attenu-guard 0.1.0

package/dist/cjs/canonical.js

@@ -0,0 +1,372 @@
+"use strict";
+/**
+ * canonical.ts — byte-exact interoperability with the Python implementation.
+ *
+ * Every hash, seal and signature in Attenu is taken over a canonical JSON
+ * serialisation. The Python library produces those bytes with
+ * `json.dumps(obj, sort_keys=True, separators=(",", ":"))`, whose defaults
+ * include `ensure_ascii=True`. `JSON.stringify` differs from that in three
+ * ways that would each silently break cross-language verification:
+ *
+ *   1. key order — `JSON.stringify` preserves insertion order, Python sorts;
+ *   2. non-ASCII — Python escapes every code point above U+007E as `\uXXXX`
+ *      (astral characters as a surrogate pair), `JSON.stringify` emits them raw;
+ *   3. numbers — Python distinguishes `int` from `float` (`100` vs `100.0`) and
+ *      switches to exponential notation at different magnitudes than JavaScript
+ *      (`1e-05` where `String()` gives `0.00001`).
+ *
+ * (1) and (2) are handled by `canonicalJson` below. (3) cannot be solved by a
+ * serialiser alone, because a JavaScript `number` has forgotten whether the
+ * document said `100` or `100.0`. So a document that is going to be re-hashed —
+ * a ledger or a bundle produced elsewhere — is read with `parseJson`, which
+ * keeps each number's original literal alongside its value as a `RawNumber`.
+ * `canonicalJson` re-emits that literal verbatim, so a Python-written entry
+ * hashes to the byte-identical digest here. Values created in this library are
+ * plain numbers, and `pyNumber` formats them the way Python's `json` would, so
+ * the reverse direction round-trips too.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RawNumber = void 0;
+exports.compareCodePoints = compareCodePoints;
+exports.sortedStrings = sortedStrings;
+exports.pyNumber = pyNumber;
+exports.pyString = pyString;
+exports.canonicalJson = canonicalJson;
+exports.pyJsonDumps = pyJsonDumps;
+exports.canonicalBytes = canonicalBytes;
+exports.toPlain = toPlain;
+exports.parseJson = parseJson;
+/** A number as it was written in the source document, plus its parsed value. */
+class RawNumber {
+    raw;
+    value;
+    constructor(raw, value) {
+        this.raw = raw;
+        this.value = value;
+    }
+    valueOf() {
+        return this.value;
+    }
+    toJSON() {
+        return this.value;
+    }
+}
+exports.RawNumber = RawNumber;
+/** Compare two strings by Unicode code point, as Python's `sorted` does. */
+function compareCodePoints(a, b) {
+    const ca = Array.from(a);
+    const cb = Array.from(b);
+    const n = Math.min(ca.length, cb.length);
+    for (let i = 0; i < n; i++) {
+        const x = ca[i].codePointAt(0);
+        const y = cb[i].codePointAt(0);
+        if (x !== y)
+            return x < y ? -1 : 1;
+    }
+    return ca.length - cb.length;
+}
+/** Sort strings by code point (Python's `sorted(list_of_str)`). */
+function sortedStrings(values) {
+    return Array.from(values).sort(compareCodePoints);
+}
+/**
+ * Format a number the way Python's `json.dumps` would.
+ *
+ * Integral values are emitted without a decimal point, matching a Python `int`.
+ * A TypeScript number cannot record that it was meant to be the float `100.0`,
+ * so such a value serialises as `100`; Python reads that back as an `int` and
+ * re-emits `100`, which keeps the chain verifiable in both directions. Values
+ * with a fractional part follow CPython's `repr`: shortest round-tripping
+ * digits, exponential notation when the decimal exponent is below -4 or at
+ * least 16, a two-digit signed exponent, and always a decimal point otherwise.
+ */
+function pyNumber(n) {
+    if (Number.isNaN(n))
+        return "NaN";
+    if (!Number.isFinite(n))
+        return n > 0 ? "Infinity" : "-Infinity";
+    if (Object.is(n, -0))
+        return "-0.0";
+    if (Number.isInteger(n) && Math.abs(n) < 1e21)
+        return n.toFixed(0);
+    return pyFloatRepr(n);
+}
+function pyFloatRepr(n) {
+    // `toExponential()` with no argument yields the shortest digit string that
+    // uniquely identifies the value — the same "shortest round-trip" digits
+    // CPython's repr produces. Only the layout around them differs.
