{"version":3,"sources":["../../protocol/src/ids.ts","../../protocol/src/helpers.ts","../../protocol/src/errors.ts","../../protocol/src/query-limits.ts","../../core/src/tx.ts","../../admin/src/client-services.ts","../../admin/src/realtime-proxy.ts","../../admin/src/client.ts","../../schema/src/index.ts","../src/handshake.ts","../src/federation.ts","../src/index.ts"],"names":["i","issue","init","tx"],"mappings":";;;AAKO,IAAM,gBAAA,GAAmB;AACzB,IAAM,uBAAA,GAA0B,yBAAA;;;ACCjC,SAAU,MAAA,GAAM;AACpB,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAE5B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA;AAC5B,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAQ,EAAA,IAAM,MAAO,KAAK,CAAA;AACrC,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAQ,EAAA,IAAM,MAAO,KAAK,CAAA;AACrC,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAQ,EAAA,IAAM,MAAO,KAAK,CAAA;AACrC,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAQ,EAAA,IAAM,MAAO,KAAK,CAAA;AACrC,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAQ,EAAA,IAAM,KAAM,KAAK,CAAA;AACpC,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,EAAA,GAAK,KAAK,CAAA;AAG5B,EAAA,KAAA,CAAM,CAAC,CAAA,GAAK,KAAA,CAAM,CAAC,IAAK,EAAA,GAAQ,GAAA;AAEhC,EAAA,KAAA,CAAM,CAAC,CAAA,GAAK,KAAA,CAAM,CAAC,IAAK,EAAA,GAAQ,GAAA;AAEhC,EAAA,MAAM,MAAM,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC7E,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAC1G;;;ACpBM,IAAO,SAAA,GAAP,cAAyB,KAAA,CAAK;AACzB,EAAA,IAAA;AACA,EAAA,MAAA;AACA,EAAA,MAAA;AACA,EAAA,SAAA;AACA,EAAA,SAAA;AAET,EAAA,WAAA,CACE,IAAA,EACA,OAAA,EACA,IAAA,GAAqG,EAAA,EAAE;AAEvG,IAAA,KAAA,CAAM,OAAA,EAAS,KAAK,KAAA,KAAU,MAAA,GAAY,SAAY,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA;AAC3E,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,iBAAA,CAAkB,KAAK,MAAM,CAAA;AAChE,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,EAAA;;AASF,eAAsB,iBAAA,CAAkB,UAAoB,SAAA,EAAiB;AAC3E,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAI;AACjC,IAAA,KAAA,GAAQ,IAAA,EAAM,KAAA;EAChB,CAAA,CAAA,MAAQ;AAER,EAAA;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,KAAA,EAAO,IAAA,KAAS,WAAW,KAAA,CAAM,IAAA,GAAO,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,OAAO,KAAA,EAAO,OAAA,KAAY,QAAA,IAAY,KAAA,CAAM,OAAA,GACxD,KAAA,CAAM,OAAA,GACN,CAAA,KAAA,EAAQ,SAAS,CAAA,kBAAA,EAAqB,SAAS,MAAM,CAAA,CAAA;AACzD,EAAA,OAAO,IAAI,SAAA,CAAU,IAAA,EAAM,OAAA,EAAS;AAClC,IAAA,MAAA,EAAQ,QAAA,CAAS,MAAA;AACjB,IAAA,MAAA,EAAQ,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA,GAAI,MAAM,MAAA,GAAS,MAAA;IAC/C,SAAA,EAAW,QAAA,CAAS,SAAS,GAAA,GAAM,cAAc,KAAK,QAAA,CAAS,OAAA,EAAS,GAAA,GAAM,QAAQ,CAAA,IAAK;AAC5F,GAAA,CAAA;AACH;AAIM,SAAU,uBAAuB,QAAA,EAAkB;AACvD,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,EAAS,GAAA,GAAM,uBAAuB,CAAA;AAChE,EAAA,IAAI,QAAA,IAAY,QAAA,KAAa,MAAA,CAAO,gBAAgB,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,SAAA,CAAU,kBAAA,EAAoB,iBAAiB,QAAQ,CAAA,6BAAA,EAAgC,gBAAgB,CAAA,CAAA,EAAI;AACnH,MAAA,MAAA,EAAQ,QAAA,CAAS,MAAA;MACjB,MAAA,EAAQ,EAAE,SAAA,EAAW,gBAAA,EAAkB,QAAA;AACxC,KAAA,CAAA;AACH,EAAA;AACF;AAEA,SAAS,kBAAkB,MAAA,EAA0B;AACnD,EAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,KAAW,UAAa,MAAA,IAAU,GAAA;AAChF;AAEA,SAAS,OAAO,KAAA,EAAc;AAC5B,EAAA,IAAI,KAAA,KAAU,QAAQ,CAAC,QAAA,EAAU,UAAU,SAAS,CAAA,CAAE,QAAA,CAAS,OAAO,KAAK,CAAA;AAAG,IAAA,OAAO,IAAA;AACrF,EAAA,IAAI,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAG,IAAA,OAAO,KAAA,CAAM,MAAM,MAAM,CAAA;AACnD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,IAAQ,OAAO,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,MAAM,CAAA;AACzF;;;ACrEO,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,eAAA,GAAkB,CAAA;AACxB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,cAAA,GAAiB,EAAA;AAYxB,SAAU,cAAc,KAAA,EAAc;AAC1C,EAAA,IAAI,CAAC,SAAS,KAAK,CAAA,IAAK,OAAO,IAAA,CAAK,KAAK,EAAE,MAAA,KAAW,CAAA;AAAG,IAAA,OAAO,QAAQ,2CAA2C,CAAA;AACnH,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAG;AAEpB,EAAA,MAAM,IAAA,GAAO,CAAC,IAAA,EAAe,IAAA,EAAc,KAAA,KAAoC;AAC7E,IAAA,IAAI,CAAC,SAAS,IAAI,CAAA;AAAG,MAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,kBAAA,CAAoB,CAAA;AAC/D,IAAA,IAAI,IAAA,CAAK,IAAI,IAAI,CAAA;AAAG,MAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,iBAAA,CAAmB,CAAA;AAC7D,IAAA,IAAA,CAAK,IAAI,IAAI,CAAA;AACb,IAAA,KAAA,EAAA;AACA,IAAA,IAAI,KAAA,GAAQ,eAAA,IAAmB,KAAA,GAAQ,eAAA,EAAiB;AACtD,MAAA,OAAO,OAAA,CAAQ,CAAA,cAAA,EAAiB,eAAe,CAAA,oBAAA,EAAuB,eAAe,CAAA,MAAA,CAAQ,CAAA;AAC/F,IAAA;AACA,IAAA,IAAI,IAAA,CAAK,MAAM,MAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA;AAChD,MAAA,IAAI,SAAA;AAAW,QAAA,OAAO,SAAA;AACtB,MAAA,MAAM,QAAQ,aAAA,CAAe,IAAA,CAAK,EAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,QAAA,CAAU,CAAA;AAC1E,MAAA,IAAI,KAAA,CAAM,KAAA;AAAO,QAAA,OAAO,KAAA,CAAM,KAAA;AAC9B,MAAA,UAAA,IAAc,KAAA,CAAM,KAAA;AACpB,MAAA,IAAI,UAAA,GAAa,eAAA;AAAiB,QAAA,OAAO,OAAA,CAAQ,CAAA,cAAA,EAAiB,eAAe,CAAA,mBAAA,CAAqB,CAAA;AACxG,IAAA;AACA,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC/C,MAAA,IAAI,GAAA,KAAQ,GAAA;AAAK,QAAA;AACjB,MAAA,IAAI,CAAC,GAAA;AAAK,QAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,gCAAA,CAAkC,CAAA;AAClE,MAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,KAAA,GAAQ,CAAC,CAAA;AACrD,MAAA,IAAI,KAAA;AAAO,QAAA,OAAO,KAAA;AACpB,IAAA;AACA,IAAA,IAAA,CAAK,OAAO,IAAI,CAAA;AAChB,IAAA,OAAO,IAAA;AACT,EAAA,CAAA;AAEA,EAAA,KAAA,MAAW,CAAC,SAAA,EAAW,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACrD,IAAA,IAAI,CAAC,SAAA;AAAW,MAAA,OAAO,QAAQ,mCAAmC,CAAA;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,CAAC,CAAA;AACrC,IAAA,IAAI,KAAA;AAAO,MAAA,OAAO,KAAA;AACpB,EAAA;AACA,EAAA,OAAO,IAAA;AACT;AAEM,SAAU,iBAAA,CAAkB,IAAA,EAAe,IAAA,GAAO,MAAA,EAAM;AAC5D,EAAA,IAAI,CAAC,SAAS,IAAI,CAAA;AAAG,IAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,kBAAA,CAAoB,CAAA;AAC/D,EAAA,MAAM,OAAA,mBAAU,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,SAAS,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,OAAO,CAAC,CAAA;AAChF,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAAG,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAAG,MAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,0BAAA,EAA6B,GAAG,CAAA,CAAA,CAAG,CAAA;AACrH,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,KAAc,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,IAAM,IAAA,CAAK,KAAA,GAAmB,CAAA,IAAM,IAAA,CAAK,QAAmB,eAAA,CAAA,EAAkB;AACzI,IAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,oCAAA,EAAuC,eAAe,CAAA,CAAE,CAAA;AAChF,EAAA;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,KAAc,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA,IAAM,IAAA,CAAK,MAAA,GAAoB,CAAA,IAAM,IAAA,CAAK,SAAoB,gBAAA,CAAA,EAAmB;AAC9I,IAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,qCAAA,EAAwC,gBAAgB,CAAA,CAAE,CAAA;AAClF,EAAA;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,KAAc,OAAO,IAAA,CAAK,WAAW,QAAA,IAAY,IAAA,CAAK,MAAA,CAAO,MAAA,GAAS,iBAAA,CAAA,EAAoB;AAC5G,IAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,oCAAA,EAAuC,iBAAiB,CAAA,WAAA,CAAa,CAAA;AAC7F,EAAA;AACA,EAAA,IAAI,KAAK,KAAA,KAAU,MAAA,IAAa,OAAO,IAAA,CAAK,UAAU,SAAA,EAAW;AAC/D,IAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,wBAAA,CAA0B,CAAA;AAClD,EAAA;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,KAAc,CAAC,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,CAAC,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,KAAM,KAAA,IAAS,CAAA,KAAM,MAAM,CAAA,CAAA,EAAI;AACvK,IAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,0DAAA,CAA4D,CAAA;AACpF,EAAA;AACA,EAAA,IAAI,IAAA,CAAK,UAAU,MAAA,EAAW;AAC5B,IAAA,MAAM,QAAQ,aAAA,CAAc,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAQ,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,KAAA;AAAO,MAAA,OAAO,KAAA,CAAM,KAAA;AAChC,EAAA;AACA,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,aAAA,CAAc,OAA0C,IAAA,EAAY;AAC3E,EAAA,IAAI,KAAA,KAAU,MAAA;AAAW,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,EAAG,KAAA,EAAO,IAAA,EAAI;AACvD,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAG;AACpB,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,EAAgB,WAAA,EAAqB,KAAA,KAAoC;AACrF,IAAA,IAAI,CAAC,SAAS,KAAK,CAAA;AAAG,MAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,kBAAA,CAAoB,CAAA;AACvE,IAAA,IAAI,IAAA,CAAK,IAAI,KAAK,CAAA;AAAG,MAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,iBAAA,CAAmB,CAAA;AACrE,IAAA,IAAI,KAAA,GAAQ,eAAA;AAAiB,MAAA,OAAO,OAAA,CAAQ,CAAA,qBAAA,EAAwB,eAAe,CAAA,OAAA,CAAS,CAAA;AAC5F,IAAA,IAAA,CAAK,IAAI,KAAK,CAAA;AACd,IAAA,KAAA,EAAA;AACA,IAAA,IAAI,KAAA,GAAQ,eAAA;AAAiB,MAAA,OAAO,OAAA,CAAQ,CAAA,cAAA,EAAiB,eAAe,CAAA,mBAAA,CAAqB,CAAA;AACjG,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,SAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACtD,MAAA,KAAA,EAAA;AACA,MAAA,IAAI,KAAA,GAAQ,eAAA;AAAiB,QAAA,OAAO,OAAA,CAAQ,CAAA,cAAA,EAAiB,eAAe,CAAA,iBAAA,CAAmB,CAAA;AAC/F,MAAA,IAAI,KAAA,KAAU,KAAA,IAAS,KAAA,KAAU,IAAA,EAAM;AACrC,QAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,IAAK,UAAU,MAAA,KAAW,CAAA;AAAG,UAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,CAAA,0BAAA,CAA4B,CAAA;AAC3H,QAAA,KAAA,IAASA,EAAAA,GAAI,CAAA,EAAGA,EAAAA,GAAI,SAAA,CAAU,QAAQA,EAAAA,EAAAA,EAAK;AACzC,UAAA,MAAMC,MAAAA,GAAQ,IAAA,CAAK,SAAA,CAAUD,EAAC,CAAA,EAAG,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,EAAIA,EAAC,CAAA,CAAA,CAAA,EAAK,QAAQ,CAAC,CAAA;AAC3E,UAAA,IAAIC,MAAAA;AAAO,YAAA,OAAOA,MAAAA;AACpB,QAAA;AACA,QAAA;AACF,MAAA;AACA,MAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA;AAAG,QAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,gCAAA,EAAmC,KAAK,CAAA,CAAA,CAAG,CAAA;AACjG,MAAA,IAAI,SAAS,SAAS,CAAA;AAAG,QAAA;AACzB,MAAA,IAAI,CAAC,SAAS,SAAS,CAAA;AAAG,QAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,CAAA,oCAAA,CAAsC,CAAA;AACtG,MAAA,MAAM,SAAA,mBAAY,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,KAAA,EAAO,OAAO,CAAC,CAAA;AAC/E,MAAA,IAAI,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,MAAA,KAAW,CAAA;AAAG,QAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,CAAA,gCAAA,CAAkC,CAAA;AACjH,MAAA,KAAA,MAAW,CAAC,QAAA,EAAU,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC3D,QAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AAAG,UAAA,OAAO,QAAQ,CAAA,EAAG,WAAW,IAAI,KAAK,CAAA,4BAAA,EAA+B,QAAQ,CAAA,CAAA,CAAG,CAAA;AAC9G,QAAA,IAAI,aAAa,KAAA,EAAO;AACtB,UAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IAAK,OAAA,CAAQ,MAAA,GAAS,aAAA,IAAiB,CAAC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EAAG;AACzF,YAAA,OAAO,QAAQ,CAAA,EAAG,WAAW,IAAI,KAAK,CAAA,0BAAA,EAA6B,aAAa,CAAA,cAAA,CAAgB,CAAA;AAClG,UAAA;AACF,QAAA,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAC/B,UAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,IAAI,WAAA,GAAc,MAAA,CAAO,OAAO,CAAA,CAAE,UAAA,GAAa,cAAA,EAAgB;AAChG,YAAA,OAAO,QAAQ,CAAA,EAAG,WAAW,IAAI,KAAK,CAAA,uBAAA,EAA0B,cAAc,CAAA,YAAA,CAAc,CAAA;AAC9F,UAAA;AACA,UAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACxC,UAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,IAAM,iBAAiB,EAAA,KAAO,YAAA,KAAiB,OAAA,CAAQ,MAAA,GAAS,CAAA,IAAK,OAAA,CAAQ,WAAA,CAAY,GAAG,MAAM,YAAA,CAAA,EAAgB;AACxI,YAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,CAAA,oEAAA,CAAsE,CAAA;AAC9G,UAAA;AACA,UAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AACvC,YAAA,OAAO,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,CAAA,uCAAA,CAAyC,CAAA;AACjF,UAAA;QACF,CAAA,MAAA,IAAW,CAAC,QAAA,CAAS,OAAO,CAAA,EAAG;AAC7B,UAAA,OAAO,QAAQ,CAAA,EAAG,WAAW,IAAI,KAAK,CAAA,CAAA,EAAI,QAAQ,CAAA,iBAAA,CAAmB,CAAA;AACvE,QAAA;AACF,MAAA;AACF,IAAA;AACA,IAAA,IAAA,CAAK,OAAO,KAAK,CAAA;AACjB,IAAA,OAAO,IAAA;AACT,EAAA,CAAA;AACA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AACjC,EAAA,OAAO,EAAE,OAAO,KAAA,EAAK;AACvB;AAEA,SAAS,QAAQ,OAAA,EAAe;AAC9B,EAAA,OAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,OAAA,EAAO;AACzC;AAEA,SAAS,QAAQ,OAAA,EAAe;AAC9B,EAAA,OAAO,EAAE,IAAA,EAAM,mBAAA,EAAqB,OAAA,EAAO;AAC7C;AAEA,SAAS,SAAS,KAAA,EAAc;AAC9B,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,SAAS,KAAA,EAAc;AAC9B,EAAA,OAAO,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,KAAA,KAAU,SAAA,IAAc,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,SAAS,KAAK,CAAA;AACzI;;;ACjJM,IAAO,UAAP,MAAc;AAGR,EAAA,EAAA;AACA,EAAA,EAAA;AAHD,EAAA,GAAA,GAAY,EAAA;AACrB,EAAA,WAAA,CACU,IACA,EAAA,EAAa;AADb,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACA,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACP,EAAA;AACH,EAAA,MAAA,CAAO,KAAA,EAAY;AACjB,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,KAAA,EAAO,CAAA;AAC9D,IAAA,OAAO,IAAA;AACT,EAAA;AACA,EAAA,KAAA,CAAM,KAAA,EAA2B;AAC/B,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG,OAAA,EAAS,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,KAAA,EAAO,CAAA;AAC7D,IAAA,OAAO,IAAA;AACT,EAAA;EACA,MAAA,GAAM;AACJ,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,CAAA;AACvD,IAAA,OAAO,IAAA;AACT,EAAA;;;;;;;;AAQA,EAAA,OAAA,CAAQ,KAAA,EAAe;AACrB,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,KAAA,EAAO,CAAA;AAC/D,IAAA,OAAO,IAAA;AACT,EAAA;AACA,EAAA,IAAA,CAAK,OAAe,MAAA,EAAiB;AACnC,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG,MAAA,EAAQ,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,KAAA,EAAO,QAAQ,CAAA;AACpE,IAAA,OAAO,IAAA;AACT,EAAA;AACA,EAAA,MAAA,CAAO,OAAe,MAAA,EAAiB;AACrC,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,KAAA,EAAO,QAAQ,CAAA;AACtE,IAAA,OAAO,IAAA;AACT,EAAA;;AAUI,SAAU,UAAU,KAAA,EAAc;AACtC,EAAA,IAAI,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAG,IAAA,OAAO,KAAA,CAAM,QAAQ,SAAS,CAAA;AACxD,EAAA,IAAI,KAAA,YAAiB,OAAA;AAAS,IAAA,OAAO,KAAA,CAAM,GAAA;AAC3C,EAAA,OAAO,CAAC,KAAK,CAAA;AACf;AAGO,IAAM,EAAA,GAAqC,IAAI,KAAA,CACpD,EAAA,EACA;AACE,EAAA,GAAA,CAAI,IAAI,EAAA,EAAU;AAChB,IAAA,OAAO,IAAI,KAAA,CAAM,EAAA,EAAI,EAAE,GAAA,EAAK,CAAC,EAAA,EAAI,EAAA,KAAwB,IAAI,OAAA,CAAQ,EAAA,EAAI,EAAE,GAAG,CAAA;AAChF,EAAA;AACD,CAAA,CAAA;;;AC1DG,SAAU,oBACd,IAAA,EAA0B;AAE1B,EAAA,OAAO;AACL,IAAA,MAAM,MAAA,CACJ,IAAA,EACA,IAAA,EACA,WAAA,GAAc,4BACd,aAAA,EAAa;AAEb,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AACzC,MAAA,MAAM,MAAA,GAAS,aAAA,EAAe,OAAA,GAAU,YAAA,GAAe,EAAA;AACvD,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAC1B,UACA,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,MAAA,EAAS,WAAW,CAAA,EAAG,MAAM,EAAE,CAAA,EAAG;QAC5D,MAAA,EAAQ,KAAA;QACR,OAAA,EAAS;AACP,UAAA,GAAG,KAAK,iBAAA,EAAiB;UACzB,cAAA,EAAgB;;QAElB,IAAA,EAAM;OACP,CAAC,CAAA;AAEJ,MAAA,OAAA,CAAS,MAAM,QAAA,CAAS,IAAA,EAAI,EAA6B,IAAA;AAC3D,IAAA,CAAA;IACA,MAAM,IAAA,CAAK,IAAA,EAAM,UAAA,GAAa,GAAA,EAAG;AAC/B,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AACzC,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;QACjC,IAAA,EAAM,GAAA;AACN,QAAA,GAAA,EAAK,OAAO,UAAU;AACvB,OAAA,CAAA;AACD,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAC1B,QACA,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,MAAA,EAAS,WAAW,CAAA,CAAA,EAAI,MAAM,EAAE,CAAA,EAAG;AAC7D,QAAA,OAAA,EAAS,KAAK,iBAAA;OACf,CAAC,CAAA;AAMJ,MAAA,OAAO,KAAK,QAAA,CAAA,CAAW,MAAM,QAAA,CAAS,IAAA,IAA4B,GAAG,CAAA;AACvE,IAAA,CAAA;AACA,IAAA,MAAM,OAAO,IAAA,EAAI;AACf,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,OAAA,CACT,QAAA,EACA,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,MAAA,EAAS,WAAW,CAAA,CAAE,CAAA,EAAG;QACnD,MAAA,EAAQ,QAAA;AACR,QAAA,OAAA,EAAS,KAAK,iBAAA;OACf,CAAC,CAAA;AAEN,IAAA;;AAEJ;AAGM,SAAU,kBACd,IAAA,EAA0B;AAE1B,EAAA,OAAO;IACL,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,EAAO,UAAA,EAAU;AACvC,MAAA,MAAM,SAAS,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,YAAY,CAAA;AACxD,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAC1B,mBACA,MAAM,IAAA,CAAK