSubscriptionInput,\n): Promise<EncryptedWakeSubscription> {\n  const builder = new PayloadBuilder({ schema: EncryptedWakeSubscriptionSchema })\n  const cleartext = WakeSubscriptionCleartextZod.parse(builder.fields({\n    subscriptionId: input.subscriptionId ?? generateHandshakeId(),\n    revision: input.revision ?? 1,\n    ...(input.supersedes === undefined ? {} : { supersedes: input.supersedes }),\n    chainId: input.chainId,\n    publisher: input.publisher,\n    service: input.service,\n    encryptionKey: input.publisherKey.encryptionKey,\n    keyId: input.publisherKey.keyId,\n    grant: input.grant,\n    eventKind: SOURCE_WAKE_EVENT_KIND,\n    expiresAtBlock: input.expiresAtBlock,\n  }).build())\n\n  return await encryptWakeSubscription({\n    plaintext: input.plaintext,\n    publisherKey: input.publisherKey,\n    subscriber: input.subscriber,\n    subscription: cleartext,\n  })\n}\n\nexport function createWakeSubscriptionAcceptance(\n  input: CreateWakeSubscriptionAcceptanceInput,\n): WakeSubscriptionAcceptance {\n  const builder = new PayloadBuilder({ schema: WakeSubscriptionAcceptanceSchema })\n  return WakeSubscriptionAcceptanceZod.parse(builder.fields({\n    challenge: input.challenge,\n    encryptionKey: input.encryptionKey,\n    grant: input.grant,\n    response: input.response,\n    service: input.service,\n    subscription: input.subscription,\n  }).build())\n}\n\nexport function createPublisherServiceRevocation(service: Hash): PublisherServiceRevocation {\n  const builder = new PayloadBuilder({ schema: PublisherServiceRevocationSchema })\n  return PublisherServiceRevocationZod.parse(builder.fields({ service }).build())\n}\n\nexport function createPublisherEncryptionKeyRevocation(key: Hash): PublisherEncryptionKeyRevocation {\n  const builder = new PayloadBuilder({ schema: PublisherEncryptionKeyRevocationSchema })\n  return PublisherEncryptionKeyRevocationZod.parse(builder.fields({ key }).build())\n}\n\nexport function createWakeGrantRevocation(grant: Hash): WakeGrantRevocation {\n  const builder = new PayloadBuilder({ schema: WakeGrantRevocationSchema })\n  return WakeGrantRevocationZod.parse(builder.fields({ grant }).build())\n}\n\nexport function createWakeSubscriptionRevocation(subscription: Hash): WakeSubscriptionRevocation {\n  const builder = new PayloadBuilder({ schema: WakeSubscriptionRevocationSchema })\n  return WakeSubscriptionRevocationZod.parse(builder.fields({ subscription }).build())\n}\n\nexport function createWakeSubscriptionAcceptanceRevocation(\n  acceptance: Hash,\n): WakeSubscriptionAcceptanceRevocation {\n  const builder = new PayloadBuilder({ schema: WakeSubscriptionAcceptanceRevocationSchema })\n  return WakeSubscriptionAcceptanceRevocationZod.parse(builder.fields({ acceptance }).build())\n}\n", "import {\n  Aes128Gcm,\n  CipherSuite,\n  DhkemX25519HkdfSha256,\n  HkdfSha256,\n} from '@hpke/core'\nimport type {\n  Base64Url32Bytes,\n  EncryptedWakeSubscription,\n  HandshakeId,\n  Hash,\n  NormalizedAddress,\n  WakeSubscriptionCleartext,\n  WakeSubscriptionPlaintext,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  Base64Url32BytesZod,\n  bytesToCanonicalBase64Url,\n  canonicalBase64UrlToBytes,\n  EncryptedWakeSubscriptionZod,\n  HandshakeIdZod,\n  HashZod,\n  NormalizedAddressZod,\n  WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  WakeSubscriptionCleartextZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport {\n  wakeSubscriptionAadBytes,\n  wakeSubscriptionPlaintextBytes,\n  wakeSubscriptionPlaintextFromBytes,\n} from './wakeSubscriptionEncoding.ts'\n\nconst suite = new CipherSuite({\n  kem: new DhkemX25519HkdfSha256(),\n  kdf: new HkdfSha256(),\n  aead: new Aes128Gcm(),\n})\nconst textEncoder = new TextEncoder()\nconst hpkeInfo = textEncoder.encode(WAKE_SUBSCRIPTION_HPKE_PROFILE)\ntype HpkeKey = Awaited<ReturnType<typeof suite.kem.deserializePublicKey>>\n\ninterface InternalHpkeKeyPair {\n  privateKey: HpkeKey\n  publicKey: HpkeKey\n}\n\nfunction asInternalHpkeKeyPair(value: unknown): InternalHpkeKeyPair {\n  if (typeof value !== 'object' || value === null || !('privateKey' in value) || !('publicKey' in value)) {\n    throw new TypeError('HPKE implementation returned an invalid key pair')\n  }\n  return {\n    privateKey: value.privateKey as HpkeKey,\n    publicKey: value.publicKey as HpkeKey,\n  }\n}\n\nexport interface WakeSubscriptionEncryptionKeyPair {\n  /** Raw 32-byte X25519 private key encoded as canonical unpadded base64url. */\n  privateKey: Base64Url32Bytes\n  /** Raw 32-byte X25519 public key encoded as canonical unpadded base64url. */\n  publicKey: Base64Url32Bytes\n}\n\nexport interface WakeSubscriptionPublicKey {\n  /** Canonical hash of the publisher-authored key descriptor. */\n  encryptionKey: Hash\n  /** Stable key identifier copied from that descriptor. */\n  keyId: HandshakeId\n  /** Raw X25519 public key from that descriptor. */\n  publicKey: Base64Url32Bytes\n}\n\nexport interface WakeSubscriptionPrivateKey {\n  /** Canonical hash of the publisher-authored key descriptor. */\n  encryptionKey: Hash\n  /** Stable key identifier copied from that descriptor. */\n  keyId: HandshakeId\n  /** Raw X25519 private key held off-chain by the publisher. */\n  privateKey: Base64Url32Bytes\n}\n\nexport interface EncryptWakeSubscriptionInput {\n  plaintext: WakeSubscriptionPlaintext\n  publisherKey: WakeSubscriptionPublicKey\n  subscriber: NormalizedAddress\n  subscription: WakeSubscriptionCleartext\n}\n\nexport interface DecryptWakeSubscriptionInput {\n  publisherKey: WakeSubscriptionPrivateKey\n  subscriber: NormalizedAddress\n  subscription: EncryptedWakeSubscription\n}\n\n/** Deliberately carries no low-level cause that could become a decryption oracle. */\nexport class WakeSubscriptionDecryptionError extends Error {\n  override readonly name = 'WakeSubscriptionDecryptionError'\n\n  constructor() {\n    super('Wake subscription cryptographic validation failed')\n  }\n}\n\nfunction parsePublicKey(value: WakeSubscriptionPublicKey): WakeSubscriptionPublicKey {\n  return {\n    encryptionKey: HashZod.parse(value.encryptionKey),\n    keyId: HandshakeIdZod.parse(value.keyId),\n    publicKey: Base64Url32BytesZod.parse(value.publicKey),\n  }\n}\n\nfunction parsePrivateKey(value: WakeSubscriptionPrivateKey): WakeSubscriptionPrivateKey {\n  return {\n    encryptionKey: HashZod.parse(value.encryptionKey),\n    keyId: HandshakeIdZod.parse(value.keyId),\n    privateKey: Base64Url32BytesZod.parse(value.privateKey),\n  }\n}\n\nfunction decoded32(value: Base64Url32Bytes): Uint8Array {\n  const decoded = canonicalBase64UrlToBytes(value)\n  if (decoded?.length !== 32) throw new TypeError('Expected 32 canonical bytes')\n  return decoded\n}\n\n/** Generate a dedicated X25519 encryption key; never reuse the publisher signing key. */\nexport async function generateWakeSubscriptionEncryptionKeyPair(): Promise<WakeSubscriptionEncryptionKeyPair> {\n  const generated: unknown = await suite.kem.generateKeyPair()\n  const keyPair = asInternalHpkeKeyPair(generated)\n  const [publicKey, privateKey] = await Promise.all([\n    suite.kem.serializePublicKey(keyPair.publicKey),\n    suite.kem.serializePrivateKey(keyPair.privateKey),\n  ])\n  return {\n    publicKey: Base64Url32BytesZod.parse(bytesToCanonicalBase64Url(new Uint8Array(publicKey))),\n    privateKey: Base64Url32BytesZod.parse(bytesToCanonicalBase64Url(new Uint8Array(privateKey))),\n  }\n}\n\n/**\n * One-shot RFC 9180 Base-mode encryption with X25519/HKDF-SHA256/AES-128-GCM.\n * Ephemeral key material is always generated inside the HPKE implementation.\n */\nexport async function encryptWakeSubscription(\n  input: EncryptWakeSubscriptionInput,\n): Promise<EncryptedWakeSubscription> {\n  const subscription = WakeSubscriptionCleartextZod.parse(input.subscription)\n  const subscriber = NormalizedAddressZod.parse(input.subscriber)\n  const publisherKey = parsePublicKey(input.publisherKey)\n  if (\n    subscription.encryptionKey !== publisherKey.encryptionKey\n    || subscription.keyId !== publisherKey.keyId\n  ) {\n    throw new TypeError('Subscription key reference does not match the supplied publisher key')\n  }\n\n  const recipientPublicKey = await suite.kem.deserializePublicKey(decoded32(publisherKey.publicKey))\n  const { ct, enc } = await suite.seal(\n    { recipientPublicKey, info: hpkeInfo },\n    wakeSubscriptionPlaintextBytes(input.plaintext),\n    wakeSubscriptionAadBytes(subscription, subscriber),\n  )\n\n  return EncryptedWakeSubscriptionZod.parse({\n    ...subscription,\n    encryption: {\n      profile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n      enc: bytesToCanonicalBase64Url(new Uint8Array(enc)),\n      ciphertext: bytesToCanonicalBase64Url(new Uint8Array(ct)),\n    },\n  })\n}\n\n/**\n * One-shot decryption. All malformed inputs, key mismatches, authentication\n * failures, and noncanonical plaintexts collapse to the same public error.\n */\nexport async function decryptWakeSubscription(\n  input: DecryptWakeSubscriptionInput,\n): Promise<WakeSubscriptionPlaintext> {\n  try {\n    const subscription = EncryptedWakeSubscriptionZod.parse(input.subscription)\n    const subscriber = NormalizedAddressZod.parse(input.subscriber)\n    const publisherKey = parsePrivateKey(input.publisherKey)\n    if (\n      subscription.encryptionKey !== publisherKey.encryptionKey\n      || subscription.keyId !== publisherKey.keyId\n    ) throw new TypeError('Key reference mismatch')\n\n    const recipientKey = await suite.kem.deserializePrivateKey(decoded32(publisherKey.privateKey))\n    const plaintext = await suite.open(\n      {\n        recipientKey,\n        enc: decoded32(subscription.encryption.enc),\n        info: hpkeInfo,\n      },\n      canonicalBase64UrlToBytes(subscription.encryption.ciphertext) ?? new Uint8Array(),\n      wakeSubscriptionAadBytes(subscription, subscriber),\n    )\n    const parsed = wakeSubscriptionPlaintextFromBytes(new Uint8Array(plaintext))\n    return parsed\n  } catch {\n    throw new WakeSubscriptionDecryptionError()\n  }\n}\n", "import type {\n  EncryptedWakeSubscription,\n  NormalizedAddress,\n  WakeSubscriptionCleartext,\n  WakeSubscriptionPlaintext,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  EncryptedWakeSubscriptionZod,\n  MAX_SUBSCRIPTION_PLAINTEXT_BYTES,\n  NormalizedAddressZod,\n  WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  WakeSubscriptionCleartextZod,\n  WakeSubscriptionPlaintextZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport { canonicalJsonBytes } from './canonicalJson.ts'\n\nconst textDecoder = new TextDecoder('utf-8', { fatal: true })\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.length !== right.length) return false\n  let difference = 0\n  for (let index = 0; index < left.length; index += 1) difference |= left[index] ^ right[index]\n  return difference === 0\n}\n\nfunction cleartextFromEncrypted(subscription: EncryptedWakeSubscription): WakeSubscriptionCleartext {\n  const { encryption: _encryption, ...cleartext } = subscription\n  return cleartext\n}\n\n/**\n * Canonical HPKE additional authenticated data. `subscriber` is the finalized\n * Statement Graph claim source and therefore cannot be inferred from the\n * subscription body itself.\n */\nexport function wakeSubscriptionAadBytes(\n  subscription: WakeSubscriptionCleartext | EncryptedWakeSubscription,\n  subscriber: NormalizedAddress,\n): Uint8Array {\n  const parsedSubscriber = NormalizedAddressZod.parse(subscriber)\n  const parsedSubscription = 'encryption' in subscription\n    ? cleartextFromEncrypted(EncryptedWakeSubscriptionZod.parse(subscription))\n    : WakeSubscriptionCleartextZod.parse(subscription)\n\n  return canonicalJsonBytes({\n    schema: parsedSubscription.schema,\n    chainId: parsedSubscription.chainId,\n    subscriber: parsedSubscriber,\n    publisher: parsedSubscription.publisher,\n    service: parsedSubscription.service,\n    encryptionKey: parsedSubscription.encryptionKey,\n    keyId: parsedSubscription.keyId,\n    grant: parsedSubscription.grant,\n    subscriptionId: parsedSubscription.subscriptionId,\n    revision: parsedSubscription.revision,\n    supersedes: parsedSubscription.supersedes ?? null,\n    eventKind: parsedSubscription.eventKind,\n    expiresAtBlock: parsedSubscription.expiresAtBlock,\n    profile: WAKE_SUBSCRIPTION_HPKE_PROFILE,\n  })\n}\n\n/** Validate and encode the encrypted subscription plaintext as canonical JCS UTF-8. */\nexport function wakeSubscriptionPlaintextBytes(plaintext: WakeSubscriptionPlaintext): Uint8Array {\n  const parsed = WakeSubscriptionPlaintextZod.parse(plaintext)\n  const encoded = canonicalJsonBytes(parsed)\n  if (encoded.length > MAX_SUBSCRIPTION_PLAINTEXT_BYTES) {\n    throw new RangeError(`Wake subscription plaintext exceeds ${MAX_SUBSCRIPTION_PLAINTEXT_BYTES} bytes`)\n  }\n  return encoded\n}\n\n/** Decode only strict UTF-8 whose bytes are already the canonical plaintext encoding. */\nexport function wakeSubscriptionPlaintextFromBytes(encoded: Uint8Array): WakeSubscriptionPlaintext {\n  if (encoded.length > MAX_SUBSCRIPTION_PLAINTEXT_BYTES) {\n    throw new RangeError(`Wake subscription plaintext exceeds ${MAX_SUBSCRIPTION_PLAINTEXT_BYTES} bytes`)\n  }\n  const decoded = textDecoder.decode(encoded)\n  const parsed = WakeSubscriptionPlaintextZod.parse(JSON.parse(decoded) as unknown)\n  if (!equalBytes(encoded, canonicalJsonBytes(parsed))) {\n    throw new TypeError('Wake subscription plaintext is not canonically encoded')\n  }\n  return parsed\n}\n", "/**\n * Finalized lifecycle evidence shared by service and subscription revisions.\n * Claim sources are already canonical Statement Graph sources; they are\n * compared exactly and are never inferred from fields inside object bodies.\n */\nexport interface LifecycleRevisionEvidence {\n  readonly claimedAtBlock: number\n  readonly objectHash: string\n  readonly revision: number\n  readonly revokedAtBlock?: number\n  readonly source: string\n  readonly supersedes?: string\n}\n\nexport interface PublisherServiceLifecycleRevision extends LifecycleRevisionEvidence {\n  readonly encryptionKeys: readonly string[]\n  readonly eventKinds: readonly string[]\n  readonly expiresAtBlock?: number\n  readonly preferredEncryptionKey: string\n  readonly serviceId: string\n  readonly validFromBlock: number\n}\n\nexport interface PublisherEncryptionKeyLifecycle {\n  readonly claimedAtBlock: number\n  readonly expiresAtBlock?: number\n  readonly keyId: string\n  readonly objectHash: string\n  readonly revokedAtBlock?: number\n  readonly source: string\n  readonly validFromBlock: number\n}\n\nexport interface WakeSubscriptionLifecycleRevision extends LifecycleRevisionEvidence {\n  readonly expiresAtBlock: number\n  readonly subscriptionId: string\n}\n\nexport interface PublisherAcceptanceLifecycle {\n  readonly acceptanceBlock: number\n  readonly objectHash: string\n  readonly revokedAtBlock?: number\n  readonly source: string\n  readonly subscription: string\n}\n\nexport interface PublisherServiceSelectionInput {\n  readonly eventKind: string\n  readonly finalizedHead: number\n  readonly publisherSource: string\n  readonly serviceId?: string\n  readonly services: readonly PublisherServiceLifecycleRevision[]\n}\n\nexport interface PublisherServiceSelectionSuccess {\n  readonly ok: true\n  readonly service: PublisherServiceLifecycleRevision\n}\n\nexport type PublisherServiceSelectionFailureReason\n  = | 'ambiguous-service'\n    | 'invalid-revision-chain'\n    | 'service-not-found'\n\nexport interface PublisherServiceSelectionFailure {\n  readonly ok: false\n  readonly reason: PublisherServiceSelectionFailureReason\n}\n\nexport type PublisherServiceSelection = PublisherServiceSelectionFailure | PublisherServiceSelectionSuccess\n\nexport interface PreferredEncryptionKeyInput {\n  readonly finalizedHead: number\n  readonly keys: readonly PublisherEncryptionKeyLifecycle[]\n  readonly service: PublisherServiceLifecycleRevision\n}\n\nexport interface PreferredEncryptionKeySuccess {\n  readonly key: PublisherEncryptionKeyLifecycle\n  readonly ok: true\n}\n\nexport type PreferredEncryptionKeyFailureReason\n  = | 'ambiguous-key'\n    | 'preferred-key-inactive'\n    | 'preferred-key-not-found'\n    | 'preferred-key-not-referenced'\n\nexport interface PreferredEncryptionKeyFailure {\n  readonly ok: false\n  readonly reason: PreferredEncryptionKeyFailureReason\n}\n\nexport type PreferredEncryptionKeyResolution = PreferredEncryptionKeyFailure | PreferredEncryptionKeySuccess\n\nexport interface SubscriptionActivationInput {\n  readonly acceptances: readonly PublisherAcceptanceLifecycle[]\n  readonly finalizedHead: number\n  readonly publisherSource: string\n  readonly subscriberSource: string\n  readonly subscriptionId: string\n  readonly subscriptions: readonly WakeSubscriptionLifecycleRevision[]\n}\n\nexport interface SubscriptionActivationSuccess {\n  readonly acceptance: PublisherAcceptanceLifecycle\n  readonly activeFromBlock: number\n  readonly ok: true\n  readonly pendingReplacement: boolean\n  readonly subscription: WakeSubscriptionLifecycleRevision\n}\n\nexport type SubscriptionActivationFailureReason\n  = | 'ambiguous-acceptance'\n    | 'invalid-revision-chain'\n    | 'subscription-inactive'\n    | 'subscription-not-found'\n    | 'subscription-pending'\n\nexport interface SubscriptionActivationFailure {\n  readonly ok: false\n  readonly reason: SubscriptionActivationFailureReason\n}\n\nexport type SubscriptionActivation = SubscriptionActivationFailure | SubscriptionActivationSuccess\n\ninterface LinearChainSuccess<T extends LifecycleRevisionEvidence> {\n  readonly chain: readonly T[]\n  readonly ok: true\n}\n\ninterface LinearChainFailure {\n  readonly ok: false\n}\n\ntype LinearChain<T extends LifecycleRevisionEvidence> = LinearChainFailure | LinearChainSuccess<T>\n\ninterface AcceptedSubscription {\n  readonly acceptance: PublisherAcceptanceLifecycle\n  readonly activeFromBlock: number\n  readonly subscription: WakeSubscriptionLifecycleRevision\n}\n\nfunction isNonnegativeSafeInteger(value: number): boolean {\n  return Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isVisible(claimedAtBlock: number, finalizedHead: number): boolean {\n  return isNonnegativeSafeInteger(claimedAtBlock) && claimedAtBlock <= finalizedHead\n}\n\nfunction isRevoked(revokedAtBlock: number | undefined, finalizedHead: number): boolean {\n  return revokedAtBlock !