{"version":3,"sources":["../src/infra/constants.ts","../src/session-manager.ts","../src/http-transport.ts","../src/cli.ts","../src/infra/errors.ts","../src/infra/policy.ts","../src/infra/key-loader.ts","../src/infra/jwks-loader.ts","../src/stdout-fence.ts","../src/server.ts","../src/handlers/guards.ts","../src/handlers/verify.ts","../src/handlers/inspect.ts","../src/handlers/decode.ts","../src/handlers/issue.ts","../src/infra/path-safety.ts","../src/handlers/bundle.ts","../src/schemas/verify.ts","../src/schemas/inspect.ts","../src/schemas/decode.ts","../src/schemas/issue.ts","../src/schemas/bundle.ts"],"names":["randomUUID","versionError","entry","resolve","SDK_SUPPORTED_PROTOCOL_VERSIONS","readFile","sha256Hex","base64urlDecode","total","checks","decode","base64urlEncode","buildKeyPatterns","join","mkdir","stat","rm","z","MetaSchema","fsStat","createHttpTransport"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAIa,WAAA,CAAA,CACA,gBACA,oBAAA;AANb,IAAA,cAAA,GAAA,KAAA,CAAA;AAAA,EAAA,wBAAA,GAAA;AAIO,IAAM,WAAA,GAAc,iBAAA;AACpB,IAAM,cAAA,GAAiB,QAAA;AACvB,IAAM,oBAAA,GAAuB,YAAA;AAcY,EAAA;AAAA,CAAA,CAAA;ACpBhD,IAqCa,cAAA;AArCb,IAAA,oBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,wBAAA,GAAA;AAqCO,IAAM,iBAAN,MAAqB;AAAA,MAQ1B,WAAA,CAA6B,OAAA,GAAiC,EAAC,EAAG;AAArC,QAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAC3B,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,EAAA,GAAK,EAAA,GAAK,GAAA;AACxC,QAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAC1C,QAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,EAAA;AAAA,MACtD;AAAA,MAXiB,QAAA,uBAAe,GAAA,EAA0B;AAAA,MACzC,cAAA,uBAAqB,GAAA,EAAoB;AAAA,MACzC,KAAA;AAAA,MACA,WAAA;AAAA,MACA,gBAAA;AAAA,MACT,UAAA;AAAA;AAAA,MASR,UAAA,GAAmB;AACjB,QAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,eAAA,IAAmB,GAAA;AACnD,QAAA,IAAA,CAAK,aAAa,WAAA,CAAY,MAAM,IAAA,CAAK,UAAA,IAAc,UAAU,CAAA;AACjE,QAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,MACxB;AAAA;AAAA,MAGA,MAAM,aAAA,CAAc,aAAA,EAA8B,QAAA,GAAW,SAAA,EAAkC;AAE7F,QAAA,IAAA,CAAK,UAAA,EAAW;AAGhB,QAAA,IAAI,IAAA,CAAK,QAAA,CAAS,IAAA,IAAQ,IAAA,CAAK,WAAA,EAAa;AAC1C,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,IAAA,CAAK,WAAW,CAAA,mBAAA,CAAqB,CAAA;AAAA,QACjF;AAGA,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,QAAQ,CAAA,IAAK,CAAA;AACrD,QAAA,IAAI,OAAA,IAAW,KAAK,gBAAA,EAAkB;AACpC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,8BAAA,EAAiC,IAAA,CAAK,gBAAgB,CAAA,KAAA,EAAQ,QAAQ,CAAA,mBAAA;AAAA,WACxE;AAAA,QACF;AAEA,QAAA,MAAM,YAAYA,UAAAA,EAAW;AAC7B,QAAA,MAAM,SAAS,aAAA,EAAc;AAC7B,QAAA,MAAM,SAAA,GAAY,IAAI,6BAAA,CAA8B;AAAA,UAClD,oBAAoB,MAAM;AAAA,SAC3B,CAAA;AAED,QAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAE9B,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,MAAM,KAAA,GAAsB;AAAA,UAC1B,SAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,EAAW,GAAA;AAAA,UACX,QAAA,EAAU;AAAA,SACZ;AAEA,QAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAA,EAAW,KAAK,CAAA;AAClC,QAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,QAAA,EAAU,OAAA,GAAU,CAAC,CAAA;AAC7C,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AAAA,MAGA,WAAW,SAAA,EAA6C;AACtD,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AACzC,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,KAAA,CAAM,QAAA,GAAW,KAAK,GAAA,EAAI;AAAA,QAC5B;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AAAA,MAGA,WAAW,SAAA,EAA4B;AACrC,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AACzC,QAAA,OAAO,UAAU,MAAA,IAAa,IAAA,CAAK,KAAI,GAAI,KAAA,CAAM,YAAY,IAAA,CAAK,KAAA;AAAA,MACpE;AAAA;AAAA,MAGA,MAAM,iBAAiB,SAAA,EAAqC;AAC1D,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AACzC,QAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AAEnB,QAAA,IAAA,CAAK,QAAA,CAAS,OAAO,SAAS,CAAA;AAC9B,QAAA,IAAA,CAAK,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACpC,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,UAAA,MAAM,KAAA,CAAM,OAAO,KAAA,EAAM;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA;AAAA,MAGA,MAAM,OAAA,GAAyB;AAC7B,QAAA,IAAI,KAAK,UAAA,EAAY;AACnB,UAAA,aAAA,CAAc,KAAK,UAAU,CAAA;AAC7B,UAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAAA,QACpB;AAEA,QAAA,MAAM,UAAU,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA;AAC1C,QAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,QAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAE1B,QAAA,MAAM,OAAA,CAAQ,UAAA;AAAA,UACZ,OAAA,CAAQ,GAAA,CAAI,OAAO,KAAA,KAAU;AAC3B,YAAA,IAAI;AACF,cAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,cAAA,MAAM,KAAA,CAAM,OAAO,KAAA,EAAM;AAAA,YAC3B,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,CAAC;AAAA,SACH;AAAA,MACF;AAAA;AAAA,MAGA,IAAI,IAAA,GAAe;AACjB,QAAA,OAAO,KAAK,QAAA,CAAS,IAAA;AAAA,MACvB;AAAA;AAAA,MAGQ,UAAA,GAAmB;AACzB,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,QAAA,EAAU;AACvC,UAAA,IAAI,GAAA,GAAM,KAAA,CAAM,QAAA,GAAW,IAAA,CAAK,KAAA,EAAO;AACrC,YAAA,IAAA,CAAK,QAAA,CAAS,OAAO,EAAE,CAAA;AACvB,YAAA,IAAA,CAAK,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AAEpC,YAAA,KAAK,KAAA,CAAM,SAAA,CAAU,KAAA,EAAM,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAC3C,YAAA,KAAK,KAAA,CAAM,MAAA,CAAO,KAAA,EAAM,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAAA;AAAA,MAGQ,iBAAiB,EAAA,EAAkB;AACzC,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,EAAE,CAAA,IAAK,CAAA;AAC7C,QAAA,IAAI,SAAS,CAAA,EAAG;AACd,UAAA,IAAA,CAAK,cAAA,CAAe,OAAO,EAAE,CAAA;AAAA,QAC/B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,EAAA,EAAI,KAAA,GAAQ,CAAC,CAAA;AAAA,QACvC;AAAA,MACF;AAAA,KACF;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACrLA,IAAA,sBAAA,GAAA,EAAA;AAAA,QAAA,CAAA,sBAAA,EAAA;AAAA,EAAA,mBAAA,EAAA,MAAA,mBAAA;AAAA,EAAA,mBAAA,EAAA,MAAA,mBAAA;AAAA,EAAA,eAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAyFA,SAAS,qBAAqB,GAAA,EAAqC;AACjE,EAAA,MAAM,eAAA,GAAkB,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAC1D,EAAA,IAAI,eAAA,IAAmB,CAAC,2BAAA,CAA4B,QAAA,CAAS,eAAe,CAAA,EAAG;AAC7E,IAAA,OAAO,qCAAqC,eAAe,CAAA,sBAAA,EAAyB,2BAAA,CAA4B,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,EAC5H;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,iBAAiB,EAAA,EAAqB;AAC7C,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,EAAA,CAAG,MAAA,GAAS,uBAAuB,OAAO,KAAA;AACjE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,CAAG,QAAQ,CAAA,EAAA,EAAK;AAClC,IAAA,MAAM,IAAA,GAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAA;AAC5B,IAAA,IAAI,IAAA,GAAO,EAAA,IAAQ,IAAA,GAAO,GAAA,EAAM,OAAO,KAAA;AAAA,EACzC;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,eAAA,CACd,SAAA,EACA,QAAA,EACA,aAAA,EACQ;AACR,EAAA,OAAO,SAAA,KAAc,MAAA,IAAa,gBAAA,CAAiB,SAAS,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,GACpF,CAAA,QAAA,EAAW,SAAS,CAAA,CAAA,GACpB,CAAA,GAAA,EAAM,QAAQ,CAAA,CAAA;AACpB;AAMA,SAAS,eAAe,IAAA,EAAuB;AAC7C,EAAA,OAAO,KAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,KAAS,SAAS,IAAA,KAAS,kBAAA;AAC/D;AACA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,IAAI,cAAA,CAAe,IAAI,CAAA,EAAG,OAAO,IAAA;AACjC,EAAA,OAAO,KAAK,UAAA,CAAW,UAAU,CAAA,IAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC9D;AACA,SAAS,cAAc,IAAA,EAAuB;AAC5C,EAAA,IAAI,eAAA,CAAgB,IAAI,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,OACE,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,IACrB,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,IAC1B,4BAAA,CAA6B,IAAA,CAAK,IAAI,CAAA,IACtC,KAAK,UAAA,CAAW,IAAI,CAAA,IACpB,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACpB,IAAA,CAAK,UAAA,CAAW,YAAY,CAAA,IAC5B,IAAA,CAAK,UAAA,CAAW,iBAAiB,CAAA,IACjC,mCAAA,CAAoC,KAAK,IAAI,CAAA;AAEjD;AAKA,SAAS,cAAA,CAAe,YAAoB,UAAA,EAAsC;AAChF,EAAA,IAAI,UAAA,KAAe,OAAO,OAAO,KAAA;AACjC,EAAA,IAAI,UAAA,KAAe,OAAO,OAAO,IAAA;AACjC,EAAA,IAAI,UAAA,KAAe,UAAA,EAAY,OAAO,cAAA,CAAe,UAAU,CAAA;AAC/D,EAAA,IAAI,UAAA,KAAe,WAAA,EAAa,OAAO,eAAA,CAAgB,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,KAAe,SAAA,EAAW,OAAO,aAAA,CAAc,UAAU,CAAA;AAE7D,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACzD,EAAA,OAAO,OAAA,CAAQ,SAAS,UAAU,CAAA;AACpC;AAQA,SAAS,kBAAkB,MAAA,EAAsE;AAC/F,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,IAAI,IAAI,MAAM,CAAA;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,aAAA,EAAgB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3C;AACA,EAAA,IAAI,EAAE,IAAA,EAAM;AACV,IAAA,OAAO,EAAE,OAAO,2CAAA,EAA4C;AAAA,EAC9D;AACA,EAAA,MAAM,UAAA,GACJ,EAAE,QAAA,KAAa,WAAA,IAAe,EAAE,QAAA,KAAa,WAAA,IAAe,EAAE,QAAA,KAAa,KAAA;AAC7E,EAAA,IAAI,CAAA,CAAE,QAAA,KAAa,QAAA,IAAY,CAAC,UAAA,EAAY;AAC1C,IAAA,OAAO,EAAE,OAAO,qEAAA,EAAsE;AAAA,EACxF;AAEA,EAAA,MAAM,aAAa,CAAA,CAAE,IAAA,CAAK,QAAQ,MAAA,EAAQ,EAAE,KAAK,CAAA,CAAE,MAAA;AACnD,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,UAAA,EAAW;AAC9B;AAMA,eAAsB,oBAAoB,OAAA,EAIvC;AACD,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,GAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,WAAA;AAC7B,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,EAAE,CAAA;AACrD,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,yBAAA;AACnD,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,sBAAA;AAE7C,EAAA,MAAM,cAAA,GAAiB,IAAI,cAAA,CAAe;AAAA,IACxC,OAAO,OAAA,CAAQ,YAAA;AAAA,IACf,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,kBAAkB,OAAA,CAAQ;AAAA,GAC3B,CAAA;AACD,EAAA,cAAA,CAAe,UAAA,EAAW;AAG1B,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA4B;AAEnD,EAAA,SAAS,eAAe,GAAA,EAAsB;AAC5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,KAAA,IAAS,GAAA,GAAM,KAAA,CAAM,cAAc,aAAA,EAAe;AACrD,MAAA,IAAI,CAAC,KAAA,IAAS,UAAA,CAAW,IAAA,IAAQ,mBAAA,EAAqB;AACpD,QAAA,MAAM,MAAA,GAAS,UAAA,CAAW,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACxC,QAAA,IAAI,MAAA,KAAW,MAAA,EAAW,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAAA,MACpD;AACA,MAAA,KAAA,GAAQ,EAAE,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,GAAA,EAAI;AACrC,MAAA,UAAA,CAAW,OAAO,GAAG,CAAA;AACrB,MAAA,UAAA,CAAW,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,IAC3B;AACA,IAAA,KAAA,CAAM,KAAA,EAAA;AACN,IAAA,OAAO,MAAM,KAAA,IAAS,YAAA;AAAA,EACxB;AAEA,EAAA,MAAM,eAAA,GAAmC,QAAQ,UAAA,IAAc,KAAA;AAgB/D,EAAA,SAAS,YAAY,GAAA,EAA8B;AACjD,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,SAAA;AAC3C,IAAA,IAAI,eAAA,KAAoB,KAAA,IAAS,cAAA,CAAe,MAAA,EAAQ,eAAe,CAAA,EAAG;AACxE,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,iBAAiB,CAAA;AACzC,MAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,QAAA,MAAM,QAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAG,IAAA,EAAK;AACtC,QAAA,IAAI,OAAO,OAAO,KAAA;AAAA,MACpB;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AACrC,EAAA,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,YAAA,CAAa,GAAA,CAAI,IAAA,KAAS,SAAA,GAAY,CAAA,UAAA,EAAa,IAAI,KAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAC7E,EAAA,IAAI,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,SAAA,EAAW;AAC9C,IAAA,YAAA,CAAa,GAAA,CAAI,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AACpC,IAAA,YAAA,CAAa,GAAA,CAAI,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AAAA,EACtC;AACA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA;AACnC,MAAA,YAAA,CAAa,GAAA,CAAI,EAAE,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAY,WAAW,CAAA;AAElD,EAAA,SAAS,cAAA,CAAe,KAAsB,GAAA,EAA8B;AAC1E,IAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAE7B,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AAC/B,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,SAAS,cAAA,CAAe,KAAsB,GAAA,EAA2B;AACvE,IAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,IAAA,IAAI,MAAA,IAAU,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AACxC,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,MAAM,CAAA;AACnD,MAAA,GAAA,CAAI,SAAA,CAAU,gCAAgC,4BAA4B,CAAA;AAC1E,MAAA,GAAA,CAAI,SAAA;AAAA,QACF,8BAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iCAAiC,gBAAgB,CAAA;AAAA,IACjE;AAAA,EACF;AAEA,EAAA,SAAS,QAAA,CAAS,GAAA,EAAqB,MAAA,EAAgB,IAAA,EAAqB;AAC1E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAChC,IAAA,GAAA,CAAI,SAAA,CAAU,MAAA,EAAQ,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AAC5D,IAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,eAAe,SAAS,GAAA,EAAuC;AAC7D,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,WAAA,MAAiB,SAAS,GAAA,EAAK;AAC7B,MAAA,UAAA,IAAe,KAAA,CAAiB,MAAA;AAChC,MAAA,IAAI,aAAa,eAAA,EAAiB;AAChC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,eAAe,CAAA,MAAA,CAAQ,CAAA;AAAA,MACjE;AACA,MAAA,MAAA,CAAO,KAAK,KAAe,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,EAC7B;AAIA,EAAA,MAAM,WAAA,GAAA,CAAe,OAAA,CAAQ,oBAAA,IAAwB,EAAC,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAK,CAAE,MAAA,GAAS,CAAC,CAAA;AAC1F,EAAA,IAAI,OAAA,CAAQ,oBAAA,EAAsB,MAAA,IAAU,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,IAAK,CAAC,QAAQ,SAAA,EAAW;AAChD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG;AACjD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,MAAM,aAAa,CAAC,EAAE,WAAA,CAAY,MAAA,GAAS,KAAK,OAAA,CAAQ,SAAA,CAAA;AACxD,EAAA,IAAI,OAAA,GAAU,uCAAA;AACd,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,UAAA,IAAc,QAAQ,SAAA,EAAW;AACnC,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,OAAA,CAAQ,SAAS,CAAA;AACtD,IAAA,IAAI,WAAW,UAAA,EAAY;AACzB,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,CAAA,EAAI,WAAW,CAAA,+CAAA,EAAkD,UAAA,CAAW,KAAK;AAAA;AAAA,OACnF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,EAAE,GAAA,EAAK,CAAA,EAAG,UAAA,EAAW,GAAI,UAAA;AAE/B,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClD,MAAA,IAAI,YAAA,IAAgB,iBAAiB,GAAA,EAAK;AACxC,QAAA,OAAA,GAAU,wCAAwC,YAAY,CAAA,CAAA;AAAA,MAChE;AACA,MAAA,WAAA,GAAc;AAAA,QACZ,QAAA,EAAU,UAAA;AAAA,QACV,qBAAA,EAAuB;AAAA,OACzB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAO,GAAA,EAAsB,GAAA,KAAwB;AAC/E,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAA,IAAO,GAAA,EAAK,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA,CAAE,CAAA;AAC/E,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AAIrB,IAAA,GAAA,CAAI,WAAW,GAAM,CAAA;AAGrB,IAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,MAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AACvB,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA;AAAA,IACF;AAEA,IAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AAGvB,IAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,IAAA;AAC/B,IAAA,IAAI,UAAA,IAAc,CAAC,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,EAAG;AAC/C,MAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,uBAAuB,CAAA;AACnD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,EAAK,GAAG,CAAA,EAAG;AAG/B,IAAA,IAAI,QAAA,KAAa,SAAA,IAAa,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAClD,MAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,QACjB,EAAA,EAAI,IAAA;AAAA,QACJ,OAAA,EAAS,cAAA;AAAA,QACT,eAAA,EAAiB;AAAA,OAClB,CAAA;AACD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAChD,MAAA,IAAI,cAAc,WAAA,EAAa;AAC7B,QAAA,QAAA,CAAS,GAAA,EAAK,KAAK,WAAW,CAAA;AAAA,MAChC,CAAA,MAAO;AACL,QAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,MAC3C;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,aAAa,MAAA,EAAQ;AAEvB,MAAA,IAAI,GAAA,CAAI,WAAW,KAAA,EAAO;AACxB,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,OAAO,cAAA,EAAgB,cAAA,EAAgB,oBAAoB,CAAA;AAChF,QAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qDAAA,EAAuD,CAAC,CAAA;AACxF,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,GAAA,CAAI,WAAW,QAAA,EAAU;AAC3B,QAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAC7D,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAChC,UAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,YACjB,KAAA,EAAO;AAAA,WACR,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,MAAM,UAAA,GAAa,MAAM,cAAA,CAAe,gBAAA,CAAiB,SAAS,CAAA;AAClE,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACjC,CAAA,MAAO;AACL,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,2CAA2C,CAAA;AAAA,QACzE;AACA,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,GAAA,CAAI,WAAW,MAAA,EAAQ;AAEzB,QAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,QAAA,MAAM,YAAA,GAAe,eAAA;AAAA,UAAgB,SAAA;AAAA,UAAW,YAAY,GAAG,CAAA;AAAA,UAAG,CAAC,EAAA,KACjE,cAAA,CAAe,UAAA,CAAW,EAAE;AAAA,SAC9B;AACA,QAAA,IAAI,CAAC,cAAA,CAAe,YAAY,CAAA,EAAG;AACjC,UAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,gBAAgB,kBAAA,EAAoB,aAAA,EAAe,MAAM,CAAA;AAC9E,UAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qBAAA,EAAuB,CAAC,CAAA;AACxD,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,IAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,GAAG,CAAA;AAC9B,UAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,QACzC,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,GAAA,GAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACjD,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACjC,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,MAAA,GACJ,OAAO,IAAA,KAAS,QAAA,IAChB,SAAS,IAAA,IACT,QAAA,IAAY,IAAA,IACX,IAAA,CAA4B,MAAA,KAAW,YAAA;AAE1C,QAAA,IAAI,MAAA,EAAQ;AAEV,UAAA,MAAMC,aAAAA,GAAe,qBAAqB,GAAG,CAAA;AAC7C,UAAA,IAAIA,aAAAA,EAAc;AAChB,YAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAOA,eAAc,CAAA;AAC1C,YAAA;AAAA,UACF;AAGA,UAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,cACb,IAAI,WAAW,CAAA;AAAA;AAAA,aACjB;AAAA,UACF;AAGA,UAAA,IAAIC,MAAAA;AACJ,UAAA,IAAI;AACF,YAAAA,MAAAA,GAAQ,MAAM,cAAA,CAAe,aAAA,CAAc,QAAQ,aAAA,EAAe,WAAA,CAAY,GAAG,CAAC,CAAA;AAAA,UACpF,SAAS,GAAA,EAAK;AACZ,YAAA,MAAM,GAAA,GAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,0BAAA;AACjD,YAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACjC,YAAA;AAAA,UACF;AAGA,UAAA,MAAMA,MAAAA,CAAM,SAAA,CAAU,aAAA,CAAc,GAAA,EAAK,KAAK,IAAI,CAAA;AAClD,UAAA;AAAA,QACF;AAIA,QAAA,MAAM,YAAA,GAAe,qBAAqB,GAAG,CAAA;AAC7C,QAAA,IAAI,YAAA,EAAc;AAChB,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,cAAc,CAAA;AAC1C,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAC7D,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAChC,UAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,YACjB,KAAA,EAAO;AAAA,WACR,CAAA;AACD,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,UAAA,CAAW,SAAS,CAAA;AACjD,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,mCAAmC,CAAA;AAC/D,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,KAAA,CAAM,SAAA,CAAU,aAAA,CAAc,GAAA,EAAK,KAAK,IAAI,CAAA;AAClD,QAAA;AAAA,MACF;AAGA,MAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,OAAO,cAAA,EAAgB,cAAA,EAAgB,oBAAoB,CAAA;AAChF,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA;AAAA,IACF;AAGA,IAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,EAC3C,CAAC,CAAA;AAGD,EAAA,MAAA,CAAO,cAAA,GAAiB,GAAA;AACxB,EAAA,MAAA,CAAO,cAAA,GAAiB,GAAA;AACxB,EAAA,MAAA,CAAO,gBAAA,GAAmB,GAAA;AAE1B,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAA,CAAO,EAAA,CAAG,SAAS,MAAM,CAAA;AACzB,IAAA,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AAC9B,MAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA,qCAAA,EAAwC,IAAI,IAAI,IAAI;AAAA,CAAI,CAAA;AAC5F,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,kCAAA,EAAqC,oBAAoB,CAAA;AAAA,CAAK,CAAA;AACnF,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA;AAAA;AAAA,OACF;AACA,MAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA;AAAA,CAAoD,CAAA;AACzE,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,WAAA,EAAc,OAAO,CAAA;AAAA,CAAqC,CAAA;AAAA,MACjF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,UACb,CAAA;AAAA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,gBAAA,EAAmB,OAAA,CAAQ,WAAA,IAAe,GAAG,CAAA,EAAA,EAAK,OAAA,CAAQ,gBAAA,IAAoB,EAAE,CAAA,UAAA,EAAA,CAAc,OAAA,CAAQ,YAAA,IAAgB,IAAA,IAAa,GAAI,CAAA;AAAA;AAAA,OACzI;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,YAAY,CAAA;AAAA,CAA0C,CAAA;AAC5F,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,QAAA,EAAW,WAAA,CAAY,IAAA,GAAO,CAAA,GAAI,CAAC,GAAG,WAAW,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,UAAU;AAAA;AAAA,OAC5E;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA;AAAA;AAAA,OACF;AAEA,MAAAA,QAAAA,CAAQ;AAAA,QACN,SAAS,YAAY;AACnB,UAAA,MAAM,eAAe,OAAA,EAAQ;AAC7B,UAAA,MAAM,IAAI,QAAc,CAAC,GAAA,KAAQ,OAAO,KAAA,CAAM,MAAM,GAAA,EAAK,CAAC,CAAA;AAAA,QAC5D,CAAA;AAAA,QACA,iBAAA,EAAmB,MAAM,UAAA,CAAW;AAAA,OACrC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AA5kBA,IAsEM,aAAA,EACA,yBAAA,EACA,sBAAA,EACA,qBAAA,EAGO,mBAAA,EAGP,2BAAA;AA/EN,IAAA,mBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,uBAAA,GAAA;AAiBA,IAAA,oBAAA,EAAA;AACA,IAAA,cAAA,EAAA;AAoDA,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,yBAAA,GAA4B,OAAA;AAClC,IAAM,sBAAA,GAAyB,GAAA;AAC/B,IAAM,qBAAA,GAAwB,GAAA;AAGvB,IAAM,mBAAA,GAAsB,GAAA;AAGnC,IAAM,2BAAA,GAAiDC,6BAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACjEvD,cAAA,EAAA;;;ACcO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAC/B,IAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA0B,OAAA,EAAiB,OAAA,EAAwB;AAC7E,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA,EAC/C,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,gBAAA,EAAkB,SAAS,OAAO,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,mBAAA,EAAqB,SAAS,OAAO,CAAA;AAC3C,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,aAAA,GAAN,cAA4B,cAAA,CAAe;AAAA,EAChD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF,CAAA;AAgBO,IAAM,kBAAA,GAAN,cAAiC,cAAA,