,OAAA,CACT,IAAA,CAAK,GAAA,CACH,CAAA,kBAAA,EAAqB,mBAAmB,MAAM,CAAC,CAAA,WAAA,CAAA,GAC7C,MAAM,CAAA,EAEV,EAAE,SAAS,IAAA,CAAK,iBAAA,EAAiB,EAAI,CACtC,CAAA;AAEH,MAAA,OAAQ,MAAM,SAAS,IAAA,EAAI;AAC7B,IAAA,CAAA;AACA,IAAA,MAAM,QAAQ,KAAA,EAAK;AACjB,MAAA,MAAM,EAAE,MAAA,EAAQ,GAAG,IAAA,EAAI,GAAK,KAAA;AAC5B,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAC1B,iBACA,MAAM,IAAA,CAAK,OAAA,CACT,IAAA,CAAK,IACH,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,MAAM,CAAC,YAAY,CAAA,EAE7D;QACE,MAAA,EAAQ,MAAA;AACR,QAAA,OAAA,EAAS,KAAK,OAAA,EAAO;QACrB,IAAA,EAAM,IAAA,CAAK,UAAU,IAAI;OAC1B,CACF,CAAA;AAEH,MAAA,OAAQ,MAAM,SAAS,IAAA,EAAI;AAI7B,IAAA,CAAA;AACA,IAAA,MAAM,QAAQ,KAAA,EAAK;AACjB,MAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAS,GAAG,MAAI,GAAK,KAAA;AACrC,MAAA,MAAM,WAAW,MAAM,IAAA,CAAK,QAC1B,eAAA,EACA,MAAM,KAAK,OAAA,CACT,IAAA,CAAK,IACH,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,MAAM,CAAC,CAAA,QAAA,EAC1C,mBAAmB,OAAO,CAAC,WAAW,CAAA,EAE7C;QACE,MAAA,EAAQ,MAAA;AACR,QAAA,OAAA,EAAS,KAAK,OAAA,EAAO;QACrB,IAAA,EAAM,IAAA,CAAK,UAAU,IAAI;OAC1B,CACF,CAAA;AAEH,MAAA,OAAQ,MAAM,SAAS,IAAA,EAAI;AAI7B,IAAA,CAAA;IACA,MAAM,gBAAA,CAAiB,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAK;AAC3C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,EAAE,OAAO,CAAA;AAC5C,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAC1B,kBAAA,EACA,MAAM,IAAA,CAAK,OAAA,CACT,IAAA,CAAK,GAAA,CACH,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,MAAM,CAAC,CAAA,QAAA,EAC1C,kBAAA,CAAmB,OAAO,CAAC,CAAA,SAAA,EAAY,MAAM,CAAA,CAAE,CAAA,EAEtD,EAAE,OAAA,EAAS,IAAA,CAAK,iBAAA,EAAiB,EAAI,CACtC,CAAA;AAEH,MAAA,OAAO;AACL,QAAA,KAAA,EAAO,IAAI,UAAA,CAAW,MAAM,QAAA,CAAS,aAAa,CAAA;AAClD,QAAA,WAAA,EACE,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK;;AAE9C,IAAA;;AAEJ;AAGM,SAAU,oBACd,IAAA,EAA0B;AAE1B,EAAA,OAAO;AACL,IAAA,MAAM,IAAI,IAAA,EAAI;AACZ,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAC1B,cACA,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,QAAA,EAAW,kBAAA,CAAmB,IAAI,CAAC,EAAE,CAAA,EAAG;AAClE,QAAA,OAAA,EAAS,KAAK,iBAAA;OACf,CAAC,CAAA;AAEJ,MAAA,OAAA,CAAS,MAAM,QAAA,CAAS,IAAA,EAAI,EAA0B,KAAA;AACxD,IAAA;;AAEJ;;;ACpKO,IAAM,2BAAA,GAA8B,uBAAA;AAE3C,IAAM,iBAAA,GAAoB,EAAA;AAC1B,IAAM,qBAAA,GAAwB,IAAA;AAC9B,IAAM,qBAAA,GAAwB,GAAA;AAuCxB,SAAU,oBACd,SAAA,EAAiC;AAEjC,EAAA,OAAO;IACL,MAAM,KAAA,CAAM,SAAS,OAAA,EAAO;AAC1B,MAAA,IAAI,OAAA,CAAQ,WAAW,KAAA,EAAO;AAC5B,QAAA,OAAO,IAAI,SAAS,oBAAA,EAAsB;UACxC,MAAA,EAAQ,GAAA;UACR,OAAA,EAAS,EAAE,OAAO,KAAA;AACnB,SAAA,CAAA;AACH,MAAA;AACA,MAAA,IAAI,OAAA,CAAQ,QAAQ,GAAA,CAAI,SAAS,GAAG,IAAA,EAAI,CAAG,WAAA,EAAW,KAAO,WAAA,EAAa;AACxE,QAAA,OAAO,IAAI,SAAS,kBAAA,EAAoB;UACtC,MAAA,EAAQ,GAAA;UACR,OAAA,EAAS,EAAE,SAAS,WAAA;AACrB,SAAA,CAAA;AACH,MAAA;AAEA,MAAA,MAAM,cAAA,GAAiB,uBAAA,CAAwB,OAAA,EAAS,cAAc,CAAA;AACtE,MAAA,MAAM,gBAAgB,yBAAA,CACpB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AAE/B,MAAA,IAAI,kBAAkB,IAAA,IAAQ,CAAC,cAAA,CAAe,GAAA,CAAI,aAAa,CAAA,EAAG;AAChE,QAAA,OAAO,IAAI,QAAA,CAAS,WAAA,EAAa,EAAE,MAAA,EAAQ,KAAK,CAAA;AAClD,MAAA;AAEA,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,OAAA,EAAS,OAAO,CAAA;AAChD,MAAA,MAAM,UAAA,GAAa,QAAQ,gBAAA,IAAoB,qBAAA;AAC/C,MAAA,IACE,CAAC,OAAO,SAAA,CAAU,UAAU,KAC5B,UAAA,GAAa,CAAA,IACb,aAAa,qBAAA,EACb;AACA,QAAA,MAAM,IAAI,SAAA,CACR,CAAA,6DAAA,EAAgE,qBAAqB,CAAA,CAAE,CAAA;AAE3F,MAAA;AAEA,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,EAAE,OAAA,EAAS,YAAY,CAAA;AAC/C,MAAA,IAAI,KAAA,CAAM,SAAS,qBAAA,EAAuB;AACxC,QAAA,MAAM,IAAI,SAAA,CACR,CAAA,2CAAA,EAA8C,qBAAqB,CAAA,YAAA,CAAc,CAAA;AAErF,MAAA;AAEA,MAAA,MAAM,WAAW,IAAI,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,SAAS,CAAA,EAAG;QACrD,MAAA,EAAQ,KAAA;QACR,OAAA,EAAS;UACP,aAAA,EAAe,CAAA,OAAA,EAAU,UAAU,UAAU,CAAA,CAAA;UAC7C,CAAC,uBAAuB,GAAG,MAAA,CAAO,gBAAgB,CAAA;UAClD,OAAA,EAAS,WAAA;AACT,UAAA,CAAC,2BAA2B,GAAG;;AAElC,OAAA,CAAA;AACD,MAAA,OAAO,SAAA,CAAU,QAAQ,QAAQ,CAAA;AACnC,IAAA;;AAEJ;AAEA,SAAS,gBAAgB,KAAA,EAAc;AACrC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,MAAM,MAAA,GAAS,CAAA,IAAK,KAAA,CAAM,MAAA,GAAS,iBAAA,EAAmB;AACjF,IAAA,MAAM,IAAI,SAAA,CACR,CAAA,8CAAA,EAAiD,iBAAiB,CAAA,cAAA,CAAgB,CAAA;AAEtF,EAAA;AACA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,CAAA,IAAK,KAAA,CAAM,SAAO,EAAI;AAC5C,IAAA,MAAM,KAAA,GAAQ,cAAc,KAAK,CAAA;AACjC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,SAAA,CACR,CAAA,uBAAA,EAA0B,KAAK,CAAA,cAAA,EAAiB,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAEnE,IAAA;AACF,EAAA;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,UAAU,KAAA,EAAc;AAC/B,EAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA,CAAE,QAAQ,kBAAA,EAAoB,CAAC,cACxD,CAAA,GAAA,EAAM,SAAA,CAAU,WAAW,CAAC,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAEjE;AAEA,SAAS,wBAAwB,KAAA,EAAc;AAC7C,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,UAAU,iDAAiD,CAAA;AACvE,EAAA;AACA,EAAA,OAAO,IAAI,GAAA,CACT,KAAA,CAAM,GAAA,CAAI,CAAC,MAAA,EAAQ,KAAA,KACjB,eAAA,CAAgB,MAAA,EAAQ,CAAA,eAAA,EAAkB,KAAK,CAAA,CAAA,CAAG,CAAC,CACpD,CAAA;AAEL;AAEA,SAAS,0BAA0B,KAAA,EAAoB;AACrD,EAAA,IAAI;AACF,IAAA,OAAO,eAAA,CAAgB,OAAO,gBAAgB,CAAA;EAChD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAEA,SAAS,eAAA,CAAgB,OAAgB,KAAA,EAAa;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,SAAA,CACR,CAAA,eAAA,EAAkB,KAAK,CAAA,kDAAA,CAAoD,CAAA;AAE/E,EAAA;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,KAAK,CAAA;EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,SAAA,CACR,CAAA,eAAA,EAAkB,KAAK,CAAA,kDAAA,CAAoD,CAAA;AAE/E,EAAA;AACA,EAAA,IACG,OAAO,QAAA,KAAa,OAAA,IAAW,OAAO,QAAA,KAAa,QAAA,IACpD,OAAO,QAAA,IACP,MAAA,CAAO,YACP,MAAA,CAAO,QAAA,KAAa,OACpB,MAAA,CAAO,MAAA,IACP,OAAO,IAAA,IACP,MAAA,CAAO,WAAW,MAAA,EAClB;AACA,IAAA,MAAM,IAAI,SAAA,CACR,CAAA,eAAA,EAAkB,KAAK,CAAA,kDAAA,CAAoD,CAAA;AAE/E,EAAA;AACA,EAAA,OAAO,MAAA,CAAO,MAAA;AAChB;;;ACzJM,SAAU,KAAK,IAAA,EAAkB;AACrC,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,OAAO,EAAE,CAAA;AAI5C,EAAA,MAAM,OAAA,GACJ,KAAK,KAAA,KAAU,CAAC,OAAOC,KAAAA,KAAS,UAAA,CAAW,KAAA,CAAM,KAAA,EAAOA,KAAI,CAAA,CAAA;AAC9D,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAiB,CAAA,EAAG,IAAI,CAAA,KAAA,EAAQ,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC/D,EAAA,MAAM,WAAA,GAAc,CAAC,IAAA,KAAwB;AAC3C,IAAA,IACE,OAAO,IAAA,KAAS,QAAA,IAChB,CAAC,IAAA,IACD,KAAK,UAAA,CAAW,GAAG,CAAA,IACnB,IAAA,CAAK,SAAS,GAAG,CAAA,IACjB,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAClB;AACA,MAAA,MAAM,IAAI,UACR,gEAAgE,CAAA;AAEpE,IAAA;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC/B,IAAA,IACE,SAAS,IAAA,CACP,CAAC,YACC,CAAC,OAAA,IACD,YAAY,GAAA,IACZ,OAAA,KAAY,IAAA,IACZ,aAAA,CAAc,KAAK,OAAO,CAAA,IAC1B,wBAAwB,IAAA,CAAK,OAAO,CAAC,CAAA,EAEzC;AACA,MAAA,MAAM,IAAI,UACR,wEAAwE,CAAA;AAE5E,IAAA;AACA,IAAA,OAAO,QAAA,CAAS,IAAI,CAAC,OAAA,KAAY,mBAAmB,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACxE,EAAA,CAAA;AACA,EAAA,MAAM,oBAAoB,OAA+B;IACvD,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,UAAU,CAAA,CAAA;IACxC,CAAC,uBAAuB,GAAG,MAAA,CAAO,gBAAgB,CAAA;AAClD,IAAA,GAAI,KAAK,iBAAA,GACL;AACE,MAAA,gCAAA,EAAkC,KAAK,iBAAA,CAAkB,IAAA;AACzD,MAAA,8BAAA,EAAgC,KAAK,iBAAA,CAAkB;QAEzD;;AAEN,EAAA,MAAM,OAAA,GAAU,CAAC,OAAA,KAAqD;AACpE,IAAA,MAAM,MAAA,GAAiC;AACrC,MAAA,GAAG,iBAAA,EAAiB;MACpB,cAAA,EAAgB;;AAElB,IAAA,IAAI,OAAA,EAAS,MAAA;AAAQ,MAAA,MAAA,CAAO,gBAAgB,IAAI,OAAA,CAAQ,MAAA;AACxD,IAAA,IAAI,OAAA,EAAS,MAAA,IAAU,OAAA,EAAS,OAAA,EAAS;AACvC,MAAA,MAAA,CAAO,iBAAiB,IAAI,OAAA,CAAQ,OAAA;AACtC,IAAA;AACA,IAAA,IAAI,OAAA,EAAS,MAAA,IAAU,OAAA,EAAS,eAAA,EAAiB;AAC/C,MAAA,MAAA,CAAO,0BAA0B,IAAI,OAAA,CAAQ,eAAA;AAC/C,IAAA;AACA,IAAA,IACE,iBAAA,KAAsB,OAAA,IAAW,EAAA,CAAA,IACjC,SAAS,eAAA,EACT;AACA,MAAA,MAAA,CAAO,yBAAyB,CAAA,GAAI,IAAA,CAAK,SAAA,CACvC,QAAQ,eAAe,CAAA;AAE3B,IAAA;AACA,IAAA,IACE,8BAAA,KAAmC,OAAA,IAAW,EAAA,CAAA,IAC9C,SAAS,4BAAA,EACT;AACA,MAAA,MAAA,CAAO,kCAAkC,CAAA,GAAI,IAAA,CAAK,SAAA,CAChD,QAAQ,4BAA4B,CAAA;AAExC,IAAA;AACA,IAAA,OAAO,MAAA;AACT,EAAA,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,OACd,SAAA,EACA,QAAA,KACqB;AACrB,IAAA,sBAAA,CAAuB,QAAQ,CAAA;AAC/B,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA;AAAI,MAAA,MAAM,MAAM,iBAAA,CAAkB,QAAA,EAAU,SAAS,CAAA;AACnE,IAAA,OAAO,QAAA;AACT,EAAA,CAAA;AACA,EAAA,MAAM,SAAA,GAAkC;AACtC,IAAA,GAAA;AACA,IAAA,QAAA,EAAU,CAAC,SAAA,KAAc,IAAI,IAAI,SAAA,EAAW,IAAI,EAAE,QAAA,EAAQ;AAC1D,IAAA,OAAA;AACA,IAAA,OAAA;AACA,IAAA,iBAAA;AACA,IAAA,OAAA;AACA,IAAA;;AAGF,EAAA,OAAO;AACL,IAAA,EAAA;IACA,MAAM,KAAA,CAAM,OAAO,OAAA,EAAO;AACxB,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CACrB,OAAA,EACA,MAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;QAC1B,MAAA,EAAQ,MAAA;AACR,QAAA,OAAA,EAAS,QAAQ,OAAO,CAAA;AACxB,QAAA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO;OAC/B,CAAC,CAAA;AAEJ,MAAA,OAAA,CAAS,MAAM,QAAA,CAAS,IAAA,EAAI,EAAgC,MAAA;AAC9D,IAAA,CAAA;IACA,MAAM,eAAA,CAAgB,OAAO,OAAA,EAAO;AAClC,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CACrB,OAAA,EACA,MAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;QAC1B,MAAA,EAAQ,MAAA;AACR,QAAA,OAAA,EAAS,QAAQ,OAAO,CAAA;AACxB,QAAA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO;OAC/B,CAAC,CAAA;AAEJ,MAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAI;AAIjC,MAAA,OAAO,EAAE,QAAQ,IAAA,CAAK,MAAA,EAAQ,QAAQ,IAAA,CAAK,MAAA,IAAU,EAAA,EAAE;AACzD,IAAA,CAAA;IACA,MAAM,QAAA,CAAS,OAAO,OAAA,EAAO;AAC3B,MAAA,MAAM,GAAA,GAAM,UAAU,KAAK,CAAA;AAC3B,MAAA,MAAM,UAAA,GAAa,OAAA,EAAS,UAAA,IAAc,MAAA,CAAO,UAAA,EAAU;AAC3D,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CACrB,UAAA,EACA,MAAM,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG;QAC7B,MAAA,EAAQ,MAAA;AACR,QAAA,OAAA,EAAS,QAAQ,OAAO,CAAA;AACxB,QAAA,IAAA,EAAM,KAAK,SAAA,CAAU;AACnB,UAAA,UAAA;AACA,UAAA,GAAA;AACA,UAAA,GAAI,SAAS,MAAA,GAAS,EAAE,QAAQ,OAAA,CAAQ,MAAA,KAAW;AACpD,SAAA;OACF,CAAC,CAAA;AAEJ,MAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAI;AAIjC,MAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,SAAA,EAAW,IAAA,CAAK,cAAc,IAAA,EAAI;AAC9D,IAAA,CAAA;AACA,IAAA,MAAM,SAAA,CAAU,EAAA,EAAI,IAAA,EAAM,YAAA,EAAc,OAAA,EAAO;AAC7C,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CACrB,WAAA,EACA,MAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;QAC9B,MAAA,EAAQ,MAAA;AACR,QAAA,OAAA,EAAS,QAAQ,OAAO,CAAA;AACxB,QAAA,IAAA,EAAM,KAAK,SAAA,CAAU;AACnB,UAAA,EAAA;UACA,IAAA,EAAM,YAAA;UACN,SAAA,EAAW;AACZ,SAAA;OACF,CAAC,CAAA;AAEJ,MAAA,OAAA,CAAS,MAAM,QAAA,CAAS,IAAA,EAAI,EACzB,SAAA;AACL,IAAA,CAAA;IACA,MAAM,cAAA,CAAe,UAA8B,OAAA,EAAO;AACxD,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CACrB,iBAAA,EACA,MAAM,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAG;QACpC,MAAA,EAAQ,MAAA;AACR,QAAA,OAAA,EAAS,QAAQ,OAAO,CAAA;AACxB,QAAA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,UAAA,EAAY,UAAU;OAC9C,CAAC,CAAA;AAEJ,MAAA,OAAA,CAAS,MAAM,QAAA,CAAS,IAAA,EAAI,EACzB,UAAA;AACL,IAAA,CAAA;IACA,MAAM,OAAA,CAAQ,OAAA,GAAU,EAAA,EAAE;AACxB,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAe;AAClC,MAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,QAAA,MAAA,CAAO,IAAI,OAAA,EAAS,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AAChD,QAAA,MAAA,CAAO,IAAI,OAAA,EAAS,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAC,CAAA;AACjD,MAAA;AACA,MAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,QAAA,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAC3C,MAAA;AACA,MAAA,MAAM,SAAS,MAAA,CAAO,IAAA,GAAO,CAAA,GAAI,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,GAAK,EAAA;AAChD,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CACrB,SAAA,EACA,MAAM,QAAQ,GAAA,CAAI,CAAA,OAAA,EAAU,MAAM,CAAA,CAAE,CAAA,EAAG;AACrC,QAAA,OAAA,EAAS,OAAA;OACV,CAAC,CAAA;AAEJ,MAAA,OAAQ,MAAM,SAAS,IAAA,EAAI;AAC7B,IAAA,CAAA;AACA,IAAA,QAAA,EAAU,mBAAA,CAAoB;AAC5B,MAAA,GAAA;AACA,MAAA,OAAA;AACA,MAAA,UAAA,EAAY,IAAA,CAAK;AAClB,KAAA,CAAA;AACD,IAAA,OAAA,EAAS,oBAAoB,SAAS,CAAA;AACtC,IAAA,KAAA,EAAO,kBAAkB,SAAS,CAAA;AAClC,IAAA,OAAA,EAAS,oBAAoB,SAAS;;AAE1C;;;AClNM,IAAO,IAAA,GAAP,MAAO,KAAA,CAAI;AAIJ,EAAA,IAAA;AACA,EAAA,OAAA;AACA,EAAA,QAAA;AACA,EAAA,SAAA;AAJX,EAAA,WAAA,CACW,MACA,OAAA,GAAU,KAAA,EACV,QAAA,GAAW,KAAA,EACX,YAAY,KAAA,EAAK;AAHjB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACR,EAAA;EAEH,MAAA,GAAM;AACJ,IAAA,OAAO,IAAI,MAAa,IAAA,CAAK,IAAA,EAAM,MAAM,IAAA,CAAK,QAAA,EAAU,KAAK,SAAS,CAAA;AACxE,EAAA;EACA,OAAA,GAAO;AACL,IAAA,OAAO,IAAI,MAAa,IAAA,CAAK,IAAA,EAAM,KAAK,OAAA,EAAS,IAAA,EAAM,KAAK,SAAS,CAAA;AACvE,EAAA;EACA,QAAA,GAAQ;AACN,IAAA,OAAO,IAAI,MAA2B,IAAA,CAAK,IAAA,EAAM,KAAK,OAAA,EAAS,IAAA,CAAK,UAAU,IAAI,CAAA;AACpF,EAAA;EAEA,SAAA,GAAS;AACP,IAAA,OAAO;AACL,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,MAAA,EAAQ,IAAA,CAAK,OAAA;AACb,MAAA,OAAA,EAAS,IAAA,CAAK,QAAA;AACd,MAAA,QAAA,EAAU,IAAA,CAAK;;AAEnB,EAAA;;AAcI,IAAO,aAAP,MAAiB;AAKV,EAAA,QAAA;AACA,EAAA,KAAA;AAFX,EAAA,WAAA,CACW,UACA,KAAA,EAAQ;AADR,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACR,EAAA;EAEH,SAAA,GAAS;AACP,IAAA,MAAM,WAA6C,EAAA;AACnD,IAAA,KAAA,MAAW,CAAC,IAAI,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,EAAG;AACrD,MAAA,MAAM,QAAwC,EAAA;AAC9C,MAAA,KAAA,MAAW,CAAC,OAAO,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACrD,QAAA,KAAA,CAAM,KAAK,CAAA,GAAI,IAAA,CAAK,SAAA,EAAS;AAC/B,MAAA;AACA,MAAA,QAAA,CAAS,EAAE,CAAA,GAAI,EAAE,KAAA,EAAK;AACxB,IAAA;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,EAAE,GAAI,IAAA,CAAK,OAAwC,EAAE;AACjF,EAAA;;AAIK,IAAM,CAAA,GAAI;EACf,MAAA,EAAQ,MAAM,IAAI,IAAA,CAAa,QAAQ,CAAA;EACvC,MAAA,EAAQ,MAAM,IAAI,IAAA,CAAa,QAAQ,CAAA;EACvC,OAAA,EAAS,MAAM,IAAI,IAAA,CAAc,SAAS,CAAA;EAC1C,IAAA,EAAM,MAAM,IAAI,IAAA,CAAsB,MAAM,CAAA;EAC5C,IAAA,EAAM,MAA6B,IAAI,IAAA,CAAQ,MAAM,CAAA;AAErD,EAAA,MAAA,CAAyD,KAAA,EAAQ;AAC/D,IAAA,OAAO,EAAE,KAAA,EAAK;AAChB,EAAA,CAAA;AAEA,EAAA,MAAA,CAGE,GAAA,EAA+B;AAC/B,IAAA,OAAO,IAAI,UAAA,CAAW,GAAA,CAAI,UAAW,GAAA,CAAI,KAAA,IAAS,EAAQ,CAAA;AAC5D,EAAA;;;;AClEK,IAAM,mCAAA,GACX,CAAC,YAAA,EAAc,UAAA,EAAY,cAAc;AAUpC,IAAM,cAAA,GAAiB;AAWvB,IAAM,mBAAA,GAAyC;AAAA,EACpD,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA,uBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAIO,IAAM,mBAAA,GAAyC;AAAA,EACpD,yBAAA;AAAA,EACA,0BAAA;AAAA,EACA,6BAAA;AAAA,EACA,8BAAA;AAAA,EACA,wBAAA;AAAA,EACA,wBAAA;AAAA,EACA,sBAAA;AAAA,EACA,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA,uBAAA;AAAA,EACA,4BAAA;AAAA,EACA,wBAAA;AAAA,EACA,wBAAA;AAAA,EACA,mBAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF;AA4EA,SAAS,eAAA,CAAgB,QAAA,EAAkB,OAAA,EAAkC,MAAA,EAAqC;AAChH,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACvC,EAAA,OAAO,OAAO,MAAM,IAAA,KAAS;AAC3B,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACrC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,CAAC,uBAAuB,GAAG,MAAA,CAAO,gBAAY;AAAA,SAChD;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,QACzB;AAAA,OACD,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,QAAQ,OAAA,IAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,SAAS,YAAA,EAAe;AAC9E,QAAA,MAAM,IAAI,SAAA,CAAU,SAAA,EAAW,4BAAA,EAA8B,EAAE,OAAO,CAAA;AAAA,MACxE;AACA,MAAA,MAAM,IAAI,UAAU,eAAA,EAAiB,+BAAA,EAAiC,EAAE,KAAA,EAAO,SAAA,EAAW,MAAM,CAAA;AAAA,IAClG;AAAA,EACF,CAAA;AACF;AAsBA,eAAsB,aAAa,IAAA,EAAiD;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY,GAAI,EAAA;AACjF,EAAA,IAAI,MAAM,MAAA,GAAS,GAAA,IAAO,CAAC,4BAAA,CAA6B,IAAA,CAAK,KAAK,CAAA,EAAG;AACnE,IAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,EAAa,IAAA,GAAO,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA,CAAE,WAAA,EAAY;AAC3E,EAAA,IAAI,gBAAgB,MAAA,IAAa,CAAC,wBAAA,CAAyB,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5E,IAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,IAAA,GAAO,gBAAgB,IAAA,CAAK,QAAA,EAAU,KAAK,KAAA,IAAS,UAAA,CAAW,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AACvF,