== undefined && revokedAtBlock <= finalizedHead\n}\n\nfunction isUnrevokedEvidence(\n  claimedAtBlock: number,\n  revokedAtBlock: number | undefined,\n  finalizedHead: number,\n): boolean {\n  return isVisible(claimedAtBlock, finalizedHead)\n    && (revokedAtBlock === undefined || (isNonnegativeSafeInteger(revokedAtBlock) && revokedAtBlock >= claimedAtBlock))\n    && !isRevoked(revokedAtBlock, finalizedHead)\n}\n\nfunction isInsideExclusiveWindow(\n  finalizedHead: number,\n  validFromBlock: number,\n  expiresAtBlock?: number,\n): boolean {\n  if (!isNonnegativeSafeInteger(validFromBlock) || finalizedHead < validFromBlock) return false\n  return expiresAtBlock === undefined\n    || (isNonnegativeSafeInteger(expiresAtBlock) && expiresAtBlock > validFromBlock && finalizedHead < expiresAtBlock)\n}\n\nfunction isRevisionShapeValid(revision: LifecycleRevisionEvidence): boolean {\n  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1) return false\n  if (!isNonnegativeSafeInteger(revision.claimedAtBlock)) return false\n  if (revision.revokedAtBlock !== undefined\n    && (!isNonnegativeSafeInteger(revision.revokedAtBlock) || revision.revokedAtBlock < revision.claimedAtBlock)) return false\n  return revision.revision === 1\n    ? revision.supersedes === undefined\n    : revision.supersedes !== undefined\n}\n\nfunction resolveLinearChain<T extends LifecycleRevisionEvidence>(\n  revisions: readonly T[],\n  finalizedHead: number,\n): LinearChain<T> {\n  const visible = revisions.filter(revision => isVisible(revision.claimedAtBlock, finalizedHead))\n  if (visible.length === 0) return { ok: true, chain: [] }\n  if (visible.some(revision => !isRevisionShapeValid(revision))) return { ok: false }\n\n  const byHash = new Map<string, T>()\n  const childByParent = new Map<string, T>()\n  let root: T | undefined\n\n  for (const revision of visible) {\n    if (byHash.has(revision.objectHash)) return { ok: false }\n    byHash.set(revision.objectHash, revision)\n    if (revision.revision === 1) {\n      if (root !== undefined) return { ok: false }\n      root = revision\n    }\n  }\n  if (root === undefined) return { ok: false }\n\n  for (const revision of visible) {\n    if (revision.revision === 1) continue\n    const parentHash = revision.supersedes\n    if (parentHash === undefined || childByParent.has(parentHash)) return { ok: false }\n    const parent = byHash.get(parentHash)\n    if (parent === undefined\n      || revision.revision !== parent.revision + 1\n      || revision.claimedAtBlock < parent.claimedAtBlock) return { ok: false }\n    childByParent.set(parentHash, revision)\n  }\n\n  const chain: T[] = [root]\n  let current = root\n  while (childByParent.has(current.objectHash)) {\n    const child = childByParent.get(current.objectHash)\n    if (child === undefined) return { ok: false }\n    chain.push(child)\n    current = child\n  }\n  return chain.length === visible.length ? { ok: true, chain } : { ok: false }\n}\n\nfunction groupServicesByIdentity(\n  services: readonly PublisherServiceLifecycleRevision[],\n  input: PublisherServiceSelectionInput,\n): ReadonlyMap<string, readonly PublisherServiceLifecycleRevision[]> {\n  const groups = new Map<string, PublisherServiceLifecycleRevision[]>()\n  for (const service of services) {\n    if (service.source !== input.publisherSource) continue\n    if (input.serviceId !== undefined && service.serviceId !== input.serviceId) continue\n    const group = groups.get(service.serviceId) ?? []\n    group.push(service)\n    groups.set(service.serviceId, group)\n  }\n  return groups\n}\n\nfunction authoritativeService(\n  chain: readonly PublisherServiceLifecycleRevision[],\n  finalizedHead: number,\n): PublisherServiceLifecycleRevision | undefined {\n  let authoritative: PublisherServiceLifecycleRevision | undefined\n  for (const service of chain) {\n    if (service.validFromBlock <= finalizedHead) authoritative = service\n  }\n  return authoritative\n}\n\nfunction isActiveService(service: PublisherServiceLifecycleRevision, finalizedHead: number): boolean {\n  return isUnrevokedEvidence(service.claimedAtBlock, service.revokedAtBlock, finalizedHead)\n    && isInsideExclusiveWindow(finalizedHead, service.validFromBlock, service.expiresAtBlock)\n}\n\n/** Selects exactly one active service; response order never breaks ambiguity. */\nexport function selectPublisherService(input: PublisherServiceSelectionInput): PublisherServiceSelection {\n  const groups = groupServicesByIdentity(input.services, input)\n  const selectable: PublisherServiceLifecycleRevision[] = []\n\n  for (const revisions of groups.values()) {\n    if (input.serviceId === undefined && revisions.every(service => !service.eventKinds.includes(input.eventKind))) {\n      continue\n    }\n    const resolution = resolveLinearChain(revisions, input.finalizedHead)\n    if (!resolution.ok) return { ok: false, reason: 'invalid-revision-chain' }\n    const service = authoritativeService(resolution.chain, input.finalizedHead)\n    if (service?.eventKinds.includes(input.eventKind) && isActiveService(service, input.finalizedHead)) {\n      selectable.push(service)\n    }\n  }\n\n  if (selectable.length === 0) return { ok: false, reason: 'service-not-found' }\n  if (selectable.length > 1) return { ok: false, reason: 'ambiguous-service' }\n  return { ok: true, service: selectable[0] }\n}\n\n/** Resolves the exact preferred descriptor; another active key is never a fallback. */\nexport function resolvePreferredEncryptionKey(\n  input: PreferredEncryptionKeyInput,\n): PreferredEncryptionKeyResolution {\n  const preferredHash = input.service.preferredEncryptionKey\n  if (!input.service.encryptionKeys.includes(preferredHash)) {\n    return { ok: false, reason: 'preferred-key-not-referenced' }\n  }\n\n  const exact = input.keys.filter(key => key.source === input.service.source\n    && key.objectHash === preferredHash\n    && isVisible(key.claimedAtBlock, input.finalizedHead))\n  if (exact.length === 0) return { ok: false, reason: 'preferred-key-not-found' }\n  if (exact.length > 1) return { ok: false, reason: 'ambiguous-key' }\n\n  const key = exact[0]\n  const sameStableIdentity = input.keys.filter(candidate => candidate.source === key.source\n    && candidate.keyId === key.keyId\n    && candidate.objectHash !== key.objectHash\n    && isVisible(candidate.claimedAtBlock, input.finalizedHead))\n  if (sameStableIdentity.length > 0) return { ok: false, reason: 'ambiguous-key' }\n  if (!isUnrevokedEvidence(key.claimedAtBlock, key.revokedAtBlock, input.finalizedHead)\n    || !isInsideExclusiveWindow(input.finalizedHead, key.validFromBlock, key.expiresAtBlock)) {\n    return { ok: false, reason: 'preferred-key-inactive' }\n  }\n  return { ok: true, key }\n}\n\nfunction acceptanceFor(\n  subscription: WakeSubscriptionLifecycleRevision,\n  input: SubscriptionActivationInput,\n): PublisherAcceptanceLifecycle[] {\n  return input.acceptances.filter(acceptance => acceptance.source === input.publisherSource\n    && acceptance.subscription === subscription.objectHash\n    && isVisible(acceptance.acceptanceBlock, input.finalizedHead))\n}\n\nfunction acceptedSubscription(\n  subscription: WakeSubscriptionLifecycleRevision,\n  input: SubscriptionActivationInput,\n): AcceptedSubscription | 'ambiguous' | undefined {\n  const acceptances = acceptanceFor(subscription, input)\n  if (acceptances.length > 1) return 'ambiguous'\n  const acceptance = acceptances[0]\n  if (acceptance === undefined || !isNonnegativeSafeInteger(acceptance.acceptanceBlock)) return undefined\n  if (!Number.isSafeInteger(subscription.expiresAtBlock) || subscription.expiresAtBlock < 1) return undefined\n  if (acceptance.acceptanceBlock <= subscription.claimedAtBlock\n    || acceptance.acceptanceBlock >= Number.MAX_SAFE_INTEGER) return undefined\n  const activeFromBlock = acceptance.acceptanceBlock + 1\n  if (activeFromBlock >= subscription.expiresAtBlock) return undefined\n  return {\n    acceptance, activeFromBlock, subscription,\n  }\n}\n\nfunction isActiveAcceptedSubscription(\n  accepted: AcceptedSubscription,\n  finalizedHead: number,\n): boolean {\n  return isUnrevokedEvidence(\n    accepted.subscription.claimedAtBlock,\n    accepted.subscription.revokedAtBlock,\n    finalizedHead,\n  )\n  && isUnrevokedEvidence(\n    accepted.acceptance.acceptanceBlock,\n    accepted.acceptance.revokedAtBlock,\n    finalizedHead,\n  )\n  && finalizedHead < accepted.subscription.expiresAtBlock\n}\n\n/**\n * Selects the highest revision whose acceptance cutover has arrived. A newer\n * pending revision leaves the prior activation in place; after cutover, an\n * inactive replacement never falls back to an older accepted revision.\n */\nexport function selectSubscriptionActivation(input: SubscriptionActivationInput): SubscriptionActivation {\n  const revisions = input.subscriptions.filter(subscription => subscription.source === input.subscriberSource\n    && subscription.subscriptionId === input.subscriptionId)\n  const resolution = resolveLinearChain(revisions, input.finalizedHead)\n  if (!resolution.ok) return { ok: false, reason: 'invalid-revision-chain' }\n  if (resolution.chain.length === 0) return { ok: false, reason: 'subscription-not-found' }\n\n  let selected: AcceptedSubscription | undefined\n  for (const subscription of resolution.chain) {\n    const accepted = acceptedSubscription(subscription, input)\n    if (accepted === 'ambiguous') return { ok: false, reason: 'ambiguous-acceptance' }\n    if (accepted !== undefined && accepted.activeFromBlock <= input.finalizedHead) selected = accepted\n  }\n  if (selected === undefined) return { ok: false, reason: 'subscription-pending' }\n  const latest = resolution.chain.at(-1)\n  if (!isActiveAcceptedSubscription(selected, input.finalizedHead)) {\n    // Exact-hash revocation or expiry of the prior accepted revision must not\n    // hide a fresh successor that still needs its own acceptance.\n    if (latest?.objectHash !== selected.subscription.objectHash) {\n      return { ok: false, reason: 'subscription-pending' }\n    }\n    return { ok: false, reason: 'subscription-inactive' }\n  }\n\n  return {\n    acceptance: selected.acceptance,\n    activeFromBlock: selected.activeFromBlock,\n    ok: true,\n    pendingReplacement: latest?.objectHash !== selected.subscription.objectHash,\n    subscription: selected.subscription,\n  }\n}\n", "import type {\n  WakeGrantObject,\n  WakeGrantRevocation,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  normalizeAddress,\n  WakeGrantObjectSchema,\n  WakeGrantRevocationSchema,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  StatementGrantClaim,\n  StatementGrantObject,\n  StatementGraphGrantReadModel,\n} from './statementGraphPorts.ts'\n\nexport interface MemoryStatementGrantGraph extends StatementGraphGrantReadModel {\n  /**\n   * Claim a grant object. Statement Graph v2 is append-only, so a repeat claim\n   * is redundant: it advances `lastBlock` and leaves `firstBlock` frozen.\n   */\n  claim: (input: {\n    block: number\n    /** Claim event hash; must be 64 lowercase hex. */\n    eventHash: string\n    grant: WakeGrantObject\n    objectHash: string\n    source: string\n    /** Defaults to `grant.publisher`. */\n    subject?: string\n  }) => void\n  /**\n   * Claim a revocation object negating `grant`. There is no revoke verb in v2 \u2014\n   * negation is another claim, and Event Kit reads it as the disabling signal.\n   */\n  revoke: (input: {\n    block: number\n    eventHash: string\n    grantObjectHash: string\n    objectHash: string\n    source: string\n    /** Defaults to the subject of the referenced grant Claim. */\n    subject?: string\n  }) => void\n  setHead: (block: number) => void\n}\n\n/**\n * In-memory Statement Graph v2 stand-in for grant/negation tests.\n * Not a full fold \u2014 enough to exercise the Event Kit allowlist adapter.\n */\nexport function createMemoryStatementGrantGraph(initialHead = 0): MemoryStatementGrantGraph {\n  let head = initialHead\n  const claims = new Map<string, StatementGrantClaim>()\n  const objects = new Map<string, StatementGrantObject>()\n\n  function claimKey(source: string, subject: string, objectHash: string): string {\n    return `${normalizeAddress(source)}|${normalizeAddress(subject)}|${objectHash}`\n  }\n\n  function materialize(input: {\n    block: number\n    declaredSchema: string\n    eventHash: string\n    objectHash: string\n    params: Readonly<Record<string, unknown>>\n    source: string\n    subject: string\n  }): void {\n    const source = normalizeAddress(input.source)\n    const subject = normalizeAddress(input.subject)\n    objects.set(input.objectHash, Object.freeze({\n      assurance: 'resolved',\n      declaredSchema: input.declaredSchema,\n      objectHash: input.objectHash,\n      params: Object.freeze({ ...input.params }),\n    }))\n\n    const key = claimKey(source, subject, input.objectHash)\n    const existing = claims.get(key)\n    claims.set(key, Object.freeze(existing === undefined\n      ? {\n          declaredObjectSchema: input.declaredSchema,\n          firstBlock: input.block,\n          firstEventHash: input.eventHash,\n          lastBlock: input.block,\n          objectHash: input.objectHash,\n          source,\n          subject,\n        }\n      // Redundant claim: first-wins on identity, only the moving clock advances.\n      : { ...existing, lastBlock: Math.max(existing.lastBlock, input.block) }))\n    if (input.block > head) head = input.block\n  }\n\n  return {\n    head: async (): Promise<number> => head,\n\n    setHead(block: number): void {\n      head = block\n    },\n\n    async claims(source, query): Promise<readonly StatementGrantClaim[]> {\n      const normalizedSource = normalizeAddress(source)\n      const records: StatementGrantClaim[] = []\n      for (const record of claims.values()) {\n        if (record.source !== normalizedSource) continue\n        if (query?.subject !== undefined && record.subject !== normalizeAddress(query.subject)) continue\n        if (query?.objectHash !== undefined && record.objectHash !== query.objectHash) continue\n        if (query?.declaredObjectSchemaPrefix !== undefined\n          && !record.declaredObjectSchema.startsWith(query.declaredObjectSchemaPrefix)) {\n          continue\n        }\n        records.push(record)\n      }\n      return records\n    },\n\n    object: async (objectHash): Promise<StatementGrantObject | undefined> => objects.get(objectHash),\n\n    claim(input): void {\n      if (input.grant.schema !== WakeGrantObjectSchema) {\n        throw new Error(`expected ${WakeGrantObjectSchema}`)\n      }\n      const { schema: _schema, ...params } = input.grant\n      materialize({\n        block: input.block,\n        declaredSchema: WakeGrantObjectSchema,\n        eventHash: input.eventHash,\n        objectHash: input.objectHash,\n        params: {\n          ...params,\n          permissions: Object.freeze([...params.permissions]),\n        },\n        source: input.source,\n        subject: input.subject ?? input.grant.publisher,\n      })\n    },\n\n    revoke(input): void {\n      const revocation: Omit<WakeGrantRevocation, 'schema'> = { grant: input.grantObjectHash }\n      const source = normalizeAddress(input.source)\n      const subjects = claims.values()\n        .filter(claim => claim.source === source && claim.objectHash === input.grantObjectHash)\n        .map(claim => claim.subject)\n        .toArray()\n      const uniqueSubjects = [...new Set(subjects)]\n      if (input.subject === undefined && uniqueSubjects.length > 1) {\n        throw new Error(`cannot infer one subject for ambiguous grant Claim ${input.grantObjectHash}`)\n      }\n      const subject = input.subject ?? uniqueSubjects[0]\n      if (subject === undefined) {\n        throw new Error(`cannot infer subject for unknown grant Claim ${input.grantObjectHash}`)\n      }\n      materialize({\n        block: input.block,\n        declaredSchema: WakeGrantRevocationSchema,\n        eventHash: input.eventHash,\n        objectHash: input.objectHash,\n        params: revocation,\n        source: input.source,\n        subject,\n      })\n    },\n  }\n}\n", "import type {\n  Hash,\n  WakeId,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  AtomicWakeInbox,\n  WakeAdmissionAttempt,\n  WakeAdmissionReceipt,\n  WakeAttemptResolution,\n  WakeCommitResult,\n} from './admissionTypes.ts'\nimport type { AdmittedWake } from './types.ts'\n\nexport interface MemoryWakeInboxOptions<TWake = AdmittedWake> {\n  /**\n   * Durable-sink stand-in invoked inside the atomic commit. A throw leaves both\n   * identities unconsumed, so the publisher may retry the same `wakeId` with a\n   * fresh `jti` instead of losing the wake to a burned replay key.\n   */\n  readonly enqueue?: (wake: TWake) => Promise<void> | void\n  /** Trusted clock in Unix seconds, used to drop expired token records. */\n  readonly nowSeconds?: () => number\n}\n\nexport interface MemoryWakeInbox<TWake = AdmittedWake> extends AtomicWakeInbox<TWake> {\n  /** Wakes handed to `enqueue`, in commit order. */\n  readonly queued: readonly TWake[]\n  /** Live `(aud, iss, jti)` replay records. */\n  readonly tokenRecordCount: number\n  /** Live `(aud, iss, wakeId)` logical records. */\n  readonly wakeRecordCount: number\n}\n\ninterface ReceiptBinding {\n  readonly eventHash: Hash\n  readonly receipt: WakeAdmissionReceipt\n  readonly wakeId: WakeId\n}\n\ninterface TokenBinding extends ReceiptBinding {\n  readonly retainJwtUntil: number\n}\n\n/** The already-recorded outcomes, common to both the resolve and commit unions. */\ntype RecordedResolution = Exclude<WakeAttemptResolution, { readonly kind: 'new' }>\n\n/**\n * Single-process linearizable `AtomicWakeInbox` for structural tests and local\n * rehearsal.\n *\n * Writes are ordered so a failing sink cannot consume `jti` or `wakeId` without\n * a recoverable receipt. It is **not** durable: process death between enqueue\n * and record commit redelivers the wake, and no state survives restart. The\n * historical core implementation-plan Gate 5 requires a durable adapter; this\n * is local evidence only.\n */\nexport function createMemoryWakeInbox<TWake = AdmittedWake>(\n  options: MemoryWakeInboxOptions<TWake> = {},\n): MemoryWakeInbox<TWake> {\n  const tokenRecords = new Map<string, TokenBinding>()\n  const wakeRecords = new Map<string, ReceiptBinding>()\n  const queued: TWake[] = []\n  let receiptSequence = 0\n  let tail: Promise<unknown> = Promise.resolve()\n\n  /**\n   * Serializes the critical section. Both entry points read, decide, and write\n   * across an `await`, so without this a concurrent commit could pass its\n   * recheck before the winning commit records either identity.\n   */\n  function exclusive<T>(work: () => Promise<T>): Promise<T> {\n    const previous = tail\n    const run = (async (): Promise<T> => {\n      try {\n        await previous\n      } catch {\n        // Prior section still releases the lock; this section must run either way.