emdash 0.35.0 → 0.37.0

package/dist/api-Dz6rgoa3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-Dz6rgoa3.mjs","names":["decodeBase64","pluginManifestSchema","reconcileManifestAccess","pluginManifestSchema","reconcileManifestAccess","MAX_BUNDLE_COMPRESSED_BYTES","MAX_BUNDLE_SIZE","MAX_BUNDLE_FILE_BYTES","MAX_BUNDLE_FILE_COUNT","MAX_BUNDLE_TAR_ENTRY_COUNT","MAX_BUNDLE_DECOMPRESSED_BYTES","TAR_BLOCK_BYTES","TAR_END_BYTES","decoder","verificationError","verifyMultihash","pluginManifestSchema","reconcileManifestAccess","BASE32_ALPHABET"],"sources":["../src/api/rev.ts","../src/api/handlers/validate-media-fields.ts","../src/api/handlers/content.ts","../src/api/handlers/manifest.ts","../src/api/handlers/revision.ts","../src/api/handlers/media.ts","../src/api/handlers/plugins.ts","../src/api/handlers/plugin-settings.ts","../src/plugins/marketplace.ts","../src/plugins/storage-indexes.ts","../src/api/handlers/marketplace.ts","../../registry-verification/dist/bundle.js","../src/registry/artifact-verification.ts","../../registry-verification/dist/index.js","../src/registry/authoritative-records.ts","../src/registry/plugin-id.ts","../src/registry/record-labels.ts","../src/api/handlers/registry.ts"],"sourcesContent":["/**\n * Opaque _rev token generation and validation.\n *\n * Format: base64(\"version:updated_at\")\n * Stateless — server decodes and checks both components.\n *\n * Rules:\n * - No _rev sent → blind write (backwards-compatible)\n * - _rev matches → write proceeds, new _rev returned\n * - _rev mismatch → 409 Conflict\n */\n\nimport type { ContentItem } from \"../database/repositories/types.js\";\nimport { encodeBase64, decodeBase64 } from \"../utils/base64.js\";\n\n/**\n * Generate a _rev token from a content item's version and updatedAt.\n */\nexport function encodeRev(item: ContentItem): string {\n\treturn encodeBase64(`${item.version}:${item.updatedAt}`);\n}\n\n/**\n * Decode a _rev token into its components.\n * Returns null if the token is malformed.\n */\nexport function decodeRev(rev: string): { version: number; updatedAt: string } | null {\n\ttry {\n\t\tconst decoded = decodeBase64(rev);\n\t\tconst colonIdx = decoded.indexOf(\":\");\n\t\tif (colonIdx === -1) return null;\n\n\t\tconst version = parseInt(decoded.slice(0, colonIdx), 10);\n\t\tconst updatedAt = decoded.slice(colonIdx + 1);\n\n\t\tif (isNaN(version) || !updatedAt) return null;\n\t\treturn { version, updatedAt };\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Validate a _rev token against a content item.\n * Returns null if valid (or if no _rev provided), or an error message if invalid.\n */\nexport function validateRev(\n\trev: string | undefined,\n\titem: ContentItem,\n): { valid: true } | { valid: false; message: string } {\n\t// No _rev = blind write (backwards-compatible)\n\tif (!rev) return { valid: true };\n\n\tconst decoded = decodeRev(rev);\n\tif (!decoded) {\n\t\treturn { valid: false, message: \"Malformed _rev token\" };\n\t}\n\n\tif (decoded.version !== item.version || decoded.updatedAt !== item.updatedAt) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\tmessage: \"Content has been modified since last read (version conflict)\",\n\t\t};\n\t}\n\n\treturn { valid: true };\n}\n","import type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport { matchesMimeAllowlist, parseAllowedMimeTypes } from \"../../media/mime.js\";\nimport { requestCached } from \"../../request-cache.js\";\nimport { chunks, SQL_BATCH_SIZE } from \"../../utils/chunks.js\";\nimport type { ApiResult } from \"../types.js\";\n\ninterface FieldRow {\n\tslug: string;\n\ttype: string;\n\tallowedMimeTypes: string[];\n}\n\ninterface MediaRefValue {\n\tid?: unknown;\n\tprovider?: unknown;\n\tmimeType?: unknown;\n}\n\nfunction asMediaRef(value: unknown): MediaRefValue | null {\n\tif (value === null || value === undefined) return null;\n\tif (typeof value !== \"object\" || Array.isArray(value)) return null;\n\treturn value;\n}\n\nfunction fail(message: string): ApiResult<never> {\n\treturn { success: false, error: { code: \"INVALID_MIME_FOR_FIELD\", message } };\n}\n\nasync function loadMediaFieldsForCollection(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n): Promise<FieldRow[]> {\n\tconst rows = await db\n\t\t.selectFrom(\"_emdash_fields\")\n\t\t.innerJoin(\"_emdash_collections\", \"_emdash_collections.id\", \"_emdash_fields.collection_id\")\n\t\t.select([\"_emdash_fields.slug\", \"_emdash_fields.type\", \"_emdash_fields.validation\"])\n\t\t.where(\"_emdash_collections.slug\", \"=\", collectionSlug)\n\t\t.where(\"_emdash_fields.type\", \"in\", [\"file\", \"image\"])\n\t\t.execute();\n\n\tconst out: FieldRow[] = [];\n\tfor (const row of rows) {\n\t\tconst list = parseAllowedMimeTypes(row.validation);\n\t\tif (!list) continue;\n\t\tout.push({ slug: row.slug, type: row.type, allowedMimeTypes: list });\n\t}\n\treturn out;\n}\n\nexport async function validateMediaFields(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tdata: Record<string, unknown>,\n): Promise<ApiResult<true>> {\n\t// Cache is keyed on slug only. If a handler creates/modifies a field and\n\t// then writes content in the same request (e.g. bulk import), the cached\n\t// list will be stale for that request. This is an edge case in normal use.\n\tconst fields = await requestCached(`mediaFields:${collectionSlug}`, () =>\n\t\tloadMediaFieldsForCollection(db, collectionSlug),\n\t);\n\tif (fields.length === 0) return { success: true, data: true };\n\n\t// Collect local media ids that need a MIME lookup\n\tconst localIds = new Set<string>();\n\tfor (const field of fields) {\n\t\tconst ref = asMediaRef(data[field.slug]);\n\t\tif (!ref) continue;\n\t\tconst provider = typeof ref.provider === \"string\" ? ref.provider : \"local\";\n\t\tif (provider === \"local\" && typeof ref.id === \"string\") {\n\t\t\tlocalIds.add(ref.id);\n\t\t}\n\t}\n\n\t// Batch-load local media MIMEs\n\tconst idList = [...localIds];\n\tconst mimeById = new Map<string, string>();\n\tif (idList.length > 0) {\n\t\tfor (const batch of chunks(idList, SQL_BATCH_SIZE)) {\n\t\t\tconst rows = await db\n\t\t\t\t.selectFrom(\"media\")\n\t\t\t\t.select([\"id\", \"mime_type\"])\n\t\t\t\t.where(\"id\", \"in\", batch)\n\t\t\t\t.execute();\n\t\t\tfor (const r of rows) mimeById.set(r.id, r.mime_type);\n\t\t}\n\t}\n\n\tfor (const field of fields) {\n\t\tconst value = data[field.slug];\n\t\tif (value === null || value === undefined) continue;\n\t\tconst ref = asMediaRef(value);\n\t\tif (!ref) continue;\n\n\t\tconst provider = typeof ref.provider === \"string\" ? ref.provider : \"local\";\n\n\t\t// External providers carry mimeType in the ref; trust it as-is.\n\t\t// Local media: look up the stored mimeType by id.\n\t\tlet mime: string | undefined;\n\t\tif (provider === \"local\") {\n\t\t\tif (typeof ref.id !== \"string\") {\n\t\t\t\treturn fail(`Field '${field.slug}' references media with an invalid id`);\n\t\t\t}\n\t\t\tmime = mimeById.get(ref.id);\n\t\t\tif (!mime) {\n\t\t\t\treturn fail(`Field '${field.slug}' references media with unknown MIME type`);\n\t\t\t}\n\t\t} else {\n\t\t\tif (typeof ref.mimeType !== \"string\") {\n\t\t\t\treturn fail(`Field '${field.slug}' requires a mimeType declaration for non-local media`);\n\t\t\t}\n\t\t\t// TODO: long-term, consider a server-side HEAD probe or provider-vouched\n\t\t\t// MIMEs for non-local refs; for now the constraint is only as strong as\n\t\t\t// the client that constructed the ref.\n\t\t\tmime = ref.mimeType;\n\t\t}\n\n\t\tif (!matchesMimeAllowlist(mime, field.allowedMimeTypes)) {\n\t\t\treturn fail(`Field '${field.slug}' does not accept ${mime}`);\n\t\t}\n\t}\n\n\treturn { success: true, data: true };\n}\n","/**\n * Content CRUD handlers\n */\n\nimport type { Kysely } from \"kysely\";\nimport { sql } from \"kysely\";\n\nimport type { ContentFieldFilters } from \"../../content-list-query.js\";\nimport { isSqlite } from \"../../database/dialect-helpers.js\";\nimport { BylineRepository } from \"../../database/repositories/byline.js\";\nimport type { ContentBylineInput } from \"../../database/repositories/byline.js\";\nimport { CommentRepository } from \"../../database/repositories/comment.js\";\nimport {\n\tContentRepository,\n\tisSystemOrderField,\n\ttype ContentRevisionPrecondition,\n} from \"../../database/repositories/content.js\";\nimport { RedirectRepository } from \"../../database/repositories/redirect.js\";\nimport { RevisionRepository } from \"../../database/repositories/revision.js\";\nimport { SeoRepository } from \"../../database/repositories/seo.js\";\nimport { TaxonomyRepository } from \"../../database/repositories/taxonomy.js\";\nimport {\n\tContentCollectionNotFoundError,\n\tContentMutationConflictError,\n\tEmDashValidationError,\n\tScheduledNotDueError,\n\tInvalidCursorError,\n\ttype BylineSummary,\n\ttype ContentBylineCredit,\n\ttype ContentBylineFilter,\n\ttype ContentDateField,\n\ttype ContentItem,\n\ttype ContentSeo,\n\ttype ContentSeoInput,\n\ttype FindManyOptions,\n} from \"../../database/repositories/types.js\";\nimport { UserRepository } from \"../../database/repositories/user.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { validateIdentifier } from \"../../database/validate.js\";\nimport { getI18nConfig, isI18nEnabled, resolveConfiguredLocale } from \"../../i18n/config.js\";\nimport { invalidateRedirectCache } from \"../../redirects/cache.js\";\nimport { FTSManager } from \"../../search/fts-manager.js\";\nimport { invalidateTermCache } from \"../../taxonomies/index.js\";\nimport { isMissingColumnError, isMissingTableError } from \"../../utils/db-errors.js\";\nimport { decodeRev, encodeRev, validateRev } from \"../rev.js\";\nimport type { ApiResult, ContentListResponse, ContentResponse } from \"../types.js\";\nimport { validateMediaFields } from \"./validate-media-fields.js\";\n\n/**\n * Narrow a caught error to one carrying a structured `apiError` discriminant.\n * Used by transaction callbacks that want to surface a specific error code\n * through the standard Error throwing path.\n */\nfunction hasApiError(error: unknown): error is Error & { apiError: { code: string } } {\n\tif (!(error instanceof Error) || !(\"apiError\" in error)) return false;\n\tconst { apiError } = error;\n\treturn (\n\t\ttypeof apiError === \"object\" &&\n\t\tapiError !== null &&\n\t\t\"code\" in apiError &&\n\t\ttypeof apiError.code === \"string\"\n\t);\n}\n\nfunction decodeRevisionPrecondition(\n\trev: string | undefined,\n): ContentRevisionPrecondition | undefined {\n\tif (rev === undefined) return undefined;\n\tconst decoded = decodeRev(rev);\n\tif (!decoded) throw new ContentMutationConflictError(\"Revision precondition did not match\");\n\treturn decoded;\n}\n\n/**\n * Extract a slug source (title or name) from content data.\n * Returns null if no suitable string field is found.\n */\nfunction getSlugSource(data: Record<string, unknown>): string | null {\n\tif (typeof data.title === \"string\" && data.title.length > 0) return data.title;\n\tif (typeof data.name === \"string\" && data.name.length > 0) return data.name;\n\treturn null;\n}\n\n/** Default SEO values for content without an explicit SEO row */\nconst SEO_DEFAULTS: ContentSeo = {\n\ttitle: null,\n\tdescription: null,\n\timage: null,\n\tcanonical: null,\n\tnoIndex: false,\n};\n\n/**\n * Check if a collection has SEO enabled.\n */\nasync function collectionHasSeo(db: Kysely<Database>, collection: string): Promise<boolean> {\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_collections\")\n\t\t.select(\"has_seo\")\n\t\t.where(\"slug\", \"=\", collection)\n\t\t.executeTakeFirst();\n\treturn row?.has_seo === 1;\n}\n\nasync function getCollectionPublishConfig(\n\tdb: Kysely<Database>,\n\tcollection: string,\n): Promise<{ supportsRevisions: boolean; routable: boolean }> {\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_collections\")\n\t\t.select([\"supports\", \"routable\"])\n\t\t.where(\"slug\", \"=\", collection)\n\t\t.executeTakeFirst();\n\tconst supports: unknown = row?.supports ? JSON.parse(row.supports) : [];\n\treturn {\n\t\tsupportsRevisions: Array.isArray(supports) && supports.includes(\"revisions\"),\n\t\troutable: row?.routable !== 0,\n\t};\n}\n\nfunction requireRoutablePublishSlug(routable: boolean, slug: string | null | undefined): void {\n\tif (routable && !slug?.trim()) {\n\t\tthrow new EmDashValidationError(\"Cannot publish routable content without a slug\");\n\t}\n}\n\n/**\n * Hydrate SEO data on a single content item if the collection has SEO enabled.\n */\nasync function hydrateSeo(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\titem: ContentItem,\n\thasSeo: boolean,\n): Promise<void> {\n\tif (!hasSeo) return;\n\tconst seoRepo = new SeoRepository(db);\n\titem.seo = await seoRepo.get(collection, item.id);\n}\n\n/**\n * Hydrate SEO data on multiple content items using a single batch query.\n */\nasync function hydrateSeoMany(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\titems: ContentItem[],\n\thasSeo: boolean,\n): Promise<void> {\n\tif (!hasSeo || items.length === 0) return;\n\tconst seoRepo = new SeoRepository(db);\n\tconst seoMap = await seoRepo.getMany(\n\t\tcollection,\n\t\titems.map((i) => i.id),\n\t);\n\tfor (const item of items) {\n\t\titem.seo = seoMap.get(item.id) ?? { ...SEO_DEFAULTS };\n\t}\n}\n\nasync function hydrateBylines(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\titem: ContentItem,\n): Promise<void> {\n\tconst bylineRepo = new BylineRepository(db);\n\t// Strict per-locale (migration 040): a credit at locale X renders iff a\n\t// byline row exists at locale X in the credited translation_group. The\n\t// junction itself spans translations; rendering does not fall back.\n\tconst localeOpt = item.locale ? { locale: item.locale } : undefined;\n\tconst bylines = await bylineRepo.getContentBylines(collection, item.id, localeOpt);\n\n\tif (bylines.length > 0) {\n\t\titem.bylines = bylines.map((c) => ({ ...c, source: \"explicit\" as const }));\n\t\titem.byline = bylines[0]?.byline ?? null;\n\t\treturn;\n\t}\n\n\t// `primaryBylineId` is set iff junction rows exist; non-null\n\t// suppresses author fallback even when the credit doesn't resolve\n\t// at this locale.\n\tif (item.primaryBylineId) {\n\t\titem.bylines = [];\n\t\titem.byline = null;\n\t\treturn;\n\t}\n\n\tif (item.authorId) {\n\t\t// Same strict-locale rule as explicit credits: a user-linked byline\n\t\t// renders on the entry only when a sibling exists at the entry's\n\t\t// locale. Without this we'd silently surface the default-locale\n\t\t// row, which contradicts the per-locale model.\n\t\tconst fallback = await bylineRepo.findByUserId(item.authorId, localeOpt);\n\t\tif (fallback) {\n\t\t\titem.bylines = [{ byline: fallback, sortOrder: 0, roleLabel: null, source: \"inferred\" }];\n\t\t\titem.byline = fallback;\n\t\t\treturn;\n\t\t}\n\t}\n\n\titem.bylines = [];\n\titem.byline = null;\n}\n\n/**\n * Batch-hydrate bylines for multiple items using two bulk queries instead of N+1.\n *\n * Items may live at different locales (e.g. a list endpoint returning the\n * translations of an entry). Group by `item.locale` and call the strict\n * per-locale repo method once per group so each item resolves against its\n * own locale's byline rows.\n */\nasync function hydrateBylinesMany(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\titems: ContentItem[],\n): Promise<void> {\n\tif (items.length === 0) return;\n\n\tconst bylineRepo = new BylineRepository(db);\n\n\t// 1. Bucket items by locale so we can call the strict-locale repo\n\t//    once per bucket. Items with a null/undefined locale (pre-i18n\n\t//    rows on a single-locale install) share an \"unscoped\" bucket.\n\tconst localeBuckets = new Map<string | null, ContentItem[]>();\n\tfor (const item of items) {\n\t\tconst key = item.locale ?? null;\n\t\tconst bucket = localeBuckets.get(key);\n\t\tif (bucket) bucket.push(item);\n\t\telse localeBuckets.set(key, [item]);\n\t}\n\n\t// 2. Per-locale: fetch explicit credits. Items whose credits don't\n\t//    resolve at this locale go through a locale-agnostic \"has any\n\t//    junction\" check before being considered for author inference —\n\t//    explicit editorial intent at any locale beats inferred fallback.\n\tconst bylinesByItem = new Map<string, ContentBylineCredit[]>();\n\tconst itemsNeedingAuthorCheck: ContentItem[] = [];\n\tfor (const [locale, bucket] of localeBuckets) {\n\t\tconst localeOpt = locale ? { locale } : undefined;\n\t\tconst ids = bucket.map((i) => i.id);\n\t\tconst credits = await bylineRepo.getContentBylinesMany(collection, ids, localeOpt);\n\t\tfor (const [id, list] of credits) bylinesByItem.set(id, list);\n\n\t\tfor (const item of bucket) {\n\t\t\tif (credits.has(item.id) && credits.get(item.id)!.length > 0) continue;\n\t\t\tif (item.authorId) itemsNeedingAuthorCheck.push(item);\n\t\t}\n\t}\n\n\t// 3. Author fallback applies only when no explicit credit exists\n\t//    (primaryBylineId null).\n\tconst fallbackByItem = new Map<string, BylineSummary>();\n\tif (itemsNeedingAuthorCheck.length > 0) {\n\t\tconst authorBuckets = new Map<string | null, ContentItem[]>();\n\t\tfor (const item of itemsNeedingAuthorCheck) {\n\t\t\tif (item.primaryBylineId) continue;\n\t\t\tconst key = item.locale ?? null;\n\t\t\tconst bucket = authorBuckets.get(key);\n\t\t\tif (bucket) bucket.push(item);\n\t\t\telse authorBuckets.set(key, [item]);\n\t\t}\n\n\t\tfor (const [locale, bucket] of authorBuckets) {\n\t\t\tconst localeOpt = locale ? { locale } : undefined;\n\t\t\tconst authorIds = bucket.map((i) => i.authorId).filter((id): id is string => id !== null);\n\t\t\tconst uniqueAuthorIds = [...new Set(authorIds)];\n\t\t\tif (uniqueAuthorIds.length === 0) continue;\n\t\t\tconst authorMap = await bylineRepo.findByUserIds(uniqueAuthorIds, localeOpt);\n\t\t\tfor (const item of bucket) {\n\t\t\t\tif (!item.authorId) continue;\n\t\t\t\tconst f = authorMap.get(item.authorId);\n\t\t\t\tif (f) fallbackByItem.set(item.id, f);\n\t\t\t}\n\t\t}\n\t}\n\n\t// 4. Assign to each item.\n\tfor (const item of items) {\n\t\tconst explicit = bylinesByItem.get(item.id);\n\t\tif (explicit && explicit.length > 0) {\n\t\t\titem.bylines = explicit.map((c) => ({ ...c, source: \"explicit\" as const }));\n\t\t\titem.byline = explicit[0]?.byline ?? null;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst fallback = fallbackByItem.get(item.id);\n\t\tif (fallback) {\n\t\t\titem.bylines = [{ byline: fallback, sortOrder: 0, roleLabel: null, source: \"inferred\" }];\n\t\t\titem.byline = fallback;\n\t\t\tcontinue;\n\t\t}\n\n\t\titem.bylines = [];\n\t\titem.byline = null;\n\t}\n}\n\n/**\n * Resolve an identifier (ID or slug) to a real content ID.\n * Returns the ID if found, null if not found.\n * When locale is provided, slug lookups are scoped to that locale.\n */\nasync function resolveId(\n\trepo: ContentRepository,\n\tcollection: string,\n\tidentifier: string,\n\tlocale?: string,\n): Promise<string | null> {\n\tconst item = await repo.findByIdOrSlug(\n\t\tcollection,\n\t\tidentifier,\n\t\tlocale ? resolveConfiguredLocale(locale) : undefined,\n\t);\n\treturn item?.id ?? null;\n}\n\n/**\n * Resolve an identifier (ID or slug) to a real content ID,\n * including trashed (soft-deleted) items.\n */\nasync function resolveIdIncludingTrashed(\n\trepo: ContentRepository,\n\tcollection: string,\n\tidentifier: string,\n\tlocale?: string,\n): Promise<string | null> {\n\tconst item = await repo.findByIdOrSlugIncludingTrashed(\n\t\tcollection,\n\t\tidentifier,\n\t\tlocale ? resolveConfiguredLocale(locale) : undefined,\n\t);\n\treturn item?.id ?? null;\n}\n\n/**\n * Trashed content item with deletion timestamp\n */\nexport interface TrashedContentItem {\n\tid: string;\n\ttype: string;\n\tslug: string | null;\n\tstatus: string;\n\tlocale: string | null;\n\ttranslationGroup: string | null;\n\tdata: Record<string, unknown>;\n\tauthorId: string | null;\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tpublishedAt: string | null;\n\tdeletedAt: string;\n}\n\n/**\n * Resolve the columns a content-list search should match against. Always\n * includes `slug` (a standard column), adds the configured `titleField` plus\n * the `title`/`name` display fields when the collection actually defines them,\n * mirroring the admin's item-title resolution (titleField -> title -> name ->\n * slug), and includes every field explicitly marked searchable. Returning only\n * schema-backed columns avoids \"no such column\" errors.\n */\nasync function resolveSearchColumns(db: Kysely<Database>, collection: string): Promise<string[]> {\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_collections\")\n\t\t.select([\"id\", \"title_field\"])\n\t\t.where(\"slug\", \"=\", collection)\n\t\t.executeTakeFirst();\n\tif (!row) return [\"slug\"];\n\n\tconst fields = await db\n\t\t.selectFrom(\"_emdash_fields\")\n\t\t.select([\"slug\", \"searchable\"])\n\t\t.where(\"collection_id\", \"=\", row.id)\n\t\t.orderBy(\"sort_order\", \"asc\")\n\t\t.execute();\n\tconst columns = new Set([\"slug\"]);\n\tconst fieldSlugs = new Set(fields.map((f) => f.slug));\n\n\t// A configured titleField takes precedence, then the conventional\n\t// title/name fields. A null title_field falls through to those defaults.\n\tif (row.title_field && fieldSlugs.has(row.title_field)) columns.add(row.title_field);\n\tfor (const candidate of [\"title\", \"name\"]) {\n\t\tif (fieldSlugs.has(candidate)) columns.add(candidate);\n\t}\n\tfor (const field of fields) {\n\t\tif (field.searchable === 1) columns.add(field.slug);\n\t}\n\treturn [...columns];\n}\n\n/**\n * Decide whether the content-list `q` filter can be served from the\n * collection's FTS5 index instead of a full-scan substring LIKE (#1517).\n *\n * Requires SQLite (FTS5 is SQLite-only), search enabled on the collection,\n * every non-slug display column present in the searchable-field set (or the\n * index would miss matches the LIKE finds), and the index table actually\n * existing.\n */\nasync function canUseFtsForListFilter(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tsearchColumns: string[],\n): Promise<boolean> {\n\tif (!isSqlite(db)) return false;\n\tconst ftsManager = new FTSManager(db);\n\tconst config = await ftsManager.getSearchConfig(collection);\n\tif (!config?.enabled) return false;\n\tconst searchable = new Set(await ftsManager.getSearchableFields(collection));\n\tconst covered = searchColumns.every((col) => col === \"slug\" || searchable.has(col));\n\tif (!covered) return false;\n\treturn ftsManager.ftsTableExists(collection);\n}\n\n/**\n * Create a 301 auto-redirect from an entry's old URL to its new one after a\n * slug change, using the collection's URL pattern. Shared by\n * handleContentUpdate (direct slug edits) and handleContentPublish (slug edits\n * staged as `_slug` in a draft revision, which only land on publish).\n */\nasync function createSlugChangeRedirect(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\toldSlug: string,\n\tnewSlug: string,\n\tcontentId: string,\n): Promise<void> {\n\t// A URL pattern has no locale token, so every locale variant of an entry\n\t// generates the same URL, and slugs are unique per (slug, locale) — a\n\t// translation may still hold the old slug. Redirecting away from a URL\n\t// another row still answers on would take that page down: the redirect\n\t// middleware runs `order: \"pre\"`, so routing never gets a chance.\n\t// Any surviving row counts, published or not: a draft that publishes later\n\t// would otherwise be shadowed by the redirect.\n\tif (await slugStillTaken(db, collection, oldSlug, contentId)) return;\n\n\tconst collectionRow = await db\n\t\t.selectFrom(\"_emdash_collections\")\n\t\t.select(\"url_pattern\")\n\t\t.where(\"slug\", \"=\", collection)\n\t\t.executeTakeFirst();\n\n\tconst redirectRepo = new RedirectRepository(db);\n\tawait redirectRepo.createAutoRedirect(\n\t\tcollection,\n\t\toldSlug,\n\t\tnewSlug,\n\t\tcontentId,\n\t\tcollectionRow?.url_pattern ?? null,\n\t);\n\tinvalidateRedirectCache();\n}\n\n/** Whether a row other than `contentId` still holds `slug` in this collection. */\nasync function slugStillTaken(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tslug: string,\n\tcontentId: string,\n): Promise<boolean> {\n\tvalidateIdentifier(collection, \"collection slug\");\n\tconst result = await sql<{ id: string }>`\n\t\tSELECT id FROM ${sql.ref(`ec_${collection}`)}\n\t\tWHERE slug = ${slug}\n\t\tAND id != ${contentId}\n\t\tAND deleted_at IS NULL\n\t\tLIMIT 1\n\t`.execute(db);\n\treturn result.rows.length > 0;\n}\n\n/** Matches a date-only `YYYY-MM-DD` bound (no time component). */\nconst DATE_ONLY_RE = /^\\d{4}-\\d{2}-\\d{2}$/;\n\n/**\n * Normalize a date-range bound to an ISO datetime for lexicographic comparison\n * against stored ISO 8601 timestamps. A bare `YYYY-MM-DD` is widened to the\n * appropriate UTC day boundary so the range stays inclusive: a `start` bound\n * becomes the start of the day and an `end` bound the end of the day.\n * Otherwise a date-only upper bound would exclude every same-day row (since\n * `2024-06-01T12:00:00Z` sorts after `2024-06-01`). Full datetimes pass\n * through unchanged.\n */\nfunction normalizeDateBound(value: string | undefined, edge: \"start\" | \"end\"): string | undefined {\n\tif (!value) return undefined;\n\tif (!DATE_ONLY_RE.test(value)) return value;\n\treturn edge === \"start\" ? `${value}T00:00:00.000Z` : `${value}T23:59:59.999Z`;\n}\n\n/**\n * Build the repository's byline filter from the wire params.\n *\n * `locale` is the locale the list is scoped to, which is the locale an\n * inferred credit has to resolve at — the admin list is always scoped to the\n * locale picked in its switcher.\n */\nfunction resolveBylineFilter(\n\tparams: { bylines?: string[]; bylinesNone?: boolean; includeInferredBylines?: boolean },\n\tlocale: string | undefined,\n): ContentBylineFilter | undefined {\n\tconst includeInferred = params.includeInferredBylines === true;\n\n\tif (params.bylinesNone) return { mode: \"none\", includeInferred, locale };\n\n\tconst bylineIds = params.bylines ?? [];\n\tif (bylineIds.length === 0) return undefined;\n\n\treturn { mode: \"any\", bylineIds, includeInferred, locale };\n}\n\n/**\n * Create content list handler\n */\nexport async function handleContentList(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tparams: {\n\t\tcursor?: string;\n\t\tlimit?: number;\n\t\tstatus?: string;\n\t\torderBy?: string;\n\t\torder?: \"asc\" | \"desc\";\n\t\tlocale?: string;\n\t\tq?: string;\n\t\tauthorId?: string;\n\t\tdateField?: ContentDateField;\n\t\tdateFrom?: string;\n\t\tdateTo?: string;\n\t\tbylines?: string[];\n\t\tbylinesNone?: boolean;\n\t\tincludeInferredBylines?: boolean;\n\t\tfieldFilters?: ContentFieldFilters;\n\t},\n): Promise<ApiResult<ContentListResponse>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst where: FindManyOptions[\"where\"] = {};\n\t\tif (params.status) where.status = params.status;\n\t\tconst locale = params.locale ? resolveConfiguredLocale(params.locale) : undefined;\n\t\tif (locale) where.locale = locale;\n\t\tif (params.authorId) where.authorId = params.authorId;\n\t\tif (params.fieldFilters && Object.keys(params.fieldFilters).length > 0) {\n\t\t\twhere.fieldFilters = params.fieldFilters;\n\t\t}\n\n\t\tconst bylineFilter = resolveBylineFilter(params, locale);\n\t\tif (bylineFilter) where.bylineFilter = bylineFilter;\n\n\t\t// A date range requires a target column; ignore stray from/to without\n\t\t// a field so a half-specified filter doesn't silently drop all rows.\n\t\tif (params.dateField && (params.dateFrom || params.dateTo)) {\n\t\t\twhere.dateFilter = {\n\t\t\t\tfield: params.dateField,\n\t\t\t\tfrom: normalizeDateBound(params.dateFrom, \"start\"),\n\t\t\t\tto: normalizeDateBound(params.dateTo, \"end\"),\n\t\t\t};\n\t\t}\n\n\t\tconst q = params.q?.trim();\n\t\tif (q) {\n\t\t\twhere.q = q;\n\t\t\twhere.searchColumns = await resolveSearchColumns(db, collection);\n\t\t\twhere.useFts = await canUseFtsForListFilter(db, collection, where.searchColumns);\n\t\t}\n\n\t\t// Sorting by a non-system field (a collection's titleField/dateField)\n\t\t// needs the collection's *actual* sort fields resolved server-side,\n\t\t// so the orderBy set stays closed. Only query when it's not a system field.\n\t\tlet sortableExtras: string[] | undefined;\n\t\tif (params.orderBy && !isSystemOrderField(params.orderBy)) {\n\t\t\tconst coll = await db\n\t\t\t\t.selectFrom(\"_emdash_collections\")\n\t\t\t\t.select([\"title_field\", \"date_field\"])\n\t\t\t\t.where(\"slug\", \"=\", collection)\n\t\t\t\t.executeTakeFirst();\n\t\t\tsortableExtras = [coll?.title_field, coll?.date_field].filter(\n\t\t\t\t(slug): slug is string => !!slug,\n\t\t\t);\n\t\t}\n\n\t\tconst result = await repo.findMany(collection, {\n\t\t\tcursor: params.cursor,\n\t\t\tlimit: params.limit || 50,\n\t\t\twhere: Object.keys(where).length > 0 ? where : undefined,\n\t\t\torderBy: params.orderBy\n\t\t\t\t? { field: params.orderBy, direction: params.order || \"desc\" }\n\t\t\t\t: undefined,\n\t\t\tsortableExtras,\n\t\t});\n\n\t\t// Hydrate SEO data if the collection has SEO enabled\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeoMany(db, collection, result.items, hasSeo);\n\t\tawait hydrateBylinesMany(db, collection, result.items);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\titems: result.items,\n\t\t\t\tnextCursor: result.nextCursor,\n\t\t\t\ttotal: result.total,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tif (error instanceof ContentCollectionNotFoundError || isMissingTableError(error)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"COLLECTION_NOT_FOUND\",\n\t\t\t\t\tmessage: `Collection '${collection}' not found`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (isMissingColumnError(error, \"deleted_at\")) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"COLLECTION_SCHEMA_MISMATCH\",\n\t\t\t\t\tmessage: `Collection '${collection}' backing table is missing the 'deleted_at' column`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\t// e.g. invalid orderBy field\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"VALIDATION_ERROR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content list error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/** A content author option for the admin author filter. */\nexport interface ContentAuthor {\n\tid: string;\n\tname: string | null;\n\temail: string;\n\tavatarUrl: string | null;\n}\n\n/**\n * List the distinct authors of a collection's live content.\n *\n * Backs the admin content-list author filter. Unlike `/admin/users` (ADMIN\n * only), this is gated on `content:read`, so any editor can filter by author.\n * Returns only users who have authored at least one non-trashed entry, sorted\n * by display name then email for a stable dropdown order.\n */\nexport async function handleContentAuthors(\n\tdb: Kysely<Database>,\n\tcollection: string,\n): Promise<ApiResult<{ items: ContentAuthor[] }>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst authorIds = await repo.findDistinctAuthorIds(collection);\n\t\tif (authorIds.length === 0) {\n\t\t\treturn { success: true, data: { items: [] } };\n\t\t}\n\n\t\tconst userRepo = new UserRepository(db);\n\t\tconst users = await userRepo.findByIds(authorIds);\n\n\t\tconst items: ContentAuthor[] = users\n\t\t\t.map((u) => ({ id: u.id, name: u.name, email: u.email, avatarUrl: u.avatarUrl }))\n\t\t\t.toSorted((a, b) => (a.name ?? a.email).localeCompare(b.name ?? b.email));\n\n\t\treturn { success: true, data: { items } };\n\t} catch (error) {\n\t\tif (isMissingTableError(error)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"COLLECTION_NOT_FOUND\",\n\t\t\t\t\tmessage: `Collection '${collection}' not found`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content authors error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_AUTHORS_ERROR\",\n\t\t\t\tmessage: \"Failed to list content authors\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get single content item\n */\nexport async function handleContentGet(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\tlocale?: string,\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst item = await repo.findByIdOrSlug(\n\t\t\tcollection,\n\t\t\tid,\n\t\t\tlocale ? resolveConfiguredLocale(locale) : undefined,\n\t\t);\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Content item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Hydrate SEO data if the collection has SEO enabled\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeo(db, collection, item, hasSeo);\n\t\tawait hydrateBylines(db, collection, item);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content get error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get a content item by id, including trashed items.\n * Used by restore endpoint for ownership checks on soft-deleted items.\n */\nexport async function handleContentGetIncludingTrashed(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\tlocale?: string,\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst item = await repo.findByIdOrSlugIncludingTrashed(\n\t\t\tcollection,\n\t\t\tid,\n\t\t\tlocale ? resolveConfiguredLocale(locale) : undefined,\n\t\t);\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Content item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Hydrate SEO data if the collection has SEO enabled\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeo(db, collection, item, hasSeo);\n\t\tawait hydrateBylines(db, collection, item);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content get error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Create content item.\n *\n * Content + SEO writes are wrapped in a transaction so either both succeed\n * or neither does. If `body.seo` is provided for a non-SEO collection, the\n * API returns a validation error rather than silently dropping it.\n */\nexport async function handleContentCreate(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tbody: {\n\t\tdata: Record<string, unknown>;\n\t\tslug?: string | null;\n\t\tstatus?: string;\n\t\tauthorId?: string;\n\t\tbylines?: ContentBylineInput[];\n\t\tlocale?: string;\n\t\ttranslationOf?: string;\n\t\tseo?: ContentSeoInput;\n\t\ttaxonomies?: Record<string, string[]>;\n\t\tcreatedAt?: string | null;\n\t\tpublishedAt?: string | null;\n\t},\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\n\t\t// Reject SEO input for non-SEO collections\n\t\tif (body.seo && !hasSeo) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: `Collection \"${collection}\" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst mimeCheck = await validateMediaFields(db, collection, body.data);\n\t\tif (!mimeCheck.success) return mimeCheck;\n\n\t\t// Wrap content + SEO writes in a transaction for atomicity\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst bylineRepo = new BylineRepository(trx);\n\n\t\t\t// Default to the configured site locale rather than the repo's\n\t\t\t// hard-coded \"en\" — otherwise non-English default-locale sites\n\t\t\t// silently create entries in a locale the editor never chose.\n\t\t\tconst effectiveLocale = body.locale\n\t\t\t\t? resolveConfiguredLocale(body.locale)\n\t\t\t\t: getI18nConfig()?.defaultLocale;\n\n\t\t\tlet slug: string | null | undefined = body.slug;\n\t\t\tif (!slug) {\n\t\t\t\tconst slugSource = getSlugSource(body.data);\n\t\t\t\tif (slugSource) {\n\t\t\t\t\tslug = await repo.generateUniqueSlug(collection, slugSource, effectiveLocale);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (body.status === \"published\") {\n\t\t\t\tconst publishConfig = await getCollectionPublishConfig(trx, collection);\n\t\t\t\trequireRoutablePublishSlug(publishConfig.routable, slug);\n\t\t\t}\n\n\t\t\tconst created = await repo.create({\n\t\t\t\ttype: collection,\n\t\t\t\tslug,\n\t\t\t\tdata: body.data,\n\t\t\t\tstatus: body.status || \"draft\",\n\t\t\t\tauthorId: body.authorId,\n\t\t\t\tlocale: effectiveLocale,\n\t\t\t\ttranslationOf: body.translationOf,\n\t\t\t\tcreatedAt: body.createdAt,\n\t\t\t\tpublishedAt: body.publishedAt,\n\t\t\t});\n\n\t\t\tif (body.bylines !== undefined) {\n\t\t\t\tconst credits = await bylineRepo.setContentBylines(collection, created.id, body.bylines);\n\t\t\t\t// `setContentBylines` translates wire row ids to their\n\t\t\t\t// `translation_group` before writing. The response-shape\n\t\t\t\t// `primaryBylineId` must match what's now in the DB, so read\n\t\t\t\t// it from the returned credit (whose `byline` came from a\n\t\t\t\t// hydration round-trip).\n\t\t\t\tcreated.primaryBylineId = credits[0]?.byline.translationGroup ?? null;\n\t\t\t}\n\n\t\t\t// Taxonomy assignments already belong to the content translation\n\t\t\t// group. Byline credits remain per content row and need copying.\n\t\t\t// Explicit `body.bylines` wins — `copyContentBylines` no-ops\n\t\t\t// when the target already has credits, but the cleaner guard\n\t\t\t// is to skip the call entirely.\n\t\t\tif (body.translationOf) {\n\t\t\t\tif (body.bylines === undefined) {\n\t\t\t\t\tawait bylineRepo.copyContentBylines(collection, body.translationOf, created.id);\n\t\t\t\t\t// `copyContentBylines` writes the source's primary\n\t\t\t\t\t// pointer onto the new row; reflect it in-memory so the\n\t\t\t\t\t// response includes it before hydrateBylines runs.\n\t\t\t\t\tconst source = await repo.findById(collection, body.translationOf);\n\t\t\t\t\tif (source) created.primaryBylineId = source.primaryBylineId;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait hydrateBylines(trx, collection, created);\n\n\t\t\t// Side-write SEO data if provided\n\t\t\tif (body.seo && hasSeo) {\n\t\t\t\tconst seoRepo = new SeoRepository(trx);\n\t\t\t\tcreated.seo = await seoRepo.upsert(collection, created.id, body.seo);\n\t\t\t} else if (hasSeo) {\n\t\t\t\t// Assign defaults in-memory — no DB round-trip needed\n\t\t\t\tcreated.seo = { ...SEO_DEFAULTS };\n\t\t\t}\n\n\t\t\t// Attach taxonomy terms in the same transaction. The MCP tool\n\t\t\t// (and the REST create body) previously accepted a `taxonomies`\n\t\t\t// field on `content_create` without doing anything with it, so\n\t\t\t// agents publishing a categorized/tagged entry had to make N\n\t\t\t// follow-up REST calls per taxonomy. This resolves each slug in\n\t\t\t// the entry's locale and pipes it through the same\n\t\t\t// `setTermsForEntry` path the `.../terms/{taxonomy}` REST route\n\t\t\t// uses, so the two entry points can't drift.\n\t\t\tif (body.taxonomies) {\n\t\t\t\tawait assignTaxonomies(trx, collection, created.id, effectiveLocale, body.taxonomies);\n\t\t\t}\n\n\t\t\treturn created;\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tif (isMissingTableError(error)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"COLLECTION_NOT_FOUND\",\n\t\t\t\t\tmessage: `Collection '${collection}' not found`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"VALIDATION_ERROR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\t// SQLite UNIQUE constraint OR Postgres unique_violation — slug\n\t\t// collisions and any other unique violations land here. Match\n\t\t// specifically on \"unique constraint failed\" / \"duplicate key\" so we\n\t\t// don't false-positive on NOT NULL or CHECK violations whose\n\t\t// messages also contain \"constraint failed\".\n\t\tconst message = error instanceof Error ? error.message.toLowerCase() : \"\";\n\t\tif (message.includes(\"unique constraint failed\") || message.includes(\"duplicate key\")) {\n\t\t\t// Detect slug-specific collisions by message fingerprint\n\t\t\tif (message.includes(\"slug\")) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"SLUG_CONFLICT\",\n\t\t\t\t\t\tmessage: `Slug '${body.slug ?? \"(auto-generated)\"}' already exists in collection '${collection}'`,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\t\tmessage: \"Unique constraint violation\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content create error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Update content item.\n * If `_rev` is provided, validates it against the current version before writing.\n * No `_rev` = blind write (backwards-compatible for admin UI).\n *\n * Content + SEO writes are wrapped in a transaction for atomicity.\n */\nexport async function handleContentUpdate(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\tbody: {\n\t\tdata?: Record<string, unknown>;\n\t\tslug?: string | null;\n\t\tstatus?: string;\n\t\tauthorId?: string | null;\n\t\tbylines?: ContentBylineInput[];\n\t\tlocale?: string;\n\t\t_rev?: string;\n\t\tseo?: ContentSeoInput;\n\t\ttaxonomies?: Record<string, string[]>;\n\t\tpublishedAt?: string | null;\n\t},\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\n\t\t// Reject SEO input for non-SEO collections\n\t\tif (body.seo && !hasSeo) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: `Collection \"${collection}\" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tif (body.data) {\n\t\t\tconst mimeCheck = await validateMediaFields(db, collection, body.data);\n\t\t\tif (!mimeCheck.success) return mimeCheck;\n\t\t}\n\n\t\tconst repo = new ContentRepository(db);\n\n\t\t// Resolve slug → ID if needed\n\t\tconst resolvedId = (await resolveId(repo, collection, id, body.locale)) ?? id;\n\n\t\t// Wrap content + SEO writes in a transaction for atomicity.\n\t\t// The _rev check is inside the transaction so the read-then-write\n\t\t// is atomic -- no concurrent write can slip between the check and update.\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst trxRepo = new ContentRepository(trx);\n\t\t\tconst bylineRepo = new BylineRepository(trx);\n\n\t\t\t// Read existing item once for both _rev check and old slug capture\n\t\t\tconst existing =\n\t\t\t\tbody._rev || body.slug !== undefined || body.status === \"published\"\n\t\t\t\t\t? await trxRepo.findById(collection, resolvedId)\n\t\t\t\t\t: null;\n\n\t\t\t// Validate _rev if provided (optimistic concurrency)\n\t\t\tif (body._rev) {\n\t\t\t\tif (!existing) {\n\t\t\t\t\tthrow Object.assign(new Error(`Content item not found: ${id}`), {\n\t\t\t\t\t\tapiError: { code: \"NOT_FOUND\" as const },\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\tconst revCheck = validateRev(body._rev, existing);\n\t\t\t\tif (!revCheck.valid) {\n\t\t\t\t\tthrow Object.assign(new Error(revCheck.message), {\n\t\t\t\t\t\tapiError: { code: \"CONFLICT\" as const },\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Capture old slug before update for auto-redirect\n\t\t\tlet oldSlug: string | undefined;\n\t\t\tif (body.slug && existing?.slug && existing.slug !== body.slug) {\n\t\t\t\toldSlug = existing.slug;\n\t\t\t}\n\n\t\t\tconst resultingStatus = body.status ?? existing?.status;\n\t\t\tif (resultingStatus === \"published\") {\n\t\t\t\tif (!existing) {\n\t\t\t\t\tthrow Object.assign(new Error(`Content item not found: ${id}`), {\n\t\t\t\t\t\tapiError: { code: \"NOT_FOUND\" as const },\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tconst publishConfig = await getCollectionPublishConfig(trx, collection);\n\t\t\t\tconst intendedSlug = body.slug !== undefined ? body.slug : existing.slug;\n\t\t\t\trequireRoutablePublishSlug(publishConfig.routable, intendedSlug);\n\t\t\t}\n\n\t\t\tconst updated = await trxRepo.update(collection, resolvedId, {\n\t\t\t\tdata: body.data,\n\t\t\t\tslug: body.slug,\n\t\t\t\tstatus: body.status,\n\t\t\t\tauthorId: body.authorId,\n\t\t\t\tpublishedAt: body.publishedAt,\n\t\t\t});\n\n\t\t\tif (body.bylines !== undefined) {\n\t\t\t\tconst credits = await bylineRepo.setContentBylines(collection, resolvedId, body.bylines);\n\t\t\t\t// `setContentBylines` translates wire row ids to their\n\t\t\t\t// `translation_group` before writing. Read the in-memory\n\t\t\t\t// pointer from the persisted credit so the response shape\n\t\t\t\t// matches the DB. See the matching block in handleContentCreate.\n\t\t\t\tupdated.primaryBylineId = credits[0]?.byline.translationGroup ?? null;\n\t\t\t}\n\n\t\t\t// Create auto-redirect when slug changes\n\t\t\tif (oldSlug && body.slug) {\n\t\t\t\tawait createSlugChangeRedirect(trx, collection, oldSlug, body.slug, resolvedId);\n\t\t\t}\n\n\t\t\t// Sync non-translatable fields to sibling locales in the same\n\t\t\t// translation group. Only runs when i18n is enabled, data was updated,\n\t\t\t// and the item belongs to a translation group with siblings.\n\t\t\tif (isI18nEnabled() && body.data && updated.translationGroup) {\n\t\t\t\tawait syncNonTranslatableFields(\n\t\t\t\t\ttrx,\n\t\t\t\t\tcollection,\n\t\t\t\t\tupdated.id,\n\t\t\t\t\tupdated.translationGroup,\n\t\t\t\t\tbody.data,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Side-write SEO data if provided, always hydrate for SEO-enabled collections\n\t\t\tif (body.seo && hasSeo) {\n\t\t\t\tconst seoRepo = new SeoRepository(trx);\n\t\t\t\tupdated.seo = await seoRepo.upsert(collection, resolvedId, body.seo);\n\t\t\t} else if (hasSeo) {\n\t\t\t\tconst seoRepo = new SeoRepository(trx);\n\t\t\t\tupdated.seo = await seoRepo.get(collection, resolvedId);\n\t\t\t}\n\n\t\t\tawait hydrateBylines(trx, collection, updated);\n\n\t\t\t// Replace taxonomy assignments in the same transaction. Uses the\n\t\t\t// entry's own locale (post-update) to resolve slugs so an update\n\t\t\t// that also changes locale still lands on the correct term\n\t\t\t// variants. See handleContentCreate for rationale.\n\t\t\tif (body.taxonomies) {\n\t\t\t\tawait assignTaxonomies(\n\t\t\t\t\ttrx,\n\t\t\t\t\tcollection,\n\t\t\t\t\tresolvedId,\n\t\t\t\t\tupdated.locale ?? body.locale,\n\t\t\t\t\tbody.taxonomies,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn updated;\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\t// Handle structured errors thrown from inside the transaction\n\t\t// (rev check failures, not-found)\n\t\tif (hasApiError(error)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: error.apiError.code, message: error.message },\n\t\t\t};\n\t\t}\n\t\tif (isMissingTableError(error)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"COLLECTION_NOT_FOUND\",\n\t\t\t\t\tmessage: `Collection '${collection}' not found`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"VALIDATION_ERROR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tconst message = error instanceof Error ? error.message.toLowerCase() : \"\";\n\t\tif (message.includes(\"unique constraint failed\") || message.includes(\"duplicate key\")) {\n\t\t\tif (message.includes(\"slug\")) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"SLUG_CONFLICT\",\n\t\t\t\t\t\tmessage: `Slug '${body.slug ?? id}' already exists in collection '${collection}'`,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\t\tmessage: \"Unique constraint violation\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content update error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_UPDATE_ERROR\",\n\t\t\t\tmessage: \"Failed to update content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Duplicate content item.\n *\n * Only copies SEO data if the collection has SEO enabled.\n * Always returns consistent `seo` shape for SEO-enabled collections.\n */\nexport async function handleContentDuplicate(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\tauthorId?: string,\n): Promise<ApiResult<{ item: ContentItem }>> {\n\ttry {\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\n\t\t// Wrap duplicate + SEO copy in a transaction for atomicity\n\t\tconst duplicate = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst bylineRepo = new BylineRepository(trx);\n\t\t\tconst resolvedId = (await resolveId(repo, collection, id)) ?? id;\n\t\t\tconst dup = await repo.duplicate(collection, resolvedId, authorId);\n\n\t\t\tconst existingBylines = await bylineRepo.getContentBylines(collection, resolvedId);\n\t\t\tif (existingBylines.length > 0) {\n\t\t\t\tawait bylineRepo.setContentBylines(\n\t\t\t\t\tcollection,\n\t\t\t\t\tdup.id,\n\t\t\t\t\texistingBylines.map((entry) => ({\n\t\t\t\t\t\tbylineId: entry.byline.id,\n\t\t\t\t\t\troleLabel: entry.roleLabel,\n\t\t\t\t\t})),\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tif (hasSeo) {\n\t\t\t\t// Copy SEO data from the original (clears canonical)\n\t\t\t\tconst seoRepo = new SeoRepository(trx);\n\t\t\t\tawait seoRepo.copyForDuplicate(collection, resolvedId, dup.id);\n\t\t\t\t// Always hydrate SEO for consistent response shape\n\t\t\t\tdup.seo = await seoRepo.get(collection, dup.id);\n\t\t\t}\n\n\t\t\tawait hydrateBylines(trx, collection, dup);\n\n\t\t\treturn dup;\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item: duplicate },\n\t\t};\n\t} catch (err) {\n\t\tif (err instanceof EmDashValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: err.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content duplicate error:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_DUPLICATE_ERROR\",\n\t\t\t\tmessage: \"Failed to duplicate content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete content item (soft delete - moves to trash)\n */\nexport async function handleContentDelete(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n): Promise<ApiResult<{ deleted: true; id: string }>> {\n\ttry {\n\t\tconst result = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst resolvedId = (await resolveId(repo, collection, id)) ?? id;\n\t\t\treturn {\n\t\t\t\tid: resolvedId,\n\t\t\t\tdeleted: await repo.delete(collection, resolvedId),\n\t\t\t};\n\t\t});\n\n\t\tif (!result.deleted) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Content item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { deleted: true, id: result.id },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content delete error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Restore content item from trash\n */\nexport async function handleContentRestore(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n): Promise<ApiResult<{ restored: true; item: ContentItem }>> {\n\ttry {\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst resolvedId = (await resolveIdIncludingTrashed(repo, collection, id)) ?? id;\n\t\t\treturn repo.restore(collection, resolvedId);\n\t\t});\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Trashed content item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { restored: true, item },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content restore error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_RESTORE_ERROR\",\n\t\t\t\tmessage: \"Failed to restore content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Permanently delete content item (cannot be undone).\n * Also cleans up associated SEO data.\n */\nexport async function handleContentPermanentDelete(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n): Promise<ApiResult<{ deleted: true; id: string }>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst resolvedId = (await resolveIdIncludingTrashed(repo, collection, id)) ?? id;\n\n\t\t// Wrap content delete + SEO/comment cleanup in a transaction\n\t\tconst deleted = await withTransaction(db, async (trx) => {\n\t\t\tconst trxRepo = new ContentRepository(trx);\n\t\t\tconst wasDeleted = await trxRepo.permanentDelete(collection, resolvedId);\n\n\t\t\tif (wasDeleted) {\n\t\t\t\t// Clean up SEO data for permanently deleted content\n\t\t\t\tconst seoRepo = new SeoRepository(trx);\n\t\t\t\tawait seoRepo.delete(collection, resolvedId);\n\t\t\t\t// Clean up comments for permanently deleted content\n\t\t\t\tconst commentRepo = new CommentRepository(trx);\n\t\t\t\tawait commentRepo.deleteByContent(collection, resolvedId);\n\t\t\t\t// Clean up revisions for permanently deleted content\n\t\t\t\tconst revisionRepo = new RevisionRepository(trx);\n\t\t\t\tawait revisionRepo.deleteByEntry(collection, resolvedId);\n\t\t\t}\n\n\t\t\treturn wasDeleted;\n\t\t});\n\n\t\tif (!deleted) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Content item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { deleted: true, id: resolvedId },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content permanent delete error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to permanently delete content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List trashed content items\n */\nexport async function handleContentListTrashed(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\toptions: { limit?: number; cursor?: string; locale?: string } = {},\n): Promise<ApiResult<{ items: TrashedContentItem[]; nextCursor?: string }>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst result = await repo.findTrashed(collection, {\n\t\t\tlimit: options.limit,\n\t\t\tcursor: options.cursor,\n\t\t\twhere: { locale: options.locale },\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\titems: result.items.map((item) => ({\n\t\t\t\t\tid: item.id,\n\t\t\t\t\ttype: item.type,\n\t\t\t\t\tslug: item.slug,\n\t\t\t\t\tstatus: item.status,\n\t\t\t\t\tlocale: item.locale,\n\t\t\t\t\ttranslationGroup: item.translationGroup,\n\t\t\t\t\tdata: item.data,\n\t\t\t\t\tauthorId: item.authorId,\n\t\t\t\t\tcreatedAt: item.createdAt,\n\t\t\t\t\tupdatedAt: item.updatedAt,\n\t\t\t\t\tpublishedAt: item.publishedAt,\n\t\t\t\t\tdeletedAt: item.deletedAt,\n\t\t\t\t})),\n\t\t\t\tnextCursor: result.nextCursor,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content list trashed error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list trashed content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Count trashed content items\n */\nexport async function handleContentCountTrashed(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\toptions: { locale?: string } = {},\n): Promise<ApiResult<{ count: number }>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst count = await repo.countTrashed(collection, { locale: options.locale });\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { count },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content count trashed error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_COUNT_ERROR\",\n\t\t\t\tmessage: \"Failed to count trashed content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Schedule content for future publishing\n */\nexport async function handleContentSchedule(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\tscheduledAt: string,\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst existing = await repo.findByIdOrSlug(collection, id);\n\t\t\tconst resolvedId = existing?.id ?? id;\n\t\t\tif (existing) {\n\t\t\t\tconst publishConfig = await getCollectionPublishConfig(trx, collection);\n\t\t\t\trequireRoutablePublishSlug(publishConfig.routable, existing.slug);\n\t\t\t}\n\t\t\treturn repo.schedule(collection, resolvedId, scheduledAt);\n\t\t});\n\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeo(db, collection, item, hasSeo);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content schedule error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_SCHEDULE_ERROR\",\n\t\t\t\tmessage: \"Failed to schedule content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Unschedule content (revert to draft)\n */\nexport async function handleContentUnschedule(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst resolvedId = (await resolveId(repo, collection, id)) ?? id;\n\t\t\treturn repo.unschedule(collection, resolvedId);\n\t\t});\n\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeo(db, collection, item, hasSeo);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content unschedule error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_UNSCHEDULE_ERROR\",\n\t\t\t\tmessage: \"Failed to unschedule content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Publish content immediately.\n *\n * Publication is one atomic content-row statement. On databases that support\n * transactions, the existing slug-redirect side write remains grouped with it.\n */\nexport async function handleContentPublish(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\toptions: {\n\t\tpublishedAt?: string;\n\t\trequireScheduledDue?: boolean;\n\t\texpectedScheduledAt?: string;\n\t\t_rev?: string;\n\t} = {},\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst expectedRevision = decodeRevisionPrecondition(options._rev);\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst resolvedId = (await resolveId(repo, collection, id)) ?? id;\n\t\t\tconst publishConfig = await getCollectionPublishConfig(trx, collection);\n\n\t\t\t// Capture the pre-publish state. For revision-supporting collections a\n\t\t\t// slug edit is staged as `_slug` in the draft revision and only lands\n\t\t\t// on the live `slug` column here, inside `repo.publish()` — it never\n\t\t\t// passes through handleContentUpdate, where slug-change auto-redirects\n\t\t\t// are normally created.\n\t\t\tconst existing = await repo.findById(collection, resolvedId);\n\n\t\t\tconst published = await repo.publish(\n\t\t\t\tcollection,\n\t\t\t\tresolvedId,\n\t\t\t\toptions.publishedAt,\n\t\t\t\toptions.requireScheduledDue,\n\t\t\t\toptions.expectedScheduledAt,\n\t\t\t\tpublishConfig.supportsRevisions,\n\t\t\t\tpublishConfig.routable,\n\t\t\t\texpectedRevision,\n\t\t\t);\n\n\t\t\t// Leave a 301 behind when publishing changed the slug of an entry that\n\t\t\t// was already published — its old URL was live and may be indexed or\n\t\t\t// linked. A first publish is excluded: a draft's URL was never public.\n\t\t\tif (\n\t\t\t\texisting?.status === \"published\" &&\n\t\t\t\texisting.slug &&\n\t\t\t\tpublished.slug &&\n\t\t\t\texisting.slug !== published.slug\n\t\t\t) {\n\t\t\t\tawait createSlugChangeRedirect(trx, collection, existing.slug, published.slug, resolvedId);\n\t\t\t}\n\n\t\t\treturn published;\n\t\t});\n\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeo(db, collection, item, hasSeo);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof ContentMutationConflictError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\t// The scheduled sweep gates publish on the row still being due; a row\n\t\t// unscheduled in the meantime is a silent skip, not a failure.\n\t\tif (error instanceof ScheduledNotDueError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_DUE\",\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\t// The staged-slug pre-check tags its error so it maps to the same\n\t\t\t// 409 SLUG_CONFLICT as direct slug edits in create/update.\n\t\t\tconst details: unknown = error.details;\n\t\t\tconst isSlugConflict =\n\t\t\t\ttypeof details === \"object\" &&\n\t\t\t\tdetails !== null &&\n\t\t\t\t\"code\" in details &&\n\t\t\t\tdetails.code === \"SLUG_CONFLICT\";\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: isSlugConflict ? \"SLUG_CONFLICT\" : \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\t// Backstop for the pre-check inside repo.publish(): a concurrent write\n\t\t// can still take the slug between the check and the UPDATE, in which\n\t\t// case the `(slug, locale)` unique constraint fires. Same fingerprint\n\t\t// mapping as create/update — never a raw SQLite error to the client.\n\t\tconst message = error instanceof Error ? error.message.toLowerCase() : \"\";\n\t\tif (\n\t\t\t(message.includes(\"unique constraint failed\") || message.includes(\"duplicate key\")) &&\n\t\t\tmessage.includes(\"slug\")\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"SLUG_CONFLICT\",\n\t\t\t\t\tmessage: `The staged slug is already used by another entry in collection '${collection}'`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content publish error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_PUBLISH_ERROR\",\n\t\t\t\tmessage: \"Failed to publish content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Unpublish content (revert to draft).\n *\n * Wrapped in a transaction — unpublish may create a draft revision\n * from the live version then update the status, which is multi-step.\n */\nexport async function handleContentUnpublish(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\toptions: { _rev?: string } = {},\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst expectedRevision = decodeRevisionPrecondition(options._rev);\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst resolvedId = (await resolveId(repo, collection, id)) ?? id;\n\t\t\treturn repo.unpublish(collection, resolvedId, expectedRevision);\n\t\t});\n\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeo(db, collection, item, hasSeo);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof ContentMutationConflictError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"CONFLICT\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content unpublish error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_UNPUBLISH_ERROR\",\n\t\t\t\tmessage: \"Failed to unpublish content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Count scheduled content items\n */\nexport async function handleContentCountScheduled(\n\tdb: Kysely<Database>,\n\tcollection: string,\n): Promise<ApiResult<{ count: number }>> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst count = await repo.countScheduled(collection);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { count },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content count scheduled error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_COUNT_ERROR\",\n\t\t\t\tmessage: \"Failed to count scheduled content\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Discard draft changes (revert to live version)\n */\nexport async function handleContentDiscardDraft(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n\toptions: { _rev?: string } = {},\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst expectedRevision = decodeRevisionPrecondition(options._rev);\n\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\tconst repo = new ContentRepository(trx);\n\t\t\tconst resolvedId = (await resolveId(repo, collection, id)) ?? id;\n\t\t\treturn repo.discardDraft(collection, resolvedId, expectedRevision);\n\t\t});\n\n\t\tconst hasSeo = await collectionHasSeo(db, collection);\n\t\tawait hydrateSeo(db, collection, item, hasSeo);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item, _rev: encodeRev(item) },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof ContentMutationConflictError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"CONFLICT\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tif (error instanceof EmDashValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Content discard draft error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_DISCARD_DRAFT_ERROR\",\n\t\t\t\tmessage: \"Failed to discard draft\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Compare live and draft revisions\n */\nexport async function handleContentCompare(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n): Promise<\n\tApiResult<{\n\t\thasChanges: boolean;\n\t\tlive: Record<string, unknown> | null;\n\t\tdraft: Record<string, unknown> | null;\n\t}>\n> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst entry = await repo.findByIdOrSlug(collection, id);\n\n\t\tif (!entry) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Content item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst revisionRepo = new RevisionRepository(db);\n\n\t\tconst live = entry.liveRevisionId ? await revisionRepo.findById(entry.liveRevisionId) : null;\n\t\tconst draft = entry.draftRevisionId ? await revisionRepo.findById(entry.draftRevisionId) : null;\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\thasChanges:\n\t\t\t\t\tentry.draftRevisionId !== null && entry.draftRevisionId !== entry.liveRevisionId,\n\t\t\t\tlive: live?.data ?? null,\n\t\t\t\tdraft: draft?.data ?? null,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Content compare error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_COMPARE_ERROR\",\n\t\t\t\tmessage: \"Failed to compare revisions\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get all translations for a content item.\n * Returns the item's translation group members with locale and status info.\n */\nexport async function handleContentTranslations(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tid: string,\n): Promise<\n\tApiResult<{\n\t\ttranslationGroup: string;\n\t\ttranslations: Array<{\n\t\t\tid: string;\n\t\t\tlocale: string | null;\n\t\t\tslug: string | null;\n\t\t\tstatus: string;\n\t\t\tupdatedAt: string;\n\t\t}>;\n\t}>\n> {\n\ttry {\n\t\tconst repo = new ContentRepository(db);\n\t\tconst item = await repo.findByIdOrSlug(collection, id);\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Content item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tif (!item.translationGroup) {\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: {\n\t\t\t\t\ttranslationGroup: item.id,\n\t\t\t\t\ttranslations: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tid: item.id,\n\t\t\t\t\t\t\tlocale: item.locale,\n\t\t\t\t\t\t\tslug: item.slug,\n\t\t\t\t\t\t\tstatus: item.status,\n\t\t\t\t\t\t\tupdatedAt: item.updatedAt,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst translations = await repo.findTranslations(collection, item.translationGroup);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\ttranslationGroup: item.translationGroup,\n\t\t\t\ttranslations: translations.map((t) => ({\n\t\t\t\t\tid: t.id,\n\t\t\t\t\tlocale: t.locale,\n\t\t\t\t\tslug: t.slug,\n\t\t\t\t\tstatus: t.status,\n\t\t\t\t\tupdatedAt: t.updatedAt,\n\t\t\t\t})),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof Error) {\n\t\t\tconsole.error(\"Content translations error:\", error);\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONTENT_TRANSLATIONS_ERROR\",\n\t\t\t\tmessage: \"Failed to get translations\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Non-translatable field sync\n// ---------------------------------------------------------------------------\n\n/**\n * Sync non-translatable fields to sibling locales.\n *\n * When a content item is updated and it belongs to a translation group,\n * any non-translatable fields in the update data are written to all other\n * rows in the same translation group within the same transaction.\n *\n * Non-translatable fields are **copied, not linked** — each row owns its\n * own data. This keeps queries simple and avoids cross-row joins.\n */\nasync function syncNonTranslatableFields(\n\ttrx: Kysely<Database>,\n\tcollectionSlug: string,\n\tupdatedItemId: string,\n\ttranslationGroup: string,\n\tdata: Record<string, unknown>,\n): Promise<void> {\n\t// Get the collection to find its fields\n\tconst collection = await trx\n\t\t.selectFrom(\"_emdash_collections\")\n\t\t.select(\"id\")\n\t\t.where(\"slug\", \"=\", collectionSlug)\n\t\t.executeTakeFirst();\n\n\tif (!collection) return;\n\n\t// Find non-translatable fields that are present in the update data\n\tconst fields = await trx\n\t\t.selectFrom(\"_emdash_fields\")\n\t\t.select(\"slug\")\n\t\t.where(\"collection_id\", \"=\", collection.id)\n\t\t.where(\"translatable\", \"=\", 0)\n\t\t.execute();\n\n\tconst nonTranslatableSlugs = fields.map((f) => f.slug);\n\tif (nonTranslatableSlugs.length === 0) return;\n\n\t// Filter to only the non-translatable fields present in this update\n\tconst syncData: Record<string, unknown> = {};\n\tfor (const slug of nonTranslatableSlugs) {\n\t\tif (slug in data) {\n\t\t\tsyncData[slug] = data[slug];\n\t\t}\n\t}\n\tif (Object.keys(syncData).length === 0) return;\n\n\t// Build the SET clause for sibling rows\n\tvalidateIdentifier(collectionSlug, \"collection slug\");\n\tconst tableName = `ec_${collectionSlug}`;\n\n\t// Update all sibling rows (same translation_group, different id)\n\tconst setClauses = Object.entries(syncData).map(([key, value]) => {\n\t\tvalidateIdentifier(key, \"field slug\");\n\t\tconst serialized = typeof value === \"object\" && value !== null ? JSON.stringify(value) : value;\n\t\treturn sql`${sql.ref(key)} = ${serialized}`;\n\t});\n\n\tawait sql`\n\t\tUPDATE ${sql.ref(tableName)}\n\t\tSET ${sql.join(setClauses, sql`, `)}\n\t\tWHERE translation_group = ${translationGroup}\n\t\tAND id != ${updatedItemId}\n\t`.execute(trx);\n}\n\n/**\n * Resolve a `{ taxonomyName: [slug, ...] }` map to term IDs and replace the\n * entry's assignments for each named taxonomy.\n *\n * Shared by handleContentCreate and handleContentUpdate so both MCP entry\n * points behave identically. Slug resolution is scoped to `locale`; passing\n * `undefined` lets `findBySlug` fall back to its default (lowest locale code)\n * so callers on single-locale sites don't need to know the site's default.\n *\n * Throws EmDashValidationError on unknown slug or wrong shape; the calling\n * handler translates that into a VALIDATION_ERROR response.\n */\nasync function assignTaxonomies(\n\ttrx: Kysely<Database>,\n\tcollection: string,\n\tentryId: string,\n\tlocale: string | undefined,\n\ttaxonomies: Record<string, string[]>,\n): Promise<void> {\n\tconst taxRepo = new TaxonomyRepository(trx);\n\tlet anyChange = false;\n\n\tfor (const [taxonomyName, slugs] of Object.entries(taxonomies)) {\n\t\tif (!Array.isArray(slugs)) {\n\t\t\tthrow new EmDashValidationError(`taxonomies.${taxonomyName} must be an array of term slugs`);\n\t\t}\n\n\t\tconst termIds: string[] = [];\n\t\tfor (const slug of slugs) {\n\t\t\tif (typeof slug !== \"string\" || slug.length === 0) {\n\t\t\t\tthrow new EmDashValidationError(\n\t\t\t\t\t`taxonomies.${taxonomyName} contains a non-string or empty slug`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst term = await taxRepo.findBySlug(taxonomyName, slug, locale);\n\t\t\tif (!term) {\n\t\t\t\tthrow new EmDashValidationError(\n\t\t\t\t\t`Unknown taxonomy term: ${taxonomyName}='${slug}'${\n\t\t\t\t\t\tlocale ? ` (locale '${locale}')` : \"\"\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\ttermIds.push(term.id);\n\t\t}\n\n\t\tawait taxRepo.setTermsForEntry(collection, entryId, taxonomyName, termIds);\n\t\tanyChange = true;\n\t}\n\n\t// Match the REST route's behaviour: taxonomy term assignments changed,\n\t// so invalidate the taxonomy object cache used during hydration.\n\tif (anyChange) invalidateTermCache();\n}\n","/**\n * Manifest generation handlers\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport { SchemaRegistry } from \"../../schema/registry.js\";\nimport { MAX_COLLECTION_LIST_COLUMNS } from \"../../schema/types.js\";\nimport type { Field, FieldType } from \"../../schema/types.js\";\nimport { hashString } from \"../../utils/hash.js\";\nimport type {\n\tFieldDescriptor,\n\tManifestCollectionMap,\n\tManifestFieldDescriptor,\n\tManifestResponse,\n} from \"../types.js\";\n\n/** Pattern to add spaces before capital letters */\nconst CAMEL_CASE_PATTERN = /([A-Z])/g;\nconst FIRST_CHAR_PATTERN = /^./;\n\n/**\n * Map schema field types to editor field kinds.\n */\n/** Field types that can be surfaced as list columns in the admin. */\nconst LIST_COLUMN_FIELD_TYPES: ReadonlySet<FieldType> = new Set([\n\t\"string\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"multiSelect\",\n]);\n\nconst FIELD_TYPE_TO_KIND: Record<FieldType, string> = {\n\tstring: \"string\",\n\tslug: \"string\",\n\turl: \"url\",\n\ttext: \"richText\",\n\tnumber: \"number\",\n\tinteger: \"number\",\n\tboolean: \"boolean\",\n\tdatetime: \"datetime\",\n\tselect: \"select\",\n\tmultiSelect: \"multiSelect\",\n\tportableText: \"portableText\",\n\timage: \"image\",\n\tfile: \"file\",\n\treference: \"reference\",\n\tjson: \"json\",\n\trepeater: \"repeater\",\n};\n\n// Collection definition shape for manifest generation\ninterface CollectionDefinition {\n\tschema: {\n\t\t_def?: { shape?: () => Record<string, unknown> };\n\t\tshape?: Record<string, unknown>;\n\t};\n\tadmin: {\n\t\tlabel: string;\n\t\tlabelSingular?: string;\n\t\tsupports?: string[];\n\t\troutable?: boolean;\n\t};\n}\ntype CollectionMap = Record<string, CollectionDefinition>;\n\ninterface GenerateManifestOptions {\n\tdb?: Kysely<Database> | null;\n}\n\n/**\n * Generate admin manifest from collections\n */\nexport async function generateManifest(\n\tcollections: CollectionMap,\n\tplugins: Record<\n\t\tstring,\n\t\t{\n\t\t\tadminPages?: Array<{ path: string; component: string }>;\n\t\t\twidgets?: string[];\n\t\t}\n\t> = {},\n\toptions: GenerateManifestOptions = {},\n): Promise<ManifestResponse> {\n\tconst manifestCollections = await buildManifestCollections(collections, options.db);\n\n\t// Generate hash from collections (for cache invalidation)\n\tconst hash = await hashString(JSON.stringify(manifestCollections));\n\n\treturn {\n\t\tversion: \"0.1.0\",\n\t\thash,\n\t\tcollections: manifestCollections,\n\t\tplugins,\n\t};\n}\n\n/**\n * Build collection descriptors from build-time config plus live database rows.\n *\n * Config collections are added first and win on slug conflicts. Runtime/manual\n * collections have no Zod schema to inspect, so their field descriptors are\n * synthesized from `_emdash_fields`.\n */\nexport async function buildManifestCollections(\n\tcollections: CollectionMap,\n\tdb?: Kysely<Database> | null,\n): Promise<ManifestCollectionMap> {\n\tconst manifestCollections: ManifestCollectionMap = {};\n\n\tfor (const [name, definition] of Object.entries(collections)) {\n\t\t// Extract field descriptors from Zod schema\n\t\tconst fields = extractFieldDescriptors(definition.schema);\n\n\t\tmanifestCollections[name] = {\n\t\t\tlabel: definition.admin.label,\n\t\t\tlabelSingular: definition.admin.labelSingular || definition.admin.label,\n\t\t\tsupports: definition.admin.supports || [],\n\t\t\thasSeo: (definition.admin.supports || []).includes(\"seo\"),\n\t\t\troutable: definition.admin.routable ?? true,\n\t\t\tfields,\n\t\t};\n\t}\n\n\tif (!db) return manifestCollections;\n\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst dbCollections = await registry.listCollectionsWithFields();\n\t\tfor (const collection of dbCollections) {\n\t\t\tif (manifestCollections[collection.slug]) continue;\n\n\t\t\tconst fields: Record<string, ManifestFieldDescriptor> = {};\n\t\t\tfor (const field of collection.fields) {\n\t\t\t\tfields[field.slug] = dbFieldDescriptor(field);\n\t\t\t}\n\n\t\t\tconst configuredListColumns = collection.admin?.listColumns ?? [];\n\t\t\tconst fieldTypes = new Map(collection.fields.map((field) => [field.slug, field.type]));\n\t\t\tconst listColumns: string[] = [];\n\t\t\tfor (const slug of configuredListColumns) {\n\t\t\t\tif (listColumns.includes(slug)) continue;\n\t\t\t\tconst fieldType = fieldTypes.get(slug);\n\t\t\t\tif (!fieldType || !LIST_COLUMN_FIELD_TYPES.has(fieldType)) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`EmDash: Ignoring unsupported or unknown list column \"${slug}\" in collection \"${collection.slug}\".`,\n\t\t\t\t\t);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (listColumns.length >= MAX_COLLECTION_LIST_COLUMNS) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`EmDash: Collection \"${collection.slug}\" declares more than ${MAX_COLLECTION_LIST_COLUMNS} list columns; extra columns are ignored.`,\n\t\t\t\t\t);\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tlistColumns.push(slug);\n\t\t\t}\n\n\t\t\tmanifestCollections[collection.slug] = {\n\t\t\t\tlabel: collection.label,\n\t\t\t\tlabelSingular: collection.labelSingular || collection.label,\n\t\t\t\tsupports: collection.supports || [],\n\t\t\t\thasSeo: collection.hasSeo,\n\t\t\t\turlPattern: collection.urlPattern,\n\t\t\t\troutable: collection.routable !== false,\n\t\t\t\ttitleField: collection.titleField,\n\t\t\t\tdateField: collection.dateField,\n\t\t\t\t...(collection.hidden ? { hidden: true } : {}),\n\t\t\t\tlistColumns: listColumns.length > 0 ? listColumns : undefined,\n\t\t\t\tfields,\n\t\t\t};\n\t\t}\n\t} catch (error) {\n\t\tconsole.debug(\"EmDash: Could not load database collections for manifest:\", error);\n\t}\n\n\treturn manifestCollections;\n}\n\n/**\n * Extract field descriptors from Zod schema\n * Note: This is a simplified implementation that handles common types\n */\nfunction extractFieldDescriptors(schema: {\n\t_def?: { shape?: () => Record<string, unknown> };\n\tshape?: Record<string, unknown>;\n}): Record<string, ManifestFieldDescriptor> {\n\tconst fields: Record<string, ManifestFieldDescriptor> = {};\n\n\t// Handle Zod object schema\n\tconst shape = typeof schema._def?.shape === \"function\" ? schema._def.shape() : schema.shape || {};\n\n\tfor (const [name, fieldSchema] of Object.entries(shape)) {\n\t\tfields[name] = extractFieldType(name, fieldSchema);\n\t}\n\n\treturn fields;\n}\n\n/**\n * Extract field type from Zod schema\n */\n/** Type guard: check if a value is a non-null object */\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction extractFieldType(name: string, schema: unknown): FieldDescriptor {\n\tif (!isObject(schema)) {\n\t\treturn { kind: \"string\", label: formatLabel(name) };\n\t}\n\n\t// Check for custom field markers\n\tif (schema.isPortableText) {\n\t\treturn { kind: \"portableText\", label: formatLabel(name) };\n\t}\n\tif (schema.isImage) {\n\t\treturn { kind: \"image\", label: formatLabel(name) };\n\t}\n\tif (schema.isReference) {\n\t\treturn { kind: \"reference\", label: formatLabel(name) };\n\t}\n\n\t// Handle standard Zod types\n\tconst def = isObject(schema._def) ? schema._def : undefined;\n\tconst typeName = typeof def?.typeName === \"string\" ? def.typeName : undefined;\n\n\tswitch (typeName) {\n\t\tcase \"ZodString\":\n\t\t\treturn { kind: \"string\", label: formatLabel(name) };\n\t\tcase \"ZodNumber\":\n\t\t\treturn { kind: \"number\", label: formatLabel(name) };\n\t\tcase \"ZodBoolean\":\n\t\t\treturn { kind: \"boolean\", label: formatLabel(name) };\n\t\tcase \"ZodDate\":\n\t\t\treturn { kind: \"datetime\", label: formatLabel(name) };\n\t\tcase \"ZodEnum\": {\n\t\t\tconst values = Array.isArray(def?.values) ? def.values : [];\n\t\t\treturn {\n\t\t\t\tkind: \"select\",\n\t\t\t\tlabel: formatLabel(name),\n\t\t\t\toptions: values\n\t\t\t\t\t.filter((v): v is string => typeof v === \"string\")\n\t\t\t\t\t.map((v) => ({\n\t\t\t\t\t\tvalue: v,\n\t\t\t\t\t\tlabel: v.charAt(0).toUpperCase() + v.slice(1),\n\t\t\t\t\t})),\n\t\t\t};\n\t\t}\n\t\tcase \"ZodArray\":\n\t\t\treturn { kind: \"array\", label: formatLabel(name) };\n\t\tcase \"ZodObject\":\n\t\t\treturn { kind: \"object\", label: formatLabel(name) };\n\t\tcase \"ZodOptional\":\n\t\tcase \"ZodDefault\":\n\t\t\t// Unwrap optional/default types\n\t\t\tif (def?.innerType) {\n\t\t\t\treturn extractFieldType(name, def.innerType);\n\t\t\t}\n\t\t\treturn { kind: \"string\", label: formatLabel(name) };\n\t\tdefault:\n\t\t\treturn { kind: \"string\", label: formatLabel(name) };\n\t}\n}\n\nfunction dbFieldDescriptor(field: Field): ManifestFieldDescriptor {\n\tconst entry: ManifestFieldDescriptor = {\n\t\tkind: FIELD_TYPE_TO_KIND[field.type] ?? \"string\",\n\t\tlabel: field.label,\n\t\trequired: field.required,\n\t\tid: field.id,\n\t};\n\n\tif (field.widget) entry.widget = field.widget;\n\tif (field.options) entry.options = field.options;\n\n\t// Legacy: select/multiSelect enum options live on `field.validation.options`.\n\t// They win over widget options to preserve existing select behavior.\n\tif (field.validation?.options) {\n\t\tentry.options = field.validation.options.map((value) => ({\n\t\t\tvalue,\n\t\t\tlabel: value.charAt(0).toUpperCase() + value.slice(1),\n\t\t}));\n\t}\n\n\t// Include validation only for field widgets that need it client-side.\n\tif (\n\t\t(field.type === \"repeater\" || field.type === \"file\" || field.type === \"image\") &&\n\t\tfield.validation\n\t) {\n\t\tentry.validation = { ...field.validation };\n\t}\n\n\treturn entry;\n}\n\n/**\n * Format field name as label\n */\nfunction formatLabel(name: string): string {\n\treturn name\n\t\t.replace(CAMEL_CASE_PATTERN, \" $1\")\n\t\t.replace(FIRST_CHAR_PATTERN, (str) => str.toUpperCase())\n\t\t.trim();\n}\n","/**\n * Revision history handlers\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { after } from \"../../after.js\";\nimport { ContentRepository } from \"../../database/repositories/content.js\";\nimport { RevisionRepository, type Revision } from \"../../database/repositories/revision.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult, ContentResponse } from \"../types.js\";\n\nexport interface RevisionListResponse {\n\titems: Revision[];\n\ttotal: number;\n}\n\nexport interface RevisionResponse {\n\titem: Revision;\n}\n\n/**\n * List revisions for a content entry\n */\nexport async function handleRevisionList(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tentryId: string,\n\tparams: { limit?: number } = {},\n): Promise<ApiResult<RevisionListResponse>> {\n\ttry {\n\t\tconst repo = new RevisionRepository(db);\n\t\tconst [items, total] = await Promise.all([\n\t\t\trepo.findByEntry(collection, entryId, { limit: Math.min(params.limit || 50, 100) }),\n\t\t\trepo.countByEntry(collection, entryId),\n\t\t]);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { items, total },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"REVISION_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list revisions\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get a specific revision\n */\nexport async function handleRevisionGet(\n\tdb: Kysely<Database>,\n\trevisionId: string,\n): Promise<ApiResult<RevisionResponse>> {\n\ttry {\n\t\tconst repo = new RevisionRepository(db);\n\t\tconst item = await repo.findById(revisionId);\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Revision not found: ${revisionId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"REVISION_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get revision\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Restore a revision (updates content to this revision's data and creates new revision)\n */\nexport async function handleRevisionRestore(\n\tdb: Kysely<Database>,\n\trevisionId: string,\n\tcallerUserId: string,\n): Promise<ApiResult<ContentResponse>> {\n\ttry {\n\t\tconst revisionRepo = new RevisionRepository(db);\n\n\t\t// Get the revision\n\t\tconst revision = await revisionRepo.findById(revisionId);\n\t\tif (!revision) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Revision not found: ${revisionId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Extract _slug from revision data (stored as metadata, not a real column)\n\t\tconst { _slug, ...fieldData } = revision.data;\n\n\t\t// Atomically update content and create a new revision to record the restore.\n\t\t// If either operation fails, neither is committed (on engines that support\n\t\t// transactions; on D1, withTransaction falls back to sequential execution).\n\t\tconst { item, queuedRevisionId } = await withTransaction(db, async (trx) => {\n\t\t\tconst trxContentRepo = new ContentRepository(trx);\n\t\t\tconst trxRevisionRepo = new RevisionRepository(trx);\n\n\t\t\tconst updated = await trxContentRepo.update(revision.collection, revision.entryId, {\n\t\t\t\tdata: fieldData,\n\t\t\t\tslug: typeof _slug === \"string\" ? _slug : undefined,\n\t\t\t});\n\n\t\t\tconst queuedRevision = await trxRevisionRepo.create({\n\t\t\t\tcollection: revision.collection,\n\t\t\t\tentryId: revision.entryId,\n\t\t\t\tdata: revision.data,\n\t\t\t\tauthorId: callerUserId,\n\t\t\t});\n\n\t\t\treturn { item: updated, queuedRevisionId: queuedRevision.id };\n\t\t});\n\n\t\tconst pruneRepo = new RevisionRepository(db);\n\t\tafter(async () => {\n\t\t\ttry {\n\t\t\t\tawait pruneRepo.pruneQueuedEntry(\n\t\t\t\t\trevision.collection,\n\t\t\t\t\trevision.entryId,\n\t\t\t\t\tqueuedRevisionId,\n\t\t\t\t\t50,\n\t\t\t\t);\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\n\t\t\t\t\t`[revisions] Failed to prune revisions for ${revision.collection}/${revision.entryId}:`,\n\t\t\t\t\terror,\n\t\t\t\t);\n\t\t\t}\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"REVISION_RESTORE_ERROR\",\n\t\t\t\tmessage: \"Failed to restore revision\",\n\t\t\t},\n\t\t};\n\t}\n}\n","/**\n * Media CRUD handlers\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { MediaRepository, type MediaItem } from \"../../database/repositories/media.js\";\nimport { InvalidCursorError } from \"../../database/repositories/types.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { isValidFocalPointUpdate, type FocalPointUpdate } from \"../../media/focal-point.js\";\nimport type { ApiResult } from \"../types.js\";\n\nconst FOREIGN_KEY_VIOLATION_RE = /foreign key constraint failed/i;\n\nexport interface MediaListResponse {\n\titems: MediaItem[];\n\tnextCursor?: string;\n\ttotalCount?: number;\n}\n\nexport interface MediaResponse {\n\titem: MediaItem;\n}\n\n/**\n * List media items\n */\nexport async function handleMediaList(\n\tdb: Kysely<Database>,\n\tparams: {\n\t\tcursor?: string;\n\t\tpage?: number;\n\t\tlimit?: number;\n\t\tmimeType?: string | readonly string[];\n\t\tq?: string;\n\t\tfolderId?: string | null;\n\t},\n): Promise<ApiResult<MediaListResponse>> {\n\ttry {\n\t\tif (params.page !== undefined) {\n\t\t\tconst limit = Math.min(params.limit || 50, 100);\n\t\t\tconst offset = (params.page - 1) * limit;\n\t\t\tif (\n\t\t\t\tparams.cursor !