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,EAAc;AAAA,IACxC,KAAA;AAAA,IACA,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,GAAI,WAAA,GAAc,EAAE,WAAA,KAAgB,EAAC;AAAA,IACrC,GAAI,KAAK,MAAA,EAAQ,MAAA,GAAS,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAO,GAAI,EAAC;AAAA,IACrD,GAAI,KAAK,UAAA,EAAY,MAAA,GAAS,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,IACjE,GAAI,KAAK,2BAAA,EAA6B,MAAA,GAClC,EAAE,2BAAA,EAA6B,IAAA,CAAK,2BAAA,EAA4B,GAChE;AAAC,GACN,CAAA;AACD,EAAA,sBAAA,CAAuB,QAAQ,CAAA;AAC/B,EAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,MAAM,iBAAA,CAAkB,UAAU,iBAAiB,CAAA;AAC3E,EAAA,MAAM,EAAE,QAAA,EAAU,UAAA,EAAY,SAAA,EAAW,QAAA,EAAU,iBAAiB,uBAAA,EAAwB,GAAK,MAAM,QAAA,CAAS,IAAA,EAAK;AAQrH,EAAA,MAAM,IAAA,CAAK,OAAO,EAAE,QAAA,EAAU,YAAY,SAAA,EAAW,QAAA,EAAU,eAAA,EAAiB,uBAAA,EAAyB,CAAA;AACzG,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,UAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,IACpC,QAAA;AAAA,IACA,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,QAAQ,IAAA,CAAK;AAAA,GACd,CAAA;AACH;AAYA,eAAsB,aAAa,IAAA,EAAiD;AAClF,EAAA,MAAM,IAAA,GAAO,gBAAgB,IAAA,CAAK,QAAA,EAAU,KAAK,KAAA,IAAS,UAAA,CAAW,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AACvF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,MAAA,KAAW,MAAA,GAAY,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,MAAM,CAAA;AACzG,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA,CAAI,GAAG,IAAA,CAAK,QAAA,IAAY,CAAC,CAAA,GAAI,GAAA;AACrD,EAAA,MAAM,OAAO,CAAC,EAAA,KACZ,IAAI,OAAA,CAAc,CAAC,SAAS,MAAA,KAAW;AACrC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAA,EAAS;AACxB,MAAA,MAAA,CAAO,IAAI,SAAA,CAAU,SAAA,EAAW,4BAAA,EAA8B,EAAE,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,CAAC,CAAA;AAC5F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAU,MAAM;AACpB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,IAAI,SAAA,CAAU,SAAA,EAAW,4BAAA,EAA8B,EAAE,OAAO,IAAA,CAAK,MAAA,EAAQ,MAAA,EAAQ,CAAC,CAAA;AAAA,IAC/F,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,IAAA,CAAK,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AACjD,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,IAAA,CAAK,QAAQ,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAChE,CAAC,CAAA;AAEH,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,QAAA,GAAW,IAAA,CAAK,GAAA,EAAK,CAAC,CAAC,CAAA;AACnE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,iBAAA,EAAmB,EAAE,UAAA,EAAY,IAAA,CAAK,YAAY,CAAA;AACzE,IAAA,sBAAA,CAAuB,GAAG,CAAA;AAC1B,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,QAAU,MAAM,iBAAA,CAAkB,KAAK,gBAAgB,CAAA;AAChE,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAO/C,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,UAAA,IAAc,IAAA,CAAK,OAAO,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAO,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,KAAI,EAAE;AAClH,IAAA,IAAI,IAAA,CAAK,WAAW,QAAA,EAAU;AAC5B,MAAA,MAAM,SAAS,OAAO,IAAA,CAAK,MAAA,KAAW,QAAA,IAAY,KAAK,MAAA,CAAO,IAAA,EAAK,GAC/D,IAAA,CAAK,OAAO,IAAA,EAAK,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,GAC/B,qCAAA;AACJ,MAAA,IAAI,IAAA,CAAK,cAAc,IAAA,EAAM;AAC3B,QAAA,MAAM,IAAI,SAAA;AAAA,UACR,qBAAA;AAAA,UACA,uGAAA;AAAA,UACA,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAE,SACvB;AAAA,MACF;AACA,MAAA,MAAM,IAAI,SAAA;AAAA,QACR,kBAAA;AAAA,QACA,uDAAkD,MAAM,CAAA,CAAA;AAAA,QACxD,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAE,OACvB;AAAA,IACF;AACA,IAAA,IAAI,KAAK,MAAA,KAAW,SAAA,QAAiB,IAAI,SAAA,CAAU,qBAAqB,wBAAwB,CAAA;AAAA,EAClG;AACA,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,IAAA,MAAM,IAAI,SAAA,CAAU,mBAAA,EAAqB,4EAA4E,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EAC1I;AACA,EAAA,MAAM,IAAI,SAAA,CAAU,mBAAA,EAAqB,iDAAiD,CAAA;AAC5F;;;ACzSO,IAAM,kBAAA,GAAqB;AAAA,EAChC,OAAA,EAAS,mBAAA;AAAA,EACT,MAAA,EAAQ,0BAAA;AAAA,EACR,SAAA,EAAW,6BAAA;AAAA,EACX,KAAA,EAAO,yBAAA;AAAA,EACP,SAAA,EAAW;AACb;AAGO,IAAM,kBAAA,GAAqB;AAElC,IAAM,sBAAsB,CAAA,GAAI,GAAA;AAChC,IAAM,MAAA,GAAS,2BAAA;AACf,IAAM,KAAA,GAAQ,yBAAA;AACd,IAAM,SAAA,GAAY,kEAAA;AAiElB,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAEhC,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,SAAS,CAAA,EAAG,MAAA,GAAS,KAAA,CAAM,MAAA,EAAQ,UAAU,CAAA,EAAG;AACvD,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,IAAK,CAAA;AAC3B,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,IAAK,CAAA;AAC/B,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,IAAK,CAAA;AAC/B,IAAA,MAAM,KAAA,GAAS,CAAA,IAAK,EAAA,GAAO,CAAA,IAAK,CAAA,GAAK,CAAA;AACrC,IAAA,MAAA,IAAU,SAAA,CAAW,KAAA,KAAU,EAAA,GAAM,EAAE,CAAA;AACvC,IAAA,MAAA,IAAU,SAAA,CAAW,KAAA,KAAU,EAAA,GAAM,EAAE,CAAA;AACvC,IAAA,IAAI,MAAA,GAAS,IAAI,KAAA,CAAM,MAAA,YAAkB,SAAA,CAAW,KAAA,KAAU,IAAK,EAAE,CAAA;AACrE,IAAA,IAAI,SAAS,CAAA,GAAI,KAAA,CAAM,QAAQ,MAAA,IAAU,SAAA,CAAU,QAAQ,EAAE,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,WAAA,GAAsB;AAC7B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,iBAAiB,KAAK,CAAA;AAC/B;AAEA,eAAe,OAAO,KAAA,EAAgC;AACpD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,SAAA,EAAW,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AAC1E,EAAA,OAAO,gBAAA,CAAiB,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAChD;AAWA,eAAe,QAAQ,MAAA,EAA0C;AAC/D,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,EAAI,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAC/F,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,KAAA;AAAA,IACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,GACnB;AACF;AAEA,SAAS,cAAc,GAAA,EAA2B;AAChD,EAAA,MAAM,SAAS,OAAO,GAAA,KAAQ,WAAW,IAAI,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AACxD,EAAA,OAAO,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,EAAG,OAAO,MAAM,CAAA,CAAA;AAC3C;AAEA,eAAe,iBAAiB,KAAA,EAOZ;AAClB,EAAA,OAAO;AAAA,IACL,kBAAA;AAAA,IACA,KAAA,CAAM,MAAA;AAAA,IACN,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,IACtB,KAAA,CAAM,KAAA;AAAA,IACN,KAAA,CAAM,OAAO,WAAA,EAAY;AAAA,IACzB,aAAA,CAAc,MAAM,GAAG,CAAA;AAAA,IACvB,MAAM,MAAA,CAAO,KAAA,CAAM,IAAI;AAAA,GACzB,CAAE,KAAK,IAAI,CAAA;AACb;AAMA,eAAsB,qBACpB,OAAA,EACiC;AACjC,EAAA,IAAI,CAAC,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,gDAAgD,CAAA;AAClG,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI;AAChD,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,SAAS,CAAA,IAAK,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,iDAAiD,CAAA;AACzH,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,EAAY;AAC3C,EAAA,IAAI,CAAC,MAAM,IAAA,CAAK,KAAK,GAAG,MAAM,IAAI,MAAM,kEAA6D,CAAA;AACrG,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,EAAA;AAC7B,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB;AAAA,IACvC,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,SAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb;AAAA,GACD,CAAA;AACD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,MAAA,EAAQ,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAC,CAAA;AAC3G,EAAA,OAAO;AAAA,IACL,CAAC,kBAAA,CAAmB,OAAO,GAAG,kBAAA;AAAA,IAC9B,CAAC,kBAAA,CAAmB,MAAM,GAAG,OAAA,CAAQ,MAAA;AAAA,IACrC,CAAC,kBAAA,CAAmB,SAAS,GAAG,OAAO,SAAS,CAAA;AAAA,IAChD,CAAC,kBAAA,CAAmB,KAAK,GAAG,KAAA;AAAA,IAC5B,CAAC,mBAAmB,SAAS,GAAG,iBAAiB,IAAI,UAAA,CAAW,SAAS,CAAC;AAAA,GAC5E;AACF;AAOA,eAAsB,sBAAA,CACpB,SACA,OAAA,EACiC;AACjC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,OAAO,CAAA;AAC9D,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,MAAM,CAAA;AAC5D,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,SAAS,CAAA;AACtE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,KAAK,CAAA;AAC1D,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,SAAS,CAAA;AAClE,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,MAAA,IAAU,CAAC,aAAA,IAAiB,CAAC,KAAA,IAAS,CAAC,WAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,iBAAA,EAAkB;AACjH,EAAA,IAAI,YAAY,kBAAA,EAAoB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,qBAAA,EAAsB;AACtF,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,SAAU,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AACvE,EAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,CAAC,OAAA,CAAQ,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,oBAAA,EAAqB;AAE3G,EAAA,MAAM,SAAA,GAAY,OAAO,aAAa,CAAA;AACtC,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,SAAS,CAAA,IAAK,SAAA,IAAa,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AACxG,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,mBAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,YAAY,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,yCAAyC,CAAA;AAC3G,EAAA,IAAI,KAAK,GAAA,CAAA,CAAK,OAAA,CAAQ,GAAA,IAAM,IAAK,KAAK,GAAA,EAAI,IAAK,SAAS,CAAA,GAAI,WAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,SAAA,EAAU;AAC7G,EAAA,IAAI,CAAC,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,SAAU,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAEpE,EAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,KAAA,GAAQ,IAAA,EAAK;AACxC,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB;AAAA,IACvC,MAAA;AAAA,IACA,SAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb;AAAA,GACD,CAAA;AACD,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,SAAA,CAAU,KAAA,CAAM,EAAE,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAC,CAAA;AAC3E,IAAA,IAAI,SAAA,CAAU,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,GAAQ,CAAC,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAC1F,IAAA,IAAI,WAAA,GAAc,CAAA;AAClB,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,SAAS,SAAA,EAAW;AAC7B,MAAA,WAAA,GAAe,eAAe,CAAA,GAAK,KAAA;AACnC,MAAA,IAAA,IAAQ,CAAA;AACR,MAAA,IAAI,QAAQ,CAAA,EAAG;AACb,QAAA,IAAA,IAAQ,CAAA;AACR,QAAA,KAAA,CAAM,IAAA,CAAM,WAAA,KAAgB,IAAA,GAAQ,GAAG,CAAA;AAAA,MACzC;AAAA,IACF;AACA,IAAA,KAAA,GAAQ,MAAM,OAAO,MAAA,CAAO,MAAA;AAAA,MAC1B,MAAA;AAAA,MACA,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAAA,MAC5B,IAAI,WAAW,KAAK,CAAA;AAAA,MACpB,OAAA,CAAQ,OAAO,SAAS;AAAA,KAC1B;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,KAAA,GAAQ,KAAA;AAAA,EACV;AACA,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AAC5D,EAAA,IAAI,OAAA,CAAQ,gBAAgB,CAAE,MAAM,QAAQ,YAAA,CAAa,MAAA,EAAQ,KAAA,EAAO,SAAS,CAAA,EAAI;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAAA,EACzC;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,OAAO,IAAA,EAAK;AACpD;;;AC/NO,SAASA,MAAK,OAAA,EAAkD;AACrE,EAAA,OAAO,IAAA,CAAgB;AAAA,IACrB,GAAG,OAAA;AAAA,IACH,KAAA,EACE,QAAQ,KAAA,KAAU,CAAC,OAAO,WAAA,KAAgB,UAAA,CAAW,KAAA,CAAM,KAAA,EAAO,WAAW,CAAA;AAAA,GAChF,CAAA;AACH;AAsCO,IAAMC,GAAAA,GAAK","file":"index.cjs","sourcesContent":["// Protocol version, identifier aliases, and value types — the primitives every\n// other protocol module builds on.\n\n/** Wire protocol version, bumped on breaking changes to the on-the-wire message\n *  shapes so client and server can detect a mismatch. Currently `1`. */\nexport const PROTOCOL_VERSION = 1 as const;\nexport const PROTOCOL_VERSION_HEADER = \"x-odla-protocol-version\";\n\n// ----------------------------------------------------------------------------\n// Identifiers\n// ----------------------------------------------------------------------------\nexport type EntityId = string; // UUIDv7\nexport type AppId = string;\nexport type ClientId = string;\nexport type SubId = string;\nexport type MutationId = string;\nexport type QueryHash = string;\n/** Monotonic per app DO. Treat as an OPAQUE PER-STREAM WATERMARK: only compare\n * txIds from the same app stream; never do arithmetic on them. */\nexport type TxId = number;\n/** Names an entity's home graph (cell). Today every app is exactly one graph, so\n * refs omit it; it exists so cross-cell references stay expressible later. */\nexport type GraphId = string;\n\n// ----------------------------------------------------------------------------\n// Values\n// ----------------------------------------------------------------------------\nexport type ValueType = \"string\" | \"number\" | \"boolean\" | \"date\" | \"json\" | \"ref\";\nexport type Scalar = string | number | boolean | null;\nexport type Json = Scalar | Json[] | { [key: string]: Json };\nexport type Value = Scalar | Json;\n","import { PROTOCOL_VERSION, type EntityId } from \"./ids\";\nimport type { ClientMsg, ServerMsg } from \"./messages\";\n\n/**\n * Generate a UUIDv7 (time-ordered). Uses the Web Crypto API available in both\n * the browser, Node >=20, and the Workers runtime.\n */\nexport function uuidv7(): EntityId {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n\n  const ts = BigInt(Date.now());\n  bytes[0] = Number((ts >> 40n) & 0xffn);\n  bytes[1] = Number((ts >> 32n) & 0xffn);\n  bytes[2] = Number((ts >> 24n) & 0xffn);\n  bytes[3] = Number((ts >> 16n) & 0xffn);\n  bytes[4] = Number((ts >> 8n) & 0xffn);\n  bytes[5] = Number(ts & 0xffn);\n\n  // version 7\n  bytes[6] = (bytes[6]! & 0x0f) | 0x70;\n  // variant (RFC 4122)\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n\n  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nconst CLIENT_OPS = new Set([\n  \"init\", \"subscribe\", \"subscribe-batch\", \"unsubscribe\", \"transact\",\n  \"presence-set\", \"presence-clear\", \"room-publish\", \"ping\",\n]);\nconst SERVER_OPS = new Set([\n  \"init-ok\", \"query-result\", \"query-result-batch\", \"query-diff\", \"tx-ack\",\n  \"mutation-reject\", \"tx\", \"presence\", \"room-event\", \"error\", \"pong\", \"echo\",\n]);\nexport const MAX_WS_MESSAGE_BYTES = 1_100_000;\nexport const MAX_TRANSACTION_OPS = 1_000;\n/** Durable Object sockets retain at most this many live query registrations. */\nexport const MAX_ACTIVE_SUBSCRIPTIONS = 32;\n\n/** Cheap structural guard for an inbound client message. */\nexport function isClientMsg(x: unknown): x is ClientMsg {\n  if (!isEnvelope(x, CLIENT_OPS)) return false;\n  const m = x as Record<string, unknown>;\n  switch (m.op) {\n    case \"init\":\n      return isShortString(m.clientId) && optionalString(m.auth) && optionalNonNegativeNumber(m.lastSeenTx) &&\n        (m.caps === undefined || (Array.isArray(m.caps) && m.caps.length <= 32 && m.caps.every(isShortString))) &&\n        (m.resume === undefined || (Array.isArray(m.resume) && m.resume.length <= MAX_ACTIVE_SUBSCRIPTIONS && m.resume.every(isResume)));\n    case \"subscribe\": return isShortString(m.subId) && isRecord(m.query);\n    case \"subscribe-batch\":\n      return Array.isArray(m.subs) && m.subs.length >= 1 && m.subs.length <= MAX_ACTIVE_SUBSCRIPTIONS && m.subs.every(isResume);\n    case \"unsubscribe\": return isShortString(m.subId);\n    case \"transact\": return isShortString(m.mutationId) && Array.isArray(m.ops) && m.ops.length <= MAX_TRANSACTION_OPS && m.ops.every(isOp);\n    case \"presence-set\": return isRoom(m.room) && isJson(m.presence);\n    case \"presence-clear\": return isRoom(m.room);\n    case \"room-publish\": return isRoom(m.room) && isJson(m.event);\n    case \"ping\": return true;\n    default: return false;\n  }\n}\n\n/** Cheap structural guard for an inbound server message. */\nexport function isServerMsg(x: unknown): x is ServerMsg {\n  if (!isEnvelope(x, SERVER_OPS)) return false;\n  const m = x as Record<string, unknown>;\n  switch (m.op) {\n    case \"init-ok\":\n      return isFiniteNumber(m.serverTime) && isFiniteNumber(m.currentTx) && optionalNonNegativeNumber(m.epoch) &&\n        (m.caps === undefined || (Array.isArray(m.caps) && m.caps.length <= 32 && m.caps.every(isShortString)));\n    case \"query-result\": return isShortString(m.subId) && isShortString(m.queryHash) && isFiniteNumber(m.txId) && isRecord(m.result);\n    case \"query-result-batch\":\n      return isFiniteNumber(m.txId) && Array.isArray(m.results) && m.results.length >= 1 &&\n        m.results.length <= MAX_ACTIVE_SUBSCRIPTIONS && m.results.every(isBatchResult);\n    case \"query-diff\": return isShortString(m.subId) && isShortString(m.queryHash) && isFiniteNumber(m.txId) && isRecord(m.diff);\n    case \"tx-ack\": return isShortString(m.mutationId) && isFiniteNumber(m.txId);\n    case \"mutation-reject\": return isShortString(m.mutationId) && isErr(m.error);\n    case \"tx\": return isFiniteNumber(m.txId);\n    case \"presence\": return isRoom(m.room) && Array.isArray(m.peers) && m.peers.every(isPeer);\n    case \"room-event\": return isRoom(m.room) && isShortString(m.from) && isJson(m.event);\n    case \"error\": return isErr(m.error);\n    case \"pong\": return true;\n    case \"echo\": return typeof m.data === \"string\";\n    default: return false;\n  }\n}\n\nexport type WireParse<T> =\n  | { ok: true; value: T }\n  | { ok: false; code: \"invalid_json\" | \"protocol_version\" | \"bad_message\" | \"message_too_large\"; receivedVersion?: unknown };\n\n/** Parse with enough detail for a peer to report an actionable version error. */\nexport function parseClientMsgDetailed(data: string): WireParse<ClientMsg> {\n  if (new TextEncoder().encode(data).byteLength > MAX_WS_MESSAGE_BYTES) return { ok: false, code: \"message_too_large\" };\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(data);\n  } catch {\n    return { ok: false, code: \"invalid_json\" };\n  }\n  if (typeof parsed === \"object\" && parsed !