\n      }\n      return await work()\n    })()\n    tail = Promise.allSettled([run])\n    return run\n  }\n\n  function pruneExpiredTokens(): void {\n    const { nowSeconds } = options\n    if (nowSeconds === undefined) return\n    const now = nowSeconds()\n    for (const [key, binding] of tokenRecords) {\n      if (binding.retainJwtUntil <= now) tokenRecords.delete(key)\n    }\n  }\n\n  /** Resolves an attempt against both indexes, binding a fresh `jti` to a known wake. */\n  function matchRecorded(attempt: WakeAdmissionAttempt): RecordedResolution | undefined {\n    const tokenBinding = tokenRecords.get(tokenKey(attempt))\n    if (tokenBinding !== undefined) {\n      return tokenBinding.eventHash === attempt.eventHash && tokenBinding.wakeId === attempt.wakeId\n        ? { kind: 'duplicate', receipt: tokenBinding.receipt }\n        : { kind: 'jwt-id-collision' }\n    }\n\n    const wakeBinding = wakeRecords.get(wakeKey(attempt))\n    if (wakeBinding === undefined) return undefined\n    if (wakeBinding.eventHash !== attempt.eventHash) return { kind: 'wake-id-collision' }\n    tokenRecords.set(tokenKey(attempt), { ...wakeBinding, retainJwtUntil: attempt.retainJwtUntil })\n    return { kind: 'duplicate', receipt: wakeBinding.receipt }\n  }\n\n  return {\n    get queued(): readonly TWake[] {\n      return queued\n    },\n\n    get tokenRecordCount(): number {\n      return tokenRecords.size\n    },\n\n    get wakeRecordCount(): number {\n      return wakeRecords.size\n    },\n\n    resolveAttempt: async (attempt: WakeAdmissionAttempt): Promise<WakeAttemptResolution> => await exclusive(async () => {\n      pruneExpiredTokens()\n      return matchRecorded(attempt) ?? { kind: 'new' }\n    }),\n\n    commitAuthorized: async ({ attempt, wake }: {\n      readonly attempt: WakeAdmissionAttempt\n      readonly wake: TWake\n    }): Promise<WakeCommitResult> => await exclusive(async () => {\n      pruneExpiredTokens()\n      const recorded = matchRecorded(attempt)\n      if (recorded !== undefined) return recorded\n\n      const receipt: WakeAdmissionReceipt = Object.freeze({\n        audience: attempt.audience,\n        eventHash: attempt.eventHash,\n        id: `receipt-${receiptSequence += 1}`,\n        publisher: attempt.publisher,\n        wakeId: attempt.wakeId,\n      })\n\n      // Hand the wake to the sink before consuming either identity. A throw here\n      // must leave the attempt retryable rather than strand it without a receipt.\n      await options.enqueue?.(wake)\n      queued.push(wake)\n\n      const binding: ReceiptBinding = {\n        eventHash: attempt.eventHash,\n        receipt,\n        wakeId: attempt.wakeId,\n      }\n      tokenRecords.set(tokenKey(attempt), { ...binding, retainJwtUntil: attempt.retainJwtUntil })\n      wakeRecords.set(wakeKey(attempt), binding)\n      return { kind: 'enqueued', receipt }\n    }),\n  }\n}\n\n/** Opaque audiences may contain any character, so keys are JSON-encoded rather than joined. */\nfunction tokenKey(attempt: WakeAdmissionAttempt): string {\n  return JSON.stringify([attempt.audience, attempt.publisher, attempt.jwtId])\n}\n\nfunction wakeKey(attempt: WakeAdmissionAttempt): string {\n  return JSON.stringify([attempt.audience, attempt.publisher, attempt.wakeId])\n}\n", "import type { AdmittedWake } from './types.ts'\nimport type {\n  LeasedWake,\n  WakeQueue,\n} from './wakeQueue.ts'\n\nexport interface MemoryWakeQueue<TWake = AdmittedWake> extends WakeQueue<TWake> {\n  /** Entries currently leased and not yet acked or released. */\n  inflightCount: () => Promise<number>\n}\n\ninterface Entry<TWake> {\n  readonly sequence: number\n  readonly wake: TWake\n}\n\n/**\n * In-process `WakeQueue`.\n *\n * Structural evidence only: nothing survives process death, so `recoverInflight`\n * can reclaim a lease abandoned within this process but cannot help after a\n * restart. Use the filesystem or SQLite provider where durability matters.\n */\nexport function createMemoryWakeQueue<TWake = AdmittedWake>(): MemoryWakeQueue<TWake> {\n  const pending: Entry<TWake>[] = []\n  const inflight = new Map<number, Entry<TWake>>()\n  let sequence = 0\n\n  return {\n    async append(wake: TWake): Promise<void> {\n      pending.push({ sequence: sequence += 1, wake })\n    },\n\n    async claim(): Promise<LeasedWake<TWake> | undefined> {\n      const entry = pending.shift()\n      if (entry === undefined) return undefined\n      inflight.set(entry.sequence, entry)\n\n      return {\n        wake: entry.wake,\n        async ack(): Promise<void> {\n          inflight.delete(entry.sequence)\n        },\n        async release(): Promise<void> {\n          if (!inflight.delete(entry.sequence)) return\n          // Restore arrival order rather than appending to the tail.\n          pending.push(entry)\n          pending.sort((left, right) => left.sequence - right.sequence)\n        },\n      }\n    },\n\n    inflightCount: async (): Promise<number> => inflight.size,\n\n    pendingCount: async (): Promise<number> => pending.length,\n\n    async recoverInflight(): Promise<number> {\n      const recovered = inflight.size\n      for (const entry of inflight.values()) pending.push(entry)\n      inflight.clear()\n      pending.sort((left, right) => left.sequence - right.sequence)\n      return recovered\n    },\n  }\n}\n", "/* eslint-disable max-lines -- Publisher-side validation and challenge completion share one auditable security boundary. */\nimport type {\n  ChainId,\n  EncryptedWakeSubscription,\n  EndpointChallenge,\n  EndpointChallengeResponse,\n  Hash,\n  NormalizedAddress,\n  PublisherEncryptionKey,\n  PublisherService,\n  WakeGrantObject,\n  WakeSubscriptionAcceptance,\n  WakeSubscriptionPlaintext,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  ChainIdZod,\n  EncryptedWakeSubscriptionZod,\n  EndpointChallengeZod,\n  HashZod,\n  hasMatchingHandshakeProfile,\n  NormalizedAddressZod,\n  PublisherEncryptionKeyZod,\n  PublisherServiceZod,\n  WakeGrantObjectZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport {\n  createEndpointChallenge,\n  endpointChallengeHash,\n  verifyEndpointChallengeProof,\n  verifyEndpointChallengeResponse,\n} from './endpointChallenge.ts'\nimport type { HashedHandshakeObject } from './handshakeConstruction.ts'\nimport {\n  createWakeSubscriptionAcceptance,\n  handshakeObjectHash,\n} from './handshakeConstruction.ts'\nimport type {\n  BeginPublisherEndpointChallengeAttemptResult,\n  CompletePublisherEndpointChallengeResult,\n  PublisherEncryptionKeyStore,\n  PublisherEndpointChallengeRecord,\n  PublisherEndpointChallengeStore,\n} from './publisherHandshakeStores.ts'\nimport { wakeSourcesEqual } from './sourceWakeIdentity.ts'\nimport { decryptWakeSubscription } from './wakeSubscriptionHpke.ts'\n\n/**\n * Finalized, publisher-scoped read-model output for one exact subscriber\n * fan-out Claim. The caller remains responsible for finalized Claim authority,\n * service/key selection, lifecycle revocations, and revalidation before\n * publishing acceptance; this boundary independently recomputes immutable\n * body hashes and enforces publisher-private constraints.\n */\nexport interface PublisherSubscriptionCandidate {\n  readonly chainId: ChainId\n  readonly finalizedHead: number\n  readonly grant: HashedHandshakeObject<WakeGrantObject>\n  readonly key: HashedHandshakeObject<PublisherEncryptionKey>\n  readonly keys: PublisherEncryptionKeyStore\n  readonly publisher: NormalizedAddress\n  readonly service: HashedHandshakeObject<PublisherService>\n  /** Finalized fan-out Claim source; this is the subscriber identity used in HPKE AAD. */\n  readonly subscriber: NormalizedAddress\n  readonly subscription: HashedHandshakeObject<EncryptedWakeSubscription>\n  /** Finalized block containing the exact service/grant/subscription fan-out Claim. */\n  readonly tupleBlock: number\n  /** All object hashes in that one fan-out Claim. */\n  readonly tupleObjectHashes: readonly Hash[]\n  /** Publisher subject under which the finalized fan-out Claim was discovered. */\n  readonly tupleSubject: NormalizedAddress\n}\n\nexport type PublisherSubscriptionValidationFailureReason\n  = | 'body-hash-mismatch'\n    | 'decryption-failed'\n    | 'grant-binding-invalid'\n    | 'grant-scope-invalid'\n    | 'key-binding-invalid'\n    | 'key-inactive'\n    | 'key-store-unavailable'\n    | 'malformed-candidate'\n    | 'private-key-not-found'\n    | 'service-inactive'\n    | 'service-limit-invalid'\n    | 'subscription-binding-invalid'\n    | 'subscription-expiry-invalid'\n    | 'tuple-binding-invalid'\n\nexport interface PublisherSubscriptionValidationFailure {\n  readonly ok: false\n  readonly reason: PublisherSubscriptionValidationFailureReason\n}\n\nexport interface PublisherEndpointChallengeContext {\n  readonly chainId: ChainId\n  readonly encryptionKey: Hash\n  readonly eventKind: EncryptedWakeSubscription['eventKind']\n  readonly grant: Hash\n  readonly keyId: EncryptedWakeSubscription['keyId']\n  readonly publisher: NormalizedAddress\n  readonly service: Hash\n  readonly subscriber: NormalizedAddress\n  readonly subscription: Hash\n}\n\nexport interface ValidatedPublisherSubscription {\n  readonly context: PublisherEndpointChallengeContext\n  readonly finalizedHead: number\n  readonly grant: HashedHandshakeObject<WakeGrantObject>\n  readonly key: HashedHandshakeObject<PublisherEncryptionKey>\n  readonly ok: true\n  readonly plaintext: WakeSubscriptionPlaintext\n  readonly service: HashedHandshakeObject<PublisherService>\n  readonly subscription: HashedHandshakeObject<EncryptedWakeSubscription>\n  readonly tupleBlock: number\n}\n\nexport type PublisherSubscriptionValidation\n  = | PublisherSubscriptionValidationFailure\n    | ValidatedPublisherSubscription\n\nexport interface IssuePublisherEndpointChallengeApiInput {\n  readonly issuedAt: number\n  readonly lifetimeSeconds?: number\n  readonly store: PublisherEndpointChallengeStore\n  readonly subscription: ValidatedPublisherSubscription\n}\n\nexport type IssuePublisherEndpointChallengeApiResult\n  = | { readonly ok: false; readonly reason: 'challenge-collision' | 'challenge-store-invalid' | 'challenge-store-unavailable' }\n    | {\n      readonly challenge: EndpointChallenge\n      readonly challengeHash: Hash\n      readonly disposition: 'duplicate' | 'issued'\n      readonly ok: true\n    }\n\nexport interface BeginPublisherEndpointChallengeAttemptApiInput {\n  readonly challengeHash: Hash\n  readonly nowSeconds: number\n  readonly store: PublisherEndpointChallengeStore\n}\n\nexport type BeginPublisherEndpointChallengeAttemptApiResult\n  = | BeginPublisherEndpointChallengeAttemptResult\n    | { readonly kind: 'store-invalid' | 'store-unavailable' }\n\nexport interface CompletePublisherEndpointChallengeApiInput {\n  readonly challenge: EndpointChallenge\n  /**\n   * Publisher-local Unix second for the one-time proof-verification and\n   * acceptance decision. Finalized replay cannot and does not re-evaluate this\n   * value from XL1 block time.\n   */\n  readonly nowSeconds: number\n  readonly response: EndpointChallengeResponse\n  readonly store: PublisherEndpointChallengeStore\n  readonly subscription: ValidatedPublisherSubscription\n}\n\nexport type CompletePublisherEndpointChallengeFailureReason\n  = | 'challenge-context-invalid'\n    | 'challenge-expired'\n    | 'challenge-not-attempted'\n    | 'challenge-not-found'\n    | 'challenge-response-collision'\n    | 'challenge-store-invalid'\n    | 'challenge-store-unavailable'\n    | 'invalid-proof'\n\nexport interface CompletePublisherEndpointChallengeFailure {\n  readonly ok: false\n  readonly reason: CompletePublisherEndpointChallengeFailureReason\n}\n\nexport interface CompletePublisherEndpointChallengeSuccess {\n  readonly acceptance: WakeSubscriptionAcceptance\n  readonly acceptanceHash: Hash\n  readonly challengeHash: Hash\n  readonly disposition: 'duplicate' | 'verified'\n  readonly ok: true\n  readonly responseHash: Hash\n}\n\nexport type CompletePublisherEndpointChallengeApiResult\n  = | CompletePublisherEndpointChallengeFailure\n    | CompletePublisherEndpointChallengeSuccess\n\nfunction rejectPublisherSubscription(\n  reason: PublisherSubscriptionValidationFailureReason,\n): PublisherSubscriptionValidationFailure {\n  return Object.freeze({ ok: false, reason })\n}\n\nfunction isNonnegativeSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isActiveAt(\n  value: { readonly expiresAtBlock?: number; readonly validFromBlock: number },\n  block: number,\n): boolean {\n  return value.validFromBlock <= block\n    && (value.expiresAtBlock === undefined || block < value.expiresAtBlock)\n}\n\nfunction occursExactlyOnce(hashes: readonly Hash[], expected: Hash): boolean {\n  return hashes.filter(hash => hash === expected).length === 1\n}\n\nfunction hasExactGrantBinding(grant: WakeGrantObject, publisher: NormalizedAddress): boolean {\n  return grant.publisher === publisher\n    && grant.permissions.length === 1\n    && grant.permissions[0] === 'enqueue'\n}\n\nfunction hasExactQueueScope(grant: WakeGrantObject, plaintext: WakeSubscriptionPlaintext): boolean {\n  const grantQueue = Object.hasOwn(grant, 'queueId') ? grant.queueId : null\n  return plaintext.deploymentId === grant.deploymentId && plaintext.queueId === grantQueue\n}\n\nfunction hasExactSubscriptionBinding(\n  candidate: PublisherSubscriptionCandidate,\n  subscription: EncryptedWakeSubscription,\n): boolean {\n  return subscription.chainId === candidate.chainId\n    && subscription.publisher === candidate.publisher\n    && subscription.service === candidate.service.objectHash\n    && subscription.encryptionKey === candidate.key.objectHash\n    && subscription.keyId === candidate.key.body.keyId\n    && subscription.grant === candidate.grant.objectHash\n}\n\nfunction hasExactKeyBinding(\n  service: PublisherService,\n  key: HashedHandshakeObject<PublisherEncryptionKey>,\n  subscription: EncryptedWakeSubscription,\n): boolean {\n  return service.encryptionKeys.includes(key.objectHash)\n    && service.preferredEncryptionKey === key.objectHash\n    && key.body.keyId === subscription.keyId\n    && key.objectHash === subscription.encryptionKey\n}\n\nfunction expiryWithinServicePolicy(\n  subscription: EncryptedWakeSubscription,\n  service: PublisherService,\n  tupleBlock: number,\n): boolean {\n  return subscription.expiresAtBlock > tupleBlock\n    && subscription.expiresAtBlock - tupleBlock <= service.limits.maxSubscriptionLifetimeBlocks\n}\n\ninterface ParsedPublisherSubscriptionCandidate {\n  readonly chainId: ChainId\n  readonly grant: WakeGrantObject\n  readonly key: PublisherEncryptionKey\n  readonly publisher: NormalizedAddress\n  readonly service: PublisherService\n  readonly subscriber: NormalizedAddress\n  readonly subscription: EncryptedWakeSubscription\n  readonly tupleObjectHashes: readonly Hash[]\n  readonly tupleSubject: NormalizedAddress\n}\n\nfunction parsePublisherSubscriptionCandidate(\n  candidate: PublisherSubscriptionCandidate,\n): ParsedPublisherSubscriptionCandidate | undefined {\n  try {\n    return {\n      chainId: ChainIdZod.parse(candidate.chainId),\n      grant: WakeGrantObjectZod.parse(candidate.grant.body),\n      key: PublisherEncryptionKeyZod.parse(candidate.key.body),\n      publisher: NormalizedAddressZod.parse(candidate.publisher),\n      service: PublisherServiceZod.parse(candidate.service.body),\n      subscriber: NormalizedAddressZod.parse(candidate.subscriber),\n      subscription: EncryptedWakeSubscriptionZod.parse(candidate.subscription.body),\n      tupleObjectHashes: candidate.tupleObjectHashes.map(hash => HashZod.parse(hash)),\n      tupleSubject: NormalizedAddressZod.parse(candidate.tupleSubject),\n    }\n  } catch {\n    return undefined\n  }\n}\n\nfunction tupleBindingIsValid(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): boolean {\n  return isNonnegativeSafeInteger(candidate.tupleBlock)\n    && isNonnegativeSafeInteger(candidate.finalizedHead)\n    && candidate.finalizedHead >= candidate.tupleBlock\n    && parsed.tupleSubject === parsed.publisher\n    && occursExactlyOnce(parsed.tupleObjectHashes, candidate.service.objectHash)\n    && occursExactlyOnce(parsed.tupleObjectHashes, candidate.grant.objectHash)\n    && occursExactlyOnce(parsed.tupleObjectHashes, candidate.subscription.objectHash)\n}\n\nasync function bodyHashesAreValid(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): Promise<boolean> {\n  const canonicalHashes = await Promise.all([\n    handshakeObjectHash(parsed.service),\n    handshakeObjectHash(parsed.key),\n    handshakeObjectHash(parsed.grant),\n    handshakeObjectHash(parsed.subscription),\n  ])\n  return canonicalHashes[0] === candidate.service.objectHash\n    && canonicalHashes[1] === candidate.key.objectHash\n    && canonicalHashes[2] === candidate.grant.objectHash\n    && canonicalHashes[3] === candidate.subscription.objectHash\n}\n\nfunction publicBindingFailure(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): PublisherSubscriptionValidationFailureReason | undefined {\n  if (!hasMatchingHandshakeProfile(parsed.service, parsed.subscription, parsed.chainId)) return 'subscription-binding-invalid'\n  if (!hasExactGrantBinding(parsed.grant, parsed.publisher)) return 'grant-binding-invalid'\n  if (!hasExactSubscriptionBinding(candidate, parsed.subscription)) return 'subscription-binding-invalid'\n  const hashedKey = { body: parsed.key, objectHash: candidate.key.objectHash }\n  if (!hasExactKeyBinding(parsed.service, hashedKey, parsed.subscription)) return 'key-binding-invalid'\n  if (!isActiveAt(parsed.service, candidate.tupleBlock)\n    || !isActiveAt(parsed.service, candidate.finalizedHead)) return 'service-inactive'\n  if (!isActiveAt(parsed.key, candidate.tupleBlock)\n    || !isActiveAt(parsed.key, candidate.finalizedHead)) return 'key-inactive'\n  if (!expiryWithinServicePolicy(parsed.subscription, parsed.service, candidate.tupleBlock)\n    || parsed.subscription.expiresAtBlock - candidate.finalizedHead <= 2) return 'subscription-expiry-invalid'\n  return undefined\n}\n\nasync function decryptCandidate(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n): Promise<PublisherSubscriptionValidationFailure | { readonly plaintext: WakeSubscriptionPlaintext }> {\n  let privateKey\n  try {\n    privateKey = await candidate.keys.getPrivateKey({\n      encryptionKey: candidate.key.objectHash,\n      keyId: parsed.key.keyId,\n      publisher: parsed.publisher,\n    })\n  } catch {\n    return rejectPublisherSubscription('key-store-unavailable')\n  }\n  if (privateKey === undefined) return rejectPublisherSubscription('private-key-not-found')\n  if (privateKey.encryptionKey !== candidate.key.objectHash || privateKey.keyId !