CAAe;AAAA,EACrD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF,CAAA;AAOO,SAAS,cAAA,CAAe,MAAc,iBAAA,EAAqC;AAChF,EAAA,IAAI,MAAA,GAAS,IAAA;AACb,EAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,MAAA;AACT;;;AClFA,IAAM,gBAAA,GAAmB,EAAE,MAAA,CAAO;AAAA,EAChC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACjC,eAAe,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA;AACrC,CAAC,CAAA;AAED,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA,EAC/B,cAAA,EAAgB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACzC,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,mBAAA,EAAqB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AAChD,CAAC,CAAA;AAED,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EAC5B,aAAA,EAAe,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EACzD,kBAAA,EAAoB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EAC9D,eAAA,EAAiB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAM,CAAA;AAAA,EAC3D,eAAA,EAAiB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EACvD,gBAAA,EAAkB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAO,CAAA;AAAA,EAC7D,mBAAA,EAAqB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EAC5D,gBAAA,EAAkB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,QAAU,CAAA;AAAA,EAChE,eAAA,EAAiB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM;AAC7D,CAAC,CAAA;AAKD,IAAM,gBAAA,GAAmB,EAAE,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC,CAAA;AAEM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACnC,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EACtB,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,SAAA,EAAW,eAAA,CAAgB,QAAA,CAAS,EAAE,CAAA;AAAA,EACtC,KAAA,EAAO,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,gBAAgB,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAAA,EACzD,MAAA,EAAQ,YAAA,CAAa,QAAA,CAAS,EAAE,CAAA;AAAA,EAChC,IAAA,EAAM,iBAAiB,QAAA;AACzB,CAAC,CAAA;AAID,IAAM,cAAA,GAA+B;AAAA,EACnC,OAAA,EAAS,GAAA;AAAA,EACT,aAAA,EAAe,KAAA;AAAA,EACf,WAAW,EAAE,cAAA,EAAgB,OAAO,aAAA,EAAe,KAAA,EAAO,qBAAqB,KAAA,EAAM;AAAA,EACrF,OAAO,EAAC;AAAA,EACR,MAAA,EAAQ;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,kBAAA,EAAoB,KAAA;AAAA,IACpB,eAAA,EAAiB,GAAA;AAAA,IACjB,eAAA,EAAiB,EAAA;AAAA,IACjB,gBAAA,EAAkB,MAAA;AAAA,IAClB,mBAAA,EAAqB,GAAA;AAAA,IACrB,gBAAA,EAAkB,QAAA;AAAA,IAClB,eAAA,EAAiB;AAAA;AAErB,CAAA;AAEO,SAAS,gBAAA,GAAiC;AAC/C,EAAA,OAAO,gBAAgB,cAAc,CAAA;AACvC;AAOA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/C,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,CAAI,mBAAmB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EAC1D;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA,GAAI,GAAA,GAAM,mBAAA,CAAoB,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,OAAO,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AACjC;AAQA,eAAsB,kBAAkB,KAAA,EAA+C;AACrF,EAAA,MAAM,YAAY,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,oBAAoB,KAAK,CAAA;AAC/E,EAAA,OAAO,UAAU,SAAS,CAAA;AAC5B;AAEA,eAAsB,WACpB,QAAA,EACiD;AACjD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,QAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,4BAAA,EAA+B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,QAAQ,CAAA;AAC7B,IAAA,IAAI,CAAA,CAAE,OAAO,CAAA,EAAO;AAClB,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,0CAA0C,QAAQ,CAAA;AAAA;AAAA,OACpD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,gBAAgB,CAAA,+BAAA,EAAkC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACxF;AAEA,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OAAO,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAC5F,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,MAAA,CAAO,IAAI,CAAA;AAChD,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,IAAA,EAAK;AACrC;ACnHA,eAAsB,cAAc,SAAA,EAAuC;AACzE,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,MAAM,CAAA,EAAG;AAChC,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACpC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,qBAAA,EAAwB,OAAO,CAAA,oBAAA,CAAsB,CAAA;AAAA,IAC9E;AACA,IAAA,GAAA,GAAM,QAAA;AAAA,EACR,CAAA,MAAA,IAAW,SAAA,CAAU,UAAA,CAAW,OAAO,CAAA,EAAG;AACxC,IAAA,MAAM,QAAA,GAAW,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AAClC,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAMC,QAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,IACxC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,CAAA,yBAAA,EAA4B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,QAC3F,EAAE,OAAO,GAAA;AAAI,OACf;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,2BAA2B,SAAS,CAAA,sCAAA;AAAA,KACtC;AAAA,EACF;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,4BAAA,EAA8B,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACrE;AAGA,EAAA,IACE,OAAO,GAAA,KAAQ,QAAA,IACf,GAAA,KAAQ,IAAA,IACR,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,OAAO,GAAA,CAAA,EACT;AACA,IAAA,MAAM,IAAI,aAAa,yCAAyC,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC1C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,sDAAA,EAAyD,OAAO,CAAA,CAAE,GAAG,CAAC,CAAA,KAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AAEA,EAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,YAAY,OAAO,CAAA,CAAE,MAAM,QAAA,EAAU;AACtD,IAAA,MAAM,IAAI,aAAa,8CAA8C,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,UAAA,GAAgC;AAAA,IACpC,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,GAAG,CAAA,CAAE,CAAA;AAAA,IACL,GAAG,CAAA,CAAE;AAAA,GACP;AAGA,EAAA,MAAM,KAAA,GAAQ,MAAM,eAAA,CAAgB,UAAU,CAAA;AAC9C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAa,uDAAuD,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,UAAA,CAAW,CAAC,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,UAAU,CAAA;AAIlD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC7B,IAAA,GAAA,GAAM,CAAA,CAAE,GAAA;AAAA,EACV,CAAA,MAAO;AACL,IAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,MAAMC,SAAAA,CAAU,MAAM,CAAA;AACnC,IAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,EAAE,UAAA,EAAY,SAAA,EAAW,GAAA,EAAI;AACtC;AC5FA,eAAsB,aAAa,QAAA,EAA2C;AAC5E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMD,QAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,CAAA,0BAAA,EAA6B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC5F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,cAAc,CAAA,6BAAA,EAAgC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACpF;AAEA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,IAAA,IAAQ,EAAE,UAAU,MAAA,CAAA,EAAS;AACxE,IAAA,MAAM,IAAI,cAAc,kCAAkC,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA;AACb,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,cAAc,8BAA8B,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,IAAA,EAAM;AAC3B,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC7C,IAAA,MAAM,CAAA,GAAI,GAAA;AAGV,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC5C,IAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,QAAA,EAAU;AAC7B,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,CAAA,CAAE,QAAQ,OAAA,EAAS;AAE9C,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,CAAE,GAAA,KAAQ,WAAW,CAAA,CAAE,GAAA,GAAM,CAAA,IAAA,EAAO,OAAA,CAAQ,MAAM,CAAA,CAAA;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAYE,eAAAA,CAAgB,CAAA,CAAE,CAAC,CAAA;AACrC,MAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,SAAA,EAAW,CAAA;AAAA,MACjC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAA,CAAgB,MAAsB,GAAA,EAAqC;AACzF,EAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAC5C,EAAA,OAAO,KAAA,EAAO,SAAA;AAChB;;;ACtDA,IAAM,cAAA,GAAiB,IAAI,IAAA,GAAO,IAAA;AAE3B,SAAS,kBAAA,GAAiC;AAC/C,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,QAAQ,MAAM,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,WAAA,GAAc,CAAA;AAElB,EAAA,SAAS,oBAAoB,IAAA,EAAoB;AAE/C,IAAA,MAAM,YAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,YAAY,cAAA,EAAgB;AAC9B,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sBAAA,EAAyB,SAAS,CAAA,2BAAA,EAA8B,cAAc,CAAA;AAAA,OAChF;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sCAAA,EAAyC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OAC7D;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,MAAA;AAEZ,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACzB,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAIA,IAAA,MAAM,QAAQ,IAAA,IAAQ,GAAA;AACtB,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAC9B,IAAA,MAAM,WAAW,OAAA,IAAW,GAAA;AAC5B,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAE9B,IAAA,IAAI,KAAA,KAAU,aAAa,QAAA,CAAA,EAAW;AAEpC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,IAAa,CAAC,KAAA,EAAO;AAEvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,8BAAA;AAAA,MACA,CAAA,kFAAA,EAAqF,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KACzG;AAAA,EACF;AAEA,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAE/B,IAAA,MAAA,GAAS,MAAM,GAAA,EAAI;AACnB,IAAA,WAAA,GAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA;AAE/C,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,MAAA,mBAAA,CAAoB,OAAO,CAAA;AAAA,IAC7B;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,SACnB,KAAA,EACA,kBAAA,EACA,QAAA,EACS;AAET,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,EAAA;AAEJ,IAAA,IAAI,OAAO,uBAAuB,UAAA,EAAY;AAC5C,MAAA,EAAA,GAAK,kBAAA;AAAA,IACP,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,kBAAA;AACX,MAAA,EAAA,GAAK,QAAA;AAAA,IACP;AAGA,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAI9E,IAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,WAAA,GAAc,aAAa,cAAA,EAAgB;AAC7C,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,iCAAiC,cAAc,CAAA,wBAAA;AAAA,OACjD;AAAA,IACF;AAEA,IAAA,MAAA,IAAU,GAAA;AACV,IAAA,WAAA,IAAe,UAAA;AACf,IAAA,aAAA,EAAc;AAGd,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,aAAA,CAAc,KAAA,EAAO,QAAA,EAAU,EAAE,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,aAAA,CAAc,OAAO,EAAmB,CAAA;AAAA,EACjD,CAAA;AAEA,EAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,YAAA;AAGvB,EAAA,OAAO,SAAS,QAAA,GAAiB;AAE/B,IAAA,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,mBAAA,CAAoB,MAAA,CAAO,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,MAAA,GAAS,EAAA;AACT,IAAA,WAAA,GAAc,CAAA;AACd,IAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,aAAA;AAAA,EACzB,CAAA;AACF;;;ACxIA,cAAA,EAAA;;;ACGO,SAAS,YAAA,CAAa,KAAa,MAAA,EAAiD;AACzF,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,aAAA,EAAe;AAC5C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,uBAAA,EAA0B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,aAAa,CAAA,MAAA,CAAA;AAAA,MACnG,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,aAAA,EAAgB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,aAAa,CAAA;AAAA,OACpF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,UACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAA,IAAc,UAAA,CAAW,OAAA,KAAY,KAAA,EAAO;AAC9C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,SAAS,QAAQ,CAAA,8BAAA,CAAA;AAAA,MACvB,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS,SAAS,QAAQ,CAAA,8BAAA;AAAA,OAC5B;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,cAAA,CAAe,OAAgB,IAAA,EAAgC;AACtE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AAAA,EACzC;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,CAAA;AAGxD,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAIC,MAAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAAA,MAAAA,IAAS,cAAA,CAAe,IAAA,EAAM,OAAO,CAAA;AAAA,IACvC;AACA,IAAA,OAAOA,MAAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,EAAG;AAC/D,IAAA,KAAA,IAAS,cAAA,CAAe,GAAG,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAA;AACT;AAaA,SAAS,uBAAA,CAAwB,KAAA,EAAgB,KAAA,EAAe,IAAA,EAAgC;AAC9F,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,CAAA;AAC3B,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA;AAChC,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,CAAA,GAAI,CAAA;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,WAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,MAAM,CAAA;AAErF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,MAAA,KAAA,IAAS,uBAAA,CAAwB,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,OAAO,CAAA;AACzD,MAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA;AAC/D,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,QAAQ,CAAC,CAAA;AACxB,IAAA,KAAA,IAAS,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,CAAC,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AACxD,IAAA,KAAA,IAAS,uBAAA,CAAwB,CAAA,EAAG,KAAA,EAAO,OAAO,CAAA;AAClD,IAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,EAC5B;AACA,EAAA,OAAO,KAAA;AACT;AAYO,SAAS,eAAA,CACd,OACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,aAAA,GAAgB,CAAA;AAG5C,EAAA,MAAM,UAAA,GAAa,eAAe,KAAK,CAAA;AACvC,EAAA,IAAI,aAAa,KAAA,EAAO;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,CAAA,+BAAA,EAAkC,UAAU,CAAA,2BAAA,EAA8B,KAAK,CAAA,MAAA,CAAA;AAAA,MACrF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,UAAU,CAAA,iBAAA,EAAoB,KAAK,CAAA;AAAA,OAChE;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAIA,EAAA,MAAM,cAAA,GAAiB,uBAAA,CAAwB,KAAA,EAAO,KAAK,CAAA;AAC3D,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,+DAA+D,KAAK,CAAA,MAAA,CAAA;AAAA,MAC1E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,+CAA+C,KAAK,CAAA,MAAA;AAAA,OAC/D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,GAAA,EACA,QAAA,GAAmB,EAAA,EACnB,eAAuB,CAAA,EACd;AACT,EAAA,IAAI,YAAA,GAAe,UAAU,OAAO,KAAA;AACpC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,IAAA;AACpD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,MAAM,CAAC,IAAA,KAAS,iBAAiB,IAAA,EAAM,QAAA,EAAU,YAAA,GAAe,CAAC,CAAC,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,GAA8B,CAAA,CAAE,KAAA;AAAA,IAAM,CAAC,KAAA,KAC1D,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAU,eAAe,CAAC;AAAA,GACpD;AACF;AASA,IAAM,2BAAA,GAA8B,sCAAA;AAU7B,SAAS,oBAAA,CACd,cAAA,EAKA,EAAA,GAAsB,2BAAA,EACd;AACR,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,OAAA,EAAS,KAAA;AAAA,IACT,EAAA;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,SAAS,cAAA,CAAe,OAAA;AAAA,MACxB,mBAAmB,cAAA,CAAe,iBAAA;AAAA,MAClC,SAAS,cAAA,CAAe;AAAA;AAC1B,GACF;AACA,EAAA,OAAO,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,QAAQ,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AAC/D;AASA,IAAM,iBAAA,GAAoB,iDAAA;AAC1B,IAAM,0BAA0B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAiB,CAAA,CAAE,MAAA;AAQrE,SAAS,gBAAA,CAAiB,MAAc,MAAA,EAAwC;AACrF,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,CAAO,kBAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,EAAU;AAC9B,IAAA,OAAO,EAAE,MAAM,SAAA,EAAW,KAAA,EAAO,eAAe,OAAA,CAAQ,MAAA,EAAQ,aAAA,EAAe,OAAA,CAAQ,MAAA,EAAO;AAAA,EAChG;AAIA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,uBAAuB,CAAA;AAEjE,EAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,UAAU,CAAC,CAAA;AAC3E,EAAA,MAAM,YAAY,aAAA,GAAgB,iBAAA;AAClC,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AACvD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,SAAA,EAAW,IAAA;AAAA,IACX,eAAe,OAAA,CAAQ,MAAA;AAAA,IACvB,eAAe,YAAA,CAAa;AAAA,GAC9B;AACF;;;AC5PA,SAAS,iBAAiB,MAAA,EAGxB;AACA,EAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAI,MAAA;AAG3B,EAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,IAAA,OAAO;AAAA,MACL,SAAA,EAAWD,eAAAA,CAAgB,KAAA,CAAM,oBAAoB,CAAA;AAAA,MACrD,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAGA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAGnB,IAAA,MAAM,WAAA,GAAc,KAAK,IAAA,CAAK,MAAA;AAAA,MAC5B,CAAC,CAAA,KACC,CAAA,CAAE,GAAA,KAAQ,KAAA,IACV,EAAE,GAAA,KAAQ,SAAA,IACV,OAAO,CAAA,CAAE,MAAM,QAAA,KACd,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,EAAE,GAAA,KAAQ,OAAA;AAAA,KACtC;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AAGA,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,UAAU,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACrD,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAO;AAAA,UACL,SAAA,EAAWA,eAAAA,CAAgB,OAAA,CAAQ,CAAW,CAAA;AAAA,UAC9C,SAAA,EAAW;AAAA,SACb;AAAA,MACF;AACA,MAAA,MAAM,MAAA,CAAO,MAAA;AAAA,QACX,IAAI,KAAA,CAAM,CAAA,wDAAA,EAA2D,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,QAC3E,EAAE,WAAW,qBAAA;AAA+B,OAC9C;AAAA,IACF;AAGA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,OAAO;AAAA,QACL,SAAA,EAAWA,eAAAA,CAAgB,WAAA,CAAY,CAAC,EAAE,CAAW,CAAA;AAAA,QACrD,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,iCAAA,EAAoC,YAAY,MAAM,CAAA,sCAAA;AAAA,OACxD;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAQ;AAC5B,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAEnB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,OAAA,CAAQ,QAAA,EAAU,GAAG,CAAA;AACjD,MAAA,IAAI,GAAA,EAAK;AACP,QAAA,OAAO,EAAE,SAAA,EAAW,GAAA,EAAK,SAAA,EAAW,aAAA,EAAc;AAAA,MACpD;AACA,MAAA,MAAM,OAAO,MAAA,CAAO,IAAI,MAAM,CAAA,wCAAA,EAA2C,GAAG,GAAG,CAAA,EAAG;AAAA,QAChF,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACjC,MAAA,OAAO,EAAE,WAAW,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAA,CAAE,SAAA,EAAW,WAAW,aAAA,EAAc;AAAA,IAC9E;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,wCAAA,EAA2C,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,8BAAA;AAAA,OACpE;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,CAAO,MAAA;AAAA,IACX,IAAI,KAAA;AAAA,MACF;AAAA,KACF;AAAA,IACA,EAAE,WAAW,sBAAA;AAAgC,GAC/C;AACF;AAEA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,iBAAiB,MAAM,CAAA;AACxC,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AACrB,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AAAA,EACvB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAA,GACF,IAAgC,SAAA,IAAoC,sBAAA;AACxE,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,wBAAwB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA;AAAA,QACA,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACxD,QAAQ;AAAC,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,KAAA,CAAM,KAAK,SAAA,EAAW;AAAA,IACrD,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,UAAU,KAAA,CAAM;AAAA,GACjB,CAAA;AAED,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,MAAME,OAAAA,GAAS;AAAA,MACb,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,IAAA,EAAK;AAAA,MAClC,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAK;AAAA,MAC/B,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA;AAAK,KACjC;AAEA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,gBAAA,EAAkB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,kBAAA,EAAoB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,IAAA,MAAM,aAAA,GAAyC;AAAA,MAC7C,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,GAAI,MAAA,CAAO,GAAA,KAAQ,UAAa,EAAE,GAAA,EAAK,OAAO,GAAA,EAAI;AAAA,MAClD,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,aAAa,MAAA,CAAO;AAAA,KACtB;AAEA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,qBAAA,EAAwB,OAAO,OAAO,CAAA,eAAA,EAAkB,OAAO,IAAA,IAAQ,SAAS,CAAA,MAAA,EAAS,MAAA,CAAO,GAAG,CAAA,CAAA,CAAA;AAAA,MACnG;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAA,EAAAA,OAAAA;AAAA,QACA,aAAA;AAAA,QACA,SAAA;AAAA,QACA,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAqE,EAAC;AAC5E,EAAA,IAAI,MAAA,CAAO,SAAS,qBAAA,EAAuB;AACzC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,WAAA,EAAa;AACtC,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,gBAAA,EAAkB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAChF,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,oBAAA,EAAsB;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,kBAAA,EAAoB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAClF,CAAA,MAAO;AACL,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,MAAA,GAAS,gBAAA;AAAA,IACb,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,IAAA,EAAO,OAAO,OAAO,CAAA,CAAA;AAAA,IACxD;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAA,EAAY;AAAA,MACV,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAI,OAAO,SAAA,GACP;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,eAAe,MAAA,CAAO,aAAA;AAAA,UACtB,eAAe,MAAA,CAAO;AAAA;AACxB,UAEF;AAAC;AACP,GACF;AACF;AChPA,eAAsB,cAAc,MAAA,EAA6D;AAC/F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,cAAA,EAAgB,MAAM,CAAA;AAC9D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUC,MAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAAA,EACpB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACzE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,GAAU,SAAA;AACd,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAK,mBAAmB,OAAO,CAAA;AACrC,IAAA,IAAI,GAAG,EAAA,EAAI;AACT,MAAA,OAAA,GAAU,EAAA,CAAG,OAAA;AAAA,IACf;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,OAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,GAAA;AAAA,IAChB,UAAU,OAAA,CAAQ;AAAA,GACpB;AAEA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,WAAW,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EAClE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,OAAA,CAAQ,GAAA;AAAA,EAClC;AAGA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,WAAA;AAGJ,EAAA,MAAM,mBAAA,GAAsB,KAAA,CAAM,WAAA,IAAe,MAAA,CAAO,SAAA,CAAU,mBAAA;AAClE,EAAA,IAAI,mBAAA,EAAqB;AACvB,IAAA,WAAA,GAAc,EAAE,GAAG,OAAA,EAAQ;AAE3B,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,cAAA,IAAkB,UAAA,IAAc,WAAA,EAAa;AAChE,MAAA,WAAA,CAAY,QAAA,GAAW,sBAAA;AACvB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AACA,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