== null && (parsed as { v?: unknown }).v !== PROTOCOL_VERSION) {\n    return { ok: false, code: \"protocol_version\", receivedVersion: (parsed as { v?: unknown }).v };\n  }\n  return isClientMsg(parsed) ? { ok: true, value: parsed } : { ok: false, code: \"bad_message\" };\n}\n\n/** Parse a raw WebSocket text frame into a typed client message, or null. */\nexport function parseClientMsg(data: string): ClientMsg | null {\n  const result = parseClientMsgDetailed(data);\n  return result.ok ? result.value : null;\n}\n\n/** Parse a server WebSocket frame, rejecting unknown ops and versions. */\nexport function parseServerMsg(data: string): WireParse<ServerMsg> {\n  if (new TextEncoder().encode(data).byteLength > MAX_WS_MESSAGE_BYTES) return { ok: false, code: \"message_too_large\" };\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(data);\n  } catch {\n    return { ok: false, code: \"invalid_json\" };\n  }\n  if (typeof parsed === \"object\" && parsed !== null && (parsed as { v?: unknown }).v !== PROTOCOL_VERSION) {\n    return { ok: false, code: \"protocol_version\", receivedVersion: (parsed as { v?: unknown }).v };\n  }\n  return isServerMsg(parsed) ? { ok: true, value: parsed } : { ok: false, code: \"bad_message\" };\n}\n\n/** Serialize a server message for the wire. */\nexport function encodeServerMsg(msg: ServerMsg): string {\n  return JSON.stringify(msg);\n}\n\nfunction isEnvelope(value: unknown, ops: ReadonlySet<string>): value is Record<string, unknown> {\n  return isRecord(value) && value.v === PROTOCOL_VERSION && typeof value.op === \"string\" && ops.has(value.op);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction isShortString(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0 && value.length <= 512;\n}\n\nfunction optionalString(value: unknown): boolean {\n  return value === undefined || typeof value === \"string\";\n}\n\nfunction isFiniteNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value);\n}\n\nfunction optionalNonNegativeNumber(value: unknown): boolean {\n  return value === undefined || (isFiniteNumber(value) && value >= 0);\n}\n\nfunction isRoom(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0 && value.length <= 256;\n}\n\nfunction isResume(value: unknown): boolean {\n  return isRecord(value) && isShortString(value.subId) && isRecord(value.query);\n}\n\nfunction isBatchResult(value: unknown): boolean {\n  return isRecord(value) && isShortString(value.subId) && isShortString(value.queryHash) && isRecord(value.result);\n}\n\nfunction isEntityRef(value: unknown): boolean {\n  if (isShortString(value)) return true;\n  if (!isRecord(value)) return false;\n  if (isShortString(value.id)) return value.graph === undefined || isShortString(value.graph);\n  return isShortString(value.ns) && isShortString(value.attr) && isScalar(value.value) &&\n    (value.graph === undefined || isShortString(value.graph));\n}\n\nfunction isOp(value: unknown): boolean {\n  if (!isRecord(value) || !isShortString(value.ns) || !isEntityRef(value.id)) return false;\n  switch (value.t) {\n    case \"update\": case \"merge\": return isRecord(value.attrs);\n    case \"increment\": return isShortString(value.attr) && isFiniteNumber(value.by);\n    case \"delete\": return true;\n    case \"retract\": return Array.isArray(value.attrs) && value.attrs.every(isShortString);\n    case \"link\": case \"unlink\": return isShortString(value.label) && isEntityRef(value.target);\n    default: return false;\n  }\n}\n\nfunction isErr(value: unknown): boolean {\n  return isRecord(value) && isShortString(value.code) && typeof value.message === \"string\" &&\n    (value.detail === undefined || isJson(value.detail));\n}\n\nfunction isPeer(value: unknown): boolean {\n  return isRecord(value) && isShortString(value.peerId) && isJson(value.presence);\n}\n\nfunction isScalar(value: unknown): boolean {\n  return value === null || typeof value === \"string\" || typeof value === \"boolean\" || isFiniteNumber(value);\n}\n\nfunction isJson(value: unknown, depth = 0): boolean {\n  if (isScalar(value)) return true;\n  if (depth >= 32) return false;\n  if (Array.isArray(value)) return value.every((item) => isJson(item, depth + 1));\n  return isRecord(value) && Object.values(value).every((item) => isJson(item, depth + 1));\n}\n","import type { Json } from \"./ids\";\nimport type { ErrShape } from \"./ops\";\nimport { PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER } from \"./ids\";\n\n/** Stable SDK error shared by HTTP and realtime clients. Branch on `code`, not\n * message text; `status` is present for HTTP failures. */\nexport class OdlaError extends Error {\n  readonly code: string;\n  readonly status?: number;\n  readonly detail?: Json;\n  readonly retryable: boolean;\n  readonly requestId?: string;\n\n  constructor(\n    code: string,\n    message: string,\n    opts: { status?: number; detail?: Json; retryable?: boolean; requestId?: string; cause?: unknown } = {},\n  ) {\n    super(message, opts.cause === undefined ? undefined : { cause: opts.cause });\n    this.name = \"OdlaError\";\n    this.code = code;\n    this.status = opts.status;\n    this.detail = opts.detail;\n    this.retryable = opts.retryable ?? isRetryableStatus(opts.status);\n    this.requestId = opts.requestId;\n  }\n}\n\nexport function errorFromShape(shape: ErrShape, opts: { status?: number; requestId?: string } = {}): OdlaError {\n  return new OdlaError(shape.code, shape.message, { ...opts, detail: shape.detail });\n}\n\n/** Parse the platform's `{error:{code,message,detail}}` envelope without ever\n * reflecting an arbitrary HTML/text error body into application logs. */\nexport async function errorFromResponse(response: Response, operation: string): Promise<OdlaError> {\n  let shape: Partial<ErrShape> | undefined;\n  try {\n    const body = (await response.json()) as { error?: Partial<ErrShape> };\n    shape = body?.error;\n  } catch {\n    // Proxies may return HTML/plain text; keep the stable fallback below.\n  }\n  const code = typeof shape?.code === \"string\" ? shape.code : `http_${response.status}`;\n  const message = typeof shape?.message === \"string\" && shape.message\n    ? shape.message\n    : `odla ${operation} failed with HTTP ${response.status}`;\n  return new OdlaError(code, message, {\n    status: response.status,\n    detail: isJson(shape?.detail) ? shape.detail : undefined,\n    requestId: response.headers?.get?.(\"x-request-id\") ?? response.headers?.get?.(\"cf-ray\") ?? undefined,\n  });\n}\n\n/** Accept old servers that omit negotiation, but fail before decoding a\n * response that explicitly declares an incompatible wire contract. */\nexport function assertProtocolResponse(response: Response): void {\n  const received = response.headers?.get?.(PROTOCOL_VERSION_HEADER);\n  if (received && received !== String(PROTOCOL_VERSION)) {\n    throw new OdlaError(\"protocol_version\", `odla protocol ${received} is incompatible with client ${PROTOCOL_VERSION}`, {\n      status: response.status,\n      detail: { supported: PROTOCOL_VERSION, received },\n    });\n  }\n}\n\nfunction isRetryableStatus(status: number | undefined): boolean {\n  return status === 408 || status === 429 || (status !== undefined && status >= 500);\n}\n\nfunction isJson(value: unknown): value is Json {\n  if (value === null || [\"string\", \"number\", \"boolean\"].includes(typeof value)) return true;\n  if (Array.isArray(value)) return value.every(isJson);\n  return typeof value === \"object\" && value !== null && Object.values(value).every(isJson);\n}\n","import type { Json } from \"./ids\";\nimport type { QueryOpts, WhereClause } from \"./query\";\n\nexport const DEFAULT_QUERY_LIMIT = 100;\nexport const MAX_QUERY_LIMIT = 1_000;\nexport const MAX_QUERY_OFFSET = 100_000;\nexport const MAX_QUERY_DEPTH = 6;\nexport const MAX_QUERY_NODES = 32;\nexport const MAX_WHERE_NODES = 100;\nexport const MAX_IN_VALUES = 1_000;\nexport const MAX_SEARCH_LENGTH = 512;\nexport const MAX_LIKE_BYTES = 50;\nexport const MAX_QUERY_SCAN = 10_000;\nexport const MAX_QUERY_RESULTS = 5_000;\nexport const MAX_QUERY_RESPONSE_BYTES = 1_000_000;\n\nexport interface QueryIssue {\n  code: \"query_invalid\" | \"query_too_complex\";\n  message: string;\n  detail?: Json;\n}\n\n/** Runtime query validation shared by HTTP and WebSocket entrypoints. */\nexport function validateQuery(query: unknown): QueryIssue | null {\n  if (!isRecord(query) || Object.keys(query).length === 0) return invalid(\"query must contain at least one namespace\");\n  let nodes = 0;\n  let whereNodes = 0;\n  const seen = new Set<object>();\n\n  const walk = (node: unknown, path: string, depth: number): QueryIssue | null => {\n    if (!isRecord(node)) return invalid(`${path} must be an object`);\n    if (seen.has(node)) return invalid(`${path} contains a cycle`);\n    seen.add(node);\n    nodes++;\n    if (depth > MAX_QUERY_DEPTH || nodes > MAX_QUERY_NODES) {\n      return complex(`query exceeds ${MAX_QUERY_DEPTH} relation levels or ${MAX_QUERY_NODES} nodes`);\n    }\n    if (node.$ !== undefined) {\n      const optsIssue = validateQueryOpts(node.$, path);\n      if (optsIssue) return optsIssue;\n      const where = validateWhere((node.$ as QueryOpts).where, `${path}.$.where`);\n      if (where.issue) return where.issue;\n      whereNodes += where.nodes;\n      if (whereNodes > MAX_WHERE_NODES) return complex(`query exceeds ${MAX_WHERE_NODES} where-clause nodes`);\n    }\n    for (const [key, child] of Object.entries(node)) {\n      if (key === \"$\") continue;\n      if (!key) return invalid(`${path} contains an empty relation name`);\n      const issue = walk(child, `${path}.${key}`, depth + 1);\n      if (issue) return issue;\n    }\n    seen.delete(node);\n    return null;\n  };\n\n  for (const [namespace, node] of Object.entries(query)) {\n    if (!namespace) return invalid(\"query contains an empty namespace\");\n    const issue = walk(node, namespace, 1);\n    if (issue) return issue;\n  }\n  return null;\n}\n\nexport function validateQueryOpts(opts: unknown, path = \"opts\"): QueryIssue | null {\n  if (!isRecord(opts)) return invalid(`${path} must be an object`);\n  const allowed = new Set([\"where\", \"order\", \"limit\", \"offset\", \"search\", \"count\"]);\n  for (const key of Object.keys(opts)) if (!allowed.has(key)) return invalid(`${path} uses unsupported option \"${key}\"`);\n  if (opts.limit !== undefined && (!Number.isInteger(opts.limit) || (opts.limit as number) < 0 || (opts.limit as number) > MAX_QUERY_LIMIT)) {\n    return invalid(`${path}.limit must be an integer from 0 to ${MAX_QUERY_LIMIT}`);\n  }\n  if (opts.offset !== undefined && (!Number.isInteger(opts.offset) || (opts.offset as number) < 0 || (opts.offset as number) > MAX_QUERY_OFFSET)) {\n    return invalid(`${path}.offset must be an integer from 0 to ${MAX_QUERY_OFFSET}`);\n  }\n  if (opts.search !== undefined && (typeof opts.search !== \"string\" || opts.search.length > MAX_SEARCH_LENGTH)) {\n    return invalid(`${path}.search must be a string of at most ${MAX_SEARCH_LENGTH} characters`);\n  }\n  if (opts.count !== undefined && typeof opts.count !== \"boolean\") {\n    return invalid(`${path}.count must be a boolean`);\n  }\n  if (opts.order !== undefined && (!isRecord(opts.order) || Object.keys(opts.order).length !== 1 || !Object.values(opts.order).every((v) => v === \"asc\" || v === \"desc\"))) {\n    return invalid(`${path}.order must contain exactly one field with \"asc\" or \"desc\"`);\n  }\n  if (opts.where !== undefined) {\n    const where = validateWhere(opts.where, `${path}.where`);\n    if (where.issue) return where.issue;\n  }\n  return null;\n}\n\n/** Apply the documented default/cap before the engine resolves a node. */\nexport function boundedQueryOpts(opts: QueryOpts | undefined): QueryOpts {\n  return { ...opts, limit: opts?.limit ?? DEFAULT_QUERY_LIMIT };\n}\n\nfunction validateWhere(where: WhereClause | undefined | unknown, path: string): { nodes: number; issue: QueryIssue | null } {\n  if (where === undefined) return { nodes: 0, issue: null };\n  const seen = new Set<object>();\n  let nodes = 0;\n  const walk = (value: unknown, currentPath: string, depth: number): QueryIssue | null => {\n    if (!isRecord(value)) return invalid(`${currentPath} must be an object`);\n    if (seen.has(value)) return invalid(`${currentPath} contains a cycle`);\n    if (depth > MAX_QUERY_DEPTH) return complex(`where clause exceeds ${MAX_QUERY_DEPTH} levels`);\n    seen.add(value);\n    nodes++;\n    if (nodes > MAX_WHERE_NODES) return complex(`query exceeds ${MAX_WHERE_NODES} where-clause nodes`);\n    for (const [field, predicate] of Object.entries(value)) {\n      nodes++;\n      if (nodes > MAX_WHERE_NODES) return complex(`query exceeds ${MAX_WHERE_NODES} where predicates`);\n      if (field === \"and\" || field === \"or\") {\n        if (!Array.isArray(predicate) || predicate.length === 0) return invalid(`${currentPath}.${field} must be a non-empty array`);\n        for (let i = 0; i < predicate.length; i++) {\n          const issue = walk(predicate[i], `${currentPath}.${field}[${i}]`, depth + 1);\n          if (issue) return issue;\n        }\n        continue;\n      }\n      if (field.includes(\".\")) return invalid(`${currentPath} uses unsupported dotted field \"${field}\"`);\n      if (isScalar(predicate)) continue;\n      if (!isRecord(predicate)) return invalid(`${currentPath}.${field} must be a scalar or operator object`);\n      const operators = new Set([\"$gt\", \"$gte\", \"$lt\", \"$lte\", \"$ne\", \"$in\", \"$like\"]);\n      if (Object.keys(predicate).length === 0) return invalid(`${currentPath}.