== undefined ||\n\t\t\t\t!Number.isSafeInteger(params.page) ||\n\t\t\t\tparams.page < 1 ||\n\t\t\t\t!Number.isSafeInteger(offset)\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: { code: \"VALIDATION_ERROR\", message: \"Invalid media page\" },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst repo = new MediaRepository(db);\n\t\t\tconst result = await repo.findPage({\n\t\t\t\tpage: params.page,\n\t\t\t\tlimit,\n\t\t\t\tmimeType: params.mimeType,\n\t\t\t\tq: params.q,\n\t\t\t\tfolderId: params.folderId,\n\t\t\t});\n\t\t\treturn { success: true, data: result };\n\t\t}\n\n\t\tconst repo = new MediaRepository(db);\n\t\tconst result = await repo.findMany({\n\t\t\tcursor: params.cursor,\n\t\t\tlimit: Math.min(params.limit || 50, 100),\n\t\t\tmimeType: params.mimeType,\n\t\t\tq: params.q,\n\t\t\tfolderId: params.folderId,\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\titems: result.items,\n\t\t\t\tnextCursor: result.nextCursor,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MEDIA_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list media\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get single media item\n */\nexport async function handleMediaGet(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<MediaResponse>> {\n\ttry {\n\t\tconst repo = new MediaRepository(db);\n\t\tconst item = await repo.findById(id);\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Media item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MEDIA_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get media\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Create media item (after file upload)\n */\nexport async function handleMediaCreate(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tfilename: string;\n\t\tmimeType: string;\n\t\tsize?: number;\n\t\twidth?: number;\n\t\theight?: number;\n\t\talt?: string;\n\t\tstorageKey: string;\n\t\tcontentHash?: string;\n\t\tblurhash?: string;\n\t\tdominantColor?: string;\n\t\tauthorId?: string;\n\t\tfolderId?: string | null;\n\t},\n): Promise<ApiResult<MediaResponse>> {\n\ttry {\n\t\tconst repo = new MediaRepository(db);\n\t\tconst item = await repo.create(input);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MEDIA_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create media\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Update media metadata\n */\nexport async function handleMediaUpdate(\n\tdb: Kysely<Database>,\n\tid: string,\n\tinput: {\n\t\talt?: string;\n\t\tcaption?: string;\n\t\twidth?: number;\n\t\theight?: number;\n\t\tfolderId?: string | null;\n\t} & FocalPointUpdate,\n): Promise<ApiResult<MediaResponse>> {\n\tif (!isValidFocalPointUpdate(input)) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\tmessage: \"focalX and focalY must both be valid numbers or both be null\",\n\t\t\t},\n\t\t};\n\t}\n\ttry {\n\t\tconst repo = new MediaRepository(db);\n\t\tconst item = await repo.update(id, input);\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Media item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (isForeignKeyViolation(error)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Media folder not found\" },\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MEDIA_UPDATE_ERROR\",\n\t\t\t\tmessage: \"Failed to update media\",\n\t\t\t},\n\t\t};\n\t}\n}\n\nexport async function handleMediaReplaceMetadata(\n\tdb: Kysely<Database>,\n\tid: string,\n\texpectedStorageKey: string,\n\tinput: { size: number; width: number; height: number; contentHash: string },\n): Promise<ApiResult<MediaResponse>> {\n\ttry {\n\t\tconst item = await new MediaRepository(db).replaceReadyFile(id, expectedStorageKey, input);\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"MEDIA_REPLACE_METADATA_ERROR\",\n\t\t\t\t\tmessage: \"Failed to update replaced media metadata\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn { success: true, data: { item } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MEDIA_REPLACE_METADATA_ERROR\",\n\t\t\t\tmessage: \"Failed to update replaced media metadata\",\n\t\t\t},\n\t\t};\n\t}\n}\n\nfunction isForeignKeyViolation(error: unknown): boolean {\n\tif (error && typeof error === \"object\") {\n\t\tif (\"code\" in error && error.code === \"23503\") return true;\n\t}\n\tconst message = error instanceof Error ? error.message : \"\";\n\tif (FOREIGN_KEY_VIOLATION_RE.test(message)) return true;\n\treturn Boolean(\n\t\terror && typeof error === \"object\" && \"cause\" in error && isForeignKeyViolation(error.cause),\n\t);\n}\n\n/**\n * Delete media item\n */\nexport async function handleMediaDelete(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<{ deleted: true; storageKey: string }>> {\n\ttry {\n\t\tconst repo = new MediaRepository(db);\n\t\tconst storageKey = await repo.deleteWithStorageKey(id);\n\n\t\tif (!storageKey) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Media item not found: ${id}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { deleted: true, storageKey },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MEDIA_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete media\",\n\t\t\t},\n\t\t};\n\t}\n}\n","/**\n * Plugin management handlers\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport type { SandboxedPluginEntry } from \"../../emdash-runtime.js\";\nimport { PluginStateRepository, type PluginState, type PluginStatus } from \"../../plugins/state.js\";\nimport type { ResolvedPlugin } from \"../../plugins/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\nexport interface PluginInfo {\n\tid: string;\n\tname: string;\n\tversion: string;\n\tpackage?: string;\n\tenabled: boolean;\n\tstatus: PluginStatus;\n\tsource?: \"config\" | \"marketplace\" | \"registry\";\n\t/** True for statically-sandboxed plugins (registered via `sandboxed: []`) */\n\tsandboxed?: boolean;\n\tmarketplaceVersion?: string;\n\t/** Publisher DID, for registry-source plugins */\n\tregistryPublisherDid?: string;\n\t/** Publisher slug, for registry-source plugins */\n\tregistrySlug?: string;\n\tcapabilities: string[];\n\thasAdminPages: boolean;\n\thasDashboardWidgets: boolean;\n\thasHooks: boolean;\n\t/** True when the plugin declares `admin.settingsSchema` (auto-generated settings form) */\n\thasSettings: boolean;\n\tinstalledAt?: string;\n\tactivatedAt?: string;\n\tdeactivatedAt?: string;\n\t/** Description of what the plugin does */\n\tdescription?: string;\n\t/** URL to the plugin icon on the marketplace */\n\ticonUrl?: string;\n\tmcpToolsEnabled: boolean;\n\tmcpTools: Array<{\n\t\tname: string;\n\t\tdescription: string;\n\t\troute: string;\n\t\tpermission: string;\n\t\tdestructive: boolean;\n\t}>;\n}\n\nexport interface PluginListResponse {\n\titems: PluginInfo[];\n}\n\nexport interface PluginResponse {\n\titem: PluginInfo;\n}\n\nfunction marketplaceIconUrl(marketplaceUrl: string, pluginId: string): string {\n\treturn `${marketplaceUrl}/api/v1/plugins/${encodeURIComponent(pluginId)}/icon`;\n}\n\n/**\n * Get plugin info from configured plugin and database state\n */\nfunction buildPluginInfo(\n\tplugin: ResolvedPlugin,\n\tstate: PluginState | null,\n\tmarketplaceUrl?: string,\n): PluginInfo {\n\t// If no state exists, plugin is considered active (default on first run)\n\tconst status = state?.status ?? \"active\";\n\tconst enabled = status === \"active\";\n\tconst isMarketplace = (state?.source ?? \"config\") === \"marketplace\";\n\n\treturn {\n\t\tid: plugin.id,\n\t\tname: state?.displayName || plugin.id,\n\t\tversion: plugin.version,\n\t\tpackage: undefined, // v2 doesn't have package field\n\t\tenabled,\n\t\tstatus,\n\t\tsource: state?.source ?? \"config\",\n\t\tmarketplaceVersion: state?.marketplaceVersion ?? undefined,\n\t\tregistryPublisherDid: state?.registryPublisherDid ?? undefined,\n\t\tregistrySlug: state?.registrySlug ?? undefined,\n\t\tcapabilities: plugin.capabilities,\n\t\thasAdminPages: (plugin.admin.pages?.length ?? 0) > 0,\n\t\thasDashboardWidgets: (plugin.admin.widgets?.length ?? 0) > 0,\n\t\thasHooks: Object.keys(plugin.hooks ?? {}).length > 0,\n\t\thasSettings: Object.keys(plugin.admin.settingsSchema ?? {}).length > 0,\n\t\tinstalledAt: state?.installedAt?.toISOString(),\n\t\tactivatedAt: state?.activatedAt?.toISOString() ?? undefined,\n\t\tdeactivatedAt: state?.deactivatedAt?.toISOString() ?? undefined,\n\t\tdescription: state?.description ?? undefined,\n\t\ticonUrl:\n\t\t\tisMarketplace && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, plugin.id) : undefined,\n\t\tmcpToolsEnabled: state?.mcpToolsEnabled ?? false,\n\t\tmcpTools: Object.entries(plugin.mcp?.tools ?? {}).flatMap(([name, tool]) => {\n\t\t\tconst permission = plugin.routes[tool.route]?.permission;\n\t\t\treturn permission\n\t\t\t\t? [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tdescription: tool.description,\n\t\t\t\t\t\t\troute: tool.route,\n\t\t\t\t\t\t\tpermission,\n\t\t\t\t\t\t\tdestructive: tool.destructive ?? false,\n\t\t\t\t\t\t},\n\t\t\t\t\t]\n\t\t\t\t: [];\n\t\t}),\n\t};\n}\n\n/**\n * Build plugin info for a statically-sandboxed plugin entry\n */\nfunction buildSandboxedPluginInfo(\n\tentry: SandboxedPluginEntry,\n\tstate: PluginState | null,\n): PluginInfo {\n\tconst status = state?.status ?? \"active\";\n\tconst enabled = status === \"active\";\n\n\treturn {\n\t\tid: entry.id,\n\t\tname: state?.displayName || entry.id,\n\t\tversion: entry.version,\n\t\tpackage: undefined, // v2 doesn't have package field\n\t\tenabled,\n\t\tstatus,\n\t\tsource: \"config\",\n\t\tsandboxed: true,\n\t\tcapabilities: entry.capabilities,\n\t\thasAdminPages: (entry.adminPages?.length ?? 0) > 0,\n\t\thasDashboardWidgets: (entry.adminWidgets?.length ?? 0) > 0,\n\t\thasHooks: false,\n\t\thasSettings: Object.keys(entry.settingsSchema ?? {}).length > 0,\n\t\tinstalledAt: state?.installedAt?.toISOString(),\n\t\tactivatedAt: state?.activatedAt?.toISOString() ?? undefined,\n\t\tdeactivatedAt: state?.deactivatedAt?.toISOString() ?? undefined,\n\t\tdescription: state?.description ?? undefined,\n\t\tmcpToolsEnabled: state?.mcpToolsEnabled ?? false,\n\t\tmcpTools: entry.mcp?.tools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool) ?? [],\n\t};\n}\n\n/**\n * List all configured plugins with their state\n */\nexport async function handlePluginList(\n\tdb: Kysely<Database>,\n\tconfiguredPlugins: ResolvedPlugin[],\n\tsandboxedPluginEntries: SandboxedPluginEntry[],\n\tmarketplaceUrl?: string,\n\t/**\n\t * Settings-schema lookup for runtime-installed (marketplace/registry)\n\t * plugins, which aren't in either build-time list. Typically\n\t * `EmDashRuntime.getRuntimePluginSettingsSchema`.\n\t */\n\truntimeSettingsSchemaLookup?: (pluginId: string) => Record<string, unknown> | null,\n): Promise<ApiResult<PluginListResponse>> {\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst allStates = await stateRepo.getAll();\n\t\tconst stateMap = new Map(allStates.map((s) => [s.pluginId, s]));\n\n\t\tconst configuredIds = new Set(configuredPlugins.map((p) => p.id));\n\n\t\tconst items = configuredPlugins.map((plugin) => {\n\t\t\tconst state = stateMap.get(plugin.id) ?? null;\n\t\t\treturn buildPluginInfo(plugin, state, marketplaceUrl);\n\t\t});\n\n\t\t// Include statically-sandboxed plugins (registered via `sandboxed: []`\n\t\t// in astro.config.mjs).\n\t\tfor (const entry of sandboxedPluginEntries) {\n\t\t\tif (configuredIds.has(entry.id)) continue;\n\t\t\tconfiguredIds.add(entry.id);\n\t\t\titems.push(buildSandboxedPluginInfo(entry, stateMap.get(entry.id) ?? null));\n\t\t}\n\n\t\t// Include runtime-installed plugins (marketplace or registry) that\n\t\t// aren't in the configured plugins list.\n\t\tfor (const state of allStates) {\n\t\t\tif (state.source !== \"marketplace\" && state.source !== \"registry\") continue;\n\t\t\tif (configuredIds.has(state.pluginId)) continue;\n\n\t\t\titems.push({\n\t\t\t\tid: state.pluginId,\n\t\t\t\tname: state.displayName || state.pluginId,\n\t\t\t\tversion: state.marketplaceVersion ?? state.version,\n\t\t\t\tenabled: state.status === \"active\",\n\t\t\t\tstatus: state.status,\n\t\t\t\tsource: state.source,\n\t\t\t\tmarketplaceVersion: state.marketplaceVersion ?? undefined,\n\t\t\t\tregistryPublisherDid: state.registryPublisherDid ?? undefined,\n\t\t\t\tregistrySlug: state.registrySlug ?? undefined,\n\t\t\t\tcapabilities: [],\n\t\t\t\thasAdminPages: false,\n\t\t\t\thasDashboardWidgets: false,\n\t\t\t\thasHooks: false,\n\t\t\t\thasSettings: Object.keys(runtimeSettingsSchemaLookup?.(state.pluginId) ?? {}).length > 0,\n\t\t\t\tinstalledAt: state.installedAt?.toISOString(),\n\t\t\t\tactivatedAt: state.activatedAt?.toISOString() ?? undefined,\n\t\t\t\tdeactivatedAt: state.deactivatedAt?.toISOString() ?? undefined,\n\t\t\t\tdescription: state.description ?? undefined,\n\t\t\t\ticonUrl:\n\t\t\t\t\tstate.source === \"marketplace\" && marketplaceUrl\n\t\t\t\t\t\t? marketplaceIconUrl(marketplaceUrl, state.pluginId)\n\t\t\t\t\t\t: undefined,\n\t\t\t\tmcpToolsEnabled: state.mcpToolsEnabled,\n\t\t\t\tmcpTools: [],\n\t\t\t});\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { items },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"PLUGIN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list plugins\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get a single plugin's info\n */\nexport async function handlePluginGet(\n\tdb: Kysely<Database>,\n\tconfiguredPlugins: ResolvedPlugin[],\n\tsandboxedPluginEntries: SandboxedPluginEntry[],\n\tpluginId: string,\n\tmarketplaceUrl?: string,\n): Promise<ApiResult<PluginResponse>> {\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst plugin = configuredPlugins.find((p) => p.id === pluginId);\n\n\t\tif (plugin) {\n\t\t\tconst state = await stateRepo.get(pluginId);\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: { item: buildPluginInfo(plugin, state, marketplaceUrl) },\n\t\t\t};\n\t\t}\n\n\t\tconst sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);\n\t\tif (sandboxed) {\n\t\t\tconst state = await stateRepo.get(pluginId);\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: { item: buildSandboxedPluginInfo(sandboxed, state) },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\tmessage: `Plugin not found: ${pluginId}`,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"PLUGIN_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get plugin\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Build a minimal `PluginInfo` for a plugin that exists only as a\n * `_plugin_state` row (marketplace or registry install), with no\n * matching `configuredPlugins` entry. Runtime-installed plugins don't\n * have ResolvedPlugin metadata until they're loaded into the sandbox,\n * so the enable/disable response surfaces the state-row view as a\n * stable shape the admin UI already understands.\n */\nfunction buildStateOnlyPluginInfo(\n\tstate: NonNullable<Awaited<ReturnType<PluginStateRepository[\"get\"]>>>,\n): PluginInfo {\n\treturn {\n\t\tid: state.pluginId,\n\t\tname: state.displayName || state.pluginId,\n\t\tversion: state.marketplaceVersion ?? state.version,\n\t\tenabled: state.status === \"active\",\n\t\tstatus: state.status,\n\t\tsource: state.source,\n\t\tmarketplaceVersion: state.marketplaceVersion ?? undefined,\n\t\tregistryPublisherDid: state.registryPublisherDid ?? undefined,\n\t\tregistrySlug: state.registrySlug ?? undefined,\n\t\tcapabilities: [],\n\t\thasAdminPages: false,\n\t\thasDashboardWidgets: false,\n\t\thasHooks: false,\n\t\thasSettings: false,\n\t\tinstalledAt: state.installedAt?.toISOString(),\n\t\tactivatedAt: state.activatedAt?.toISOString() ?? undefined,\n\t\tdeactivatedAt: state.deactivatedAt?.toISOString() ?? undefined,\n\t\tdescription: state.description ?? undefined,\n\t\tmcpToolsEnabled: state.mcpToolsEnabled,\n\t\tmcpTools: [],\n\t};\n}\n\n/**\n * Enable a plugin\n */\nexport async function handlePluginEnable(\n\tdb: Kysely<Database>,\n\tconfiguredPlugins: ResolvedPlugin[],\n\tsandboxedPluginEntries: SandboxedPluginEntry[],\n\tpluginId: string,\n): Promise<ApiResult<PluginResponse>> {\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst plugin = configuredPlugins.find((p) => p.id === pluginId);\n\n\t\t// Configured plugin: use its version as the source of truth.\n\t\tif (plugin) {\n\t\t\tconst state = await stateRepo.enable(pluginId, plugin.version);\n\t\t\treturn { success: true, data: { item: buildPluginInfo(plugin, state) } };\n\t\t}\n\n\t\t// Statically-sandboxed plugin: addressable via its build-time entry.\n\t\tconst sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);\n\t\tif (sandboxed) {\n\t\t\tconst state = await stateRepo.enable(pluginId, sandboxed.version);\n\t\t\treturn { success: true, data: { item: buildSandboxedPluginInfo(sandboxed, state) } };\n\t\t}\n\n\t\t// Runtime-installed plugin (marketplace or registry): only\n\t\t// addressable through the state row. Fall back to the existing\n\t\t// version recorded there.\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (!existing || (existing.source !== \"marketplace\" && existing.source !== \"registry\")) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Plugin not found: ${pluginId}` },\n\t\t\t};\n\t\t}\n\t\tconst enabled = await stateRepo.enable(pluginId, existing.version);\n\t\treturn { success: true, data: { item: buildStateOnlyPluginInfo(enabled) } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"PLUGIN_ENABLE_ERROR\",\n\t\t\t\tmessage: \"Failed to enable plugin\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Disable a plugin\n */\nexport async function handlePluginDisable(\n\tdb: Kysely<Database>,\n\tconfiguredPlugins: ResolvedPlugin[],\n\tsandboxedPluginEntries: SandboxedPluginEntry[],\n\tpluginId: string,\n): Promise<ApiResult<PluginResponse>> {\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst plugin = configuredPlugins.find((p) => p.id === pluginId);\n\n\t\tif (plugin) {\n\t\t\tconst state = await stateRepo.disable(pluginId, plugin.version);\n\t\t\treturn { success: true, data: { item: buildPluginInfo(plugin, state) } };\n\t\t}\n\n\t\tconst sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);\n\t\tif (sandboxed) {\n\t\t\tconst state = await stateRepo.disable(pluginId, sandboxed.version);\n\t\t\treturn { success: true, data: { item: buildSandboxedPluginInfo(sandboxed, state) } };\n\t\t}\n\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (!existing || (existing.source !== \"marketplace\" && existing.source !== \"registry\")) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Plugin not found: ${pluginId}` },\n\t\t\t};\n\t\t}\n\t\tconst disabled = await stateRepo.disable(pluginId, existing.version);\n\t\treturn { success: true, data: { item: buildStateOnlyPluginInfo(disabled) } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"PLUGIN_DISABLE_ERROR\",\n\t\t\t\tmessage: \"Failed to disable plugin\",\n\t\t\t},\n\t\t};\n\t}\n}\n","/**\n * Plugin settings handlers\n *\n * Auto-generated settings UI backend for plugins that declare\n * `admin.settingsSchema`. Values are stored in the options table under\n * `plugin:{pluginId}:settings:{key}` — the same keys the plugin itself\n * reads via `ctx.kv.get(\"settings:{key}\")`.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../../database/repositories/options.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { SandboxedPluginEntry } from \"../../emdash-runtime.js\";\nimport type { ResolvedPlugin, SettingField } from \"../../plugins/types.js\";\nimport { ErrorCode } from \"../errors.js\";\nimport type { ApiResult } from \"../types.js\";\n\nexport interface PluginSettingsResponse {\n\t/** The plugin's declared settings schema, keyed by setting name */\n\tschema: Record<string, SettingField>;\n\t/**\n\t * Current values keyed by setting name. Secret fields are never\n\t * included here — check `secretsSet` instead.\n\t */\n\tvalues: Record<string, unknown>;\n\t/** For secret fields: whether a value is currently stored */\n\tsecretsSet: Record<string, boolean>;\n}\n\nfunction settingsKey(pluginId: string, key: string): string {\n\treturn `plugin:${pluginId}:settings:${key}`;\n}\n\n/**\n * Resolve a plugin's settings schema from either the configured\n * (in-process) plugin list or the statically-sandboxed entries.\n * Returns null when the plugin doesn't exist, undefined-equivalent\n * empty object when it declares no schema.\n */\nexport function getPluginSettingsSchema(\n\tconfiguredPlugins: ResolvedPlugin[],\n\tsandboxedPluginEntries: SandboxedPluginEntry[],\n\tpluginId: string,\n): Record<string, SettingField> | null {\n\tconst plugin = configuredPlugins.find((p) => p.id === pluginId);\n\tif (plugin) return plugin.admin.settingsSchema ?? {};\n\n\tconst sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);\n\tif (sandboxed) return sandboxed.settingsSchema ?? {};\n\n\treturn null;\n}\n\n/**\n * Validate a single value against its schema field.\n * Returns an error message, or null when valid.\n */\nfunction validateValue(key: string, field: SettingField, value: unknown): string | null {\n\tswitch (field.type) {\n\t\tcase \"string\":\n\t\tcase \"secret\":\n\t\tcase \"url\":\n\t\tcase \"email\":\n\t\t\tif (typeof value !== \"string\") return `Setting \"${key}\" must be a string`;\n\t\t\tif (field.type === \"url\" && value !== \"\" && !URL.canParse(value)) {\n\t\t\t\treturn `Setting \"${key}\" must be a valid URL`;\n\t\t\t}\n\t\t\tif (field.type === \"email\" && value !== \"\" && !value.includes(\"@\")) {\n\t\t\t\treturn `Setting \"${key}\" must be a valid email address`;\n\t\t\t}\n\t\t\treturn null;\n\t\tcase \"number\": {\n\t\t\tif (typeof value !== \"number\" || Number.isNaN(value)) {\n\t\t\t\treturn `Setting \"${key}\" must be a number`;\n\t\t\t}\n\t\t\tif (field.min !== undefined && value < field.min) {\n\t\t\t\treturn `Setting \"${key}\" must be at least ${field.min}`;\n\t\t\t}\n\t\t\tif (field.max !== undefined && value > field.max) {\n\t\t\t\treturn `Setting \"${key}\" must be at most ${field.max}`;\n\t\t\t}\n\t\t\treturn null;\n\t\t}\n\t\tcase \"boolean\":\n\t\t\treturn typeof value === \"boolean\" ? null : `Setting \"${key}\" must be a boolean`;\n\t\tcase \"select\":\n\t\t\tif (typeof value !== \"string\" || !field.options.some((o) => o.value === value)) {\n\t\t\t\treturn `Setting \"${key}\" must be one of the defined options`;\n\t\t\t}\n\t\t\treturn null;\n\t\tdefault: {\n\t\t\tconst _exhaustive: never = field;\n\t\t\treturn `Setting \"${key}\" has an unknown field type`;\n\t\t}\n\t}\n}\n\nasync function buildSettingsResponse(\n\toptionsRepo: OptionsRepository,\n\tpluginId: string,\n\tschema: Record<string, SettingField>,\n): Promise<PluginSettingsResponse> {\n\tconst keys = Object.keys(schema);\n\tconst stored = await optionsRepo.getMany(keys.map((key) => settingsKey(pluginId, key)));\n\n\tconst values: Record<string, unknown> = {};\n\tconst secretsSet: Record<string, boolean> = {};\n\n\tfor (const key of keys) {\n\t\tconst field = schema[key];\n\t\tif (!field) continue;\n\t\tconst storedValue = stored.get(settingsKey(pluginId, key));\n\n\t\tif (field.type === \"secret\") {\n\t\t\tsecretsSet[key] = typeof storedValue === \"string\" && storedValue.length > 0;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (storedValue !== undefined && storedValue !== null) {\n\t\t\tvalues[key] = storedValue;\n\t\t} else if (\"default\" in field && field.default !== undefined) {\n\t\t\tvalues[key] = field.default;\n\t\t} else {\n\t\t\tvalues[key] = null;\n\t\t}\n\t}\n\n\treturn { schema, values, secretsSet };\n}\n\n/**\n * Get a plugin's settings (schema + current values, secrets masked)\n */\nexport async function handlePluginSettingsGet(\n\tdb: Kysely<Database>,\n\tpluginId: string,\n\tschema: Record<string, SettingField>,\n): Promise<ApiResult<PluginSettingsResponse>> {\n\ttry {\n\t\tconst optionsRepo = new OptionsRepository(db);\n\t\treturn { success: true, data: await buildSettingsResponse(optionsRepo, pluginId, schema) };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: ErrorCode.PLUGIN_SETTINGS_READ_ERROR,\n\t\t\t\tmessage: \"Failed to read plugin settings\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Update a plugin's settings.\n *\n * Only keys present in `updates` are written. A `null` value deletes the\n * stored value (reverting to the schema default). Secret fields are\n * write-only: they accept a new string value or `null` to clear, and the\n * response never echoes them back.\n */\nexport async function handlePluginSettingsUpdate(\n\tdb: Kysely<Database>,\n\tpluginId: string,\n\tschema: Record<string, SettingField>,\n\tupdates: Record<string, unknown>,\n): Promise<ApiResult<PluginSettingsResponse>> {\n\ttry {\n\t\t// Validate everything before writing anything.\n\t\tfor (const [key, value] of Object.entries(updates)) {\n\t\t\tconst field = schema[key];\n\t\t\tif (!field) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: ErrorCode.VALIDATION_ERROR,\n\t\t\t\t\t\tmessage: `Unknown setting \"${key}\" for plugin \"${pluginId}\"`,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (value === null) continue;\n\t\t\tconst error = validateValue(key, field, value);\n\t\t\tif (error) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: { code: ErrorCode.VALIDATION_ERROR, message: error },\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Wrap the writes + read-back in a transaction so a partial failure\n\t\t// can't leave some settings updated and others not. On D1\n\t\t// withTransaction degrades to running the callback directly — D1 is\n\t\t// single-writer, so per-statement atomicity still holds.\n\t\tconst data = await withTransaction(db, async (trx) => {\n\t\t\tconst txRepo = new OptionsRepository(trx);\n\t\t\tfor (const [key, value] of Object.entries(updates)) {\n\t\t\t\tif (value === null) {\n\t\t\t\t\tawait txRepo.delete(settingsKey(pluginId, key));\n\t\t\t\t} else {\n\t\t\t\t\tawait txRepo.set(settingsKey(pluginId, key), value);\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn buildSettingsResponse(txRepo, pluginId, schema);\n\t\t});\n\n\t\treturn { success: true, data };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: ErrorCode.PLUGIN_SETTINGS_UPDATE_ERROR,\n\t\t\t\tmessage: \"Failed to update plugin settings\",\n\t\t\t},\n\t\t};\n\t}\n}\n","/**\n * MarketplaceClient — HTTP client for the EmDash Plugin Marketplace\n *\n * Used by the install/update/proxy endpoints in EmDash core to communicate\n * with the marketplace Worker. The marketplace is a distribution channel,\n * not a runtime dependency — bundles are copied to site-local R2 at install time.\n */\n\nimport { createGzipDecoder, unpackTar } from \"modern-tar\";\n\nimport { pluginManifestSchema, reconcileManifestAccess } from \"./manifest-schema.js\";\nimport type { PluginManifest } from \"./types.js\";\n\n// ── Module-level regex patterns ───────────────────────────────────\n\nconst TRAILING_SLASHES = /\\/+$/;\nconst LEADING_DOT_SLASH = /^\\.\\//;\n\n// ── Types ──────────────────────────────────────────────────────────\n\nexport interface MarketplacePluginSummary {\n\tid: string;\n\tname: string;\n\tdescription: string | null;\n\tauthor: {\n\t\tname: string;\n\t\tverified: boolean;\n\t\tavatarUrl: string | null;\n\t};\n\tcapabilities: string[];\n\tkeywords: string[];\n\tinstallCount: number;\n\thasIcon: boolean;\n\ticonUrl: string;\n\tlatestVersion?: {\n\t\tversion: string;\n\t\taudit?: {\n\t\t\tverdict: string;\n\t\t\triskScore: number;\n\t\t};\n\t\timageAudit?: {\n\t\t\tverdict: string;\n\t\t};\n\t};\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface MarketplaceVersionSummary {\n\tversion: string;\n\tminEmDashVersion: string | null;\n\tbundleSize: number;\n\tchecksum: string;\n\tchangelog: string | null;\n\tcapabilities: string[];\n\tstatus: string;\n\tauditVerdict: string | null;\n\timageAuditVerdict: string | null;\n\tpublishedAt: string;\n}\n\nexport interface MarketplacePluginDetail extends MarketplacePluginSummary {\n\trepositoryUrl: string | null;\n\thomepageUrl: string | null;\n\tlicense: string | null;\n\tlatestVersion?: {\n\t\tversion: string;\n\t\tminEmDashVersion: string | null;\n\t\tbundleSize: number;\n\t\tchecksum: string;\n\t\tchangelog: string | null;\n\t\treadme: string | null;\n\t\thasIcon: boolean;\n\t\tscreenshotCount: number;\n\t\tscreenshotUrls: string[];\n\t\tcapabilities: string[];\n\t\tstatus: string;\n\t\taudit?: {\n\t\t\tverdict: string;\n\t\t\triskScore: number;\n\t\t};\n\t\timageAudit?: {\n\t\t\tverdict: string;\n\t\t};\n\t\tpublishedAt: string;\n\t};\n}\n\nexport interface MarketplaceSearchOpts {\n\tcategory?: string;\n\tcapability?: string;\n\tsort?: \"installs\" | \"updated\" | \"created\" | \"name\";\n\tcursor?: string;\n\tlimit?: number;\n}\n\nexport interface MarketplaceSearchResult {\n\titems: MarketplacePluginSummary[];\n\tnextCursor?: string;\n}\n\n// ── Theme types ───────────────────────────────────────────────────\n\nexport interface MarketplaceThemeSummary {\n\tid: string;\n\tname: string;\n\tdescription: string | null;\n\tauthor: {\n\t\tname: string;\n\t\tverified: boolean;\n\t\tavatarUrl: string | null;\n\t};\n\tkeywords: string[];\n\tpreviewUrl: string;\n\tdemoUrl: string | null;\n\thasThumbnail: boolean;\n\tthumbnailUrl: string | null;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface MarketplaceThemeDetail extends MarketplaceThemeSummary {\n\tauthor: {\n\t\tid: string;\n\t\tname: string;\n\t\tverified: boolean;\n\t\tavatarUrl: string | null;\n\t};\n\trepositoryUrl: string | null;\n\thomepageUrl: string | null;\n\tlicense: string | null;\n\tscreenshotCount: number;\n\tscreenshotUrls: string[];\n}\n\nexport interface MarketplaceThemeSearchOpts {\n\tkeyword?: string;\n\tsort?: \"name\" | \"created\" | \"updated\";\n\tcursor?: string;\n\tlimit?: number;\n}\n\nexport interface MarketplaceThemeSearchResult {\n\titems: MarketplaceThemeSummary[];\n\tnextCursor?: string;\n}\n\nexport interface PluginBundle {\n\tmanifest: PluginManifest;\n\tbackendCode: string;\n\tadminCode?: string;\n\tchecksum: string;\n}\n\n// ── Interface ──────────────────────────────────────────────────────\n\nexport interface MarketplaceClient {\n\t/** Search the marketplace catalog */\n\tsearch(query?: string, opts?: MarketplaceSearchOpts): Promise<MarketplaceSearchResult>;\n\n\t/** Get full plugin detail */\n\tgetPlugin(id: string): Promise<MarketplacePluginDetail>;\n\n\t/** Get version history for a plugin */\n\tgetVersions(id: string): Promise<MarketplaceVersionSummary[]>;\n\n\t/** Download and extract a plugin bundle */\n\tdownloadBundle(id: string, version: string): Promise<PluginBundle>;\n\n\t/** Fire-and-forget install stat (never throws) */\n\treportInstall(id: string, version: string): Promise<void>;\n\n\t/** Search theme listings */\n\tsearchThemes(\n\t\tquery?: string,\n\t\topts?: MarketplaceThemeSearchOpts,\n\t): Promise<MarketplaceThemeSearchResult>;\n\n\t/** Get full theme detail */\n\tgetTheme(id: string): Promise<MarketplaceThemeDetail>;\n}\n\n// ── Errors ─────────────────────────────────────────────────────────\n\nexport class MarketplaceError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic readonly status?: number,\n\t\tpublic readonly code?: string,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"MarketplaceError\";\n\t}\n}\n\nexport class MarketplaceUnavailableError extends MarketplaceError {\n\tconstructor(cause?: unknown) {\n\t\tsuper(\"Plugin marketplace is unavailable\", undefined, \"MARKETPLACE_UNAVAILABLE\");\n\t\tif (cause) this.cause = cause;\n\t}\n}\n\n// ── Implementation ─────────────────────────────────────────────────\n\nclass MarketplaceClientImpl implements MarketplaceClient {\n\tprivate readonly baseUrl: string;\n\tprivate readonly siteOrigin: string | undefined;\n\n\tconstructor(baseUrl: string, siteOrigin?: string) {\n\t\t// Strip trailing slash\n\t\tthis.baseUrl = baseUrl.replace(TRAILING_SLASHES, \"\");\n\t\tthis.siteOrigin = siteOrigin;\n\t}\n\n\tasync search(query?: string, opts?: MarketplaceSearchOpts): Promise<MarketplaceSearchResult> {\n\t\tconst params = new URLSearchParams();\n\t\tif (query) params.set(\"q\", query);\n\t\tif (opts?.category) params.set(\"category\", opts.category);\n\t\tif (opts?.capability) params.set(\"capability\", opts.capability);\n\t\tif (opts?.sort) params.set(\"sort\", opts.sort);\n\t\tif (opts?.cursor) params.set(\"cursor\", opts.cursor);\n\t\tif (opts?.limit) params.set(\"limit\", String(opts.limit));\n\n\t\tconst qs = params.toString();\n\t\tconst url = `${this.baseUrl}/api/v1/plugins${qs ? `?${qs}` : \"\"}`;\n\t\tconst data = await this.fetchJson<MarketplaceSearchResult>(url);\n\t\treturn data;\n\t}\n\n\tasync getPlugin(id: string): Promise<MarketplacePluginDetail> {\n\t\tconst url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}`;\n\t\treturn this.fetchJson<MarketplacePluginDetail>(url);\n\t}\n\n\tasync getVersions(id: string): Promise<MarketplaceVersionSummary[]> {\n\t\tconst url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/versions`;\n\t\tconst data = await this.fetchJson<{ items: MarketplaceVersionSummary[] }>(url);\n\t\treturn data.items;\n\t}\n\n\tasync downloadBundle(id: string, version: string): Promise<PluginBundle> {\n\t\tconst bundleUrl = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/versions/${encodeURIComponent(version)}/bundle`;\n\n\t\tconst marketplaceOrigin = new URL(this.baseUrl).origin;\n\t\tconst MAX_REDIRECTS = 5;\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tlet currentUrl = bundleUrl;\n\t\t\tresponse = await fetch(currentUrl, { redirect: \"manual\" });\n\n\t\t\t// Follow redirects manually, validating each target stays on the marketplace host\n\t\t\tfor (let i = 0; i < MAX_REDIRECTS; i++) {\n\t\t\t\tif (response.status < 300 || response.status >= 400) break;\n\n\t\t\t\tconst location = response.headers.get(\"location\");\n\t\t\t\tif (!location) break;\n\n\t\t\t\tconst target = new URL(location, currentUrl);\n\t\t\t\tif (target.origin !== marketplaceOrigin) {\n\t\t\t\t\tthrow new MarketplaceError(\n\t\t\t\t\t\t`Bundle download redirected to untrusted host: ${target.origin}`,\n\t\t\t\t\t\tresponse.status,\n\t\t\t\t\t\t\"BUNDLE_REDIRECT_UNTRUSTED\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tcurrentUrl = target.href;\n\t\t\t\tresponse = await fetch(currentUrl, { redirect: \"manual\" });\n\t\t\t}\n\n\t\t\t// If still a redirect after MAX_REDIRECTS, fail explicitly\n\t\t\tif (response.status >= 300 && response.status < 400) {\n\t\t\t\tthrow new MarketplaceError(\n\t\t\t\t\t`Bundle download exceeded maximum redirects (${MAX_REDIRECTS})`,\n\t\t\t\t\tresponse.status,\n\t\t\t\t\t\"BUNDLE_TOO_MANY_REDIRECTS\",\n\t\t\t\t);\n\t\t\t}\n\t\t} catch (err) {\n\t\t\tif (err instanceof MarketplaceError) throw err;\n\t\t\tthrow new MarketplaceUnavailableError(err);\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t`Failed to download bundle: ${response.status} ${response.statusText}`,\n\t\t\t\tresponse.status,\n\t\t\t\t\"BUNDLE_DOWNLOAD_FAILED\",\n\t\t\t);\n\t\t}\n\n\t\tconst tarballBytes = new Uint8Array(await response.arrayBuffer());\n\t\ttry {\n\t\t\treturn await extractBundle(tarballBytes);\n\t\t} catch (err) {\n\t\t\tif (err instanceof MarketplaceError) throw err;\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t\"Failed to extract plugin bundle\",\n\t\t\t\tundefined,\n\t\t\t\t\"BUNDLE_EXTRACT_FAILED\",\n\t\t\t);\n\t\t}\n\t}\n\n\tasync reportInstall(id: string, version: string): Promise<void> {\n\t\t// Generate a stable site hash from the site origin (best-effort, non-identifying)\n\t\tconst siteHash = await generateSiteHash(this.siteOrigin);\n\t\tconst url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/installs`;\n\n\t\ttry {\n\t\t\tawait fetch(url, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\t\tbody: JSON.stringify({ siteHash, version }),\n\t\t\t});\n\t\t} catch {\n\t\t\t// Fire-and-forget — never throw\n\t\t}\n\t}\n\n\tasync searchThemes(\n\t\tquery?: string,\n\t\topts?: MarketplaceThemeSearchOpts,\n\t): Promise<MarketplaceThemeSearchResult> {\n\t\tconst params = new URLSearchParams();\n\t\tif (query) params.set(\"q\", query);\n\t\tif (opts?.keyword) params.set(\"keyword\", opts.keyword);\n\t\tif (opts?.sort) params.set(\"sort\", opts.sort);\n\t\tif (opts?.cursor) params.set(\"cursor\", opts.cursor);\n\t\tif (opts?.limit) params.set(\"limit\", String(opts.limit));\n\n\t\tconst qs = params.toString();\n\t\tconst url = `${this.baseUrl}/api/v1/themes${qs ? `?${qs}` : \"\"}`;\n\t\treturn this.fetchJson<MarketplaceThemeSearchResult>(url);\n\t}\n\n\tasync getTheme(id: string): Promise<MarketplaceThemeDetail> {\n\t\tconst url = `${this.baseUrl}/api/v1/themes/${encodeURIComponent(id)}`;\n\t\treturn this.fetchJson<MarketplaceThemeDetail>(url);\n\t}\n\n\tprivate async fetchJson<T>(url: string): Promise<T> {\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(url, {\n\t\t\t\theaders: { Accept: \"application/json\" },\n\t\t\t});\n\t\t} catch (err) {\n\t\t\tthrow new MarketplaceUnavailableError(err);\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tlet errorMessage = `Marketplace request failed: ${response.status}`;\n\t\t\ttry {\n\t\t\t\tconst body: { error?: string } = await response.json();\n\t\t\t\tif (body.error) errorMessage = body.error;\n\t\t\t} catch {\n\t\t\t\t// use default message\n\t\t\t}\n\t\t\tthrow new MarketplaceError(errorMessage, response.status);\n\t\t}\n\n\t\tconst data: T = await response.json();\n\t\treturn data;\n\t}\n}\n\n// ── Bundle extraction ──────────────────────────────────────────────\n\n/**\n * Extract manifest + code files from a tarball.\n *\n * The tarball is a gzipped tar archive containing:\n * - manifest.json\n * - backend.js\n * - admin.js (optional)\n *\n * We use a minimal tar parser since we only need to read a few small files.\n */\n/**\n * Exported so the experimental registry install handler can reuse the\n * same parse / validate / hash primitive. Despite the file name, this\n * function predates the marketplace-vs-registry split and is generic\n * over plugin bundle tarballs regardless of distribution channel.\n */\n// Aligns with RFC 0001 §\"Bundle size limits\" (256 KiB decompressed,\n// 20 files). Matches `MAX_BUNDLE_SIZE` in cli/commands/bundle-utils.ts\n// (the publish-side cap). We don't import that constant to keep this\n// runtime module independent of the CLI; the two values are\n// load-bearing identical and must stay in sync.\n//\n// Tar adds per-file headers (~512 bytes each) plus directory entries,\n// so the entry count cap is set comfortably above RFC's 20-file limit.\n// Going over either is a strong signal the bundle isn't a legitimate\n// sandboxed plugin.\nconst MAX_DECOMPRESSED_BUNDLE_BYTES = 256 * 1024;\nconst MAX_BUNDLE_TAR_ENTRIES = 32;\n\nexport async function extractBundle(tarballBytes: Uint8Array): Promise<PluginBundle> {\n\t// Decompress fully into memory first, then parse the tar.\n\t// Passing a pipeThrough() stream directly to unpackTar causes a backpressure\n\t// deadlock in workerd: the tar decoder's body-stream pull() needs more\n\t// decompressed data, but the upstream pipe is stalled waiting for the\n\t// decoder's writable side to drain — a circular dependency.\n\tconst decompressedStream = new ReadableStream<Uint8Array>({\n\t\tstart(controller) {\n\t\t\tcontroller.enqueue(tarballBytes);\n\t\t\tcontroller.close();\n\t\t},\n\t}).pipeThrough(createGzipDecoder());\n\n\t// Collect decompressed bytes with a hard cap. A gzip-bomb -- a small\n\t// tarball that decompresses to gigabytes -- otherwise exhausts\n\t// worker / Node memory before we know to reject it. The cap matches\n\t// RFC 0001's publish-time bundle size limit (MAX_DECOMPRESSED_BUNDLE_BYTES);\n\t// anything past that isn't a legitimate sandboxed plugin.\n\tconst reader = decompressedStream.getReader();\n\tconst chunks: Uint8Array[] = [];\n\tlet total = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\tif (!value) continue;\n\t\ttotal += value.byteLength;\n\t\tif (total > MAX_DECOMPRESSED_BUNDLE_BYTES) {\n\t\t\ttry {\n\t\t\t\tawait reader.cancel();\n\t\t\t} catch {\n\t\t\t\t// nothing to do\n\t\t\t}\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t`Bundle decompressed size exceeds limit (${MAX_DECOMPRESSED_BUNDLE_BYTES} bytes)`,\n\t\t\t\tundefined,\n\t\t\t\t\"INVALID_BUNDLE\",\n\t\t\t);\n\t\t}\n\t\tchunks.push(value);\n\t}\n\tconst decompressedBytes = new Uint8Array(total);\n\t{\n\t\tlet offset = 0;\n\t\tfor (const chunk of chunks) {\n\t\t\tdecompressedBytes.set(chunk, offset);\n\t\t\toffset += chunk.byteLength;\n\t\t}\n\t}\n\n\tconst decompressed = new ReadableStream<Uint8Array>({\n\t\tstart(controller) {\n\t\t\tcontroller.enqueue(decompressedBytes);\n\t\t\tcontroller.close();\n\t\t},\n\t});\n\n\tconst entries = await unpackTar(decompressed);\n\tif (entries.length > MAX_BUNDLE_TAR_ENTRIES) {\n\t\tthrow new MarketplaceError(\n\t\t\t`Bundle has too many tar entries (${entries.length} > ${MAX_BUNDLE_TAR_ENTRIES})`,\n\t\t\tundefined,\n\t\t\t\"INVALID_BUNDLE\",\n\t\t);\n\t}\n\n\tconst decoder = new TextDecoder();\n\tconst files = new Map<string, string>();\n\tfor (const entry of entries) {\n\t\tif (entry.data && entry.header.type === \"file\") {\n\t\t\t// Strip leading ./ prefix that tar tools commonly add\n\t\t\tconst name = entry.header.name.replace(LEADING_DOT_SLASH, \"\");\n\t\t\tfiles.set(name, decoder.decode(entry.data));\n\t\t}\n\t}\n\n\tconst manifestJson = files.get(\"manifest.json\");\n\tconst backendCode = files.get(\"backend.js\");\n\n\tif (!manifestJson) {\n\t\tthrow new MarketplaceError(\n\t\t\t\"Invalid bundle: missing manifest.json\",\n\t\t\tundefined,\n\t\t\t\"INVALID_BUNDLE\",\n\t\t);\n\t}\n\tif (!backendCode) {\n\t\tthrow new MarketplaceError(\"Invalid bundle: missing backend.js\", undefined, \"INVALID_BUNDLE\");\n\t}\n\n\tlet manifest: PluginManifest;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(manifestJson);\n\t\tconst result = pluginManifestSchema.safeParse(parsed);\n\t\tif (!result.success) {\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t\"Invalid bundle: manifest.json failed validation\",\n\t\t\t\tundefined,\n\t\t\t\t\"INVALID_BUNDLE\",\n\t\t\t);\n\t\t}\n\t\tmanifest = reconcileManifestAccess(result.data);\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceError) throw err;\n\t\tthrow new MarketplaceError(\n\t\t\t\"Invalid bundle: malformed manifest.json\",\n\t\t\tundefined,\n\t\t\t\"INVALID_BUNDLE\",\n\t\t);\n\t}\n\n\t// Compute SHA-256 checksum of the tarball for verification\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Uint8Array is a valid BufferSource at runtime; TS lib mismatch\n\tconst hashBuffer = await crypto.subtle.digest(\"SHA-256\", tarballBytes as unknown as BufferSource);\n\tconst hashArray = new Uint8Array(hashBuffer);\n\tconst checksum = Array.from(hashArray, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n\treturn {\n\t\tmanifest,\n\t\tbackendCode,\n\t\tadminCode: files.get(\"admin.js\"),\n\t\tchecksum,\n\t};\n}\n\n// ── Helpers ────────────────────────────────────────────────────────\n\n/**\n * Generate a stable non-identifying site hash from the site origin.\n * The same origin always produces the same hash, so the marketplace\n * installs table deduplicates correctly per (plugin_id, site_hash).\n */\nasync function generateSiteHash(siteOrigin?: string): Promise<string> {\n\tconst seed = siteOrigin ? `emdash-site:${siteOrigin}` : `emdash-anonymous`;\n\ttry {\n\t\tconst hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(seed));\n\t\tconst arr = new Uint8Array(hash);\n\t\treturn Array.from(arr.slice(0, 8), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\t} catch {\n\t\t// Fallback for environments without crypto.subtle: FNV-1a hash encoded as hex.\n\t\t// Deterministic, uniform distribution, no origin leakage.\n\t\tlet h = 0x811c9dc5;\n\t\tfor (let i = 0; i < seed.length; i++) {\n\t\t\th ^= seed.charCodeAt(i);\n\t\t\th = Math.imul(h, 0x01000193);\n\t\t}\n\t\tconst h2 = h ^ (h >>> 16);\n\t\treturn (h >>> 0).toString(16).padStart(8, \"0\") + (h2 >>> 0).toString(16).padStart(8, \"0\");\n\t}\n}\n\n// ── Factory ────────────────────────────────────────────────────────\n\n/**\n * Create a MarketplaceClient for the given marketplace URL.\n *\n * @param baseUrl - The marketplace API base URL (e.g. \"https://marketplace.emdashcms.com\")\n * @param siteOrigin - The origin of the EmDash site (e.g. \"https://myblog.example.com\").\n *   Used to generate a stable, non-identifying site hash for install deduplication.\n */\nexport function createMarketplaceClient(baseUrl: string, siteOrigin?: string): MarketplaceClient {\n\treturn new MarketplaceClientImpl(baseUrl, siteOrigin);\n}\n","/**\n * Plugin Storage Index Management\n *\n * Manages expression indexes on the _plugin_storage table for efficient queries.\n *\n * @see PLUGIN-SYSTEM.md § Plugin Storage > Index Management\n */\n\nimport type { Kysely, RawBuilder } from \"kysely\";\nimport { sql } from \"kysely\";\n\nimport { jsonExtractExpr, isPostgres } from \"../database/dialect-helpers.js\";\nimport type { Database } from \"../database/types.js\";\nimport {\n\tvalidateJsonFieldName,\n\tvalidatePluginIdentifier,\n\tvalidateStorageCollectionName,\n} from \"../database/validate.js\";\n\n/**\n * Generate a deterministic index name.\n * Unique indexes use a `uidx_` prefix to avoid collisions with regular indexes on the same fields.\n */\nexport function generateIndexName(\n\tpluginId: string,\n\tcollection: string,\n\tfields: string[],\n\toptions?: { unique?: boolean },\n): string {\n\tconst prefix = options?.unique ? \"uidx\" : \"idx\";\n\tconst fieldPart = fields.join(\"_\");\n\t// SQLite index names have no length limit, but keep it reasonable\n\treturn `${prefix}_plugin_${pluginId}_${collection}_${fieldPart}`.substring(0, 128);\n}\n\n/**\n * Generate a Kysely sql expression for creating an expression index.\n *\n * Validates all inputs before interpolation. The collection uses the\n * permissive manifest-key rules rather than SQL-identifier rules — it is\n * stored as opaque text and only reaches SQL inside the generated index\n * name — so kebab-case collections index like any other.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function generateCreateIndexSql(\n\tdb: Kysely<any>,\n\tpluginId: string,\n\tcollection: string,\n\tfields: string[],\n\toptions?: { unique?: boolean },\n): RawBuilder<unknown> {\n\tvalidatePluginIdentifier(pluginId, \"plugin ID\");\n\tvalidateStorageCollectionName(collection, \"collection name\");\n\tfor (const field of fields) {\n\t\tvalidateJsonFieldName(field, \"index field name\");\n\t}\n\n\tconst indexName = generateIndexName(pluginId, collection, fields, options);\n\n\t// Build the indexed expressions\n\t// Fields are validated above, safe to interpolate into json path\n\tconst expressions = fields\n\t\t.map((field) => {\n\t\t\tif (isPostgres(db)) {\n\t\t\t\t// Postgres expression indexes need parens around the expression\n\t\t\t\treturn `(${jsonExtractExpr(db, \"data\", field)})`;\n\t\t\t}\n\t\t\treturn jsonExtractExpr(db, \"data\", field);\n\t\t})\n\t\t.join(\", \");\n\n\t// Composite non-partial index: the leading (plugin_id, collection) columns\n\t// scope it per plugin/collection — including unique-index semantics — and\n\t// let it serve the repository's bound-parameter WHERE plus the JSON\n\t// expression ORDER BY. A partial index (WHERE plugin_id = 'x' AND\n\t// collection = 'y') is never chosen by SQLite under bound parameters\n\t// unless ANALYZE has run, and D1 never runs ANALYZE.\n\tconst createKeyword = options?.unique ? \"CREATE UNIQUE INDEX\" : \"CREATE INDEX\";\n\treturn sql`${sql.raw(createKeyword)} IF NOT EXISTS ${sql.ref(indexName)}\n\t\tON _plugin_storage(plugin_id, collection, ${sql.raw(expressions)})\n\t`;\n}\n\n/**\n * Generate a Kysely sql expression for dropping an index.\n *\n * Uses sql.ref() for safe identifier quoting.\n */\nexport function generateDropIndexSql(indexName: string): RawBuilder<unknown> {\n\treturn sql`DROP INDEX IF EXISTS ${sql.ref(indexName)}`;\n}\n\n/**\n * Normalize index declarations to arrays of field arrays\n */\nexport function normalizeIndexes(indexes: Array<string | string[]>): string[][] {\n\treturn indexes.map((index) => (Array.isArray(index) ? index : [index]));\n}\n\n/**\n * Create all declared indexes for a plugin collection\n */\nexport async function createStorageIndexes(\n\tdb: Kysely<Database>,\n\tpluginId: string,\n\tcollection: string,\n\tindexes: Array<string | string[]>,\n\toptions?: { uniqueIndexes?: Array<string | string[]> },\n): Promise<{\n\tcreated: string[];\n\terrors: Array<{ index: string; error: string }>;\n}> {\n\tconst normalized = normalizeIndexes(indexes);\n\tconst uniqueNormalized = options?.uniqueIndexes ? normalizeIndexes(options.uniqueIndexes) : [];\n\tconst uniqueSet = new Set(uniqueNormalized.map((f) => f.join(\",\")));\n\n\t// Deduplicate: if fields appear in both indexes and uniqueIndexes, only create the unique version\n\tconst deduped = normalized.filter((f) => !uniqueSet.has(f.join(\",\")));\n\tconst allEntries: Array<{ fields: string[]; unique: boolean }> = [\n\t\t...deduped.map((fields) => ({ fields, unique: false })),\n\t\t...uniqueNormalized.map((fields) => ({ fields, unique: true })),\n\t];\n\n\tconst created: string[] = [];\n\tconst errors: Array<{ index: string; error: string }> = [];\n\n\tfor (const entry of allEntries) {\n\t\tconst { fields } = entry;\n\t\tconst indexName = generateIndexName(pluginId, collection, fields, { unique: entry.unique });\n\n\t\ttry {\n\t\t\t// Create the index\n\t\t\tconst createSql = generateCreateIndexSql(db, pluginId, collection, fields, {\n\t\t\t\tunique: entry.unique,\n\t\t\t});\n\t\t\tawait createSql.execute(db);\n\n\t\t\t// Track in _plugin_indexes table\n\t\t\tawait db\n\t\t\t\t.insertInto(\"_plugin_indexes\")\n\t\t\t\t.values({\n\t\t\t\t\tplugin_id: pluginId,\n\t\t\t\t\tcollection,\n\t\t\t\t\tindex_name: indexName,\n\t\t\t\t\tfields: JSON.stringify(fields),\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc\n\t\t\t\t\t\t.columns([\"plugin_id\", \"collection\", \"index_name\"])\n\t\t\t\t\t\t.doUpdateSet({ fields: JSON.stringify(fields) }),\n\t\t\t\t)\n\t\t\t\t.execute();\n\n\t\t\tcreated.push(indexName);\n\t\t} catch (error) {\n\t\t\terrors.push({\n\t\t\t\tindex: indexName,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t}\n\t}\n\n\treturn { created, errors };\n}\n\n/**\n * Remove indexes that are no longer declared\n */\nexport async function removeOrphanedIndexes(\n\tdb: Kysely<Database>,\n\tpluginId: string,\n\tcollection: string,\n\tcurrentIndexes: Array<string | string[]>,\n\toptions?: { uniqueIndexes?: Array<string | string[]> },\n): Promise<{\n\tremoved: string[];\n\terrors: Array<{ index: string; error: string }>;\n}> {\n\tconst normalized = normalizeIndexes(currentIndexes);\n\tconst uniqueNormalized = options?.uniqueIndexes ? normalizeIndexes(options.uniqueIndexes) : [];\n\tconst uniqueSet = new Set(uniqueNormalized.map((f) => f.join(\",\")));\n\n\t// Build the set of expected index names (regular + unique with correct prefix)\n\tconst currentIndexNames = new Set<string>();\n\tfor (const fields of normalized) {\n\t\t// If this field set is in both, only the unique version exists (deduplication in create)\n\t\tif (!uniqueSet.has(fields.join(\",\"))) {\n\t\t\tcurrentIndexNames.add(generateIndexName(pluginId, collection, fields));\n\t\t}\n\t}\n\tfor (const fields of uniqueNormalized) {\n\t\tcurrentIndexNames.add(generateIndexName(pluginId, collection, fields, { unique: true }));\n\t}\n\n\t// Get existing indexes from tracking table\n\tconst existingIndexes = await db\n\t\t.selectFrom(\"_plugin_indexes\")\n\t\t.select([\"index_name\"])\n\t\t.where(\"plugin_id\", \"=\", pluginId)\n\t\t.where(\"collection\", \"=\", collection)\n\t\t.execute();\n\n\tconst removed: string[] = [];\n\tconst errors: Array<{ index: string; error: string }> = [];\n\n\tfor (const { index_name } of existingIndexes) {\n\t\tif (!currentIndexNames.has(index_name)) {\n\t\t\ttry {\n\t\t\t\t// Drop the index\n\t\t\t\tawait generateDropIndexSql(index_name).execute(db);\n\n\t\t\t\t// Remove from tracking table\n\t\t\t\tawait db\n\t\t\t\t\t.deleteFrom(\"_plugin_indexes\")\n\t\t\t\t\t.where(\"plugin_id\", \"=\", pluginId)\n\t\t\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t\t\t.where(\"index_name\", \"=\", index_name)\n\t\t\t\t\t.execute();\n\n\t\t\t\tremoved.push(index_name);\n\t\t\t} catch (error) {\n\t\t\t\terrors.push({\n\t\t\t\t\tindex: index_name,\n\t\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { removed, errors };\n}\n\n/**\n * Sync indexes for a plugin collection (create new, remove old)\n */\nexport async function syncStorageIndexes(\n\tdb: Kysely<Database>,\n\tpluginId: string,\n\tcollection: string,\n\tindexes: Array<string | string[]>,\n\toptions?: { uniqueIndexes?: Array<string | string[]> },\n): Promise<{\n\tcreated: string[];\n\tremoved: string[];\n\terrors: Array<{ index: string; error: string }>;\n}> {\n\tconst [createResult, removeResult] = await Promise.all([\n\t\tcreateStorageIndexes(db, pluginId, collection, indexes, options),\n\t\tremoveOrphanedIndexes(db, pluginId, collection, indexes, options),\n\t]);\n\n\treturn {\n\t\tcreated: createResult.created,\n\t\tremoved: removeResult.removed,\n\t\terrors: [...createResult.errors, ...removeResult.errors],\n\t};\n}\n\n/**\n * Materialize the storage indexes a set of plugins declare in their\n * manifests. Failures are logged per collection and never thrown — a missing\n * index affects query performance, not correctness, so it must not fail an\n * install or a scheduler tick.\n */\nexport async function syncDeclaredStorageIndexes(\n\tdb: Kysely<Database>,\n\tplugins: Array<{\n\t\tid: string;\n\t\tstorage?: Record<\n\t\t\tstring,\n\t\t\t{ indexes: Array<string | string[]>; uniqueIndexes?: Array<string | string[]> }\n\t\t>;\n\t}>,\n): Promise<void> {\n\tfor (const plugin of plugins) {\n\t\tfor (const [collection, config] of Object.entries(plugin.storage ?? {})) {\n\t\t\ttry {\n\t\t\t\tconst result = await syncStorageIndexes(db, plugin.id, collection, config.indexes, {\n\t\t\t\t\tuniqueIndexes: config.uniqueIndexes,\n\t\t\t\t});\n\t\t\t\tfor (const failure of result.errors) {\n\t\t\t\t\tconsole.error(\n\t\t\t\t\t\t`[plugins] Failed to sync storage index ${failure.index} for ${plugin.id}/${collection}: ${failure.error}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\n\t\t\t\t\t`[plugins] Failed to sync storage indexes for ${plugin.id}/${collection}:`,\n\t\t\t\t\terror,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n}\n\n/**\n * Remove all indexes for a plugin\n */\nexport async function removeAllPluginIndexes(\n\tdb: Kysely<Database>,\n\tpluginId: string,\n): Promise<{\n\tremoved: string[];\n\terrors: Array<{ index: string; error: string }>;\n}> {\n\tconst existingIndexes = await db\n\t\t.selectFrom(\"_plugin_indexes\")\n\t\t.select([\"index_name\", \"collection\"])\n\t\t.where(\"plugin_id\", \"=\", pluginId)\n\t\t.execute();\n\n\tconst removed: string[] = [];\n\tconst errors: Array<{ index: string; error: string }> = [];\n\n\tfor (const { index_name } of existingIndexes) {\n\t\ttry {\n\t\t\tawait generateDropIndexSql(index_name).execute(db);\n\t\t\tremoved.push(index_name);\n\t\t} catch (error) {\n\t\t\terrors.push({\n\t\t\t\tindex: index_name,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t}\n\t}\n\n\t// Clean up tracking table\n\tawait db.deleteFrom(\"_plugin_indexes\").where(\"plugin_id\", \"=\", pluginId).execute();\n\n\treturn { removed, errors };\n}\n\n/**\n * Get current index status for a plugin\n */\nexport async function getPluginIndexStatus(\n\tdb: Kysely<Database>,\n\tpluginId: string,\n): Promise<\n\tArray<{\n\t\tcollection: string;\n\t\tindexName: string;\n\t\tfields: string[];\n\t\tcreatedAt: string;\n\t}>\n> {\n\tconst rows = await db\n\t\t.selectFrom(\"_plugin_indexes\")\n\t\t.select([\"collection\", \"index_name\", \"fields\", \"created_at\"])\n\t\t.where(\"plugin_id\", \"=\", pluginId)\n\t\t.execute();\n\n\treturn rows.map((row) => {\n\t\tconst parsed: unknown = JSON.parse(row.fields);\n\t\tconst fields = Array.isArray(parsed)\n\t\t\t? parsed.filter((f): f is string => typeof f === \"string\")\n\t\t\t: [];\n\t\treturn {\n\t\t\tcollection: row.collection,\n\t\t\tindexName: row.index_name,\n\t\t\tfields,\n\t\t\tcreatedAt: row.created_at,\n\t\t};\n\t});\n}\n","/**\n * Marketplace plugin handlers\n *\n * Business logic for installing, updating, uninstalling, and checking\n * updates for marketplace plugins. Routes are thin wrappers around these.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport { validatePluginIdentifier } from \"../../database/validate.js\";\nimport { pluginManifestSchema, reconcileManifestAccess } from \"../../plugins/manifest-schema.js\";\nimport { normalizeManifestRoute } from \"../../plugins/manifest-schema.js\";\nimport {\n\tcreateMarketplaceClient,\n\tMarketplaceError,\n\tMarketplaceUnavailableError,\n\ttype MarketplaceClient,\n\ttype MarketplacePluginDetail,\n\ttype MarketplaceSearchOpts,\n\ttype MarketplaceThemeSearchOpts,\n\ttype MarketplaceVersionSummary,\n\ttype PluginBundle,\n} from \"../../plugins/marketplace.js\";\nimport type { SandboxRunner } from \"../../plugins/sandbox/types.js\";\nimport { PluginStateRepository } from \"../../plugins/state.js\";\nimport {\n\tremoveAllPluginIndexes,\n\tsyncDeclaredStorageIndexes,\n} from \"../../plugins/storage-indexes.js\";\nimport { normalizeCapabilities } from \"../../plugins/types.js\";\nimport type { PluginManifest } from \"../../plugins/types.js\";\nimport { EmDashStorageError } from \"../../storage/types.js\";\nimport type { Storage } from \"../../storage/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ── Types ──────────────────────────────────────────────────────────\n\nexport interface MarketplaceInstallResult {\n\tpluginId: string;\n\tversion: string;\n\tcapabilities: string[];\n}\n\nexport interface MarketplaceUpdateResult {\n\tpluginId: string;\n\toldVersion: string;\n\tnewVersion: string;\n\tcapabilityChanges: {\n\t\tadded: string[];\n\t\tremoved: string[];\n\t};\n\trouteVisibilityChanges?: {\n\t\tnewlyPublic: string[];\n\t};\n}\n\nexport interface MarketplaceUpdateCheck {\n\tpluginId: string;\n\tinstalled: string;\n\tlatest: string;\n\thasUpdate: boolean;\n\thasCapabilityChanges: boolean;\n\tcapabilityChanges?: {\n\t\tadded: string[];\n\t\tremoved: string[];\n\t};\n\thasRouteVisibilityChanges: boolean;\n\trouteVisibilityChanges?: {\n\t\tnewlyPublic: string[];\n\t};\n}\n\nexport interface MarketplaceUninstallResult {\n\tpluginId: string;\n\tdataDeleted: boolean;\n}\n\n// ── Helpers ────────────────────────────────────────────────────────\n\n/** Semver-like pattern: digits, dots, hyphens, plus signs (e.g. 1.0.0, 1.0.0-beta.1) */\nconst VERSION_PATTERN = /^[a-z0-9][a-z0-9._+-]*$/i;\n\nfunction validateVersion(version: string): void {\n\tif (version.includes(\"..\")) throw new Error(\"Invalid version format\");\n\tif (!VERSION_PATTERN.test(version)) {\n\t\tthrow new Error(\"Invalid version format\");\n\t}\n}\n\nfunction getClient(\n\tmarketplaceUrl: string | undefined,\n\tsiteOrigin?: string,\n): MarketplaceClient | null {\n\tif (!marketplaceUrl) return null;\n\treturn createMarketplaceClient(marketplaceUrl, siteOrigin);\n}\n\nexport function diffCapabilities(\n\toldCaps: string[],\n\tnewCaps: string[],\n): { added: string[]; removed: string[] } {\n\t// Normalize both sides before diffing so that an installed v1 manifest\n\t// declaring `read:content` and an upgrade v2 manifest declaring\n\t// `content:read` produces an empty diff — users should not see a\n\t// spurious \"capability changed\" prompt for a pure rename.\n\tconst oldNorm = normalizeCapabilities(oldCaps);\n\tconst newNorm = normalizeCapabilities(newCaps);\n\tconst oldSet = new Set(oldNorm);\n\tconst newSet = new Set(newNorm);\n\treturn {\n\t\tadded: newNorm.filter((c) => !oldSet.has(c)),\n\t\tremoved: oldNorm.filter((c) => !newSet.has(c)),\n\t};\n}\n\n/**\n * Diff route visibility between two manifests.\n * Returns routes that changed from private to public (newly exposed).\n */\nexport function diffRouteVisibility(\n\toldManifest: PluginManifest | undefined,\n\tnewManifest: PluginManifest,\n): { newlyPublic: string[] } {\n\tconst oldPublicRoutes = new Set<string>();\n\tif (oldManifest) {\n\t\tfor (const entry of oldManifest.routes) {\n\t\t\tconst normalized = normalizeManifestRoute(entry);\n\t\t\tif (normalized.public === true) {\n\t\t\t\toldPublicRoutes.add(normalized.name);\n\t\t\t}\n\t\t}\n\t}\n\n\tconst newlyPublic: string[] = [];\n\tfor (const entry of newManifest.routes) {\n\t\tconst normalized = normalizeManifestRoute(entry);\n\t\tif (normalized.public === true && !oldPublicRoutes.has(normalized.name)) {\n\t\t\tnewlyPublic.push(normalized.name);\n\t\t}\n\t}\n\n\treturn { newlyPublic };\n}\n\nasync function resolveVersionMetadata(\n\tclient: MarketplaceClient,\n\tpluginId: string,\n\tpluginDetail: MarketplacePluginDetail,\n\tversion: string,\n): Promise<MarketplaceVersionSummary | null> {\n\tif (pluginDetail.latestVersion?.version === version) {\n\t\treturn {\n\t\t\tversion: pluginDetail.latestVersion.version,\n\t\t\tminEmDashVersion: pluginDetail.latestVersion.minEmDashVersion,\n\t\t\tbundleSize: pluginDetail.latestVersion.bundleSize,\n\t\t\tchecksum: pluginDetail.latestVersion.checksum,\n\t\t\tchangelog: pluginDetail.latestVersion.changelog,\n\t\t\tcapabilities: pluginDetail.latestVersion.capabilities,\n\t\t\tstatus: pluginDetail.latestVersion.status,\n\t\t\tauditVerdict: pluginDetail.latestVersion.audit?.verdict ?? null,\n\t\t\timageAuditVerdict: pluginDetail.latestVersion.imageAudit?.verdict ?? null,\n\t\t\tpublishedAt: pluginDetail.latestVersion.publishedAt,\n\t\t};\n\t}\n\n\tconst versions = await client.getVersions(pluginId);\n\treturn versions.find((v) => v.version === version) ?? null;\n}\n\nfunction validateBundleIdentity(\n\tbundle: PluginBundle,\n\tpluginId: string,\n\tversion: string,\n): ApiResult<never> | null {\n\tif (bundle.manifest.id !== pluginId) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MANIFEST_MISMATCH\",\n\t\t\t\tmessage: `Bundle manifest ID (${bundle.manifest.id}) does not match requested plugin (${pluginId})`,\n\t\t\t},\n\t\t};\n\t}\n\n\tif (bundle.manifest.version !== version) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MANIFEST_VERSION_MISMATCH\",\n\t\t\t\tmessage: `Bundle manifest version (${bundle.manifest.version}) does not match requested version (${version})`,\n\t\t\t},\n\t\t};\n\t}\n\n\treturn null;\n}\n\n/** Store a plugin bundle's files in site-local R2 storage */\n/**\n * Storage source for an installed plugin bundle. Determines the R2\n * key prefix and is used to keep marketplace and registry installs\n * cleanly separated in object listings.\n */\nexport type PluginBundleSource = \"marketplace\" | \"registry\";\n\nfunction bundlePrefix(source: PluginBundleSource, pluginId: string, version: string): string {\n\treturn `${source}/${pluginId}/${version}`;\n}\n\nexport async function storeBundleInR2(\n\tstorage: Storage,\n\tpluginId: string,\n\tversion: string,\n\tbundle: PluginBundle,\n\tsource: PluginBundleSource = \"marketplace\",\n): Promise<void> {\n\tvalidatePluginIdentifier(pluginId, \"plugin ID\");\n\tvalidateVersion(version);\n\tconst prefix = bundlePrefix(source, pluginId, version);\n\n\t// Store manifest\n\tawait storage.upload({\n\t\tkey: `${prefix}/manifest.json`,\n\t\tbody: new TextEncoder().encode(JSON.stringify(bundle.manifest)),\n\t\tcontentType: \"application/json\",\n\t});\n\n\t// Store backend code\n\tawait storage.upload({\n\t\tkey: `${prefix}/backend.js`,\n\t\tbody: new TextEncoder().encode(bundle.backendCode),\n\t\tcontentType: \"application/javascript\",\n\t});\n\n\t// Store admin code if present\n\tif (bundle.adminCode) {\n\t\tawait storage.upload({\n\t\t\tkey: `${prefix}/admin.js`,\n\t\t\tbody: new TextEncoder().encode(bundle.adminCode),\n\t\t\tcontentType: \"application/javascript\",\n\t\t});\n\t}\n}\n\n/** Read a ReadableStream to string */\nasync function streamToText(stream: ReadableStream<Uint8Array>): Promise<string> {\n\treturn new Response(stream).text();\n}\n\n/**\n * Load a plugin bundle from site-local R2 storage.\n *\n * `source` selects the R2 key prefix: marketplace plugins are stored\n * under `marketplace/<id>/<version>/`, registry plugins under\n * `registry/<id>/<version>/`. Defaults to `\"marketplace\"` for\n * backwards compatibility with pre-registry call sites.\n */\nexport async function loadBundleFromR2(\n\tstorage: Storage,\n\tpluginId: string,\n\tversion: string,\n\tsource: PluginBundleSource = \"marketplace\",\n): Promise<{ manifest: PluginManifest; backendCode: string; adminCode?: string } | null> {\n\tvalidatePluginIdentifier(pluginId, \"plugin ID\");\n\tvalidateVersion(version);\n\tconst prefix = bundlePrefix(source, pluginId, version);\n\n\ttry {\n\t\tconst manifestResult = await storage.download(`${prefix}/manifest.json`);\n\t\tconst backendResult = await storage.download(`${prefix}/backend.js`);\n\n\t\tconst manifestText = await streamToText(manifestResult.body);\n\t\tconst backendCode = await streamToText(backendResult.body);\n\t\tconst parsed: unknown = JSON.parse(manifestText);\n\t\tconst result = pluginManifestSchema.safeParse(parsed);\n\t\tif (!result.success) return null;\n\t\tconst manifest = reconcileManifestAccess(result.data);\n\n\t\t// Try to load admin code (optional)\n\t\tlet adminCode: string | undefined;\n\t\ttry {\n\t\t\tconst adminResult = await storage.download(`${prefix}/admin.js`);\n\t\t\tadminCode = await streamToText(adminResult.body);\n\t\t} catch {\n\t\t\t// admin.js is optional\n\t\t}\n\n\t\treturn { manifest, backendCode, adminCode };\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/** Delete a plugin bundle from site-local R2 storage */\nexport async function deleteBundleFromR2(\n\tstorage: Storage,\n\tpluginId: string,\n\tversion: string,\n\tsource: PluginBundleSource = \"marketplace\",\n): Promise<void> {\n\tvalidatePluginIdentifier(pluginId, \"plugin ID\");\n\tvalidateVersion(version);\n\tconst prefix = bundlePrefix(source, pluginId, version);\n\tconst files = [\"manifest.json\", \"backend.js\", \"admin.js\"];\n\n\tfor (const file of files) {\n\t\ttry {\n\t\t\tawait storage.delete(`${prefix}/${file}`);\n\t\t} catch {\n\t\t\t// Ignore missing files\n\t\t}\n\t}\n}\n\n// ── Install ────────────────────────────────────────────────────────\n\nexport async function handleMarketplaceInstall(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n\tsandboxRunner: SandboxRunner | null,\n\tmarketplaceUrl: string | undefined,\n\tpluginId: string,\n\topts?: {\n\t\tversion?: string;\n\t\tconfiguredPluginIds?: Set<string>;\n\t\tsiteOrigin?: string;\n\t\t/**\n\t\t * When true, sandbox: false bypass mode is active. The sandbox runner\n\t\t * is the noop runner (isAvailable() === false) but the runtime will\n\t\t * load the marketplace plugin in-process via syncMarketplacePlugins().\n\t\t * Skip the SANDBOX_NOT_AVAILABLE gate so the install can proceed.\n\t\t */\n\t\tsandboxBypassed?: boolean;\n\t\tconfirmMcpTools?: boolean;\n\t},\n): Promise<ApiResult<MarketplaceInstallResult>> {\n\tconst client = getClient(marketplaceUrl, opts?.siteOrigin);\n\tif (!client) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"MARKETPLACE_NOT_CONFIGURED\",\n\t\t\t\tmessage: \"Marketplace is not configured\",\n\t\t\t},\n\t\t};\n\t}\n\n\tif (!storage) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"STORAGE_NOT_CONFIGURED\",\n\t\t\t\tmessage: \"Storage is required for marketplace plugin installation\",\n\t\t\t},\n\t\t};\n\t}\n\n\t// Sandbox availability check: skip when sandbox: false bypass is active.\n\t// The runtime's syncMarketplacePlugins() will load the plugin in-process.\n\tif (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SANDBOX_NOT_AVAILABLE\",\n\t\t\t\tmessage: \"Sandbox runner is required for marketplace plugins\",\n\t\t\t},\n\t\t};\n\t}\n\n\ttry {\n\t\t// Check if already installed\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (existing && existing.source === \"marketplace\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"ALREADY_INSTALLED\",\n\t\t\t\t\tmessage: `Plugin ${pluginId} is already installed`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Block installation if a configured (trusted) plugin with the same ID exists.\n\t\t// Without this check, the sandboxed plugin could shadow the trusted plugin's\n\t\t// route handlers while auth decisions are made against the trusted plugin's metadata.\n\t\tif (opts?.configuredPluginIds?.has(pluginId)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"PLUGIN_ID_CONFLICT\",\n\t\t\t\t\tmessage: `Cannot install marketplace plugin \"${pluginId}\" — a configured plugin with the same ID already exists`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Fetch plugin detail from marketplace\n\t\tconst pluginDetail = await client.getPlugin(pluginId);\n\t\tconst version = opts?.version ?? pluginDetail.latestVersion?.version;\n\t\tif (!version) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NO_VERSION\",\n\t\t\t\t\tmessage: `No published versions found for plugin ${pluginId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst versionMetadata = await resolveVersionMetadata(client, pluginId, pluginDetail, version);\n\t\tif (!versionMetadata) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NO_VERSION\",\n\t\t\t\t\tmessage: `Version ${version} was not found for plugin ${pluginId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Block installation of plugins that haven't passed audit.\n\t\t// Both \"fail\" (explicitly malicious) and \"warn\" (audit error or\n\t\t// inconclusive) are non-installable — only \"pass\" or null (no audit\n\t\t// ran) are allowed through.\n\t\tif (versionMetadata.auditVerdict === \"fail\" || versionMetadata.auditVerdict === \"warn\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AUDIT_FAILED\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tversionMetadata.auditVerdict === \"fail\"\n\t\t\t\t\t\t\t? \"Plugin failed security audit and cannot be installed\"\n\t\t\t\t\t\t\t: \"Plugin audit was inconclusive and cannot be installed until reviewed\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Download and extract bundle\n\t\tconst bundle = await client.downloadBundle(pluginId, version);\n\n\t\t// Verify checksum matches marketplace-published checksum\n\t\tif (versionMetadata.checksum && bundle.checksum !== versionMetadata.checksum) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CHECKSUM_MISMATCH\",\n\t\t\t\t\tmessage: \"Bundle checksum does not match marketplace record. Download may be corrupted.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst bundleIdentityError = validateBundleIdentity(bundle, pluginId, version);\n\t\tif (bundleIdentityError) return bundleIdentityError;\n\n\t\tif ((bundle.manifest.mcp?.tools.length ?? 0) > 0 && !opts?.confirmMcpTools) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"MCP_TOOL_CONSENT_REQUIRED\",\n\t\t\t\t\tmessage: \"Plugin MCP tools require explicit consent\",\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tmcpTools: bundle.manifest.mcp?.tools.map(\n\t\t\t\t\t\t\t({ inputSchema: _, outputSchema: __, ...tool }) => tool,\n\t\t\t\t\t\t),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Store bundle in site-local R2\n\t\tawait storeBundleInR2(storage, pluginId, version, bundle);\n\n\t\t// Write plugin state\n\t\tawait stateRepo.upsert(pluginId, version, \"active\", {\n\t\t\tsource: \"marketplace\",\n\t\t\tmarketplaceVersion: version,\n\t\t\tdisplayName: pluginDetail.name,\n\t\t\tdescription: pluginDetail.description ?? undefined,\n\t\t});\n\n\t\tawait syncDeclaredStorageIndexes(db, [bundle.manifest]);\n\n\t\t// Fire-and-forget install stat\n\t\tclient.reportInstall(pluginId, version).catch(() => {\n\t\t\t// Intentional: never fails the install\n\t\t});\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tpluginId,\n\t\t\t\tversion,\n\t\t\t\tcapabilities: bundle.manifest.capabilities,\n\t\t\t},\n\t\t};\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceUnavailableError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"MARKETPLACE_UNAVAILABLE\",\n\t\t\t\t\tmessage: \"Plugin marketplace is currently unavailable\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err instanceof MarketplaceError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: err.code ?? \"MARKETPLACE_ERROR\",\n\t\t\t\t\tmessage: err.message,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err instanceof EmDashStorageError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: err.code ?? \"STORAGE_ERROR\",\n\t\t\t\t\tmessage: \"Storage error while installing plugin\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err && typeof err === \"object\" && \"code\" in err) {\n\t\t\tconst code = (err as { code?: unknown }).code;\n\t\t\tif (typeof code === \"string\" && code.trim()) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode,\n\t\t\t\t\t\tmessage: \"Failed to install plugin from marketplace\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\tconsole.error(\"Failed to install marketplace plugin:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"INSTALL_FAILED\",\n\t\t\t\tmessage: \"Failed to install plugin from marketplace\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ── Update ─────────────────────────────────────────────────────────\n\nexport async function handleMarketplaceUpdate(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n\tsandboxRunner: SandboxRunner | null,\n\tmarketplaceUrl: string | undefined,\n\tpluginId: string,\n\topts?: {\n\t\tversion?: string;\n\t\tconfirmCapabilityChanges?: boolean;\n\t\tconfirmRouteVisibilityChanges?: boolean;\n\t\tconfirmMcpTools?: boolean;\n\t\t/**\n\t\t * When true, sandbox: false bypass mode is active. The sandbox runner\n\t\t * is the noop runner (isAvailable() === false) but the runtime will\n\t\t * load the marketplace plugin in-process via syncMarketplacePlugins().\n\t\t * Skip the SANDBOX_NOT_AVAILABLE gate so the update can proceed.\n\t\t */\n\t\tsandboxBypassed?: boolean;\n\t},\n): Promise<ApiResult<MarketplaceUpdateResult>> {\n\tconst client = getClient(marketplaceUrl);\n\tif (!client) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MARKETPLACE_NOT_CONFIGURED\", message: \"Marketplace is not configured\" },\n\t\t};\n\t}\n\tif (!storage) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"STORAGE_NOT_CONFIGURED\", message: \"Storage is required\" },\n\t\t};\n\t}\n\t// Sandbox availability check: skip when sandbox: false bypass is active.\n\t// The runtime's syncMarketplacePlugins() will load the plugin in-process.\n\tif (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SANDBOX_NOT_AVAILABLE\", message: \"Sandbox runner is required\" },\n\t\t};\n\t}\n\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (!existing || existing.source !== \"marketplace\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `No marketplace plugin found: ${pluginId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst oldVersion = existing.marketplaceVersion ?? existing.version;\n\n\t\t// Get target version\n\t\tconst pluginDetail = await client.getPlugin(pluginId);\n\t\tconst newVersion = opts?.version ?? pluginDetail.latestVersion?.version;\n\t\tif (!newVersion) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NO_VERSION\", message: \"No newer version available\" },\n\t\t\t};\n\t\t}\n\n\t\tif (newVersion === oldVersion) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"ALREADY_UP_TO_DATE\", message: \"Plugin is already up to date\" },\n\t\t\t};\n\t\t}\n\n\t\tconst versionMetadata = await resolveVersionMetadata(\n\t\t\tclient,\n\t\t\tpluginId,\n\t\t\tpluginDetail,\n\t\t\tnewVersion,\n\t\t);\n\t\tif (!versionMetadata) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NO_VERSION\",\n\t\t\t\t\tmessage: `Version ${newVersion} was not found for plugin ${pluginId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Download new bundle\n\t\tconst bundle = await client.downloadBundle(pluginId, newVersion);\n\n\t\t// Verify checksum matches marketplace-published checksum for this version\n\t\tif (versionMetadata.checksum && bundle.checksum !== versionMetadata.checksum) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CHECKSUM_MISMATCH\",\n\t\t\t\t\tmessage: \"Bundle checksum does not match marketplace record. Download may be corrupted.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst bundleIdentityError = validateBundleIdentity(bundle, pluginId, newVersion);\n\t\tif (bundleIdentityError) return bundleIdentityError;\n\n\t\t// Diff capabilities and route visibility against old version\n\t\tconst oldBundle = await loadBundleFromR2(storage, pluginId, oldVersion);\n\t\tconst oldCaps = oldBundle?.manifest.capabilities ?? [];\n\t\tconst capabilityChanges = diffCapabilities(oldCaps, bundle.manifest.capabilities);\n\t\tconst hasEscalation = capabilityChanges.added.length > 0;\n\n\t\t// If capabilities escalated, require explicit confirmation\n\t\tif (hasEscalation && !opts?.confirmCapabilityChanges) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CAPABILITY_ESCALATION\",\n\t\t\t\t\tmessage: \"Plugin update requires new capabilities\",\n\t\t\t\t\tdetails: { capabilityChanges },\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Diff route visibility — routes going from private to public are a\n\t\t// security-sensitive change that exposes unauthenticated endpoints.\n\t\tconst routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);\n\t\tconst hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;\n\n\t\tif (hasNewPublicRoutes && !opts?.confirmRouteVisibilityChanges) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"ROUTE_VISIBILITY_ESCALATION\",\n\t\t\t\t\tmessage: \"Plugin update exposes new public (unauthenticated) routes\",\n\t\t\t\t\tdetails: { routeVisibilityChanges, capabilityChanges },\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst oldMcpTools = [...(oldBundle?.manifest.mcp?.tools ?? [])].toSorted((a, b) =>\n\t\t\ta.name.localeCompare(b.name),\n\t\t);\n\t\tconst newMcpTools = [...(bundle.manifest.mcp?.tools ?? [])].toSorted((a, b) =>\n\t\t\ta.name.localeCompare(b.name),\n\t\t);\n\t\tif (JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools) && !opts?.confirmMcpTools) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"MCP_TOOL_CONSENT_REQUIRED\",\n\t\t\t\t\tmessage: \"Plugin update changes its MCP tools\",\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tmcpTools: newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Store new bundle\n\t\tawait storeBundleInR2(storage, pluginId, newVersion, bundle);\n\n\t\t// Update state\n\t\tawait stateRepo.upsert(pluginId, newVersion, \"active\", {\n\t\t\tsource: \"marketplace\",\n\t\t\tmarketplaceVersion: newVersion,\n\t\t\tdisplayName: pluginDetail.name,\n\t\t\tdescription: pluginDetail.description ?? undefined,\n\t\t\tmcpToolsEnabled: false,\n\t\t\tmcpToolsConsent: null,\n\t\t});\n\n\t\tawait syncDeclaredStorageIndexes(db, [bundle.manifest]);\n\n\t\t// Clean up old bundle from R2 (best-effort)\n\t\tdeleteBundleFromR2(storage, pluginId, oldVersion).catch(() => {});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tpluginId,\n\t\t\t\toldVersion,\n\t\t\t\tnewVersion,\n\t\t\t\tcapabilityChanges,\n\t\t\t\trouteVisibilityChanges: hasNewPublicRoutes ? routeVisibilityChanges : undefined,\n\t\t\t},\n\t\t};\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceUnavailableError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"MARKETPLACE_UNAVAILABLE\", message: \"Marketplace is unavailable\" },\n\t\t\t};\n\t\t}\n\t\tif (err instanceof MarketplaceError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: err.code ?? \"MARKETPLACE_ERROR\", message: err.message },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Failed to update marketplace plugin:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"UPDATE_FAILED\", message: \"Failed to update plugin\" },\n\t\t};\n\t}\n}\n\n// ── Uninstall ──────────────────────────────────────────────────────\n\nexport async function handleMarketplaceUninstall(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n\tpluginId: string,\n\topts?: { deleteData?: boolean },\n): Promise<ApiResult<MarketplaceUninstallResult>> {\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (!existing || existing.source !== \"marketplace\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `No marketplace plugin found: ${pluginId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst version = existing.marketplaceVersion ?? existing.version;\n\n\t\t// Delete bundle from site R2\n\t\tif (storage) {\n\t\t\tawait deleteBundleFromR2(storage, pluginId, version);\n\t\t}\n\n\t\t// Optionally delete plugin storage data\n\t\tlet dataDeleted = false;\n\t\tif (opts?.deleteData) {\n\t\t\ttry {\n\t\t\t\tawait db.deleteFrom(\"_plugin_storage\").where(\"plugin_id\", \"=\", pluginId).execute();\n\t\t\t\tdataDeleted = true;\n\t\t\t} catch {\n\t\t\t\t// Plugin storage table may not have data for this plugin\n\t\t\t}\n\t\t}\n\n\t\ttry {\n\t\t\tawait removeAllPluginIndexes(db, pluginId);\n\t\t} catch {\n\t\t\t// Nothing to drop, or tracking table predates the feature\n\t\t}\n\n\t\t// Delete state row\n\t\tawait stateRepo.delete(pluginId);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { pluginId, dataDeleted },\n\t\t};\n\t} catch (err) {\n\t\tconsole.error(\"Failed to uninstall marketplace plugin:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"UNINSTALL_FAILED\",\n\t\t\t\tmessage: \"Failed to uninstall plugin\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ── Update check ───────────────────────────────────────────────────\n\nexport async function handleMarketplaceUpdateCheck(\n\tdb: Kysely<Database>,\n\tmarketplaceUrl: string | undefined,\n): Promise<ApiResult<{ items: MarketplaceUpdateCheck[] }>> {\n\tconst client = getClient(marketplaceUrl);\n\tif (!client) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MARKETPLACE_NOT_CONFIGURED\", message: \"Marketplace is not configured\" },\n\t\t};\n\t}\n\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst marketplacePlugins = await stateRepo.getMarketplacePlugins();\n\n\t\tconst items: MarketplaceUpdateCheck[] = [];\n\n\t\tfor (const plugin of marketplacePlugins) {\n\t\t\ttry {\n\t\t\t\tconst detail = await client.getPlugin(plugin.pluginId);\n\t\t\t\tconst latest = detail.latestVersion?.version;\n\t\t\t\tconst installed = plugin.marketplaceVersion ?? plugin.version;\n\n\t\t\t\tif (!latest) continue;\n\n\t\t\t\tconst hasUpdate = latest !== installed;\n\t\t\t\tlet capabilityChanges: { added: string[]; removed: string[] } | undefined;\n\t\t\t\tlet hasCapabilityChanges = false;\n\n\t\t\t\tif (hasUpdate && detail.latestVersion) {\n\t\t\t\t\tconst oldCaps = detail.capabilities ?? [];\n\t\t\t\t\tconst newCaps = detail.latestVersion.capabilities ?? [];\n\t\t\t\t\tcapabilityChanges = diffCapabilities(oldCaps, newCaps);\n\t\t\t\t\thasCapabilityChanges =\n\t\t\t\t\t\tcapabilityChanges.added.length > 0 || capabilityChanges.removed.length > 0;\n\t\t\t\t}\n\n\t\t\t\titems.push({\n\t\t\t\t\tpluginId: plugin.pluginId,\n\t\t\t\t\tinstalled,\n\t\t\t\t\tlatest: latest ?? installed,\n\t\t\t\t\thasUpdate,\n\t\t\t\t\thasCapabilityChanges,\n\t\t\t\t\tcapabilityChanges: hasCapabilityChanges ? capabilityChanges : undefined,\n\t\t\t\t\t// Route visibility changes require downloading both bundles to compare\n\t\t\t\t\t// manifests, which is too expensive for a preview check. The actual\n\t\t\t\t\t// enforcement happens at update time in handleMarketplaceUpdate.\n\t\t\t\t\thasRouteVisibilityChanges: false,\n\t\t\t\t});\n\t\t\t} catch (err) {\n\t\t\t\t// Skip plugins that can't be checked (marketplace down, plugin delisted)\n\t\t\t\tconsole.warn(`Failed to check updates for ${plugin.pluginId}:`, err);\n\t\t\t}\n\t\t}\n\n\t\treturn { success: true, data: { items } };\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceUnavailableError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"MARKETPLACE_UNAVAILABLE\", message: \"Marketplace is unavailable\" },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Failed to check marketplace updates:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"UPDATE_CHECK_FAILED\", message: \"Failed to check for updates\" },\n\t\t};\n\t}\n}\n\n// ── Proxy ──────────────────────────────────────────────────────────\n\nexport async function handleMarketplaceSearch(\n\tmarketplaceUrl: string | undefined,\n\tquery?: string,\n\topts?: MarketplaceSearchOpts,\n): Promise<ApiResult<unknown>> {\n\tconst client = getClient(marketplaceUrl);\n\tif (!client) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MARKETPLACE_NOT_CONFIGURED\", message: \"Marketplace is not configured\" },\n\t\t};\n\t}\n\n\ttry {\n\t\tconst result = await client.search(query, opts);\n\t\treturn { success: true, data: result };\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceUnavailableError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"MARKETPLACE_UNAVAILABLE\", message: \"Marketplace is unavailable\" },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Failed to search marketplace:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SEARCH_FAILED\", message: \"Failed to search marketplace\" },\n\t\t};\n\t}\n}\n\nexport async function handleMarketplaceGetPlugin(\n\tmarketplaceUrl: string | undefined,\n\tpluginId: string,\n): Promise<ApiResult<unknown>> {\n\tconst client = getClient(marketplaceUrl);\n\tif (!client) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MARKETPLACE_NOT_CONFIGURED\", message: \"Marketplace is not configured\" },\n\t\t};\n\t}\n\n\ttry {\n\t\tconst result = await client.getPlugin(pluginId);\n\t\treturn { success: true, data: result };\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceError && err.status === 404) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Plugin not found: ${pluginId}` },\n\t\t\t};\n\t\t}\n\t\tif (err instanceof MarketplaceUnavailableError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"MARKETPLACE_UNAVAILABLE\", message: \"Marketplace is unavailable\" },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Failed to get marketplace plugin:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"GET_PLUGIN_FAILED\", message: \"Failed to get plugin details\" },\n\t\t};\n\t}\n}\n\n// ── Theme proxy handlers ──────────────────────────────────────────\n\nexport async function handleThemeSearch(\n\tmarketplaceUrl: string | undefined,\n\tquery?: string,\n\topts?: MarketplaceThemeSearchOpts,\n): Promise<ApiResult<unknown>> {\n\tconst client = getClient(marketplaceUrl);\n\tif (!client) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MARKETPLACE_NOT_CONFIGURED\", message: \"Marketplace is not configured\" },\n\t\t};\n\t}\n\n\ttry {\n\t\tconst result = await client.searchThemes(query, opts);\n\t\treturn { success: true, data: result };\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceUnavailableError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"MARKETPLACE_UNAVAILABLE\", message: \"Marketplace is unavailable\" },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Failed to search themes:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"THEME_SEARCH_FAILED\", message: \"Failed to search themes\" },\n\t\t};\n\t}\n}\n\nexport async function handleThemeGetDetail(\n\tmarketplaceUrl: string | undefined,\n\tthemeId: string,\n): Promise<ApiResult<unknown>> {\n\tconst client = getClient(marketplaceUrl);\n\tif (!client) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MARKETPLACE_NOT_CONFIGURED\", message: \"Marketplace is not configured\" },\n\t\t};\n\t}\n\n\ttry {\n\t\tconst result = await client.getTheme(themeId);\n\t\treturn { success: true, data: result };\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceError && err.status === 404) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Theme not found: ${themeId}` },\n\t\t\t};\n\t\t}\n\t\tif (err instanceof MarketplaceUnavailableError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"MARKETPLACE_UNAVAILABLE\", message: \"Marketplace is unavailable\" },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Failed to get marketplace theme:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"GET_THEME_FAILED\", message: \"Failed to get theme details\" },\n\t\t};\n\t}\n}\n","import { n as verificationError } from \"./errors-CI-j3m_y.js\";\nimport { pluginManifestSchema, reconcileManifestAccess } from \"@emdash-cms/plugin-types\";\nimport { createGzipDecoder } from \"modern-tar\";\n\n//#region src/bundle-limits.ts\n/** Maximum accepted gzip payload size. */\nconst MAX_BUNDLE_COMPRESSED_BYTES = 384 * 1024;\n/** Maximum aggregate size of regular-file contents. */\nconst MAX_BUNDLE_SIZE = 256 * 1024;\n/** Maximum size of one regular file. */\nconst MAX_BUNDLE_FILE_BYTES = 128 * 1024;\n/** Maximum number of regular files. */\nconst MAX_BUNDLE_FILE_COUNT = 20;\n/** Maximum total tar entries, including harmless directory entries. */\nconst MAX_BUNDLE_TAR_ENTRY_COUNT = 32;\n/**\n* Maximum tar stream size after decompression. This includes USTAR headers,\n* file padding, and the end marker in addition to the regular-file contents.\n*/\nconst MAX_BUNDLE_DECOMPRESSED_BYTES = MAX_BUNDLE_SIZE + MAX_BUNDLE_TAR_ENTRY_COUNT * 512 + MAX_BUNDLE_FILE_COUNT * 511 + 2 * 512;\n\n//#endregion\n//#region src/bundle.ts\nconst TAR_BLOCK_BYTES = 512;\nconst TAR_END_BYTES = TAR_BLOCK_BYTES * 2;\nconst OCTAL_PATTERN = /^[0-7]+$/;\nconst WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:/;\nconst decoder = new TextDecoder(\"utf-8\", {\n\tfatal: true,\n\tignoreBOM: false\n});\nasync function validatePluginBundle(compressed, options = {}) {\n\tif (compressed.byteLength > MAX_BUNDLE_COMPRESSED_BYTES) return verificationError(\"BUNDLE_COMPRESSED_SIZE_EXCEEDED\", \"The compressed plugin bundle exceeds the size limit.\");\n\tconst decompressed = await decompressBundle(compressed);\n\tif (!decompressed.success) return decompressed;\n\tconst files = parseTar(decompressed.value);\n\tif (!files.success) return files;\n\tconst manifestFile = files.value.get(\"manifest.json\");\n\tif (!manifestFile) return verificationError(\"BUNDLE_MISSING_MANIFEST\", \"The plugin bundle is missing manifest.json.\");\n\tconst backend = files.value.get(\"backend.js\");\n\tif (!backend) return verificationError(\"BUNDLE_MISSING_BACKEND\", \"The plugin bundle is missing backend.js.