,aAAA,IAAiB,SAAA,IAAa,WAAA,EAAa;AAC9D,MAAA,WAAA,CAAY,OAAA,GAAU,sBAAA;AACtB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,6DAAA;AAAA,IACA,EAAA;AAAA,IACA,YAAY,OAAO,CAAA,CAAA;AAAA,IACnB,CAAA,QAAA,EAAW,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA,CAAA;AAAA,IAC/B,CAAA,UAAA,EAAa,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA;AAAA,GACnC;AAEA,EAAA,IAAI,YAAY,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,WAAA,CAAY,QAAQ,CAAA,CAAE,CAAA;AACzE,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,QAAA,EAAU,KAAA,CAAM,IAAA,CAAK,EAAA,EAAI,sCAAsC,CAAA;AAEnE,EAAA,MAAM,KAAK,gBAAA,CAAiB,KAAA,CAAM,IAAA,CAAK,IAAI,GAAG,MAAM,CAAA;AACpD,EAAA,OAAO;AAAA,IACL,MAAM,EAAA,CAAG,IAAA;AAAA,IACT,UAAA,EAAY;AAAA,MACV,MAAA;AAAA,MACA,WAAA;AAAA,MACA,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB,EAAC;AAAA,MACnD,QAAA;AAAA,MACA,QAAA,EAAU,KAAA;AAAA,MACV,GAAI,GAAG,SAAA,GACH;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,EAAA,CAAG,SAAA;AAAA,UACd,eAAe,EAAA,CAAG,aAAA;AAAA,UAClB,eAAe,EAAA,CAAG;AAAA;AACpB,UAEF;AAAC;AACP,GACF;AACF;AC5GA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUA,MAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAExB,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT;AAAA,QACE,iCAAA;AAAA,QACA,EAAA;AAAA,QACA,WAAW,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA,CAAA;AAAA,QAC1C,EAAA;AAAA,QACA,YAAY,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,OAC9C,CAAE,KAAK,IAAI,CAAA;AAAA,MACX;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,MAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA,EAAU,KAAA;AAAA,QACV,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,kBAAkB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACxE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;AChDA,SAAS,gBAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUC,gBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,gBAAgB,SAAS,CAAA;AAExC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAEA,eAAsB,YAAY,MAAA,EAA2D;AAC3F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,YAAA,EAAc,MAAM,CAAA;AAC5D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yFAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACtC,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,MAAA;AACvD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AAC/C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,2BAAA,EAA8B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,gBAAgB,CAAA,MAAA,CAAA;AAAA,MAC1G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,gBAAA,EAAmB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OAC1F;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAc,gBAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI;AAIF,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAC,KAAA,CAAM,OAAO,MAAA,EAAQ;AACxC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uEAAA;AAAA,QACN,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EACE;AAAA,SACJ;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,cAAc,KAAA,CAAM,MAAA,EAAQ,MAAA,GAC9B,EAAE,QAAQ,KAAA,CAAM,MAAA,CAAO,MAAA,EAAQ,GAAA,EAAK,MAAM,MAAA,CAAO,GAAA,EAAK,SAAS,KAAA,CAAM,MAAA,CAAO,SAAQ,GACpF,KAAA,CAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY;AAAA,MAC/B,KAAK,OAAA,CAAQ,QAAA;AAAA,MACb,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,MAAA,EAAQ,WAAA;AAAA,MACR,UAAA,EAAY,QAAQ,SAAA,CAAU,UAAA;AAAA,MAC9B,GAAA,EAAK,QAAQ,SAAA,CAAU;AAAA,KACxB,CAAA;AAGD,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAID,MAAAA,CAAgC,OAAO,GAAG,CAAA;AAC9D,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,GAAI,QAAQ,GAAA,KAAQ,KAAA,CAAA,GAAY,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAc,GAAI,EAAC;AAAA,MAClE,GAAI,QAAQ,OAAA,KAAY,KAAA,CAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAoB,GAAI;AAAC,KAClF;AAGA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,oBAAA,EAAuB,cAAc,GAAG,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,CAAA;AAAA,MAChG;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAEpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAe,UAAA,EAAY;AAC7B,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,MAClC,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACpJA,IAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,EACrC,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAUM,SAAS,mBAAmB,CAAA,EAAiB;AAClD,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,mBAAmB,wBAAwB,CAAA;AAAA,EACvD;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,mBAAmB,qCAAqC,CAAA;AAAA,EACpE;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,mBAAmB,2DAA2D,CAAA;AAAA,EAC1F;AAEA,EAAA,IAAa,QAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,mBAAmB,gCAAgC,CAAA;AAAA,EAC/D;AAGA,EAAA,MAAM,UAAA,GAAsB,mBAAU,CAAC,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,KAAK,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5F,IAAA,MAAM,IAAI,mBAAmB,oCAAoC,CAAA;AAAA,EACnE;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,mBAAmB,0DAA0D,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,CAAA,CAAE,SAAS,GAAA,EAAK;AAClB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,yCAAA,EAA4C,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACtF;AAGA,EAAA,IAAI,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,mBAAmB,gDAAgD,CAAA;AAAA,EAC/E;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,mBAAmB,0CAA0C,CAAA;AAAA,EACzE;AAIA,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC9B,EAAA,MAAM,QAAA,GAAA,CAAY,YAAY,CAAA,GAAI,CAAA,CAAE,MAAM,CAAA,EAAG,QAAQ,CAAA,GAAI,CAAA,EAAG,WAAA,EAAY;AACxE,EAAA,IAAI,sBAAA,CAAuB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAA,CAAS,WAAA,EAAa,CAAA,CAAE,CAAA;AAAA,EACxF;AACF;AA2BA,eAAe,iBAAiB,aAAA,EAAsC;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,aAAa,CAAA;AACvC,IAAA,IAAI,KAAA,CAAM,gBAAe,EAAG;AAC1B,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,oBAAA,EAAuB,aAAa,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,oBAAoB,MAAM,GAAA;AAE7C,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACtD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAwBA,eAAsB,cAAA,CAAe,SAAiB,SAAA,EAAkC;AACtF,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,CAAO,SAAS,SAAS,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAMA,eAAsB,cAAc,QAAA,EAAmC;AACrE,EAAA,MAAM,iBAAiB,QAAQ,CAAA;AAC/B,EAAA,MAAM,MAAA,GAAkB,QAAA,CAAA,IAAA,CAAK,QAAA,EAAU,CAAA,KAAA,EAAQ,UAAA,GAAa,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AAC1E,EAAA,OAAO,QAAQ,MAAM,CAAA;AACvB;;;ACzKA,cAAA,EAAA;AAOA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,OACE,IAAA,CAAK,SAAA;AAAA,IACH,KAAA;AAAA,IACA,CAAC,MAAM,GAAA,KAAQ;AACb,MAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,GAAA,KAAQ,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AAClE,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,KAAA,MAAW,KAAK,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA,CAAE,MAAK,EAAG;AAClE,UAAA,MAAA,CAAO,CAAC,CAAA,GAAK,GAAA,CAAgC,CAAC,CAAA;AAAA,QAChD;AACA,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF,GAAI,IAAA;AAER;AAKA,SAASE,iBAAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUD,gBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,gBAAgB,SAAS,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAKA,SAAS,kBAAA,GAA6B;AACpC,EAAA,MAAM,EAAA,GAAA,qBAAS,IAAA,EAAK,EAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,GAAG,CAAA;AACxD,EAAA,MAAM,IAAA,GAAOX,UAAAA,EAAW,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA;AACpC,EAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC7B;AAEA,eAAsB,mBACpB,MAAA,EACwB;AACxB,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,oBAAA,EAAsB,MAAM,CAAA;AACpE,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,2BAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,sEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,OAAO,mBAAA,EAAqB;AAC7D,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA,CAAA;AAAA,MAC7G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,GAAG,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA;AAAA,OAClG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,iBAAA,GAAoB,CAAA;AACxB,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,QAAA,EAAU;AAC9B,IAAA,iBAAA,IAAqB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,MAAA;AAAA,EACnD;AACA,EAAA,IAAI,iBAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AACtD,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,oCAAA,EAAuC,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA,CAAA;AAAA,MACjH,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,oBAAA,EAAuB,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OACtG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,WAAA,IAAe,kBAAA,EAAmB;AAC3D,EAAA,IAAI;AACF,IAAA,kBAAA,CAAmB,UAAU,CAAA;AAAA,EAC/B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACjF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,sBAAA;AAAA,QACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,OAC1D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAcY,iBAAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AAEF,IAAA,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAS,CAAA;AAG/C,IAAA,MAAM,WAAA,GAAcC,IAAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAC5C,IAAA,MAAMC,KAAAA,CAAM,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AASxC,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,IAAI,UAAA,GAAa,CAAA;AAIjB,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,IAAA,MAAM,gBAA0B,EAAC;AAEjC,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAE9C,MAAA,IAAI,MAAA,CAAO,QAAQ,OAAA,EAAS;AAC1B,QAAA,MAAM,IAAI,cAAA,CAAe,iBAAA,EAAmB,0CAA0C,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA;AAC5B,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AACzC,MAAA,MAAM,IAAA,GAAO,MAAMR,SAAAA,CAAU,IAAI,CAAA;AAEjC,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1B,MAAA,UAAA,CAAW,IAAI,IAAI,CAAA;AACnB,MAAA,aAAA,CAAc,KAAK,IAAI,CAAA;AAIvB,MAAA,MAAM,QAAA,GAAW,GAAG,IAAI,CAAA,IAAA,CAAA;AACxB,MAAA,MAAM,QAAA,GAAWO,IAAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAC3C,MAAA,MAAM,UAAU,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAC/C,MAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,QACX,KAAA,EAAO,CAAA;AAAA,QACP,IAAA,EAAM,YAAY,QAAQ,CAAA,CAAA;AAAA,QAC1B,MAAA,EAAQ,IAAA;AAAA,QACR,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AACD,MAAA,UAAA,IAAc,IAAA,CAAK,MAAA;AAAA,IACrB;AAMA,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,MAAA,CAAO,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AAIvD,IAAA,MAAM,YAAA,GAAe,CAAC,GAAG,aAAa,EAAE,IAAA,EAAK;AAC7C,IAAA,MAAM,aAAA,GAAgB,GAAG,OAAA,CAAQ,UAAU,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AACrE,IAAA,MAAM,QAAA,GAAW,MAAMP,SAAAA,CAAU,IAAI,aAAY,CAAE,MAAA,CAAO,aAAa,CAAC,CAAA;AAExE,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,SAAA,EAAW,QAAA;AAAA,MACX,YAAA,EAAc,cAAA;AAAA,MACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MACnC,aAAa,OAAA,CAAQ,UAAA;AAAA,MACrB,eAAe,OAAA,CAAQ,MAAA;AAAA,MACvB,QAAA,EAAU,OAAA;AAAA,MACV,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC,KACvD;AAGA,IAAA,MAAM,YAAA,GAAe,oBAAoB,QAAQ,CAAA;AACjD,IAAA,MAAM,SAAA,CAAUO,KAAK,OAAA,EAAS,eAAe,GAAG,YAAA,EAAc,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,YAAY,CAAA;AAC3D,IAAA,MAAM,cAAA,GAAiB,MAAMP,SAAAA,CAAU,aAAa,CAAA;AAMpD,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AACjD,IAAA,MAAM,cAAc,MAAM,IAAA;AAAA,MACxB,iBAAA;AAAA,MACA,QAAQ,SAAA,CAAU,UAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACpB;AACA,IAAA,MAAM,SAAA,CAAUO,KAAK,OAAA,EAAS,cAAc,GAAG,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC3E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,WAAW,CAAA,CAAE,MAAA;AAGpD,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,GAAS,CAAA;AAGnC,IAAA,MAAM,SAAA,GAAYA,IAAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,UAAU,CAAA;AAGpD,IAAA,IAAI;AACF,MAAA,MAAME,KAAK,SAAS,CAAA;AAEpB,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uDAAuD,UAAU,CAAA,CAAA;AAAA,QACvE,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,qBAAA;AAAA,UACN,OAAA,EAAS,+BAA+B,UAAU,CAAA;AAAA,SACpD;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,CAAe,SAAS,SAAS,CAAA;AACvC,IAAA,OAAA,GAAU,KAAA,CAAA;AAEV,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,gBAAA,EAAmB,UAAU,CAAA,EAAA,EAAK,SAAS,WAAW,UAAU,CAAA,OAAA,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAMpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,QAAA;AAAA,QACA,UAAA,EAAY,UAAA;AAAA,QACZ,cAAc,OAAA,CAAQ,MAAA;AAAA,QACtB,SAAA;AAAA,QACA,UAAA;AAAA,QACA,WAAW,QAAA,CAAS,UAAA;AAAA,QACpB;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAI;AACF,QAAA,MAAMC,GAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,QAC5C,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,MAC5C,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACnUO,IAAM,iBAAA,GAAoBC,EAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,EAC/E,sBAAsBA,CAAAA,CACnB,MAAA,GACA,QAAA,EAAS,CACT,SAAS,qDAAqD,CAAA;AAAA,EACjE,MAAMA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,+CAA+C,CAAA;AAAA,EACpF,QAAQA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,uCAAuC,CAAA;AAAA,EAC9E,UAAUA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC;AACpF,CAAC,CAAA;AAID,IAAM,UAAA,GAAaA,EAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,EAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,WAAA,GAAcA,EAAE,MAAA,CAAO;AAAA,EAC3B,IAAA,EAAMA,EAAE,MAAA,EAAO;AAAA,EACf,MAAA,EAAQA,EAAE,OAAA,EAAQ;AAAA,EAClB,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,EAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAO,UAAA;AAAA,EACP,EAAA,EAAIA,EAAE,OAAA,EAAQ;AAAA,EACd,IAAA,EAAMA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAQA,CAAAA,CAAE,KAAA,CAAM,WAAW,CAAA;AAAA,EAC3B,aAAA,EAAeA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAUA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC,CAAA;AClCM,IAAM,kBAAA,GAAqBA,EAAE,MAAA,CAAO;AAAA,EACzC,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sCAAsC,CAAA;AAAA,EAC/D,WAAA,EAAaA,CAAAA,CACV,OAAA,EAAQ,CACR,QAAA,GACA,OAAA,CAAQ,KAAK,CAAA,CACb,QAAA,CAAS,yDAAyD;AACvE,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,EAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,EAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,mBAAA,GAAsBA,EAAE,MAAA,CAAO;AAAA,EAC1C,KAAA,EAAOC,WAAAA;AAAA,EACP,MAAA,EAAQD,EAAE,MAAA,CAAOA,CAAAA,CAAE,QAAO,EAAGA,CAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,WAAA,EAAaA,EAAE,MAAA,CAAO;AAAA,IACpB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC5B,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,GAChC,CAAA;AAAA,EACD,WAAA,EAAaA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAUA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EACxD,QAAA,EAAUA,EAAE,OAAA,EAAQ;AAAA,EACpB,QAAA,EAAUA,CAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;AC/BM,IAAM,iBAAA,GAAoBA,EAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qCAAqC;AAChE,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,EAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,EAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,EAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOC,WAAAA;AAAA,EACP,MAAA,EAAQD,EAAE,MAAA,CAAOA,CAAAA,CAAE,QAAO,EAAGA,CAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,OAAA,EAASA,EAAE,MAAA,CAAOA,CAAAA,CAAE,QAAO,EAAGA,CAAAA,CAAE,SAAS,CAAA;AAAA,EACzC,QAAA,EAAUA,CAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;ACbM,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EACvC,IAAA,EAAMA,EACH,IAAA,CAAK,CAAC,YAAY,WAAW,CAAC,CAAA,CAC9B,QAAA,CAAS,gFAAgF,CAAA;AAAA,EAC5F,IAAA,EAAMA,EACH,MAAA,EAAO,CACP,IAAI,CAAC,CAAA,CACL,GAAA,CAAI,GAAG,CAAA,CACP,MAAA;AAAA,IACC,CAAC,MACC,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,IACrB,2DAAA,CAA4D,KAAK,CAAC,CAAA;AAAA,IACpE;AAAA,MACE,OAAA,EACE;AAAA;AACJ,GACF,CACC,SAAS,mFAAmF,CAAA;AAAA,EAC/F,GAAA,EAAKA,CAAAA,CACF,MAAA,EAAO,CACP,GAAA,CAAI,IAAI,CAAA,CACR,QAAA,EAAS,CACT,QAAA,CAAS,qDAAqD,CAAA;AAAA,EACjE,SAASA,CAAAA,CACN,KAAA;AAAA,IACCA,EAAE,IAAA,CAAK;AAAA,MACL,QAAA;AAAA,MACA,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,SAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH,CACC,UAAS,CACT,MAAA;AAAA,IACC,CAAC,GAAA,KACC,CAAC,GAAA,IAAQ,IAAI,IAAI,GAAG,CAAA,CAAE,IAAA,KAAS,GAAA,CAAI,MAAA,IAAU,CAAC,GAAG,GAAG,CAAA,CAAE,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAG,CAAA,KAAM,CAAA,KAAM,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC3F,EAAE,SAAS,6CAAA;AAA8C,GAC3D,CACC,SAAS,mEAAmE,CAAA;AAAA,EAC/E,aAAaA,CAAAA,CACV,MAAA,EAAO,CACP,QAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,KAAK,CAAC,KAAA,CAAM,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AAAA,IAC1C,OAAA,EAAS;AAAA,GACV,CAAA,CACA,QAAA,CAAS,mEAAmE,CAAA;AAAA,EAC/E,UAAA,EAAYA,CAAAA,CACT,MAAA,CAAOA,CAAAA,CAAE,MAAA,EAAO,EAAGA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,kDAAkD,CAAA;AAAA,EAC9D,MAAA,EAAQA,EACL,MAAA,CAAO;AAAA,IACN,GAAA,EAAKA,EACF,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,IAAI,CAAA,CACR,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG,EAAE,SAAS,2BAAA,EAA6B,CAAA,CAChF,QAAA,CAAS,kCAAkC,CAAA;AAAA,IAC9C,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gBAAgB,CAAA;AAAA,IACjE,MAAA,EAAQA,CAAAA,CACL,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,CAAA,CAC7B,QAAA,EAAS,CACT,QAAA,CAAS,yCAAyC;AAAA,GACtD,CAAA,CACA,QAAA,EAAS,CACT,SAAS,sBAAsB,CAAA;AAAA,EAClC,WAAA,EAAaA,CAAAA,CACV,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,QAAA,EAAS,CACT,QAAA,EAAS,CACT,QAAA,CAAS,2DAA2D;AACzE,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,EAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,EAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsBA,EAAE,MAAA,CAAO;AAAA,EACnC,GAAA,EAAKA,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAMA,EAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAMA,EAAE,MAAA,EAAO;AAAA,EACf,GAAA,EAAKA,EAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,EAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAASA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA;AAC/B,CAAC,CAAA;AAEM,IAAM,iBAAA,GAAoBA,EAAE,MAAA,CAAO;AAAA,EACxC,KAAA,EAAOC,WAAAA;AAAA,EACP,EAAA,EAAID,EAAE,OAAA,EAAQ;AAAA,EACd,GAAA,EAAKA,EAAE,MAAA,EAAO;AAAA,EACd,aAAA,EAAe;AACjB,CAAC,CAAA;AC5GM,IAAM,iBAAA,GAAoBA,EAAE,MAAA,CAAO;AAAA,EACxC,UAAUA,CAAAA,CACP,KAAA,CAAMA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,KAAM,CAAC,CAAA,CAC5B,IAAI,CAAC,CAAA,CACL,IAAI,GAAG,CAAA,CACP,SAAS,uCAAuC,CAAA;AAAA,EACnD,QAAA,EAAUA,CAAAA,CACP,MAAA,CAAOA,CAAAA,CAAE,MAAA,EAAO,EAAGA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,8CAA8C,CAAA;AAAA,EAC1D,WAAA,EAAaA,CAAAA,CACV,MAAA,EAAO,CACP,GAAA,CAAI,GAAG,CAAA,CACP,QAAA,EAAS,CACT,QAAA,CAAS,4DAA4D;AAC1E,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,EAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,EAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,EAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOC,WAAAA;AAAA,EACP,EAAA,EAAID,EAAE,OAAA,EAAQ;AAAA,EACd,QAAA,EAAUA,EAAE,MAAA,EAAO;AAAA,EACnB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,YAAA,EAAcA,EAAE,MAAA,EAAO;AAAA,EACvB,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,EACpB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,EACpB,cAAA,EAAgBA,EAAE,MAAA;AACpB,CAAC,CAAA;;;AZHD,SAAS,QAAA,CAAS,KAAoB,UAAA,EAA6C;AACjF,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,eAAe,GAAA,CAAI,OAAA;AAAA,IACnB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,iBAAA,EAAmB;AAAA,GACrB;AACF;AAEA,SAAS,6BAAA,CACP,QACA,IAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAiB,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AAAA,IACtD,mBAAmB,EAAE,KAAA,EAAO,IAAA,EAAM,GAAG,OAAO,UAAA,EAAW;AAAA,IACvD,SAAS,MAAA,CAAO;AAAA,GAClB;AACF;AAEA,IAAM,qBAAA,GAAyC;AAAA,EAC7C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,IAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAMA,IAAM,sBAAA,GAA0C;AAAA,EAC9C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,uBAAA,GAA2C;AAAA,EAC/C,YAAA,EAAc,KAAA;AAAA,EACd,eAAA,EAAiB,IAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,eAAA,GAAkB,EAAA;AAGxB,IAAM,uBAAA,GAA0B,IAAA;AAEhC,SAAS,mBAAA,CACP,IAAA,EACA,IAAA,EACA,OAAA,EACgB;AAChB,EAAA,MAAM,QAAA,GAAW,OAAO,IAAI,CAAA;AAC5B,EAAA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,MAAA,EAAiB,IAAA,EAAM,SAAS,CAAA;AAAA,IAClD,iBAAA,EAAmB;AAAA,MACjB,KAAA,EAAO,IAAA;AAAA,MACP,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,UAAU,SAAA,IAAa,KAAA;AAAA,MAClC,WAAA,EAAa,UAAU,WAAA,IAAe;AAAA,KACxC;AAAA,IACA,OAAA,EAAS;AAAA,GACX;AACF;AA2BO,SAAS,oBAAoB,OAAA,EAAmC;AACrE,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAQ,GAAI,OAAA;AAGrC,EAAA,MAAM,eAAA,GAAkB,CAAC,aAAA,EAAe,cAAA,EAAgB,aAAa,CAAA;AACrE,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,eAAA,CAAgB,KAAK,YAAY,CAAA;AACjC,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,eAAA,CAAgB,KAAK,oBAAoB,CAAA;AAAA,IAC3C;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,EAAE,GAAG,SAAS,OAAA,EAAS,WAAW,GAAG,eAAA,EAAgB;AAClE,EAAA,MAAM,cAAA,GAAiB,OAAO,MAAA,CAAO,eAAA;AACrC,EAAA,IAAI,cAAA,GAAiB,CAAA;AAErB,EAAA,eAAe,WAAA,CACb,QAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACyB;AAEzB,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,yBAAA;AAAA,QACA,uBAAuB,cAAc,CAAA,qBAAA;AAAA,OACvC;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,EAAM,eAAe,CAAA,EAAG;AAC5C,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,sBAAA;AAAA,QACA,0CAA0C,eAAe,CAAA;AAAA,OAC3D;AAAA,IACF;AAGA,IAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,IAAA,EAAM,MAAM,CAAA;AACpD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,OAAO,6BAAA,CAA8B,iBAAiB,IAAI,CAAA;AAAA,IAC5D;AAcA,IAAA,cAAA,EAAA;AACA,IAAA,MAAM,cAAA,GAAiB,UAAU,MAAM,CAAA;AAIvC,IAAA,KAAK,cAAA,CACF,QAAQ,MAAM;AACb,MAAA,cAAA,EAAA;AAAA,IACF,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAKjB,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC9D,MAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,MAAA,CAAO,IAAI,MAAM,CAAA,MAAA,EAAS,QAAQ,qBAAqB,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,EAAA,CAAI,CAAC,CAAA;AAAA,MAC3F,CAAA,EAAG,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA;AAEhC,MAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,IAChB,CAAC,CAAA;AAGD,IAAA,MAAM,gBAAA,GAA6C,CAAC,cAAA,EAAgB,cAAc,CAAA;AAElF,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,EAAS;AAC7B,MAAA,MAAM,aAAA,GAAgB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC7D,QAAA,MAAM,UAAU,MAAM;AACpB,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,mBAAmB,CAAC,CAAA;AAAA,QACvC,CAAA;AACA,QAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AACxD,QAAA,YAAA,GAAe,MAAM,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,MAClE,CAAC,CAAA;AACD,MAAA,gBAAA,CAAiB,KAAK,aAAa,CAAA;AAAA,IACrC;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,gBAAgB,CAAA;AAOlD,MAAA,MAAM,UAAA,GAAa,6BAAA,CAA8B,MAAA,EAAQ,IAAI,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,qBAAqB,UAAU,CAAA;AACnD,MAAA,IAAI,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,kBAAA,EAAoB;AAClD,QAAA,OAAO,mBAAA;AAAA,UACL,IAAA;AAAA,UACA,wBAAA;AAAA,UACA,CAAA,YAAA,EAAe,WAAW,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,kBAAkB,CAAA;AAAA,SAC1F;AAAA,MACF;AAEA,MAAA,OAAO,UAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,MACzE;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,oBAAA,EAAsB,OAAO,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,gBAAA,EAAkB,OAAO,CAAA;AAAA,IAC5D,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,YAAA,IAAe;AAAA,IACjB;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,IAAI,SAAA;AAAA,IACjB,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAQ;AAAA;AAAA;AAAA,IAG7B;AAAA,MACE,cAAc,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,OAAM,EAAE;AAAA,MAC9C,oBAAA,EAAsB;AAAA;AACxB,GACF;AAGA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,MAAM,CAAA;AAGhD,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,mIAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,cAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EACE,8HAAA;AAAA,MACF,WAAA,EAAa,kBAAA;AAAA,MACb,YAAA,EAAc,mBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,cAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,aAAA,CAAc,EAAE,OAAO,IAAA,EAAsB,MAAwB,CAAC,CAAA;AAAA,MACjF,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,yHAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAwB,CAAC,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAKA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,QAAA;AAAA,MACE,YAAA;AAAA,MACA;AAAA,QACE,KAAA,EAAO,6BAAA;AAAA,QACP,WAAA,EACE,iPAAA;AAAA,QACF,WAAA,EAAa,gBAAA;AAAA,QACb,YAAA,EAAc,iBAAA;AAAA,QACd,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,QACE,YAAA;AAAA,QACA,IAAA;AAAA,QACA,CAAC,WAAW,WAAA,CAAY,EAAE,OAAO,IAAA,EAAoB,MAAA,EAAQ,OAAgB,CAAC,CAAA;AAAA,QAC7E,KAAA,CAAmC;AAAA;AACtC,KACJ;AAGA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,QAAA;AAAA,QACE,oBAAA;AAAA,QACA;AAAA,UACE,KAAA,EAAO,wBAAA;AAAA,UACP,WAAA,EACE,6JAAA;AAAA,UACF,WAAA,EAAa,iBAAA;AAAA,UACb,YAAA,EAAc,kBAAA;AAAA,UACd,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,UACE,oBAAA;AAAA,UACA,IAAA;AAAA,UACA,CAAC,WAAW,kBAAA,CAAmB,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,UACrF,KAAA,CAAmC;AAAA;AACtC,OACJ;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;;;AN/WA,IAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,OAAA,CACG,IAAA,CAAK,WAAW,CAAA,CAChB,OAAA,CAAQ,cAAc,CAAA,CACtB,WAAA,CAAY,sCAAsC,CAAA,CAClD,MAAA,CAAO,sBAAsB,8CAA8C,CAAA,CAC3E,OAAO,mBAAA,EAAqB,uBAAuB,EACnD,MAAA,CAAO,iBAAA,EAAmB,gCAAgC,CAAA,CAC1D,MAAA,CAAO,oBAAA,EAAsB,uCAAuC,CAAA,CACpE,MAAA,CAAO,uBAAuB,sCAAsC,CAAA,CACpE,OAAO,oBAAA,EAAsB,oCAAA,EAAsC,OAAO,CAAA,CAC1E,MAAA,CAAO,iBAAA,EAAmB,wCAAwC,MAAM,CAAA,CACxE,OAAO,kBAAA,EAAoB,wCAAA,EAA0C,WAAW,CAAA,CAChF,MAAA,CAAO,uBAAA,EAAyB,wCAAwC,CAAA,CACxE,MAAA;AAAA,EACC,gCAAA;AAAA,EACA;AACF,CAAA,CACC,MAAA,CAAO,oBAAA,EAAsB,wDAAwD,CAAA,CACrF,MAAA;AAAA,EACC,uBAAA;AAAA,EACA,+GAAA;AAAA,EACA;AACF,CAAA,CACC,MAAA,CAAO,OAAO,IAAA,KAAS;AAEtB,EAAA,MAAM,gBAAgB,IAAA,CAAK,SAAA;AAC3B,EAAA,IAAI,aAAA,KAAkB,OAAA,IAAW,aAAA,KAAkB,MAAA,EAAQ;AACzD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,sDAAsD,aAAa,CAAA;AAAA;AAAA,KACrE;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,IAAA,CAAK,SAAA,IAAa,CAAC,IAAA,CAAK,QAAA,EAAU;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,4CAA4C,CAAA;AACjE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,SAAA,EAAW;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,4CAA4C,CAAA;AACjE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA;AAC3C,IAAA,MAAA,GAAS,MAAA,CAAO,MAAA;AAChB,IAAA,UAAA,GAAa,MAAA,CAAO,IAAA;AAAA,EACtB,CAAA,MAAO;AACL,IAAA,MAAA,GAAS,gBAAA,EAAiB;AAC1B,IAAA,UAAA,GAAa,MAAM,iBAAA,CAAkB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,EAC7D;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,SAAA,GAAY,MAAM,aAAA,CAAc,IAAA,CAAK,SAAS,CAAA;AAAA,EAChD;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,QAAA,GAAW,MAAM,YAAA,CAAa,IAAA,CAAK,QAAQ,CAAA;AAAA,EAC7C;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,MAAME,IAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACrC,MAAA,IAAI,CAAC,CAAA,CAAE,WAAA,EAAY,EAAG;AACpB,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,wCAAA,EAA2C,IAAA,CAAK,SAAS;AAAA,CAAI,CAAA;AAClF,QAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,MAChB;AACA,MAAA,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IAC3C,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC;AAAA;AAAA,OAC9G;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GAAyB;AAAA,IAC7B,OAAA,EAAS,cAAA;AAAA,IACT,UAAA;AAAA,IACA,eAAA,EAAiB,oBAAA;AAAA,IACjB,SAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf;AAAA,GACF;AAGA,EAAA,MAAM,KAAA,GAAQ,CAAC,aAAA,EAAe,cAAA,EAAgB,aAAa,CAAA;AAC3D,EAAA,IAAI,SAAA,IAAa,KAAK,QAAA,EAAU;AAC9B,IAAA,KAAA,CAAM,KAAK,YAAY,CAAA;AACvB,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAAA,IACjC;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAA+B;AAAA,IACnC,OAAA,EAAS,cAAA;AAAA,IACT,MAAA;AAAA,IAGA;AAAA,GACF;AAGA,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,CAAA,EAAI,WAAW,CAAA,GAAA,EAAM,cAAc,eAAe,oBAAoB;AAAA;AAAA,GACxE;AACA,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,aAAA,EAAgB,aAAa;AAAA,CAAI,CAAA;AACtD,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AACrD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,OAAA,EAAU,SAAA,GAAY,WAAW,MAAM;AAAA,CAAI,CAAA;AAChE,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,QAAA,EAAW,QAAA,GAAW,GAAG,QAAA,CAAS,MAAM,YAAY,MAAM;AAAA,CAAI,CAAA;AACnF,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,SAAA,IAAa,MAAM;AAAA,CAAI,CAAA;AAC7D,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,eAAA,EAAkB,WAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAAA,CAAO,CAAA;AAErE,EAAA,IAAI,kBAAkB,MAAA,EAAQ;AAE5B,IAAA,MAAM,EAAE,mBAAA,EAAAC,oBAAAA,EAAoB,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,mBAAA,EAAA,EAAA,sBAAA,CAAA,CAAA;AAEtC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,GACpB,IAAA,CAAK,YAAuB,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,GACnE,MAAA;AACJ,IAAA,MAAM,oBAAA,GAAuB,IAAA,CAAK,oBAAA,GAC7B,IAAA,CAAK,qBAAgC,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,GAC5E,MAAA;AAEJ,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMA,oBAAAA,CAAoB;AAAA,MAC5C,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,IAAA,EAAgB,EAAE,CAAA;AAAA,MACtC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,WAAA;AAAA,MACA,oBAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,UAAA,EAAa,KAAK,UAAA,IAAyB,KAAA;AAAA,MAC3C,aAAA,EAAe,MAAM,mBAAA,CAAoB,aAAa;AAAA,KACvD,CAAA;AAGD,IAAA,MAAM,WAAW,YAAY;AAC3B,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA;AAAA,CAAsB,CAAA;AAC1D,MAAA,MAAM,OAAA,EAAQ;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAAA,EAChC,CAAA,MAAO;AAEL,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,2CAA2C,CAAA;AAGzF,IAAA,MAAM,gBAAgB,kBAAA,EAAmB;AAEzC,IAAA,MAAM,MAAA,GAAS,oBAAoB,aAAa,CAAA;AAChD,IAAA,MAAM,SAAA,GAAY,IAAI,oBAAA,EAAqB;AAG3C,IAAA,MAAM,WAAW,YAAY;AAC3B,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA;AAAA,CAAsB,CAAA;AAC1D,MAAA,MAAM,OAAO,KAAA,EAAM;AACnB,MAAA,aAAA,EAAc;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAE9B,IAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,EAChC;AACF,CAAC,CAAA;AAEH,KAAK,QAAQ,UAAA,CAAW,OAAA,CAAQ,IAAI,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC5D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,CAAA,EAAI,WAAW,CAAA,SAAA,EAAY,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC;AAAA;AAAA,GAC7E;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB,CAAC,CAAA","file":"cli.mjs","sourcesContent":["/**\n * MCP Server constants -- zero imports\n */\n\nexport const SERVER_NAME = 'peac-mcp-server';\nexport const SERVER_VERSION = '0.16.5';\nexport const MCP_PROTOCOL_VERSION = '2025-11-25';\nexport const DEFAULT_MAX_JWS_BYTES = 16_384; // 16 KB\nexport const DEFAULT_MAX_RESPONSE_BYTES = 65_536; // 64 KB\nexport const DEFAULT_TOOL_TIMEOUT_MS = 30_000; // 30 s\nexport const DEFAULT_MAX_CLAIMS_BYTES = 262_144; // 256 KB\nexport const DEFAULT_MAX_BUNDLE_RECEIPTS = 256;\nexport const DEFAULT_MAX_BUNDLE_BYTES = 16_777_216; // 16 MB\nexport const DEFAULT_MAX_TTL_SECONDS = 86_400; // 24 hours\n\n// HTTP transport defaults\nexport const DEFAULT_HTTP_PORT = 3000;\nexport const DEFAULT_HTTP_HOST = '127.0.0.1'; // localhost only; 0.0.0.0 requires explicit opt-in\nexport const DEFAULT_MAX_REQUEST_BYTES = 1_048_576; // 1 MB\nexport const DEFAULT_RATE_LIMIT_RPM = 100;\nexport const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000; // 30 min\nexport const DEFAULT_MAX_SESSIONS = 100;\n","/**\n * MCP Session Manager -- Mcp-Session-Id lifecycle, eviction, isolation\n *\n * Each HTTP session gets its own McpServer + StreamableHTTPServerTransport\n * pair. This is the primary defense against CVE-2026-25536 (cross-client\n * response data leak when a single transport is reused across connections).\n *\n * INVARIANT: NEVER reuse a single transport instance across multiple\n * client sessions. Each session is fully isolated.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\n\nexport interface SessionEntry {\n  readonly sessionId: string;\n  readonly server: McpServer;\n  readonly transport: StreamableHTTPServerTransport;\n  readonly createdAt: number;\n  readonly clientIp: string;\n  lastSeen: number;\n}\n\nexport interface SessionManagerOptions {\n  /** Max idle time before eviction (ms). Default: 30 min */\n  ttlMs?: number;\n  /** Max concurrent sessions. Default: 100 */\n  maxSessions?: number;\n  /** Max sessions per client IP. Default: 10 */\n  maxSessionsPerIp?: number;\n  /** Eviction sweep interval (ms). Default: 60s */\n  sweepIntervalMs?: number;\n}\n\ntype ServerFactory = () => McpServer;\n\nexport class SessionManager {\n  private readonly sessions = new Map<string, SessionEntry>();\n  private readonly ipSessionCount = new Map<string, number>();\n  private readonly ttlMs: number;\n  private readonly maxSessions: number;\n  private readonly maxSessionsPerIp: number;\n  private sweepTimer: ReturnType<typeof setInterval> | undefined;\n\n  constructor(private readonly options: SessionManagerOptions = {}) {\n    this.ttlMs = options.ttlMs ?? 30 * 60 * 1000; // 30 min\n    this.maxSessions = options.maxSessions ?? 100;\n    this.maxSessionsPerIp = options.maxSessionsPerIp ?? 10;\n  }\n\n  /** Start periodic eviction sweep */\n  startSweep(): void {\n    const intervalMs = this.options.sweepIntervalMs ?? 60_000;\n    this.sweepTimer = setInterval(() => this.evictStale(), intervalMs);\n    this.sweepTimer.unref();\n  }\n\n  /** Create a new isolated session with its own McpServer + transport */\n  async createSession(serverFactory: ServerFactory, clientIp = 'unknown'): Promise<SessionEntry> {\n    // Evict stale sessions first\n    this.evictStale();\n\n    // Check global capacity\n    if (this.sessions.size >= this.maxSessions) {\n      throw new Error(`Session limit reached (${this.maxSessions}). Try again later.`);\n    }\n\n    // Check per-IP capacity (prevents one IP exhausting the global pool)\n    const ipCount = this.ipSessionCount.get(clientIp) ?? 0;\n    if (ipCount >= this.maxSessionsPerIp) {\n      throw new Error(\n        `Per-IP session limit reached (${this.maxSessionsPerIp} for ${clientIp}). Try again later.`\n      );\n    }\n\n    const sessionId = randomUUID();\n    const server = serverFactory();\n    const transport = new StreamableHTTPServerTransport({\n      sessionIdGenerator: () => sessionId,\n    });\n\n    await server.connect(transport);\n\n    const now = Date.now();\n    const entry: SessionEntry = {\n      sessionId,\n      server,\n      transport,\n      clientIp,\n      createdAt: now,\n      lastSeen: now,\n    };\n\n    this.sessions.set(sessionId, entry);\n    this.ipSessionCount.set(clientIp, ipCount + 1);\n    return entry;\n  }\n\n  /** Look up an existing session by ID */\n  getSession(sessionId: string): SessionEntry | undefined {\n    const entry = this.sessions.get(sessionId);\n    if (entry) {\n      entry.lastSeen = Date.now();\n    }\n    return entry;\n  }\n\n  /** Whether an unexpired session exists; unlike getSession(), does not refresh lastSeen. */\n  hasSession(sessionId: string): boolean {\n    const entry = this.sessions.get(sessionId);\n    return entry !== undefined && Date.now() - entry.lastSeen <= this.ttlMs;\n  }\n\n  /** Terminate and clean up a specific session */\n  async terminateSession(sessionId: string): Promise<boolean> {\n    const entry = this.sessions.get(sessionId);\n    if (!entry) return false;\n\n    this.sessions.delete(sessionId);\n    this.decrementIpCount(entry.clientIp);\n    try {\n      await entry.transport.close();\n      await entry.server.close();\n    } catch {\n      // Best effort cleanup\n    }\n    return true;\n  }\n\n  /** Terminate all sessions and stop sweep */\n  async cleanup(): Promise<void> {\n    if (this.sweepTimer) {\n      clearInterval(this.sweepTimer);\n      this.sweepTimer = undefined;\n    }\n\n    const entries = [...this.sessions.values()];\n    this.sessions.clear();\n    this.ipSessionCount.clear();\n\n    await Promise.allSettled(\n      entries.map(async (entry) => {\n        try {\n          await entry.transport.close();\n          await entry.server.close();\n        } catch {\n          // Best effort\n        }\n      })\n    );\n  }\n\n  /** Get current session count */\n  get size(): number {\n    return this.sessions.size;\n  }\n\n  /** Evict sessions past TTL */\n  private evictStale(): void {\n    const now = Date.now();\n    for (const [id, entry] of this.sessions) {\n      if (now - entry.lastSeen > this.ttlMs) {\n        this.sessions.delete(id);\n        this.decrementIpCount(entry.clientIp);\n        // Fire-and-forget cleanup\n        void entry.transport.close().catch(() => {});\n        void entry.server.close().catch(() => {});\n      }\n    }\n  }\n\n  /** Decrement per-IP session count, removing the key when it reaches 0 */\n  private decrementIpCount(ip: string): void {\n    const count = this.ipSessionCount.get(ip) ?? 0;\n    if (count <= 1) {\n      this.ipSessionCount.delete(ip);\n    } else {\n      this.ipSessionCount.set(ip, count - 1);\n    }\n  }\n}\n","/**\n * MCP Streamable HTTP transport\n *\n * Adds HTTP transport alongside stdio. Unprotected mode only.\n * Each session gets its own McpServer + transport (CVE-2026-25536 defense).\n *\n * Endpoints:\n *   POST /mcp          JSON-RPC tool calls (requires Mcp-Session-Id after init)\n *   DELETE /mcp         Terminate session\n *   GET /health         Health check (no auth)\n *   GET /.well-known/oauth-protected-resource[/<path>]   PRM (conditional)\n *   GET /mcp            405 Method Not Allowed\n */\n\nimport { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { SUPPORTED_PROTOCOL_VERSIONS as SDK_SUPPORTED_PROTOCOL_VERSIONS } from '@modelcontextprotocol/sdk/types.js';\nimport { SessionManager } from './session-manager.js';\nimport { SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION } from './infra/constants.js';\n\n/**\n * Trust-proxy configuration for X-Forwarded-For interpretation.\n *\n * Presets:\n * - 'off': never trust forwarded headers (default; safe for direct clients)\n * - 'loopback': trust only from 127.0.0.0/8 and ::1\n * - 'linklocal': trust loopback + link-local (169.254.0.0/16, fe80::/10)\n * - 'private': trust loopback + link-local + RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)\n * - 'all': trust any remote address (DISCOURAGED; use only when behind a fully trusted proxy chain)\n *\n * Explicit addresses:\n * - comma-separated IPs: trust only from listed addresses (e.g., '10.0.0.1,10.0.0.2')\n *\n * WARNING: only enable behind a trusted reverse proxy. An attacker can forge\n * X-Forwarded-For from an untrusted peer to bypass per-IP rate limiting.\n */\nexport type TrustProxyValue = 'off' | 'loopback' | 'linklocal' | 'private' | 'all' | string;\n\nexport interface HttpTransportOptions {\n  /** Port to listen on. Default: 3000 */\n  port?: number;\n  /** Bind address. Default: '127.0.0.1' (localhost only) */\n  host?: string;\n  /** Allowed CORS origins (empty = deny all). */\n  corsOrigins?: string[];\n  /** OAuth authorization server URIs (enables PRM with publicUrl). */\n  authorizationServers?: string[];\n  /** Canonical public URL of this server (required for PRM). */\n  publicUrl?: string;\n  /** Trust X-Forwarded-For for rate limiting. Default: 'off' */\n  trustProxy?: TrustProxyValue;\n  /** Max request body bytes. Default: 1MB */\n  maxRequestBytes?: number;\n  /** Rate limit: requests per minute per session. Default: 100 */\n  rateLimitRpm?: number;\n  /** Session TTL in ms. Default: 30 min */\n  sessionTtlMs?: number;\n  /** Max concurrent sessions. Default: 100 */\n  maxSessions?: number;\n  /** Max sessions per client IP. Default: 10 */\n  maxSessionsPerIp?: number;\n  /** Factory to create new McpServer instances (one per session) */\n  serverFactory: () => McpServer;\n}\n\ninterface RateLimitEntry {\n  count: number;\n  windowStart: number;\n}\n\nconst ONE_MINUTE_MS = 60_000;\nconst DEFAULT_MAX_REQUEST_BYTES = 1_048_576; // 1 MB\nconst DEFAULT_RATE_LIMIT_RPM = 100;\nconst MAX_SESSION_ID_LENGTH = 128;\n\n/** Upper bound on tracked rate-limit windows; the oldest window is evicted first. */\nexport const MAX_RATE_LIMIT_KEYS = 10_000;\n\n/** Accepted MCP-Protocol-Version values: exactly the SDK's supported list. */\nconst SUPPORTED_PROTOCOL_VERSIONS: readonly string[] = SDK_SUPPORTED_PROTOCOL_VERSIONS;\n\n/**\n * Validate MCP-Protocol-Version for both init and non-init requests.\n *\n * An absent header is not an error: per the spec's backwards-compatibility\n * rule the client is assumed to speak the SDK's default negotiated revision\n * (DEFAULT_NEGOTIATED_PROTOCOL_VERSION). Returns an error message for an\n * unsupported version, or null when the request may proceed.\n */\nfunction checkProtocolVersion(req: IncomingMessage): string | null {\n  const protocolVersion = req.headers['mcp-protocol-version'] as string | undefined;\n  if (protocolVersion && !SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {\n    return `Unsupported MCP protocol version: ${protocolVersion} (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(', ')})`;\n  }\n  return null;\n}\n\n/**\n * Validate Mcp-Session-Id: visible ASCII (0x21-0x7E), max 128 chars.\n * MCP spec requires session IDs to be visible ASCII characters only.\n */\nfunction isValidSessionId(id: string): boolean {\n  if (id.length === 0 || id.length > MAX_SESSION_ID_LENGTH) return false;\n  for (let i = 0; i < id.length; i++) {\n    const code = id.charCodeAt(i);\n    if (code < 0x21 || code > 0x7e) return false;\n  }\n  return true;\n}\n\n/** Rate-limit key: a valid id of a live session, otherwise the client address. */\nexport function rateLimitKeyFor(\n  sessionId: string | undefined,\n  clientIp: string,\n  isLiveSession: (id: string) => boolean\n): string {\n  return sessionId !