+    const parsed = /^(-?)(\d)(?:\.(\d+))?e([+-]\d+)$/.exec(n.toExponential());
+    if (!parsed)
+        return String(n); // unreachable for a finite double
+    const sign = parsed[1];
+    const digits = parsed[2] + (parsed[3] ?? "");
+    const exp = parseInt(parsed[4], 10);
+    if (exp < -4 || exp >= 16) {
+        const mantissa = digits.length > 1 ? `${digits[0]}.${digits.slice(1)}` : digits;
+        const expSign = exp < 0 ? "-" : "+";
+        return `${sign}${mantissa}e${expSign}${String(Math.abs(exp)).padStart(2, "0")}`;
+    }
+    if (exp >= 0) {
+        const body = digits.length > exp + 1
+            ? `${digits.slice(0, exp + 1)}.${digits.slice(exp + 1)}`
+            : `${digits.padEnd(exp + 1, "0")}.0`;
+        return sign + body;
+    }
+    return `${sign}0.${"0".repeat(-exp - 1)}${digits}`;
+}
+/** Escape a string the way Python's `json.dumps(ensure_ascii=True)` does. */
+function pyString(s) {
+    let out = '"';
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i];
+        const code = s.charCodeAt(i);
+        if (ch === '"')
+            out += '\\"';
+        else if (ch === "\\")
+            out += "\\\\";
+        else if (code === 0x08)
+            out += "\\b";
+        else if (code === 0x09)
+            out += "\\t";
+        else if (code === 0x0a)
+            out += "\\n";
+        else if (code === 0x0c)
+            out += "\\f";
+        else if (code === 0x0d)
+            out += "\\r";
+        else if (code < 0x20 || code > 0x7e)
+            out += "\\u" + code.toString(16).padStart(4, "0");
+        else
+            out += ch;
+    }
+    return out + '"';
+}
+/**
+ * Serialise to the exact bytes Python's
+ * `json.dumps(obj, sort_keys=True, separators=(",", ":"))` produces:
+ * sorted keys, no incidental whitespace, ASCII-escaped strings.
+ *
+ * Object entries whose value is `undefined` are omitted, matching a Python dict
+ * that simply never held the key. `null` is kept — it is a value.
+ */
+function canonicalJson(value) {
+    return pyJsonDumps(value, ",", ":");
+}
+/**
+ * Serialise with sorted keys and ASCII escaping, choosing the separators.
+ *
+ * `canonicalJson` uses the compact `(",", ":")` pair every hash is taken over.
+ * The `.jsonl` ledger on disk is written with Python's DEFAULT separators
+ * (`", "` and `": "`), so a line read back by either language re-serialises to
+ * the same bytes its writer produced.
+ */
+function pyJsonDumps(value, itemSeparator = ", ", keySeparator = ": ") {
+    if (value === null || value === undefined)
+        return "null";
+    if (value instanceof RawNumber)
+        return value.raw;
+    switch (typeof value) {
+        case "boolean":
+            return value ? "true" : "false";
+        case "number":
+            return pyNumber(value);
+        case "string":
+            return pyString(value);
+    }
+    if (Array.isArray(value)) {
+        return ("[" + value.map((v) => pyJsonDumps(v, itemSeparator, keySeparator)).join(itemSeparator) + "]");
+    }
+    const keys = sortedStrings(Object.keys(value).filter((k) => value[k] !== undefined));
+    return ("{" +
+        keys
+            .map((k) => `${pyString(k)}${keySeparator}${pyJsonDumps(value[k], itemSeparator, keySeparator)}`)
+            .join(itemSeparator) +
+        "}");
+}
+/** The canonical bytes — what every hash, seal and signature is taken over. */
+function canonicalBytes(value) {
+    return Buffer.from(canonicalJson(value), "utf8");
+}
+/** Strip `RawNumber` wrappers, yielding ordinary JavaScript values. */
+function toPlain(value) {
+    if (value instanceof RawNumber)
+        return value.value;
+    if (Array.isArray(value))
+        return value.map((v) => toPlain(v));
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = toPlain(v);
+        return out;
+    }
+    return value;
+}
+/**
+ * Parse JSON, keeping every number's original literal.