\");\n\tlet parsed;\n\ttry {\n\t\tparsed = JSON.parse(decoder.decode(manifestFile.data));\n\t} catch {\n\t\treturn verificationError(\"BUNDLE_INVALID_MANIFEST\", \"The plugin bundle manifest is not valid JSON.\");\n\t}\n\tconst validated = pluginManifestSchema.safeParse(parsed);\n\tif (!validated.success) return verificationError(\"BUNDLE_INVALID_MANIFEST\", \"The plugin bundle manifest failed schema validation.\");\n\tconst manifest = reconcileManifestAccess(validated.data);\n\tif (options.expectedSlug !== void 0 && manifest.id !== options.expectedSlug) return verificationError(\"BUNDLE_ID_MISMATCH\", \"The plugin bundle manifest id does not match the expected plugin.\");\n\tif (options.expectedVersion !== void 0 && manifest.version !== options.expectedVersion) return verificationError(\"BUNDLE_VERSION_MISMATCH\", \"The plugin bundle manifest version does not match the expected version.\");\n\tconst result = {\n\t\tmanifest,\n\t\tdeclaredAccess: manifest.declaredAccess ?? {},\n\t\tbackend: backend.data\n\t};\n\tconst admin = files.value.get(\"admin.js\");\n\tif (admin) result.admin = admin.data;\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: result\n\t};\n}\nasync function decompressBundle(bytes) {\n\tconst source = new ReadableStream({ start(controller) {\n\t\tcontroller.enqueue(bytes);\n\t\tcontroller.close();\n\t} });\n\tlet reader;\n\ttry {\n\t\treader = source.pipeThrough(createGzipDecoder()).getReader();\n\t} catch {\n\t\treturn verificationError(\"BUNDLE_INVALID_ARCHIVE\", \"The plugin bundle is not valid gzip data.\");\n\t}\n\tconst chunks = [];\n\tlet total = 0;\n\ttry {\n\t\twhile (true) {\n\t\t\tconst { done, value } = await reader.read();\n\t\t\tif (done) break;\n\t\t\tif (!value) continue;\n\t\t\ttotal += value.byteLength;\n\t\t\tif (total > MAX_BUNDLE_DECOMPRESSED_BYTES) {\n\t\t\t\tawait reader.cancel().catch(() => void 0);\n\t\t\t\treturn verificationError(\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\", \"The decompressed plugin bundle exceeds the size limit.\");\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch {\n\t\treturn verificationError(\"BUNDLE_INVALID_ARCHIVE\", \"The plugin bundle is not valid gzip data.\");\n\t}\n\tconst output = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\toutput.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: output\n\t};\n}\nfunction parseTar(bytes) {\n\tif (bytes.byteLength < TAR_END_BYTES || bytes.byteLength % TAR_BLOCK_BYTES !== 0) return invalidArchive();\n\tconst files = /* @__PURE__ */ new Map();\n\tconst rawPaths = /* @__PURE__ */ new Set();\n\tconst normalizedPaths = /* @__PURE__ */ new Set();\n\tlet offset = 0;\n\tlet fileCount = 0;\n\tlet entryCount = 0;\n\tlet totalFileBytes = 0;\n\tlet ended = false;\n\twhile (offset + TAR_BLOCK_BYTES <= bytes.byteLength) {\n\t\tconst header = bytes.subarray(offset, offset + TAR_BLOCK_BYTES);\n\t\tif (isZeroBlock(header)) {\n\t\t\tif (!isZeroBlock(bytes.subarray(offset + TAR_BLOCK_BYTES, offset + TAR_END_BYTES))) return invalidArchive();\n\t\t\tif (bytes.subarray(offset + TAR_END_BYTES).some((byte) => byte !== 0)) return invalidArchive();\n\t\t\tended = true;\n\t\t\tbreak;\n\t\t}\n\t\tif (!validChecksum(header)) return invalidArchive();\n\t\tentryCount += 1;\n\t\tif (entryCount > MAX_BUNDLE_TAR_ENTRY_COUNT) return verificationError(\"BUNDLE_FILE_COUNT_EXCEEDED\", \"The plugin bundle contains too many archive entries.\");\n\t\tconst rawName = readTarPath(header);\n\t\tif (!rawName.success) return rawName;\n\t\tconst typeFlag = header[156];\n\t\tconst type = typeFlag === 0 ? \"file\" : String.fromCharCode(typeFlag ?? 0);\n\t\tconst isDirectory = type === \"5\";\n\t\tconst normalized = normalizePath(rawName.value, isDirectory);\n\t\tif (!normalized.success) return normalized;\n\t\tif (rawPaths.has(rawName.value) || normalizedPaths.has(normalized.value)) return verificationError(\"BUNDLE_PATH_COLLISION\", \"The plugin bundle contains duplicate or ambiguous paths.\");\n\t\trawPaths.add(rawName.value);\n\t\tnormalizedPaths.add(normalized.value);\n\t\tconst size = readOctal(header.subarray(124, 136));\n\t\tif (size === null || !Number.isSafeInteger(size)) return invalidArchive();\n\t\tconst bodyStart = offset + TAR_BLOCK_BYTES;\n\t\tconst nextOffset = bodyStart + Math.ceil(size / TAR_BLOCK_BYTES) * TAR_BLOCK_BYTES;\n\t\tif (nextOffset > bytes.byteLength) return invalidArchive();\n\t\tif (isDirectory) {\n\t\t\tif (size !== 0) return invalidArchive();\n\t\t} else if (type === \"file\" || type === \"0\") {\n\t\t\tfileCount += 1;\n\t\t\tif (fileCount > MAX_BUNDLE_FILE_COUNT) return verificationError(\"BUNDLE_FILE_COUNT_EXCEEDED\", \"The plugin bundle contains too many files.\");\n\t\t\tif (size > MAX_BUNDLE_FILE_BYTES) return verificationError(\"BUNDLE_FILE_SIZE_EXCEEDED\", \"A file in the plugin bundle exceeds the per-file size limit.\");\n\t\t\ttotalFileBytes += size;\n\t\t\tif (totalFileBytes > MAX_BUNDLE_SIZE) return verificationError(\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\", \"The plugin bundle file contents exceed the size limit.\");\n\t\t\tfiles.set(normalized.value, {\n\t\t\t\tname: normalized.value,\n\t\t\t\tdata: bytes.slice(bodyStart, bodyStart + size)\n\t\t\t});\n\t\t} else return verificationError(\"BUNDLE_UNSUPPORTED_ENTRY\", \"The plugin bundle contains an unsupported archive entry type.\");\n\t\toffset = nextOffset;\n\t}\n\tif (!ended) return invalidArchive();\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: files\n\t};\n}\nfunction readTarPath(header) {\n\tconst name = readTarString(header.subarray(0, 100));\n\tconst prefix = readTarString(header.subarray(345, 500));\n\tif (name === null || prefix === null || name.length === 0) return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains a malformed path.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: prefix ? `${prefix}/${name}` : name\n\t};\n}\nfunction readTarString(field) {\n\tconst terminator = field.indexOf(0);\n\tconst end = terminator === -1 ? field.length : terminator;\n\tif (terminator !== -1 && field.subarray(terminator + 1).some((byte) => byte !== 0)) return null;\n\ttry {\n\t\treturn decoder.decode(field.subarray(0, end));\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction normalizePath(raw, isDirectory) {\n\tif (raw.includes(\"\\\\\") || raw.startsWith(\"/\") || WINDOWS_DRIVE_PATTERN.test(raw) || hasControlCharacter(raw) || raw.endsWith(\"/\") !== isDirectory) return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains an unsafe path.\");\n\tconst parts = raw.split(\"/\");\n\tif (isDirectory) parts.pop();\n\tconst normalized = [];\n\tfor (const part of parts) {\n\t\tif (part === \".\") continue;\n\t\tif (part === \"\" || part === \"..\") return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains an unsafe path.\");\n\t\tnormalized.push(part.normalize(\"NFC\"));\n\t}\n\tif (normalized.length === 0) return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains a malformed path.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: normalized.join(\"/\")\n\t};\n}\nfunction hasControlCharacter(value) {\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return true;\n\t}\n\treturn false;\n}\nfunction readOctal(field) {\n\tconst text = new TextDecoder().decode(field).replaceAll(\"\\0\", \"\").trim();\n\tif (!OCTAL_PATTERN.test(text)) return null;\n\tconst value = Number.parseInt(text, 8);\n\treturn Number.isSafeInteger(value) ? value : null;\n}\nfunction validChecksum(header) {\n\tconst expected = readOctal(header.subarray(148, 156));\n\tif (expected === null) return false;\n\tlet actual = 0;\n\tfor (let index = 0; index < header.length; index += 1) actual += index >= 148 && index < 156 ? 32 : header[index] ?? 0;\n\treturn actual === expected;\n}\nfunction isZeroBlock(block) {\n\treturn block.byteLength === TAR_BLOCK_BYTES && block.every((byte) => byte === 0);\n}\nfunction invalidArchive() {\n\treturn verificationError(\"BUNDLE_INVALID_ARCHIVE\", \"The plugin bundle is not a valid tar archive.\");\n}\n\n//#endregion\nexport { validatePluginBundle };\n//# sourceMappingURL=bundle.js.map","import type { VerificationErrorCode } from \"@emdash-cms/registry-verification\";\nimport { validatePluginBundle } from \"@emdash-cms/registry-verification/bundle\";\nimport {\n\tcomputeArtifactDigestCandidates,\n\tverifyMultihash,\n} from \"@emdash-cms/registry-verification/checksum\";\n\nimport { pluginManifestSchema, reconcileManifestAccess } from \"../plugins/manifest-schema.js\";\nimport type { PluginBundle } from \"../plugins/marketplace.js\";\n\nconst bundleDecoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport type RegistryArtifactVerificationCode =\n\t| VerificationErrorCode\n\t| \"BUNDLE_INVALID_CODE_ENCODING\"\n\t| \"BUNDLE_RUNTIME_UNSUPPORTED\";\n\nexport type RegistryArtifactVerificationResult =\n\t| {\n\t\t\tsuccess: true;\n\t\t\tvalue: {\n\t\t\t\tbundle: PluginBundle;\n\t\t\t\tartifactDigest: Uint8Array;\n\t\t\t\tartifactDigests: readonly Uint8Array[];\n\t\t\t};\n\t  }\n\t| {\n\t\t\tsuccess: false;\n\t\t\terror: { code: RegistryArtifactVerificationCode; message: string };\n\t  };\n\nexport async function validateRegistryArtifact(\n\tbytes: Uint8Array,\n\tchecksum: string,\n\tslug: string,\n\tversion: string,\n): Promise<RegistryArtifactVerificationResult> {\n\tconst checksumReport = await verifyMultihash(bytes, checksum);\n\tif (!checksumReport.success) return checksumReport;\n\tconst [artifactDigest, ...artifactDigests] = await computeArtifactDigestCandidates(bytes);\n\n\tconst bundleReport = await validatePluginBundle(bytes, {\n\t\texpectedSlug: slug,\n\t\texpectedVersion: version,\n\t});\n\tif (!bundleReport.success) return bundleReport;\n\n\tconst manifest = pluginManifestSchema.safeParse(bundleReport.value.manifest);\n\tif (!manifest.success) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"BUNDLE_RUNTIME_UNSUPPORTED\",\n\t\t\t\tmessage: \"The plugin bundle uses manifest features unsupported by this EmDash version.\",\n\t\t\t},\n\t\t};\n\t}\n\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: {\n\t\t\t\tbundle: {\n\t\t\t\t\tmanifest: reconcileManifestAccess(manifest.data),\n\t\t\t\t\tbackendCode: bundleDecoder.decode(bundleReport.value.backend),\n\t\t\t\t\tadminCode:\n\t\t\t\t\t\tbundleReport.value.admin === undefined\n\t\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t\t: bundleDecoder.decode(bundleReport.value.admin),\n\t\t\t\t\tchecksum,\n\t\t\t\t},\n\t\t\t\tartifactDigest,\n\t\t\t\tartifactDigests,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"BUNDLE_INVALID_CODE_ENCODING\",\n\t\t\t\tmessage: \"Plugin bundle code must be valid UTF-8.\",\n\t\t\t},\n\t\t};\n\t}\n}\n","import { createRequire } from \"node:module\";\nimport { NSID, PackageProfile, PackageProfileExtension, PackageRelease, PackageReleaseExtension, RECORD_SCOPED_BLOB_CACHE_TYPE } from \"@emdash-cms/registry-lexicons\";\nimport { canonicalizeDeclaredAccess, isPluginSlug, isPluginVersion, pluginManifestSchema, reconcileManifestAccess } from \"@emdash-cms/plugin-types\";\nimport { createGzipDecoder } from \"modern-tar\";\n\n//#region \\0rolldown/runtime.js\nvar __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);\nvar __require = /* @__PURE__ */ createRequire(\"file:///emdash-registry-verification.js\");\n\n//#endregion\n//#region src/errors.ts\n/** Stable, machine-readable failures returned by this package. */\nconst VERIFICATION_ERROR_CODES = [\n\t\"AUTH_METHOD_UNSUPPORTED\",\n\t\"BLOB_METADATA_MISMATCH\",\n\t\"BLOB_REF_INVALID\",\n\t\"BUNDLE_COMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_FILE_COUNT_EXCEEDED\",\n\t\"BUNDLE_FILE_SIZE_EXCEEDED\",\n\t\"BUNDLE_ID_MISMATCH\",\n\t\"BUNDLE_INVALID_ARCHIVE\",\n\t\"BUNDLE_INVALID_MANIFEST\",\n\t\"BUNDLE_INVALID_PATH\",\n\t\"BUNDLE_MISSING_BACKEND\",\n\t\"BUNDLE_MISSING_MANIFEST\",\n\t\"BUNDLE_PATH_COLLISION\",\n\t\"BUNDLE_UNSUPPORTED_ENTRY\",\n\t\"BUNDLE_VERSION_MISMATCH\",\n\t\"CHECKSUM_MISMATCH\",\n\t\"FETCH_FAILED\",\n\t\"HOST_REJECTED\",\n\t\"INVALID_MULTIHASH\",\n\t\"INVALID_URL\",\n\t\"PDS_RESOLUTION_FAILED\",\n\t\"PROFILE_EXTENSION_INVALID\",\n\t\"PROFILE_EXTENSION_MISSING\",\n\t\"PROFILE_ID_MISMATCH\",\n\t\"PROFILE_LEXICON_INVALID\",\n\t\"PROFILE_POLICY_INVALID\",\n\t\"PROFILE_REPOSITORY_INVALID\",\n\t\"PROVENANCE_REQUIRED\",\n\t\"PROVENANCE_UNVERIFIABLE\",\n\t\"REDIRECT_LIMIT_EXCEEDED\",\n\t\"REDIRECT_LOCATION_MISSING\",\n\t\"RESOURCE_SIZE_EXCEEDED\",\n\t\"RESOURCE_STATUS_ERROR\",\n\t\"RESOURCE_TIMEOUT\",\n\t\"RELEASE_EXTENSION_INVALID\",\n\t\"RELEASE_EXTENSION_MISSING\",\n\t\"RELEASE_ARTIFACT_SOURCE_MISSING\",\n\t\"RELEASE_LEXICON_INVALID\",\n\t\"RELEASE_PACKAGE_MISMATCH\",\n\t\"RELEASE_RKEY_MISMATCH\",\n\t\"RELEASE_VERSION_INVALID\",\n\t\"RELEASE_VERSION_MISMATCH\",\n\t\"UNSUPPORTED_MULTIHASH\"\n];\nfunction verificationError(code, message, details) {\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode,\n\t\t\tmessage,\n\t\t\t...details === void 0 ? {} : { details }\n\t\t}\n\t};\n}\n\n//#endregion\n//#region src/checksum.ts\nconst SHA2_256_CODE = 18;\nconst SHA2_256_LENGTH = 32;\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\n/** Derive the required artifact checksum from a raw sha2-256 blob CID. */\nfunction multihashFromBlobCid(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"BLOB_REF_INVALID\", \"The blob reference CID is malformed.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\tconst checksum = `b${encodeBase32(bytes.slice(2))}`;\n\tif (!decodeMultihash(checksum).success) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: checksum\n\t};\n}\n/** Decodes a lowercase base32 multibase-encoded multihash. */\nfunction decodeMultihash(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"INVALID_MULTIHASH\", \"Checksums must be lowercase base32 multibase-encoded multihashes.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null) return verificationError(\"INVALID_MULTIHASH\", \"The multibase checksum is malformed.\");\n\tconst code = readVarint(bytes, 0);\n\tif (code === null) return verificationError(\"INVALID_MULTIHASH\", \"The multihash algorithm code is malformed.\");\n\tconst length = readVarint(bytes, code.nextOffset);\n\tif (length === null || length.value !== bytes.length - length.nextOffset) return verificationError(\"INVALID_MULTIHASH\", \"The multihash digest length is malformed.\");\n\tif (code.value !== SHA2_256_CODE) return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\tif (length.value !== SHA2_256_LENGTH) return verificationError(\"INVALID_MULTIHASH\", \"The sha2-256 digest must be 32 bytes.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\talgorithm: \"sha2-256\",\n\t\t\tdigest: bytes.slice(length.nextOffset)\n\t\t}\n\t};\n}\nasync function computeMultihash(bytes, algorithm = \"sha2-256\") {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\tconst digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)));\n\t\tconst multihash = new Uint8Array(2 + digest.length);\n\t\tmultihash[0] = SHA2_256_CODE;\n\t\tmultihash[1] = digest.length;\n\t\tmultihash.set(digest, 2);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: `b${encodeBase32(multihash)}`\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nasync function computeArtifactDigestCandidates(bytes) {\n\tconst [sha256, sha384, sha512] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-384\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-512\", new Uint8Array(bytes))\n\t]);\n\treturn [\n\t\tnew Uint8Array(sha256),\n\t\tnew Uint8Array(sha384),\n\t\tnew Uint8Array(sha512)\n\t];\n}\nasync function verifyMultihash(bytes, expected) {\n\tconst decoded = decodeMultihash(expected);\n\tif (!decoded.success) return decoded;\n\tconst actual = await computeDigest(bytes, decoded.value.algorithm);\n\tif (!actual.success) return actual;\n\tif (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError(\"CHECKSUM_MISMATCH\", \"The resource bytes do not match the expected checksum.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: true\n\t};\n}\n/**\n* Compare public checksum digest bytes without early exit. Digests are public\n* integrity metadata, so a portable byte loop is preferable to a Node-only\n* timing primitive while still avoiding an ordinary equality short circuit.\n*/\nfunction compareDigestBytes(left, right) {\n\tlet difference = left.length ^ right.length;\n\tconst maximumLength = Math.max(left.length, right.length);\n\tfor (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);\n\treturn difference === 0;\n}\nasync function computeDigest(bytes, algorithm) {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)))\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nfunction readVarint(bytes, offset) {\n\tlet value = 0;\n\tlet shift = 0;\n\tfor (let index = offset; index < bytes.length && index < offset + 5; index += 1) {\n\t\tconst byte = bytes[index];\n\t\tif (byte === void 0) return null;\n\t\tvalue |= (byte & 127) << shift;\n\t\tif ((byte & 128) === 0) return {\n\t\t\tvalue,\n\t\t\tnextOffset: index + 1\n\t\t};\n\t\tshift += 7;\n\t}\n\treturn null;\n}\nfunction encodeBase32(bytes) {\n\tlet result = \"\";\n\tlet buffer = 0;\n\tlet bits = 0;\n\tfor (const byte of bytes) {\n\t\tbuffer = buffer << 8 | byte;\n\t\tbits += 8;\n\t\twhile (bits >= 5) {\n\t\t\tresult += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? \"\";\n\t\t\tbits -= 5;\n\t\t}\n\t}\n\tif (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? \"\";\n\treturn result;\n}\nfunction decodeBase32(value) {\n\tif (value.length === 0) return null;\n\tlet buffer = 0;\n\tlet bits = 0;\n\tconst output = [];\n\tfor (const character of value) {\n\t\tconst digit = BASE32_ALPHABET.indexOf(character);\n\t\tif (digit === -1) return null;\n\t\tbuffer = buffer << 5 | digit;\n\t\tbits += 5;\n\t\tif (bits >= 8) {\n\t\t\toutput.push(buffer >>> bits - 8 & 255);\n\t\t\tbits -= 8;\n\t\t}\n\t}\n\tif (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;\n\treturn new Uint8Array(output);\n}\n\n//#endregion\n//#region src/auth.ts\nconst UNSUPPORTED_AUTH_MESSAGE = \"This release requires an authentication method the client does not support.\";\nfunction unsupportedAuthDetails(auth) {\n\tif (!isRecord$3(auth) || typeof auth.hint_url !== \"string\" || auth.hint_url.length > 2048) return;\n\ttry {\n\t\tconst url = new URL(auth.hint_url);\n\t\tif (url.protocol !== \"https:\" || url.username || url.password) return void 0;\n\t\treturn { hintUrl: url.href };\n\t} catch {\n\t\treturn;\n\t}\n}\nfunction isRecord$3(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n//#endregion\n//#region src/fetch.ts\nconst DIGITS = /^\\d+$/;\nconst IPV4_LITERAL = /^\\d{1,3}(?:\\.\\d{1,3}){3}$/;\nconst IPV4_PART = /^\\d{1,3}$/;\nconst IPV6_PART = /^[0-9a-f]{1,4}$/i;\nconst TRAILING_DOT = /\\.+$/;\nconst DEFAULT_FETCH_LIMITS = {\n\theaderTimeoutMs: 1e4,\n\ttotalTimeoutMs: 3e4,\n\tmaxBytes: 25 * 1024 * 1024,\n\tmaxRedirects: 3\n};\nasync function fetchVerifiedResource(value, options) {\n\tconst limits = {\n\t\theaderTimeoutMs: options.headerTimeoutMs ?? DEFAULT_FETCH_LIMITS.headerTimeoutMs,\n\t\ttotalTimeoutMs: options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs,\n\t\tmaxBytes: options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes,\n\t\tmaxRedirects: options.maxRedirects ?? DEFAULT_FETCH_LIMITS.maxRedirects\n\t};\n\tif (!areValidLimits(limits)) return verificationError(\"INVALID_URL\", \"Fetch limits must be positive integers.\");\n\tconst startedAt = Date.now();\n\tlet currentUrl = parseAndValidateUrl(value, void 0, options.allowHttpLocalhost === true);\n\tif (!currentUrl.success) return currentUrl;\n\tfor (let redirects = 0;; redirects += 1) {\n\t\tconst remaining = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remaining <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst host = isAllowedLoopback(currentUrl.value, options.allowHttpLocalhost === true) ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t} : await validateHost(currentUrl.value, options.resolveHostname, remaining);\n\t\tif (!host.success) return host;\n\t\tconst remainingAfterResolution = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remainingAfterResolution <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst response = await fetchResponse(options.fetch, currentUrl.value, Math.min(remainingAfterResolution, limits.headerTimeoutMs));\n\t\tif (!response.success) return response;\n\t\tif (isRedirect(response.value.status)) {\n\t\t\tif (redirects >= limits.maxRedirects) return verificationError(\"REDIRECT_LIMIT_EXCEEDED\", \"The resource exceeded the redirect limit.\");\n\t\t\tconst location = response.value.headers.get(\"location\");\n\t\t\tif (location === null) return verificationError(\"REDIRECT_LOCATION_MISSING\", \"The redirect response has no location header.\");\n\t\t\tcurrentUrl = parseAndValidateUrl(location, currentUrl.value, options.allowHttpLocalhost === true);\n\t\t\tif (!currentUrl.success) return currentUrl;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!response.value.ok && !options.allowedStatuses?.includes(response.value.status)) return verificationError(\"RESOURCE_STATUS_ERROR\", `The resource returned HTTP ${response.value.status}.`);\n\t\tconst contentLength = response.value.headers.get(\"content-length\");\n\t\tif (contentLength !== null && (!DIGITS.test(contentLength) || Number(contentLength) > limits.maxBytes)) return verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\tconst bytes = await readResponse(response.value, limits.maxBytes, startedAt, limits.totalTimeoutMs);\n\t\tif (!bytes.success) return bytes;\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: {\n\t\t\t\tbytes: bytes.value,\n\t\t\t\turl: currentUrl.value,\n\t\t\t\tstatus: response.value.status,\n\t\t\t\theaders: response.value.headers\n\t\t\t}\n\t\t};\n\t}\n}\nfunction parseAndValidateUrl(value, base, allowHttpLocalhost = false) {\n\tlet url;\n\ttry {\n\t\turl = new URL(value, base);\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The resource URL is invalid.\");\n\t}\n\tif (url.protocol !== \"https:\" && !isAllowedLoopback(url, allowHttpLocalhost) || url.username !== \"\" || url.password !== \"\") return verificationError(\"INVALID_URL\", \"Resource URLs must use HTTPS and cannot include credentials.\");\n\tif (!isAllowedLoopback(url, allowHttpLocalhost) && (isIpLiteral(url.hostname) || isLocalHostname(url.hostname))) return verificationError(\"HOST_REJECTED\", \"The resource host is not permitted.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nfunction isAllowedLoopback(url, enabled) {\n\tif (!enabled || url.protocol !== \"http:\" && url.protocol !== \"https:\") return false;\n\tconst hostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn hostname === \"localhost\" || hostname.endsWith(\".localhost\") || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\nasync function validateHost(url, resolver, timeoutMs) {\n\ttry {\n\t\tconst addresses = await withTimeout(Promise.resolve().then(() => resolver(url.hostname)), timeoutMs);\n\t\tif (addresses.length === 0 || addresses.some(isForbiddenAddress)) return verificationError(\"HOST_REJECTED\", \"The resource host resolved to a forbidden address.\");\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"HOST_REJECTED\", \"The resource host could not be validated.\");\n\t}\n}\nasync function fetchResponse(fetchImplementation, url, timeoutMs) {\n\tconst controller = new AbortController();\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => fetchImplementation(url, {\n\t\t\t\tmethod: \"GET\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: controller.signal\n\t\t\t})), timeoutMs, () => controller.abort())\n\t\t};\n\t} catch (error) {\n\t\tif (controller.signal.aborted || isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource response headers timed out.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource request failed.\");\n\t}\n}\nasync function readResponse(response, maximumBytes, startedAt, totalTimeoutMs) {\n\tif (response.body === null) return {\n\t\tsuccess: true,\n\t\tvalue: new Uint8Array()\n\t};\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet length = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst remaining = totalTimeoutMs - (Date.now() - startedAt);\n\t\t\tif (remaining <= 0) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\t\t}\n\t\t\tconst chunk = await readWithTimeout(reader, remaining);\n\t\t\tif (!chunk.success) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn chunk;\n\t\t\t}\n\t\t\tif (chunk.value.done) break;\n\t\t\tconst value = chunk.value.value;\n\t\t\tlength += value.length;\n\t\t\tif (length > maximumBytes) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch {\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst output = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\toutput.set(chunk, offset);\n\t\toffset += chunk.length;\n\t}\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: output\n\t};\n}\nasync function readWithTimeout(reader, timeoutMs) {\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => reader.read()), timeoutMs)\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t}\n}\n/**\n* Every operation has both fulfillment and rejection handlers, so an operation\n* that loses the timeout race cannot later become an unhandled rejection.\n*/\nfunction withTimeout(operation, timeoutMs, onTimeout) {\n\treturn new Promise((resolve, reject) => {\n\t\tlet settled = false;\n\t\tconst timeout = setTimeout(() => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tonTimeout?.();\n\t\t\treject(new DOMException(\"Timed out\", \"AbortError\"));\n\t\t}, timeoutMs);\n\t\toperation.then((value) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\tresolve(value);\n\t\t}, (error) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\treject(error);\n\t\t});\n\t});\n}\nfunction areValidLimits(limits) {\n\treturn Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);\n}\nfunction isRedirect(status) {\n\treturn status === 301 || status === 302 || status === 303 || status === 307 || status === 308;\n}\nfunction isAbortError(error) {\n\treturn error instanceof DOMException && error.name === \"AbortError\";\n}\nfunction isIpLiteral(hostname) {\n\treturn IPV4_LITERAL.test(hostname) || hostname.includes(\":\");\n}\nfunction isLocalHostname(hostname) {\n\tconst normalized = hostname.toLowerCase();\n\treturn normalized === \"localhost\" || normalized.endsWith(\".localhost\") || normalized.endsWith(\".local\") || normalized.endsWith(\".internal\");\n}\nfunction isForbiddenAddress(address) {\n\tconst ipv4 = parseIpv4(address);\n\tif (ipv4 !== null) {\n\t\tconst [a, b] = ipv4;\n\t\treturn a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;\n\t}\n\tconst ipv6 = parseIpv6(address);\n\tif (ipv6 === null) return true;\n\tconst first = ipv6[0];\n\tconst isUnspecified = ipv6.every((part) => part === 0);\n\tconst isLoopback = ipv6.slice(0, 7).every((part) => part === 0) && ipv6[7] === 1;\n\tconst isPrivate = (first & 65024) === 64512;\n\tconst isLinkLocal = (first & 65472) === 65152;\n\tconst isMulticast = (first & 65280) === 65280;\n\tif (ipv6.slice(0, 5).every((part) => part === 0) && ipv6[5] === 65535) return isForbiddenAddress(`${ipv6[6] >>> 8}.${ipv6[6] & 255}.${ipv6[7] >>> 8}.${ipv6[7] & 255}`);\n\treturn isUnspecified || isLoopback || isPrivate || isLinkLocal || isMulticast;\n}\nfunction parseIpv4(value) {\n\tconst parts = value.split(\".\");\n\tif (parts.length !== 4) return null;\n\tconst numbers = parts.map((part) => IPV4_PART.test(part) ? Number(part) : NaN);\n\tif (numbers.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;\n\treturn [\n\t\tnumbers[0],\n\t\tnumbers[1],\n\t\tnumbers[2],\n\t\tnumbers[3]\n\t];\n}\nfunction parseIpv6(value) {\n\tif (value.includes(\":::\") || value.split(\"::\").length > 2) return null;\n\tconst [before = \"\", after = \"\"] = value.split(\"::\");\n\tconst head = before === \"\" ? [] : before.split(\":\");\n\tconst tail = after === \"\" ? [] : after.split(\":\");\n\tconst parts = [...head, ...tail];\n\tif (parts.some((part) => !IPV6_PART.test(part)) || parts.length > 8) return null;\n\tif (!value.includes(\"::\") && parts.length !== 8) return null;\n\tconst zeroes = value.includes(\"::\") ? 8 - parts.length : 0;\n\treturn [\n\t\t...head,\n\t\t...Array.from({ length: zeroes }).fill(\"0\"),\n\t\t...tail\n\t].map((part) => Number.parseInt(part, 16));\n}\n\n//#endregion\n//#region src/artifact.ts\nconst DID_DOCUMENT_MAX_BYTES = 256 * 1024;\nconst PLC_DID_PATTERN = /^did:plc:[a-z2-7]{24}$/;\nconst CID_PATTERN = /^b[a-z2-7]+$/;\nconst UNSAFE_PATH_SEGMENT = /[/\\\\?#]/;\nasync function fetchReleaseArtifact(input, options) {\n\tconst deadline = Date.now() + (options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs);\n\tconst { artifact } = input;\n\tif (!artifact.blob && !artifact.url) return verificationError(\"RELEASE_ARTIFACT_SOURCE_MISSING\", \"The release artifact must provide a blob or URL.\");\n\tif (artifact.requiresAuth === true || input.auth !== void 0) return unsupportedAuth$1(input.auth);\n\tconst blobCid = modernBlobCid(artifact.blob);\n\tconst blobMetadata = blobCid && artifact.blob && \"ref\" in artifact.blob ? artifact.blob : void 0;\n\tif (artifact.blob && !blobCid) return verificationError(\"BLOB_REF_INVALID\", \"Legacy blob references are not supported.\");\n\tif (blobCid) {\n\t\tconst expected = multihashFromBlobCid(blobCid);\n\t\tif (!expected.success) return expected;\n\t\tif (expected.value !== artifact.checksum) return verificationError(\"CHECKSUM_MISMATCH\", \"The artifact checksum does not match its blob reference CID.\");\n\t}\n\tlet lastError;\n\tfor (const cache of input.artifactCaches ?? []) {\n\t\tconst serviceEndpoint = recordScopedCacheEndpoint(cache);\n\t\tif (!serviceEndpoint || !blobCid) continue;\n\t\tconst cacheUrl = recordScopedBlobCacheUrl(serviceEndpoint, input.record, blobCid);\n\t\tif (!cacheUrl.success) {\n\t\t\tlastError = cacheUrl.error;\n\t\t\tcontinue;\n\t\t}\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"artifact-cache\", cacheUrl.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\tif (blobCid) {\n\t\tconst resolutionOptions = withinDeadline(options, deadline);\n\t\tif (!resolutionOptions) return timedOut();\n\t\tconst pds = input.pdsEndpoint ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: input.pdsEndpoint\n\t\t} : await resolvePublisherPdsEndpoint(input.record.did, resolutionOptions);\n\t\tif (pds.success) {\n\t\t\tconst url = blobUrl(pds.value, input.record.did, blobCid);\n\t\t\tif (url.success) {\n\t\t\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\t\t\tif (!attemptOptions) return timedOut();\n\t\t\t\tconst result = await fetchAndVerify(\"blob\", url.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\t\t\tif (result.success) return result;\n\t\t\t\tlastError = result.error;\n\t\t\t} else lastError = url.error;\n\t\t} else lastError = pds.error;\n\t}\n\tif (artifact.url) {\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"url\", artifact.url, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\treturn lastError ? {\n\t\tsuccess: false,\n\t\terror: lastError\n\t} : verificationError(\"FETCH_FAILED\", \"The release artifact could not be fetched.\");\n}\nfunction recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid) {\n\ttry {\n\t\tconst endpoint = new URL(serviceEndpoint);\n\t\tif (endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password || endpoint.pathname !== \"/\" || endpoint.search || endpoint.hash) throw new Error();\n\t\tconst segments = [\n\t\t\t\"r\",\n\t\t\trecord.did,\n\t\t\trecord.collection,\n\t\t\trecord.rkey,\n\t\t\trecord.cid,\n\t\t\tblobCid\n\t\t];\n\t\tif (!CID_PATTERN.test(record.cid) || !CID_PATTERN.test(blobCid) || segments.some((segment) => !isSafePathSegment(segment))) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new URL(segments.join(\"/\"), endpoint)\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The record-scoped blob cache endpoint is invalid.\");\n\t}\n}\nfunction recordScopedImageCacheUrl(serviceEndpoint, preset, record, blobCid) {\n\tconst raw = recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid);\n\tif (!raw.success) return raw;\n\tconst url = new URL(raw.value);\n\turl.pathname = `/img/${preset}${url.pathname}`;\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nasync function resolvePublisherPdsEndpoint(publisherDid, options) {\n\tconst documentUrl = didDocumentUrl(publisherDid);\n\tif (!documentUrl) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID is not supported.\");\n\tconst fetched = await fetchVerifiedResource(documentUrl, {\n\t\t...options,\n\t\tmaxBytes: DID_DOCUMENT_MAX_BYTES\n\t});\n\tif (!fetched.success) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document could not be fetched.\");\n\tlet document;\n\ttry {\n\t\tdocument = JSON.parse(new TextDecoder().decode(fetched.value.bytes));\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document is malformed.\");\n\t}\n\tif (!isRecord$2(document) || document.id !== publisherDid || !Array.isArray(document.service)) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\tconst service = document.service.find((value) => isRecord$2(value) && (value.id === `${publisherDid}#atproto_pds` || value.id === \"#atproto_pds\") && value.type === \"AtprotoPersonalDataServer\" && typeof value.serviceEndpoint === \"string\");\n\tif (!isRecord$2(service) || typeof service.serviceEndpoint !== \"string\") return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\ttry {\n\t\tconst endpoint = new URL(service.serviceEndpoint);\n\t\tif (!(options.allowHttpLocalhost === true && endpoint.protocol === \"http:\" && (endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\")) && endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: endpoint.href\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\t}\n}\nasync function fetchAndVerify(source, url, checksum, options, blobMetadata) {\n\tconst fetched = await fetchVerifiedResource(url, options);\n\tif (!fetched.success) return blobMetadata && fetched.error.code === \"RESOURCE_SIZE_EXCEEDED\" ? verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact size does not match its signed blob metadata.\") : fetched;\n\tconst verified = await verifyMultihash(fetched.value.bytes, checksum);\n\tif (!verified.success) return verified;\n\tconst contentType = fetched.value.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim();\n\tif (blobMetadata && (fetched.value.bytes.byteLength !== blobMetadata.size || contentType !== void 0 && contentType !== blobMetadata.mimeType)) return verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact does not match its signed blob metadata.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\tbytes: fetched.value.bytes,\n\t\t\tsource,\n\t\t\turl: fetched.value.url\n\t\t}\n\t};\n}\nfunction withBlobSizeLimit(options, blobMetadata) {\n\tif (!blobMetadata) return options;\n\treturn {\n\t\t...options,\n\t\tmaxBytes: Math.min(options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes, blobMetadata.size)\n\t};\n}\nfunction blobUrl(pdsEndpoint, publisherDid, cid) {\n\ttry {\n\t\tconst url = new URL(\"/xrpc/com.atproto.sync.getBlob\", pdsEndpoint);\n\t\turl.searchParams.set(\"did\", publisherDid);\n\t\turl.searchParams.set(\"cid\", cid);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: url\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher PDS endpoint is invalid.\");\n\t}\n}\nfunction didDocumentUrl(did) {\n\tif (PLC_DID_PATTERN.test(did)) return `https://plc.directory/${encodeURIComponent(did)}`;\n\tif (!did.startsWith(\"did:web:\")) return null;\n\ttry {\n\t\tconst parts = did.slice(8).split(\":\").map(decodeURIComponent);\n\t\tconst host = parts.shift();\n\t\tif (!host || parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) return null;\n\t\tconst path = parts.length === 0 ? \"/.well-known/did.json\" : `/${parts.join(\"/\")}/did.json`;\n\t\treturn new URL(path, `https://${host}`).href;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction unsupportedAuth$1(auth) {\n\treturn verificationError(\"AUTH_METHOD_UNSUPPORTED\", UNSUPPORTED_AUTH_MESSAGE, unsupportedAuthDetails(auth));\n}\nfunction withinDeadline(options, deadline) {\n\tconst remaining = deadline - Date.now();\n\tif (remaining <= 0) return null;\n\treturn {\n\t\t...options,\n\t\ttotalTimeoutMs: remaining\n\t};\n}\nfunction timedOut() {\n\treturn verificationError(\"RESOURCE_TIMEOUT\", \"Artifact retrieval exceeded its total timeout.\");\n}\nfunction isRecord$2(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction modernBlobCid(blob) {\n\tif (!blob || !(\"ref\" in blob) || typeof blob.ref?.$link !== \"string\") return null;\n\treturn blob.ref.$link;\n}\nfunction recordScopedCacheEndpoint(value) {\n\tif (!isRecord$2(value) || value.$type !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;\n\treturn typeof value.serviceEndpoint === \"string\" ? value.serviceEndpoint : null;\n}\nfunction isSafePathSegment(value) {\n\tif (value.length === 0 || UNSAFE_PATH_SEGMENT.test(value)) return false;\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return false;\n\t}\n\treturn true;\n}\n\n//#endregion\n//#region src/bundle-limits.ts\n/** Maximum accepted gzip payload size. */\nconst MAX_BUNDLE_COMPRESSED_BYTES = 384 * 1024;\n/** Maximum aggregate size of regular-file contents. */\nconst MAX_BUNDLE_SIZE = 256 * 1024;\n/** Maximum size of one regular file. */\nconst MAX_BUNDLE_FILE_BYTES = 128 * 1024;\n/** Maximum number of regular files. */\nconst MAX_BUNDLE_FILE_COUNT = 20;\n/** Maximum total tar entries, including harmless directory entries. */\nconst MAX_BUNDLE_TAR_ENTRY_COUNT = 32;\n/**\n* Maximum tar stream size after decompression. This includes USTAR headers,\n* file padding, and the end marker in addition to the regular-file contents.\n*/\nconst MAX_BUNDLE_DECOMPRESSED_BYTES = MAX_BUNDLE_SIZE + MAX_BUNDLE_TAR_ENTRY_COUNT * 512 + MAX_BUNDLE_FILE_COUNT * 511 + 2 * 512;\n\n//#endregion\n//#region src/bundle.ts\nconst TAR_BLOCK_BYTES = 512;\nconst TAR_END_BYTES = TAR_BLOCK_BYTES * 2;\nconst OCTAL_PATTERN = /^[0-7]+$/;\nconst WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:/;\nconst decoder$1 = new TextDecoder(\"utf-8\", {\n\tfatal: true,\n\tignoreBOM: false\n});\nasync function validatePluginBundle(compressed, options = {}) {\n\tif (compressed.byteLength > MAX_BUNDLE_COMPRESSED_BYTES) return verificationError(\"BUNDLE_COMPRESSED_SIZE_EXCEEDED\", \"The compressed plugin bundle exceeds the size limit.\");\n\tconst decompressed = await decompressBundle(compressed);\n\tif (!decompressed.success) return decompressed;\n\tconst files = parseTar(decompressed.value);\n\tif (!files.success) return files;\n\tconst manifestFile = files.value.get(\"manifest.json\");\n\tif (!manifestFile) return verificationError(\"BUNDLE_MISSING_MANIFEST\", \"The plugin bundle is missing manifest.json.\");\n\tconst backend = files.value.get(\"backend.js\");\n\tif (!backend) return verificationError(\"BUNDLE_MISSING_BACKEND\", \"The plugin bundle is missing backend.js.\");\n\tlet parsed;\n\ttry {\n\t\tparsed = JSON.parse(decoder$1.decode(manifestFile.data));\n\t} catch {\n\t\treturn verificationError(\"BUNDLE_INVALID_MANIFEST\", \"The plugin bundle manifest is not valid JSON.\");\n\t}\n\tconst validated = pluginManifestSchema.safeParse(parsed);\n\tif (!validated.success) return verificationError(\"BUNDLE_INVALID_MANIFEST\", \"The plugin bundle manifest failed schema validation.\");\n\tconst manifest = reconcileManifestAccess(validated.data);\n\tif (options.expectedSlug !== void 0 && manifest.id !== options.expectedSlug) return verificationError(\"BUNDLE_ID_MISMATCH\", \"The plugin bundle manifest id does not match the expected plugin.\");\n\tif (options.expectedVersion !== void 0 && manifest.version !== options.expectedVersion) return verificationError(\"BUNDLE_VERSION_MISMATCH\", \"The plugin bundle manifest version does not match the expected version.\");\n\tconst result = {\n\t\tmanifest,\n\t\tdeclaredAccess: manifest.declaredAccess ?? {},\n\t\tbackend: backend.data\n\t};\n\tconst admin = files.value.get(\"admin.js\");\n\tif (admin) result.admin = admin.data;\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: result\n\t};\n}\nasync function decompressBundle(bytes) {\n\tconst source = new ReadableStream({ start(controller) {\n\t\tcontroller.enqueue(bytes);\n\t\tcontroller.close();\n\t} });\n\tlet reader;\n\ttry {\n\t\treader = source.pipeThrough(createGzipDecoder()).getReader();\n\t} catch {\n\t\treturn verificationError(\"BUNDLE_INVALID_ARCHIVE\", \"The plugin bundle is not valid gzip data.\");\n\t}\n\tconst chunks = [];\n\tlet total = 0;\n\ttry {\n\t\twhile (true) {\n\t\t\tconst { done, value } = await reader.read();\n\t\t\tif (done) break;\n\t\t\tif (!value) continue;\n\t\t\ttotal += value.byteLength;\n\t\t\tif (total > MAX_BUNDLE_DECOMPRESSED_BYTES) {\n\t\t\t\tawait reader.cancel().catch(() => void 0);\n\t\t\t\treturn verificationError(\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\", \"The decompressed plugin bundle exceeds the size limit.\");\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch {\n\t\treturn verificationError(\"BUNDLE_INVALID_ARCHIVE\", \"The plugin bundle is not valid gzip data.\");\n\t}\n\tconst output = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\toutput.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: output\n\t};\n}\nfunction parseTar(bytes) {\n\tif (bytes.byteLength < TAR_END_BYTES || bytes.byteLength % TAR_BLOCK_BYTES !== 0) return invalidArchive();\n\tconst files = /* @__PURE__ */ new Map();\n\tconst rawPaths = /* @__PURE__ */ new Set();\n\tconst normalizedPaths = /* @__PURE__ */ new Set();\n\tlet offset = 0;\n\tlet fileCount = 0;\n\tlet entryCount = 0;\n\tlet totalFileBytes = 0;\n\tlet ended = false;\n\twhile (offset + TAR_BLOCK_BYTES <= bytes.byteLength) {\n\t\tconst header = bytes.subarray(offset, offset + TAR_BLOCK_BYTES);\n\t\tif (isZeroBlock(header)) {\n\t\t\tif (!isZeroBlock(bytes.subarray(offset + TAR_BLOCK_BYTES, offset + TAR_END_BYTES))) return invalidArchive();\n\t\t\tif (bytes.subarray(offset + TAR_END_BYTES).some((byte) => byte !== 0)) return invalidArchive();\n\t\t\tended = true;\n\t\t\tbreak;\n\t\t}\n\t\tif (!validChecksum(header)) return invalidArchive();\n\t\tentryCount += 1;\n\t\tif (entryCount > MAX_BUNDLE_TAR_ENTRY_COUNT) return verificationError(\"BUNDLE_FILE_COUNT_EXCEEDED\", \"The plugin bundle contains too many archive entries.\");\n\t\tconst rawName = readTarPath(header);\n\t\tif (!rawName.success) return rawName;\n\t\tconst typeFlag = header[156];\n\t\tconst type = typeFlag === 0 ? \"file\" : String.fromCharCode(typeFlag ?? 0);\n\t\tconst isDirectory = type === \"5\";\n\t\tconst normalized = normalizePath(rawName.value, isDirectory);\n\t\tif (!normalized.success) return normalized;\n\t\tif (rawPaths.has(rawName.value) || normalizedPaths.has(normalized.value)) return verificationError(\"BUNDLE_PATH_COLLISION\", \"The plugin bundle contains duplicate or ambiguous paths.\");\n\t\trawPaths.add(rawName.value);\n\t\tnormalizedPaths.add(normalized.value);\n\t\tconst size = readOctal(header.subarray(124, 136));\n\t\tif (size === null || !Number.isSafeInteger(size)) return invalidArchive();\n\t\tconst bodyStart = offset + TAR_BLOCK_BYTES;\n\t\tconst nextOffset = bodyStart + Math.ceil(size / TAR_BLOCK_BYTES) * TAR_BLOCK_BYTES;\n\t\tif (nextOffset > bytes.byteLength) return invalidArchive();\n\t\tif (isDirectory) {\n\t\t\tif (size !== 0) return invalidArchive();\n\t\t} else if (type === \"file\" || type === \"0\") {\n\t\t\tfileCount += 1;\n\t\t\tif (fileCount > MAX_BUNDLE_FILE_COUNT) return verificationError(\"BUNDLE_FILE_COUNT_EXCEEDED\", \"The plugin bundle contains too many files.\");\n\t\t\tif (size > MAX_BUNDLE_FILE_BYTES) return verificationError(\"BUNDLE_FILE_SIZE_EXCEEDED\", \"A file in the plugin bundle exceeds the per-file size limit.\");\n\t\t\ttotalFileBytes += size;\n\t\t\tif (totalFileBytes > MAX_BUNDLE_SIZE) return verificationError(\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\", \"The plugin bundle file contents exceed the size limit.\");\n\t\t\tfiles.set(normalized.value, {\n\t\t\t\tname: normalized.value,\n\t\t\t\tdata: bytes.slice(bodyStart, bodyStart + size)\n\t\t\t});\n\t\t} else return verificationError(\"BUNDLE_UNSUPPORTED_ENTRY\", \"The plugin bundle contains an unsupported archive entry type.\");\n\t\toffset = nextOffset;\n\t}\n\tif (!ended) return invalidArchive();\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: files\n\t};\n}\nfunction readTarPath(header) {\n\tconst name = readTarString(header.subarray(0, 100));\n\tconst prefix = readTarString(header.subarray(345, 500));\n\tif (name === null || prefix === null || name.length === 0) return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains a malformed path.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: prefix ? `${prefix}/${name}` : name\n\t};\n}\nfunction readTarString(field) {\n\tconst terminator = field.indexOf(0);\n\tconst end = terminator === -1 ? field.length : terminator;\n\tif (terminator !== -1 && field.subarray(terminator + 1).some((byte) => byte !== 0)) return null;\n\ttry {\n\t\treturn decoder$1.decode(field.subarray(0, end));\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction normalizePath(raw, isDirectory) {\n\tif (raw.includes(\"\\\\\") || raw.startsWith(\"/\") || WINDOWS_DRIVE_PATTERN.test(raw) || hasControlCharacter(raw) || raw.endsWith(\"/\") !== isDirectory) return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains an unsafe path.\");\n\tconst parts = raw.split(\"/\");\n\tif (isDirectory) parts.pop();\n\tconst normalized = [];\n\tfor (const part of parts) {\n\t\tif (part === \".\") continue;\n\t\tif (part === \"\" || part === \"..\") return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains an unsafe path.\");\n\t\tnormalized.push(part.normalize(\"NFC\"));\n\t}\n\tif (normalized.length === 0) return verificationError(\"BUNDLE_INVALID_PATH\", \"The plugin bundle contains a malformed path.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: normalized.join(\"/\")\n\t};\n}\nfunction hasControlCharacter(value) {\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return true;\n\t}\n\treturn false;\n}\nfunction readOctal(field) {\n\tconst text = new TextDecoder().decode(field).replaceAll(\"\\0\", \"\").trim();\n\tif (!OCTAL_PATTERN.test(text)) return null;\n\tconst value = Number.parseInt(text, 8);\n\treturn Number.isSafeInteger(value) ? value : null;\n}\nfunction validChecksum(header) {\n\tconst expected = readOctal(header.subarray(148, 156));\n\tif (expected === null) return false;\n\tlet actual = 0;\n\tfor (let index = 0; index < header.length; index += 1) actual += index >= 148 && index < 156 ? 32 : header[index] ?? 0;\n\treturn actual === expected;\n}\nfunction isZeroBlock(block) {\n\treturn block.byteLength === TAR_BLOCK_BYTES && block.every((byte) => byte === 0);\n}\nfunction invalidArchive() {\n\treturn verificationError(\"BUNDLE_INVALID_ARCHIVE\", \"The plugin bundle is not a valid tar archive.\");\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/envelope.js\nvar require_envelope = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.Signature = exports.Envelope = void 0;\n\texports.Envelope = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tpayload: isSet(object.payload) ? Buffer.from(bytesFromBase64(object.payload)) : Buffer.alloc(0),\n\t\t\t\tpayloadType: isSet(object.payloadType) ? globalThis.String(object.payloadType) : \"\",\n\t\t\t\tsignatures: globalThis.Array.isArray(object?.signatures) ? object.signatures.map((e) => exports.Signature.fromJSON(e)) : []\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.payload.length !== 0) obj.payload = base64FromBytes(message.payload);\n\t\t\tif (message.payloadType !== \"\") obj.payloadType = message.payloadType;\n\t\t\tif (message.signatures?.length) obj.signatures = message.signatures.map((e) => exports.Signature.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Signature = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tsig: isSet(object.sig) ? Buffer.from(bytesFromBase64(object.sig)) : Buffer.alloc(0),\n\t\t\t\tkeyid: isSet(object.keyid) ? globalThis.String(object.keyid) : \"\"\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.sig.length !== 0) obj.sig = base64FromBytes(message.sig);\n\t\t\tif (message.keyid !== \"\") obj.keyid = message.keyid;\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction bytesFromBase64(b64) {\n\t\treturn Uint8Array.from(globalThis.Buffer.from(b64, \"base64\"));\n\t}\n\tfunction base64FromBytes(arr) {\n\t\treturn globalThis.Buffer.from(arr).toString(\"base64\");\n\t}\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/google/protobuf/timestamp.js\nvar require_timestamp$2 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.Timestamp = void 0;\n\texports.Timestamp = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tseconds: isSet(object.seconds) ? globalThis.String(object.seconds) : \"0\",\n\t\t\t\tnanos: isSet(object.nanos) ? globalThis.Number(object.nanos) : 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.seconds !== \"0\") obj.seconds = message.seconds;\n\t\t\tif (message.nanos !== 0) obj.nanos = Math.round(message.nanos);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_common.js\nvar require_sigstore_common = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.TimeRange = exports.X509CertificateChain = exports.SubjectAlternativeName = exports.X509Certificate = exports.DistinguishedName = exports.ObjectIdentifierValuePair = exports.ObjectIdentifier = exports.PublicKeyIdentifier = exports.PublicKey = exports.RFC3161SignedTimestamp = exports.LogId = exports.MessageSignature = exports.HashOutput = exports.SubjectAlternativeNameType = exports.PublicKeyDetails = exports.HashAlgorithm = void 0;\n\texports.hashAlgorithmFromJSON = hashAlgorithmFromJSON;\n\texports.hashAlgorithmToJSON = hashAlgorithmToJSON;\n\texports.publicKeyDetailsFromJSON = publicKeyDetailsFromJSON;\n\texports.publicKeyDetailsToJSON = publicKeyDetailsToJSON;\n\texports.subjectAlternativeNameTypeFromJSON = subjectAlternativeNameTypeFromJSON;\n\texports.subjectAlternativeNameTypeToJSON = subjectAlternativeNameTypeToJSON;\n\tconst timestamp_1 = require_timestamp$2();\n\t/**\n\t* Only a subset of the secure hash standard algorithms are supported.\n\t* See <https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf> for more\n\t* details.\n\t* UNSPECIFIED SHOULD not be used, primary reason for inclusion is to force\n\t* any proto JSON serialization to emit the used hash algorithm, as default\n\t* option is to *omit* the default value of an enum (which is the first\n\t* value, represented by '0'.\n\t*/\n\tvar HashAlgorithm;\n\t(function(HashAlgorithm) {\n\t\tHashAlgorithm[HashAlgorithm[\"HASH_ALGORITHM_UNSPECIFIED\"] = 0] = \"HASH_ALGORITHM_UNSPECIFIED\";\n\t\tHashAlgorithm[HashAlgorithm[\"SHA2_256\"] = 1] = \"SHA2_256\";\n\t\tHashAlgorithm[HashAlgorithm[\"SHA2_384\"] = 2] = \"SHA2_384\";\n\t\tHashAlgorithm[HashAlgorithm[\"SHA2_512\"] = 3] = \"SHA2_512\";\n\t\t/**\n\t\t* SHA3_256 - Used for LMS\n\t\t*\n\t\t* @deprecated\n\t\t*/\n\t\tHashAlgorithm[HashAlgorithm[\"SHA3_256\"] = 4] = \"SHA3_256\";\n\t\t/**\n\t\t* SHA3_384 - Used for LMS\n\t\t*\n\t\t* @deprecated\n\t\t*/\n\t\tHashAlgorithm[HashAlgorithm[\"SHA3_384\"] = 5] = \"SHA3_384\";\n\t})(HashAlgorithm || (exports.HashAlgorithm = HashAlgorithm = {}));\n\tfunction hashAlgorithmFromJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase 0:\n\t\t\tcase \"HASH_ALGORITHM_UNSPECIFIED\": return HashAlgorithm.HASH_ALGORITHM_UNSPECIFIED;\n\t\t\tcase 1:\n\t\t\tcase \"SHA2_256\": return HashAlgorithm.SHA2_256;\n\t\t\tcase 2:\n\t\t\tcase \"SHA2_384\": return HashAlgorithm.SHA2_384;\n\t\t\tcase 3:\n\t\t\tcase \"SHA2_512\": return HashAlgorithm.SHA2_512;\n\t\t\tcase 4:\n\t\t\tcase \"SHA3_256\": return HashAlgorithm.SHA3_256;\n\t\t\tcase 5:\n\t\t\tcase \"SHA3_384\": return HashAlgorithm.SHA3_384;\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum HashAlgorithm\");\n\t\t}\n\t}\n\tfunction hashAlgorithmToJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase HashAlgorithm.HASH_ALGORITHM_UNSPECIFIED: return \"HASH_ALGORITHM_UNSPECIFIED\";\n\t\t\tcase HashAlgorithm.SHA2_256: return \"SHA2_256\";\n\t\t\tcase HashAlgorithm.SHA2_384: return \"SHA2_384\";\n\t\t\tcase HashAlgorithm.SHA2_512: return \"SHA2_512\";\n\t\t\tcase HashAlgorithm.SHA3_256: return \"SHA3_256\";\n\t\t\tcase HashAlgorithm.SHA3_384: return \"SHA3_384\";\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum HashAlgorithm\");\n\t\t}\n\t}\n\t/**\n\t* Details of a specific public key, capturing the the key encoding method,\n\t* and signature algorithm.\n\t*\n\t* PublicKeyDetails captures the public key/hash algorithm combinations\n\t* recommended in the Sigstore ecosystem.\n\t*\n\t* This is modelled as a linear set as we want to provide a small number of\n\t* opinionated options instead of allowing every possible permutation.\n\t*\n\t* Any changes to this enum MUST be reflected in the algorithm registry.\n\t*\n\t* See: <https://github.com/sigstore/architecture-docs/blob/main/algorithm-registry.md>\n\t*\n\t* To avoid the possibility of contradicting formats such as PKCS1 with\n\t* ED25519 the valid permutations are listed as a linear set instead of a\n\t* cartesian set (i.e one combined variable instead of two, one for encoding\n\t* and one for the signature algorithm).\n\t*/\n\tvar PublicKeyDetails;\n\t(function(PublicKeyDetails) {\n\t\tPublicKeyDetails[PublicKeyDetails[\"PUBLIC_KEY_DETAILS_UNSPECIFIED\"] = 0] = \"PUBLIC_KEY_DETAILS_UNSPECIFIED\";\n\t\t/**\n\t\t* PKCS1_RSA_PKCS1V5 - RSA\n\t\t*\n\t\t* @deprecated\n\t\t*/\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKCS1_RSA_PKCS1V5\"] = 1] = \"PKCS1_RSA_PKCS1V5\";\n\t\t/**\n\t\t* PKCS1_RSA_PSS - See RFC8017\n\t\t*\n\t\t* @deprecated\n\t\t*/\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKCS1_RSA_PSS\"] = 2] = \"PKCS1_RSA_PSS\";\n\t\t/** @deprecated */\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PKCS1V5\"] = 3] = \"PKIX_RSA_PKCS1V5\";\n\t\t/** @deprecated */\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PSS\"] = 4] = \"PKIX_RSA_PSS\";\n\t\t/** PKIX_RSA_PKCS1V15_2048_SHA256 - RSA public key in PKIX format, PKCS#1v1.5 signature */\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PKCS1V15_2048_SHA256\"] = 9] = \"PKIX_RSA_PKCS1V15_2048_SHA256\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PKCS1V15_3072_SHA256\"] = 10] = \"PKIX_RSA_PKCS1V15_3072_SHA256\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PKCS1V15_4096_SHA256\"] = 11] = \"PKIX_RSA_PKCS1V15_4096_SHA256\";\n\t\t/** PKIX_RSA_PSS_2048_SHA256 - RSA public key in PKIX format, RSASSA-PSS signature */\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PSS_2048_SHA256\"] = 16] = \"PKIX_RSA_PSS_2048_SHA256\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PSS_3072_SHA256\"] = 17] = \"PKIX_RSA_PSS_3072_SHA256\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_RSA_PSS_4096_SHA256\"] = 18] = \"PKIX_RSA_PSS_4096_SHA256\";\n\t\t/**\n\t\t* PKIX_ECDSA_P256_HMAC_SHA_256 - ECDSA\n\t\t*\n\t\t* @deprecated\n\t\t*/\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ECDSA_P256_HMAC_SHA_256\"] = 6] = \"PKIX_ECDSA_P256_HMAC_SHA_256\";\n\t\t/** PKIX_ECDSA_P256_SHA_256 - See NIST FIPS 186-4 */\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ECDSA_P256_SHA_256\"] = 5] = \"PKIX_ECDSA_P256_SHA_256\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ECDSA_P384_SHA_384\"] = 12] = \"PKIX_ECDSA_P384_SHA_384\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ECDSA_P521_SHA_512\"] = 13] = \"PKIX_ECDSA_P521_SHA_512\";\n\t\t/** PKIX_ED25519 - Ed 25519 */\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ED25519\"] = 7] = \"PKIX_ED25519\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ED25519_PH\"] = 8] = \"PKIX_ED25519_PH\";\n\t\t/**\n\t\t* PKIX_ECDSA_P384_SHA_256 - These algorithms are deprecated and should not be used, but they\n\t\t* were/are being used by most Sigstore clients implementations.\n\t\t*\n\t\t* @deprecated\n\t\t*/\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ECDSA_P384_SHA_256\"] = 19] = \"PKIX_ECDSA_P384_SHA_256\";\n\t\t/** @deprecated */\n\t\tPublicKeyDetails[PublicKeyDetails[\"PKIX_ECDSA_P521_SHA_256\"] = 20] = \"PKIX_ECDSA_P521_SHA_256\";\n\t\t/**\n\t\t* LMS_SHA256 - LMS and LM-OTS\n\t\t*\n\t\t* These algorithms are deprecated and should not be used.\n\t\t* There are no plans to support SLH-DSA at this time.\n\t\t*\n\t\t* USER WARNING: LMS and LM-OTS are both stateful signature schemes.\n\t\t* Using them correctly requires discretion and careful consideration\n\t\t* to ensure that individual secret keys are not used more than once.\n\t\t* In addition, LM-OTS is a single-use scheme, meaning that it\n\t\t* MUST NOT be used for more than one signature per LM-OTS key.\n\t\t* If you cannot maintain these invariants, you MUST NOT use these\n\t\t* schemes.\n\t\t*\n\t\t* @deprecated\n\t\t*/\n\t\tPublicKeyDetails[PublicKeyDetails[\"LMS_SHA256\"] = 14] = \"LMS_SHA256\";\n\t\t/** @deprecated */\n\t\tPublicKeyDetails[PublicKeyDetails[\"LMOTS_SHA256\"] = 15] = \"LMOTS_SHA256\";\n\t\t/**\n\t\t* ML_DSA_44 - ML-DSA\n\t\t*\n\t\t* These ML_DSA_44, ML_DSA_65 and ML-DSA_87 algorithms are the pure variants\n\t\t* that take data to sign rather than the prehash variants (HashML-DSA), which\n\t\t* take digests. While considered quantum-resistant, their usage\n\t\t* involves tradeoffs in that signatures and keys are much larger, and\n\t\t* this makes deployments more costly.\n\t\t*\n\t\t* USER WARNING: ML_DSA_44, ML_DSA_65 and ML_DSA_87 are experimental algorithms.\n\t\t* In the future they MAY be used by private Sigstore deployments, but\n\t\t* they are not yet fully functional. This warning will be removed when\n\t\t* these algorithms are widely supported by Sigstore clients and servers,\n\t\t* but care should still be taken for production environments.\n\t\t*\n\t\t* See NIST FIPS 204, RFC 9881 for algorithm identifiers\n\t\t*/\n\t\tPublicKeyDetails[PublicKeyDetails[\"ML_DSA_44\"] = 23] = \"ML_DSA_44\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"ML_DSA_65\"] = 21] = \"ML_DSA_65\";\n\t\tPublicKeyDetails[PublicKeyDetails[\"ML_DSA_87\"] = 22] = \"ML_DSA_87\";\n\t})(PublicKeyDetails || (exports.PublicKeyDetails = PublicKeyDetails = {}));\n\tfunction publicKeyDetailsFromJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase 0:\n\t\t\tcase \"PUBLIC_KEY_DETAILS_UNSPECIFIED\": return PublicKeyDetails.PUBLIC_KEY_DETAILS_UNSPECIFIED;\n\t\t\tcase 1:\n\t\t\tcase \"PKCS1_RSA_PKCS1V5\": return PublicKeyDetails.PKCS1_RSA_PKCS1V5;\n\t\t\tcase 2:\n\t\t\tcase \"PKCS1_RSA_PSS\": return PublicKeyDetails.PKCS1_RSA_PSS;\n\t\t\tcase 3:\n\t\t\tcase \"PKIX_RSA_PKCS1V5\": return PublicKeyDetails.PKIX_RSA_PKCS1V5;\n\t\t\tcase 4:\n\t\t\tcase \"PKIX_RSA_PSS\": return PublicKeyDetails.PKIX_RSA_PSS;\n\t\t\tcase 9:\n\t\t\tcase \"PKIX_RSA_PKCS1V15_2048_SHA256\": return PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256;\n\t\t\tcase 10:\n\t\t\tcase \"PKIX_RSA_PKCS1V15_3072_SHA256\": return PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256;\n\t\t\tcase 11:\n\t\t\tcase \"PKIX_RSA_PKCS1V15_4096_SHA256\": return PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256;\n\t\t\tcase 16:\n\t\t\tcase \"PKIX_RSA_PSS_2048_SHA256\": return PublicKeyDetails.PKIX_RSA_PSS_2048_SHA256;\n\t\t\tcase 17:\n\t\t\tcase \"PKIX_RSA_PSS_3072_SHA256\": return PublicKeyDetails.PKIX_RSA_PSS_3072_SHA256;\n\t\t\tcase 18:\n\t\t\tcase \"PKIX_RSA_PSS_4096_SHA256\": return PublicKeyDetails.PKIX_RSA_PSS_4096_SHA256;\n\t\t\tcase 6:\n\t\t\tcase \"PKIX_ECDSA_P256_HMAC_SHA_256\": return PublicKeyDetails.PKIX_ECDSA_P256_HMAC_SHA_256;\n\t\t\tcase 5:\n\t\t\tcase \"PKIX_ECDSA_P256_SHA_256\": return PublicKeyDetails.PKIX_ECDSA_P256_SHA_256;\n\t\t\tcase 12:\n\t\t\tcase \"PKIX_ECDSA_P384_SHA_384\": return PublicKeyDetails.PKIX_ECDSA_P384_SHA_384;\n\t\t\tcase 13:\n\t\t\tcase \"PKIX_ECDSA_P521_SHA_512\": return PublicKeyDetails.PKIX_ECDSA_P521_SHA_512;\n\t\t\tcase 7:\n\t\t\tcase \"PKIX_ED25519\": return PublicKeyDetails.PKIX_ED25519;\n\t\t\tcase 8:\n\t\t\tcase \"PKIX_ED25519_PH\": return PublicKeyDetails.PKIX_ED25519_PH;\n\t\t\tcase 19:\n\t\t\tcase \"PKIX_ECDSA_P384_SHA_256\": return PublicKeyDetails.PKIX_ECDSA_P384_SHA_256;\n\t\t\tcase 20:\n\t\t\tcase \"PKIX_ECDSA_P521_SHA_256\": return PublicKeyDetails.PKIX_ECDSA_P521_SHA_256;\n\t\t\tcase 14:\n\t\t\tcase \"LMS_SHA256\": return PublicKeyDetails.LMS_SHA256;\n\t\t\tcase 15:\n\t\t\tcase \"LMOTS_SHA256\": return PublicKeyDetails.LMOTS_SHA256;\n\t\t\tcase 23:\n\t\t\tcase \"ML_DSA_44\": return PublicKeyDetails.ML_DSA_44;\n\t\t\tcase 21:\n\t\t\tcase \"ML_DSA_65\": return PublicKeyDetails.ML_DSA_65;\n\t\t\tcase 22:\n\t\t\tcase \"ML_DSA_87\": return PublicKeyDetails.ML_DSA_87;\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum PublicKeyDetails\");\n\t\t}\n\t}\n\tfunction publicKeyDetailsToJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase PublicKeyDetails.PUBLIC_KEY_DETAILS_UNSPECIFIED: return \"PUBLIC_KEY_DETAILS_UNSPECIFIED\";\n\t\t\tcase PublicKeyDetails.PKCS1_RSA_PKCS1V5: return \"PKCS1_RSA_PKCS1V5\";\n\t\t\tcase PublicKeyDetails.PKCS1_RSA_PSS: return \"PKCS1_RSA_PSS\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PKCS1V5: return \"PKIX_RSA_PKCS1V5\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PSS: return \"PKIX_RSA_PSS\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256: return \"PKIX_RSA_PKCS1V15_2048_SHA256\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256: return \"PKIX_RSA_PKCS1V15_3072_SHA256\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256: return \"PKIX_RSA_PKCS1V15_4096_SHA256\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PSS_2048_SHA256: return \"PKIX_RSA_PSS_2048_SHA256\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PSS_3072_SHA256: return \"PKIX_RSA_PSS_3072_SHA256\";\n\t\t\tcase PublicKeyDetails.PKIX_RSA_PSS_4096_SHA256: return \"PKIX_RSA_PSS_4096_SHA256\";\n\t\t\tcase PublicKeyDetails.PKIX_ECDSA_P256_HMAC_SHA_256: return \"PKIX_ECDSA_P256_HMAC_SHA_256\";\n\t\t\tcase PublicKeyDetails.PKIX_ECDSA_P256_SHA_256: return \"PKIX_ECDSA_P256_SHA_256\";\n\t\t\tcase PublicKeyDetails.PKIX_ECDSA_P384_SHA_384: return \"PKIX_ECDSA_P384_SHA_384\";\n\t\t\tcase PublicKeyDetails.PKIX_ECDSA_P521_SHA_512: return \"PKIX_ECDSA_P521_SHA_512\";\n\t\t\tcase PublicKeyDetails.PKIX_ED25519: return \"PKIX_ED25519\";\n\t\t\tcase PublicKeyDetails.PKIX_ED25519_PH: return \"PKIX_ED25519_PH\";\n\t\t\tcase PublicKeyDetails.PKIX_ECDSA_P384_SHA_256: return \"PKIX_ECDSA_P384_SHA_256\";\n\t\t\tcase PublicKeyDetails.PKIX_ECDSA_P521_SHA_256: return \"PKIX_ECDSA_P521_SHA_256\";\n\t\t\tcase PublicKeyDetails.LMS_SHA256: return \"LMS_SHA256\";\n\t\t\tcase PublicKeyDetails.LMOTS_SHA256: return \"LMOTS_SHA256\";\n\t\t\tcase PublicKeyDetails.ML_DSA_44: return \"ML_DSA_44\";\n\t\t\tcase PublicKeyDetails.ML_DSA_65: return \"ML_DSA_65\";\n\t\t\tcase PublicKeyDetails.ML_DSA_87: return \"ML_DSA_87\";\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum PublicKeyDetails\");\n\t\t}\n\t}\n\tvar SubjectAlternativeNameType;\n\t(function(SubjectAlternativeNameType) {\n\t\tSubjectAlternativeNameType[SubjectAlternativeNameType[\"SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED\"] = 0] = \"SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED\";\n\t\tSubjectAlternativeNameType[SubjectAlternativeNameType[\"EMAIL\"] = 1] = \"EMAIL\";\n\t\tSubjectAlternativeNameType[SubjectAlternativeNameType[\"URI\"] = 2] = \"URI\";\n\t\t/**\n\t\t* OTHER_NAME - OID 1.3.6.1.4.1.57264.1.7\n\t\t* See https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md#1361415726417--othername-san\n\t\t* for more details.\n\t\t*/\n\t\tSubjectAlternativeNameType[SubjectAlternativeNameType[\"OTHER_NAME\"] = 3] = \"OTHER_NAME\";\n\t})(SubjectAlternativeNameType || (exports.SubjectAlternativeNameType = SubjectAlternativeNameType = {}));\n\tfunction subjectAlternativeNameTypeFromJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase 0:\n\t\t\tcase \"SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED\": return SubjectAlternativeNameType.SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED;\n\t\t\tcase 1:\n\t\t\tcase \"EMAIL\": return SubjectAlternativeNameType.EMAIL;\n\t\t\tcase 2:\n\t\t\tcase \"URI\": return SubjectAlternativeNameType.URI;\n\t\t\tcase 3:\n\t\t\tcase \"OTHER_NAME\": return SubjectAlternativeNameType.OTHER_NAME;\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum SubjectAlternativeNameType\");\n\t\t}\n\t}\n\tfunction subjectAlternativeNameTypeToJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase SubjectAlternativeNameType.SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED: return \"SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED\";\n\t\t\tcase SubjectAlternativeNameType.EMAIL: return \"EMAIL\";\n\t\t\tcase SubjectAlternativeNameType.URI: return \"URI\";\n\t\t\tcase SubjectAlternativeNameType.OTHER_NAME: return \"OTHER_NAME\";\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum SubjectAlternativeNameType\");\n\t\t}\n\t}\n\texports.HashOutput = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\talgorithm: isSet(object.algorithm) ? hashAlgorithmFromJSON(object.algorithm) : 0,\n\t\t\t\tdigest: isSet(object.digest) ? Buffer.from(bytesFromBase64(object.digest)) : Buffer.alloc(0)\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.algorithm !== 0) obj.algorithm = hashAlgorithmToJSON(message.algorithm);\n\t\t\tif (message.digest.length !== 0) obj.digest = base64FromBytes(message.digest);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.MessageSignature = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tmessageDigest: isSet(object.messageDigest) ? exports.HashOutput.fromJSON(object.messageDigest) : void 0,\n\t\t\t\tsignature: isSet(object.signature) ? Buffer.from(bytesFromBase64(object.signature)) : Buffer.alloc(0)\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.messageDigest !== void 0) obj.messageDigest = exports.HashOutput.toJSON(message.messageDigest);\n\t\t\tif (message.signature.length !== 0) obj.signature = base64FromBytes(message.signature);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.LogId = {\n\t\tfromJSON(object) {\n\t\t\treturn { keyId: isSet(object.keyId) ? Buffer.from(bytesFromBase64(object.keyId)) : Buffer.alloc(0) };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.keyId.length !== 0) obj.keyId = base64FromBytes(message.keyId);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.RFC3161SignedTimestamp = {\n\t\tfromJSON(object) {\n\t\t\treturn { signedTimestamp: isSet(object.signedTimestamp) ? Buffer.from(bytesFromBase64(object.signedTimestamp)) : Buffer.alloc(0) };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.signedTimestamp.length !== 0) obj.signedTimestamp = base64FromBytes(message.signedTimestamp);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.PublicKey = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\trawBytes: isSet(object.rawBytes) ? Buffer.from(bytesFromBase64(object.rawBytes)) : void 0,\n\t\t\t\tkeyDetails: isSet(object.keyDetails) ? publicKeyDetailsFromJSON(object.keyDetails) : 0,\n\t\t\t\tvalidFor: isSet(object.validFor) ? exports.TimeRange.fromJSON(object.validFor) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.rawBytes !== void 0) obj.rawBytes = base64FromBytes(message.rawBytes);\n\t\t\tif (message.keyDetails !== 0) obj.keyDetails = publicKeyDetailsToJSON(message.keyDetails);\n\t\t\tif (message.validFor !== void 0) obj.validFor = exports.TimeRange.toJSON(message.validFor);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.PublicKeyIdentifier = {\n\t\tfromJSON(object) {\n\t\t\treturn { hint: isSet(object.hint) ? globalThis.String(object.hint) : \"\" };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.hint !== \"\") obj.hint = message.hint;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ObjectIdentifier = {\n\t\tfromJSON(object) {\n\t\t\treturn { id: globalThis.Array.isArray(object?.id) ? object.id.map((e) => globalThis.Number(e)) : [] };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.id?.length) obj.id = message.id.map((e) => Math.round(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ObjectIdentifierValuePair = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\toid: isSet(object.oid) ? exports.ObjectIdentifier.fromJSON(object.oid) : void 0,\n\t\t\t\tvalue: isSet(object.value) ? Buffer.from(bytesFromBase64(object.value)) : Buffer.alloc(0)\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.oid !== void 0) obj.oid = exports.ObjectIdentifier.toJSON(message.oid);\n\t\t\tif (message.value.length !== 0) obj.value = base64FromBytes(message.value);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.DistinguishedName = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\torganization: isSet(object.organization) ? globalThis.String(object.organization) : \"\",\n\t\t\t\tcommonName: isSet(object.commonName) ? globalThis.String(object.commonName) : \"\"\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.organization !== \"\") obj.organization = message.organization;\n\t\t\tif (message.commonName !== \"\") obj.commonName = message.commonName;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.X509Certificate = {\n\t\tfromJSON(object) {\n\t\t\treturn { rawBytes: isSet(object.rawBytes) ? Buffer.from(bytesFromBase64(object.rawBytes)) : Buffer.alloc(0) };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.rawBytes.length !== 0) obj.rawBytes = base64FromBytes(message.rawBytes);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.SubjectAlternativeName = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\ttype: isSet(object.type) ? subjectAlternativeNameTypeFromJSON(object.type) : 0,\n\t\t\t\tidentity: isSet(object.regexp) ? {\n\t\t\t\t\t$case: \"regexp\",\n\t\t\t\t\tregexp: globalThis.String(object.regexp)\n\t\t\t\t} : isSet(object.value) ? {\n\t\t\t\t\t$case: \"value\",\n\t\t\t\t\tvalue: globalThis.String(object.value)\n\t\t\t\t} : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.type !== 0) obj.type = subjectAlternativeNameTypeToJSON(message.type);\n\t\t\tif (message.identity?.$case === \"regexp\") obj.regexp = message.identity.regexp;\n\t\t\telse if (message.identity?.$case === \"value\") obj.value = message.identity.value;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.X509CertificateChain = {\n\t\tfromJSON(object) {\n\t\t\treturn { certificates: globalThis.Array.isArray(object?.certificates) ? object.certificates.map((e) => exports.X509Certificate.fromJSON(e)) : [] };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.certificates?.length) obj.certificates = message.certificates.map((e) => exports.X509Certificate.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.TimeRange = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tstart: isSet(object.start) ? fromJsonTimestamp(object.start) : void 0,\n\t\t\t\tend: isSet(object.end) ? fromJsonTimestamp(object.end) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.start !== void 0) obj.start = message.start.toISOString();\n\t\t\tif (message.end !== void 0) obj.end = message.end.toISOString();\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction bytesFromBase64(b64) {\n\t\treturn Uint8Array.from(globalThis.Buffer.from(b64, \"base64\"));\n\t}\n\tfunction base64FromBytes(arr) {\n\t\treturn globalThis.Buffer.from(arr).toString(\"base64\");\n\t}\n\tfunction fromTimestamp(t) {\n\t\tlet millis = (globalThis.Number(t.seconds) || 0) * 1e3;\n\t\tmillis += (t.nanos || 0) / 1e6;\n\t\treturn new globalThis.Date(millis);\n\t}\n\tfunction fromJsonTimestamp(o) {\n\t\tif (o instanceof globalThis.Date) return o;\n\t\telse if (typeof o === \"string\") return new globalThis.Date(o);\n\t\telse return fromTimestamp(timestamp_1.Timestamp.fromJSON(o));\n\t}\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_rekor.js\nvar require_sigstore_rekor = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.TransparencyLogEntry = exports.InclusionPromise = exports.InclusionProof = exports.Checkpoint = exports.KindVersion = void 0;\n\tconst sigstore_common_1 = require_sigstore_common();\n\texports.KindVersion = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tkind: isSet(object.kind) ? globalThis.String(object.kind) : \"\",\n\t\t\t\tversion: isSet(object.version) ? globalThis.String(object.version) : \"\"\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.kind !== \"\") obj.kind = message.kind;\n\t\t\tif (message.version !== \"\") obj.version = message.version;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Checkpoint = {\n\t\tfromJSON(object) {\n\t\t\treturn { envelope: isSet(object.envelope) ? globalThis.String(object.envelope) : \"\" };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.envelope !== \"\") obj.envelope = message.envelope;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.InclusionProof = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tlogIndex: isSet(object.logIndex) ? globalThis.String(object.logIndex) : \"0\",\n\t\t\t\trootHash: isSet(object.rootHash) ? Buffer.from(bytesFromBase64(object.rootHash)) : Buffer.alloc(0),\n\t\t\t\ttreeSize: isSet(object.treeSize) ? globalThis.String(object.treeSize) : \"0\",\n\t\t\t\thashes: globalThis.Array.isArray(object?.hashes) ? object.hashes.map((e) => Buffer.from(bytesFromBase64(e))) : [],\n\t\t\t\tcheckpoint: isSet(object.checkpoint) ? exports.Checkpoint.fromJSON(object.checkpoint) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.logIndex !== \"0\") obj.logIndex = message.logIndex;\n\t\t\tif (message.rootHash.length !== 0) obj.rootHash = base64FromBytes(message.rootHash);\n\t\t\tif (message.treeSize !== \"0\") obj.treeSize = message.treeSize;\n\t\t\tif (message.hashes?.length) obj.hashes = message.hashes.map((e) => base64FromBytes(e));\n\t\t\tif (message.checkpoint !== void 0) obj.checkpoint = exports.Checkpoint.toJSON(message.checkpoint);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.InclusionPromise = {\n\t\tfromJSON(object) {\n\t\t\treturn { signedEntryTimestamp: isSet(object.signedEntryTimestamp) ? Buffer.from(bytesFromBase64(object.signedEntryTimestamp)) : Buffer.alloc(0) };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.signedEntryTimestamp.length !== 0) obj.signedEntryTimestamp = base64FromBytes(message.signedEntryTimestamp);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.TransparencyLogEntry = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tlogIndex: isSet(object.logIndex) ? globalThis.String(object.logIndex) : \"0\",\n\t\t\t\tlogId: isSet(object.logId) ? sigstore_common_1.LogId.fromJSON(object.logId) : void 0,\n\t\t\t\tkindVersion: isSet(object.kindVersion) ? exports.KindVersion.fromJSON(object.kindVersion) : void 0,\n\t\t\t\tintegratedTime: isSet(object.integratedTime) ? globalThis.String(object.integratedTime) : \"0\",\n\t\t\t\tinclusionPromise: isSet(object.inclusionPromise) ? exports.InclusionPromise.fromJSON(object.inclusionPromise) : void 0,\n\t\t\t\tinclusionProof: isSet(object.inclusionProof) ? exports.InclusionProof.fromJSON(object.inclusionProof) : void 0,\n\t\t\t\tcanonicalizedBody: isSet(object.canonicalizedBody) ? Buffer.from(bytesFromBase64(object.canonicalizedBody)) : Buffer.alloc(0)\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.logIndex !== \"0\") obj.logIndex = message.logIndex;\n\t\t\tif (message.logId !== void 0) obj.logId = sigstore_common_1.LogId.toJSON(message.logId);\n\t\t\tif (message.kindVersion !== void 0) obj.kindVersion = exports.KindVersion.toJSON(message.kindVersion);\n\t\t\tif (message.integratedTime !== \"0\") obj.integratedTime = message.integratedTime;\n\t\t\tif (message.inclusionPromise !== void 0) obj.inclusionPromise = exports.InclusionPromise.toJSON(message.inclusionPromise);\n\t\t\tif (message.inclusionProof !== void 0) obj.inclusionProof = exports.InclusionProof.toJSON(message.inclusionProof);\n\t\t\tif (message.canonicalizedBody.length !== 0) obj.canonicalizedBody = base64FromBytes(message.canonicalizedBody);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction bytesFromBase64(b64) {\n\t\treturn Uint8Array.from(globalThis.Buffer.from(b64, \"base64\"));\n\t}\n\tfunction base64FromBytes(arr) {\n\t\treturn globalThis.Buffer.from(arr).toString(\"base64\");\n\t}\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_bundle.js\nvar require_sigstore_bundle = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.Bundle = exports.VerificationMaterial = exports.TimestampVerificationData = void 0;\n\tconst envelope_1 = require_envelope();\n\tconst sigstore_common_1 = require_sigstore_common();\n\tconst sigstore_rekor_1 = require_sigstore_rekor();\n\texports.TimestampVerificationData = {\n\t\tfromJSON(object) {\n\t\t\treturn { rfc3161Timestamps: globalThis.Array.isArray(object?.rfc3161Timestamps) ? object.rfc3161Timestamps.map((e) => sigstore_common_1.RFC3161SignedTimestamp.fromJSON(e)) : [] };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.rfc3161Timestamps?.length) obj.rfc3161Timestamps = message.rfc3161Timestamps.map((e) => sigstore_common_1.RFC3161SignedTimestamp.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.VerificationMaterial = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tcontent: isSet(object.publicKey) ? {\n\t\t\t\t\t$case: \"publicKey\",\n\t\t\t\t\tpublicKey: sigstore_common_1.PublicKeyIdentifier.fromJSON(object.publicKey)\n\t\t\t\t} : isSet(object.x509CertificateChain) ? {\n\t\t\t\t\t$case: \"x509CertificateChain\",\n\t\t\t\t\tx509CertificateChain: sigstore_common_1.X509CertificateChain.fromJSON(object.x509CertificateChain)\n\t\t\t\t} : isSet(object.certificate) ? {\n\t\t\t\t\t$case: \"certificate\",\n\t\t\t\t\tcertificate: sigstore_common_1.X509Certificate.fromJSON(object.certificate)\n\t\t\t\t} : void 0,\n\t\t\t\ttlogEntries: globalThis.Array.isArray(object?.tlogEntries) ? object.tlogEntries.map((e) => sigstore_rekor_1.TransparencyLogEntry.fromJSON(e)) : [],\n\t\t\t\ttimestampVerificationData: isSet(object.timestampVerificationData) ? exports.TimestampVerificationData.fromJSON(object.timestampVerificationData) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.content?.$case === \"publicKey\") obj.publicKey = sigstore_common_1.PublicKeyIdentifier.toJSON(message.content.publicKey);\n\t\t\telse if (message.content?.$case === \"x509CertificateChain\") obj.x509CertificateChain = sigstore_common_1.X509CertificateChain.toJSON(message.content.x509CertificateChain);\n\t\t\telse if (message.content?.$case === \"certificate\") obj.certificate = sigstore_common_1.X509Certificate.toJSON(message.content.certificate);\n\t\t\tif (message.tlogEntries?.length) obj.tlogEntries = message.tlogEntries.map((e) => sigstore_rekor_1.TransparencyLogEntry.toJSON(e));\n\t\t\tif (message.timestampVerificationData !== void 0) obj.timestampVerificationData = exports.TimestampVerificationData.toJSON(message.timestampVerificationData);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Bundle = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tmediaType: isSet(object.mediaType) ? globalThis.String(object.mediaType) : \"\",\n\t\t\t\tverificationMaterial: isSet(object.verificationMaterial) ? exports.VerificationMaterial.fromJSON(object.verificationMaterial) : void 0,\n\t\t\t\tcontent: isSet(object.messageSignature) ? {\n\t\t\t\t\t$case: \"messageSignature\",\n\t\t\t\t\tmessageSignature: sigstore_common_1.MessageSignature.fromJSON(object.messageSignature)\n\t\t\t\t} : isSet(object.dsseEnvelope) ? {\n\t\t\t\t\t$case: \"dsseEnvelope\",\n\t\t\t\t\tdsseEnvelope: envelope_1.Envelope.fromJSON(object.dsseEnvelope)\n\t\t\t\t} : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.mediaType !== \"\") obj.mediaType = message.mediaType;\n\t\t\tif (message.verificationMaterial !== void 0) obj.verificationMaterial = exports.VerificationMaterial.toJSON(message.verificationMaterial);\n\t\t\tif (message.content?.$case === \"messageSignature\") obj.messageSignature = sigstore_common_1.MessageSignature.toJSON(message.content.messageSignature);\n\t\t\telse if (message.content?.$case === \"dsseEnvelope\") obj.dsseEnvelope = envelope_1.Envelope.toJSON(message.content.dsseEnvelope);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_trustroot.js\nvar require_sigstore_trustroot = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.ClientTrustConfig = exports.ServiceConfiguration = exports.Service = exports.SigningConfig = exports.TrustedRoot = exports.CertificateAuthority = exports.TransparencyLogInstance = exports.ServiceSelector = void 0;\n\texports.serviceSelectorFromJSON = serviceSelectorFromJSON;\n\texports.serviceSelectorToJSON = serviceSelectorToJSON;\n\tconst sigstore_common_1 = require_sigstore_common();\n\t/**\n\t* ServiceSelector specifies how a client SHOULD select a set of\n\t* Services to connect to. A client SHOULD throw an error if\n\t* the value is SERVICE_SELECTOR_UNDEFINED.\n\t*/\n\tvar ServiceSelector;\n\t(function(ServiceSelector) {\n\t\tServiceSelector[ServiceSelector[\"SERVICE_SELECTOR_UNDEFINED\"] = 0] = \"SERVICE_SELECTOR_UNDEFINED\";\n\t\t/**\n\t\t* ALL - Clients SHOULD select all Services based on supported API version\n\t\t* and validity window.\n\t\t*/\n\t\tServiceSelector[ServiceSelector[\"ALL\"] = 1] = \"ALL\";\n\t\t/**\n\t\t* ANY - Clients SHOULD select one Service based on supported API version\n\t\t* and validity window. It is up to the client implementation to\n\t\t* decide how to select the Service, e.g. random or round-robin.\n\t\t*/\n\t\tServiceSelector[ServiceSelector[\"ANY\"] = 2] = \"ANY\";\n\t\t/**\n\t\t* EXACT - Clients SHOULD select a specific number of Services based on\n\t\t* supported API version and validity window, using the provided\n\t\t* `count`. It is up to the client implementation to decide how to\n\t\t* select the Service, e.g. random or round-robin.\n\t\t*/\n\t\tServiceSelector[ServiceSelector[\"EXACT\"] = 3] = \"EXACT\";\n\t})(ServiceSelector || (exports.ServiceSelector = ServiceSelector = {}));\n\tfunction serviceSelectorFromJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase 0:\n\t\t\tcase \"SERVICE_SELECTOR_UNDEFINED\": return ServiceSelector.SERVICE_SELECTOR_UNDEFINED;\n\t\t\tcase 1:\n\t\t\tcase \"ALL\": return ServiceSelector.ALL;\n\t\t\tcase 2:\n\t\t\tcase \"ANY\": return ServiceSelector.ANY;\n\t\t\tcase 3:\n\t\t\tcase \"EXACT\": return ServiceSelector.EXACT;\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum ServiceSelector\");\n\t\t}\n\t}\n\tfunction serviceSelectorToJSON(object) {\n\t\tswitch (object) {\n\t\t\tcase ServiceSelector.SERVICE_SELECTOR_UNDEFINED: return \"SERVICE_SELECTOR_UNDEFINED\";\n\t\t\tcase ServiceSelector.ALL: return \"ALL\";\n\t\t\tcase ServiceSelector.ANY: return \"ANY\";\n\t\t\tcase ServiceSelector.EXACT: return \"EXACT\";\n\t\t\tdefault: throw new globalThis.Error(\"Unrecognized enum value \" + object + \" for enum ServiceSelector\");\n\t\t}\n\t}\n\texports.TransparencyLogInstance = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tbaseUrl: isSet(object.baseUrl) ? globalThis.String(object.baseUrl) : \"\",\n\t\t\t\thashAlgorithm: isSet(object.hashAlgorithm) ? (0, sigstore_common_1.hashAlgorithmFromJSON)(object.hashAlgorithm) : 0,\n\t\t\t\tpublicKey: isSet(object.publicKey) ? sigstore_common_1.PublicKey.fromJSON(object.publicKey) : void 0,\n\t\t\t\tlogId: isSet(object.logId) ? sigstore_common_1.LogId.fromJSON(object.logId) : void 0,\n\t\t\t\tcheckpointKeyId: isSet(object.checkpointKeyId) ? sigstore_common_1.LogId.fromJSON(object.checkpointKeyId) : void 0,\n\t\t\t\toperator: isSet(object.operator) ? globalThis.String(object.operator) : \"\"\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.baseUrl !== \"\") obj.baseUrl = message.baseUrl;\n\t\t\tif (message.hashAlgorithm !== 0) obj.hashAlgorithm = (0, sigstore_common_1.hashAlgorithmToJSON)(message.hashAlgorithm);\n\t\t\tif (message.publicKey !== void 0) obj.publicKey = sigstore_common_1.PublicKey.toJSON(message.publicKey);\n\t\t\tif (message.logId !== void 0) obj.logId = sigstore_common_1.LogId.toJSON(message.logId);\n\t\t\tif (message.checkpointKeyId !== void 0) obj.checkpointKeyId = sigstore_common_1.LogId.toJSON(message.checkpointKeyId);\n\t\t\tif (message.operator !== \"\") obj.operator = message.operator;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.CertificateAuthority = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tsubject: isSet(object.subject) ? sigstore_common_1.DistinguishedName.fromJSON(object.subject) : void 0,\n\t\t\t\turi: isSet(object.uri) ? globalThis.String(object.uri) : \"\",\n\t\t\t\tcertChain: isSet(object.certChain) ? sigstore_common_1.X509CertificateChain.fromJSON(object.certChain) : void 0,\n\t\t\t\tvalidFor: isSet(object.validFor) ? sigstore_common_1.TimeRange.fromJSON(object.validFor) : void 0,\n\t\t\t\toperator: isSet(object.operator) ? globalThis.String(object.operator) : \"\"\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.subject !== void 0) obj.subject = sigstore_common_1.DistinguishedName.toJSON(message.subject);\n\t\t\tif (message.uri !== \"\") obj.uri = message.uri;\n\t\t\tif (message.certChain !== void 0) obj.certChain = sigstore_common_1.X509CertificateChain.toJSON(message.certChain);\n\t\t\tif (message.validFor !== void 0) obj.validFor = sigstore_common_1.TimeRange.toJSON(message.validFor);\n\t\t\tif (message.operator !== \"\") obj.operator = message.operator;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.TrustedRoot = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tmediaType: isSet(object.mediaType) ? globalThis.String(object.mediaType) : \"\",\n\t\t\t\ttlogs: globalThis.Array.isArray(object?.tlogs) ? object.tlogs.map((e) => exports.TransparencyLogInstance.fromJSON(e)) : [],\n\t\t\t\tcertificateAuthorities: globalThis.Array.isArray(object?.certificateAuthorities) ? object.certificateAuthorities.map((e) => exports.CertificateAuthority.fromJSON(e)) : [],\n\t\t\t\tctlogs: globalThis.Array.isArray(object?.ctlogs) ? object.ctlogs.map((e) => exports.TransparencyLogInstance.fromJSON(e)) : [],\n\t\t\t\ttimestampAuthorities: globalThis.Array.isArray(object?.timestampAuthorities) ? object.timestampAuthorities.map((e) => exports.CertificateAuthority.fromJSON(e)) : []\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.mediaType !== \"\") obj.mediaType = message.mediaType;\n\t\t\tif (message.tlogs?.length) obj.tlogs = message.tlogs.map((e) => exports.TransparencyLogInstance.toJSON(e));\n\t\t\tif (message.certificateAuthorities?.length) obj.certificateAuthorities = message.certificateAuthorities.map((e) => exports.CertificateAuthority.toJSON(e));\n\t\t\tif (message.ctlogs?.length) obj.ctlogs = message.ctlogs.map((e) => exports.TransparencyLogInstance.toJSON(e));\n\t\t\tif (message.timestampAuthorities?.length) obj.timestampAuthorities = message.timestampAuthorities.map((e) => exports.CertificateAuthority.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.SigningConfig = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tmediaType: isSet(object.mediaType) ? globalThis.String(object.mediaType) : \"\",\n\t\t\t\tcaUrls: globalThis.Array.isArray(object?.caUrls) ? object.caUrls.map((e) => exports.Service.fromJSON(e)) : [],\n\t\t\t\toidcUrls: globalThis.Array.isArray(object?.oidcUrls) ? object.oidcUrls.map((e) => exports.Service.fromJSON(e)) : [],\n\t\t\t\trekorTlogUrls: globalThis.Array.isArray(object?.rekorTlogUrls) ? object.rekorTlogUrls.map((e) => exports.Service.fromJSON(e)) : [],\n\t\t\t\trekorTlogConfig: isSet(object.rekorTlogConfig) ? exports.ServiceConfiguration.fromJSON(object.rekorTlogConfig) : void 0,\n\t\t\t\ttsaUrls: globalThis.Array.isArray(object?.tsaUrls) ? object.tsaUrls.map((e) => exports.Service.fromJSON(e)) : [],\n\t\t\t\ttsaConfig: isSet(object.tsaConfig) ? exports.ServiceConfiguration.fromJSON(object.tsaConfig) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.mediaType !