== parsed.key.keyId) {\n    return rejectPublisherSubscription('key-binding-invalid')\n  }\n\n  try {\n    return {\n      plaintext: await decryptWakeSubscription({\n        publisherKey: privateKey,\n        subscriber: parsed.subscriber,\n        subscription: parsed.subscription,\n      }),\n    }\n  } catch {\n    return rejectPublisherSubscription('decryption-failed')\n  }\n}\n\nfunction validatedPublisherSubscription(\n  candidate: PublisherSubscriptionCandidate,\n  parsed: ParsedPublisherSubscriptionCandidate,\n  plaintext: WakeSubscriptionPlaintext,\n): ValidatedPublisherSubscription {\n  return Object.freeze({\n    context: Object.freeze({\n      chainId: parsed.chainId,\n      encryptionKey: candidate.key.objectHash,\n      eventKind: parsed.subscription.eventKind,\n      grant: candidate.grant.objectHash,\n      keyId: parsed.subscription.keyId,\n      publisher: parsed.publisher,\n      service: candidate.service.objectHash,\n      subscriber: parsed.subscriber,\n      subscription: candidate.subscription.objectHash,\n    }),\n    finalizedHead: candidate.finalizedHead,\n    grant: Object.freeze({ body: parsed.grant, objectHash: candidate.grant.objectHash }),\n    key: Object.freeze({ body: parsed.key, objectHash: candidate.key.objectHash }),\n    ok: true,\n    plaintext,\n    service: Object.freeze({ body: parsed.service, objectHash: candidate.service.objectHash }),\n    subscription: Object.freeze({ body: parsed.subscription, objectHash: candidate.subscription.objectHash }),\n    tupleBlock: candidate.tupleBlock,\n  })\n}\n\n/**\n * Validate one read-model-qualified finalized public tuple, resolve exactly\n * one dedicated private key, decrypt once, and enforce the private grant and\n * filter scope. No algorithm, key, service, or AAD fallback is attempted after\n * failure. Callers must resolve the finalized lifecycle again after challenge\n * and before publishing acceptance.\n */\nexport async function validateAndDecryptPublisherSubscription(\n  candidate: PublisherSubscriptionCandidate,\n): Promise<PublisherSubscriptionValidation> {\n  const parsed = parsePublisherSubscriptionCandidate(candidate)\n  if (parsed === undefined) return rejectPublisherSubscription('malformed-candidate')\n  if (!tupleBindingIsValid(candidate, parsed)) return rejectPublisherSubscription('tuple-binding-invalid')\n  if (!await bodyHashesAreValid(candidate, parsed)) return rejectPublisherSubscription('body-hash-mismatch')\n  const publicFailure = publicBindingFailure(candidate, parsed)\n  if (publicFailure !== undefined) return rejectPublisherSubscription(publicFailure)\n  const decrypted = await decryptCandidate(candidate, parsed)\n  if ('ok' in decrypted) return decrypted\n  if (!hasExactQueueScope(parsed.grant, decrypted.plaintext)) {\n    return rejectPublisherSubscription('grant-scope-invalid')\n  }\n  if (!filterWithinServicePolicy(parsed.service, decrypted.plaintext)) {\n    return rejectPublisherSubscription('service-limit-invalid')\n  }\n  return validatedPublisherSubscription(candidate, parsed, decrypted.plaintext)\n}\n\n/** Exact challenge tuple comparison; every context field is mandatory. */\nexport function endpointChallengeMatchesPublisherContext(\n  challenge: EndpointChallenge,\n  context: PublisherEndpointChallengeContext,\n): boolean {\n  const parsed = EndpointChallengeZod.safeParse(challenge)\n  if (!parsed.success) return false\n  return parsed.data.chainId === context.chainId\n    && parsed.data.publisher === context.publisher\n    && parsed.data.subscriber === context.subscriber\n    && parsed.data.service === context.service\n    && parsed.data.encryptionKey === context.encryptionKey\n    && parsed.data.keyId === context.keyId\n    && parsed.data.subscription === context.subscription\n    && parsed.data.grant === context.grant\n    && parsed.data.eventKind === context.eventKind\n}\n\nasync function challengeRecordMatches(\n  record: PublisherEndpointChallengeRecord,\n  challenge: EndpointChallenge,\n  challengeHash: Hash,\n  responseHash?: Hash,\n): Promise<boolean> {\n  if (record.challengeHash !== challengeHash\n    || await endpointChallengeHash(record.challenge) !== challengeHash\n    || await endpointChallengeHash(challenge) !== challengeHash) return false\n  return responseHash === undefined || record.responseHash === responseHash\n}\n\n/** Create and durably issue a fresh challenge for one validated tuple. */\nexport async function issuePublisherEndpointChallenge(\n  input: IssuePublisherEndpointChallengeApiInput,\n): Promise<IssuePublisherEndpointChallengeApiResult> {\n  const context = input.subscription.context\n  const common = {\n    ...context,\n    issuedAt: input.issuedAt,\n    ...(input.lifetimeSeconds === undefined ? {} : { lifetimeSeconds: input.lifetimeSeconds }),\n  }\n  const challenge = createEndpointChallenge(common)\n  const challengeHash = await endpointChallengeHash(challenge)\n  try {\n    const result = await input.store.issue({ challenge, challengeHash })\n    if (result.kind === 'collision') return { ok: false, reason: 'challenge-collision' }\n    if ((result.kind !== 'duplicate' && result.kind !== 'issued')\n      || !await challengeRecordMatches(result.record, challenge, challengeHash)) {\n      return { ok: false, reason: 'challenge-store-invalid' }\n    }\n    return Object.freeze({\n      challenge,\n      challengeHash,\n      disposition: result.kind,\n      ok: true,\n    })\n  } catch {\n    return { ok: false, reason: 'challenge-store-unavailable' }\n  }\n}\n\n/** Claim the one permitted outbound challenge attempt before any HTTP call. */\nexport async function beginPublisherEndpointChallengeAttempt(\n  input: BeginPublisherEndpointChallengeAttemptApiInput,\n): Promise<BeginPublisherEndpointChallengeAttemptApiResult> {\n  if (!isNonnegativeSafeInteger(input.nowSeconds)) return { kind: 'store-invalid' }\n  try {\n    const result = await input.store.beginAttempt({\n      challengeHash: HashZod.parse(input.challengeHash),\n      nowSeconds: input.nowSeconds,\n    })\n    if (!['already-attempted', 'expired', 'missing', 'started', 'verified'].includes(result.kind)) {\n      return { kind: 'store-invalid' }\n    }\n    if (result.kind !== 'missing'\n      && !await challengeRecordMatches(\n        result.record,\n        result.record.challenge,\n        HashZod.parse(input.challengeHash),\n      )) return { kind: 'store-invalid' }\n    if ((result.kind === 'started' || result.kind === 'already-attempted')\n      && result.record.state !== 'attempted') return { kind: 'store-invalid' }\n    if (result.kind === 'verified' && result.record.state !== 'verified') return { kind: 'store-invalid' }\n    return result\n  } catch {\n    return { kind: 'store-unavailable' }\n  }\n}\n\nfunction completeFailure(\n  reason: CompletePublisherEndpointChallengeFailureReason,\n): CompletePublisherEndpointChallengeFailure {\n  return Object.freeze({ ok: false, reason })\n}\n\ntype VerifiedPublisherEndpointChallengeResult = Extract<\n  CompletePublisherEndpointChallengeResult,\n  { readonly kind: 'duplicate' | 'verified' }\n>\n\nasync function validateChallengeCompletion(\n  input: CompletePublisherEndpointChallengeApiInput,\n  result: CompletePublisherEndpointChallengeResult,\n  challengeHash: Hash,\n  responseHash: Hash,\n  insideDecisionWindow: boolean,\n  proofValid: boolean,\n): Promise<CompletePublisherEndpointChallengeFailure | VerifiedPublisherEndpointChallengeResult> {\n  if (!insideDecisionWindow && result.kind !== 'duplicate') {\n    return completeFailure(result.kind === 'collision'\n      ? 'challenge-response-collision'\n      : 'challenge-expired')\n  }\n  if (!proofValid) return completeFailure('invalid-proof')\n  if (result.kind === 'missing') return completeFailure('challenge-not-found')\n  if (result.kind === 'expired') return completeFailure('challenge-expired')\n  if (result.kind === 'not-attempted') return completeFailure('challenge-not-attempted')\n  if (result.kind === 'collision') return completeFailure('challenge-response-collision')\n  if ((result.kind !== 'duplicate' && result.kind !== 'verified')\n    || !await challengeRecordMatches(result.record, input.challenge, challengeHash, responseHash)) {\n    return completeFailure('challenge-store-invalid')\n  }\n  return result\n}\n\n/**\n * Verify exact tuple context and proof in its Unix-time window, atomically\n * consume the durable challenge, then construct the exact publisher acceptance\n * object. Publishing that object attests to this in-window decision; later\n * finalization does not re-run a wall-clock check.\n */\nexport async function completePublisherEndpointChallenge(\n  input: CompletePublisherEndpointChallengeApiInput,\n): Promise<CompletePublisherEndpointChallengeApiResult> {\n  if (!endpointChallengeMatchesPublisherContext(input.challenge, input.subscription.context)) {\n    return completeFailure('challenge-context-invalid')\n  }\n  if (!isNonnegativeSafeInteger(input.nowSeconds)) return completeFailure('challenge-expired')\n  const insideDecisionWindow = input.challenge.issuedAt <= input.nowSeconds\n    && input.nowSeconds < input.challenge.expiresAt\n  const proofInput = {\n    challenge: input.challenge,\n    response: input.response,\n    secret: input.subscription.plaintext.challenge.secret,\n  }\n  const proofValid = insideDecisionWindow\n    ? await verifyEndpointChallengeResponse({ ...proofInput, nowSeconds: input.nowSeconds })\n    : await verifyEndpointChallengeProof(proofInput)\n  if (insideDecisionWindow && !proofValid) return completeFailure('invalid-proof')\n\n  const [challengeHash, responseHash] = await Promise.all([\n    endpointChallengeHash(input.challenge),\n    handshakeObjectHash(input.response),\n  ])\n  try {\n    const result = await input.store.completeVerified({\n      challengeHash,\n      nowSeconds: input.nowSeconds,\n      responseHash,\n    })\n    const completion = await validateChallengeCompletion(\n      input,\n      result,\n      challengeHash,\n      responseHash,\n      insideDecisionWindow,\n      proofValid,\n    )\n    if ('ok' in completion) return completion\n\n    const acceptance = createWakeSubscriptionAcceptance({\n      challenge: challengeHash,\n      encryptionKey: input.subscription.context.encryptionKey,\n      grant: input.subscription.context.grant,\n      response: responseHash,\n      service: input.subscription.context.service,\n      subscription: input.subscription.context.subscription,\n    })\n    return Object.freeze({\n      acceptance,\n      acceptanceHash: await handshakeObjectHash(acceptance),\n      challengeHash,\n      disposition: completion.kind,\n      ok: true,\n      responseHash,\n    })\n  } catch {\n    return completeFailure('challenge-store-unavailable')\n  }\n}\n\nfunction filterWithinServicePolicy(service: PublisherService, plaintext: WakeSubscriptionPlaintext): boolean {\n  const filter = plaintext.filter\n  return filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake\n    && service.events.some(event => wakeSourcesEqual(event.source, filter.source))\n}\n", "import type {\n  Hash,\n  SourceWakeSubscriptionFilter,\n  WakeSource,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  SourceWakeSubscriptionFilterZod,\n  WakeSourceSchema,\n  WakeSourceZod,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  asSchema,\n  PayloadBuilder,\n} from '@xyo-network/sdk'\n\nimport { canonicalJson } from './canonicalJson.ts'\n\n/** Canonical identity includes the source kind and its entire pinned identity. */\nexport async function wakeSourceHash(source: WakeSource): Promise<Hash> {\n  return await PayloadBuilder.dataHash({ schema: WakeSourceSchema, ...WakeSourceZod.parse(source) })\n}\n\nexport function wakeSourcesEqual(left: WakeSource, right: WakeSource): boolean {\n  return canonicalJson(WakeSourceZod.parse(left)) === canonicalJson(WakeSourceZod.parse(right))\n}\n\nexport async function sourceWakeFilterHash(filter: SourceWakeSubscriptionFilter): Promise<Hash> {\n  const parsed = SourceWakeSubscriptionFilterZod.parse(filter)\n  return await PayloadBuilder.dataHash({ ...parsed, schema: asSchema(parsed.schema, true) })\n}\n", "import {\n  ChainIdZod,\n  DeploymentIdZod,\n  HashZod,\n  NonnegativeJsonSafeIntegerZod,\n  NormalizedAddressZod,\n  PositiveJsonSafeIntegerZod,\n} from '@xyo-network/event-kit-schemas'\nimport { z } from 'zod'\n\nimport type { WakeGrantAuthorizationRequest } from './admissionTypes.ts'\n\n/** Exact, active, finalized D-005 tuple; source time never substitutes for atBlock. */\nexport const SourceWakeSubscriptionActivationZod = z.strictObject({\n  atBlock: NonnegativeJsonSafeIntegerZod,\n  activeFromBlock: NonnegativeJsonSafeIntegerZod,\n  expiresAtBlock: PositiveJsonSafeIntegerZod,\n  authorizationChainId: ChainIdZod,\n  controller: NormalizedAddressZod,\n  publisher: NormalizedAddressZod,\n  deploymentId: DeploymentIdZod,\n  queueId: z.string().min(1).max(255).optional(),\n  sourceHash: HashZod,\n  filterHash: HashZod,\n  subscriptionHash: HashZod,\n  serviceHash: HashZod,\n  grantHash: HashZod,\n}).refine(\n  value => value.activeFromBlock <= value.atBlock && value.atBlock < value.expiresAtBlock,\n  'Subscription must be active at the exact finalized authorization snapshot',\n)\nexport type SourceWakeSubscriptionActivation = z.infer<typeof SourceWakeSubscriptionActivationZod>\n\nexport interface SourceWakeSubscriptionActivationReader {\n  /** Undefined means no matching active subscription; never fabricate activation from a grant alone. */\n  readonly read: (request: WakeGrantAuthorizationRequest) => Promise<SourceWakeSubscriptionActivation | undefined>\n}\n", "import type {\n  ChainId,\n  WakeSource,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  ChainIdZod,\n  WakeSourceZod,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  WakeGrantAuthorizationDecision,\n  WakeGrantAuthorizationRequest,\n  WakeGrantAuthorizer,\n} from './admissionTypes.ts'\nimport { createDeploymentGrantAuthorizer } from './grantEvidence.ts'\nimport type { SourceWakeSubscriptionActivationReader } from './sourceWakeActivation.ts'\nimport { SourceWakeSubscriptionActivationZod } from './sourceWakeActivation.ts'\nimport { wakeSourceHash } from './sourceWakeIdentity.ts'\nimport type { StatementGraphGrantReadModel } from './statementGraphPorts.ts'\n\nexport interface StatementGraphWakeGrantAuthorizerOptions {\n  readonly activation: SourceWakeSubscriptionActivationReader\n  /** Independently pinned network session identity, never copied from a request. */\n  readonly authorizationChainId: ChainId\n  readonly source: WakeSource\n  readonly viewer: StatementGraphGrantReadModel\n}\n\n/**\n * Existing grants authorize deployment/queue. The accepted subscription and\n * immutable receiver binding narrow the permitted source without relabeling\n * another chain's Statement Graph as authorization evidence.\n */\nexport function createStatementGraphWakeGrantAuthorizer(\n  options: StatementGraphWakeGrantAuthorizerOptions,\n): WakeGrantAuthorizer {\n  const authorizationChainId = ChainIdZod.parse(options.authorizationChainId)\n  const source = WakeSourceZod.parse(options.source)\n  const grants = createDeploymentGrantAuthorizer({ viewer: options.viewer })\n  return Object.freeze({\n    async authorizePublisher(request: WakeGrantAuthorizationRequest): Promise<WakeGrantAuthorizationDecision> {\n      const sourceHash = await wakeSourceHash(source)\n      if (request.authorizationChainId !== authorizationChainId || request.sourceHash !== sourceHash) {\n        throw new TypeError('Grant request does not match the independently pinned authorization chain and source')\n      }\n      const read = await options.activation.read(request)\n      if (read === undefined) return { enabled: false, atBlock: request.expectedHead }\n      const activation = SourceWakeSubscriptionActivationZod.parse(read)\n      if (activation.atBlock !== request.expectedHead\n        || activation.authorizationChainId !== authorizationChainId\n        || activation.sourceHash !== sourceHash\n        || activation.filterHash !== request.filterHash\n        || activation.subscriptionHash !== request.subscriptionHash\n        || activation.controller !== request.controller\n        || activation.publisher !== request.publisher\n        || activation.deploymentId !== request.deploymentId\n        || activation.queueId !== request.queueId) {\n        throw new TypeError('Finalized subscription activation does not match the exact admission binding')\n      }\n      const decision = await grants.authorizePublisher({ ...request, exactGrantHash: activation.grantHash })\n      if (decision.atBlock !== activation.atBlock) {\n        throw new TypeError('Grant and active subscription snapshots do not identify the same finalized authorization head')\n      }\n      return decision.enabled\n        ? Object.freeze({\n            ...decision,\n            grant: Object.freeze({\n              ...decision.grant,\n              authorizationChainId,\n              sourceHash,\n              filterHash: activation.filterHash,\n              subscriptionHash: activation.subscriptionHash,\n            }),\n          })\n        : decision\n    },\n  })\n}\n", "import type { WakeGrantObject } from '@xyo-network/event-kit-schemas'\nimport {\n  asWakeGrantObject,\n  asWakeGrantRevocation,\n  DeploymentIdZod,\n  HashZod,\n  NormalizedAddressZod,\n  WakeGrantObjectSchema,\n  WakeGrantRevocationSchema,\n} from '@xyo-network/event-kit-schemas'\n\nimport type {\n  WakeGrantAuthorizationDecision,\n  WakeGrantAuthorizationRequest,\n  WakeGrantAuthorizer,\n  WakeGrantEvidence,\n} from './admissionTypes.ts'\nimport type {\n  StatementGrantClaim,\n  StatementGraphGrantReadModel,\n} from './statementGraphPorts.ts'\n\nexport interface DeploymentGrantAuthorizerOptions {\n  readonly viewer: StatementGraphGrantReadModel\n}\n\n/**\n * Adapts a canonical Statement Graph v2 read model to the evidence-bearing\n * D-002 grant authorization port. Each decision is bound to one stable head.\n *\n * v2 is append-only with no lifecycle `state`, so this layer owns two things\n * the protocol used to:\n *\n * - **Aboutness.** The requested publisher must match both the Claim's\n *   `subject` and the grant object's `publisher` field.\n * - **Negation.** A grant is disabled by a further claim, by the *same pinned\n *   controller*, of a revocation object referencing that grant's hash.\n *   Revocations from any other source are ignored.\n */\nexport function createDeploymentGrantAuthorizer(\n  options: DeploymentGrantAuthorizerOptions,\n): WakeGrantAuthorizer {\n  const { viewer } = options\n\n  return Object.freeze({\n    async authorizePublisher(request: WakeGrantAuthorizationRequest): Promise<WakeGrantAuthorizationDecision> {\n      assertValidRequest(request)\n\n      const atBlock = await readHead(viewer)\n      if (atBlock > request.expectedHead) {\n        throw new Error(`Statement Graph head ${atBlock} is ahead of expected head ${request.expectedHead}`)\n      }\n\n      const claims = await viewer.claims(request.controller, {\n        declaredObjectSchemaPrefix: WakeGrantObjectSchema,\n        ...