+ *
+ * `JSON.parse` is not used: it discards the literal, and with it the ability to
+ * reproduce the bytes the writer hashed. Objects preserve their key order for
+ * readability; canonical serialisation sorts them anyway.
+ */
+function parseJson(text) {
+    const p = new Parser(text);
+    p.skipWhitespace();
+    const value = p.parseValue();
+    p.skipWhitespace();
+    if (!p.atEnd())
+        p.fail("unexpected trailing data");
+    return value;
+}
+const NUMBER_RE = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/;
+class Parser {
+    s;
+    i = 0;
+    constructor(s) {
+        this.s = s;
+    }
+    atEnd() {
+        return this.i >= this.s.length;
+    }
+    fail(message) {
+        throw new SyntaxError(`${message} at position ${this.i}`);
+    }
+    skipWhitespace() {
+        while (this.i < this.s.length) {
+            const c = this.s[this.i];
+            if (c === " " || c === "\t" || c === "\n" || c === "\r")
+                this.i++;
+            else
+                break;
+        }
+    }
+    parseValue() {
+        if (this.atEnd())
+            this.fail("unexpected end of input");
+        const c = this.s[this.i];
+        if (c === "{")
+            return this.parseObject();
+        if (c === "[")
+            return this.parseArray();
+        if (c === '"')
+            return this.parseString();
+        if (this.s.startsWith("true", this.i))
+            return (this.i += 4), true;
+        if (this.s.startsWith("false", this.i))
+            return (this.i += 5), false;
+        if (this.s.startsWith("null", this.i))
+            return (this.i += 4), null;
+        return this.parseNumber();
+    }
+    parseObject() {
+        this.i++; // {
+        const out = {};
+        this.skipWhitespace();
+        if (this.s[this.i] === "}")
+            return this.i++, out;
+        for (;;) {
+            this.skipWhitespace();
+            if (this.s[this.i] !== '"')
+                this.fail("expected an object key");
+            const key = this.parseString();
+            this.skipWhitespace();
+            if (this.s[this.i] !== ":")
+                this.fail("expected ':'");
+            this.i++;
+            this.skipWhitespace();
+            out[key] = this.parseValue();
+            this.skipWhitespace();
+            const c = this.s[this.i];
+            if (c === ",") {
+                this.i++;
+                continue;
+            }
+            if (c === "}")
+                return this.i++, out;
+            this.fail("expected ',' or '}'");
+        }
+    }
+    parseArray() {
+        this.i++; // [
+        const out = [];
+        this.skipWhitespace();
+        if (this.s[this.i] === "]")
+            return this.i++, out;
+        for (;;) {
+            this.skipWhitespace();
+            out.push(this.parseValue());
+            this.skipWhitespace();
+            const c = this.s[this.i];
+            if (c === ",") {
+                this.i++;
+                continue;
+            }
+            if (c === "]")
+                return this.i++, out;
+            this.fail("expected ',' or ']'");
+        }
+    }
+    parseString() {
+        this.i++; // opening quote
+        let out = "";
+        for (;;) {
+            if (this.atEnd())
+                this.fail("unterminated string");
+            const c = this.s[this.i];
+            if (c === '"')
+                return this.i++, out;
+            if (c !== "\\") {
+                out += c;
+                this.i++;
+                continue;
+            }
+            this.i++;
+            const esc = this.s[this.i];
+            this.i++;
+            switch (esc) {
+                case '"':
+                    out += '"';
+                    break;
+                case "\\":
+                    out += "\\";
+                    break;
+                case "/":
+                    out += "/";
+                    break;
+                case "b":
+                    out += "\b";
+                    break;
+                case "f":
+                    out += "\f";
+                    break;
+                case "n":
+                    out += "\n";
+                    break;
+                case "r":
+                    out += "\r";
+                    break;
+                case "t":
+                    out += "\t";
+                    break;
+                case "u": {
+                    const hex = this.s.slice(this.i, this.i + 4);
+                    if (!/^[0-9a-fA-F]{4}$/.test(hex))
+                        this.fail("bad \\u escape");
+                    out += String.fromCharCode(parseInt(hex, 16));
+                    this.i += 4;
+                    break;
+                }
+                default:
+                    this.fail("bad escape");
+            }
+        }
+    }
+    parseNumber() {
+        const m = NUMBER_RE.exec(this.s.slice(this.i));
+        if (!m)