== \"\") obj.mediaType = message.mediaType;\n\t\t\tif (message.caUrls?.length) obj.caUrls = message.caUrls.map((e) => exports.Service.toJSON(e));\n\t\t\tif (message.oidcUrls?.length) obj.oidcUrls = message.oidcUrls.map((e) => exports.Service.toJSON(e));\n\t\t\tif (message.rekorTlogUrls?.length) obj.rekorTlogUrls = message.rekorTlogUrls.map((e) => exports.Service.toJSON(e));\n\t\t\tif (message.rekorTlogConfig !== void 0) obj.rekorTlogConfig = exports.ServiceConfiguration.toJSON(message.rekorTlogConfig);\n\t\t\tif (message.tsaUrls?.length) obj.tsaUrls = message.tsaUrls.map((e) => exports.Service.toJSON(e));\n\t\t\tif (message.tsaConfig !== void 0) obj.tsaConfig = exports.ServiceConfiguration.toJSON(message.tsaConfig);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Service = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\turl: isSet(object.url) ? globalThis.String(object.url) : \"\",\n\t\t\t\tmajorApiVersion: isSet(object.majorApiVersion) ? globalThis.Number(object.majorApiVersion) : 0,\n\t\t\t\tvalidFor: isSet(object.validFor) ? sigstore_common_1.TimeRange.fromJSON(object.validFor) : void 0,\n\t\t\t\toperator: isSet(object.operator) ? globalThis.String(object.operator) : \"\"\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.url !== \"\") obj.url = message.url;\n\t\t\tif (message.majorApiVersion !== 0) obj.majorApiVersion = Math.round(message.majorApiVersion);\n\t\t\tif (message.validFor !== void 0) obj.validFor = sigstore_common_1.TimeRange.toJSON(message.validFor);\n\t\t\tif (message.operator !== \"\") obj.operator = message.operator;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ServiceConfiguration = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tselector: isSet(object.selector) ? serviceSelectorFromJSON(object.selector) : 0,\n\t\t\t\tcount: isSet(object.count) ? globalThis.Number(object.count) : 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.selector !== 0) obj.selector = serviceSelectorToJSON(message.selector);\n\t\t\tif (message.count !== 0) obj.count = Math.round(message.count);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ClientTrustConfig = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tmediaType: isSet(object.mediaType) ? globalThis.String(object.mediaType) : \"\",\n\t\t\t\ttrustedRoot: isSet(object.trustedRoot) ? exports.TrustedRoot.fromJSON(object.trustedRoot) : void 0,\n\t\t\t\tsigningConfig: isSet(object.signingConfig) ? exports.SigningConfig.fromJSON(object.signingConfig) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.mediaType !== \"\") obj.mediaType = message.mediaType;\n\t\t\tif (message.trustedRoot !== void 0) obj.trustedRoot = exports.TrustedRoot.toJSON(message.trustedRoot);\n\t\t\tif (message.signingConfig !== void 0) obj.signingConfig = exports.SigningConfig.toJSON(message.signingConfig);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_verification.js\nvar require_sigstore_verification = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.Input = exports.Artifact = exports.ArtifactVerificationOptions_ObserverTimestampOptions = exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions = exports.ArtifactVerificationOptions_TimestampAuthorityOptions = exports.ArtifactVerificationOptions_CtlogOptions = exports.ArtifactVerificationOptions_TlogOptions = exports.ArtifactVerificationOptions = exports.PublicKeyIdentities = exports.CertificateIdentities = exports.CertificateIdentity = void 0;\n\tconst sigstore_bundle_1 = require_sigstore_bundle();\n\tconst sigstore_common_1 = require_sigstore_common();\n\tconst sigstore_trustroot_1 = require_sigstore_trustroot();\n\texports.CertificateIdentity = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tissuer: isSet(object.issuer) ? globalThis.String(object.issuer) : \"\",\n\t\t\t\tsan: isSet(object.san) ? sigstore_common_1.SubjectAlternativeName.fromJSON(object.san) : void 0,\n\t\t\t\toids: globalThis.Array.isArray(object?.oids) ? object.oids.map((e) => sigstore_common_1.ObjectIdentifierValuePair.fromJSON(e)) : []\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.issuer !== \"\") obj.issuer = message.issuer;\n\t\t\tif (message.san !== void 0) obj.san = sigstore_common_1.SubjectAlternativeName.toJSON(message.san);\n\t\t\tif (message.oids?.length) obj.oids = message.oids.map((e) => sigstore_common_1.ObjectIdentifierValuePair.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.CertificateIdentities = {\n\t\tfromJSON(object) {\n\t\t\treturn { identities: globalThis.Array.isArray(object?.identities) ? object.identities.map((e) => exports.CertificateIdentity.fromJSON(e)) : [] };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.identities?.length) obj.identities = message.identities.map((e) => exports.CertificateIdentity.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.PublicKeyIdentities = {\n\t\tfromJSON(object) {\n\t\t\treturn { publicKeys: globalThis.Array.isArray(object?.publicKeys) ? object.publicKeys.map((e) => sigstore_common_1.PublicKey.fromJSON(e)) : [] };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.publicKeys?.length) obj.publicKeys = message.publicKeys.map((e) => sigstore_common_1.PublicKey.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ArtifactVerificationOptions = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tsigners: isSet(object.certificateIdentities) ? {\n\t\t\t\t\t$case: \"certificateIdentities\",\n\t\t\t\t\tcertificateIdentities: exports.CertificateIdentities.fromJSON(object.certificateIdentities)\n\t\t\t\t} : isSet(object.publicKeys) ? {\n\t\t\t\t\t$case: \"publicKeys\",\n\t\t\t\t\tpublicKeys: exports.PublicKeyIdentities.fromJSON(object.publicKeys)\n\t\t\t\t} : void 0,\n\t\t\t\ttlogOptions: isSet(object.tlogOptions) ? exports.ArtifactVerificationOptions_TlogOptions.fromJSON(object.tlogOptions) : void 0,\n\t\t\t\tctlogOptions: isSet(object.ctlogOptions) ? exports.ArtifactVerificationOptions_CtlogOptions.fromJSON(object.ctlogOptions) : void 0,\n\t\t\t\ttsaOptions: isSet(object.tsaOptions) ? exports.ArtifactVerificationOptions_TimestampAuthorityOptions.fromJSON(object.tsaOptions) : void 0,\n\t\t\t\tintegratedTsOptions: isSet(object.integratedTsOptions) ? exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions.fromJSON(object.integratedTsOptions) : void 0,\n\t\t\t\tobserverOptions: isSet(object.observerOptions) ? exports.ArtifactVerificationOptions_ObserverTimestampOptions.fromJSON(object.observerOptions) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.signers?.$case === \"certificateIdentities\") obj.certificateIdentities = exports.CertificateIdentities.toJSON(message.signers.certificateIdentities);\n\t\t\telse if (message.signers?.$case === \"publicKeys\") obj.publicKeys = exports.PublicKeyIdentities.toJSON(message.signers.publicKeys);\n\t\t\tif (message.tlogOptions !== void 0) obj.tlogOptions = exports.ArtifactVerificationOptions_TlogOptions.toJSON(message.tlogOptions);\n\t\t\tif (message.ctlogOptions !== void 0) obj.ctlogOptions = exports.ArtifactVerificationOptions_CtlogOptions.toJSON(message.ctlogOptions);\n\t\t\tif (message.tsaOptions !== void 0) obj.tsaOptions = exports.ArtifactVerificationOptions_TimestampAuthorityOptions.toJSON(message.tsaOptions);\n\t\t\tif (message.integratedTsOptions !== void 0) obj.integratedTsOptions = exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions.toJSON(message.integratedTsOptions);\n\t\t\tif (message.observerOptions !== void 0) obj.observerOptions = exports.ArtifactVerificationOptions_ObserverTimestampOptions.toJSON(message.observerOptions);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ArtifactVerificationOptions_TlogOptions = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tthreshold: isSet(object.threshold) ? globalThis.Number(object.threshold) : 0,\n\t\t\t\tperformOnlineVerification: isSet(object.performOnlineVerification) ? globalThis.Boolean(object.performOnlineVerification) : false,\n\t\t\t\tdisable: isSet(object.disable) ? globalThis.Boolean(object.disable) : false\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.threshold !== 0) obj.threshold = Math.round(message.threshold);\n\t\t\tif (message.performOnlineVerification !== false) obj.performOnlineVerification = message.performOnlineVerification;\n\t\t\tif (message.disable !== false) obj.disable = message.disable;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ArtifactVerificationOptions_CtlogOptions = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tthreshold: isSet(object.threshold) ? globalThis.Number(object.threshold) : 0,\n\t\t\t\tdisable: isSet(object.disable) ? globalThis.Boolean(object.disable) : false\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.threshold !== 0) obj.threshold = Math.round(message.threshold);\n\t\t\tif (message.disable !== false) obj.disable = message.disable;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ArtifactVerificationOptions_TimestampAuthorityOptions = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tthreshold: isSet(object.threshold) ? globalThis.Number(object.threshold) : 0,\n\t\t\t\tdisable: isSet(object.disable) ? globalThis.Boolean(object.disable) : false\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.threshold !== 0) obj.threshold = Math.round(message.threshold);\n\t\t\tif (message.disable !== false) obj.disable = message.disable;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tthreshold: isSet(object.threshold) ? globalThis.Number(object.threshold) : 0,\n\t\t\t\tdisable: isSet(object.disable) ? globalThis.Boolean(object.disable) : false\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.threshold !== 0) obj.threshold = Math.round(message.threshold);\n\t\t\tif (message.disable !== false) obj.disable = message.disable;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.ArtifactVerificationOptions_ObserverTimestampOptions = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tthreshold: isSet(object.threshold) ? globalThis.Number(object.threshold) : 0,\n\t\t\t\tdisable: isSet(object.disable) ? globalThis.Boolean(object.disable) : false\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.threshold !== 0) obj.threshold = Math.round(message.threshold);\n\t\t\tif (message.disable !== false) obj.disable = message.disable;\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Artifact = {\n\t\tfromJSON(object) {\n\t\t\treturn { data: isSet(object.artifactUri) ? {\n\t\t\t\t$case: \"artifactUri\",\n\t\t\t\tartifactUri: globalThis.String(object.artifactUri)\n\t\t\t} : isSet(object.artifact) ? {\n\t\t\t\t$case: \"artifact\",\n\t\t\t\tartifact: Buffer.from(bytesFromBase64(object.artifact))\n\t\t\t} : isSet(object.artifactDigest) ? {\n\t\t\t\t$case: \"artifactDigest\",\n\t\t\t\tartifactDigest: sigstore_common_1.HashOutput.fromJSON(object.artifactDigest)\n\t\t\t} : void 0 };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.data?.$case === \"artifactUri\") obj.artifactUri = message.data.artifactUri;\n\t\t\telse if (message.data?.$case === \"artifact\") obj.artifact = base64FromBytes(message.data.artifact);\n\t\t\telse if (message.data?.$case === \"artifactDigest\") obj.artifactDigest = sigstore_common_1.HashOutput.toJSON(message.data.artifactDigest);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Input = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tartifactTrustRoot: isSet(object.artifactTrustRoot) ? sigstore_trustroot_1.TrustedRoot.fromJSON(object.artifactTrustRoot) : void 0,\n\t\t\t\tartifactVerificationOptions: isSet(object.artifactVerificationOptions) ? exports.ArtifactVerificationOptions.fromJSON(object.artifactVerificationOptions) : void 0,\n\t\t\t\tbundle: isSet(object.bundle) ? sigstore_bundle_1.Bundle.fromJSON(object.bundle) : void 0,\n\t\t\t\tartifact: isSet(object.artifact) ? exports.Artifact.fromJSON(object.artifact) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.artifactTrustRoot !== void 0) obj.artifactTrustRoot = sigstore_trustroot_1.TrustedRoot.toJSON(message.artifactTrustRoot);\n\t\t\tif (message.artifactVerificationOptions !== void 0) obj.artifactVerificationOptions = exports.ArtifactVerificationOptions.toJSON(message.artifactVerificationOptions);\n\t\t\tif (message.bundle !== void 0) obj.bundle = sigstore_bundle_1.Bundle.toJSON(message.bundle);\n\t\t\tif (message.artifact !== void 0) obj.artifact = exports.Artifact.toJSON(message.artifact);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction bytesFromBase64(b64) {\n\t\treturn Uint8Array.from(globalThis.Buffer.from(b64, \"base64\"));\n\t}\n\tfunction base64FromBytes(arr) {\n\t\treturn globalThis.Buffer.from(arr).toString(\"base64\");\n\t}\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/index.js\nvar require_dist$3 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\tvar desc = Object.getOwnPropertyDescriptor(m, k);\n\t\tif (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {\n\t\t\tenumerable: true,\n\t\t\tget: function() {\n\t\t\t\treturn m[k];\n\t\t\t}\n\t\t};\n\t\tObject.defineProperty(o, k2, desc);\n\t}) : (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\to[k2] = m[k];\n\t}));\n\tvar __exportStar = exports && exports.__exportStar || function(m, exports$2) {\n\t\tfor (var p in m) if (p !== \"default\" && !Object.prototype.hasOwnProperty.call(exports$2, p)) __createBinding(exports$2, m, p);\n\t};\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\t__exportStar(require_envelope(), exports);\n\t__exportStar(require_sigstore_bundle(), exports);\n\t__exportStar(require_sigstore_common(), exports);\n\t__exportStar(require_sigstore_rekor(), exports);\n\t__exportStar(require_sigstore_trustroot(), exports);\n\t__exportStar(require_sigstore_verification(), exports);\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+bundle@5.0.0/node_modules/@sigstore/bundle/dist/bundle.js\nvar require_bundle$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = void 0;\n\texports.isBundleWithCertificateChain = isBundleWithCertificateChain;\n\texports.isBundleWithPublicKey = isBundleWithPublicKey;\n\texports.isBundleWithMessageSignature = isBundleWithMessageSignature;\n\texports.isBundleWithDsseEnvelope = isBundleWithDsseEnvelope;\n\texports.BUNDLE_V01_MEDIA_TYPE = \"application/vnd.dev.sigstore.bundle+json;version=0.1\";\n\texports.BUNDLE_V02_MEDIA_TYPE = \"application/vnd.dev.sigstore.bundle+json;version=0.2\";\n\texports.BUNDLE_V03_LEGACY_MEDIA_TYPE = \"application/vnd.dev.sigstore.bundle+json;version=0.3\";\n\texports.BUNDLE_V03_MEDIA_TYPE = \"application/vnd.dev.sigstore.bundle.v0.3+json\";\n\tfunction isBundleWithCertificateChain(b) {\n\t\treturn b.verificationMaterial.content.$case === \"x509CertificateChain\";\n\t}\n\tfunction isBundleWithPublicKey(b) {\n\t\treturn b.verificationMaterial.content.$case === \"publicKey\";\n\t}\n\tfunction isBundleWithMessageSignature(b) {\n\t\treturn b.content.$case === \"messageSignature\";\n\t}\n\tfunction isBundleWithDsseEnvelope(b) {\n\t\treturn b.content.$case === \"dsseEnvelope\";\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+bundle@5.0.0/node_modules/@sigstore/bundle/dist/build.js\nvar require_build = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.toMessageSignatureBundle = toMessageSignatureBundle;\n\texports.toDSSEBundle = toDSSEBundle;\n\tconst protobuf_specs_1 = require_dist$3();\n\tconst bundle_1 = require_bundle$1();\n\tfunction toMessageSignatureBundle(options) {\n\t\treturn {\n\t\t\tmediaType: options.certificateChain ? bundle_1.BUNDLE_V02_MEDIA_TYPE : bundle_1.BUNDLE_V03_MEDIA_TYPE,\n\t\t\tcontent: {\n\t\t\t\t$case: \"messageSignature\",\n\t\t\t\tmessageSignature: {\n\t\t\t\t\tmessageDigest: {\n\t\t\t\t\t\talgorithm: protobuf_specs_1.HashAlgorithm.SHA2_256,\n\t\t\t\t\t\tdigest: options.digest\n\t\t\t\t\t},\n\t\t\t\t\tsignature: options.signature\n\t\t\t\t}\n\t\t\t},\n\t\t\tverificationMaterial: toVerificationMaterial(options)\n\t\t};\n\t}\n\tfunction toDSSEBundle(options) {\n\t\treturn {\n\t\t\tmediaType: options.certificateChain ? bundle_1.BUNDLE_V02_MEDIA_TYPE : bundle_1.BUNDLE_V03_MEDIA_TYPE,\n\t\t\tcontent: {\n\t\t\t\t$case: \"dsseEnvelope\",\n\t\t\t\tdsseEnvelope: toEnvelope(options)\n\t\t\t},\n\t\t\tverificationMaterial: toVerificationMaterial(options)\n\t\t};\n\t}\n\tfunction toEnvelope(options) {\n\t\treturn {\n\t\t\tpayloadType: options.artifactType,\n\t\t\tpayload: options.artifact,\n\t\t\tsignatures: [toSignature(options)]\n\t\t};\n\t}\n\tfunction toSignature(options) {\n\t\treturn {\n\t\t\tkeyid: options.keyHint || \"\",\n\t\t\tsig: options.signature\n\t\t};\n\t}\n\tfunction toVerificationMaterial(options) {\n\t\treturn {\n\t\t\tcontent: toKeyContent(options),\n\t\t\ttlogEntries: [],\n\t\t\ttimestampVerificationData: { rfc3161Timestamps: [] }\n\t\t};\n\t}\n\tfunction toKeyContent(options) {\n\t\tif (options.certificate) if (options.certificateChain) return {\n\t\t\t$case: \"x509CertificateChain\",\n\t\t\tx509CertificateChain: { certificates: [{ rawBytes: options.certificate }] }\n\t\t};\n\t\telse return {\n\t\t\t$case: \"certificate\",\n\t\t\tcertificate: { rawBytes: options.certificate }\n\t\t};\n\t\telse return {\n\t\t\t$case: \"publicKey\",\n\t\t\tpublicKey: { hint: options.keyHint || \"\" }\n\t\t};\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+bundle@5.0.0/node_modules/@sigstore/bundle/dist/error.js\nvar require_error$3 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.ValidationError = void 0;\n\tvar ValidationError = class extends Error {\n\t\tfields;\n\t\tconstructor(message, fields) {\n\t\t\tsuper(message);\n\t\t\tthis.fields = fields;\n\t\t}\n\t};\n\texports.ValidationError = ValidationError;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+bundle@5.0.0/node_modules/@sigstore/bundle/dist/validate.js\nvar require_validate = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.assertBundle = assertBundle;\n\texports.assertBundleV01 = assertBundleV01;\n\texports.isBundleV01 = isBundleV01;\n\texports.assertBundleV02 = assertBundleV02;\n\texports.assertBundleLatest = assertBundleLatest;\n\tconst error_1 = require_error$3();\n\tfunction assertBundle(b) {\n\t\tconst invalidValues = validateBundleBase(b);\n\t\tif (invalidValues.length > 0) throw new error_1.ValidationError(\"invalid bundle\", invalidValues);\n\t}\n\tfunction assertBundleV01(b) {\n\t\tconst invalidValues = [];\n\t\tinvalidValues.push(...validateBundleBase(b));\n\t\tinvalidValues.push(...validateInclusionPromise(b));\n\t\tif (invalidValues.length > 0) throw new error_1.ValidationError(\"invalid v0.1 bundle\", invalidValues);\n\t}\n\tfunction isBundleV01(b) {\n\t\ttry {\n\t\t\tassertBundleV01(b);\n\t\t\treturn true;\n\t\t} catch (e) {\n\t\t\treturn false;\n\t\t}\n\t}\n\tfunction assertBundleV02(b) {\n\t\tconst invalidValues = [];\n\t\tinvalidValues.push(...validateBundleBase(b));\n\t\tinvalidValues.push(...validateInclusionProof(b));\n\t\tif (invalidValues.length > 0) throw new error_1.ValidationError(\"invalid v0.2 bundle\", invalidValues);\n\t}\n\tfunction assertBundleLatest(b) {\n\t\tconst invalidValues = [];\n\t\tinvalidValues.push(...validateBundleBase(b));\n\t\tinvalidValues.push(...validateInclusionProof(b));\n\t\tinvalidValues.push(...validateNoCertificateChain(b));\n\t\tif (invalidValues.length > 0) throw new error_1.ValidationError(\"invalid bundle\", invalidValues);\n\t}\n\tfunction validateBundleBase(b) {\n\t\tconst invalidValues = [];\n\t\tif (b.mediaType === void 0 || !b.mediaType.match(/^application\\/vnd\\.dev\\.sigstore\\.bundle\\+json;version=\\d\\.\\d/) && !b.mediaType.match(/^application\\/vnd\\.dev\\.sigstore\\.bundle\\.v\\d\\.\\d\\+json/)) invalidValues.push(\"mediaType\");\n\t\tif (b.content === void 0) invalidValues.push(\"content\");\n\t\telse switch (b.content.$case) {\n\t\t\tcase \"messageSignature\":\n\t\t\t\tif (b.content.messageSignature.messageDigest === void 0) invalidValues.push(\"content.messageSignature.messageDigest\");\n\t\t\t\telse if (b.content.messageSignature.messageDigest.digest.length === 0) invalidValues.push(\"content.messageSignature.messageDigest.digest\");\n\t\t\t\tif (b.content.messageSignature.signature.length === 0) invalidValues.push(\"content.messageSignature.signature\");\n\t\t\t\tbreak;\n\t\t\tcase \"dsseEnvelope\":\n\t\t\t\tif (b.content.dsseEnvelope.payload.length === 0) invalidValues.push(\"content.dsseEnvelope.payload\");\n\t\t\t\tif (b.content.dsseEnvelope.signatures.length !== 1) invalidValues.push(\"content.dsseEnvelope.signatures\");\n\t\t\t\telse if (b.content.dsseEnvelope.signatures[0].sig.length === 0) invalidValues.push(\"content.dsseEnvelope.signatures[0].sig\");\n\t\t\t\tbreak;\n\t\t}\n\t\tif (b.verificationMaterial === void 0) invalidValues.push(\"verificationMaterial\");\n\t\telse {\n\t\t\tif (b.verificationMaterial.content === void 0) invalidValues.push(\"verificationMaterial.content\");\n\t\t\telse switch (b.verificationMaterial.content.$case) {\n\t\t\t\tcase \"x509CertificateChain\":\n\t\t\t\t\tif (b.verificationMaterial.content.x509CertificateChain.certificates.length === 0) invalidValues.push(\"verificationMaterial.content.x509CertificateChain.certificates\");\n\t\t\t\t\tb.verificationMaterial.content.x509CertificateChain.certificates.forEach((cert, i) => {\n\t\t\t\t\t\tif (cert.rawBytes.length === 0) invalidValues.push(`verificationMaterial.content.x509CertificateChain.certificates[${i}].rawBytes`);\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"certificate\":\n\t\t\t\t\tif (b.verificationMaterial.content.certificate.rawBytes.length === 0) invalidValues.push(\"verificationMaterial.content.certificate.rawBytes\");\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (b.verificationMaterial.tlogEntries === void 0) invalidValues.push(\"verificationMaterial.tlogEntries\");\n\t\t\telse if (b.verificationMaterial.tlogEntries.length > 0) b.verificationMaterial.tlogEntries.forEach((entry, i) => {\n\t\t\t\tif (entry.logId === void 0) invalidValues.push(`verificationMaterial.tlogEntries[${i}].logId`);\n\t\t\t\tif (entry.kindVersion === void 0) invalidValues.push(`verificationMaterial.tlogEntries[${i}].kindVersion`);\n\t\t\t});\n\t\t}\n\t\treturn invalidValues;\n\t}\n\tfunction validateInclusionPromise(b) {\n\t\tconst invalidValues = [];\n\t\tif (b.verificationMaterial && b.verificationMaterial.tlogEntries?.length > 0) b.verificationMaterial.tlogEntries.forEach((entry, i) => {\n\t\t\tif (entry.inclusionPromise === void 0) invalidValues.push(`verificationMaterial.tlogEntries[${i}].inclusionPromise`);\n\t\t});\n\t\treturn invalidValues;\n\t}\n\tfunction validateInclusionProof(b) {\n\t\tconst invalidValues = [];\n\t\tif (b.verificationMaterial && b.verificationMaterial.tlogEntries?.length > 0) b.verificationMaterial.tlogEntries.forEach((entry, i) => {\n\t\t\tif (entry.inclusionProof === void 0) invalidValues.push(`verificationMaterial.tlogEntries[${i}].inclusionProof`);\n\t\t\telse if (entry.inclusionProof.checkpoint === void 0) invalidValues.push(`verificationMaterial.tlogEntries[${i}].inclusionProof.checkpoint`);\n\t\t});\n\t\treturn invalidValues;\n\t}\n\tfunction validateNoCertificateChain(b) {\n\t\tconst invalidValues = [];\n\t\t/* istanbul ignore next */\n\t\tif (b.verificationMaterial?.content?.$case === \"x509CertificateChain\") invalidValues.push(\"verificationMaterial.content.$case\");\n\t\treturn invalidValues;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+bundle@5.0.0/node_modules/@sigstore/bundle/dist/serialized.js\nvar require_serialized = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.envelopeToJSON = exports.envelopeFromJSON = exports.bundleToJSON = exports.bundleFromJSON = void 0;\n\tconst protobuf_specs_1 = require_dist$3();\n\tconst bundle_1 = require_bundle$1();\n\tconst validate_1 = require_validate();\n\tconst bundleFromJSON = (obj) => {\n\t\tconst bundle = protobuf_specs_1.Bundle.fromJSON(obj);\n\t\tswitch (bundle.mediaType) {\n\t\t\tcase bundle_1.BUNDLE_V01_MEDIA_TYPE:\n\t\t\t\t(0, validate_1.assertBundleV01)(bundle);\n\t\t\t\tbreak;\n\t\t\tcase bundle_1.BUNDLE_V02_MEDIA_TYPE:\n\t\t\t\t(0, validate_1.assertBundleV02)(bundle);\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\t(0, validate_1.assertBundleLatest)(bundle);\n\t\t\t\tbreak;\n\t\t}\n\t\treturn bundle;\n\t};\n\texports.bundleFromJSON = bundleFromJSON;\n\tconst bundleToJSON = (bundle) => {\n\t\treturn protobuf_specs_1.Bundle.toJSON(bundle);\n\t};\n\texports.bundleToJSON = bundleToJSON;\n\tconst envelopeFromJSON = (obj) => {\n\t\treturn protobuf_specs_1.Envelope.fromJSON(obj);\n\t};\n\texports.envelopeFromJSON = envelopeFromJSON;\n\tconst envelopeToJSON = (envelope) => {\n\t\treturn protobuf_specs_1.Envelope.toJSON(envelope);\n\t};\n\texports.envelopeToJSON = envelopeToJSON;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+bundle@5.0.0/node_modules/@sigstore/bundle/dist/index.js\nvar require_dist$2 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.isBundleV01 = exports.assertBundleV02 = exports.assertBundleV01 = exports.assertBundleLatest = exports.assertBundle = exports.envelopeToJSON = exports.envelopeFromJSON = exports.bundleToJSON = exports.bundleFromJSON = exports.ValidationError = exports.isBundleWithPublicKey = exports.isBundleWithMessageSignature = exports.isBundleWithDsseEnvelope = exports.isBundleWithCertificateChain = exports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = exports.toMessageSignatureBundle = exports.toDSSEBundle = void 0;\n\tvar build_1 = require_build();\n\tObject.defineProperty(exports, \"toDSSEBundle\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn build_1.toDSSEBundle;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"toMessageSignatureBundle\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn build_1.toMessageSignatureBundle;\n\t\t}\n\t});\n\tvar bundle_1 = require_bundle$1();\n\tObject.defineProperty(exports, \"BUNDLE_V01_MEDIA_TYPE\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.BUNDLE_V01_MEDIA_TYPE;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"BUNDLE_V02_MEDIA_TYPE\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.BUNDLE_V02_MEDIA_TYPE;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"BUNDLE_V03_LEGACY_MEDIA_TYPE\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.BUNDLE_V03_LEGACY_MEDIA_TYPE;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"BUNDLE_V03_MEDIA_TYPE\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.BUNDLE_V03_MEDIA_TYPE;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"isBundleWithCertificateChain\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.isBundleWithCertificateChain;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"isBundleWithDsseEnvelope\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.isBundleWithDsseEnvelope;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"isBundleWithMessageSignature\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.isBundleWithMessageSignature;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"isBundleWithPublicKey\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.isBundleWithPublicKey;\n\t\t}\n\t});\n\tvar error_1 = require_error$3();\n\tObject.defineProperty(exports, \"ValidationError\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn error_1.ValidationError;\n\t\t}\n\t});\n\tvar serialized_1 = require_serialized();\n\tObject.defineProperty(exports, \"bundleFromJSON\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn serialized_1.bundleFromJSON;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"bundleToJSON\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn serialized_1.bundleToJSON;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"envelopeFromJSON\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn serialized_1.envelopeFromJSON;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"envelopeToJSON\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn serialized_1.envelopeToJSON;\n\t\t}\n\t});\n\tvar validate_1 = require_validate();\n\tObject.defineProperty(exports, \"assertBundle\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn validate_1.assertBundle;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"assertBundleLatest\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn validate_1.assertBundleLatest;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"assertBundleV01\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn validate_1.assertBundleV01;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"assertBundleV02\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn validate_1.assertBundleV02;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"isBundleV01\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn validate_1.isBundleV01;\n\t\t}\n\t});\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/stream.js\nvar require_stream = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.ByteStream = void 0;\n\tvar StreamError = class extends Error {};\n\tvar ByteStream = class ByteStream {\n\t\tstatic BLOCK_SIZE = 1024;\n\t\tbuf;\n\t\tview;\n\t\tstart = 0;\n\t\tconstructor(buffer) {\n\t\t\tif (buffer) {\n\t\t\t\tthis.buf = buffer;\n\t\t\t\tthis.view = Buffer.from(buffer);\n\t\t\t} else {\n\t\t\t\tthis.buf = Buffer.alloc(0);\n\t\t\t\tthis.view = Buffer.from(this.buf);\n\t\t\t}\n\t\t}\n\t\tget buffer() {\n\t\t\treturn this.view.subarray(0, this.start);\n\t\t}\n\t\tget length() {\n\t\t\treturn this.view.byteLength;\n\t\t}\n\t\tget position() {\n\t\t\treturn this.start;\n\t\t}\n\t\tseek(position) {\n\t\t\tthis.start = position;\n\t\t}\n\t\tslice(start, len) {\n\t\t\tconst end = start + len;\n\t\t\tif (end > this.length) throw new StreamError(\"request past end of buffer\");\n\t\t\treturn this.view.subarray(start, end);\n\t\t}\n\t\tappendChar(char) {\n\t\t\tthis.ensureCapacity(1);\n\t\t\tthis.view[this.start] = char;\n\t\t\tthis.start += 1;\n\t\t}\n\t\tappendUint16(num) {\n\t\t\tthis.ensureCapacity(2);\n\t\t\tconst value = new Uint16Array([num]);\n\t\t\tconst view = new Uint8Array(value.buffer);\n\t\t\tthis.view[this.start] = view[1];\n\t\t\tthis.view[this.start + 1] = view[0];\n\t\t\tthis.start += 2;\n\t\t}\n\t\tappendUint24(num) {\n\t\t\tthis.ensureCapacity(3);\n\t\t\tconst value = new Uint32Array([num]);\n\t\t\tconst view = new Uint8Array(value.buffer);\n\t\t\tthis.view[this.start] = view[2];\n\t\t\tthis.view[this.start + 1] = view[1];\n\t\t\tthis.view[this.start + 2] = view[0];\n\t\t\tthis.start += 3;\n\t\t}\n\t\tappendView(view) {\n\t\t\tthis.ensureCapacity(view.length);\n\t\t\tthis.view.set(view, this.start);\n\t\t\tthis.start += view.length;\n\t\t}\n\t\tgetBlock(size) {\n\t\t\tif (size <= 0) return Buffer.alloc(0);\n\t\t\tif (this.start + size > this.view.length) throw new Error(\"request past end of buffer\");\n\t\t\tconst result = this.view.subarray(this.start, this.start + size);\n\t\t\tthis.start += size;\n\t\t\treturn result;\n\t\t}\n\t\tgetUint8() {\n\t\t\treturn this.getBlock(1)[0];\n\t\t}\n\t\tgetUint16() {\n\t\t\tconst block = this.getBlock(2);\n\t\t\treturn block[0] << 8 | block[1];\n\t\t}\n\t\tensureCapacity(size) {\n\t\t\tif (this.start + size > this.view.byteLength) {\n\t\t\t\tconst blockSize = ByteStream.BLOCK_SIZE + (size > ByteStream.BLOCK_SIZE ? size : 0);\n\t\t\t\tthis.realloc(this.view.byteLength + blockSize);\n\t\t\t}\n\t\t}\n\t\trealloc(size) {\n\t\t\tconst newArray = Buffer.alloc(size);\n\t\t\tconst newView = Buffer.from(newArray);\n\t\t\tnewView.set(this.view);\n\t\t\tthis.buf = newArray;\n\t\t\tthis.view = newView;\n\t\t}\n\t};\n\texports.ByteStream = ByteStream;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/asn1/error.js\nvar require_error$2 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.ASN1TypeError = exports.ASN1ParseError = void 0;\n\tvar ASN1ParseError = class extends Error {};\n\texports.ASN1ParseError = ASN1ParseError;\n\tvar ASN1TypeError = class extends Error {};\n\texports.ASN1TypeError = ASN1TypeError;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/asn1/length.js\nvar require_length = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.decodeLength = decodeLength;\n\texports.encodeLength = encodeLength;\n\tconst error_1 = require_error$2();\n\tfunction decodeLength(stream) {\n\t\tconst buf = stream.getUint8();\n\t\tif ((buf & 128) === 0) return buf;\n\t\tconst byteCount = buf & 127;\n\t\tif (byteCount > 6) throw new error_1.ASN1ParseError(\"length exceeds 6 byte limit\");\n\t\tlet len = 0;\n\t\tfor (let i = 0; i < byteCount; i++) {\n\t\t\tconst byte = stream.getUint8();\n\t\t\tif (i === 0 && byte === 0) throw new error_1.ASN1ParseError(\"non-minimal length encoding\");\n\t\t\tlen = len * 256 + byte;\n\t\t}\n\t\tif (len === 0) throw new error_1.ASN1ParseError(\"indefinite length encoding not supported\");\n\t\tif (len < 128) throw new error_1.ASN1ParseError(\"non-minimal length encoding\");\n\t\treturn len;\n\t}\n\tfunction encodeLength(len) {\n\t\tif (len < 128) return Buffer.from([len]);\n\t\tlet val = BigInt(len);\n\t\tconst bytes = [];\n\t\twhile (val > 0n) {\n\t\t\tbytes.unshift(Number(val & 255n));\n\t\t\tval = val >> 8n;\n\t\t}\n\t\treturn Buffer.from([128 | bytes.length, ...bytes]);\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/asn1/parse.js\nvar require_parse = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.parseInteger = parseInteger;\n\texports.parseStringASCII = parseStringASCII;\n\texports.parseTime = parseTime;\n\texports.parseOID = parseOID;\n\texports.parseBoolean = parseBoolean;\n\texports.parseBitString = parseBitString;\n\tconst error_1 = require_error$2();\n\tconst RE_TIME_SHORT_YEAR = /^(\\d{2})(\\d{2})(\\d{2})(\\d{2})(\\d{2})(\\d{2})(\\.\\d{3})?Z$/;\n\tconst RE_TIME_LONG_YEAR = /^(\\d{4})(\\d{2})(\\d{2})(\\d{2})(\\d{2})(\\d{2})(\\.\\d{3})?Z$/;\n\tfunction parseInteger(buf) {\n\t\tlet pos = 0;\n\t\tconst end = buf.length;\n\t\tlet val = buf[pos];\n\t\tconst neg = val > 127;\n\t\tconst pad = neg ? 255 : 0;\n\t\twhile (val == pad && ++pos < end) val = buf[pos];\n\t\tif (end - pos === 0) return BigInt(neg ? -1 : 0);\n\t\tval = neg ? val - 256 : val;\n\t\tlet n = BigInt(val);\n\t\tfor (let i = pos + 1; i < end; ++i) n = n * BigInt(256) + BigInt(buf[i]);\n\t\treturn n;\n\t}\n\tfunction parseStringASCII(buf) {\n\t\treturn buf.toString(\"ascii\");\n\t}\n\tfunction parseTime(buf, shortYear) {\n\t\tconst timeStr = parseStringASCII(buf);\n\t\tconst m = shortYear ? RE_TIME_SHORT_YEAR.exec(timeStr) : RE_TIME_LONG_YEAR.exec(timeStr);\n\t\tif (!m) throw new Error(\"invalid time\");\n\t\tif (shortYear) {\n\t\t\tlet year = Number(m[1]);\n\t\t\tyear += year >= 50 ? 1900 : 2e3;\n\t\t\tm[1] = year.toString();\n\t\t}\n\t\treturn /* @__PURE__ */ new Date(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z`);\n\t}\n\tfunction parseOID(buf) {\n\t\tlet pos = 0;\n\t\tconst end = buf.length;\n\t\tlet n = buf[pos++];\n\t\tlet oid = `${Math.floor(n / 40)}.${n % 40}`;\n\t\tlet val = 0n;\n\t\tfor (; pos < end; ++pos) {\n\t\t\tn = buf[pos];\n\t\t\tval = (val << 7n) + BigInt(n & 127);\n\t\t\tif ((n & 128) === 0) {\n\t\t\t\toid += `.${val}`;\n\t\t\t\tval = 0n;\n\t\t\t}\n\t\t}\n\t\treturn oid;\n\t}\n\tfunction parseBoolean(buf) {\n\t\tif (buf.length !== 1) throw new error_1.ASN1ParseError(\"invalid boolean\");\n\t\tswitch (buf[0]) {\n\t\t\tcase 0: return false;\n\t\t\tcase 255: return true;\n\t\t\tdefault: throw new error_1.ASN1ParseError(\"invalid boolean\");\n\t\t}\n\t}\n\tfunction parseBitString(buf) {\n\t\tconst unused = buf[0];\n\t\tif (unused > 7) throw new error_1.ASN1ParseError(\"invalid bit string\");\n\t\tconst start = 1;\n\t\tconst end = buf.length;\n\t\tconst bits = [];\n\t\tfor (let i = start; i < end; ++i) {\n\t\t\tconst byte = buf[i];\n\t\t\tconst skip = i === end - 1 ? unused : 0;\n\t\t\tfor (let j = 7; j >= skip; --j) bits.push(byte >> j & 1);\n\t\t}\n\t\treturn bits;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/asn1/tag.js\nvar require_tag = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.ASN1Tag = void 0;\n\tconst error_1 = require_error$2();\n\tconst UNIVERSAL_TAG = {\n\t\tBOOLEAN: 1,\n\t\tINTEGER: 2,\n\t\tBIT_STRING: 3,\n\t\tOCTET_STRING: 4,\n\t\tOBJECT_IDENTIFIER: 6,\n\t\tSEQUENCE: 16,\n\t\tSET: 17,\n\t\tPRINTABLE_STRING: 19,\n\t\tUTC_TIME: 23,\n\t\tGENERALIZED_TIME: 24\n\t};\n\tconst TAG_CLASS = {\n\t\tUNIVERSAL: 0,\n\t\tAPPLICATION: 1,\n\t\tCONTEXT_SPECIFIC: 2,\n\t\tPRIVATE: 3\n\t};\n\tvar ASN1Tag = class {\n\t\tnumber;\n\t\tconstructed;\n\t\tclass;\n\t\tconstructor(enc) {\n\t\t\tthis.number = enc & 31;\n\t\t\tthis.constructed = (enc & 32) === 32;\n\t\t\tthis.class = enc >> 6;\n\t\t\tif (this.number === 31) throw new error_1.ASN1ParseError(\"long form tags not supported\");\n\t\t\tif (this.class === TAG_CLASS.UNIVERSAL && this.number === 0) throw new error_1.ASN1ParseError(\"unsupported tag 0x00\");\n\t\t}\n\t\tisUniversal() {\n\t\t\treturn this.class === TAG_CLASS.UNIVERSAL;\n\t\t}\n\t\tisContextSpecific(num) {\n\t\t\tconst res = this.class === TAG_CLASS.CONTEXT_SPECIFIC;\n\t\t\treturn num !== void 0 ? res && this.number === num : res;\n\t\t}\n\t\tisBoolean() {\n\t\t\treturn this.isUniversal() && this.number === UNIVERSAL_TAG.BOOLEAN;\n\t\t}\n\t\tisInteger() {\n\t\t\treturn this.isUniversal() && this.number === UNIVERSAL_TAG.INTEGER;\n\t\t}\n\t\tisBitString() {\n\t\t\treturn this.isUniversal() && this.number === UNIVERSAL_TAG.BIT_STRING;\n\t\t}\n\t\tisOctetString() {\n\t\t\treturn this.isUniversal() && this.number === UNIVERSAL_TAG.OCTET_STRING;\n\t\t}\n\t\tisOID() {\n\t\t\treturn this.isUniversal() && this.number === UNIVERSAL_TAG.OBJECT_IDENTIFIER;\n\t\t}\n\t\tisUTCTime() {\n\t\t\treturn this.isUniversal() && this.number === UNIVERSAL_TAG.UTC_TIME;\n\t\t}\n\t\tisGeneralizedTime() {\n\t\t\treturn this.isUniversal() && this.number === UNIVERSAL_TAG.GENERALIZED_TIME;\n\t\t}\n\t\ttoDER() {\n\t\t\treturn this.number | (this.constructed ? 32 : 0) | this.class << 6;\n\t\t}\n\t};\n\texports.ASN1Tag = ASN1Tag;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/asn1/obj.js\nvar require_obj = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.ASN1Obj = void 0;\n\tconst stream_1 = require_stream();\n\tconst error_1 = require_error$2();\n\tconst length_1 = require_length();\n\tconst parse_1 = require_parse();\n\tconst tag_1 = require_tag();\n\tvar ASN1Obj = class {\n\t\ttag;\n\t\tsubs;\n\t\tvalue;\n\t\tconstructor(tag, value, subs) {\n\t\t\tthis.tag = tag;\n\t\t\tthis.value = value;\n\t\t\tthis.subs = subs;\n\t\t}\n\t\tstatic parseBuffer(buf) {\n\t\t\tconst stream = new stream_1.ByteStream(buf);\n\t\t\tconst obj = parseStream(stream);\n\t\t\tif (stream.position !== stream.length) throw new error_1.ASN1ParseError(\"invalid trailing data\");\n\t\t\treturn obj;\n\t\t}\n\t\ttoDER() {\n\t\t\tconst valueStream = new stream_1.ByteStream();\n\t\t\tif (this.subs.length > 0) for (const sub of this.subs) valueStream.appendView(sub.toDER());\n\t\t\telse valueStream.appendView(this.value);\n\t\t\tconst value = valueStream.buffer;\n\t\t\tconst obj = new stream_1.ByteStream();\n\t\t\tobj.appendChar(this.tag.toDER());\n\t\t\tobj.appendView((0, length_1.encodeLength)(value.length));\n\t\t\tobj.appendView(value);\n\t\t\treturn obj.buffer;\n\t\t}\n\t\ttoBoolean() {\n\t\t\tif (!this.tag.isBoolean()) throw new error_1.ASN1TypeError(\"not a boolean\");\n\t\t\treturn (0, parse_1.parseBoolean)(this.value);\n\t\t}\n\t\ttoInteger() {\n\t\t\tif (!this.tag.isInteger()) throw new error_1.ASN1TypeError(\"not an integer\");\n\t\t\treturn (0, parse_1.parseInteger)(this.value);\n\t\t}\n\t\ttoOID() {\n\t\t\tif (!this.tag.isOID()) throw new error_1.ASN1TypeError(\"not an OID\");\n\t\t\treturn (0, parse_1.parseOID)(this.value);\n\t\t}\n\t\ttoDate() {\n\t\t\tswitch (true) {\n\t\t\t\tcase this.tag.isUTCTime(): return (0, parse_1.parseTime)(this.value, true);\n\t\t\t\tcase this.tag.isGeneralizedTime(): return (0, parse_1.parseTime)(this.value, false);\n\t\t\t\tdefault: throw new error_1.ASN1TypeError(\"not a date\");\n\t\t\t}\n\t\t}\n\t\ttoBitString() {\n\t\t\tif (!this.tag.isBitString()) throw new error_1.ASN1TypeError(\"not a bit string\");\n\t\t\treturn (0, parse_1.parseBitString)(this.value);\n\t\t}\n\t};\n\texports.ASN1Obj = ASN1Obj;\n\tconst MAX_DEPTH = 100;\n\tfunction parseStream(stream, depth = 0) {\n\t\tif (depth > MAX_DEPTH) throw new error_1.ASN1ParseError(\"maximum nesting depth exceeded\");\n\t\tconst tag = new tag_1.ASN1Tag(stream.getUint8());\n\t\tconst len = (0, length_1.decodeLength)(stream);\n\t\tconst value = stream.slice(stream.position, len);\n\t\tconst start = stream.position;\n\t\tlet subs = [];\n\t\tif (tag.constructed) subs = collectSubs(stream, len, depth);\n\t\telse if (tag.isOctetString()) try {\n\t\t\tsubs = collectSubs(stream, len, depth);\n\t\t} catch (e) {}\n\t\tif (subs.length === 0) stream.seek(start + len);\n\t\treturn new ASN1Obj(tag, value, subs);\n\t}\n\tfunction collectSubs(stream, len, depth) {\n\t\tconst end = stream.position + len;\n\t\t/* istanbul ignore if */\n\t\tif (end > stream.length) throw new error_1.ASN1ParseError(\"invalid length\");\n\t\tconst subs = [];\n\t\twhile (stream.position < end) subs.push(parseStream(stream, depth + 1));\n\t\tif (stream.position !== end) throw new error_1.ASN1ParseError(\"invalid length\");\n\t\treturn subs;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/asn1/index.js\nvar require_asn1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.ASN1Obj = void 0;\n\tvar obj_1 = require_obj();\n\tObject.defineProperty(exports, \"ASN1Obj\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn obj_1.ASN1Obj;\n\t\t}\n\t});\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/crypto.js\nvar require_crypto = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __importDefault = exports && exports.__importDefault || function(mod) {\n\t\treturn mod && mod.__esModule ? mod : { \"default\": mod };\n\t};\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.createPublicKey = createPublicKey;\n\texports.digest = digest;\n\texports.verify = verify;\n\texports.bufferEqual = bufferEqual;\n\tconst crypto_1 = __importDefault(__require(\"crypto\"));\n\tfunction createPublicKey(key, type = \"spki\") {\n\t\tif (typeof key === \"string\") if (key.startsWith(\"-----\")) return crypto_1.default.createPublicKey(key);\n\t\telse return crypto_1.default.createPublicKey({\n\t\t\tkey: Buffer.from(key, \"base64\"),\n\t\t\tformat: \"der\",\n\t\t\ttype\n\t\t});\n\t\telse return crypto_1.default.createPublicKey({\n\t\t\tkey,\n\t\t\tformat: \"der\",\n\t\t\ttype\n\t\t});\n\t}\n\tfunction digest(algorithm, ...data) {\n\t\tconst hash = crypto_1.default.createHash(algorithm);\n\t\tfor (const d of data) hash.update(d);\n\t\treturn hash.digest();\n\t}\n\tfunction algorithmForKey(key) {\n\t\tif (!(key instanceof crypto_1.default.KeyObject) || key.type !== \"public\") return false;\n\t\tswitch (key.asymmetricKeyType) {\n\t\t\tcase \"ec\": switch (key.asymmetricKeyDetails?.namedCurve) {\n\t\t\t\tcase \"prime256v1\": return \"sha256\";\n\t\t\t\tcase \"secp384r1\": return \"sha384\";\n\t\t\t\tcase \"secp521r1\": return \"sha512\";\n\t\t\t\tdefault: return false;\n\t\t\t}\n\t\t\tcase \"ed25519\": return;\n\t\t\tdefault: return false;\n\t\t}\n\t}\n\tfunction verify(data, key, signature, algorithm) {\n\t\ttry {\n\t\t\tif (algorithm === void 0) {\n\t\t\t\talgorithm = algorithmForKey(key);\n\t\t\t\tif (algorithm === false) return false;\n\t\t\t}\n\t\t\treturn crypto_1.default.verify(algorithm, data, key, signature);\n\t\t} catch (e) {\n\t\t\t/* istanbul ignore next */\n\t\t\treturn false;\n\t\t}\n\t}\n\tfunction bufferEqual(a, b) {\n\t\ttry {\n\t\t\treturn crypto_1.default.timingSafeEqual(a, b);\n\t\t} catch {\n\t\t\t/* istanbul ignore next */\n\t\t\treturn false;\n\t\t}\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/dsse.js\nvar require_dsse$3 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.preAuthEncoding = preAuthEncoding;\n\tconst PAE_PREFIX = \"DSSEv1\";\n\tfunction preAuthEncoding(payloadType, payload) {\n\t\tconst typeBytes = Buffer.from(payloadType, \"utf-8\");\n\t\treturn Buffer.concat([\n\t\t\tBuffer.from(`${PAE_PREFIX} ${typeBytes.length} `, \"ascii\"),\n\t\t\ttypeBytes,\n\t\t\tBuffer.from(` ${payload.length} `, \"ascii\"),\n\t\t\tpayload\n\t\t]);\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/encoding.js\nvar require_encoding = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.base64Encode = base64Encode;\n\texports.base64Decode = base64Decode;\n\tconst BASE64_ENCODING = \"base64\";\n\tconst UTF8_ENCODING = \"utf-8\";\n\tfunction base64Encode(str) {\n\t\treturn Buffer.from(str, UTF8_ENCODING).toString(BASE64_ENCODING);\n\t}\n\tfunction base64Decode(str) {\n\t\treturn Buffer.from(str, BASE64_ENCODING).toString(UTF8_ENCODING);\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/json.js\nvar require_json = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.canonicalize = canonicalize;\n\tfunction canonicalize(object) {\n\t\tlet buffer = \"\";\n\t\tif (object === null || typeof object !== \"object\" || object.toJSON != null) buffer += JSON.stringify(object);\n\t\telse if (Array.isArray(object)) {\n\t\t\tbuffer += \"[\";\n\t\t\tlet first = true;\n\t\t\tobject.forEach((element) => {\n\t\t\t\tif (!first) buffer += \",\";\n\t\t\t\tfirst = false;\n\t\t\t\tbuffer += canonicalize(element);\n\t\t\t});\n\t\t\tbuffer += \"]\";\n\t\t} else {\n\t\t\tbuffer += \"{\";\n\t\t\tlet first = true;\n\t\t\tObject.keys(object).sort().forEach((property) => {\n\t\t\t\tif (!first) buffer += \",\";\n\t\t\t\tfirst = false;\n\t\t\t\tbuffer += JSON.stringify(property);\n\t\t\t\tbuffer += \":\";\n\t\t\t\tbuffer += canonicalize(object[property]);\n\t\t\t});\n\t\t\tbuffer += \"}\";\n\t\t}\n\t\treturn buffer;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/pem.js\nvar require_pem = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.toDER = toDER;\n\texports.fromDER = fromDER;\n\tconst PEM_HEADER = /-----BEGIN (.*)-----/;\n\tconst PEM_FOOTER = /-----END (.*)-----/;\n\tfunction toDER(certificate) {\n\t\tlet der = \"\";\n\t\tcertificate.split(\"\\n\").forEach((line) => {\n\t\t\tif (line.match(PEM_HEADER) || line.match(PEM_FOOTER)) return;\n\t\t\tder += line;\n\t\t});\n\t\treturn Buffer.from(der, \"base64\");\n\t}\n\tfunction fromDER(certificate, type = \"CERTIFICATE\") {\n\t\tconst lines = certificate.toString(\"base64\").match(/.{1,64}/g) || \"\";\n\t\treturn [\n\t\t\t`-----BEGIN ${type}-----`,\n\t\t\t...lines,\n\t\t\t`-----END ${type}-----`\n\t\t].join(\"\\n\").concat(\"\\n\");\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/oid.js\nvar require_oid = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.SHA2_HASH_ALGOS = exports.RSA_SIGNATURE_ALGOS = exports.ECDSA_SIGNATURE_ALGOS = void 0;\n\texports.ECDSA_SIGNATURE_ALGOS = {\n\t\t\"1.2.840.10045.4.3.1\": \"sha224\",\n\t\t\"1.2.840.10045.4.3.2\": \"sha256\",\n\t\t\"1.2.840.10045.4.3.3\": \"sha384\",\n\t\t\"1.2.840.10045.4.3.4\": \"sha512\"\n\t};\n\texports.RSA_SIGNATURE_ALGOS = {\n\t\t\"1.2.840.113549.1.1.14\": \"sha224\",\n\t\t\"1.2.840.113549.1.1.11\": \"sha256\",\n\t\t\"1.2.840.113549.1.1.12\": \"sha384\",\n\t\t\"1.2.840.113549.1.1.13\": \"sha512\"\n\t};\n\texports.SHA2_HASH_ALGOS = {\n\t\t\"2.16.840.1.101.3.4.2.1\": \"sha256\",\n\t\t\"2.16.840.1.101.3.4.2.2\": \"sha384\",\n\t\t\"2.16.840.1.101.3.4.2.3\": \"sha512\"\n\t};\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/rfc3161/error.js\nvar require_error$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.RFC3161TimestampVerificationError = void 0;\n\tvar RFC3161TimestampVerificationError = class extends Error {};\n\texports.RFC3161TimestampVerificationError = RFC3161TimestampVerificationError;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/rfc3161/tstinfo.js\nvar require_tstinfo = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\tvar desc = Object.getOwnPropertyDescriptor(m, k);\n\t\tif (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {\n\t\t\tenumerable: true,\n\t\t\tget: function() {\n\t\t\t\treturn m[k];\n\t\t\t}\n\t\t};\n\t\tObject.defineProperty(o, k2, desc);\n\t}) : (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\to[k2] = m[k];\n\t}));\n\tvar __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {\n\t\tObject.defineProperty(o, \"default\", {\n\t\t\tenumerable: true,\n\t\t\tvalue: v\n\t\t});\n\t}) : function(o, v) {\n\t\to[\"default\"] = v;\n\t});\n\tvar __importStar = exports && exports.__importStar || (function() {\n\t\tvar ownKeys = function(o) {\n\t\t\townKeys = Object.getOwnPropertyNames || function(o) {\n\t\t\t\tvar ar = [];\n\t\t\t\tfor (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;\n\t\t\t\treturn ar;\n\t\t\t};\n\t\t\treturn ownKeys(o);\n\t\t};\n\t\treturn function(mod) {\n\t\t\tif (mod && mod.__esModule) return mod;\n\t\t\tvar result = {};\n\t\t\tif (mod != null) {\n\t\t\t\tfor (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== \"default\") __createBinding(result, mod, k[i]);\n\t\t\t}\n\t\t\t__setModuleDefault(result, mod);\n\t\t\treturn result;\n\t\t};\n\t})();\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.TSTInfo = void 0;\n\tconst crypto = __importStar(require_crypto());\n\tconst oid_1 = require_oid();\n\tconst error_1 = require_error$1();\n\tvar TSTInfo = class {\n\t\troot;\n\t\tconstructor(asn1) {\n\t\t\tthis.root = asn1;\n\t\t}\n\t\tget version() {\n\t\t\treturn this.root.subs[0].toInteger();\n\t\t}\n\t\tget genTime() {\n\t\t\treturn this.root.subs[4].toDate();\n\t\t}\n\t\tget messageImprintHashAlgorithm() {\n\t\t\tconst oid = this.messageImprintObj.subs[0].subs[0].toOID();\n\t\t\treturn oid_1.SHA2_HASH_ALGOS[oid];\n\t\t}\n\t\tget messageImprintHashedMessage() {\n\t\t\treturn this.messageImprintObj.subs[1].value;\n\t\t}\n\t\tget raw() {\n\t\t\treturn this.root.toDER();\n\t\t}\n\t\tverify(data) {\n\t\t\tconst digest = crypto.digest(this.messageImprintHashAlgorithm, data);\n\t\t\tif (!crypto.bufferEqual(digest, this.messageImprintHashedMessage)) throw new error_1.RFC3161TimestampVerificationError(\"message imprint does not match artifact\");\n\t\t}\n\t\tget messageImprintObj() {\n\t\t\treturn this.root.subs[2];\n\t\t}\n\t};\n\texports.TSTInfo = TSTInfo;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/rfc3161/timestamp.js\nvar require_timestamp$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\tvar desc = Object.getOwnPropertyDescriptor(m, k);\n\t\tif (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {\n\t\t\tenumerable: true,\n\t\t\tget: function() {\n\t\t\t\treturn m[k];\n\t\t\t}\n\t\t};\n\t\tObject.defineProperty(o, k2, desc);\n\t}) : (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\to[k2] = m[k];\n\t}));\n\tvar __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {\n\t\tObject.defineProperty(o, \"default\", {\n\t\t\tenumerable: true,\n\t\t\tvalue: v\n\t\t});\n\t}) : function(o, v) {\n\t\to[\"default\"] = v;\n\t});\n\tvar __importStar = exports && exports.__importStar || (function() {\n\t\tvar ownKeys = function(o) {\n\t\t\townKeys = Object.getOwnPropertyNames || function(o) {\n\t\t\t\tvar ar = [];\n\t\t\t\tfor (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;\n\t\t\t\treturn ar;\n\t\t\t};\n\t\t\treturn ownKeys(o);\n\t\t};\n\t\treturn function(mod) {\n\t\t\tif (mod && mod.__esModule) return mod;\n\t\t\tvar result = {};\n\t\t\tif (mod != null) {\n\t\t\t\tfor (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== \"default\") __createBinding(result, mod, k[i]);\n\t\t\t}\n\t\t\t__setModuleDefault(result, mod);\n\t\t\treturn result;\n\t\t};\n\t})();\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.RFC3161Timestamp = void 0;\n\tconst asn1_1 = require_asn1();\n\tconst crypto = __importStar(require_crypto());\n\tconst oid_1 = require_oid();\n\tconst error_1 = require_error$1();\n\tconst tstinfo_1 = require_tstinfo();\n\tconst OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = \"1.2.840.113549.1.7.2\";\n\tconst OID_PKCS9_CONTENT_TYPE_TSTINFO = \"1.2.840.113549.1.9.16.1.4\";\n\tconst OID_PKCS9_MESSAGE_DIGEST_KEY = \"1.2.840.113549.1.9.4\";\n\tvar RFC3161Timestamp = class RFC3161Timestamp {\n\t\troot;\n\t\tconstructor(asn1) {\n\t\t\tthis.root = asn1;\n\t\t}\n\t\tstatic parse(der) {\n\t\t\treturn new RFC3161Timestamp(asn1_1.ASN1Obj.parseBuffer(der));\n\t\t}\n\t\tget status() {\n\t\t\treturn this.pkiStatusInfoObj.subs[0].toInteger();\n\t\t}\n\t\tget contentType() {\n\t\t\treturn this.contentTypeObj.toOID();\n\t\t}\n\t\tget eContentType() {\n\t\t\treturn this.eContentTypeObj.toOID();\n\t\t}\n\t\tget signingTime() {\n\t\t\treturn this.tstInfo.genTime;\n\t\t}\n\t\tget signerIssuer() {\n\t\t\treturn this.signerSidObj.subs[0].value;\n\t\t}\n\t\tget signerSerialNumber() {\n\t\t\treturn this.signerSidObj.subs[1].value;\n\t\t}\n\t\tget signerDigestAlgorithm() {\n\t\t\tconst oid = this.signerDigestAlgorithmObj.subs[0].toOID();\n\t\t\treturn oid_1.SHA2_HASH_ALGOS[oid];\n\t\t}\n\t\tget signatureAlgorithm() {\n\t\t\tconst oid = this.signatureAlgorithmObj.subs[0].toOID();\n\t\t\treturn oid_1.ECDSA_SIGNATURE_ALGOS[oid];\n\t\t}\n\t\tget signatureValue() {\n\t\t\treturn this.signatureValueObj.value;\n\t\t}\n\t\tget tstInfo() {\n\t\t\treturn new tstinfo_1.TSTInfo(this.eContentObj.subs[0].subs[0]);\n\t\t}\n\t\tverify(data, publicKey) {\n\t\t\tif (!this.timeStampTokenObj) throw new error_1.RFC3161TimestampVerificationError(\"timeStampToken is missing\");\n\t\t\tif (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) throw new error_1.RFC3161TimestampVerificationError(`incorrect content type: ${this.contentType}`);\n\t\t\tif (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) throw new error_1.RFC3161TimestampVerificationError(`incorrect encapsulated content type: ${this.eContentType}`);\n\t\t\tthis.tstInfo.verify(data);\n\t\t\tthis.verifyMessageDigest();\n\t\t\tthis.verifySignature(publicKey);\n\t\t}\n\t\tverifyMessageDigest() {\n\t\t\tconst tstInfoDigest = crypto.digest(this.signerDigestAlgorithm, this.tstInfo.raw);\n\t\t\tconst expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;\n\t\t\tif (!crypto.bufferEqual(tstInfoDigest, expectedDigest)) throw new error_1.RFC3161TimestampVerificationError(\"signed data does not match tstInfo\");\n\t\t}\n\t\tverifySignature(key) {\n\t\t\tconst signedAttrs = this.signedAttrsObj.toDER();\n\t\t\tsignedAttrs[0] = 49;\n\t\t\tif (!crypto.verify(signedAttrs, key, this.signatureValue, this.signatureAlgorithm)) throw new error_1.RFC3161TimestampVerificationError(\"signature verification failed\");\n\t\t}\n\t\tget pkiStatusInfoObj() {\n\t\t\treturn this.root.subs[0];\n\t\t}\n\t\tget timeStampTokenObj() {\n\t\t\treturn this.root.subs[1];\n\t\t}\n\t\tget contentTypeObj() {\n\t\t\treturn this.timeStampTokenObj.subs[0];\n\t\t}\n\t\tget signedDataObj() {\n\t\t\treturn this.timeStampTokenObj.subs.find((sub) => sub.tag.isContextSpecific(0)).subs[0];\n\t\t}\n\t\tget encapContentInfoObj() {\n\t\t\treturn this.signedDataObj.subs[2];\n\t\t}\n\t\tget signerInfosObj() {\n\t\t\tconst sd = this.signedDataObj;\n\t\t\treturn sd.subs[sd.subs.length - 1];\n\t\t}\n\t\tget signerInfoObj() {\n\t\t\treturn this.signerInfosObj.subs[0];\n\t\t}\n\t\tget eContentTypeObj() {\n\t\t\treturn this.encapContentInfoObj.subs[0];\n\t\t}\n\t\tget eContentObj() {\n\t\t\treturn this.encapContentInfoObj.subs[1];\n\t\t}\n\t\tget signedAttrsObj() {\n\t\t\treturn this.signerInfoObj.subs.find((sub) => sub.tag.isContextSpecific(0));\n\t\t}\n\t\tget messageDigestAttributeObj() {\n\t\t\treturn this.signedAttrsObj.subs.find((sub) => sub.subs[0].tag.isOID() && sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY);\n\t\t}\n\t\tget signerSidObj() {\n\t\t\treturn this.signerInfoObj.subs[1];\n\t\t}\n\t\tget signerDigestAlgorithmObj() {\n\t\t\treturn this.signerInfoObj.subs[2];\n\t\t}\n\t\tget signatureAlgorithmObj() {\n\t\t\treturn this.signerInfoObj.subs[4];\n\t\t}\n\t\tget signatureValueObj() {\n\t\t\treturn this.signerInfoObj.subs[5];\n\t\t}\n\t};\n\texports.RFC3161Timestamp = RFC3161Timestamp;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/rfc3161/index.js\nvar require_rfc3161 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.RFC3161Timestamp = void 0;\n\tvar timestamp_1 = require_timestamp$1();\n\tObject.defineProperty(exports, \"RFC3161Timestamp\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn timestamp_1.RFC3161Timestamp;\n\t\t}\n\t});\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/x509/sct.js\nvar require_sct$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\tvar desc = Object.getOwnPropertyDescriptor(m, k);\n\t\tif (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {\n\t\t\tenumerable: true,\n\t\t\tget: function() {\n\t\t\t\treturn m[k];\n\t\t\t}\n\t\t};\n\t\tObject.defineProperty(o, k2, desc);\n\t}) : (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\to[k2] = m[k];\n\t}));\n\tvar __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {\n\t\tObject.defineProperty(o, \"default\", {\n\t\t\tenumerable: true,\n\t\t\tvalue: v\n\t\t});\n\t}) : function(o, v) {\n\t\to[\"default\"] = v;\n\t});\n\tvar __importStar = exports && exports.__importStar || (function() {\n\t\tvar ownKeys = function(o) {\n\t\t\townKeys = Object.getOwnPropertyNames || function(o) {\n\t\t\t\tvar ar = [];\n\t\t\t\tfor (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;\n\t\t\t\treturn ar;\n\t\t\t};\n\t\t\treturn ownKeys(o);\n\t\t};\n\t\treturn function(mod) {\n\t\t\tif (mod && mod.__esModule) return mod;\n\t\t\tvar result = {};\n\t\t\tif (mod != null) {\n\t\t\t\tfor (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== \"default\") __createBinding(result, mod, k[i]);\n\t\t\t}\n\t\t\t__setModuleDefault(result, mod);\n\t\t\treturn result;\n\t\t};\n\t})();\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.SignedCertificateTimestamp = void 0;\n\tconst crypto = __importStar(require_crypto());\n\tconst stream_1 = require_stream();\n\tvar SignedCertificateTimestamp = class SignedCertificateTimestamp {\n\t\tversion;\n\t\tlogID;\n\t\ttimestamp;\n\t\textensions;\n\t\thashAlgorithm;\n\t\tsignatureAlgorithm;\n\t\tsignature;\n\t\tconstructor(options) {\n\t\t\tthis.version = options.version;\n\t\t\tthis.logID = options.logID;\n\t\t\tthis.timestamp = options.timestamp;\n\t\t\tthis.extensions = options.extensions;\n\t\t\tthis.hashAlgorithm = options.hashAlgorithm;\n\t\t\tthis.signatureAlgorithm = options.signatureAlgorithm;\n\t\t\tthis.signature = options.signature;\n\t\t}\n\t\tget datetime() {\n\t\t\treturn new Date(Number(this.timestamp.readBigInt64BE()));\n\t\t}\n\t\tget algorithm() {\n\t\t\tswitch (this.hashAlgorithm) {\n\t\t\t\tcase 0: return \"none\";\n\t\t\t\tcase 1: return \"md5\";\n\t\t\t\tcase 2: return \"sha1\";\n\t\t\t\tcase 3: return \"sha224\";\n\t\t\t\tcase 4: return \"sha256\";\n\t\t\t\tcase 5: return \"sha384\";\n\t\t\t\tcase 6: return \"sha512\";\n\t\t\t\tdefault: return \"unknown\";\n\t\t\t}\n\t\t}\n\t\tverify(preCert, key) {\n\t\t\tconst stream = new stream_1.ByteStream();\n\t\t\tstream.appendChar(this.version);\n\t\t\tstream.appendChar(0);\n\t\t\tstream.appendView(this.timestamp);\n\t\t\tstream.appendUint16(1);\n\t\t\tstream.appendView(preCert);\n\t\t\tstream.appendUint16(this.extensions.byteLength);\n\t\t\t/* istanbul ignore next - extensions are very uncommon */\n\t\t\tif (this.extensions.byteLength > 0) stream.appendView(this.extensions);\n\t\t\treturn crypto.verify(stream.buffer, key, this.signature, this.algorithm);\n\t\t}\n\t\tstatic parse(buf) {\n\t\t\tconst stream = new stream_1.ByteStream(buf);\n\t\t\tconst version = stream.getUint8();\n\t\t\tconst logID = stream.getBlock(32);\n\t\t\tconst timestamp = stream.getBlock(8);\n\t\t\tconst extenstionLength = stream.getUint16();\n\t\t\tconst extensions = stream.getBlock(extenstionLength);\n\t\t\tconst hashAlgorithm = stream.getUint8();\n\t\t\tconst signatureAlgorithm = stream.getUint8();\n\t\t\tconst sigLength = stream.getUint16();\n\t\t\tconst signature = stream.getBlock(sigLength);\n\t\t\tif (stream.position !== buf.length) throw new Error(\"SCT buffer length mismatch\");\n\t\t\treturn new SignedCertificateTimestamp({\n\t\t\t\tversion,\n\t\t\t\tlogID,\n\t\t\t\ttimestamp,\n\t\t\t\textensions,\n\t\t\t\thashAlgorithm,\n\t\t\t\tsignatureAlgorithm,\n\t\t\t\tsignature\n\t\t\t});\n\t\t}\n\t};\n\texports.SignedCertificateTimestamp = SignedCertificateTimestamp;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/x509/ext.js\nvar require_ext = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.X509SCTExtension = exports.X509SubjectKeyIDExtension = exports.X509AuthorityKeyIDExtension = exports.X509SubjectAlternativeNameExtension = exports.X509KeyUsageExtension = exports.X509BasicConstraintsExtension = exports.X509Extension = void 0;\n\tconst stream_1 = require_stream();\n\tconst sct_1 = require_sct$1();\n\tvar X509Extension = class {\n\t\troot;\n\t\tconstructor(asn1) {\n\t\t\tthis.root = asn1;\n\t\t}\n\t\tget oid() {\n\t\t\treturn this.root.subs[0].toOID();\n\t\t}\n\t\tget critical() {\n\t\t\treturn this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;\n\t\t}\n\t\tget value() {\n\t\t\treturn this.extnValueObj.value;\n\t\t}\n\t\tget valueObj() {\n\t\t\treturn this.extnValueObj;\n\t\t}\n\t\tget extnValueObj() {\n\t\t\treturn this.root.subs[this.root.subs.length - 1];\n\t\t}\n\t};\n\texports.X509Extension = X509Extension;\n\tvar X509BasicConstraintsExtension = class extends X509Extension {\n\t\tget isCA() {\n\t\t\treturn this.sequence.subs[0]?.toBoolean() ?? false;\n\t\t}\n\t\tget pathLenConstraint() {\n\t\t\treturn this.sequence.subs.length > 1 ? this.sequence.subs[1].toInteger() : void 0;\n\t\t}\n\t\tget sequence() {\n\t\t\treturn this.extnValueObj.subs[0];\n\t\t}\n\t};\n\texports.X509BasicConstraintsExtension = X509BasicConstraintsExtension;\n\tvar X509KeyUsageExtension = class extends X509Extension {\n\t\tget digitalSignature() {\n\t\t\treturn this.bitString[0] === 1;\n\t\t}\n\t\tget keyCertSign() {\n\t\t\treturn this.bitString[5] === 1;\n\t\t}\n\t\tget crlSign() {\n\t\t\treturn this.bitString[6] === 1;\n\t\t}\n\t\tget bitString() {\n\t\t\treturn this.extnValueObj.subs[0].toBitString();\n\t\t}\n\t};\n\texports.X509KeyUsageExtension = X509KeyUsageExtension;\n\tvar X509SubjectAlternativeNameExtension = class extends X509Extension {\n\t\tget rfc822Name() {\n\t\t\treturn this.findGeneralName(1)?.value.toString(\"ascii\");\n\t\t}\n\t\tget uri() {\n\t\t\treturn this.findGeneralName(6)?.value.toString(\"ascii\");\n\t\t}\n\t\totherName(oid) {\n\t\t\tconst otherName = this.findGeneralName(0);\n\t\t\tif (otherName === void 0) return;\n\t\t\tif (otherName.subs[0].toOID() !== oid) return;\n\t\t\treturn otherName.subs[1].subs[0].value.toString(\"ascii\");\n\t\t}\n\t\tfindGeneralName(tag) {\n\t\t\treturn this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));\n\t\t}\n\t\tget generalNames() {\n\t\t\treturn this.extnValueObj.subs[0].subs;\n\t\t}\n\t};\n\texports.X509SubjectAlternativeNameExtension = X509SubjectAlternativeNameExtension;\n\tvar X509AuthorityKeyIDExtension = class extends X509Extension {\n\t\tget keyIdentifier() {\n\t\t\treturn this.findSequenceMember(0)?.value;\n\t\t}\n\t\tfindSequenceMember(tag) {\n\t\t\treturn this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));\n\t\t}\n\t\tget sequence() {\n\t\t\treturn this.extnValueObj.subs[0];\n\t\t}\n\t};\n\texports.X509AuthorityKeyIDExtension = X509AuthorityKeyIDExtension;\n\tvar X509SubjectKeyIDExtension = class extends X509Extension {\n\t\tget keyIdentifier() {\n\t\t\treturn this.extnValueObj.subs[0].value;\n\t\t}\n\t};\n\texports.X509SubjectKeyIDExtension = X509SubjectKeyIDExtension;\n\tvar X509SCTExtension = class extends X509Extension {\n\t\tconstructor(asn1) {\n\t\t\tsuper(asn1);\n\t\t}\n\t\tget signedCertificateTimestamps() {\n\t\t\tconst buf = this.extnValueObj.subs[0].value;\n\t\t\tconst stream = new stream_1.ByteStream(buf);\n\t\t\tconst end = stream.getUint16() + 2;\n\t\t\tconst sctList = [];\n\t\t\twhile (stream.position < end) {\n\t\t\t\tconst sctLength = stream.getUint16();\n\t\t\t\tconst sct = stream.getBlock(sctLength);\n\t\t\t\tsctList.push(sct_1.SignedCertificateTimestamp.parse(sct));\n\t\t\t}\n\t\t\tif (stream.position !== end) throw new Error(\"SCT list length does not match actual length\");\n\t\t\treturn sctList;\n\t\t}\n\t};\n\texports.X509SCTExtension = X509SCTExtension;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/x509/cert.js\nvar require_cert = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\tvar desc = Object.getOwnPropertyDescriptor(m, k);\n\t\tif (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {\n\t\t\tenumerable: true,\n\t\t\tget: function() {\n\t\t\t\treturn m[k];\n\t\t\t}\n\t\t};\n\t\tObject.defineProperty(o, k2, desc);\n\t}) : (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\to[k2] = m[k];\n\t}));\n\tvar __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {\n\t\tObject.defineProperty(o, \"default\", {\n\t\t\tenumerable: true,\n\t\t\tvalue: v\n\t\t});\n\t}) : function(o, v) {\n\t\to[\"default\"] = v;\n\t});\n\tvar __importStar = exports && exports.__importStar || (function() {\n\t\tvar ownKeys = function(o) {\n\t\t\townKeys = Object.getOwnPropertyNames || function(o) {\n\t\t\t\tvar ar = [];\n\t\t\t\tfor (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;\n\t\t\t\treturn ar;\n\t\t\t};\n\t\t\treturn ownKeys(o);\n\t\t};\n\t\treturn function(mod) {\n\t\t\tif (mod && mod.__esModule) return mod;\n\t\t\tvar result = {};\n\t\t\tif (mod != null) {\n\t\t\t\tfor (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== \"default\") __createBinding(result, mod, k[i]);\n\t\t\t}\n\t\t\t__setModuleDefault(result, mod);\n\t\t\treturn result;\n\t\t};\n\t})();\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.X509Certificate = exports.EXTENSION_OID_SCT = void 0;\n\tconst asn1_1 = require_asn1();\n\tconst crypto = __importStar(require_crypto());\n\tconst oid_1 = require_oid();\n\tconst pem = __importStar(require_pem());\n\tconst ext_1 = require_ext();\n\tconst EXTENSION_OID_SUBJECT_KEY_ID = \"2.5.29.14\";\n\tconst EXTENSION_OID_KEY_USAGE = \"2.5.29.15\";\n\tconst EXTENSION_OID_SUBJECT_ALT_NAME = \"2.5.29.17\";\n\tconst EXTENSION_OID_BASIC_CONSTRAINTS = \"2.5.29.19\";\n\tconst EXTENSION_OID_AUTHORITY_KEY_ID = \"2.5.29.35\";\n\texports.EXTENSION_OID_SCT = \"1.3.6.1.4.1.11129.2.4.2\";\n\tvar X509Certificate = class X509Certificate {\n\t\troot;\n\t\tconstructor(asn1) {\n\t\t\tthis.root = asn1;\n\t\t}\n\t\tstatic parse(cert) {\n\t\t\tconst der = typeof cert === \"string\" ? pem.toDER(cert) : cert;\n\t\t\treturn new X509Certificate(asn1_1.ASN1Obj.parseBuffer(der));\n\t\t}\n\t\tget tbsCertificate() {\n\t\t\treturn this.tbsCertificateObj;\n\t\t}\n\t\tget version() {\n\t\t\treturn `v${(this.versionObj.subs[0].toInteger() + BigInt(1)).toString()}`;\n\t\t}\n\t\tget serialNumber() {\n\t\t\treturn this.serialNumberObj.value;\n\t\t}\n\t\tget notBefore() {\n\t\t\treturn this.validityObj.subs[0].toDate();\n\t\t}\n\t\tget notAfter() {\n\t\t\treturn this.validityObj.subs[1].toDate();\n\t\t}\n\t\tget issuer() {\n\t\t\treturn this.issuerObj.value;\n\t\t}\n\t\tget subject() {\n\t\t\treturn this.subjectObj.value;\n\t\t}\n\t\tget publicKey() {\n\t\t\treturn this.subjectPublicKeyInfoObj.toDER();\n\t\t}\n\t\tget signatureAlgorithm() {\n\t\t\tconst oid = this.signatureAlgorithmObj.subs[0].toOID();\n\t\t\tif (oid_1.RSA_SIGNATURE_ALGOS[oid]) return oid_1.RSA_SIGNATURE_ALGOS[oid];\n\t\t\treturn oid_1.ECDSA_SIGNATURE_ALGOS[oid];\n\t\t}\n\t\tget signatureValue() {\n\t\t\treturn this.signatureValueObj.value.subarray(1);\n\t\t}\n\t\tget subjectAltName() {\n\t\t\tconst ext = this.extSubjectAltName;\n\t\t\treturn ext?.uri || ext?.rfc822Name;\n\t\t}\n\t\tget extensions() {\n\t\t\t/* istanbul ignore next */\n\t\t\treturn (this.extensionsObj?.subs[0])?.subs || [];\n\t\t}\n\t\tget extKeyUsage() {\n\t\t\tconst ext = this.findExtension(EXTENSION_OID_KEY_USAGE);\n\t\t\treturn ext ? new ext_1.X509KeyUsageExtension(ext) : void 0;\n\t\t}\n\t\tget extBasicConstraints() {\n\t\t\tconst ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);\n\t\t\treturn ext ? new ext_1.X509BasicConstraintsExtension(ext) : void 0;\n\t\t}\n\t\tget extSubjectAltName() {\n\t\t\tconst ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);\n\t\t\treturn ext ? new ext_1.X509SubjectAlternativeNameExtension(ext) : void 0;\n\t\t}\n\t\tget extAuthorityKeyID() {\n\t\t\tconst ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);\n\t\t\treturn ext ? new ext_1.X509AuthorityKeyIDExtension(ext) : void 0;\n\t\t}\n\t\tget extSubjectKeyID() {\n\t\t\tconst ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);\n\t\t\treturn ext ? new ext_1.X509SubjectKeyIDExtension(ext) : void 0;\n\t\t}\n\t\tget extSCT() {\n\t\t\tconst ext = this.findExtension(exports.EXTENSION_OID_SCT);\n\t\t\treturn ext ? new ext_1.X509SCTExtension(ext) : void 0;\n\t\t}\n\t\tget isCA() {\n\t\t\tconst ca = this.extBasicConstraints?.isCA || false;\n\t\t\t/* istanbul ignore else */\n\t\t\tif (this.extKeyUsage) return ca && this.extKeyUsage.keyCertSign;\n\t\t\t/* istanbul ignore next */\n\t\t\treturn ca;\n\t\t}\n\t\textension(oid) {\n\t\t\tconst ext = this.findExtension(oid);\n\t\t\treturn ext ? new ext_1.X509Extension(ext) : void 0;\n\t\t}\n\t\tverify(issuerCertificate) {\n\t\t\tconst publicKey = issuerCertificate?.publicKey || this.publicKey;\n\t\t\tconst key = crypto.createPublicKey(publicKey);\n\t\t\treturn crypto.verify(this.tbsCertificate.toDER(), key, this.signatureValue, this.signatureAlgorithm);\n\t\t}\n\t\tvalidForDate(date) {\n\t\t\treturn this.notBefore <= date && date <= this.notAfter;\n\t\t}\n\t\tequals(other) {\n\t\t\treturn this.root.toDER().equals(other.root.toDER());\n\t\t}\n\t\tclone() {\n\t\t\tconst der = this.root.toDER();\n\t\t\tconst clone = Buffer.alloc(der.length);\n\t\t\tder.copy(clone);\n\t\t\treturn X509Certificate.parse(clone);\n\t\t}\n\t\tfindExtension(oid) {\n\t\t\treturn this.extensions.find((ext) => ext.subs[0].toOID() === oid);\n\t\t}\n\t\tget tbsCertificateObj() {\n\t\t\treturn this.root.subs[0];\n\t\t}\n\t\tget signatureAlgorithmObj() {\n\t\t\treturn this.root.subs[1];\n\t\t}\n\t\tget signatureValueObj() {\n\t\t\treturn this.root.subs[2];\n\t\t}\n\t\tget versionObj() {\n\t\t\treturn this.tbsCertificateObj.subs[0];\n\t\t}\n\t\tget serialNumberObj() {\n\t\t\treturn this.tbsCertificateObj.subs[1];\n\t\t}\n\t\tget issuerObj() {\n\t\t\treturn this.tbsCertificateObj.subs[3];\n\t\t}\n\t\tget validityObj() {\n\t\t\treturn this.tbsCertificateObj.subs[4];\n\t\t}\n\t\tget subjectObj() {\n\t\t\treturn this.tbsCertificateObj.subs[5];\n\t\t}\n\t\tget subjectPublicKeyInfoObj() {\n\t\t\treturn this.tbsCertificateObj.subs[6];\n\t\t}\n\t\tget extensionsObj() {\n\t\t\treturn this.tbsCertificateObj.subs.find((sub) => sub.tag.isContextSpecific(3));\n\t\t}\n\t};\n\texports.X509Certificate = X509Certificate;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/x509/index.js\nvar require_x509 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.X509SCTExtension = exports.X509Certificate = exports.EXTENSION_OID_SCT = void 0;\n\tvar cert_1 = require_cert();\n\tObject.defineProperty(exports, \"EXTENSION_OID_SCT\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn cert_1.EXTENSION_OID_SCT;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"X509Certificate\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn cert_1.X509Certificate;\n\t\t}\n\t});\n\tvar ext_1 = require_ext();\n\tObject.defineProperty(exports, \"X509SCTExtension\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn ext_1.X509SCTExtension;\n\t\t}\n\t});\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+core@4.0.1_patch_hash=2900ec704c3abfc6962eb2edecaa946b783a97e13084c4c30b1be0df5b30ae4d/node_modules/@sigstore/core/dist/index.js\nvar require_dist$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\tvar desc = Object.getOwnPropertyDescriptor(m, k);\n\t\tif (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {\n\t\t\tenumerable: true,\n\t\t\tget: function() {\n\t\t\t\treturn m[k];\n\t\t\t}\n\t\t};\n\t\tObject.defineProperty(o, k2, desc);\n\t}) : (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\to[k2] = m[k];\n\t}));\n\tvar __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {\n\t\tObject.defineProperty(o, \"default\", {\n\t\t\tenumerable: true,\n\t\t\tvalue: v\n\t\t});\n\t}) : function(o, v) {\n\t\to[\"default\"] = v;\n\t});\n\tvar __importStar = exports && exports.__importStar || (function() {\n\t\tvar ownKeys = function(o) {\n\t\t\townKeys = Object.getOwnPropertyNames || function(o) {\n\t\t\t\tvar ar = [];\n\t\t\t\tfor (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;\n\t\t\t\treturn ar;\n\t\t\t};\n\t\t\treturn ownKeys(o);\n\t\t};\n\t\treturn function(mod) {\n\t\t\tif (mod && mod.__esModule) return mod;\n\t\t\tvar result = {};\n\t\t\tif (mod != null) {\n\t\t\t\tfor (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== \"default\") __createBinding(result, mod, k[i]);\n\t\t\t}\n\t\t\t__setModuleDefault(result, mod);\n\t\t\treturn result;\n\t\t};\n\t})();\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.X509SCTExtension = exports.X509Certificate = exports.EXTENSION_OID_SCT = exports.ByteStream = exports.RFC3161Timestamp = exports.pem = exports.json = exports.encoding = exports.dsse = exports.crypto = exports.ASN1Obj = void 0;\n\tvar asn1_1 = require_asn1();\n\tObject.defineProperty(exports, \"ASN1Obj\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn asn1_1.ASN1Obj;\n\t\t}\n\t});\n\texports.crypto = __importStar(require_crypto());\n\texports.dsse = __importStar(require_dsse$3());\n\texports.encoding = __importStar(require_encoding());\n\texports.json = __importStar(require_json());\n\texports.pem = __importStar(require_pem());\n\tvar rfc3161_1 = require_rfc3161();\n\tObject.defineProperty(exports, \"RFC3161Timestamp\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn rfc3161_1.RFC3161Timestamp;\n\t\t}\n\t});\n\tvar stream_1 = require_stream();\n\tObject.defineProperty(exports, \"ByteStream\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn stream_1.ByteStream;\n\t\t}\n\t});\n\tvar x509_1 = require_x509();\n\tObject.defineProperty(exports, \"EXTENSION_OID_SCT\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn x509_1.EXTENSION_OID_SCT;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"X509Certificate\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn x509_1.X509Certificate;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"X509SCTExtension\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn x509_1.X509SCTExtension;\n\t\t}\n\t});\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/bundle/dsse.js\nvar require_dsse$2 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.DSSESignatureContent = void 0;\n\tconst core_1 = require_dist$1();\n\tvar DSSESignatureContent = class {\n\t\tenv;\n\t\tconstructor(env) {\n\t\t\tthis.env = env;\n\t\t}\n\t\tcompareDigest(digest) {\n\t\t\treturn core_1.crypto.bufferEqual(digest, core_1.crypto.digest(\"sha256\", this.env.payload));\n\t\t}\n\t\tcompareSignedDigest(digest) {\n\t\t\treturn core_1.crypto.bufferEqual(digest, core_1.crypto.digest(\"sha256\", this.preAuthEncoding));\n\t\t}\n\t\tcompareSignature(signature) {\n\t\t\treturn core_1.crypto.bufferEqual(signature, this.signature);\n\t\t}\n\t\tverifySignature(key) {\n\t\t\treturn core_1.crypto.verify(this.preAuthEncoding, key, this.signature);\n\t\t}\n\t\tget signature() {\n\t\t\treturn this.env.signatures.length > 0 ? this.env.signatures[0].sig : Buffer.from(\"\");\n\t\t}\n\t\tget preAuthEncoding() {\n\t\t\treturn core_1.dsse.preAuthEncoding(this.env.payloadType, this.env.payload);\n\t\t}\n\t};\n\texports.DSSESignatureContent = DSSESignatureContent;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/bundle/message.js\nvar require_message = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.MessageSignatureContent = void 0;\n\tconst core_1 = require_dist$1();\n\tconst protobuf_specs_1 = require_dist$3();\n\tconst HASH_ALGORITHM_MAP = {\n\t\t[protobuf_specs_1.HashAlgorithm.HASH_ALGORITHM_UNSPECIFIED]: \"sha256\",\n\t\t[protobuf_specs_1.HashAlgorithm.SHA2_256]: \"sha256\",\n\t\t[protobuf_specs_1.HashAlgorithm.SHA2_384]: \"sha384\",\n\t\t[protobuf_specs_1.HashAlgorithm.SHA2_512]: \"sha512\",\n\t\t[protobuf_specs_1.HashAlgorithm.SHA3_256]: \"sha3-256\",\n\t\t[protobuf_specs_1.HashAlgorithm.SHA3_384]: \"sha3-384\"\n\t};\n\tvar MessageSignatureContent = class {\n\t\tsignature;\n\t\tmessageDigest;\n\t\tartifact;\n\t\thashAlgorithm;\n\t\tconstructor(messageSignature, artifact) {\n\t\t\tthis.signature = messageSignature.signature;\n\t\t\tthis.messageDigest = messageSignature.messageDigest.digest;\n\t\t\tthis.artifact = artifact;\n\t\t\tthis.hashAlgorithm = HASH_ALGORITHM_MAP[messageSignature.messageDigest.algorithm] ?? \"sha256\";\n\t\t}\n\t\tcompareSignature(signature) {\n\t\t\treturn core_1.crypto.bufferEqual(signature, this.signature);\n\t\t}\n\t\tcompareDigest(digest) {\n\t\t\treturn core_1.crypto.bufferEqual(digest, this.messageDigest);\n\t\t}\n\t\tcompareSignedDigest(digest) {\n\t\t\treturn this.compareDigest(digest);\n\t\t}\n\t\tverifySignature(key) {\n\t\t\treturn core_1.crypto.verify(this.artifact, key, this.signature, this.hashAlgorithm);\n\t\t}\n\t};\n\texports.MessageSignatureContent = MessageSignatureContent;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/bundle/index.js\nvar require_bundle = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.toSignedEntity = toSignedEntity;\n\texports.signatureContent = signatureContent;\n\tconst core_1 = require_dist$1();\n\tconst dsse_1 = require_dsse$2();\n\tconst message_1 = require_message();\n\tfunction toSignedEntity(bundle, artifact) {\n\t\tconst { tlogEntries, timestampVerificationData } = bundle.verificationMaterial;\n\t\tconst timestamps = [];\n\t\tfor (const entry of tlogEntries) if (entry.integratedTime && entry.integratedTime !== \"0\") timestamps.push({\n\t\t\t$case: \"transparency-log\",\n\t\t\ttlogEntry: entry\n\t\t});\n\t\tfor (const ts of timestampVerificationData?.rfc3161Timestamps ?? []) timestamps.push({\n\t\t\t$case: \"timestamp-authority\",\n\t\t\ttimestamp: core_1.RFC3161Timestamp.parse(Buffer.from(ts.signedTimestamp))\n\t\t});\n\t\treturn {\n\t\t\tsignature: signatureContent(bundle, artifact),\n\t\t\tkey: key(bundle),\n\t\t\ttlogEntries,\n\t\t\ttimestamps\n\t\t};\n\t}\n\tfunction signatureContent(bundle, artifact) {\n\t\tswitch (bundle.content.$case) {\n\t\t\tcase \"dsseEnvelope\": return new dsse_1.DSSESignatureContent(bundle.content.dsseEnvelope);\n\t\t\tcase \"messageSignature\": return new message_1.MessageSignatureContent(bundle.content.messageSignature, artifact);\n\t\t}\n\t}\n\tfunction key(bundle) {\n\t\tswitch (bundle.verificationMaterial.content.$case) {\n\t\t\tcase \"publicKey\": return {\n\t\t\t\t$case: \"public-key\",\n\t\t\t\thint: bundle.verificationMaterial.content.publicKey.hint\n\t\t\t};\n\t\t\tcase \"x509CertificateChain\": return {\n\t\t\t\t$case: \"certificate\",\n\t\t\t\tcertificate: core_1.X509Certificate.parse(Buffer.from(bundle.verificationMaterial.content.x509CertificateChain.certificates[0].rawBytes))\n\t\t\t};\n\t\t\tcase \"certificate\": return {\n\t\t\t\t$case: \"certificate\",\n\t\t\t\tcertificate: core_1.X509Certificate.parse(Buffer.from(bundle.verificationMaterial.content.certificate.rawBytes))\n\t\t\t};\n\t\t}\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/error.js\nvar require_error = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.PolicyError = exports.VerificationError = void 0;\n\tvar BaseError = class extends Error {\n\t\tcode;\n\t\tcause;\n\t\tconstructor({ code, message, cause }) {\n\t\t\tsuper(message);\n\t\t\tthis.code = code;\n\t\t\tthis.cause = cause;\n\t\t\tthis.name = this.constructor.name;\n\t\t}\n\t};\n\tvar VerificationError = class extends BaseError {};\n\texports.VerificationError = VerificationError;\n\tvar PolicyError = class extends BaseError {};\n\texports.PolicyError = PolicyError;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/trust/filter.js\nvar require_filter = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.filterCertAuthorities = filterCertAuthorities;\n\texports.filterTLogAuthorities = filterTLogAuthorities;\n\tfunction filterCertAuthorities(certAuthorities, timestamp) {\n\t\treturn certAuthorities.filter((ca) => {\n\t\t\treturn ca.validFor.start <= timestamp && ca.validFor.end >= timestamp;\n\t\t});\n\t}\n\tfunction filterTLogAuthorities(tlogAuthorities, criteria) {\n\t\treturn tlogAuthorities.filter((tlog) => {\n\t\t\tif (criteria.logID && !tlog.logID.equals(criteria.logID)) return false;\n\t\t\treturn tlog.validFor.start <= criteria.targetDate && criteria.targetDate <= tlog.validFor.end;\n\t\t});\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/trust/index.js\nvar require_trust = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.filterTLogAuthorities = exports.filterCertAuthorities = void 0;\n\texports.toTrustMaterial = toTrustMaterial;\n\tconst core_1 = require_dist$1();\n\tconst protobuf_specs_1 = require_dist$3();\n\tconst error_1 = require_error();\n\tconst BEGINNING_OF_TIME = /* @__PURE__ */ new Date(0);\n\tconst END_OF_TIME = /* @__PURE__ */ new Date(864e13);\n\tvar filter_1 = require_filter();\n\tObject.defineProperty(exports, \"filterCertAuthorities\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn filter_1.filterCertAuthorities;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"filterTLogAuthorities\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn filter_1.filterTLogAuthorities;\n\t\t}\n\t});\n\tfunction toTrustMaterial(root, keys) {\n\t\tconst keyFinder = typeof keys === \"function\" ? keys : keyLocator(keys);\n\t\treturn {\n\t\t\tcertificateAuthorities: root.certificateAuthorities.map(createCertAuthority),\n\t\t\ttimestampAuthorities: root.timestampAuthorities.map(createCertAuthority),\n\t\t\ttlogs: root.tlogs.map(createTLogAuthority),\n\t\t\tctlogs: root.ctlogs.map(createTLogAuthority),\n\t\t\tpublicKey: keyFinder\n\t\t};\n\t}\n\tfunction createTLogAuthority(tlogInstance) {\n\t\tconst keyDetails = tlogInstance.publicKey.keyDetails;\n\t\tconst keyType = keyDetails === protobuf_specs_1.PublicKeyDetails.PKCS1_RSA_PKCS1V5 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V5 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256 ? \"pkcs1\" : \"spki\";\n\t\t/* istanbul ignore next */\n\t\treturn {\n\t\t\tbaseURL: tlogInstance.baseUrl,\n\t\t\tlogID: tlogInstance.checkpointKeyId ? tlogInstance.checkpointKeyId.keyId : tlogInstance.logId.keyId,\n\t\t\tpublicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes, keyType),\n\t\t\tvalidFor: {\n\t\t\t\tstart: tlogInstance.publicKey.validFor?.start || BEGINNING_OF_TIME,\n\t\t\t\tend: tlogInstance.publicKey.validFor?.end || END_OF_TIME\n\t\t\t}\n\t\t};\n\t}\n\tfunction createCertAuthority(ca) {\n\t\t/* istanbul ignore next */\n\t\treturn {\n\t\t\tcertChain: ca.certChain.certificates.map((cert) => {\n\t\t\t\treturn core_1.X509Certificate.parse(Buffer.from(cert.rawBytes));\n\t\t\t}),\n\t\t\tvalidFor: {\n\t\t\t\tstart: ca.validFor?.start || BEGINNING_OF_TIME,\n\t\t\t\tend: ca.validFor?.end || END_OF_TIME\n\t\t\t}\n\t\t};\n\t}\n\tfunction keyLocator(keys) {\n\t\treturn (hint) => {\n\t\t\tconst key = (keys || {})[hint];\n\t\t\tif (!key) throw new error_1.VerificationError({\n\t\t\t\tcode: \"PUBLIC_KEY_ERROR\",\n\t\t\t\tmessage: `key not found: ${hint}`\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tpublicKey: core_1.crypto.createPublicKey(key.rawBytes),\n\t\t\t\tvalidFor: (date) => {\n\t\t\t\t\t/* istanbul ignore next */\n\t\t\t\t\treturn (key.validFor?.start || BEGINNING_OF_TIME) <= date && (key.validFor?.end || END_OF_TIME) >= date;\n\t\t\t\t}\n\t\t\t};\n\t\t};\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/key/certificate.js\nvar require_certificate = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.CertificateChainVerifier = void 0;\n\texports.verifyCertificateChain = verifyCertificateChain;\n\tconst error_1 = require_error();\n\tconst trust_1 = require_trust();\n\tfunction verifyCertificateChain(timestamp, leaf, certificateAuthorities) {\n\t\tconst cas = (0, trust_1.filterCertAuthorities)(certificateAuthorities, timestamp);\n\t\tlet error;\n\t\tfor (const ca of cas) try {\n\t\t\treturn new CertificateChainVerifier({\n\t\t\t\ttrustedCerts: ca.certChain,\n\t\t\t\tuntrustedCert: leaf,\n\t\t\t\ttimestamp\n\t\t\t}).verify();\n\t\t} catch (err) {\n\t\t\terror = err;\n\t\t}\n\t\tthrow new error_1.VerificationError({\n\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\tmessage: \"Failed to verify certificate chain\",\n\t\t\tcause: error\n\t\t});\n\t}\n\tvar CertificateChainVerifier = class {\n\t\tuntrustedCert;\n\t\ttrustedCerts;\n\t\tlocalCerts;\n\t\ttimestamp;\n\t\tconstructor(opts) {\n\t\t\tthis.untrustedCert = opts.untrustedCert;\n\t\t\tthis.trustedCerts = opts.trustedCerts;\n\t\t\tthis.localCerts = dedupeCertificates([...opts.trustedCerts, opts.untrustedCert]);\n\t\t\tthis.timestamp = opts.timestamp;\n\t\t}\n\t\tverify() {\n\t\t\tconst certificatePath = this.sort();\n\t\t\tthis.checkPath(certificatePath);\n\t\t\tif (!certificatePath.every((cert) => cert.validForDate(this.timestamp))) throw new error_1.VerificationError({\n\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\tmessage: \"certificate is not valid or expired at the specified date\"\n\t\t\t});\n\t\t\treturn certificatePath;\n\t\t}\n\t\tsort() {\n\t\t\tconst leafCert = this.untrustedCert;\n\t\t\tlet paths = this.buildPaths(leafCert);\n\t\t\tpaths = paths.filter((path) => path.some((cert) => this.trustedCerts.includes(cert)));\n\t\t\tif (paths.length === 0) throw new error_1.VerificationError({\n\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\tmessage: \"no trusted certificate path found\"\n\t\t\t});\n\t\t\treturn [leafCert, ...paths.reduce((prev, curr) => prev.length < curr.length ? prev : curr)].slice(0, -1);\n\t\t}\n\t\tbuildPaths(certificate) {\n\t\t\tconst paths = [];\n\t\t\tconst issuers = this.findIssuer(certificate);\n\t\t\tif (issuers.length === 0) throw new error_1.VerificationError({\n\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\tmessage: \"no valid certificate path found\"\n\t\t\t});\n\t\t\tfor (let i = 0; i < issuers.length; i++) {\n\t\t\t\tconst issuer = issuers[i];\n\t\t\t\tif (issuer.equals(certificate)) {\n\t\t\t\t\tpaths.push([certificate]);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst subPaths = this.buildPaths(issuer);\n\t\t\t\tfor (let j = 0; j < subPaths.length; j++) paths.push([issuer, ...subPaths[j]]);\n\t\t\t}\n\t\t\treturn paths;\n\t\t}\n\t\tfindIssuer(certificate) {\n\t\t\tlet issuers = [];\n\t\t\tlet keyIdentifier;\n\t\t\tif (certificate.subject.equals(certificate.issuer)) {\n\t\t\t\tif (certificate.verify()) return [certificate];\n\t\t\t}\n\t\t\tif (certificate.extAuthorityKeyID) keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;\n\t\t\tthis.localCerts.forEach((possibleIssuer) => {\n\t\t\t\tif (keyIdentifier) {\n\t\t\t\t\t/* istanbul ignore else */\n\t\t\t\t\tif (possibleIssuer.extSubjectKeyID) {\n\t\t\t\t\t\tif (possibleIssuer.extSubjectKeyID.keyIdentifier.equals(keyIdentifier)) issuers.push(possibleIssuer);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (possibleIssuer.subject.equals(certificate.issuer)) issuers.push(possibleIssuer);\n\t\t\t});\n\t\t\tissuers = issuers.filter((issuer) => {\n\t\t\t\ttry {\n\t\t\t\t\treturn certificate.verify(issuer);\n\t\t\t\t} catch (ex) {\n\t\t\t\t\t/* istanbul ignore next - should never error */\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t});\n\t\t\treturn issuers;\n\t\t}\n\t\tcheckPath(path) {\n\t\t\t/* istanbul ignore if */\n\t\t\tif (path.length < 1) throw new error_1.VerificationError({\n\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\tmessage: \"certificate chain must contain at least one certificate\"\n\t\t\t});\n\t\t\tif (!path.slice(1).every((cert) => cert.isCA)) throw new error_1.VerificationError({\n\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\tmessage: \"intermediate certificate is not a CA\"\n\t\t\t});\n\t\t\tfor (let i = path.length - 2; i >= 0; i--)\n /* istanbul ignore if */\n\t\t\tif (!path[i].issuer.equals(path[i + 1].subject)) throw new error_1.VerificationError({\n\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\tmessage: \"incorrect certificate name chaining\"\n\t\t\t});\n\t\t\tfor (let i = 0; i < path.length; i++) {\n\t\t\t\tconst cert = path[i];\n\t\t\t\tif (cert.extBasicConstraints?.isCA) {\n\t\t\t\t\tconst pathLength = cert.extBasicConstraints.pathLenConstraint;\n\t\t\t\t\tif (pathLength !