${field} operator object cannot be empty`);\n      for (const [operator, operand] of Object.entries(predicate)) {\n        if (!operators.has(operator)) return invalid(`${currentPath}.${field} uses unsupported operator \"${operator}\"`);\n        if (operator === \"$in\") {\n          if (!Array.isArray(operand) || operand.length > MAX_IN_VALUES || !operand.every(isScalar)) {\n            return invalid(`${currentPath}.${field}.$in must contain at most ${MAX_IN_VALUES} scalar values`);\n          }\n        } else if (operator === \"$like\") {\n          if (typeof operand !== \"string\" || new TextEncoder().encode(operand).byteLength > MAX_LIKE_BYTES) {\n            return invalid(`${currentPath}.${field}.$like must be at most ${MAX_LIKE_BYTES} UTF-8 bytes`);\n          }\n          const firstPercent = operand.indexOf(\"%\");\n          if (operand.includes(\"_\") || (firstPercent !== -1 && (firstPercent !== operand.length - 1 || operand.lastIndexOf(\"%\") !== firstPercent))) {\n            return invalid(`${currentPath}.${field}.$like supports only an optional trailing \"%\" after a literal prefix`);\n          }\n          if (!operand || operand.startsWith(\"%\")) {\n            return invalid(`${currentPath}.${field}.$like must start with a literal prefix`);\n          }\n        } else if (!isScalar(operand)) {\n          return invalid(`${currentPath}.${field}.${operator} must be a scalar`);\n        }\n      }\n    }\n    seen.delete(value);\n    return null;\n  };\n  const issue = walk(where, path, 1);\n  return { nodes, issue };\n}\n\nfunction invalid(message: string): QueryIssue {\n  return { code: \"query_invalid\", message };\n}\n\nfunction complex(message: string): QueryIssue {\n  return { code: \"query_too_complex\", message };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction isScalar(value: unknown): value is string | number | boolean | null {\n  return value === null || typeof value === \"string\" || typeof value === \"boolean\" || (typeof value === \"number\" && Number.isFinite(value));\n}\n","import type { EntityRef, Json, Op, QueryResult, QueryTotals, Value } from \"@odla/protocol\";\n\n/** What a subscriber receives. `totals` is present only for queries whose nodes\n * asked for `count`; it is a second argument rather than a field on the result\n * so the plain `(result) => void` callback keeps working untouched. */\nexport type QueryCallback = (result: QueryResult, totals?: QueryTotals) => void;\n\n// ---------------------------------------------------------------------------\n// Transaction builder\n// ---------------------------------------------------------------------------\ntype Attrs = Record<string, Value>;\n\n/**\n * Chainable builder for one entity's mutations. Created via the {@link tx}\n * proxy (`tx.<namespace>[id]`), it accumulates ops in `ops`; each method\n * (`update`, `merge`, `delete`, `retract`, `link`, `unlink`) pushes one `Op`\n * and returns `this` so calls chain. Pass the chain (or an array of chains) to\n * `transact`.\n */\nexport class TxChain {\n  readonly ops: Op[] = [];\n  constructor(\n    private ns: string,\n    private id: EntityRef,\n  ) {}\n  update(attrs: Attrs): this {\n    this.ops.push({ t: \"update\", ns: this.ns, id: this.id, attrs });\n    return this;\n  }\n  merge(attrs: Record<string, Json>): this {\n    this.ops.push({ t: \"merge\", ns: this.ns, id: this.id, attrs });\n    return this;\n  }\n  delete(): this {\n    this.ops.push({ t: \"delete\", ns: this.ns, id: this.id });\n    return this;\n  }\n  /**\n   * Remove the named scalar/json attributes from this entity, returning them to\n   * the absence-of-triple state — the scalar sibling of {@link unlink}. Use it\n   * to CLEAR a value: a typed scalar attribute cannot store `null`, so\n   * `retract([\"dueAt\"])` is how you unset one. A no-op for attributes already\n   * absent; retracting a required attribute aborts the transaction.\n   */\n  retract(attrs: string[]): this {\n    this.ops.push({ t: \"retract\", ns: this.ns, id: this.id, attrs });\n    return this;\n  }\n  link(label: string, target: EntityRef): this {\n    this.ops.push({ t: \"link\", ns: this.ns, id: this.id, label, target });\n    return this;\n  }\n  unlink(label: string, target: EntityRef): this {\n    this.ops.push({ t: \"unlink\", ns: this.ns, id: this.id, label, target });\n    return this;\n  }\n}\n\nexport type TxInput = TxChain | Op | TxInput[];\n/**\n * Flatten a transaction input into the wire `Op[]`. Accepts a {@link TxChain}\n * (returns its accumulated `ops`), a bare `Op` literal (wrapped in a\n * single-element array), or an arbitrarily nested array of either, recursing to\n * produce one flat, ordered op list — the shape sent to the `transact` endpoint.\n */\nexport function flattenTx(input: TxInput): Op[] {\n  if (Array.isArray(input)) return input.flatMap(flattenTx);\n  if (input instanceof TxChain) return input.ops;\n  return [input];\n}\n\ntype NamespaceProxy = Record<string, TxChain>;\nexport const tx: Record<string, NamespaceProxy> = new Proxy(\n  {},\n  {\n    get(_t, ns: string): NamespaceProxy {\n      return new Proxy({}, { get: (_n, id: string): TxChain => new TxChain(ns, id) }) as NamespaceProxy;\n    },\n  },\n) as Record<string, NamespaceProxy>;\n","import type {\n  AdminDb,\n  BrandCapabilityAuthority,\n  FileRecord,\n  TransactOptions,\n} from \"./index\";\n\nexport interface AdminClientTransport {\n  url(path: string): string;\n  /** Resolve a reference the server returned against this client's endpoint.\n   * A server that already answers with an absolute URL passes through. */\n  absolute(reference: string): string;\n  doFetch: typeof globalThis.fetch;\n  checked(operation: string, response: Response): Promise<Response>;\n  credentialHeaders(): Record<string, string>;\n  headers(options?: TransactOptions): Record<string, string>;\n  storagePath(path: string): string;\n}\n\n/** Build the private-file transport over the shared admin credential. */\nexport function createStorageClient(\n  deps: AdminClientTransport,\n): AdminDb[\"storage\"] {\n  return {\n    async upload(\n      path,\n      data,\n      contentType = \"application/octet-stream\",\n      uploadOptions,\n    ) {\n      const encodedPath = deps.storagePath(path);\n      const suffix = uploadOptions?.private ? \"?private=1\" : \"\";\n      const response = await deps.checked(\n        \"upload\",\n        await deps.doFetch(deps.url(`files/${encodedPath}${suffix}`), {\n          method: \"PUT\",\n          headers: {\n            ...deps.credentialHeaders(),\n            \"content-type\": contentType,\n          },\n          body: data,\n        }),\n      );\n      return ((await response.json()) as { file: FileRecord }).file;\n    },\n    async sign(path, ttlSeconds = 300) {\n      const encodedPath = deps.storagePath(path);\n      const params = new URLSearchParams({\n        sign: \"1\",\n        ttl: String(ttlSeconds),\n      });\n      const response = await deps.checked(\n        \"sign\",\n        await deps.doFetch(deps.url(`files/${encodedPath}?${params}`), {\n          headers: deps.credentialHeaders(),\n        }),\n      );\n      // The contract is a URL a caller can hand straight to `fetch`. Resolve\n      // whatever the server answered: a deployment older than the absolute\n      // signed URL returns a root-relative path, which `fetch` rejects with\n      // \"Failed to parse URL\" — far from the cause, and read as \"not stored\".\n      return deps.absolute(((await response.json()) as { url: string }).url);\n    },\n    async delete(path) {\n      const encodedPath = deps.storagePath(path);\n      await deps.checked(\n        \"delete\",\n        await deps.doFetch(deps.url(`files/${encodedPath}`), {\n          method: \"DELETE\",\n          headers: deps.credentialHeaders(),\n        }),\n      );\n    },\n  };\n}\n\n/** Build managed-agent Brand semantic operations. */\nexport function createBrandClient(\n  deps: AdminClientTransport,\n): AdminDb[\"brand\"] {\n  return {\n    async authorize(bookId, jobId, capability) {\n      const params = new URLSearchParams({ jobId, capability });\n      const response = await deps.checked(\n        \"brand authorize\",\n        await deps.doFetch(\n          deps.url(\n            `agent/brand/books/${encodeURIComponent(bookId)}/authority?` +\n              params,\n          ),\n          { headers: deps.credentialHeaders() },\n        ),\n      );\n      return (await response.json()) as BrandCapabilityAuthority;\n    },\n    async propose(input) {\n      const { bookId, ...body } = input;\n      const response = await deps.checked(\n        \"brand propose\",\n        await deps.doFetch(\n          deps.url(\n            `agent/brand/books/${encodeURIComponent(bookId)}/proposals`,\n          ),\n          {\n            method: \"POST\",\n            headers: deps.headers(),\n            body: JSON.stringify(body),\n          },\n        ),\n      );\n      return (await response.json()) as {\n        proposal: Record<string, unknown>;\n        duplicate: boolean;\n      };\n    },\n    async analyze(input) {\n      const { bookId, assetId, ...body } = input;\n      const response = await deps.checked(\n        \"brand analyze\",\n        await deps.doFetch(\n          deps.url(\n            `agent/brand/books/${encodeURIComponent(bookId)}/assets/` +\n              `${encodeURIComponent(assetId)}/analysis`,\n          ),\n          {\n            method: \"POST\",\n            headers: deps.headers(),\n            body: JSON.stringify(body),\n          },\n        ),\n      );\n      return (await response.json()) as {\n        asset: Record<string, unknown>;\n        duplicate: boolean;\n      };\n    },\n    async readAssetContent(bookId, assetId, jobId) {\n      const params = new URLSearchParams({ jobId });\n      const response = await deps.checked(\n        \"brand asset read\",\n        await deps.doFetch(\n          deps.url(\n            `agent/brand/books/${encodeURIComponent(bookId)}/assets/` +\n              `${encodeURIComponent(assetId)}/content?${params}`,\n          ),\n          { headers: deps.credentialHeaders() },\n        ),\n      );\n      return {\n        bytes: new Uint8Array(await response.arrayBuffer()),\n        contentType:\n          response.headers.get(\"content-type\") ?? \"application/octet-stream\",\n      };\n    },\n  };\n}\n\n/** Build the tenant-vault read transport. */\nexport function createSecretsClient(\n  deps: AdminClientTransport,\n): AdminDb[\"secrets\"] {\n  return {\n    async get(name) {\n      const response = await deps.checked(\n        \"secret get\",\n        await deps.doFetch(deps.url(`secrets/${encodeURIComponent(name)}`), {\n          headers: deps.credentialHeaders(),\n        }),\n      );\n      return ((await response.json()) as { value: string }).value;\n    },\n  };\n}\n","import {\n  PROTOCOL_VERSION,\n  PROTOCOL_VERSION_HEADER,\n  validateQuery,\n  type InstaQLQuery,\n} from \"@odla/protocol\";\n\n/** Header carrying the exact bounded query scope for a trusted realtime proxy. */\nexport const REALTIME_PROXY_SCOPE_HEADER = \"x-odla-realtime-proxy\";\n\nconst MAX_PROXY_QUERIES = 16;\nconst MAX_PROXY_SCOPE_BYTES = 4_096;\nconst MAX_PROXY_TTL_SECONDS = 300;\n\n/**\n * Per-handshake restrictions for a trusted backend realtime proxy.\n *\n * These restrictions are enforced before the app credential leaves the\n * backend. They do not replace the host application's own authentication and\n * authorization of the incoming browser request.\n */\nexport interface RealtimeProxyOptions {\n  /** Exact HTTP(S) browser origins allowed to use this proxy. Wildcards are rejected. */\n  allowedOrigins: readonly string[];\n  /** Exact live queries the proxied connection may execute (1–16, 4 KiB serialized total). */\n  queries: readonly InstaQLQuery[];\n  /** Lifetime and maximum session/key revocation window in seconds (1–300, default 300). */\n  expiresInSeconds?: number;\n}\n\n/** Trusted, Worker/server-only realtime WebSocket proxy surface. */\nexport interface RealtimeProxy {\n  /**\n   * Validate a downstream WebSocket handshake and open a query-scoped upstream\n   * connection without exposing or accepting a browser credential.\n   *\n   * Authenticate and authorize the browser request before calling this method,\n   * then return its response directly from the Worker. Cloudflare couples the\n   * upstream upgrade to the downstream client; the Worker never intercepts or\n   * relays database frames.\n   */\n  proxy(request: Request, options: RealtimeProxyOptions): Promise<Response>;\n}\n\ninterface RealtimeProxyTransport {\n  url(path: string): string;\n  doFetch: typeof globalThis.fetch;\n  adminToken: string;\n}\n\n/** Construct the isolated realtime proxy service used by the admin client. */\nexport function createRealtimeProxy(\n  transport: RealtimeProxyTransport,\n): RealtimeProxy {\n  return {\n    async proxy(request, options) {\n      if (request.method !== \"GET\") {\n        return new Response(\"Method Not Allowed\", {\n          status: 405,\n          headers: { allow: \"GET\" },\n        });\n      }\n      if (request.headers.get(\"upgrade\")?.trim().toLowerCase() !== \"websocket\") {\n        return new Response(\"Upgrade Required\", {\n          status: 426,\n          headers: { upgrade: \"websocket\" },\n        });\n      }\n\n      const allowedOrigins = normalizeAllowedOrigins(options?.allowedOrigins);\n      const requestOrigin = tryNormalizeRequestOrigin(\n        request.headers.get(\"origin\"),\n      );\n      if (requestOrigin === null || !allowedOrigins.has(requestOrigin)) {\n        return new Response(\"Forbidden\", { status: 403 });\n      }\n\n      const queries = validateQueries(options?.queries);\n      const ttlSeconds = options.expiresInSeconds ?? MAX_PROXY_TTL_SECONDS;\n      if (\n        !Number.isInteger(ttlSeconds) ||\n        ttlSeconds < 1 ||\n        ttlSeconds > MAX_PROXY_TTL_SECONDS\n      ) {\n        throw new TypeError(\n          `realtime proxy expiresInSeconds must be an integer from 1 to ${MAX_PROXY_TTL_SECONDS}`,\n        );\n      }\n\n      const scope = asciiJson({ queries, ttlSeconds });\n      if (scope.length > MAX_PROXY_SCOPE_BYTES) {\n        throw new TypeError(\n          `realtime proxy query scope must not exceed ${MAX_PROXY_SCOPE_BYTES} UTF-8 bytes`,\n        );\n      }\n\n      const upstream = new Request(transport.url(\"connect\"), {\n        method: \"GET\",\n        headers: {\n          authorization: `Bearer ${transport.adminToken}`,\n          [PROTOCOL_VERSION_HEADER]: String(PROTOCOL_VERSION),\n          upgrade: \"websocket\",\n          [REALTIME_PROXY_SCOPE_HEADER]: scope,\n        },\n      });\n      return transport.doFetch(upstream);\n    },\n  };\n}\n\nfunction validateQueries(value: unknown): readonly InstaQLQuery[] {\n  if (!Array.isArray(value) || value.length < 1 || value.length > MAX_PROXY_QUERIES) {\n    throw new TypeError(\n      `realtime proxy queries must contain from 1 to ${MAX_PROXY_QUERIES} exact queries`,\n    );\n  }\n  for (const [index, query] of value.entries()) {\n    const issue = validateQuery(query);\n    if (issue) {\n      throw new TypeError(\n        `realtime proxy queries[${index}] is invalid: ${issue.message}`,\n      );\n    }\n  }\n  return value as readonly InstaQLQuery[];\n}\n\n/** Fetch header values are ByteStrings, so preserve arbitrary query text as ASCII JSON. */\nfunction asciiJson(value: unknown): string {\n  return JSON.stringify(value).replace(/[\\u007f-\\uffff]/g, (character) =>\n    `\\\\u${character.charCodeAt(0).toString(16).padStart(4, \"0\")}`,\n  );\n}\n\nfunction normalizeAllowedOrigins(value: unknown): Set<string> {\n  if (!Array.isArray(value) || value.length === 0) {\n    throw new TypeError(\"realtime proxy allowedOrigins must not be empty\");\n  }\n  return new Set(\n    value.map((origin, index) =>\n      normalizeOrigin(origin, `allowedOrigins[${index}]`),\n    ),\n  );\n}\n\nfunction tryNormalizeRequestOrigin(value: string | null): string | null {\n  try {\n    return normalizeOrigin(value, \"request Origin\");\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeOrigin(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || value.includes(\"*\")) {\n    throw new TypeError(\n      `realtime proxy ${label} must be an exact HTTP(S) origin without wildcards`,\n    );\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new TypeError(\n      `realtime proxy ${label} must be an exact HTTP(S) origin without wildcards`,\n    );\n  }\n  if (\n    (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n    parsed.username ||\n    parsed.password ||\n    parsed.pathname !