+            this.fail("expected a value");
+        const raw = m[0];
+        this.i += raw.length;
+        return new RawNumber(raw, Number(raw));
+    }
+}
+//# sourceMappingURL=canonical.js.map

package/dist/cjs/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/canonical.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AA8BH,8CAUC;AAGD,sCAEC;AAaD,4BAMC;AA4BD,4BAgBC;AAUD,sCAEC;AAUD,kCA4BC;AAGD,wCAEC;AAGD,0BASC;AASD,8BAOC;AA7LD,gFAAgF;AAChF,MAAa,SAAS;IAET;IACA;IAFX,YACW,GAAW,EACX,KAAa;QADb,QAAG,GAAH,GAAG,CAAQ;QACX,UAAK,GAAL,KAAK,CAAQ;IACrB,CAAC;IACJ,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAXD,8BAWC;AAeD,4EAA4E;AAC5E,SAAgB,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,mEAAmE;AACnE,SAAgB,aAAa,CAAC,MAAwB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,QAAQ,CAAC,CAAS;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;IACjE,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,MAAM,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAErC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChF,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,OAAO,GAAG,IAAI,GAAG,QAAQ,IAAI,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,GACR,MAAM,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC;YACrB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE;YACxD,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;QACzC,OAAO,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,6EAA6E;AAC7E,SAAgB,QAAQ,CAAC,CAAS;IAChC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,KAAK,CAAC;aACxB,IAAI,EAAE,KAAK,IAAI;YAAE,GAAG,IAAI,MAAM,CAAC;aAC/B,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAChC,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAChC,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAChC,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAChC,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAChC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI;YAAE,GAAG,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;;YAClF,GAAG,IAAI,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,KAAwB;IACpD,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CACzB,KAAwB,EACxB,aAAa,GAAG,IAAI,EACpB,YAAY,GAAG,IAAI;IAEnB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IACjD,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IACrF,OAAO,CACL,GAAG;QACH,IAAI;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;aACjG,IAAI,CAAC,aAAa,CAAC;QACtB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAwB;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,uEAAuE;AACvE,SAAgB,OAAO,CAAW,KAAwB;IACxD,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC,KAAqB,CAAC;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAiB,CAAC;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAyB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,KAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,cAAc,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC,CAAC,cAAc,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,SAAS,GAAG,8CAA8C,CAAC;AAEjE,MAAM,MAAM;IAEmB;IADrB,CAAC,GAAG,CAAC,CAAC;IACd,YAA6B,CAAS;QAAT,MAAC,GAAD,CAAC,CAAQ;IAAG,CAAC;IAE1C,KAAK;QACH,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,MAAM,IAAI,WAAW,CAAC,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,CAAC,EAAE,CAAC;;gBAC7D,MAAM;QACb,CAAC;IACH,CAAC;IAED,UAAU;QACR,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;QAClE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC;QACpE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;QAClE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;QACd,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;QACjD,SAAS,CAAC;YACR,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;QACd,MAAM,GAAG,GAAY,EAAE,CAAC;QACxB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;QACjD,SAAS,CAAC;YACR,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB;QAC1B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;YACpC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,GAAG,IAAI,CAAC,CAAC;gBACT,IAAI,CAAC,CAAC,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACT,QAAQ,GAAG,EAAE,CAAC;gBACZ,KAAK,GAAG;oBACN,GAAG,IAAI,GAAG,CAAC;oBACX,MAAM;gBACR,KAAK,IAAI;oBACP,GAAG,IAAI,IAAI,CAAC;oBACZ,MAAM;gBACR,KAAK,GAAG;oBACN,GAAG,IAAI,GAAG,CAAC;oBACX,MAAM;gBACR,KAAK,GAAG;oBACN,GAAG,IAAI,IAAI,CAAC;oBACZ,MAAM;gBACR,KAAK,GAAG;oBACN,GAAG,IAAI,IAAI,CAAC;oBACZ,MAAM;gBACR,KAAK,GAAG;oBACN,GAAG,IAAI,IAAI,CAAC;oBACZ,MAAM;gBACR,KAAK,GAAG;oBACN,GAAG,IAAI,IAAI,CAAC;oBACZ,MAAM;gBACR,KAAK,GAAG;oBACN,GAAG,IAAI,IAAI,CAAC;oBACZ,MAAM;gBACR,KAAK,GAAG,CAAC,CAAC,CAAC;oBACT,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;oBAC/D,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC9C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;oBACZ,MAAM;gBACR,CAAC;gBACD;oBACE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;QACrB,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/cjs/ceilings.d.ts

@@ -0,0 +1,211 @@
+/**
+ * ceilings.ts — typed, self-narrowing, self-enforcing bounds on an Authority.