== undefined && isValidSessionId(sessionId) && isLiveSession(sessionId)\n    ? `session:${sessionId}`\n    : `ip:${clientIp}`;\n}\n\n/**\n * Check if an IPv4 address falls within a well-known range.\n * Does NOT perform CIDR parsing; uses prefix matching for known ranges.\n */\nfunction isLoopbackAddr(addr: string): boolean {\n  return addr.startsWith('127.') || addr === '::1' || addr === '::ffff:127.0.0.1';\n}\nfunction isLinkLocalAddr(addr: string): boolean {\n  if (isLoopbackAddr(addr)) return true;\n  return addr.startsWith('169.254.') || addr.startsWith('fe80');\n}\nfunction isPrivateAddr(addr: string): boolean {\n  if (isLinkLocalAddr(addr)) return true;\n  return (\n    addr.startsWith('10.') ||\n    addr.startsWith('192.168.') ||\n    /^172\\.(1[6-9]|2\\d|3[01])\\./.test(addr) ||\n    addr.startsWith('fc') ||\n    addr.startsWith('fd') ||\n    addr.startsWith('::ffff:10.') ||\n    addr.startsWith('::ffff:192.168.') ||\n    /^::ffff:172\\.(1[6-9]|2\\d|3[01])\\./.test(addr)\n  );\n}\n\n/**\n * Check if a remote address is a trusted proxy based on trust-proxy config.\n */\nfunction isTrustedProxy(remoteAddr: string, trustProxy: TrustProxyValue): boolean {\n  if (trustProxy === 'off') return false;\n  if (trustProxy === 'all') return true;\n  if (trustProxy === 'loopback') return isLoopbackAddr(remoteAddr);\n  if (trustProxy === 'linklocal') return isLinkLocalAddr(remoteAddr);\n  if (trustProxy === 'private') return isPrivateAddr(remoteAddr);\n  // Comma-separated trusted IPs\n  const trusted = trustProxy.split(',').map((s) => s.trim());\n  return trusted.includes(remoteAddr);\n}\n\n/**\n * Validate --public-url for RFC 9728 PRM correctness:\n * - Must be https (unless loopback for dev ergonomics)\n * - Must not contain fragments\n * - Trailing slashes normalized\n */\nfunction validatePublicUrl(rawUrl: string): { url: URL; normalized: string } | { error: string } {\n  let u: URL;\n  try {\n    u = new URL(rawUrl);\n  } catch {\n    return { error: `Invalid URL: ${rawUrl}` };\n  }\n  if (u.hash) {\n    return { error: 'Public URL must not contain fragments (#)' };\n  }\n  const isLoopback =\n    u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1';\n  if (u.protocol !== 'https:' && !isLoopback) {\n    return { error: 'Public URL must use https (except for localhost/loopback dev usage)' };\n  }\n  // Normalize: strip trailing slash for path matching consistency\n  const normalized = u.href.replace(/\\/+$/, '') || u.origin;\n  return { url: u, normalized };\n}\n\n/**\n * Create and start an HTTP server for MCP Streamable HTTP transport.\n * Returns a cleanup function to shut everything down.\n */\nexport async function createHttpTransport(options: HttpTransportOptions): Promise<{\n  cleanup: () => Promise<void>;\n  /** Number of tracked rate-limit windows (test seam). */\n  rateLimitKeyCount: () => number;\n}> {\n  const port = options.port ?? 3000;\n  const host = options.host ?? '127.0.0.1';\n  const corsOrigins = new Set(options.corsOrigins ?? []);\n  const maxRequestBytes = options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES;\n  const rateLimitRpm = options.rateLimitRpm ?? DEFAULT_RATE_LIMIT_RPM;\n\n  const sessionManager = new SessionManager({\n    ttlMs: options.sessionTtlMs,\n    maxSessions: options.maxSessions,\n    maxSessionsPerIp: options.maxSessionsPerIp,\n  });\n  sessionManager.startSweep();\n\n  // One-minute windows keyed by rateLimitKeyFor; at most MAX_RATE_LIMIT_KEYS are tracked.\n  const rateLimits = new Map<string, RateLimitEntry>();\n\n  function checkRateLimit(key: string): boolean {\n    const now = Date.now();\n    let entry = rateLimits.get(key);\n    if (!entry || now - entry.windowStart > ONE_MINUTE_MS) {\n      if (!entry && rateLimits.size >= MAX_RATE_LIMIT_KEYS) {\n        const oldest = rateLimits.keys().next().value; // Map keeps insertion order\n        if (oldest !== undefined) rateLimits.delete(oldest);\n      }\n      entry = { count: 0, windowStart: now };\n      rateLimits.delete(key);\n      rateLimits.set(key, entry);\n    }\n    entry.count++;\n    return entry.count <= rateLimitRpm;\n  }\n\n  const trustProxyValue: TrustProxyValue = options.trustProxy ?? 'off';\n\n  /**\n   * Resolve the client IP for rate limiting and per-IP session caps.\n   *\n   * Terminology:\n   * - peer_ip: the TCP socket remote address (req.socket.remoteAddress).\n   *   This is the IP the OS reports; it cannot be spoofed at the application layer.\n   * - client_ip: the resolved end-client IP after trust-proxy evaluation.\n   *   When trust-proxy is 'off' (default), client_ip === peer_ip.\n   *   When trust-proxy is enabled AND the peer_ip matches the trusted range,\n   *   client_ip is taken from the first entry in X-Forwarded-For.\n   *   When trust-proxy is enabled but the peer_ip is NOT in the trusted range,\n   *   X-Forwarded-For is IGNORED (peer_ip used as client_ip) to prevent\n   *   spoofing from untrusted peers.\n   */\n  function getClientIp(req: IncomingMessage): string {\n    const peerIp = req.socket.remoteAddress ?? 'unknown';\n    if (trustProxyValue !== 'off' && isTrustedProxy(peerIp, trustProxyValue)) {\n      const xff = req.headers['x-forwarded-for'];\n      if (typeof xff === 'string') {\n        const first = xff.split(',')[0]?.trim();\n        if (first) return first;\n      }\n    }\n    return peerIp;\n  }\n\n  // Allowed hosts for Host header validation\n  const allowedHosts = new Set<string>();\n  allowedHosts.add(`${host}:${port}`);\n  allowedHosts.add(host === '0.0.0.0' ? `localhost:${port}` : `${host}:${port}`);\n  if (host === '127.0.0.1' || host === '0.0.0.0') {\n    allowedHosts.add(`localhost:${port}`);\n    allowedHosts.add(`127.0.0.1:${port}`);\n  }\n  if (options.publicUrl) {\n    try {\n      const u = new URL(options.publicUrl);\n      allowedHosts.add(u.host);\n    } catch {\n      // Invalid publicUrl, ignore\n    }\n  }\n\n  // Origin allowlist for DNS rebinding defense (MCP spec MUST requirement)\n  const allowedOrigins = new Set<string>(corsOrigins);\n\n  function validateOrigin(req: IncomingMessage, res: ServerResponse): boolean {\n    const origin = req.headers.origin;\n    if (!origin) return true; // No origin = same-origin or non-browser\n    if (allowedOrigins.size === 0) {\n      // Deny all cross-origin by default\n      res.writeHead(403, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify({ error: 'Origin not allowed' }));\n      return false;\n    }\n    if (!allowedOrigins.has(origin)) {\n      res.writeHead(403, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify({ error: 'Origin not allowed' }));\n      return false;\n    }\n    return true;\n  }\n\n  function setCorsHeaders(req: IncomingMessage, res: ServerResponse): void {\n    const origin = req.headers.origin;\n    if (origin && allowedOrigins.has(origin)) {\n      res.setHeader('Access-Control-Allow-Origin', origin);\n      res.setHeader('Access-Control-Allow-Methods', 'POST, DELETE, GET, OPTIONS');\n      res.setHeader(\n        'Access-Control-Allow-Headers',\n        'Content-Type, Mcp-Session-Id, Accept, MCP-Protocol-Version'\n      );\n      res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');\n    }\n  }\n\n  function sendJson(res: ServerResponse, status: number, body: unknown): void {\n    const json = JSON.stringify(body);\n    res.writeHead(status, { 'Content-Type': 'application/json' });\n    res.end(json);\n  }\n\n  async function readBody(req: IncomingMessage): Promise<Buffer> {\n    const chunks: Buffer[] = [];\n    let totalBytes = 0;\n    for await (const chunk of req) {\n      totalBytes += (chunk as Buffer).length;\n      if (totalBytes > maxRequestBytes) {\n        throw new Error(`Request body exceeds ${maxRequestBytes} bytes`);\n      }\n      chunks.push(chunk as Buffer);\n    }\n    return Buffer.concat(chunks);\n  }\n\n  // PRM configuration (RFC 9728 path-aware discovery)\n  // Both authorizationServers (non-empty) and publicUrl are required for PRM.\n  const authServers = (options.authorizationServers ?? []).filter((s) => s.trim().length > 0);\n  if (options.authorizationServers?.length && authServers.length === 0) {\n    process.stderr.write(\n      `[${SERVER_NAME}] WARNING: --authorization-servers contains only empty entries, PRM disabled\\n`\n    );\n  }\n  if (authServers.length > 0 && !options.publicUrl) {\n    process.stderr.write(\n      `[${SERVER_NAME}] WARNING: --authorization-servers set without --public-url, PRM disabled\\n`\n    );\n  }\n  if (options.publicUrl && authServers.length === 0) {\n    process.stderr.write(\n      `[${SERVER_NAME}] WARNING: --public-url set without --authorization-servers, PRM disabled\\n`\n    );\n  }\n  const prmEnabled = !!(authServers.length > 0 && options.publicUrl);\n  let prmPath = '/.well-known/oauth-protected-resource';\n  let prmDocument: object | undefined;\n  if (prmEnabled && options.publicUrl) {\n    const validation = validatePublicUrl(options.publicUrl);\n    if ('error' in validation) {\n      process.stderr.write(\n        `[${SERVER_NAME}] WARNING: --public-url invalid, PRM disabled: ${validation.error}\\n`\n      );\n    } else {\n      const { url: u, normalized } = validation;\n      // RFC 9728 path insertion: /.well-known/oauth-protected-resource/<resource-path>\n      const resourcePath = u.pathname.replace(/\\/+$/, '');\n      if (resourcePath && resourcePath !== '/') {\n        prmPath = `/.well-known/oauth-protected-resource${resourcePath}`;\n      }\n      prmDocument = {\n        resource: normalized,\n        authorization_servers: authServers,\n      };\n    }\n  }\n\n  const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);\n    const pathname = url.pathname;\n\n    // Node.js server timeouts (slowloris defense)\n    // These are set per-request since createServer options apply globally\n    res.setTimeout(30_000);\n\n    // CORS preflight\n    if (req.method === 'OPTIONS') {\n      setCorsHeaders(req, res);\n      res.writeHead(204);\n      res.end();\n      return;\n    }\n\n    setCorsHeaders(req, res);\n\n    // Host header validation\n    const hostHeader = req.headers.host;\n    if (hostHeader && !allowedHosts.has(hostHeader)) {\n      sendJson(res, 400, { error: 'Invalid Host header' });\n      return;\n    }\n\n    // Origin validation (DNS rebinding defense)\n    if (!validateOrigin(req, res)) return;\n\n    // --- Health endpoint ---\n    if (pathname === '/health' && req.method === 'GET') {\n      sendJson(res, 200, {\n        ok: true,\n        version: SERVER_VERSION,\n        protocolVersion: MCP_PROTOCOL_VERSION,\n      });\n      return;\n    }\n\n    // --- PRM endpoint ---\n    if (pathname === prmPath && req.method === 'GET') {\n      if (prmEnabled && prmDocument) {\n        sendJson(res, 200, prmDocument);\n      } else {\n        sendJson(res, 404, { error: 'Not found' });\n      }\n      return;\n    }\n\n    // --- MCP endpoint ---\n    if (pathname === '/mcp') {\n      // GET /mcp -> 405 (server-initiated SSE streams are not supported)\n      if (req.method === 'GET') {\n        res.writeHead(405, { Allow: 'POST, DELETE', 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Method Not Allowed. Use POST for JSON-RPC requests.' }));\n        return;\n      }\n\n      // DELETE /mcp -> terminate session\n      if (req.method === 'DELETE') {\n        const sessionId = req.headers['mcp-session-id'] as string | undefined;\n        if (!sessionId) {\n          sendJson(res, 400, { error: 'Missing Mcp-Session-Id header' });\n          return;\n        }\n        if (!isValidSessionId(sessionId)) {\n          sendJson(res, 400, {\n            error: 'Invalid Mcp-Session-Id: must be visible ASCII (0x21-0x7E), max 128 chars',\n          });\n          return;\n        }\n        const terminated = await sessionManager.terminateSession(sessionId);\n        if (terminated) {\n          sendJson(res, 200, { ok: true });\n        } else {\n          sendJson(res, 404, { error: 'Session not found or already terminated' });\n        }\n        return;\n      }\n\n      // POST /mcp -> JSON-RPC\n      if (req.method === 'POST') {\n        // Rate limit check\n        const sessionId = req.headers['mcp-session-id'] as string | undefined;\n        const rateLimitKey = rateLimitKeyFor(sessionId, getClientIp(req), (id) =>\n          sessionManager.hasSession(id)\n        );\n        if (!checkRateLimit(rateLimitKey)) {\n          res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': '60' });\n          res.end(JSON.stringify({ error: 'Rate limit exceeded' }));\n          return;\n        }\n\n        // Read and parse body\n        let body: unknown;\n        try {\n          const raw = await readBody(req);\n          body = JSON.parse(raw.toString('utf-8'));\n        } catch (err) {\n          const msg = err instanceof Error ? err.message : 'Invalid request body';\n          sendJson(res, 400, { error: msg });\n          return;\n        }\n\n        // Check if this is an initialization request\n        const isInit =\n          typeof body === 'object' &&\n          body !== null &&\n          'method' in body &&\n          (body as { method: string }).method === 'initialize';\n\n        if (isInit) {\n          // MCP-Protocol-Version validation (on init)\n          const versionError = checkProtocolVersion(req);\n          if (versionError) {\n            sendJson(res, 400, { error: versionError });\n            return;\n          }\n\n          // Accept header tolerance\n          const accept = req.headers.accept;\n          if (!accept) {\n            process.stderr.write(\n              `[${SERVER_NAME}] Warning: missing Accept header on init request\\n`\n            );\n          }\n\n          // Create new session\n          let entry;\n          try {\n            entry = await sessionManager.createSession(options.serverFactory, getClientIp(req));\n          } catch (err) {\n            const msg = err instanceof Error ? err.message : 'Failed to create session';\n            sendJson(res, 503, { error: msg });\n            return;\n          }\n\n          // Delegate to transport (it will set Mcp-Session-Id header)\n          await entry.transport.handleRequest(req, res, body);\n          return;\n        }\n\n        // Checked before session handling so an unsupported version is\n        // rejected as such, without touching session state.\n        const versionError = checkProtocolVersion(req);\n        if (versionError) {\n          sendJson(res, 400, { error: versionError });\n          return;\n        }\n\n        // Non-init requests require Mcp-Session-Id\n        if (!sessionId) {\n          sendJson(res, 400, { error: 'Missing Mcp-Session-Id header' });\n          return;\n        }\n        if (!isValidSessionId(sessionId)) {\n          sendJson(res, 400, {\n            error: 'Invalid Mcp-Session-Id: must be visible ASCII (0x21-0x7E), max 128 chars',\n          });\n          return;\n        }\n\n        const entry = sessionManager.getSession(sessionId);\n        if (!entry) {\n          sendJson(res, 404, { error: 'Session not found or terminated' });\n          return;\n        }\n\n        // Delegate to session's transport\n        await entry.transport.handleRequest(req, res, body);\n        return;\n      }\n\n      // Other methods on /mcp\n      res.writeHead(405, { Allow: 'POST, DELETE', 'Content-Type': 'application/json' });\n      res.end(JSON.stringify({ error: 'Method Not Allowed' }));\n      return;\n    }\n\n    // --- Not found ---\n    sendJson(res, 404, { error: 'Not found' });\n  });\n\n  // Node.js server timeouts (slowloris defense)\n  server.headersTimeout = 10_000; // 10s for headers\n  server.requestTimeout = 30_000; // 30s for full request\n  server.keepAliveTimeout = 5_000; // 5s keep-alive\n\n  return new Promise((resolve, reject) => {\n    server.on('error', reject);\n    server.listen(port, host, () => {\n      process.stderr.write(`[${SERVER_NAME}] HTTP transport listening on http://${host}:${port}\\n`);\n      process.stderr.write(`  Transport: Streamable HTTP (MCP ${MCP_PROTOCOL_VERSION})\\n`);\n      process.stderr.write(\n        `  Auth: unprotected mode (no token validation); PRM discovery per RFC 9728\\n`\n      );\n      process.stderr.write(`  Endpoints: POST /mcp, DELETE /mcp, GET /health\\n`);\n      if (prmEnabled) {\n        process.stderr.write(`  PRM: GET ${prmPath} (implemented, enabled by config)\\n`);\n      } else {\n        process.stderr.write(\n          `  PRM: disabled (set --authorization-servers + --public-url to enable)\\n`\n        );\n      }\n      process.stderr.write(\n        `  Sessions: max ${options.maxSessions ?? 100} (${options.maxSessionsPerIp ?? 10}/IP), TTL ${(options.sessionTtlMs ?? 1_800_000) / 1000}s\\n`\n      );\n      process.stderr.write(`  Rate limit: ${rateLimitRpm} req/min per session or client address\\n`);\n      process.stderr.write(\n        `  CORS: ${corsOrigins.size > 0 ? [...corsOrigins].join(', ') : 'deny all'}\\n`\n      );\n      process.stderr.write(\n        `  Mode: unprotected (no token validation; deploy behind an authenticating reverse proxy)\\n`\n      );\n\n      resolve({\n        cleanup: async () => {\n          await sessionManager.cleanup();\n          await new Promise<void>((res) => server.close(() => res()));\n        },\n        rateLimitKeyCount: () => rateLimits.size,\n      });\n    });\n  });\n}\n","#!/usr/bin/env node\n/**\n * peac-mcp-server CLI entry point\n *\n * Startup: parse args -> load policy -> load key -> load JWKS ->\n *          select transport -> create server -> connect\n *\n * Transports:\n *   stdio (default): stdin/stdout JSON-RPC, stdout fence\n *   http: Streamable HTTP on configurable port, session-isolated\n */\n\nimport { stat as fsStat, realpath } from 'node:fs/promises';\nimport { Command } from 'commander';\nimport { SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION } from './infra/constants.js';\nimport { loadPolicy, getDefaultPolicy, computePolicyHash } from './infra/policy.js';\nimport { loadIssuerKey } from './infra/key-loader.js';\nimport { loadJwksFile } from './infra/jwks-loader.js';\nimport type { JwksKeyEntry } from './infra/jwks-loader.js';\nimport type { PolicyConfig } from './infra/policy.js';\nimport type { LoadedKey } from './infra/key-loader.js';\nimport type { ServerContext } from './handlers/types.js';\nimport { installStdoutFence } from './stdout-fence.js';\nimport { createPeacMcpServer } from './server.js';\nimport type { ServerOptions } from './server.js';\n\nconst program = new Command();\n\nprogram\n  .name(SERVER_NAME)\n  .version(SERVER_VERSION)\n  .description('PEAC receipt operations as MCP tools')\n  .option('--issuer-key <ref>', 'Issuer key reference (env:VAR or file:/path)')\n  .option('--issuer-id <uri>', 'Issuer identifier URI')\n  .option('--policy <path>', 'Policy configuration file path')\n  .option('--jwks-file <path>', 'JWKS file for verifier key resolution')\n  .option('--bundle-dir <path>', 'Directory for evidence bundle output')\n  .option('--transport <type>', 'Transport: stdio (default) or http', 'stdio')\n  .option('--port <number>', 'HTTP port (default: 3000, http only)', '3000')\n  .option('--host <address>', 'HTTP bind address (default: 127.0.0.1)', '127.0.0.1')\n  .option('--cors-origins <list>', 'Allowed CORS origins (comma-separated)')\n  .option(\n    '--authorization-servers <list>',\n    'OAuth authorization server URIs (enables PRM with --public-url)'\n  )\n  .option('--public-url <url>', 'Canonical public URL of this server (required for PRM)')\n  .option(\n    '--trust-proxy <value>',\n    'Trust X-Forwarded-For: off (default), loopback, linklocal, private, all (discouraged), or comma-separated IPs',\n    'off'\n  )\n  .action(async (opts) => {\n    // Validate transport\n    const transportType = opts.transport as string;\n    if (transportType !== 'stdio' && transportType !