== \"/\" ||\n    parsed.search ||\n    parsed.hash ||\n    parsed.origin === \"null\"\n  ) {\n    throw new TypeError(\n      `realtime proxy ${label} must be an exact HTTP(S) origin without wildcards`,\n    );\n  }\n  return parsed.origin;\n}\n","import { flattenTx, tx } from \"@odla/core\";\nimport {\n  assertProtocolResponse,\n  errorFromResponse,\n  PROTOCOL_VERSION,\n  PROTOCOL_VERSION_HEADER,\n} from \"@odla/protocol\";\nimport type {\n  AggregateResult,\n  AggregateRequest,\n  ChangePage,\n  QueryResult,\n  QueryTotals,\n} from \"@odla/protocol\";\nimport type {\n  AdminDb,\n  AdminOptions,\n  TransactOptions,\n} from \"./index\";\nimport {\n  createBrandClient,\n  createSecretsClient,\n  createStorageClient,\n  type AdminClientTransport,\n} from \"./client-services\";\nimport { createRealtimeProxy } from \"./realtime-proxy\";\n\n/** Build the trusted backend HTTP client for one exact app. */\nexport function init(opts: AdminOptions): AdminDb {\n  const base = opts.endpoint.replace(/\\/$/, \"\");\n  // Cloudflare Workers requires the platform fetch function to be invoked\n  // through globalThis. Capturing it as a bare function throws\n  // `Illegal invocation` before the request leaves the Worker.\n  const doFetch: typeof globalThis.fetch =\n    opts.fetch ?? ((input, init) => globalThis.fetch(input, init));\n  const url = (path: string) => `${base}/app/${opts.appId}/${path}`;\n  const storagePath = (path: string): string => {\n    if (\n      typeof path !== \"string\" ||\n      !path ||\n      path.startsWith(\"/\") ||\n      path.endsWith(\"/\") ||\n      path.includes(\"\\\\\")\n    ) {\n      throw new TypeError(\n        \"storage path must be a non-empty relative slash-delimited path\",\n      );\n    }\n    const segments = path.split(\"/\");\n    if (\n      segments.some(\n        (segment) =>\n          !segment ||\n          segment === \".\" ||\n          segment === \"..\" ||\n          /%(?:2f|5c)/i.test(segment) ||\n          /[\\u0000-\\u001f\\u007f]/.test(segment),\n      )\n    ) {\n      throw new TypeError(\n        \"storage path contains an empty, dot, encoded-slash, or control segment\",\n      );\n    }\n    return segments.map((segment) => encodeURIComponent(segment)).join(\"/\");\n  };\n  const credentialHeaders = (): Record<string, string> => ({\n    authorization: `Bearer ${opts.adminToken}`,\n    [PROTOCOL_VERSION_HEADER]: String(PROTOCOL_VERSION),\n    ...(opts.expectedPrincipal\n      ? {\n          \"x-odla-expected-principal-kind\": opts.expectedPrincipal.kind,\n          \"x-odla-expected-principal-id\": opts.expectedPrincipal.id,\n        }\n      : {}),\n  });\n  const headers = (options?: TransactOptions): Record<string, string> => {\n    const result: Record<string, string> = {\n      ...credentialHeaders(),\n      \"content-type\": \"application/json\",\n    };\n    if (options?.asUser) result[\"x-odla-as-user\"] = options.asUser;\n    if (options?.asUser && options?.asEmail) {\n      result[\"x-odla-as-email\"] = options.asEmail;\n    }\n    if (options?.asUser && options?.asPrincipalKind) {\n      result[\"x-odla-as-principal-kind\"] = options.asPrincipalKind;\n    }\n    if (\n      \"agentDelegation\" in (options ?? {}) &&\n      options?.agentDelegation\n    ) {\n      result[\"x-odla-agent-delegation\"] = JSON.stringify(\n        options.agentDelegation,\n      );\n    }\n    if (\n      \"requiredDiscussionDispatches\" in (options ?? {}) &&\n      options?.requiredDiscussionDispatches\n    ) {\n      result[\"x-odla-discussion-dispatch-batch\"] = JSON.stringify(\n        options.requiredDiscussionDispatches,\n      );\n    }\n    return result;\n  };\n  const checked = async (\n    operation: string,\n    response: Response,\n  ): Promise<Response> => {\n    assertProtocolResponse(response);\n    if (!response.ok) throw await errorFromResponse(response, operation);\n    return response;\n  };\n  const transport: AdminClientTransport = {\n    url,\n    absolute: (reference) => new URL(reference, base).toString(),\n    doFetch,\n    checked,\n    credentialHeaders,\n    headers,\n    storagePath,\n  };\n\n  return {\n    tx,\n    async query(query, options) {\n      const response = await checked(\n        \"query\",\n        await doFetch(url(\"query\"), {\n          method: \"POST\",\n          headers: headers(options),\n          body: JSON.stringify({ query }),\n        }),\n      );\n      return ((await response.json()) as { result: QueryResult }).result;\n    },\n    async queryWithTotals(query, options) {\n      const response = await checked(\n        \"query\",\n        await doFetch(url(\"query\"), {\n          method: \"POST\",\n          headers: headers(options),\n          body: JSON.stringify({ query }),\n        }),\n      );\n      const body = (await response.json()) as {\n        result: QueryResult;\n        totals?: QueryTotals;\n      };\n      return { result: body.result, totals: body.totals ?? {} };\n    },\n    async transact(input, options) {\n      const ops = flattenTx(input);\n      const mutationId = options?.mutationId ?? crypto.randomUUID();\n      const response = await checked(\n        \"transact\",\n        await doFetch(url(\"transact\"), {\n          method: \"POST\",\n          headers: headers(options),\n          body: JSON.stringify({\n            mutationId,\n            ops,\n            ...(options?.guards ? { guards: options.guards } : {}),\n          }),\n        }),\n      );\n      const body = (await response.json()) as {\n        txId: number;\n        duplicate?: boolean;\n      };\n      return { txId: body.txId, duplicate: body.duplicate === true };\n    },\n    async aggregate(ns, spec, queryOptions, options) {\n      const response = await checked(\n        \"aggregate\",\n        await doFetch(url(\"aggregate\"), {\n          method: \"POST\",\n          headers: headers(options),\n          body: JSON.stringify({\n            ns,\n            opts: queryOptions,\n            aggregate: spec,\n          }),\n        }),\n      );\n      return ((await response.json()) as { aggregate: AggregateResult })\n        .aggregate;\n    },\n    async aggregateBatch(requests: AggregateRequest[], options) {\n      const response = await checked(\n        \"aggregate batch\",\n        await doFetch(url(\"aggregate-batch\"), {\n          method: \"POST\",\n          headers: headers(options),\n          body: JSON.stringify({ aggregates: requests }),\n        }),\n      );\n      return ((await response.json()) as { aggregates: AggregateResult[] })\n        .aggregates;\n    },\n    async changes(options = {}) {\n      const params = new URLSearchParams();\n      if (options.cursor) {\n        params.set(\"epoch\", String(options.cursor.epoch));\n        params.set(\"after\", String(options.cursor.txId));\n      }\n      if (options.limit !== undefined) {\n        params.set(\"limit\", String(options.limit));\n      }\n      const suffix = params.size > 0 ? `?${params}` : \"\";\n      const response = await checked(\n        \"changes\",\n        await doFetch(url(`changes${suffix}`), {\n          headers: headers(),\n        }),\n      );\n      return (await response.json()) as ChangePage;\n    },\n    realtime: createRealtimeProxy({\n      url,\n      doFetch,\n      adminToken: opts.adminToken,\n    }),\n    storage: createStorageClient(transport),\n    brand: createBrandClient(transport),\n    secrets: createSecretsClient(transport),\n  };\n}\n","/**\n * @odla/schema — the `i.schema()` builder. Defines an app's entities, typed\n * attributes, and links in code. Produces a `SerializedSchema` (the wire shape\n * in @odla/protocol) that the CLI pushes to the app DO, and TypeScript types\n * the client uses for `useQuery`/`db.tx`.\n */\nimport type {\n  Json,\n  SerializedAttr,\n  SerializedEntity,\n  SerializedLink,\n  SerializedSchema,\n} from \"@odla/protocol\";\n\ntype ScalarType = SerializedAttr[\"type\"]; // \"string\" | \"number\" | \"boolean\" | \"date\" | \"json\"\n\n/** A typed attribute definition. `T` carries the inferred TS value type. */\nexport class Attr<T, Req extends boolean = true> {\n  declare readonly __type: T;\n  declare readonly __req: Req;\n  constructor(\n    readonly type: ScalarType,\n    readonly _unique = false,\n    readonly _indexed = false,\n    readonly _optional = false,\n  ) {}\n\n  unique(): Attr<T, Req> {\n    return new Attr<T, Req>(this.type, true, this._indexed, this._optional);\n  }\n  indexed(): Attr<T, Req> {\n    return new Attr<T, Req>(this.type, this._unique, true, this._optional);\n  }\n  optional(): Attr<T | undefined, false> {\n    return new Attr<T | undefined, false>(this.type, this._unique, this._indexed, true);\n  }\n\n  serialize(): SerializedAttr {\n    return {\n      type: this.type,\n      unique: this._unique,\n      indexed: this._indexed,\n      optional: this._optional,\n    };\n  }\n}\n\nexport interface EntityDef<A extends Record<string, Attr<unknown, boolean>>> {\n  attrs: A;\n}\n\n/**\n * A compiled schema: the app's entity definitions (`entities`) and links\n * (`links`), produced by `i.schema({ entities, links })`. Its type parameters\n * carry the entity/link shapes so the client can infer query and `tx` types;\n * `serialize()` lowers it to the `SerializedSchema` wire form the CLI pushes to\n * the app DO and that codegen reads.\n */\nexport class OdlaSchema<\n  E extends Record<string, EntityDef<Record<string, Attr<unknown, boolean>>>>,\n  L extends Record<string, SerializedLink>,\n> {\n  constructor(\n    readonly entities: E,\n    readonly links: L,\n  ) {}\n\n  serialize(): SerializedSchema {\n    const entities: Record<string, SerializedEntity> = {};\n    for (const [ns, def] of Object.entries(this.entities)) {\n      const attrs: Record<string, SerializedAttr> = {};\n      for (const [label, attr] of Object.entries(def.attrs)) {\n        attrs[label] = attr.serialize();\n      }\n      entities[ns] = { attrs };\n    }\n    return { entities, links: { ...(this.links as Record<string, SerializedLink>) } };\n  }\n}\n\n/** The schema builder entrypoint. */\nexport const i = {\n  string: () => new Attr<string>(\"string\"),\n  number: () => new Attr<number>(\"number\"),\n  boolean: () => new Attr<boolean>(\"boolean\"),\n  date: () => new Attr<number | string>(\"date\"),\n  json: <T extends Json = Json>() => new Attr<T>(\"json\"),\n\n  entity<A extends Record<string, Attr<unknown, boolean>>>(attrs: A): EntityDef<A> {\n    return { attrs };\n  },\n\n  schema<\n    E extends Record<string, EntityDef<Record<string, Attr<unknown, boolean>>>>,\n    L extends Record<string, SerializedLink> = Record<string, never>,\n  >(def: { entities: E; links?: L }): OdlaSchema<E, L> {\n    return new OdlaSchema(def.entities, (def.links ?? {}) as L);\n  },\n};\n\n// ---------------------------------------------------------------------------\n// Type inference helpers (basic in v1; richer query-result typing in P6)\n// ---------------------------------------------------------------------------\nexport type EntityName<S> = S extends OdlaSchema<infer E, infer _L> ? keyof E : never;\n\nexport type InferEntity<S, NS extends keyof InferEntities<S>> = { id: string } & {\n  [K in keyof InferEntities<S>[NS]]: InferEntities<S>[NS][K];\n};\n\ntype InferEntities<S> =\n  S extends OdlaSchema<infer E, infer _L>\n    ? {\n        [NS in keyof E]: {\n          [K in keyof E[NS][\"attrs\"]]: E[NS][\"attrs\"][K] extends Attr<infer T, boolean> ? T : never;\n        };\n      }\n    : never;\n\nexport { generateTypes, generateOpenApi } from \"./codegen.js\";\n","/**\n * Agent device-authorization handshake: obtain a scoped, revocable developer\n * token with no pre-shared secret. `requestToken` starts a handshake and waits\n * for the human's approval; `collectToken` resumes waiting on a handshake that\n * was started earlier (for example by a process that was killed before the\n * human approved), so callers can persist the poll credential and survive\n * shell timeouts without losing the approval window.\n */\nimport {\n  assertProtocolResponse,\n  errorFromResponse,\n  OdlaError,\n  PROTOCOL_VERSION as WIRE_VERSION,\n  PROTOCOL_VERSION_HEADER,\n} from \"@odla/protocol\";\n\n/**\n * Owner-reviewed exact-project authority that is excluded from ordinary agent\n * handshakes.\n *\n * This union is duplicated from OPTIONAL_AGENT_PROJECT_CAPABILITIES in the\n * registry, because @odla-ai/db cannot depend on it — and it has already\n * drifted once: `code.session` shipped registry-side while this list still said\n * two entries, which made it impossible for the CLI to request the very\n * capability the registry had just started accepting. Add here whenever you add\n * there.\n */\nexport type OptionalAgentProjectCapability = \"app.manage\" | \"crm.read\" | \"code.session\";\n\n/** The same list as a value, so a caller asking for everything an owner can\n * approve does not have to keep its own copy of what \"everything\" is. */\nexport const OPTIONAL_AGENT_PROJECT_CAPABILITIES: readonly OptionalAgentProjectCapability[] =\n  [\"app.manage\", \"crm.read\", \"code.session\"];\n\n/**\n * Every app the approving human owns, now and later — the one `projectIds`\n * value that is not an exact id.\n *\n * Not platform-wide authority and cannot become it: the registry resolves it at\n * each action boundary against that human's LIVE owned apps, so an app\n * transferred away stops being reachable without anyone re-approving anything.\n */\nexport const ALL_OWNED_APPS = \"*\";\n\n/**\n * Scopes an app owner may put on a machine in a single approval.