(request.exactGrantHash === undefined ? {} : { objectHash: request.exactGrantHash }),\n        subject: request.publisher,\n      })\n      const revokedGrantHashes = await readRevocations(viewer, request.controller, request.publisher, atBlock)\n\n      let evidence: WakeGrantEvidence | undefined\n      for (const claim of claims) {\n        evidence = await resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes)\n        if (evidence !== undefined) break\n      }\n\n      const completedAtBlock = await readHead(viewer)\n      if (completedAtBlock !== atBlock) {\n        throw new Error(`Statement Graph head changed during authorization [${atBlock} -> ${completedAtBlock}]`)\n      }\n\n      const lag = request.expectedHead - atBlock\n      if (evidence === undefined) {\n        return Object.freeze({\n          atBlock,\n          enabled: false,\n          expectedHead: request.expectedHead,\n          lag,\n        })\n      }\n      return Object.freeze({\n        atBlock,\n        enabled: true,\n        expectedHead: request.expectedHead,\n        grant: evidence,\n        lag,\n      })\n    },\n  })\n}\n\n/**\n * Collects the grant hashes the pinned controller has negated at or before\n * `atBlock`. A revocation claimed after the evaluated snapshot is not yet in\n * effect, matching how a grant claimed after the snapshot does not yet enable.\n */\nasync function readRevocations(\n  viewer: StatementGraphGrantReadModel,\n  controller: string,\n  subject: string,\n  atBlock: number,\n): Promise<ReadonlySet<string>> {\n  const revoked = new Set<string>()\n  const claims = await viewer.claims(controller, {\n    declaredObjectSchemaPrefix: WakeGrantRevocationSchema,\n    subject,\n  })\n\n  for (const claim of claims) {\n    if (!isLiveClaim(claim, controller, subject, WakeGrantRevocationSchema, atBlock)) continue\n    const object = await viewer.object(claim.objectHash)\n    if (object?.assurance !== 'resolved') continue\n    if (object.declaredSchema !== WakeGrantRevocationSchema || object.objectHash !== claim.objectHash) continue\n    if (!isRecord(object.params) || Object.hasOwn(object.params, 'schema')) continue\n    const revocation = asWakeGrantRevocation({ ...object.params, schema: object.declaredSchema })\n    if (revocation !== undefined) revoked.add(revocation.grant)\n  }\n  return revoked\n}\n\nasync function resolveEvidence(\n  viewer: StatementGraphGrantReadModel,\n  claim: StatementGrantClaim,\n  request: WakeGrantAuthorizationRequest,\n  atBlock: number,\n  revokedGrantHashes: ReadonlySet<string>,\n): Promise<WakeGrantEvidence | undefined> {\n  if (!isLiveClaim(claim, request.controller, request.publisher, WakeGrantObjectSchema, atBlock)) return undefined\n  if (revokedGrantHashes.has(claim.objectHash)) return undefined\n  if (request.exactGrantHash !== undefined && claim.objectHash !== request.exactGrantHash) return undefined\n\n  const object = await viewer.object(claim.objectHash)\n  const grant = parseExactGrantObject(object, claim.objectHash)\n  if (grant === undefined) return undefined\n  if (grant.publisher !== request.publisher) return undefined\n  if (grant.deploymentId !== request.deploymentId) return undefined\n  if (grant.queueId !== request.queueId) return undefined\n  if (!grant.permissions.includes('enqueue')) return undefined\n\n  return Object.freeze({\n    assertedAtBlock: claim.firstBlock,\n    authorizationChainId: request.authorizationChainId,\n    sourceHash: request.sourceHash,\n    filterHash: request.filterHash,\n    subscriptionHash: request.subscriptionHash,\n    controller: request.controller,\n    deploymentId: grant.deploymentId,\n    id: claim.firstEventHash,\n    ...(request.exactGrantHash === undefined ? {} : { objectHash: claim.objectHash }),\n    ...(grant.queueId === undefined ? {} : { queueId: grant.queueId }),\n    target: grant.publisher,\n  })\n}\n\nfunction isLiveClaim(\n  claim: StatementGrantClaim,\n  controller: string,\n  subject: string,\n  declaredObjectSchema: string,\n  atBlock: number,\n): boolean {\n  if (claim.source !== controller) return false\n  if (claim.subject !== subject) return false\n  if (claim.declaredObjectSchema !== declaredObjectSchema) return false\n  if (!isNonnegativeSafeInteger(claim.firstBlock) || claim.firstBlock > atBlock) return false\n  if (!isNonnegativeSafeInteger(claim.lastBlock) || claim.lastBlock < claim.firstBlock) return false\n  if (!HashZod.safeParse(claim.firstEventHash).success) return false\n  return HashZod.safeParse(claim.objectHash).success\n}\n\nfunction parseExactGrantObject(\n  object: Awaited<ReturnType<StatementGraphGrantReadModel['object']>>,\n  expectedObjectHash: string,\n): WakeGrantObject | undefined {\n  if (object?.assurance !== 'resolved') return undefined\n  if (object.declaredSchema !== WakeGrantObjectSchema || object.objectHash !== expectedObjectHash) return undefined\n  if (!isRecord(object.params) || Object.hasOwn(object.params, 'schema')) return undefined\n  return asWakeGrantObject({\n    ...object.params,\n    schema: object.declaredSchema,\n  })\n}\n\nfunction assertValidRequest(request: WakeGrantAuthorizationRequest): void {\n  if (request.exactGrantHash !== undefined && !HashZod.safeParse(request.exactGrantHash).success) {\n    throw new TypeError('Exact grant hash must be canonical lowercase hexadecimal')\n  }\n  if (!NormalizedAddressZod.safeParse(request.controller).success) {\n    throw new TypeError('Grant controller must be a normalized address')\n  }\n  if (!NormalizedAddressZod.safeParse(request.publisher).success) {\n    throw new TypeError('Grant publisher must be a normalized address')\n  }\n  if (!DeploymentIdZod.safeParse(request.deploymentId).success) {\n    throw new TypeError('Grant deploymentId must contain 1 to 255 characters')\n  }\n  if (request.queueId !== undefined && (request.queueId.length === 0 || request.queueId.length > 255)) {\n    throw new TypeError('Grant queueId must contain 1 to 255 characters when configured')\n  }\n  if (!isNonnegativeSafeInteger(request.expectedHead)) {\n    throw new RangeError('Grant expectedHead must be a nonnegative safe integer')\n  }\n}\n\nasync function readHead(viewer: StatementGraphGrantReadModel): Promise<number> {\n  const head = await viewer.head()\n  if (!isNonnegativeSafeInteger(head)) {\n    throw new RangeError('Statement Graph head must be a nonnegative safe integer')\n  }\n  return head\n}\n\nfunction isNonnegativeSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n", "import type {\n  Hash,\n  NormalizedAddress,\n  WakeEnvelope,\n  WakeJwtHeader,\n  WakeJwtId,\n  WakeJwtPayload,\n} from '@xyo-network/event-kit-schemas'\nimport {\n  ChainIdZod,\n  DeploymentIdZod,\n  HashZod,\n  MAX_POSITIONS_PER_SUBSCRIPTION_WAKE,\n  NonnegativeJsonSafeIntegerZod,\n  NormalizedAddressZod,\n  PositiveJsonSafeIntegerZod,\n  SOURCE_WAKE_FILTER_PROFILE,\n  WakeEnvelopeZod,\n  WakeJwtAudienceZod,\n  WakeJwtHeaderZod,\n  WakeJwtPayloadZod,\n  WakeJwtSchema,\n  WakeSourceZod,\n} from '@xyo-network/event-kit-schemas'\nimport type {\n  JwtHeader,\n  JwtPayload,\n} from '@xyo-network/sdk'\nimport {\n  Account,\n  PayloadBuilder,\n} from '@xyo-network/sdk'\nimport { z } from 'zod'\n\nimport {\n  sourceWakeFilterHash,\n  wakeSourceHash,\n  wakeSourcesEqual,\n} from './sourceWakeIdentity.ts'\nimport type { VerifiedAdmissionWake } from './verifiedAdmissionWake.ts'\n\n/** D-002 maximum accepted JWT lifetime. */\nexport const EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300\n/** D-002 maximum accepted publisher clock lead. */\nexport const EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60\n\nexport const WakeAdmissionRouteZod = z.strictObject({\n  audience: WakeJwtAudienceZod,\n  authorizationChainId: ChainIdZod,\n  controller: NormalizedAddressZod,\n  deploymentId: DeploymentIdZod,\n  queueId: z.string().min(1).max(255).optional(),\n  source: WakeSourceZod,\n  filterHash: HashZod,\n  subscriptionHash: HashZod,\n  fromPosition: NonnegativeJsonSafeIntegerZod,\n  maxPositionsPerWake: PositiveJsonSafeIntegerZod.max(MAX_POSITIONS_PER_SUBSCRIPTION_WAKE),\n  maxGrantLagBlocks: NonnegativeJsonSafeIntegerZod,\n})\nexport type WakeAdmissionRoute = z.infer<typeof WakeAdmissionRouteZod>\n\nexport type VerifyWakeRequestRejectionReason\n  = | 'configuration-invalid'\n    | 'event-hash-failed'\n    | 'event-hash-mismatch'\n    | 'event-malformed'\n    | 'event-target-mismatch'\n    | 'range-invalid'\n    | 'range-too-large'\n    | 'wake-id-invalid'\n    | 'jwt-audience-mismatch'\n    | 'jwt-claims-invalid'\n    | 'jwt-expired'\n    | 'jwt-future-iat'\n    | 'jwt-header-invalid'\n    | 'jwt-identity-invalid'\n    | 'jwt-invalid'\n    | 'jwt-lifetime-invalid'\n    | 'jwt-malformed'\n    | 'jwt-nbf-not-allowed'\n    | 'jwt-schema-mismatch'\n    | 'event-source-mismatch'\n    | 'event-authorization-chain-mismatch'\n    | 'event-filter-mismatch'\n    | 'range-before-floor'\n\nexport interface VerifiedWakeRequest extends VerifiedAdmissionWake {\n  readonly deploymentId: string\n  readonly event: WakeEnvelope\n  readonly fromPosition: number\n  readonly issuedAt: number\n  readonly queueId?: string\n  readonly route: WakeAdmissionRoute & { readonly sourceHash: Hash }\n  readonly toPosition: number\n  readonly tokenIssuedAt: number\n}\n\nexport interface VerifyWakeRequestInput {\n  readonly body: unknown\n  readonly jwt: string\n  readonly nowSeconds: number\n  readonly route: WakeAdmissionRoute\n}\n\nexport interface VerifyWakeRequestSuccess {\n  readonly ok: true\n  readonly verified: VerifiedWakeRequest\n}\n\nexport interface VerifyWakeRequestFailure {\n  readonly details?: readonly string[]\n  readonly ok: false\n  readonly reason: VerifyWakeRequestRejectionReason\n}\n\nexport type VerifyWakeRequestResult = VerifyWakeRequestFailure | VerifyWakeRequestSuccess\n\ninterface VerifiedJwtProfile {\n  readonly eventHash: Hash\n  readonly expiresAt: number\n  readonly issuedAt: number\n  readonly jwtId: WakeJwtId\n  readonly publisher: NormalizedAddress\n}\n\ntype JwtProfileResult = VerifyWakeRequestFailure | {\n  readonly jwt: VerifiedJwtProfile\n  readonly ok: true\n}\n\ntype StrictJwtWireResult = VerifyWakeRequestFailure | {\n  readonly header: WakeJwtHeader\n  readonly ok: true\n  readonly payload: WakeJwtPayload\n}\n\n/** Source-aware strict Payload verification, reusing the exact D-002 JWT verifier. */\nexport async function verifyWakeRequest(input: VerifyWakeRequestInput): Promise<VerifyWakeRequestResult> {\n  const routeResult = WakeAdmissionRouteZod.safeParse(input.route)\n  if (!routeResult.success || !NonnegativeJsonSafeIntegerZod.safeParse(input.nowSeconds).success) {\n    return { ok: false, reason: 'configuration-invalid' }\n  }\n  const eventResult = WakeEnvelopeZod.safeParse(input.body)\n  if (!eventResult.success) return malformedWake(input.body, eventResult.error.issues)\n  const route = routeResult.data\n  if (route.filterHash !== await sourceWakeFilterHash({\n    schema: SOURCE_WAKE_FILTER_PROFILE,\n    source: route.source,\n    fromPosition: route.fromPosition,\n    maxPositionsPerWake: route.maxPositionsPerWake,\n  })) return { ok: false, reason: 'configuration-invalid' }\n  const event = Object.freeze({ ...eventResult.data, source: Object.freeze(eventResult.data.source) })\n  if (event.authorizationChainId !== route.authorizationChainId) {\n    return { ok: false, reason: 'event-authorization-chain-mismatch' }\n  }\n  if (!wakeSourcesEqual(event.source, route.source)) return { ok: false, reason: 'event-source-mismatch' }\n  if (event.filterHash !== route.filterHash) return { ok: false, reason: 'event-filter-mismatch' }\n  if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {\n    return { ok: false, reason: 'event-target-mismatch' }\n  }\n  if (event.fromPosition < route.fromPosition) return { ok: false, reason: 'range-before-floor' }\n  if (event.toPosition - event.fromPosition >= route.maxPositionsPerWake) return { ok: false, reason: 'range-too-large' }\n\n  const jwt = await verifyJwtProfile(input.jwt, route.audience, input.nowSeconds)\n  if (!jwt.ok) return jwt\n  let eventHash: Hash\n  try {\n    eventHash = await PayloadBuilder.dataHash(event)\n  } catch {\n    return { ok: false, reason: 'event-hash-failed' }\n  }\n  if (eventHash !== jwt.jwt.eventHash) return { ok: false, reason: 'event-hash-mismatch' }\n  const sourceHash = await wakeSourceHash(route.source)\n  return Object.freeze({\n    ok: true,\n    verified: Object.freeze({\n      audience: route.audience,\n      deploymentId: event.deploymentId,\n      event,\n      eventHash,\n      expiresAt: jwt.jwt.expiresAt,\n      fromPosition: event.fromPosition,\n      issuedAt: event.issuedAt,\n      jwtId: jwt.jwt.jwtId,\n      publisher: jwt.jwt.publisher,\n      ...(event.queueId === undefined ? {} : { queueId: event.queueId }),\n      route: Object.freeze({\n        ...route, source: Object.freeze(route.source), sourceHash,\n      }),\n      toPosition: event.toPosition,\n      tokenIssuedAt: jwt.jwt.issuedAt,\n      wakeId: event.wakeId,\n    }),\n  })\n}\n\nasync function verifyJwtProfile(token: string, audience: string, nowSeconds: number): Promise<JwtProfileResult> {\n  let verified: Awaited<ReturnType<typeof Account.verifyJwt>>\n  try {\n    verified = await Account.verifyJwt(token, { audience, now: nowSeconds })\n  } catch (error) {\n    return reject('jwt-malformed', [errorMessage(error)])\n  }\n\n  if (!verified.ok) {\n    if (Object.hasOwn(verified.payload ?? {}, 'nbf')) return reject('jwt-nbf-not-allowed')\n    return reject(classifySdkJwtFailure(verified.reasons), verified.reasons)\n  }\n\n  const wireResult = parseStrictJwtWire(verified.header, verified.payload, audience)\n  if (!wireResult.ok) return wireResult\n\n  const { header: strictHeader, payload: strictPayload } = wireResult\n  if (strictHeader.kid !== strictPayload.iss) return reject('jwt-identity-invalid')\n  if (strictPayload.exp <= nowSeconds) return reject('jwt-expired')\n  if (strictPayload.exp - strictPayload.iat > EVENT_KIT_MAX_JWT_LIFETIME_SECONDS) return reject('jwt-lifetime-invalid')\n  if (strictPayload.iat - nowSeconds > EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return reject('jwt-future-iat')\n\n  const jwt: VerifiedJwtProfile = Object.freeze({\n    eventHash: strictPayload.eventHash,\n    expiresAt: strictPayload.exp,\n    issuedAt: strictPayload.iat,\n    jwtId: strictPayload.jti,\n    publisher: strictPayload.iss,\n  })\n  return Object.freeze({ jwt, ok: true })\n}\n\nfunction parseStrictJwtWire(header: JwtHeader, payload: JwtPayload, audience: string): StrictJwtWireResult {\n  const headerResult = WakeJwtHeaderZod.safeParse(header)\n  if (!headerResult.success) {\n    if (!NormalizedAddressZod.safeParse(header.kid).success) return reject('jwt-identity-invalid')\n    return reject('jwt-header-invalid', zodDetails(headerResult.error.issues))\n  }\n  if (Object.hasOwn(payload, 'nbf')) return reject('jwt-nbf-not-allowed')\n  if (!NormalizedAddressZod.safeParse(payload.iss).success) return reject('jwt-identity-invalid')\n  if (payload.schema !== WakeJwtSchema) return reject('jwt-schema-mismatch')\n  if (payload.aud !== audience) return reject('jwt-audience-mismatch')\n  if (!isNonnegativeSafeInteger(payload.iat) || !isNonnegativeSafeInteger(payload.exp) || payload.exp <= payload.iat) {\n    return reject('jwt-lifetime-invalid')\n  }\n\n  const payloadResult = WakeJwtPayloadZod.safeParse(payload)\n  if (!payloadResult.success) return reject('jwt-claims-invalid', zodDetails(payloadResult.error.issues))\n  return Object.freeze({\n    header: headerResult.data,\n    ok: true,\n    payload: payloadResult.data,\n  })\n}\n\nfunction classifySdkJwtFailure(reasons: readonly string[]): VerifyWakeRequestRejectionReason {\n  if (reasons.some(reason => reason.startsWith('audience mismatch:'))) return 'jwt-audience-mismatch'\n  if (reasons.some(reason => reason.startsWith('expired:'))) return 'jwt-expired'\n  if (reasons.some(reason => reason.startsWith('unsupported alg:') || reason.startsWith('unsupported typ:'))) {\n    return 'jwt-header-invalid'\n  }\n  if (reasons.some(reason => (\n    reason.startsWith('invalid public key:')\n    || reason.startsWith('public key does not derive to kid:')\n    || reason === 'header.kid does not match payload.iss'\n  ))) {\n    return 'jwt-identity-invalid'\n  }\n  return 'jwt-invalid'\n}\n\nfunction malformedWake(\n  body: unknown,\n  issues: readonly { readonly message: string; readonly path: readonly PropertyKey[] }[],\n): VerifyWakeRequestFailure {\n  const details = zodDetails(issues)\n  if (hasInvertedSafeRange(body)) return reject('range-invalid', details)\n  if (isRecord(body) && Object.hasOwn(body, 'wakeId')\n    && issues.some(issue => issue.path[0] === 'wakeId')) return reject('wake-id-invalid', details)\n  return reject('event-malformed', details)\n}\n\nfunction hasInvertedSafeRange(value: unknown): boolean {\n  if (!isRecord(value)) return false\n  const { fromPosition, toPosition } = value\n  return typeof fromPosition === 'number'\n    && typeof toPosition === 'number'\n    && isNonnegativeSafeInteger(fromPosition)\n    && isNonnegativeSafeInteger(toPosition)\n    && fromPosition > toPosition\n}\n\nfunction isNonnegativeSafeInteger(value: number): boolean {\n  return Number.isSafeInteger(value) && value >= 0\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction zodDetails(issues: readonly { readonly message: string; readonly path: readonly PropertyKey[] }[]): readonly string[] {\n  return issues.map((issue) => {\n    const path = issue.path.map(String).join('.') || '<root>'\n    return `${path}: ${issue.message}`\n  })\n}\n\nfunction reject(\n  reason: VerifyWakeRequestRejectionReason,\n  details?: readonly string[],\n): VerifyWakeRequestFailure {\n  if (details === undefined) return Object.freeze({ ok: false, reason })\n  return Object.freeze({\n    details: Object.freeze([...details]),\n    ok: false,\n    reason,\n  })\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n", "import type { AdmittedWake } from './types.ts'\n\n/**\n * One wake leased to exactly one consumer.\n *\n * The lease is held until `ack` or `release`. A consumer that dies holding it\n * leaves the entry recoverable rather than lost, which is why the queue port is\n * lease-based rather than push-based: a fire-and-forget handoff has no way to\n * reclaim work whose consumer never finished.\n */\nexport interface LeasedWake<TWake = AdmittedWake> {\n  /** Removes the entry permanently. Call only once the handler committed. */\n  readonly ack: () => Promise<void>\n  /** Returns the entry for another attempt. */\n  readonly release: () => Promise<void>\n  readonly wake: TWake\n}\n\n/**\n * Provider-agnostic durable wake queue.\n *\n * Implementations back this with a filesystem directory, SQLite, Postgres, or a\n * cloud queue. Delivery is at-least-once: a consumer MUST be idempotent, since\n * a lease that is never acked is redelivered.\n *\n * Every implementation must satisfy the shared conformance suite in\n * `@xyo-network/event-kit-testing`.\n */\nexport interface WakeQueue<TWake = AdmittedWake> {\n  /** Durably appends a wake. Resolves only once the entry survives a crash. */\n  append: (wake: TWake) => Promise<void>\n  /** Leases the next pending entry, or `undefined` when none remain. */\n  claim: () => Promise<LeasedWake<TWake> | undefined>\n  /** Entries waiting to be claimed. Excludes leases already held. */\n  pendingCount: () => Promise<number>\n  /**\n   * Returns every in-flight entry to pending and reports how many moved.\n   * Run at startup: entries held by a process that died are otherwise stranded.\n   */\n  recoverInflight: () => Promise<number>\n}\n\nexport type WakeHandler<TWake = AdmittedWake> = (wake: TWake) => Promise<void> | void\n\n/**\n * Drains the queue serially until empty, acking each wake the handler accepts.\n *\n * A handler that throws releases its lease, so the wake is retried rather than\n * dropped, and the error propagates. Push-style consumption composes over the\n * lease port; the reverse does not.\n */\nexport async function drainQueue<TWake = AdmittedWake>(queue: WakeQueue<TWake>, handler: WakeHandler<TWake>): Promise<number> {\n  let handled = 0\n  for (;;) {\n    const leased = await queue.claim()\n    if (leased === undefined) return handled\n\n    try {\n      await handler(leased.wake)\n    } catch (error) {\n      await leased.release()\n      throw error\n    }\n    await leased.ack()\n    handled += 1\n  }\n}\n"],