+ *
+ * A `Ceiling` is a small typed object that knows how to (a) check itself against
+ * a request context, (b) narrow itself against a sibling ceiling of the same
+ * kind, (c) state whether it admits a superset of what another ceiling of its
+ * kind admits, and (d) read and write its own wire form. `Authority` never needs
+ * to know the semantics of any particular ceiling — it just calls these methods.
+ *
+ * The property the Internet-Draft's constraint vocabulary demands: "a verifier
+ * that encounters an unknown constraint type MUST treat the action as denied
+ * (fail-closed), never as unconstrained." That is `ceilingFromWire`: an
+ * unrecognised wire constraint becomes an `UnknownCeiling`, whose `permits`
+ * always denies. There is no code path by which an unrecognised bound is
+ * silently dropped.
+ */
+import { type CJson, type Json } from "./canonical.js";
+import { Decision } from "./reasons.js";
+/** A request context: the quantities and attributes a call declares. */
+export type Context = Record<string, Json>;
+/** The shape every ceiling — built-in or custom — must implement. */
+export interface Ceiling {
+    /** The dimension being bounded, e.g. "max_rows". Pairs ceilings in `meet`. */
+    readonly key: string;
+    /** The request-context field this ceiling reads, when it differs from `key`. */
+    readonly ctxField?: string;
+    /** Caller-chosen context field for the generic membership/prefix ceilings. */
+    readonly field?: string | null;
+    /** Set on a ceiling that bounds a consumed quantity the caller must declare. */
+    readonly metered?: boolean;
+    /**
+     * Does this ceiling admit the given request context? A context that does not
+     * mention this ceiling's dimension is not asserting anything here, and is
+     * permitted.
+     */
+    permits(ctx: Context): Decision;
+    /**
+     * The more restrictive of `this` and `other` (same key). Must satisfy:
+     * the result's admitted set is a subset of both inputs'. That is what makes
+     * `Authority.meet` sound.
+     */
+    narrow(other: Ceiling): Ceiling;
+    /** True iff `this` admits a superset of what `other` admits. */
+    subsumes(other: Ceiling): boolean;
+    /** The wire form, per the Internet-Draft's Constraint Vocabulary. */
+    toWire(): Record<string, Json>;
+    /** Human-readable rendering, for dashboards and parent-vs-child diffs. */
+    describe?(): string;
+    /** Scoped ceilings only: does this bound bite a request for `scope`? */
+    appliesToScope?(scope: string | null | undefined): boolean;
+    /** Scoped ceilings only: the pattern this ceiling meters against, or "*". */
+    readonly meterKey?: string;
+}
+/**
+ * The request-context field a ceiling reads. Prefers an explicit `ctxField`,
+ * then the caller-keyed `field`, then the ceiling's own `key`.
+ */
+export declare function ctxFieldOf(ceiling: Ceiling): string;
+/** Uniform human-readable rendering of any ceiling. Never parsed back. */
+export declare function describe(ceiling: Ceiling): string;
+/**
+ * A METERED ceiling bounds a consumed quantity the caller must declare (rows
+ * read, spend, calls) — by convention its key starts with "max_". Rank and
+ * membership ceilings are not metered: omitting them from a context means "not
+ * asserting anything here", not "consuming an undeclared amount".
+ */
+export declare function isMetered(ceiling: Ceiling): boolean;
+/** Per-call cap on rows read or returned. Context field: "rows". */
+export declare class RowLimit implements Ceiling {
+    readonly maxRows: number;
+    readonly key = "max_rows";
+    readonly ctxField = "rows";
+    constructor(maxRows: number);
+    permits(ctx: Context): Decision;
+    describe(): string;
+    narrow(other: Ceiling): RowLimit;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): RowLimit;
+}
+/** Per-call cap on spend, currency-agnostic. Context field: "spend". */
+export declare class SpendCap implements Ceiling {
+    readonly maxSpend: number;
+    readonly key = "max_spend";
+    readonly ctxField = "spend";
+    constructor(maxSpend: number);
+    permits(ctx: Context): Decision;
+    describe(): string;
+    narrow(other: Ceiling): SpendCap;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): SpendCap;
+}
+/**
+ * Cap on a call COUNT. Context field: "calls" — the running count including
+ * this call.