== void 0 && pathLength < i - 1) throw new error_1.VerificationError({\n\t\t\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\t\t\tmessage: \"path length constraint exceeded\"\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n\texports.CertificateChainVerifier = CertificateChainVerifier;\n\tfunction dedupeCertificates(certs) {\n\t\tfor (let i = 0; i < certs.length; i++) for (let j = i + 1; j < certs.length; j++) if (certs[i].equals(certs[j])) {\n\t\t\tcerts.splice(j, 1);\n\t\t\tj--;\n\t\t}\n\t\treturn certs;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/key/sct.js\nvar require_sct = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifySCTs = verifySCTs;\n\tconst core_1 = require_dist$1();\n\tconst error_1 = require_error();\n\tconst trust_1 = require_trust();\n\tfunction verifySCTs(cert, issuer, ctlogs) {\n\t\tlet extSCT;\n\t\tconst clone = cert.clone();\n\t\tfor (let i = 0; i < clone.extensions.length; i++) {\n\t\t\tconst ext = clone.extensions[i];\n\t\t\tif (ext.subs[0].toOID() === core_1.EXTENSION_OID_SCT) {\n\t\t\t\textSCT = new core_1.X509SCTExtension(ext);\n\t\t\t\tclone.extensions.splice(i, 1);\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tif (!extSCT) return [];\n\t\t/* istanbul ignore if -- too difficult to fabricate test case for this */\n\t\tif (extSCT.signedCertificateTimestamps.length === 0) return [];\n\t\tconst preCert = new core_1.ByteStream();\n\t\tconst issuerId = core_1.crypto.digest(\"sha256\", issuer.publicKey);\n\t\tpreCert.appendView(issuerId);\n\t\tconst tbs = clone.tbsCertificate.toDER();\n\t\tpreCert.appendUint24(tbs.length);\n\t\tpreCert.appendView(tbs);\n\t\treturn extSCT.signedCertificateTimestamps.map((sct) => {\n\t\t\tif (!(0, trust_1.filterTLogAuthorities)(ctlogs, {\n\t\t\t\tlogID: sct.logID,\n\t\t\t\ttargetDate: sct.datetime\n\t\t\t}).some((log) => sct.verify(preCert.buffer, log.publicKey))) throw new error_1.VerificationError({\n\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\tmessage: \"SCT verification failed\"\n\t\t\t});\n\t\t\treturn sct.logID;\n\t\t});\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/key/index.js\nvar require_key = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifyPublicKey = verifyPublicKey;\n\texports.verifyCertificate = verifyCertificate;\n\tconst core_1 = require_dist$1();\n\tconst error_1 = require_error();\n\tconst certificate_1 = require_certificate();\n\tconst sct_1 = require_sct();\n\tconst OID_FULCIO_ISSUER_V1 = \"1.3.6.1.4.1.57264.1.1\";\n\tconst OID_FULCIO_ISSUER_V2 = \"1.3.6.1.4.1.57264.1.8\";\n\tfunction verifyPublicKey(hint, timestamps, trustMaterial) {\n\t\tconst key = trustMaterial.publicKey(hint);\n\t\ttimestamps.forEach((timestamp) => {\n\t\t\tif (!key.validFor(timestamp)) throw new error_1.VerificationError({\n\t\t\t\tcode: \"PUBLIC_KEY_ERROR\",\n\t\t\t\tmessage: `Public key is not valid for timestamp: ${timestamp.toISOString()}`\n\t\t\t});\n\t\t});\n\t\treturn { key: key.publicKey };\n\t}\n\tfunction verifyCertificate(leaf, timestamps, trustMaterial) {\n\t\tlet path = [];\n\t\ttimestamps.forEach((timestamp) => {\n\t\t\tpath = (0, certificate_1.verifyCertificateChain)(timestamp, leaf, trustMaterial.certificateAuthorities);\n\t\t});\n\t\treturn {\n\t\t\tscts: (0, sct_1.verifySCTs)(path[0], path[1], trustMaterial.ctlogs),\n\t\t\tsigner: getSigner(path[0])\n\t\t};\n\t}\n\tfunction getSigner(cert) {\n\t\tlet issuer;\n\t\tconst issuerExtension = cert.extension(OID_FULCIO_ISSUER_V2);\n\t\t/* istanbul ignore next */\n\t\tif (issuerExtension) issuer = issuerExtension.valueObj.subs?.[0]?.value.toString(\"ascii\");\n\t\telse issuer = cert.extension(OID_FULCIO_ISSUER_V1)?.value.toString(\"ascii\");\n\t\tconst oids = cert.extensions.map((ext) => {\n\t\t\treturn {\n\t\t\t\toid: { id: ext.subs[0].toOID().split(\".\").map(Number) },\n\t\t\t\tvalue: ext.subs[ext.subs.length - 1].value\n\t\t\t};\n\t\t});\n\t\tconst identity = {\n\t\t\textensions: { issuer },\n\t\t\tsubjectAlternativeName: cert.subjectAltName,\n\t\t\toids\n\t\t};\n\t\treturn {\n\t\t\tkey: core_1.crypto.createPublicKey(cert.publicKey),\n\t\t\tidentity\n\t\t};\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/policy.js\nvar require_policy = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifySubjectAlternativeName = verifySubjectAlternativeName;\n\texports.verifyExtensions = verifyExtensions;\n\texports.verifyOIDs = verifyOIDs;\n\tconst error_1 = require_error();\n\tfunction verifySubjectAlternativeName(policyIdentity, signerIdentity) {\n\t\tif (signerIdentity === void 0 || !signerIdentity.match(policyIdentity)) throw new error_1.PolicyError({\n\t\t\tcode: \"UNTRUSTED_SIGNER_ERROR\",\n\t\t\tmessage: `certificate identity error - expected ${policyIdentity}, got ${signerIdentity}`\n\t\t});\n\t}\n\tfunction verifyExtensions(policyExtensions, signerExtensions = {}) {\n\t\tlet key;\n\t\tfor (key in policyExtensions) if (signerExtensions[key] !== policyExtensions[key]) throw new error_1.PolicyError({\n\t\t\tcode: \"UNTRUSTED_SIGNER_ERROR\",\n\t\t\tmessage: `invalid certificate extension - expected ${key}=${policyExtensions[key]}, got ${key}=${signerExtensions[key]}`\n\t\t});\n\t}\n\tfunction verifyOIDs(policyOIDs, signerOIDs = []) {\n\t\tfor (const policyOID of policyOIDs) if (!signerOIDs.find((signerOID) => oidEquals(policyOID.oid?.id, signerOID.oid?.id) && policyOID.value.equals(signerOID.value))) {\n\t\t\tconst oid = policyOID.oid?.id.join(\".\") ?? \"<unknown>\";\n\t\t\tthrow new error_1.PolicyError({\n\t\t\t\tcode: \"UNTRUSTED_SIGNER_ERROR\",\n\t\t\t\tmessage: `invalid certificate extension - missing OID ${oid}`\n\t\t\t});\n\t\t}\n\t}\n\tfunction oidEquals(a, b) {\n\t\tif (a === void 0 || b === void 0) return false;\n\t\treturn a.length === b.length && a.every((v, i) => v === b[i]);\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/timestamp/tsa.js\nvar require_tsa = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifyRFC3161Timestamp = verifyRFC3161Timestamp;\n\tconst core_1 = require_dist$1();\n\tconst error_1 = require_error();\n\tconst certificate_1 = require_certificate();\n\tconst trust_1 = require_trust();\n\tfunction verifyRFC3161Timestamp(timestamp, data, timestampAuthorities) {\n\t\tconst signingTime = timestamp.signingTime;\n\t\ttimestampAuthorities = (0, trust_1.filterCertAuthorities)(timestampAuthorities, signingTime);\n\t\ttimestampAuthorities = filterCAsBySerialAndIssuer(timestampAuthorities, {\n\t\t\tserialNumber: timestamp.signerSerialNumber,\n\t\t\tissuer: timestamp.signerIssuer\n\t\t});\n\t\tif (!timestampAuthorities.some((ca) => {\n\t\t\ttry {\n\t\t\t\tverifyTimestampForCA(timestamp, data, ca);\n\t\t\t\treturn true;\n\t\t\t} catch (e) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t})) throw new error_1.VerificationError({\n\t\t\tcode: \"TIMESTAMP_ERROR\",\n\t\t\tmessage: \"timestamp could not be verified\"\n\t\t});\n\t}\n\tfunction verifyTimestampForCA(timestamp, data, ca) {\n\t\tconst [leaf, ...cas] = ca.certChain;\n\t\tconst signingKey = core_1.crypto.createPublicKey(leaf.publicKey);\n\t\tconst signingTime = timestamp.signingTime;\n\t\ttry {\n\t\t\tnew certificate_1.CertificateChainVerifier({\n\t\t\t\tuntrustedCert: leaf,\n\t\t\t\ttrustedCerts: cas,\n\t\t\t\ttimestamp: signingTime\n\t\t\t}).verify();\n\t\t} catch (e) {\n\t\t\tthrow new error_1.VerificationError({\n\t\t\t\tcode: \"TIMESTAMP_ERROR\",\n\t\t\t\tmessage: \"invalid certificate chain\"\n\t\t\t});\n\t\t}\n\t\ttimestamp.verify(data, signingKey);\n\t}\n\tfunction filterCAsBySerialAndIssuer(timestampAuthorities, criteria) {\n\t\treturn timestampAuthorities.filter((ca) => ca.certChain.length > 0 && core_1.crypto.bufferEqual(ca.certChain[0].serialNumber, criteria.serialNumber) && core_1.crypto.bufferEqual(ca.certChain[0].issuer, criteria.issuer));\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/timestamp/index.js\nvar require_timestamp = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.getTSATimestamp = getTSATimestamp;\n\texports.getTLogTimestamp = getTLogTimestamp;\n\tconst tsa_1 = require_tsa();\n\tfunction getTSATimestamp(timestamp, data, timestampAuthorities) {\n\t\t(0, tsa_1.verifyRFC3161Timestamp)(timestamp, data, timestampAuthorities);\n\t\treturn {\n\t\t\ttype: \"timestamp-authority\",\n\t\t\tlogID: timestamp.signerSerialNumber,\n\t\t\ttimestamp: timestamp.signingTime\n\t\t};\n\t}\n\tfunction getTLogTimestamp(entry) {\n\t\tif (!entry.inclusionPromise) return;\n\t\treturn {\n\t\t\ttype: \"transparency-log\",\n\t\t\tlogID: entry.logId.keyId,\n\t\t\ttimestamp: /* @__PURE__ */ new Date(Number(entry.integratedTime) * 1e3)\n\t\t};\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/verifier.js\nvar require_verifier$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.Signature = exports.Verifier = exports.PublicKey = void 0;\n\tconst sigstore_common_1 = require_sigstore_common();\n\texports.PublicKey = {\n\t\tfromJSON(object) {\n\t\t\treturn { rawBytes: isSet(object.rawBytes) ? Buffer.from(bytesFromBase64(object.rawBytes)) : Buffer.alloc(0) };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.rawBytes.length !== 0) obj.rawBytes = base64FromBytes(message.rawBytes);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Verifier = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tverifier: isSet(object.publicKey) ? {\n\t\t\t\t\t$case: \"publicKey\",\n\t\t\t\t\tpublicKey: exports.PublicKey.fromJSON(object.publicKey)\n\t\t\t\t} : isSet(object.x509Certificate) ? {\n\t\t\t\t\t$case: \"x509Certificate\",\n\t\t\t\t\tx509Certificate: sigstore_common_1.X509Certificate.fromJSON(object.x509Certificate)\n\t\t\t\t} : void 0,\n\t\t\t\tkeyDetails: isSet(object.keyDetails) ? (0, sigstore_common_1.publicKeyDetailsFromJSON)(object.keyDetails) : 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.verifier?.$case === \"publicKey\") obj.publicKey = exports.PublicKey.toJSON(message.verifier.publicKey);\n\t\t\telse if (message.verifier?.$case === \"x509Certificate\") obj.x509Certificate = sigstore_common_1.X509Certificate.toJSON(message.verifier.x509Certificate);\n\t\t\tif (message.keyDetails !== 0) obj.keyDetails = (0, sigstore_common_1.publicKeyDetailsToJSON)(message.keyDetails);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Signature = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tcontent: isSet(object.content) ? Buffer.from(bytesFromBase64(object.content)) : Buffer.alloc(0),\n\t\t\t\tverifier: isSet(object.verifier) ? exports.Verifier.fromJSON(object.verifier) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.content.length !== 0) obj.content = base64FromBytes(message.content);\n\t\t\tif (message.verifier !== void 0) obj.verifier = exports.Verifier.toJSON(message.verifier);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction bytesFromBase64(b64) {\n\t\treturn Uint8Array.from(globalThis.Buffer.from(b64, \"base64\"));\n\t}\n\tfunction base64FromBytes(arr) {\n\t\treturn globalThis.Buffer.from(arr).toString(\"base64\");\n\t}\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/dsse.js\nvar require_dsse$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.DSSELogEntryV002 = exports.DSSERequestV002 = void 0;\n\tconst envelope_1 = require_envelope();\n\tconst sigstore_common_1 = require_sigstore_common();\n\tconst verifier_1 = require_verifier$1();\n\texports.DSSERequestV002 = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tenvelope: isSet(object.envelope) ? envelope_1.Envelope.fromJSON(object.envelope) : void 0,\n\t\t\t\tverifiers: globalThis.Array.isArray(object?.verifiers) ? object.verifiers.map((e) => verifier_1.Verifier.fromJSON(e)) : []\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.envelope !== void 0) obj.envelope = envelope_1.Envelope.toJSON(message.envelope);\n\t\t\tif (message.verifiers?.length) obj.verifiers = message.verifiers.map((e) => verifier_1.Verifier.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.DSSELogEntryV002 = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tpayloadHash: isSet(object.payloadHash) ? sigstore_common_1.HashOutput.fromJSON(object.payloadHash) : void 0,\n\t\t\t\tsignatures: globalThis.Array.isArray(object?.signatures) ? object.signatures.map((e) => verifier_1.Signature.fromJSON(e)) : []\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.payloadHash !== void 0) obj.payloadHash = sigstore_common_1.HashOutput.toJSON(message.payloadHash);\n\t\t\tif (message.signatures?.length) obj.signatures = message.signatures.map((e) => verifier_1.Signature.toJSON(e));\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/hashedrekord.js\nvar require_hashedrekord$1 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.HashedRekordLogEntryV002 = exports.HashedRekordRequestV002 = void 0;\n\tconst sigstore_common_1 = require_sigstore_common();\n\tconst verifier_1 = require_verifier$1();\n\texports.HashedRekordRequestV002 = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tdigest: isSet(object.digest) ? Buffer.from(bytesFromBase64(object.digest)) : Buffer.alloc(0),\n\t\t\t\tsignature: isSet(object.signature) ? verifier_1.Signature.fromJSON(object.signature) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.digest.length !== 0) obj.digest = base64FromBytes(message.digest);\n\t\t\tif (message.signature !== void 0) obj.signature = verifier_1.Signature.toJSON(message.signature);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.HashedRekordLogEntryV002 = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tdata: isSet(object.data) ? sigstore_common_1.HashOutput.fromJSON(object.data) : void 0,\n\t\t\t\tsignature: isSet(object.signature) ? verifier_1.Signature.fromJSON(object.signature) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.data !== void 0) obj.data = sigstore_common_1.HashOutput.toJSON(message.data);\n\t\t\tif (message.signature !== void 0) obj.signature = verifier_1.Signature.toJSON(message.signature);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction bytesFromBase64(b64) {\n\t\treturn Uint8Array.from(globalThis.Buffer.from(b64, \"base64\"));\n\t}\n\tfunction base64FromBytes(arr) {\n\t\treturn globalThis.Buffer.from(arr).toString(\"base64\");\n\t}\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/entry.js\nvar require_entry = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.CreateEntryRequest = exports.Spec = exports.Entry = void 0;\n\tconst dsse_1 = require_dsse$1();\n\tconst hashedrekord_1 = require_hashedrekord$1();\n\texports.Entry = {\n\t\tfromJSON(object) {\n\t\t\treturn {\n\t\t\t\tkind: isSet(object.kind) ? globalThis.String(object.kind) : \"\",\n\t\t\t\tapiVersion: isSet(object.apiVersion) ? globalThis.String(object.apiVersion) : \"\",\n\t\t\t\tspec: isSet(object.spec) ? exports.Spec.fromJSON(object.spec) : void 0\n\t\t\t};\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.kind !== \"\") obj.kind = message.kind;\n\t\t\tif (message.apiVersion !== \"\") obj.apiVersion = message.apiVersion;\n\t\t\tif (message.spec !== void 0) obj.spec = exports.Spec.toJSON(message.spec);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.Spec = {\n\t\tfromJSON(object) {\n\t\t\treturn { spec: isSet(object.hashedRekordV002) ? {\n\t\t\t\t$case: \"hashedRekordV002\",\n\t\t\t\thashedRekordV002: hashedrekord_1.HashedRekordLogEntryV002.fromJSON(object.hashedRekordV002)\n\t\t\t} : isSet(object.dsseV002) ? {\n\t\t\t\t$case: \"dsseV002\",\n\t\t\t\tdsseV002: dsse_1.DSSELogEntryV002.fromJSON(object.dsseV002)\n\t\t\t} : void 0 };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.spec?.$case === \"hashedRekordV002\") obj.hashedRekordV002 = hashedrekord_1.HashedRekordLogEntryV002.toJSON(message.spec.hashedRekordV002);\n\t\t\telse if (message.spec?.$case === \"dsseV002\") obj.dsseV002 = dsse_1.DSSELogEntryV002.toJSON(message.spec.dsseV002);\n\t\t\treturn obj;\n\t\t}\n\t};\n\texports.CreateEntryRequest = {\n\t\tfromJSON(object) {\n\t\t\treturn { spec: isSet(object.hashedRekordRequestV002) ? {\n\t\t\t\t$case: \"hashedRekordRequestV002\",\n\t\t\t\thashedRekordRequestV002: hashedrekord_1.HashedRekordRequestV002.fromJSON(object.hashedRekordRequestV002)\n\t\t\t} : isSet(object.dsseRequestV002) ? {\n\t\t\t\t$case: \"dsseRequestV002\",\n\t\t\t\tdsseRequestV002: dsse_1.DSSERequestV002.fromJSON(object.dsseRequestV002)\n\t\t\t} : void 0 };\n\t\t},\n\t\ttoJSON(message) {\n\t\t\tconst obj = {};\n\t\t\tif (message.spec?.$case === \"hashedRekordRequestV002\") obj.hashedRekordRequestV002 = hashedrekord_1.HashedRekordRequestV002.toJSON(message.spec.hashedRekordRequestV002);\n\t\t\telse if (message.spec?.$case === \"dsseRequestV002\") obj.dsseRequestV002 = dsse_1.DSSERequestV002.toJSON(message.spec.dsseRequestV002);\n\t\t\treturn obj;\n\t\t}\n\t};\n\tfunction isSet(value) {\n\t\treturn value !== null && value !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+protobuf-specs@0.5.1/node_modules/@sigstore/protobuf-specs/dist/rekor/v2/index.js\nvar require_v2 = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tvar __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\tvar desc = Object.getOwnPropertyDescriptor(m, k);\n\t\tif (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {\n\t\t\tenumerable: true,\n\t\t\tget: function() {\n\t\t\t\treturn m[k];\n\t\t\t}\n\t\t};\n\t\tObject.defineProperty(o, k2, desc);\n\t}) : (function(o, m, k, k2) {\n\t\tif (k2 === void 0) k2 = k;\n\t\to[k2] = m[k];\n\t}));\n\tvar __exportStar = exports && exports.__exportStar || function(m, exports$1) {\n\t\tfor (var p in m) if (p !== \"default\" && !Object.prototype.hasOwnProperty.call(exports$1, p)) __createBinding(exports$1, m, p);\n\t};\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\t__exportStar(require_dsse$1(), exports);\n\t__exportStar(require_entry(), exports);\n\t__exportStar(require_hashedrekord$1(), exports);\n\t__exportStar(require_verifier$1(), exports);\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/tlog/dsse.js\nvar require_dsse = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.DSSE_API_VERSION_V1 = void 0;\n\texports.verifyDSSETLogBody = verifyDSSETLogBody;\n\texports.verifyDSSETLogBodyV2 = verifyDSSETLogBodyV2;\n\tconst error_1 = require_error();\n\texports.DSSE_API_VERSION_V1 = \"0.0.1\";\n\tfunction verifyDSSETLogBody(tlogEntry, content) {\n\t\tswitch (tlogEntry.apiVersion) {\n\t\t\tcase exports.DSSE_API_VERSION_V1: return verifyDSSE001TLogBody(tlogEntry, content);\n\t\t\tdefault: throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\t\tmessage: `unsupported dsse version: ${tlogEntry.apiVersion}`\n\t\t\t});\n\t\t}\n\t}\n\tfunction verifyDSSETLogBodyV2(tlogEntry, content) {\n\t\tconst spec = tlogEntry.spec?.spec;\n\t\tif (!spec) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: `missing dsse spec`\n\t\t});\n\t\tswitch (spec.$case) {\n\t\t\tcase \"dsseV002\": return verifyDSSE002TLogBody(spec.dsseV002, content);\n\t\t\tdefault: throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\t\tmessage: `unsupported version: ${spec.$case}`\n\t\t\t});\n\t\t}\n\t}\n\tfunction verifyDSSE001TLogBody(tlogEntry, content) {\n\t\tif (tlogEntry.spec.signatures?.length !== 1) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"signature count mismatch\"\n\t\t});\n\t\tconst tlogSig = tlogEntry.spec.signatures[0].signature;\n\t\tif (!content.compareSignature(Buffer.from(tlogSig, \"base64\"))) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"tlog entry signature mismatch\"\n\t\t});\n\t\tconst tlogHash = tlogEntry.spec.payloadHash?.value || \"\";\n\t\tif (!content.compareDigest(Buffer.from(tlogHash, \"hex\"))) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"DSSE payload hash mismatch\"\n\t\t});\n\t}\n\tfunction verifyDSSE002TLogBody(spec, content) {\n\t\tif (spec.signatures?.length !== 1) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"signature count mismatch\"\n\t\t});\n\t\tconst tlogSig = spec.signatures[0].content;\n\t\tif (!content.compareSignature(tlogSig)) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"tlog entry signature mismatch\"\n\t\t});\n\t\tconst tlogHash = spec.payloadHash?.digest || Buffer.from(\"\");\n\t\tif (!content.compareDigest(tlogHash)) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"DSSE payload hash mismatch\"\n\t\t});\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/tlog/hashedrekord.js\nvar require_hashedrekord = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.HASHEDREKORD_API_VERSION_V1 = void 0;\n\texports.verifyHashedRekordTLogBody = verifyHashedRekordTLogBody;\n\texports.verifyHashedRekordTLogBodyV2 = verifyHashedRekordTLogBodyV2;\n\tconst error_1 = require_error();\n\texports.HASHEDREKORD_API_VERSION_V1 = \"0.0.1\";\n\tfunction verifyHashedRekordTLogBody(tlogEntry, content) {\n\t\tswitch (tlogEntry.apiVersion) {\n\t\t\tcase exports.HASHEDREKORD_API_VERSION_V1: return verifyHashedrekord001TLogBody(tlogEntry, content);\n\t\t\tdefault: throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\t\tmessage: `unsupported hashedrekord version: ${tlogEntry.apiVersion}`\n\t\t\t});\n\t\t}\n\t}\n\tfunction verifyHashedRekordTLogBodyV2(tlogEntry, content) {\n\t\tconst spec = tlogEntry.spec?.spec;\n\t\tif (!spec) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: `missing dsse spec`\n\t\t});\n\t\tswitch (spec.$case) {\n\t\t\tcase \"hashedRekordV002\": return verifyHashedrekord002TLogBody(spec.hashedRekordV002, content);\n\t\t\tdefault: throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\t\tmessage: `unsupported version: ${spec.$case}`\n\t\t\t});\n\t\t}\n\t}\n\tfunction verifyHashedrekord001TLogBody(tlogEntry, content) {\n\t\tconst tlogSig = tlogEntry.spec.signature.content || \"\";\n\t\tif (!content.compareSignature(Buffer.from(tlogSig, \"base64\"))) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"signature mismatch\"\n\t\t});\n\t\tconst tlogDigest = tlogEntry.spec.data.hash?.value || \"\";\n\t\tif (!content.compareSignedDigest(Buffer.from(tlogDigest, \"hex\"))) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"digest mismatch\"\n\t\t});\n\t}\n\tfunction verifyHashedrekord002TLogBody(spec, content) {\n\t\tconst tlogSig = spec.signature?.content || Buffer.from(\"\");\n\t\tif (!content.compareSignature(tlogSig)) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"signature mismatch\"\n\t\t});\n\t\tconst tlogHash = spec.data?.digest || Buffer.from(\"\");\n\t\tif (!content.compareSignedDigest(tlogHash)) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"digest mismatch\"\n\t\t});\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/tlog/intoto.js\nvar require_intoto = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifyIntotoTLogBody = verifyIntotoTLogBody;\n\tconst error_1 = require_error();\n\tfunction verifyIntotoTLogBody(tlogEntry, content) {\n\t\tswitch (tlogEntry.apiVersion) {\n\t\t\tcase \"0.0.2\": return verifyIntoto002TLogBody(tlogEntry, content);\n\t\t\tdefault: throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\t\tmessage: `unsupported intoto version: ${tlogEntry.apiVersion}`\n\t\t\t});\n\t\t}\n\t}\n\tfunction verifyIntoto002TLogBody(tlogEntry, content) {\n\t\tif (tlogEntry.spec.content.envelope.signatures?.length !== 1) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"signature count mismatch\"\n\t\t});\n\t\tconst tlogSig = base64Decode(tlogEntry.spec.content.envelope.signatures[0].sig);\n\t\tif (!content.compareSignature(Buffer.from(tlogSig, \"base64\"))) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"tlog entry signature mismatch\"\n\t\t});\n\t\tconst tlogHash = tlogEntry.spec.content.payloadHash?.value || \"\";\n\t\tif (!content.compareDigest(Buffer.from(tlogHash, \"hex\"))) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: \"DSSE payload hash mismatch\"\n\t\t});\n\t}\n\tfunction base64Decode(str) {\n\t\treturn Buffer.from(str, \"base64\").toString(\"utf-8\");\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/tlog/checkpoint.js\nvar require_checkpoint = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.LogCheckpoint = void 0;\n\texports.verifyCheckpoint = verifyCheckpoint;\n\tconst core_1 = require_dist$1();\n\tconst error_1 = require_error();\n\tconst CHECKPOINT_SEPARATOR = \"\\n\\n\";\n\tconst SIGNATURE_REGEX = /\\u2014 (\\S+) (\\S+)\\n/g;\n\tfunction verifyCheckpoint(entry, tlogs) {\n\t\tconst inclusionProof = entry.inclusionProof;\n\t\tconst signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope);\n\t\tconst checkpoint = LogCheckpoint.fromString(signedNote.note);\n\t\tif (!verifySignedNote(signedNote, tlogs)) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\tmessage: \"invalid checkpoint signature\"\n\t\t});\n\t\treturn checkpoint;\n\t}\n\tfunction verifySignedNote(signedNote, tlogs) {\n\t\tconst data = Buffer.from(signedNote.note, \"utf-8\");\n\t\treturn signedNote.signatures.some((signature) => {\n\t\t\tconst tlog = tlogs.find((tlog) => core_1.crypto.bufferEqual(tlog.logID.subarray(0, 4), signature.keyHint) && tlog.baseURL.match(signature.name));\n\t\t\tif (!tlog) return false;\n\t\t\treturn core_1.crypto.verify(data, tlog.publicKey, signature.signature);\n\t\t});\n\t}\n\tvar SignedNote = class SignedNote {\n\t\tnote;\n\t\tsignatures;\n\t\tconstructor(note, signatures) {\n\t\t\tthis.note = note;\n\t\t\tthis.signatures = signatures;\n\t\t}\n\t\tstatic fromString(envelope) {\n\t\t\tif (!envelope.includes(CHECKPOINT_SEPARATOR)) throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\t\tmessage: \"missing checkpoint separator\"\n\t\t\t});\n\t\t\tconst split = envelope.indexOf(CHECKPOINT_SEPARATOR);\n\t\t\tconst header = envelope.slice(0, split + 1);\n\t\t\tconst matches = envelope.slice(split + 2).matchAll(SIGNATURE_REGEX);\n\t\t\tconst signatures = Array.from(matches, (match) => {\n\t\t\t\tconst [, name, signature] = match;\n\t\t\t\tconst sigBytes = Buffer.from(signature, \"base64\");\n\t\t\t\tif (sigBytes.length < 5) throw new error_1.VerificationError({\n\t\t\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\t\t\tmessage: \"malformed checkpoint signature\"\n\t\t\t\t});\n\t\t\t\treturn {\n\t\t\t\t\tname,\n\t\t\t\t\tkeyHint: sigBytes.subarray(0, 4),\n\t\t\t\t\tsignature: sigBytes.subarray(4)\n\t\t\t\t};\n\t\t\t});\n\t\t\tif (signatures.length === 0) throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\t\tmessage: \"no signatures found in checkpoint\"\n\t\t\t});\n\t\t\treturn new SignedNote(header, signatures);\n\t\t}\n\t};\n\tvar LogCheckpoint = class LogCheckpoint {\n\t\torigin;\n\t\tlogSize;\n\t\tlogHash;\n\t\trest;\n\t\tconstructor(origin, logSize, logHash, rest) {\n\t\t\tthis.origin = origin;\n\t\t\tthis.logSize = logSize;\n\t\t\tthis.logHash = logHash;\n\t\t\tthis.rest = rest;\n\t\t}\n\t\tstatic fromString(note) {\n\t\t\tconst lines = note.trimEnd().split(\"\\n\");\n\t\t\tif (lines.length < 3) throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\t\tmessage: \"too few lines in checkpoint header\"\n\t\t\t});\n\t\t\tconst origin = lines[0];\n\t\t\treturn new LogCheckpoint(origin, BigInt(lines[1]), Buffer.from(lines[2], \"base64\"), lines.slice(3));\n\t\t}\n\t};\n\texports.LogCheckpoint = LogCheckpoint;\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/tlog/merkle.js\nvar require_merkle = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifyMerkleInclusion = verifyMerkleInclusion;\n\tconst core_1 = require_dist$1();\n\tconst error_1 = require_error();\n\tconst RFC6962_LEAF_HASH_PREFIX = Buffer.from([0]);\n\tconst RFC6962_NODE_HASH_PREFIX = Buffer.from([1]);\n\tfunction verifyMerkleInclusion(entry, checkpoint) {\n\t\tconst inclusionProof = entry.inclusionProof;\n\t\tconst logIndex = BigInt(inclusionProof.logIndex);\n\t\tconst treeSize = BigInt(checkpoint.logSize);\n\t\tif (logIndex < 0n || logIndex >= treeSize) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\tmessage: `invalid index: ${logIndex}`\n\t\t});\n\t\tconst { inner, border } = decompInclProof(logIndex, treeSize);\n\t\tif (inclusionProof.hashes.length !== inner + border) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\tmessage: \"invalid hash count\"\n\t\t});\n\t\tconst innerHashes = inclusionProof.hashes.slice(0, inner);\n\t\tconst borderHashes = inclusionProof.hashes.slice(inner);\n\t\tconst calculatedHash = chainBorderRight(chainInner(hashLeaf(entry.canonicalizedBody), innerHashes, logIndex), borderHashes);\n\t\tif (!core_1.crypto.bufferEqual(calculatedHash, checkpoint.logHash)) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_INCLUSION_PROOF_ERROR\",\n\t\t\tmessage: \"calculated root hash does not match inclusion proof\"\n\t\t});\n\t}\n\tfunction decompInclProof(index, size) {\n\t\tconst inner = innerProofSize(index, size);\n\t\treturn {\n\t\t\tinner,\n\t\t\tborder: onesCount(index >> BigInt(inner))\n\t\t};\n\t}\n\tfunction chainInner(seed, hashes, index) {\n\t\treturn hashes.reduce((acc, h, i) => {\n\t\t\tif (index >> BigInt(i) & BigInt(1)) return hashChildren(h, acc);\n\t\t\telse return hashChildren(acc, h);\n\t\t}, seed);\n\t}\n\tfunction chainBorderRight(seed, hashes) {\n\t\treturn hashes.reduce((acc, h) => hashChildren(h, acc), seed);\n\t}\n\tfunction innerProofSize(index, size) {\n\t\treturn bitLength(index ^ size - BigInt(1));\n\t}\n\tfunction onesCount(num) {\n\t\treturn num.toString(2).split(\"1\").length - 1;\n\t}\n\tfunction bitLength(n) {\n\t\tif (n === 0n) return 0;\n\t\treturn n.toString(2).length;\n\t}\n\tfunction hashChildren(left, right) {\n\t\treturn core_1.crypto.digest(\"sha256\", RFC6962_NODE_HASH_PREFIX, left, right);\n\t}\n\tfunction hashLeaf(leaf) {\n\t\treturn core_1.crypto.digest(\"sha256\", RFC6962_LEAF_HASH_PREFIX, leaf);\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/tlog/set.js\nvar require_set = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifyTLogSET = verifyTLogSET;\n\tconst core_1 = require_dist$1();\n\tconst error_1 = require_error();\n\tconst trust_1 = require_trust();\n\tfunction verifyTLogSET(entry, tlogs) {\n\t\tif (!(0, trust_1.filterTLogAuthorities)(tlogs, {\n\t\t\tlogID: entry.logId.keyId,\n\t\t\ttargetDate: /* @__PURE__ */ new Date(Number(entry.integratedTime) * 1e3)\n\t\t}).some((tlog) => {\n\t\t\tconst payload = toVerificationPayload(entry);\n\t\t\tconst data = Buffer.from(core_1.json.canonicalize(payload), \"utf8\");\n\t\t\tconst signature = entry.inclusionPromise.signedEntryTimestamp;\n\t\t\treturn core_1.crypto.verify(data, tlog.publicKey, signature);\n\t\t})) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_INCLUSION_PROMISE_ERROR\",\n\t\t\tmessage: \"inclusion promise could not be verified\"\n\t\t});\n\t}\n\tfunction toVerificationPayload(entry) {\n\t\tconst { integratedTime, logIndex, logId, canonicalizedBody } = entry;\n\t\treturn {\n\t\t\tbody: canonicalizedBody.toString(\"base64\"),\n\t\t\tintegratedTime: Number(integratedTime),\n\t\t\tlogIndex: Number(logIndex),\n\t\t\tlogID: logId.keyId.toString(\"hex\")\n\t\t};\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/tlog/index.js\nvar require_tlog = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.verifyTLogBody = verifyTLogBody;\n\texports.verifyTLogInclusion = verifyTLogInclusion;\n\tconst v2_1 = require_v2();\n\tconst error_1 = require_error();\n\tconst dsse_1 = require_dsse();\n\tconst hashedrekord_1 = require_hashedrekord();\n\tconst intoto_1 = require_intoto();\n\tconst checkpoint_1 = require_checkpoint();\n\tconst merkle_1 = require_merkle();\n\tconst set_1 = require_set();\n\tfunction verifyTLogBody(entry, sigContent) {\n\t\tconst { kind, version } = entry.kindVersion;\n\t\tconst body = JSON.parse(entry.canonicalizedBody.toString(\"utf8\"));\n\t\tif (kind !== body.kind || version !== body.apiVersion) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\tmessage: `kind/version mismatch - expected: ${kind}/${version}, received: ${body.kind}/${body.apiVersion}`\n\t\t});\n\t\tswitch (kind) {\n\t\t\tcase \"dsse\": if (version == dsse_1.DSSE_API_VERSION_V1) return (0, dsse_1.verifyDSSETLogBody)(body, sigContent);\n\t\t\telse {\n\t\t\t\tconst entryRekorV2 = v2_1.Entry.fromJSON(body);\n\t\t\t\treturn (0, dsse_1.verifyDSSETLogBodyV2)(entryRekorV2, sigContent);\n\t\t\t}\n\t\t\tcase \"intoto\": return (0, intoto_1.verifyIntotoTLogBody)(body, sigContent);\n\t\t\tcase \"hashedrekord\": if (version == hashedrekord_1.HASHEDREKORD_API_VERSION_V1) return (0, hashedrekord_1.verifyHashedRekordTLogBody)(body, sigContent);\n\t\t\telse {\n\t\t\t\tconst entryRekorV2 = v2_1.Entry.fromJSON(body);\n\t\t\t\treturn (0, hashedrekord_1.verifyHashedRekordTLogBodyV2)(entryRekorV2, sigContent);\n\t\t\t}\n\t\t\tdefault: throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_BODY_ERROR\",\n\t\t\t\tmessage: `unsupported kind: ${kind}`\n\t\t\t});\n\t\t}\n\t}\n\tfunction verifyTLogInclusion(entry, tlogAuthorities) {\n\t\tlet inclusionVerified = false;\n\t\tif (isTLogEntryWithInclusionPromise(entry)) {\n\t\t\t(0, set_1.verifyTLogSET)(entry, tlogAuthorities);\n\t\t\tinclusionVerified = true;\n\t\t}\n\t\tif (isTLogEntryWithInclusionProof(entry)) {\n\t\t\tconst checkpoint = (0, checkpoint_1.verifyCheckpoint)(entry, tlogAuthorities);\n\t\t\t(0, merkle_1.verifyMerkleInclusion)(entry, checkpoint);\n\t\t\tinclusionVerified = true;\n\t\t}\n\t\tif (!inclusionVerified) throw new error_1.VerificationError({\n\t\t\tcode: \"TLOG_MISSING_INCLUSION_ERROR\",\n\t\t\tmessage: \"inclusion could not be verified\"\n\t\t});\n\t}\n\tfunction isTLogEntryWithInclusionPromise(entry) {\n\t\treturn entry.inclusionPromise !== void 0;\n\t}\n\tfunction isTLogEntryWithInclusionProof(entry) {\n\t\treturn entry.inclusionProof !== void 0;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/verifier.js\nvar require_verifier = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.Verifier = void 0;\n\tconst util_1 = __require(\"util\");\n\tconst error_1 = require_error();\n\tconst key_1 = require_key();\n\tconst policy_1 = require_policy();\n\tconst timestamp_1 = require_timestamp();\n\tconst tlog_1 = require_tlog();\n\tvar Verifier = class {\n\t\ttrustMaterial;\n\t\toptions;\n\t\tconstructor(trustMaterial, options = {}) {\n\t\t\tthis.trustMaterial = trustMaterial;\n\t\t\tthis.options = {\n\t\t\t\tctlogThreshold: options.ctlogThreshold ?? 1,\n\t\t\t\ttlogThreshold: options.tlogThreshold ?? 1,\n\t\t\t\ttimestampThreshold: options.timestampThreshold ?? options.tsaThreshold ?? 1,\n\t\t\t\ttsaThreshold: 0\n\t\t\t};\n\t\t}\n\t\tverify(entity, policy) {\n\t\t\tconst timestamps = this.verifyTimestamps(entity);\n\t\t\tconst signer = this.verifySigningKey(entity, timestamps);\n\t\t\tthis.verifyTLogs(entity);\n\t\t\tthis.verifySignature(entity, signer);\n\t\t\tif (policy) this.verifyPolicy(policy, signer.identity || {});\n\t\t\treturn signer;\n\t\t}\n\t\tverifyTimestamps(entity) {\n\t\t\tconst timestamps = [];\n\t\t\tfor (const timestamp of entity.timestamps) switch (timestamp.$case) {\n\t\t\t\tcase \"timestamp-authority\":\n\t\t\t\t\ttimestamps.push((0, timestamp_1.getTSATimestamp)(timestamp.timestamp, entity.signature.signature, this.trustMaterial.timestampAuthorities));\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"transparency-log\": {\n\t\t\t\t\tconst result = (0, timestamp_1.getTLogTimestamp)(timestamp.tlogEntry);\n\t\t\t\t\tif (result) timestamps.push(result);\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (containsDupes(timestamps)) throw new error_1.VerificationError({\n\t\t\t\tcode: \"TIMESTAMP_ERROR\",\n\t\t\t\tmessage: \"duplicate timestamp\"\n\t\t\t});\n\t\t\tif (timestamps.length < this.options.timestampThreshold) throw new error_1.VerificationError({\n\t\t\t\tcode: \"TIMESTAMP_ERROR\",\n\t\t\t\tmessage: `expected ${this.options.timestampThreshold} timestamps, got ${timestamps.length}`\n\t\t\t});\n\t\t\treturn timestamps.map((t) => t.timestamp);\n\t\t}\n\t\tverifySigningKey({ key }, timestamps) {\n\t\t\tswitch (key.$case) {\n\t\t\t\tcase \"public-key\": return (0, key_1.verifyPublicKey)(key.hint, timestamps, this.trustMaterial);\n\t\t\t\tcase \"certificate\": {\n\t\t\t\t\tconst result = (0, key_1.verifyCertificate)(key.certificate, timestamps, this.trustMaterial);\n\t\t\t\t\t/* istanbul ignore next - no fixture */\n\t\t\t\t\tif (containsDupes(result.scts)) throw new error_1.VerificationError({\n\t\t\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\t\t\tmessage: \"duplicate SCT\"\n\t\t\t\t\t});\n\t\t\t\t\tif (result.scts.length < this.options.ctlogThreshold) throw new error_1.VerificationError({\n\t\t\t\t\t\tcode: \"CERTIFICATE_ERROR\",\n\t\t\t\t\t\tmessage: `expected ${this.options.ctlogThreshold} SCTs, got ${result.scts.length}`\n\t\t\t\t\t});\n\t\t\t\t\treturn result.signer;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tverifyTLogs({ signature: content, tlogEntries }) {\n\t\t\tlet tlogCount = 0;\n\t\t\ttlogEntries.forEach((entry) => {\n\t\t\t\ttlogCount++;\n\t\t\t\t(0, tlog_1.verifyTLogInclusion)(entry, this.trustMaterial.tlogs);\n\t\t\t\t(0, tlog_1.verifyTLogBody)(entry, content);\n\t\t\t});\n\t\t\tif (tlogCount < this.options.tlogThreshold) throw new error_1.VerificationError({\n\t\t\t\tcode: \"TLOG_ERROR\",\n\t\t\t\tmessage: `expected ${this.options.tlogThreshold} tlog entries, got ${tlogCount}`\n\t\t\t});\n\t\t}\n\t\tverifySignature(entity, signer) {\n\t\t\tif (!entity.signature.verifySignature(signer.key)) throw new error_1.VerificationError({\n\t\t\t\tcode: \"SIGNATURE_ERROR\",\n\t\t\t\tmessage: \"signature verification failed\"\n\t\t\t});\n\t\t}\n\t\tverifyPolicy(policy, identity) {\n\t\t\t/* istanbul ignore else */\n\t\t\tif (policy.subjectAlternativeName) (0, policy_1.verifySubjectAlternativeName)(policy.subjectAlternativeName, identity.subjectAlternativeName);\n\t\t\t/* istanbul ignore else */\n\t\t\tif (policy.extensions) (0, policy_1.verifyExtensions)(policy.extensions, identity.extensions);\n\t\t\t/* istanbul ignore if */\n\t\t\tif (policy.oids) (0, policy_1.verifyOIDs)(policy.oids, identity.oids);\n\t\t}\n\t};\n\texports.Verifier = Verifier;\n\tfunction containsDupes(arr) {\n\t\tfor (let i = 0; i < arr.length; i++) for (let j = i + 1; j < arr.length; j++) if ((0, util_1.isDeepStrictEqual)(arr[i], arr[j])) return true;\n\t\treturn false;\n\t}\n}));\n\n//#endregion\n//#region ../../node_modules/.pnpm/@sigstore+verify@4.1.0/node_modules/@sigstore/verify/dist/index.js\nvar require_dist = /* @__PURE__ */ __commonJSMin(((exports) => {\n\tObject.defineProperty(exports, \"__esModule\", { value: true });\n\texports.Verifier = exports.toTrustMaterial = exports.VerificationError = exports.PolicyError = exports.toSignedEntity = void 0;\n\t/* istanbul ignore file */\n\tvar bundle_1 = require_bundle();\n\tObject.defineProperty(exports, \"toSignedEntity\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn bundle_1.toSignedEntity;\n\t\t}\n\t});\n\tvar error_1 = require_error();\n\tObject.defineProperty(exports, \"PolicyError\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn error_1.PolicyError;\n\t\t}\n\t});\n\tObject.defineProperty(exports, \"VerificationError\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn error_1.VerificationError;\n\t\t}\n\t});\n\tvar trust_1 = require_trust();\n\tObject.defineProperty(exports, \"toTrustMaterial\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn trust_1.toTrustMaterial;\n\t\t}\n\t});\n\tvar verifier_1 = require_verifier();\n\tObject.defineProperty(exports, \"Verifier\", {\n\t\tenumerable: true,\n\t\tget: function() {\n\t\t\treturn verifier_1.Verifier;\n\t\t}\n\t});\n}));\n\n//#endregion\n//#region src/repository.ts\nvar import_dist$2 = require_dist();\nvar import_dist = require_dist$2();\nvar import_dist$1 = require_dist$3();\nconst TRAILING_SLASHES_RE = /\\/+$/;\n/** Canonicalize a signed source repository URL, or return null when it is unsafe. */\nfunction canonicalizeRepositoryUrl(value) {\n\ttry {\n\t\tconst url = new URL(value);\n\t\tif (url.protocol !== \"https:\" || url.username || url.password || url.search || url.hash || url.port) return null;\n\t\tlet path = url.pathname;\n\t\tif (path !== \"/\") path = path.replace(TRAILING_SLASHES_RE, \"\") || \"/\";\n\t\treturn `https://${url.hostname.toLowerCase()}${path}`;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n//#endregion\n//#region src/trust-roots/sigstore-public-good-v1.json\nvar sigstore_public_good_v1_default = {\n\tmediaType: \"application/vnd.dev.sigstore.trustedroot+json;version=0.1\",\n\ttlogs: [{\n\t\t\"baseUrl\": \"https://rekor.sigstore.dev\",\n\t\t\"hashAlgorithm\": \"SHA2_256\",\n\t\t\"publicKey\": {\n\t\t\t\"rawBytes\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==\",\n\t\t\t\"keyDetails\": \"PKIX_ECDSA_P256_SHA_256\",\n\t\t\t\"validFor\": { \"start\": \"2021-01-12T11:53:27Z\" }\n\t\t},\n\t\t\"logId\": { \"keyId\": \"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=\" }\n\t}, {\n\t\t\"baseUrl\": \"https://log2025-1.rekor.sigstore.dev\",\n\t\t\"hashAlgorithm\": \"SHA2_256\",\n\t\t\"publicKey\": {\n\t\t\t\"rawBytes\": \"MCowBQYDK2VwAyEAt8rlp1knGwjfbcXAYPYAkn0XiLz1x8O4t0YkEhie244=\",\n\t\t\t\"keyDetails\": \"PKIX_ED25519\",\n\t\t\t\"validFor\": { \"start\": \"2025-09-23T00:00:00Z\" }\n\t\t},\n\t\t\"logId\": { \"keyId\": \"zxGZFVvd0FEmjR8WrFwMdcAJ9vtaY/QXf44Y1wUeP6A=\" }\n\t}],\n\tcertificateAuthorities: [{\n\t\t\"subject\": {\n\t\t\t\"organization\": \"sigstore.dev\",\n\t\t\t\"commonName\": \"sigstore\"\n\t\t},\n\t\t\"uri\": \"https://fulcio.sigstore.dev\",\n\t\t\"certChain\": { \"certificates\": [{ \"rawBytes\": \"MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==\" }] },\n\t\t\"validFor\": {\n\t\t\t\"start\": \"2021-03-07T03:20:29Z\",\n\t\t\t\"end\": \"2022-12-31T23:59:59.999Z\"\n\t\t}\n\t}, {\n\t\t\"subject\": {\n\t\t\t\"organization\": \"sigstore.dev\",\n\t\t\t\"commonName\": \"sigstore\"\n\t\t},\n\t\t\"uri\": \"https://fulcio.sigstore.dev\",\n\t\t\"certChain\": { \"certificates\": [{ \"rawBytes\": \"MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow=\" }, { \"rawBytes\": \"MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ\" }] },\n\t\t\"validFor\": { \"start\": \"2022-04-13T20:06:15Z\" }\n\t}],\n\tctlogs: [{\n\t\t\"baseUrl\": \"https://ctfe.sigstore.dev/test\",\n\t\t\"hashAlgorithm\": \"SHA2_256\",\n\t\t\"publicKey\": {\n\t\t\t\"rawBytes\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==\",\n\t\t\t\"keyDetails\": \"PKIX_ECDSA_P256_SHA_256\",\n\t\t\t\"validFor\": {\n\t\t\t\t\"start\": \"2021-03-14T00:00:00Z\",\n\t\t\t\t\"end\": \"2022-10-31T23:59:59.999Z\"\n\t\t\t}\n\t\t},\n\t\t\"logId\": { \"keyId\": \"CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I=\" }\n\t}, {\n\t\t\"baseUrl\": \"https://ctfe.sigstore.dev/2022\",\n\t\t\"hashAlgorithm\": \"SHA2_256\",\n\t\t\"publicKey\": {\n\t\t\t\"rawBytes\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==\",\n\t\t\t\"keyDetails\": \"PKIX_ECDSA_P256_SHA_256\",\n\t\t\t\"validFor\": { \"start\": \"2022-10-20T00:00:00Z\" }\n\t\t},\n\t\t\"logId\": { \"keyId\": \"3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4=\" }\n\t}],\n\ttimestampAuthorities: [{\n\t\t\"subject\": {\n\t\t\t\"organization\": \"sigstore.dev\",\n\t\t\t\"commonName\": \"sigstore-tsa-selfsigned\"\n\t\t},\n\t\t\"uri\": \"https://timestamp.sigstore.dev/api/v1/timestamp\",\n\t\t\"certChain\": { \"certificates\": [{ \"rawBytes\": \"MIICEDCCAZagAwIBAgIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ra2Z8hKNig2T9kFjCAToGG30jky+WQv3BzL+mKvh1SKNR/UwuwsfNCg4sryoYAd8E6isovVA3M4aoNdm9QDi50Z8nTEyvqgfDPtTIwXItfiW/AFf1V7uwkbkAoj0xxco2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFIn9eUOHz9BlRsMCRscsc1t9tOsDMB8GA1UdIwQYMBaAFJjsAe9/u1H/1JUeb4qImFMHic6/MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2gAMGUCMDtpsV/6KaO0qyF/UMsX2aSUXKQFdoGTptQGc0ftq1csulHPGG6dsmyMNd3JB+G3EQIxAOajvBcjpJmKb4Nv+2Taoj8Uc5+b6ih6FXCCKraSqupe07zqswMcXJTe1cExvHvvlw==\" }, { \"rawBytes\": \"MIIB9zCCAXygAwIBAgIUV7f0GLDOoEzIh8LXSW80OJiUp14wCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQUQNtfRT/ou3YATa6wB/kKTe70cfJwyRIBovMnt8RcJph/COE82uyS6FmppLLL1VBPGcPfpQPYJNXzWwi8icwhKQ6W/Qe2h3oebBb2FHpwNJDqo+TMaC/tdfkv/ElJB72jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSY7AHvf7tR/9SVHm+KiJhTB4nOvzAKBggqhkjOPQQDAwNpADBmAjEAwGEGrfGZR1cen1R8/DTVMI943LssZmJRtDp/i7SfGHmGRP6gRbuj9vOK3b67Z0QQAjEAuT2H673LQEaHTcyQSZrkp4mX7WwkmF+sVbkYY5mXN+RMH13KUEHHOqASaemYWK/E\" }] },\n\t\t\"validFor\": { \"start\": \"2025-07-04T00:00:00Z\" }\n\t}]\n};\n\n//#endregion\n//#region src/provenance.ts\nconst STATEMENT_TYPE = \"https://in-toto.io/Statement/v1\";\nconst PREDICATE_TYPE = \"https://slsa.dev/provenance/v1\";\nconst GITHUB_WORKFLOW_BUILD_TYPE = \"https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1\";\nconst GITHUB_OIDC_ISSUER = \"https://token.actions.githubusercontent.com\";\nconst DSSE_PAYLOAD_TYPE = \"application/vnd.in-toto+json\";\nconst FULCIO_OID_PREFIX = \"1.3.6.1.4.1.57264.1.\";\nconst GIT_COMMIT_RE = /^[0-9a-f]{40}$/;\nconst GITHUB_WORKFLOW_PATH_RE = /^\\.github\\/workflows\\/.+\\.ya?ml$/;\nconst DECIMAL_RE = /^[1-9][0-9]*$/;\nconst BASE64_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;\nconst HEX_RE = /^[0-9a-f]+$/;\nconst REGEX_META_RE = /[\\\\^$.*+?()[\\]{}|]/g;\nconst SUPPORTED_SUBJECT_DIGESTS = new Map([\n\t[\"sha256\", 32],\n\t[\"sha384\", 48],\n\t[\"sha512\", 64]\n]);\nconst decoder = new TextDecoder(\"utf-8\", {\n\tfatal: true,\n\tignoreBOM: false\n});\nconst verifier = new import_dist$2.Verifier((0, import_dist$2.toTrustMaterial)(import_dist$1.TrustedRoot.fromJSON(sigstore_public_good_v1_default)), {\n\ttlogThreshold: 1,\n\tctlogThreshold: 1,\n\ttimestampThreshold: 1\n});\nvar GitHubProvenanceVerifier = class {\n\tasync verify(input) {\n\t\ttry {\n\t\t\tconst snapshot = snapshotInput(input);\n\t\t\tif (!(await verifyMultihash(snapshot.document, snapshot.reference.checksum)).success) return unverifiable();\n\t\t\tconst serializedBundle = parseJson(snapshot.document);\n\t\t\tconst expected = validateStatement(parseStatement(serializedBundle), snapshot);\n\t\t\tconst bundle = (0, import_dist.bundleFromJSON)(serializedBundle);\n\t\t\tvalidateSignerIdentity(verifier.verify((0, import_dist$2.toSignedEntity)(bundle), {\n\t\t\t\tsubjectAlternativeName: exactRegexPattern(snapshot.reference.builderId),\n\t\t\t\textensions: { issuer: GITHUB_OIDC_ISSUER }\n\t\t\t}).identity, expected);\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tvalue: {\n\t\t\t\t\tpredicateType: PREDICATE_TYPE,\n\t\t\t\t\tartifactDigest: expected.artifactDigest,\n\t\t\t\t\tsourceRepository: expected.repository,\n\t\t\t\t\tbuilderId: expected.builderId,\n\t\t\t\t\trepositoryId: expected.repositoryId,\n\t\t\t\t\tworkflowRef: expected.workflowRef,\n\t\t\t\t\tcommitSha: expected.commitSha,\n\t\t\t\t\tinvocationId: expected.invocationId\n\t\t\t\t}\n\t\t\t};\n\t\t} catch {\n\t\t\treturn unverifiable();\n\t\t}\n\t}\n};\nfunction snapshotInput(input) {\n\treturn {\n\t\tdocument: new Uint8Array(input.document),\n\t\treference: {\n\t\t\tbuilderId: input.reference.builderId,\n\t\t\tchecksum: input.reference.checksum,\n\t\t\tpredicateType: input.reference.predicateType,\n\t\t\tsourceRepository: input.reference.sourceRepository,\n\t\t\turl: input.reference.url\n\t\t},\n\t\tartifactDigest: new Uint8Array(input.artifactDigest),\n\t\tartifactDigests: input.artifactDigests?.map((digest) => new Uint8Array(digest)),\n\t\tprofileRepository: input.profileRepository\n\t};\n}\nfunction exactRegexPattern(value) {\n\treturn `^${value.replace(REGEX_META_RE, \"\\\\$&\")}$`;\n}\nfunction parseJson(document) {\n\treturn JSON.parse(decoder.decode(document));\n}\nfunction parseStatement(serializedBundle) {\n\tconst bundle = requireObject(serializedBundle);\n\tconst mediaType = requireString(bundle.mediaType);\n\tif (mediaType !== import_dist.BUNDLE_V03_MEDIA_TYPE && mediaType !== import_dist.BUNDLE_V03_LEGACY_MEDIA_TYPE) throw new Error(\"Unsupported Sigstore bundle format\");\n\tif (\"messageSignature\" in bundle || !(\"dsseEnvelope\" in bundle)) throw new Error(\"Only DSSE Sigstore bundles are supported\");\n\tconst envelope = requireObject(bundle.dsseEnvelope);\n\tif (requireString(envelope.payloadType) !== DSSE_PAYLOAD_TYPE) throw new Error(\"Unsupported DSSE payload type\");\n\tconst statement = requireObject(JSON.parse(decoder.decode(decodeBase64(requireString(envelope.payload)))));\n\tconst statementType = requireString(statement._type);\n\tconst predicateType = requireString(statement.predicateType);\n\tif (statementType !== STATEMENT_TYPE || predicateType !== PREDICATE_TYPE || !Array.isArray(statement.subject)) throw new Error(\"Unsupported provenance statement\");\n\treturn {\n\t\t_type: statementType,\n\t\tsubject: statement.subject,\n\t\tpredicateType,\n\t\tpredicate: requireObject(statement.predicate)\n\t};\n}\nfunction validateStatement(statement, input) {\n\tif (input.reference.predicateType !== PREDICATE_TYPE) throw new Error(\"Provenance predicate reference mismatch\");\n\tconst artifactDigest = validateArtifactSubject(statement.subject, [input.artifactDigest, ...input.artifactDigests ?? []]);\n\tconst profileRepository = requireRepository(input.profileRepository);\n\tconst referenceRepository = requireRepository(input.reference.sourceRepository);\n\tconst buildDefinition = requireObject(statement.predicate.buildDefinition);\n\tif (requireString(buildDefinition.buildType) !== GITHUB_WORKFLOW_BUILD_TYPE) throw new Error(\"Unsupported SLSA build type\");\n\tconst workflow = requireObject(requireObject(buildDefinition.externalParameters).workflow);\n\tconst attestedRepository = requireRepository(requireString(workflow.repository));\n\tif (attestedRepository !== referenceRepository || referenceRepository !== profileRepository) throw new Error(\"Repository identity mismatch\");\n\tconst workflowPath = requireString(workflow.path);\n\tconst workflowRef = requireString(workflow.ref);\n\tif (!GITHUB_WORKFLOW_PATH_RE.test(workflowPath)) throw new Error(\"Unsupported GitHub workflow path\");\n\tif (!workflowRef.startsWith(\"refs/\")) throw new Error(\"Invalid GitHub workflow ref\");\n\tconst builderId = `${attestedRepository}/${workflowPath}@${workflowRef}`;\n\tif (builderId !== input.reference.builderId) throw new Error(\"Workflow identity mismatch\");\n\tconst repositoryId = requireDecimalString(requireObject(requireObject(buildDefinition.internalParameters).github).repository_id);\n\tconst runDetails = requireObject(statement.predicate.runDetails);\n\tconst invocationId = requireHttpsUrl(requireString(requireObject(runDetails.metadata).invocationId));\n\tif (requireString(requireObject(runDetails.builder).id) !== \"https://github.com/actions/runner/github-hosted\") throw new Error(\"Unsupported GitHub Actions runner class\");\n\tconst dependencies = buildDefinition.resolvedDependencies;\n\tif (!Array.isArray(dependencies)) throw new Error(\"Missing resolved dependency\");\n\tconst expectedUri = `git+${attestedRepository}@${workflowRef}`;\n\tconst matching = dependencies.filter((dependency) => requireString(requireObject(dependency).uri) === expectedUri);\n\tif (matching.length !== 1) throw new Error(\"Ambiguous resolved dependency\");\n\tconst commitSha = requireString(requireObject(requireObject(matching[0]).digest).gitCommit);\n\tif (!GIT_COMMIT_RE.test(commitSha)) throw new Error(\"Invalid Git commit digest\");\n\treturn {\n\t\tartifactDigest,\n\t\trepository: attestedRepository,\n\t\tbuilderId,\n\t\tworkflowRef,\n\t\tcommitSha,\n\t\trepositoryId,\n\t\tinvocationId\n\t};\n}\nfunction validateArtifactSubject(subjects, artifactDigests) {\n\tfor (const value of subjects) {\n\t\tconst digest = requireObject(requireObject(value).digest);\n\t\tfor (const [algorithm, expectedLength] of SUPPORTED_SUBJECT_DIGESTS) {\n\t\t\tif (!(algorithm in digest)) continue;\n\t\t\tconst bytes = decodeHex(requireString(digest[algorithm]));\n\t\t\tif (bytes.byteLength !== expectedLength) throw new Error(\"Invalid subject digest length\");\n\t\t\tconst matched = artifactDigests.find((candidate) => compareDigestBytes(bytes, candidate));\n\t\t\tif (matched) return new Uint8Array(matched);\n\t\t}\n\t}\n\tthrow new Error(\"Artifact digest mismatch\");\n}\nfunction validateSignerIdentity(identity, expected) {\n\tif (identity?.subjectAlternativeName !== expected.builderId || identity.extensions?.issuer !== GITHUB_OIDC_ISSUER) throw new Error(\"Certificate identity mismatch\");\n\tconst oids = identity.oids ?? [];\n\tconst issuer = readRequiredOid(oids, 8);\n\tconst buildSignerUri = readRequiredOid(oids, 9);\n\tconst buildSignerDigest = readRequiredOid(oids, 10);\n\tconst sourceRepository = requireRepository(readRequiredOid(oids, 12));\n\tconst sourceDigest = readRequiredOid(oids, 13);\n\tconst sourceRef = readRequiredOid(oids, 14);\n\tconst repositoryId = readRequiredOid(oids, 15);\n\tconst buildConfigUri = readRequiredOid(oids, 18);\n\tconst buildConfigDigest = readRequiredOid(oids, 19);\n\tconst invocationId = readRequiredOid(oids, 21);\n\tif (issuer !== GITHUB_OIDC_ISSUER || buildSignerUri !== expected.builderId || buildConfigUri !== expected.builderId || buildSignerDigest !== expected.commitSha || sourceDigest !== expected.commitSha || buildConfigDigest !== expected.commitSha || sourceRepository !== expected.repository || sourceRef !== expected.workflowRef || repositoryId !== expected.repositoryId || invocationId !== expected.invocationId) throw new Error(\"Certificate and predicate identity mismatch\");\n}\nfunction readRequiredOid(oids, suffix) {\n\tconst expectedOid = `${FULCIO_OID_PREFIX}${suffix}`;\n\tconst matches = oids.filter((pair) => pair.oid?.id.join(\".\") === expectedOid);\n\tif (matches.length !== 1) throw new Error(\"Missing or duplicate Fulcio identity OID\");\n\tconst value = matches[0]?.value;\n\tif (!value) throw new Error(\"Missing Fulcio identity OID value\");\n\treturn decodeDerUtf8String(value);\n}\nfunction decodeDerUtf8String(value) {\n\tif (value[0] !== 12 || value.byteLength < 2) throw new Error(\"Malformed DER UTF8String\");\n\tconst firstLength = value[1];\n\tif (firstLength === void 0) throw new Error(\"Malformed DER UTF8String\");\n\tlet offset = 2;\n\tlet length;\n\tif (firstLength < 128) length = firstLength;\n\telse {\n\t\tconst lengthBytes = firstLength & 127;\n\t\tif (lengthBytes === 0 || lengthBytes > 2 || value.byteLength < 2 + lengthBytes) throw new Error(\"Malformed DER UTF8String length\");\n\t\tlength = 0;\n\t\tfor (let index = 0; index < lengthBytes; index += 1) length = length * 256 + (value[offset + index] ?? 0);\n\t\tif (length < 128 || lengthBytes === 2 && length < 256) throw new Error(\"Non-canonical DER UTF8String length\");\n\t\toffset += lengthBytes;\n\t}\n\tif (length === 0 || offset + length !== value.byteLength) throw new Error(\"Malformed DER UTF8String value\");\n\treturn decoder.decode(value.subarray(offset));\n}\nfunction requireRepository(value) {\n\tconst repository = canonicalizeRepositoryUrl(value);\n\tif (!repository) throw new Error(\"Invalid repository URL\");\n\treturn repository;\n}\nfunction requireHttpsUrl(value) {\n\tconst url = new URL(value);\n\tif (url.protocol !== \"https:\" || url.username || url.password || url.hash || url.port || url.toString() !== value) throw new Error(\"Invalid HTTPS URL\");\n\treturn value;\n}\nfunction requireDecimalString(value) {\n\tconst result = requireString(value);\n\tif (!DECIMAL_RE.test(result)) throw new Error(\"Invalid decimal identity\");\n\treturn result;\n}\nfunction requireObject(value) {\n\tif (!isRecord$1(value)) throw new Error(\"Expected an object\");\n\treturn value;\n}\nfunction isRecord$1(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction requireString(value) {\n\tif (typeof value !== \"string\" || value.length === 0) throw new Error(\"Expected a string\");\n\treturn value;\n}\nfunction decodeBase64(value) {\n\tif (!BASE64_RE.test(value)) throw new Error(\"Invalid base64\");\n\treturn Uint8Array.from(atob(value), (character) => character.charCodeAt(0));\n}\nfunction decodeHex(value) {\n\tif (!HEX_RE.test(value) || value.length % 2 !== 0) throw new Error(\"Invalid hexadecimal digest\");\n\treturn Uint8Array.from(value.match(/.{2}/g) ?? [], (byte) => Number.parseInt(byte, 16));\n}\nfunction unverifiable() {\n\treturn verificationError(\"PROVENANCE_UNVERIFIABLE\", \"The supplied provenance could not be verified.\");\n}\n\n//#endregion\n//#region src/records.ts\nconst DEFAULT_POLICY = {\n\trequireProvenance: false,\n\tconfirmation: \"escalation-only\",\n\tapprovers: []\n};\n/** Validate signed profile/release records without evaluating provenance evidence. */\nasync function inspectPackageReleaseRecords(input) {\n\tconst profile = await parseLexicon(PackageProfile.mainSchema, input.profile);\n\tif (!profile) return failed(\"PROFILE_LEXICON_INVALID\", \"The package profile is malformed.\");\n\tif (!isPluginSlug(input.package)) return failed(\"RELEASE_PACKAGE_MISMATCH\", \"The expected package slug is invalid.\");\n\tconst expectedProfileId = `at://${input.publisherDid}/${NSID.packageProfile}/${input.package}`;\n\tif (profile.id !== expectedProfileId || profile.slug !== void 0 && profile.slug !== input.package) return failed(\"PROFILE_ID_MISMATCH\", \"The profile does not match its authoritative record identity.\");\n\tif (profile.extensions === void 0) return failed(\"PROFILE_EXTENSION_MISSING\", \"The signed repository extension is absent.\");\n\tif (!isRecord(profile.extensions)) return failed(\"PROFILE_EXTENSION_INVALID\", \"The signed repository extension is malformed.\");\n\tconst rawProfileExtension = profile.extensions[NSID.packageProfileExtension];\n\tif (rawProfileExtension === void 0) return failed(\"PROFILE_EXTENSION_MISSING\", \"The signed repository extension is absent.\");\n\tconst profileExtension = await parseLexicon(PackageProfileExtension.mainSchema, rawProfileExtension);\n\tif (!profileExtension) return failed(\"PROFILE_EXTENSION_INVALID\", \"The signed repository extension is malformed.\");\n\tconst repository = canonicalizeRepositoryUrl(profileExtension.repository);\n\tif (!repository || repository !== profileExtension.repository) return failed(\"PROFILE_REPOSITORY_INVALID\", \"The signed repository anchor is not canonical HTTPS.\");\n\tconst policy = normalizePolicy(profileExtension.releasePolicy);\n\tif (!policy) return failed(\"PROFILE_POLICY_INVALID\", \"The signed release policy is invalid.\");\n\tconst release = await parseLexicon(PackageRelease.mainSchema, input.release);\n\tif (!release) return failed(\"RELEASE_LEXICON_INVALID\", \"The package release is malformed.\");\n\tif (release.package !== input.package) return failed(\"RELEASE_PACKAGE_MISMATCH\", \"The release package does not match the requested package.\");\n\tif (!isComparablePluginVersion(release.version)) return failed(\"RELEASE_VERSION_INVALID\", \"The release version is not canonical semver.\");\n\tif (release.version !== input.version) return failed(\"RELEASE_VERSION_MISMATCH\", \"The release version does not match the requested version.\");\n\tif (input.rkey !== `${input.package}:${release.version}`) return failed(\"RELEASE_RKEY_MISMATCH\", \"The release record key does not match package and version.\");\n\tconst artifactFailure = validateArtifacts(release);\n\tif (artifactFailure) return failed(artifactFailure.code, artifactFailure.message);\n\tconst authFailure = unsupportedAuth(release);\n\tif (authFailure) return failed(authFailure.code, authFailure.message, \"not-checked\", authFailure.details);\n\tif (release.extensions === void 0) return failed(\"RELEASE_EXTENSION_MISSING\", \"The EmDash release extension is absent.\");\n\tif (!isRecord(release.extensions)) return failed(\"RELEASE_EXTENSION_INVALID\", \"The EmDash release extension is malformed.\");\n\tconst rawReleaseExtension = release.extensions[NSID.packageReleaseExtension];\n\tif (rawReleaseExtension === void 0) return failed(\"RELEASE_EXTENSION_MISSING\", \"The EmDash release extension is absent.\");\n\tconst releaseExtension = await parseLexicon(PackageReleaseExtension.mainSchema, rawReleaseExtension);\n\tif (!releaseExtension) return failed(\"RELEASE_EXTENSION_INVALID\", \"The EmDash release extension is malformed.\");\n\treturn {\n\t\tsuccess: true,\n\t\tstatus: \"inspected\",\n\t\tcode: \"VERIFIED\",\n\t\treasons: [{\n\t\t\tcode: \"VERIFIED\",\n\t\t\tmessage: \"The signed package records are valid.\"\n\t\t}],\n\t\tprovenance: { status: \"not-checked\" },\n\t\tvalue: {\n\t\t\tprofile,\n\t\t\trelease,\n\t\t\tprofileExtension,\n\t\t\treleaseExtension,\n\t\t\trepository,\n\t\t\tpolicy,\n\t\t\tdeclaredAccess: canonicalizeDeclaredAccess(releaseExtension.declaredAccess)\n\t\t}\n\t};\n}\nasync function verifyPackageReleaseRecordsInternal(input, defaultVerifier) {\n\tconst inspection = await inspectPackageReleaseRecords(input);\n\tif (!inspection.success) return inspection;\n\tconst context = inspection.value;\n\tconst { policy, release, releaseExtension, repository } = context;\n\tif (!releaseExtension.provenance) {\n\t\tif (policy.requireProvenance) return failed(\"PROVENANCE_REQUIRED\", \"The signed policy requires provenance, but the release has none.\", \"absent-required\");\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tstatus: \"unattested\",\n\t\t\tcode: \"PROVENANCE_ABSENT_OPTIONAL\",\n\t\t\treasons: [{\n\t\t\t\tcode: \"PROVENANCE_ABSENT_OPTIONAL\",\n\t\t\t\tmessage: \"The release has no provenance and the signed policy permits it.\"\n\t\t\t}],\n\t\t\tprovenance: { status: \"absent-optional\" },\n\t\t\tvalue: context\n\t\t};\n\t}\n\tif (!input.provenance) return failed(\"PROVENANCE_UNVERIFIABLE\", \"The release supplies provenance, but no verification evidence was provided.\", \"failed\");\n\tconst artifactChecksum = decodeMultihash(release.artifacts.package.checksum);\n\tif (!artifactChecksum.success) return failed(artifactChecksum.error.code, artifactChecksum.error.message, \"failed\");\n\tif (!compareDigestBytes(input.provenance.artifactDigest, artifactChecksum.value.digest)) return failed(\"CHECKSUM_MISMATCH\", \"The artifact digest does not match the signed package checksum.\", \"failed\");\n\tconst verifier = input.provenance.verifier ?? defaultVerifier;\n\tif (!verifier) return failed(\"PROVENANCE_UNVERIFIABLE\", \"The supplied provenance verifier is unavailable.\", \"failed\");\n\tlet provenanceResult;\n\ttry {\n\t\tprovenanceResult = await verifier.verify({\n\t\t\tdocument: input.provenance.document,\n\t\t\treference: releaseExtension.provenance,\n\t\t\tartifactDigest: input.provenance.artifactDigest,\n\t\t\tartifactDigests: input.provenance.artifactDigests,\n\t\t\tprofileRepository: repository\n\t\t});\n\t} catch {\n\t\treturn failed(\"PROVENANCE_UNVERIFIABLE\", \"The supplied provenance could not be verified.\", \"failed\");\n\t}\n\tif (!provenanceResult.success) return failed(provenanceResult.error.code, provenanceResult.error.message, \"failed\");\n\treturn {\n\t\tsuccess: true,\n\t\tstatus: \"verified\",\n\t\tcode: \"VERIFIED\",\n\t\treasons: [{\n\t\t\tcode: \"VERIFIED\",\n\t\t\tmessage: \"The signed records and provenance are valid.\"\n\t\t}],\n\t\tprovenance: { status: \"verified\" },\n\t\tvalue: {\n\t\t\t...context,\n\t\t\tverifiedProvenance: provenanceResult.value\n\t\t}\n\t};\n}\nfunction verifyPackageReleaseRecordsWithDefaultVerifier(input, defaultVerifier) {\n\treturn verifyPackageReleaseRecordsInternal(input, defaultVerifier);\n}\nfunction normalizePolicy(value) {\n\tif (!value) return {\n\t\t...DEFAULT_POLICY,\n\t\tapprovers: []\n\t};\n\tconst confirmation = value.confirmation ?? DEFAULT_POLICY.confirmation;\n\tif (!isConfirmation(confirmation)) return null;\n\tconst approvers = value.approvers ?? [];\n\tif (new Set(approvers).size !== approvers.length) return null;\n\treturn {\n\t\trequireProvenance: value.requireProvenance ?? false,\n\t\tconfirmation,\n\t\tapprovers: [...approvers]\n\t};\n}\nfunction isConfirmation(value) {\n\treturn value === \"always\" || value === \"escalation-only\";\n}\nfunction isComparablePluginVersion(value) {\n\tif (!isPluginVersion(value)) return false;\n\tconst prereleaseSeparator = value.indexOf(\"-\");\n\treturn value.slice(0, prereleaseSeparator === -1 ? void 0 : prereleaseSeparator).split(\".\").every((component) => Number.isSafeInteger(Number(component)));\n}\nfunction failed(code, message, provenance = \"not-checked\", details) {\n\treturn {\n\t\tsuccess: false,\n\t\tstatus: \"failed\",\n\t\tcode,\n\t\treasons: [{\n\t\t\tcode,\n\t\t\tmessage\n\t\t}],\n\t\tprovenance: { status: provenance },\n\t\t...details === void 0 ? {} : { details }\n\t};\n}\nfunction validateArtifacts(release) {\n\tconst artifacts = [\n\t\trelease.artifacts.package,\n\t\trelease.artifacts.icon,\n\t\trelease.artifacts.banner,\n\t\t...release.artifacts.screenshots ?? []\n\t];\n\tfor (const value of artifacts) {\n\t\tif (value === void 0) continue;\n\t\tif (!isRecord(value)) return {\n\t\t\tcode: \"RELEASE_LEXICON_INVALID\",\n\t\t\tmessage: \"A release artifact is malformed.\"\n\t\t};\n\t\tconst hasUrl = typeof value.url === \"string\" && value.url.length > 0;\n\t\tconst blob = value.blob;\n\t\tconst hasBlob = isRecord(blob);\n\t\tif (!hasUrl && !hasBlob) return {\n\t\t\tcode: \"RELEASE_ARTIFACT_SOURCE_MISSING\",\n\t\t\tmessage: \"Every release artifact must provide a blob or URL.\"\n\t\t};\n\t\tif (hasBlob) {\n\t\t\tconst ref = blob.ref;\n\t\t\tconst cid = isRecord(ref) ? ref.$link : void 0;\n\t\t\tif (typeof cid !== \"string\") return {\n\t\t\t\tcode: \"BLOB_REF_INVALID\",\n\t\t\t\tmessage: \"The blob reference CID is malformed.\"\n\t\t\t};\n\t\t\tconst expected = multihashFromBlobCid(cid);\n\t\t\tif (!expected.success) return expected.error;\n\t\t\tif (value.checksum !== expected.value) return {\n\t\t\t\tcode: \"CHECKSUM_MISMATCH\",\n\t\t\t\tmessage: \"The artifact checksum does not match its blob reference CID.\"\n\t\t\t};\n\t\t}\n\t}\n\treturn null;\n}\nfunction unsupportedAuth(release) {\n\tconst gated = [\n\t\trelease.artifacts.package,\n\t\trelease.artifacts.icon,\n\t\trelease.artifacts.banner,\n\t\t...release.artifacts.screenshots ?? []\n\t].some((artifact) => artifact?.requiresAuth === true);\n\tif (release.auth === void 0 && !gated) return null;\n\tconst details = unsupportedAuthDetails(release.auth);\n\treturn {\n\t\tcode: \"AUTH_METHOD_UNSUPPORTED\",\n\t\tmessage: UNSUPPORTED_AUTH_MESSAGE,\n\t\t...details === void 0 ? {} : { details }\n\t};\n}\nasync function parseLexicon(schema, value) {\n\tconst result = await schema[\"~standard\"].validate(value);\n\treturn result.issues ? null : result.value;\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n//#endregion\n//#region src/records-default.ts\n/** Validate signed profile/release records and apply the complete provenance policy. */\nfunction verifyPackageReleaseRecords(input) {\n\treturn verifyPackageReleaseRecordsWithDefaultVerifier(input, new GitHubProvenanceVerifier());\n}\n\n//#endregion\nexport { DEFAULT_FETCH_LIMITS, GitHubProvenanceVerifier, MAX_BUNDLE_COMPRESSED_BYTES, MAX_BUNDLE_DECOMPRESSED_BYTES, MAX_BUNDLE_FILE_BYTES, MAX_BUNDLE_FILE_COUNT, MAX_BUNDLE_SIZE, MAX_BUNDLE_TAR_ENTRY_COUNT, VERIFICATION_ERROR_CODES, canonicalizeRepositoryUrl, compareDigestBytes, computeArtifactDigestCandidates, computeMultihash, decodeMultihash, fetchReleaseArtifact, fetchVerifiedResource, inspectPackageReleaseRecords, multihashFromBlobCid, recordScopedBlobCacheUrl, recordScopedImageCacheUrl, resolvePublisherPdsEndpoint, validatePluginBundle, verifyMultihash, verifyPackageReleaseRecords };\n//# sourceMappingURL=index.js.map","import type {\n\tDirectPdsDidDocumentResolver,\n\tDirectPdsProfileRecord,\n\tDirectPdsReadErrorCode,\n\tDirectPdsReleaseRecord,\n} from \"@emdash-cms/registry-client/direct-pds\";\nimport { DirectPdsClient, DirectPdsReadError } from \"@emdash-cms/registry-client/direct-pds\";\nimport {\n\tfetchVerifiedResource,\n\tinspectPackageReleaseRecords,\n\tverifyMultihash,\n\tverifyPackageReleaseRecords,\n\ttype FetchImplementation,\n\ttype HostnameResolver,\n\ttype ProvenanceVerifier,\n\ttype RecordInspectionReport,\n\ttype RecordVerificationFailure,\n\ttype RecordVerificationReport,\n\ttype VerificationErrorCode,\n} from \"@emdash-cms/registry-verification\";\n\nimport { cloudflareDohResolver, ssrfSafeFetch } from \"../security/ssrf.js\";\n\nconst MAX_PROVENANCE_BYTES = 5 * 1024 * 1024;\n\nexport type AuthoritativeRecordErrorCode =\n\t| DirectPdsReadErrorCode\n\t| VerificationErrorCode\n\t| \"AUTHORITATIVE_RECORD_READ_FAILED\";\n\nexport interface AuthoritativeRecordReadOptions {\n\tfetch?: typeof fetch;\n\tdidDocumentResolver?: DirectPdsDidDocumentResolver;\n\tprovenanceFetch?: FetchImplementation;\n\tresolveHostname?: HostnameResolver;\n\tprovenanceVerifier?: ProvenanceVerifier;\n\tartifactDigests?: readonly Uint8Array[];\n}\n\nexport interface VerifiedAuthoritativeRecords {\n\tpublisherDid: string;\n\tpackageSlug: string;\n\tversion: string;\n\tprofile: DirectPdsProfileRecord;\n\trelease: DirectPdsReleaseRecord;\n\tinspection: Extract<RecordInspectionReport, { success: true }>;\n}\n\nexport type VerifiedAuthoritativeReleaseReport = Extract<\n\tRecordVerificationReport,\n\t{ success: true }\n>;\n\nexport type AuthoritativeRecordReadResult =\n\t| { success: true; value: VerifiedAuthoritativeRecords }\n\t| {\n\t\t\tsuccess: false;\n\t\t\terror: { code: AuthoritativeRecordErrorCode; message: string };\n\t  };\n\nexport type AuthoritativeRecordReader = (\n\tpublisherDid: string,\n\tpackageSlug: string,\n\tversion: string,\n\toptions?: AuthoritativeRecordReadOptions,\n) => Promise<AuthoritativeRecordReadResult>;\n\nexport async function readAuthoritativePackageRelease(\n\tpublisherDid: string,\n\tpackageSlug: string,\n\tversion: string,\n\toptions: AuthoritativeRecordReadOptions = {},\n): Promise<AuthoritativeRecordReadResult> {\n\ttry {\n\t\tconst client = new DirectPdsClient({\n\t\t\tdid: publisherDid,\n\t\t\tfetch: options.fetch ?? guardedFetch,\n\t\t\tdidDocumentResolver: options.didDocumentResolver,\n\t\t});\n\t\tconst [profile, release] = await Promise.all([\n\t\t\tclient.getPackageProfile(packageSlug),\n\t\t\tclient.getPackageRelease(packageSlug, version),\n\t\t]);\n\t\tconst inspection = await inspectPackageReleaseRecords({\n\t\t\tpublisherDid,\n\t\t\tpackage: packageSlug,\n\t\t\tversion,\n\t\t\trkey: release.rkey,\n\t\t\tprofile: profile.value,\n\t\t\trelease: release.value,\n\t\t});\n\t\tif (!inspection.success) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: inspection.code,\n\t\t\t\t\tmessage: inspection.reasons[0]?.message ?? \"The signed package records are invalid.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: { publisherDid, packageSlug, version, profile, release, inspection },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof DirectPdsReadError) {\n\t\t\treturn { success: false, error: { code: error.code, message: error.message } };\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORITATIVE_RECORD_READ_FAILED\",\n\t\t\t\tmessage: \"The publisher's signed package records could not be verified.\",\n\t\t\t},\n\t\t};\n\t}\n}\n\nexport async function verifyAuthoritativePackageRelease(\n\trecords: VerifiedAuthoritativeRecords,\n\tartifactDigest: Uint8Array,\n\toptions: AuthoritativeRecordReadOptions = {},\n): Promise<RecordVerificationReport> {\n\tconst context = records.inspection.value;\n\tconst provenanceReference = context.releaseExtension.provenance;\n\tlet document: Uint8Array | undefined;\n\tif (provenanceReference) {\n\t\tconst fetched = await fetchVerifiedResource(provenanceReference.url, {\n\t\t\tfetch: options.provenanceFetch ?? defaultProvenanceFetch,\n\t\t\tresolveHostname: options.resolveHostname ?? cloudflareDohResolver,\n\t\t\tmaxBytes: MAX_PROVENANCE_BYTES,\n\t\t});\n\t\tif (!fetched.success) {\n\t\t\treturn verificationFailure(fetched.error.code, fetched.error.message);\n\t\t}\n\t\tconst checksum = await verifyMultihash(fetched.value.bytes, provenanceReference.checksum);\n\t\tif (!checksum.success) {\n\t\t\treturn verificationFailure(checksum.error.code, checksum.error.message);\n\t\t}\n\t\tdocument = fetched.value.bytes;\n\t}\n\n\treturn verifyPackageReleaseRecords({\n\t\tpublisherDid: records.publisherDid,\n\t\tpackage: records.packageSlug,\n\t\tversion: records.version,\n\t\trkey: records.release.rkey,\n\t\tprofile: records.profile.value,\n\t\trelease: records.release.value,\n\t\tprovenance:\n\t\t\tdocument === undefined\n\t\t\t\t? undefined\n\t\t\t\t: {\n\t\t\t\t\t\tdocument,\n\t\t\t\t\t\tartifactDigest,\n\t\t\t\t\t\tartifactDigests: options.artifactDigests,\n\t\t\t\t\t\tverifier: options.provenanceVerifier,\n\t\t\t\t\t},\n\t});\n}\n\nfunction verificationFailure(\n\tcode: VerificationErrorCode,\n\tmessage: string,\n): RecordVerificationFailure {\n\treturn {\n\t\tsuccess: false,\n\t\tstatus: \"failed\",\n\t\tcode,\n\t\treasons: [{ code, message }],\n\t\tprovenance: { status: \"failed\" },\n\t};\n}\n\nconst guardedFetch: typeof fetch = async (input, init) => {\n\tconst url = input instanceof Request ? input.url : String(input);\n\treturn ssrfSafeFetch(url, init, { httpsOnly: true });\n};\n\nconst defaultProvenanceFetch: FetchImplementation = (input, init) => globalThis.fetch(input, init);\n","/**\n * Plugin identifier helpers for the experimental decentralized plugin\n * registry.\n *\n * Registry plugins are addressed by `(publisher_did, slug)`, but the\n * EmDash runtime threads a single `pluginId: string` through every\n * install primitive (R2 storage keys, `PluginStateRepository`,\n * `syncMarketplacePlugins`, sandbox cache keys). Rather than refactor\n * everything to carry a composite identifier, we normalize the registry\n * tuple to an opaque content-addressed id that satisfies the existing\n * `validatePluginIdentifier` shape (`/^[a-z][a-z0-9_-]*$/`).\n *\n * The normalized id is:\n *\n *   `r_` + base32-encoded SHA-256(publisher_did + \"\\n\" + slug), truncated.\n *\n * Properties:\n *\n *   - Deterministic. The same `(publisher, slug)` always produces the\n *     same id, so re-resolving an installed plugin's metadata against\n *     the aggregator is a straightforward lookup keyed by the columns\n *     stored alongside `plugin_id` in `plugin_states`.\n *   - Collision-resistant. 80 bits of truncated hash; a 50% birthday\n *     collision happens around 2^40 distinct plugins, well beyond what\n *     this registry will ever index.\n *   - R2-safe. Lowercase alphanumerics + underscore (no hyphens), no\n *     `:` or `/`. Existing sandbox cache keys (`${pluginId}:${version}`)\n *     keep working because the id contains no `:`.\n *   - Syntactically distinct from typical marketplace plugin ids: the\n *     `r_` prefix plus exactly 16 base32 characters is unlikely to be\n *     chosen as a marketplace id. Not formally guaranteed by the\n *     validator -- marketplace ids may begin with `r_` and contain\n *     hyphens -- so the install handler also performs an explicit\n *     pre-existing-row check at the derived id and rejects any cross-\n *     source collision (`PLUGIN_ID_COLLISION`).\n *\n * Reverse lookup (id → publisher + slug) requires the `plugin_states`\n * row -- the hash is one-way. That's intentional: any code path that\n * needs the human-meaningful pair already has the state row in hand.\n */\n\n/** Length (in base32 characters) of the truncated hash portion of the id. */\nconst HASH_LENGTH = 16;\n\n/** Total expected length of a registry plugin id. */\nexport const REGISTRY_PLUGIN_ID_LENGTH = 2 /* \"r_\" */ + HASH_LENGTH;\n\n/**\n * Regex matching a well-formed registry plugin id. Used by call sites\n * that need to distinguish registry installs from marketplace installs\n * without consulting the `source` column on `plugin_states`.\n *\n * The base32 alphabet here uses RFC 4648 lowercase without padding,\n * matching {@link base32Encode}'s output.\n */\nexport const REGISTRY_PLUGIN_ID_PATTERN = /^r_[a-z2-7]{16}$/;\n\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\n\n/**\n * RFC 4648 base32 encoding without padding, lowercase. Implemented inline\n * rather than depending on a multibase library because (a) we only need\n * lowercase base32 here, (b) we need it to run identically in workerd,\n * Node, and the browser, and (c) the implementation is fewer lines than\n * the import statement would be.\n */\nfunction base32Encode(bytes: Uint8Array): string {\n\tlet bits = 0;\n\tlet value = 0;\n\tlet out = \"\";\n\tfor (const byte of bytes) {\n\t\tvalue = (value << 8) | byte;\n\t\tbits += 8;\n\t\twhile (bits >= 5) {\n\t\t\tbits -= 5;\n\t\t\tout += BASE32_ALPHABET[(value >>> bits) & 0x1f];\n\t\t}\n\t}\n\tif (bits > 0) {\n\t\tout += BASE32_ALPHABET[(value << (5 - bits)) & 0x1f];\n\t}\n\treturn out;\n}\n\n/**\n * Derive the normalized plugin id for a registry-published plugin.\n *\n * Throws if either input is empty or whitespace-only -- a missing DID\n * or slug is always a programming error in the install path, not a\n * recoverable runtime condition.\n */\nexport async function makeRegistryPluginId(publisherDid: string, slug: string): Promise<string> {\n\tconst did = publisherDid.trim();\n\tconst s = slug.trim();\n\tif (!did) throw new Error(\"makeRegistryPluginId: publisherDid is required\");\n\tif (!s) throw new Error(\"makeRegistryPluginId: slug is required\");\n\n\t// `\\n` separator avoids ambiguity: no canonical did:plc / did:web form\n\t// contains a literal newline, so `(\"a\", \"b\\nc\")` cannot hash to the\n\t// same bytes as `(\"a\\nb\", \"c\")`.\n\tconst input = `${did}\\n${s}`;\n\tconst hashBuffer = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(input));\n\tconst encoded = base32Encode(new Uint8Array(hashBuffer));\n\treturn `r_${encoded.slice(0, HASH_LENGTH)}`;\n}\n\n/**\n * Return whether `pluginId` is a well-formed registry plugin id.\n *\n * This is a syntactic check, not a database lookup -- it answers\n * \"could this id have come from `makeRegistryPluginId`?\", not \"is this\n * plugin installed?\".\n */\nexport function isRegistryPluginId(pluginId: string): boolean {\n\treturn REGISTRY_PLUGIN_ID_PATTERN.test(pluginId);\n}\n","interface VersionedRecordLabel {\n\tval?: string;\n\turi?: string;\n\tcid?: string;\n\tneg?: boolean;\n\texp?: string;\n}\n\nexport function hasCurrentRecordLabel(\n\tlabels: readonly VersionedRecordLabel[],\n\tvalue: string,\n\trecord: { uri: string; cid: string },\n\tnow = Date.now(),\n): boolean {\n\treturn labels.some((label) => {\n\t\tif (\n\t\t\tlabel.val !== value ||\n\t\t\tlabel.uri !== record.uri ||\n\t\t\tlabel.cid !== record.cid ||\n\t\t\tlabel.neg === true\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\t\tif (label.exp === undefined) return true;\n\t\tconst expiresAt = Date.parse(label.exp);\n\t\treturn Number.isFinite(expiresAt) && expiresAt > now;\n\t});\n}\n","/**\n * Registry installs use aggregator results only for discovery and moderation\n * metadata. The handler reads profile and release records from the publisher's\n * PDS, verifies their repository proofs, then validates the bundle checksum,\n * manifest, policy, and consent before storing or activating executable code.\n * Applicable labels can block installation but cannot supply any verified\n * record, checksum, permission, or executable byte.\n */\n\nimport { ClientResponseError, ClientValidationError } from \"@atcute/client\";\nimport type { Did } from \"@atcute/lexicons\";\nimport { canonicalizeDeclaredAccess } from \"@emdash-cms/plugin-types\";\nimport type { CanonicalDeclaredAccess } from \"@emdash-cms/plugin-types\";\nimport { checkEnvCompatibility, findSkippedEnvConstraints } from \"@emdash-cms/registry-client/env\";\nimport type { HostEnv } from \"@emdash-cms/registry-client/env\";\nimport { evaluateRegistryReleaseWithdrawal } from \"@emdash-cms/registry-client/withdrawal\";\nimport { NSID } from \"@emdash-cms/registry-lexicons\";\nimport {\n\tfetchReleaseArtifact,\n\ttype ReleaseArtifactReference,\n} from \"@emdash-cms/registry-verification/artifact\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport type { SandboxRunner } from \"../../plugins/sandbox/types.js\";\nimport { PluginStateRepository } from \"../../plugins/state.js\";\nimport {\n\tremoveAllPluginIndexes,\n\tsyncDeclaredStorageIndexes,\n} from \"../../plugins/storage-indexes.js\";\nimport { declaredAccessToCapabilities } from \"../../plugins/types.js\";\nimport type { DeclaredAccess } from \"../../plugins/types.js\";\nimport { fetchRegistryArtifactUrl } from \"../../registry/artifact-fetch.js\";\nimport {\n\tvalidateRegistryArtifact,\n\ttype RegistryArtifactVerificationCode,\n} from \"../../registry/artifact-verification.js\";\nimport {\n\treadAuthoritativePackageRelease,\n\tverifyAuthoritativePackageRelease,\n\ttype AuthoritativeRecordErrorCode,\n\ttype AuthoritativeRecordReader,\n\ttype AuthoritativeRecordReadOptions,\n\ttype VerifiedAuthoritativeReleaseReport,\n\ttype VerifiedAuthoritativeRecords,\n} from \"../../registry/authoritative-records.js\";\nimport {\n\tcanonicalCapabilitiesForDriftCheck,\n\tcoerceRegistryConfig,\n\tparseDurationSeconds,\n\treleaseExemptFromMinimumAge,\n\tvalidateAggregatorUrl,\n} from \"../../registry/config.js\";\nimport { makeRegistryPluginId } from \"../../registry/plugin-id.js\";\nimport { hasCurrentRecordLabel } from \"../../registry/record-labels.js\";\nimport type { RegistryConfigInput } from \"../../registry/types.js\";\nimport { resolveAndValidateExternalUrlTarget } from \"../../security/ssrf.js\";\nimport { EmDashStorageError } from \"../../storage/types.js\";\nimport type { Storage } from \"../../storage/types.js\";\nimport type { ApiResult } from \"../types.js\";\nimport {\n\tdeleteBundleFromR2,\n\tdiffCapabilities,\n\tdiffRouteVisibility,\n\tloadBundleFromR2,\n\tstoreBundleInR2,\n} from \"./marketplace.js\";\n\nexport { assertSafeArtifactUrl } from \"../../registry/artifact-fetch.js\";\n\n/**\n * Whether two `declaredAccess` blocks grant exactly the same enforced access --\n * the same capabilities AND the same host allow-list. Both are lowered through\n * the canonical converter so that constraint content (`allowedHosts`), not just\n * the capability set, is part of the comparison. The capability-set consent\n * gate is blind to host scope; this is what keeps a bundle from being installed\n * with a wider (or simply different) host allow-list than its published record\n * advertised and the user consented to.\n */\nexport function enforcedAccessEqual(a: DeclaredAccess, b: DeclaredAccess): boolean {\n\tconst aa = declaredAccessToCapabilities(a);\n\tconst bb = declaredAccessToCapabilities(b);\n\treturn (\n\t\tJSON.stringify(aa.capabilities.toSorted()) === JSON.stringify(bb.capabilities.toSorted()) &&\n\t\tJSON.stringify(aa.allowedHosts.toSorted()) === JSON.stringify(bb.allowedHosts.toSorted())\n\t);\n}\n\nfunction verifiedAccessEqual(a: CanonicalDeclaredAccess, b: DeclaredAccess): boolean {\n\treturn JSON.stringify(a) === JSON.stringify(canonicalizeDeclaredAccess(b));\n}\n\n// ── Types ──────────────────────────────────────────────────────────\n\nexport interface RegistryInstallInput {\n\t/**\n\t * Publisher DID. Required. The browser is expected to resolve\n\t * `(handle, slug) → (did, slug)` via the aggregator's\n\t * `resolvePackage` XRPC before posting -- the server then skips that\n\t * round-trip and looks up the package directly.\n\t *\n\t * Passing DID rather than handle here means installs work for\n\t * publishers whose handle the aggregator couldn't resolve at view\n\t * time (handle is \"best-effort\" per the lexicon -- absent for any\n\t * publisher whose DID document didn't resolve cleanly at ingest).\n\t */\n\tdid: string;\n\t/** Package slug (rkey of the publisher's profile record). */\n\tslug: string;\n\t/** Optional explicit version. When omitted, the aggregator's latest. */\n\tversion?: string;\n\t/**\n\t * Capabilities the admin acknowledged in the consent dialog, lifted\n\t * from the release record's `declaredAccess` block. Compared against\n\t * the bundle's `manifest.declaredAccess` to detect drift between\n\t * what the admin agreed to and what the bundle actually requests.\n\t *\n\t * When omitted, drift detection is skipped -- callers that don't\n\t * surface a consent UI before posting (e.g. CI scripts) opt out.\n\t */\n\tacknowledgedDeclaredAccess?: unknown;\n\tacknowledgedMcpTools?: unknown;\n\tacknowledgedProfileCid?: string;\n\tacknowledgedReleaseCid?: string;\n}\n\nexport interface RegistryInstallResult {\n\t/** Hashed, opaque plugin id used everywhere in the runtime. */\n\tpluginId: string;\n\t/** Publisher DID resolved from the handle. */\n\tpublisherDid: string;\n\t/** Publisher slug (== the registry slug). */\n\tslug: string;\n\t/** Installed version. */\n\tversion: string;\n\t/** Capabilities surfaced from the bundle's manifest. */\n\tcapabilities: string[];\n\tdeclaredAccess: DeclaredAccess;\n\tmcpTools: RegistryMcpConsentTool[];\n\tverification: RegistryRecordVerificationSummary;\n}\n\nexport interface RegistryMcpConsentTool {\n\tname: string;\n\tdescription: string;\n\troute: string;\n\tpermission: string;\n\tdestructive: boolean;\n}\n\nexport interface RegistryRecordVerificationSummary {\n\tprofileCid: string;\n\treleaseCid: string;\n\tprovenance: \"verified\" | \"absent-optional\";\n\tpolicy: {\n\t\trequireProvenance: boolean;\n\t\tconfirmation: \"escalation-only\" | \"always\";\n\t\tapprovers: string[];\n\t};\n}\n\n// ── Helpers ────────────────────────────────────────────────────────\n\nexport function registryArtifactError(\n\tcode: RegistryArtifactVerificationCode,\n\tmessage: string,\n\toperation: \"install\" | \"update\",\n): ApiResult<never> {\n\tlet apiCode: string;\n\tswitch (code) {\n\t\tcase \"BUNDLE_ID_MISMATCH\":\n\t\t\tapiCode = operation === \"install\" ? \"MANIFEST_ID_MISMATCH\" : \"BUNDLE_IDENTITY_MISMATCH\";\n\t\t\tbreak;\n\t\tcase \"BUNDLE_VERSION_MISMATCH\":\n\t\t\tapiCode = operation === \"install\" ? \"MANIFEST_VERSION_MISMATCH\" : code;\n\t\t\tbreak;\n\t\tcase \"CHECKSUM_MISMATCH\":\n\t\tcase \"INVALID_MULTIHASH\":\n\t\tcase \"UNSUPPORTED_MULTIHASH\":\n\t\t\tapiCode = \"CHECKSUM_MISMATCH\";\n\t\t\tbreak;\n\t\tcase \"FETCH_FAILED\":\n\t\tcase \"HOST_REJECTED\":\n\t\tcase \"REDIRECT_LIMIT_EXCEEDED\":\n\t\tcase \"REDIRECT_LOCATION_MISSING\":\n\t\tcase \"RESOURCE_STATUS_ERROR\":\n\t\tcase \"RESOURCE_TIMEOUT\":\n\t\t\tapiCode = operation === \"install\" ? \"INSTALL_FAILED\" : \"UPDATE_FAILED\";\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tapiCode = \"INVALID_BUNDLE\";\n\t}\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode: apiCode,\n\t\t\tmessage,\n\t\t\tdetails: { verificationCode: code },\n\t\t},\n\t};\n}\n\nfunction registryRecordError(\n\tcode: AuthoritativeRecordErrorCode,\n\tmessage: string,\n): ApiResult<never> {\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode: \"RECORD_VERIFICATION_FAILED\",\n\t\t\tmessage,\n\t\t\tdetails: { verificationCode: code },\n\t\t},\n\t};\n}\n\nfunction recordConsentError(\n\tinput: { profileCid?: string; releaseCid?: string },\n\trecords: VerifiedAuthoritativeRecords,\n): ApiResult<never> | null {\n\tif (!input.profileCid || !input.releaseCid) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"RECORD_CONSENT_REQUIRED\",\n\t\t\t\tmessage: \"Verify the signed package records before confirming this action.\",\n\t\t\t},\n\t\t};\n\t}\n\tif (input.profileCid !== records.profile.cid || input.releaseCid !== records.release.cid) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"RECORD_VERIFICATION_DRIFT\",\n\t\t\t\tmessage: \"The signed package records changed after review. Verify them again.