+  "mappings": ";AAaO,IAAM,0CAA0C;;;ACsCvD,eAAsB,kBAAyB,OAAyE;AACtH,QAAM,gBAAgB,cAAc,MAAM,QAAQ;AAClD,MAAI,CAAC,cAAc,GAAI,QAAO,cAAc;AAC5C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,EAAE,KAAK,IAAI;AAEjB,QAAM,QAAQ,MAAM,oBAAoB,MAAM,OAAO,SAAS,IAAI;AAClE,MAAI,CAAC,MAAM,QAAS,QAAO,MAAM;AAEjC,MAAI,CAAC,yBAAyB,MAAM,YAAY,GAAG;AACjD,WAAO,OAAO,sBAAsB,CAAC,iDAAiD,CAAC;AAAA,EACzF;AAEA,QAAM,gBAAgB,MAAM,UAAU,KAAK;AAC3C,MAAI,CAAC,cAAc,GAAI,QAAO,cAAc;AAC5C,SAAO,MAAM,qBAAqB,MAAM,OAAO,SAAS,cAAc,OAAO,IAAI;AACnF;AASA,eAAe,oBACb,OACA,SACA,MACoC;AACpC,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,MAAM,eAAe,OAAO;AAAA,EACjD,SAAS,OAAO;AACd,WAAO,UAAU,OAAO,qBAAqB,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC;AAAA,EACrE;AAEA,MAAI,CAAC,SAAS,UAAU,KAAK,OAAO,WAAW,SAAS,UAAU;AAChE,WAAO,UAAU,OAAO,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;AAAA,EAChG;AACA,MAAI,WAAW,SAAS,sBAAsB,WAAW,SAAS,qBAAqB;AACrF,WAAO,UAAU,OAAO,WAAW,IAAI,CAAC;AAAA,EAC1C;AACA,MAAI,WAAW,SAAS,aAAa;AACnC,UAAM,iBAAiB,gBAAgB,WAAW,SAAS,OAAO;AAClE,WAAO,UAAU,kBACZ,QAAQ,aAAa,gBAAgB,WAAW,OAAO,GAAG,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,WAAW,SAAS,OAAO;AAC7B,WAAO,UAAU,OAAO,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;AAAA,EAChG;AACA,SAAO,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACxC;AAEA,eAAe,qBACb,OACA,SACA,OACA,MACuC;AACvC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,MAAM,iBAAiB;AAAA,MACvC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,OAAO,qBAAqB,CAAC,aAAa,KAAK,CAAC,CAAC;AAAA,EAC1D;AAEA,MAAI,CAAC,SAAS,SAAS,KAAK,OAAO,UAAU,SAAS,UAAU;AAC9D,WAAO,OAAO,qBAAqB,CAAC,yCAAyC,CAAC;AAAA,EAChF;AACA,MAAI,UAAU,SAAS,sBAAsB,UAAU,SAAS,qBAAqB;AACnF,WAAO,OAAO,UAAU,IAAI;AAAA,EAC9B;AACA,MAAI,UAAU,SAAS,eAAe,UAAU,SAAS,YAAY;AACnE,WAAO,OAAO,qBAAqB,CAAC,yCAAyC,CAAC;AAAA,EAChF;AAEA,QAAM,iBAAiB,gBAAgB,UAAU,SAAS,OAAO;AACjE,MAAI,mBAAmB,OAAW,QAAO;AACzC,SAAO,QAAQ,UAAU,MAAM,gBAAgB,UAAU,OAAO,GAAG,IAAI;AACzE;AAEA,SAAS,UAAiB,QAAiE;AACzF,SAAO,OAAO,OAAO,EAAE,SAAS,OAAO,OAAO,CAAC;AACjD;AAUA,SAAS,cAAc,UAAgD;AACrE,MAAI,SAAS,YAAY,OAAO,mBAAmB,yCAAyC;AAC1F,WAAO;AAAA,MACL,SAAS,OAAO,qBAAqB,CAAC,sEAAsE,CAAC;AAAA,MAC7G,IAAI;AAAA,IACN;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,OAAO,OAAO;AAAA,MACrB,UAAU,SAAS;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,OAAO,SAAS;AAAA,MAChB,WAAW,SAAS;AAAA,MACpB,gBAAgB,SAAS,YAAY;AAAA,MACrC,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,IACD,IAAI;AAAA,EACN;AACF;AAUA,eAAe,UACb,OAC8B;AAC9B,QAAM,EAAE,MAAM,IAAI,MAAM;AACxB,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,MAAM,OAAO,mBAAmB;AAAA,MAC/C,YAAY,MAAM;AAAA,MAClB,sBAAsB,MAAM;AAAA,MAC5B,YAAY,MAAM;AAAA,MAClB,YAAY,MAAM;AAAA,MAClB,kBAAkB,MAAM;AAAA,MACxB,cAAc,MAAM;AAAA,MACpB,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM,SAAS;AAAA,MAC1B,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,EAAE,SAAS,OAAO,qBAAqB,CAAC,aAAa,KAAK,CAAC,CAAC,GAAG,IAAI,MAAM;AAAA,EAClF;AAEA,QAAM,cAAc,kBAAkB,UAAU,MAAM,cAAc,MAAM,iBAAiB;AAC3F,MAAI,gBAAgB,OAAW,QAAO,EAAE,SAAS,aAAa,IAAI,MAAM;AACxE,MAAI,CAAC,SAAS,QAAS,QAAO,EAAE,SAAS,OAAO,eAAe,GAAG,IAAI,MAAM;AAE5E,QAAM,kBAAkB,sBAAsB,SAAS,OAAO,MAAM,UAAU,SAAS,OAAO;AAC9F,MAAI,oBAAoB,OAAW,QAAO,EAAE,SAAS,iBAAiB,IAAI,MAAM;AAEhF,QAAM,QAA6B,OAAO,OAAO;AAAA,IAC/C,SAAS,SAAS;AAAA,IAClB,cAAc,MAAM;AAAA,IACpB,OAAO,sBAAsB,SAAS,KAAK;AAAA,IAC3C,KAAK,MAAM,eAAe,SAAS;AAAA,EACrC,CAAC;AACD,SAAO,EAAE,OAAO,IAAI,KAAK;AAC3B;AAEA,SAAS,kBACP,UACA,cACA,mBACoC;AACpC,MAAI,CAAC,SAAS,QAAQ,KACjB,CAAC,OAAO,OAAO,UAAU,SAAS,KAClC,OAAO,SAAS,YAAY,aAC5B,CAAC,OAAO,OAAO,UAAU,SAAS,GAAG;AACxC,WAAO,OAAO,sBAAsB,CAAC,+CAA+C,CAAC;AAAA,EACvF;AACA,MAAI,CAAC,yBAAyB,SAAS,OAAO,GAAG;AAC/C,WAAO,OAAO,sBAAsB,CAAC,kDAAkD,CAAC;AAAA,EAC1F;AACA,MAAI,SAAS,UAAU,cAAc;AACnC,WAAO,OAAO,sBAAsB,CAAC,mDAAmD,CAAC;AAAA,EAC3F;AACA,MAAI,SAAS,iBAAiB,UAAa,SAAS,iBAAiB,cAAc;AACjF,WAAO,OAAO,sBAAsB,CAAC,+DAA+D,CAAC;AAAA,EACvG;AAEA,QAAM,MAAM,eAAe,SAAS;AACpC,MAAI,SAAS,QAAQ,UAAa,SAAS,QAAQ,KAAK;AACtD,WAAO,OAAO,sBAAsB,CAAC,wDAAwD,CAAC;AAAA,EAChG;AACA,MAAI,MAAM,mBAAmB;AAC3B,WAAO,OAAO,oBAAoB,CAAC,YAAY,GAAG,QAAQ,iBAAiB,EAAE,CAAC;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,sBACP,UACA,UACA,SACoC;AACpC,MAAI,CAAC,SAAS,QAAQ,EAAG,QAAO,OAAO,sBAAsB,CAAC,yCAAyC,CAAC;AACxG,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,eAAe,KAAK,WAAS,CAAC,OAAO,OAAO,UAAU,KAAK,CAAC,GAAG;AACjE,WAAO,OAAO,sBAAsB,CAAC,sDAAsD,CAAC;AAAA,EAC9F;AACA,MAAI,OAAO,SAAS,OAAO,YAAY,SAAS,GAAG,WAAW,GAAG;AAC/D,WAAO,OAAO,sBAAsB,CAAC,gDAAgD,CAAC;AAAA,EACxF;AACA,MAAI,CAAC,yBAAyB,SAAS,eAAe,KAAK,SAAS,kBAAkB,SAAS;AAC7F,WAAO,OAAO,sBAAsB,CAAC,mEAAmE,CAAC;AAAA,EAC3G;AACA,MAAI,SAAS,eAAe,SAAS,MAAM,YAAY;AACrD,WAAO,OAAO,sBAAsB,CAAC,2DAA2D,CAAC;AAAA,EACnG;AACA,MAAI,SAAS,yBAAyB,SAAS,MAAM,wBAChD,SAAS,eAAe,SAAS,MAAM,cACvC,SAAS,eAAe,SAAS,MAAM,cACvC,SAAS,qBAAqB,SAAS,MAAM,kBAAkB;AAClE,WAAO,OAAO,sBAAsB,CAAC,yEAAyE,CAAC;AAAA,EACjH;AACA,MAAI,SAAS,WAAW,SAAS,WAAW;AAC1C,WAAO,OAAO,sBAAsB,CAAC,oDAAoD,CAAC;AAAA,EAC5F;AACA,QAAM,mBAAmB,OAAO,OAAO,UAAU,SAAS;AAC1D,QAAM,gBAAgB,OAAO,OAAO,SAAS,OAAO,SAAS;AAC7D,MAAI,SAAS,iBAAiB,SAAS,MAAM,gBACxC,qBAAqB,iBACrB,SAAS,YAAY,SAAS,MAAM,SAAS;AAChD,WAAO,OAAO,sBAAsB,CAAC,yDAAyD,CAAC;AAAA,EACjG;AACA,SAAO;AACT;AAEA,SAAS,gBACP,SACA,SACoC;AACpC,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS,OAAO,KAChB,eAAe,KAAK,WAAS,CAAC,OAAO,OAAO,SAAS,KAAK,CAAC,KAC3D,OAAO,QAAQ,OAAO,YACtB,QAAQ,GAAG,WAAW,GAAG;AAC5B,WAAO,OAAO,qBAAqB,CAAC,mCAAmC,CAAC;AAAA,EAC1E;AACA,MAAI,QAAQ,aAAa,QAAQ,YAC5B,QAAQ,cAAc,QAAQ,aAC9B,QAAQ,cAAc,QAAQ,aAC9B,QAAQ,WAAW,QAAQ,QAAQ;AACtC,WAAO,OAAO,qBAAqB,CAAC,oDAAoD,CAAC;AAAA,EAC3F;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAgD;AAC7E,SAAO,OAAO,OAAO;AAAA,IACnB,iBAAiB,SAAS;AAAA,IAC1B,sBAAsB,SAAS;AAAA,IAC/B,YAAY,SAAS;AAAA,IACrB,YAAY,SAAS;AAAA,IACrB,kBAAkB,SAAS;AAAA,IAC3B,GAAI,SAAS,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,SAAS,WAAW;AAAA,IAC/E,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS;AAAA,IACvB,IAAI,SAAS;AAAA,IACb,GAAI,SAAS,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,IACtE,QAAQ,SAAS;AAAA,EACnB,CAAC;AACH;AAEA,SAAS,gBAAgB,SAAqD;AAC5E,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,IAAI,QAAQ;AAAA,IACZ,WAAW,QAAQ;AAAA,IACnB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;AAEA,SAAS,QACP,aACA,SACA,MAC+B;AAC/B,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IAAa,IAAI;AAAA,IAAM;AAAA,IAAS;AAAA,EAClC,CAAC;AACH;AAEA,SAAS,OACP,QACA,SACwB;AACxB,MAAI,YAAY,OAAW,QAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AACrE,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC;AAAA,IAAG,IAAI;AAAA,IAAO;AAAA,EACnD,CAAC;AACH;AAEA,SAAS,yBAAyB,OAAiC;AACjE,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,aAAa,OAAwB;AAC5C,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;;ACxXA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,SAAS;AAEX,IAAM,kBAAkB,EAAE,aAAa;AAAA,EAC5C,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO;AAAA,EACP,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,WAAW;AAAA,EACX,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,QAAQ;AACV,CAAC,EAAE;AAAA,EACD,UAAQ,KAAK,iBAAiB,KAAK,MAAM,gBACpC,KAAK,YAAY,KAAK,MAAM,WAC5B,KAAK,WAAW,KAAK,MAAM,UAC3B,KAAK,iBAAiB,KAAK,MAAM,gBACjC,KAAK,eAAe,KAAK,MAAM;AAAA,EACpC;AACF;AAIA,eAAsB,kBAAkB,OAAuC;AAC7E,QAAM,OAAO,gBAAgB,MAAM,KAAK;AACxC,MAAI,MAAM,eAAe,SAAS,KAAK,KAAK,MAAM,KAAK,WAAW;AAChE,UAAM,IAAI,UAAU,+DAA+D;AAAA,EACrF;AACA,SAAO;AACT;;;ACnBA,eAAsB,gBACpB,OAC8C;AAC9C,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,OAAO,gBAAgB,MAAM;AAAA,IACjC,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,IACvB,OAAO,SAAS;AAAA,IAChB,WAAW,SAAS;AAAA,IACpB,cAAc,SAAS;AAAA,IACvB,YAAY,SAAS;AAAA,IACrB,KAAK,SAAS;AAAA,IACd,WAAW,SAAS;AAAA,IACpB,GAAI,SAAS,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,IACtE,QAAQ,SAAS;AAAA,EACnB,CAAC;AACD,SAAO,MAAM,kBAAkB,EAAE,GAAG,OAAO,KAAK,CAAC;AACnD;;;ACvCA,IAAM,cAAc,IAAI,YAAY;AAEpC,SAAS,qBAAqB,OAAwB;AACpD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,YAAY,MAAM,YAAY,KAAK;AACzC,QAAI,cAAc,UAAc,aAAa,SAAW,aAAa,MAAU,QAAO;AACtF,QAAI,YAAY,MAAS,UAAS;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,UAAU,KAAM,QAAO;AAE3B,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,UAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,UAAU,uCAAuC;AACxF,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,IACA,KAAK,UAAU;AACb,UAAI,qBAAqB,KAAK,EAAG,OAAM,IAAI,UAAU,8CAA8C;AACnG,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,IACA,KAAK,UAAU;AACb,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,UAAQ,aAAa,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AACpF,YAAM,YAAY,QAAQ,eAAe,KAAK;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,UAAU,8CAA8C;AAAA,MACpE;AACA,YAAM,SAAS;AACf,YAAM,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ;AAC1D,YAAI,qBAAqB,GAAG,EAAG,OAAM,IAAI,UAAU,2CAA2C;AAC9F,cAAM,SAAS,OAAO,GAAG;AACzB,YAAI,WAAW,OAAW,OAAM,IAAI,UAAU,kDAAkD;AAChG,eAAO,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,MAAM,CAAC;AAAA,MACvD,CAAC;AACD,aAAO,IAAI,QAAQ,KAAK,GAAG,CAAC;AAAA,IAC9B;AAAA,IACA;AACE,YAAM,IAAI,UAAU,gCAAgC,OAAO,KAAK,EAAE;AAAA,EACtE;AACF;AAGO,SAAS,cAAc,OAAwB;AACpD,SAAO,aAAa,KAAK;AAC3B;AAGO,SAAS,mBAAmB,OAA4B;AAC7D,SAAO,YAAY,OAAO,aAAa,KAAK,CAAC;AAC/C;;;AC3CA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAAA,uBAAsB;AAyB/B,SAAS,UAAU,MAAqC;AACtD,SAAO,WAAW,KAAK,EAAE,QAAQ,GAAG,GAAG,CAAC,GAAG,UAAU,OAAO,SAAS,KAAK,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;AAChH;AAEA,eAAe,UAAU,QAA0B,eAAgD;AACjG,QAAM,cAAc,0BAA0B,oBAAoB,MAAM,MAAM,CAAC;AAC/E,MAAI,aAAa,WAAW,GAAI,OAAM,IAAI,UAAU,mCAAmC;AACvF,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,IAC/C;AAAA,IACA,WAAW,KAAK,WAAW;AAAA,IAC3B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO,KAAK,QAAQ,WAAW,UAAU,aAAa,CAAC;AACjG,SAAO,oBAAoB,MAAM,0BAA0B,IAAI,WAAW,SAAS,CAAC,CAAC;AACvF;AAEA,SAAS,WAAW,MAAwB,OAAkC;AAC5E,QAAM,YAAY,0BAA0B,IAAI;AAChD,QAAM,aAAa,0BAA0B,KAAK;AAClD,MAAI,WAAW,WAAW,MAAM,YAAY,WAAW,GAAI,QAAO;AAClE,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,EAAG,eAAc,UAAU,KAAK,IAAI,WAAW,KAAK;AAC7F,SAAO,eAAe;AACxB;AAEA,eAAsB,sBAAsB,WAA6C;AACvF,QAAM,SAAS,qBAAqB,MAAM,SAAS;AACnD,SAAO,MAAMA,gBAAe,SAAS,MAAM;AAC7C;AAGO,SAAS,wBAAwB,OAAwD;AAC9F,QAAM,kBAAkB,MAAM,mBAAmB;AACjD,MAAI,CAAC,OAAO,cAAc,eAAe,KAAK,kBAAkB,GAAG;AACjE,UAAM,IAAI,WAAW,oDAAoD;AAAA,EAC3E;AACA,MAAI,CAAC,OAAO,cAAc,MAAM,QAAQ,KAAK,MAAM,WAAW,GAAG;AAC/D,UAAM,IAAI,WAAW,uDAAuD;AAAA,EAC9E;AACA,MAAI,MAAM,WAAW,OAAO,mBAAmB,iBAAiB;AAC9D,UAAM,IAAI,WAAW,sDAAsD;AAAA,EAC7E;AAEA,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,wBAAwB,CAAC;AACtE,SAAO,qBAAqB,MAAM,QAAQ,OAAO;AAAA,IAC/C,aAAa,oBAAoB;AAAA,IACjC,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,eAAe,MAAM;AAAA,IACrB,OAAO,MAAM;AAAA,IACb,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,OAAO,uBAAuB;AAAA,IAC9B,UAAU,MAAM;AAAA,IAChB,WAAW,MAAM,WAAW;AAAA,EAC9B,CAAC,EAAE,MAAM,CAAC;AACZ;AAGA,eAAsB,gCACpB,WACA,QACoC;AACpC,QAAM,gBAAgB,MAAM,sBAAsB,SAAS;AAC3D,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,gCAAgC,CAAC;AAC9E,SAAO,6BAA6B,MAAM,QAAQ,OAAO;AAAA,IACvD,WAAW;AAAA,IACX,OAAO,MAAM,UAAU,QAAQ,aAAa;AAAA,EAC9C,CAAC,EAAE,MAAM,CAAC;AACZ;AAOA,eAAsB,6BACpB,OACkB;AAClB,MAAI;AACF,UAAM,YAAY,qBAAqB,MAAM,MAAM,SAAS;AAC5D,UAAM,WAAW,6BAA6B,MAAM,MAAM,QAAQ;AAClE,UAAM,gBAAgB,MAAM,sBAAsB,SAAS;AAC3D,QAAI,SAAS,cAAc,cAAe,QAAO;AACjD,WAAO,WAAW,SAAS,OAAO,MAAM,UAAU,MAAM,QAAQ,aAAa,CAAC;AAAA,EAChF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,gCACpB,OACkB;AAClB,MAAI;AACF,UAAM,YAAY,qBAAqB,MAAM,MAAM,SAAS;AAC5D,QAAI,CAAC,OAAO,cAAc,MAAM,UAAU,KACrC,MAAM,aAAa,UAAU,YAC7B,MAAM,cAAc,UAAU,UAAW,QAAO;AACrD,WAAO,MAAM,6BAA6B,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACtIA;AAAA,EACE,6BAAAC;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA,uBAAAC;AAAA,EACA,WAAAC;AAAA,EACA,oCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAAC,uBAAsB;;;AC1D/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP;AAAA,EACE,uBAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,kCAAAC;AAAA,EACA,gCAAAC;AAAA,OACK;;;ACnBP;AAAA,EACE;AAAA,EACA;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,IAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAE5D,SAAS,WAAW,MAAkB,OAA4B;AAChE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,EAAG,eAAc,KAAK,KAAK,IAAI,MAAM,KAAK;AAC5F,SAAO,eAAe;AACxB;AAEA,SAAS,uBAAuB,cAAoE;AAClG,QAAM,EAAE,YAAY,aAAa,GAAG,UAAU,IAAI;AAClD,SAAO;AACT;AAOO,SAAS,yBACd,cACA,YACY;AACZ,QAAM,mBAAmBC,sBAAqB,MAAM,UAAU;AAC9D,QAAM,qBAAqB,gBAAgB,eACvC,uBAAuB,6BAA6B,MAAM,YAAY,CAAC,IACvE,6BAA6B,MAAM,YAAY;AAEnD,SAAO,mBAAmB;AAAA,IACxB,QAAQ,mBAAmB;AAAA,IAC3B,SAAS,mBAAmB;AAAA,IAC5B,YAAY;AAAA,IACZ,WAAW,mBAAmB;AAAA,IAC9B,SAAS,mBAAmB;AAAA,IAC5B,eAAe,mBAAmB;AAAA,IAClC,OAAO,mBAAmB;AAAA,IAC1B,OAAO,mBAAmB;AAAA,IAC1B,gBAAgB,mBAAmB;AAAA,IACnC,UAAU,mBAAmB;AAAA,IAC7B,YAAY,mBAAmB,cAAc;AAAA,IAC7C,WAAW,mBAAmB;AAAA,IAC9B,gBAAgB,mBAAmB;AAAA,IACnC,SAAS;AAAA,EACX,CAAC;AACH;AAGO,SAAS,+BAA+B,WAAkD;AAC/F,QAAM,SAAS,6BAA6B,MAAM,SAAS;AAC3D,QAAM,UAAU,mBAAmB,MAAM;AACzC,MAAI,QAAQ,SAAS,kCAAkC;AACrD,UAAM,IAAI,WAAW,uCAAuC,gCAAgC,QAAQ;AAAA,EACtG;AACA,SAAO;AACT;AAGO,SAAS,mCAAmC,SAAgD;AACjG,MAAI,QAAQ,SAAS,kCAAkC;AACrD,UAAM,IAAI,WAAW,uCAAuC,gCAAgC,QAAQ;AAAA,EACtG;AACA,QAAM,UAAU,YAAY,OAAO,OAAO;AAC1C,QAAM,SAAS,6BAA6B,MAAM,KAAK,MAAM,OAAO,CAAY;AAChF,MAAI,CAAC,WAAW,SAAS,mBAAmB,MAAM,CAAC,GAAG;AACpD,UAAM,IAAI,UAAU,wDAAwD;AAAA,EAC9E;AACA,SAAO;AACT;;;ADnDA,IAAM,QAAQ,IAAI,YAAY;AAAA,EAC5B,KAAK,IAAI,sBAAsB;AAAA,EAC/B,KAAK,IAAI,WAAW;AAAA,EACpB,MAAM,IAAI,UAAU;AACtB,CAAC;AACD,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,WAAWA,aAAY,OAAOC,+BAA8B;AAQlE,SAAS,sBAAsB,OAAqC;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,gBAAgB,UAAU,EAAE,eAAe,QAAQ;AACtG,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,SAAO;AAAA,IACL,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB;AACF;AAyCO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EACvC,OAAO;AAAA,EAEzB,cAAc;AACZ,UAAM,mDAAmD;AAAA,EAC3D;AACF;AAEA,SAAS,eAAe,OAA6D;AACnF,SAAO;AAAA,IACL,eAAeC,SAAQ,MAAM,MAAM,aAAa;AAAA,IAChD,OAAO,eAAe,MAAM,MAAM,KAAK;AAAA,IACvC,WAAWC,qBAAoB,MAAM,MAAM,SAAS;AAAA,EACtD;AACF;AAEA,SAAS,gBAAgB,OAA+D;AACtF,SAAO;AAAA,IACL,eAAeD,SAAQ,MAAM,MAAM,aAAa;AAAA,IAChD,OAAO,eAAe,MAAM,MAAM,KAAK;AAAA,IACvC,YAAYC,qBAAoB,MAAM,MAAM,UAAU;AAAA,EACxD;AACF;AAEA,SAAS,UAAU,OAAqC;AACtD,QAAM,UAAUC,2BAA0B,KAAK;AAC/C,MAAI,SAAS,WAAW,GAAI,OAAM,IAAI,UAAU,6BAA6B;AAC7E,SAAO;AACT;AAGA,eAAsB,4CAAwF;AAC5G,QAAM,YAAqB,MAAM,MAAM,IAAI,gBAAgB;AAC3D,QAAM,UAAU,sBAAsB,SAAS;AAC/C,QAAM,CAAC,WAAW,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,IAChD,MAAM,IAAI,mBAAmB,QAAQ,SAAS;AAAA,IAC9C,MAAM,IAAI,oBAAoB,QAAQ,UAAU;AAAA,EAClD,CAAC;AACD,SAAO;AAAA,IACL,WAAWD,qBAAoB,MAAME,2BAA0B,IAAI,WAAW,SAAS,CAAC,CAAC;AAAA,IACzF,YAAYF,qBAAoB,MAAME,2BAA0B,IAAI,WAAW,UAAU,CAAC,CAAC;AAAA,EAC7F;AACF;AAMA,eAAsB,wBACpB,OACoC;AACpC,QAAM,eAAeC,8BAA6B,MAAM,MAAM,YAAY;AAC1E,QAAM,aAAaC,sBAAqB,MAAM,MAAM,UAAU;AAC9D,QAAM,eAAe,eAAe,MAAM,YAAY;AACtD,MACE,aAAa,kBAAkB,aAAa,iBACzC,aAAa,UAAU,aAAa,OACvC;AACA,UAAM,IAAI,UAAU,sEAAsE;AAAA,EAC5F;AAEA,QAAM,qBAAqB,MAAM,MAAM,IAAI,qBAAqB,UAAU,aAAa,SAAS,CAAC;AACjG,QAAM,EAAE,IAAI,IAAI,IAAI,MAAM,MAAM;AAAA,IAC9B,EAAE,oBAAoB,MAAM,SAAS;AAAA,IACrC,+BAA+B,MAAM,SAAS;AAAA,IAC9C,yBAAyB,cAAc,UAAU;AAAA,EACnD;AAEA,SAAOC,8BAA6B,MAAM;AAAA,IACxC,GAAG;AAAA,IACH,YAAY;AAAA,MACV,SAASP;AAAA,MACT,KAAKI,2BAA0B,IAAI,WAAW,GAAG,CAAC;AAAA,MAClD,YAAYA,2BAA0B,IAAI,WAAW,EAAE,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAMA,eAAsB,wBACpB,OACoC;AACpC,MAAI;AACF,UAAM,eAAeG,8BAA6B,MAAM,MAAM,YAAY;AAC1E,UAAM,aAAaD,sBAAqB,MAAM,MAAM,UAAU;AAC9D,UAAM,eAAe,gBAAgB,MAAM,YAAY;AACvD,QACE,aAAa,kBAAkB,aAAa,iBACzC,aAAa,UAAU,aAAa,MACvC,OAAM,IAAI,UAAU,wBAAwB;AAE9C,UAAM,eAAe,MAAM,MAAM,IAAI,sBAAsB,UAAU,aAAa,UAAU,CAAC;AAC7F,UAAM,YAAY,MAAM,MAAM;AAAA,MAC5B;AAAA,QACE;AAAA,QACA,KAAK,UAAU,aAAa,WAAW,GAAG;AAAA,QAC1C,MAAM;AAAA,MACR;AAAA,MACAH,2BAA0B,aAAa,WAAW,UAAU,KAAK,IAAI,WAAW;AAAA,MAChF,yBAAyB,cAAc,UAAU;AAAA,IACnD;AACA,UAAM,SAAS,mCAAmC,IAAI,WAAW,SAAS,CAAC;AAC3E,WAAO;AAAA,EACT,QAAQ;AACN,UAAM,IAAI,gCAAgC;AAAA,EAC5C;AACF;;;ADvCA,IAAM,sBAA8E;AAAA,EAClF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACAK;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACAC;AAAA,EACAC;AACF;AAEA,SAAS,2BAA2B,OAA+C;AACjF,aAAW,UAAU,qBAAqB;AACxC,UAAM,SAAS,OAAO,UAAU,KAAK;AACrC,QAAI,OAAO,QAAS,QAAO,OAAO;AAAA,EACpC;AAEA,QAAM,IAAI,UAAU,qDAAqD;AAC3E;AAGA,eAAsB,oBAAoB,QAAsD;AAC9F,SAAOC,SAAQ,MAAM,MAAMC,gBAAe,SAAS,2BAA2B,MAAM,CAAC,CAAC;AACxF;AAEA,eAAsB,wBACpB,MACmC;AACnC,SAAO,OAAO,OAAO,EAAE,MAAM,YAAY,MAAM,oBAAoB,IAAI,EAAE,CAAC;AAC5E;AAGO,SAAS,6BAA6B,OAAkE;AAC7G,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,6BAA6B,CAAC;AAC3E,SAAO,0BAA0B,MAAM,QAAQ,OAAO;AAAA,IACpD,OAAO,MAAM,SAASC,qBAAoB;AAAA,IAC1C,SAASC;AAAA,IACT,WAAW,MAAM;AAAA,IACjB,gBAAgB,MAAM;AAAA,IACtB,GAAI,MAAM,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;AAAA,EACvF,CAAC,EAAE,MAAM,CAAC;AACZ;AAGA,eAAsB,+BACpB,OAC0C;AAC1C,QAAM,WAAW,MAAM,0CAA0C;AACjE,QAAM,aAAa,6BAA6B;AAAA,IAC9C,GAAG;AAAA,IACH,WAAW,SAAS;AAAA,EACtB,CAAC;AACD,QAAM,iBAAiB,MAAM,oBAAoB,UAAU;AAC3D,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,YAAY,OAAO,OAAO;AAAA,MACxB,eAAe;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,YAAY,SAAS;AAAA,IACvB,CAAC;AAAA,IACD,WAAW,OAAO,OAAO;AAAA,MACvB,eAAe;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,CAAC;AACH;AAGO,SAAS,uBAAuB,OAAsD;AAC3F,QAAM,UAAU,IAAIF,gBAAe,EAAE,QAAQ,uBAAuB,CAAC;AACrE,SAAO,oBAAoB,MAAM,QAAQ,OAAO;AAAA,IAC9C,sBAAsB,MAAM;AAAA,IAC5B,WAAW,MAAM,aAAaC,qBAAoB;AAAA,IAClD,UAAU,MAAM,YAAY;AAAA,IAC5B,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IACzE,gBAAgB,MAAM;AAAA,IACtB,GAAI,MAAM,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