+ *
+ * `appliesTo` makes the ceiling SCOPED: it only bites requests for that scope
+ * (wildcards as in scopes: "fs.write", "web.*"). A scoped limit is its own
+ * dimension — `key` becomes `max_calls[<appliesTo>]` — so an unscoped and a
+ * scoped limit coexist in one Authority and pair independently.
+ *
+ * `Guard.check` supplies `calls` itself, per (node, pattern), when the caller
+ * does not; an explicit `calls` in the context still wins.
+ */
+export declare class CallLimit implements Ceiling {
+    readonly maxCalls: number;
+    readonly appliesTo: string | null;
+    readonly key: string;
+    readonly ctxField: string;
+    constructor(maxCalls: number, appliesTo?: string | null);
+    /** What this ceiling counts: the pattern it applies to, or every call. */
+    get meterKey(): string;
+    appliesToScope(scope: string | null | undefined): boolean;
+    permits(ctx: Context): Decision;
+    describe(): string;
+    narrow(other: Ceiling): CallLimit;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): CallLimit;
+}
+/** Ordered-enum egress ceiling: none < internal < any. Context field: "egress". */
+export declare class EgressRank implements Ceiling {
+    readonly level: string;
+    readonly key = "egress";
+    readonly ctxField = "egress";
+    constructor(level: string);
+    permits(ctx: Context): Decision;
+    describe(): string;
+    narrow(other: Ceiling): EgressRank;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): EgressRank;
+}
+/** Membership allow-list: the context value MUST be one of `oneOf`. */
+export declare class Allow implements Ceiling {
+    readonly key: string;
+    readonly field: string | null;
+    readonly oneOf: ReadonlySet<Json>;
+    constructor(key: string, oneOf: Iterable<Json>, field?: string | null);
+    private ctxKey;
+    permits(ctx: Context): Decision;
+    describe(): string;
+    narrow(other: Ceiling): Allow;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): Allow;
+}
+/** Membership deny-list: the context value MUST NOT be one of `notOneOf`. */
+export declare class Deny implements Ceiling {
+    readonly key: string;
+    readonly field: string | null;
+    readonly notOneOf: ReadonlySet<Json>;
+    constructor(key: string, notOneOf: Iterable<Json>, field?: string | null);
+    private ctxKey;
+    permits(ctx: Context): Decision;
+    describe(): string;
+    narrow(other: Ceiling): Deny;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): Deny;
+}
+/** String-prefix bound: the context value MUST start with `prefix`. */
+export declare class Prefix implements Ceiling {
+    readonly key: string;
+    readonly prefix: string;
+    readonly field: string | null;
+    constructor(key: string, prefix: string, field?: string | null);
+    private ctxKey;
+    permits(ctx: Context): Decision;
+    describe(): string;
+    narrow(other: Ceiling): Prefix;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): Prefix;
+}
+export interface CeilingClass {
+    fromWire(d: Record<string, Json>): Ceiling;
+}
+/**
+ * Register a ceiling class's `fromWire` under a wire discriminator.
+ * Re-registering replaces the previous mapping — callers may shadow a built-in
+ * deliberately, but should do so knowingly.
+ */
+export declare function registerCeiling(key: string, cls: CeilingClass): void;
+/**
+ * Fail-closed placeholder for a wire constraint this build does not recognise.
+ *
+ * `permits` always denies. `narrow` stays an unknown ceiling, so it can never
+ * resolve to something more permissive than "deny everything". `subsumes` is
+ * true only against an identical unknown ceiling — just enough reflexivity for
+ * `isNarrowerThan(self)`. `toWire` preserves the original bytes losslessly, so
+ * a chain that merely forwards constraints can still do so.