\",\n\t\t\t},\n\t\t};\n\t}\n\treturn null;\n}\n\nfunction recordVerificationSummary(\n\trecords: VerifiedAuthoritativeRecords,\n\treport: VerifiedAuthoritativeReleaseReport,\n): RegistryRecordVerificationSummary {\n\treturn {\n\t\tprofileCid: records.profile.cid,\n\t\treleaseCid: records.release.cid,\n\t\tprovenance: report.provenance.status,\n\t\tpolicy: report.value.policy,\n\t};\n}\n\n/**\n * Bytes-per-artifact cap on the gzipped tarball we'll download before\n * decompression. RFC 0001 caps a sandboxed plugin bundle at 256 KiB\n * decompressed (see `MAX_BUNDLE_SIZE` in cli/commands/bundle-utils.ts);\n * gzip on a mix of JSON manifest + JS code typically gives 0.3-0.6\n * ratio, so compressed bundles are well under 200 KiB in practice.\n * 512 KiB leaves margin for unusual file mixes that compress poorly\n * while still rejecting anything that's obviously not a legitimate\n * plugin bundle.\n */\nconst MAX_ARTIFACT_BYTES = 512 * 1024;\n\n/**\n * Maximum number of HTTP redirects followed during artifact download.\n * Each hop is independently URL-validated, so a malicious server cannot\n * redirect through a series of allowed-looking origins to reach a\n * forbidden one.\n */\nconst MAX_REDIRECTS = 5;\n\n/**\n * Wall-clock cap on any single artifact fetch attempt (per URL).\n * Defends against slow-loris artifact sources that accept the connection but\n * never finish sending headers or body.\n */\nconst ARTIFACT_FETCH_TIMEOUT_MS = 15_000;\n\n/**\n * Total wall-clock budget for the artifact-download phase across all\n * advertised caches, the publisher PDS, and the declared URL. Even with the\n * per-URL timeout, unavailable sources could otherwise tie up the install request for\n * minutes; this caps total time at a budget interactive admins can\n * tolerate. Tuned so a fast happy path takes <1s of budget per\n * attempt and a worst case still completes in under a minute.\n */\nconst ARTIFACT_TOTAL_BUDGET_MS = 45_000;\n\n/**\n * Per-request timeout applied to every aggregator XRPC call\n * (`resolvePackage`, `getLatestRelease`, `listReleases`). Matches the\n * per-URL artifact-fetch cap. Without this, a slow-loris aggregator\n * can stall the install before the artifact phase even starts.\n */\nconst AGGREGATOR_REQUEST_TIMEOUT_MS = 15_000;\n\n/**\n * Total wall-clock budget for the aggregator-discovery phase\n * (resolve + selected-release lookup). Mirrors the artifact-download\n * budget. Worst case with the pinned-version path's 20-page cap is\n * 20 + 1 calls; capping the total ensures any one stalled call\n * still bounds the whole phase.\n */\nconst AGGREGATOR_TOTAL_BUDGET_MS = 30_000;\n\nclass RegistryArtifactFetchError extends Error {\n\tconstructor(\n\t\treadonly code: RegistryArtifactVerificationCode,\n\t\tmessage: string,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"RegistryArtifactFetchError\";\n\t}\n}\n\n/** Build a fetch function that enforces a per-request and per-budget timeout. */\nfunction timedFetch(totalDeadline: number): typeof fetch {\n\treturn (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n\t\tconst now = Date.now();\n\t\tconst remaining = Math.max(0, totalDeadline - now);\n\t\tif (remaining === 0) {\n\t\t\treturn Promise.reject(new Error(\"Aggregator request budget exhausted\"));\n\t\t}\n\t\tconst timeout = Math.min(AGGREGATOR_REQUEST_TIMEOUT_MS, remaining);\n\t\tconst controller = new AbortController();\n\t\tconst timer = setTimeout(() => controller.abort(), timeout);\n\t\tconst callerSignal = init?.signal;\n\t\tif (callerSignal) {\n\t\t\tif (callerSignal.aborted) controller.abort(callerSignal.reason);\n\t\t\telse callerSignal.addEventListener(\"abort\", () => controller.abort(callerSignal.reason));\n\t\t}\n\t\treturn fetch(input, { ...init, signal: controller.signal }).finally(() => {\n\t\t\tclearTimeout(timer);\n\t\t});\n\t};\n}\n\nasync function fetchArtifact(\n\tartifactCaches: readonly unknown[],\n\tartifact: ReleaseArtifactReference,\n\trecord: {\n\t\tdid: string;\n\t\tcollection: string;\n\t\trkey: string;\n\t\tcid: string;\n\t},\n\tauth?: unknown,\n): Promise<Uint8Array> {\n\tconst result = await fetchReleaseArtifact(\n\t\t{\n\t\t\tartifact,\n\t\t\trecord,\n\t\t\tartifactCaches,\n\t\t\t...(auth === undefined ? {} : { auth }),\n\t\t},\n\t\t{\n\t\t\tfetch: async (url, init) => {\n\t\t\t\tif (!init.signal) throw new Error(\"Registry artifact fetch requires an abort signal\");\n\t\t\t\treturn fetchRegistryArtifactUrl(url.href, {\n\t\t\t\t\tsignal: init.signal,\n\t\t\t\t\tmaxResponseBytes: MAX_ARTIFACT_BYTES,\n\t\t\t\t});\n\t\t\t},\n\t\t\tresolveHostname: async (hostname) =>\n\t\t\t\t(await resolveAndValidateExternalUrlTarget(`https://${hostname}`)).addresses,\n\t\t\tallowHttpLocalhost: import.meta.env.DEV,\n\t\t\theaderTimeoutMs: ARTIFACT_FETCH_TIMEOUT_MS,\n\t\t\ttotalTimeoutMs: ARTIFACT_TOTAL_BUDGET_MS,\n\t\t\tmaxBytes: MAX_ARTIFACT_BYTES,\n\t\t\tmaxRedirects: MAX_REDIRECTS,\n\t\t},\n\t);\n\tif (!result.success) {\n\t\tthrow new RegistryArtifactFetchError(result.error.code, result.error.message);\n\t}\n\treturn result.value.bytes;\n}\n\n/**\n * The shape of a single env-compatibility failure returned to the admin in\n * the `ENV_INCOMPATIBLE` error's `details`.\n */\ninterface EnvIncompatibleError {\n\tcode: \"ENV_INCOMPATIBLE\";\n\tmessage: string;\n\tdetails: { requires: Record<string, string>; host: HostEnv };\n}\n\n/**\n * Gate a release's `requires` constraints against the running host\n * environment. `requires` is the lexicon-`unknown` value off the signed\n * release record — never trust its shape; `checkEnvCompatibility` guards it.\n *\n * Returns `null` when every advertised constraint is satisfied (or there are\n * none), or a structured `ENV_INCOMPATIBLE` error naming the unsatisfied\n * constraints and the host versions. The error carries the guarded `requires`\n * and `host` maps so the admin can render the same mismatch the UI gate shows.\n */\nexport function assertEnvCompatible(\n\trequires: unknown,\n\thostEnv: HostEnv,\n): EnvIncompatibleError | null {\n\t// A constraint the host can't evaluate (unknown or unparseable host\n\t// version) downgrades the gate to a no-op for that env. Log it so a\n\t// silent bypass is observable rather than invisible.\n\tfor (const skipped of findSkippedEnvConstraints(requires, hostEnv)) {\n\t\tconsole.warn(\n\t\t\t`[registry] env compatibility constraint skipped: ${skipped.key} requires ${skipped.required} but host version is ${skipped.reason}`,\n\t\t);\n\t}\n\tconst mismatches = checkEnvCompatibility(requires, hostEnv);\n\tif (mismatches.length === 0) return null;\n\tconst guarded: Record<string, string> = {};\n\tfor (const m of mismatches) guarded[m.key] = m.required;\n\tconst summary = mismatches\n\t\t.map((m) => `${m.key} requires ${m.required} but host is ${m.host}`)\n\t\t.join(\"; \");\n\treturn {\n\t\tcode: \"ENV_INCOMPATIBLE\",\n\t\tmessage: `This release is not compatible with the current environment: ${summary}.`,\n\t\tdetails: { requires: guarded, host: hostEnv },\n\t};\n}\n\n// ── Install ────────────────────────────────────────────────────────\n\nexport async function handleRegistryInstall(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n\tsandboxRunner: SandboxRunner | null,\n\tregistryConfigInput: RegistryConfigInput | undefined,\n\tinput: RegistryInstallInput,\n\topts?: {\n\t\tconfiguredPluginIds?: Set<string>;\n\t\thostEnv?: HostEnv;\n\t\tauthoritativeRecords?: AuthoritativeRecordReadOptions;\n\t\treadAuthoritativeRecords?: AuthoritativeRecordReader;\n\t\tverifyOnly?: boolean;\n\t},\n): Promise<ApiResult<RegistryInstallResult>> {\n\t// Accept either the bare-string shorthand or the full\n\t// `RegistryConfig` object (see `RegistryConfigInput`).\n\tconst registryConfig = coerceRegistryConfig(registryConfigInput);\n\tif (!registryConfig) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"REGISTRY_NOT_CONFIGURED\",\n\t\t\t\tmessage: \"Registry is not configured\",\n\t\t\t},\n\t\t};\n\t}\n\n\tif (!storage) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"STORAGE_NOT_CONFIGURED\",\n\t\t\t\tmessage: \"Storage is required for registry plugin installation\",\n\t\t\t},\n\t\t};\n\t}\n\n\tif (!sandboxRunner || !sandboxRunner.isAvailable()) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SANDBOX_NOT_AVAILABLE\",\n\t\t\t\tmessage: \"Sandbox runner is required for registry plugins\",\n\t\t\t},\n\t\t};\n\t}\n\n\t// Defense in depth: validate the aggregator URL even though the same\n\t// check runs at config-normalize time. Keeps every entrypoint into\n\t// `handleRegistryInstall` safe regardless of how the caller obtained\n\t// the config.\n\ttry {\n\t\tvalidateAggregatorUrl(registryConfig.aggregatorUrl);\n\t} catch (err) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"REGISTRY_NOT_CONFIGURED\",\n\t\t\t\tmessage: err instanceof Error ? err.message : \"Invalid aggregator URL\",\n\t\t\t},\n\t\t};\n\t}\n\n\tconst { did, slug, version: requestedVersion } = input;\n\n\t// Lazy-load the discovery client. Avoids pulling @atcute/client into\n\t// every code path that imports core/api/handlers.\n\tconst { DiscoveryClient, registryLabelerPolicy } =\n\t\tawait import(\"@emdash-cms/registry-client/discovery\");\n\n\t// Every aggregator XRPC call passes through `timedFetch`, which\n\t// enforces a per-request timeout and shares a single total-budget\n\t// deadline. Defends against a slow-loris aggregator stalling the\n\t// install before the artifact phase begins.\n\tconst aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;\n\tconst discovery = new DiscoveryClient({\n\t\taggregatorUrl: registryConfig.aggregatorUrl,\n\t\tacceptLabelers: registryConfig.acceptLabelers,\n\t\tlabelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),\n\t\tfetch: timedFetch(aggregatorDeadline),\n\t});\n\n\t// Basic shape check on the DID. The browser is expected to send a\n\t// DID resolved via the aggregator's `resolvePackage`; reject obvious\n\t// malformations here rather than letting the XRPC call fail\n\t// opaquely. The lexicon's `did:${string}:${string}` template is the\n\t// authoritative check.\n\tif (!did.startsWith(\"did:\") || did.split(\":\").length < 3) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"INVALID_DID\",\n\t\t\t\tmessage: \"DID must be a valid atproto DID (e.g. did:plc:abc123)\",\n\t\t\t},\n\t\t};\n\t}\n\n\ttry {\n\t\t// Step 1: look up the package by DID + slug. The browser already\n\t\t// resolved any handle to a DID via `resolvePackage`; we skip that\n\t\t// round-trip and go straight to `getPackage`.\n\t\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- validated above\n\t\tconst publisherDid = did as Did;\n\t\tconst packageView = await discovery.getPackage({\n\t\t\tdid: publisherDid,\n\t\t\tslug,\n\t\t});\n\n\t\t// Step 2: select the target release.\n\t\t// For an explicit version, page through listReleases until we find\n\t\t// the matching record; the aggregator returns releases ordered by\n\t\t// semver descending. For \"latest\", use the dedicated convenience\n\t\t// endpoint which applies the aggregator's policy filter (yanked\n\t\t// exclusion etc.) server-side.\n\t\t//\n\t\t// Pagination is bounded both by total pages and by repeated-cursor\n\t\t// detection: a buggy or compromised aggregator could otherwise\n\t\t// return endless distinct cursors that never include the\n\t\t// requested version, hanging the install for the platform's\n\t\t// request-time budget.\n\t\tconst MAX_LIST_PAGES = 20; // 20 * 50 limit = 1000 releases worth\n\t\tconst latestRelease = await (async () => {\n\t\t\tif (!requestedVersion) {\n\t\t\t\treturn discovery.getLatestRelease({\n\t\t\t\t\tdid: publisherDid,\n\t\t\t\t\tpackage: slug,\n\t\t\t\t});\n\t\t\t}\n\t\t\tlet cursor: string | undefined;\n\t\t\tconst seenCursors = new Set<string>();\n\t\t\tfor (let page = 0; page < MAX_LIST_PAGES; page++) {\n\t\t\t\tif (cursor !== undefined) {\n\t\t\t\t\tif (seenCursors.has(cursor)) break;\n\t\t\t\t\tseenCursors.add(cursor);\n\t\t\t\t}\n\t\t\t\tconst result = await discovery.listReleases({\n\t\t\t\t\tdid: publisherDid,\n\t\t\t\t\tpackage: slug,\n\t\t\t\t\tcursor,\n\t\t\t\t\tlimit: 50,\n\t\t\t\t});\n\t\t\t\tfor (const r of result.releases) {\n\t\t\t\t\tif (r.version === requestedVersion) return r;\n\t\t\t\t}\n\t\t\t\tif (!result.cursor) break;\n\t\t\t\tcursor = result.cursor;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t})();\n\t\tconst releaseView = latestRelease;\n\n\t\tif (!releaseView) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NO_RELEASE\",\n\t\t\t\t\tmessage: requestedVersion\n\t\t\t\t\t\t? `Version ${requestedVersion} not found for ${publisherDid}/${slug}`\n\t\t\t\t\t\t: `No installable release found for ${publisherDid}/${slug}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// The aggregator selects the package/version and supplies mirrors and\n\t\t// moderation metadata. Its copies of the signed records are not\n\t\t// verification inputs.\n\t\tif (packageView.did !== publisherDid || packageView.slug !== slug) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_IDENTITY_MISMATCH\",\n\t\t\t\t\tmessage: \"Aggregator returned a package view for a different publisher or slug.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (\n\t\t\treleaseView.did !== publisherDid ||\n\t\t\treleaseView.package !== slug ||\n\t\t\t(requestedVersion !== undefined && releaseView.version !== requestedVersion)\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_IDENTITY_MISMATCH\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"Aggregator returned a release view that does not match the requested package or version.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst version = releaseView.version;\n\t\tif (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"RELEASE_YANKED\",\n\t\t\t\t\tmessage: \"This release has been withdrawn\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst authoritative = await (opts?.readAuthoritativeRecords ?? readAuthoritativePackageRelease)(\n\t\t\tpublisherDid,\n\t\t\tslug,\n\t\t\tversion,\n\t\t\topts?.authoritativeRecords,\n\t\t);\n\t\tif (!authoritative.success) {\n\t\t\treturn registryRecordError(authoritative.error.code, authoritative.error.message);\n\t\t}\n\t\tconst records = authoritative.value;\n\t\tconst { profile, release } = records.inspection.value;\n\t\tif (\n\t\t\tpackageView.uri !== records.profile.uri ||\n\t\t\tpackageView.cid !== records.profile.cid ||\n\t\t\treleaseView.uri !== records.release.uri ||\n\t\t\treleaseView.cid !== records.release.cid\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_RECORD_MISMATCH\",\n\t\t\t\t\tmessage: \"Aggregator metadata does not match the publisher's signed records.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (!opts?.verifyOnly) {\n\t\t\tconst consentError = recordConsentError(\n\t\t\t\t{\n\t\t\t\t\tprofileCid: input.acknowledgedProfileCid,\n\t\t\t\t\treleaseCid: input.acknowledgedReleaseCid,\n\t\t\t\t},\n\t\t\t\trecords,\n\t\t\t);\n\t\t\tif (consentError) return consentError;\n\t\t}\n\n\t\tconst packageYanked =\n\t\t\thasCurrentRecordLabel(packageView.labels ?? [], \"security:yanked\", records.profile) ||\n\t\t\thasCurrentRecordLabel(packageView.labels ?? [], \"security-yanked\", records.profile);\n\t\tif (packageYanked) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"RELEASE_YANKED\",\n\t\t\t\t\tmessage: \"This release has been withdrawn\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Environment compatibility remains an install-safety gate. Listing\n\t\t// approval says only that displayed metadata passed moderation. A release\n\t\t// may carry a `requires` block (`env:emdash`, `env:astro`, ...). Refuse\n\t\t// the install if the running host doesn't satisfy a constraint, so a\n\t\t// stale browser tab or non-UI caller can't bypass the admin's\n\t\t// disabled Install button. `requires` is lexicon-`unknown`; the\n\t\t// helper guards its shape.\n\t\tif (opts?.hostEnv) {\n\t\t\tconst envError = assertEnvCompatible(release.requires, opts.hostEnv);\n\t\t\tif (envError) return { success: false, error: envError };\n\t\t}\n\n\t\t// Step 3a: enforce the configured minimum release age. The browser\n\t\t// applies the same check up front for UX, but the gate lives here\n\t\t// -- a stale browser tab, a deep link, or a non-admin-UI caller\n\t\t// must still hit the holdback. The `minimumReleaseAgeExclude`\n\t\t// allowlist short-circuits the check for trusted publisher DIDs.\n\t\t//\n\t\t// `releaseView.indexedAt` is aggregator operational data, not part\n\t\t// of the signed release. The release schema has no publication\n\t\t// timestamp, so minimum age remains a local discovery holdback\n\t\t// rather than a cryptographic property. A missing or malformed\n\t\t// timestamp fails closed.\n\t\t// `registryConfig` is the user-supplied integration option, not\n\t\t// the normalized manifest shape, so the duration parse runs once\n\t\t// per install. Catch a malformed value here -- normally caught at\n\t\t// `normalizeRegistryConfig` time, but a future config-mutation\n\t\t// path could re-enter with a bad value -- and surface it as a\n\t\t// structured error rather than letting it bubble out as a generic\n\t\t// 500.\n\t\tconst minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;\n\t\tlet minimumReleaseAgeSeconds = 0;\n\t\tif (minimumReleaseAge !== undefined) {\n\t\t\ttry {\n\t\t\t\tminimumReleaseAgeSeconds = parseDurationSeconds(minimumReleaseAge);\n\t\t\t} catch (err) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"REGISTRY_POLICY_INVALID\",\n\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\terr instanceof Error\n\t\t\t\t\t\t\t\t? err.message\n\t\t\t\t\t\t\t\t: \"Invalid minimumReleaseAge value in registry config\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\tif (minimumReleaseAgeSeconds > 0) {\n\t\t\tconst exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) =>\n\t\t\t\te.trim().toLowerCase(),\n\t\t\t);\n\t\t\tconst exempt = releaseExemptFromMinimumAge(exclude, publisherDid, slug);\n\t\t\tif (!exempt) {\n\t\t\t\tconst indexedAt = Date.parse(releaseView.indexedAt);\n\t\t\t\tif (!Number.isFinite(indexedAt)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: \"RELEASE_TIMESTAMP_INVALID\",\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\"Release record is missing a valid indexed-at timestamp; cannot evaluate minimum release age policy.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\tconst ageSeconds = (Date.now() - indexedAt) / 1000;\n\t\t\t\tif (ageSeconds < minimumReleaseAgeSeconds) {\n\t\t\t\t\tconst remaining = Math.ceil(minimumReleaseAgeSeconds - ageSeconds);\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: \"RELEASE_TOO_NEW\",\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`This release does not meet the configured minimum release age of ` +\n\t\t\t\t\t\t\t\t`${minimumReleaseAgeSeconds}s. It will be installable in ~${remaining}s.`,\n\t\t\t\t\t\t},\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Derive the normalized opaque plugin id we'll use as the\n\t\t// runtime-wide identifier from here on. The publisher_did + slug\n\t\t// stay in the state row for update resolution and admin display.\n\t\tconst pluginId = await makeRegistryPluginId(publisherDid, slug);\n\n\t\t// Block installation if a configured (trusted) plugin shares this\n\t\t// id. Mirrors the marketplace install's PLUGIN_ID_CONFLICT check.\n\t\tif (opts?.configuredPluginIds?.has(pluginId)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"PLUGIN_ID_CONFLICT\",\n\t\t\t\t\tmessage: \"A configured plugin with the same derived id already exists\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Check for an existing install (any source) under the derived id.\n\t\t// We reject all pre-existing rows -- if the row is from a registry\n\t\t// install of this same package, the caller should go through the\n\t\t// (future) update flow; if it's from any other source, the\n\t\t// pluginId collision means installing would silently mutate an\n\t\t// unrelated plugin's lifecycle row.\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (existing) {\n\t\t\tif (existing.source === \"registry\") {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"ALREADY_INSTALLED\",\n\t\t\t\t\t\tmessage: `Plugin ${publisherDid}/${slug} is already installed`,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"PLUGIN_ID_COLLISION\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`A non-registry plugin already exists at the derived id ${pluginId}. ` +\n\t\t\t\t\t\t\"Uninstall it before installing this registry plugin.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Step 6: fetch bytes through an aggregator cache, the publisher PDS,\n\t\t// or the URL in the authoritative signed release. Every source remains untrusted.\n\t\tconst packageArtifact = release.artifacts.package;\n\t\tconst declaredChecksum = release.artifacts.package.checksum;\n\n\t\tif (!packageArtifact || !declaredChecksum) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_RELEASE\",\n\t\t\t\t\tmessage: \"Release record is missing its package artifact or checksum\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tlet artifactBytes: Uint8Array;\n\t\ttry {\n\t\t\tartifactBytes = await fetchArtifact(\n\t\t\t\treleaseView.artifactCaches ?? [],\n\t\t\t\tpackageArtifact,\n\t\t\t\t{\n\t\t\t\t\tdid: publisherDid,\n\t\t\t\t\tcollection: NSID.packageRelease,\n\t\t\t\t\trkey: `${slug}:${version}`,\n\t\t\t\t\tcid: releaseView.cid,\n\t\t\t\t},\n\t\t\t\trelease.auth,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof RegistryArtifactFetchError) {\n\t\t\t\treturn registryArtifactError(error.code, error.message, \"install\");\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\n\t\t// Steps 6-7: verify the signed checksum, archive, manifest, and\n\t\t// expected package identity with the runtime-neutral verifier used\n\t\t// by the release service.\n\t\tconst artifactReport = await validateRegistryArtifact(\n\t\t\tartifactBytes,\n\t\t\tdeclaredChecksum,\n\t\t\tslug,\n\t\t\tversion,\n\t\t);\n\t\tif (!artifactReport.success) {\n\t\t\treturn registryArtifactError(\n\t\t\t\tartifactReport.error.code,\n\t\t\t\tartifactReport.error.message,\n\t\t\t\t\"install\",\n\t\t\t);\n\t\t}\n\t\tconst { bundle, artifactDigest, artifactDigests } = artifactReport.value;\n\t\tconst recordReport = await verifyAuthoritativePackageRelease(records, artifactDigest, {\n\t\t\t...opts?.authoritativeRecords,\n\t\t\tartifactDigests,\n\t\t});\n\t\tif (!recordReport.success) {\n\t\t\treturn registryRecordError(\n\t\t\t\trecordReport.code,\n\t\t\t\trecordReport.reasons[0]?.message ?? \"The release provenance is invalid.\",\n\t\t\t);\n\t\t}\n\t\tconst verification = recordVerificationSummary(records, recordReport);\n\n\t\t// Rewrite the manifest's id to the derived opaque pluginId before\n\t\t// it reaches R2 storage or the sandbox loader. The sandbox uses\n\t\t// `manifest.id` as its identity for per-plugin storage and bridge\n\t\t// calls; addressing it by the same pluginId we use in the runtime\n\t\t// cache, R2 prefix, and `_plugin_state` row keeps every layer\n\t\t// in sync and prevents registry installs from colliding with\n\t\t// marketplace plugins that happen to share the publisher's slug.\n\t\tbundle.manifest = { ...bundle.manifest, id: pluginId };\n\n\t\t// Integrity: the bundle that will run MUST declare exactly the access\n\t\t// the signed release record advertises. The consent dialog is driven\n\t\t// from the record's `declaredAccess`, so a bundle enforcing something\n\t\t// different -- a wider host allow-list, an extra capability -- would run\n\t\t// outside what the user reviewed. The capability-set consent gate below\n\t\t// is blind to constraint content (host scope), so compare the full\n\t\t// enforced access of record vs bundle here and refuse on any difference.\n\t\tif (\n\t\t\t!verifiedAccessEqual(recordReport.value.declaredAccess, bundle.manifest.declaredAccess ?? {})\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"DECLARED_ACCESS_DRIFT\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"The plugin bundle declares different permissions than its published record. Installation refused.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Capability consent gate: the admin MUST acknowledge the\n\t\t// capabilities the bundle's manifest actually declares before we\n\t\t// install it. The bundle manifest is the runtime enforcement\n\t\t// currency; the exact-equality check above binds it to the\n\t\t// independently verified signed release.\n\t\t//\n\t\t// Two outcomes after normalization (filter to strings, dedupe,\n\t\t// sort):\n\t\t//\n\t\t//   1. The bundle declares no capabilities: install is allowed\n\t\t//      without any acknowledgement (nothing to consent to).\n\t\t//   2. The bundle declares capabilities: install requires the\n\t\t//      caller to send `acknowledgedDeclaredAccess`, and the\n\t\t//      sorted lists must match exactly.\n\t\t//\n\t\t// We compare against the bundle's *capabilities* (the legacy\n\t\t// shape) for v1 because EmDash's existing sandbox enforces\n\t\t// capabilities, not the RFC's structured `declaredAccess`. Once\n\t\t// the runtime starts enforcing `declaredAccess` natively, this\n\t\t// comparison switches to that shape.\n\t\tconst actualCapabilities = canonicalCapabilitiesForDriftCheck(bundle.manifest.capabilities);\n\t\tif (!opts?.verifyOnly && actualCapabilities.length > 0) {\n\t\t\tif (input.acknowledgedDeclaredAccess === undefined) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"DECLARED_ACCESS_REQUIRED\",\n\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\"This plugin declares capabilities that require consent. Re-open the install dialog to review and acknowledge them.\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst acknowledged = canonicalCapabilitiesForDriftCheck(input.acknowledgedDeclaredAccess);\n\t\t\tif (\n\t\t\t\tacknowledged.length !== actualCapabilities.length ||\n\t\t\t\tacknowledged.some((cap, i) => cap !== actualCapabilities[i])\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"DECLARED_ACCESS_DRIFT\",\n\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\"Plugin manifest has changed since you consented. Re-open the install dialog to review the new permissions.\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tconst actualMcpTools = (bundle.manifest.mcp?.tools ?? []).map(\n\t\t\t({ inputSchema: _, outputSchema: __, ...tool }) => tool,\n\t\t);\n\t\tif (!opts?.verifyOnly && actualMcpTools.length > 0) {\n\t\t\tif (JSON.stringify(input.acknowledgedMcpTools) !== JSON.stringify(actualMcpTools)) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"MCP_TOOL_CONSENT_REQUIRED\",\n\t\t\t\t\t\tmessage: \"Plugin MCP tools require explicit consent\",\n\t\t\t\t\t\tdetails: { mcpTools: actualMcpTools, verification },\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tconst result: RegistryInstallResult = {\n\t\t\tpluginId,\n\t\t\tpublisherDid,\n\t\t\tslug,\n\t\t\tversion,\n\t\t\tcapabilities: bundle.manifest.capabilities,\n\t\t\tdeclaredAccess: recordReport.value.releaseExtension.declaredAccess,\n\t\t\tmcpTools: actualMcpTools,\n\t\t\tverification,\n\t\t};\n\t\tif (opts?.verifyOnly) return { success: true, data: result };\n\n\t\t// Step 7: store in R2 under the registry prefix.\n\t\tawait storeBundleInR2(storage, pluginId, version, bundle, \"registry\");\n\n\t\t// Step 8: write plugin state.\n\t\t// Display name and description come from the *package profile*\n\t\t// (the signed record from the publisher's repo), not from the\n\t\t// bundle manifest -- the manifest carries the trust contract,\n\t\t// the profile carries the marketing copy.\n\t\t//\n\t\t// On failure, we may need to clean up the R2 bundle we just\n\t\t// wrote. But two parallel installs of the same (did, slug,\n\t\t// version) both pass the earlier `existing` check at line 822\n\t\t// (the read is not transactional with the insert), both upload\n\t\t// to the same deterministic R2 prefix (overwrites are\n\t\t// content-identical because R2 keys include the version and\n\t\t// the bundle is checksum-verified upstream), and then one wins\n\t\t// the insert while the other fails with a PK constraint\n\t\t// violation.\n\t\t//\n\t\t// If we blindly clean up R2 on every state-write failure, the\n\t\t// loser of that race would delete the winner's bundle and the\n\t\t// runtime would fail to load the plugin on the next sync.\n\t\t//\n\t\t// Instead: on state-write failure, re-query the state row. If\n\t\t// a row now exists for this pluginId, we lost the race -- the\n\t\t// winner owns the R2 bundle and we must not touch it. If the\n\t\t// row doesn't exist, the failure was a real DB error and the\n\t\t// R2 bytes are orphans; clean them up.\n\t\t//\n\t\t// Cleanup is best-effort; if it also fails, the row failure\n\t\t// still surfaces to the caller and the orphan R2 bundle costs\n\t\t// only the storage of a single checksum-verified zip.\n\t\ttry {\n\t\t\tawait stateRepo.upsert(pluginId, version, \"active\", {\n\t\t\t\tsource: \"registry\",\n\t\t\t\tdisplayName: profile.name ?? slug,\n\t\t\t\tdescription: profile.description ?? undefined,\n\t\t\t\tregistryPublisherDid: publisherDid,\n\t\t\t\tregistrySlug: slug,\n\t\t\t});\n\t\t} catch (stateErr) {\n\t\t\tlet lostRace = false;\n\t\t\ttry {\n\t\t\t\tconst winner = await stateRepo.get(pluginId);\n\t\t\t\tlostRace = winner !== undefined && winner !== null;\n\t\t\t} catch (probeErr) {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[registry-install] Failed to probe state row for ${pluginId} after state-write failure; treating as orphan:`,\n\t\t\t\t\tprobeErr,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!lostRace) {\n\t\t\t\ttry {\n\t\t\t\t\tawait deleteBundleFromR2(storage, pluginId, version, \"registry\");\n\t\t\t\t} catch (cleanupErr) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`[registry-install] Failed to clean up R2 bundle for ${pluginId}@${version} after state-row write failure:`,\n\t\t\t\t\t\tcleanupErr,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow stateErr;\n\t\t}\n\n\t\tawait syncDeclaredStorageIndexes(db, [bundle.manifest]);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: result,\n\t\t};\n\t} catch (err) {\n\t\tif (err instanceof ClientValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_RESPONSE_INVALID\",\n\t\t\t\t\tmessage: `Aggregator returned a response that does not conform to its lexicon (${err.target})`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err instanceof ClientResponseError) {\n\t\t\tif (err.error === \"ListingUnavailable\") {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"LISTING_UNAVAILABLE\",\n\t\t\t\t\t\tmessage: \"This plugin is unavailable under the active registry policy\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: err.status === 404 ? \"AGGREGATOR_NOT_FOUND\" : \"AGGREGATOR_HTTP_ERROR\",\n\t\t\t\t\tmessage: `Aggregator returned ${err.status}: ${err.error}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err instanceof EmDashStorageError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: err.code ?? \"STORAGE_ERROR\",\n\t\t\t\t\tmessage: \"Storage error while installing plugin\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"[registry-install] Failed:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"INSTALL_FAILED\",\n\t\t\t\tmessage: err instanceof Error ? err.message : \"Failed to install plugin from registry\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ── Uninstall ──────────────────────────────────────────────────────\n\nexport interface RegistryUninstallResult {\n\tpluginId: string;\n\t/** True when `_plugin_storage` rows were also deleted (opts.deleteData). */\n\tdataDeleted: boolean;\n}\n\n/**\n * Uninstall a registry-source plugin. Deletes the R2 bundle under\n * `registry/<pluginId>/<version>/`, optionally drops the plugin's\n * `_plugin_storage` rows, and removes the `_plugin_state` row. The\n * sandbox runtime is reconciled by the route's `syncRegistryPlugins`\n * call after this returns.\n *\n * Refuses to uninstall plugins whose `source` is not `\"registry\"` to\n * avoid trashing a marketplace/config plugin that happens to share the\n * pluginId namespace.\n */\nexport async function handleRegistryUninstall(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n\tpluginId: string,\n\topts?: { deleteData?: boolean },\n): Promise<ApiResult<RegistryUninstallResult>> {\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (!existing || existing.source !== \"registry\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `No registry plugin found: ${pluginId}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// `_plugin_state.version` carries the installed version directly for\n\t\t// registry-source rows (there's no shadow column like marketplace's\n\t\t// `marketplaceVersion`). Use it verbatim for the R2 prefix.\n\t\tconst version = existing.version;\n\n\t\t// Order: optional storage cleanup → bundle delete → state row delete.\n\t\t// The most failure-prone step runs first so a transient DB error\n\t\t// (deadlock, contention) cascades to the outer catch with the state\n\t\t// row and bundle intact — admin retries safely. Bundle delete is\n\t\t// idempotent on misses.\n\t\tlet dataDeleted = false;\n\t\tif (opts?.deleteData) {\n\t\t\tawait db.deleteFrom(\"_plugin_storage\").where(\"plugin_id\", \"=\", pluginId).execute();\n\t\t\tdataDeleted = true;\n\t\t}\n\n\t\tif (storage) {\n\t\t\tawait deleteBundleFromR2(storage, pluginId, version, \"registry\");\n\t\t}\n\n\t\ttry {\n\t\t\tawait removeAllPluginIndexes(db, pluginId);\n\t\t} catch {\n\t\t\t// Nothing to drop, or tracking table predates the feature\n\t\t}\n\n\t\tawait stateRepo.delete(pluginId);\n\n\t\treturn { success: true, data: { pluginId, dataDeleted } };\n\t} catch (err) {\n\t\tconsole.error(\"[registry-uninstall] Failed:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"UNINSTALL_FAILED\",\n\t\t\t\tmessage: \"Failed to uninstall plugin\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ── Update ─────────────────────────────────────────────────────────\n\nexport interface RegistryUpdateResult {\n\tpluginId: string;\n\toldVersion: string;\n\tnewVersion: string;\n\tcapabilityChanges: { added: string[]; removed: string[] };\n\t/** Set only when `newlyPublic` is non-empty, mirroring marketplace. */\n\trouteVisibilityChanges?: { newlyPublic: string[] };\n\tverification: RegistryRecordVerificationSummary;\n}\n\n/**\n * Update a registry-source plugin to a newer release. Mirrors\n * `handleMarketplaceUpdate`: resolves the target version via the aggregator,\n * re-runs the artifact fetch / checksum / extract pipeline, diffs capabilities\n * and route visibility against the currently installed bundle, and gates\n * escalations behind `confirmCapabilityChanges` / `confirmRouteVisibilityChanges`\n * so the admin re-consents to widened permissions.\n *\n * Refuses non-registry sources. Refuses when the stored state row is missing\n * the `(publisherDid, slug)` it needs to resolve against the aggregator.\n */\nexport async function handleRegistryUpdate(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n\tsandboxRunner: SandboxRunner | null,\n\tregistryConfigInput: RegistryConfigInput | undefined,\n\tpluginId: string,\n\topts?: {\n\t\tversion?: string;\n\t\tconfirmCapabilityChanges?: boolean;\n\t\tconfirmRouteVisibilityChanges?: boolean;\n\t\tconfirmMcpTools?: boolean;\n\t\tacknowledgedProfileCid?: string;\n\t\tacknowledgedReleaseCid?: string;\n\t\thostEnv?: HostEnv;\n\t\tauthoritativeRecords?: AuthoritativeRecordReadOptions;\n\t\treadAuthoritativeRecords?: AuthoritativeRecordReader;\n\t},\n): Promise<ApiResult<RegistryUpdateResult>> {\n\tconst registryConfig = coerceRegistryConfig(registryConfigInput);\n\tif (!registryConfig) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"REGISTRY_NOT_CONFIGURED\", message: \"Registry is not configured\" },\n\t\t};\n\t}\n\tif (!storage) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"STORAGE_NOT_CONFIGURED\",\n\t\t\t\tmessage: \"Storage is required for registry plugin updates\",\n\t\t\t},\n\t\t};\n\t}\n\tif (!sandboxRunner || !sandboxRunner.isAvailable()) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SANDBOX_NOT_AVAILABLE\", message: \"Sandbox runner is required\" },\n\t\t};\n\t}\n\ttry {\n\t\tvalidateAggregatorUrl(registryConfig.aggregatorUrl);\n\t} catch (err) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"REGISTRY_NOT_CONFIGURED\",\n\t\t\t\tmessage: err instanceof Error ? err.message : \"Invalid aggregator URL\",\n\t\t\t},\n\t\t};\n\t}\n\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst existing = await stateRepo.get(pluginId);\n\t\tif (!existing || existing.source !== \"registry\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `No registry plugin found: ${pluginId}` },\n\t\t\t};\n\t\t}\n\t\tif (!existing.registryPublisherDid || !existing.registrySlug) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_STATE\",\n\t\t\t\t\tmessage: `Registry plugin ${pluginId} is missing publisher DID or slug in state`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconst oldVersion = existing.version;\n\t\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- existing.registryPublisherDid is a DID string written by the install handler\n\t\tconst publisherDid = existing.registryPublisherDid as Did;\n\t\tconst slug = existing.registrySlug;\n\n\t\tconst { DiscoveryClient, registryLabelerPolicy } =\n\t\t\tawait import(\"@emdash-cms/registry-client/discovery\");\n\t\tconst aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;\n\t\tconst discovery = new DiscoveryClient({\n\t\t\taggregatorUrl: registryConfig.aggregatorUrl,\n\t\t\tacceptLabelers: registryConfig.acceptLabelers,\n\t\t\tlabelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),\n\t\t\tfetch: timedFetch(aggregatorDeadline),\n\t\t});\n\n\t\t// Resolve target release. Explicit version → paginate listReleases;\n\t\t// otherwise getLatestRelease (aggregator applies its own filters).\n\t\tconst MAX_LIST_PAGES = 20;\n\t\tconst releaseView = await (async () => {\n\t\t\tif (!opts?.version) {\n\t\t\t\treturn discovery.getLatestRelease({ did: publisherDid, package: slug });\n\t\t\t}\n\t\t\tlet cursor: string | undefined;\n\t\t\tconst seenCursors = new Set<string>();\n\t\t\tfor (let page = 0; page < MAX_LIST_PAGES; page++) {\n\t\t\t\tif (cursor !== undefined) {\n\t\t\t\t\tif (seenCursors.has(cursor)) break;\n\t\t\t\t\tseenCursors.add(cursor);\n\t\t\t\t}\n\t\t\t\tconst result = await discovery.listReleases({\n\t\t\t\t\tdid: publisherDid,\n\t\t\t\t\tpackage: slug,\n\t\t\t\t\tcursor,\n\t\t\t\t\tlimit: 50,\n\t\t\t\t});\n\t\t\t\tfor (const r of result.releases) {\n\t\t\t\t\tif (r.version === opts.version) return r;\n\t\t\t\t}\n\t\t\t\tif (!result.cursor) break;\n\t\t\t\tcursor = result.cursor;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t})();\n\n\t\tif (!releaseView) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NO_VERSION\",\n\t\t\t\t\tmessage: opts?.version\n\t\t\t\t\t\t? `Version ${opts.version} not found for ${publisherDid}/${slug}`\n\t\t\t\t\t\t: `No installable release found for ${publisherDid}/${slug}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// The aggregator selects the target version and supplies mirrors and\n\t\t// moderation metadata. Its release-record copy is not trusted.\n\t\tif (\n\t\t\treleaseView.did !== publisherDid ||\n\t\t\treleaseView.package !== slug ||\n\t\t\t(opts?.version !== undefined && releaseView.version !== opts.version)\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_IDENTITY_MISMATCH\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"Aggregator returned a release view that does not match the requested package or version.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconst packageView = await discovery.getPackage({ did: publisherDid, slug });\n\t\tif (!packageView || packageView.did !== publisherDid || packageView.slug !== slug) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_IDENTITY_MISMATCH\",\n\t\t\t\t\tmessage: \"Aggregator returned a package view that does not match the installed plugin.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst newVersion = releaseView.version;\n\t\tif (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"YANKED\", message: \"Release has been withdrawn\" },\n\t\t\t};\n\t\t}\n\t\tif (newVersion === oldVersion) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"ALREADY_UP_TO_DATE\",\n\t\t\t\t\tmessage: \"Plugin is already at the requested version\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconst authoritative = await (opts?.readAuthoritativeRecords ?? readAuthoritativePackageRelease)(\n\t\t\tpublisherDid,\n\t\t\tslug,\n\t\t\tnewVersion,\n\t\t\topts?.authoritativeRecords,\n\t\t);\n\t\tif (!authoritative.success) {\n\t\t\treturn registryRecordError(authoritative.error.code, authoritative.error.message);\n\t\t}\n\t\tconst records = authoritative.value;\n\t\tconst { profile, release } = records.inspection.value;\n\t\tif (\n\t\t\tpackageView.uri !== records.profile.uri ||\n\t\t\tpackageView.cid !== records.profile.cid ||\n\t\t\treleaseView.uri !== records.release.uri ||\n\t\t\treleaseView.cid !== records.release.cid\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_RECORD_MISMATCH\",\n\t\t\t\t\tmessage: \"Aggregator metadata does not match the publisher's signed records.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconst packageYanked =\n\t\t\thasCurrentRecordLabel(packageView.labels ?? [], \"security:yanked\", records.profile) ||\n\t\t\thasCurrentRecordLabel(packageView.labels ?? [], \"security-yanked\", records.profile);\n\t\tif (packageYanked) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"YANKED\", message: \"Package has been withdrawn\" },\n\t\t\t};\n\t\t}\n\t\tif (\n\t\t\topts?.confirmCapabilityChanges ||\n\t\t\topts?.confirmRouteVisibilityChanges ||\n\t\t\topts?.confirmMcpTools\n\t\t) {\n\t\t\tconst consentError = recordConsentError(\n\t\t\t\t{\n\t\t\t\t\tprofileCid: opts.acknowledgedProfileCid,\n\t\t\t\t\treleaseCid: opts.acknowledgedReleaseCid,\n\t\t\t\t},\n\t\t\t\trecords,\n\t\t\t);\n\t\t\tif (consentError) return consentError;\n\t\t}\n\t\t// Environment compatibility remains independent from listing approval.\n\t\t// An ungated update could otherwise\n\t\t// land a version whose `requires` the host doesn't satisfy. Same\n\t\t// guard as install; `requires` is lexicon-`unknown`.\n\t\tif (opts?.hostEnv) {\n\t\t\tconst envError = assertEnvCompatible(release.requires, opts.hostEnv);\n\t\t\tif (envError) return { success: false, error: envError };\n\t\t}\n\n\t\tconst packageArtifact = release.artifacts.package;\n\t\tconst declaredChecksum = packageArtifact?.checksum;\n\t\tif (!packageArtifact || !declaredChecksum) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_RELEASE\",\n\t\t\t\t\tmessage: \"Release record is missing its package artifact or checksum\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tlet artifactBytes: Uint8Array;\n\t\ttry {\n\t\t\tartifactBytes = await fetchArtifact(\n\t\t\t\treleaseView.artifactCaches ?? [],\n\t\t\t\tpackageArtifact,\n\t\t\t\t{\n\t\t\t\t\tdid: publisherDid,\n\t\t\t\t\tcollection: NSID.packageRelease,\n\t\t\t\t\trkey: `${slug}:${newVersion}`,\n\t\t\t\t\tcid: releaseView.cid,\n\t\t\t\t},\n\t\t\t\trelease.auth,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof RegistryArtifactFetchError) {\n\t\t\t\treturn registryArtifactError(error.code, error.message, \"update\");\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t\tconst artifactReport = await validateRegistryArtifact(\n\t\t\tartifactBytes,\n\t\t\tdeclaredChecksum,\n\t\t\tslug,\n\t\t\tnewVersion,\n\t\t);\n\t\tif (!artifactReport.success) {\n\t\t\treturn registryArtifactError(\n\t\t\t\tartifactReport.error.code,\n\t\t\t\tartifactReport.error.message,\n\t\t\t\t\"update\",\n\t\t\t);\n\t\t}\n\t\tconst { bundle, artifactDigest, artifactDigests } = artifactReport.value;\n\t\tconst recordReport = await verifyAuthoritativePackageRelease(records, artifactDigest, {\n\t\t\t...opts?.authoritativeRecords,\n\t\t\tartifactDigests,\n\t\t});\n\t\tif (!recordReport.success) {\n\t\t\treturn registryRecordError(\n\t\t\t\trecordReport.code,\n\t\t\t\trecordReport.reasons[0]?.message ?? \"The release provenance is invalid.\",\n\t\t\t);\n\t\t}\n\t\tconst verification = recordVerificationSummary(records, recordReport);\n\n\t\t// Rewrite manifest.id to the opaque pluginId so the sandbox loader\n\t\t// and R2 layout stay in sync across install and update.\n\t\tbundle.manifest = { ...bundle.manifest, id: pluginId };\n\n\t\t// Integrity: same gate as install. The new bundle must declare exactly\n\t\t// the access its signed release record advertises. Without it, an update\n\t\t// that changes only the host scope (e.g. api.good.com -> evil.com) keeps\n\t\t// the capability set identical, sails through the escalation diff below,\n\t\t// and installs a bundle enforcing a scope the record never showed.\n\t\tif (\n\t\t\t!verifiedAccessEqual(recordReport.value.declaredAccess, bundle.manifest.declaredAccess ?? {})\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"DECLARED_ACCESS_DRIFT\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"The plugin bundle declares different permissions than its published record. Update refused.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Diff capabilities + route visibility against the currently\n\t\t// installed bundle. Loading from R2 keeps us honest: the diff is\n\t\t// against the bytes the sandbox is actually running, not whatever\n\t\t// the state row claims.\n\t\tconst oldBundle = await loadBundleFromR2(storage, pluginId, oldVersion, \"registry\");\n\t\tconst oldCaps = oldBundle?.manifest.capabilities ?? [];\n\t\tconst capabilityChanges = diffCapabilities(oldCaps, bundle.manifest.capabilities);\n\t\tconst hasEscalation = capabilityChanges.added.length > 0;\n\t\tif (hasEscalation && !opts?.confirmCapabilityChanges) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CAPABILITY_ESCALATION\",\n\t\t\t\t\tmessage: \"Plugin update requires new capabilities\",\n\t\t\t\t\tdetails: { capabilityChanges, verification },\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);\n\t\tconst hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;\n\t\tif (hasNewPublicRoutes && !opts?.confirmRouteVisibilityChanges) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"ROUTE_VISIBILITY_ESCALATION\",\n\t\t\t\t\tmessage: \"Plugin update exposes new public (unauthenticated) routes\",\n\t\t\t\t\tdetails: { routeVisibilityChanges, capabilityChanges, verification },\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst oldMcpTools = [...(oldBundle?.manifest.mcp?.tools ?? [])].toSorted((a, b) =>\n\t\t\ta.name.localeCompare(b.name),\n\t\t);\n\t\tconst newMcpTools = [...(bundle.manifest.mcp?.tools ?? [])].toSorted((a, b) =>\n\t\t\ta.name.localeCompare(b.name),\n\t\t);\n\t\tif (JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools) && !opts?.confirmMcpTools) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"MCP_TOOL_CONSENT_REQUIRED\",\n\t\t\t\t\tmessage: \"Plugin update changes its MCP tools\",\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tmcpTools: newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool),\n\t\t\t\t\t\tverification,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Store new bundle. R2 prefix is deterministic per (pluginId, version),\n\t\t// so a retry of the same update is idempotent.\n\t\tawait storeBundleInR2(storage, pluginId, newVersion, bundle, \"registry\");\n\n\t\t// Refresh display metadata from the same signed profile used for\n\t\t// release-policy verification.\n\t\tawait stateRepo.upsert(pluginId, newVersion, \"active\", {\n\t\t\tsource: \"registry\",\n\t\t\tregistryPublisherDid: publisherDid,\n\t\t\tregistrySlug: slug,\n\t\t\tdisplayName: profile.name ?? slug,\n\t\t\tdescription: profile.description ?? undefined,\n\t\t\tmcpToolsEnabled: false,\n\t\t\tmcpToolsConsent: null,\n\t\t});\n\n\t\tawait syncDeclaredStorageIndexes(db, [bundle.manifest]);\n\n\t\t// Best-effort cleanup of the old bundle. Failures here don't roll\n\t\t// back the upgrade (the new bundle is already stored and committed\n\t\t// in the state row); the orphan is just storage we'll pay for.\n\t\tdeleteBundleFromR2(storage, pluginId, oldVersion, \"registry\").catch(() => {});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tpluginId,\n\t\t\t\toldVersion,\n\t\t\t\tnewVersion,\n\t\t\t\tcapabilityChanges,\n\t\t\t\trouteVisibilityChanges: hasNewPublicRoutes ? routeVisibilityChanges : undefined,\n\t\t\t\tverification,\n\t\t\t},\n\t\t};\n\t} catch (err) {\n\t\tif (err instanceof ClientValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_RESPONSE_INVALID\",\n\t\t\t\t\tmessage: `Aggregator returned a response that does not conform to its lexicon (${err.target})`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err instanceof ClientResponseError) {\n\t\t\tif (err.error === \"ListingUnavailable\") {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"LISTING_UNAVAILABLE\",\n\t\t\t\t\t\tmessage: \"This plugin is unavailable under the active registry policy\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: err.status === 404 ? \"AGGREGATOR_NOT_FOUND\" : \"AGGREGATOR_HTTP_ERROR\",\n\t\t\t\t\tmessage: `Aggregator returned ${err.status}: ${err.error}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err instanceof EmDashStorageError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: err.code ?? \"STORAGE_ERROR\",\n\t\t\t\t\tmessage: \"Storage error while updating plugin\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"[registry-update] Failed:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"UPDATE_FAILED\",\n\t\t\t\tmessage: err instanceof Error ? err.message : \"Failed to update plugin\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ── Update check ───────────────────────────────────────────────────\n\nexport interface RegistryUpdateCheck {\n\tpluginId: string;\n\tinstalled: string;\n\tlatest: string;\n\thasUpdate: boolean;\n\t/**\n\t * Both diff fields are `false` here by design: computing them at\n\t * update-check time would require downloading both bundles (or\n\t * extracting from the signed release extension and the installed\n\t * R2 bundle), which is too expensive for a bulk preview. The actual\n\t * escalation gate runs at update time in `handleRegistryUpdate`.\n\t * Mirrors marketplace's `hasRouteVisibilityChanges: false`.\n\t */\n\thasCapabilityChanges: boolean;\n\thasRouteVisibilityChanges: boolean;\n}\n\n/**\n * Bulk update check across every installed registry plugin. Queries the\n * aggregator for each plugin's latest release and reports `hasUpdate`\n * based on the version comparison. Plugins whose aggregator lookup fails\n * (unreachable, delisted, malformed) are skipped silently — one bad\n * publisher must not blank the whole admin Updates list.\n */\nexport async function handleRegistryUpdateCheck(\n\tdb: Kysely<Database>,\n\tregistryConfigInput: RegistryConfigInput | undefined,\n): Promise<ApiResult<{ items: RegistryUpdateCheck[] }>> {\n\tconst registryConfig = coerceRegistryConfig(registryConfigInput);\n\tif (!registryConfig) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"REGISTRY_NOT_CONFIGURED\", message: \"Registry is not configured\" },\n\t\t};\n\t}\n\n\ttry {\n\t\tconst stateRepo = new PluginStateRepository(db);\n\t\tconst registryPlugins = await stateRepo.getRegistryPlugins();\n\t\tif (registryPlugins.length === 0) {\n\t\t\treturn { success: true, data: { items: [] } };\n\t\t}\n\n\t\tconst { DiscoveryClient, registryLabelerPolicy } =\n\t\t\tawait import(\"@emdash-cms/registry-client/discovery\");\n\t\tconst aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;\n\t\tconst discovery = new DiscoveryClient({\n\t\t\taggregatorUrl: registryConfig.aggregatorUrl,\n\t\t\tacceptLabelers: registryConfig.acceptLabelers,\n\t\t\tlabelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),\n\t\t\tfetch: timedFetch(aggregatorDeadline),\n\t\t});\n\n\t\tconst items: RegistryUpdateCheck[] = [];\n\t\tfor (const plugin of registryPlugins) {\n\t\t\tif (!plugin.registryPublisherDid || !plugin.registrySlug) continue;\n\t\t\ttry {\n\t\t\t\tconst releaseView = await discovery.getLatestRelease({\n\t\t\t\t\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- DID string was validated by the install handler\n\t\t\t\t\tdid: plugin.registryPublisherDid as Did,\n\t\t\t\t\tpackage: plugin.registrySlug,\n\t\t\t\t});\n\t\t\t\tif (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst latest = releaseView.version;\n\t\t\t\tif (!latest) continue;\n\t\t\t\tconst installed = plugin.version;\n\t\t\t\titems.push({\n\t\t\t\t\tpluginId: plugin.pluginId,\n\t\t\t\t\tinstalled,\n\t\t\t\t\tlatest,\n\t\t\t\t\thasUpdate: latest !== installed,\n\t\t\t\t\thasCapabilityChanges: false,\n\t\t\t\t\thasRouteVisibilityChanges: false,\n\t\t\t\t});\n\t\t\t} catch (err) {\n\t\t\t\t// Skip plugins that can't be checked. Don't fail the whole\n\t\t\t\t// list because one aggregator query went wrong.\n\t\t\t\tconsole.warn(`[registry-update-check] Skipped ${plugin.pluginId}:`, err);\n\t\t\t}\n\t\t}\n\n\t\treturn { success: true, data: { items } };\n\t} catch (err) {\n\t\tif (err instanceof ClientValidationError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"AGGREGATOR_RESPONSE_INVALID\",\n\t\t\t\t\tmessage: `Aggregator returned a response that does not conform to its lexicon (${err.target})`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tif (err instanceof ClientResponseError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: err.status === 404 ? \"AGGREGATOR_NOT_FOUND\" : \"AGGREGATOR_HTTP_ERROR\",\n\t\t\t\t\tmessage: `Aggregator returned ${err.status}: ${err.error}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"[registry-update-check] Failed:\", err);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"UPDATE_CHECK_FAILED\", message: \"Failed to check for registry updates\" },\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,SAAgB,UAAU,MAA2B;AACpD,QAAO,aAAa,GAAG,KAAK,QAAQ,GAAG,KAAK,YAAY;;;;;;AAOzD,SAAgB,UAAU,KAA4D;AACrF,KAAI;EACH,MAAM,UAAUA,eAAa,IAAI;EACjC,MAAM,WAAW,QAAQ,QAAQ,IAAI;AACrC,MAAI,aAAa,GAAI,QAAO;EAE5B,MAAM,UAAU,SAAS,QAAQ,MAAM,GAAG,SAAS,EAAE,GAAG;EACxD,MAAM,YAAY,QAAQ,MAAM,WAAW,EAAE;AAE7C,MAAI,MAAM,QAAQ,IAAI,CAAC,UAAW,QAAO;AACzC,SAAO;GAAE;GAAS;GAAW;SACtB;AACP,SAAO;;;;;;;AAQT,SAAgB,YACf,KACA,MACsD;AAEtD,KAAI,CAAC,IAAK,QAAO,EAAE,OAAO,MAAM;CAEhC,MAAM,UAAU,UAAU,IAAI;AAC9B,KAAI,CAAC,QACJ,QAAO;EAAE,OAAO;EAAO,SAAS;EAAwB;AAGzD,KAAI,QAAQ,YAAY,KAAK,WAAW,QAAQ,cAAc,KAAK,UAClE,QAAO;EACN,OAAO;EACP,SAAS;EACT;AAGF,QAAO,EAAE,OAAO,MAAM;;;;;AC7CvB,SAAS,WAAW,OAAsC;AACzD,KAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,KAAI,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAAE,QAAO;AAC9D,QAAO;;AAGR,SAAS,KAAK,SAAmC;AAChD,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAA0B;GAAS;EAAE;;AAG9E,eAAe,6BACd,IACA,gBACsB;CACtB,MAAM,OAAO,MAAM,GACjB,WAAW,iBAAiB,CAC5B,UAAU,uBAAuB,0BAA0B,+BAA+B,CAC1F,OAAO;EAAC;EAAuB;EAAuB;EAA4B,CAAC,CACnF,MAAM,4BAA4B,KAAK,eAAe,CACtD,MAAM,uBAAuB,MAAM,CAAC,QAAQ,QAAQ,CAAC,CACrD,SAAS;CAEX,MAAM,MAAkB,EAAE;AAC1B,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,OAAO,sBAAsB,IAAI,WAAW;AAClD,MAAI,CAAC,KAAM;AACX,MAAI,KAAK;GAAE,MAAM,IAAI;GAAM,MAAM,IAAI;GAAM,kBAAkB;GAAM,CAAC;;AAErE,QAAO;;AAGR,eAAsB,oBACrB,IACA,gBACA,MAC2B;CAI3B,MAAM,SAAS,MAAM,cAAc,eAAe,wBACjD,6BAA6B,IAAI,eAAe,CAChD;AACD,KAAI,OAAO,WAAW,EAAG,QAAO;EAAE,SAAS;EAAM,MAAM;EAAM;CAG7D,MAAM,2BAAW,IAAI,KAAa;AAClC,MAAK,MAAM,SAAS,QAAQ;EAC3B,MAAM,MAAM,WAAW,KAAK,MAAM,MAAM;AACxC,MAAI,CAAC,IAAK;AAEV,OADiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW,aAClD,WAAW,OAAO,IAAI,OAAO,SAC7C,UAAS,IAAI,IAAI,GAAG;;CAKtB,MAAM,SAAS,CAAC,GAAG,SAAS;CAC5B,MAAM,2BAAW,IAAI,KAAqB;AAC1C,KAAI,OAAO,SAAS,EACnB,MAAK,MAAM,SAAS,OAAO,QAAQ,eAAe,EAAE;EACnD,MAAM,OAAO,MAAM,GACjB,WAAW,QAAQ,CACnB,OAAO,CAAC,MAAM,YAAY,CAAC,CAC3B,MAAM,MAAM,MAAM,MAAM,CACxB,SAAS;AACX,OAAK,MAAM,KAAK,KAAM,UAAS,IAAI,EAAE,IAAI,EAAE,UAAU;;AAIvD,MAAK,MAAM,SAAS,QAAQ;EAC3B,MAAM,QAAQ,KAAK,MAAM;AACzB,MAAI,UAAU,QAAQ,UAAU,OAAW;EAC3C,MAAM,MAAM,WAAW,MAAM;AAC7B,MAAI,CAAC,IAAK;EAEV,MAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;EAInE,IAAI;AACJ,MAAI,aAAa,SAAS;AACzB,OAAI,OAAO,IAAI,OAAO,SACrB,QAAO,KAAK,UAAU,MAAM,KAAK,uCAAuC;AAEzE,UAAO,SAAS,IAAI,IAAI,GAAG;AAC3B,OAAI,CAAC,KACJ,QAAO,KAAK,UAAU,MAAM,KAAK,2CAA2C;SAEvE;AACN,OAAI,OAAO,IAAI,aAAa,SAC3B,QAAO,KAAK,UAAU,MAAM,KAAK,uDAAuD;AAKzF,UAAO,IAAI;;AAGZ,MAAI,CAAC,qBAAqB,MAAM,MAAM,iBAAiB,CACtD,QAAO,KAAK,UAAU,MAAM,KAAK,oBAAoB,OAAO;;AAI9D,QAAO;EAAE,SAAS;EAAM,MAAM;EAAM;;;;;;;;;;ACrErC,SAAS,YAAY,OAAiE;AACrF,KAAI,EAAE,iBAAiB,UAAU,EAAE,cAAc,OAAQ,QAAO;CAChE,MAAM,EAAE,aAAa;AACrB,QACC,OAAO,aAAa,YACpB,aAAa,QACb,UAAU,YACV,OAAO,SAAS,SAAS;;AAI3B,SAAS,2BACR,KAC0C;AAC1C,KAAI,QAAQ,OAAW,QAAO;CAC9B,MAAM,UAAU,UAAU,IAAI;AAC9B,KAAI,CAAC,QAAS,OAAM,IAAI,6BAA6B,sCAAsC;AAC3F,QAAO;;;;;;AAOR,SAAS,cAAc,MAA8C;AACpE,KAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,EAAG,QAAO,KAAK;AACzE,KAAI,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,SAAS,EAAG,QAAO,KAAK;AACvE,QAAO;;;AAIR,MAAM,eAA2B;CAChC,OAAO;CACP,aAAa;CACb,OAAO;CACP,WAAW;CACX,SAAS;CACT;;;;AAKD,eAAe,iBAAiB,IAAsB,YAAsC;AAM3F,SALY,MAAM,GAChB,WAAW,sBAAsB,CACjC,OAAO,UAAU,CACjB,MAAM,QAAQ,KAAK,WAAW,CAC9B,kBAAkB,GACR,YAAY;;AAGzB,eAAe,2BACd,IACA,YAC6D;CAC7D,MAAM,MAAM,MAAM,GAChB,WAAW,sBAAsB,CACjC,OAAO,CAAC,YAAY,WAAW,CAAC,CAChC,MAAM,QAAQ,KAAK,WAAW,CAC9B,kBAAkB;CACpB,MAAM,WAAoB,KAAK,WAAW,KAAK,MAAM,IAAI,SAAS,GAAG,EAAE;AACvE,QAAO;EACN,mBAAmB,MAAM,QAAQ,SAAS,IAAI,SAAS,SAAS,YAAY;EAC5E,UAAU,KAAK,aAAa;EAC5B;;AAGF,SAAS,2BAA2B,UAAmB,MAAuC;AAC7F,KAAI,YAAY,CAAC,MAAM,MAAM,CAC5B,OAAM,IAAI,sBAAsB,iDAAiD;;;;;AAOnF,eAAe,WACd,IACA,YACA,MACA,QACgB;AAChB,KAAI,CAAC,OAAQ;AAEb,MAAK,MAAM,MADK,IAAI,cAAc,GAAG,CACZ,IAAI,YAAY,KAAK,GAAG;;;;;AAMlD,eAAe,eACd,IACA,YACA,OACA,QACgB;AAChB,KAAI,CAAC,UAAU,MAAM,WAAW,EAAG;CAEnC,MAAM,SAAS,MADC,IAAI,cAAc,GAAG,CACR,QAC5B,YACA,MAAM,KAAK,MAAM,EAAE,GAAG,CACtB;AACD,MAAK,MAAM,QAAQ,MAClB,MAAK,MAAM,OAAO,IAAI,KAAK,GAAG,IAAI,EAAE,GAAG,cAAc;;AAIvD,eAAe,eACd,IACA,YACA,MACgB;CAChB,MAAM,aAAa,IAAI,iBAAiB,GAAG;CAI3C,MAAM,YAAY,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG;CAC1D,MAAM,UAAU,MAAM,WAAW,kBAAkB,YAAY,KAAK,IAAI,UAAU;AAElF,KAAI,QAAQ,SAAS,GAAG;AACvB,OAAK,UAAU,QAAQ,KAAK,OAAO;GAAE,GAAG;GAAG,QAAQ;GAAqB,EAAE;AAC1E,OAAK,SAAS,QAAQ,IAAI,UAAU;AACpC;;AAMD,KAAI,KAAK,iBAAiB;AACzB,OAAK,UAAU,EAAE;AACjB,OAAK,SAAS;AACd;;AAGD,KAAI,KAAK,UAAU;EAKlB,MAAM,WAAW,MAAM,WAAW,aAAa,KAAK,UAAU,UAAU;AACxE,MAAI,UAAU;AACb,QAAK,UAAU,CAAC;IAAE,QAAQ;IAAU,WAAW;IAAG,WAAW;IAAM,QAAQ;IAAY,CAAC;AACxF,QAAK,SAAS;AACd;;;AAIF,MAAK,UAAU,EAAE;AACjB,MAAK,SAAS;;;;;;;;;;AAWf,eAAe,mBACd,IACA,YACA,OACgB;AAChB,KAAI,MAAM,WAAW,EAAG;CAExB,MAAM,aAAa,IAAI,iBAAiB,GAAG;CAK3C,MAAM,gCAAgB,IAAI,KAAmC;AAC7D,MAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,MAAM,KAAK,UAAU;EAC3B,MAAM,SAAS,cAAc,IAAI,IAAI;AACrC,MAAI,OAAQ,QAAO,KAAK,KAAK;MACxB,eAAc,IAAI,KAAK,CAAC,KAAK,CAAC;;CAOpC,MAAM,gCAAgB,IAAI,KAAoC;CAC9D,MAAM,0BAAyC,EAAE;AACjD,MAAK,MAAM,CAAC,QAAQ,WAAW,eAAe;EAC7C,MAAM,YAAY,SAAS,EAAE,QAAQ,GAAG;EACxC,MAAM,MAAM,OAAO,KAAK,MAAM,EAAE,GAAG;EACnC,MAAM,UAAU,MAAM,WAAW,sBAAsB,YAAY,KAAK,UAAU;AAClF,OAAK,MAAM,CAAC,IAAI,SAAS,QAAS,eAAc,IAAI,IAAI,KAAK;AAE7D,OAAK,MAAM,QAAQ,QAAQ;AAC1B,OAAI,QAAQ,IAAI,KAAK,GAAG,IAAI,QAAQ,IAAI,KAAK,GAAG,CAAE,SAAS,EAAG;AAC9D,OAAI,KAAK,SAAU,yBAAwB,KAAK,KAAK;;;CAMvD,MAAM,iCAAiB,IAAI,KAA4B;AACvD,KAAI,wBAAwB,SAAS,GAAG;EACvC,MAAM,gCAAgB,IAAI,KAAmC;AAC7D,OAAK,MAAM,QAAQ,yBAAyB;AAC3C,OAAI,KAAK,gBAAiB;GAC1B,MAAM,MAAM,KAAK,UAAU;GAC3B,MAAM,SAAS,cAAc,IAAI,IAAI;AACrC,OAAI,OAAQ,QAAO,KAAK,KAAK;OACxB,eAAc,IAAI,KAAK,CAAC,KAAK,CAAC;;AAGpC,OAAK,MAAM,CAAC,QAAQ,WAAW,eAAe;GAC7C,MAAM,YAAY,SAAS,EAAE,QAAQ,GAAG;GACxC,MAAM,YAAY,OAAO,KAAK,MAAM,EAAE,SAAS,CAAC,QAAQ,OAAqB,OAAO,KAAK;GACzF,MAAM,kBAAkB,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC;AAC/C,OAAI,gBAAgB,WAAW,EAAG;GAClC,MAAM,YAAY,MAAM,WAAW,cAAc,iBAAiB,UAAU;AAC5E,QAAK,MAAM,QAAQ,QAAQ;AAC1B,QAAI,CAAC,KAAK,SAAU;IACpB,MAAM,IAAI,UAAU,IAAI,KAAK,SAAS;AACtC,QAAI,EAAG,gBAAe,IAAI,KAAK,IAAI,EAAE;;;;AAMxC,MAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,WAAW,cAAc,IAAI,KAAK,GAAG;AAC3C,MAAI,YAAY,SAAS,SAAS,GAAG;AACpC,QAAK,UAAU,SAAS,KAAK,OAAO;IAAE,GAAG;IAAG,QAAQ;IAAqB,EAAE;AAC3E,QAAK,SAAS,SAAS,IAAI,UAAU;AACrC;;EAGD,MAAM,WAAW,eAAe,IAAI,KAAK,GAAG;AAC5C,MAAI,UAAU;AACb,QAAK,UAAU,CAAC;IAAE,QAAQ;IAAU,WAAW;IAAG,WAAW;IAAM,QAAQ;IAAY,CAAC;AACxF,QAAK,SAAS;AACd;;AAGD,OAAK,UAAU,EAAE;AACjB,OAAK,SAAS;;;;;;;;AAShB,eAAe,UACd,MACA,YACA,YACA,QACyB;AAMzB,SALa,MAAM,KAAK,eACvB,YACA,YACA,SAAS,wBAAwB,OAAO,GAAG,OAC3C,GACY,MAAM;;;;;;AAOpB,eAAe,0BACd,MACA,YACA,YACA,QACyB;AAMzB,SALa,MAAM,KAAK,+BACvB,YACA,YACA,SAAS,wBAAwB,OAAO,GAAG,OAC3C,GACY,MAAM;;;;;;;;;;AA6BpB,eAAe,qBAAqB,IAAsB,YAAuC;CAChG,MAAM,MAAM,MAAM,GAChB,WAAW,sBAAsB,CACjC,OAAO,CAAC,MAAM,cAAc,CAAC,CAC7B,MAAM,QAAQ,KAAK,WAAW,CAC9B,kBAAkB;AACpB,KAAI,CAAC,IAAK,QAAO,CAAC,OAAO;CAEzB,MAAM,SAAS,MAAM,GACnB,WAAW,iBAAiB,CAC5B,OAAO,CAAC,QAAQ,aAAa,CAAC,CAC9B,MAAM,iBAAiB,KAAK,IAAI,GAAG,CACnC,QAAQ,cAAc,MAAM,CAC5B,SAAS;CACX,MAAM,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC;CACjC,MAAM,aAAa,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC;AAIrD,KAAI,IAAI,eAAe,WAAW,IAAI,IAAI,YAAY,CAAE,SAAQ,IAAI,IAAI,YAAY;AACpF,MAAK,MAAM,aAAa,CAAC,SAAS,OAAO,CACxC,KAAI,WAAW,IAAI,UAAU,CAAE,SAAQ,IAAI,UAAU;AAEtD,MAAK,MAAM,SAAS,OACnB,KAAI,MAAM,eAAe,EAAG,SAAQ,IAAI,MAAM,KAAK;AAEpD,QAAO,CAAC,GAAG,QAAQ;;;;;;;;;;;AAYpB,eAAe,uBACd,IACA,YACA,eACmB;AACnB,KAAI,CAAC,SAAS,GAAG,CAAE,QAAO;CAC1B,MAAM,aAAa,IAAI,WAAW,GAAG;AAErC,KAAI,EADW,MAAM,WAAW,gBAAgB,WAAW,GAC9C,QAAS,QAAO;CAC7B,MAAM,aAAa,IAAI,IAAI,MAAM,WAAW,oBAAoB,WAAW,CAAC;AAE5E,KAAI,CADY,cAAc,OAAO,QAAQ,QAAQ,UAAU,WAAW,IAAI,IAAI,CAAC,CACrE,QAAO;AACrB,QAAO,WAAW,eAAe,WAAW;;;;;;;;AAS7C,eAAe,yBACd,IACA,YACA,SACA,SACA,WACgB;AAQhB,KAAI,MAAM,eAAe,IAAI,YAAY,SAAS,UAAU,CAAE;CAE9D,MAAM,gBAAgB,MAAM,GAC1B,WAAW,sBAAsB,CACjC,OAAO,cAAc,CACrB,MAAM,QAAQ,KAAK,WAAW,CAC9B,kBAAkB;AAGpB,OADqB,IAAI,mBAAmB,GAAG,CAC5B,mBAClB,YACA,SACA,SACA,WACA,eAAe,eAAe,KAC9B;AACD,0BAAyB;;;AAI1B,eAAe,eACd,IACA,YACA,MACA,WACmB;AACnB,oBAAmB,YAAY,kBAAkB;AAQjD,SAPe,MAAM,GAAmB;mBACtB,IAAI,IAAI,MAAM,aAAa,CAAC;iBAC9B,KAAK;cACR,UAAU;;;GAGrB,QAAQ,GAAG,EACC,KAAK,SAAS;;;AAI7B,MAAM,eAAe;;;;;;;;;;AAWrB,SAAS,mBAAmB,OAA2B,MAA2C;AACjG,KAAI,CAAC,MAAO,QAAO;AACnB,KAAI,CAAC,aAAa,KAAK,MAAM,CAAE,QAAO;AACtC,QAAO,SAAS,UAAU,GAAG,MAAM,kBAAkB,GAAG,MAAM;;;;;;;;;AAU/D,SAAS,oBACR,QACA,QACkC;CAClC,MAAM,kBAAkB,OAAO,2BAA2B;AAE1D,KAAI,OAAO,YAAa,QAAO;EAAE,MAAM;EAAQ;EAAiB;EAAQ;CAExE,MAAM,YAAY,OAAO,WAAW,EAAE;AACtC,KAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,QAAO;EAAE,MAAM;EAAO;EAAW;EAAiB;EAAQ;;;;;AAM3D,eAAsB,kBACrB,IACA,YACA,QAiB0C;AAC1C,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EACtC,MAAM,QAAkC,EAAE;AAC1C,MAAI,OAAO,OAAQ,OAAM,SAAS,OAAO;EACzC,MAAM,SAAS,OAAO,SAAS,wBAAwB,OAAO,OAAO,GAAG;AACxE,MAAI,OAAQ,OAAM,SAAS;AAC3B,MAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,MAAI,OAAO,gBAAgB,OAAO,KAAK,OAAO,aAAa,CAAC,SAAS,EACpE,OAAM,eAAe,OAAO;EAG7B,MAAM,eAAe,oBAAoB,QAAQ,OAAO;AACxD,MAAI,aAAc,OAAM,eAAe;AAIvC,MAAI,OAAO,cAAc,OAAO,YAAY,OAAO,QAClD,OAAM,aAAa;GAClB,OAAO,OAAO;GACd,MAAM,mBAAmB,OAAO,UAAU,QAAQ;GAClD,IAAI,mBAAmB,OAAO,QAAQ,MAAM;GAC5C;EAGF,MAAM,IAAI,OAAO,GAAG,MAAM;AAC1B,MAAI,GAAG;AACN,SAAM,IAAI;AACV,SAAM,gBAAgB,MAAM,qBAAqB,IAAI,WAAW;AAChE,SAAM,SAAS,MAAM,uBAAuB,IAAI,YAAY,MAAM,cAAc;;EAMjF,IAAI;AACJ,MAAI,OAAO,WAAW,CAAC,mBAAmB,OAAO,QAAQ,EAAE;GAC1D,MAAM,OAAO,MAAM,GACjB,WAAW,sBAAsB,CACjC,OAAO,CAAC,eAAe,aAAa,CAAC,CACrC,MAAM,QAAQ,KAAK,WAAW,CAC9B,kBAAkB;AACpB,oBAAiB,CAAC,MAAM,aAAa,MAAM,WAAW,CAAC,QACrD,SAAyB,CAAC,CAAC,KAC5B;;EAGF,MAAM,SAAS,MAAM,KAAK,SAAS,YAAY;GAC9C,QAAQ,OAAO;GACf,OAAO,OAAO,SAAS;GACvB,OAAO,OAAO,KAAK,MAAM,CAAC,SAAS,IAAI,QAAQ;GAC/C,SAAS,OAAO,UACb;IAAE,OAAO,OAAO;IAAS,WAAW,OAAO,SAAS;IAAQ,GAC5D;GACH;GACA,CAAC;EAGF,MAAM,SAAS,MAAM,iBAAiB,IAAI,WAAW;AACrD,QAAM,eAAe,IAAI,YAAY,OAAO,OAAO,OAAO;AAC1D,QAAM,mBAAmB,IAAI,YAAY,OAAO,MAAM;AAEtD,SAAO;GACN,SAAS;GACT,MAAM;IACL,OAAO,OAAO;IACd,YAAY,OAAO;IACnB,OAAO,OAAO;IACd;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,MAAI,iBAAiB,kCAAkC,oBAAoB,MAAM,CAChF,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,WAAW;IACnC;GACD;AAEF,MAAI,qBAAqB,OAAO,aAAa,CAC5C,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,WAAW;IACnC;GACD;AAEF,MAAI,iBAAiB,sBAEpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAoB,SAAS,MAAM;IAAS;GAC3D;AAEF,UAAQ,MAAM,uBAAuB,MAAM;AAC3C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;AAoBH,eAAsB,qBACrB,IACA,YACiD;AACjD,KAAI;EAEH,MAAM,YAAY,MADL,IAAI,kBAAkB,GAAG,CACT,sBAAsB,WAAW;AAC9D,MAAI,UAAU,WAAW,EACxB,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,OAAO,EAAE,EAAE;GAAE;AAU9C,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QANlB,MADG,IAAI,eAAe,GAAG,CACV,UAAU,UAAU,EAG/C,KAAK,OAAO;IAAE,IAAI,EAAE;IAAI,MAAM,EAAE;IAAM,OAAO,EAAE;IAAO,WAAW,EAAE;IAAW,EAAE,CAChF,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,EAEnC;GAAE;UACjC,OAAO;AACf,MAAI,oBAAoB,MAAM,CAC7B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,WAAW;IACnC;GACD;AAEF,UAAQ,MAAM,0BAA0B,MAAM;AAC9C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,iBACrB,IACA,YACA,IACA,QACsC;AACtC,KAAI;EAEH,MAAM,OAAO,MADA,IAAI,kBAAkB,GAAG,CACd,eACvB,YACA,IACA,SAAS,wBAAwB,OAAO,GAAG,OAC3C;AAED,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,2BAA2B;IACpC;GACD;AAKF,QAAM,WAAW,IAAI,YAAY,MADlB,MAAM,iBAAiB,IAAI,WAAW,CACP;AAC9C,QAAM,eAAe,IAAI,YAAY,KAAK;AAE1C,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,UAAQ,MAAM,sBAAsB,MAAM;AAC1C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;AAQH,eAAsB,iCACrB,IACA,YACA,IACA,QACsC;AACtC,KAAI;EAEH,MAAM,OAAO,MADA,IAAI,kBAAkB,GAAG,CACd,+BACvB,YACA,IACA,SAAS,wBAAwB,OAAO,GAAG,OAC3C;AAED,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,2BAA2B;IACpC;GACD;AAKF,QAAM,WAAW,IAAI,YAAY,MADlB,MAAM,iBAAiB,IAAI,WAAW,CACP;AAC9C,QAAM,eAAe,IAAI,YAAY,KAAK;AAE1C,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,UAAQ,MAAM,sBAAsB,MAAM;AAC1C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;AAWH,eAAsB,oBACrB,IACA,YACA,MAasC;AACtC,KAAI;EACH,MAAM,SAAS,MAAM,iBAAiB,IAAI,WAAW;AAGrD,MAAI,KAAK,OAAO,CAAC,OAChB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,WAAW;IACnC;GACD;EAGF,MAAM,YAAY,MAAM,oBAAoB,IAAI,YAAY,KAAK,KAAK;AACtE,MAAI,CAAC,UAAU,QAAS,QAAO;EAG/B,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,aAAa,IAAI,iBAAiB,IAAI;GAK5C,MAAM,kBAAkB,KAAK,SAC1B,wBAAwB,KAAK,OAAO,GACpC,eAAe,EAAE;GAEpB,IAAI,OAAkC,KAAK;AAC3C,OAAI,CAAC,MAAM;IACV,MAAM,aAAa,cAAc,KAAK,KAAK;AAC3C,QAAI,WACH,QAAO,MAAM,KAAK,mBAAmB,YAAY,YAAY,gBAAgB;;AAG/E,OAAI,KAAK,WAAW,YAEnB,6BADsB,MAAM,2BAA2B,KAAK,WAAW,EAC9B,UAAU,KAAK;GAGzD,MAAM,UAAU,MAAM,KAAK,OAAO;IACjC,MAAM;IACN;IACA,MAAM,KAAK;IACX,QAAQ,KAAK,UAAU;IACvB,UAAU,KAAK;IACf,QAAQ;IACR,eAAe,KAAK;IACpB,WAAW,KAAK;IAChB,aAAa,KAAK;IAClB,CAAC;AAEF,OAAI,KAAK,YAAY,OAOpB,SAAQ,mBANQ,MAAM,WAAW,kBAAkB,YAAY,QAAQ,IAAI,KAAK,QAAQ,EAMtD,IAAI,OAAO,oBAAoB;AAQlE,OAAI,KAAK,eACR;QAAI,KAAK,YAAY,QAAW;AAC/B,WAAM,WAAW,mBAAmB,YAAY,KAAK,eAAe,QAAQ,GAAG;KAI/E,MAAM,SAAS,MAAM,KAAK,SAAS,YAAY,KAAK,cAAc;AAClE,SAAI,OAAQ,SAAQ,kBAAkB,OAAO;;;AAI/C,SAAM,eAAe,KAAK,YAAY,QAAQ;AAG9C,OAAI,KAAK,OAAO,OAEf,SAAQ,MAAM,MADE,IAAI,cAAc,IAAI,CACV,OAAO,YAAY,QAAQ,IAAI,KAAK,IAAI;YAC1D,OAEV,SAAQ,MAAM,EAAE,GAAG,cAAc;AAWlC,OAAI,KAAK,WACR,OAAM,iBAAiB,KAAK,YAAY,QAAQ,IAAI,iBAAiB,KAAK,WAAW;AAGtF,UAAO;IACN;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,MAAI,oBAAoB,MAAM,CAC7B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,WAAW;IACnC;GACD;AAEF,MAAI,iBAAiB,sBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAoB,SAAS,MAAM;IAAS;GAC3D;EAOF,MAAM,UAAU,iBAAiB,QAAQ,MAAM,QAAQ,aAAa,GAAG;AACvE,MAAI,QAAQ,SAAS,2BAA2B,IAAI,QAAQ,SAAS,gBAAgB,EAAE;AAEtF,OAAI,QAAQ,SAAS,OAAO,CAC3B,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS,SAAS,KAAK,QAAQ,mBAAmB,kCAAkC,WAAW;KAC/F;IACD;AAEF,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;AAEF,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;AAWH,eAAsB,oBACrB,IACA,YACA,IACA,MAYsC;AACtC,KAAI;EACH,MAAM,SAAS,MAAM,iBAAiB,IAAI,WAAW;AAGrD,MAAI,KAAK,OAAO,CAAC,OAChB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,WAAW;IACnC;GACD;AAGF,MAAI,KAAK,MAAM;GACd,MAAM,YAAY,MAAM,oBAAoB,IAAI,YAAY,KAAK,KAAK;AACtE,OAAI,CAAC,UAAU,QAAS,QAAO;;EAMhC,MAAM,aAAc,MAAM,UAHb,IAAI,kBAAkB,GAAG,EAGI,YAAY,IAAI,KAAK,OAAO,IAAK;EAK3E,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,UAAU,IAAI,kBAAkB,IAAI;GAC1C,MAAM,aAAa,IAAI,iBAAiB,IAAI;GAG5C,MAAM,WACL,KAAK,QAAQ,KAAK,SAAS,UAAa,KAAK,WAAW,cACrD,MAAM,QAAQ,SAAS,YAAY,WAAW,GAC9C;AAGJ,OAAI,KAAK,MAAM;AACd,QAAI,CAAC,SACJ,OAAM,OAAO,uBAAO,IAAI,MAAM,2BAA2B,KAAK,EAAE,EAC/D,UAAU,EAAE,MAAM,aAAsB,EACxC,CAAC;IAGH,MAAM,WAAW,YAAY,KAAK,MAAM,SAAS;AACjD,QAAI,CAAC,SAAS,MACb,OAAM,OAAO,OAAO,IAAI,MAAM,SAAS,QAAQ,EAAE,EAChD,UAAU,EAAE,MAAM,YAAqB,EACvC,CAAC;;GAKJ,IAAI;AACJ,OAAI,KAAK,QAAQ,UAAU,QAAQ,SAAS,SAAS,KAAK,KACzD,WAAU,SAAS;AAIpB,QADwB,KAAK,UAAU,UAAU,YACzB,aAAa;AACpC,QAAI,CAAC,SACJ,OAAM,OAAO,uBAAO,IAAI,MAAM,2BAA2B,KAAK,EAAE,EAC/D,UAAU,EAAE,MAAM,aAAsB,EACxC,CAAC;IAEH,MAAM,gBAAgB,MAAM,2BAA2B,KAAK,WAAW;IACvE,MAAM,eAAe,KAAK,SAAS,SAAY,KAAK,OAAO,SAAS;AACpE,+BAA2B,cAAc,UAAU,aAAa;;GAGjE,MAAM,UAAU,MAAM,QAAQ,OAAO,YAAY,YAAY;IAC5D,MAAM,KAAK;IACX,MAAM,KAAK;IACX,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,aAAa,KAAK;IAClB,CAAC;AAEF,OAAI,KAAK,YAAY,OAMpB,SAAQ,mBALQ,MAAM,WAAW,kBAAkB,YAAY,YAAY,KAAK,QAAQ,EAKtD,IAAI,OAAO,oBAAoB;AAIlE,OAAI,WAAW,KAAK,KACnB,OAAM,yBAAyB,KAAK,YAAY,SAAS,KAAK,MAAM,WAAW;AAMhF,OAAI,eAAe,IAAI,KAAK,QAAQ,QAAQ,iBAC3C,OAAM,0BACL,KACA,YACA,QAAQ,IACR,QAAQ,kBACR,KAAK,KACL;AAIF,OAAI,KAAK,OAAO,OAEf,SAAQ,MAAM,MADE,IAAI,cAAc,IAAI,CACV,OAAO,YAAY,YAAY,KAAK,IAAI;YAC1D,OAEV,SAAQ,MAAM,MADE,IAAI,cAAc,IAAI,CACV,IAAI,YAAY,WAAW;AAGxD,SAAM,eAAe,KAAK,YAAY,QAAQ;AAM9C,OAAI,KAAK,WACR,OAAM,iBACL,KACA,YACA,YACA,QAAQ,UAAU,KAAK,QACvB,KAAK,WACL;AAGF,UAAO;IACN;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AAGf,MAAI,YAAY,MAAM,CACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,MAAM,SAAS;IAAM,SAAS,MAAM;IAAS;GAC5D;AAEF,MAAI,oBAAoB,MAAM,CAC7B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,WAAW;IACnC;GACD;AAEF,MAAI,iBAAiB,sBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAoB,SAAS,MAAM;IAAS;GAC3D;EAEF,MAAM,UAAU,iBAAiB,QAAQ,MAAM,QAAQ,aAAa,GAAG;AACvE,MAAI,QAAQ,SAAS,2BAA2B,IAAI,QAAQ,SAAS,gBAAgB,EAAE;AACtF,OAAI,QAAQ,SAAS,OAAO,CAC3B,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS,SAAS,KAAK,QAAQ,GAAG,kCAAkC,WAAW;KAC/E;IACD;AAEF,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;AAEF,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,uBACrB,IACA,YACA,IACA,UAC4C;AAC5C,KAAI;EACH,MAAM,SAAS,MAAM,iBAAiB,IAAI,WAAW;AAkCrD,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAjCS,MAAM,gBAAgB,IAAI,OAAO,QAAQ;IAC1D,MAAM,OAAO,IAAI,kBAAkB,IAAI;IACvC,MAAM,aAAa,IAAI,iBAAiB,IAAI;IAC5C,MAAM,aAAc,MAAM,UAAU,MAAM,YAAY,GAAG,IAAK;IAC9D,MAAM,MAAM,MAAM,KAAK,UAAU,YAAY,YAAY,SAAS;IAElE,MAAM,kBAAkB,MAAM,WAAW,kBAAkB,YAAY,WAAW;AAClF,QAAI,gBAAgB,SAAS,EAC5B,OAAM,WAAW,kBAChB,YACA,IAAI,IACJ,gBAAgB,KAAK,WAAW;KAC/B,UAAU,MAAM,OAAO;KACvB,WAAW,MAAM;KACjB,EAAE,CACH;AAGF,QAAI,QAAQ;KAEX,MAAM,UAAU,IAAI,cAAc,IAAI;AACtC,WAAM,QAAQ,iBAAiB,YAAY,YAAY,IAAI,GAAG;AAE9D,SAAI,MAAM,MAAM,QAAQ,IAAI,YAAY,IAAI,GAAG;;AAGhD,UAAM,eAAe,KAAK,YAAY,IAAI;AAE1C,WAAO;KACN,EAIwB;GACzB;UACO,KAAK;AACb,MAAI,eAAe,sBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,IAAI;IACb;GACD;AAEF,UAAQ,MAAM,4BAA4B,IAAI;AAC9C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,oBACrB,IACA,YACA,IACoD;AACpD,KAAI;EACH,MAAM,SAAS,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACvD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,aAAc,MAAM,UAAU,MAAM,YAAY,GAAG,IAAK;AAC9D,UAAO;IACN,IAAI;IACJ,SAAS,MAAM,KAAK,OAAO,YAAY,WAAW;IAClD;IACA;AAEF,MAAI,CAAC,OAAO,QACX,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,2BAA2B;IACpC;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IAAE,SAAS;IAAM,IAAI,OAAO;IAAI;GACtC;UACO,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,YACA,IAC4D;AAC5D,KAAI;EACH,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,aAAc,MAAM,0BAA0B,MAAM,YAAY,GAAG,IAAK;AAC9E,UAAO,KAAK,QAAQ,YAAY,WAAW;IAC1C;AAEF,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,mCAAmC;IAC5C;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IAAE,UAAU;IAAM;IAAM;GAC9B;UACO,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAC9C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;AAQH,eAAsB,6BACrB,IACA,YACA,IACoD;AACpD,KAAI;EAEH,MAAM,aAAc,MAAM,0BADb,IAAI,kBAAkB,GAAG,EACoB,YAAY,GAAG,IAAK;AAsB9E,MAAI,CAnBY,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GAExD,MAAM,aAAa,MADH,IAAI,kBAAkB,IAAI,CACT,gBAAgB,YAAY,WAAW;AAExE,OAAI,YAAY;AAGf,UADgB,IAAI,cAAc,IAAI,CACxB,OAAO,YAAY,WAAW;AAG5C,UADoB,IAAI,kBAAkB,IAAI,CAC5B,gBAAgB,YAAY,WAAW;AAGzD,UADqB,IAAI,mBAAmB,IAAI,CAC7B,cAAc,YAAY,WAAW;;AAGzD,UAAO;IACN,CAGD,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,2BAA2B;IACpC;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IAAE,SAAS;IAAM,IAAI;IAAY;GACvC;UACO,OAAO;AACf,UAAQ,MAAM,mCAAmC,MAAM;AACvD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,yBACrB,IACA,YACA,UAAgE,EAAE,EACS;AAC3E,KAAI;EAEH,MAAM,SAAS,MADF,IAAI,kBAAkB,GAAG,CACZ,YAAY,YAAY;GACjD,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB,OAAO,EAAE,QAAQ,QAAQ,QAAQ;GACjC,CAAC;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IACL,OAAO,OAAO,MAAM,KAAK,UAAU;KAClC,IAAI,KAAK;KACT,MAAM,KAAK;KACX,MAAM,KAAK;KACX,QAAQ,KAAK;KACb,QAAQ,KAAK;KACb,kBAAkB,KAAK;KACvB,MAAM,KAAK;KACX,UAAU,KAAK;KACf,WAAW,KAAK;KAChB,WAAW,KAAK;KAChB,aAAa,KAAK;KAClB,WAAW,KAAK;KAChB,EAAE;IACH,YAAY,OAAO;IACnB;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,UAAQ,MAAM,+BAA+B,MAAM;AACnD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,0BACrB,IACA,YACA,UAA+B,EAAE,EACO;AACxC,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,OAJK,MADD,IAAI,kBAAkB,GAAG,CACb,aAAa,YAAY,EAAE,QAAQ,QAAQ,QAAQ,CAAC,EAI7D;GACf;UACO,OAAO;AACf,UAAQ,MAAM,gCAAgC,MAAM;AACpD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,sBACrB,IACA,YACA,IACA,aACsC;AACtC,KAAI;EACH,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,WAAW,MAAM,KAAK,eAAe,YAAY,GAAG;GAC1D,MAAM,aAAa,UAAU,MAAM;AACnC,OAAI,SAEH,6BADsB,MAAM,2BAA2B,KAAK,WAAW,EAC9B,UAAU,SAAS,KAAK;AAElE,UAAO,KAAK,SAAS,YAAY,YAAY,YAAY;IACxD;AAGF,QAAM,WAAW,IAAI,YAAY,MADlB,MAAM,iBAAiB,IAAI,WAAW,CACP;AAE9C,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,MAAI,iBAAiB,sBACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,MAAM;IACf;GACD;AAEF,UAAQ,MAAM,2BAA2B,MAAM;AAC/C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,wBACrB,IACA,YACA,IACsC;AACtC,KAAI;EACH,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,aAAc,MAAM,UAAU,MAAM,YAAY,GAAG,IAAK;AAC9D,UAAO,KAAK,WAAW,YAAY,WAAW;IAC7C;AAGF,QAAM,WAAW,IAAI,YAAY,MADlB,MAAM,iBAAiB,IAAI,WAAW,CACP;AAE9C,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,MAAI,iBAAiB,sBACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,MAAM;IACf;GACD;AAEF,UAAQ,MAAM,6BAA6B,MAAM;AACjD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,qBACrB,IACA,YACA,IACA,UAKI,EAAE,EACgC;AACtC,KAAI;EACH,MAAM,mBAAmB,2BAA2B,QAAQ,KAAK;EACjE,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,aAAc,MAAM,UAAU,MAAM,YAAY,GAAG,IAAK;GAC9D,MAAM,gBAAgB,MAAM,2BAA2B,KAAK,WAAW;GAOvE,MAAM,WAAW,MAAM,KAAK,SAAS,YAAY,WAAW;GAE5D,MAAM,YAAY,MAAM,KAAK,QAC5B,YACA,YACA,QAAQ,aACR,QAAQ,qBACR,QAAQ,qBACR,cAAc,mBACd,cAAc,UACd,iBACA;AAKD,OACC,UAAU,WAAW,eACrB,SAAS,QACT,UAAU,QACV,SAAS,SAAS,UAAU,KAE5B,OAAM,yBAAyB,KAAK,YAAY,SAAS,MAAM,UAAU,MAAM,WAAW;AAG3F,UAAO;IACN;AAGF,QAAM,WAAW,IAAI,YAAY,MADlB,MAAM,iBAAiB,IAAI,WAAW,CACP;AAE9C,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,MAAI,iBAAiB,6BACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,MAAM;IACf;GACD;AAIF,MAAI,iBAAiB,qBACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,MAAM;IACf;GACD;AAEF,MAAI,iBAAiB,uBAAuB;GAG3C,MAAM,UAAmB,MAAM;AAM/B,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAPD,OAAO,YAAY,YACnB,YAAY,QACZ,UAAU,WACV,QAAQ,SAAS,kBAIO,kBAAkB;KACzC,SAAS,MAAM;KACf;IACD;;EAMF,MAAM,UAAU,iBAAiB,QAAQ,MAAM,QAAQ,aAAa,GAAG;AACvE,OACE,QAAQ,SAAS,2BAA2B,IAAI,QAAQ,SAAS,gBAAgB,KAClF,QAAQ,SAAS,OAAO,CAExB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,mEAAmE,WAAW;IACvF;GACD;AAEF,UAAQ,MAAM,0BAA0B,MAAM;AAC9C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,uBACrB,IACA,YACA,IACA,UAA6B,EAAE,EACO;AACtC,KAAI;EACH,MAAM,mBAAmB,2BAA2B,QAAQ,KAAK;EACjE,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,aAAc,MAAM,UAAU,MAAM,YAAY,GAAG,IAAK;AAC9D,UAAO,KAAK,UAAU,YAAY,YAAY,iBAAiB;IAC9D;AAGF,QAAM,WAAW,IAAI,YAAY,MADlB,MAAM,iBAAiB,IAAI,WAAW,CACP;AAE9C,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,MAAI,iBAAiB,6BACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAY,SAAS,MAAM;IAAS;GACnD;AAEF,MAAI,iBAAiB,sBACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,MAAM;IACf;GACD;AAEF,UAAQ,MAAM,4BAA4B,MAAM;AAChD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,4BACrB,IACA,YACwC;AACxC,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,OAJK,MADD,IAAI,kBAAkB,GAAG,CACb,eAAe,WAAW,EAInC;GACf;UACO,OAAO;AACf,UAAQ,MAAM,kCAAkC,MAAM;AACtD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,0BACrB,IACA,YACA,IACA,UAA6B,EAAE,EACO;AACtC,KAAI;EACH,MAAM,mBAAmB,2BAA2B,QAAQ,KAAK;EACjE,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACrD,MAAM,OAAO,IAAI,kBAAkB,IAAI;GACvC,MAAM,aAAc,MAAM,UAAU,MAAM,YAAY,GAAG,IAAK;AAC9D,UAAO,KAAK,aAAa,YAAY,YAAY,iBAAiB;IACjE;AAGF,QAAM,WAAW,IAAI,YAAY,MADlB,MAAM,iBAAiB,IAAI,WAAW,CACP;AAE9C,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,UAAU,KAAK;IAAE;GACrC;UACO,OAAO;AACf,MAAI,iBAAiB,6BACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAY,SAAS,MAAM;IAAS;GACnD;AAEF,MAAI,iBAAiB,sBACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,MAAM;IACf;GACD;AAEF,UAAQ,MAAM,gCAAgC,MAAM;AACpD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,YACA,IAOC;AACD,KAAI;EAEH,MAAM,QAAQ,MADD,IAAI,kBAAkB,GAAG,CACb,eAAe,YAAY,GAAG;AAEvD,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,2BAA2B;IACpC;GACD;EAGF,MAAM,eAAe,IAAI,mBAAmB,GAAG;EAE/C,MAAM,OAAO,MAAM,iBAAiB,MAAM,aAAa,SAAS,MAAM,eAAe,GAAG;EACxF,MAAM,QAAQ,MAAM,kBAAkB,MAAM,aAAa,SAAS,MAAM,gBAAgB,GAAG;AAE3F,SAAO;GACN,SAAS;GACT,MAAM;IACL,YACC,MAAM,oBAAoB,QAAQ,MAAM,oBAAoB,MAAM;IACnE,MAAM,MAAM,QAAQ;IACpB,OAAO,OAAO,QAAQ;IACtB;GACD;UACO,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAC9C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;AAQH,eAAsB,0BACrB,IACA,YACA,IAYC;AACD,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EACtC,MAAM,OAAO,MAAM,KAAK,eAAe,YAAY,GAAG;AAEtD,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,2BAA2B;IACpC;GACD;AAGF,MAAI,CAAC,KAAK,iBACT,QAAO;GACN,SAAS;GACT,MAAM;IACL,kBAAkB,KAAK;IACvB,cAAc,CACb;KACC,IAAI,KAAK;KACT,QAAQ,KAAK;KACb,MAAM,KAAK;KACX,QAAQ,KAAK;KACb,WAAW,KAAK;KAChB,CACD;IACD;GACD;EAGF,MAAM,eAAe,MAAM,KAAK,iBAAiB,YAAY,KAAK,iBAAiB;AAEnF,SAAO;GACN,SAAS;GACT,MAAM;IACL,kBAAkB,KAAK;IACvB,cAAc,aAAa,KAAK,OAAO;KACtC,IAAI,EAAE;KACN,QAAQ,EAAE;KACV,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,WAAW,EAAE;KACb,EAAE;IACH;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,MACpB,SAAQ,MAAM,+BAA+B,MAAM;AAEpD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAkBH,eAAe,0BACd,KACA,gBACA,eACA,kBACA,MACgB;CAEhB,MAAM,aAAa,MAAM,IACvB,WAAW,sBAAsB,CACjC,OAAO,KAAK,CACZ,MAAM,QAAQ,KAAK,eAAe,CAClC,kBAAkB;AAEpB,KAAI,CAAC,WAAY;CAUjB,MAAM,wBAPS,MAAM,IACnB,WAAW,iBAAiB,CAC5B,OAAO,OAAO,CACd,MAAM,iBAAiB,KAAK,WAAW,GAAG,CAC1C,MAAM,gBAAgB,KAAK,EAAE,CAC7B,SAAS,EAEyB,KAAK,MAAM,EAAE,KAAK;AACtD,KAAI,qBAAqB,WAAW,EAAG;CAGvC,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,QAAQ,qBAClB,KAAI,QAAQ,KACX,UAAS,QAAQ,KAAK;AAGxB,KAAI,OAAO,KAAK,SAAS,CAAC,WAAW,EAAG;AAGxC,oBAAmB,gBAAgB,kBAAkB;CACrD,MAAM,YAAY,MAAM;CAGxB,MAAM,aAAa,OAAO,QAAQ,SAAS,CAAC,KAAK,CAAC,KAAK,WAAW;AACjE,qBAAmB,KAAK,aAAa;EACrC,MAAM,aAAa,OAAO,UAAU,YAAY,UAAU,OAAO,KAAK,UAAU,MAAM,GAAG;AACzF,SAAO,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK;GAC9B;AAEF,OAAM,GAAG;WACC,IAAI,IAAI,UAAU,CAAC;QACtB,IAAI,KAAK,YAAY,GAAG,KAAK,CAAC;8BACR,iBAAiB;cACjC,cAAc;GACzB,QAAQ,IAAI;;;;;;;;;;;;;;AAef,eAAe,iBACd,KACA,YACA,SACA,QACA,YACgB;CAChB,MAAM,UAAU,IAAI,mBAAmB,IAAI;CAC3C,IAAI,YAAY;AAEhB,MAAK,MAAM,CAAC,cAAc,UAAU,OAAO,QAAQ,WAAW,EAAE;AAC/D,MAAI,CAAC,MAAM,QAAQ,MAAM,CACxB,OAAM,IAAI,sBAAsB,cAAc,aAAa,iCAAiC;EAG7F,MAAM,UAAoB,EAAE;AAC5B,OAAK,MAAM,QAAQ,OAAO;AACzB,OAAI,OAAO,SAAS,YAAY,KAAK,WAAW,EAC/C,OAAM,IAAI,sBACT,cAAc,aAAa,sCAC3B;GAEF,MAAM,OAAO,MAAM,QAAQ,WAAW,cAAc,MAAM,OAAO;AACjE,OAAI,CAAC,KACJ,OAAM,IAAI,sBACT,0BAA0B,aAAa,IAAI,KAAK,GAC/C,SAAS,aAAa,OAAO,MAAM,KAEpC;AAEF,WAAQ,KAAK,KAAK,GAAG;;AAGtB,QAAM,QAAQ,iBAAiB,YAAY,SAAS,cAAc,QAAQ;AAC1E,cAAY;;AAKb,KAAI,UAAW,sBAAqB;;;;;;ACziErC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;;;;;AAM3B,MAAM,0BAAkD,IAAI,IAAI;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAM,qBAAgD;CACrD,QAAQ;CACR,MAAM;CACN,KAAK;CACL,MAAM;CACN,QAAQ;CACR,SAAS;CACT,SAAS;CACT,UAAU;CACV,QAAQ;CACR,aAAa;CACb,cAAc;CACd,OAAO;CACP,MAAM;CACN,WAAW;CACX,MAAM;CACN,UAAU;CACV;;;;AAwBD,eAAsB,iBACrB,aACA,UAMI,EAAE,EACN,UAAmC,EAAE,EACT;CAC5B,MAAM,sBAAsB,MAAM,yBAAyB,aAAa,QAAQ,GAAG;AAKnF,QAAO;EACN,SAAS;EACT,MAJY,MAAM,WAAW,KAAK,UAAU,oBAAoB,CAAC;EAKjE,aAAa;EACb;EACA;;;;;;;;;AAUF,eAAsB,yBACrB,aACA,IACiC;CACjC,MAAM,sBAA6C,EAAE;AAErD,MAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,EAAE;EAE7D,MAAM,SAAS,wBAAwB,WAAW,OAAO;AAEzD,sBAAoB,QAAQ;GAC3B,OAAO,WAAW,MAAM;GACxB,eAAe,WAAW,MAAM,iBAAiB,WAAW,MAAM;GAClE,UAAU,WAAW,MAAM,YAAY,EAAE;GACzC,SAAS,WAAW,MAAM,YAAY,EAAE,EAAE,SAAS,MAAM;GACzD,UAAU,WAAW,MAAM,YAAY;GACvC;GACA;;AAGF,KAAI,CAAC,GAAI,QAAO;AAEhB,KAAI;EAEH,MAAM,gBAAgB,MADL,IAAI,eAAe,GAAG,CACF,2BAA2B;AAChE,OAAK,MAAM,cAAc,eAAe;AACvC,OAAI,oBAAoB,WAAW,MAAO;GAE1C,MAAM,SAAkD,EAAE;AAC1D,QAAK,MAAM,SAAS,WAAW,OAC9B,QAAO,MAAM,QAAQ,kBAAkB,MAAM;GAG9C,MAAM,wBAAwB,WAAW,OAAO,eAAe,EAAE;GACjE,MAAM,aAAa,IAAI,IAAI,WAAW,OAAO,KAAK,UAAU,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC;GACtF,MAAM,cAAwB,EAAE;AAChC,QAAK,MAAM,QAAQ,uBAAuB;AACzC,QAAI,YAAY,SAAS,KAAK,CAAE;IAChC,MAAM,YAAY,WAAW,IAAI,KAAK;AACtC,QAAI,CAAC,aAAa,CAAC,wBAAwB,IAAI,UAAU,EAAE;AAC1D,aAAQ,KACP,wDAAwD,KAAK,mBAAmB,WAAW,KAAK,IAChG;AACD;;AAED,QAAI,YAAY,UAAU,6BAA6B;AACtD,aAAQ,KACP,uBAAuB,WAAW,KAAK,uBAAuB,4BAA4B,2CAC1F;AACD;;AAED,gBAAY,KAAK,KAAK;;AAGvB,uBAAoB,WAAW,QAAQ;IACtC,OAAO,WAAW;IAClB,eAAe,WAAW,iBAAiB,WAAW;IACtD,UAAU,WAAW,YAAY,EAAE;IACnC,QAAQ,WAAW;IACnB,YAAY,WAAW;IACvB,UAAU,WAAW,aAAa;IAClC,YAAY,WAAW;IACvB,WAAW,WAAW;IACtB,GAAI,WAAW,SAAS,EAAE,QAAQ,MAAM,GAAG,EAAE;IAC7C,aAAa,YAAY,SAAS,IAAI,cAAc;IACpD;IACA;;UAEM,OAAO;AACf,UAAQ,MAAM,6DAA6D,MAAM;;AAGlF,QAAO;;;;;;AAOR,SAAS,wBAAwB,QAGW;CAC3C,MAAM,SAAkD,EAAE;CAG1D,MAAM,QAAQ,OAAO,OAAO,MAAM,UAAU,aAAa,OAAO,KAAK,OAAO,GAAG,OAAO,SAAS,EAAE;AAEjG,MAAK,MAAM,CAAC,MAAM,gBAAgB,OAAO,QAAQ,MAAM,CACtD,QAAO,QAAQ,iBAAiB,MAAM,YAAY;AAGnD,QAAO;;;;;;AAOR,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,iBAAiB,MAAc,QAAkC;AACzE,KAAI,CAAC,SAAS,OAAO,CACpB,QAAO;EAAE,MAAM;EAAU,OAAO,YAAY,KAAK;EAAE;AAIpD,KAAI,OAAO,eACV,QAAO;EAAE,MAAM;EAAgB,OAAO,YAAY,KAAK;EAAE;AAE1D,KAAI,OAAO,QACV,QAAO;EAAE,MAAM;EAAS,OAAO,YAAY,KAAK;EAAE;AAEnD,KAAI,OAAO,YACV,QAAO;EAAE,MAAM;EAAa,OAAO,YAAY,KAAK;EAAE;CAIvD,MAAM,MAAM,SAAS,OAAO,KAAK,GAAG,OAAO,OAAO;AAGlD,SAFiB,OAAO,KAAK,aAAa,WAAW,IAAI,WAAW,QAEpE;EACC,KAAK,YACJ,QAAO;GAAE,MAAM;GAAU,OAAO,YAAY,KAAK;GAAE;EACpD,KAAK,YACJ,QAAO;GAAE,MAAM;GAAU,OAAO,YAAY,KAAK;GAAE;EACpD,KAAK,aACJ,QAAO;GAAE,MAAM;GAAW,OAAO,YAAY,KAAK;GAAE;EACrD,KAAK,UACJ,QAAO;GAAE,MAAM;GAAY,OAAO,YAAY,KAAK;GAAE;EACtD,KAAK,WAAW;GACf,MAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,GAAG,IAAI,SAAS,EAAE;AAC3D,UAAO;IACN,MAAM;IACN,OAAO,YAAY,KAAK;IACxB,SAAS,OACP,QAAQ,MAAmB,OAAO,MAAM,SAAS,CACjD,KAAK,OAAO;KACZ,OAAO;KACP,OAAO,EAAE,OAAO,EAAE,CAAC,aAAa,GAAG,EAAE,MAAM,EAAE;KAC7C,EAAE;IACJ;;EAEF,KAAK,WACJ,QAAO;GAAE,MAAM;GAAS,OAAO,YAAY,KAAK;GAAE;EACnD,KAAK,YACJ,QAAO;GAAE,MAAM;GAAU,OAAO,YAAY,KAAK;GAAE;EACpD,KAAK;EACL,KAAK;AAEJ,OAAI,KAAK,UACR,QAAO,iBAAiB,MAAM,IAAI,UAAU;AAE7C,UAAO;IAAE,MAAM;IAAU,OAAO,YAAY,KAAK;IAAE;EACpD,QACC,QAAO;GAAE,MAAM;GAAU,OAAO,YAAY,KAAK;GAAE;;;AAItD,SAAS,kBAAkB,OAAuC;CACjE,MAAM,QAAiC;EACtC,MAAM,mBAAmB,MAAM,SAAS;EACxC,OAAO,MAAM;EACb,UAAU,MAAM;EAChB,IAAI,MAAM;EACV;AAED,KAAI,MAAM,OAAQ,OAAM,SAAS,MAAM;AACvC,KAAI,MAAM,QAAS,OAAM,UAAU,MAAM;AAIzC,KAAI,MAAM,YAAY,QACrB,OAAM,UAAU,MAAM,WAAW,QAAQ,KAAK,WAAW;EACxD;EACA,OAAO,MAAM,OAAO,EAAE,CAAC,aAAa,GAAG,MAAM,MAAM,EAAE;EACrD,EAAE;AAIJ,MACE,MAAM,SAAS,cAAc,MAAM,SAAS,UAAU,MAAM,SAAS,YACtE,MAAM,WAEN,OAAM,aAAa,EAAE,GAAG,MAAM,YAAY;AAG3C,QAAO;;;;;AAMR,SAAS,YAAY,MAAsB;AAC1C,QAAO,KACL,QAAQ,oBAAoB,MAAM,CAClC,QAAQ,qBAAqB,QAAQ,IAAI,aAAa,CAAC,CACvD,MAAM;;;;;;;;AC1RT,eAAsB,mBACrB,IACA,YACA,SACA,SAA6B,EAAE,EACY;AAC3C,KAAI;EACH,MAAM,OAAO,IAAI,mBAAmB,GAAG;EACvC,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,IAAI,CACxC,KAAK,YAAY,YAAY,SAAS,EAAE,OAAO,KAAK,IAAI,OAAO,SAAS,IAAI,IAAI,EAAE,CAAC,EACnF,KAAK,aAAa,YAAY,QAAQ,CACtC,CAAC;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAO;IAAO;GACtB;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,kBACrB,IACA,YACuC;AACvC,KAAI;EAEH,MAAM,OAAO,MADA,IAAI,mBAAmB,GAAG,CACf,SAAS,WAAW;AAE5C,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,uBAAuB;IAChC;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,sBACrB,IACA,YACA,cACsC;AACtC,KAAI;EAIH,MAAM,WAAW,MAHI,IAAI,mBAAmB,GAAG,CAGX,SAAS,WAAW;AACxD,MAAI,CAAC,SACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,uBAAuB;IAChC;GACD;EAIF,MAAM,EAAE,OAAO,GAAG,cAAc,SAAS;EAKzC,MAAM,EAAE,MAAM,qBAAqB,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GAC3E,MAAM,iBAAiB,IAAI,kBAAkB,IAAI;GACjD,MAAM,kBAAkB,IAAI,mBAAmB,IAAI;AAcnD,UAAO;IAAE,MAZO,MAAM,eAAe,OAAO,SAAS,YAAY,SAAS,SAAS;KAClF,MAAM;KACN,MAAM,OAAO,UAAU,WAAW,QAAQ;KAC1C,CAAC;IASsB,mBAPD,MAAM,gBAAgB,OAAO;KACnD,YAAY,SAAS;KACrB,SAAS,SAAS;KAClB,MAAM,SAAS;KACf,UAAU;KACV,CAAC,EAEuD;IAAI;IAC5D;EAEF,MAAM,YAAY,IAAI,mBAAmB,GAAG;AAC5C,QAAM,YAAY;AACjB,OAAI;AACH,UAAM,UAAU,iBACf,SAAS,YACT,SAAS,SACT,kBACA,GACA;YACO,OAAO;AACf,YAAQ,MACP,6CAA6C,SAAS,WAAW,GAAG,SAAS,QAAQ,IACrF,MACA;;IAED;AAEF,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;ACzJH,MAAM,2BAA2B;;;;AAejC,eAAsB,gBACrB,IACA,QAQwC;AACxC,KAAI;AACH,MAAI,OAAO,SAAS,QAAW;GAC9B,MAAM,QAAQ,KAAK,IAAI,OAAO,SAAS,IAAI,IAAI;GAC/C,MAAM,UAAU,OAAO,OAAO,KAAK;AACnC,OACC,OAAO,WAAW,UAClB,CAAC,OAAO,cAAc,OAAO,KAAK,IAClC,OAAO,OAAO,KACd,CAAC,OAAO,cAAc,OAAO,CAE7B,QAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAoB,SAAS;KAAsB;IAClE;AAWF,UAAO;IAAE,SAAS;IAAM,MAPT,MADF,IAAI,gBAAgB,GAAG,CACV,SAAS;KAClC,MAAM,OAAO;KACb;KACA,UAAU,OAAO;KACjB,GAAG,OAAO;KACV,UAAU,OAAO;KACjB,CAAC;IACoC;;EAIvC,MAAM,SAAS,MADF,IAAI,gBAAgB,GAAG,CACV,SAAS;GAClC,QAAQ,OAAO;GACf,OAAO,KAAK,IAAI,OAAO,SAAS,IAAI,IAAI;GACxC,UAAU,OAAO;GACjB,GAAG,OAAO;GACV,UAAU,OAAO;GACjB,CAAC;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IACL,OAAO,OAAO;IACd,YAAY,OAAO;IACnB;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,eACrB,IACA,IACoC;AACpC,KAAI;EAEH,MAAM,OAAO,MADA,IAAI,gBAAgB,GAAG,CACZ,SAAS,GAAG;AAEpC,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,yBAAyB;IAClC;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,kBACrB,IACA,OAcoC;AACpC,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAJI,MADA,IAAI,gBAAgB,GAAG,CACZ,OAAO,MAAM,EAItB;GACd;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,kBACrB,IACA,IACA,OAOoC;AACpC,KAAI,CAAC,wBAAwB,MAAM,CAClC,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAEF,KAAI;EAEH,MAAM,OAAO,MADA,IAAI,gBAAgB,GAAG,CACZ,OAAO,IAAI,MAAM;AAEzC,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,yBAAyB;IAClC;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;UACO,OAAO;AACf,MAAI,sBAAsB,MAAM,CAC/B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAC/D;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAIH,eAAsB,2BACrB,IACA,IACA,oBACA,OACoC;AACpC,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,gBAAgB,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,MAAM;AAC1F,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAEF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM;GAAE;SACjC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAIH,SAAS,sBAAsB,OAAyB;AACvD,KAAI,SAAS,OAAO,UAAU,UAC7B;MAAI,UAAU,SAAS,MAAM,SAAS,QAAS,QAAO;;CAEvD,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,KAAI,yBAAyB,KAAK,QAAQ,CAAE,QAAO;AACnD,QAAO,QACN,SAAS,OAAO,UAAU,YAAY,WAAW,SAAS,sBAAsB,MAAM,MAAM,CAC5F;;;;;AAMF,eAAsB,kBACrB,IACA,IAC4D;AAC5D,KAAI;EAEH,MAAM,aAAa,MADN,IAAI,gBAAgB,GAAG,CACN,qBAAqB,GAAG;AAEtD,MAAI,CAAC,WACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,yBAAyB;IAClC;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IAAE,SAAS;IAAM;IAAY;GACnC;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;ACrPH,SAAS,mBAAmB,gBAAwB,UAA0B;AAC7E,QAAO,GAAG,eAAe,kBAAkB,mBAAmB,SAAS,CAAC;;;;;AAMzE,SAAS,gBACR,QACA,OACA,gBACa;CAEb,MAAM,SAAS,OAAO,UAAU;CAChC,MAAM,UAAU,WAAW;CAC3B,MAAM,iBAAiB,OAAO,UAAU,cAAc;AAEtD,QAAO;EACN,IAAI,OAAO;EACX,MAAM,OAAO,eAAe,OAAO;EACnC,SAAS,OAAO;EAChB,SAAS;EACT;EACA;EACA,QAAQ,OAAO,UAAU;EACzB,oBAAoB,OAAO,sBAAsB;EACjD,sBAAsB,OAAO,wBAAwB;EACrD,cAAc,OAAO,gBAAgB;EACrC,cAAc,OAAO;EACrB,gBAAgB,OAAO,MAAM,OAAO,UAAU,KAAK;EACnD,sBAAsB,OAAO,MAAM,SAAS,UAAU,KAAK;EAC3D,UAAU,OAAO,KAAK,OAAO,SAAS,EAAE,CAAC,CAAC,SAAS;EACnD,aAAa,OAAO,KAAK,OAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,SAAS;EACrE,aAAa,OAAO,aAAa,aAAa;EAC9C,aAAa,OAAO,aAAa,aAAa,IAAI;EAClD,eAAe,OAAO,eAAe,aAAa,IAAI;EACtD,aAAa,OAAO,eAAe;EACnC,SACC,iBAAiB,iBAAiB,mBAAmB,gBAAgB,OAAO,GAAG,GAAG;EACnF,iBAAiB,OAAO,mBAAmB;EAC3C,UAAU,OAAO,QAAQ,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU;GAC3E,MAAM,aAAa,OAAO,OAAO,KAAK,QAAQ;AAC9C,UAAO,aACJ,CACA;IACC;IACA,aAAa,KAAK;IAClB,OAAO,KAAK;IACZ;IACA,aAAa,KAAK,eAAe;IACjC,CACD,GACA,EAAE;IACJ;EACF;;;;;AAMF,SAAS,yBACR,OACA,OACa;CACb,MAAM,SAAS,OAAO,UAAU;CAChC,MAAM,UAAU,WAAW;AAE3B,QAAO;EACN,IAAI,MAAM;EACV,MAAM,OAAO,eAAe,MAAM;EAClC,SAAS,MAAM;EACf,SAAS;EACT;EACA;EACA,QAAQ;EACR,WAAW;EACX,cAAc,MAAM;EACpB,gBAAgB,MAAM,YAAY,UAAU,KAAK;EACjD,sBAAsB,MAAM,cAAc,UAAU,KAAK;EACzD,UAAU;EACV,aAAa,OAAO,KAAK,MAAM,kBAAkB,EAAE,CAAC,CAAC,SAAS;EAC9D,aAAa,OAAO,aAAa,aAAa;EAC9C,aAAa,OAAO,aAAa,aAAa,IAAI;EAClD,eAAe,OAAO,eAAe,aAAa,IAAI;EACtD,aAAa,OAAO,eAAe;EACnC,iBAAiB,OAAO,mBAAmB;EAC3C,UAAU,MAAM,KAAK,MAAM,KAAK,EAAE,aAAa,GAAG,cAAc,IAAI,GAAG,WAAW,KAAK,IAAI,EAAE;EAC7F;;;;;AAMF,eAAsB,iBACrB,IACA,mBACA,wBACA,gBAMA,6BACyC;AACzC,KAAI;EAEH,MAAM,YAAY,MADA,IAAI,sBAAsB,GAAG,CACb,QAAQ;EAC1C,MAAM,WAAW,IAAI,IAAI,UAAU,KAAK,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;EAE/D,MAAM,gBAAgB,IAAI,IAAI,kBAAkB,KAAK,MAAM,EAAE,GAAG,CAAC;EAEjE,MAAM,QAAQ,kBAAkB,KAAK,WAAW;AAE/C,UAAO,gBAAgB,QADT,SAAS,IAAI,OAAO,GAAG,IAAI,MACH,eAAe;IACpD;AAIF,OAAK,MAAM,SAAS,wBAAwB;AAC3C,OAAI,cAAc,IAAI,MAAM,GAAG,CAAE;AACjC,iBAAc,IAAI,MAAM,GAAG;AAC3B,SAAM,KAAK,yBAAyB,OAAO,SAAS,IAAI,MAAM,GAAG,IAAI,KAAK,CAAC;;AAK5E,OAAK,MAAM,SAAS,WAAW;AAC9B,OAAI,MAAM,WAAW,iBAAiB,MAAM,WAAW,WAAY;AACnE,OAAI,cAAc,IAAI,MAAM,SAAS,CAAE;AAEvC,SAAM,KAAK;IACV,IAAI,MAAM;IACV,MAAM,MAAM,eAAe,MAAM;IACjC,SAAS,MAAM,sBAAsB,MAAM;IAC3C,SAAS,MAAM,WAAW;IAC1B,QAAQ,MAAM;IACd,QAAQ,MAAM;IACd,oBAAoB,MAAM,sBAAsB;IAChD,sBAAsB,MAAM,wBAAwB;IACpD,cAAc,MAAM,gBAAgB;IACpC,cAAc,EAAE;IAChB,eAAe;IACf,qBAAqB;IACrB,UAAU;IACV,aAAa,OAAO,KAAK,8BAA8B,MAAM,SAAS,IAAI,EAAE,CAAC,CAAC,SAAS;IACvF,aAAa,MAAM,aAAa,aAAa;IAC7C,aAAa,MAAM,aAAa,aAAa,IAAI;IACjD,eAAe,MAAM,eAAe,aAAa,IAAI;IACrD,aAAa,MAAM,eAAe;IAClC,SACC,MAAM,WAAW,iBAAiB,iBAC/B,mBAAmB,gBAAgB,MAAM,SAAS,GAClD;IACJ,iBAAiB,MAAM;IACvB,UAAU,EAAE;IACZ,CAAC;;AAGH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,OAAO;GACf;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,gBACrB,IACA,mBACA,wBACA,UACA,gBACqC;AACrC,KAAI;EACH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,SAAS,kBAAkB,MAAM,MAAM,EAAE,OAAO,SAAS;AAE/D,MAAI,OAEH,QAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM,gBAAgB,QAHjB,MAAM,UAAU,IAAI,SAAS,EAGG,eAAe,EAAE;GAC9D;EAGF,MAAM,YAAY,uBAAuB,MAAM,MAAM,EAAE,OAAO,SAAS;AACvE,MAAI,UAEH,QAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM,yBAAyB,WAH1B,MAAM,UAAU,IAAI,SAAS,CAGc,EAAE;GAC1D;AAGF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,qBAAqB;IAC9B;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;AAYH,SAAS,yBACR,OACa;AACb,QAAO;EACN,IAAI,MAAM;EACV,MAAM,MAAM,eAAe,MAAM;EACjC,SAAS,MAAM,sBAAsB,MAAM;EAC3C,SAAS,MAAM,WAAW;EAC1B,QAAQ,MAAM;EACd,QAAQ,MAAM;EACd,oBAAoB,MAAM,sBAAsB;EAChD,sBAAsB,MAAM,wBAAwB;EACpD,cAAc,MAAM,gBAAgB;EACpC,cAAc,EAAE;EAChB,eAAe;EACf,qBAAqB;EACrB,UAAU;EACV,aAAa;EACb,aAAa,MAAM,aAAa,aAAa;EAC7C,aAAa,MAAM,aAAa,aAAa,IAAI;EACjD,eAAe,MAAM,eAAe,aAAa,IAAI;EACrD,aAAa,MAAM,eAAe;EAClC,iBAAiB,MAAM;EACvB,UAAU,EAAE;EACZ;;;;;AAMF,eAAsB,mBACrB,IACA,mBACA,wBACA,UACqC;AACrC,KAAI;EACH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,SAAS,kBAAkB,MAAM,MAAM,EAAE,OAAO,SAAS;AAG/D,MAAI,OAEH,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM,gBAAgB,QADxC,MAAM,UAAU,OAAO,UAAU,OAAO,QAAQ,CACM,EAAE;GAAE;EAIzE,MAAM,YAAY,uBAAuB,MAAM,MAAM,EAAE,OAAO,SAAS;AACvE,MAAI,UAEH,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM,yBAAyB,WADjD,MAAM,UAAU,OAAO,UAAU,UAAU,QAAQ,CACe,EAAE;GAAE;EAMrF,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,CAAC,YAAa,SAAS,WAAW,iBAAiB,SAAS,WAAW,WAC1E,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,qBAAqB;IAAY;GACtE;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM,yBADtB,MAAM,UAAU,OAAO,UAAU,SAAS,QAAQ,CACK,EAAE;GAAE;SACpE;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,oBACrB,IACA,mBACA,wBACA,UACqC;AACrC,KAAI;EACH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,SAAS,kBAAkB,MAAM,MAAM,EAAE,OAAO,SAAS;AAE/D,MAAI,OAEH,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM,gBAAgB,QADxC,MAAM,UAAU,QAAQ,UAAU,OAAO,QAAQ,CACK,EAAE;GAAE;EAGzE,MAAM,YAAY,uBAAuB,MAAM,MAAM,EAAE,OAAO,SAAS;AACvE,MAAI,UAEH,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM,yBAAyB,WADjD,MAAM,UAAU,QAAQ,UAAU,UAAU,QAAQ,CACc,EAAE;GAAE;EAGrF,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,CAAC,YAAa,SAAS,WAAW,iBAAiB,SAAS,WAAW,WAC1E,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,qBAAqB;IAAY;GACtE;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM,yBADrB,MAAM,UAAU,QAAQ,UAAU,SAAS,QAAQ,CACI,EAAE;GAAE;SACrE;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;ACtXH,SAAS,YAAY,UAAkB,KAAqB;AAC3D,QAAO,UAAU,SAAS,YAAY;;;;;;;;AASvC,SAAgB,wBACf,mBACA,wBACA,UACsC;CACtC,MAAM,SAAS,kBAAkB,MAAM,MAAM,EAAE,OAAO,SAAS;AAC/D,KAAI,OAAQ,QAAO,OAAO,MAAM,kBAAkB,EAAE;CAEpD,MAAM,YAAY,uBAAuB,MAAM,MAAM,EAAE,OAAO,SAAS;AACvE,KAAI,UAAW,QAAO,UAAU,kBAAkB,EAAE;AAEpD,QAAO;;;;;;AAOR,SAAS,cAAc,KAAa,OAAqB,OAA+B;AACvF,SAAQ,MAAM,MAAd;EACC,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACJ,OAAI,OAAO,UAAU,SAAU,QAAO,YAAY,IAAI;AACtD,OAAI,MAAM,SAAS,SAAS,UAAU,MAAM,CAAC,IAAI,SAAS,MAAM,CAC/D,QAAO,YAAY,IAAI;AAExB,OAAI,MAAM,SAAS,WAAW,UAAU,MAAM,CAAC,MAAM,SAAS,IAAI,CACjE,QAAO,YAAY,IAAI;AAExB,UAAO;EACR,KAAK;AACJ,OAAI,OAAO,UAAU,YAAY,OAAO,MAAM,MAAM,CACnD,QAAO,YAAY,IAAI;AAExB,OAAI,MAAM,QAAQ,UAAa,QAAQ,MAAM,IAC5C,QAAO,YAAY,IAAI,qBAAqB,MAAM;AAEnD,OAAI,MAAM,QAAQ,UAAa,QAAQ,MAAM,IAC5C,QAAO,YAAY,IAAI,oBAAoB,MAAM;AAElD,UAAO;EAER,KAAK,UACJ,QAAO,OAAO,UAAU,YAAY,OAAO,YAAY,IAAI;EAC5D,KAAK;AACJ,OAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,MAAM,EAAE,UAAU,MAAM,CAC7E,QAAO,YAAY,IAAI;AAExB,UAAO;EACR,QAEC,QAAO,YAAY,IAAI;;;AAK1B,eAAe,sBACd,aACA,UACA,QACkC;CAClC,MAAM,OAAO,OAAO,KAAK,OAAO;CAChC,MAAM,SAAS,MAAM,YAAY,QAAQ,KAAK,KAAK,QAAQ,YAAY,UAAU,IAAI,CAAC,CAAC;CAEvF,MAAM,SAAkC,EAAE;CAC1C,MAAM,aAAsC,EAAE;AAE9C,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO;EACZ,MAAM,cAAc,OAAO,IAAI,YAAY,UAAU,IAAI,CAAC;AAE1D,MAAI,MAAM,SAAS,UAAU;AAC5B,cAAW,OAAO,OAAO,gBAAgB,YAAY,YAAY,SAAS;AAC1E;;AAGD,MAAI,gBAAgB,UAAa,gBAAgB,KAChD,QAAO,OAAO;WACJ,aAAa,SAAS,MAAM,YAAY,OAClD,QAAO,OAAO,MAAM;MAEpB,QAAO,OAAO;;AAIhB,QAAO;EAAE;EAAQ;EAAQ;EAAY;;;;;AAMtC,eAAsB,wBACrB,IACA,UACA,QAC6C;AAC7C,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MAAM,MAAM,sBADhB,IAAI,kBAAkB,GAAG,EAC0B,UAAU,OAAO;GAAE;SACnF;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,UAAU;IAChB,SAAS;IACT;GACD;;;;;;;;;;;AAYH,eAAsB,2BACrB,IACA,UACA,QACA,SAC6C;AAC7C,KAAI;AAEH,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,EAAE;GACnD,MAAM,QAAQ,OAAO;AACrB,OAAI,CAAC,MACJ,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM,UAAU;KAChB,SAAS,oBAAoB,IAAI,gBAAgB,SAAS;KAC1D;IACD;AAEF,OAAI,UAAU,KAAM;GACpB,MAAM,QAAQ,cAAc,KAAK,OAAO,MAAM;AAC9C,OAAI,MACH,QAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM,UAAU;KAAkB,SAAS;KAAO;IAC3D;;AAoBH,SAAO;GAAE,SAAS;GAAM,MAZX,MAAM,gBAAgB,IAAI,OAAO,QAAQ;IACrD,MAAM,SAAS,IAAI,kBAAkB,IAAI;AACzC,SAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,CACjD,KAAI,UAAU,KACb,OAAM,OAAO,OAAO,YAAY,UAAU,IAAI,CAAC;QAE/C,OAAM,OAAO,IAAI,YAAY,UAAU,IAAI,EAAE,MAAM;AAGrD,WAAO,sBAAsB,QAAQ,UAAU,OAAO;KACrD;GAE4B;SACvB;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,UAAU;IAChB,SAAS;IACT;GACD;;;;;;;;;;;;;ACxMH,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;AAwK1B,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YACC,SACA,AAAgB,QAChB,AAAgB,MACf;AACD,QAAM,QAAQ;EAHE;EACA;AAGhB,OAAK,OAAO;;;AAId,IAAa,8BAAb,cAAiD,iBAAiB;CACjE,YAAY,OAAiB;AAC5B,QAAM,qCAAqC,QAAW,0BAA0B;AAChF,MAAI,MAAO,MAAK,QAAQ;;;AAM1B,IAAM,wBAAN,MAAyD;CACxD,AAAiB;CACjB,AAAiB;CAEjB,YAAY,SAAiB,YAAqB;AAEjD,OAAK,UAAU,QAAQ,QAAQ,kBAAkB,GAAG;AACpD,OAAK,aAAa;;CAGnB,MAAM,OAAO,OAAgB,MAAgE;EAC5F,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,MAAO,QAAO,IAAI,KAAK,MAAM;AACjC,MAAI,MAAM,SAAU,QAAO,IAAI,YAAY,KAAK,SAAS;AACzD,MAAI,MAAM,WAAY,QAAO,IAAI,cAAc,KAAK,WAAW;AAC/D,MAAI,MAAM,KAAM,QAAO,IAAI,QAAQ,KAAK,KAAK;AAC7C,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,OAAO;AACnD,MAAI,MAAM,MAAO,QAAO,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;EAExD,MAAM,KAAK,OAAO,UAAU;EAC5B,MAAM,MAAM,GAAG,KAAK,QAAQ,iBAAiB,KAAK,IAAI,OAAO;AAE7D,SADa,MAAM,KAAK,UAAmC,IAAI;;CAIhE,MAAM,UAAU,IAA8C;EAC7D,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG;AACpE,SAAO,KAAK,UAAmC,IAAI;;CAGpD,MAAM,YAAY,IAAkD;EACnE,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG,CAAC;AAErE,UADa,MAAM,KAAK,UAAkD,IAAI,EAClE;;CAGb,MAAM,eAAe,IAAY,SAAwC;EACxE,MAAM,YAAY,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG,CAAC,YAAY,mBAAmB,QAAQ,CAAC;EAEnH,MAAM,oBAAoB,IAAI,IAAI,KAAK,QAAQ,CAAC;EAChD,MAAM,gBAAgB;EACtB,IAAI;AACJ,MAAI;GACH,IAAI,aAAa;AACjB,cAAW,MAAM,MAAM,YAAY,EAAE,UAAU,UAAU,CAAC;AAG1D,QAAK,IAAI,IAAI,GAAG,IAAI,eAAe,KAAK;AACvC,QAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAAK;IAErD,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;AACjD,QAAI,CAAC,SAAU;IAEf,MAAM,SAAS,IAAI,IAAI,UAAU,WAAW;AAC5C,QAAI,OAAO,WAAW,kBACrB,OAAM,IAAI,iBACT,iDAAiD,OAAO,UACxD,SAAS,QACT,4BACA;AAEF,iBAAa,OAAO;AACpB,eAAW,MAAM,MAAM,YAAY,EAAE,UAAU,UAAU,CAAC;;AAI3D,OAAI,SAAS,UAAU,OAAO,SAAS,SAAS,IAC/C,OAAM,IAAI,iBACT,+CAA+C,cAAc,IAC7D,SAAS,QACT,4BACA;WAEM,KAAK;AACb,OAAI,eAAe,iBAAkB,OAAM;AAC3C,SAAM,IAAI,4BAA4B,IAAI;;AAG3C,MAAI,CAAC,SAAS,GACb,OAAM,IAAI,iBACT,8BAA8B,SAAS,OAAO,GAAG,SAAS,cAC1D,SAAS,QACT,yBACA;EAGF,MAAM,eAAe,IAAI,WAAW,MAAM,SAAS,aAAa,CAAC;AACjE,MAAI;AACH,UAAO,MAAM,cAAc,aAAa;WAChC,KAAK;AACb,OAAI,eAAe,iBAAkB,OAAM;AAC3C,SAAM,IAAI,iBACT,mCACA,QACA,wBACA;;;CAIH,MAAM,cAAc,IAAY,SAAgC;EAE/D,MAAM,WAAW,MAAM,iBAAiB,KAAK,WAAW;EACxD,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG,CAAC;AAErE,MAAI;AACH,SAAM,MAAM,KAAK;IAChB,QAAQ;IACR,SAAS,EAAE,gBAAgB,oBAAoB;IAC/C,MAAM,KAAK,UAAU;KAAE;KAAU;KAAS,CAAC;IAC3C,CAAC;UACK;;CAKT,MAAM,aACL,OACA,MACwC;EACxC,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,MAAO,QAAO,IAAI,KAAK,MAAM;AACjC,MAAI,MAAM,QAAS,QAAO,IAAI,WAAW,KAAK,QAAQ;AACtD,MAAI,MAAM,KAAM,QAAO,IAAI,QAAQ,KAAK,KAAK;AAC7C,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,OAAO;AACnD,MAAI,MAAM,MAAO,QAAO,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;EAExD,MAAM,KAAK,OAAO,UAAU;EAC5B,MAAM,MAAM,GAAG,KAAK,QAAQ,gBAAgB,KAAK,IAAI,OAAO;AAC5D,SAAO,KAAK,UAAwC,IAAI;;CAGzD,MAAM,SAAS,IAA6C;EAC3D,MAAM,MAAM,GAAG,KAAK,QAAQ,iBAAiB,mBAAmB,GAAG;AACnE,SAAO,KAAK,UAAkC,IAAI;;CAGnD,MAAc,UAAa,KAAyB;EACnD,IAAI;AACJ,MAAI;AACH,cAAW,MAAM,MAAM,KAAK,EAC3B,SAAS,EAAE,QAAQ,oBAAoB,EACvC,CAAC;WACM,KAAK;AACb,SAAM,IAAI,4BAA4B,IAAI;;AAG3C,MAAI,CAAC,SAAS,IAAI;GACjB,IAAI,eAAe,+BAA+B,SAAS;AAC3D,OAAI;IACH,MAAM,OAA2B,MAAM,SAAS,MAAM;AACtD,QAAI,KAAK,MAAO,gBAAe,KAAK;WAC7B;AAGR,SAAM,IAAI,iBAAiB,cAAc,SAAS,OAAO;;AAI1D,SADgB,MAAM,SAAS,MAAM;;;;;;;;;;;;;;;;;;;AAiCvC,MAAM,gCAAgC,MAAM;AAC5C,MAAM,yBAAyB;AAE/B,eAAsB,cAAc,cAAiD;CAkBpF,MAAM,SAZqB,IAAI,eAA2B,EACzD,MAAM,YAAY;AACjB,aAAW,QAAQ,aAAa;AAChC,aAAW,OAAO;IAEnB,CAAC,CAAC,YAAY,mBAAmB,CAAC,CAOD,WAAW;CAC7C,MAAM,SAAuB,EAAE;CAC/B,IAAI,QAAQ;AACZ,QAAO,MAAM;EACZ,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;AAC3C,MAAI,KAAM;AACV,MAAI,CAAC,MAAO;AACZ,WAAS,MAAM;AACf,MAAI,QAAQ,+BAA+B;AAC1C,OAAI;AACH,UAAM,OAAO,QAAQ;WACd;AAGR,SAAM,IAAI,iBACT,2CAA2C,8BAA8B,UACzE,QACA,iBACA;;AAEF,SAAO,KAAK,MAAM;;CAEnB,MAAM,oBAAoB,IAAI,WAAW,MAAM;CAC/C;EACC,IAAI,SAAS;AACb,OAAK,MAAM,SAAS,QAAQ;AAC3B,qBAAkB,IAAI,OAAO,OAAO;AACpC,aAAU,MAAM;;;CAWlB,MAAM,UAAU,MAAM,UAPD,IAAI,eAA2B,EACnD,MAAM,YAAY;AACjB,aAAW,QAAQ,kBAAkB;AACrC,aAAW,OAAO;IAEnB,CAAC,CAE2C;AAC7C,KAAI,QAAQ,SAAS,uBACpB,OAAM,IAAI,iBACT,oCAAoC,QAAQ,OAAO,KAAK,uBAAuB,IAC/E,QACA,iBACA;CAGF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,wBAAQ,IAAI,KAAqB;AACvC,MAAK,MAAM,SAAS,QACnB,KAAI,MAAM,QAAQ,MAAM,OAAO,SAAS,QAAQ;EAE/C,MAAM,OAAO,MAAM,OAAO,KAAK,QAAQ,mBAAmB,GAAG;AAC7D,QAAM,IAAI,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC;;CAI7C,MAAM,eAAe,MAAM,IAAI,gBAAgB;CAC/C,MAAM,cAAc,MAAM,IAAI,aAAa;AAE3C,KAAI,CAAC,aACJ,OAAM,IAAI,iBACT,yCACA,QACA,iBACA;AAEF,KAAI,CAAC,YACJ,OAAM,IAAI,iBAAiB,sCAAsC,QAAW,iBAAiB;CAG9F,IAAI;AACJ,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,aAAa;EAChD,MAAM,SAASC,uBAAqB,UAAU,OAAO;AACrD,MAAI,CAAC,OAAO,QACX,OAAM,IAAI,iBACT,mDACA,QACA,iBACA;AAEF,aAAWC,0BAAwB,OAAO,KAAK;UACvC,KAAK;AACb,MAAI,eAAe,iBAAkB,OAAM;AAC3C,QAAM,IAAI,iBACT,2CACA,QACA,iBACA;;CAKF,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,aAAwC;CACjG,MAAM,YAAY,IAAI,WAAW,WAAW;CAC5C,MAAM,WAAW,MAAM,KAAK,YAAY,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;AAEvF,QAAO;EACN;EACA;EACA,WAAW,MAAM,IAAI,WAAW;EAChC;EACA;;;;;;;AAUF,eAAe,iBAAiB,YAAsC;CACrE,MAAM,OAAO,aAAa,eAAe,eAAe;AACxD,KAAI;EACH,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC;EAClF,MAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,MAAM,KAAK,IAAI,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;SAC5E;EAGP,IAAI,IAAI;AACR,OAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACrC,QAAK,KAAK,WAAW,EAAE;AACvB,OAAI,KAAK,KAAK,GAAG,SAAW;;EAE7B,MAAM,KAAK,IAAK,MAAM;AACtB,UAAQ,MAAM,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,OAAO,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI;;;;;;;;;;AAa3F,SAAgB,wBAAwB,SAAiB,YAAwC;AAChG,QAAO,IAAI,sBAAsB,SAAS,WAAW;;;;;;;;;ACthBtD,SAAgB,kBACf,UACA,YACA,QACA,SACS;AAIT,QAAO,GAHQ,SAAS,SAAS,SAAS,MAGzB,UAAU,SAAS,GAAG,WAAW,GAFhC,OAAO,KAAK,IAAI,GAE+B,UAAU,GAAG,IAAI;;;;;;;;;;AAYnF,SAAgB,uBACf,IACA,UACA,YACA,QACA,SACsB;AACtB,0BAAyB,UAAU,YAAY;AAC/C,+BAA8B,YAAY,kBAAkB;AAC5D,MAAK,MAAM,SAAS,OACnB,uBAAsB,OAAO,mBAAmB;CAGjD,MAAM,YAAY,kBAAkB,UAAU,YAAY,QAAQ,QAAQ;CAI1E,MAAM,cAAc,OAClB,KAAK,UAAU;AACf,MAAI,WAAW,GAAG,CAEjB,QAAO,IAAI,gBAAgB,IAAI,QAAQ,MAAM,CAAC;AAE/C,SAAO,gBAAgB,IAAI,QAAQ,MAAM;GACxC,CACD,KAAK,KAAK;CAQZ,MAAM,gBAAgB,SAAS,SAAS,wBAAwB;AAChE,QAAO,GAAG,GAAG,IAAI,IAAI,cAAc,CAAC,iBAAiB,IAAI,IAAI,UAAU,CAAC;8CAC3B,IAAI,IAAI,YAAY,CAAC;;;;;;;;AASnE,SAAgB,qBAAqB,WAAwC;AAC5E,QAAO,GAAG,wBAAwB,IAAI,IAAI,UAAU;;;;;AAMrD,SAAgB,iBAAiB,SAA+C;AAC/E,QAAO,QAAQ,KAAK,UAAW,MAAM,QAAQ,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAE;;;;;AAMxE,eAAsB,qBACrB,IACA,UACA,YACA,SACA,SAIE;CACF,MAAM,aAAa,iBAAiB,QAAQ;CAC5C,MAAM,mBAAmB,SAAS,gBAAgB,iBAAiB,QAAQ,cAAc,GAAG,EAAE;CAC9F,MAAM,YAAY,IAAI,IAAI,iBAAiB,KAAK,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;CAInE,MAAM,aAA2D,CAChE,GAFe,WAAW,QAAQ,MAAM,CAAC,UAAU,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAEzD,KAAK,YAAY;EAAE;EAAQ,QAAQ;EAAO,EAAE,EACvD,GAAG,iBAAiB,KAAK,YAAY;EAAE;EAAQ,QAAQ;EAAM,EAAE,CAC/D;CAED,MAAM,UAAoB,EAAE;CAC5B,MAAM,SAAkD,EAAE;AAE1D,MAAK,MAAM,SAAS,YAAY;EAC/B,MAAM,EAAE,WAAW;EACnB,MAAM,YAAY,kBAAkB,UAAU,YAAY,QAAQ,EAAE,QAAQ,MAAM,QAAQ,CAAC;AAE3F,MAAI;AAKH,SAHkB,uBAAuB,IAAI,UAAU,YAAY,QAAQ,EAC1E,QAAQ,MAAM,QACd,CAAC,CACc,QAAQ,GAAG;AAG3B,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP,WAAW;IACX;IACA,YAAY;IACZ,QAAQ,KAAK,UAAU,OAAO;IAC9B,CAAC,CACD,YAAY,OACZ,GACE,QAAQ;IAAC;IAAa;IAAc;IAAa,CAAC,CAClD,YAAY,EAAE,QAAQ,KAAK,UAAU,OAAO,EAAE,CAAC,CACjD,CACA,SAAS;AAEX,WAAQ,KAAK,UAAU;WACf,OAAO;AACf,UAAO,KAAK;IACX,OAAO;IACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;IAC7D,CAAC;;;AAIJ,QAAO;EAAE;EAAS;EAAQ;;;;;AAM3B,eAAsB,sBACrB,IACA,UACA,YACA,gBACA,SAIE;CACF,MAAM,aAAa,iBAAiB,eAAe;CACnD,MAAM,mBAAmB,SAAS,gBAAgB,iBAAiB,QAAQ,cAAc,GAAG,EAAE;CAC9F,MAAM,YAAY,IAAI,IAAI,iBAAiB,KAAK,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;CAGnE,MAAM,oCAAoB,IAAI,KAAa;AAC3C,MAAK,MAAM,UAAU,WAEpB,KAAI,CAAC,UAAU,IAAI,OAAO,KAAK,IAAI,CAAC,CACnC,mBAAkB,IAAI,kBAAkB,UAAU,YAAY,OAAO,CAAC;AAGxE,MAAK,MAAM,UAAU,iBACpB,mBAAkB,IAAI,kBAAkB,UAAU,YAAY,QAAQ,EAAE,QAAQ,MAAM,CAAC,CAAC;CAIzF,MAAM,kBAAkB,MAAM,GAC5B,WAAW,kBAAkB,CAC7B,OAAO,CAAC,aAAa,CAAC,CACtB,MAAM,aAAa,KAAK,SAAS,CACjC,MAAM,cAAc,KAAK,WAAW,CACpC,SAAS;CAEX,MAAM,UAAoB,EAAE;CAC5B,MAAM,SAAkD,EAAE;AAE1D,MAAK,MAAM,EAAE,gBAAgB,gBAC5B,KAAI,CAAC,kBAAkB,IAAI,WAAW,CACrC,KAAI;AAEH,QAAM,qBAAqB,WAAW,CAAC,QAAQ,GAAG;AAGlD,QAAM,GACJ,WAAW,kBAAkB,CAC7B,MAAM,aAAa,KAAK,SAAS,CACjC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,cAAc,KAAK,WAAW,CACpC,SAAS;AAEX,UAAQ,KAAK,WAAW;UAChB,OAAO;AACf,SAAO,KAAK;GACX,OAAO;GACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC7D,CAAC;;AAKL,QAAO;EAAE;EAAS;EAAQ;;;;;AAM3B,eAAsB,mBACrB,IACA,UACA,YACA,SACA,SAKE;CACF,MAAM,CAAC,cAAc,gBAAgB,MAAM,QAAQ,IAAI,CACtD,qBAAqB,IAAI,UAAU,YAAY,SAAS,QAAQ,EAChE,sBAAsB,IAAI,UAAU,YAAY,SAAS,QAAQ,CACjE,CAAC;AAEF,QAAO;EACN,SAAS,aAAa;EACtB,SAAS,aAAa;EACtB,QAAQ,CAAC,GAAG,aAAa,QAAQ,GAAG,aAAa,OAAO;EACxD;;;;;;;;AASF,eAAsB,2BACrB,IACA,SAOgB;AAChB,MAAK,MAAM,UAAU,QACpB,MAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QAAQ,OAAO,WAAW,EAAE,CAAC,CACtE,KAAI;EACH,MAAM,SAAS,MAAM,mBAAmB,IAAI,OAAO,IAAI,YAAY,OAAO,SAAS,EAClF,eAAe,OAAO,eACtB,CAAC;AACF,OAAK,MAAM,WAAW,OAAO,OAC5B,SAAQ,MACP,0CAA0C,QAAQ,MAAM,OAAO,OAAO,GAAG,GAAG,WAAW,IAAI,QAAQ,QACnG;UAEM,OAAO;AACf,UAAQ,MACP,gDAAgD,OAAO,GAAG,GAAG,WAAW,IACxE,MACA;;;;;;AASL,eAAsB,uBACrB,IACA,UAIE;CACF,MAAM,kBAAkB,MAAM,GAC5B,WAAW,kBAAkB,CAC7B,OAAO,CAAC,cAAc,aAAa,CAAC,CACpC,MAAM,aAAa,KAAK,SAAS,CACjC,SAAS;CAEX,MAAM,UAAoB,EAAE;CAC5B,MAAM,SAAkD,EAAE;AAE1D,MAAK,MAAM,EAAE,gBAAgB,gBAC5B,KAAI;AACH,QAAM,qBAAqB,WAAW,CAAC,QAAQ,GAAG;AAClD,UAAQ,KAAK,WAAW;UAChB,OAAO;AACf,SAAO,KAAK;GACX,OAAO;GACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC7D,CAAC;;AAKJ,OAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,SAAS,CAAC,SAAS;AAElF,QAAO;EAAE;EAAS;EAAQ;;;;;;ACxP3B,MAAM,kBAAkB;AAExB,SAAS,gBAAgB,SAAuB;AAC/C,KAAI,QAAQ,SAAS,KAAK,CAAE,OAAM,IAAI,MAAM,yBAAyB;AACrE,KAAI,CAAC,gBAAgB,KAAK,QAAQ,CACjC,OAAM,IAAI,MAAM,yBAAyB;;AAI3C,SAAS,UACR,gBACA,YAC2B;AAC3B,KAAI,CAAC,eAAgB,QAAO;AAC5B,QAAO,wBAAwB,gBAAgB,WAAW;;AAG3D,SAAgB,iBACf,SACA,SACyC;CAKzC,MAAM,UAAU,sBAAsB,QAAQ;CAC9C,MAAM,UAAU,sBAAsB,QAAQ;CAC9C,MAAM,SAAS,IAAI,IAAI,QAAQ;CAC/B,MAAM,SAAS,IAAI,IAAI,QAAQ;AAC/B,QAAO;EACN,OAAO,QAAQ,QAAQ,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;EAC5C,SAAS,QAAQ,QAAQ,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;EAC9C;;;;;;AAOF,SAAgB,oBACf,aACA,aAC4B;CAC5B,MAAM,kCAAkB,IAAI,KAAa;AACzC,KAAI,YACH,MAAK,MAAM,SAAS,YAAY,QAAQ;EACvC,MAAM,aAAa,uBAAuB,MAAM;AAChD,MAAI,WAAW,WAAW,KACzB,iBAAgB,IAAI,WAAW,KAAK;;CAKvC,MAAM,cAAwB,EAAE;AAChC,MAAK,MAAM,SAAS,YAAY,QAAQ;EACvC,MAAM,aAAa,uBAAuB,MAAM;AAChD,MAAI,WAAW,WAAW,QAAQ,CAAC,gBAAgB,IAAI,WAAW,KAAK,CACtE,aAAY,KAAK,WAAW,KAAK;;AAInC,QAAO,EAAE,aAAa;;AAGvB,eAAe,uBACd,QACA,UACA,cACA,SAC4C;AAC5C,KAAI,aAAa,eAAe,YAAY,QAC3C,QAAO;EACN,SAAS,aAAa,cAAc;EACpC,kBAAkB,aAAa,cAAc;EAC7C,YAAY,aAAa,cAAc;EACvC,UAAU,aAAa,cAAc;EACrC,WAAW,aAAa,cAAc;EACtC,cAAc,aAAa,cAAc;EACzC,QAAQ,aAAa,cAAc;EACnC,cAAc,aAAa,cAAc,OAAO,WAAW;EAC3D,mBAAmB,aAAa,cAAc,YAAY,WAAW;EACrE,aAAa,aAAa,cAAc;EACxC;AAIF,SADiB,MAAM,OAAO,YAAY,SAAS,EACnC,MAAM,MAAM,EAAE,YAAY,QAAQ,IAAI;;AAGvD,SAAS,uBACR,QACA,UACA,SAC0B;AAC1B,KAAI,OAAO,SAAS,OAAO,SAC1B,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS,uBAAuB,OAAO,SAAS,GAAG,qCAAqC,SAAS;GACjG;EACD;AAGF,KAAI,OAAO,SAAS,YAAY,QAC/B,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS,4BAA4B,OAAO,SAAS,QAAQ,sCAAsC,QAAQ;GAC3G;EACD;AAGF,QAAO;;AAWR,SAAS,aAAa,QAA4B,UAAkB,SAAyB;AAC5F,QAAO,GAAG,OAAO,GAAG,SAAS,GAAG;;AAGjC,eAAsB,gBACrB,SACA,UACA,SACA,QACA,SAA6B,eACb;AAChB,0BAAyB,UAAU,YAAY;AAC/C,iBAAgB,QAAQ;CACxB,MAAM,SAAS,aAAa,QAAQ,UAAU,QAAQ;AAGtD,OAAM,QAAQ,OAAO;EACpB,KAAK,GAAG,OAAO;EACf,MAAM,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,OAAO,SAAS,CAAC;EAC/D,aAAa;EACb,CAAC;AAGF,OAAM,QAAQ,OAAO;EACpB,KAAK,GAAG,OAAO;EACf,MAAM,IAAI,aAAa,CAAC,OAAO,OAAO,YAAY;EAClD,aAAa;EACb,CAAC;AAGF,KAAI,OAAO,UACV,OAAM,QAAQ,OAAO;EACpB,KAAK,GAAG,OAAO;EACf,MAAM,IAAI,aAAa,CAAC,OAAO,OAAO,UAAU;EAChD,aAAa;EACb,CAAC;;;AAKJ,eAAe,aAAa,QAAqD;AAChF,QAAO,IAAI,SAAS,OAAO,CAAC,MAAM;;;;;;;;;;AAWnC,eAAsB,iBACrB,SACA,UACA,SACA,SAA6B,eAC2D;AACxF,0BAAyB,UAAU,YAAY;AAC/C,iBAAgB,QAAQ;CACxB,MAAM,SAAS,aAAa,QAAQ,UAAU,QAAQ;AAEtD,KAAI;EACH,MAAM,iBAAiB,MAAM,QAAQ,SAAS,GAAG,OAAO,gBAAgB;EACxE,MAAM,gBAAgB,MAAM,QAAQ,SAAS,GAAG,OAAO,aAAa;EAEpE,MAAM,eAAe,MAAM,aAAa,eAAe,KAAK;EAC5D,MAAM,cAAc,MAAM,aAAa,cAAc,KAAK;EAC1D,MAAM,SAAkB,KAAK,MAAM,aAAa;EAChD,MAAM,SAASC,uBAAqB,UAAU,OAAO;AACrD,MAAI,CAAC,OAAO,QAAS,QAAO;EAC5B,MAAM,WAAWC,0BAAwB,OAAO,KAAK;EAGrD,IAAI;AACJ,MAAI;AAEH,eAAY,MAAM,cADE,MAAM,QAAQ,SAAS,GAAG,OAAO,WAAW,EACrB,KAAK;UACzC;AAIR,SAAO;GAAE;GAAU;GAAa;GAAW;SACpC;AACP,SAAO;;;;AAKT,eAAsB,mBACrB,SACA,UACA,SACA,SAA6B,eACb;AAChB,0BAAyB,UAAU,YAAY;AAC/C,iBAAgB,QAAQ;CACxB,MAAM,SAAS,aAAa,QAAQ,UAAU,QAAQ;AAGtD,MAAK,MAAM,QAFG;EAAC;EAAiB;EAAc;EAAW,CAGxD,KAAI;AACH,QAAM,QAAQ,OAAO,GAAG,OAAO,GAAG,OAAO;SAClC;;AAQV,eAAsB,yBACrB,IACA,SACA,eACA,gBACA,UACA,MAa+C;CAC/C,MAAM,SAAS,UAAU,gBAAgB,MAAM,WAAW;AAC1D,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAGF,KAAI,CAAC,QACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAKF,KAAI,CAAC,MAAM,oBAAoB,CAAC,iBAAiB,CAAC,cAAc,aAAa,EAC5E,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAGF,KAAI;EAEH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,YAAY,SAAS,WAAW,cACnC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,UAAU,SAAS;IAC5B;GACD;AAMF,MAAI,MAAM,qBAAqB,IAAI,SAAS,CAC3C,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,sCAAsC,SAAS;IACxD;GACD;EAIF,MAAM,eAAe,MAAM,OAAO,UAAU,SAAS;EACrD,MAAM,UAAU,MAAM,WAAW,aAAa,eAAe;AAC7D,MAAI,CAAC,QACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,0CAA0C;IACnD;GACD;EAGF,MAAM,kBAAkB,MAAM,uBAAuB,QAAQ,UAAU,cAAc,QAAQ;AAC7F,MAAI,CAAC,gBACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,WAAW,QAAQ,4BAA4B;IACxD;GACD;AAOF,MAAI,gBAAgB,iBAAiB,UAAU,gBAAgB,iBAAiB,OAC/E,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SACC,gBAAgB,iBAAiB,SAC9B,yDACA;IACJ;GACD;EAIF,MAAM,SAAS,MAAM,OAAO,eAAe,UAAU,QAAQ;AAG7D,MAAI,gBAAgB,YAAY,OAAO,aAAa,gBAAgB,SACnE,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,MAAM,sBAAsB,uBAAuB,QAAQ,UAAU,QAAQ;AAC7E,MAAI,oBAAqB,QAAO;AAEhC,OAAK,OAAO,SAAS,KAAK,MAAM,UAAU,KAAK,KAAK,CAAC,MAAM,gBAC1D,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT,SAAS,EACR,UAAU,OAAO,SAAS,KAAK,MAAM,KACnC,EAAE,aAAa,GAAG,cAAc,IAAI,GAAG,WAAW,KACnD,EACD;IACD;GACD;AAIF,QAAM,gBAAgB,SAAS,UAAU,SAAS,OAAO;AAGzD,QAAM,UAAU,OAAO,UAAU,SAAS,UAAU;GACnD,QAAQ;GACR,oBAAoB;GACpB,aAAa,aAAa;GAC1B,aAAa,aAAa,eAAe;GACzC,CAAC;AAEF,QAAM,2BAA2B,IAAI,CAAC,OAAO,SAAS,CAAC;AAGvD,SAAO,cAAc,UAAU,QAAQ,CAAC,YAAY,GAElD;AACF,SAAO;GACN,SAAS;GACT,MAAM;IACL;IACA;IACA,cAAc,OAAO,SAAS;IAC9B;GACD;UACO,KAAK;AACb,MAAI,eAAe,4BAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAEF,MAAI,eAAe,iBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,IAAI,QAAQ;IAClB,SAAS,IAAI;IACb;GACD;AAEF,MAAI,eAAe,mBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,IAAI,QAAQ;IAClB,SAAS;IACT;GACD;AAEF,MAAI,OAAO,OAAO,QAAQ,YAAY,UAAU,KAAK;GACpD,MAAM,OAAQ,IAA2B;AACzC,OAAI,OAAO,SAAS,YAAY,KAAK,MAAM,CAC1C,QAAO;IACN,SAAS;IACT,OAAO;KACN;KACA,SAAS;KACT;IACD;;AAGH,UAAQ,MAAM,yCAAyC,IAAI;AAC3D,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAMH,eAAsB,wBACrB,IACA,SACA,eACA,gBACA,UACA,MAa8C;CAC9C,MAAM,SAAS,UAAU,eAAe;AACxC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA8B,SAAS;GAAiC;EACvF;AAEF,KAAI,CAAC,QACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA0B,SAAS;GAAuB;EACzE;AAIF,KAAI,CAAC,MAAM,oBAAoB,CAAC,iBAAiB,CAAC,cAAc,aAAa,EAC5E,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAAyB,SAAS;GAA8B;EAC/E;AAGF,KAAI;EACH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,CAAC,YAAY,SAAS,WAAW,cACpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,gCAAgC;IACzC;GACD;EAGF,MAAM,aAAa,SAAS,sBAAsB,SAAS;EAG3D,MAAM,eAAe,MAAM,OAAO,UAAU,SAAS;EACrD,MAAM,aAAa,MAAM,WAAW,aAAa,eAAe;AAChE,MAAI,CAAC,WACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAc,SAAS;IAA8B;GACpE;AAGF,MAAI,eAAe,WAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAsB,SAAS;IAAgC;GAC9E;EAGF,MAAM,kBAAkB,MAAM,uBAC7B,QACA,UACA,cACA,WACA;AACD,MAAI,CAAC,gBACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,WAAW,WAAW,4BAA4B;IAC3D;GACD;EAIF,MAAM,SAAS,MAAM,OAAO,eAAe,UAAU,WAAW;AAGhE,MAAI,gBAAgB,YAAY,OAAO,aAAa,gBAAgB,SACnE,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,MAAM,sBAAsB,uBAAuB,QAAQ,UAAU,WAAW;AAChF,MAAI,oBAAqB,QAAO;EAGhC,MAAM,YAAY,MAAM,iBAAiB,SAAS,UAAU,WAAW;EAEvE,MAAM,oBAAoB,iBADV,WAAW,SAAS,gBAAgB,EAAE,EACF,OAAO,SAAS,aAAa;AAIjF,MAHsB,kBAAkB,MAAM,SAAS,KAGlC,CAAC,MAAM,yBAC3B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT,SAAS,EAAE,mBAAmB;IAC9B;GACD;EAKF,MAAM,yBAAyB,oBAAoB,WAAW,UAAU,OAAO,SAAS;EACxF,MAAM,qBAAqB,uBAAuB,YAAY,SAAS;AAEvE,MAAI,sBAAsB,CAAC,MAAM,8BAChC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT,SAAS;KAAE;KAAwB;KAAmB;IACtD;GACD;EAGF,MAAM,cAAc,CAAC,GAAI,WAAW,SAAS,KAAK,SAAS,EAAE,CAAE,CAAC,UAAU,GAAG,MAC5E,EAAE,KAAK,cAAc,EAAE,KAAK,CAC5B;EACD,MAAM,cAAc,CAAC,GAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAE,CAAC,UAAU,GAAG,MACxE,EAAE,KAAK,cAAc,EAAE,KAAK,CAC5B;AACD,MAAI,KAAK,UAAU,YAAY,KAAK,KAAK,UAAU,YAAY,IAAI,CAAC,MAAM,gBACzE,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT,SAAS,EACR,UAAU,YAAY,KAAK,EAAE,aAAa,GAAG,cAAc,IAAI,GAAG,WAAW,KAAK,EAClF;IACD;GACD;AAIF,QAAM,gBAAgB,SAAS,UAAU,YAAY,OAAO;AAG5D,QAAM,UAAU,OAAO,UAAU,YAAY,UAAU;GACtD,QAAQ;GACR,oBAAoB;GACpB,aAAa,aAAa;GAC1B,aAAa,aAAa,eAAe;GACzC,iBAAiB;GACjB,iBAAiB;GACjB,CAAC;AAEF,QAAM,2BAA2B,IAAI,CAAC,OAAO,SAAS,CAAC;AAGvD,qBAAmB,SAAS,UAAU,WAAW,CAAC,YAAY,GAAG;AAEjE,SAAO;GACN,SAAS;GACT,MAAM;IACL;IACA;IACA;IACA;IACA,wBAAwB,qBAAqB,yBAAyB;IACtE;GACD;UACO,KAAK;AACb,MAAI,eAAe,4BAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAA8B;GACjF;AAEF,MAAI,eAAe,iBAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,IAAI,QAAQ;IAAqB,SAAS,IAAI;IAAS;GACtE;AAEF,UAAQ,MAAM,wCAAwC,IAAI;AAC1D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA2B;GACpE;;;AAMH,eAAsB,2BACrB,IACA,SACA,UACA,MACiD;AACjD,KAAI;EACH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,CAAC,YAAY,SAAS,WAAW,cACpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,gCAAgC;IACzC;GACD;EAGF,MAAM,UAAU,SAAS,sBAAsB,SAAS;AAGxD,MAAI,QACH,OAAM,mBAAmB,SAAS,UAAU,QAAQ;EAIrD,IAAI,cAAc;AAClB,MAAI,MAAM,WACT,KAAI;AACH,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,SAAS,CAAC,SAAS;AAClF,iBAAc;UACP;AAKT,MAAI;AACH,SAAM,uBAAuB,IAAI,SAAS;UACnC;AAKR,QAAM,UAAU,OAAO,SAAS;AAEhC,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAU;IAAa;GAC/B;UACO,KAAK;AACb,UAAQ,MAAM,2CAA2C,IAAI;AAC7D,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAMH,eAAsB,6BACrB,IACA,gBAC0D;CAC1D,MAAM,SAAS,UAAU,eAAe;AACxC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA8B,SAAS;GAAiC;EACvF;AAGF,KAAI;EAEH,MAAM,qBAAqB,MADT,IAAI,sBAAsB,GAAG,CACJ,uBAAuB;EAElE,MAAM,QAAkC,EAAE;AAE1C,OAAK,MAAM,UAAU,mBACpB,KAAI;GACH,MAAM,SAAS,MAAM,OAAO,UAAU,OAAO,SAAS;GACtD,MAAM,SAAS,OAAO,eAAe;GACrC,MAAM,YAAY,OAAO,sBAAsB,OAAO;AAEtD,OAAI,CAAC,OAAQ;GAEb,MAAM,YAAY,WAAW;GAC7B,IAAI;GACJ,IAAI,uBAAuB;AAE3B,OAAI,aAAa,OAAO,eAAe;AAGtC,wBAAoB,iBAFJ,OAAO,gBAAgB,EAAE,EACzB,OAAO,cAAc,gBAAgB,EAAE,CACD;AACtD,2BACC,kBAAkB,MAAM,SAAS,KAAK,kBAAkB,QAAQ,SAAS;;AAG3E,SAAM,KAAK;IACV,UAAU,OAAO;IACjB;IACA,QAAQ,UAAU;IAClB;IACA;IACA,mBAAmB,uBAAuB,oBAAoB;IAI9D,2BAA2B;IAC3B,CAAC;WACM,KAAK;AAEb,WAAQ,KAAK,+BAA+B,OAAO,SAAS,IAAI,IAAI;;AAItE,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,OAAO;GAAE;UACjC,KAAK;AACb,MAAI,eAAe,4BAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAA8B;GACjF;AAEF,UAAQ,MAAM,wCAAwC,IAAI;AAC1D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA+B;GAC9E;;;AAMH,eAAsB,wBACrB,gBACA,OACA,MAC8B;CAC9B,MAAM,SAAS,UAAU,eAAe;AACxC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA8B,SAAS;GAAiC;EACvF;AAGF,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MADT,MAAM,OAAO,OAAO,OAAO,KAAK;GACT;UAC9B,KAAK;AACb,MAAI,eAAe,4BAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAA8B;GACjF;AAEF,UAAQ,MAAM,iCAAiC,IAAI;AACnD,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;;;AAIH,eAAsB,2BACrB,gBACA,UAC8B;CAC9B,MAAM,SAAS,UAAU,eAAe;AACxC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA8B,SAAS;GAAiC;EACvF;AAGF,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MADT,MAAM,OAAO,UAAU,SAAS;GACT;UAC9B,KAAK;AACb,MAAI,eAAe,oBAAoB,IAAI,WAAW,IACrD,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,qBAAqB;IAAY;GACtE;AAEF,MAAI,eAAe,4BAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAA8B;GACjF;AAEF,UAAQ,MAAM,qCAAqC,IAAI;AACvD,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAqB,SAAS;IAAgC;GAC7E;;;AAMH,eAAsB,kBACrB,gBACA,OACA,MAC8B;CAC9B,MAAM,SAAS,UAAU,eAAe;AACxC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA8B,SAAS;GAAiC;EACvF;AAGF,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MADT,MAAM,OAAO,aAAa,OAAO,KAAK;GACf;UAC9B,KAAK;AACb,MAAI,eAAe,4BAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAA8B;GACjF;AAEF,UAAQ,MAAM,4BAA4B,IAAI;AAC9C,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA2B;GAC1E;;;AAIH,eAAsB,qBACrB,gBACA,SAC8B;CAC9B,MAAM,SAAS,UAAU,eAAe;AACxC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA8B,SAAS;GAAiC;EACvF;AAGF,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MADT,MAAM,OAAO,SAAS,QAAQ;GACP;UAC9B,KAAK;AACb,MAAI,eAAe,oBAAoB,IAAI,WAAW,IACrD,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,oBAAoB;IAAW;GACpE;AAEF,MAAI,eAAe,4BAClB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAA8B;GACjF;AAEF,UAAQ,MAAM,oCAAoC,IAAI;AACtD,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA+B;GAC3E;;;;;;;AC//BH,MAAMC,gCAA8B,MAAM;;AAE1C,MAAMC,oBAAkB,MAAM;;AAE9B,MAAMC,0BAAwB,MAAM;;AAEpC,MAAMC,0BAAwB;;AAE9B,MAAMC,+BAA6B;;;;;AAKnC,MAAMC,kCAAgCJ,oBAAkBG,+BAA6B,MAAMD,0BAAwB,MAAM,IAAI;AAI7H,MAAMG,oBAAkB;AACxB,MAAMC,kBAAgBD,oBAAkB;AACxC,MAAM,gBAAgB;AACtB,MAAM,wBAAwB;AAC9B,MAAME,YAAU,IAAI,YAAY,SAAS;CACxC,OAAO;CACP,WAAW;CACX,CAAC;AACF,eAAe,qBAAqB,YAAY,UAAU,EAAE,EAAE;AAC7D,KAAI,WAAW,aAAaR,8BAA6B,QAAOS,oBAAkB,mCAAmC,uDAAuD;CAC5K,MAAM,eAAe,MAAM,iBAAiB,WAAW;AACvD,KAAI,CAAC,aAAa,QAAS,QAAO;CAClC,MAAM,QAAQ,SAAS,aAAa,MAAM;AAC1C,KAAI,CAAC,MAAM,QAAS,QAAO;CAC3B,MAAM,eAAe,MAAM,MAAM,IAAI,gBAAgB;AACrD,KAAI,CAAC,aAAc,QAAOA,oBAAkB,2BAA2B,8CAA8C;CACrH,MAAM,UAAU,MAAM,MAAM,IAAI,aAAa;AAC7C,KAAI,CAAC,QAAS,QAAOA,oBAAkB,0BAA0B,2CAA2C;CAC5G,IAAI;AACJ,KAAI;AACH,WAAS,KAAK,MAAMD,UAAQ,OAAO,aAAa,KAAK,CAAC;SAC/C;AACP,SAAOC,oBAAkB,2BAA2B,gDAAgD;;CAErG,MAAM,YAAY,qBAAqB,UAAU,OAAO;AACxD,KAAI,CAAC,UAAU,QAAS,QAAOA,oBAAkB,2BAA2B,uDAAuD;CACnI,MAAM,WAAW,wBAAwB,UAAU,KAAK;AACxD,KAAI,QAAQ,iBAAiB,KAAK,KAAK,SAAS,OAAO,QAAQ,aAAc,QAAOA,oBAAkB,sBAAsB,oEAAoE;AAChM,KAAI,QAAQ,oBAAoB,KAAK,KAAK,SAAS,YAAY,QAAQ,gBAAiB,QAAOA,oBAAkB,2BAA2B,0EAA0E;CACtN,MAAM,SAAS;EACd;EACA,gBAAgB,SAAS,kBAAkB,EAAE;EAC7C,SAAS,QAAQ;EACjB;CACD,MAAM,QAAQ,MAAM,MAAM,IAAI,WAAW;AACzC,KAAI,MAAO,QAAO,QAAQ,MAAM;AAChC,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,iBAAiB,OAAO;CACtC,MAAM,SAAS,IAAI,eAAe,EAAE,MAAM,YAAY;AACrD,aAAW,QAAQ,MAAM;AACzB,aAAW,OAAO;IAChB,CAAC;CACJ,IAAI;AACJ,KAAI;AACH,WAAS,OAAO,YAAY,mBAAmB,CAAC,CAAC,WAAW;SACrD;AACP,SAAOA,oBAAkB,0BAA0B,4CAA4C;;CAEhG,MAAM,SAAS,EAAE;CACjB,IAAI,QAAQ;AACZ,KAAI;AACH,SAAO,MAAM;GACZ,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;AAC3C,OAAI,KAAM;AACV,OAAI,CAAC,MAAO;AACZ,YAAS,MAAM;AACf,OAAI,QAAQJ,iCAA+B;AAC1C,UAAM,OAAO,QAAQ,CAAC,YAAY,KAAK,EAAE;AACzC,WAAOI,oBAAkB,qCAAqC,yDAAyD;;AAExH,UAAO,KAAK,MAAM;;SAEZ;AACP,SAAOA,oBAAkB,0BAA0B,4CAA4C;;CAEhG,MAAM,SAAS,IAAI,WAAW,MAAM;CACpC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,SAAO,IAAI,OAAO,OAAO;AACzB,YAAU,MAAM;;AAEjB,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,SAAS,SAAS,OAAO;AACxB,KAAI,MAAM,aAAaF,mBAAiB,MAAM,aAAaD,sBAAoB,EAAG,QAAO,gBAAgB;CACzG,MAAM,wBAAwB,IAAI,KAAK;CACvC,MAAM,2BAA2B,IAAI,KAAK;CAC1C,MAAM,kCAAkC,IAAI,KAAK;CACjD,IAAI,SAAS;CACb,IAAI,YAAY;CAChB,IAAI,aAAa;CACjB,IAAI,iBAAiB;CACrB,IAAI,QAAQ;AACZ,QAAO,SAASA,qBAAmB,MAAM,YAAY;EACpD,MAAM,SAAS,MAAM,SAAS,QAAQ,SAASA,kBAAgB;AAC/D,MAAI,YAAY,OAAO,EAAE;AACxB,OAAI,CAAC,YAAY,MAAM,SAAS,SAASA,mBAAiB,SAASC,gBAAc,CAAC,CAAE,QAAO,gBAAgB;AAC3G,OAAI,MAAM,SAAS,SAASA,gBAAc,CAAC,MAAM,SAAS,SAAS,EAAE,CAAE,QAAO,gBAAgB;AAC9F,WAAQ;AACR;;AAED,MAAI,CAAC,cAAc,OAAO,CAAE,QAAO,gBAAgB;AACnD,gBAAc;AACd,MAAI,aAAaH,6BAA4B,QAAOK,oBAAkB,8BAA8B,uDAAuD;EAC3J,MAAM,UAAU,YAAY,OAAO;AACnC,MAAI,CAAC,QAAQ,QAAS,QAAO;EAC7B,MAAM,WAAW,OAAO;EACxB,MAAM,OAAO,aAAa,IAAI,SAAS,OAAO,aAAa,YAAY,EAAE;EACzE,MAAM,cAAc,SAAS;EAC7B,MAAM,aAAa,cAAc,QAAQ,OAAO,YAAY;AAC5D,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAI,SAAS,IAAI,QAAQ,MAAM,IAAI,gBAAgB,IAAI,WAAW,MAAM,CAAE,QAAOA,oBAAkB,yBAAyB,2DAA2D;AACvL,WAAS,IAAI,QAAQ,MAAM;AAC3B,kBAAgB,IAAI,WAAW,MAAM;EACrC,MAAM,OAAO,UAAU,OAAO,SAAS,KAAK,IAAI,CAAC;AACjD,MAAI,SAAS,QAAQ,CAAC,OAAO,cAAc,KAAK,CAAE,QAAO,gBAAgB;EACzE,MAAM,YAAY,SAASH;EAC3B,MAAM,aAAa,YAAY,KAAK,KAAK,OAAOA,kBAAgB,GAAGA;AACnE,MAAI,aAAa,MAAM,WAAY,QAAO,gBAAgB;AAC1D,MAAI,aACH;OAAI,SAAS,EAAG,QAAO,gBAAgB;aAC7B,SAAS,UAAU,SAAS,KAAK;AAC3C,gBAAa;AACb,OAAI,YAAYH,wBAAuB,QAAOM,oBAAkB,8BAA8B,6CAA6C;AAC3I,OAAI,OAAOP,wBAAuB,QAAOO,oBAAkB,6BAA6B,+DAA+D;AACvJ,qBAAkB;AAClB,OAAI,iBAAiBR,kBAAiB,QAAOQ,oBAAkB,qCAAqC,yDAAyD;AAC7J,SAAM,IAAI,WAAW,OAAO;IAC3B,MAAM,WAAW;IACjB,MAAM,MAAM,MAAM,WAAW,YAAY,KAAK;IAC9C,CAAC;QACI,QAAOA,oBAAkB,4BAA4B,gEAAgE;AAC5H,WAAS;;AAEV,KAAI,CAAC,MAAO,QAAO,gBAAgB;AACnC,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,SAAS,YAAY,QAAQ;CAC5B,MAAM,OAAO,cAAc,OAAO,SAAS,GAAG,IAAI,CAAC;CACnD,MAAM,SAAS,cAAc,OAAO,SAAS,KAAK,IAAI,CAAC;AACvD,KAAI,SAAS,QAAQ,WAAW,QAAQ,KAAK,WAAW,EAAG,QAAOA,oBAAkB,uBAAuB,+CAA+C;AAC1J,QAAO;EACN,SAAS;EACT,OAAO,SAAS,GAAG,OAAO,GAAG,SAAS;EACtC;;AAEF,SAAS,cAAc,OAAO;CAC7B,MAAM,aAAa,MAAM,QAAQ,EAAE;CACnC,MAAM,MAAM,eAAe,KAAK,MAAM,SAAS;AAC/C,KAAI,eAAe,MAAM,MAAM,SAAS,aAAa,EAAE,CAAC,MAAM,SAAS,SAAS,EAAE,CAAE,QAAO;AAC3F,KAAI;AACH,SAAOD,UAAQ,OAAO,MAAM,SAAS,GAAG,IAAI,CAAC;SACtC;AACP,SAAO;;;AAGT,SAAS,cAAc,KAAK,aAAa;AACxC,KAAI,IAAI,SAAS,KAAK,IAAI,IAAI,WAAW,IAAI,IAAI,sBAAsB,KAAK,IAAI,IAAI,oBAAoB,IAAI,IAAI,IAAI,SAAS,IAAI,KAAK,YAAa,QAAOC,oBAAkB,uBAAuB,6CAA6C;CAChP,MAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,KAAI,YAAa,OAAM,KAAK;CAC5B,MAAM,aAAa,EAAE;AACrB,MAAK,MAAM,QAAQ,OAAO;AACzB,MAAI,SAAS,IAAK;AAClB,MAAI,SAAS,MAAM,SAAS,KAAM,QAAOA,oBAAkB,uBAAuB,6CAA6C;AAC/H,aAAW,KAAK,KAAK,UAAU,MAAM,CAAC;;AAEvC,KAAI,WAAW,WAAW,EAAG,QAAOA,oBAAkB,uBAAuB,+CAA+C;AAC5H,QAAO;EACN,SAAS;EACT,OAAO,WAAW,KAAK,IAAI;EAC3B;;AAEF,SAAS,oBAAoB,OAAO;AACnC,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,YAAY,UAAU,YAAY,EAAE;AAC1C,MAAI,cAAc,KAAK,MAAM,aAAa,MAAM,cAAc,KAAM,QAAO;;AAE5E,QAAO;;AAER,SAAS,UAAU,OAAO;CACzB,MAAM,OAAO,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,WAAW,MAAM,GAAG,CAAC,MAAM;AACxE,KAAI,CAAC,cAAc,KAAK,KAAK,CAAE,QAAO;CACtC,MAAM,QAAQ,OAAO,SAAS,MAAM,EAAE;AACtC,QAAO,OAAO,cAAc,MAAM,GAAG,QAAQ;;AAE9C,SAAS,cAAc,QAAQ;CAC9B,MAAM,WAAW,UAAU,OAAO,SAAS,KAAK,IAAI,CAAC;AACrD,KAAI,aAAa,KAAM,QAAO;CAC9B,IAAI,SAAS;AACb,MAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,EAAG,WAAU,SAAS,OAAO,QAAQ,MAAM,KAAK,OAAO,UAAU;AACrH,QAAO,WAAW;;AAEnB,SAAS,YAAY,OAAO;AAC3B,QAAO,MAAM,eAAeH,qBAAmB,MAAM,OAAO,SAAS,SAAS,EAAE;;AAEjF,SAAS,iBAAiB;AACzB,QAAOG,oBAAkB,0BAA0B,gDAAgD;;;;;ACjNpG,MAAM,gBAAgB,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC;AAqB/D,eAAsB,yBACrB,OACA,UACA,MACA,SAC8C;CAC9C,MAAM,iBAAiB,MAAMC,kBAAgB,OAAO,SAAS;AAC7D,KAAI,CAAC,eAAe,QAAS,QAAO;CACpC,MAAM,CAAC,gBAAgB,GAAG,mBAAmB,MAAM,gCAAgC,MAAM;CAEzF,MAAM,eAAe,MAAM,qBAAqB,OAAO;EACtD,cAAc;EACd,iBAAiB;EACjB,CAAC;AACF,KAAI,CAAC,aAAa,QAAS,QAAO;CAElC,MAAM,WAAWC,uBAAqB,UAAU,aAAa,MAAM,SAAS;AAC5E,KAAI,CAAC,SAAS,QACb,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAGF,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO;IACN,QAAQ;KACP,UAAUC,0BAAwB,SAAS,KAAK;KAChD,aAAa,cAAc,OAAO,aAAa,MAAM,QAAQ;KAC7D,WACC,aAAa,MAAM,UAAU,SAC1B,SACA,cAAc,OAAO,aAAa,MAAM,MAAM;KAClD;KACA;IACD;IACA;IACA;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AC5EH,IAAI,iBAAiB,IAAI,eAAe,OAAO,IAAI,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,IAAI,EAAE,IAAI;AAC7F,IAAI,YAA4B,8BAAc,0CAA0C;AAmDxF,SAAS,kBAAkB,MAAM,SAAS,SAAS;AAClD,QAAO;EACN,SAAS;EACT,OAAO;GACN;GACA;GACA,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;GACxC;EACD;;AAKF,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAMC,oBAAkB;;AAExB,SAAS,qBAAqB,OAAO;AACpC,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,oBAAoB,uCAAuC;CAChH,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,QAAQ,MAAM,WAAW,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,GAAI,QAAO,kBAAkB,oBAAoB,qDAAqD;CAClL,MAAM,WAAW,IAAI,aAAa,MAAM,MAAM,EAAE,CAAC;AACjD,KAAI,CAAC,gBAAgB,SAAS,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,qDAAqD;AAC1I,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;AAGF,SAAS,gBAAgB,OAAO;AAC/B,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,qBAAqB,oEAAoE;CAC9I,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,KAAM,QAAO,kBAAkB,qBAAqB,uCAAuC;CACzG,MAAM,OAAO,WAAW,OAAO,EAAE;AACjC,KAAI,SAAS,KAAM,QAAO,kBAAkB,qBAAqB,6CAA6C;CAC9G,MAAM,SAAS,WAAW,OAAO,KAAK,WAAW;AACjD,KAAI,WAAW,QAAQ,OAAO,UAAU,MAAM,SAAS,OAAO,WAAY,QAAO,kBAAkB,qBAAqB,4CAA4C;AACpK,KAAI,KAAK,UAAU,cAAe,QAAO,kBAAkB,yBAAyB,4CAA4C;AAChI,KAAI,OAAO,UAAU,gBAAiB,QAAO,kBAAkB,qBAAqB,wCAAwC;AAC5H,QAAO;EACN,SAAS;EACT,OAAO;GACN,WAAW;GACX,QAAQ,MAAM,MAAM,OAAO,WAAW;GACtC;EACD;;AA8BF,eAAe,gBAAgB,OAAO,UAAU;CAC/C,MAAM,UAAU,gBAAgB,SAAS;AACzC,KAAI,CAAC,QAAQ,QAAS,QAAO;CAC7B,MAAM,SAAS,MAAM,cAAc,OAAO,QAAQ,MAAM,UAAU;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,KAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,MAAM,OAAO,CAAE,QAAO,kBAAkB,qBAAqB,yDAAyD;AACpK,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;;;;;AAOF,SAAS,mBAAmB,MAAM,OAAO;CACxC,IAAI,aAAa,KAAK,SAAS,MAAM;CACrC,MAAM,gBAAgB,KAAK,IAAI,KAAK,QAAQ,MAAM,OAAO;AACzD,MAAK,IAAI,QAAQ,GAAG,QAAQ,eAAe,SAAS,EAAG,gBAAe,KAAK,UAAU,MAAM,MAAM,UAAU;AAC3G,QAAO,eAAe;;AAEvB,eAAe,cAAc,OAAO,WAAW;AAC9C,KAAI,cAAc,WAAY,QAAO,kBAAkB,yBAAyB,4CAA4C;AAC5H,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC,CAAC;GACnF;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,WAAW,OAAO,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;AACZ,MAAK,IAAI,QAAQ,QAAQ,QAAQ,MAAM,UAAU,QAAQ,SAAS,GAAG,SAAS,GAAG;EAChF,MAAM,OAAO,MAAM;AACnB,MAAI,SAAS,KAAK,EAAG,QAAO;AAC5B,YAAU,OAAO,QAAQ;AACzB,OAAK,OAAO,SAAS,EAAG,QAAO;GAC9B;GACA,YAAY,QAAQ;GACpB;AACD,WAAS;;AAEV,QAAO;;AAER,SAAS,aAAa,OAAO;CAC5B,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI,OAAO;AACX,MAAK,MAAM,QAAQ,OAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,SAAO,QAAQ,GAAG;AACjB,aAAUA,kBAAgB,WAAW,OAAO,IAAI,OAAO;AACvD,WAAQ;;;AAGV,KAAI,OAAO,EAAG,WAAUA,kBAAgB,UAAU,IAAI,OAAO,OAAO;AACpE,QAAO;;AAER,SAAS,aAAa,OAAO;AAC5B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,IAAI,SAAS;CACb,IAAI,OAAO;CACX,MAAM,SAAS,EAAE;AACjB,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,QAAQA,kBAAgB,QAAQ,UAAU;AAChD,MAAI,UAAU,GAAI,QAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,MAAI,QAAQ,GAAG;AACd,UAAO,KAAK,WAAW,OAAO,IAAI,IAAI;AACtC,WAAQ;;;AAGV,KAAI,OAAO,MAAM,UAAU,KAAK,QAAQ,OAAO,EAAG,QAAO;AACzD,QAAO,IAAI,WAAW,OAAO;;AAK9B,MAAM,2BAA2B;AACjC,SAAS,uBAAuB,MAAM;AACrC,KAAI,CAAC,WAAW,KAAK,IAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAM;AAC3F,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,KAAK,SAAS;AAClC,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,SAAU,QAAO,KAAK;AAC3E,SAAO,EAAE,SAAS,IAAI,MAAM;SACrB;AACP;;;AAGF,SAAS,WAAW,OAAO;AAC1B,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAK5E,MAAM,SAAS;AACf,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,uBAAuB;CAC5B,iBAAiB;CACjB,gBAAgB;CAChB,UAAU,KAAK,OAAO;CACtB,cAAc;CACd;AACD,eAAe,sBAAsB,OAAO,SAAS;CACpD,MAAM,SAAS;EACd,iBAAiB,QAAQ,mBAAmB,qBAAqB;EACjE,gBAAgB,QAAQ,kBAAkB,qBAAqB;EAC/D,UAAU,QAAQ,YAAY,qBAAqB;EACnD,cAAc,QAAQ,gBAAgB,qBAAqB;EAC3D;AACD,KAAI,CAAC,eAAe,OAAO,CAAE,QAAO,kBAAkB,eAAe,0CAA0C;CAC/G,MAAM,YAAY,KAAK,KAAK;CAC5B,IAAI,aAAa,oBAAoB,OAAO,KAAK,GAAG,QAAQ,uBAAuB,KAAK;AACxF,KAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAK,IAAI,YAAY,IAAI,aAAa,GAAG;EACxC,MAAM,YAAY,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACxD,MAAI,aAAa,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EAClH,MAAM,OAAO,kBAAkB,WAAW,OAAO,QAAQ,uBAAuB,KAAK,GAAG;GACvF,SAAS;GACT,OAAO;GACP,GAAG,MAAM,aAAa,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AAC5E,MAAI,CAAC,KAAK,QAAS,QAAO;EAC1B,MAAM,2BAA2B,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACvE,MAAI,4BAA4B,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EACjI,MAAM,WAAW,MAAM,cAAc,QAAQ,OAAO,WAAW,OAAO,KAAK,IAAI,0BAA0B,OAAO,gBAAgB,CAAC;AACjI,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,WAAW,SAAS,MAAM,OAAO,EAAE;AACtC,OAAI,aAAa,OAAO,aAAc,QAAO,kBAAkB,2BAA2B,4CAA4C;GACtI,MAAM,WAAW,SAAS,MAAM,QAAQ,IAAI,WAAW;AACvD,OAAI,aAAa,KAAM,QAAO,kBAAkB,6BAA6B,gDAAgD;AAC7H,gBAAa,oBAAoB,UAAU,WAAW,OAAO,QAAQ,uBAAuB,KAAK;AACjG,OAAI,CAAC,WAAW,QAAS,QAAO;AAChC;;AAED,MAAI,CAAC,SAAS,MAAM,MAAM,CAAC,QAAQ,iBAAiB,SAAS,SAAS,MAAM,OAAO,CAAE,QAAO,kBAAkB,yBAAyB,8BAA8B,SAAS,MAAM,OAAO,GAAG;EAC9L,MAAM,gBAAgB,SAAS,MAAM,QAAQ,IAAI,iBAAiB;AAClE,MAAI,kBAAkB,SAAS,CAAC,OAAO,KAAK,cAAc,IAAI,OAAO,cAAc,GAAG,OAAO,UAAW,QAAO,kBAAkB,0BAA0B,uCAAuC;EAClM,MAAM,QAAQ,MAAM,aAAa,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,eAAe;AACnG,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,SAAO;GACN,SAAS;GACT,OAAO;IACN,OAAO,MAAM;IACb,KAAK,WAAW;IAChB,QAAQ,SAAS,MAAM;IACvB,SAAS,SAAS,MAAM;IACxB;GACD;;;AAGH,SAAS,oBAAoB,OAAO,MAAM,qBAAqB,OAAO;CACrE,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,OAAO,KAAK;SACnB;AACP,SAAO,kBAAkB,eAAe,+BAA+B;;AAExE,KAAI,IAAI,aAAa,YAAY,CAAC,kBAAkB,KAAK,mBAAmB,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,QAAO,kBAAkB,eAAe,+DAA+D;AACnO,KAAI,CAAC,kBAAkB,KAAK,mBAAmB,KAAK,YAAY,IAAI,SAAS,IAAI,gBAAgB,IAAI,SAAS,EAAG,QAAO,kBAAkB,iBAAiB,sCAAsC;AACjM,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,SAAS,kBAAkB,KAAK,SAAS;AACxC,KAAI,CAAC,WAAW,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;CAC9E,MAAM,WAAW,IAAI,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;AACrE,QAAO,aAAa,eAAe,SAAS,SAAS,aAAa,IAAI,aAAa,eAAe,aAAa,WAAW,aAAa;;AAExI,eAAe,aAAa,KAAK,UAAU,WAAW;AACrD,KAAI;EACH,MAAM,YAAY,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,SAAS,IAAI,SAAS,CAAC,EAAE,UAAU;AACpG,MAAI,UAAU,WAAW,KAAK,UAAU,KAAK,mBAAmB,CAAE,QAAO,kBAAkB,iBAAiB,qDAAqD;AACjK,SAAO;GACN,SAAS;GACT,OAAO;GACP;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,iBAAiB,4CAA4C;;;AAGxF,eAAe,cAAc,qBAAqB,KAAK,WAAW;CACjE,MAAM,aAAa,IAAI,iBAAiB;AACxC,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,oBAAoB,KAAK;IAC9E,QAAQ;IACR,UAAU;IACV,QAAQ,WAAW;IACnB,CAAC,CAAC,EAAE,iBAAiB,WAAW,OAAO,CAAC;GACzC;UACO,OAAO;AACf,MAAI,WAAW,OAAO,WAAW,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,2CAA2C;AAC9I,SAAO,kBAAkB,gBAAgB,+BAA+B;;;AAG1E,eAAe,aAAa,UAAU,cAAc,WAAW,gBAAgB;AAC9E,KAAI,SAAS,SAAS,KAAM,QAAO;EAClC,SAAS;EACT,OAAO,IAAI,YAAY;EACvB;CACD,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,MAAM,SAAS,EAAE;CACjB,IAAI,SAAS;AACb,KAAI;AACH,WAAS;GACR,MAAM,YAAY,kBAAkB,KAAK,KAAK,GAAG;AACjD,OAAI,aAAa,GAAG;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,oBAAoB,iDAAiD;;GAE/F,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,OAAI,CAAC,MAAM,SAAS;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO;;AAER,OAAI,MAAM,MAAM,KAAM;GACtB,MAAM,QAAQ,MAAM,MAAM;AAC1B,aAAU,MAAM;AAChB,OAAI,SAAS,cAAc;AAC1B,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,0BAA0B,uCAAuC;;AAE3F,UAAO,KAAK,MAAM;;SAEZ;AACP,SAAO,kBAAkB,gBAAgB,2CAA2C;WAC3E;AACT,SAAO,aAAa;;CAErB,MAAM,SAAS,IAAI,WAAW,OAAO;CACrC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,SAAO,IAAI,OAAO,OAAO;AACzB,YAAU,MAAM;;AAEjB,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,gBAAgB,QAAQ,WAAW;AACjD,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,OAAO,MAAM,CAAC,EAAE,UAAU;GAChF;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,gBAAgB,2CAA2C;;;;;;;AAOtF,SAAS,YAAY,WAAW,WAAW,WAAW;AACrD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI,UAAU;EACd,MAAM,UAAU,iBAAiB;AAChC,OAAI,QAAS;AACb,aAAU;AACV,gBAAa;AACb,UAAO,IAAI,aAAa,aAAa,aAAa,CAAC;KACjD,UAAU;AACb,YAAU,MAAM,UAAU;AACzB,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,WAAQ,MAAM;MACX,UAAU;AACb,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,UAAO,MAAM;IACZ;GACD;;AAEH,SAAS,eAAe,QAAQ;AAC/B,QAAO,OAAO,OAAO,OAAO,CAAC,OAAO,UAAU,OAAO,cAAc,MAAM,IAAI,QAAQ,EAAE;;AAExF,SAAS,WAAW,QAAQ;AAC3B,QAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW;;AAE3F,SAAS,aAAa,OAAO;AAC5B,QAAO,iBAAiB,gBAAgB,MAAM,SAAS;;AAExD,SAAS,YAAY,UAAU;AAC9B,QAAO,aAAa,KAAK,SAAS,IAAI,SAAS,SAAS,IAAI;;AAE7D,SAAS,gBAAgB,UAAU;CAClC,MAAM,aAAa,SAAS,aAAa;AACzC,QAAO,eAAe,eAAe,WAAW,SAAS,aAAa,IAAI,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,YAAY;;AAE5I,SAAS,mBAAmB,SAAS;CACpC,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,MAAM;EAClB,MAAM,CAAC,GAAG,KAAK;AACf,SAAO,MAAM,KAAK,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,MAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,MAAM,OAAO,KAAK;;CAEhO,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,KAAM,QAAO;CAC1B,MAAM,QAAQ,KAAK;CACnB,MAAM,gBAAgB,KAAK,OAAO,SAAS,SAAS,EAAE;CACtD,MAAM,aAAa,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO;CAC/E,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,eAAe,QAAQ,WAAW;CACxC,MAAM,eAAe,QAAQ,WAAW;AACxC,KAAI,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO,MAAO,QAAO,mBAAmB,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM;AACvK,QAAO,iBAAiB,cAAc,aAAa,eAAe;;AAEnE,SAAS,UAAU,OAAO;CACzB,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,UAAU,MAAM,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IAAI;AAC9E,KAAI,QAAQ,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAAE,QAAO;AACtF,QAAO;EACN,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR;;AAEF,SAAS,UAAU,OAAO;AACzB,KAAI,MAAM,SAAS,MAAM,IAAI,MAAM,MAAM,KAAK,CAAC,SAAS,EAAG,QAAO;CAClE,MAAM,CAAC,SAAS,IAAI,QAAQ,MAAM,MAAM,MAAM,KAAK;CACnD,MAAM,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,MAAM,IAAI;CACnD,MAAM,OAAO,UAAU,KAAK,EAAE,GAAG,MAAM,MAAM,IAAI;CACjD,MAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK;AAChC,KAAI,MAAM,MAAM,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,MAAM,SAAS,EAAG,QAAO;AAC5E,KAAI,CAAC,MAAM,SAAS,KAAK,IAAI,MAAM,WAAW,EAAG,QAAO;CACxD,MAAM,SAAS,MAAM,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS;AACzD,QAAO;EACN,GAAG;EACH,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,CAAC,CAAC,KAAK,IAAI;EAC3C,GAAG;EACH,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,GAAG,CAAC;;AAK3C,MAAM,yBAAyB,MAAM;;AA+MrC,MAAM,8BAA8B,MAAM;;AAE1C,MAAM,kBAAkB,MAAM;;AAE9B,MAAM,wBAAwB,MAAM;;AAEpC,MAAM,wBAAwB;;AAE9B,MAAM,6BAA6B;;;;;AAKnC,MAAM,gCAAgC,kBAAkB,6BAA6B,MAAM,wBAAwB,MAAM,IAAI;AAI7H,MAAM,kBAAkB;AACxB,MAAM,gBAAgB,kBAAkB;AAGxC,MAAM,YAAY,IAAI,YAAY,SAAS;CAC1C,OAAO;CACP,WAAW;CACX,CAAC;AAkMF,IAAI,mBAAmC,gCAAgB,YAAY;AAClE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,YAAY,QAAQ,WAAW,KAAK;AAC5C,SAAQ,WAAW;EAClB,SAAS,QAAQ;AAChB,UAAO;IACN,SAAS,MAAM,OAAO,QAAQ,GAAG,OAAO,KAAK,gBAAgB,OAAO,QAAQ,CAAC,GAAG,OAAO,MAAM,EAAE;IAC/F,aAAa,MAAM,OAAO,YAAY,GAAG,WAAW,OAAO,OAAO,YAAY,GAAG;IACjF,YAAY,WAAW,MAAM,QAAQ,QAAQ,WAAW,GAAG,OAAO,WAAW,KAAK,MAAM,QAAQ,UAAU,SAAS,EAAE,CAAC,GAAG,EAAE;IAC3H;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,QAAQ,WAAW,EAAG,KAAI,UAAU,gBAAgB,QAAQ,QAAQ;AAChF,OAAI,QAAQ,gBAAgB,GAAI,KAAI,cAAc,QAAQ;AAC1D,OAAI,QAAQ,YAAY,OAAQ,KAAI,aAAa,QAAQ,WAAW,KAAK,MAAM,QAAQ,UAAU,OAAO,EAAE,CAAC;AAC3G,UAAO;;EAER;AACD,SAAQ,YAAY;EACnB,SAAS,QAAQ;AAChB,UAAO;IACN,KAAK,MAAM,OAAO,IAAI,GAAG,OAAO,KAAK,gBAAgB,OAAO,IAAI,CAAC,GAAG,OAAO,MAAM,EAAE;IACnF,OAAO,MAAM,OAAO,MAAM,GAAG,WAAW,OAAO,OAAO,MAAM,GAAG;IAC/D;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,IAAI,WAAW,EAAG,KAAI,MAAM,gBAAgB,QAAQ,IAAI;AACpE,OAAI,QAAQ,UAAU,GAAI,KAAI,QAAQ,QAAQ;AAC9C,UAAO;;EAER;CACD,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,KAAK,WAAW,OAAO,KAAK,KAAK,SAAS,CAAC;;CAE9D,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,OAAO,KAAK,IAAI,CAAC,SAAS,SAAS;;CAEtD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,sBAAsC,gCAAgB,YAAY;AACrE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,YAAY,KAAK;AACzB,SAAQ,YAAY;EACnB,SAAS,QAAQ;AAChB,UAAO;IACN,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,OAAO,OAAO,QAAQ,GAAG;IACrE,OAAO,MAAM,OAAO,MAAM,GAAG,WAAW,OAAO,OAAO,MAAM,GAAG;IAC/D;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,YAAY,IAAK,KAAI,UAAU,QAAQ;AACnD,OAAI,QAAQ,UAAU,EAAG,KAAI,QAAQ,KAAK,MAAM,QAAQ,MAAM;AAC9D,UAAO;;EAER;CACD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,0BAA0C,gCAAgB,YAAY;AACzE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,YAAY,QAAQ,uBAAuB,QAAQ,yBAAyB,QAAQ,kBAAkB,QAAQ,oBAAoB,QAAQ,4BAA4B,QAAQ,mBAAmB,QAAQ,sBAAsB,QAAQ,YAAY,QAAQ,yBAAyB,QAAQ,QAAQ,QAAQ,mBAAmB,QAAQ,aAAa,QAAQ,6BAA6B,QAAQ,mBAAmB,QAAQ,gBAAgB,KAAK;AACzb,SAAQ,wBAAwB;AAChC,SAAQ,sBAAsB;AAC9B,SAAQ,2BAA2B;AACnC,SAAQ,yBAAyB;AACjC,SAAQ,qCAAqC;AAC7C,SAAQ,mCAAmC;CAC3C,MAAM,cAAc,qBAAqB;;;;;;;;;;CAUzC,IAAI;AACJ,EAAC,SAAS,eAAe;AACxB,gBAAc,cAAc,gCAAgC,KAAK;AACjE,gBAAc,cAAc,cAAc,KAAK;AAC/C,gBAAc,cAAc,cAAc,KAAK;AAC/C,gBAAc,cAAc,cAAc,KAAK;;;;;;AAM/C,gBAAc,cAAc,cAAc,KAAK;;;;;;AAM/C,gBAAc,cAAc,cAAc,KAAK;IAC7C,kBAAkB,QAAQ,gBAAgB,gBAAgB,EAAE,EAAE;CACjE,SAAS,sBAAsB,QAAQ;AACtC,UAAQ,QAAR;GACC,KAAK;GACL,KAAK,6BAA8B,QAAO,cAAc;GACxD,KAAK;GACL,KAAK,WAAY,QAAO,cAAc;GACtC,KAAK;GACL,KAAK,WAAY,QAAO,cAAc;GACtC,KAAK;GACL,KAAK,WAAY,QAAO,cAAc;GACtC,KAAK;GACL,KAAK,WAAY,QAAO,cAAc;GACtC,KAAK;GACL,KAAK,WAAY,QAAO,cAAc;GACtC,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,0BAA0B;;;CAGtG,SAAS,oBAAoB,QAAQ;AACpC,UAAQ,QAAR;GACC,KAAK,cAAc,2BAA4B,QAAO;GACtD,KAAK,cAAc,SAAU,QAAO;GACpC,KAAK,cAAc,SAAU,QAAO;GACpC,KAAK,cAAc,SAAU,QAAO;GACpC,KAAK,cAAc,SAAU,QAAO;GACpC,KAAK,cAAc,SAAU,QAAO;GACpC,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,0BAA0B;;;;;;;;;;;;;;;;;;;;;;CAsBtG,IAAI;AACJ,EAAC,SAAS,kBAAkB;AAC3B,mBAAiB,iBAAiB,oCAAoC,KAAK;;;;;;AAM3E,mBAAiB,iBAAiB,uBAAuB,KAAK;;;;;;AAM9D,mBAAiB,iBAAiB,mBAAmB,KAAK;;AAE1D,mBAAiB,iBAAiB,sBAAsB,KAAK;;AAE7D,mBAAiB,iBAAiB,kBAAkB,KAAK;;AAEzD,mBAAiB,iBAAiB,mCAAmC,KAAK;AAC1E,mBAAiB,iBAAiB,mCAAmC,MAAM;AAC3E,mBAAiB,iBAAiB,mCAAmC,MAAM;;AAE3E,mBAAiB,iBAAiB,8BAA8B,MAAM;AACtE,mBAAiB,iBAAiB,8BAA8B,MAAM;AACtE,mBAAiB,iBAAiB,8BAA8B,MAAM;;;;;;AAMtE,mBAAiB,iBAAiB,kCAAkC,KAAK;;AAEzE,mBAAiB,iBAAiB,6BAA6B,KAAK;AACpE,mBAAiB,iBAAiB,6BAA6B,MAAM;AACrE,mBAAiB,iBAAiB,6BAA6B,MAAM;;AAErE,mBAAiB,iBAAiB,kBAAkB,KAAK;AACzD,mBAAiB,iBAAiB,qBAAqB,KAAK;;;;;;;AAO5D,mBAAiB,iBAAiB,6BAA6B,MAAM;;AAErE,mBAAiB,iBAAiB,6BAA6B,MAAM;;;;;;;;;;;;;;;;;AAiBrE,mBAAiB,iBAAiB,gBAAgB,MAAM;;AAExD,mBAAiB,iBAAiB,kBAAkB,MAAM;;;;;;;;;;;;;;;;;;AAkB1D,mBAAiB,iBAAiB,eAAe,MAAM;AACvD,mBAAiB,iBAAiB,eAAe,MAAM;AACvD,mBAAiB,iBAAiB,eAAe,MAAM;IACrD,qBAAqB,QAAQ,mBAAmB,mBAAmB,EAAE,EAAE;CAC1E,SAAS,yBAAyB,QAAQ;AACzC,UAAQ,QAAR;GACC,KAAK;GACL,KAAK,iCAAkC,QAAO,iBAAiB;GAC/D,KAAK;GACL,KAAK,oBAAqB,QAAO,iBAAiB;GAClD,KAAK;GACL,KAAK,gBAAiB,QAAO,iBAAiB;GAC9C,KAAK;GACL,KAAK,mBAAoB,QAAO,iBAAiB;GACjD,KAAK;GACL,KAAK,eAAgB,QAAO,iBAAiB;GAC7C,KAAK;GACL,KAAK,gCAAiC,QAAO,iBAAiB;GAC9D,KAAK;GACL,KAAK,gCAAiC,QAAO,iBAAiB;GAC9D,KAAK;GACL,KAAK,gCAAiC,QAAO,iBAAiB;GAC9D,KAAK;GACL,KAAK,2BAA4B,QAAO,iBAAiB;GACzD,KAAK;GACL,KAAK,2BAA4B,QAAO,iBAAiB;GACzD,KAAK;GACL,KAAK,2BAA4B,QAAO,iBAAiB;GACzD,KAAK;GACL,KAAK,+BAAgC,QAAO,iBAAiB;GAC7D,KAAK;GACL,KAAK,0BAA2B,QAAO,iBAAiB;GACxD,KAAK;GACL,KAAK,0BAA2B,QAAO,iBAAiB;GACxD,KAAK;GACL,KAAK,0BAA2B,QAAO,iBAAiB;GACxD,KAAK;GACL,KAAK,eAAgB,QAAO,iBAAiB;GAC7C,KAAK;GACL,KAAK,kBAAmB,QAAO,iBAAiB;GAChD,KAAK;GACL,KAAK,0BAA2B,QAAO,iBAAiB;GACxD,KAAK;GACL,KAAK,0BAA2B,QAAO,iBAAiB;GACxD,KAAK;GACL,KAAK,aAAc,QAAO,iBAAiB;GAC3C,KAAK;GACL,KAAK,eAAgB,QAAO,iBAAiB;GAC7C,KAAK;GACL,KAAK,YAAa,QAAO,iBAAiB;GAC1C,KAAK;GACL,KAAK,YAAa,QAAO,iBAAiB;GAC1C,KAAK;GACL,KAAK,YAAa,QAAO,iBAAiB;GAC1C,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,6BAA6B;;;CAGzG,SAAS,uBAAuB,QAAQ;AACvC,UAAQ,QAAR;GACC,KAAK,iBAAiB,+BAAgC,QAAO;GAC7D,KAAK,iBAAiB,kBAAmB,QAAO;GAChD,KAAK,iBAAiB,cAAe,QAAO;GAC5C,KAAK,iBAAiB,iBAAkB,QAAO;GAC/C,KAAK,iBAAiB,aAAc,QAAO;GAC3C,KAAK,iBAAiB,8BAA+B,QAAO;GAC5D,KAAK,iBAAiB,8BAA+B,QAAO;GAC5D,KAAK,iBAAiB,8BAA+B,QAAO;GAC5D,KAAK,iBAAiB,yBAA0B,QAAO;GACvD,KAAK,iBAAiB,yBAA0B,QAAO;GACvD,KAAK,iBAAiB,yBAA0B,QAAO;GACvD,KAAK,iBAAiB,6BAA8B,QAAO;GAC3D,KAAK,iBAAiB,wBAAyB,QAAO;GACtD,KAAK,iBAAiB,wBAAyB,QAAO;GACtD,KAAK,iBAAiB,wBAAyB,QAAO;GACtD,KAAK,iBAAiB,aAAc,QAAO;GAC3C,KAAK,iBAAiB,gBAAiB,QAAO;GAC9C,KAAK,iBAAiB,wBAAyB,QAAO;GACtD,KAAK,iBAAiB,wBAAyB,QAAO;GACtD,KAAK,iBAAiB,WAAY,QAAO;GACzC,KAAK,iBAAiB,aAAc,QAAO;GAC3C,KAAK,iBAAiB,UAAW,QAAO;GACxC,KAAK,iBAAiB,UAAW,QAAO;GACxC,KAAK,iBAAiB,UAAW,QAAO;GACxC,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,6BAA6B;;;CAGzG,IAAI;AACJ,EAAC,SAAS,4BAA4B;AACrC,6BAA2B,2BAA2B,+CAA+C,KAAK;AAC1G,6BAA2B,2BAA2B,WAAW,KAAK;AACtE,6BAA2B,2BAA2B,SAAS,KAAK;;;;;;AAMpE,6BAA2B,2BAA2B,gBAAgB,KAAK;IACzE,+BAA+B,QAAQ,6BAA6B,6BAA6B,EAAE,EAAE;CACxG,SAAS,mCAAmC,QAAQ;AACnD,UAAQ,QAAR;GACC,KAAK;GACL,KAAK,4CAA6C,QAAO,2BAA2B;GACpF,KAAK;GACL,KAAK,QAAS,QAAO,2BAA2B;GAChD,KAAK;GACL,KAAK,MAAO,QAAO,2BAA2B;GAC9C,KAAK;GACL,KAAK,aAAc,QAAO,2BAA2B;GACrD,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,uCAAuC;;;CAGnH,SAAS,iCAAiC,QAAQ;AACjD,UAAQ,QAAR;GACC,KAAK,2BAA2B,0CAA2C,QAAO;GAClF,KAAK,2BAA2B,MAAO,QAAO;GAC9C,KAAK,2BAA2B,IAAK,QAAO;GAC5C,KAAK,2BAA2B,WAAY,QAAO;GACnD,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,uCAAuC;;;AAGnH,SAAQ,aAAa;EACpB,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,sBAAsB,OAAO,UAAU,GAAG;IAC/E,QAAQ,MAAM,OAAO,OAAO,GAAG,OAAO,KAAK,gBAAgB,OAAO,OAAO,CAAC,GAAG,OAAO,MAAM,EAAE;IAC5F;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,EAAG,KAAI,YAAY,oBAAoB,QAAQ,UAAU;AACnF,OAAI,QAAQ,OAAO,WAAW,EAAG,KAAI,SAAS,gBAAgB,QAAQ,OAAO;AAC7E,UAAO;;EAER;AACD,SAAQ,mBAAmB;EAC1B,SAAS,QAAQ;AAChB,UAAO;IACN,eAAe,MAAM,OAAO,cAAc,GAAG,QAAQ,WAAW,SAAS,OAAO,cAAc,GAAG,KAAK;IACtG,WAAW,MAAM,OAAO,UAAU,GAAG,OAAO,KAAK,gBAAgB,OAAO,UAAU,CAAC,GAAG,OAAO,MAAM,EAAE;IACrG;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,kBAAkB,KAAK,EAAG,KAAI,gBAAgB,QAAQ,WAAW,OAAO,QAAQ,cAAc;AAC1G,OAAI,QAAQ,UAAU,WAAW,EAAG,KAAI,YAAY,gBAAgB,QAAQ,UAAU;AACtF,UAAO;;EAER;AACD,SAAQ,QAAQ;EACf,SAAS,QAAQ;AAChB,UAAO,EAAE,OAAO,MAAM,OAAO,MAAM,GAAG,OAAO,KAAK,gBAAgB,OAAO,MAAM,CAAC,GAAG,OAAO,MAAM,EAAE,EAAE;;EAErG,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,MAAM,WAAW,EAAG,KAAI,QAAQ,gBAAgB,QAAQ,MAAM;AAC1E,UAAO;;EAER;AACD,SAAQ,yBAAyB;EAChC,SAAS,QAAQ;AAChB,UAAO,EAAE,iBAAiB,MAAM,OAAO,gBAAgB,GAAG,OAAO,KAAK,gBAAgB,OAAO,gBAAgB,CAAC,GAAG,OAAO,MAAM,EAAE,EAAE;;EAEnI,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,gBAAgB,WAAW,EAAG,KAAI,kBAAkB,gBAAgB,QAAQ,gBAAgB;AACxG,UAAO;;EAER;AACD,SAAQ,YAAY;EACnB,SAAS,QAAQ;AAChB,UAAO;IACN,UAAU,MAAM,OAAO,SAAS,GAAG,OAAO,KAAK,gBAAgB,OAAO,SAAS,CAAC,GAAG,KAAK;IACxF,YAAY,MAAM,OAAO,WAAW,GAAG,yBAAyB,OAAO,WAAW,GAAG;IACrF,UAAU,MAAM,OAAO,SAAS,GAAG,QAAQ,UAAU,SAAS,OAAO,SAAS,GAAG,KAAK;IACtF;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,aAAa,KAAK,EAAG,KAAI,WAAW,gBAAgB,QAAQ,SAAS;AACjF,OAAI,QAAQ,eAAe,EAAG,KAAI,aAAa,uBAAuB,QAAQ,WAAW;AACzF,OAAI,QAAQ,aAAa,KAAK,EAAG,KAAI,WAAW,QAAQ,UAAU,OAAO,QAAQ,SAAS;AAC1F,UAAO;;EAER;AACD,SAAQ,sBAAsB;EAC7B,SAAS,QAAQ;AAChB,UAAO,EAAE,MAAM,MAAM,OAAO,KAAK,GAAG,WAAW,OAAO,OAAO,KAAK,GAAG,IAAI;;EAE1E,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,GAAI,KAAI,OAAO,QAAQ;AAC5C,UAAO;;EAER;AACD,SAAQ,mBAAmB;EAC1B,SAAS,QAAQ;AAChB,UAAO,EAAE,IAAI,WAAW,MAAM,QAAQ,QAAQ,GAAG,GAAG,OAAO,GAAG,KAAK,MAAM,WAAW,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;;EAEtG,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,IAAI,OAAQ,KAAI,KAAK,QAAQ,GAAG,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AACrE,UAAO;;EAER;AACD,SAAQ,4BAA4B;EACnC,SAAS,QAAQ;AAChB,UAAO;IACN,KAAK,MAAM,OAAO,IAAI,GAAG,QAAQ,iBAAiB,SAAS,OAAO,IAAI,GAAG,KAAK;IAC9E,OAAO,MAAM,OAAO,MAAM,GAAG,OAAO,KAAK,gBAAgB,OAAO,MAAM,CAAC,GAAG,OAAO,MAAM,EAAE;IACzF;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,QAAQ,KAAK,EAAG,KAAI,MAAM,QAAQ,iBAAiB,OAAO,QAAQ,IAAI;AAClF,OAAI,QAAQ,MAAM,WAAW,EAAG,KAAI,QAAQ,gBAAgB,QAAQ,MAAM;AAC1E,UAAO;;EAER;AACD,SAAQ,oBAAoB;EAC3B,SAAS,QAAQ;AAChB,UAAO;IACN,cAAc,MAAM,OAAO,aAAa,GAAG,WAAW,OAAO,OAAO,aAAa,GAAG;IACpF,YAAY,MAAM,OAAO,WAAW,GAAG,WAAW,OAAO,OAAO,WAAW,GAAG;IAC9E;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,iBAAiB,GAAI,KAAI,eAAe,QAAQ;AAC5D,OAAI,QAAQ,eAAe,GAAI,KAAI,aAAa,QAAQ;AACxD,UAAO;;EAER;AACD,SAAQ,kBAAkB;EACzB,SAAS,QAAQ;AAChB,UAAO,EAAE,UAAU,MAAM,OAAO,SAAS,GAAG,OAAO,KAAK,gBAAgB,OAAO,SAAS,CAAC,GAAG,OAAO,MAAM,EAAE,EAAE;;EAE9G,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,WAAW,EAAG,KAAI,WAAW,gBAAgB,QAAQ,SAAS;AACnF,UAAO;;EAER;AACD,SAAQ,yBAAyB;EAChC,SAAS,QAAQ;AAChB,UAAO;IACN,MAAM,MAAM,OAAO,KAAK,GAAG,mCAAmC,OAAO,KAAK,GAAG;IAC7E,UAAU,MAAM,OAAO,OAAO,GAAG;KAChC,OAAO;KACP,QAAQ,WAAW,OAAO,OAAO,OAAO;KACxC,GAAG,MAAM,OAAO,MAAM,GAAG;KACzB,OAAO;KACP,OAAO,WAAW,OAAO,OAAO,MAAM;KACtC,GAAG,KAAK;IACT;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,EAAG,KAAI,OAAO,iCAAiC,QAAQ,KAAK;AACjF,OAAI,QAAQ,UAAU,UAAU,SAAU,KAAI,SAAS,QAAQ,SAAS;YAC/D,QAAQ,UAAU,UAAU,QAAS,KAAI,QAAQ,QAAQ,SAAS;AAC3E,UAAO;;EAER;AACD,SAAQ,uBAAuB;EAC9B,SAAS,QAAQ;AAChB,UAAO,EAAE,cAAc,WAAW,MAAM,QAAQ,QAAQ,aAAa,GAAG,OAAO,aAAa,KAAK,MAAM,QAAQ,gBAAgB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;;EAEnJ,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,OAAQ,KAAI,eAAe,QAAQ,aAAa,KAAK,MAAM,QAAQ,gBAAgB,OAAO,EAAE,CAAC;AACvH,UAAO;;EAER;AACD,SAAQ,YAAY;EACnB,SAAS,QAAQ;AAChB,UAAO;IACN,OAAO,MAAM,OAAO,MAAM,GAAG,kBAAkB,OAAO,MAAM,GAAG,KAAK;IACpE,KAAK,MAAM,OAAO,IAAI,GAAG,kBAAkB,OAAO,IAAI,GAAG,KAAK;IAC9D;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,UAAU,KAAK,EAAG,KAAI,QAAQ,QAAQ,MAAM,aAAa;AACrE,OAAI,QAAQ,QAAQ,KAAK,EAAG,KAAI,MAAM,QAAQ,IAAI,aAAa;AAC/D,UAAO;;EAER;CACD,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,KAAK,WAAW,OAAO,KAAK,KAAK,SAAS,CAAC;;CAE9D,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,OAAO,KAAK,IAAI,CAAC,SAAS,SAAS;;CAEtD,SAAS,cAAc,GAAG;EACzB,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,IAAI,KAAK;AACnD,aAAW,EAAE,SAAS,KAAK;AAC3B,SAAO,IAAI,WAAW,KAAK,OAAO;;CAEnC,SAAS,kBAAkB,GAAG;AAC7B,MAAI,aAAa,WAAW,KAAM,QAAO;WAChC,OAAO,MAAM,SAAU,QAAO,IAAI,WAAW,KAAK,EAAE;MACxD,QAAO,cAAc,YAAY,UAAU,SAAS,EAAE,CAAC;;CAE7D,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,yBAAyC,gCAAgB,YAAY;AACxE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,uBAAuB,QAAQ,mBAAmB,QAAQ,iBAAiB,QAAQ,aAAa,QAAQ,cAAc,KAAK;CACnI,MAAM,oBAAoB,yBAAyB;AACnD,SAAQ,cAAc;EACrB,SAAS,QAAQ;AAChB,UAAO;IACN,MAAM,MAAM,OAAO,KAAK,GAAG,WAAW,OAAO,OAAO,KAAK,GAAG;IAC5D,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,OAAO,OAAO,QAAQ,GAAG;IACrE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,GAAI,KAAI,OAAO,QAAQ;AAC5C,OAAI,QAAQ,YAAY,GAAI,KAAI,UAAU,QAAQ;AAClD,UAAO;;EAER;AACD,SAAQ,aAAa;EACpB,SAAS,QAAQ;AAChB,UAAO,EAAE,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,OAAO,OAAO,SAAS,GAAG,IAAI;;EAEtF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,aAAa,GAAI,KAAI,WAAW,QAAQ;AACpD,UAAO;;EAER;AACD,SAAQ,iBAAiB;EACxB,SAAS,QAAQ;AAChB,UAAO;IACN,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,OAAO,OAAO,SAAS,GAAG;IACxE,UAAU,MAAM,OAAO,SAAS,GAAG,OAAO,KAAK,gBAAgB,OAAO,SAAS,CAAC,GAAG,OAAO,MAAM,EAAE;IAClG,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,OAAO,OAAO,SAAS,GAAG;IACxE,QAAQ,WAAW,MAAM,QAAQ,QAAQ,OAAO,GAAG,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACjH,YAAY,MAAM,OAAO,WAAW,GAAG,QAAQ,WAAW,SAAS,OAAO,WAAW,GAAG,KAAK;IAC7F;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,aAAa,IAAK,KAAI,WAAW,QAAQ;AACrD,OAAI,QAAQ,SAAS,WAAW,EAAG,KAAI,WAAW,gBAAgB,QAAQ,SAAS;AACnF,OAAI,QAAQ,aAAa,IAAK,KAAI,WAAW,QAAQ;AACrD,OAAI,QAAQ,QAAQ,OAAQ,KAAI,SAAS,QAAQ,OAAO,KAAK,MAAM,gBAAgB,EAAE,CAAC;AACtF,OAAI,QAAQ,eAAe,KAAK,EAAG,KAAI,aAAa,QAAQ,WAAW,OAAO,QAAQ,WAAW;AACjG,UAAO;;EAER;AACD,SAAQ,mBAAmB;EAC1B,SAAS,QAAQ;AAChB,UAAO,EAAE,sBAAsB,MAAM,OAAO,qBAAqB,GAAG,OAAO,KAAK,gBAAgB,OAAO,qBAAqB,CAAC,GAAG,OAAO,MAAM,EAAE,EAAE;;EAElJ,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,qBAAqB,WAAW,EAAG,KAAI,uBAAuB,gBAAgB,QAAQ,qBAAqB;AACvH,UAAO;;EAER;AACD,SAAQ,uBAAuB;EAC9B,SAAS,QAAQ;AAChB,UAAO;IACN,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,OAAO,OAAO,SAAS,GAAG;IACxE,OAAO,MAAM,OAAO,MAAM,GAAG,kBAAkB,MAAM,SAAS,OAAO,MAAM,GAAG,KAAK;IACnF,aAAa,MAAM,OAAO,YAAY,GAAG,QAAQ,YAAY,SAAS,OAAO,YAAY,GAAG,KAAK;IACjG,gBAAgB,MAAM,OAAO,eAAe,GAAG,WAAW,OAAO,OAAO,eAAe,GAAG;IAC1F,kBAAkB,MAAM,OAAO,iBAAiB,GAAG,QAAQ,iBAAiB,SAAS,OAAO,iBAAiB,GAAG,KAAK;IACrH,gBAAgB,MAAM,OAAO,eAAe,GAAG,QAAQ,eAAe,SAAS,OAAO,eAAe,GAAG,KAAK;IAC7G,mBAAmB,MAAM,OAAO,kBAAkB,GAAG,OAAO,KAAK,gBAAgB,OAAO,kBAAkB,CAAC,GAAG,OAAO,MAAM,EAAE;IAC7H;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,aAAa,IAAK,KAAI,WAAW,QAAQ;AACrD,OAAI,QAAQ,UAAU,KAAK,EAAG,KAAI,QAAQ,kBAAkB,MAAM,OAAO,QAAQ,MAAM;AACvF,OAAI,QAAQ,gBAAgB,KAAK,EAAG,KAAI,cAAc,QAAQ,YAAY,OAAO,QAAQ,YAAY;AACrG,OAAI,QAAQ,mBAAmB,IAAK,KAAI,iBAAiB,QAAQ;AACjE,OAAI,QAAQ,qBAAqB,KAAK,EAAG,KAAI,mBAAmB,QAAQ,iBAAiB,OAAO,QAAQ,iBAAiB;AACzH,OAAI,QAAQ,mBAAmB,KAAK,EAAG,KAAI,iBAAiB,QAAQ,eAAe,OAAO,QAAQ,eAAe;AACjH,OAAI,QAAQ,kBAAkB,WAAW,EAAG,KAAI,oBAAoB,gBAAgB,QAAQ,kBAAkB;AAC9G,UAAO;;EAER;CACD,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,KAAK,WAAW,OAAO,KAAK,KAAK,SAAS,CAAC;;CAE9D,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,OAAO,KAAK,IAAI,CAAC,SAAS,SAAS;;CAEtD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,0BAA0C,gCAAgB,YAAY;AACzE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,SAAS,QAAQ,uBAAuB,QAAQ,4BAA4B,KAAK;CACzF,MAAM,aAAa,kBAAkB;CACrC,MAAM,oBAAoB,yBAAyB;CACnD,MAAM,mBAAmB,wBAAwB;AACjD,SAAQ,4BAA4B;EACnC,SAAS,QAAQ;AAChB,UAAO,EAAE,mBAAmB,WAAW,MAAM,QAAQ,QAAQ,kBAAkB,GAAG,OAAO,kBAAkB,KAAK,MAAM,kBAAkB,uBAAuB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;;EAEnL,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,mBAAmB,OAAQ,KAAI,oBAAoB,QAAQ,kBAAkB,KAAK,MAAM,kBAAkB,uBAAuB,OAAO,EAAE,CAAC;AACvJ,UAAO;;EAER;AACD,SAAQ,uBAAuB;EAC9B,SAAS,QAAQ;AAChB,UAAO;IACN,SAAS,MAAM,OAAO,UAAU,GAAG;KAClC,OAAO;KACP,WAAW,kBAAkB,oBAAoB,SAAS,OAAO,UAAU;KAC3E,GAAG,MAAM,OAAO,qBAAqB,GAAG;KACxC,OAAO;KACP,sBAAsB,kBAAkB,qBAAqB,SAAS,OAAO,qBAAqB;KAClG,GAAG,MAAM,OAAO,YAAY,GAAG;KAC/B,OAAO;KACP,aAAa,kBAAkB,gBAAgB,SAAS,OAAO,YAAY;KAC3E,GAAG,KAAK;IACT,aAAa,WAAW,MAAM,QAAQ,QAAQ,YAAY,GAAG,OAAO,YAAY,KAAK,MAAM,iBAAiB,qBAAqB,SAAS,EAAE,CAAC,GAAG,EAAE;IAClJ,2BAA2B,MAAM,OAAO,0BAA0B,GAAG,QAAQ,0BAA0B,SAAS,OAAO,0BAA0B,GAAG,KAAK;IACzJ;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,UAAU,YAAa,KAAI,YAAY,kBAAkB,oBAAoB,OAAO,QAAQ,QAAQ,UAAU;YAC1H,QAAQ,SAAS,UAAU,uBAAwB,KAAI,uBAAuB,kBAAkB,qBAAqB,OAAO,QAAQ,QAAQ,qBAAqB;YACjK,QAAQ,SAAS,UAAU,cAAe,KAAI,cAAc,kBAAkB,gBAAgB,OAAO,QAAQ,QAAQ,YAAY;AAC1I,OAAI,QAAQ,aAAa,OAAQ,KAAI,cAAc,QAAQ,YAAY,KAAK,MAAM,iBAAiB,qBAAqB,OAAO,EAAE,CAAC;AAClI,OAAI,QAAQ,8BAA8B,KAAK,EAAG,KAAI,4BAA4B,QAAQ,0BAA0B,OAAO,QAAQ,0BAA0B;AAC7J,UAAO;;EAER;AACD,SAAQ,SAAS;EAChB,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,sBAAsB,MAAM,OAAO,qBAAqB,GAAG,QAAQ,qBAAqB,SAAS,OAAO,qBAAqB,GAAG,KAAK;IACrI,SAAS,MAAM,OAAO,iBAAiB,GAAG;KACzC,OAAO;KACP,kBAAkB,kBAAkB,iBAAiB,SAAS,OAAO,iBAAiB;KACtF,GAAG,MAAM,OAAO,aAAa,GAAG;KAChC,OAAO;KACP,cAAc,WAAW,SAAS,SAAS,OAAO,aAAa;KAC/D,GAAG,KAAK;IACT;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,GAAI,KAAI,YAAY,QAAQ;AACtD,OAAI,QAAQ,yBAAyB,KAAK,EAAG,KAAI,uBAAuB,QAAQ,qBAAqB,OAAO,QAAQ,qBAAqB;AACzI,OAAI,QAAQ,SAAS,UAAU,mBAAoB,KAAI,mBAAmB,kBAAkB,iBAAiB,OAAO,QAAQ,QAAQ,iBAAiB;YAC5I,QAAQ,SAAS,UAAU,eAAgB,KAAI,eAAe,WAAW,SAAS,OAAO,QAAQ,QAAQ,aAAa;AAC/H,UAAO;;EAER;CACD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,6BAA6C,gCAAgB,YAAY;AAC5E,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,oBAAoB,QAAQ,uBAAuB,QAAQ,UAAU,QAAQ,gBAAgB,QAAQ,cAAc,QAAQ,uBAAuB,QAAQ,0BAA0B,QAAQ,kBAAkB,KAAK;AAC3N,SAAQ,0BAA0B;AAClC,SAAQ,wBAAwB;CAChC,MAAM,oBAAoB,yBAAyB;;;;;;CAMnD,IAAI;AACJ,EAAC,SAAS,iBAAiB;AAC1B,kBAAgB,gBAAgB,gCAAgC,KAAK;;;;;AAKrE,kBAAgB,gBAAgB,SAAS,KAAK;;;;;;AAM9C,kBAAgB,gBAAgB,SAAS,KAAK;;;;;;;AAO9C,kBAAgB,gBAAgB,WAAW,KAAK;IAC9C,oBAAoB,QAAQ,kBAAkB,kBAAkB,EAAE,EAAE;CACvE,SAAS,wBAAwB,QAAQ;AACxC,UAAQ,QAAR;GACC,KAAK;GACL,KAAK,6BAA8B,QAAO,gBAAgB;GAC1D,KAAK;GACL,KAAK,MAAO,QAAO,gBAAgB;GACnC,KAAK;GACL,KAAK,MAAO,QAAO,gBAAgB;GACnC,KAAK;GACL,KAAK,QAAS,QAAO,gBAAgB;GACrC,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,4BAA4B;;;CAGxG,SAAS,sBAAsB,QAAQ;AACtC,UAAQ,QAAR;GACC,KAAK,gBAAgB,2BAA4B,QAAO;GACxD,KAAK,gBAAgB,IAAK,QAAO;GACjC,KAAK,gBAAgB,IAAK,QAAO;GACjC,KAAK,gBAAgB,MAAO,QAAO;GACnC,QAAS,OAAM,IAAI,WAAW,MAAM,6BAA6B,SAAS,4BAA4B;;;AAGxG,SAAQ,0BAA0B;EACjC,SAAS,QAAQ;AAChB,UAAO;IACN,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,OAAO,OAAO,QAAQ,GAAG;IACrE,eAAe,MAAM,OAAO,cAAc,IAAI,GAAG,kBAAkB,uBAAuB,OAAO,cAAc,GAAG;IAClH,WAAW,MAAM,OAAO,UAAU,GAAG,kBAAkB,UAAU,SAAS,OAAO,UAAU,GAAG,KAAK;IACnG,OAAO,MAAM,OAAO,MAAM,GAAG,kBAAkB,MAAM,SAAS,OAAO,MAAM,GAAG,KAAK;IACnF,iBAAiB,MAAM,OAAO,gBAAgB,GAAG,kBAAkB,MAAM,SAAS,OAAO,gBAAgB,GAAG,KAAK;IACjH,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,OAAO,OAAO,SAAS,GAAG;IACxE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,YAAY,GAAI,KAAI,UAAU,QAAQ;AAClD,OAAI,QAAQ,kBAAkB,EAAG,KAAI,iBAAiB,GAAG,kBAAkB,qBAAqB,QAAQ,cAAc;AACtH,OAAI,QAAQ,cAAc,KAAK,EAAG,KAAI,YAAY,kBAAkB,UAAU,OAAO,QAAQ,UAAU;AACvG,OAAI,QAAQ,UAAU,KAAK,EAAG,KAAI,QAAQ,kBAAkB,MAAM,OAAO,QAAQ,MAAM;AACvF,OAAI,QAAQ,oBAAoB,KAAK,EAAG,KAAI,kBAAkB,kBAAkB,MAAM,OAAO,QAAQ,gBAAgB;AACrH,OAAI,QAAQ,aAAa,GAAI,KAAI,WAAW,QAAQ;AACpD,UAAO;;EAER;AACD,SAAQ,uBAAuB;EAC9B,SAAS,QAAQ;AAChB,UAAO;IACN,SAAS,MAAM,OAAO,QAAQ,GAAG,kBAAkB,kBAAkB,SAAS,OAAO,QAAQ,GAAG,KAAK;IACrG,KAAK,MAAM,OAAO,IAAI,GAAG,WAAW,OAAO,OAAO,IAAI,GAAG;IACzD,WAAW,MAAM,OAAO,UAAU,GAAG,kBAAkB,qBAAqB,SAAS,OAAO,UAAU,GAAG,KAAK;IAC9G,UAAU,MAAM,OAAO,SAAS,GAAG,kBAAkB,UAAU,SAAS,OAAO,SAAS,GAAG,KAAK;IAChG,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,OAAO,OAAO,SAAS,GAAG;IACxE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,YAAY,KAAK,EAAG,KAAI,UAAU,kBAAkB,kBAAkB,OAAO,QAAQ,QAAQ;AACzG,OAAI,QAAQ,QAAQ,GAAI,KAAI,MAAM,QAAQ;AAC1C,OAAI,QAAQ,cAAc,KAAK,EAAG,KAAI,YAAY,kBAAkB,qBAAqB,OAAO,QAAQ,UAAU;AAClH,OAAI,QAAQ,aAAa,KAAK,EAAG,KAAI,WAAW,kBAAkB,UAAU,OAAO,QAAQ,SAAS;AACpG,OAAI,QAAQ,aAAa,GAAI,KAAI,WAAW,QAAQ;AACpD,UAAO;;EAER;AACD,SAAQ,cAAc;EACrB,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,OAAO,WAAW,MAAM,QAAQ,QAAQ,MAAM,GAAG,OAAO,MAAM,KAAK,MAAM,QAAQ,wBAAwB,SAAS,EAAE,CAAC,GAAG,EAAE;IAC1H,wBAAwB,WAAW,MAAM,QAAQ,QAAQ,uBAAuB,GAAG,OAAO,uBAAuB,KAAK,MAAM,QAAQ,qBAAqB,SAAS,EAAE,CAAC,GAAG,EAAE;IAC1K,QAAQ,WAAW,MAAM,QAAQ,QAAQ,OAAO,GAAG,OAAO,OAAO,KAAK,MAAM,QAAQ,wBAAwB,SAAS,EAAE,CAAC,GAAG,EAAE;IAC7H,sBAAsB,WAAW,MAAM,QAAQ,QAAQ,qBAAqB,GAAG,OAAO,qBAAqB,KAAK,MAAM,QAAQ,qBAAqB,SAAS,EAAE,CAAC,GAAG,EAAE;IACpK;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,GAAI,KAAI,YAAY,QAAQ;AACtD,OAAI,QAAQ,OAAO,OAAQ,KAAI,QAAQ,QAAQ,MAAM,KAAK,MAAM,QAAQ,wBAAwB,OAAO,EAAE,CAAC;AAC1G,OAAI,QAAQ,wBAAwB,OAAQ,KAAI,yBAAyB,QAAQ,uBAAuB,KAAK,MAAM,QAAQ,qBAAqB,OAAO,EAAE,CAAC;AAC1J,OAAI,QAAQ,QAAQ,OAAQ,KAAI,SAAS,QAAQ,OAAO,KAAK,MAAM,QAAQ,wBAAwB,OAAO,EAAE,CAAC;AAC7G,OAAI,QAAQ,sBAAsB,OAAQ,KAAI,uBAAuB,QAAQ,qBAAqB,KAAK,MAAM,QAAQ,qBAAqB,OAAO,EAAE,CAAC;AACpJ,UAAO;;EAER;AACD,SAAQ,gBAAgB;EACvB,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,QAAQ,WAAW,MAAM,QAAQ,QAAQ,OAAO,GAAG,OAAO,OAAO,KAAK,MAAM,QAAQ,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE;IAC7G,UAAU,WAAW,MAAM,QAAQ,QAAQ,SAAS,GAAG,OAAO,SAAS,KAAK,MAAM,QAAQ,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE;IACnH,eAAe,WAAW,MAAM,QAAQ,QAAQ,cAAc,GAAG,OAAO,cAAc,KAAK,MAAM,QAAQ,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE;IAClI,iBAAiB,MAAM,OAAO,gBAAgB,GAAG,QAAQ,qBAAqB,SAAS,OAAO,gBAAgB,GAAG,KAAK;IACtH,SAAS,WAAW,MAAM,QAAQ,QAAQ,QAAQ,GAAG,OAAO,QAAQ,KAAK,MAAM,QAAQ,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE;IAChH,WAAW,MAAM,OAAO,UAAU,GAAG,QAAQ,qBAAqB,SAAS,OAAO,UAAU,GAAG,KAAK;IACpG;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,GAAI,KAAI,YAAY,QAAQ;AACtD,OAAI,QAAQ,QAAQ,OAAQ,KAAI,SAAS,QAAQ,OAAO,KAAK,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAC7F,OAAI,QAAQ,UAAU,OAAQ,KAAI,WAAW,QAAQ,SAAS,KAAK,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC;AACnG,OAAI,QAAQ,eAAe,OAAQ,KAAI,gBAAgB,QAAQ,cAAc,KAAK,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAClH,OAAI,QAAQ,oBAAoB,KAAK,EAAG,KAAI,kBAAkB,QAAQ,qBAAqB,OAAO,QAAQ,gBAAgB;AAC1H,OAAI,QAAQ,SAAS,OAAQ,KAAI,UAAU,QAAQ,QAAQ,KAAK,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAChG,OAAI,QAAQ,cAAc,KAAK,EAAG,KAAI,YAAY,QAAQ,qBAAqB,OAAO,QAAQ,UAAU;AACxG,UAAO;;EAER;AACD,SAAQ,UAAU;EACjB,SAAS,QAAQ;AAChB,UAAO;IACN,KAAK,MAAM,OAAO,IAAI,GAAG,WAAW,OAAO,OAAO,IAAI,GAAG;IACzD,iBAAiB,MAAM,OAAO,gBAAgB,GAAG,WAAW,OAAO,OAAO,gBAAgB,GAAG;IAC7F,UAAU,MAAM,OAAO,SAAS,GAAG,kBAAkB,UAAU,SAAS,OAAO,SAAS,GAAG,KAAK;IAChG,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,OAAO,OAAO,SAAS,GAAG;IACxE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,QAAQ,GAAI,KAAI,MAAM,QAAQ;AAC1C,OAAI,QAAQ,oBAAoB,EAAG,KAAI,kBAAkB,KAAK,MAAM,QAAQ,gBAAgB;AAC5F,OAAI,QAAQ,aAAa,KAAK,EAAG,KAAI,WAAW,kBAAkB,UAAU,OAAO,QAAQ,SAAS;AACpG,OAAI,QAAQ,aAAa,GAAI,KAAI,WAAW,QAAQ;AACpD,UAAO;;EAER;AACD,SAAQ,uBAAuB;EAC9B,SAAS,QAAQ;AAChB,UAAO;IACN,UAAU,MAAM,OAAO,SAAS,GAAG,wBAAwB,OAAO,SAAS,GAAG;IAC9E,OAAO,MAAM,OAAO,MAAM,GAAG,WAAW,OAAO,OAAO,MAAM,GAAG;IAC/D;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,aAAa,EAAG,KAAI,WAAW,sBAAsB,QAAQ,SAAS;AAClF,OAAI,QAAQ,UAAU,EAAG,KAAI,QAAQ,KAAK,MAAM,QAAQ,MAAM;AAC9D,UAAO;;EAER;AACD,SAAQ,oBAAoB;EAC3B,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,aAAa,MAAM,OAAO,YAAY,GAAG,QAAQ,YAAY,SAAS,OAAO,YAAY,GAAG,KAAK;IACjG,eAAe,MAAM,OAAO,cAAc,GAAG,QAAQ,cAAc,SAAS,OAAO,cAAc,GAAG,KAAK;IACzG;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,GAAI,KAAI,YAAY,QAAQ;AACtD,OAAI,QAAQ,gBAAgB,KAAK,EAAG,KAAI,cAAc,QAAQ,YAAY,OAAO,QAAQ,YAAY;AACrG,OAAI,QAAQ,kBAAkB,KAAK,EAAG,KAAI,gBAAgB,QAAQ,cAAc,OAAO,QAAQ,cAAc;AAC7G,UAAO;;EAER;CACD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,gCAAgD,gCAAgB,YAAY;AAC/E,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,QAAQ,QAAQ,WAAW,QAAQ,uDAAuD,QAAQ,6DAA6D,QAAQ,wDAAwD,QAAQ,2CAA2C,QAAQ,0CAA0C,QAAQ,8BAA8B,QAAQ,sBAAsB,QAAQ,wBAAwB,QAAQ,sBAAsB,KAAK;CACnd,MAAM,oBAAoB,yBAAyB;CACnD,MAAM,oBAAoB,yBAAyB;CACnD,MAAM,uBAAuB,4BAA4B;AACzD,SAAQ,sBAAsB;EAC7B,SAAS,QAAQ;AAChB,UAAO;IACN,QAAQ,MAAM,OAAO,OAAO,GAAG,WAAW,OAAO,OAAO,OAAO,GAAG;IAClE,KAAK,MAAM,OAAO,IAAI,GAAG,kBAAkB,uBAAuB,SAAS,OAAO,IAAI,GAAG,KAAK;IAC9F,MAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,GAAG,OAAO,KAAK,KAAK,MAAM,kBAAkB,0BAA0B,SAAS,EAAE,CAAC,GAAG,EAAE;IACnI;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,WAAW,GAAI,KAAI,SAAS,QAAQ;AAChD,OAAI,QAAQ,QAAQ,KAAK,EAAG,KAAI,MAAM,kBAAkB,uBAAuB,OAAO,QAAQ,IAAI;AAClG,OAAI,QAAQ,MAAM,OAAQ,KAAI,OAAO,QAAQ,KAAK,KAAK,MAAM,kBAAkB,0BAA0B,OAAO,EAAE,CAAC;AACnH,UAAO;;EAER;AACD,SAAQ,wBAAwB;EAC/B,SAAS,QAAQ;AAChB,UAAO,EAAE,YAAY,WAAW,MAAM,QAAQ,QAAQ,WAAW,GAAG,OAAO,WAAW,KAAK,MAAM,QAAQ,oBAAoB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;;EAEjJ,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,YAAY,OAAQ,KAAI,aAAa,QAAQ,WAAW,KAAK,MAAM,QAAQ,oBAAoB,OAAO,EAAE,CAAC;AACrH,UAAO;;EAER;AACD,SAAQ,sBAAsB;EAC7B,SAAS,QAAQ;AAChB,UAAO,EAAE,YAAY,WAAW,MAAM,QAAQ,QAAQ,WAAW,GAAG,OAAO,WAAW,KAAK,MAAM,kBAAkB,UAAU,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;;EAEjJ,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,YAAY,OAAQ,KAAI,aAAa,QAAQ,WAAW,KAAK,MAAM,kBAAkB,UAAU,OAAO,EAAE,CAAC;AACrH,UAAO;;EAER;AACD,SAAQ,8BAA8B;EACrC,SAAS,QAAQ;AAChB,UAAO;IACN,SAAS,MAAM,OAAO,sBAAsB,GAAG;KAC9C,OAAO;KACP,uBAAuB,QAAQ,sBAAsB,SAAS,OAAO,sBAAsB;KAC3F,GAAG,MAAM,OAAO,WAAW,GAAG;KAC9B,OAAO;KACP,YAAY,QAAQ,oBAAoB,SAAS,OAAO,WAAW;KACnE,GAAG,KAAK;IACT,aAAa,MAAM,OAAO,YAAY,GAAG,QAAQ,wCAAwC,SAAS,OAAO,YAAY,GAAG,KAAK;IAC7H,cAAc,MAAM,OAAO,aAAa,GAAG,QAAQ,yCAAyC,SAAS,OAAO,aAAa,GAAG,KAAK;IACjI,YAAY,MAAM,OAAO,WAAW,GAAG,QAAQ,sDAAsD,SAAS,OAAO,WAAW,GAAG,KAAK;IACxI,qBAAqB,MAAM,OAAO,oBAAoB,GAAG,QAAQ,2DAA2D,SAAS,OAAO,oBAAoB,GAAG,KAAK;IACxK,iBAAiB,MAAM,OAAO,gBAAgB,GAAG,QAAQ,qDAAqD,SAAS,OAAO,gBAAgB,GAAG,KAAK;IACtJ;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,UAAU,wBAAyB,KAAI,wBAAwB,QAAQ,sBAAsB,OAAO,QAAQ,QAAQ,sBAAsB;YACtJ,QAAQ,SAAS,UAAU,aAAc,KAAI,aAAa,QAAQ,oBAAoB,OAAO,QAAQ,QAAQ,WAAW;AACjI,OAAI,QAAQ,gBAAgB,KAAK,EAAG,KAAI,cAAc,QAAQ,wCAAwC,OAAO,QAAQ,YAAY;AACjI,OAAI,QAAQ,iBAAiB,KAAK,EAAG,KAAI,eAAe,QAAQ,yCAAyC,OAAO,QAAQ,aAAa;AACrI,OAAI,QAAQ,eAAe,KAAK,EAAG,KAAI,aAAa,QAAQ,sDAAsD,OAAO,QAAQ,WAAW;AAC5I,OAAI,QAAQ,wBAAwB,KAAK,EAAG,KAAI,sBAAsB,QAAQ,2DAA2D,OAAO,QAAQ,oBAAoB;AAC5K,OAAI,QAAQ,oBAAoB,KAAK,EAAG,KAAI,kBAAkB,QAAQ,qDAAqD,OAAO,QAAQ,gBAAgB;AAC1J,UAAO;;EAER;AACD,SAAQ,0CAA0C;EACjD,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,2BAA2B,MAAM,OAAO,0BAA0B,GAAG,WAAW,QAAQ,OAAO,0BAA0B,GAAG;IAC5H,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,QAAQ,OAAO,QAAQ,GAAG;IACtE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,EAAG,KAAI,YAAY,KAAK,MAAM,QAAQ,UAAU;AAC1E,OAAI,QAAQ,8BAA8B,MAAO,KAAI,4BAA4B,QAAQ;AACzF,OAAI,QAAQ,YAAY,MAAO,KAAI,UAAU,QAAQ;AACrD,UAAO;;EAER;AACD,SAAQ,2CAA2C;EAClD,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,QAAQ,OAAO,QAAQ,GAAG;IACtE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,EAAG,KAAI,YAAY,KAAK,MAAM,QAAQ,UAAU;AAC1E,OAAI,QAAQ,YAAY,MAAO,KAAI,UAAU,QAAQ;AACrD,UAAO;;EAER;AACD,SAAQ,wDAAwD;EAC/D,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,QAAQ,OAAO,QAAQ,GAAG;IACtE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,EAAG,KAAI,YAAY,KAAK,MAAM,QAAQ,UAAU;AAC1E,OAAI,QAAQ,YAAY,MAAO,KAAI,UAAU,QAAQ;AACrD,UAAO;;EAER;AACD,SAAQ,6DAA6D;EACpE,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,QAAQ,OAAO,QAAQ,GAAG;IACtE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,EAAG,KAAI,YAAY,KAAK,MAAM,QAAQ,UAAU;AAC1E,OAAI,QAAQ,YAAY,MAAO,KAAI,UAAU,QAAQ;AACrD,UAAO;;EAER;AACD,SAAQ,uDAAuD;EAC9D,SAAS,QAAQ;AAChB,UAAO;IACN,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,OAAO,OAAO,UAAU,GAAG;IAC3E,SAAS,MAAM,OAAO,QAAQ,GAAG,WAAW,QAAQ,OAAO,QAAQ,GAAG;IACtE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,cAAc,EAAG,KAAI,YAAY,KAAK,MAAM,QAAQ,UAAU;AAC1E,OAAI,QAAQ,YAAY,MAAO,KAAI,UAAU,QAAQ;AACrD,UAAO;;EAER;AACD,SAAQ,WAAW;EAClB,SAAS,QAAQ;AAChB,UAAO,EAAE,MAAM,MAAM,OAAO,YAAY,GAAG;IAC1C,OAAO;IACP,aAAa,WAAW,OAAO,OAAO,YAAY;IAClD,GAAG,MAAM,OAAO,SAAS,GAAG;IAC5B,OAAO;IACP,UAAU,OAAO,KAAK,gBAAgB,OAAO,SAAS,CAAC;IACvD,GAAG,MAAM,OAAO,eAAe,GAAG;IAClC,OAAO;IACP,gBAAgB,kBAAkB,WAAW,SAAS,OAAO,eAAe;IAC5E,GAAG,KAAK,GAAG;;EAEb,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,MAAM,UAAU,cAAe,KAAI,cAAc,QAAQ,KAAK;YACjE,QAAQ,MAAM,UAAU,WAAY,KAAI,WAAW,gBAAgB,QAAQ,KAAK,SAAS;YACzF,QAAQ,MAAM,UAAU,iBAAkB,KAAI,iBAAiB,kBAAkB,WAAW,OAAO,QAAQ,KAAK,eAAe;AACxI,UAAO;;EAER;AACD,SAAQ,QAAQ;EACf,SAAS,QAAQ;AAChB,UAAO;IACN,mBAAmB,MAAM,OAAO,kBAAkB,GAAG,qBAAqB,YAAY,SAAS,OAAO,kBAAkB,GAAG,KAAK;IAChI,6BAA6B,MAAM,OAAO,4BAA4B,GAAG,QAAQ,4BAA4B,SAAS,OAAO,4BAA4B,GAAG,KAAK;IACjK,QAAQ,MAAM,OAAO,OAAO,GAAG,kBAAkB,OAAO,SAAS,OAAO,OAAO,GAAG,KAAK;IACvF,UAAU,MAAM,OAAO,SAAS,GAAG,QAAQ,SAAS,SAAS,OAAO,SAAS,GAAG,KAAK;IACrF;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,sBAAsB,KAAK,EAAG,KAAI,oBAAoB,qBAAqB,YAAY,OAAO,QAAQ,kBAAkB;AACpI,OAAI,QAAQ,gCAAgC,KAAK,EAAG,KAAI,8BAA8B,QAAQ,4BAA4B,OAAO,QAAQ,4BAA4B;AACrK,OAAI,QAAQ,WAAW,KAAK,EAAG,KAAI,SAAS,kBAAkB,OAAO,OAAO,QAAQ,OAAO;AAC3F,OAAI,QAAQ,aAAa,KAAK,EAAG,KAAI,WAAW,QAAQ,SAAS,OAAO,QAAQ,SAAS;AACzF,UAAO;;EAER;CACD,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,KAAK,WAAW,OAAO,KAAK,KAAK,SAAS,CAAC;;CAE9D,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,OAAO,KAAK,IAAI,CAAC,SAAS,SAAS;;CAEtD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;CAChE,IAAI,kBAAkB,WAAW,QAAQ,oBAAoB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AACnG,MAAI,OAAO,KAAK,EAAG,MAAK;EACxB,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAAe,QAAO;GACzF,YAAY;GACZ,KAAK,WAAW;AACf,WAAO,EAAE;;GAEV;AACD,SAAO,eAAe,GAAG,IAAI,KAAK;OAC7B,SAAS,GAAG,GAAG,GAAG,IAAI;AAC3B,MAAI,OAAO,KAAK,EAAG,MAAK;AACxB,IAAE,MAAM,EAAE;;CAEX,IAAI,eAAe,WAAW,QAAQ,gBAAgB,SAAS,GAAG,WAAW;AAC5E,OAAK,IAAI,KAAK,EAAG,KAAI,MAAM,aAAa,CAAC,OAAO,UAAU,eAAe,KAAK,WAAW,EAAE,CAAE,iBAAgB,WAAW,GAAG,EAAE;;AAE9H,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,cAAa,kBAAkB,EAAE,QAAQ;AACzC,cAAa,yBAAyB,EAAE,QAAQ;AAChD,cAAa,yBAAyB,EAAE,QAAQ;AAChD,cAAa,wBAAwB,EAAE,QAAQ;AAC/C,cAAa,4BAA4B,EAAE,QAAQ;AACnD,cAAa,+BAA+B,EAAE,QAAQ;GACpD;AAIH,IAAI,mBAAmC,gCAAgB,YAAY;AAClE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,wBAAwB,QAAQ,+BAA+B,QAAQ,wBAAwB,QAAQ,wBAAwB,KAAK;AAC5I,SAAQ,+BAA+B;AACvC,SAAQ,wBAAwB;AAChC,SAAQ,+BAA+B;AACvC,SAAQ,2BAA2B;AACnC,SAAQ,wBAAwB;AAChC,SAAQ,wBAAwB;AAChC,SAAQ,+BAA+B;AACvC,SAAQ,wBAAwB;CAChC,SAAS,6BAA6B,GAAG;AACxC,SAAO,EAAE,qBAAqB,QAAQ,UAAU;;CAEjD,SAAS,sBAAsB,GAAG;AACjC,SAAO,EAAE,qBAAqB,QAAQ,UAAU;;CAEjD,SAAS,6BAA6B,GAAG;AACxC,SAAO,EAAE,QAAQ,UAAU;;CAE5B,SAAS,yBAAyB,GAAG;AACpC,SAAO,EAAE,QAAQ,UAAU;;GAE1B;AAIH,IAAI,gBAAgC,gCAAgB,YAAY;AAC/D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,2BAA2B;AACnC,SAAQ,eAAe;CACvB,MAAM,mBAAmB,gBAAgB;CACzC,MAAM,WAAW,kBAAkB;CACnC,SAAS,yBAAyB,SAAS;AAC1C,SAAO;GACN,WAAW,QAAQ,mBAAmB,SAAS,wBAAwB,SAAS;GAChF,SAAS;IACR,OAAO;IACP,kBAAkB;KACjB,eAAe;MACd,WAAW,iBAAiB,cAAc;MAC1C,QAAQ,QAAQ;MAChB;KACD,WAAW,QAAQ;KACnB;IACD;GACD,sBAAsB,uBAAuB,QAAQ;GACrD;;CAEF,SAAS,aAAa,SAAS;AAC9B,SAAO;GACN,WAAW,QAAQ,mBAAmB,SAAS,wBAAwB,SAAS;GAChF,SAAS;IACR,OAAO;IACP,cAAc,WAAW,QAAQ;IACjC;GACD,sBAAsB,uBAAuB,QAAQ;GACrD;;CAEF,SAAS,WAAW,SAAS;AAC5B,SAAO;GACN,aAAa,QAAQ;GACrB,SAAS,QAAQ;GACjB,YAAY,CAAC,YAAY,QAAQ,CAAC;GAClC;;CAEF,SAAS,YAAY,SAAS;AAC7B,SAAO;GACN,OAAO,QAAQ,WAAW;GAC1B,KAAK,QAAQ;GACb;;CAEF,SAAS,uBAAuB,SAAS;AACxC,SAAO;GACN,SAAS,aAAa,QAAQ;GAC9B,aAAa,EAAE;GACf,2BAA2B,EAAE,mBAAmB,EAAE,EAAE;GACpD;;CAEF,SAAS,aAAa,SAAS;AAC9B,MAAI,QAAQ,YAAa,KAAI,QAAQ,iBAAkB,QAAO;GAC7D,OAAO;GACP,sBAAsB,EAAE,cAAc,CAAC,EAAE,UAAU,QAAQ,aAAa,CAAC,EAAE;GAC3E;MACI,QAAO;GACX,OAAO;GACP,aAAa,EAAE,UAAU,QAAQ,aAAa;GAC9C;MACI,QAAO;GACX,OAAO;GACP,WAAW,EAAE,MAAM,QAAQ,WAAW,IAAI;GAC1C;;GAEA;AAIH,IAAI,kBAAkC,gCAAgB,YAAY;AACjE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,kBAAkB,KAAK;CAC/B,IAAI,kBAAkB,cAAc,MAAM;EACzC;EACA,YAAY,SAAS,QAAQ;AAC5B,SAAM,QAAQ;AACd,QAAK,SAAS;;;AAGhB,SAAQ,kBAAkB;GACxB;AAIH,IAAI,mBAAmC,gCAAgB,YAAY;AAClE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,eAAe;AACvB,SAAQ,kBAAkB;AAC1B,SAAQ,cAAc;AACtB,SAAQ,kBAAkB;AAC1B,SAAQ,qBAAqB;CAC7B,MAAM,UAAU,iBAAiB;CACjC,SAAS,aAAa,GAAG;EACxB,MAAM,gBAAgB,mBAAmB,EAAE;AAC3C,MAAI,cAAc,SAAS,EAAG,OAAM,IAAI,QAAQ,gBAAgB,kBAAkB,cAAc;;CAEjG,SAAS,gBAAgB,GAAG;EAC3B,MAAM,gBAAgB,EAAE;AACxB,gBAAc,KAAK,GAAG,mBAAmB,EAAE,CAAC;AAC5C,gBAAc,KAAK,GAAG,yBAAyB,EAAE,CAAC;AAClD,MAAI,cAAc,SAAS,EAAG,OAAM,IAAI,QAAQ,gBAAgB,uBAAuB,cAAc;;CAEtG,SAAS,YAAY,GAAG;AACvB,MAAI;AACH,mBAAgB,EAAE;AAClB,UAAO;WACC,GAAG;AACX,UAAO;;;CAGT,SAAS,gBAAgB,GAAG;EAC3B,MAAM,gBAAgB,EAAE;AACxB,gBAAc,KAAK,GAAG,mBAAmB,EAAE,CAAC;AAC5C,gBAAc,KAAK,GAAG,uBAAuB,EAAE,CAAC;AAChD,MAAI,cAAc,SAAS,EAAG,OAAM,IAAI,QAAQ,gBAAgB,uBAAuB,cAAc;;CAEtG,SAAS,mBAAmB,GAAG;EAC9B,MAAM,gBAAgB,EAAE;AACxB,gBAAc,KAAK,GAAG,mBAAmB,EAAE,CAAC;AAC5C,gBAAc,KAAK,GAAG,uBAAuB,EAAE,CAAC;AAChD,gBAAc,KAAK,GAAG,2BAA2B,EAAE,CAAC;AACpD,MAAI,cAAc,SAAS,EAAG,OAAM,IAAI,QAAQ,gBAAgB,kBAAkB,cAAc;;CAEjG,SAAS,mBAAmB,GAAG;EAC9B,MAAM,gBAAgB,EAAE;AACxB,MAAI,EAAE,cAAc,KAAK,KAAK,CAAC,EAAE,UAAU,MAAM,gEAAgE,IAAI,CAAC,EAAE,UAAU,MAAM,0DAA0D,CAAE,eAAc,KAAK,YAAY;AACnO,MAAI,EAAE,YAAY,KAAK,EAAG,eAAc,KAAK,UAAU;MAClD,SAAQ,EAAE,QAAQ,OAAlB;GACJ,KAAK;AACJ,QAAI,EAAE,QAAQ,iBAAiB,kBAAkB,KAAK,EAAG,eAAc,KAAK,yCAAyC;aAC5G,EAAE,QAAQ,iBAAiB,cAAc,OAAO,WAAW,EAAG,eAAc,KAAK,gDAAgD;AAC1I,QAAI,EAAE,QAAQ,iBAAiB,UAAU,WAAW,EAAG,eAAc,KAAK,qCAAqC;AAC/G;GACD,KAAK;AACJ,QAAI,EAAE,QAAQ,aAAa,QAAQ,WAAW,EAAG,eAAc,KAAK,+BAA+B;AACnG,QAAI,EAAE,QAAQ,aAAa,WAAW,WAAW,EAAG,eAAc,KAAK,kCAAkC;aAChG,EAAE,QAAQ,aAAa,WAAW,GAAG,IAAI,WAAW,EAAG,eAAc,KAAK,yCAAyC;AAC5H;;AAEF,MAAI,EAAE,yBAAyB,KAAK,EAAG,eAAc,KAAK,uBAAuB;OAC5E;AACJ,OAAI,EAAE,qBAAqB,YAAY,KAAK,EAAG,eAAc,KAAK,+BAA+B;OAC5F,SAAQ,EAAE,qBAAqB,QAAQ,OAAvC;IACJ,KAAK;AACJ,SAAI,EAAE,qBAAqB,QAAQ,qBAAqB,aAAa,WAAW,EAAG,eAAc,KAAK,iEAAiE;AACvK,OAAE,qBAAqB,QAAQ,qBAAqB,aAAa,SAAS,MAAM,MAAM;AACrF,UAAI,KAAK,SAAS,WAAW,EAAG,eAAc,KAAK,kEAAkE,EAAE,YAAY;OAClI;AACF;IACD,KAAK;AACJ,SAAI,EAAE,qBAAqB,QAAQ,YAAY,SAAS,WAAW,EAAG,eAAc,KAAK,oDAAoD;AAC7I;;AAEF,OAAI,EAAE,qBAAqB,gBAAgB,KAAK,EAAG,eAAc,KAAK,mCAAmC;YAChG,EAAE,qBAAqB,YAAY,SAAS,EAAG,GAAE,qBAAqB,YAAY,SAAS,OAAO,MAAM;AAChH,QAAI,MAAM,UAAU,KAAK,EAAG,eAAc,KAAK,oCAAoC,EAAE,SAAS;AAC9F,QAAI,MAAM,gBAAgB,KAAK,EAAG,eAAc,KAAK,oCAAoC,EAAE,eAAe;KACzG;;AAEH,SAAO;;CAER,SAAS,yBAAyB,GAAG;EACpC,MAAM,gBAAgB,EAAE;AACxB,MAAI,EAAE,wBAAwB,EAAE,qBAAqB,aAAa,SAAS,EAAG,GAAE,qBAAqB,YAAY,SAAS,OAAO,MAAM;AACtI,OAAI,MAAM,qBAAqB,KAAK,EAAG,eAAc,KAAK,oCAAoC,EAAE,oBAAoB;IACnH;AACF,SAAO;;CAER,SAAS,uBAAuB,GAAG;EAClC,MAAM,gBAAgB,EAAE;AACxB,MAAI,EAAE,wBAAwB,EAAE,qBAAqB,aAAa,SAAS,EAAG,GAAE,qBAAqB,YAAY,SAAS,OAAO,MAAM;AACtI,OAAI,MAAM,mBAAmB,KAAK,EAAG,eAAc,KAAK,oCAAoC,EAAE,kBAAkB;YACvG,MAAM,eAAe,eAAe,KAAK,EAAG,eAAc,KAAK,oCAAoC,EAAE,6BAA6B;IAC1I;AACF,SAAO;;CAER,SAAS,2BAA2B,GAAG;EACtC,MAAM,gBAAgB,EAAE;;AAExB,MAAI,EAAE,sBAAsB,SAAS,UAAU,uBAAwB,eAAc,KAAK,qCAAqC;AAC/H,SAAO;;GAEN;AAIH,IAAI,qBAAqC,gCAAgB,YAAY;AACpE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,iBAAiB,QAAQ,mBAAmB,QAAQ,eAAe,QAAQ,iBAAiB,KAAK;CACzG,MAAM,mBAAmB,gBAAgB;CACzC,MAAM,WAAW,kBAAkB;CACnC,MAAM,aAAa,kBAAkB;CACrC,MAAM,kBAAkB,QAAQ;EAC/B,MAAM,SAAS,iBAAiB,OAAO,SAAS,IAAI;AACpD,UAAQ,OAAO,WAAf;GACC,KAAK,SAAS;AACb,KAAC,GAAG,WAAW,iBAAiB,OAAO;AACvC;GACD,KAAK,SAAS;AACb,KAAC,GAAG,WAAW,iBAAiB,OAAO;AACvC;GACD;AACC,KAAC,GAAG,WAAW,oBAAoB,OAAO;AAC1C;;AAEF,SAAO;;AAER,SAAQ,iBAAiB;CACzB,MAAM,gBAAgB,WAAW;AAChC,SAAO,iBAAiB,OAAO,OAAO,OAAO;;AAE9C,SAAQ,eAAe;CACvB,MAAM,oBAAoB,QAAQ;AACjC,SAAO,iBAAiB,SAAS,SAAS,IAAI;;AAE/C,SAAQ,mBAAmB;CAC3B,MAAM,kBAAkB,aAAa;AACpC,SAAO,iBAAiB,SAAS,OAAO,SAAS;;AAElD,SAAQ,iBAAiB;GACvB;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,cAAc,QAAQ,kBAAkB,QAAQ,kBAAkB,QAAQ,qBAAqB,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,mBAAmB,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,kBAAkB,QAAQ,wBAAwB,QAAQ,+BAA+B,QAAQ,2BAA2B,QAAQ,+BAA+B,QAAQ,wBAAwB,QAAQ,+BAA+B,QAAQ,wBAAwB,QAAQ,wBAAwB,QAAQ,2BAA2B,QAAQ,eAAe,KAAK;CACnlB,IAAI,UAAU,eAAe;AAC7B,QAAO,eAAe,SAAS,gBAAgB;EAC9C,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,QAAQ;;EAEhB,CAAC;AACF,QAAO,eAAe,SAAS,4BAA4B;EAC1D,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,QAAQ;;EAEhB,CAAC;CACF,IAAI,WAAW,kBAAkB;AACjC,QAAO,eAAe,SAAS,yBAAyB;EACvD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,yBAAyB;EACvD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,gCAAgC;EAC9D,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,yBAAyB;EACvD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,gCAAgC;EAC9D,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,4BAA4B;EAC1D,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,gCAAgC;EAC9D,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,yBAAyB;EACvD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;CACF,IAAI,UAAU,iBAAiB;AAC/B,QAAO,eAAe,SAAS,mBAAmB;EACjD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,QAAQ;;EAEhB,CAAC;CACF,IAAI,eAAe,oBAAoB;AACvC,QAAO,eAAe,SAAS,kBAAkB;EAChD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,aAAa;;EAErB,CAAC;AACF,QAAO,eAAe,SAAS,gBAAgB;EAC9C,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,aAAa;;EAErB,CAAC;AACF,QAAO,eAAe,SAAS,oBAAoB;EAClD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,aAAa;;EAErB,CAAC;AACF,QAAO,eAAe,SAAS,kBAAkB;EAChD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,aAAa;;EAErB,CAAC;CACF,IAAI,aAAa,kBAAkB;AACnC,QAAO,eAAe,SAAS,gBAAgB;EAC9C,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,WAAW;;EAEnB,CAAC;AACF,QAAO,eAAe,SAAS,sBAAsB;EACpD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,WAAW;;EAEnB,CAAC;AACF,QAAO,eAAe,SAAS,mBAAmB;EACjD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,WAAW;;EAEnB,CAAC;AACF,QAAO,eAAe,SAAS,mBAAmB;EACjD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,WAAW;;EAEnB,CAAC;AACF,QAAO,eAAe,SAAS,eAAe;EAC7C,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,WAAW;;EAEnB,CAAC;GACA;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,aAAa,KAAK;CAC1B,IAAI,cAAc,cAAc,MAAM;AAuFtC,SAAQ,aAtFS,MAAM,WAAW;EACjC,OAAO,aAAa;EACpB;EACA;EACA,QAAQ;EACR,YAAY,QAAQ;AACnB,OAAI,QAAQ;AACX,SAAK,MAAM;AACX,SAAK,OAAO,OAAO,KAAK,OAAO;UACzB;AACN,SAAK,MAAM,OAAO,MAAM,EAAE;AAC1B,SAAK,OAAO,OAAO,KAAK,KAAK,IAAI;;;EAGnC,IAAI,SAAS;AACZ,UAAO,KAAK,KAAK,SAAS,GAAG,KAAK,MAAM;;EAEzC,IAAI,SAAS;AACZ,UAAO,KAAK,KAAK;;EAElB,IAAI,WAAW;AACd,UAAO,KAAK;;EAEb,KAAK,UAAU;AACd,QAAK,QAAQ;;EAEd,MAAM,OAAO,KAAK;GACjB,MAAM,MAAM,QAAQ;AACpB,OAAI,MAAM,KAAK,OAAQ,OAAM,IAAI,YAAY,6BAA6B;AAC1E,UAAO,KAAK,KAAK,SAAS,OAAO,IAAI;;EAEtC,WAAW,MAAM;AAChB,QAAK,eAAe,EAAE;AACtB,QAAK,KAAK,KAAK,SAAS;AACxB,QAAK,SAAS;;EAEf,aAAa,KAAK;AACjB,QAAK,eAAe,EAAE;GACtB,MAAM,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC;GACpC,MAAM,OAAO,IAAI,WAAW,MAAM,OAAO;AACzC,QAAK,KAAK,KAAK,SAAS,KAAK;AAC7B,QAAK,KAAK,KAAK,QAAQ,KAAK,KAAK;AACjC,QAAK,SAAS;;EAEf,aAAa,KAAK;AACjB,QAAK,eAAe,EAAE;GACtB,MAAM,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC;GACpC,MAAM,OAAO,IAAI,WAAW,MAAM,OAAO;AACzC,QAAK,KAAK,KAAK,SAAS,KAAK;AAC7B,QAAK,KAAK,KAAK,QAAQ,KAAK,KAAK;AACjC,QAAK,KAAK,KAAK,QAAQ,KAAK,KAAK;AACjC,QAAK,SAAS;;EAEf,WAAW,MAAM;AAChB,QAAK,eAAe,KAAK,OAAO;AAChC,QAAK,KAAK,IAAI,MAAM,KAAK,MAAM;AAC/B,QAAK,SAAS,KAAK;;EAEpB,SAAS,MAAM;AACd,OAAI,QAAQ,EAAG,QAAO,OAAO,MAAM,EAAE;AACrC,OAAI,KAAK,QAAQ,OAAO,KAAK,KAAK,OAAQ,OAAM,IAAI,MAAM,6BAA6B;GACvF,MAAM,SAAS,KAAK,KAAK,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK;AAChE,QAAK,SAAS;AACd,UAAO;;EAER,WAAW;AACV,UAAO,KAAK,SAAS,EAAE,CAAC;;EAEzB,YAAY;GACX,MAAM,QAAQ,KAAK,SAAS,EAAE;AAC9B,UAAO,MAAM,MAAM,IAAI,MAAM;;EAE9B,eAAe,MAAM;AACpB,OAAI,KAAK,QAAQ,OAAO,KAAK,KAAK,YAAY;IAC7C,MAAM,YAAY,WAAW,cAAc,OAAO,WAAW,aAAa,OAAO;AACjF,SAAK,QAAQ,KAAK,KAAK,aAAa,UAAU;;;EAGhD,QAAQ,MAAM;GACb,MAAM,WAAW,OAAO,MAAM,KAAK;GACnC,MAAM,UAAU,OAAO,KAAK,SAAS;AACrC,WAAQ,IAAI,KAAK,KAAK;AACtB,QAAK,MAAM;AACX,QAAK,OAAO;;;GAIZ;AAIH,IAAI,kBAAkC,gCAAgB,YAAY;AACjE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,gBAAgB,QAAQ,iBAAiB,KAAK;CACtD,IAAI,iBAAiB,cAAc,MAAM;AACzC,SAAQ,iBAAiB;CACzB,IAAI,gBAAgB,cAAc,MAAM;AACxC,SAAQ,gBAAgB;GACtB;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,eAAe;AACvB,SAAQ,eAAe;CACvB,MAAM,UAAU,iBAAiB;CACjC,SAAS,aAAa,QAAQ;EAC7B,MAAM,MAAM,OAAO,UAAU;AAC7B,OAAK,MAAM,SAAS,EAAG,QAAO;EAC9B,MAAM,YAAY,MAAM;AACxB,MAAI,YAAY,EAAG,OAAM,IAAI,QAAQ,eAAe,8BAA8B;EAClF,IAAI,MAAM;AACV,OAAK,IAAI,IAAI,GAAG,IAAI,WAAW,KAAK;GACnC,MAAM,OAAO,OAAO,UAAU;AAC9B,OAAI,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,QAAQ,eAAe,8BAA8B;AAC1F,SAAM,MAAM,MAAM;;AAEnB,MAAI,QAAQ,EAAG,OAAM,IAAI,QAAQ,eAAe,2CAA2C;AAC3F,MAAI,MAAM,IAAK,OAAM,IAAI,QAAQ,eAAe,8BAA8B;AAC9E,SAAO;;CAER,SAAS,aAAa,KAAK;AAC1B,MAAI,MAAM,IAAK,QAAO,OAAO,KAAK,CAAC,IAAI,CAAC;EACxC,IAAI,MAAM,OAAO,IAAI;EACrB,MAAM,QAAQ,EAAE;AAChB,SAAO,MAAM,IAAI;AAChB,SAAM,QAAQ,OAAO,MAAM,KAAK,CAAC;AACjC,SAAM,OAAO;;AAEd,SAAO,OAAO,KAAK,CAAC,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;;GAEjD;AAIH,IAAI,gBAAgC,gCAAgB,YAAY;AAC/D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,eAAe;AACvB,SAAQ,mBAAmB;AAC3B,SAAQ,YAAY;AACpB,SAAQ,WAAW;AACnB,SAAQ,eAAe;AACvB,SAAQ,iBAAiB;CACzB,MAAM,UAAU,iBAAiB;CACjC,MAAM,qBAAqB;CAC3B,MAAM,oBAAoB;CAC1B,SAAS,aAAa,KAAK;EAC1B,IAAI,MAAM;EACV,MAAM,MAAM,IAAI;EAChB,IAAI,MAAM,IAAI;EACd,MAAM,MAAM,MAAM;EAClB,MAAM,MAAM,MAAM,MAAM;AACxB,SAAO,OAAO,OAAO,EAAE,MAAM,IAAK,OAAM,IAAI;AAC5C,MAAI,MAAM,QAAQ,EAAG,QAAO,OAAO,MAAM,KAAK,EAAE;AAChD,QAAM,MAAM,MAAM,MAAM;EACxB,IAAI,IAAI,OAAO,IAAI;AACnB,OAAK,IAAI,IAAI,MAAM,GAAG,IAAI,KAAK,EAAE,EAAG,KAAI,IAAI,OAAO,IAAI,GAAG,OAAO,IAAI,GAAG;AACxE,SAAO;;CAER,SAAS,iBAAiB,KAAK;AAC9B,SAAO,IAAI,SAAS,QAAQ;;CAE7B,SAAS,UAAU,KAAK,WAAW;EAClC,MAAM,UAAU,iBAAiB,IAAI;EACrC,MAAM,IAAI,YAAY,mBAAmB,KAAK,QAAQ,GAAG,kBAAkB,KAAK,QAAQ;AACxF,MAAI,CAAC,EAAG,OAAM,IAAI,MAAM,eAAe;AACvC,MAAI,WAAW;GACd,IAAI,OAAO,OAAO,EAAE,GAAG;AACvB,WAAQ,QAAQ,KAAK,OAAO;AAC5B,KAAE,KAAK,KAAK,UAAU;;AAEvB,yBAAuB,IAAI,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG;;CAEpF,SAAS,SAAS,KAAK;EACtB,IAAI,MAAM;EACV,MAAM,MAAM,IAAI;EAChB,IAAI,IAAI,IAAI;EACZ,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI;EACvC,IAAI,MAAM;AACV,SAAO,MAAM,KAAK,EAAE,KAAK;AACxB,OAAI,IAAI;AACR,UAAO,OAAO,MAAM,OAAO,IAAI,IAAI;AACnC,QAAK,IAAI,SAAS,GAAG;AACpB,WAAO,IAAI;AACX,UAAM;;;AAGR,SAAO;;CAER,SAAS,aAAa,KAAK;AAC1B,MAAI,IAAI,WAAW,EAAG,OAAM,IAAI,QAAQ,eAAe,kBAAkB;AACzE,UAAQ,IAAI,IAAZ;GACC,KAAK,EAAG,QAAO;GACf,KAAK,IAAK,QAAO;GACjB,QAAS,OAAM,IAAI,QAAQ,eAAe,kBAAkB;;;CAG9D,SAAS,eAAe,KAAK;EAC5B,MAAM,SAAS,IAAI;AACnB,MAAI,SAAS,