== 'http') {\n      process.stderr.write(\n        `ERROR: --transport must be \"stdio\" or \"http\", got \"${transportType}\"\\n`\n      );\n      process.exit(1);\n    }\n\n    // Validate key flag pairing\n    if (opts.issuerKey && !opts.issuerId) {\n      process.stderr.write('ERROR: --issuer-key requires --issuer-id\\n');\n      process.exit(1);\n    }\n    if (opts.issuerId && !opts.issuerKey) {\n      process.stderr.write('ERROR: --issuer-id requires --issuer-key\\n');\n      process.exit(1);\n    }\n\n    // Load policy\n    let policy: PolicyConfig;\n    let policyHash: string;\n    if (opts.policy) {\n      const loaded = await loadPolicy(opts.policy);\n      policy = loaded.policy;\n      policyHash = loaded.hash;\n    } else {\n      policy = getDefaultPolicy();\n      policyHash = await computePolicyHash(JSON.stringify(policy));\n    }\n\n    // Load issuer key (optional, for issue tool)\n    let issuerKey: LoadedKey | undefined;\n    if (opts.issuerKey) {\n      issuerKey = await loadIssuerKey(opts.issuerKey);\n    }\n\n    // Load JWKS (optional, for verifier key resolution)\n    let jwksKeys: JwksKeyEntry[] | undefined;\n    if (opts.jwksFile) {\n      jwksKeys = await loadJwksFile(opts.jwksFile);\n    }\n\n    // Validate bundle-dir (optional, for bundle tool)\n    let bundleDir: string | undefined;\n    if (opts.bundleDir) {\n      try {\n        const s = await fsStat(opts.bundleDir);\n        if (!s.isDirectory()) {\n          process.stderr.write(`ERROR: --bundle-dir is not a directory: ${opts.bundleDir}\\n`);\n          process.exit(1);\n        }\n        bundleDir = await realpath(opts.bundleDir);\n      } catch (err) {\n        process.stderr.write(\n          `ERROR: --bundle-dir not accessible: ${opts.bundleDir} -- ${err instanceof Error ? err.message : String(err)}\\n`\n        );\n        process.exit(1);\n      }\n    }\n\n    // Build server context\n    const context: ServerContext = {\n      version: SERVER_VERSION,\n      policyHash,\n      protocolVersion: MCP_PROTOCOL_VERSION,\n      issuerKey,\n      jwksKeys,\n      issuerId: opts.issuerId,\n      bundleDir,\n    };\n\n    // Compute tool list for banner\n    const tools = ['peac_verify', 'peac_inspect', 'peac_decode'];\n    if (issuerKey && opts.issuerId) {\n      tools.push('peac_issue');\n      if (bundleDir) {\n        tools.push('peac_create_bundle');\n      }\n    }\n\n    // Server options (shared between stdio and http)\n    const serverOptions: ServerOptions = {\n      version: SERVER_VERSION,\n      policy,\n      policyHash,\n      protocolVersion: MCP_PROTOCOL_VERSION,\n      context,\n    };\n\n    // Banner to stderr (never stdout)\n    process.stderr.write(\n      `[${SERVER_NAME}] v${SERVER_VERSION} | protocol ${MCP_PROTOCOL_VERSION}\\n`\n    );\n    process.stderr.write(`  Transport: ${transportType}\\n`);\n    process.stderr.write(`  Tools: ${tools.join(', ')}\\n`);\n    process.stderr.write(`  Key: ${issuerKey ? 'loaded' : 'none'}\\n`);\n    process.stderr.write(`  JWKS: ${jwksKeys ? `${jwksKeys.length} key(s)` : 'none'}\\n`);\n    process.stderr.write(`  Bundle dir: ${bundleDir ?? 'none'}\\n`);\n    process.stderr.write(`  Policy hash: ${policyHash.slice(0, 16)}...\\n`);\n\n    if (transportType === 'http') {\n      // --- HTTP transport ---\n      const { createHttpTransport } = await import('./http-transport.js');\n\n      const corsOrigins = opts.corsOrigins\n        ? (opts.corsOrigins as string).split(',').map((s: string) => s.trim())\n        : undefined;\n      const authorizationServers = opts.authorizationServers\n        ? (opts.authorizationServers as string).split(',').map((s: string) => s.trim())\n        : undefined;\n\n      const { cleanup } = await createHttpTransport({\n        port: parseInt(opts.port as string, 10),\n        host: opts.host as string,\n        corsOrigins,\n        authorizationServers,\n        publicUrl: opts.publicUrl as string | undefined,\n        trustProxy: (opts.trustProxy as string) || 'off',\n        serverFactory: () => createPeacMcpServer(serverOptions),\n      });\n\n      // Graceful shutdown\n      const shutdown = async () => {\n        process.stderr.write(`[${SERVER_NAME}] Shutting down...\\n`);\n        await cleanup();\n        process.exit(0);\n      };\n\n      process.on('SIGINT', shutdown);\n      process.on('SIGTERM', shutdown);\n    } else {\n      // --- stdio transport (default, unchanged) ---\n      const { StdioServerTransport } = await import('@modelcontextprotocol/sdk/server/stdio.js');\n\n      // Install stdout fence BEFORE connecting transport\n      const teardownFence = installStdoutFence();\n\n      const server = createPeacMcpServer(serverOptions);\n      const transport = new StdioServerTransport();\n\n      // Graceful shutdown\n      const shutdown = async () => {\n        process.stderr.write(`[${SERVER_NAME}] Shutting down...\\n`);\n        await server.close();\n        teardownFence();\n        process.exit(0);\n      };\n\n      process.on('SIGINT', shutdown);\n      process.on('SIGTERM', shutdown);\n\n      await server.connect(transport);\n    }\n  });\n\nvoid program.parseAsync(process.argv).catch((err: unknown) => {\n  process.stderr.write(\n    `[${SERVER_NAME}] Fatal: ${err instanceof Error ? err.message : String(err)}\\n`\n  );\n  process.exit(1);\n});\n","/**\n * MCP Server error hierarchy -- zero external imports\n *\n * Error codes use the E_MCP_* taxonomy for MCP-server-specific errors.\n * Protocol errors (E_INVALID_SIGNATURE, etc.) are passed through as nested detail.\n */\n\nexport type McpServerErrorCode =\n  | 'E_MCP_KEY_LOAD'\n  | 'E_MCP_POLICY_LOAD'\n  | 'E_MCP_JWKS_LOAD'\n  | 'E_MCP_INPUT_TOO_LARGE'\n  | 'E_MCP_OUTPUT_TOO_LARGE'\n  | 'E_MCP_TOOL_DISABLED'\n  | 'E_MCP_TOOL_TIMEOUT'\n  | 'E_MCP_KEY_RESOLUTION'\n  | 'E_MCP_KID_REQUIRED'\n  | 'E_MCP_JWKS_NO_MATCH'\n  | 'E_MCP_INVALID_INPUT'\n  | 'E_MCP_HANDLER_ERROR'\n  | 'E_MCP_STDOUT_FENCE_VIOLATION'\n  | 'E_MCP_KEY_REQUIRED'\n  | 'E_MCP_ISSUE_FAILED'\n  | 'E_MCP_BUNDLE_FAILED'\n  | 'E_MCP_PATH_TRAVERSAL'\n  | 'E_MCP_BUNDLE_DIR_REQUIRED'\n  | 'E_MCP_CANCELLED';\n\nexport class McpServerError extends Error {\n  readonly code: McpServerErrorCode;\n\n  constructor(code: McpServerErrorCode, message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'McpServerError';\n    this.code = code;\n  }\n}\n\nexport class KeyLoadError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_KEY_LOAD', message, options);\n    this.name = 'KeyLoadError';\n  }\n}\n\nexport class PolicyLoadError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_POLICY_LOAD', message, options);\n    this.name = 'PolicyLoadError';\n  }\n}\n\nexport class JwksLoadError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_JWKS_LOAD', message, options);\n    this.name = 'JwksLoadError';\n  }\n}\n\nexport class IssueToolError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_ISSUE_FAILED', message, options);\n    this.name = 'IssueToolError';\n  }\n}\n\nexport class BundleToolError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_BUNDLE_FAILED', message, options);\n    this.name = 'BundleToolError';\n  }\n}\n\nexport class PathTraversalError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_PATH_TRAVERSAL', message, options);\n    this.name = 'PathTraversalError';\n  }\n}\n\n/**\n * Strip key-like material from output strings (Trust Gate 1 helper).\n *\n * Replaces matches of each pattern with `[REDACTED]`.\n */\nexport function sanitizeOutput(text: string, sensitivePatterns: RegExp[]): string {\n  let result = text;\n  for (const pattern of sensitivePatterns) {\n    result = result.replace(pattern, '[REDACTED]');\n  }\n  return result;\n}\n","/**\n * Static policy loader (load once, hash, never reload)\n */\n\nimport { readFile, stat } from 'node:fs/promises';\nimport { z } from 'zod';\nimport { sha256Hex } from '@peac/crypto';\nimport { PolicyLoadError } from './errors.js';\n\nconst ToolPolicySchema = z.object({\n  enabled: z.boolean().default(true),\n  allowed_kinds: z.array(z.string()).optional(),\n});\n\nconst RedactionSchema = z.object({\n  strip_evidence: z.boolean().default(false),\n  strip_payment: z.boolean().default(false),\n  inspect_full_claims: z.boolean().default(false),\n});\n\nconst LimitsSchema = z.object({\n  max_jws_bytes: z.number().int().positive().default(16_384),\n  max_response_bytes: z.number().int().positive().default(65_536),\n  tool_timeout_ms: z.number().int().positive().default(30_000),\n  max_concurrency: z.number().int().positive().default(10),\n  max_claims_bytes: z.number().int().positive().default(262_144),\n  max_bundle_receipts: z.number().int().positive().default(256),\n  max_bundle_bytes: z.number().int().positive().default(16_777_216),\n  max_ttl_seconds: z.number().int().positive().default(86_400),\n});\n\n// JWKS config: file-only. URL fetch is not implemented (SSRF surface).\n// When allow_network + URL fetch is added, gate it behind allow_network\n// with strict allowlist, timeouts, max-size, and no-redirect policy.\nconst JwksConfigSchema = z.object({\n  file: z.string().optional(),\n});\n\nexport const PolicySchema = z.object({\n  version: z.literal('1'),\n  allow_network: z.boolean().default(false),\n  redaction: RedactionSchema.prefault({}),\n  tools: z.record(z.string(), ToolPolicySchema).prefault({}),\n  limits: LimitsSchema.prefault({}),\n  jwks: JwksConfigSchema.optional(),\n});\n\nexport type PolicyConfig = z.infer<typeof PolicySchema>;\n\nconst DEFAULT_POLICY: PolicyConfig = {\n  version: '1',\n  allow_network: false,\n  redaction: { strip_evidence: false, strip_payment: false, inspect_full_claims: false },\n  tools: {},\n  limits: {\n    max_jws_bytes: 16_384,\n    max_response_bytes: 65_536,\n    tool_timeout_ms: 30_000,\n    max_concurrency: 10,\n    max_claims_bytes: 262_144,\n    max_bundle_receipts: 256,\n    max_bundle_bytes: 16_777_216,\n    max_ttl_seconds: 86_400,\n  },\n};\n\nexport function getDefaultPolicy(): PolicyConfig {\n  return structuredClone(DEFAULT_POLICY);\n}\n\n/**\n * Deep stable stringify: recursively sorts all object keys at every level\n * so semantically identical policies always produce the same hash regardless\n * of insertion order. Arrays preserve element order (order-significant).\n */\nfunction deepStableStringify(value: unknown): string {\n  if (value === null || typeof value !== 'object') {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return '[' + value.map(deepStableStringify).join(',') + ']';\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const pairs = keys.map((k) => JSON.stringify(k) + ':' + deepStableStringify(obj[k]));\n  return '{' + pairs.join(',') + '}';\n}\n\n/**\n * Compute the policy hash from a canonical JSON representation.\n * Accepts either raw JSON string or a PolicyConfig object.\n * When given a PolicyConfig, uses deep stable stringify (recursive key sort)\n * so semantically identical policies always hash identically.\n */\nexport async function computePolicyHash(input: string | PolicyConfig): Promise<string> {\n  const canonical = typeof input === 'string' ? input : deepStableStringify(input);\n  return sha256Hex(canonical);\n}\n\nexport async function loadPolicy(\n  filePath: string\n): Promise<{ policy: PolicyConfig; hash: string }> {\n  let raw: string;\n  try {\n    raw = await readFile(filePath, 'utf-8');\n  } catch (err) {\n    throw new PolicyLoadError(\n      `Failed to read policy file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n      { cause: err }\n    );\n  }\n\n  // Warn on world-writable permissions (0o002)\n  try {\n    const s = await stat(filePath);\n    if (s.mode & 0o002) {\n      process.stderr.write(\n        `[peac-mcp-server] WARNING: Policy file ${filePath} is world-writable\\n`\n      );\n    }\n  } catch {\n    // stat failure is non-fatal\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new PolicyLoadError(`Policy file is not valid JSON: ${filePath}`, { cause: err });\n  }\n\n  const result = PolicySchema.safeParse(parsed);\n  if (!result.success) {\n    const issues = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ');\n    throw new PolicyLoadError(`Policy validation failed: ${issues}`);\n  }\n\n  // Hash the materialized policy (after Zod defaults applied) for determinism\n  const hash = await computePolicyHash(result.data);\n  return { policy: result.data, hash };\n}\n","/**\n * Issuer key loader (no ambient key discovery)\n *\n * Supports `env:VAR_NAME` and `file:/path` schemes.\n * Reads JWK JSON, validates Ed25519, derives public key.\n * NEVER logs key bytes.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport {\n  base64urlDecode,\n  base64urlEncode,\n  derivePublicKey,\n  validateKeypair,\n  sha256Hex,\n} from '@peac/crypto';\nimport type { Ed25519PrivateJwk } from '@peac/crypto';\nimport { KeyLoadError } from './errors.js';\n\nexport interface LoadedKey {\n  privateKey: Uint8Array;\n  publicKey: Uint8Array;\n  kid: string;\n}\n\nexport async function loadIssuerKey(schemeUri: string): Promise<LoadedKey> {\n  let raw: string;\n\n  if (schemeUri.startsWith('env:')) {\n    const varName = schemeUri.slice(4);\n    const envValue = process.env[varName];\n    if (!envValue) {\n      throw new KeyLoadError(`Environment variable ${varName} is not set or empty`);\n    }\n    raw = envValue;\n  } else if (schemeUri.startsWith('file:')) {\n    const filePath = schemeUri.slice(5);\n    try {\n      raw = await readFile(filePath, 'utf-8');\n    } catch (err) {\n      throw new KeyLoadError(\n        `Failed to read key file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n        { cause: err }\n      );\n    }\n  } else {\n    throw new KeyLoadError(\n      `Unsupported key scheme: ${schemeUri} (expected env:VAR_NAME or file:/path)`\n    );\n  }\n\n  let jwk: unknown;\n  try {\n    jwk = JSON.parse(raw);\n  } catch (err) {\n    throw new KeyLoadError('Key data is not valid JSON', { cause: err });\n  }\n\n  // Validate JWK structure\n  if (\n    typeof jwk !== 'object' ||\n    jwk === null ||\n    !('kty' in jwk) ||\n    !('crv' in jwk) ||\n    !('d' in jwk)\n  ) {\n    throw new KeyLoadError('JWK must contain kty, crv, and d fields');\n  }\n\n  const j = jwk as Record<string, unknown>;\n  if (j.kty !== 'OKP' || j.crv !== 'Ed25519') {\n    throw new KeyLoadError(\n      `JWK must be Ed25519 (kty: OKP, crv: Ed25519), got kty=${String(j.kty)} crv=${String(j.crv)}`\n    );\n  }\n\n  if (typeof j.d !== 'string' || typeof j.x !== 'string') {\n    throw new KeyLoadError('JWK d and x fields must be base64url strings');\n  }\n\n  const ed25519Jwk: Ed25519PrivateJwk = {\n    kty: 'OKP',\n    crv: 'Ed25519',\n    x: j.x as string,\n    d: j.d as string,\n  };\n\n  // Validate keypair consistency\n  const valid = await validateKeypair(ed25519Jwk);\n  if (!valid) {\n    throw new KeyLoadError('JWK keypair validation failed: d does not derive to x');\n  }\n\n  const privateKey = base64urlDecode(ed25519Jwk.d);\n  const publicKey = await derivePublicKey(privateKey);\n\n  // Extract kid. Falls back to a deterministic derivation from the public key\n  // (truncated SHA-256 of base64url-encoded public key) so runs are reproducible.\n  let kid: string;\n  if (typeof j.kid === 'string') {\n    kid = j.kid;\n  } else {\n    const pubB64 = base64urlEncode(publicKey);\n    const hash = await sha256Hex(pubB64);\n    kid = hash.slice(0, 16);\n  }\n\n  return { privateKey, publicKey, kid };\n}\n","/**\n * JWKS file loader for verifier-side key resolution\n *\n * Loads a local JWKS JSON file, filters for Ed25519 keys,\n * and provides kid-based lookup.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { base64urlDecode } from '@peac/crypto';\nimport { JwksLoadError } from './errors.js';\n\nexport interface JwksKeyEntry {\n  kid: string;\n  publicKey: Uint8Array;\n}\n\nexport async function loadJwksFile(filePath: string): Promise<JwksKeyEntry[]> {\n  let raw: string;\n  try {\n    raw = await readFile(filePath, 'utf-8');\n  } catch (err) {\n    throw new JwksLoadError(\n      `Failed to read JWKS file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n      { cause: err }\n    );\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new JwksLoadError(`JWKS file is not valid JSON: ${filePath}`, { cause: err });\n  }\n\n  if (typeof parsed !== 'object' || parsed === null || !('keys' in parsed)) {\n    throw new JwksLoadError('JWKS must contain a \"keys\" array');\n  }\n\n  const jwks = parsed as { keys: unknown[] };\n  if (!Array.isArray(jwks.keys)) {\n    throw new JwksLoadError('JWKS \"keys\" must be an array');\n  }\n\n  const entries: JwksKeyEntry[] = [];\n  for (const key of jwks.keys) {\n    if (typeof key !== 'object' || key === null) continue;\n    const k = key as Record<string, unknown>;\n\n    // Filter for Ed25519 only (reject non-EdDSA alg values)\n    if (k.kty !== 'OKP' || k.crv !== 'Ed25519') continue;\n    if (typeof k.x !== 'string') continue;\n    if (k.alg !== undefined && k.alg !== 'EdDSA') continue;\n\n    const kid = typeof k.kid === 'string' ? k.kid : `key-${entries.length}`;\n    try {\n      const publicKey = base64urlDecode(k.x);\n      if (publicKey.length === 32) {\n        entries.push({ kid, publicKey });\n      }\n    } catch {\n      // Skip keys with invalid base64url encoding\n    }\n  }\n\n  return entries;\n}\n\nexport function resolveKeyByKid(keys: JwksKeyEntry[], kid: string): Uint8Array | undefined {\n  const entry = keys.find((k) => k.kid === kid);\n  return entry?.publicKey;\n}\n","/**\n * Stdout fence (line-buffered JSON-RPC validator)\n *\n * Monkey-patches process.stdout.write at startup.\n * Buffers bytes, splits on newline, validates each complete line\n * as JSON-RPC 2.0. Invalid lines cause a fail-fast throw.\n *\n * Returns a teardown function that restores the original write.\n */\n\nimport { McpServerError } from './infra/errors.js';\n\ntype WriteCallback = (err?: Error | null) => void;\n\n// 4 MB max line/buffer length -- prevents memory exhaustion from\n// unbounded writes without newlines or a single huge JSON-RPC message\nconst MAX_LINE_BYTES = 4 * 1024 * 1024;\n\nexport function installStdoutFence(): () => void {\n  const originalWrite = process.stdout.write.bind(process.stdout);\n  let buffer = '';\n  let bufferBytes = 0;\n\n  function validateJsonRpcLine(line: string): void {\n    // Guard: reject lines that exceed the byte budget before attempting JSON.parse\n    const lineBytes = new TextEncoder().encode(line).length;\n    if (lineBytes > MAX_LINE_BYTES) {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: line is ${lineBytes} bytes, exceeding limit of ${MAX_LINE_BYTES}`\n      );\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(line);\n    } catch {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: non-JSON line detected: ${line.slice(0, 100)}`\n      );\n    }\n\n    if (typeof parsed !== 'object' || parsed === null) {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n      );\n    }\n\n    const obj = parsed as Record<string, unknown>;\n\n    if (obj.jsonrpc !== '2.0') {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n      );\n    }\n\n    // Require valid JSON-RPC 2.0 response shape: id + (result or error),\n    // or a notification (method without id). Reject anything else.\n    const hasId = 'id' in obj;\n    const hasResult = 'result' in obj;\n    const hasError = 'error' in obj;\n    const hasMethod = 'method' in obj;\n\n    if (hasId && (hasResult || hasError)) {\n      // Valid response\n      return;\n    }\n    if (hasMethod && !hasId) {\n      // Valid notification (server -> client, e.g. notifications/*)\n      return;\n    }\n\n    throw new McpServerError(\n      'E_MCP_STDOUT_FENCE_VIOLATION',\n      `Stdout fence: malformed JSON-RPC 2.0 message (expected response or notification): ${line.slice(0, 100)}`\n    );\n  }\n\n  function processBuffer(): void {\n    const lines = buffer.split('\\n');\n    // Keep the last segment (incomplete line or empty string after trailing newline)\n    buffer = lines.pop()!;\n    bufferBytes = new TextEncoder().encode(buffer).length;\n\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (trimmed.length === 0) continue; // skip blank lines\n      validateJsonRpcLine(trimmed);\n    }\n  }\n\n  const patchedWrite = function (\n    chunk: string | Uint8Array,\n    encodingOrCallback?: BufferEncoding | WriteCallback,\n    callback?: WriteCallback\n  ): boolean {\n    // Normalize arguments\n    let encoding: BufferEncoding | undefined;\n    let cb: WriteCallback | undefined;\n\n    if (typeof encodingOrCallback === 'function') {\n      cb = encodingOrCallback;\n    } else {\n      encoding = encodingOrCallback;\n      cb = callback;\n    }\n\n    // Convert chunk to string\n    const str = typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk);\n\n    // Cap buffer growth before appending -- prevents memory exhaustion from\n    // writes that never include a newline (e.g. broken serializer)\n    const chunkBytes = new TextEncoder().encode(str).length;\n    if (bufferBytes + chunkBytes > MAX_LINE_BYTES) {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: buffer exceeded ${MAX_LINE_BYTES} bytes without a newline`\n      );\n    }\n\n    buffer += str;\n    bufferBytes += chunkBytes;\n    processBuffer();\n\n    // Forward to original write\n    if (encoding) {\n      return originalWrite(chunk, encoding, cb);\n    }\n    return originalWrite(chunk, cb as WriteCallback);\n  };\n\n  process.stdout.write = patchedWrite as typeof process.stdout.write;\n\n  // Teardown: flush remaining buffer, restore original\n  return function teardown(): void {\n    // Validate any remaining buffered content\n    if (buffer.trim().length > 0) {\n      validateJsonRpcLine(buffer.trim());\n    }\n    buffer = '';\n    bufferBytes = 0;\n    process.stdout.write = originalWrite;\n  };\n}\n","/**\n * MCP Server binding -- the only module that registers tools with @modelcontextprotocol/sdk\n *\n * Registers pure tool handlers with the MCP server.\n * Injects _meta audit block into every response.\n */\n\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { CallToolResult, ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport { ERRORS } from '@peac/kernel';\nimport { SERVER_NAME } from './infra/constants.js';\nimport type { PolicyConfig } from './infra/policy.js';\nimport type { ServerContext, HandlerResult } from './handlers/types.js';\nimport { handleVerify } from './handlers/verify.js';\nimport { handleInspect } from './handlers/inspect.js';\nimport { handleDecode } from './handlers/decode.js';\nimport { handleIssue } from './handlers/issue.js';\nimport { handleCreateBundle } from './handlers/bundle.js';\nimport { checkInputSizes, checkObjectDepth, measureEnvelopeBytes } from './handlers/guards.js';\nimport type { VerifyInput } from './schemas/verify.js';\nimport type { InspectInput } from './schemas/inspect.js';\nimport type { DecodeInput } from './schemas/decode.js';\nimport type { IssueInput } from './schemas/issue.js';\nimport type { BundleInput } from './schemas/bundle.js';\nimport { VerifyInputSchema, VerifyOutputSchema } from './schemas/verify.js';\nimport { InspectInputSchema, InspectOutputSchema } from './schemas/inspect.js';\nimport { DecodeInputSchema, DecodeOutputSchema } from './schemas/decode.js';\nimport { IssueInputSchema, IssueOutputSchema } from './schemas/issue.js';\nimport { BundleInputSchema, BundleOutputSchema } from './schemas/bundle.js';\n\nexport interface ServerOptions {\n  version: string;\n  policy: PolicyConfig;\n  policyHash: string;\n  protocolVersion: string;\n  context: ServerContext;\n}\n\nfunction makeMeta(ctx: ServerContext, serverName: string): Record<string, unknown> {\n  return {\n    serverName,\n    serverVersion: ctx.version,\n    policyHash: ctx.policyHash,\n    protocolVersion: ctx.protocolVersion,\n    wireFormatVersion: '0.2',\n  };\n}\n\nfunction handlerResultToCallToolResult(\n  result: HandlerResult,\n  meta: Record<string, unknown>\n): CallToolResult {\n  return {\n    content: [{ type: 'text' as const, text: result.text }],\n    structuredContent: { _meta: meta, ...result.structured },\n    isError: result.isError,\n  };\n}\n\nconst PURE_TOOL_ANNOTATIONS: ToolAnnotations = {\n  readOnlyHint: true,\n  destructiveHint: false,\n  idempotentHint: true,\n  openWorldHint: false,\n};\n\n// peac_issue: pure in-memory signing, no filesystem or network side-effects.\n// readOnlyHint: true -- produces a JWS string, does not mutate state.\n// idempotentHint: false -- each call includes a fresh `iat` timestamp.\n// openWorldHint: false -- closed world; no external I/O or filesystem access.\nconst ISSUE_TOOL_ANNOTATIONS: ToolAnnotations = {\n  readOnlyHint: true,\n  destructiveHint: false,\n  idempotentHint: false,\n  openWorldHint: false,\n};\n\nconst BUNDLE_TOOL_ANNOTATIONS: ToolAnnotations = {\n  readOnlyHint: false,\n  destructiveHint: true,\n  idempotentHint: false,\n  openWorldHint: true,\n};\n\nconst MAX_INPUT_DEPTH = 10;\n\n// Largest legitimate input: a 256-receipt bundle call (259 elements); the rest is headroom.\nconst MAX_TOOL_INPUT_ELEMENTS = 1024;\n\nfunction errorCallToolResult(\n  meta: Record<string, unknown>,\n  code: string,\n  message: string\n): CallToolResult {\n  const errorDef = ERRORS[code];\n  return {\n    content: [{ type: 'text' as const, text: message }],\n    structuredContent: {\n      _meta: meta,\n      ok: false,\n      code,\n      message,\n      retryable: errorDef?.retryable ?? false,\n      next_action: errorDef?.next_action ?? 'none',\n    },\n    isError: true,\n  };\n}\n\n/**\n * Narrowed type for McpServer.registerTool that avoids TS2589\n * deep instantiation errors from cross-version Zod generics.\n *\n * The MCP SDK and our workspace may pin different Zod versions.\n * Zod schema objects are structurally identical at runtime (the SDK\n * duck-types via _def presence check), but TypeScript cannot resolve\n * the deep generic chain across version boundaries.\n *\n * This type accurately describes the runtime contract: inputSchema\n * accepts any object with Zod-like structure (which our schemas are).\n * See package.json for actual pinned versions.\n */\ntype RegisterToolBridge = (\n  name: string,\n  config: {\n    title?: string;\n    description?: string;\n    inputSchema?: unknown;\n    outputSchema?: unknown;\n    annotations?: ToolAnnotations;\n  },\n  cb: (args: Record<string, unknown>, extra: Record<string, unknown>) => Promise<CallToolResult>\n) => unknown;\n\nexport function createPeacMcpServer(options: ServerOptions): McpServer {\n  const { version, policy, context } = options;\n\n  // Compute registered tool list upfront for capability discovery\n  const registeredTools = ['peac_verify', 'peac_inspect', 'peac_decode'];\n  if (context.issuerKey && context.issuerId) {\n    registeredTools.push('peac_issue');\n    if (context.bundleDir) {\n      registeredTools.push('peac_create_bundle');\n    }\n  }\n\n  const meta = { ...makeMeta(context, SERVER_NAME), registeredTools };\n  const maxConcurrency = policy.limits.max_concurrency;\n  let activeHandlers = 0;\n\n  async function wrapHandler(\n    toolName: string,\n    args: Record<string, unknown>,\n    handlerFn: (signal?: AbortSignal) => Promise<HandlerResult>,\n    signal?: AbortSignal\n  ): Promise<CallToolResult> {\n    // Cancellation: if already aborted before we start, return immediately\n    if (signal?.aborted) {\n      return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n    }\n\n    // Concurrency guard\n    if (activeHandlers >= maxConcurrency) {\n      return errorCallToolResult(\n        meta,\n        'E_MCP_CONCURRENCY_LIMIT',\n        `Server at capacity (${maxConcurrency} concurrent handlers)`\n      );\n    }\n\n    // Input depth guard\n    if (!checkObjectDepth(args, MAX_INPUT_DEPTH)) {\n      return errorCallToolResult(\n        meta,\n        'E_MCP_INPUT_TOO_DEEP',\n        `Input exceeds maximum nesting depth of ${MAX_INPUT_DEPTH}`\n      );\n    }\n\n    // Input size guard (recursive sum of all string bytes)\n    const inputSizeResult = checkInputSizes(args, policy);\n    if (inputSizeResult) {\n      return handlerResultToCallToolResult(inputSizeResult, meta);\n    }\n\n    // Reserve concurrency slot. Released when the handler settles (not when\n    // timeout fires), so inflight CPU work stays bounded by maxConcurrency.\n    // The slot release is detached -- wrapHandler returns the timeout error\n    // immediately without waiting for the handler to finish.\n    //\n    // IMPORTANT: If a handler promise never settles, the concurrency slot is\n    // permanently leaked. This is by design -- Node.js cannot forcibly cancel\n    // arbitrary user code. All built-in handlers (verify, inspect, decode) are\n    // pure synchronous-ish operations that will always settle. Future handlers\n    // with network I/O should accept AbortSignal and honor cancellation.\n    // If leaked slots become an operational concern, add a watchdog that logs\n    // when a handler exceeds 2x tool_timeout_ms without settling.\n    activeHandlers++;\n    const handlerPromise = handlerFn(signal);\n\n    // Detached slot release: fires when handler settles, regardless of timeout.\n    // The void + catch ensure no unhandled rejection if handler throws.\n    void handlerPromise\n      .finally(() => {\n        activeHandlers--;\n      })\n      .catch(() => {});\n\n    // Timeout + cancellation race -- handlerPromise keeps running even if\n    // timeout or cancellation fires. Timer is cleared when the handler\n    // resolves to avoid unnecessary timers accumulating under load.\n    let timedOut = false;\n    let cancelled = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const timeoutPromise = new Promise<never>((_resolve, reject) => {\n      timer = setTimeout(() => {\n        timedOut = true;\n        reject(new Error(`Tool \"${toolName}\" timed out after ${policy.limits.tool_timeout_ms}ms`));\n      }, policy.limits.tool_timeout_ms);\n      // Prevent timeout timer from keeping Node.js alive during shutdown\n      timer.unref?.();\n    });\n\n    // Build race participants: handler vs timeout vs (optional) cancellation\n    const raceParticipants: Promise<HandlerResult>[] = [handlerPromise, timeoutPromise];\n\n    let abortCleanup: (() => void) | undefined;\n    if (signal && !signal.aborted) {\n      const cancelPromise = new Promise<never>((_resolve, reject) => {\n        const onAbort = () => {\n          cancelled = true;\n          reject(new Error('Request cancelled'));\n        };\n        signal.addEventListener('abort', onAbort, { once: true });\n        abortCleanup = () => signal.removeEventListener('abort', onAbort);\n      });\n      raceParticipants.push(cancelPromise);\n    }\n\n    try {\n      const result = await Promise.race(raceParticipants);\n\n      // Output size cap -- measure the full JSON-RPC envelope that will be\n      // serialized to stdout, not just the tool result. This is the actual\n      // risk surface for downstream clients parsing the response line.\n      // Uses conservative UUID-length id placeholder (default) since the\n      // MCP SDK doesn't expose the request id to tool handlers.\n      const callResult = handlerResultToCallToolResult(result, meta);\n      const outputBytes = measureEnvelopeBytes(callResult);\n      if (outputBytes > policy.limits.max_response_bytes) {\n        return errorCallToolResult(\n          meta,\n          'E_MCP_OUTPUT_TOO_LARGE',\n          `Response is ${outputBytes} bytes, exceeding limit of ${policy.limits.max_response_bytes}`\n        );\n      }\n\n      return callResult;\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      if (cancelled) {\n        return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n      }\n      if (timedOut) {\n        return errorCallToolResult(meta, 'E_MCP_TOOL_TIMEOUT', message);\n      }\n      return errorCallToolResult(meta, 'E_MCP_INTERNAL', message);\n    } finally {\n      clearTimeout(timer);\n      abortCleanup?.();\n    }\n  }\n\n  const server = new McpServer(\n    { name: SERVER_NAME, version },\n    // listChanged: false -- tool set is static per server instance (determined\n    // at startup from CLI flags). The server never emits notifications/tools/list_changed.\n    {\n      capabilities: { tools: { listChanged: false } },\n      maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS,\n    }\n  );\n\n  // Bind with narrowed types to bridge workspace Zod <-> SDK Zod boundary\n  const register = server.registerTool.bind(server) as RegisterToolBridge;\n\n  // -- peac_verify --\n  register(\n    'peac_verify',\n    {\n      title: 'Verify PEAC Receipt',\n      description:\n        'Verify a PEAC receipt: check Ed25519 signature, validate claims, and return structured check results. Read-only, no side effects.',\n      inputSchema: VerifyInputSchema,\n      outputSchema: VerifyOutputSchema,\n      annotations: PURE_TOOL_ANNOTATIONS,\n    },\n    async (args, extra) =>\n      wrapHandler(\n        'peac_verify',\n        args,\n        (signal) => handleVerify({ input: args as VerifyInput, policy, context, signal }),\n        (extra as { signal?: AbortSignal }).signal\n      )\n  );\n\n  // -- peac_inspect --\n  register(\n    'peac_inspect',\n    {\n      title: 'Inspect PEAC Receipt',\n      description:\n        'Inspect a PEAC receipt without verifying the signature. Returns decoded header, payload metadata, and timestamps. Read-only.',\n      inputSchema: InspectInputSchema,\n      outputSchema: InspectOutputSchema,\n      annotations: PURE_TOOL_ANNOTATIONS,\n    },\n    async (args, extra) =>\n      wrapHandler(\n        'peac_inspect',\n        args,\n        (signal) => handleInspect({ input: args as InspectInput, policy, context, signal }),\n        (extra as { signal?: AbortSignal }).signal\n      )\n  );\n\n  // -- peac_decode --\n  register(\n    'peac_decode',\n    {\n      title: 'Decode PEAC Receipt',\n      description:\n        'Raw-decode a PEAC receipt JWS into header and payload objects. No signature check. Use peac_verify for trusted results.',\n      inputSchema: DecodeInputSchema,\n      outputSchema: DecodeOutputSchema,\n      annotations: PURE_TOOL_ANNOTATIONS,\n    },\n    async (args, extra) =>\n      wrapHandler(\n        'peac_decode',\n        args,\n        (signal) => handleDecode({ input: args as DecodeInput, policy, context, signal }),\n        (extra as { signal?: AbortSignal }).signal\n      )\n  );\n\n  // -- Privileged tools (conditionally registered) --\n\n  // peac_issue: requires issuerKey + issuerId\n  if (context.issuerKey && context.issuerId) {\n    register(\n      'peac_issue',\n      {\n        title: 'Issue Wire 0.2 PEAC Receipt',\n        description:\n          'Sign and return a Wire 0.2 PEAC receipt JWS. Accepts kind, type, pillars, extensions, and policy fields. Wire 0.2 only: Wire 0.1 fields are not accepted. Requires server configured with an Ed25519 issuer key (--issuer-key and --issuer-id).',\n        inputSchema: IssueInputSchema,\n        outputSchema: IssueOutputSchema,\n        annotations: ISSUE_TOOL_ANNOTATIONS,\n      },\n      async (args, extra) =>\n        wrapHandler(\n          'peac_issue',\n          args,\n          (signal) => handleIssue({ input: args as IssueInput, policy, context, signal }),\n          (extra as { signal?: AbortSignal }).signal\n        )\n    );\n\n    // peac_create_bundle: additionally requires bundleDir\n    if (context.bundleDir) {\n      register(\n        'peac_create_bundle',\n        {\n          title: 'Create Evidence Bundle',\n          description:\n            'Create a signed evidence bundle directory from one or more receipt JWS strings. Writes files to disk. Requires --issuer-key, --issuer-id, and --bundle-dir.',\n          inputSchema: BundleInputSchema,\n          outputSchema: BundleOutputSchema,\n          annotations: BUNDLE_TOOL_ANNOTATIONS,\n        },\n        async (args, extra) =>\n          wrapHandler(\n            'peac_create_bundle',\n            args,\n            (signal) => handleCreateBundle({ input: args as BundleInput, policy, context, signal }),\n            (extra as { signal?: AbortSignal }).signal\n          )\n      );\n    }\n  }\n\n  return server;\n}\n\nexport { McpServer };\n","/**\n * Handler guards -- enforces policy limits and tool enablement\n *\n * ZERO MCP SDK imports.\n */\n\nimport type { PolicyConfig } from '../infra/policy.js';\nimport type { HandlerResult } from './types.js';\n\n/**\n * Check if the JWS input exceeds the configured max size.\n * Returns an error result if too large, undefined if OK.\n */\nexport function checkJwsSize(jws: string, policy: PolicyConfig): HandlerResult | undefined {\n  const byteLength = new TextEncoder().encode(jws).length;\n  if (byteLength > policy.limits.max_jws_bytes) {\n    return {\n      text: `Input rejected: JWS is ${byteLength} bytes, exceeding limit of ${policy.limits.max_jws_bytes} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `JWS input is ${byteLength} bytes, limit is ${policy.limits.max_jws_bytes}`,\n      },\n      isError: true,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Check if the tool is enabled in policy.\n * Returns an error result if disabled, undefined if OK.\n */\nexport function checkToolEnabled(\n  toolName: string,\n  policy: PolicyConfig\n): HandlerResult | undefined {\n  const toolConfig = policy.tools[toolName];\n  if (toolConfig && toolConfig.enabled === false) {\n    return {\n      text: `Tool \"${toolName}\" is disabled by server policy`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_TOOL_DISABLED',\n        message: `Tool \"${toolName}\" is disabled by server policy`,\n      },\n      isError: true,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Recursively sum byte lengths of all string values in an object graph.\n * Depth is bounded by checkObjectDepth (called first in wrapHandler).\n * Uses a WeakSet to guard against cyclic references.\n */\nfunction sumStringBytes(value: unknown, seen?: WeakSet<object>): number {\n  if (typeof value === 'string') {\n    return new TextEncoder().encode(value).length;\n  }\n  if (typeof value !== 'object' || value === null) return 0;\n\n  // Cycle guard: skip objects we've already visited\n  const visited = seen ?? new WeakSet<object>();\n  if (visited.has(value as object)) return 0;\n  visited.add(value as object);\n\n  if (Array.isArray(value)) {\n    let total = 0;\n    for (const item of value) {\n      total += sumStringBytes(item, visited);\n    }\n    return total;\n  }\n  let total = 0;\n  for (const v of Object.values(value as Record<string, unknown>)) {\n    total += sumStringBytes(v, visited);\n  }\n  return total;\n}\n\n/**\n * Bounded serialized-size estimator. Walks the object graph and estimates\n * JSON serialized bytes WITHOUT materializing the full string. Aborts early\n * when the estimate exceeds the limit (returns Infinity). This prevents\n * memory exhaustion from adversarial inputs with many small non-string values\n * (e.g. large arrays of numbers) that would bypass string-only counting.\n *\n * Accuracy: conservative overestimate for numbers (uses String(n).length),\n * exact for strings (JSON.stringify escapes), exact for structural overhead.\n * Uses a WeakSet cycle guard consistent with sumStringBytes.\n */\nfunction estimateSerializedBytes(value: unknown, limit: number, seen?: WeakSet<object>): number {\n  if (value === null) return 4; // \"null\"\n  if (value === undefined) return 0; // omitted in JSON\n  if (typeof value === 'boolean') return value ? 4 : 5; // \"true\" / \"false\"\n  if (typeof value === 'number') return String(value).length;\n  if (typeof value === 'string') return Buffer.byteLength(JSON.stringify(value), 'utf8');\n\n  if (typeof value !== 'object') return 0;\n\n  const visited = seen ?? new WeakSet<object>();\n  if (visited.has(value as object)) return 0;\n  visited.add(value as object);\n\n  let total = 2; // {} or []\n\n  if (Array.isArray(value)) {\n    for (let i = 0; i < value.length; i++) {\n      if (i > 0) total += 1; // comma\n      total += estimateSerializedBytes(value[i], limit, visited);\n      if (total > limit) return Infinity; // early exit\n    }\n    return total;\n  }\n\n  const entries = Object.entries(value as Record<string, unknown>);\n  for (let i = 0; i < entries.length; i++) {\n    if (i > 0) total += 1; // comma\n    const [k, v] = entries[i];\n    total += Buffer.byteLength(JSON.stringify(k), 'utf8') + 1; // key + colon\n    total += estimateSerializedBytes(v, limit, visited);\n    if (total > limit) return Infinity; // early exit\n  }\n  return total;\n}\n\n/**\n * Check total input size across all string fields (recursive).\n * Prevents memory exhaustion from oversized jwks, public_key_base64url, etc.\n * Traverses the full object graph so nested payloads cannot bypass the limit.\n * Uses 2x max_jws_bytes as the total budget.\n *\n * Also applies a bounded serialized-size estimate (without materializing\n * the full JSON string) to catch large non-string structures like arrays\n * of numbers that bypass string-only counting.\n */\nexport function checkInputSizes(\n  input: Record<string, unknown>,\n  policy: PolicyConfig\n): HandlerResult | undefined {\n  const limit = policy.limits.max_jws_bytes * 2;\n\n  // Primary check: recursive string byte sum\n  const totalBytes = sumStringBytes(input);\n  if (totalBytes > limit) {\n    return {\n      text: `Input rejected: total input is ${totalBytes} bytes, exceeding limit of ${limit} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Total input is ${totalBytes} bytes, limit is ${limit}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Fallback: bounded serialized-size estimate catches large non-string structures\n  // without materializing the full JSON string (prevents allocation attacks)\n  const estimatedBytes = estimateSerializedBytes(input, limit);\n  if (estimatedBytes > limit) {\n    return {\n      text: `Input rejected: estimated serialized input exceeds limit of ${limit} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Estimated serialized input exceeds limit of ${limit} bytes`,\n      },\n      isError: true,\n    };\n  }\n\n  return undefined;\n}\n\n/**\n * Check that an object does not exceed maximum nesting depth.