+ */
+export declare class UnknownCeiling implements Ceiling {
+    readonly raw: Record<string, Json>;
+    readonly key: string;
+    constructor(key: Json, raw?: Record<string, Json>);
+    permits(_ctx: Context): Decision;
+    narrow(_other: Ceiling): UnknownCeiling;
+    subsumes(other: Ceiling): boolean;
+    toWire(): Record<string, Json>;
+    static fromWire(d: Record<string, Json>): UnknownCeiling;
+}
+/**
+ * Reconstruct a Ceiling from its wire form. Routes on "type" when present (it
+ * disambiguates the generic ceilings), else on "key". An unrecognised
+ * discriminator fails closed via `UnknownCeiling`.
+ */
+export declare function ceilingFromWire(wire: CJson): Ceiling;
+//# sourceMappingURL=ceilings.d.ts.map

package/dist/cjs/ceilings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceilings.d.ts","sourceRoot":"","sources":["../../src/ceilings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAwC,KAAK,KAAK,EAAE,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAsB,MAAM,cAAc,CAAC;AAE5D,wEAAwE;AACxE,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAE3C,qEAAqE;AACrE,MAAM,WAAW,OAAO;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAEhC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAElC,qEAAqE;IACrE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE/B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,MAAM,CAAC;IAEpB,wEAAwE;IACxE,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC;IAE3D,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAYD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAInD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAGjD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEnD;AAmBD,oEAAoE;AACpE,qBAAa,QAAS,YAAW,OAAO;IAG1B,QAAQ,CAAC,OAAO,EAAE,MAAM;IAFpC,QAAQ,CAAC,GAAG,cAAc;IAC1B,QAAQ,CAAC,QAAQ,UAAU;gBACN,OAAO,EAAE,MAAM;IAEpC,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ;IAY/B,QAAQ,IAAI,MAAM;IAIlB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ;IAIhC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAI9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ;CAGnD;AAED,wEAAwE;AACxE,qBAAa,QAAS,YAAW,OAAO;IAG1B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAFrC,QAAQ,CAAC,GAAG,eAAe;IAC3B,QAAQ,CAAC,QAAQ,WAAW;gBACP,QAAQ,EAAE,MAAM;IAErC,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ;IAY/B,QAAQ,IAAI,MAAM;IAIlB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ;IAIhC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAI9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ;CAGnD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,YAAW,OAAO;IAKrC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IALnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAGf,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAM,GAAG,IAAW;IAM1C,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAMzD,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ;IAa/B,QAAQ,IAAI,MAAM;IAIlB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS;IAIjC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAK9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,SAAS;CAGpD;AAED,mFAAmF;AACnF,qBAAa,UAAW,YAAW,OAAO;IAG5B,QAAQ,CAAC,KAAK,EAAE,MAAM;IAFlC,QAAQ,CAAC,GAAG,YAAY;IACxB,QAAQ,CAAC,QAAQ,YAAY;gBACR,KAAK,EAAE,MAAM;IAElC,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ;IAc/B,QAAQ,IAAI,MAAM;IAIlB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU;IAKlC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAI9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,UAAU;CAGrD;AAQD,uEAAuE;AACvE,qBAAa,KAAM,YAAW,OAAO;IAGjC,QAAQ,CAAC,GAAG,EAAE,MAAM;IAEpB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAJ/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBAEvB,GAAG,EAAE,MAAM,EACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EACZ,KAAK,GAAE,MAAM,GAAG,IAAW;IAKtC,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ;IAY/B,QAAQ,IAAI,MAAM;IAIlB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK;IAK7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAM9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK;CAOhD;AAED,6EAA6E;AAC7E,qBAAa,IAAK,YAAW,OAAO;IAGhC,QAAQ,CAAC,GAAG,EAAE,MAAM;IAEpB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAJ/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBAE1B,GAAG,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EACf,KAAK,GAAE,MAAM,GAAG,IAAW;IAKtC,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ;IAY/B,QAAQ,IAAI,MAAM;IAIlB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAK5B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAMjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAU9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI;CAO/C;AAED,uEAAuE;AACvE,qBAAa,MAAO,YAAW,OAAO;IAElC,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;gBAFpB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,GAAG,IAAW;IAGtC,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ;IAc/B,QAAQ,IAAI,MAAM;IAIlB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAc9B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAM9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM;CAOjD;AAQD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC;CAC5C;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI,CAEpE;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAe,YAAW,OAAO;IAI1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAHpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAEnB,GAAG,EAAE,IAAI,EACA,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAM;IAKzC,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ;IAShC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAOjC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAI9B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,cAAc;CAGzD;AAQD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAMpD"}