EAAG,OAAM,IAAI,QAAQ,eAAe,qBAAqB;EACtE,MAAM,QAAQ;EACd,MAAM,MAAM,IAAI;EAChB,MAAM,OAAO,EAAE;AACf,OAAK,IAAI,IAAI,OAAO,IAAI,KAAK,EAAE,GAAG;GACjC,MAAM,OAAO,IAAI;GACjB,MAAM,OAAO,MAAM,MAAM,IAAI,SAAS;AACtC,QAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,EAAG,MAAK,KAAK,QAAQ,IAAI,EAAE;;AAEzD,SAAO;;GAEN;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,UAAU,KAAK;CACvB,MAAM,UAAU,iBAAiB;CACjC,MAAM,gBAAgB;EACrB,SAAS;EACT,SAAS;EACT,YAAY;EACZ,cAAc;EACd,mBAAmB;EACnB,UAAU;EACV,KAAK;EACL,kBAAkB;EAClB,UAAU;EACV,kBAAkB;EAClB;CACD,MAAM,YAAY;EACjB,WAAW;EACX,aAAa;EACb,kBAAkB;EAClB,SAAS;EACT;CACD,IAAI,UAAU,MAAM;EACnB;EACA;EACA;EACA,YAAY,KAAK;AAChB,QAAK,SAAS,MAAM;AACpB,QAAK,eAAe,MAAM,QAAQ;AAClC,QAAK,QAAQ,OAAO;AACpB,OAAI,KAAK,WAAW,GAAI,OAAM,IAAI,QAAQ,eAAe,+BAA+B;AACxF,OAAI,KAAK,UAAU,UAAU,aAAa,KAAK,WAAW,EAAG,OAAM,IAAI,QAAQ,eAAe,uBAAuB;;EAEtH,cAAc;AACb,UAAO,KAAK,UAAU,UAAU;;EAEjC,kBAAkB,KAAK;GACtB,MAAM,MAAM,KAAK,UAAU,UAAU;AACrC,UAAO,QAAQ,KAAK,IAAI,OAAO,KAAK,WAAW,MAAM;;EAEtD,YAAY;AACX,UAAO,KAAK,aAAa,IAAI,KAAK,WAAW,cAAc;;EAE5D,YAAY;AACX,UAAO,KAAK,aAAa,IAAI,KAAK,WAAW,cAAc;;EAE5D,cAAc;AACb,UAAO,KAAK,aAAa,IAAI,KAAK,WAAW,cAAc;;EAE5D,gBAAgB;AACf,UAAO,KAAK,aAAa,IAAI,KAAK,WAAW,cAAc;;EAE5D,QAAQ;AACP,UAAO,KAAK,aAAa,IAAI,KAAK,WAAW,cAAc;;EAE5D,YAAY;AACX,UAAO,KAAK,aAAa,IAAI,KAAK,WAAW,cAAc;;EAE5D,oBAAoB;AACnB,UAAO,KAAK,aAAa,IAAI,KAAK,WAAW,cAAc;;EAE5D,QAAQ;AACP,UAAO,KAAK,UAAU,KAAK,cAAc,KAAK,KAAK,KAAK,SAAS;;;AAGnE,SAAQ,UAAU;GAChB;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,UAAU,KAAK;CACvB,MAAM,WAAW,gBAAgB;CACjC,MAAM,UAAU,iBAAiB;CACjC,MAAM,WAAW,gBAAgB;CACjC,MAAM,UAAU,eAAe;CAC/B,MAAM,QAAQ,aAAa;CAC3B,IAAI,UAAU,MAAM;EACnB;EACA;EACA;EACA,YAAY,KAAK,OAAO,MAAM;AAC7B,QAAK,MAAM;AACX,QAAK,QAAQ;AACb,QAAK,OAAO;;EAEb,OAAO,YAAY,KAAK;GACvB,MAAM,SAAS,IAAI,SAAS,WAAW,IAAI;GAC3C,MAAM,MAAM,YAAY,OAAO;AAC/B,OAAI,OAAO,aAAa,OAAO,OAAQ,OAAM,IAAI,QAAQ,eAAe,wBAAwB;AAChG,UAAO;;EAER,QAAQ;GACP,MAAM,cAAc,IAAI,SAAS,YAAY;AAC7C,OAAI,KAAK,KAAK,SAAS,EAAG,MAAK,MAAM,OAAO,KAAK,KAAM,aAAY,WAAW,IAAI,OAAO,CAAC;OACrF,aAAY,WAAW,KAAK,MAAM;GACvC,MAAM,QAAQ,YAAY;GAC1B,MAAM,MAAM,IAAI,SAAS,YAAY;AACrC,OAAI,WAAW,KAAK,IAAI,OAAO,CAAC;AAChC,OAAI,YAAY,GAAG,SAAS,cAAc,MAAM,OAAO,CAAC;AACxD,OAAI,WAAW,MAAM;AACrB,UAAO,IAAI;;EAEZ,YAAY;AACX,OAAI,CAAC,KAAK,IAAI,WAAW,CAAE,OAAM,IAAI,QAAQ,cAAc,gBAAgB;AAC3E,WAAQ,GAAG,QAAQ,cAAc,KAAK,MAAM;;EAE7C,YAAY;AACX,OAAI,CAAC,KAAK,IAAI,WAAW,CAAE,OAAM,IAAI,QAAQ,cAAc,iBAAiB;AAC5E,WAAQ,GAAG,QAAQ,cAAc,KAAK,MAAM;;EAE7C,QAAQ;AACP,OAAI,CAAC,KAAK,IAAI,OAAO,CAAE,OAAM,IAAI,QAAQ,cAAc,aAAa;AACpE,WAAQ,GAAG,QAAQ,UAAU,KAAK,MAAM;;EAEzC,SAAS;AACR,WAAQ,MAAR;IACC,KAAK,KAAK,IAAI,WAAW,CAAE,SAAQ,GAAG,QAAQ,WAAW,KAAK,OAAO,KAAK;IAC1E,KAAK,KAAK,IAAI,mBAAmB,CAAE,SAAQ,GAAG,QAAQ,WAAW,KAAK,OAAO,MAAM;IACnF,QAAS,OAAM,IAAI,QAAQ,cAAc,aAAa;;;EAGxD,cAAc;AACb,OAAI,CAAC,KAAK,IAAI,aAAa,CAAE,OAAM,IAAI,QAAQ,cAAc,mBAAmB;AAChF,WAAQ,GAAG,QAAQ,gBAAgB,KAAK,MAAM;;;AAGhD,SAAQ,UAAU;CAClB,MAAM,YAAY;CAClB,SAAS,YAAY,QAAQ,QAAQ,GAAG;AACvC,MAAI,QAAQ,UAAW,OAAM,IAAI,QAAQ,eAAe,iCAAiC;EACzF,MAAM,MAAM,IAAI,MAAM,QAAQ,OAAO,UAAU,CAAC;EAChD,MAAM,OAAO,GAAG,SAAS,cAAc,OAAO;EAC9C,MAAM,QAAQ,OAAO,MAAM,OAAO,UAAU,IAAI;EAChD,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,EAAE;AACb,MAAI,IAAI,YAAa,QAAO,YAAY,QAAQ,KAAK,MAAM;WAClD,IAAI,eAAe,CAAE,KAAI;AACjC,UAAO,YAAY,QAAQ,KAAK,MAAM;WAC9B,GAAG;AACZ,MAAI,KAAK,WAAW,EAAG,QAAO,KAAK,QAAQ,IAAI;AAC/C,SAAO,IAAI,QAAQ,KAAK,OAAO,KAAK;;CAErC,SAAS,YAAY,QAAQ,KAAK,OAAO;EACxC,MAAM,MAAM,OAAO,WAAW;;AAE9B,MAAI,MAAM,OAAO,OAAQ,OAAM,IAAI,QAAQ,eAAe,iBAAiB;EAC3E,MAAM,OAAO,EAAE;AACf,SAAO,OAAO,WAAW,IAAK,MAAK,KAAK,YAAY,QAAQ,QAAQ,EAAE,CAAC;AACvE,MAAI,OAAO,aAAa,IAAK,OAAM,IAAI,QAAQ,eAAe,iBAAiB;AAC/E,SAAO;;GAEN;AAIH,IAAI,eAA+B,gCAAgB,YAAY;AAC9D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,UAAU,KAAK;CACvB,IAAI,QAAQ,aAAa;AACzB,QAAO,eAAe,SAAS,WAAW;EACzC,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,MAAM;;EAEd,CAAC;GACA;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;CAChE,IAAI,kBAAkB,WAAW,QAAQ,mBAAmB,SAAS,KAAK;AACzE,SAAO,OAAO,IAAI,aAAa,MAAM,EAAE,WAAW,KAAK;;AAExD,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,kBAAkB;AAC1B,SAAQ,SAAS;AACjB,SAAQ,SAAS;AACjB,SAAQ,cAAc;CACtB,MAAM,WAAW,gBAAgB,UAAU,SAAS,CAAC;CACrD,SAAS,gBAAgB,KAAK,OAAO,QAAQ;AAC5C,MAAI,OAAO,QAAQ,SAAU,KAAI,IAAI,WAAW,QAAQ,CAAE,QAAO,SAAS,QAAQ,gBAAgB,IAAI;MACjG,QAAO,SAAS,QAAQ,gBAAgB;GAC5C,KAAK,OAAO,KAAK,KAAK,SAAS;GAC/B,QAAQ;GACR;GACA,CAAC;MACG,QAAO,SAAS,QAAQ,gBAAgB;GAC5C;GACA,QAAQ;GACR;GACA,CAAC;;CAEH,SAAS,OAAO,WAAW,GAAG,MAAM;EACnC,MAAM,OAAO,SAAS,QAAQ,WAAW,UAAU;AACnD,OAAK,MAAM,KAAK,KAAM,MAAK,OAAO,EAAE;AACpC,SAAO,KAAK,QAAQ;;CAErB,SAAS,gBAAgB,KAAK;AAC7B,MAAI,EAAE,eAAe,SAAS,QAAQ,cAAc,IAAI,SAAS,SAAU,QAAO;AAClF,UAAQ,IAAI,mBAAZ;GACC,KAAK,KAAM,SAAQ,IAAI,sBAAsB,YAAlC;IACV,KAAK,aAAc,QAAO;IAC1B,KAAK,YAAa,QAAO;IACzB,KAAK,YAAa,QAAO;IACzB,QAAS,QAAO;;GAEjB,KAAK,UAAW;GAChB,QAAS,QAAO;;;CAGlB,SAAS,OAAO,MAAM,KAAK,WAAW,WAAW;AAChD,MAAI;AACH,OAAI,cAAc,KAAK,GAAG;AACzB,gBAAY,gBAAgB,IAAI;AAChC,QAAI,cAAc,MAAO,QAAO;;AAEjC,UAAO,SAAS,QAAQ,OAAO,WAAW,MAAM,KAAK,UAAU;WACvD,GAAG;;AAEX,UAAO;;;CAGT,SAAS,YAAY,GAAG,GAAG;AAC1B,MAAI;AACH,UAAO,SAAS,QAAQ,gBAAgB,GAAG,EAAE;UACtC;;AAEP,UAAO;;;GAGP;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,kBAAkB;CAC1B,MAAM,aAAa;CACnB,SAAS,gBAAgB,aAAa,SAAS;EAC9C,MAAM,YAAY,OAAO,KAAK,aAAa,QAAQ;AACnD,SAAO,OAAO,OAAO;GACpB,OAAO,KAAK,GAAG,WAAW,GAAG,UAAU,OAAO,IAAI,QAAQ;GAC1D;GACA,OAAO,KAAK,IAAI,QAAQ,OAAO,IAAI,QAAQ;GAC3C;GACA,CAAC;;GAED;AAIH,IAAI,mBAAmC,gCAAgB,YAAY;AAClE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,eAAe;AACvB,SAAQ,eAAe;CACvB,MAAM,kBAAkB;CACxB,MAAM,gBAAgB;CACtB,SAAS,aAAa,KAAK;AAC1B,SAAO,OAAO,KAAK,KAAK,cAAc,CAAC,SAAS,gBAAgB;;CAEjE,SAAS,aAAa,KAAK;AAC1B,SAAO,OAAO,KAAK,KAAK,gBAAgB,CAAC,SAAS,cAAc;;GAE/D;AAIH,IAAI,eAA+B,gCAAgB,YAAY;AAC9D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,eAAe;CACvB,SAAS,aAAa,QAAQ;EAC7B,IAAI,SAAS;AACb,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,OAAO,UAAU,KAAM,WAAU,KAAK,UAAU,OAAO;WACnG,MAAM,QAAQ,OAAO,EAAE;AAC/B,aAAU;GACV,IAAI,QAAQ;AACZ,UAAO,SAAS,YAAY;AAC3B,QAAI,CAAC,MAAO,WAAU;AACtB,YAAQ;AACR,cAAU,aAAa,QAAQ;KAC9B;AACF,aAAU;SACJ;AACN,aAAU;GACV,IAAI,QAAQ;AACZ,UAAO,KAAK,OAAO,CAAC,MAAM,CAAC,SAAS,aAAa;AAChD,QAAI,CAAC,MAAO,WAAU;AACtB,YAAQ;AACR,cAAU,KAAK,UAAU,SAAS;AAClC,cAAU;AACV,cAAU,aAAa,OAAO,UAAU;KACvC;AACF,aAAU;;AAEX,SAAO;;GAEN;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,QAAQ;AAChB,SAAQ,UAAU;CAClB,MAAM,aAAa;CACnB,MAAM,aAAa;CACnB,SAAS,MAAM,aAAa;EAC3B,IAAI,MAAM;AACV,cAAY,MAAM,KAAK,CAAC,SAAS,SAAS;AACzC,OAAI,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,CAAE;AACtD,UAAO;IACN;AACF,SAAO,OAAO,KAAK,KAAK,SAAS;;CAElC,SAAS,QAAQ,aAAa,OAAO,eAAe;EACnD,MAAM,QAAQ,YAAY,SAAS,SAAS,CAAC,MAAM,WAAW,IAAI;AAClE,SAAO;GACN,cAAc,KAAK;GACnB,GAAG;GACH,YAAY,KAAK;GACjB,CAAC,KAAK,KAAK,CAAC,OAAO,KAAK;;GAExB;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,kBAAkB,QAAQ,sBAAsB,QAAQ,wBAAwB,KAAK;AAC7F,SAAQ,wBAAwB;EAC/B,uBAAuB;EACvB,uBAAuB;EACvB,uBAAuB;EACvB,uBAAuB;EACvB;AACD,SAAQ,sBAAsB;EAC7B,yBAAyB;EACzB,yBAAyB;EACzB,yBAAyB;EACzB,yBAAyB;EACzB;AACD,SAAQ,kBAAkB;EACzB,0BAA0B;EAC1B,0BAA0B;EAC1B,0BAA0B;EAC1B;GACC;AAIH,IAAI,kBAAkC,gCAAgB,YAAY;AACjE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,oCAAoC,KAAK;CACjD,IAAI,oCAAoC,cAAc,MAAM;AAC5D,SAAQ,oCAAoC;GAC1C;AAIH,IAAI,kBAAkC,gCAAgB,YAAY;CACjE,IAAI,kBAAkB,WAAW,QAAQ,oBAAoB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AACnG,MAAI,OAAO,KAAK,EAAG,MAAK;EACxB,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAAe,QAAO;GACzF,YAAY;GACZ,KAAK,WAAW;AACf,WAAO,EAAE;;GAEV;AACD,SAAO,eAAe,GAAG,IAAI,KAAK;OAC7B,SAAS,GAAG,GAAG,GAAG,IAAI;AAC3B,MAAI,OAAO,KAAK,EAAG,MAAK;AACxB,IAAE,MAAM,EAAE;;CAEX,IAAI,qBAAqB,WAAW,QAAQ,uBAAuB,OAAO,UAAU,SAAS,GAAG,GAAG;AAClG,SAAO,eAAe,GAAG,WAAW;GACnC,YAAY;GACZ,OAAO;GACP,CAAC;MACE,SAAS,GAAG,GAAG;AACnB,IAAE,aAAa;;CAEhB,IAAI,eAAe,WAAW,QAAQ,iBAAiB,WAAW;EACjE,IAAI,UAAU,SAAS,GAAG;AACzB,aAAU,OAAO,uBAAuB,SAAS,GAAG;IACnD,IAAI,KAAK,EAAE;AACX,SAAK,IAAI,KAAK,EAAG,KAAI,OAAO,UAAU,eAAe,KAAK,GAAG,EAAE,CAAE,IAAG,GAAG,UAAU;AACjF,WAAO;;AAER,UAAO,QAAQ,EAAE;;AAElB,SAAO,SAAS,KAAK;AACpB,OAAI,OAAO,IAAI,WAAY,QAAO;GAClC,IAAI,SAAS,EAAE;AACf,OAAI,OAAO,MACV;SAAK,IAAI,IAAI,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,EAAE,OAAO,UAAW,iBAAgB,QAAQ,KAAK,EAAE,GAAG;;AAEhH,sBAAmB,QAAQ,IAAI;AAC/B,UAAO;;KAEL;AACJ,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,UAAU,KAAK;CACvB,MAAM,SAAS,aAAa,gBAAgB,CAAC;CAC7C,MAAM,QAAQ,aAAa;CAC3B,MAAM,UAAU,iBAAiB;CACjC,IAAI,UAAU,MAAM;EACnB;EACA,YAAY,MAAM;AACjB,QAAK,OAAO;;EAEb,IAAI,UAAU;AACb,UAAO,KAAK,KAAK,KAAK,GAAG,WAAW;;EAErC,IAAI,UAAU;AACb,UAAO,KAAK,KAAK,KAAK,GAAG,QAAQ;;EAElC,IAAI,8BAA8B;GACjC,MAAM,MAAM,KAAK,kBAAkB,KAAK,GAAG,KAAK,GAAG,OAAO;AAC1D,UAAO,MAAM,gBAAgB;;EAE9B,IAAI,8BAA8B;AACjC,UAAO,KAAK,kBAAkB,KAAK,GAAG;;EAEvC,IAAI,MAAM;AACT,UAAO,KAAK,KAAK,OAAO;;EAEzB,OAAO,MAAM;GACZ,MAAM,SAAS,OAAO,OAAO,KAAK,6BAA6B,KAAK;AACpE,OAAI,CAAC,OAAO,YAAY,QAAQ,KAAK,4BAA4B,CAAE,OAAM,IAAI,QAAQ,kCAAkC,0CAA0C;;EAElK,IAAI,oBAAoB;AACvB,UAAO,KAAK,KAAK,KAAK;;;AAGxB,SAAQ,UAAU;GAChB;AAIH,IAAI,sBAAsC,gCAAgB,YAAY;CACrE,IAAI,kBAAkB,WAAW,QAAQ,oBAAoB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AACnG,MAAI,OAAO,KAAK,EAAG,MAAK;EACxB,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAAe,QAAO;GACzF,YAAY;GACZ,KAAK,WAAW;AACf,WAAO,EAAE;;GAEV;AACD,SAAO,eAAe,GAAG,IAAI,KAAK;OAC7B,SAAS,GAAG,GAAG,GAAG,IAAI;AAC3B,MAAI,OAAO,KAAK,EAAG,MAAK;AACxB,IAAE,MAAM,EAAE;;CAEX,IAAI,qBAAqB,WAAW,QAAQ,uBAAuB,OAAO,UAAU,SAAS,GAAG,GAAG;AAClG,SAAO,eAAe,GAAG,WAAW;GACnC,YAAY;GACZ,OAAO;GACP,CAAC;MACE,SAAS,GAAG,GAAG;AACnB,IAAE,aAAa;;CAEhB,IAAI,eAAe,WAAW,QAAQ,iBAAiB,WAAW;EACjE,IAAI,UAAU,SAAS,GAAG;AACzB,aAAU,OAAO,uBAAuB,SAAS,GAAG;IACnD,IAAI,KAAK,EAAE;AACX,SAAK,IAAI,KAAK,EAAG,KAAI,OAAO,UAAU,eAAe,KAAK,GAAG,EAAE,CAAE,IAAG,GAAG,UAAU;AACjF,WAAO;;AAER,UAAO,QAAQ,EAAE;;AAElB,SAAO,SAAS,KAAK;AACpB,OAAI,OAAO,IAAI,WAAY,QAAO;GAClC,IAAI,SAAS,EAAE;AACf,OAAI,OAAO,MACV;SAAK,IAAI,IAAI,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,EAAE,OAAO,UAAW,iBAAgB,QAAQ,KAAK,EAAE,GAAG;;AAEhH,sBAAmB,QAAQ,IAAI;AAC/B,UAAO;;KAEL;AACJ,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,mBAAmB,KAAK;CAChC,MAAM,SAAS,cAAc;CAC7B,MAAM,SAAS,aAAa,gBAAgB,CAAC;CAC7C,MAAM,QAAQ,aAAa;CAC3B,MAAM,UAAU,iBAAiB;CACjC,MAAM,YAAY,iBAAiB;CACnC,MAAM,qCAAqC;CAC3C,MAAM,iCAAiC;CACvC,MAAM,+BAA+B;AA0GrC,SAAQ,mBAzGe,MAAM,iBAAiB;EAC7C;EACA,YAAY,MAAM;AACjB,QAAK,OAAO;;EAEb,OAAO,MAAM,KAAK;AACjB,UAAO,IAAI,iBAAiB,OAAO,QAAQ,YAAY,IAAI,CAAC;;EAE7D,IAAI,SAAS;AACZ,UAAO,KAAK,iBAAiB,KAAK,GAAG,WAAW;;EAEjD,IAAI,cAAc;AACjB,UAAO,KAAK,eAAe,OAAO;;EAEnC,IAAI,eAAe;AAClB,UAAO,KAAK,gBAAgB,OAAO;;EAEpC,IAAI,cAAc;AACjB,UAAO,KAAK,QAAQ;;EAErB,IAAI,eAAe;AAClB,UAAO,KAAK,aAAa,KAAK,GAAG;;EAElC,IAAI,qBAAqB;AACxB,UAAO,KAAK,aAAa,KAAK,GAAG;;EAElC,IAAI,wBAAwB;GAC3B,MAAM,MAAM,KAAK,yBAAyB,KAAK,GAAG,OAAO;AACzD,UAAO,MAAM,gBAAgB;;EAE9B,IAAI,qBAAqB;GACxB,MAAM,MAAM,KAAK,sBAAsB,KAAK,GAAG,OAAO;AACtD,UAAO,MAAM,sBAAsB;;EAEpC,IAAI,iBAAiB;AACpB,UAAO,KAAK,kBAAkB;;EAE/B,IAAI,UAAU;AACb,UAAO,IAAI,UAAU,QAAQ,KAAK,YAAY,KAAK,GAAG,KAAK,GAAG;;EAE/D,OAAO,MAAM,WAAW;AACvB,OAAI,CAAC,KAAK,kBAAmB,OAAM,IAAI,QAAQ,kCAAkC,4BAA4B;AAC7G,OAAI,KAAK,gBAAgB,mCAAoC,OAAM,IAAI,QAAQ,kCAAkC,2BAA2B,KAAK,cAAc;AAC/J,OAAI,KAAK,iBAAiB,+BAAgC,OAAM,IAAI,QAAQ,kCAAkC,wCAAwC,KAAK,eAAe;AAC1K,QAAK,QAAQ,OAAO,KAAK;AACzB,QAAK,qBAAqB;AAC1B,QAAK,gBAAgB,UAAU;;EAEhC,sBAAsB;GACrB,MAAM,gBAAgB,OAAO,OAAO,KAAK,uBAAuB,KAAK,QAAQ,IAAI;GACjF,MAAM,iBAAiB,KAAK,0BAA0B,KAAK,GAAG,KAAK,GAAG;AACtE,OAAI,CAAC,OAAO,YAAY,eAAe,eAAe,CAAE,OAAM,IAAI,QAAQ,kCAAkC,qCAAqC;;EAElJ,gBAAgB,KAAK;GACpB,MAAM,cAAc,KAAK,eAAe,OAAO;AAC/C,eAAY,KAAK;AACjB,OAAI,CAAC,OAAO,OAAO,aAAa,KAAK,KAAK,gBAAgB,KAAK,mBAAmB,CAAE,OAAM,IAAI,QAAQ,kCAAkC,gCAAgC;;EAEzK,IAAI,mBAAmB;AACtB,UAAO,KAAK,KAAK,KAAK;;EAEvB,IAAI,oBAAoB;AACvB,UAAO,KAAK,KAAK,KAAK;;EAEvB,IAAI,iBAAiB;AACpB,UAAO,KAAK,kBAAkB,KAAK;;EAEpC,IAAI,gBAAgB;AACnB,UAAO,KAAK,kBAAkB,KAAK,MAAM,QAAQ,IAAI,IAAI,kBAAkB,EAAE,CAAC,CAAC,KAAK;;EAErF,IAAI,sBAAsB;AACzB,UAAO,KAAK,cAAc,KAAK;;EAEhC,IAAI,iBAAiB;GACpB,MAAM,KAAK,KAAK;AAChB,UAAO,GAAG,KAAK,GAAG,KAAK,SAAS;;EAEjC,IAAI,gBAAgB;AACnB,UAAO,KAAK,eAAe,KAAK;;EAEjC,IAAI,kBAAkB;AACrB,UAAO,KAAK,oBAAoB,KAAK;;EAEtC,IAAI,cAAc;AACjB,UAAO,KAAK,oBAAoB,KAAK;;EAEtC,IAAI,iBAAiB;AACpB,UAAO,KAAK,cAAc,KAAK,MAAM,QAAQ,IAAI,IAAI,kBAAkB,EAAE,CAAC;;EAE3E,IAAI,4BAA4B;AAC/B,UAAO,KAAK,eAAe,KAAK,MAAM,QAAQ,IAAI,KAAK,GAAG,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,OAAO,KAAK,6BAA6B;;EAE/H,IAAI,eAAe;AAClB,UAAO,KAAK,cAAc,KAAK;;EAEhC,IAAI,2BAA2B;AAC9B,UAAO,KAAK,cAAc,KAAK;;EAEhC,IAAI,wBAAwB;AAC3B,UAAO,KAAK,cAAc,KAAK;;EAEhC,IAAI,oBAAoB;AACvB,UAAO,KAAK,cAAc,KAAK;;;GAI/B;AAIH,IAAI,kBAAkC,gCAAgB,YAAY;AACjE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,mBAAmB,KAAK;CAChC,IAAI,cAAc,qBAAqB;AACvC,QAAO,eAAe,SAAS,oBAAoB;EAClD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,YAAY;;EAEpB,CAAC;GACA;AAIH,IAAI,gBAAgC,gCAAgB,YAAY;CAC/D,IAAI,kBAAkB,WAAW,QAAQ,oBAAoB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AACnG,MAAI,OAAO,KAAK,EAAG,MAAK;EACxB,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAAe,QAAO;GACzF,YAAY;GACZ,KAAK,WAAW;AACf,WAAO,EAAE;;GAEV;AACD,SAAO,eAAe,GAAG,IAAI,KAAK;OAC7B,SAAS,GAAG,GAAG,GAAG,IAAI;AAC3B,MAAI,OAAO,KAAK,EAAG,MAAK;AACxB,IAAE,MAAM,EAAE;;CAEX,IAAI,qBAAqB,WAAW,QAAQ,uBAAuB,OAAO,UAAU,SAAS,GAAG,GAAG;AAClG,SAAO,eAAe,GAAG,WAAW;GACnC,YAAY;GACZ,OAAO;GACP,CAAC;MACE,SAAS,GAAG,GAAG;AACnB,IAAE,aAAa;;CAEhB,IAAI,eAAe,WAAW,QAAQ,iBAAiB,WAAW;EACjE,IAAI,UAAU,SAAS,GAAG;AACzB,aAAU,OAAO,uBAAuB,SAAS,GAAG;IACnD,IAAI,KAAK,EAAE;AACX,SAAK,IAAI,KAAK,EAAG,KAAI,OAAO,UAAU,eAAe,KAAK,GAAG,EAAE,CAAE,IAAG,GAAG,UAAU;AACjF,WAAO;;AAER,UAAO,QAAQ,EAAE;;AAElB,SAAO,SAAS,KAAK;AACpB,OAAI,OAAO,IAAI,WAAY,QAAO;GAClC,IAAI,SAAS,EAAE;AACf,OAAI,OAAO,MACV;SAAK,IAAI,IAAI,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,EAAE,OAAO,UAAW,iBAAgB,QAAQ,KAAK,EAAE,GAAG;;AAEhH,sBAAmB,QAAQ,IAAI;AAC/B,UAAO;;KAEL;AACJ,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,6BAA6B,KAAK;CAC1C,MAAM,SAAS,aAAa,gBAAgB,CAAC;CAC7C,MAAM,WAAW,gBAAgB;AAoEjC,SAAQ,6BAnEyB,MAAM,2BAA2B;EACjE;EACA;EACA;EACA;EACA;EACA;EACA;EACA,YAAY,SAAS;AACpB,QAAK,UAAU,QAAQ;AACvB,QAAK,QAAQ,QAAQ;AACrB,QAAK,YAAY,QAAQ;AACzB,QAAK,aAAa,QAAQ;AAC1B,QAAK,gBAAgB,QAAQ;AAC7B,QAAK,qBAAqB,QAAQ;AAClC,QAAK,YAAY,QAAQ;;EAE1B,IAAI,WAAW;AACd,UAAO,IAAI,KAAK,OAAO,KAAK,UAAU,gBAAgB,CAAC,CAAC;;EAEzD,IAAI,YAAY;AACf,WAAQ,KAAK,eAAb;IACC,KAAK,EAAG,QAAO;IACf,KAAK,EAAG,QAAO;IACf,KAAK,EAAG,QAAO;IACf,KAAK,EAAG,QAAO;IACf,KAAK,EAAG,QAAO;IACf,KAAK,EAAG,QAAO;IACf,KAAK,EAAG,QAAO;IACf,QAAS,QAAO;;;EAGlB,OAAO,SAAS,KAAK;GACpB,MAAM,SAAS,IAAI,SAAS,YAAY;AACxC,UAAO,WAAW,KAAK,QAAQ;AAC/B,UAAO,WAAW,EAAE;AACpB,UAAO,WAAW,KAAK,UAAU;AACjC,UAAO,aAAa,EAAE;AACtB,UAAO,WAAW,QAAQ;AAC1B,UAAO,aAAa,KAAK,WAAW,WAAW;;AAE/C,OAAI,KAAK,WAAW,aAAa,EAAG,QAAO,WAAW,KAAK,WAAW;AACtE,UAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,KAAK,WAAW,KAAK,UAAU;;EAEzE,OAAO,MAAM,KAAK;GACjB,MAAM,SAAS,IAAI,SAAS,WAAW,IAAI;GAC3C,MAAM,UAAU,OAAO,UAAU;GACjC,MAAM,QAAQ,OAAO,SAAS,GAAG;GACjC,MAAM,YAAY,OAAO,SAAS,EAAE;GACpC,MAAM,mBAAmB,OAAO,WAAW;GAC3C,MAAM,aAAa,OAAO,SAAS,iBAAiB;GACpD,MAAM,gBAAgB,OAAO,UAAU;GACvC,MAAM,qBAAqB,OAAO,UAAU;GAC5C,MAAM,YAAY,OAAO,WAAW;GACpC,MAAM,YAAY,OAAO,SAAS,UAAU;AAC5C,OAAI,OAAO,aAAa,IAAI,OAAQ,OAAM,IAAI,MAAM,6BAA6B;AACjF,UAAO,IAAI,2BAA2B;IACrC;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC;;;GAIF;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,mBAAmB,QAAQ,4BAA4B,QAAQ,8BAA8B,QAAQ,sCAAsC,QAAQ,wBAAwB,QAAQ,gCAAgC,QAAQ,gBAAgB,KAAK;CACxP,MAAM,WAAW,gBAAgB;CACjC,MAAM,QAAQ,eAAe;CAC7B,IAAI,gBAAgB,MAAM;EACzB;EACA,YAAY,MAAM;AACjB,QAAK,OAAO;;EAEb,IAAI,MAAM;AACT,UAAO,KAAK,KAAK,KAAK,GAAG,OAAO;;EAEjC,IAAI,WAAW;AACd,UAAO,KAAK,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK,GAAG,WAAW,GAAG;;EAEtE,IAAI,QAAQ;AACX,UAAO,KAAK,aAAa;;EAE1B,IAAI,WAAW;AACd,UAAO,KAAK;;EAEb,IAAI,eAAe;AAClB,UAAO,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,SAAS;;;AAGhD,SAAQ,gBAAgB;CACxB,IAAI,gCAAgC,cAAc,cAAc;EAC/D,IAAI,OAAO;AACV,UAAO,KAAK,SAAS,KAAK,IAAI,WAAW,IAAI;;EAE9C,IAAI,oBAAoB;AACvB,UAAO,KAAK,SAAS,KAAK,SAAS,IAAI,KAAK,SAAS,KAAK,GAAG,WAAW,GAAG,KAAK;;EAEjF,IAAI,WAAW;AACd,UAAO,KAAK,aAAa,KAAK;;;AAGhC,SAAQ,gCAAgC;CACxC,IAAI,wBAAwB,cAAc,cAAc;EACvD,IAAI,mBAAmB;AACtB,UAAO,KAAK,UAAU,OAAO;;EAE9B,IAAI,cAAc;AACjB,UAAO,KAAK,UAAU,OAAO;;EAE9B,IAAI,UAAU;AACb,UAAO,KAAK,UAAU,OAAO;;EAE9B,IAAI,YAAY;AACf,UAAO,KAAK,aAAa,KAAK,GAAG,aAAa;;;AAGhD,SAAQ,wBAAwB;CAChC,IAAI,sCAAsC,cAAc,cAAc;EACrE,IAAI,aAAa;AAChB,UAAO,KAAK,gBAAgB,EAAE,EAAE,MAAM,SAAS,QAAQ;;EAExD,IAAI,MAAM;AACT,UAAO,KAAK,gBAAgB,EAAE,EAAE,MAAM,SAAS,QAAQ;;EAExD,UAAU,KAAK;GACd,MAAM,YAAY,KAAK,gBAAgB,EAAE;AACzC,OAAI,cAAc,KAAK,EAAG;AAC1B,OAAI,UAAU,KAAK,GAAG,OAAO,KAAK,IAAK;AACvC,UAAO,UAAU,KAAK,GAAG,KAAK,GAAG,MAAM,SAAS,QAAQ;;EAEzD,gBAAgB,KAAK;AACpB,UAAO,KAAK,aAAa,MAAM,OAAO,GAAG,IAAI,kBAAkB,IAAI,CAAC;;EAErE,IAAI,eAAe;AAClB,UAAO,KAAK,aAAa,KAAK,GAAG;;;AAGnC,SAAQ,sCAAsC;CAC9C,IAAI,8BAA8B,cAAc,cAAc;EAC7D,IAAI,gBAAgB;AACnB,UAAO,KAAK,mBAAmB,EAAE,EAAE;;EAEpC,mBAAmB,KAAK;AACvB,UAAO,KAAK,SAAS,KAAK,MAAM,OAAO,GAAG,IAAI,kBAAkB,IAAI,CAAC;;EAEtE,IAAI,WAAW;AACd,UAAO,KAAK,aAAa,KAAK;;;AAGhC,SAAQ,8BAA8B;CACtC,IAAI,4BAA4B,cAAc,cAAc;EAC3D,IAAI,gBAAgB;AACnB,UAAO,KAAK,aAAa,KAAK,GAAG;;;AAGnC,SAAQ,4BAA4B;CACpC,IAAI,mBAAmB,cAAc,cAAc;EAClD,YAAY,MAAM;AACjB,SAAM,KAAK;;EAEZ,IAAI,8BAA8B;GACjC,MAAM,MAAM,KAAK,aAAa,KAAK,GAAG;GACtC,MAAM,SAAS,IAAI,SAAS,WAAW,IAAI;GAC3C,MAAM,MAAM,OAAO,WAAW,GAAG;GACjC,MAAM,UAAU,EAAE;AAClB,UAAO,OAAO,WAAW,KAAK;IAC7B,MAAM,YAAY,OAAO,WAAW;IACpC,MAAM,MAAM,OAAO,SAAS,UAAU;AACtC,YAAQ,KAAK,MAAM,2BAA2B,MAAM,IAAI,CAAC;;AAE1D,OAAI,OAAO,aAAa,IAAK,OAAM,IAAI,MAAM,+CAA+C;AAC5F,UAAO;;;AAGT,SAAQ,mBAAmB;GACzB;AAIH,IAAI,eAA+B,gCAAgB,YAAY;CAC9D,IAAI,kBAAkB,WAAW,QAAQ,oBAAoB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AACnG,MAAI,OAAO,KAAK,EAAG,MAAK;EACxB,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAAe,QAAO;GACzF,YAAY;GACZ,KAAK,WAAW;AACf,WAAO,EAAE;;GAEV;AACD,SAAO,eAAe,GAAG,IAAI,KAAK;OAC7B,SAAS,GAAG,GAAG,GAAG,IAAI;AAC3B,MAAI,OAAO,KAAK,EAAG,MAAK;AACxB,IAAE,MAAM,EAAE;;CAEX,IAAI,qBAAqB,WAAW,QAAQ,uBAAuB,OAAO,UAAU,SAAS,GAAG,GAAG;AAClG,SAAO,eAAe,GAAG,WAAW;GACnC,YAAY;GACZ,OAAO;GACP,CAAC;MACE,SAAS,GAAG,GAAG;AACnB,IAAE,aAAa;;CAEhB,IAAI,eAAe,WAAW,QAAQ,iBAAiB,WAAW;EACjE,IAAI,UAAU,SAAS,GAAG;AACzB,aAAU,OAAO,uBAAuB,SAAS,GAAG;IACnD,IAAI,KAAK,EAAE;AACX,SAAK,IAAI,KAAK,EAAG,KAAI,OAAO,UAAU,eAAe,KAAK,GAAG,EAAE,CAAE,IAAG,GAAG,UAAU;AACjF,WAAO;;AAER,UAAO,QAAQ,EAAE;;AAElB,SAAO,SAAS,KAAK;AACpB,OAAI,OAAO,IAAI,WAAY,QAAO;GAClC,IAAI,SAAS,EAAE;AACf,OAAI,OAAO,MACV;SAAK,IAAI,IAAI,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,EAAE,OAAO,UAAW,iBAAgB,QAAQ,KAAK,EAAE,GAAG;;AAEhH,sBAAmB,QAAQ,IAAI;AAC/B,UAAO;;KAEL;AACJ,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,kBAAkB,QAAQ,oBAAoB,KAAK;CAC3D,MAAM,SAAS,cAAc;CAC7B,MAAM,SAAS,aAAa,gBAAgB,CAAC;CAC7C,MAAM,QAAQ,aAAa;CAC3B,MAAM,MAAM,aAAa,aAAa,CAAC;CACvC,MAAM,QAAQ,aAAa;CAC3B,MAAM,+BAA+B;CACrC,MAAM,0BAA0B;CAChC,MAAM,iCAAiC;CACvC,MAAM,kCAAkC;CACxC,MAAM,iCAAiC;AACvC,SAAQ,oBAAoB;AAwI5B,SAAQ,kBAvIc,MAAM,gBAAgB;EAC3C;EACA,YAAY,MAAM;AACjB,QAAK,OAAO;;EAEb,OAAO,MAAM,MAAM;GAClB,MAAM,MAAM,OAAO,SAAS,WAAW,IAAI,MAAM,KAAK,GAAG;AACzD,UAAO,IAAI,gBAAgB,OAAO,QAAQ,YAAY,IAAI,CAAC;;EAE5D,IAAI,iBAAiB;AACpB,UAAO,KAAK;;EAEb,IAAI,UAAU;AACb,UAAO,KAAK,KAAK,WAAW,KAAK,GAAG,WAAW,GAAG,OAAO,EAAE,EAAE,UAAU;;EAExE,IAAI,eAAe;AAClB,UAAO,KAAK,gBAAgB;;EAE7B,IAAI,YAAY;AACf,UAAO,KAAK,YAAY,KAAK,GAAG,QAAQ;;EAEzC,IAAI,WAAW;AACd,UAAO,KAAK,YAAY,KAAK,GAAG,QAAQ;;EAEzC,IAAI,SAAS;AACZ,UAAO,KAAK,UAAU;;EAEvB,IAAI,UAAU;AACb,UAAO,KAAK,WAAW;;EAExB,IAAI,YAAY;AACf,UAAO,KAAK,wBAAwB,OAAO;;EAE5C,IAAI,qBAAqB;GACxB,MAAM,MAAM,KAAK,sBAAsB,KAAK,GAAG,OAAO;AACtD,OAAI,MAAM,oBAAoB,KAAM,QAAO,MAAM,oBAAoB;AACrE,UAAO,MAAM,sBAAsB;;EAEpC,IAAI,iBAAiB;AACpB,UAAO,KAAK,kBAAkB,MAAM,SAAS,EAAE;;EAEhD,IAAI,iBAAiB;GACpB,MAAM,MAAM,KAAK;AACjB,UAAO,KAAK,OAAO,KAAK;;EAEzB,IAAI,aAAa;;AAEhB,WAAQ,KAAK,eAAe,KAAK,KAAK,QAAQ,EAAE;;EAEjD,IAAI,cAAc;GACjB,MAAM,MAAM,KAAK,cAAc,wBAAwB;AACvD,UAAO,MAAM,IAAI,MAAM,sBAAsB,IAAI,GAAG,KAAK;;EAE1D,IAAI,sBAAsB;GACzB,MAAM,MAAM,KAAK,cAAc,gCAAgC;AAC/D,UAAO,MAAM,IAAI,MAAM,8BAA8B,IAAI,GAAG,KAAK;;EAElE,IAAI,oBAAoB;GACvB,MAAM,MAAM,KAAK,cAAc,+BAA+B;AAC9D,UAAO,MAAM,IAAI,MAAM,oCAAoC,IAAI,GAAG,KAAK;;EAExE,IAAI,oBAAoB;GACvB,MAAM,MAAM,KAAK,cAAc,+BAA+B;AAC9D,UAAO,MAAM,IAAI,MAAM,4BAA4B,IAAI,GAAG,KAAK;;EAEhE,IAAI,kBAAkB;GACrB,MAAM,MAAM,KAAK,cAAc,6BAA6B;AAC5D,UAAO,MAAM,IAAI,MAAM,0BAA0B,IAAI,GAAG,KAAK;;EAE9D,IAAI,SAAS;GACZ,MAAM,MAAM,KAAK,cAAc,QAAQ,kBAAkB;AACzD,UAAO,MAAM,IAAI,MAAM,iBAAiB,IAAI,GAAG,KAAK;;EAErD,IAAI,OAAO;GACV,MAAM,KAAK,KAAK,qBAAqB,QAAQ;;AAE7C,OAAI,KAAK,YAAa,QAAO,MAAM,KAAK,YAAY;;AAEpD,UAAO;;EAER,UAAU,KAAK;GACd,MAAM,MAAM,KAAK,cAAc,IAAI;AACnC,UAAO,MAAM,IAAI,MAAM,cAAc,IAAI,GAAG,KAAK;;EAElD,OAAO,mBAAmB;GACzB,MAAM,YAAY,mBAAmB,aAAa,KAAK;GACvD,MAAM,MAAM,OAAO,gBAAgB,UAAU;AAC7C,UAAO,OAAO,OAAO,KAAK,eAAe,OAAO,EAAE,KAAK,KAAK,gBAAgB,KAAK,mBAAmB;;EAErG,aAAa,MAAM;AAClB,UAAO,KAAK,aAAa,QAAQ,QAAQ,KAAK;;EAE/C,OAAO,OAAO;AACb,UAAO,KAAK,KAAK,OAAO,CAAC,OAAO,MAAM,KAAK,OAAO,CAAC;;EAEpD,QAAQ;GACP,MAAM,MAAM,KAAK,KAAK,OAAO;GAC7B,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO;AACtC,OAAI,KAAK,MAAM;AACf,UAAO,gBAAgB,MAAM,MAAM;;EAEpC,cAAc,KAAK;AAClB,UAAO,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,GAAG,OAAO,KAAK,IAAI;;EAElE,IAAI,oBAAoB;AACvB,UAAO,KAAK,KAAK,KAAK;;EAEvB,IAAI,wBAAwB;AAC3B,UAAO,KAAK,KAAK,KAAK;;EAEvB,IAAI,oBAAoB;AACvB,UAAO,KAAK,KAAK,KAAK;;EAEvB,IAAI,aAAa;AAChB,UAAO,KAAK,kBAAkB,KAAK;;EAEpC,IAAI,kBAAkB;AACrB,UAAO,KAAK,kBAAkB,KAAK;;EAEpC,IAAI,YAAY;AACf,UAAO,KAAK,kBAAkB,KAAK;;EAEpC,IAAI,cAAc;AACjB,UAAO,KAAK,kBAAkB,KAAK;;EAEpC,IAAI,aAAa;AAChB,UAAO,KAAK,kBAAkB,KAAK;;EAEpC,IAAI,0BAA0B;AAC7B,UAAO,KAAK,kBAAkB,KAAK;;EAEpC,IAAI,gBAAgB;AACnB,UAAO,KAAK,kBAAkB,KAAK,MAAM,QAAQ,IAAI,IAAI,kBAAkB,EAAE,CAAC;;;GAI9E;AAIH,IAAI,eAA+B,gCAAgB,YAAY;AAC9D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,mBAAmB,QAAQ,kBAAkB,QAAQ,oBAAoB,KAAK;CACtF,IAAI,SAAS,cAAc;AAC3B,QAAO,eAAe,SAAS,qBAAqB;EACnD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,OAAO;;EAEf,CAAC;AACF,QAAO,eAAe,SAAS,mBAAmB;EACjD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,OAAO;;EAEf,CAAC;CACF,IAAI,QAAQ,aAAa;AACzB,QAAO,eAAe,SAAS,oBAAoB;EAClD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,MAAM;;EAEd,CAAC;GACA;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;CAChE,IAAI,kBAAkB,WAAW,QAAQ,oBAAoB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AACnG,MAAI,OAAO,KAAK,EAAG,MAAK;EACxB,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAAe,QAAO;GACzF,YAAY;GACZ,KAAK,WAAW;AACf,WAAO,EAAE;;GAEV;AACD,SAAO,eAAe,GAAG,IAAI,KAAK;OAC7B,SAAS,GAAG,GAAG,GAAG,IAAI;AAC3B,MAAI,OAAO,KAAK,EAAG,MAAK;AACxB,IAAE,MAAM,EAAE;;CAEX,IAAI,qBAAqB,WAAW,QAAQ,uBAAuB,OAAO,UAAU,SAAS,GAAG,GAAG;AAClG,SAAO,eAAe,GAAG,WAAW;GACnC,YAAY;GACZ,OAAO;GACP,CAAC;MACE,SAAS,GAAG,GAAG;AACnB,IAAE,aAAa;;CAEhB,IAAI,eAAe,WAAW,QAAQ,iBAAiB,WAAW;EACjE,IAAI,UAAU,SAAS,GAAG;AACzB,aAAU,OAAO,uBAAuB,SAAS,GAAG;IACnD,IAAI,KAAK,EAAE;AACX,SAAK,IAAI,KAAK,EAAG,KAAI,OAAO,UAAU,eAAe,KAAK,GAAG,EAAE,CAAE,IAAG,GAAG,UAAU;AACjF,WAAO;;AAER,UAAO,QAAQ,EAAE;;AAElB,SAAO,SAAS,KAAK;AACpB,OAAI,OAAO,IAAI,WAAY,QAAO;GAClC,IAAI,SAAS,EAAE;AACf,OAAI,OAAO,MACV;SAAK,IAAI,IAAI,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,EAAE,OAAO,UAAW,iBAAgB,QAAQ,KAAK,EAAE,GAAG;;AAEhH,sBAAmB,QAAQ,IAAI;AAC/B,UAAO;;KAEL;AACJ,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,mBAAmB,QAAQ,kBAAkB,QAAQ,oBAAoB,QAAQ,aAAa,QAAQ,mBAAmB,QAAQ,MAAM,QAAQ,OAAO,QAAQ,WAAW,QAAQ,OAAO,QAAQ,SAAS,QAAQ,UAAU,KAAK;CACxO,IAAI,SAAS,cAAc;AAC3B,QAAO,eAAe,SAAS,WAAW;EACzC,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,OAAO;;EAEf,CAAC;AACF,SAAQ,SAAS,aAAa,gBAAgB,CAAC;AAC/C,SAAQ,OAAO,aAAa,gBAAgB,CAAC;AAC7C,SAAQ,WAAW,aAAa,kBAAkB,CAAC;AACnD,SAAQ,OAAO,aAAa,cAAc,CAAC;AAC3C,SAAQ,MAAM,aAAa,aAAa,CAAC;CACzC,IAAI,YAAY,iBAAiB;AACjC,QAAO,eAAe,SAAS,oBAAoB;EAClD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,UAAU;;EAElB,CAAC;CACF,IAAI,WAAW,gBAAgB;AAC/B,QAAO,eAAe,SAAS,cAAc;EAC5C,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;CACF,IAAI,SAAS,cAAc;AAC3B,QAAO,eAAe,SAAS,qBAAqB;EACnD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,OAAO;;EAEf,CAAC;AACF,QAAO,eAAe,SAAS,mBAAmB;EACjD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,OAAO;;EAEf,CAAC;AACF,QAAO,eAAe,SAAS,oBAAoB;EAClD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,OAAO;;EAEf,CAAC;GACA;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,uBAAuB,KAAK;CACpC,MAAM,SAAS,gBAAgB;CAC/B,IAAI,uBAAuB,MAAM;EAChC;EACA,YAAY,KAAK;AAChB,QAAK,MAAM;;EAEZ,cAAc,QAAQ;AACrB,UAAO,OAAO,OAAO,YAAY,QAAQ,OAAO,OAAO,OAAO,UAAU,KAAK,IAAI,QAAQ,CAAC;;EAE3F,oBAAoB,QAAQ;AAC3B,UAAO,OAAO,OAAO,YAAY,QAAQ,OAAO,OAAO,OAAO,UAAU,KAAK,gBAAgB,CAAC;;EAE/F,iBAAiB,WAAW;AAC3B,UAAO,OAAO,OAAO,YAAY,WAAW,KAAK,UAAU;;EAE5D,gBAAgB,KAAK;AACpB,UAAO,OAAO,OAAO,OAAO,KAAK,iBAAiB,KAAK,KAAK,UAAU;;EAEvE,IAAI,YAAY;AACf,UAAO,KAAK,IAAI,WAAW,SAAS,IAAI,KAAK,IAAI,WAAW,GAAG,MAAM,OAAO,KAAK,GAAG;;EAErF,IAAI,kBAAkB;AACrB,UAAO,OAAO,KAAK,gBAAgB,KAAK,IAAI,aAAa,KAAK,IAAI,QAAQ;;;AAG5E,SAAQ,uBAAuB;GAC7B;AAIH,IAAI,kBAAkC,gCAAgB,YAAY;AACjE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,0BAA0B,KAAK;CACvC,MAAM,SAAS,gBAAgB;CAC/B,MAAM,mBAAmB,gBAAgB;CACzC,MAAM,qBAAqB;GACzB,iBAAiB,cAAc,6BAA6B;GAC5D,iBAAiB,cAAc,WAAW;GAC1C,iBAAiB,cAAc,WAAW;GAC1C,iBAAiB,cAAc,WAAW;GAC1C,iBAAiB,cAAc,WAAW;GAC1C,iBAAiB,cAAc,WAAW;EAC3C;CACD,IAAI,0BAA0B,MAAM;EACnC;EACA;EACA;EACA;EACA,YAAY,kBAAkB,UAAU;AACvC,QAAK,YAAY,iBAAiB;AAClC,QAAK,gBAAgB,iBAAiB,cAAc;AACpD,QAAK,WAAW;AAChB,QAAK,gBAAgB,mBAAmB,iBAAiB,cAAc,cAAc;;EAEtF,iBAAiB,WAAW;AAC3B,UAAO,OAAO,OAAO,YAAY,WAAW,KAAK,UAAU;;EAE5D,cAAc,QAAQ;AACrB,UAAO,OAAO,OAAO,YAAY,QAAQ,KAAK,cAAc;;EAE7D,oBAAoB,QAAQ;AAC3B,UAAO,KAAK,cAAc,OAAO;;EAElC,gBAAgB,KAAK;AACpB,UAAO,OAAO,OAAO,OAAO,KAAK,UAAU,KAAK,KAAK,WAAW,KAAK,cAAc;;;AAGrF,SAAQ,0BAA0B;GAChC;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,iBAAiB;AACzB,SAAQ,mBAAmB;CAC3B,MAAM,SAAS,gBAAgB;CAC/B,MAAM,SAAS,gBAAgB;CAC/B,MAAM,YAAY,iBAAiB;CACnC,SAAS,eAAe,QAAQ,UAAU;EACzC,MAAM,EAAE,aAAa,8BAA8B,OAAO;EAC1D,MAAM,aAAa,EAAE;AACrB,OAAK,MAAM,SAAS,YAAa,KAAI,MAAM,kBAAkB,MAAM,mBAAmB,IAAK,YAAW,KAAK;GAC1G,OAAO;GACP,WAAW;GACX,CAAC;AACF,OAAK,MAAM,MAAM,2BAA2B,qBAAqB,EAAE,CAAE,YAAW,KAAK;GACpF,OAAO;GACP,WAAW,OAAO,iBAAiB,MAAM,OAAO,KAAK,GAAG,gBAAgB,CAAC;GACzE,CAAC;AACF,SAAO;GACN,WAAW,iBAAiB,QAAQ,SAAS;GAC7C,KAAK,IAAI,OAAO;GAChB;GACA;GACA;;CAEF,SAAS,iBAAiB,QAAQ,UAAU;AAC3C,UAAQ,OAAO,QAAQ,OAAvB;GACC,KAAK,eAAgB,QAAO,IAAI,OAAO,qBAAqB,OAAO,QAAQ,aAAa;GACxF,KAAK,mBAAoB,QAAO,IAAI,UAAU,wBAAwB,OAAO,QAAQ,kBAAkB,SAAS;;;CAGlH,SAAS,IAAI,QAAQ;AACpB,UAAQ,OAAO,qBAAqB,QAAQ,OAA5C;GACC,KAAK,YAAa,QAAO;IACxB,OAAO;IACP,MAAM,OAAO,qBAAqB,QAAQ,UAAU;IACpD;GACD,KAAK,uBAAwB,QAAO;IACnC,OAAO;IACP,aAAa,OAAO,gBAAgB,MAAM,OAAO,KAAK,OAAO,qBAAqB,QAAQ,qBAAqB,aAAa,GAAG,SAAS,CAAC;IACzI;GACD,KAAK,cAAe,QAAO;IAC1B,OAAO;IACP,aAAa,OAAO,gBAAgB,MAAM,OAAO,KAAK,OAAO,qBAAqB,QAAQ,YAAY,SAAS,CAAC;IAChH;;;GAGD;AAIH,IAAI,gBAAgC,gCAAgB,YAAY;AAC/D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,cAAc,QAAQ,oBAAoB,KAAK;CACvD,IAAI,YAAY,cAAc,MAAM;EACnC;EACA;EACA,YAAY,EAAE,MAAM,SAAS,SAAS;AACrC,SAAM,QAAQ;AACd,QAAK,OAAO;AACZ,QAAK,QAAQ;AACb,QAAK,OAAO,KAAK,YAAY;;;CAG/B,IAAI,oBAAoB,cAAc,UAAU;AAChD,SAAQ,oBAAoB;CAC5B,IAAI,cAAc,cAAc,UAAU;AAC1C,SAAQ,cAAc;GACpB;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,wBAAwB;AAChC,SAAQ,wBAAwB;CAChC,SAAS,sBAAsB,iBAAiB,WAAW;AAC1D,SAAO,gBAAgB,QAAQ,OAAO;AACrC,UAAO,GAAG,SAAS,SAAS,aAAa,GAAG,SAAS,OAAO;IAC3D;;CAEH,SAAS,sBAAsB,iBAAiB,UAAU;AACzD,SAAO,gBAAgB,QAAQ,SAAS;AACvC,OAAI,SAAS,SAAS,CAAC,KAAK,MAAM,OAAO,SAAS,MAAM,CAAE,QAAO;AACjE,UAAO,KAAK,SAAS,SAAS,SAAS,cAAc,SAAS,cAAc,KAAK,SAAS;IACzF;;GAED;AAIH,IAAI,gBAAgC,gCAAgB,YAAY;AAC/D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,wBAAwB,QAAQ,wBAAwB,KAAK;AACrE,SAAQ,kBAAkB;CAC1B,MAAM,SAAS,gBAAgB;CAC/B,MAAM,mBAAmB,gBAAgB;CACzC,MAAM,UAAU,eAAe;CAC/B,MAAM,oCAAoC,IAAI,KAAK,EAAE;CACrD,MAAM,8BAA8B,IAAI,KAAK,OAAO;CACpD,IAAI,WAAW,gBAAgB;AAC/B,QAAO,eAAe,SAAS,yBAAyB;EACvD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;AACF,QAAO,eAAe,SAAS,yBAAyB;EACvD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;CACF,SAAS,gBAAgB,MAAM,MAAM;EACpC,MAAM,YAAY,OAAO,SAAS,aAAa,OAAO,WAAW,KAAK;AACtE,SAAO;GACN,wBAAwB,KAAK,uBAAuB,IAAI,oBAAoB;GAC5E,sBAAsB,KAAK,qBAAqB,IAAI,oBAAoB;GACxE,OAAO,KAAK,MAAM,IAAI,oBAAoB;GAC1C,QAAQ,KAAK,OAAO,IAAI,oBAAoB;GAC5C,WAAW;GACX;;CAEF,SAAS,oBAAoB,cAAc;EAC1C,MAAM,aAAa,aAAa,UAAU;EAC1C,MAAM,UAAU,eAAe,iBAAiB,iBAAiB,qBAAqB,eAAe,iBAAiB,iBAAiB,oBAAoB,eAAe,iBAAiB,iBAAiB,iCAAiC,eAAe,iBAAiB,iBAAiB,iCAAiC,eAAe,iBAAiB,iBAAiB,gCAAgC,UAAU;;AAE1Z,SAAO;GACN,SAAS,aAAa;GACtB,OAAO,aAAa,kBAAkB,aAAa,gBAAgB,QAAQ,aAAa,MAAM;GAC9F,WAAW,OAAO,OAAO,gBAAgB,aAAa,UAAU,UAAU,QAAQ;GAClF,UAAU;IACT,OAAO,aAAa,UAAU,UAAU,SAAS;IACjD,KAAK,aAAa,UAAU,UAAU,OAAO;IAC7C;GACD;;CAEF,SAAS,oBAAoB,IAAI;;AAEhC,SAAO;GACN,WAAW,GAAG,UAAU,aAAa,KAAK,SAAS;AAClD,WAAO,OAAO,gBAAgB,MAAM,OAAO,KAAK,KAAK,SAAS,CAAC;KAC9D;GACF,UAAU;IACT,OAAO,GAAG,UAAU,SAAS;IAC7B,KAAK,GAAG,UAAU,OAAO;IACzB;GACD;;CAEF,SAAS,WAAW,MAAM;AACzB,UAAQ,SAAS;GAChB,MAAM,OAAO,QAAQ,EAAE,EAAE;AACzB,OAAI,CAAC,IAAK,OAAM,IAAI,QAAQ,kBAAkB;IAC7C,MAAM;IACN,SAAS,kBAAkB;IAC3B,CAAC;AACF,UAAO;IACN,WAAW,OAAO,OAAO,gBAAgB,IAAI,SAAS;IACtD,WAAW,SAAS;;AAEnB,aAAQ,IAAI,UAAU,SAAS,sBAAsB,SAAS,IAAI,UAAU,OAAO,gBAAgB;;IAEpG;;;GAGD;AAIH,IAAI,sBAAsC,gCAAgB,YAAY;AACrE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,2BAA2B,KAAK;AACxC,SAAQ,yBAAyB;CACjC,MAAM,UAAU,eAAe;CAC/B,MAAM,UAAU,eAAe;CAC/B,SAAS,uBAAuB,WAAW,MAAM,wBAAwB;EACxE,MAAM,OAAO,GAAG,QAAQ,uBAAuB,wBAAwB,UAAU;EACjF,IAAI;AACJ,OAAK,MAAM,MAAM,IAAK,KAAI;AACzB,UAAO,IAAI,yBAAyB;IACnC,cAAc,GAAG;IACjB,eAAe;IACf;IACA,CAAC,CAAC,QAAQ;WACH,KAAK;AACb,WAAQ;;AAET,QAAM,IAAI,QAAQ,kBAAkB;GACnC,MAAM;GACN,SAAS;GACT,OAAO;GACP,CAAC;;CAEH,IAAI,2BAA2B,MAAM;EACpC;EACA;EACA;EACA;EACA,YAAY,MAAM;AACjB,QAAK,gBAAgB,KAAK;AAC1B,QAAK,eAAe,KAAK;AACzB,QAAK,aAAa,mBAAmB,CAAC,GAAG,KAAK,cAAc,KAAK,cAAc,CAAC;AAChF,QAAK,YAAY,KAAK;;EAEvB,SAAS;GACR,MAAM,kBAAkB,KAAK,MAAM;AACnC,QAAK,UAAU,gBAAgB;AAC/B,OAAI,CAAC,gBAAgB,OAAO,SAAS,KAAK,aAAa,KAAK,UAAU,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IAC5G,MAAM;IACN,SAAS;IACT,CAAC;AACF,UAAO;;EAER,OAAO;GACN,MAAM,WAAW,KAAK;GACtB,IAAI,QAAQ,KAAK,WAAW,SAAS;AACrC,WAAQ,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,KAAK,aAAa,SAAS,KAAK,CAAC,CAAC;AACrF,OAAI,MAAM,WAAW,EAAG,OAAM,IAAI,QAAQ,kBAAkB;IAC3D,MAAM;IACN,SAAS;IACT,CAAC;AACF,UAAO,CAAC,UAAU,GAAG,MAAM,QAAQ,MAAM,SAAS,KAAK,SAAS,KAAK,SAAS,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG;;EAEzG,WAAW,aAAa;GACvB,MAAM,QAAQ,EAAE;GAChB,MAAM,UAAU,KAAK,WAAW,YAAY;AAC5C,OAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,QAAQ,kBAAkB;IAC7D,MAAM;IACN,SAAS;IACT,CAAC;AACF,QAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;IACxC,MAAM,SAAS,QAAQ;AACvB,QAAI,OAAO,OAAO,YAAY,EAAE;AAC/B,WAAM,KAAK,CAAC,YAAY,CAAC;AACzB;;IAED,MAAM,WAAW,KAAK,WAAW,OAAO;AACxC,SAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,IAAK,OAAM,KAAK,CAAC,QAAQ,GAAG,SAAS,GAAG,CAAC;;AAE/E,UAAO;;EAER,WAAW,aAAa;GACvB,IAAI,UAAU,EAAE;GAChB,IAAI;AACJ,OAAI,YAAY,QAAQ,OAAO,YAAY,OAAO,EACjD;QAAI,YAAY,QAAQ,CAAE,QAAO,CAAC,YAAY;;AAE/C,OAAI,YAAY,kBAAmB,iBAAgB,YAAY,kBAAkB;AACjF,QAAK,WAAW,SAAS,mBAAmB;AAC3C,QAAI,eAEH;;SAAI,eAAe,iBAAiB;AACnC,UAAI,eAAe,gBAAgB,cAAc,OAAO,cAAc,CAAE,SAAQ,KAAK,eAAe;AACpG;;;AAGF,QAAI,eAAe,QAAQ,OAAO,YAAY,OAAO,CAAE,SAAQ,KAAK,eAAe;KAClF;AACF,aAAU,QAAQ,QAAQ,WAAW;AACpC,QAAI;AACH,YAAO,YAAY,OAAO,OAAO;aACzB,IAAI;;AAEZ,YAAO;;KAEP;AACF,UAAO;;EAER,UAAU,MAAM;;AAEf,OAAI,KAAK,SAAS,EAAG,OAAM,IAAI,QAAQ,kBAAkB;IACxD,MAAM;IACN,SAAS;IACT,CAAC;AACF,OAAI,CAAC,KAAK,MAAM,EAAE,CAAC,OAAO,SAAS,KAAK,KAAK,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IAClF,MAAM;IACN,SAAS;IACT,CAAC;AACF,QAAK,IAAI,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;;AAEtC,OAAI,CAAC,KAAK,GAAG,OAAO,OAAO,KAAK,IAAI,GAAG,QAAQ,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IACpF,MAAM;IACN,SAAS;IACT,CAAC;AACF,QAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;IACrC,MAAM,OAAO,KAAK;AAClB,QAAI,KAAK,qBAAqB,MAAM;KACnC,MAAM,aAAa,KAAK,oBAAoB;AAC5C,SAAI,eAAe,KAAK,KAAK,aAAa,IAAI,EAAG,OAAM,IAAI,QAAQ,kBAAkB;MACpF,MAAM;MACN,SAAS;MACT,CAAC;;;;;AAKN,SAAQ,2BAA2B;CACnC,SAAS,mBAAmB,OAAO;AAClC,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,IAAI,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,KAAI,MAAM,GAAG,OAAO,MAAM,GAAG,EAAE;AAChH,SAAM,OAAO,GAAG,EAAE;AAClB;;AAED,SAAO;;GAEN;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,aAAa;CACrB,MAAM,SAAS,gBAAgB;CAC/B,MAAM,UAAU,eAAe;CAC/B,MAAM,UAAU,eAAe;CAC/B,SAAS,WAAW,MAAM,QAAQ,QAAQ;EACzC,IAAI;EACJ,MAAM,QAAQ,KAAK,OAAO;AAC1B,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,WAAW,QAAQ,KAAK;GACjD,MAAM,MAAM,MAAM,WAAW;AAC7B,OAAI,IAAI,KAAK,GAAG,OAAO,KAAK,OAAO,mBAAmB;AACrD,aAAS,IAAI,OAAO,iBAAiB,IAAI;AACzC,UAAM,WAAW,OAAO,GAAG,EAAE;AAC7B;;;AAGF,MAAI,CAAC,OAAQ,QAAO,EAAE;;AAEtB,MAAI,OAAO,4BAA4B,WAAW,EAAG,QAAO,EAAE;EAC9D,MAAM,UAAU,IAAI,OAAO,YAAY;EACvC,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,OAAO,UAAU;AACjE,UAAQ,WAAW,SAAS;EAC5B,MAAM,MAAM,MAAM,eAAe,OAAO;AACxC,UAAQ,aAAa,IAAI,OAAO;AAChC,UAAQ,WAAW,IAAI;AACvB,SAAO,OAAO,4BAA4B,KAAK,QAAQ;AACtD,OAAI,EAAE,GAAG,QAAQ,uBAAuB,QAAQ;IAC/C,OAAO,IAAI;IACX,YAAY,IAAI;IAChB,CAAC,CAAC,MAAM,QAAQ,IAAI,OAAO,QAAQ,QAAQ,IAAI,UAAU,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IAChG,MAAM;IACN,SAAS;IACT,CAAC;AACF,UAAO,IAAI;IACV;;GAED;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,kBAAkB;AAC1B,SAAQ,oBAAoB;CAC5B,MAAM,SAAS,gBAAgB;CAC/B,MAAM,UAAU,eAAe;CAC/B,MAAM,gBAAgB,qBAAqB;CAC3C,MAAM,QAAQ,aAAa;CAC3B,MAAM,uBAAuB;CAC7B,MAAM,uBAAuB;CAC7B,SAAS,gBAAgB,MAAM,YAAY,eAAe;EACzD,MAAM,MAAM,cAAc,UAAU,KAAK;AACzC,aAAW,SAAS,cAAc;AACjC,OAAI,CAAC,IAAI,SAAS,UAAU,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IACjE,MAAM;IACN,SAAS,0CAA0C,UAAU,aAAa;IAC1E,CAAC;IACD;AACF,SAAO,EAAE,KAAK,IAAI,WAAW;;CAE9B,SAAS,kBAAkB,MAAM,YAAY,eAAe;EAC3D,IAAI,OAAO,EAAE;AACb,aAAW,SAAS,cAAc;AACjC,WAAQ,GAAG,cAAc,wBAAwB,WAAW,MAAM,cAAc,uBAAuB;IACtG;AACF,SAAO;GACN,OAAO,GAAG,MAAM,YAAY,KAAK,IAAI,KAAK,IAAI,cAAc,OAAO;GACnE,QAAQ,UAAU,KAAK,GAAG;GAC1B;;CAEF,SAAS,UAAU,MAAM;EACxB,IAAI;EACJ,MAAM,kBAAkB,KAAK,UAAU,qBAAqB;;AAE5D,MAAI,gBAAiB,UAAS,gBAAgB,SAAS,OAAO,IAAI,MAAM,SAAS,QAAQ;MACpF,UAAS,KAAK,UAAU,qBAAqB,EAAE,MAAM,SAAS,QAAQ;EAC3E,MAAM,OAAO,KAAK,WAAW,KAAK,QAAQ;AACzC,UAAO;IACN,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,EAAE;IACvD,OAAO,IAAI,KAAK,IAAI,KAAK,SAAS,GAAG;IACrC;IACA;EACF,MAAM,WAAW;GAChB,YAAY,EAAE,QAAQ;GACtB,wBAAwB,KAAK;GAC7B;GACA;AACD,SAAO;GACN,KAAK,OAAO,OAAO,gBAAgB,KAAK,UAAU;GAClD;GACA;;GAEA;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,+BAA+B;AACvC,SAAQ,mBAAmB;AAC3B,SAAQ,aAAa;CACrB,MAAM,UAAU,eAAe;CAC/B,SAAS,6BAA6B,gBAAgB,gBAAgB;AACrE,MAAI,mBAAmB,KAAK,KAAK,CAAC,eAAe,MAAM,eAAe,CAAE,OAAM,IAAI,QAAQ,YAAY;GACrG,MAAM;GACN,SAAS,yCAAyC,eAAe,QAAQ;GACzE,CAAC;;CAEH,SAAS,iBAAiB,kBAAkB,mBAAmB,EAAE,EAAE;EAClE,IAAI;AACJ,OAAK,OAAO,iBAAkB,KAAI,iBAAiB,SAAS,iBAAiB,KAAM,OAAM,IAAI,QAAQ,YAAY;GAChH,MAAM;GACN,SAAS,4CAA4C,IAAI,GAAG,iBAAiB,KAAK,QAAQ,IAAI,GAAG,iBAAiB;GAClH,CAAC;;CAEH,SAAS,WAAW,YAAY,aAAa,EAAE,EAAE;AAChD,OAAK,MAAM,aAAa,WAAY,KAAI,CAAC,WAAW,MAAM,cAAc,UAAU,UAAU,KAAK,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,MAAM,OAAO,UAAU,MAAM,CAAC,EAAE;GACpK,MAAM,MAAM,UAAU,KAAK,GAAG,KAAK,IAAI,IAAI;AAC3C,SAAM,IAAI,QAAQ,YAAY;IAC7B,MAAM;IACN,SAAS,+CAA+C;IACxD,CAAC;;;CAGJ,SAAS,UAAU,GAAG,GAAG;AACxB,MAAI,MAAM,KAAK,KAAK,MAAM,KAAK,EAAG,QAAO;AACzC,SAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,MAAM,EAAE,GAAG;;GAE5D;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,yBAAyB;CACjC,MAAM,SAAS,gBAAgB;CAC/B,MAAM,UAAU,eAAe;CAC/B,MAAM,gBAAgB,qBAAqB;CAC3C,MAAM,UAAU,eAAe;CAC/B,SAAS,uBAAuB,WAAW,MAAM,sBAAsB;EACtE,MAAM,cAAc,UAAU;AAC9B,0BAAwB,GAAG,QAAQ,uBAAuB,sBAAsB,YAAY;AAC5F,yBAAuB,2BAA2B,sBAAsB;GACvE,cAAc,UAAU;GACxB,QAAQ,UAAU;GAClB,CAAC;AACF,MAAI,CAAC,qBAAqB,MAAM,OAAO;AACtC,OAAI;AACH,yBAAqB,WAAW,MAAM,GAAG;AACzC,WAAO;YACC,GAAG;AACX,WAAO;;IAEP,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GACvC,MAAM;GACN,SAAS;GACT,CAAC;;CAEH,SAAS,qBAAqB,WAAW,MAAM,IAAI;EAClD,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG;EAC1B,MAAM,aAAa,OAAO,OAAO,gBAAgB,KAAK,UAAU;EAChE,MAAM,cAAc,UAAU;AAC9B,MAAI;AACH,OAAI,cAAc,yBAAyB;IAC1C,eAAe;IACf,cAAc;IACd,WAAW;IACX,CAAC,CAAC,QAAQ;WACH,GAAG;AACX,SAAM,IAAI,QAAQ,kBAAkB;IACnC,MAAM;IACN,SAAS;IACT,CAAC;;AAEH,YAAU,OAAO,MAAM,WAAW;;CAEnC,SAAS,2BAA2B,sBAAsB,UAAU;AACnE,SAAO,qBAAqB,QAAQ,OAAO,GAAG,UAAU,SAAS,KAAK,OAAO,OAAO,YAAY,GAAG,UAAU,GAAG,cAAc,SAAS,aAAa,IAAI,OAAO,OAAO,YAAY,GAAG,UAAU,GAAG,QAAQ,SAAS,OAAO,CAAC;;GAE1N;AAIH,IAAI,oBAAoC,gCAAgB,YAAY;AACnE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,kBAAkB;AAC1B,SAAQ,mBAAmB;CAC3B,MAAM,QAAQ,aAAa;CAC3B,SAAS,gBAAgB,WAAW,MAAM,sBAAsB;AAC/D,GAAC,GAAG,MAAM,wBAAwB,WAAW,MAAM,qBAAqB;AACxE,SAAO;GACN,MAAM;GACN,OAAO,UAAU;GACjB,WAAW,UAAU;GACrB;;CAEF,SAAS,iBAAiB,OAAO;AAChC,MAAI,CAAC,MAAM,iBAAkB;AAC7B,SAAO;GACN,MAAM;GACN,OAAO,MAAM,MAAM;GACnB,2BAA2B,IAAI,KAAK,OAAO,MAAM,eAAe,GAAG,IAAI;GACvE;;GAEA;AAIH,IAAI,qBAAqC,gCAAgB,YAAY;AACpE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,YAAY,QAAQ,WAAW,QAAQ,YAAY,KAAK;CAChE,MAAM,oBAAoB,yBAAyB;AACnD,SAAQ,YAAY;EACnB,SAAS,QAAQ;AAChB,UAAO,EAAE,UAAU,MAAM,OAAO,SAAS,GAAG,OAAO,KAAK,gBAAgB,OAAO,SAAS,CAAC,GAAG,OAAO,MAAM,EAAE,EAAE;;EAE9G,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,WAAW,EAAG,KAAI,WAAW,gBAAgB,QAAQ,SAAS;AACnF,UAAO;;EAER;AACD,SAAQ,WAAW;EAClB,SAAS,QAAQ;AAChB,UAAO;IACN,UAAU,MAAM,OAAO,UAAU,GAAG;KACnC,OAAO;KACP,WAAW,QAAQ,UAAU,SAAS,OAAO,UAAU;KACvD,GAAG,MAAM,OAAO,gBAAgB,GAAG;KACnC,OAAO;KACP,iBAAiB,kBAAkB,gBAAgB,SAAS,OAAO,gBAAgB;KACnF,GAAG,KAAK;IACT,YAAY,MAAM,OAAO,WAAW,IAAI,GAAG,kBAAkB,0BAA0B,OAAO,WAAW,GAAG;IAC5G;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,UAAU,UAAU,YAAa,KAAI,YAAY,QAAQ,UAAU,OAAO,QAAQ,SAAS,UAAU;YACxG,QAAQ,UAAU,UAAU,kBAAmB,KAAI,kBAAkB,kBAAkB,gBAAgB,OAAO,QAAQ,SAAS,gBAAgB;AACxJ,OAAI,QAAQ,eAAe,EAAG,KAAI,cAAc,GAAG,kBAAkB,wBAAwB,QAAQ,WAAW;AAChH,UAAO;;EAER;AACD,SAAQ,YAAY;EACnB,SAAS,QAAQ;AAChB,UAAO;IACN,SAAS,MAAM,OAAO,QAAQ,GAAG,OAAO,KAAK,gBAAgB,OAAO,QAAQ,CAAC,GAAG,OAAO,MAAM,EAAE;IAC/F,UAAU,MAAM,OAAO,SAAS,GAAG,QAAQ,SAAS,SAAS,OAAO,SAAS,GAAG,KAAK;IACrF;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,QAAQ,WAAW,EAAG,KAAI,UAAU,gBAAgB,QAAQ,QAAQ;AAChF,OAAI,QAAQ,aAAa,KAAK,EAAG,KAAI,WAAW,QAAQ,SAAS,OAAO,QAAQ,SAAS;AACzF,UAAO;;EAER;CACD,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,KAAK,WAAW,OAAO,KAAK,KAAK,SAAS,CAAC;;CAE9D,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,OAAO,KAAK,IAAI,CAAC,SAAS,SAAS;;CAEtD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,mBAAmB,QAAQ,kBAAkB,KAAK;CAC1D,MAAM,aAAa,kBAAkB;CACrC,MAAM,oBAAoB,yBAAyB;CACnD,MAAM,aAAa,oBAAoB;AACvC,SAAQ,kBAAkB;EACzB,SAAS,QAAQ;AAChB,UAAO;IACN,UAAU,MAAM,OAAO,SAAS,GAAG,WAAW,SAAS,SAAS,OAAO,SAAS,GAAG,KAAK;IACxF,WAAW,WAAW,MAAM,QAAQ,QAAQ,UAAU,GAAG,OAAO,UAAU,KAAK,MAAM,WAAW,SAAS,SAAS,EAAE,CAAC,GAAG,EAAE;IAC1H;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,aAAa,KAAK,EAAG,KAAI,WAAW,WAAW,SAAS,OAAO,QAAQ,SAAS;AAC5F,OAAI,QAAQ,WAAW,OAAQ,KAAI,YAAY,QAAQ,UAAU,KAAK,MAAM,WAAW,SAAS,OAAO,EAAE,CAAC;AAC1G,UAAO;;EAER;AACD,SAAQ,mBAAmB;EAC1B,SAAS,QAAQ;AAChB,UAAO;IACN,aAAa,MAAM,OAAO,YAAY,GAAG,kBAAkB,WAAW,SAAS,OAAO,YAAY,GAAG,KAAK;IAC1G,YAAY,WAAW,MAAM,QAAQ,QAAQ,WAAW,GAAG,OAAO,WAAW,KAAK,MAAM,WAAW,UAAU,SAAS,EAAE,CAAC,GAAG,EAAE;IAC9H;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,gBAAgB,KAAK,EAAG,KAAI,cAAc,kBAAkB,WAAW,OAAO,QAAQ,YAAY;AAC9G,OAAI,QAAQ,YAAY,OAAQ,KAAI,aAAa,QAAQ,WAAW,KAAK,MAAM,WAAW,UAAU,OAAO,EAAE,CAAC;AAC9G,UAAO;;EAER;CACD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,yBAAyC,gCAAgB,YAAY;AACxE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,2BAA2B,QAAQ,0BAA0B,KAAK;CAC1E,MAAM,oBAAoB,yBAAyB;CACnD,MAAM,aAAa,oBAAoB;AACvC,SAAQ,0BAA0B;EACjC,SAAS,QAAQ;AAChB,UAAO;IACN,QAAQ,MAAM,OAAO,OAAO,GAAG,OAAO,KAAK,gBAAgB,OAAO,OAAO,CAAC,GAAG,OAAO,MAAM,EAAE;IAC5F,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,UAAU,SAAS,OAAO,UAAU,GAAG,KAAK;IAC5F;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,OAAO,WAAW,EAAG,KAAI,SAAS,gBAAgB,QAAQ,OAAO;AAC7E,OAAI,QAAQ,cAAc,KAAK,EAAG,KAAI,YAAY,WAAW,UAAU,OAAO,QAAQ,UAAU;AAChG,UAAO;;EAER;AACD,SAAQ,2BAA2B;EAClC,SAAS,QAAQ;AAChB,UAAO;IACN,MAAM,MAAM,OAAO,KAAK,GAAG,kBAAkB,WAAW,SAAS,OAAO,KAAK,GAAG,KAAK;IACrF,WAAW,MAAM,OAAO,UAAU,GAAG,WAAW,UAAU,SAAS,OAAO,UAAU,GAAG,KAAK;IAC5F;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,KAAK,EAAG,KAAI,OAAO,kBAAkB,WAAW,OAAO,QAAQ,KAAK;AACzF,OAAI,QAAQ,cAAc,KAAK,EAAG,KAAI,YAAY,WAAW,UAAU,OAAO,QAAQ,UAAU;AAChG,UAAO;;EAER;CACD,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,KAAK,WAAW,OAAO,KAAK,KAAK,SAAS,CAAC;;CAE9D,SAAS,gBAAgB,KAAK;AAC7B,SAAO,WAAW,OAAO,KAAK,IAAI,CAAC,SAAS,SAAS;;CAEtD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,gBAAgC,gCAAgB,YAAY;AAC/D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,qBAAqB,QAAQ,OAAO,QAAQ,QAAQ,KAAK;CACjE,MAAM,SAAS,gBAAgB;CAC/B,MAAM,iBAAiB,wBAAwB;AAC/C,SAAQ,QAAQ;EACf,SAAS,QAAQ;AAChB,UAAO;IACN,MAAM,MAAM,OAAO,KAAK,GAAG,WAAW,OAAO,OAAO,KAAK,GAAG;IAC5D,YAAY,MAAM,OAAO,WAAW,GAAG,WAAW,OAAO,OAAO,WAAW,GAAG;IAC9E,MAAM,MAAM,OAAO,KAAK,GAAG,QAAQ,KAAK,SAAS,OAAO,KAAK,GAAG,KAAK;IACrE;;EAEF,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,SAAS,GAAI,KAAI,OAAO,QAAQ;AAC5C,OAAI,QAAQ,eAAe,GAAI,KAAI,aAAa,QAAQ;AACxD,OAAI,QAAQ,SAAS,KAAK,EAAG,KAAI,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK;AACzE,UAAO;;EAER;AACD,SAAQ,OAAO;EACd,SAAS,QAAQ;AAChB,UAAO,EAAE,MAAM,MAAM,OAAO,iBAAiB,GAAG;IAC/C,OAAO;IACP,kBAAkB,eAAe,yBAAyB,SAAS,OAAO,iBAAiB;IAC3F,GAAG,MAAM,OAAO,SAAS,GAAG;IAC5B,OAAO;IACP,UAAU,OAAO,iBAAiB,SAAS,OAAO,SAAS;IAC3D,GAAG,KAAK,GAAG;;EAEb,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,MAAM,UAAU,mBAAoB,KAAI,mBAAmB,eAAe,yBAAyB,OAAO,QAAQ,KAAK,iBAAiB;YAC3I,QAAQ,MAAM,UAAU,WAAY,KAAI,WAAW,OAAO,iBAAiB,OAAO,QAAQ,KAAK,SAAS;AACjH,UAAO;;EAER;AACD,SAAQ,qBAAqB;EAC5B,SAAS,QAAQ;AAChB,UAAO,EAAE,MAAM,MAAM,OAAO,wBAAwB,GAAG;IACtD,OAAO;IACP,yBAAyB,eAAe,wBAAwB,SAAS,OAAO,wBAAwB;IACxG,GAAG,MAAM,OAAO,gBAAgB,GAAG;IACnC,OAAO;IACP,iBAAiB,OAAO,gBAAgB,SAAS,OAAO,gBAAgB;IACxE,GAAG,KAAK,GAAG;;EAEb,OAAO,SAAS;GACf,MAAM,MAAM,EAAE;AACd,OAAI,QAAQ,MAAM,UAAU,0BAA2B,KAAI,0BAA0B,eAAe,wBAAwB,OAAO,QAAQ,KAAK,wBAAwB;YAC/J,QAAQ,MAAM,UAAU,kBAAmB,KAAI,kBAAkB,OAAO,gBAAgB,OAAO,QAAQ,KAAK,gBAAgB;AACrI,UAAO;;EAER;CACD,SAAS,MAAM,OAAO;AACrB,SAAO,UAAU,QAAQ,UAAU,KAAK;;GAEvC;AAIH,IAAI,aAA6B,gCAAgB,YAAY;CAC5D,IAAI,kBAAkB,WAAW,QAAQ,oBAAoB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AACnG,MAAI,OAAO,KAAK,EAAG,MAAK;EACxB,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAAe,QAAO;GACzF,YAAY;GACZ,KAAK,WAAW;AACf,WAAO,EAAE;;GAEV;AACD,SAAO,eAAe,GAAG,IAAI,KAAK;OAC7B,SAAS,GAAG,GAAG,GAAG,IAAI;AAC3B,MAAI,OAAO,KAAK,EAAG,MAAK;AACxB,IAAE,MAAM,EAAE;;CAEX,IAAI,eAAe,WAAW,QAAQ,gBAAgB,SAAS,GAAG,WAAW;AAC5E,OAAK,IAAI,KAAK,EAAG,KAAI,MAAM,aAAa,CAAC,OAAO,UAAU,eAAe,KAAK,WAAW,EAAE,CAAE,iBAAgB,WAAW,GAAG,EAAE;;AAE9H,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,cAAa,gBAAgB,EAAE,QAAQ;AACvC,cAAa,eAAe,EAAE,QAAQ;AACtC,cAAa,wBAAwB,EAAE,QAAQ;AAC/C,cAAa,oBAAoB,EAAE,QAAQ;GACzC;AAIH,IAAI,eAA+B,gCAAgB,YAAY;AAC9D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,sBAAsB,KAAK;AACnC,SAAQ,qBAAqB;AAC7B,SAAQ,uBAAuB;CAC/B,MAAM,UAAU,eAAe;AAC/B,SAAQ,sBAAsB;CAC9B,SAAS,mBAAmB,WAAW,SAAS;AAC/C,UAAQ,UAAU,YAAlB;GACC,KAAK,QAAQ,oBAAqB,QAAO,sBAAsB,WAAW,QAAQ;GAClF,QAAS,OAAM,IAAI,QAAQ,kBAAkB;IAC5C,MAAM;IACN,SAAS,6BAA6B,UAAU;IAChD,CAAC;;;CAGJ,SAAS,qBAAqB,WAAW,SAAS;EACjD,MAAM,OAAO,UAAU,MAAM;AAC7B,MAAI,CAAC,KAAM,OAAM,IAAI,QAAQ,kBAAkB;GAC9C,MAAM;GACN,SAAS;GACT,CAAC;AACF,UAAQ,KAAK,OAAb;GACC,KAAK,WAAY,QAAO,sBAAsB,KAAK,UAAU,QAAQ;GACrE,QAAS,OAAM,IAAI,QAAQ,kBAAkB;IAC5C,MAAM;IACN,SAAS,wBAAwB,KAAK;IACtC,CAAC;;;CAGJ,SAAS,sBAAsB,WAAW,SAAS;AAClD,MAAI,UAAU,KAAK,YAAY,WAAW,EAAG,OAAM,IAAI,QAAQ,kBAAkB;GAChF,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,UAAU,UAAU,KAAK,WAAW,GAAG;AAC7C,MAAI,CAAC,QAAQ,iBAAiB,OAAO,KAAK,SAAS,SAAS,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAClG,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,WAAW,UAAU,KAAK,aAAa,SAAS;AACtD,MAAI,CAAC,QAAQ,cAAc,OAAO,KAAK,UAAU,MAAM,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAC7F,MAAM;GACN,SAAS;GACT,CAAC;;CAEH,SAAS,sBAAsB,MAAM,SAAS;AAC7C,MAAI,KAAK,YAAY,WAAW,EAAG,OAAM,IAAI,QAAQ,kBAAkB;GACtE,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,UAAU,KAAK,WAAW,GAAG;AACnC,MAAI,CAAC,QAAQ,iBAAiB,QAAQ,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAC3E,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,WAAW,KAAK,aAAa,UAAU,OAAO,KAAK,GAAG;AAC5D,MAAI,CAAC,QAAQ,cAAc,SAAS,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GACzE,MAAM;GACN,SAAS;GACT,CAAC;;GAED;AAIH,IAAI,uBAAuC,gCAAgB,YAAY;AACtE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,8BAA8B,KAAK;AAC3C,SAAQ,6BAA6B;AACrC,SAAQ,+BAA+B;CACvC,MAAM,UAAU,eAAe;AAC/B,SAAQ,8BAA8B;CACtC,SAAS,2BAA2B,WAAW,SAAS;AACvD,UAAQ,UAAU,YAAlB;GACC,KAAK,QAAQ,4BAA6B,QAAO,8BAA8B,WAAW,QAAQ;GAClG,QAAS,OAAM,IAAI,QAAQ,kBAAkB;IAC5C,MAAM;IACN,SAAS,qCAAqC,UAAU;IACxD,CAAC;;;CAGJ,SAAS,6BAA6B,WAAW,SAAS;EACzD,MAAM,OAAO,UAAU,MAAM;AAC7B,MAAI,CAAC,KAAM,OAAM,IAAI,QAAQ,kBAAkB;GAC9C,MAAM;GACN,SAAS;GACT,CAAC;AACF,UAAQ,KAAK,OAAb;GACC,KAAK,mBAAoB,QAAO,8BAA8B,KAAK,kBAAkB,QAAQ;GAC7F,QAAS,OAAM,IAAI,QAAQ,kBAAkB;IAC5C,MAAM;IACN,SAAS,wBAAwB,KAAK;IACtC,CAAC;;;CAGJ,SAAS,8BAA8B,WAAW,SAAS;EAC1D,MAAM,UAAU,UAAU,KAAK,UAAU,WAAW;AACpD,MAAI,CAAC,QAAQ,iBAAiB,OAAO,KAAK,SAAS,SAAS,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAClG,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,aAAa,UAAU,KAAK,KAAK,MAAM,SAAS;AACtD,MAAI,CAAC,QAAQ,oBAAoB,OAAO,KAAK,YAAY,MAAM,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GACrG,MAAM;GACN,SAAS;GACT,CAAC;;CAEH,SAAS,8BAA8B,MAAM,SAAS;EACrD,MAAM,UAAU,KAAK,WAAW,WAAW,OAAO,KAAK,GAAG;AAC1D,MAAI,CAAC,QAAQ,iBAAiB,QAAQ,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAC3E,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,WAAW,KAAK,MAAM,UAAU,OAAO,KAAK,GAAG;AACrD,MAAI,CAAC,QAAQ,oBAAoB,SAAS,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAC/E,MAAM;GACN,SAAS;GACT,CAAC;;GAED;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,uBAAuB;CAC/B,MAAM,UAAU,eAAe;CAC/B,SAAS,qBAAqB,WAAW,SAAS;AACjD,UAAQ,UAAU,YAAlB;GACC,KAAK,QAAS,QAAO,wBAAwB,WAAW,QAAQ;GAChE,QAAS,OAAM,IAAI,QAAQ,kBAAkB;IAC5C,MAAM;IACN,SAAS,+BAA+B,UAAU;IAClD,CAAC;;;CAGJ,SAAS,wBAAwB,WAAW,SAAS;AACpD,MAAI,UAAU,KAAK,QAAQ,SAAS,YAAY,WAAW,EAAG,OAAM,IAAI,QAAQ,kBAAkB;GACjG,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,UAAU,aAAa,UAAU,KAAK,QAAQ,SAAS,WAAW,GAAG,IAAI;AAC/E,MAAI,CAAC,QAAQ,iBAAiB,OAAO,KAAK,SAAS,SAAS,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAClG,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,WAAW,UAAU,KAAK,QAAQ,aAAa,SAAS;AAC9D,MAAI,CAAC,QAAQ,cAAc,OAAO,KAAK,UAAU,MAAM,CAAC,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAC7F,MAAM;GACN,SAAS;GACT,CAAC;;CAEH,SAAS,aAAa,KAAK;AAC1B,SAAO,OAAO,KAAK,KAAK,SAAS,CAAC,SAAS,QAAQ;;GAElD;AAIH,IAAI,qBAAqC,gCAAgB,YAAY;AACpE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,gBAAgB,KAAK;AAC7B,SAAQ,mBAAmB;CAC3B,MAAM,SAAS,gBAAgB;CAC/B,MAAM,UAAU,eAAe;CAC/B,MAAM,uBAAuB;CAC7B,MAAM,kBAAkB;CACxB,SAAS,iBAAiB,OAAO,OAAO;EACvC,MAAM,iBAAiB,MAAM;EAC7B,MAAM,aAAa,WAAW,WAAW,eAAe,WAAW,SAAS;EAC5E,MAAM,aAAa,cAAc,WAAW,WAAW,KAAK;AAC5D,MAAI,CAAC,iBAAiB,YAAY,MAAM,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GAC7E,MAAM;GACN,SAAS;GACT,CAAC;AACF,SAAO;;CAER,SAAS,iBAAiB,YAAY,OAAO;EAC5C,MAAM,OAAO,OAAO,KAAK,WAAW,MAAM,QAAQ;AAClD,SAAO,WAAW,WAAW,MAAM,cAAc;GAChD,MAAM,OAAO,MAAM,MAAM,SAAS,OAAO,OAAO,YAAY,KAAK,MAAM,SAAS,GAAG,EAAE,EAAE,UAAU,QAAQ,IAAI,KAAK,QAAQ,MAAM,UAAU,KAAK,CAAC;AAChJ,OAAI,CAAC,KAAM,QAAO;AAClB,UAAO,OAAO,OAAO,OAAO,MAAM,KAAK,WAAW,UAAU,UAAU;IACrE;;CAEH,IAAI,aAAa,MAAM,WAAW;EACjC;EACA;EACA,YAAY,MAAM,YAAY;AAC7B,QAAK,OAAO;AACZ,QAAK,aAAa;;EAEnB,OAAO,WAAW,UAAU;AAC3B,OAAI,CAAC,SAAS,SAAS,qBAAqB,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IACjF,MAAM;IACN,SAAS;IACT,CAAC;GACF,MAAM,QAAQ,SAAS,QAAQ,qBAAqB;GACpD,MAAM,SAAS,SAAS,MAAM,GAAG,QAAQ,EAAE;GAC3C,MAAM,UAAU,SAAS,MAAM,QAAQ,EAAE,CAAC,SAAS,gBAAgB;GACnE,MAAM,aAAa,MAAM,KAAK,UAAU,UAAU;IACjD,MAAM,GAAG,MAAM,aAAa;IAC5B,MAAM,WAAW,OAAO,KAAK,WAAW,SAAS;AACjD,QAAI,SAAS,SAAS,EAAG,OAAM,IAAI,QAAQ,kBAAkB;KAC5D,MAAM;KACN,SAAS;KACT,CAAC;AACF,WAAO;KACN;KACA,SAAS,SAAS,SAAS,GAAG,EAAE;KAChC,WAAW,SAAS,SAAS,EAAE;KAC/B;KACA;AACF,OAAI,WAAW,WAAW,EAAG,OAAM,IAAI,QAAQ,kBAAkB;IAChE,MAAM;IACN,SAAS;IACT,CAAC;AACF,UAAO,IAAI,WAAW,QAAQ,WAAW;;;CAG3C,IAAI,gBAAgB,MAAM,cAAc;EACvC;EACA;EACA;EACA;EACA,YAAY,QAAQ,SAAS,SAAS,MAAM;AAC3C,QAAK,SAAS;AACd,QAAK,UAAU;AACf,QAAK,UAAU;AACf,QAAK,OAAO;;EAEb,OAAO,WAAW,MAAM;GACvB,MAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,KAAK;AACxC,OAAI,MAAM,SAAS,EAAG,OAAM,IAAI,QAAQ,kBAAkB;IACzD,MAAM;IACN,SAAS;IACT,CAAC;GACF,MAAM,SAAS,MAAM;AACrB,UAAO,IAAI,cAAc,QAAQ,OAAO,MAAM,GAAG,EAAE,OAAO,KAAK,MAAM,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,CAAC;;;AAGrG,SAAQ,gBAAgB;GACtB;AAIH,IAAI,iBAAiC,gCAAgB,YAAY;AAChE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,wBAAwB;CAChC,MAAM,SAAS,gBAAgB;CAC/B,MAAM,UAAU,eAAe;CAC/B,MAAM,2BAA2B,OAAO,KAAK,CAAC,EAAE,CAAC;CACjD,MAAM,2BAA2B,OAAO,KAAK,CAAC,EAAE,CAAC;CACjD,SAAS,sBAAsB,OAAO,YAAY;EACjD,MAAM,iBAAiB,MAAM;EAC7B,MAAM,WAAW,OAAO,eAAe,SAAS;EAChD,MAAM,WAAW,OAAO,WAAW,QAAQ;AAC3C,MAAI,WAAW,MAAM,YAAY,SAAU,OAAM,IAAI,QAAQ,kBAAkB;GAC9E,MAAM;GACN,SAAS,kBAAkB;GAC3B,CAAC;EACF,MAAM,EAAE,OAAO,WAAW,gBAAgB,UAAU,SAAS;AAC7D,MAAI,eAAe,OAAO,WAAW,QAAQ,OAAQ,OAAM,IAAI,QAAQ,kBAAkB;GACxF,MAAM;GACN,SAAS;GACT,CAAC;EACF,MAAM,cAAc,eAAe,OAAO,MAAM,GAAG,MAAM;EACzD,MAAM,eAAe,eAAe,OAAO,MAAM,MAAM;EACvD,MAAM,iBAAiB,iBAAiB,WAAW,SAAS,MAAM,kBAAkB,EAAE,aAAa,SAAS,EAAE,aAAa;AAC3H,MAAI,CAAC,OAAO,OAAO,YAAY,gBAAgB,WAAW,QAAQ,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GACvG,MAAM;GACN,SAAS;GACT,CAAC;;CAEH,SAAS,gBAAgB,OAAO,MAAM;EACrC,MAAM,QAAQ,eAAe,OAAO,KAAK;AACzC,SAAO;GACN;GACA,QAAQ,UAAU,SAAS,OAAO,MAAM,CAAC;GACzC;;CAEF,SAAS,WAAW,MAAM,QAAQ,OAAO;AACxC,SAAO,OAAO,QAAQ,KAAK,GAAG,MAAM;AACnC,OAAI,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,CAAE,QAAO,aAAa,GAAG,IAAI;OAC1D,QAAO,aAAa,KAAK,EAAE;KAC9B,KAAK;;CAET,SAAS,iBAAiB,MAAM,QAAQ;AACvC,SAAO,OAAO,QAAQ,KAAK,MAAM,aAAa,GAAG,IAAI,EAAE,KAAK;;CAE7D,SAAS,eAAe,OAAO,MAAM;AACpC,SAAO,UAAU,QAAQ,OAAO,OAAO,EAAE,CAAC;;CAE3C,SAAS,UAAU,KAAK;AACvB,SAAO,IAAI,SAAS,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS;;CAE5C,SAAS,UAAU,GAAG;AACrB,MAAI,MAAM,GAAI,QAAO;AACrB,SAAO,EAAE,SAAS,EAAE,CAAC;;CAEtB,SAAS,aAAa,MAAM,OAAO;AAClC,SAAO,OAAO,OAAO,OAAO,UAAU,0BAA0B,MAAM,MAAM;;CAE7E,SAAS,SAAS,MAAM;AACvB,SAAO,OAAO,OAAO,OAAO,UAAU,0BAA0B,KAAK;;GAEpE;AAIH,IAAI,cAA8B,gCAAgB,YAAY;AAC7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,gBAAgB;CACxB,MAAM,SAAS,gBAAgB;CAC/B,MAAM,UAAU,eAAe;CAC/B,MAAM,UAAU,eAAe;CAC/B,SAAS,cAAc,OAAO,OAAO;AACpC,MAAI,EAAE,GAAG,QAAQ,uBAAuB,OAAO;GAC9C,OAAO,MAAM,MAAM;GACnB,4BAA4B,IAAI,KAAK,OAAO,MAAM,eAAe,GAAG,IAAI;GACxE,CAAC,CAAC,MAAM,SAAS;GACjB,MAAM,UAAU,sBAAsB,MAAM;GAC5C,MAAM,OAAO,OAAO,KAAK,OAAO,KAAK,aAAa,QAAQ,EAAE,OAAO;GACnE,MAAM,YAAY,MAAM,iBAAiB;AACzC,UAAO,OAAO,OAAO,OAAO,MAAM,KAAK,WAAW,UAAU;IAC3D,CAAE,OAAM,IAAI,QAAQ,kBAAkB;GACvC,MAAM;GACN,SAAS;GACT,CAAC;;CAEH,SAAS,sBAAsB,OAAO;EACrC,MAAM,EAAE,gBAAgB,UAAU,OAAO,sBAAsB;AAC/D,SAAO;GACN,MAAM,kBAAkB,SAAS,SAAS;GAC1C,gBAAgB,OAAO,eAAe;GACtC,UAAU,OAAO,SAAS;GAC1B,OAAO,MAAM,MAAM,SAAS,MAAM;GAClC;;GAEA;AAIH,IAAI,eAA+B,gCAAgB,YAAY;AAC9D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,iBAAiB;AACzB,SAAQ,sBAAsB;CAC9B,MAAM,OAAO,YAAY;CACzB,MAAM,UAAU,eAAe;CAC/B,MAAM,SAAS,cAAc;CAC7B,MAAM,iBAAiB,sBAAsB;CAC7C,MAAM,WAAW,gBAAgB;CACjC,MAAM,eAAe,oBAAoB;CACzC,MAAM,WAAW,gBAAgB;CACjC,MAAM,QAAQ,aAAa;CAC3B,SAAS,eAAe,OAAO,YAAY;EAC1C,MAAM,EAAE,MAAM,YAAY,MAAM;EAChC,MAAM,OAAO,KAAK,MAAM,MAAM,kBAAkB,SAAS,OAAO,CAAC;AACjE,MAAI,SAAS,KAAK,QAAQ,YAAY,KAAK,WAAY,OAAM,IAAI,QAAQ,kBAAkB;GAC1F,MAAM;GACN,SAAS,qCAAqC,KAAK,GAAG,QAAQ,cAAc,KAAK,KAAK,GAAG,KAAK;GAC9F,CAAC;AACF,UAAQ,MAAR;GACC,KAAK,OAAQ,KAAI,WAAW,OAAO,oBAAqB,SAAQ,GAAG,OAAO,oBAAoB,MAAM,WAAW;QAC1G;IACJ,MAAM,eAAe,KAAK,MAAM,SAAS,KAAK;AAC9C,YAAQ,GAAG,OAAO,sBAAsB,cAAc,WAAW;;GAElE,KAAK,SAAU,SAAQ,GAAG,SAAS,sBAAsB,MAAM,WAAW;GAC1E,KAAK,eAAgB,KAAI,WAAW,eAAe,4BAA6B,SAAQ,GAAG,eAAe,4BAA4B,MAAM,WAAW;QAClJ;IACJ,MAAM,eAAe,KAAK,MAAM,SAAS,KAAK;AAC9C,YAAQ,GAAG,eAAe,8BAA8B,cAAc,WAAW;;GAElF,QAAS,OAAM,IAAI,QAAQ,kBAAkB;IAC5C,MAAM;IACN,SAAS,qBAAqB;IAC9B,CAAC;;;CAGJ,SAAS,oBAAoB,OAAO,iBAAiB;EACpD,IAAI,oBAAoB;AACxB,MAAI,gCAAgC,MAAM,EAAE;AAC3C,IAAC,GAAG,MAAM,eAAe,OAAO,gBAAgB;AAChD,uBAAoB;;AAErB,MAAI,8BAA8B,MAAM,EAAE;GACzC,MAAM,cAAc,GAAG,aAAa,kBAAkB,OAAO,gBAAgB;AAC7E,IAAC,GAAG,SAAS,uBAAuB,OAAO,WAAW;AACtD,uBAAoB;;AAErB,MAAI,CAAC,kBAAmB,OAAM,IAAI,QAAQ,kBAAkB;GAC3D,MAAM;GACN,SAAS;GACT,CAAC;;CAEH,SAAS,gCAAgC,OAAO;AAC/C,SAAO,MAAM,qBAAqB,KAAK;;CAExC,SAAS,8BAA8B,OAAO;AAC7C,SAAO,MAAM,mBAAmB,KAAK;;GAEpC;AAIH,IAAI,mBAAmC,gCAAgB,YAAY;AAClE,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,WAAW,KAAK;CACxB,MAAM,SAAS,UAAU,OAAO;CAChC,MAAM,UAAU,eAAe;CAC/B,MAAM,QAAQ,aAAa;CAC3B,MAAM,WAAW,gBAAgB;CACjC,MAAM,cAAc,mBAAmB;CACvC,MAAM,SAAS,cAAc;CAC7B,IAAI,WAAW,MAAM;EACpB;EACA;EACA,YAAY,eAAe,UAAU,EAAE,EAAE;AACxC,QAAK,gBAAgB;AACrB,QAAK,UAAU;IACd,gBAAgB,QAAQ,kBAAkB;IAC1C,eAAe,QAAQ,iBAAiB;IACxC,oBAAoB,QAAQ,sBAAsB,QAAQ,gBAAgB;IAC1E,cAAc;IACd;;EAEF,OAAO,QAAQ,QAAQ;GACtB,MAAM,aAAa,KAAK,iBAAiB,OAAO;GAChD,MAAM,SAAS,KAAK,iBAAiB,QAAQ,WAAW;AACxD,QAAK,YAAY,OAAO;AACxB,QAAK,gBAAgB,QAAQ,OAAO;AACpC,OAAI,OAAQ,MAAK,aAAa,QAAQ,OAAO,YAAY,EAAE,CAAC;AAC5D,UAAO;;EAER,iBAAiB,QAAQ;GACxB,MAAM,aAAa,EAAE;AACrB,QAAK,MAAM,aAAa,OAAO,WAAY,SAAQ,UAAU,OAAlB;IAC1C,KAAK;AACJ,gBAAW,MAAM,GAAG,YAAY,iBAAiB,UAAU,WAAW,OAAO,UAAU,WAAW,KAAK,cAAc,qBAAqB,CAAC;AAC3I;IACD,KAAK,oBAAoB;KACxB,MAAM,UAAU,GAAG,YAAY,kBAAkB,UAAU,UAAU;AACrE,SAAI,OAAQ,YAAW,KAAK,OAAO;AACnC;;;AAGF,OAAI,cAAc,WAAW,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IAClE,MAAM;IACN,SAAS;IACT,CAAC;AACF,OAAI,WAAW,SAAS,KAAK,QAAQ,mBAAoB,OAAM,IAAI,QAAQ,kBAAkB;IAC5F,MAAM;IACN,SAAS,YAAY,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW;IACnF,CAAC;AACF,UAAO,WAAW,KAAK,MAAM,EAAE,UAAU;;EAE1C,iBAAiB,EAAE,OAAO,YAAY;AACrC,WAAQ,IAAI,OAAZ;IACC,KAAK,aAAc,SAAQ,GAAG,MAAM,iBAAiB,IAAI,MAAM,YAAY,KAAK,cAAc;IAC9F,KAAK,eAAe;KACnB,MAAM,UAAU,GAAG,MAAM,mBAAmB,IAAI,aAAa,YAAY,KAAK,cAAc;;AAE5F,SAAI,cAAc,OAAO,KAAK,CAAE,OAAM,IAAI,QAAQ,kBAAkB;MACnE,MAAM;MACN,SAAS;MACT,CAAC;AACF,SAAI,OAAO,KAAK,SAAS,KAAK,QAAQ,eAAgB,OAAM,IAAI,QAAQ,kBAAkB;MACzF,MAAM;MACN,SAAS,YAAY,KAAK,QAAQ,eAAe,aAAa,OAAO,KAAK;MAC1E,CAAC;AACF,YAAO,OAAO;;;;EAIjB,YAAY,EAAE,WAAW,SAAS,eAAe;GAChD,IAAI,YAAY;AAChB,eAAY,SAAS,UAAU;AAC9B;AACA,KAAC,GAAG,OAAO,qBAAqB,OAAO,KAAK,cAAc,MAAM;AAChE,KAAC,GAAG,OAAO,gBAAgB,OAAO,QAAQ;KACzC;AACF,OAAI,YAAY,KAAK,QAAQ,cAAe,OAAM,IAAI,QAAQ,kBAAkB;IAC/E,MAAM;IACN,SAAS,YAAY,KAAK,QAAQ,cAAc,qBAAqB;IACrE,CAAC;;EAEH,gBAAgB,QAAQ,QAAQ;AAC/B,OAAI,CAAC,OAAO,UAAU,gBAAgB,OAAO,IAAI,CAAE,OAAM,IAAI,QAAQ,kBAAkB;IACtF,MAAM;IACN,SAAS;IACT,CAAC;;EAEH,aAAa,QAAQ,UAAU;;AAE9B,OAAI,OAAO,uBAAwB,EAAC,GAAG,SAAS,8BAA8B,OAAO,wBAAwB,SAAS,uBAAuB;;AAE7I,OAAI,OAAO,WAAY,EAAC,GAAG,SAAS,kBAAkB,OAAO,YAAY,SAAS,WAAW;;AAE7F,OAAI,OAAO,KAAM,EAAC,GAAG,SAAS,YAAY,OAAO,MAAM,SAAS,KAAK;;;AAGvE,SAAQ,WAAW;CACnB,SAAS,cAAc,KAAK;AAC3B,OAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,MAAK,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,MAAK,GAAG,OAAO,mBAAmB,IAAI,IAAI,IAAI,GAAG,CAAE,QAAO;AACxI,SAAO;;GAEN;AA8CH,IAAI,iBA1C+B,gCAAgB,YAAY;AAC9D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,WAAW,QAAQ,kBAAkB,QAAQ,oBAAoB,QAAQ,cAAc,QAAQ,iBAAiB,KAAK;;CAE7H,IAAI,WAAW,gBAAgB;AAC/B,QAAO,eAAe,SAAS,kBAAkB;EAChD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,SAAS;;EAEjB,CAAC;CACF,IAAI,UAAU,eAAe;AAC7B,QAAO,eAAe,SAAS,eAAe;EAC7C,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,QAAQ;;EAEhB,CAAC;AACF,QAAO,eAAe,SAAS,qBAAqB;EACnD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,QAAQ;;EAEhB,CAAC;CACF,IAAI,UAAU,eAAe;AAC7B,QAAO,eAAe,SAAS,mBAAmB;EACjD,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,QAAQ;;EAEhB,CAAC;CACF,IAAI,aAAa,kBAAkB;AACnC,QAAO,eAAe,SAAS,YAAY;EAC1C,YAAY;EACZ,KAAK,WAAW;AACf,UAAO,WAAW;;EAEnB,CAAC;GACA,GAI+B;AAClC,IAAI,cAAc,gBAAgB;AAClC,IAAI,gBAAgB,gBAAgB;AACpC,MAAM,sBAAsB;;AAE5B,SAAS,0BAA0B,OAAO;AACzC,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,QAAQ,IAAI,KAAM,QAAO;EAC5G,IAAI,OAAO,IAAI;AACf,MAAI,SAAS,IAAK,QAAO,KAAK,QAAQ,qBAAqB,GAAG,IAAI;AAClE,SAAO,WAAW,IAAI,SAAS,aAAa,GAAG;SACxC;AACP,SAAO;;;AAMT,IAAI,kCAAkC;CACrC,WAAW;CACX,OAAO,CAAC;EACP,WAAW;EACX,iBAAiB;EACjB,aAAa;GACZ,YAAY;GACZ,cAAc;GACd,YAAY,EAAE,SAAS,wBAAwB;GAC/C;EACD,SAAS,EAAE,SAAS,gDAAgD;EACpE,EAAE;EACF,WAAW;EACX,iBAAiB;EACjB,aAAa;GACZ,YAAY;GACZ,cAAc;GACd,YAAY,EAAE,SAAS,wBAAwB;GAC/C;EACD,SAAS,EAAE,SAAS,gDAAgD;EACpE,CAAC;CACF,wBAAwB,CAAC;EACxB,WAAW;GACV,gBAAgB;GAChB,cAAc;GACd;EACD,OAAO;EACP,aAAa,EAAE,gBAAgB,CAAC,EAAE,YAAY,4qBAA4qB,CAAC,EAAE;EAC7tB,YAAY;GACX,SAAS;GACT,OAAO;GACP;EACD,EAAE;EACF,WAAW;GACV,gBAAgB;GAChB,cAAc;GACd;EACD,OAAO;EACP,aAAa,EAAE,gBAAgB,CAAC,EAAE,YAAY,wtBAAwtB,EAAE,EAAE,YAAY,wqBAAwqB,CAAC,EAAE;EACj8C,YAAY,EAAE,SAAS,wBAAwB;EAC/C,CAAC;CACF,QAAQ,CAAC;EACR,WAAW;EACX,iBAAiB;EACjB,aAAa;GACZ,YAAY;GACZ,cAAc;GACd,YAAY;IACX,SAAS;IACT,OAAO;IACP;GACD;EACD,SAAS,EAAE,SAAS,gDAAgD;EACpE,EAAE;EACF,WAAW;EACX,iBAAiB;EACjB,aAAa;GACZ,YAAY;GACZ,cAAc;GACd,YAAY,EAAE,SAAS,wBAAwB;GAC/C;EACD,SAAS,EAAE,SAAS,gDAAgD;EACpE,CAAC;CACF,sBAAsB,CAAC;EACtB,WAAW;GACV,gBAAgB;GAChB,cAAc;GACd;EACD,OAAO;EACP,aAAa,EAAE,gBAAgB,CAAC,EAAE,YAAY,4sBAA4sB,EAAE,EAAE,YAAY,wqBAAwqB,CAAC,EAAE;EACr7C,YAAY,EAAE,SAAS,wBAAwB;EAC/C,CAAC;CACF;AAID,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,6BAA6B;AACnC,MAAM,qBAAqB;AAC3B,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AACtB,MAAM,0BAA0B;AAChC,MAAM,aAAa;AACnB,MAAM,YAAY;AAClB,MAAM,SAAS;AACf,MAAM,gBAAgB;AACtB,MAAM,4BAA4B,IAAI,IAAI;CACzC,CAAC,UAAU,GAAG;CACd,CAAC,UAAU,GAAG;CACd,CAAC,UAAU,GAAG;CACd,CAAC;AACF,MAAM,UAAU,IAAI,YAAY,SAAS;CACxC,OAAO;CACP,WAAW;CACX,CAAC;AACF,MAAM,WAAW,IAAI,cAAc,UAAU,GAAG,cAAc,iBAAiB,cAAc,YAAY,SAAS,gCAAgC,CAAC,EAAE;CACpJ,eAAe;CACf,gBAAgB;CAChB,oBAAoB;CACpB,CAAC;AACF,IAAI,2BAA2B,MAAM;CACpC,MAAM,OAAO,OAAO;AACnB,MAAI;GACH,MAAM,WAAW,cAAc,MAAM;AACrC,OAAI,EAAE,MAAM,gBAAgB,SAAS,UAAU,SAAS,UAAU,SAAS,EAAE,QAAS,QAAO,cAAc;GAC3G,MAAM,mBAAmB,UAAU,SAAS,SAAS;GACrD,MAAM,WAAW,kBAAkB,eAAe,iBAAiB,EAAE,SAAS;GAC9E,MAAM,UAAU,GAAG,YAAY,gBAAgB,iBAAiB;AAChE,0BAAuB,SAAS,QAAQ,GAAG,cAAc,gBAAgB,OAAO,EAAE;IACjF,wBAAwB,kBAAkB,SAAS,UAAU,UAAU;IACvE,YAAY,EAAE,QAAQ,oBAAoB;IAC1C,CAAC,CAAC,UAAU,SAAS;AACtB,UAAO;IACN,SAAS;IACT,OAAO;KACN,eAAe;KACf,gBAAgB,SAAS;KACzB,kBAAkB,SAAS;KAC3B,WAAW,SAAS;KACpB,cAAc,SAAS;KACvB,aAAa,SAAS;KACtB,WAAW,SAAS;KACpB,cAAc,SAAS;KACvB;IACD;UACM;AACP,UAAO,cAAc;;;;AAIxB,SAAS,cAAc,OAAO;AAC7B,QAAO;EACN,UAAU,IAAI,WAAW,MAAM,SAAS;EACxC,WAAW;GACV,WAAW,MAAM,UAAU;GAC3B,UAAU,MAAM,UAAU;GAC1B,eAAe,MAAM,UAAU;GAC/B,kBAAkB,MAAM,UAAU;GAClC,KAAK,MAAM,UAAU;GACrB;EACD,gBAAgB,IAAI,WAAW,MAAM,eAAe;EACpD,iBAAiB,MAAM,iBAAiB,KAAK,WAAW,IAAI,WAAW,OAAO,CAAC;EAC/E,mBAAmB,MAAM;EACzB;;AAEF,SAAS,kBAAkB,OAAO;AACjC,QAAO,IAAI,MAAM,QAAQ,eAAe,OAAO,CAAC;;AAEjD,SAAS,UAAU,UAAU;AAC5B,QAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;;AAE5C,SAAS,eAAe,kBAAkB;CACzC,MAAM,SAAS,cAAc,iBAAiB;CAC9C,MAAM,YAAY,cAAc,OAAO,UAAU;AACjD,KAAI,cAAc,YAAY,yBAAyB,cAAc,YAAY,6BAA8B,OAAM,IAAI,MAAM,qCAAqC;AACpK,KAAI,sBAAsB,UAAU,EAAE,kBAAkB,QAAS,OAAM,IAAI,MAAM,2CAA2C;CAC5H,MAAM,WAAW,cAAc,OAAO,aAAa;AACnD,KAAI,cAAc,SAAS,YAAY,KAAK,kBAAmB,OAAM,IAAI,MAAM,gCAAgC;CAC/G,MAAM,YAAY,cAAc,KAAK,MAAM,QAAQ,OAAO,aAAa,cAAc,SAAS,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC1G,MAAM,gBAAgB,cAAc,UAAU,MAAM;CACpD,MAAM,gBAAgB,cAAc,UAAU,cAAc;AAC5D,KAAI,kBAAkB,kBAAkB,kBAAkB,kBAAkB,CAAC,MAAM,QAAQ,UAAU,QAAQ,CAAE,OAAM,IAAI,MAAM,mCAAmC;AAClK,QAAO;EACN,OAAO;EACP,SAAS,UAAU;EACnB;EACA,WAAW,cAAc,UAAU,UAAU;EAC7C;;AAEF,SAAS,kBAAkB,WAAW,OAAO;AAC5C,KAAI,MAAM,UAAU,kBAAkB,eAAgB,OAAM,IAAI,MAAM,0CAA0C;CAChH,MAAM,iBAAiB,wBAAwB,UAAU,SAAS,CAAC,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,EAAE,CAAC,CAAC;CACzH,MAAM,oBAAoB,kBAAkB,MAAM,kBAAkB;CACpE,MAAM,sBAAsB,kBAAkB,MAAM,UAAU,iBAAiB;CAC/E,MAAM,kBAAkB,cAAc,UAAU,UAAU,gBAAgB;AAC1E,KAAI,cAAc,gBAAgB,UAAU,KAAK,2BAA4B,OAAM,IAAI,MAAM,8BAA8B;CAC3H,MAAM,WAAW,cAAc,cAAc,gBAAgB,mBAAmB,CAAC,SAAS;CAC1F,MAAM,qBAAqB,kBAAkB,cAAc,SAAS,WAAW,CAAC;AAChF,KAAI,uBAAuB,uBAAuB,wBAAwB,kBAAmB,OAAM,IAAI,MAAM,+BAA+B;CAC5I,MAAM,eAAe,cAAc,SAAS,KAAK;CACjD,MAAM,cAAc,cAAc,SAAS,IAAI;AAC/C,KAAI,CAAC,wBAAwB,KAAK,aAAa,CAAE,OAAM,IAAI,MAAM,mCAAmC;AACpG,KAAI,CAAC,YAAY,WAAW,QAAQ,CAAE,OAAM,IAAI,MAAM,8BAA8B;CACpF,MAAM,YAAY,GAAG,mBAAmB,GAAG,aAAa,GAAG;AAC3D,KAAI,cAAc,MAAM,UAAU,UAAW,OAAM,IAAI,MAAM,6BAA6B;CAC1F,MAAM,eAAe,qBAAqB,cAAc,cAAc,gBAAgB,mBAAmB,CAAC,OAAO,CAAC,cAAc;CAChI,MAAM,aAAa,cAAc,UAAU,UAAU,WAAW;CAChE,MAAM,eAAe,gBAAgB,cAAc,cAAc,WAAW,SAAS,CAAC,aAAa,CAAC;AACpG,KAAI,cAAc,cAAc,WAAW,QAAQ,CAAC,GAAG,KAAK,kDAAmD,OAAM,IAAI,MAAM,0CAA0C;CACzK,MAAM,eAAe,gBAAgB;AACrC,KAAI,CAAC,MAAM,QAAQ,aAAa,CAAE,OAAM,IAAI,MAAM,8BAA8B;CAChF,MAAM,cAAc,OAAO,mBAAmB,GAAG;CACjD,MAAM,WAAW,aAAa,QAAQ,eAAe,cAAc,cAAc,WAAW,CAAC,IAAI,KAAK,YAAY;AAClH,KAAI,SAAS,WAAW,EAAG,OAAM,IAAI,MAAM,gCAAgC;CAC3E,MAAM,YAAY,cAAc,cAAc,cAAc,SAAS,GAAG,CAAC,OAAO,CAAC,UAAU;AAC3F,KAAI,CAAC,cAAc,KAAK,UAAU,CAAE,OAAM,IAAI,MAAM,4BAA4B;AAChF,QAAO;EACN;EACA,YAAY;EACZ;EACA;EACA;EACA;EACA;EACA;;AAEF,SAAS,wBAAwB,UAAU,iBAAiB;AAC3D,MAAK,MAAM,SAAS,UAAU;EAC7B,MAAM,SAAS,cAAc,cAAc,MAAM,CAAC,OAAO;AACzD,OAAK,MAAM,CAAC,WAAW,mBAAmB,2BAA2B;AACpE,OAAI,EAAE,aAAa,QAAS;GAC5B,MAAM,QAAQ,UAAU,cAAc,OAAO,WAAW,CAAC;AACzD,OAAI,MAAM,eAAe,eAAgB,OAAM,IAAI,MAAM,gCAAgC;GACzF,MAAM,UAAU,gBAAgB,MAAM,cAAc,mBAAmB,OAAO,UAAU,CAAC;AACzF,OAAI,QAAS,QAAO,IAAI,WAAW,QAAQ;;;AAG7C,OAAM,IAAI,MAAM,2BAA2B;;AAE5C,SAAS,uBAAuB,UAAU,UAAU;AACnD,KAAI,UAAU,2BAA2B,SAAS,aAAa,SAAS,YAAY,WAAW,mBAAoB,OAAM,IAAI,MAAM,gCAAgC;CACnK,MAAM,OAAO,SAAS,QAAQ,EAAE;CAChC,MAAM,SAAS,gBAAgB,MAAM,EAAE;CACvC,MAAM,iBAAiB,gBAAgB,MAAM,EAAE;CAC/C,MAAM,oBAAoB,gBAAgB,MAAM,GAAG;CACnD,MAAM,mBAAmB,kBAAkB,gBAAgB,MAAM,GAAG,CAAC;CACrE,MAAM,eAAe,gBAAgB,MAAM,GAAG;CAC9C,MAAM,YAAY,gBAAgB,MAAM,GAAG;CAC3C,MAAM,eAAe,gBAAgB,MAAM,GAAG;CAC9C,MAAM,iBAAiB,gBAAgB,MAAM,GAAG;CAChD,MAAM,oBAAoB,gBAAgB,MAAM,GAAG;CACnD,MAAM,eAAe,gBAAgB,MAAM,GAAG;AAC9C,KAAI,WAAW,sBAAsB,mBAAmB,SAAS,aAAa,mBAAmB,SAAS,aAAa,sBAAsB,SAAS,aAAa,iBAAiB,SAAS,aAAa,sBAAsB,SAAS,aAAa,qBAAqB,SAAS,cAAc,cAAc,SAAS,eAAe,iBAAiB,SAAS,gBAAgB,iBAAiB,SAAS,aAAc,OAAM,IAAI,MAAM,8CAA8C;;AAEzd,SAAS,gBAAgB,MAAM,QAAQ;CACtC,MAAM,cAAc,GAAG,oBAAoB;CAC3C,MAAM,UAAU,KAAK,QAAQ,SAAS,KAAK,KAAK,GAAG,KAAK,IAAI,KAAK,YAAY;AAC7E,KAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,2CAA2C;CACrF,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,CAAC,MAAO,OAAM,IAAI,MAAM,oCAAoC;AAChE,QAAO,oBAAoB,MAAM;;AAElC,SAAS,oBAAoB,OAAO;AACnC,KAAI,MAAM,OAAO,MAAM,MAAM,aAAa,EAAG,OAAM,IAAI,MAAM,2BAA2B;CACxF,MAAM,cAAc,MAAM;AAC1B,KAAI,gBAAgB,KAAK,EAAG,OAAM,IAAI,MAAM,2BAA2B;CACvE,IAAI,SAAS;CACb,IAAI;AACJ,KAAI,cAAc,IAAK,UAAS;MAC3B;EACJ,MAAM,cAAc,cAAc;AAClC,MAAI,gBAAgB,KAAK,cAAc,KAAK,MAAM,aAAa,IAAI,YAAa,OAAM,IAAI,MAAM,kCAAkC;AAClI,WAAS;AACT,OAAK,IAAI,QAAQ,GAAG,QAAQ,aAAa,SAAS,EAAG,UAAS,SAAS,OAAO,MAAM,SAAS,UAAU;AACvG,MAAI,SAAS,OAAO,gBAAgB,KAAK,SAAS,IAAK,OAAM,IAAI,MAAM,sCAAsC;AAC7G,YAAU;;AAEX,KAAI,WAAW,KAAK,SAAS,WAAW,MAAM,WAAY,OAAM,IAAI,MAAM,iCAAiC;AAC3G,QAAO,QAAQ,OAAO,MAAM,SAAS,OAAO,CAAC;;AAE9C,SAAS,kBAAkB,OAAO;CACjC,MAAM,aAAa,0BAA0B,MAAM;AACnD,KAAI,CAAC,WAAY,OAAM,IAAI,MAAM,yBAAyB;AAC1D,QAAO;;AAER,SAAS,gBAAgB,OAAO;CAC/B,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,KAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,UAAU,KAAK,MAAO,OAAM,IAAI,MAAM,oBAAoB;AACvJ,QAAO;;AAER,SAAS,qBAAqB,OAAO;CACpC,MAAM,SAAS,cAAc,MAAM;AACnC,KAAI,CAAC,WAAW,KAAK,OAAO,CAAE,OAAM,IAAI,MAAM,2BAA2B;AACzE,QAAO;;AAER,SAAS,cAAc,OAAO;AAC7B,KAAI,CAAC,WAAW,MAAM,CAAE,OAAM,IAAI,MAAM,qBAAqB;AAC7D,QAAO;;AAER,SAAS,WAAW,OAAO;AAC1B,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAE5E,SAAS,cAAc,OAAO;AAC7B,KAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACzF,QAAO;;AAER,SAAS,aAAa,OAAO;AAC5B,KAAI,CAAC,UAAU,KAAK,MAAM,CAAE,OAAM,IAAI,MAAM,iBAAiB;AAC7D,QAAO,WAAW,KAAK,KAAK,MAAM,GAAG,cAAc,UAAU,WAAW,EAAE,CAAC;;AAE5E,SAAS,UAAU,OAAO;AACzB,KAAI,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,6BAA6B;AAChG,QAAO,WAAW,KAAK,MAAM,MAAM,QAAQ,IAAI,EAAE,GAAG,SAAS,OAAO,SAAS,MAAM,GAAG,CAAC;;AAExF,SAAS,eAAe;AACvB,QAAO,kBAAkB,2BAA2B,iDAAiD;;AAKtG,MAAM,iBAAiB;CACtB,mBAAmB;CACnB,cAAc;CACd,WAAW,EAAE;CACb;;AAED,eAAe,6BAA6B,OAAO;CAClD,MAAM,UAAU,MAAM,aAAa,eAAe,YAAY,MAAM,QAAQ;AAC5E,KAAI,CAAC,QAAS,QAAO,OAAO,2BAA2B,oCAAoC;AAC3F,KAAI,CAAC,aAAa,MAAM,QAAQ,CAAE,QAAO,OAAO,4BAA4B,wCAAwC;CACpH,MAAM,oBAAoB,QAAQ,MAAM,aAAa,GAAG,KAAK,eAAe,GAAG,MAAM;AACrF,KAAI,QAAQ,OAAO,qBAAqB,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,MAAM,QAAS,QAAO,OAAO,uBAAuB,gEAAgE;AACxM,KAAI,QAAQ,eAAe,KAAK,EAAG,QAAO,OAAO,6BAA6B,6CAA6C;AAC3H,KAAI,CAAC,SAAS,QAAQ,WAAW,CAAE,QAAO,OAAO,6BAA6B,gDAAgD;CAC9H,MAAM,sBAAsB,QAAQ,WAAW,KAAK;AACpD,KAAI,wBAAwB,KAAK,EAAG,QAAO,OAAO,6BAA6B,6CAA6C;CAC5H,MAAM,mBAAmB,MAAM,aAAa,wBAAwB,YAAY,oBAAoB;AACpG,KAAI,CAAC,iBAAkB,QAAO,OAAO,6BAA6B,gDAAgD;CAClH,MAAM,aAAa,0BAA0B,iBAAiB,WAAW;AACzE,KAAI,CAAC,cAAc,eAAe,iBAAiB,WAAY,QAAO,OAAO,8BAA8B,uDAAuD;CAClK,MAAM,SAAS,gBAAgB,iBAAiB,cAAc;AAC9D,KAAI,CAAC,OAAQ,QAAO,OAAO,0BAA0B,wCAAwC;CAC7F,MAAM,UAAU,MAAM,aAAa,eAAe,YAAY,MAAM,QAAQ;AAC5E,KAAI,CAAC,QAAS,QAAO,OAAO,2BAA2B,oCAAoC;AAC3F,KAAI,QAAQ,YAAY,MAAM,QAAS,QAAO,OAAO,4BAA4B,4DAA4D;AAC7I,KAAI,CAAC,0BAA0B,QAAQ,QAAQ,CAAE,QAAO,OAAO,2BAA2B,+CAA+C;AACzI,KAAI,QAAQ,YAAY,MAAM,QAAS,QAAO,OAAO,4BAA4B,4DAA4D;AAC7I,KAAI,MAAM,SAAS,GAAG,MAAM,QAAQ,GAAG,QAAQ,UAAW,QAAO,OAAO,yBAAyB,6DAA6D;CAC9J,MAAM,kBAAkB,kBAAkB,QAAQ;AAClD,KAAI,gBAAiB,QAAO,OAAO,gBAAgB,MAAM,gBAAgB,QAAQ;CACjF,MAAM,cAAc,gBAAgB,QAAQ;AAC5C,KAAI,YAAa,QAAO,OAAO,YAAY,MAAM,YAAY,SAAS,eAAe,YAAY,QAAQ;AACzG,KAAI,QAAQ,eAAe,KAAK,EAAG,QAAO,OAAO,6BAA6B,0CAA0C;AACxH,KAAI,CAAC,SAAS,QAAQ,WAAW,CAAE,QAAO,OAAO,6BAA6B,6CAA6C;CAC3H,MAAM,sBAAsB,QAAQ,WAAW,KAAK;AACpD,KAAI,wBAAwB,KAAK,EAAG,QAAO,OAAO,6BAA6B,0CAA0C;CACzH,MAAM,mBAAmB,MAAM,aAAa,wBAAwB,YAAY,oBAAoB;AACpG,KAAI,CAAC,iBAAkB,QAAO,OAAO,6BAA6B,6CAA6C;AAC/G,QAAO;EACN,SAAS;EACT,QAAQ;EACR,MAAM;EACN,SAAS,CAAC;GACT,MAAM;GACN,SAAS;GACT,CAAC;EACF,YAAY,EAAE,QAAQ,eAAe;EACrC,OAAO;GACN;GACA;GACA;GACA;GACA;GACA;GACA,gBAAgB,2BAA2B,iBAAiB,eAAe;GAC3E;EACD;;AAEF,eAAe,oCAAoC,OAAO,iBAAiB;CAC1E,MAAM,aAAa,MAAM,6BAA6B,MAAM;AAC5D,KAAI,CAAC,WAAW,QAAS,QAAO;CAChC,MAAM,UAAU,WAAW;CAC3B,MAAM,EAAE,QAAQ,SAAS,kBAAkB,eAAe;AAC1D,KAAI,CAAC,iBAAiB,YAAY;AACjC,MAAI,OAAO,kBAAmB,QAAO,OAAO,uBAAuB,oEAAoE,kBAAkB;AACzJ,SAAO;GACN,SAAS;GACT,QAAQ;GACR,MAAM;GACN,SAAS,CAAC;IACT,MAAM;IACN,SAAS;IACT,CAAC;GACF,YAAY,EAAE,QAAQ,mBAAmB;GACzC,OAAO;GACP;;AAEF,KAAI,CAAC,MAAM,WAAY,QAAO,OAAO,2BAA2B,+EAA+E,SAAS;CACxJ,MAAM,mBAAmB,gBAAgB,QAAQ,UAAU,QAAQ,SAAS;AAC5E,KAAI,CAAC,iBAAiB,QAAS,QAAO,OAAO,iBAAiB,MAAM,MAAM,iBAAiB,MAAM,SAAS,SAAS;AACnH,KAAI,CAAC,mBAAmB,MAAM,WAAW,gBAAgB,iBAAiB,MAAM,OAAO,CAAE,QAAO,OAAO,qBAAqB,mEAAmE,SAAS;CACxM,MAAM,WAAW,MAAM,WAAW,YAAY;AAC9C,KAAI,CAAC,SAAU,QAAO,OAAO,2BAA2B,oDAAoD,SAAS;CACrH,IAAI;AACJ,KAAI;AACH,qBAAmB,MAAM,SAAS,OAAO;GACxC,UAAU,MAAM,WAAW;GAC3B,WAAW,iBAAiB;GAC5B,gBAAgB,MAAM,WAAW;GACjC,iBAAiB,MAAM,WAAW;GAClC,mBAAmB;GACnB,CAAC;SACK;AACP,SAAO,OAAO,2BAA2B,kDAAkD,SAAS;;AAErG,KAAI,CAAC,iBAAiB,QAAS,QAAO,OAAO,iBAAiB,MAAM,MAAM,iBAAiB,MAAM,SAAS,SAAS;AACnH,QAAO;EACN,SAAS;EACT,QAAQ;EACR,MAAM;EACN,SAAS,CAAC;GACT,MAAM;GACN,SAAS;GACT,CAAC;EACF,YAAY,EAAE,QAAQ,YAAY;EAClC,OAAO;GACN,GAAG;GACH,oBAAoB,iBAAiB;GACrC;EACD;;AAEF,SAAS,+CAA+C,OAAO,iBAAiB;AAC/E,QAAO,oCAAoC,OAAO,gBAAgB;;AAEnE,SAAS,gBAAgB,OAAO;AAC/B,KAAI,CAAC,MAAO,QAAO;EAClB,GAAG;EACH,WAAW,EAAE;EACb;CACD,MAAM,eAAe,MAAM,gBAAgB,eAAe;AAC1D,KAAI,CAAC,eAAe,aAAa,CAAE,QAAO;CAC1C,MAAM,YAAY,MAAM,aAAa,EAAE;AACvC,KAAI,IAAI,IAAI,UAAU,CAAC,SAAS,UAAU,OAAQ,QAAO;AACzD,QAAO;EACN,mBAAmB,MAAM,qBAAqB;EAC9C;EACA,WAAW,CAAC,GAAG,UAAU;EACzB;;AAEF,SAAS,eAAe,OAAO;AAC9B,QAAO,UAAU,YAAY,UAAU;;AAExC,SAAS,0BAA0B,OAAO;AACzC,KAAI,CAAC,gBAAgB,MAAM,CAAE,QAAO;CACpC,MAAM,sBAAsB,MAAM,QAAQ,IAAI;AAC9C,QAAO,MAAM,MAAM,GAAG,wBAAwB,KAAK,KAAK,IAAI,oBAAoB,CAAC,MAAM,IAAI,CAAC,OAAO,cAAc,OAAO,cAAc,OAAO,UAAU,CAAC,CAAC;;AAE1J,SAAS,OAAO,MAAM,SAAS,aAAa,eAAe,SAAS;AACnE,QAAO;EACN,SAAS;EACT,QAAQ;EACR;EACA,SAAS,CAAC;GACT;GACA;GACA,CAAC;EACF,YAAY,EAAE,QAAQ,YAAY;EAClC,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;EACxC;;AAEF,SAAS,kBAAkB,SAAS;CACnC,MAAM,YAAY;EACjB,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,GAAG,QAAQ,UAAU,eAAe,EAAE;EACtC;AACD,MAAK,MAAM,SAAS,WAAW;AAC9B,MAAI,UAAU,KAAK,EAAG;AACtB,MAAI,CAAC,SAAS,MAAM,CAAE,QAAO;GAC5B,MAAM;GACN,SAAS;GACT;EACD,MAAM,SAAS,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,SAAS;EACnE,MAAM,OAAO,MAAM;EACnB,MAAM,UAAU,SAAS,KAAK;AAC9B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO;GAC/B,MAAM;GACN,SAAS;GACT;AACD,MAAI,SAAS;GACZ,MAAM,MAAM,KAAK;GACjB,MAAM,MAAM,SAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC7C,OAAI,OAAO,QAAQ,SAAU,QAAO;IACnC,MAAM;IACN,SAAS;IACT;GACD,MAAM,WAAW,qBAAqB,IAAI;AAC1C,OAAI,CAAC,SAAS,QAAS,QAAO,SAAS;AACvC,OAAI,MAAM,aAAa,SAAS,MAAO,QAAO;IAC7C,MAAM;IACN,SAAS;IACT;;;AAGH,QAAO;;AAER,SAAS,gBAAgB,SAAS;CACjC,MAAM,QAAQ;EACb,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,GAAG,QAAQ,UAAU,eAAe,EAAE;EACtC,CAAC,MAAM,aAAa,UAAU,iBAAiB,KAAK;AACrD,KAAI,QAAQ,SAAS,KAAK,KAAK,CAAC,MAAO,QAAO;CAC9C,MAAM,UAAU,uBAAuB,QAAQ,KAAK;AACpD,QAAO;EACN,MAAM;EACN,SAAS;EACT,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;EACxC;;AAEF,eAAe,aAAa,QAAQ,OAAO;CAC1C,MAAM,SAAS,MAAM,OAAO,aAAa,SAAS,MAAM;AACxD,QAAO,OAAO,SAAS,OAAO,OAAO;;AAEtC,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;;AAM5E,SAAS,4BAA4B,OAAO;AAC3C,QAAO,+CAA+C,OAAO,IAAI,0BAA0B,CAAC;;;;;ACllL7F,MAAM,uBAAuB,IAAI,OAAO;AA4CxC,eAAsB,gCACrB,cACA,aACA,SACA,UAA0C,EAAE,EACH;AACzC,KAAI;EACH,MAAM,SAAS,IAAI,gBAAgB;GAClC,KAAK;GACL,OAAO,QAAQ,SAAS;GACxB,qBAAqB,QAAQ;GAC7B,CAAC;EACF,MAAM,CAAC,SAAS,WAAW,MAAM,QAAQ,IAAI,CAC5C,OAAO,kBAAkB,YAAY,EACrC,OAAO,kBAAkB,aAAa,QAAQ,CAC9C,CAAC;EACF,MAAM,aAAa,MAAM,6BAA6B;GACrD;GACA,SAAS;GACT;GACA,MAAM,QAAQ;GACd,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,CAAC;AACF,MAAI,CAAC,WAAW,QACf,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,WAAW;IACjB,SAAS,WAAW,QAAQ,IAAI,WAAW;IAC3C;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IAAE;IAAc;IAAa;IAAS;IAAS;IAAS;IAAY;GAC3E;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GAAE,SAAS;GAAO,OAAO;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;IAAS;GAAE;AAE/E,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAIH,eAAsB,kCACrB,SACA,gBACA,UAA0C,EAAE,EACR;CAEpC,MAAM,sBADU,QAAQ,WAAW,MACC,iBAAiB;CACrD,IAAI;AACJ,KAAI,qBAAqB;EACxB,MAAM,UAAU,MAAM,sBAAsB,oBAAoB,KAAK;GACpE,OAAO,QAAQ,mBAAmB;GAClC,iBAAiB,QAAQ,mBAAmB;GAC5C,UAAU;GACV,CAAC;AACF,MAAI,CAAC,QAAQ,QACZ,QAAO,oBAAoB,QAAQ,MAAM,MAAM,QAAQ,MAAM,QAAQ;EAEtE,MAAM,WAAW,MAAM,gBAAgB,QAAQ,MAAM,OAAO,oBAAoB,SAAS;AACzF,MAAI,CAAC,SAAS,QACb,QAAO,oBAAoB,SAAS,MAAM,MAAM,SAAS,MAAM,QAAQ;AAExE,aAAW,QAAQ,MAAM;;AAG1B,QAAO,4BAA4B;EAClC,cAAc,QAAQ;EACtB,SAAS,QAAQ;EACjB,SAAS,QAAQ;EACjB,MAAM,QAAQ,QAAQ;EACtB,SAAS,QAAQ,QAAQ;EACzB,SAAS,QAAQ,QAAQ;EACzB,YACC,aAAa,SACV,SACA;GACA;GACA;GACA,iBAAiB,QAAQ;GACzB,UAAU,QAAQ;GAClB;EACJ,CAAC;;AAGH,SAAS,oBACR,MACA,SAC4B;AAC5B,QAAO;EACN,SAAS;EACT,QAAQ;EACR;EACA,SAAS,CAAC;GAAE;GAAM;GAAS,CAAC;EAC5B,YAAY,EAAE,QAAQ,UAAU;EAChC;;AAGF,MAAM,eAA6B,OAAO,OAAO,SAAS;AAEzD,QAAO,cADK,iBAAiB,UAAU,MAAM,MAAM,OAAO,MAAM,EACtC,MAAM,EAAE,WAAW,MAAM,CAAC;;AAGrD,MAAM,0BAA+C,OAAO,SAAS,WAAW,MAAM,OAAO,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACzIlG,MAAM,cAAc;;AAGpB,MAAa,4BAA4B,IAAe;AAYxD,MAAM,kBAAkB;;;;;;;;AASxB,SAAS,aAAa,OAA2B;CAChD,IAAI,OAAO;CACX,IAAI,QAAQ;CACZ,IAAI,MAAM;AACV,MAAK,MAAM,QAAQ,OAAO;AACzB,UAAS,SAAS,IAAK;AACvB,UAAQ;AACR,SAAO,QAAQ,GAAG;AACjB,WAAQ;AACR,UAAO,gBAAiB,UAAU,OAAQ;;;AAG5C,KAAI,OAAO,EACV,QAAO,gBAAiB,SAAU,IAAI,OAAS;AAEhD,QAAO;;;;;;;;;AAUR,eAAsB,qBAAqB,cAAsB,MAA+B;CAC/F,MAAM,MAAM,aAAa,MAAM;CAC/B,MAAM,IAAI,KAAK,MAAM;AACrB,KAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iDAAiD;AAC3E,KAAI,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;CAKjE,MAAM,QAAQ,GAAG,IAAI,IAAI;CACzB,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC;AAEzF,QAAO,KADS,aAAa,IAAI,WAAW,WAAW,CAAC,CACpC,MAAM,GAAG,YAAY;;;;;AC/F1C,SAAgB,sBACf,QACA,OACA,QACA,MAAM,KAAK,KAAK,EACN;AACV,QAAO,OAAO,MAAM,UAAU;AAC7B,MACC,MAAM,QAAQ,SACd,MAAM,QAAQ,OAAO,OACrB,MAAM,QAAQ,OAAO,OACrB,MAAM,QAAQ,KAEd,QAAO;AAER,MAAI,MAAM,QAAQ,OAAW,QAAO;EACpC,MAAM,YAAY,KAAK,MAAM,MAAM,IAAI;AACvC,SAAO,OAAO,SAAS,UAAU,IAAI,YAAY;GAChD;;;;;;;;;;;;;AC8DH,SAAS,oBAAoB,GAA4B,GAA4B;AACpF,QAAO,KAAK,UAAU,EAAE,KAAK,KAAK,UAAU,2BAA2B,EAAE,CAAC;;AA0E3E,SAAgB,sBACf,MACA,SACA,WACmB;CACnB,IAAI;AACJ,SAAQ,MAAR;EACC,KAAK;AACJ,aAAU,cAAc,YAAY,yBAAyB;AAC7D;EACD,KAAK;AACJ,aAAU,cAAc,YAAY,8BAA8B;AAClE;EACD,KAAK;EACL,KAAK;EACL,KAAK;AACJ,aAAU;AACV;EACD,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACJ,aAAU,cAAc,YAAY,mBAAmB;AACvD;EACD,QACC,WAAU;;AAEZ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN;GACA,SAAS,EAAE,kBAAkB,MAAM;GACnC;EACD;;AAGF,SAAS,oBACR,MACA,SACmB;AACnB,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN;GACA,SAAS,EAAE,kBAAkB,MAAM;GACnC;EACD;;AAGF,SAAS,mBACR,OACA,SAC0B;AAC1B,KAAI,CAAC,MAAM,cAAc,CAAC,MAAM,WAC/B,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAEF,KAAI,MAAM,eAAe,QAAQ,QAAQ,OAAO,MAAM,eAAe,QAAQ,QAAQ,IACpF,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAEF,QAAO;;AAGR,SAAS,0BACR,SACA,QACoC;AACpC,QAAO;EACN,YAAY,QAAQ,QAAQ;EAC5B,YAAY,QAAQ,QAAQ;EAC5B,YAAY,OAAO,WAAW;EAC9B,QAAQ,OAAO,MAAM;EACrB;;;;;;;;;;;;AAaF,MAAM,qBAAqB,MAAM;;;;;;;AAQjC,MAAM,gBAAgB;;;;;;AAOtB,MAAM,4BAA4B;;;;;;;;;AAUlC,MAAM,2BAA2B;;;;;;;AAQjC,MAAM,gCAAgC;;;;;;;;AAStC,MAAM,6BAA6B;AAEnC,IAAM,6BAAN,cAAyC,MAAM;CAC9C,YACC,AAAS,MACT,SACC;AACD,QAAM,QAAQ;EAHL;AAIT,OAAK,OAAO;;;;AAKd,SAAS,WAAW,eAAqC;AACxD,SAAQ,OAAoC,SAAuC;EAClF,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,YAAY,KAAK,IAAI,GAAG,gBAAgB,IAAI;AAClD,MAAI,cAAc,EACjB,QAAO,QAAQ,uBAAO,IAAI,MAAM,sCAAsC,CAAC;EAExE,MAAM,UAAU,KAAK,IAAI,+BAA+B,UAAU;EAClE,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,QAAQ;EAC3D,MAAM,eAAe,MAAM;AAC3B,MAAI,aACH,KAAI,aAAa,QAAS,YAAW,MAAM,aAAa,OAAO;MAC1D,cAAa,iBAAiB,eAAe,WAAW,MAAM,aAAa,OAAO,CAAC;AAEzF,SAAO,MAAM,OAAO;GAAE,GAAG;GAAM,QAAQ,WAAW;GAAQ,CAAC,CAAC,cAAc;AACzE,gBAAa,MAAM;IAClB;;;AAIJ,eAAe,cACd,gBACA,UACA,QAMA,MACsB;CACtB,MAAM,SAAS,MAAM,qBACpB;EACC;EACA;EACA;EACA,GAAI,SAAS,SAAY,EAAE,GAAG,EAAE,MAAM;EACtC,EACD;EACC,OAAO,OAAO,KAAK,SAAS;AAC3B,OAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,MAAM,mDAAmD;AACrF,UAAO,yBAAyB,IAAI,MAAM;IACzC,QAAQ,KAAK;IACb,kBAAkB;IAClB,CAAC;;EAEH,iBAAiB,OAAO,cACtB,MAAM,oCAAoC,WAAW,WAAW,EAAE;EACpE,oBAAoB,OAAO,KAAK,IAAI;EACpC,iBAAiB;EACjB,gBAAgB;EAChB,UAAU;EACV,cAAc;EACd,CACD;AACD,KAAI,CAAC,OAAO,QACX,OAAM,IAAI,2BAA2B,OAAO,MAAM,MAAM,OAAO,MAAM,QAAQ;AAE9E,QAAO,OAAO,MAAM;;;;;;;;;;;;AAuBrB,SAAgB,oBACf,UACA,SAC8B;AAI9B,MAAK,MAAM,WAAW,0BAA0B,UAAU,QAAQ,CACjE,SAAQ,KACP,oDAAoD,QAAQ,IAAI,YAAY,QAAQ,SAAS,uBAAuB,QAAQ,SAC5H;CAEF,MAAM,aAAa,sBAAsB,UAAU,QAAQ;AAC3D,KAAI,WAAW,WAAW,EAAG,QAAO;CACpC,MAAM,UAAkC,EAAE;AAC1C,MAAK,MAAM,KAAK,WAAY,SAAQ,EAAE,OAAO,EAAE;AAI/C,QAAO;EACN,MAAM;EACN,SAAS,gEALM,WACd,KAAK,MAAM,GAAG,EAAE,IAAI,YAAY,EAAE,SAAS,eAAe,EAAE,OAAO,CACnE,KAAK,KAAK,CAGsE;EACjF,SAAS;GAAE,UAAU;GAAS,MAAM;GAAS;EAC7C;;AAKF,eAAsB,sBACrB,IACA,SACA,eACA,qBACA,OACA,MAO4C;CAG5C,MAAM,iBAAiB,qBAAqB,oBAAoB;AAChE,KAAI,CAAC,eACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAGF,KAAI,CAAC,QACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAGF,KAAI,CAAC,iBAAiB,CAAC,cAAc,aAAa,CACjD,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAOF,KAAI;AACH,wBAAsB,eAAe,cAAc;UAC3C,KAAK;AACb,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,QAAQ,IAAI,UAAU;IAC9C;GACD;;CAGF,MAAM,EAAE,KAAK,MAAM,SAAS,qBAAqB;CAIjD,MAAM,EAAE,iBAAiB,0BACxB,MAAM,OAAO;CAMd,MAAM,qBAAqB,KAAK,KAAK,GAAG;CACxC,MAAM,YAAY,IAAI,gBAAgB;EACrC,eAAe,eAAe;EAC9B,gBAAgB,eAAe;EAC/B,eAAe,sBAAsB,eAAe,eAAe;EACnE,OAAO,WAAW,mBAAmB;EACrC,CAAC;AAOF,KAAI,CAAC,IAAI,WAAW,OAAO,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,EACtD,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAGF,KAAI;EAKH,MAAM,eAAe;EACrB,MAAM,cAAc,MAAM,UAAU,WAAW;GAC9C,KAAK;GACL;GACA,CAAC;EAcF,MAAM,iBAAiB;EA6BvB,MAAM,cA5BgB,OAAO,YAAY;AACxC,OAAI,CAAC,iBACJ,QAAO,UAAU,iBAAiB;IACjC,KAAK;IACL,SAAS;IACT,CAAC;GAEH,IAAI;GACJ,MAAM,8BAAc,IAAI,KAAa;AACrC,QAAK,IAAI,OAAO,GAAG,OAAO,gBAAgB,QAAQ;AACjD,QAAI,WAAW,QAAW;AACzB,SAAI,YAAY,IAAI,OAAO,CAAE;AAC7B,iBAAY,IAAI,OAAO;;IAExB,MAAM,SAAS,MAAM,UAAU,aAAa;KAC3C,KAAK;KACL,SAAS;KACT;KACA,OAAO;KACP,CAAC;AACF,SAAK,MAAM,KAAK,OAAO,SACtB,KAAI,EAAE,YAAY,iBAAkB,QAAO;AAE5C,QAAI,CAAC,OAAO,OAAQ;AACpB,aAAS,OAAO;;MAGd;AAGJ,MAAI,CAAC,YACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,mBACN,WAAW,iBAAiB,iBAAiB,aAAa,GAAG,SAC7D,oCAAoC,aAAa,GAAG;IACvD;GACD;AAMF,MAAI,YAAY,QAAQ,gBAAgB,YAAY,SAAS,KAC5D,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAEF,MACC,YAAY,QAAQ,gBACpB,YAAY,YAAY,QACvB,qBAAqB,UAAa,YAAY,YAAY,iBAE3D,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SACC;IACD;GACD;EAGF,MAAM,UAAU,YAAY;AAC5B,MAAI,kCAAkC,aAAa,UAAU,cAAc,CAAC,UAC3E,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,MAAM,gBAAgB,OAAO,MAAM,4BAA4B,iCAC9D,cACA,MACA,SACA,MAAM,qBACN;AACD,MAAI,CAAC,cAAc,QAClB,QAAO,oBAAoB,cAAc,MAAM,MAAM,cAAc,MAAM,QAAQ;EAElF,MAAM,UAAU,cAAc;EAC9B,MAAM,EAAE,SAAS,YAAY,QAAQ,WAAW;AAChD,MACC,YAAY,QAAQ,QAAQ,QAAQ,OACpC,YAAY,QAAQ,QAAQ,QAAQ,OACpC,YAAY,QAAQ,QAAQ,QAAQ,OACpC,YAAY,QAAQ,QAAQ,QAAQ,IAEpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAEF,MAAI,CAAC,MAAM,YAAY;GACtB,MAAM,eAAe,mBACpB;IACC,YAAY,MAAM;IAClB,YAAY,MAAM;IAClB,EACD,QACA;AACD,OAAI,aAAc,QAAO;;AAM1B,MAFC,sBAAsB,YAAY,UAAU,EAAE,EAAE,mBAAmB,QAAQ,QAAQ,IACnF,sBAAsB,YAAY,UAAU,EAAE,EAAE,mBAAmB,QAAQ,QAAQ,CAEnF,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAUF,MAAI,MAAM,SAAS;GAClB,MAAM,WAAW,oBAAoB,QAAQ,UAAU,KAAK,QAAQ;AACpE,OAAI,SAAU,QAAO;IAAE,SAAS;IAAO,OAAO;IAAU;;EAqBzD,MAAM,oBAAoB,eAAe,QAAQ;EACjD,IAAI,2BAA2B;AAC/B,MAAI,sBAAsB,OACzB,KAAI;AACH,8BAA2B,qBAAqB,kBAAkB;WAC1D,KAAK;AACb,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SACC,eAAe,QACZ,IAAI,UACJ;KACJ;IACD;;AAGH,MAAI,2BAA2B,GAAG;GACjC,MAAM,UAAU,eAAe,QAAQ,0BAA0B,KAAK,MACrE,EAAE,MAAM,CAAC,aAAa,CACtB;AAED,OAAI,CADW,4BAA4B,SAAS,cAAc,KAAK,EAC1D;IACZ,MAAM,YAAY,KAAK,MAAM,YAAY,UAAU;AACnD,QAAI,CAAC,OAAO,SAAS,UAAU,CAC9B,QAAO;KACN,SAAS;KACT,OAAO;MACN,MAAM;MACN,SACC;MACD;KACD;IAEF,MAAM,cAAc,KAAK,KAAK,GAAG,aAAa;AAC9C,QAAI,aAAa,0BAA0B;KAC1C,MAAM,YAAY,KAAK,KAAK,2BAA2B,WAAW;AAClE,YAAO;MACN,SAAS;MACT,OAAO;OACN,MAAM;OACN,SACC,oEACG,yBAAyB,gCAAgC,UAAU;OACvE;MACD;;;;EAQJ,MAAM,WAAW,MAAM,qBAAqB,cAAc,KAAK;AAI/D,MAAI,MAAM,qBAAqB,IAAI,SAAS,CAC3C,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EASF,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,UAAU;AACb,OAAI,SAAS,WAAW,WACvB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS,UAAU,aAAa,GAAG,KAAK;KACxC;IACD;AAEF,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SACC,0DAA0D,SAAS;KAEpE;IACD;;EAKF,MAAM,kBAAkB,QAAQ,UAAU;EAC1C,MAAM,mBAAmB,QAAQ,UAAU,QAAQ;AAEnD,MAAI,CAAC,mBAAmB,CAAC,iBACxB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,IAAI;AACJ,MAAI;AACH,mBAAgB,MAAM,cACrB,YAAY,kBAAkB,EAAE,EAChC,iBACA;IACC,KAAK;IACL,YAAY,KAAK;IACjB,MAAM,GAAG,KAAK,GAAG;IACjB,KAAK,YAAY;IACjB,EACD,QAAQ,KACR;WACO,OAAO;AACf,OAAI,iBAAiB,2BACpB,QAAO,sBAAsB,MAAM,MAAM,MAAM,SAAS,UAAU;AAEnE,SAAM;;EAMP,MAAM,iBAAiB,MAAM,yBAC5B,eACA,kBACA,MACA,QACA;AACD,MAAI,CAAC,eAAe,QACnB,QAAO,sBACN,eAAe,MAAM,MACrB,eAAe,MAAM,SACrB,UACA;EAEF,MAAM,EAAE,QAAQ,gBAAgB,oBAAoB,eAAe;EACnE,MAAM,eAAe,MAAM,kCAAkC,SAAS,gBAAgB;GACrF,GAAG,MAAM;GACT;GACA,CAAC;AACF,MAAI,CAAC,aAAa,QACjB,QAAO,oBACN,aAAa,MACb,aAAa,QAAQ,IAAI,WAAW,qCACpC;EAEF,MAAM,eAAe,0BAA0B,SAAS,aAAa;AASrE,SAAO,WAAW;GAAE,GAAG,OAAO;GAAU,IAAI;GAAU;AAStD,MACC,CAAC,oBAAoB,aAAa,MAAM,gBAAgB,OAAO,SAAS,kBAAkB,EAAE,CAAC,CAE7F,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SACC;IACD;GACD;EAuBF,MAAM,qBAAqB,mCAAmC,OAAO,SAAS,aAAa;AAC3F,MAAI,CAAC,MAAM,cAAc,mBAAmB,SAAS,GAAG;AACvD,OAAI,MAAM,+BAA+B,OACxC,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SACC;KACD;IACD;GAEF,MAAM,eAAe,mCAAmC,MAAM,2BAA2B;AACzF,OACC,aAAa,WAAW,mBAAmB,UAC3C,aAAa,MAAM,KAAK,MAAM,QAAQ,mBAAmB,GAAG,CAE5D,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SACC;KACD;IACD;;EAIH,MAAM,kBAAkB,OAAO,SAAS,KAAK,SAAS,EAAE,EAAE,KACxD,EAAE,aAAa,GAAG,cAAc,IAAI,GAAG,WAAW,KACnD;AACD,MAAI,CAAC,MAAM,cAAc,eAAe,SAAS,GAChD;OAAI,KAAK,UAAU,MAAM,qBAAqB,KAAK,KAAK,UAAU,eAAe,CAChF,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT,SAAS;MAAE,UAAU;MAAgB;MAAc;KACnD;IACD;;EAIH,MAAM,SAAgC;GACrC;GACA;GACA;GACA;GACA,cAAc,OAAO,SAAS;GAC9B,gBAAgB,aAAa,MAAM,iBAAiB;GACpD,UAAU;GACV;GACA;AACD,MAAI,MAAM,WAAY,QAAO;GAAE,SAAS;GAAM,MAAM;GAAQ;AAG5D,QAAM,gBAAgB,SAAS,UAAU,SAAS,QAAQ,WAAW;AA+BrE,MAAI;AACH,SAAM,UAAU,OAAO,UAAU,SAAS,UAAU;IACnD,QAAQ;IACR,aAAa,QAAQ,QAAQ;IAC7B,aAAa,QAAQ,eAAe;IACpC,sBAAsB;IACtB,cAAc;IACd,CAAC;WACM,UAAU;GAClB,IAAI,WAAW;AACf,OAAI;IACH,MAAM,SAAS,MAAM,UAAU,IAAI,SAAS;AAC5C,eAAW,WAAW,UAAa,WAAW;YACtC,UAAU;AAClB,YAAQ,KACP,oDAAoD,SAAS,kDAC7D,SACA;;AAEF,OAAI,CAAC,SACJ,KAAI;AACH,UAAM,mBAAmB,SAAS,UAAU,SAAS,WAAW;YACxD,YAAY;AACpB,YAAQ,KACP,uDAAuD,SAAS,GAAG,QAAQ,kCAC3E,WACA;;AAGH,SAAM;;AAGP,QAAM,2BAA2B,IAAI,CAAC,OAAO,SAAS,CAAC;AAEvD,SAAO;GACN,SAAS;GACT,MAAM;GACN;UACO,KAAK;AACb,MAAI,eAAe,sBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,wEAAwE,IAAI,OAAO;IAC5F;GACD;AAEF,MAAI,eAAe,qBAAqB;AACvC,OAAI,IAAI,UAAU,qBACjB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;AAEF,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM,IAAI,WAAW,MAAM,yBAAyB;KACpD,SAAS,uBAAuB,IAAI,OAAO,IAAI,IAAI;KACnD;IACD;;AAEF,MAAI,eAAe,mBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,IAAI,QAAQ;IAClB,SAAS;IACT;GACD;AAEF,UAAQ,MAAM,8BAA8B,IAAI;AAChD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,QAAQ,IAAI,UAAU;IAC9C;GACD;;;;;;;;;;;;;;AAuBH,eAAsB,wBACrB,IACA,SACA,UACA,MAC8C;AAC9C,KAAI;EACH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,CAAC,YAAY,SAAS,WAAW,WACpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,6BAA6B;IACtC;GACD;EAMF,MAAM,UAAU,SAAS;EAOzB,IAAI,cAAc;AAClB,MAAI,MAAM,YAAY;AACrB,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,SAAS,CAAC,SAAS;AAClF,iBAAc;;AAGf,MAAI,QACH,OAAM,mBAAmB,SAAS,UAAU,SAAS,WAAW;AAGjE,MAAI;AACH,SAAM,uBAAuB,IAAI,SAAS;UACnC;AAIR,QAAM,UAAU,OAAO,SAAS;AAEhC,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE;IAAU;IAAa;GAAE;UACjD,KAAK;AACb,UAAQ,MAAM,gCAAgC,IAAI;AAClD,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;;AA2BH,eAAsB,qBACrB,IACA,SACA,eACA,qBACA,UACA,MAW2C;CAC3C,MAAM,iBAAiB,qBAAqB,oBAAoB;AAChE,KAAI,CAAC,eACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA2B,SAAS;GAA8B;EACjF;AAEF,KAAI,CAAC,QACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;AAEF,KAAI,CAAC,iBAAiB,CAAC,cAAc,aAAa,CACjD,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAAyB,SAAS;GAA8B;EAC/E;AAEF,KAAI;AACH,wBAAsB,eAAe,cAAc;UAC3C,KAAK;AACb,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,QAAQ,IAAI,UAAU;IAC9C;GACD;;AAGF,KAAI;EACH,MAAM,YAAY,IAAI,sBAAsB,GAAG;EAC/C,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS;AAC9C,MAAI,CAAC,YAAY,SAAS,WAAW,WACpC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,6BAA6B;IAAY;GAC9E;AAEF,MAAI,CAAC,SAAS,wBAAwB,CAAC,SAAS,aAC/C,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,mBAAmB,SAAS;IACrC;GACD;EAEF,MAAM,aAAa,SAAS;EAE5B,MAAM,eAAe,SAAS;EAC9B,MAAM,OAAO,SAAS;EAEtB,MAAM,EAAE,iBAAiB,0BACxB,MAAM,OAAO;EACd,MAAM,qBAAqB,KAAK,KAAK,GAAG;EACxC,MAAM,YAAY,IAAI,gBAAgB;GACrC,eAAe,eAAe;GAC9B,gBAAgB,eAAe;GAC/B,eAAe,sBAAsB,eAAe,eAAe;GACnE,OAAO,WAAW,mBAAmB;GACrC,CAAC;EAIF,MAAM,iBAAiB;EACvB,MAAM,cAAc,OAAO,YAAY;AACtC,OAAI,CAAC,MAAM,QACV,QAAO,UAAU,iBAAiB;IAAE,KAAK;IAAc,SAAS;IAAM,CAAC;GAExE,IAAI;GACJ,MAAM,8BAAc,IAAI,KAAa;AACrC,QAAK,IAAI,OAAO,GAAG,OAAO,gBAAgB,QAAQ;AACjD,QAAI,WAAW,QAAW;AACzB,SAAI,YAAY,IAAI,OAAO,CAAE;AAC7B,iBAAY,IAAI,OAAO;;IAExB,MAAM,SAAS,MAAM,UAAU,aAAa;KAC3C,KAAK;KACL,SAAS;KACT;KACA,OAAO;KACP,CAAC;AACF,SAAK,MAAM,KAAK,OAAO,SACtB,KAAI,EAAE,YAAY,KAAK,QAAS,QAAO;AAExC,QAAI,CAAC,OAAO,OAAQ;AACpB,aAAS,OAAO;;MAGd;AAEJ,MAAI,CAAC,YACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,MAAM,UACZ,WAAW,KAAK,QAAQ,iBAAiB,aAAa,GAAG,SACzD,oCAAoC,aAAa,GAAG;IACvD;GACD;AAKF,MACC,YAAY,QAAQ,gBACpB,YAAY,YAAY,QACvB,MAAM,YAAY,UAAa,YAAY,YAAY,KAAK,QAE7D,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SACC;IACD;GACD;EAEF,MAAM,cAAc,MAAM,UAAU,WAAW;GAAE,KAAK;GAAc;GAAM,CAAC;AAC3E,MAAI,CAAC,eAAe,YAAY,QAAQ,gBAAgB,YAAY,SAAS,KAC5E,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,MAAM,aAAa,YAAY;AAC/B,MAAI,kCAAkC,aAAa,UAAU,cAAc,CAAC,UAC3E,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAU,SAAS;IAA8B;GAChE;AAEF,MAAI,eAAe,WAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAEF,MAAM,gBAAgB,OAAO,MAAM,4BAA4B,iCAC9D,cACA,MACA,YACA,MAAM,qBACN;AACD,MAAI,CAAC,cAAc,QAClB,QAAO,oBAAoB,cAAc,MAAM,MAAM,cAAc,MAAM,QAAQ;EAElF,MAAM,UAAU,cAAc;EAC9B,MAAM,EAAE,SAAS,YAAY,QAAQ,WAAW;AAChD,MACC,YAAY,QAAQ,QAAQ,QAAQ,OACpC,YAAY,QAAQ,QAAQ,QAAQ,OACpC,YAAY,QAAQ,QAAQ,QAAQ,OACpC,YAAY,QAAQ,QAAQ,QAAQ,IAEpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAKF,MAFC,sBAAsB,YAAY,UAAU,EAAE,EAAE,mBAAmB,QAAQ,QAAQ,IACnF,sBAAsB,YAAY,UAAU,EAAE,EAAE,mBAAmB,QAAQ,QAAQ,CAEnF,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAU,SAAS;IAA8B;GAChE;AAEF,MACC,MAAM,4BACN,MAAM,iCACN,MAAM,iBACL;GACD,MAAM,eAAe,mBACpB;IACC,YAAY,KAAK;IACjB,YAAY,KAAK;IACjB,EACD,QACA;AACD,OAAI,aAAc,QAAO;;AAM1B,MAAI,MAAM,SAAS;GAClB,MAAM,WAAW,oBAAoB,QAAQ,UAAU,KAAK,QAAQ;AACpE,OAAI,SAAU,QAAO;IAAE,SAAS;IAAO,OAAO;IAAU;;EAGzD,MAAM,kBAAkB,QAAQ,UAAU;EAC1C,MAAM,mBAAmB,iBAAiB;AAC1C,MAAI,CAAC,mBAAmB,CAAC,iBACxB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,IAAI;AACJ,MAAI;AACH,mBAAgB,MAAM,cACrB,YAAY,kBAAkB,EAAE,EAChC,iBACA;IACC,KAAK;IACL,YAAY,KAAK;IACjB,MAAM,GAAG,KAAK,GAAG;IACjB,KAAK,YAAY;IACjB,EACD,QAAQ,KACR;WACO,OAAO;AACf,OAAI,iBAAiB,2BACpB,QAAO,sBAAsB,MAAM,MAAM,MAAM,SAAS,SAAS;AAElE,SAAM;;EAEP,MAAM,iBAAiB,MAAM,yBAC5B,eACA,kBACA,MACA,WACA;AACD,MAAI,CAAC,eAAe,QACnB,QAAO,sBACN,eAAe,MAAM,MACrB,eAAe,MAAM,SACrB,SACA;EAEF,MAAM,EAAE,QAAQ,gBAAgB,oBAAoB,eAAe;EACnE,MAAM,eAAe,MAAM,kCAAkC,SAAS,gBAAgB;GACrF,GAAG,MAAM;GACT;GACA,CAAC;AACF,MAAI,CAAC,aAAa,QACjB,QAAO,oBACN,aAAa,MACb,aAAa,QAAQ,IAAI,WAAW,qCACpC;EAEF,MAAM,eAAe,0BAA0B,SAAS,aAAa;AAIrE,SAAO,WAAW;GAAE,GAAG,OAAO;GAAU,IAAI;GAAU;AAOtD,MACC,CAAC,oBAAoB,aAAa,MAAM,gBAAgB,OAAO,SAAS,kBAAkB,EAAE,CAAC,CAE7F,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SACC;IACD;GACD;EAOF,MAAM,YAAY,MAAM,iBAAiB,SAAS,UAAU,YAAY,WAAW;EAEnF,MAAM,oBAAoB,iBADV,WAAW,SAAS,gBAAgB,EAAE,EACF,OAAO,SAAS,aAAa;AAEjF,MADsB,kBAAkB,MAAM,SAAS,KAClC,CAAC,MAAM,yBAC3B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT,SAAS;KAAE;KAAmB;KAAc;IAC5C;GACD;EAGF,MAAM,yBAAyB,oBAAoB,WAAW,UAAU,OAAO,SAAS;EACxF,MAAM,qBAAqB,uBAAuB,YAAY,SAAS;AACvE,MAAI,sBAAsB,CAAC,MAAM,8BAChC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT,SAAS;KAAE;KAAwB;KAAmB;KAAc;IACpE;GACD;EAGF,MAAM,cAAc,CAAC,GAAI,WAAW,SAAS,KAAK,SAAS,EAAE,CAAE,CAAC,UAAU,GAAG,MAC5E,EAAE,KAAK,cAAc,EAAE,KAAK,CAC5B;EACD,MAAM,cAAc,CAAC,GAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAE,CAAC,UAAU,GAAG,MACxE,EAAE,KAAK,cAAc,EAAE,KAAK,CAC5B;AACD,MAAI,KAAK,UAAU,YAAY,KAAK,KAAK,UAAU,YAAY,IAAI,CAAC,MAAM,gBACzE,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT,SAAS;KACR,UAAU,YAAY,KAAK,EAAE,aAAa,GAAG,cAAc,IAAI,GAAG,WAAW,KAAK;KAClF;KACA;IACD;GACD;AAKF,QAAM,gBAAgB,SAAS,UAAU,YAAY,QAAQ,WAAW;AAIxE,QAAM,UAAU,OAAO,UAAU,YAAY,UAAU;GACtD,QAAQ;GACR,sBAAsB;GACtB,cAAc;GACd,aAAa,QAAQ,QAAQ;GAC7B,aAAa,QAAQ,eAAe;GACpC,iBAAiB;GACjB,iBAAiB;GACjB,CAAC;AAEF,QAAM,2BAA2B,IAAI,CAAC,OAAO,SAAS,CAAC;AAKvD,qBAAmB,SAAS,UAAU,YAAY,WAAW,CAAC,YAAY,GAAG;AAE7E,SAAO;GACN,SAAS;GACT,MAAM;IACL;IACA;IACA;IACA;IACA,wBAAwB,qBAAqB,yBAAyB;IACtE;IACA;GACD;UACO,KAAK;AACb,MAAI,eAAe,sBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,wEAAwE,IAAI,OAAO;IAC5F;GACD;AAEF,MAAI,eAAe,qBAAqB;AACvC,OAAI,IAAI,UAAU,qBACjB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;AAEF,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM,IAAI,WAAW,MAAM,yBAAyB;KACpD,SAAS,uBAAuB,IAAI,OAAO,IAAI,IAAI;KACnD;IACD;;AAEF,MAAI,eAAe,mBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,IAAI,QAAQ;IAClB,SAAS;IACT;GACD;AAEF,UAAQ,MAAM,6BAA6B,IAAI;AAC/C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,eAAe,QAAQ,IAAI,UAAU;IAC9C;GACD;;;;;;;;;;AA8BH,eAAsB,0BACrB,IACA,qBACuD;CACvD,MAAM,iBAAiB,qBAAqB,oBAAoB;AAChE,KAAI,CAAC,eACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAA2B,SAAS;GAA8B;EACjF;AAGF,KAAI;EAEH,MAAM,kBAAkB,MADN,IAAI,sBAAsB,GAAG,CACP,oBAAoB;AAC5D,MAAI,gBAAgB,WAAW,EAC9B,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,OAAO,EAAE,EAAE;GAAE;EAG9C,MAAM,EAAE,iBAAiB,0BACxB,MAAM,OAAO;EACd,MAAM,qBAAqB,KAAK,KAAK,GAAG;EACxC,MAAM,YAAY,IAAI,gBAAgB;GACrC,eAAe,eAAe;GAC9B,gBAAgB,eAAe;GAC/B,eAAe,sBAAsB,eAAe,eAAe;GACnE,OAAO,WAAW,mBAAmB;GACrC,CAAC;EAEF,MAAM,QAA+B,EAAE;AACvC,OAAK,MAAM,UAAU,iBAAiB;AACrC,OAAI,CAAC,OAAO,wBAAwB,CAAC,OAAO,aAAc;AAC1D,OAAI;IACH,MAAM,cAAc,MAAM,UAAU,iBAAiB;KAEpD,KAAK,OAAO;KACZ,SAAS,OAAO;KAChB,CAAC;AACF,QAAI,kCAAkC,aAAa,UAAU,cAAc,CAAC,UAC3E;IAED,MAAM,SAAS,YAAY;AAC3B,QAAI,CAAC,OAAQ;IACb,MAAM,YAAY,OAAO;AACzB,UAAM,KAAK;KACV,UAAU,OAAO;KACjB;KACA;KACA,WAAW,WAAW;KACtB,sBAAsB;KACtB,2BAA2B;KAC3B,CAAC;YACM,KAAK;AAGb,YAAQ,KAAK,mCAAmC,OAAO,SAAS,IAAI,IAAI;;;AAI1E,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,OAAO;GAAE;UACjC,KAAK;AACb,MAAI,eAAe,sBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,wEAAwE,IAAI,OAAO;IAC5F;GACD;AAEF,MAAI,eAAe,oBAClB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,IAAI,WAAW,MAAM,yBAAyB;IACpD,SAAS,uBAAuB,IAAI,OAAO,IAAI,IAAI;IACnD;GACD;AAEF,UAAQ,MAAM,mCAAmC,IAAI;AACrD,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAAwC;GACvF"}