;AAAA,IACrF,QAAQ,MAAM,QAAQ,IAAI,aAAW;AAAA,MACnC,MAAM;AAAA,MAAwB,eAAe;AAAA,MAA4B;AAAA,IAC3E,EAAE;AAAA,IACF,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,mBAAmBC;AAAA,IACnB,gBAAgB,CAAC,GAAG,MAAM,cAAc;AAAA,IACxC,wBAAwB,MAAM;AAAA,IAC9B,QAAQ;AAAA,MACN,qBAAqB,MAAM;AAAA,MAC3B,+BAA+B,MAAM;AAAA,MACrC,mBAAmBC;AAAA,IACrB;AAAA,IACA,kBAAkB;AAAA,EACpB,CAAC,EAAE,MAAM,CAAC;AACZ;AAGO,SAAS,gBAAgB,OAA8C;AAC5E,QAAM,UAAU,IAAIH,gBAAe,EAAE,QAAQ,sBAAsB,CAAC;AACpE,SAAO,mBAAmB,MAAM,QAAQ,OAAO;AAAA,IAC7C,SAAS,MAAM,WAAW,gBAAgB;AAAA,IAC1C,cAAc,MAAM;AAAA,IACpB,WAAW,MAAM;AAAA,IACjB,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAChE,aAAa,CAAC,SAAS;AAAA,EACzB,CAAC,EAAE,MAAM,CAAC;AACZ;AAGO,SAAS,gCACd,OAC2B;AAC3B,QAAM,cAAc,IAAI,WAAW,EAAE;AACrC,MAAI,MAAM,oBAAoB,QAAW;AAEvC,eAAW,OAAO,gBAAgB,WAAW;AAAA,EAC/C;AACA,QAAM,kBAAkB,MAAM,mBAAmBI,2BAA0B,WAAW;AAEtF,QAAM,UAAU,IAAIJ,gBAAe,EAAE,QAAQ,gCAAgC,CAAC;AAC9E,SAAOK,8BAA6B,MAAM,QAAQ,OAAO;AAAA,IACvD,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,cAAc,MAAM;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,MAAM;AAAA,MACd,cAAc,MAAM;AAAA,MACpB,qBAAqB,MAAM;AAAA,IAC7B;AAAA,IACA,WAAW;AAAA,MACT,SAAS;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,EACF,CAAC,EAAE,MAAM,CAAC;AACZ;AAGA,eAAsB,gCACpB,OACoC;AACpC,QAAM,UAAU,IAAIL,gBAAe,EAAE,QAAQ,gCAAgC,CAAC;AAC9E,QAAM,YAAYM,8BAA6B,MAAM,QAAQ,OAAO;AAAA,IAClE,gBAAgB,MAAM,kBAAkBL,qBAAoB;AAAA,IAC5D,UAAU,MAAM,YAAY;AAAA,IAC5B,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IACzE,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,eAAe,MAAM,aAAa;AAAA,IAClC,OAAO,MAAM,aAAa;AAAA,IAC1B,OAAO,MAAM;AAAA,IACb,WAAW;AAAA,IACX,gBAAgB,MAAM;AAAA,EACxB,CAAC,EAAE,MAAM,CAAC;AAEV,SAAO,MAAM,wBAAwB;AAAA,IACnC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB,cAAc;AAAA,EAChB,CAAC;AACH;AAEO,SAAS,iCACd,OAC4B;AAC5B,QAAM,UAAU,IAAID,gBAAe,EAAE,QAAQ,iCAAiC,CAAC;AAC/E,SAAO,8BAA8B,MAAM,QAAQ,OAAO;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,eAAe,MAAM;AAAA,IACrB,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,EACtB,CAAC,EAAE,MAAM,CAAC;AACZ;AAEO,SAAS,iCAAiC,SAA2C;AAC1F,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,iCAAiC,CAAC;AAC/E,SAAO,8BAA8B,MAAM,QAAQ,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;AAChF;AAEO,SAAS,uCAAuC,KAA6C;AAClG,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,uCAAuC,CAAC;AACrF,SAAO,oCAAoC,MAAM,QAAQ,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;AAClF;AAEO,SAAS,0BAA0B,OAAkC;AAC1E,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,0BAA0B,CAAC;AACxE,SAAO,uBAAuB,MAAM,QAAQ,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;AACvE;AAEO,SAAS,iCAAiC,cAAgD;AAC/F,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,iCAAiC,CAAC;AAC/E,SAAO,8BAA8B,MAAM,QAAQ,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC;AACrF;AAEO,SAAS,2CACd,YACsC;AACtC,QAAM,UAAU,IAAIA,gBAAe,EAAE,QAAQ,2CAA2C,CAAC;AACzF,SAAO,wCAAwC,MAAM,QAAQ,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC;AAC7F;;;AGvOA,SAASO,0BAAyB,OAAwB;AACxD,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS;AACjD;AAEA,SAAS,UAAU,gBAAwB,eAAgC;AACzE,SAAOA,0BAAyB,cAAc,KAAK,kBAAkB;AACvE;AAEA,SAAS,UAAU,gBAAoC,eAAgC;AACrF,SAAO,mBAAmB,UAAa,kBAAkB;AAC3D;AAEA,SAAS,oBACP,gBACA,gBACA,eACS;AACT,SAAO,UAAU,gBAAgB,aAAa,MACxC,mBAAmB,UAAcA,0BAAyB,cAAc,KAAK,kBAAkB,mBAChG,CAAC,UAAU,gBAAgB,aAAa;AAC/C;AAEA,SAAS,wBACP,eACA,gBACA,gBACS;AACT,MAAI,CAACA,0BAAyB,cAAc,KAAK,gBAAgB,eAAgB,QAAO;AACxF,SAAO,mBAAmB,UACpBA,0BAAyB,cAAc,KAAK,iBAAiB,kBAAkB,gBAAgB;AACvG;AAEA,SAAS,qBAAqB,UAA8C;AAC1E,MAAI,CAAC,OAAO,cAAc,SAAS,QAAQ,KAAK,SAAS,WAAW,EAAG,QAAO;AAC9E,MAAI,CAACA,0BAAyB,SAAS,cAAc,EAAG,QAAO;AAC/D,MAAI,SAAS,mBAAmB,WAC1B,CAACA,0BAAyB,SAAS,cAAc,KAAK,SAAS,iBAAiB,SAAS,gBAAiB,QAAO;AACvH,SAAO,SAAS,aAAa,IACzB,SAAS,eAAe,SACxB,SAAS,eAAe;AAC9B;AAEA,SAAS,mBACP,WACA,eACgB;AAChB,QAAM,UAAU,UAAU,OAAO,cAAY,UAAU,SAAS,gBAAgB,aAAa,CAAC;AAC9F,MAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,IAAI,MAAM,OAAO,CAAC,EAAE;AACvD,MAAI,QAAQ,KAAK,cAAY,CAAC,qBAAqB,QAAQ,CAAC,EAAG,QAAO,EAAE,IAAI,MAAM;AAElF,QAAM,SAAS,oBAAI,IAAe;AAClC,QAAM,gBAAgB,oBAAI,IAAe;AACzC,MAAI;AAEJ,aAAW,YAAY,SAAS;AAC9B,QAAI,OAAO,IAAI,SAAS,UAAU,EAAG,QAAO,EAAE,IAAI,MAAM;AACxD,WAAO,IAAI,SAAS,YAAY,QAAQ;AACxC,QAAI,SAAS,aAAa,GAAG;AAC3B,UAAI,SAAS,OAAW,QAAO,EAAE,IAAI,MAAM;AAC3C,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,SAAS,OAAW,QAAO,EAAE,IAAI,MAAM;AAE3C,aAAW,YAAY,SAAS;AAC9B,QAAI,SAAS,aAAa,EAAG;AAC7B,UAAM,aAAa,SAAS;AAC5B,QAAI,eAAe,UAAa,cAAc,IAAI,UAAU,EAAG,QAAO,EAAE,IAAI,MAAM;AAClF,UAAM,SAAS,OAAO,IAAI,UAAU;AACpC,QAAI,WAAW,UACV,SAAS,aAAa,OAAO,WAAW,KACxC,SAAS,iBAAiB,OAAO,eAAgB,QAAO,EAAE,IAAI,MAAM;AACzE,kBAAc,IAAI,YAAY,QAAQ;AAAA,EACxC;AAEA,QAAM,QAAa,CAAC,IAAI;AACxB,MAAI,UAAU;AACd,SAAO,cAAc,IAAI,QAAQ,UAAU,GAAG;AAC5C,UAAM,QAAQ,cAAc,IAAI,QAAQ,UAAU;AAClD,QAAI,UAAU,OAAW,QAAO,EAAE,IAAI,MAAM;AAC5C,UAAM,KAAK,KAAK;AAChB,cAAU;AAAA,EACZ;AACA,SAAO,MAAM,WAAW,QAAQ,SAAS,EAAE,IAAI,MAAM,MAAM,IAAI,EAAE,IAAI,MAAM;AAC7E;AAEA,SAAS,wBACP,UACA,OACmE;AACnE,QAAM,SAAS,oBAAI,IAAiD;AACpE,aAAW,WAAW,UAAU;AAC9B,QAAI,QAAQ,WAAW,MAAM,gBAAiB;AAC9C,QAAI,MAAM,cAAc,UAAa,QAAQ,cAAc,MAAM,UAAW;AAC5E,UAAM,QAAQ,OAAO,IAAI,QAAQ,SAAS,KAAK,CAAC;AAChD,UAAM,KAAK,OAAO;AAClB,WAAO,IAAI,QAAQ,WAAW,KAAK;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,eAC+C;AAC/C,MAAI;AACJ,aAAW,WAAW,OAAO;AAC3B,QAAI,QAAQ,kBAAkB,cAAe,iBAAgB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAA4C,eAAgC;AACnG,SAAO,oBAAoB,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,KACnF,wBAAwB,eAAe,QAAQ,gBAAgB,QAAQ,cAAc;AAC5F;AAGO,SAAS,uBAAuB,OAAkE;AACvG,QAAM,SAAS,wBAAwB,MAAM,UAAU,KAAK;AAC5D,QAAM,aAAkD,CAAC;AAEzD,aAAW,aAAa,OAAO,OAAO,GAAG;AACvC,QAAI,MAAM,cAAc,UAAa,UAAU,MAAM,CAAAC,aAAW,CAACA,SAAQ,WAAW,SAAS,MAAM,SAAS,CAAC,GAAG;AAC9G;AAAA,IACF;AACA,UAAM,aAAa,mBAAmB,WAAW,MAAM,aAAa;AACpE,QAAI,CAAC,WAAW,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AACzE,UAAM,UAAU,qBAAqB,WAAW,OAAO,MAAM,aAAa;AAC1E,QAAI,SAAS,WAAW,SAAS,MAAM,SAAS,KAAK,gBAAgB,SAAS,MAAM,aAAa,GAAG;AAClG,iBAAW,KAAK,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,WAAW,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAC7E,MAAI,WAAW,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAC3E,SAAO,EAAE,IAAI,MAAM,SAAS,WAAW,CAAC,EAAE;AAC5C;AAGO,SAAS,8BACd,OACkC;AAClC,QAAM,gBAAgB,MAAM,QAAQ;AACpC,MAAI,CAAC,MAAM,QAAQ,eAAe,SAAS,aAAa,GAAG;AACzD,WAAO,EAAE,IAAI,OAAO,QAAQ,+BAA+B;AAAA,EAC7D;AAEA,QAAM,QAAQ,MAAM,KAAK,OAAO,CAAAC,SAAOA,KAAI,WAAW,MAAM,QAAQ,UAC/DA,KAAI,eAAe,iBACnB,UAAUA,KAAI,gBAAgB,MAAM,aAAa,CAAC;AACvD,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,0BAA0B;AAC9E,MAAI,MAAM,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAElE,QAAM,MAAM,MAAM,CAAC;AACnB,QAAM,qBAAqB,MAAM,KAAK,OAAO,eAAa,UAAU,WAAW,IAAI,UAC9E,UAAU,UAAU,IAAI,SACxB,UAAU,eAAe,IAAI,cAC7B,UAAU,UAAU,gBAAgB,MAAM,aAAa,CAAC;AAC7D,MAAI,mBAAmB,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAC/E,MAAI,CAAC,oBAAoB,IAAI,gBAAgB,IAAI,gBAAgB,MAAM,aAAa,KAC/E,CAAC,wBAAwB,MAAM,eAAe,IAAI,gBAAgB,IAAI,cAAc,GAAG;AAC1F,WAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AAAA,EACvD;AACA,SAAO,EAAE,IAAI,MAAM,IAAI;AACzB;AAEA,SAAS,cACP,cACA,OACgC;AAChC,SAAO,MAAM,YAAY,OAAO,gBAAc,WAAW,WAAW,MAAM,mBACrE,WAAW,iBAAiB,aAAa,cACzC,UAAU,WAAW,iBAAiB,MAAM,aAAa,CAAC;AACjE;AAEA,SAAS,qBACP,cACA,OACgD;AAChD,QAAM,cAAc,cAAc,cAAc,KAAK;AACrD,MAAI,YAAY,SAAS,EAAG,QAAO;AACnC,QAAM,aAAa,YAAY,CAAC;AAChC,MAAI,eAAe,UAAa,CAACF,0BAAyB,WAAW,eAAe,EAAG,QAAO;AAC9F,MAAI,CAAC,OAAO,cAAc,aAAa,cAAc,KAAK,aAAa,iBAAiB,EAAG,QAAO;AAClG,MAAI,WAAW,mBAAmB,aAAa,kBAC1C,WAAW,mBAAmB,OAAO,iBAAkB,QAAO;AACnE,QAAM,kBAAkB,WAAW,kBAAkB;AACrD,MAAI,mBAAmB,aAAa,eAAgB,QAAO;AAC3D,SAAO;AAAA,IACL;AAAA,IAAY;AAAA,IAAiB;AAAA,EAC/B;AACF;AAEA,SAAS,6BACP,UACA,eACS;AACT,SAAO;AAAA,IACL,SAAS,aAAa;AAAA,IACtB,SAAS,aAAa;AAAA,IACtB;AAAA,EACF,KACG;AAAA,IACD,SAAS,WAAW;AAAA,IACpB,SAAS,WAAW;AAAA,IACpB;AAAA,EACF,KACG,gBAAgB,SAAS,aAAa;AAC3C;AAOO,SAAS,6BAA6B,OAA4D;AACvG,QAAM,YAAY,MAAM,cAAc,OAAO,kBAAgB,aAAa,WAAW,MAAM,oBACtF,aAAa,mBAAmB,MAAM,cAAc;AACzD,QAAM,aAAa,mBAAmB,WAAW,MAAM,aAAa;AACpE,MAAI,CAAC,WAAW,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AACzE,MAAI,WAAW,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,yBAAyB;AAExF,MAAI;AACJ,aAAW,gBAAgB,WAAW,OAAO;AAC3C,UAAM,WAAW,qBAAqB,cAAc,KAAK;AACzD,QAAI,aAAa,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AACjF,QAAI,aAAa,UAAa,SAAS,mBAAmB,MAAM,cAAe,YAAW;AAAA,EAC5F;AACA,MAAI,aAAa,OAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AAC/E,QAAM,SAAS,WAAW,MAAM,GAAG,EAAE;AACrC,MAAI,CAAC,6BAA6B,UAAU,MAAM,aAAa,GAAG;AAGhE,QAAI,QAAQ,eAAe,SAAS,aAAa,YAAY;AAC3D,aAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AAAA,IACrD;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAAA,EACtD;AAEA,SAAO;AAAA,IACL,YAAY,SAAS;AAAA,IACrB,iBAAiB,SAAS;AAAA,IAC1B,IAAI;AAAA,IACJ,oBAAoB,QAAQ,eAAe,SAAS,aAAa;AAAA,IACjE,cAAc,SAAS;AAAA,EACzB;AACF;;;AClYA;AAAA,EACE;AAAA,EACA,yBAAAG;AAAA,EACA,6BAAAC;AAAA,OACK;AA2CA,SAAS,gCAAgC,cAAc,GAA8B;AAC1F,MAAI,OAAO;AACX,QAAM,SAAS,oBAAI,IAAiC;AACpD,QAAM,UAAU,oBAAI,IAAkC;AAEtD,WAAS,SAAS,QAAgB,SAAiB,YAA4B;AAC7E,WAAO,GAAG,iBAAiB,MAAM,CAAC,IAAI,iBAAiB,OAAO,CAAC,IAAI,UAAU;AAAA,EAC/E;AAEA,WAAS,YAAY,OAQZ;AACP,UAAM,SAAS,iBAAiB,MAAM,MAAM;AAC5C,UAAM,UAAU,iBAAiB,MAAM,OAAO;AAC9C,YAAQ,IAAI,MAAM,YAAY,OAAO,OAAO;AAAA,MAC1C,WAAW;AAAA,MACX,gBAAgB,MAAM;AAAA,MACtB,YAAY,MAAM;AAAA,MAClB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;AAAA,IAC3C,CAAC,CAAC;AAEF,UAAM,MAAM,SAAS,QAAQ,SAAS,MAAM,UAAU;AACtD,UAAM,WAAW,OAAO,IAAI,GAAG;AAC/B,WAAO,IAAI,KAAK,OAAO,OAAO,aAAa,SACvC;AAAA,MACE,sBAAsB,MAAM;AAAA,MAC5B,YAAY,MAAM;AAAA,MAClB,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,IACF,IAEA,EAAE,GAAG,UAAU,WAAW,KAAK,IAAI,SAAS,WAAW,MAAM,KAAK,EAAE,CAAC,CAAC;AAC1E,QAAI,MAAM,QAAQ,KAAM,QAAO,MAAM;AAAA,EACvC;AAEA,SAAO;AAAA,IACL,MAAM,YAA6B;AAAA,IAEnC,QAAQ,OAAqB;AAC3B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,QAAQ,OAAgD;AACnE,YAAM,mBAAmB,iBAAiB,MAAM;AAChD,YAAM,UAAiC,CAAC;AACxC,iBAAW,UAAU,OAAO,OAAO,GAAG;AACpC,YAAI,OAAO,WAAW,iBAAkB;AACxC,YAAI,OAAO,YAAY,UAAa,OAAO,YAAY,iBAAiB,MAAM,OAAO,EAAG;AACxF,YAAI,OAAO,eAAe,UAAa,OAAO,eAAe,MAAM,WAAY;AAC/E,YAAI,OAAO,+BAA+B,UACrC,CAAC,OAAO,qBAAqB,WAAW,MAAM,0BAA0B,GAAG;AAC9E;AAAA,QACF;AACA,gBAAQ,KAAK,MAAM;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,IAEA,QAAQ,OAAO,eAA0D,QAAQ,IAAI,UAAU;AAAA,IAE/F,MAAM,OAAa;AACjB,UAAI,MAAM,MAAM,WAAWD,wBAAuB;AAChD,cAAM,IAAI,MAAM,YAAYA,sBAAqB,EAAE;AAAA,MACrD;AACA,YAAM,EAAE,QAAQ,SAAS,GAAG,OAAO,IAAI,MAAM;AAC7C,kBAAY;AAAA,QACV,OAAO,MAAM;AAAA,QACb,gBAAgBA;AAAA,QAChB,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,aAAa,OAAO,OAAO,CAAC,GAAG,OAAO,WAAW,CAAC;AAAA,QACpD;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,SAAS,MAAM,WAAW,MAAM,MAAM;AAAA,MACxC,CAAC;AAAA,IACH;AAAA,IAEA,OAAO,OAAa;AAClB,YAAM,aAAkD,EAAE,OAAO,MAAM,gBAAgB;AACvF,YAAM,SAAS,iBAAiB,MAAM,MAAM;AAC5C,YAAM,WAAW,OAAO,OAAO,EAC5B,OAAO,WAAS,MAAM,WAAW,UAAU,MAAM,eAAe,MAAM,eAAe,EACrF,IAAI,WAAS,MAAM,OAAO,EAC1B,QAAQ;AACX,YAAM,iBAAiB,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC;AAC5C,UAAI,MAAM,YAAY,UAAa,eAAe,SAAS,GAAG;AAC5D,cAAM,IAAI,MAAM,sDAAsD,MAAM,eAAe,EAAE;AAAA,MAC/F;AACA,YAAM,UAAU,MAAM,WAAW,eAAe,CAAC;AACjD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI,MAAM,gDAAgD,MAAM,eAAe,EAAE;AAAA,MACzF;AACA,kBAAY;AAAA,QACV,OAAO,MAAM;AAAA,QACb,gBAAgBC;AAAA,QAChB,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,QAAQ;AAAA,QACR,QAAQ,MAAM;AAAA,QACd;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC5GO,SAAS,sBACd,UAAyC,CAAC,GAClB;AACxB,QAAM,eAAe,oBAAI,IAA0B;AACnD,QAAM,cAAc,oBAAI,IAA4B;AACpD,QAAM,SAAkB,CAAC;AACzB,MAAI,kBAAkB;AACtB,MAAI,OAAyB,QAAQ,QAAQ;AAO7C,WAAS,UAAa,MAAoC;AACxD,UAAM,WAAW;AACjB,UAAM,OAAO,YAAwB;AACnC,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAER;AACA,aAAO,MAAM,KAAK;AAAA,IACpB,GAAG;AACH,WAAO,QAAQ,WAAW,CAAC,GAAG,CAAC;AAC/B,WAAO;AAAA,EACT;AAEA,WAAS,qBAA2B;AAClC,UAAM,EAAE,WAAW,IAAI;AACvB,QAAI,eAAe,OAAW;AAC9B,UAAM,MAAM,WAAW;AACvB,eAAW,CAAC,KAAK,OAAO,KAAK,cAAc;AACzC,UAAI,QAAQ,kBAAkB,IAAK,cAAa,OAAO,GAAG;AAAA,IAC5D;AAAA,EACF;AAGA,WAAS,cAAc,SAA+D;AACpF,UAAM,eAAe,aAAa,IAAI,SAAS,OAAO,CAAC;AACvD,QAAI,iBAAiB,QAAW;AAC9B,aAAO,aAAa,cAAc,QAAQ,aAAa,aAAa,WAAW,QAAQ,SACnF,EAAE,MAAM,aAAa,SAAS,aAAa,QAAQ,IACnD,EAAE,MAAM,mBAAmB;AAAA,IACjC;AAEA,UAAM,cAAc,YAAY,IAAI,QAAQ,OAAO,CAAC;AACpD,QAAI,gBAAgB,OAAW,QAAO;AACtC,QAAI,YAAY,cAAc,QAAQ,UAAW,QAAO,EAAE,MAAM,oBAAoB;AACpF,iBAAa,IAAI,SAAS,OAAO,GAAG,EAAE,GAAG,aAAa,gBAAgB,QAAQ,eAAe,CAAC;AAC9F,WAAO,EAAE,MAAM,aAAa,SAAS,YAAY,QAAQ;AAAA,EAC3D;AAEA,SAAO;AAAA,IACL,IAAI,SAA2B;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,IAAI,mBAA2B;AAC7B,aAAO,aAAa;AAAA,IACtB;AAAA,IAEA,IAAI,kBAA0B;AAC5B,aAAO,YAAY;AAAA,IACrB;AAAA,IAEA,gBAAgB,OAAO,YAAkE,MAAM,UAAU,YAAY;AACnH,yBAAmB;AACnB,aAAO,cAAc,OAAO,KAAK,EAAE,MAAM,MAAM;AAAA,IACjD,CAAC;AAAA,IAED,kBAAkB,OAAO,EAAE,SAAS,KAAK,MAGR,MAAM,UAAU,YAAY;AAC3D,yBAAmB;AACnB,YAAM,WAAW,cAAc,OAAO;AACtC,UAAI,aAAa,OAAW,QAAO;AAEnC,YAAM,UAAgC,OAAO,OAAO;AAAA,QAClD,UAAU,QAAQ;AAAA,QAClB,WAAW,QAAQ;AAAA,QACnB,IAAI,WAAW,mBAAmB,CAAC;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAID,YAAM,QAAQ,UAAU,IAAI;AAC5B,aAAO,KAAK,IAAI;AAEhB,YAAM,UAA0B;AAAA,QAC9B,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,QAAQ,QAAQ;AAAA,MAClB;AACA,mBAAa,IAAI,SAAS,OAAO,GAAG,EAAE,GAAG,SAAS,gBAAgB,QAAQ,eAAe,CAAC;AAC1F,kBAAY,IAAI,QAAQ,OAAO,GAAG,OAAO;AACzC,aAAO,EAAE,MAAM,YAAY,QAAQ;AAAA,IACrC,CAAC;AAAA,EACH;AACF;AAGA,SAAS,SAAS,SAAuC;AACvD,SAAO,KAAK,UAAU,CAAC,QAAQ,UAAU,QAAQ,WAAW,QAAQ,KAAK,CAAC;AAC5E;AAEA,SAAS,QAAQ,SAAuC;AACtD,SAAO,KAAK,UAAU,CAAC,QAAQ,UAAU,QAAQ,WAAW,QAAQ,MAAM,CAAC;AAC7E;;;ACjJO,SAAS,wBAAsE;AACpF,QAAM,UAA0B,CAAC;AACjC,QAAM,WAAW,oBAAI,IAA0B;AAC/C,MAAI,WAAW;AAEf,SAAO;AAAA,IACL,MAAM,OAAO,MAA4B;AACvC,cAAQ,KAAK,EAAE,UAAU,YAAY,GAAG,KAAK,CAAC;AAAA,IAChD;AAAA,IAEA,MAAM,QAAgD;AACpD,YAAM,QAAQ,QAAQ,MAAM;AAC5B,UAAI,UAAU,OAAW,QAAO;AAChC,eAAS,IAAI,MAAM,UAAU,KAAK;AAElC,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,MAAM,MAAqB;AACzB,mBAAS,OAAO,MAAM,QAAQ;AAAA,QAChC;AAAA,QACA,MAAM,UAAyB;AAC7B,cAAI,CAAC,SAAS,OAAO,MAAM,QAAQ,EAAG;AAEtC,kBAAQ,KAAK,KAAK;AAClB,kBAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,WAAW,MAAM,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,IAEA,eAAe,YAA6B,SAAS;AAAA,IAErD,cAAc,YAA6B,QAAQ;AAAA,IAEnD,MAAM,kBAAmC;AACvC,YAAM,YAAY,SAAS;AAC3B,iBAAW,SAAS,SAAS,OAAO,EAAG,SAAQ,KAAK,KAAK;AACzD,eAAS,MAAM;AACf,cAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,WAAW,MAAM,QAAQ;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AClDA;AAAA,EACE;AAAA,EACA,gCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,wBAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,uBAAAC;AAAA,EACA,sBAAAC;AAAA,OACK;;;ACnBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA,kBAAAC;AAAA,OACK;AAKP,eAAsB,eAAe,QAAmC;AACtE,SAAO,MAAMC,gBAAe,SAAS,EAAE,QAAQ,kBAAkB,GAAG,cAAc,MAAM,MAAM,EAAE,CAAC;AACnG;AAEO,SAAS,iBAAiB,MAAkB,OAA4B;AAC7E,SAAO,cAAc,cAAc,MAAM,IAAI,CAAC,MAAM,cAAc,cAAc,MAAM,KAAK,CAAC;AAC9F;AAEA,eAAsB,qBAAqB,QAAqD;AAC9F,QAAM,SAAS,gCAAgC,MAAM,MAAM;AAC3D,SAAO,MAAMA,gBAAe,SAAS,EAAE,GAAG,QAAQ,QAAQ,SAAS,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC3F;;;ADgKA,SAAS,4BACP,QACwC;AACxC,SAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AAC5C;AAEA,SAASC,0BAAyB,OAAiC;AACjE,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAAS,WACP,OACA,OACS;AACT,SAAO,MAAM,kBAAkB,UACzB,MAAM,mBAAmB,UAAa,QAAQ,MAAM;AAC5D;AAEA,SAAS,kBAAkB,QAAyB,UAAyB;AAC3E,SAAO,OAAO,OAAO,UAAQ,SAAS,QAAQ,EAAE,WAAW;AAC7D;AAEA,SAAS,qBAAqB,OAAwB,WAAuC;AAC3F,SAAO,MAAM,cAAc,aACtB,MAAM,YAAY,WAAW,KAC7B,MAAM,YAAY,CAAC,MAAM;AAChC;AAEA,SAAS,mBAAmB,OAAwB,WAA+C;AACjG,QAAM,aAAa,OAAO,OAAO,OAAO,SAAS,IAAI,MAAM,UAAU;AACrE,SAAO,UAAU,iBAAiB,MAAM,gBAAgB,UAAU,YAAY;AAChF;AAEA,SAAS,4BACP,WACA,cACS;AACT,SAAO,aAAa,YAAY,UAAU,WACrC,aAAa,cAAc,UAAU,aACrC,aAAa,YAAY,UAAU,QAAQ,cAC3C,aAAa,kBAAkB,UAAU,IAAI,cAC7C,aAAa,UAAU,UAAU,IAAI,KAAK,SAC1C,aAAa,UAAU,UAAU,MAAM;AAC9C;AAEA,SAAS,mBACP,SACA,KACA,cACS;AACT,SAAO,QAAQ,eAAe,SAAS,IAAI,UAAU,KAChD,QAAQ,2BAA2B,IAAI,cACvC,IAAI,KAAK,UAAU,aAAa,SAChC,IAAI,eAAe,aAAa;AACvC;AAEA,SAAS,0BACP,cACA,SACA,YACS;AACT,SAAO,aAAa,iBAAiB,cAChC,aAAa,iBAAiB,cAAc,QAAQ,OAAO;AAClE;AAcA,SAAS,oCACP,WACkD;AAClD,MAAI;AACF,WAAO;AAAA,MACL,SAAS,WAAW,MAAM,UAAU,OAAO;AAAA,MAC3C,OAAOC,oBAAmB,MAAM,UAAU,MAAM,IAAI;AAAA,MACpD,KAAKC,2BAA0B,MAAM,UAAU,IAAI,IAAI;AAAA,MACvD,WAAWC,sBAAqB,MAAM,UAAU,SAAS;AAAA,MACzD,SAASC,qBAAoB,MAAM,UAAU,QAAQ,IAAI;AAAA,MACzD,YAAYD,sBAAqB,MAAM,UAAU,UAAU;AAAA,MAC3D,cAAcE,8BAA6B,MAAM,UAAU,aAAa,IAAI;AAAA,MAC5E,mBAAmB,UAAU,kBAAkB,IAAI,UAAQC,SAAQ,MAAM,IAAI,CAAC;AAAA,MAC9E,cAAcH,sBAAqB,MAAM,UAAU,YAAY;AAAA,IACjE;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBACP,WACA,QACS;AACT,SAAOH,0BAAyB,UAAU,UAAU,KAC/CA,0BAAyB,UAAU,aAAa,KAChD,UAAU,iBAAiB,UAAU,cACrC,OAAO,iBAAiB,OAAO,aAC/B,kBAAkB,OAAO,mBAAmB,UAAU,QAAQ,UAAU,KACxE,kBAAkB,OAAO,mBAAmB,UAAU,MAAM,UAAU,KACtE,kBAAkB,OAAO,mBAAmB,UAAU,aAAa,UAAU;AACpF;AAEA,eAAe,mBACb,WACA,QACkB;AAClB,QAAM,kBAAkB,MAAM,QAAQ,IAAI;AAAA,IACxC,oBAAoB,OAAO,OAAO;AAAA,IAClC,oBAAoB,OAAO,GAAG;AAAA,IAC9B,oBAAoB,OAAO,KAAK;AAAA,IAChC,oBAAoB,OAAO,YAAY;AAAA,EACzC,CAAC;AACD,SAAO,gBAAgB,CAAC,MAAM,UAAU,QAAQ,cAC3C,gBAAgB,CAAC,MAAM,UAAU,IAAI,cACrC,gBAAgB,CAAC,MAAM,UAAU,MAAM,cACvC,gBAAgB,CAAC,MAAM,UAAU,aAAa;AACrD;AAEA,SAAS,qBACP,WACA,QAC0D;AAC1D,MAAI,CAAC,4BAA4B,OAAO,SAAS,OAAO,cAAc,OAAO,OAAO,EAAG,QAAO;AAC9F,MAAI,CAAC,qBAAqB,OAAO,OAAO,OAAO,SAAS,EAAG,QAAO;AAClE,MAAI,CAAC,4BAA4B,WAAW,OAAO,YAAY,EAAG,QAAO;AACzE,QAAM,YAAY,EAAE,MAAM,OAAO,KAAK,YAAY,UAAU,IAAI,WAAW;AAC3E,MAAI,CAAC,mBAAmB,OAAO,SAAS,WAAW,OAAO,YAAY,EAAG,QAAO;AAChF,MAAI,CAAC,WAAW,OAAO,SAAS,UAAU,UAAU,KAC/C,CAAC,WAAW,OAAO,SAAS,UAAU,aAAa,EAAG,QAAO;AAClE,MAAI,CAAC,WAAW,OAAO,KAAK,UAAU,UAAU,KAC3C,CAAC,WAAW,OAAO,KAAK,UAAU,aAAa,EAAG,QAAO;AAC9D,MAAI,CAAC,0BAA0B,OAAO,cAAc,OAAO,SAAS,UAAU,UAAU,KACnF,OAAO,aAAa,iBAAiB,UAAU,iBAAiB,EAAG,QAAO;AAC/E,SAAO;AACT;AAEA,eAAe,iBACb,WACA,QACqG;AACrG,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,UAAU,KAAK,cAAc;AAAA,MAC9C,eAAe,UAAU,IAAI;AAAA,MAC7B,OAAO,OAAO,IAAI;AAAA,MAClB,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,4BAA4B,uBAAuB;AAAA,EAC5D;AACA,MAAI,eAAe,OAAW,QAAO,4BAA4B,uBAAuB;AACxF,MAAI,WAAW,kBAAkB,UAAU,IAAI,cAAc,WAAW,UAAU,OAAO,IAAI,OAAO;AAClG,WAAO,4BAA4B,qBAAqB;AAAA,EAC1D;AAEA,MAAI;AACF,WAAO;AAAA,MACL,WAAW,MAAM,wBAAwB;AAAA,QACvC,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,WAAO,4BAA4B,mBAAmB;AAAA,EACxD;AACF;AAEA,SAAS,+BACP,WACA,QACA,WACgC;AAChC,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,OAAO,OAAO;AAAA,MACrB,SAAS,OAAO;AAAA,MAChB,eAAe,UAAU,IAAI;AAAA,MAC7B,WAAW,OAAO,aAAa;AAAA,MAC/B,OAAO,UAAU,MAAM;AAAA,MACvB,OAAO,OAAO,aAAa;AAAA,MAC3B,WAAW,OAAO;AAAA,MAClB,SAAS,UAAU,QAAQ;AAAA,MAC3B,YAAY,OAAO;AAAA,MACnB,cAAc,UAAU,aAAa;AAAA,IACvC,CAAC;AAAA,IACD,eAAe,UAAU;AAAA,IACzB,OAAO,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,YAAY,UAAU,MAAM,WAAW,CAAC;AAAA,IACnF,KAAK,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,YAAY,UAAU,IAAI,WAAW,CAAC;AAAA,IAC7E,IAAI;AAAA,IACJ;AAAA,IACA,SAAS,OAAO,OAAO,EAAE,MAAM,OAAO,SAAS,YAAY,UAAU,QAAQ,WAAW,CAAC;AAAA,IACzF,cAAc,OAAO,OAAO,EAAE,MAAM,OAAO,cAAc,YAAY,UAAU,aAAa,WAAW,CAAC;AAAA,IACxG,YAAY,UAAU;AAAA,EACxB,CAAC;AACH;AASA,eAAsB,wCACpB,WAC0C;AAC1C,QAAM,SAAS,oCAAoC,SAAS;AAC5D,MAAI,WAAW,OAAW,QAAO,4BAA4B,qBAAqB;AAClF,MAAI,CAAC,oBAAoB,WAAW,MAAM,EAAG,QAAO,4BAA4B,uBAAuB;AACvG,MAAI,CAAC,MAAM,mBAAmB,WAAW,MAAM,EAAG,QAAO,4BAA4B,oBAAoB;AACzG,QAAM,gBAAgB,qBAAqB,WAAW,MAAM;AAC5D,MAAI,kBAAkB,OAAW,QAAO,4BAA4B,aAAa;AACjF,QAAM,YAAY,MAAM,iBAAiB,WAAW,MAAM;AAC1D,MAAI,QAAQ,UAAW,QAAO;AAC9B,MAAI,CAAC,mBAAmB,OAAO,OAAO,UAAU,SAAS,GAAG;AAC1D,WAAO,4BAA4B,qBAAqB;AAAA,EAC1D;AACA,MAAI,CAAC,0BAA0B,OAAO,SAAS,UAAU,SAAS,GAAG;AACnE,WAAO,4BAA4B,uBAAuB;AAAA,EAC5D;AACA,SAAO,+BAA+B,WAAW,QAAQ,UAAU,SAAS;AAC9E;AAGO,SAAS,yCACd,WACA,SACS;AACT,QAAM,SAASO,sBAAqB,UAAU,SAAS;AACvD,MAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,SAAO,OAAO,KAAK,YAAY,QAAQ,WAClC,OAAO,KAAK,cAAc,QAAQ,aAClC,OAAO,KAAK,eAAe,QAAQ,cACnC,OAAO,KAAK,YAAY,QAAQ,WAChC,OAAO,KAAK,kBAAkB,QAAQ,iBACtC,OAAO,KAAK,UAAU,QAAQ,SAC9B,OAAO,KAAK,iBAAiB,QAAQ,gBACrC,OAAO,KAAK,UAAU,QAAQ,SAC9B,OAAO,KAAK,cAAc,QAAQ;AACzC;AAEA,eAAe,uBACb,QACA,WACA,eACA,cACkB;AAClB,MAAI,OAAO,kBAAkB,iBACxB,MAAM,sBAAsB,OAAO,SAAS,MAAM,iBAClD,MAAM,sBAAsB,SAAS,MAAM,cAAe,QAAO;AACtE,SAAO,iBAAiB,UAAa,OAAO,iBAAiB;AAC/D;AAGA,eAAsB,gCACpB,OACmD;AACnD,QAAM,UAAU,MAAM,aAAa;AACnC,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,EAC1F;AACA,QAAM,YAAY,wBAAwB,MAAM;AAChD,QAAM,gBAAgB,MAAM,sBAAsB,SAAS;AAC3D,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,MAAM,MAAM,EAAE,WAAW,cAAc,CAAC;AACnE,QAAI,OAAO,SAAS,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AACnF,QAAK,OAAO,SAAS,eAAe,OAAO,SAAS,YAC/C,CAAC,MAAM,uBAAuB,OAAO,QAAQ,WAAW,aAAa,GAAG;AAC3E,aAAO,EAAE,IAAI,OAAO,QAAQ,0BAA0B;AAAA,IACxD;AACA,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,IAAI;AAAA,IACN,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AAAA,EAC5D;AACF;AAGA,eAAsB,uCACpB,OAC0D;AAC1D,MAAI,CAACP,0BAAyB,MAAM,UAAU,EAAG,QAAO,EAAE,MAAM,gBAAgB;AAChF,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,MAAM,aAAa;AAAA,MAC5C,eAAeM,SAAQ,MAAM,MAAM,aAAa;AAAA,MAChD,YAAY,MAAM;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,CAAC,qBAAqB,WAAW,WAAW,WAAW,UAAU,EAAE,SAAS,OAAO,IAAI,GAAG;AAC7F,aAAO,EAAE,MAAM,gBAAgB;AAAA,IACjC;AACA,QAAI,OAAO,SAAS,aACf,CAAC,MAAM;AAAA,MACR,OAAO;AAAA,MACP,OAAO,OAAO;AAAA,MACdA,SAAQ,MAAM,MAAM,aAAa;AAAA,IACnC,EAAG,QAAO,EAAE,MAAM,gBAAgB;AACpC,SAAK,OAAO,SAAS,aAAa,OAAO,SAAS,wBAC7C,OAAO,OAAO,UAAU,YAAa,QAAO,EAAE,MAAM,gBAAgB;AACzE,QAAI,OAAO,SAAS,cAAc,OAAO,OAAO,UAAU,WAAY,QAAO,EAAE,MAAM,gBAAgB;AACrG,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,EAAE,MAAM,oBAAoB;AAAA,EACrC;AACF;AAEA,SAAS,gBACP,QAC2C;AAC3C,SAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AAC5C;AAOA,eAAe,4BACb,OACA,QACA,eACA,cACA,sBACA,YAC+F;AAC/F,MAAI,CAAC,wBAAwB,OAAO,SAAS,aAAa;AACxD,WAAO,gBAAgB,OAAO,SAAS,cACnC,iCACA,mBAAmB;AAAA,EACzB;AACA,MAAI,CAAC,WAAY,QAAO,gBAAgB,eAAe;AACvD,MAAI,OAAO,SAAS,UAAW,QAAO,gBAAgB,qBAAqB;AAC3E,MAAI,OAAO,SAAS,UAAW,QAAO,gBAAgB,mBAAmB;AACzE,MAAI,OAAO,SAAS,gBAAiB,QAAO,gBAAgB,yBAAyB;AACrF,MAAI,OAAO,SAAS,YAAa,QAAO,gBAAgB,8BAA8B;AACtF,MAAK,OAAO,SAAS,eAAe,OAAO,SAAS,cAC/C,CAAC,MAAM,uBAAuB,OAAO,QAAQ,MAAM,WAAW,eAAe,YAAY,GAAG;AAC/F,WAAO,gBAAgB,yBAAyB;AAAA,EAClD;AACA,SAAO;AACT;AAQA,eAAsB,mCACpB,OACsD;AACtD,MAAI,CAAC,yCAAyC,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;AAC1F,WAAO,gBAAgB,2BAA2B;AAAA,EACpD;AACA,MAAI,CAACN,0BAAyB,MAAM,UAAU,EAAG,QAAO,gBAAgB,mBAAmB;AAC3F,QAAM,uBAAuB,MAAM,UAAU,YAAY,MAAM,cAC1D,MAAM,aAAa,MAAM,UAAU;AACxC,QAAM,aAAa;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,aAAa,UAAU,UAAU;AAAA,EACjD;AACA,QAAM,aAAa,uBACf,MAAM,gCAAgC,EAAE,GAAG,YAAY,YAAY,MAAM,WAAW,CAAC,IACrF,MAAM,6BAA6B,UAAU;AACjD,MAAI,wBAAwB,CAAC,WAAY,QAAO,gBAAgB,eAAe;AAE/E,QAAM,CAAC,eAAe,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,IACtD,sBAAsB,MAAM,SAAS;AAAA,IACrC,oBAAoB,MAAM,QAAQ;AAAA,EACpC,CAAC;AACD,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,MAAM,iBAAiB;AAAA,MAChD;AAAA,MACA,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AACD,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,WAAY,QAAO;AAE/B,UAAM,aAAa,iCAAiC;AAAA,MAClD,WAAW;AAAA,MACX,eAAe,MAAM,aAAa,QAAQ;AAAA,MAC1C,OAAO,MAAM,aAAa,QAAQ;AAAA,MAClC,UAAU;AAAA,MACV,SAAS,MAAM,aAAa,QAAQ;AAAA,MACpC,cAAc,MAAM,aAAa,QAAQ;AAAA,IAC3C,CAAC;AACD,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA,gBAAgB,MAAM,oBAAoB,UAAU;AAAA,MACpD;AAAA,MACA,aAAa,WAAW;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,gBAAgB,6BAA6B;AAAA,EACtD;AACF;AAEA,SAAS,0BAA0B,SAA2B,WAA+C;AAC3G,QAAM,SAAS,UAAU;AACzB,SAAO,OAAO,uBAAuB,QAAQ,OAAO,uBAC/C,QAAQ,OAAO,KAAK,WAAS,iBAAiB,MAAM,QAAQ,OAAO,MAAM,CAAC;AACjF;;;AEtmBA;AAAA,EACE,cAAAQ;AAAA,EACA,mBAAAC;AAAA,EACA,WAAAC;AAAA,EACA,iCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAAC,UAAS;AAKX,IAAM,sCAAsCA,GAAE,aAAa;AAAA,EAChE,SAASF;AAAA,EACT,iBAAiBA;AAAA,EACjB,gBAAgB;AAAA,EAChB,sBAAsBH;AAAA,EACtB,YAAYI;AAAA,EACZ,WAAWA;AAAA,EACX,cAAcH;AAAA,EACd,SAASI,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAYH;AAAA,EACZ,YAAYA;AAAA,EACZ,kBAAkBA;AAAA,EAClB,aAAaA;AAAA,EACb,WAAWA;AACb,CAAC,EAAE;AAAA,EACD,WAAS,MAAM,mBAAmB,MAAM,WAAW,MAAM,UAAU,MAAM;AAAA,EACzE;AACF;;;AC1BA;AAAA,EACE,cAAAI;AAAA,EACA,iBAAAC;AAAA,OACK;;;ACNP;AAAA,EACE;AAAA,EACA;AAAA,EACA,mBAAAC;AAAA,EACA,WAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,yBAAAC;AAAA,EACA,6BAAAC;AAAA,OACK;AA8BA,SAAS,gCACd,SACqB;AACrB,QAAM,EAAE,OAAO,IAAI;AAEnB,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,mBAAmB,SAAiF;AACxG,yBAAmB,OAAO;AAE1B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,UAAU,QAAQ,cAAc;AAClC,cAAM,IAAI,MAAM,wBAAwB,OAAO,8BAA8B,QAAQ,YAAY,EAAE;AAAA,MACrG;AAEA,YAAM,SAAS,MAAM,OAAO,OAAO,QAAQ,YAAY;AAAA,QACrD,4BAA4BD;AAAA,QAC5B,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,eAAe;AAAA,QACrF,SAAS,QAAQ;AAAA,MACnB,CAAC;AACD,YAAM,qBAAqB,MAAM,gBAAgB,QAAQ,QAAQ,YAAY,QAAQ,WAAW,OAAO;AAEvG,UAAI;AACJ,iBAAW,SAAS,QAAQ;AAC1B,mBAAW,MAAM,gBAAgB,QAAQ,OAAO,SAAS,SAAS,kBAAkB;AACpF,YAAI,aAAa,OAAW;AAAA,MAC9B;AAEA,YAAM,mBAAmB,MAAM,SAAS,MAAM;AAC9C,UAAI,qBAAqB,SAAS;AAChC,cAAM,IAAI,MAAM,sDAAsD,OAAO,OAAO,gBAAgB,GAAG;AAAA,MACzG;AAEA,YAAM,MAAM,QAAQ,eAAe;AACnC,UAAI,aAAa,QAAW;AAC1B,eAAO,OAAO,OAAO;AAAA,UACnB;AAAA,UACA,SAAS;AAAA,UACT,cAAc,QAAQ;AAAA,UACtB;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO,OAAO,OAAO;AAAA,QACnB;AAAA,QACA,SAAS;AAAA,QACT,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAOA,eAAe,gBACb,QACA,YACA,SACA,SAC8B;AAC9B,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,SAAS,MAAM,OAAO,OAAO,YAAY;AAAA,IAC7C,4BAA4BC;AAAA,IAC5B;AAAA,EACF,CAAC;AAED,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,YAAY,OAAO,YAAY,SAASA,4BAA2B,OAAO,EAAG;AAClF,UAAM,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU;AACnD,QAAI,QAAQ,cAAc,WAAY;AACtC,QAAI,OAAO,mBAAmBA,8BAA6B,OAAO,eAAe,MAAM,WAAY;AACnG,QAAI,CAACC,UAAS,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,QAAQ,QAAQ,EAAG;AACxE,UAAM,aAAa,sBAAsB,EAAE,GAAG,OAAO,QAAQ,QAAQ,OAAO,eAAe,CAAC;AAC5F,QAAI,eAAe,OAAW,SAAQ,IAAI,WAAW,KAAK;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,eAAe,gBACb,QACA,OACA,SACA,SACA,oBACwC;AACxC,MAAI,CAAC,YAAY,OAAO,QAAQ,YAAY,QAAQ,WAAWF,wBAAuB,OAAO,EAAG,QAAO;AACvG,MAAI,mBAAmB,IAAI,MAAM,UAAU,EAAG,QAAO;AACrD,MAAI,QAAQ,mBAAmB,UAAa,MAAM,eAAe,QAAQ,eAAgB,QAAO;AAEhG,QAAM,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU;AACnD,QAAM,QAAQ,sBAAsB,QAAQ,MAAM,UAAU;AAC5D,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,MAAM,cAAc,QAAQ,UAAW,QAAO;AAClD,MAAI,MAAM,iBAAiB,QAAQ,aAAc,QAAO;AACxD,MAAI,MAAM,YAAY,QAAQ,QAAS,QAAO;AAC9C,MAAI,CAAC,MAAM,YAAY,SAAS,SAAS,EAAG,QAAO;AAEnD,SAAO,OAAO,OAAO;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,sBAAsB,QAAQ;AAAA,IAC9B,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,kBAAkB,QAAQ;AAAA,IAC1B,YAAY,QAAQ;AAAA,IACpB,cAAc,MAAM;AAAA,IACpB,IAAI,MAAM;AAAA,IACV,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IAC/E,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAChE,QAAQ,MAAM;AAAA,EAChB,CAAC;AACH;AAEA,SAAS,YACP,OACA,YACA,SACA,sBACA,SACS;AACT,MAAI,MAAM,WAAW,WAAY,QAAO;AACxC,MAAI,MAAM,YAAY,QAAS,QAAO;AACtC,MAAI,MAAM,yBAAyB,qBAAsB,QAAO;AAChE,MAAI,CAACG,0BAAyB,MAAM,UAAU,KAAK,MAAM,aAAa,QAAS,QAAO;AACtF,MAAI,CAACA,0BAAyB,MAAM,SAAS,KAAK,MAAM,YAAY,MAAM,WAAY,QAAO;AAC7F,MAAI,CAACL,SAAQ,UAAU,MAAM,cAAc,EAAE,QAAS,QAAO;AAC7D,SAAOA,SAAQ,UAAU,MAAM,UAAU,EAAE;AAC7C;AAEA,SAAS,sBACP,QACA,oBAC6B;AAC7B,MAAI,QAAQ,cAAc,WAAY,QAAO;AAC7C,MAAI,OAAO,mBAAmBE,0BAAyB,OAAO,eAAe,mBAAoB,QAAO;AACxG,MAAI,CAACE,UAAS,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAC/E,SAAO,kBAAkB;AAAA,IACvB,GAAG,OAAO;AAAA,IACV,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,mBAAmB,SAA8C;AACxE,MAAI,QAAQ,mBAAmB,UAAa,CAACJ,SAAQ,UAAU,QAAQ,cAAc,EAAE,SAAS;AAC9F,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AACA,MAAI,CAACC,sBAAqB,UAAU,QAAQ,UAAU,EAAE,SAAS;AAC/D,UAAM,IAAI,UAAU,+CAA+C;AAAA,EACrE;AACA,MAAI,CAACA,sBAAqB,UAAU,QAAQ,SAAS,EAAE,SAAS;AAC9D,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,MAAI,CAACF,iBAAgB,UAAU,QAAQ,YAAY,EAAE,SAAS;AAC5D,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,MAAI,QAAQ,YAAY,WAAc,QAAQ,QAAQ,WAAW,KAAK,QAAQ,QAAQ,SAAS,MAAM;AACnG,UAAM,IAAI,UAAU,gEAAgE;AAAA,EACtF;AACA,MAAI,CAACM,0BAAyB,QAAQ,YAAY,GAAG;AACnD,UAAM,IAAI,WAAW,uDAAuD;AAAA,EAC9E;AACF;AAEA,eAAe,SAAS,QAAuD;AAC7E,QAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,MAAI,CAACA,0BAAyB,IAAI,GAAG;AACnC,UAAM,IAAI,WAAW,yDAAyD;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAASA,0BAAyB,OAAiC;AACjE,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAASD,UAAS,OAA4D;AAC5E,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;ADzLO,SAAS,wCACd,SACqB;AACrB,QAAM,uBAAuBE,YAAW,MAAM,QAAQ,oBAAoB;AAC1E,QAAM,SAASC,eAAc,MAAM,QAAQ,MAAM;AACjD,QAAM,SAAS,gCAAgC,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACzE,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,mBAAmB,SAAiF;AACxG,YAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,UAAI,QAAQ,yBAAyB,wBAAwB,QAAQ,eAAe,YAAY;AAC9F,cAAM,IAAI,UAAU,sFAAsF;AAAA,MAC5G;AACA,YAAM,OAAO,MAAM,QAAQ,WAAW,KAAK,OAAO;AAClD,UAAI,SAAS,OAAW,QAAO,EAAE,SAAS,OAAO,SAAS,QAAQ,aAAa;AAC/E,YAAM,aAAa,oCAAoC,MAAM,IAAI;AACjE,UAAI,WAAW,YAAY,QAAQ,gBAC9B,WAAW,yBAAyB,wBACpC,WAAW,eAAe,cAC1B,WAAW,eAAe,QAAQ,cAClC,WAAW,qBAAqB,QAAQ,oBACxC,WAAW,eAAe,QAAQ,cAClC,WAAW,cAAc,QAAQ,aACjC,WAAW,iBAAiB,QAAQ,gBACpC,WAAW,YAAY,QAAQ,SAAS;AAC3C,cAAM,IAAI,UAAU,8EAA8E;AAAA,MACpG;AACA,YAAM,WAAW,MAAM,OAAO,mBAAmB,EAAE,GAAG,SAAS,gBAAgB,WAAW,UAAU,CAAC;AACrG,UAAI,SAAS,YAAY,WAAW,SAAS;AAC3C,cAAM,IAAI,UAAU,+FAA+F;AAAA,MACrH;AACA,aAAO,SAAS,UACZ,OAAO,OAAO;AAAA,QACZ,GAAG;AAAA,QACH,OAAO,OAAO,OAAO;AAAA,UACnB,GAAG,SAAS;AAAA,UACZ;AAAA,UACA;AAAA,UACA,YAAY,WAAW;AAAA,UACvB,kBAAkB,WAAW;AAAA,QAC/B,CAAC;AAAA,MACH,CAAC,IACD;AAAA,IACN;AAAA,EACF,CAAC;AACH;;;AErEA;AAAA,EACE,cAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,iCAAAC;AAAA,EACA,wBAAAC;AAAA,EACA,8BAAAC;AAAA,EACA,8BAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,sBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,OACK;AAKP;AAAA,EACE;AAAA,EACA,kBAAAC;AAAA,OACK;AACP,SAAS,KAAAC,UAAS;AAUX,IAAM,qCAAqC;AAE3C,IAAM,mCAAmC;AAEzC,IAAM,wBAAwBC,GAAE,aAAa;AAAA,EAClD,UAAUC;AAAA,EACV,sBAAsBC;AAAA,EACtB,YAAYC;AAAA,EACZ,cAAcC;AAAA,EACd,SAASJ,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,QAAQK;AAAA,EACR,YAAYC;AAAA,EACZ,kBAAkBA;AAAA,EAClB,cAAcC;AAAA,EACd,qBAAqBC,4BAA2B,IAAI,mCAAmC;AAAA,EACvF,mBAAmBD;AACrB,CAAC;AA+ED,eAAsB,kBAAkB,OAAiE;AACvG,QAAM,cAAc,sBAAsB,UAAU,MAAM,KAAK;AAC/D,MAAI,CAAC,YAAY,WAAW,CAACA,+BAA8B,UAAU,MAAM,UAAU,EAAE,SAAS;AAC9F,WAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAAA,EACtD;AACA,QAAM,cAAcE,iBAAgB,UAAU,MAAM,IAAI;AACxD,MAAI,CAAC,YAAY,QAAS,QAAO,cAAc,MAAM,MAAM,YAAY,MAAM,MAAM;AACnF,QAAM,QAAQ,YAAY;AAC1B,MAAI,MAAM,eAAe,MAAM,qBAAqB;AAAA,IAClD,QAAQC;AAAA,IACR,QAAQ,MAAM;AAAA,IACd,cAAc,MAAM;AAAA,IACpB,qBAAqB,MAAM;AAAA,EAC7B,CAAC,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AACxD,QAAM,QAAQ,OAAO,OAAO,EAAE,GAAG,YAAY,MAAM,QAAQ,OAAO,OAAO,YAAY,KAAK,MAAM,EAAE,CAAC;AACnG,MAAI,MAAM,yBAAyB,MAAM,sBAAsB;AAC7D,WAAO,EAAE,IAAI,OAAO,QAAQ,qCAAqC;AAAA,EACnE;AACA,MAAI,CAAC,iBAAiB,MAAM,QAAQ,MAAM,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AACvG,MAAI,MAAM,eAAe,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAC/F,MAAI,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,YAAY,MAAM,SAAS;AAChF,WAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAAA,EACtD;AACA,MAAI,MAAM,eAAe,MAAM,aAAc,QAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAC9F,MAAI,MAAM,aAAa,MAAM,gBAAgB,MAAM,oBAAqB,QAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;AAEtH,QAAM,MAAM,MAAM,iBAAiB,MAAM,KAAK,MAAM,UAAU,MAAM,UAAU;AAC9E,MAAI,CAAC,IAAI,GAAI,QAAO;AACpB,MAAI;AACJ,MAAI;AACF,gBAAY,MAAMC,gBAAe,SAAS,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AACA,MAAI,cAAc,IAAI,IAAI,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AACvF,QAAM,aAAa,MAAM,eAAe,MAAM,MAAM;AACpD,SAAO,OAAO,OAAO;AAAA,IACnB,IAAI;AAAA,IACJ,UAAU,OAAO,OAAO;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,cAAc,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,WAAW,IAAI,IAAI;AAAA,MACnB,cAAc,MAAM;AAAA,MACpB,UAAU,MAAM;AAAA,MAChB,OAAO,IAAI,IAAI;AAAA,MACf,WAAW,IAAI,IAAI;AAAA,MACnB,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,MAChE,OAAO,OAAO,OAAO;AAAA,QACnB,GAAG;AAAA,QAAO,QAAQ,OAAO,OAAO,MAAM,MAAM;AAAA,QAAG;AAAA,MACjD,CAAC;AAAA,MACD,YAAY,MAAM;AAAA,MAClB,eAAe,IAAI,IAAI;AAAA,MACvB,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAe,iBAAiB,OAAe,UAAkB,YAA+C;AAC9G,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,UAAU,OAAO,EAAE,UAAU,KAAK,WAAW,CAAC;AAAA,EACzE,SAAS,OAAO;AACd,WAAOC,QAAO,iBAAiB,CAACC,cAAa,KAAK,CAAC,CAAC;AAAA,EACtD;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,OAAO,OAAO,SAAS,WAAW,CAAC,GAAG,KAAK,EAAG,QAAOD,QAAO,qBAAqB;AACrF,WAAOA,QAAO,sBAAsB,SAAS,OAAO,GAAG,SAAS,OAAO;AAAA,EACzE;AAEA,QAAM,aAAa,mBAAmB,SAAS,QAAQ,SAAS,SAAS,QAAQ;AACjF,MAAI,CAAC,WAAW,GAAI,QAAO;AAE3B,QAAM,EAAE,QAAQ,cAAc,SAAS,cAAc,IAAI;AACzD,MAAI,aAAa,QAAQ,cAAc,IAAK,QAAOA,QAAO,sBAAsB;AAChF,MAAI,cAAc,OAAO,WAAY,QAAOA,QAAO,aAAa;AAChE,MAAI,cAAc,MAAM,cAAc,MAAM,mCAAoC,QAAOA,QAAO,sBAAsB;AACpH,MAAI,cAAc,MAAM,aAAa,iCAAkC,QAAOA,QAAO,gBAAgB;AAErG,QAAM,MAA0B,OAAO,OAAO;AAAA,IAC5C,WAAW,cAAc;AAAA,IACzB,WAAW,cAAc;AAAA,IACzB,UAAU,cAAc;AAAA,IACxB,OAAO,cAAc;AAAA,IACrB,WAAW,cAAc;AAAA,EAC3B,CAAC;AACD,SAAO,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;AACxC;AAEA,SAAS,mBAAmB,QAAmB,SAAqB,UAAuC;AACzG,QAAM,eAAe,iBAAiB,UAAU,MAAM;AACtD,MAAI,CAAC,aAAa,SAAS;AACzB,QAAI,CAACT,sBAAqB,UAAU,OAAO,GAAG,EAAE,QAAS,QAAOS,QAAO,sBAAsB;AAC7F,WAAOA,QAAO,sBAAsB,WAAW,aAAa,MAAM,MAAM,CAAC;AAAA,EAC3E;AACA,MAAI,OAAO,OAAO,SAAS,KAAK,EAAG,QAAOA,QAAO,qBAAqB;AACtE,MAAI,CAACT,sBAAqB,UAAU,QAAQ,GAAG,EAAE,QAAS,QAAOS,QAAO,sBAAsB;AAC9F,MAAI,QAAQ,WAAW,cAAe,QAAOA,QAAO,qBAAqB;AACzE,MAAI,QAAQ,QAAQ,SAAU,QAAOA,QAAO,uBAAuB;AACnE,MAAI,CAACE,0BAAyB,QAAQ,GAAG,KAAK,CAACA,0BAAyB,QAAQ,GAAG,KAAK,QAAQ,OAAO,QAAQ,KAAK;AAClH,WAAOF,QAAO,sBAAsB;AAAA,EACtC;AAEA,QAAM,gBAAgB,kBAAkB,UAAU,OAAO;AACzD,MAAI,CAAC,cAAc,QAAS,QAAOA,QAAO,sBAAsB,WAAW,cAAc,MAAM,MAAM,CAAC;AACtG,SAAO,OAAO,OAAO;AAAA,IACnB,QAAQ,aAAa;AAAA,IACrB,IAAI;AAAA,IACJ,SAAS,cAAc;AAAA,EACzB,CAAC;AACH;AAEA,SAAS,sBAAsB,SAA8D;AAC3F,MAAI,QAAQ,KAAK,YAAU,OAAO,WAAW,oBAAoB,CAAC,EAAG,QAAO;AAC5E,MAAI,QAAQ,KAAK,YAAU,OAAO,WAAW,UAAU,CAAC,EAAG,QAAO;AAClE,MAAI,QAAQ,KAAK,YAAU,OAAO,WAAW,kBAAkB,KAAK,OAAO,WAAW,kBAAkB,CAAC,GAAG;AAC1G,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,KAAK,YACf,OAAO,WAAW,qBAAqB,KACpC,OAAO,WAAW,oCAAoC,KACtD,WAAW,uCACf,GAAG;AACF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,cACP,MACA,QAC0B;AAC1B,QAAM,UAAU,WAAW,MAAM;AACjC,MAAI,qBAAqB,IAAI,EAAG,QAAOA,QAAO,iBAAiB,OAAO;AACtE,MAAIG,UAAS,IAAI,KAAK,OAAO,OAAO,MAAM,QAAQ,KAC7C,OAAO,KAAK,WAAS,MAAM,KAAK,CAAC,MAAM,QAAQ,EAAG,QAAOH,QAAO,mBAAmB,OAAO;AAC/F,SAAOA,QAAO,mBAAmB,OAAO;AAC1C;AAEA,SAAS,qBAAqB,OAAyB;AACrD,MAAI,CAACG,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,EAAE,cAAc,WAAW,IAAI;AACrC,SAAO,OAAO,iBAAiB,YAC1B,OAAO,eAAe,YACtBD,0BAAyB,YAAY,KACrCA,0BAAyB,UAAU,KACnC,eAAe;AACtB;AAEA,SAASA,0BAAyB,OAAwB;AACxD,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS;AACjD;AAEA,SAASC,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,WAAW,QAA2G;AAC7H,SAAO,OAAO,IAAI,CAAC,UAAU;AAC3B,UAAM,OAAO,MAAM,KAAK,IAAI,MAAM,EAAE,KAAK,GAAG,KAAK;AACjD,WAAO,GAAG,IAAI,KAAK,MAAM,OAAO;AAAA,EAClC,CAAC;AACH;AAEA,SAASH,QACP,QACA,SAC0B;AAC1B,MAAI,YAAY,OAAW,QAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AACrE,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC;AAAA,IACnC,IAAI;AAAA,IACJ;AAAA,EACF,CAAC;AACH;AAEA,SAASC,cAAa,OAAwB;AAC5C,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;;AC1QA,eAAsB,WAAiC,OAAyB,SAA8C;AAC5H,MAAI,UAAU;AACd,aAAS;AACP,UAAM,SAAS,MAAM,MAAM,MAAM;AACjC,QAAI,WAAW,OAAW,QAAO;AAEjC,QAAI;AACF,YAAM,QAAQ,OAAO,IAAI;AAAA,IAC3B,SAAS,OAAO;AACd,YAAM,OAAO,QAAQ;AACrB,YAAM;AAAA,IACR;AACA,UAAM,OAAO,IAAI;AACjB,eAAW;AAAA,EACb;AACF;",
+  "names": ["PayloadBuilder", "bytesToCanonicalBase64Url", "EncryptedWakeSubscriptionZod", "EndpointChallengeResponseZod", "EndpointChallengeZod", "generateHandshakeId", "HashZod", "MAX_SUBSCRIPTION_PLAINTEXT_BYTES", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "WakeSubscriptionCleartextZod", "WakeSubscriptionPlaintextZod", "PayloadBuilder", "Base64Url32BytesZod", "bytesToCanonicalBase64Url", "canonicalBase64UrlToBytes", "EncryptedWakeSubscriptionZod", "HashZod", "NormalizedAddressZod", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "WakeSubscriptionCleartextZod", "NormalizedAddressZod", "NormalizedAddressZod", "textEncoder", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "HashZod", "Base64Url32BytesZod", "canonicalBase64UrlToBytes", "bytesToCanonicalBase64Url", "WakeSubscriptionCleartextZod", "NormalizedAddressZod", "EncryptedWakeSubscriptionZod", "EncryptedWakeSubscriptionZod", "EndpointChallengeZod", "EndpointChallengeResponseZod", "HashZod", "PayloadBuilder", "generateHandshakeId", "WAKE_SUBSCRIPTION_HPKE_PROFILE", "MAX_SUBSCRIPTION_PLAINTEXT_BYTES", "bytesToCanonicalBase64Url", "WakeSubscriptionPlaintextZod", "WakeSubscriptionCleartextZod", "isNonnegativeSafeInteger", "service", "key", "WakeGrantObjectSchema", "WakeGrantRevocationSchema", "EncryptedWakeSubscriptionZod", "EndpointChallengeZod", "HashZod", "NormalizedAddressZod", "PublisherEncryptionKeyZod", "PublisherServiceZod", "WakeGrantObjectZod", "PayloadBuilder", "PayloadBuilder", "isNonnegativeSafeInteger", "WakeGrantObjectZod", "PublisherEncryptionKeyZod", "NormalizedAddressZod", "PublisherServiceZod", "EncryptedWakeSubscriptionZod", "HashZod", "EndpointChallengeZod", "ChainIdZod", "DeploymentIdZod", "HashZod", "NonnegativeJsonSafeIntegerZod", "NormalizedAddressZod", "z", "ChainIdZod", "WakeSourceZod", "DeploymentIdZod", "HashZod", "NormalizedAddressZod", "WakeGrantObjectSchema", "WakeGrantRevocationSchema", "isRecord", "isNonnegativeSafeInteger", "ChainIdZod", "WakeSourceZod", "ChainIdZod", "DeploymentIdZod", "HashZod", "NonnegativeJsonSafeIntegerZod", "NormalizedAddressZod", "PositiveJsonSafeIntegerZod", "SOURCE_WAKE_FILTER_PROFILE", "WakeEnvelopeZod", "WakeJwtAudienceZod", "WakeSourceZod", "PayloadBuilder", "z", "z", "WakeJwtAudienceZod", "ChainIdZod", "NormalizedAddressZod", "DeploymentIdZod", "WakeSourceZod", "HashZod", "NonnegativeJsonSafeIntegerZod", "PositiveJsonSafeIntegerZod", "WakeEnvelopeZod", "SOURCE_WAKE_FILTER_PROFILE", "PayloadBuilder", "reject", "errorMessage", "isNonnegativeSafeInteger", "isRecord"]
 }