\n *\n * Duplicated from OWNER_DEVICE_SCOPES in the registry for the same reason the\n * capability union above is — @odla-ai/db cannot depend on it — and guarded the\n * same way, by a source-comparison test. The registry clamps whatever arrives,\n * so drift here costs a refused enrollment with an exact message, never\n * authority nobody approved.\n */\nexport const OWNER_DEVICE_SCOPES: readonly string[] = [\n  \"app:config:read\",\n  \"app:config:write\",\n  \"app:code:host:connect\",\n  \"app:device:enroll\",\n  \"app:create\",\n];\n\n/** Scopes only an administrator's approval can put on a machine: the whole\n * requestable vocabulary, which is what \"all of odla\" has to mean. */\nexport const ADMIN_DEVICE_SCOPES: readonly string[] = [\n  \"platform:ai:policy:read\",\n  \"platform:ai:policy:write\",\n  \"platform:ai:credential:read\",\n  \"platform:ai:credential:write\",\n  \"platform:ai:usage:read\",\n  \"platform:ai:audit:read\",\n  \"platform:status:read\",\n  \"platform:pm:read\",\n  \"app:config:read\",\n  \"app:config:write\",\n  \"app:code:host:connect\",\n  \"platform:code:host:connect\",\n  \"platform:security:self\",\n  \"platform:runbook:write\",\n  \"app:device:enroll\",\n  \"app:create\",\n  \"platform:device:enroll:extended\",\n];\n\n/** Inputs for the human-approved, scoped developer-token device handshake. */\nexport interface RequestTokenOptions {\n  /** odla platform origin hosting the device handshake, normally https://odla.ai. */\n  endpoint: string;\n  /** Email of the existing odla account that will claim the request. This is\n   * an identity hint, not a password or bearer credential; the matching human\n   * must still sign in to Studio and explicitly review the exact code. */\n  email: string;\n  /** Called with the short code and signed-in Studio URL. Opening the URL does\n   * not claim access; the human must choose Review, then Approve. The\n   * `deviceCode` is the opaque poll credential — persist it privately (never\n   * display it) to make the handshake collectable by a later `collectToken`\n   * call if this process dies before approval. */\n  onCode: (info: {\n    userCode: string;\n    deviceCode: string;\n    expiresIn: number;\n    interval: number;\n    verificationUri?: string;\n    verificationUriComplete?: string;\n  }) => void | Promise<void>;\n  /** Required-for-recognition agent name shown to the human approver and used\n   * to register this handshake's new principal. The server supplies \"Agent\"\n   * only when older callers omit it. */\n  label?: string;\n  /** Optional stable single-segment agent handle. It is frozen into the exact\n   * request and reconnects a later approved handshake to the same principal. */\n  agentHandle?: string;\n  /** Optional supported platform scopes shown verbatim to an admin approver.\n   * System AI policy, credential, and usage capabilities are separate;\n   * ordinary provisioning omits scopes entirely. */\n  scopes?: string[];\n  /** Exact project ids the agent is asking the human to grant. Studio shows\n   * these verbatim; approval cannot add, remove, or replace them. */\n  projectIds?: string[];\n  /** Closed optional project capabilities requested for every selected\n   * project. Approval accepts or declines this exact set. */\n  optionalProjectCapabilities?: OptionalAgentProjectCapability[];\n  /** Cap this call's wait for approval. When it elapses while the handshake is\n   * still approvable, throws `OdlaError(\"handshake_pending\")`; the handshake\n   * stays claimable and `collectToken` can keep waiting. */\n  waitMs?: number;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\n/** Scoped, revocable developer token returned by a successful device handshake. */\nexport interface DeviceToken {\n  /** An `odla_dev_…` token bound to the newly registered agent principal.\n   * Ordinary credentials last ~24h and can act only in exact projects selected\n   * by the approver; explicitly scoped platform grants last ~15m. Neither form\n   * inherits the approver's ownership or admin role. */\n  token: string;\n  expiresAt: number;\n}\n\n/** Inputs for resuming a previously started handshake by its poll credential. */\nexport interface CollectTokenOptions {\n  /** odla platform origin hosting the device handshake, normally https://odla.ai. */\n  endpoint: string;\n  /** Opaque poll credential returned when the handshake started. */\n  deviceCode: string;\n  /** Epoch milliseconds when the handshake itself lapses server-side. */\n  expiresAt: number;\n  /** Seconds between polls, as announced when the handshake started. */\n  interval?: number;\n  /** Cap this call's wait; see {@link RequestTokenOptions.waitMs}. */\n  waitMs?: number;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\ntype HandshakePost = (path: string, body: unknown) => Promise<Response>;\n\nfunction handshakePoster(endpoint: string, doFetch: typeof globalThis.fetch, signal?: AbortSignal): HandshakePost {\n  const base = endpoint.replace(/\\/$/, \"\");\n  return async (path, body) => {\n    try {\n      return await doFetch(`${base}${path}`, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n          [PROTOCOL_VERSION_HEADER]: String(WIRE_VERSION),\n        },\n        body: JSON.stringify(body),\n        signal,\n      });\n    } catch (cause) {\n      if (signal?.aborted || (cause instanceof Error && cause.name === \"AbortError\")) {\n        throw new OdlaError(\"aborted\", \"odla handshake was aborted\", { cause });\n      }\n      throw new OdlaError(\"network_error\", \"odla handshake request failed\", { cause, retryable: true });\n    }\n  };\n}\n\n/**\n * Obtain a scoped developer token from odla-db via a device-authorization\n * handshake — no pre-shared secret. Starts a handshake, calls `onCode` with the\n * short user code to show the named account owner, then polls until that same\n * user signs in, explicitly claims it, reviews the requested exact projects,\n * and approves it at odla.ai. Requested projects and capabilities are immutable;\n * a different grant requires a declined request and a fresh submission. Resolves\n * with a revocable token (~24h for ordinary project\n * grants, ~15m for a visible admin-approved platform scope). Each new handshake\n * without `agentHandle` registers a new principal. Reuse the same reviewed\n * handle to preserve identity and authorship across credential rotation.\n *\n *   const { token } = await requestToken({\n *     endpoint: \"https://odla.ai\",\n *     email: \"owner@example.com\",\n *     projectIds: [\"customer-app\"],\n *     onCode: ({ userCode, verificationUriComplete }) =>\n *       console.log(`Review \"${userCode}\" at ${verificationUriComplete ?? \"https://odla.ai/studio\"}.`),\n *   });\n */\nexport async function requestToken(opts: RequestTokenOptions): Promise<DeviceToken> {\n  const email = typeof opts.email === \"string\" ? opts.email.trim().toLowerCase() : \"\";\n  if (email.length > 254 || !/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    throw new TypeError(\"requestToken requires a valid odla account email\");\n  }\n  const agentHandle = opts.agentHandle?.trim().replace(/^@/, \"\").toLowerCase();\n  if (agentHandle !== undefined && !/^[a-z][a-z0-9-]{1,31}$/.test(agentHandle)) {\n    throw new TypeError(\"agentHandle must be one lowercase handle segment\");\n  }\n  const post = handshakePoster(opts.endpoint, opts.fetch ?? globalThis.fetch, opts.signal);\n  const startRes = await post(\"/handshake\", {\n    email,\n    label: opts.label,\n    ...(agentHandle ? { agentHandle } : {}),\n    ...(opts.scopes?.length ? { scopes: opts.scopes } : {}),\n    ...(opts.projectIds?.length ? { projectIds: opts.projectIds } : {}),\n    ...(opts.optionalProjectCapabilities?.length\n      ? { optionalProjectCapabilities: opts.optionalProjectCapabilities }\n      : {}),\n  });\n  assertProtocolResponse(startRes);\n  if (!startRes.ok) throw await errorFromResponse(startRes, \"handshake start\");\n  const { userCode, deviceCode, expiresIn, interval, verificationUri, verificationUriComplete } = (await startRes.json()) as {\n    userCode: string;\n    deviceCode: string;\n    expiresIn: number;\n    interval: number;\n    verificationUri?: string;\n    verificationUriComplete?: string;\n  };\n  await opts.onCode({ userCode, deviceCode, expiresIn, interval, verificationUri, verificationUriComplete });\n  return collectToken({\n    endpoint: opts.endpoint,\n    deviceCode,\n    expiresAt: Date.now() + expiresIn * 1000,\n    interval,\n    waitMs: opts.waitMs,\n    fetch: opts.fetch,\n    signal: opts.signal,\n  });\n}\n\n/**\n * Wait for the human's decision on an already-started handshake and collect\n * the approved token. The poll is idempotent while the handshake is pending,\n * and an approval stays claimable (exactly once) until the handshake's own\n * expiry — so a caller that persisted the `deviceCode` can crash, be killed by\n * a shell timeout, and still collect on a later run. Throws\n * `OdlaError(\"handshake_pending\")` when `waitMs` elapses first (retry later),\n * `handshake_denied`/`handshake_expired` on a terminal decision, and\n * `handshake_timeout` once the handshake itself has lapsed unapproved.\n */\nexport async function collectToken(opts: CollectTokenOptions): Promise<DeviceToken> {\n  const post = handshakePoster(opts.endpoint, opts.fetch ?? globalThis.fetch, opts.signal);\n  const deadline = Math.min(opts.expiresAt, opts.waitMs === undefined ? Infinity : Date.now() + opts.waitMs);\n  const intervalMs = Math.max(1, opts.interval || 3) * 1000;\n  const wait = (ms: number) =>\n    new Promise<void>((resolve, reject) => {\n      if (opts.signal?.aborted) {\n        reject(new OdlaError(\"aborted\", \"odla handshake was aborted\", { cause: opts.signal.reason }));\n        return;\n      }\n      const onAbort = () => {\n        clearTimeout(timer);\n        reject(new OdlaError(\"aborted\", \"odla handshake was aborted\", { cause: opts.signal?.reason }));\n      };\n      const timer = setTimeout(() => {\n        opts.signal?.removeEventListener(\"abort\", onAbort);\n        resolve();\n      }, ms);\n      opts.signal?.addEventListener(\"abort\", onAbort, { once: true });\n    });\n\n  while (Date.now() < deadline) {\n    await wait(Math.min(intervalMs, Math.max(1, deadline - Date.now())));\n    const res = await post(\"/handshake/poll\", { deviceCode: opts.deviceCode });\n    assertProtocolResponse(res);\n    if (!res.ok) throw await errorFromResponse(res, \"handshake poll\");\n    const body = (await res.json().catch(() => ({}))) as {\n      status?: string;\n      token?: string;\n      expiresAt?: number;\n      reason?: string;\n      duplicate?: boolean;\n    };\n    if (body.status === \"approved\" && body.token) return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };\n    if (body.status === \"denied\") {\n      const reason = typeof body.reason === \"string\" && body.reason.trim()\n        ? body.reason.trim().slice(0, 500)\n        : \"The reviewer declined this request.\";\n      if (body.duplicate === true) {\n        throw new OdlaError(\n          \"handshake_duplicate\",\n          \"an identical odla handshake is already awaiting approval; this extra request was closed automatically\",\n          { detail: { reason } },\n        );\n      }\n      throw new OdlaError(\n        \"handshake_denied\",\n        `odla handshake was denied — reviewer feedback: ${reason}`,\n        { detail: { reason } },\n      );\n    }\n    if (body.status === \"expired\") throw new OdlaError(\"handshake_expired\", \"odla handshake expired\");\n  }\n  if (Date.now() < opts.expiresAt) {\n    throw new OdlaError(\"handshake_pending\", \"odla handshake is still awaiting approval; collect again to keep waiting\", { retryable: true });\n  }\n  throw new OdlaError(\"handshake_timeout\", \"odla handshake timed out (not approved in time)\");\n}\n","/**\n * Small, runtime-neutral request-signing primitives for app-to-app federation.\n *\n * Federation peers authenticate one bounded HTTP request with a shared vault\n * secret. They never exchange an end-user session or an odla-db application\n * key. The signature binds the sender, method, path/query, timestamp, nonce,\n * and exact body bytes. Callers remain responsible for authorizing the named\n * sender and, for non-idempotent operations, consuming the nonce exactly once.\n */\n\n/** Header names used by the version-1 federation signature envelope. */\nexport const FEDERATION_HEADERS = {\n  version: \"x-odla-federation\",\n  sender: \"x-odla-federation-sender\",\n  timestamp: \"x-odla-federation-timestamp\",\n  nonce: \"x-odla-federation-nonce\",\n  signature: \"x-odla-federation-signature\",\n} as const;\n\n/** Current wire version for signed federation requests. */\nexport const FEDERATION_VERSION = \"1\";\n\nconst DEFAULT_MAX_SKEW_MS = 5 * 60_000;\nconst SENDER = /^[a-z0-9][a-z0-9-]{1,62}$/;\nconst NONCE = /^[A-Za-z0-9_-]{16,128}$/;\nconst BASE64URL = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\n/** Input for {@link signFederatedRequest}. */\nexport interface SignFederatedRequestOptions {\n  /** Vaulted edge secret shared only by the two server runtimes. */\n  secret: string;\n  /** Stable app/site slug asserted by the sender. */\n  sender: string;\n  method: string;\n  url: string | URL;\n  /** Exact request body text. Omit for a bodyless request. */\n  body?: string;\n  /** Epoch milliseconds. Defaults to `Date.now()`. */\n  timestamp?: number;\n  /** Base64url-safe request nonce. Defaults to 128 random bits. */\n  nonce?: string;\n}\n\n/** Options for {@link verifyFederatedRequest}. */\nexport interface VerifyFederatedRequestOptions {\n  /** Vaulted edge secret expected for this route. */\n  secret: string;\n  /** Optional sender allowlist. An omitted list accepts any valid sender slug. */\n  senders?: readonly string[];\n  /** Epoch-millisecond clock injection. */\n  now?: () => number;\n  /** Maximum past/future clock skew. Defaults to five minutes. */\n  maxSkewMs?: number;\n  /**\n   * Optional replay gate. Return true only when this sender+nonce was consumed\n   * for the first time. Idempotent read routes can omit it.\n   */\n  consumeNonce?: (sender: string, nonce: string, timestamp: number) => boolean | Promise<boolean>;\n}\n\n/** Successful verification, including the cloned request body. */\nexport interface VerifiedFederatedRequest {\n  ok: true;\n  sender: string;\n  timestamp: number;\n  nonce: string;\n  body: string;\n}\n\n/** Stable failure reasons suitable for a route's audit log. */\nexport type FederationVerificationFailure =\n  | \"missing_headers\"\n  | \"unsupported_version\"\n  | \"invalid_sender\"\n  | \"sender_not_allowed\"\n  | \"invalid_timestamp\"\n  | \"expired\"\n  | \"invalid_nonce\"\n  | \"invalid_signature\"\n  | \"replayed\";\n\n/** Failed verification. No secret or submitted signature is reflected. */\nexport interface RejectedFederatedRequest {\n  ok: false;\n  reason: FederationVerificationFailure;\n}\n\n/** Result returned by {@link verifyFederatedRequest}. */\nexport type FederationVerification = VerifiedFederatedRequest | RejectedFederatedRequest;\n\nconst encoder = new TextEncoder();\n\nfunction bytesToBase64url(bytes: Uint8Array): string {\n  let output = \"\";\n  for (let offset = 0; offset < bytes.length; offset += 3) {\n    const a = bytes[offset] ?? 0;\n    const b = bytes[offset + 1] ?? 0;\n    const c = bytes[offset + 2] ?? 0;\n    const block = (a << 16) | (b << 8) | c;\n    output += BASE64URL[(block >>> 18) & 63];\n    output += BASE64URL[(block >>> 12) & 63];\n    if (offset + 1 < bytes.length) output += BASE64URL[(block >>> 6) & 63];\n    if (offset + 2 < bytes.length) output += BASE64URL[block & 63];\n  }\n  return output;\n}\n\nfunction randomNonce(): string {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return bytesToBase64url(bytes);\n}\n\nasync function sha256(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n  return bytesToBase64url(new Uint8Array(digest));\n}\n\n/** The key type as this runtime's Web Crypto reports it.\n *\n * Not the ambient `CryptoKey`: that name only exists with the DOM lib, and this\n * module is typechecked under more than one config — @odla-ai/cli maps\n * `@odla-ai/db` to this source and compiles it with Node libs only, where the\n * ambient name is absent. Deriving the type from the call keeps the module\n * correct under every consumer instead of requiring each to opt into DOM. */\ntype SubtleCryptoKey = Awaited<ReturnType<typeof crypto.subtle.importKey>>;\n\nasync function hmacKey(secret: string): Promise<SubtleCryptoKey> {\n  if (secret.length < 16) throw new Error(\"federation secret must contain at least 16 characters\");\n  return crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\nfunction requestTarget(url: string | URL): string {\n  const parsed = typeof url === \"string\" ? new URL(url) : url;\n  return `${parsed.pathname}${parsed.search}`;\n}\n\nasync function canonicalRequest(input: {\n  sender: string;\n  timestamp: number;\n  nonce: string;\n  method: string;\n  url: string | URL;\n  body: string;\n}): Promise<string> {\n  return [\n    FEDERATION_VERSION,\n    input.sender,\n    String(input.timestamp),\n    input.nonce,\n    input.method.toUpperCase(),\n    requestTarget(input.url),\n    await sha256(input.body),\n  ].join(\"\\n\");\n}\n\n/**\n * Sign one app-to-app HTTP request. Add the returned headers to the exact\n * method, URL path/query, and body passed here.\n */\nexport async function signFederatedRequest(\n  options: SignFederatedRequestOptions,\n): Promise<Record<string, string>> {\n  if (!SENDER.test(options.sender)) throw new Error(\"federation sender must be a lowercase app slug\");\n  const timestamp = options.timestamp ?? Date.now();\n  if (!Number.isSafeInteger(timestamp) || timestamp <= 0) throw new Error(\"federation timestamp must be epoch milliseconds\");\n  const nonce = options.nonce ?? randomNonce();\n  if (!NONCE.test(nonce)) throw new Error(\"federation nonce must be a 16–128 character base64url value\");\n  const body = options.body ?? \"\";\n  const canonical = await canonicalRequest({\n    sender: options.sender,\n    timestamp,\n    nonce,\n    method: options.method,\n    url: options.url,\n    body,\n  });\n  const signature = await crypto.subtle.sign(\"HMAC\", await hmacKey(options.secret), encoder.encode(canonical));\n  return {\n    [FEDERATION_HEADERS.version]: FEDERATION_VERSION,\n    [FEDERATION_HEADERS.sender]: options.sender,\n    [FEDERATION_HEADERS.timestamp]: String(timestamp),\n    [FEDERATION_HEADERS.nonce]: nonce,\n    [FEDERATION_HEADERS.signature]: bytesToBase64url(new Uint8Array(signature)),\n  };\n}\n\n/**\n * Verify one signed federation request. Verification reads a clone, leaving the\n * original request body available; the verified clone body is also returned so\n * route code can parse exactly the bytes covered by the signature.\n */\nexport async function verifyFederatedRequest(\n  request: Request,\n  options: VerifyFederatedRequestOptions,\n): Promise<FederationVerification> {\n  const version = request.headers.get(FEDERATION_HEADERS.version);\n  const sender = request.headers.get(FEDERATION_HEADERS.sender);\n  const timestampText = request.headers.get(FEDERATION_HEADERS.timestamp);\n  const nonce = request.headers.get(FEDERATION_HEADERS.nonce);\n  const signature = request.headers.get(FEDERATION_HEADERS.signature);\n  if (!version || !sender || !timestampText || !nonce || !signature) return { ok: false, reason: \"missing_headers\" };\n  if (version !== FEDERATION_VERSION) return { ok: false, reason: \"unsupported_version\" };\n  if (!SENDER.test(sender)) return { ok: false, reason: \"invalid_sender\" };\n  if (options.senders && !options.senders.includes(sender)) return { ok: false, reason: \"sender_not_allowed\" };\n\n  const timestamp = Number(timestampText);\n  if (!Number.isSafeInteger(timestamp) || timestamp <= 0) return { ok: false, reason: \"invalid_timestamp\" };\n  const maxSkewMs = options.maxSkewMs ?? DEFAULT_MAX_SKEW_MS;\n  if (!Number.isFinite(maxSkewMs) || maxSkewMs < 0) throw new Error(\"maxSkewMs must be a non-negative number\");\n  if (Math.abs((options.now?.() ?? Date.now()) - timestamp) > maxSkewMs) return { ok: false, reason: \"expired\" };\n  if (!NONCE.test(nonce)) return { ok: false, reason: \"invalid_nonce\" };\n\n  const body = await request.clone().text();\n  const canonical = await canonicalRequest({\n    sender,\n    timestamp,\n    nonce,\n    method: request.method,\n    url: request.url,\n    body,\n  });\n  let valid = false;\n  try {\n    const submitted = signature.split(\"\").map((char) => BASE64URL.indexOf(char));\n    if (submitted.some((value) => value < 0)) return { ok: false, reason: \"invalid_signature\" };\n    let accumulator = 0;\n    let bits = 0;\n    const bytes: number[] = [];\n    for (const value of submitted) {\n      accumulator = (accumulator << 6) | value;\n      bits += 6;\n      if (bits >= 8) {\n        bits -= 8;\n        bytes.push((accumulator >>> bits) & 255);\n      }\n    }\n    valid = await crypto.subtle.verify(\n      \"HMAC\",\n      await hmacKey(options.secret),\n      new Uint8Array(bytes),\n      encoder.encode(canonical),\n    );\n  } catch {\n    valid = false;\n  }\n  if (!valid) return { ok: false, reason: \"invalid_signature\" };\n  if (options.consumeNonce && !(await options.consumeNonce(sender, nonce, timestamp))) {\n    return { ok: false, reason: \"replayed\" };\n  }\n  return { ok: true, sender, timestamp, nonce, body };\n}\n","/**\n * @odla-ai/db — the official client for odla-db.\n *\n * Administer the graph database over HTTP, build transactions with\n * the `tx` helper (or hand-written `Op` literals), and author schemas with\n * `i.schema()`. The published package is self-contained (zero runtime deps) and\n * isomorphic at the transport level. This root entry is for trusted backends:\n * never embed a full app key in a browser. End-user applications should import\n * `@odla-ai/db/client` (and Preact applications `@odla-ai/db/preact`).\n *\n *   import { init, tx } from \"@odla-ai/db\";\n *   const db = init({ appId: \"myapp\", adminToken: \"odla_sk_...\", endpoint });\n *   await db.transact(tx.notes[db.id?.() ?? crypto.randomUUID()].update({ text: \"hi\" }));\n *   const { notes } = await db.query({ notes: {} });\n *\n * Upsert by natural key (re-discovery-safe) with a Lookup ref + raw Op literals:\n *   await db.transact([\n *     { t: \"update\", ns: \"company\", id: { ns: \"company\", attr: \"slug\", value: \"acme\" }, attrs: { name: \"Acme\" } },\n *     { t: \"link\",   ns: \"company\", id: { ns: \"company\", attr: \"slug\", value: \"acme\" }, label: \"founded_by\",\n *       target: { ns: \"person\", attr: \"slug\", value: \"ada-lovelace\" } },\n *   ]);\n */\nimport { tx as coreTx } from \"@odla/core\";\nimport { init as initAdminClient } from \"@odla/admin\";\nimport type * as AdminApi from \"@odla/admin\";\nimport type * as CoreApi from \"@odla/core\";\nimport type * as ProtocolApi from \"@odla/protocol\";\nimport type * as SchemaApi from \"@odla/schema\";\n\n// --- Connect / read / write (HTTP; backend, Workers, or any fetch runtime) ---\n/**\n * Create the trusted backend client. The default transport calls fetch through\n * `globalThis`, preserving the receiver required by Cloudflare Workers.\n */\nexport function init(options: AdminApi.AdminOptions): AdminApi.AdminDb {\n  return initAdminClient({\n    ...options,\n    fetch:\n      options.fetch ?? ((input, requestInit) => globalThis.fetch(input, requestInit)),\n  });\n}\n\n/** Alias for {@link init}, emphasizing that the returned client is privileged. */\nexport { init as initAdmin };\n\n/** Connection options for the trusted backend client, including its full app key. */\nexport type AdminOptions = AdminApi.AdminOptions;\n/** Privileged HTTP database facade returned by root `init`; never expose it to a browser. */\nexport type AdminDb = AdminApi.AdminDb;\n/** Optional verified user identity used to evaluate a privileged call as that user. */\nexport type AsUser = AdminApi.AsUser;\n/** Metadata returned after uploading a file through the trusted backend client. */\nexport type FileRecord = AdminApi.FileRecord;\n/** Transaction acknowledgement, including whether a stable mutation id was already applied. */\nexport type TransactResult = AdminApi.TransactResult;\n/** One entity-state precondition evaluated atomically with a transaction. */\nexport type TransactGuard = AdminApi.TransactGuard;\n/** Exact immutable Registry project lifetime used by trusted dispatch metadata. */\nexport type ExactProjectScope = AdminApi.ExactProjectScope;\n/** One required trusted Discussion target committed with its source write. */\nexport type RequiredDiscussionDispatch = AdminApi.RequiredDiscussionDispatch;\n/** Attribution, idempotency, and atomic preconditions for one transaction. */\nexport type TransactOptions = AdminApi.TransactOptions;\n/** Server-issued position in one app's trusted transaction stream. */\nexport type ChangeCursor = AdminApi.ChangeCursor;\n/** Content-free metadata for one committed transaction. */\nexport type ChangeTransaction = AdminApi.ChangeTransaction;\n/** Options for {@link AdminDb.changes}. */\nexport type ChangesOptions = AdminApi.ChangesOptions;\n/** One resumable page returned by {@link AdminDb.changes}. */\nexport type ChangePage = AdminApi.ChangePage;\n/** Exact origin, query scope, and lifetime restrictions for a trusted realtime proxy. */\nexport type RealtimeProxyOptions = AdminApi.RealtimeProxyOptions;\n/** Worker/server-only realtime proxy surface exposed by {@link AdminDb.realtime}. */\nexport type RealtimeProxy = AdminApi.RealtimeProxy;\n\n// --- Transactions: build Op[] ergonomically, or pass raw Op literals ---\n/** Namespace/id transaction proxy for building update, delete, link, and unlink operations. */\nexport const tx = coreTx;\nexport { flattenTx, TxChain } from \"@odla/core\";\n/** A transaction chain, raw operation, or arbitrarily nested array of either. */\nexport type TxInput = CoreApi.TxInput;\n\n// --- IDs & protocol constants ---\nexport { uuidv7, PROTOCOL_VERSION, OdlaError } from \"@odla/protocol\";\n\n// --- Wire types: the contract for ops, queries, results, and schema ---\nexport type {\n  TxId,\n  AggregateRequest,\n  AggregateSpec,\n  AggregateResults,\n  NodeQuery,\n  InstaQLQuery,\n  NamespaceDiff,\n  Lookup,\n} from \"@odla/protocol\";\n\n/** UUIDv7 entity identifier carried over the wire. */\nexport type EntityId = ProtocolApi.EntityId;\n/** Public application identifier used to select an odla tenant. */\nexport type AppId = ProtocolApi.AppId;\n/** Client-supplied stable transaction idempotency key. */\nexport type MutationId = ProtocolApi.MutationId;\n/** Serialized schema value-kind discriminator. */\nexport type ValueType = ProtocolApi.ValueType;\n/** JSON scalar accepted in attributes and query predicates. */\nexport type Scalar = ProtocolApi.Scalar;\n/** Recursively JSON-compatible value. */\nexport type Json = ProtocolApi.Json;\n/** Attribute value accepted by transaction operations. */\nexport type Value = ProtocolApi.Value;\n/** Comparison-operator object accepted for one query field. */\nexport type WhereOp = ProtocolApi.WhereOp;\n/** Scalar equality value or comparison-operator object for one query field. */\nexport type WhereValue = ProtocolApi.WhereValue;\n/** Recursive boolean filter tree for query rows. */\nexport type WhereClause = ProtocolApi.WhereClause;\n/** Per-query-node filtering, ordering, pagination, and text-search options. */\nexport type QueryOpts = ProtocolApi.QueryOpts;\n/** Count/sum/average/min/max values returned by one aggregate request. */\nexport type AggregateResult = ProtocolApi.AggregateResult;\n/** One query-result entity with an id and selected attributes or relations. */\nexport type Entity = ProtocolApi.Entity;\n/** Namespace-keyed entity arrays returned by an InstaQL query. */\nexport type QueryResult = ProtocolApi.QueryResult;\n/** Direct id, unique-attribute lookup, or graph-qualified entity reference. */\nexport type EntityRef = ProtocolApi.EntityRef;\n/** Closed transaction-operation union for updates, merges, deletes, links, and unlinks. */\nexport type Op = ProtocolApi.Op;\n/** Stable wire error payload with a machine-readable code and optional JSON detail. */\nexport type ErrShape = ProtocolApi.ErrShape;\n/** Serialized scalar attribute definition sent with an application schema. */\nexport type SerializedAttr = ProtocolApi.SerializedAttr;\n/** Serialized namespace definition containing its attributes. */\nexport type SerializedEntity = ProtocolApi.SerializedEntity;\n/** Link cardinality for one end of a schema relation. */\nexport type Cardinality = ProtocolApi.Cardinality;\n/** Namespace, cardinality, and label for one end of a serialized relation. */\nexport type SerializedLinkEnd = ProtocolApi.SerializedLinkEnd;\n/** Forward and reverse ends of a serialized schema relation. */\nexport type SerializedLink = ProtocolApi.SerializedLink;\n/** Complete entity/link schema accepted by odla provisioning. */\nexport type SerializedSchema = ProtocolApi.SerializedSchema;\n\n// --- Schema authoring: build a SerializedSchema to push to your app ---\nexport { i, OdlaSchema, Attr } from \"@odla/schema\";\n/** Typed attribute map used by the schema builder for one entity namespace. */\nexport type EntityDef<A extends Record<string, SchemaApi.Attr<unknown, boolean>>> = SchemaApi.EntityDef<A>;\n/** Namespace-name union inferred from an `OdlaSchema`. */\nexport type EntityName<S> = SchemaApi.EntityName<S>;\n/** Runtime entity shape inferred from one namespace in an `OdlaSchema`. */\nexport type InferEntity<S, NS extends SchemaApi.EntityName<S>> = SchemaApi.InferEntity<S, NS>;\n\n// --- Agent device-authorization: get a scoped, revocable token with no secret ---\nexport { collectToken, requestToken } from \"./handshake\";\nexport {\n  ADMIN_DEVICE_SCOPES,\n  ALL_OWNED_APPS,\n  OPTIONAL_AGENT_PROJECT_CAPABILITIES,\n  OWNER_DEVICE_SCOPES,\n} from \"./handshake\";\nexport type {\n  CollectTokenOptions,\n  DeviceToken,\n  OptionalAgentProjectCapability,\n  RequestTokenOptions,\n} from \"./handshake\";\nexport {\n  FEDERATION_HEADERS,\n  FEDERATION_VERSION,\n  signFederatedRequest,\n  verifyFederatedRequest,\n} from \"./federation\";\nexport type {\n  SignFederatedRequestOptions,\n  VerifyFederatedRequestOptions,\n  VerifiedFederatedRequest,\n  RejectedFederatedRequest,\n  FederationVerification,\n  FederationVerificationFailure,\n} from \"./federation\";\n"]}