\n * Prevents stack overflow from deeply nested input params.\n */\nexport function checkObjectDepth(\n  obj: unknown,\n  maxDepth: number = 10,\n  currentDepth: number = 0\n): boolean {\n  if (currentDepth > maxDepth) return false;\n  if (typeof obj !== 'object' || obj === null) return true;\n  if (Array.isArray(obj)) {\n    return obj.every((item) => checkObjectDepth(item, maxDepth, currentDepth + 1));\n  }\n  return Object.values(obj as Record<string, unknown>).every((value) =>\n    checkObjectDepth(value, maxDepth, currentDepth + 1)\n  );\n}\n\n/**\n * Conservative placeholder id for envelope size estimation.\n * The MCP SDK does not expose the JSON-RPC request id to tool handlers,\n * so we budget for a typical UUID-length string id (36 chars + quotes = 38\n * bytes in JSON). This ensures the size cap is never underestimated due to\n * a longer-than-expected id from the client.\n */\nconst CONSERVATIVE_ID_PLACEHOLDER = '00000000-0000-0000-0000-000000000000';\n\n/**\n * Measure the byte length of a full JSON-RPC 2.0 response envelope.\n * This models the exact line that will be serialized to stdout by the\n * MCP SDK, including the request id and trailing newline.\n *\n * The +1 accounts for the line-feed delimiter that separates JSON-RPC\n * messages on the stdio transport.\n */\nexport function measureEnvelopeBytes(\n  callToolResult: {\n    content: unknown;\n    structuredContent?: unknown;\n    isError?: boolean;\n  },\n  id: string | number = CONSERVATIVE_ID_PLACEHOLDER\n): number {\n  const envelope = {\n    jsonrpc: '2.0',\n    id,\n    result: {\n      content: callToolResult.content,\n      structuredContent: callToolResult.structuredContent,\n      isError: callToolResult.isError,\n    },\n  };\n  return Buffer.byteLength(JSON.stringify(envelope), 'utf8') + 1; // +1 for \\n\n}\n\nexport interface TruncationResult {\n  text: string;\n  truncated: boolean;\n  originalBytes: number;\n  returnedBytes: number;\n}\n\nconst TRUNCATION_SUFFIX = '\\n\\n[TRUNCATED: response exceeded policy limit]';\nconst TRUNCATION_SUFFIX_BYTES = new TextEncoder().encode(TRUNCATION_SUFFIX).length;\n\n/**\n * Truncate response text to stay within max_response_bytes.\n * Guarantees the final byte length is <= maxBytes by computing the\n * suffix size exactly and slicing the body budget accordingly.\n * Returns truncation metadata for structured output signaling.\n */\nexport function truncateResponse(text: string, policy: PolicyConfig): TruncationResult {\n  const maxBytes = policy.limits.max_response_bytes;\n  const encoded = new TextEncoder().encode(text);\n  if (encoded.length <= maxBytes) {\n    return { text, truncated: false, originalBytes: encoded.length, returnedBytes: encoded.length };\n  }\n\n  // Budget for body = maxBytes - suffix bytes. If maxBytes is tiny,\n  // clamp to 0 so we still return the suffix as signal.\n  const bodyBudget = Math.max(0, maxBytes - TRUNCATION_SUFFIX_BYTES);\n  // Truncate at byte boundary, avoiding mid-character cuts via TextDecoder\n  const truncatedText = new TextDecoder().decode(encoded.slice(0, bodyBudget));\n  const finalText = truncatedText + TRUNCATION_SUFFIX;\n  const finalEncoded = new TextEncoder().encode(finalText);\n  return {\n    text: finalText,\n    truncated: true,\n    originalBytes: encoded.length,\n    returnedBytes: finalEncoded.length,\n  };\n}\n","/**\n * Verify handler -- ZERO MCP SDK imports\n *\n * Resolves key from input or context, delegates to verifyLocal.\n *\n * Append-only check name registry (stable contract):\n *   signature, schema, expiry, issuer_binding, audience_binding\n */\n\nimport { verifyLocal } from '@peac/protocol';\nimport { base64urlDecode, decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { VerifyInput } from '../schemas/verify.js';\nimport { resolveKeyByKid } from '../infra/jwks-loader.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nfunction resolvePublicKey(params: HandlerParams<VerifyInput>): {\n  publicKey: Uint8Array;\n  keySource: string;\n} {\n  const { input, context } = params;\n\n  // Priority 1: inline public key\n  if (input.public_key_base64url) {\n    return {\n      publicKey: base64urlDecode(input.public_key_base64url),\n      keySource: 'inline',\n    };\n  }\n\n  // Priority 2: inline JWKS\n  if (input.jwks) {\n    const jwks = JSON.parse(input.jwks) as { keys?: Array<Record<string, unknown>> };\n    if (!jwks.keys?.length) {\n      throw new Error('Provided JWKS contains no keys');\n    }\n\n    const { header } = decode(input.jws);\n    const kid = header.kid;\n\n    // Collect Ed25519 keys (reject non-EdDSA alg values)\n    const ed25519Keys = jwks.keys.filter(\n      (k) =>\n        k.kty === 'OKP' &&\n        k.crv === 'Ed25519' &&\n        typeof k.x === 'string' &&\n        (k.alg === undefined || k.alg === 'EdDSA')\n    );\n\n    if (ed25519Keys.length === 0) {\n      throw new Error('Provided JWKS contains no Ed25519 keys');\n    }\n\n    // If kid present, match by kid\n    if (kid) {\n      const matched = ed25519Keys.find((k) => k.kid === kid);\n      if (matched) {\n        return {\n          publicKey: base64urlDecode(matched.x as string),\n          keySource: 'inline-jwks',\n        };\n      }\n      throw Object.assign(\n        new Error(`No matching Ed25519 key found in provided JWKS for kid=\"${kid}\"`),\n        { errorCode: 'E_MCP_JWKS_NO_MATCH' as const }\n      );\n    }\n\n    // No kid: single-key fallback\n    if (ed25519Keys.length === 1) {\n      return {\n        publicKey: base64urlDecode(ed25519Keys[0].x as string),\n        keySource: 'inline-jwks',\n      };\n    }\n\n    throw Object.assign(\n      new Error(\n        `JWS has no kid and JWKS contains ${ed25519Keys.length} Ed25519 keys -- provide kid to select`\n      ),\n      { errorCode: 'E_MCP_KID_REQUIRED' as const }\n    );\n  }\n\n  // Priority 3: server-configured JWKS\n  if (context.jwksKeys?.length) {\n    const { header } = decode(input.jws);\n    const kid = header.kid;\n\n    if (kid) {\n      const key = resolveKeyByKid(context.jwksKeys, kid);\n      if (key) {\n        return { publicKey: key, keySource: 'server-jwks' };\n      }\n      throw Object.assign(new Error(`No matching key in server JWKS for kid=\"${kid}\"`), {\n        errorCode: 'E_MCP_JWKS_NO_MATCH' as const,\n      });\n    }\n\n    // No kid: single-key fallback\n    if (context.jwksKeys.length === 1) {\n      return { publicKey: context.jwksKeys[0].publicKey, keySource: 'server-jwks' };\n    }\n\n    throw Object.assign(\n      new Error(\n        `JWS has no kid and server JWKS contains ${context.jwksKeys.length} keys -- provide kid to select`\n      ),\n      { errorCode: 'E_MCP_KID_REQUIRED' as const }\n    );\n  }\n\n  throw Object.assign(\n    new Error(\n      'No public key available: provide public_key_base64url, jwks, or configure --jwks-file'\n    ),\n    { errorCode: 'E_MCP_KEY_RESOLUTION' as const }\n  );\n}\n\nexport async function handleVerify(params: HandlerParams<VerifyInput>): Promise<HandlerResult> {\n  const { input, policy } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_verify', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: JWS size limit\n  const sizeResult = checkJwsSize(input.jws, policy);\n  if (sizeResult) return sizeResult;\n\n  let publicKey: Uint8Array;\n  let keySource: string;\n  try {\n    const resolved = resolvePublicKey(params);\n    publicKey = resolved.publicKey;\n    keySource = resolved.keySource;\n  } catch (err) {\n    const code =\n      ((err as Record<string, unknown>).errorCode as string | undefined) ?? 'E_MCP_KEY_RESOLUTION';\n    return {\n      text: `Verification failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        ok: false,\n        code,\n        message: err instanceof Error ? err.message : String(err),\n        checks: [],\n      },\n      isError: true,\n    };\n  }\n\n  const result = await verifyLocal(input.jws, publicKey, {\n    issuer: input.issuer,\n    audience: input.audience,\n  });\n\n  if (result.valid) {\n    const checks = [\n      { name: 'signature', passed: true },\n      { name: 'schema', passed: true },\n      { name: 'expiry', passed: true },\n    ];\n\n    if (input.issuer) {\n      checks.push({ name: 'issuer_binding', passed: true });\n    }\n    if (input.audience) {\n      checks.push({ name: 'audience_binding', passed: true });\n    }\n\n    const claims = result.claims as Record<string, unknown>;\n    const claimsSummary: Record<string, unknown> = {\n      iss: claims.iss,\n      kind: claims.kind,\n      type: claims.type,\n      jti: claims.jti,\n      ...(claims.sub !== undefined && { sub: claims.sub }),\n      variant: result.variant,\n      wireVersion: result.wireVersion,\n    };\n\n    const tr = truncateResponse(\n      `Verification PASSED (${result.variant} receipt, kind=${claims.kind ?? 'unknown'}, kid=${result.kid})`,\n      policy\n    );\n    return {\n      text: tr.text,\n      structured: {\n        ok: true,\n        variant: result.variant,\n        checks,\n        claimsSummary,\n        keySource,\n        ...(tr.truncated\n          ? {\n              _truncation: {\n                truncated: tr.truncated,\n                originalBytes: tr.originalBytes,\n                returnedBytes: tr.returnedBytes,\n              },\n            }\n          : {}),\n      },\n    };\n  }\n\n  // Failure case\n  const checks: Array<{ name: string; passed: boolean; message?: string }> = [];\n  if (result.code === 'E_INVALID_SIGNATURE') {\n    checks.push({ name: 'signature', passed: false, message: result.message });\n  } else if (result.code === 'E_INVALID_FORMAT') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: false, message: result.message });\n  } else if (result.code === 'E_EXPIRED') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: true });\n    checks.push({ name: 'expiry', passed: false, message: result.message });\n  } else if (result.code === 'E_INVALID_ISSUER') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: true });\n    checks.push({ name: 'issuer_binding', passed: false, message: result.message });\n  } else if (result.code === 'E_INVALID_AUDIENCE') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: true });\n    checks.push({ name: 'audience_binding', passed: false, message: result.message });\n  } else {\n    checks.push({ name: result.code, passed: false, message: result.message });\n  }\n\n  const trFail = truncateResponse(\n    `Verification FAILED: ${result.code} -- ${result.message}`,\n    policy\n  );\n  return {\n    text: trFail.text,\n    structured: {\n      ok: false,\n      code: result.code,\n      message: result.message,\n      checks,\n      keySource,\n      ...(trFail.truncated\n        ? {\n            _truncation: {\n              truncated: trFail.truncated,\n              originalBytes: trFail.originalBytes,\n              returnedBytes: trFail.returnedBytes,\n            },\n          }\n        : {}),\n    },\n  };\n}\n","/**\n * Inspect handler -- ZERO MCP SDK imports\n *\n * Decodes JWS (without verifying) and extracts metadata.\n * Respects policy redaction settings.\n */\n\nimport { decode } from '@peac/crypto';\nimport { parseReceiptClaims } from '@peac/schema';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { InspectInput } from '../schemas/inspect.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleInspect(params: HandlerParams<InspectInput>): Promise<HandlerResult> {\n  const { input, policy } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_inspect', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: JWS size limit\n  const sizeResult = checkJwsSize(input.jws, policy);\n  if (sizeResult) return sizeResult;\n\n  let header: Record<string, unknown>;\n  let payload: Record<string, unknown>;\n  try {\n    const decoded = decode<Record<string, unknown>>(input.jws);\n    header = decoded.header as unknown as Record<string, unknown>;\n    payload = decoded.payload;\n  } catch (err) {\n    return {\n      text: `Inspect failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        error: err instanceof Error ? err.message : String(err),\n        code: 'E_MCP_INVALID_INPUT',\n      },\n      isError: true,\n    };\n  }\n\n  // Classify variant (don't throw on failure)\n  let variant = 'unknown';\n  try {\n    const pr = parseReceiptClaims(payload);\n    if (pr.ok) {\n      variant = pr.variant;\n    }\n  } catch {\n    // classification failure is non-fatal\n  }\n\n  const payloadMeta: Record<string, unknown> = {\n    variant,\n    issuer: payload.iss,\n    audience: payload.aud,\n  };\n\n  if (typeof payload.iat === 'number') {\n    payloadMeta.issuedAt = new Date(payload.iat * 1000).toISOString();\n  }\n  if (typeof payload.exp === 'number') {\n    payloadMeta.expiresAt = new Date(payload.exp * 1000).toISOString();\n  }\n  if (typeof payload.rid === 'string') {\n    payloadMeta.receiptId = payload.rid;\n  }\n\n  // Apply redaction\n  let redacted = false;\n  let fullPayload: Record<string, unknown> | undefined;\n\n  // Gate: full_claims only honored when policy permits (inspect_full_claims)\n  const effectiveFullClaims = input.full_claims && policy.redaction.inspect_full_claims;\n  if (effectiveFullClaims) {\n    fullPayload = { ...payload };\n\n    if (policy.redaction.strip_evidence && 'evidence' in fullPayload) {\n      fullPayload.evidence = '[REDACTED by policy]';\n      redacted = true;\n    }\n    if (policy.redaction.strip_payment && 'payment' in fullPayload) {\n      fullPayload.payment = '[REDACTED by policy]';\n      redacted = true;\n    }\n  }\n\n  const lines = [\n    'WARNING: Signature NOT verified (use peac_verify to verify)',\n    '',\n    `Variant: ${variant}`,\n    `Issuer: ${payload.iss ?? 'N/A'}`,\n    `Audience: ${payload.aud ?? 'N/A'}`,\n  ];\n\n  if (payloadMeta.issuedAt) lines.push(`Issued At: ${payloadMeta.issuedAt}`);\n  if (payloadMeta.expiresAt) lines.push(`Expires At: ${payloadMeta.expiresAt}`);\n  if (payloadMeta.receiptId) lines.push(`Receipt ID: ${payloadMeta.receiptId}`);\n  if (redacted) lines.push('', 'Note: Some fields redacted by policy');\n\n  const tr = truncateResponse(lines.join('\\n'), policy);\n  return {\n    text: tr.text,\n    structured: {\n      header,\n      payloadMeta,\n      ...(fullPayload !== undefined ? { fullPayload } : {}),\n      redacted,\n      verified: false,\n      ...(tr.truncated\n        ? {\n            _truncation: {\n              truncated: tr.truncated,\n              originalBytes: tr.originalBytes,\n              returnedBytes: tr.returnedBytes,\n            },\n          }\n        : {}),\n    },\n  };\n}\n","/**\n * Decode handler -- ZERO MCP SDK imports\n *\n * Raw JWS decode. Returns header and payload without verification.\n * Text output is bounded by policy limits.\n */\n\nimport { decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { DecodeInput } from '../schemas/decode.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleDecode(params: HandlerParams<DecodeInput>): Promise<HandlerResult> {\n  const { input, policy } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_decode', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: JWS size limit\n  const sizeResult = checkJwsSize(input.jws, policy);\n  if (sizeResult) return sizeResult;\n\n  try {\n    const decoded = decode<Record<string, unknown>>(input.jws);\n    const header = decoded.header as unknown as Record<string, unknown>;\n    const payload = decoded.payload;\n\n    const tr = truncateResponse(\n      [\n        'WARNING: Signature NOT verified',\n        '',\n        `Header: ${JSON.stringify(header, null, 2)}`,\n        '',\n        `Payload: ${JSON.stringify(payload, null, 2)}`,\n      ].join('\\n'),\n      policy\n    );\n\n    return {\n      text: tr.text,\n      structured: {\n        header,\n        payload,\n        verified: false,\n        ...(tr.truncated\n          ? {\n              _truncation: {\n                truncated: tr.truncated,\n                originalBytes: tr.originalBytes,\n                returnedBytes: tr.returnedBytes,\n              },\n            }\n          : {}),\n      },\n    };\n  } catch (err) {\n    return {\n      text: `Decode failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        error: err instanceof Error ? err.message : String(err),\n        code: 'E_MCP_INVALID_INPUT',\n      },\n      isError: true,\n    };\n  }\n}\n","/**\n * Issue handler -- Wire 0.2 only, ZERO MCP SDK imports\n *\n * Signs and returns a Wire 0.2 PEAC record JWS (in-memory only, no side-effects).\n * Requires issuerKey + issuerId on ServerContext.\n */\n\nimport { issueWire02, IssueError } from '@peac/protocol';\nimport { decode, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { IssueInput } from '../schemas/issue.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n * Matches base64url-encoded private key bytes and public key bytes.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n  const privB64 = base64urlEncode(privateKey);\n  const pubB64 = base64urlEncode(publicKey);\n  // Escape any regex-special chars in base64url strings (none expected, but defensive)\n  const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\nexport async function handleIssue(params: HandlerParams<IssueInput>): Promise<HandlerResult> {\n  const { input, policy, context } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_issue', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: issuer key + id must be configured\n  if (!context.issuerKey || !context.issuerId) {\n    return {\n      text: 'Issue failed: server not configured with issuer key and ID (--issuer-key + --issuer-id)',\n      structured: {\n        ok: false,\n        code: 'E_MCP_KEY_REQUIRED',\n        message: 'Server requires --issuer-key and --issuer-id for peac_issue',\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: check claims byte size\n  const inputJson = JSON.stringify(input);\n  const inputBytes = new TextEncoder().encode(inputJson).length;\n  if (inputBytes > policy.limits.max_claims_bytes) {\n    return {\n      text: `Input rejected: claims are ${inputBytes} bytes, exceeding limit of ${policy.limits.max_claims_bytes} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Claims input is ${inputBytes} bytes, limit is ${policy.limits.max_claims_bytes}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Build Trust Gate 1 patterns from actual key\n  const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n  try {\n    // Build policy block: PolicyBlock requires digest (non-optional per kernel type).\n    // If caller provides policy without digest, return a clear error rather than\n    // silently discarding the policy metadata.\n    if (input.policy && !input.policy.digest) {\n      return {\n        text: 'Issue failed: policy.digest is required when policy block is provided',\n        structured: {\n          ok: false,\n          code: 'E_MCP_ISSUE_FAILED',\n          message:\n            'policy.digest is required when policy block is provided (uri/version alone is insufficient for binding)',\n        },\n        isError: true,\n      };\n    }\n    const policyBlock = input.policy?.digest\n      ? { digest: input.policy.digest, uri: input.policy.uri, version: input.policy.version }\n      : undefined;\n\n    const result = await issueWire02({\n      iss: context.issuerId,\n      kind: input.kind,\n      type: input.type,\n      sub: input.sub,\n      pillars: input.pillars,\n      occurred_at: input.occurred_at,\n      extensions: input.extensions,\n      policy: policyBlock,\n      privateKey: context.issuerKey.privateKey,\n      kid: context.issuerKey.kid,\n    });\n\n    // Decode JWS to extract claims summary\n    const { payload } = decode<Record<string, unknown>>(result.jws);\n    const claimsSummary = {\n      iss: payload.iss as string,\n      kind: payload.kind as string,\n      type: payload.type as string,\n      iat: payload.iat as number,\n      jti: payload.jti as string,\n      ...(payload.sub !== undefined ? { sub: payload.sub as string } : {}),\n      ...(payload.pillars !== undefined ? { pillars: payload.pillars as string[] } : {}),\n    };\n\n    // Trust Gate 1: scan output for key bytes\n    const tr = truncateResponse(\n      `Receipt issued: jti=${claimsSummary.jti}, kind=${claimsSummary.kind}, type=${claimsSummary.type}`,\n      policy\n    );\n    const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n    return {\n      text: safeText,\n      structured: {\n        ok: true,\n        jws: result.jws,\n        claimsSummary,\n      },\n    };\n  } catch (err) {\n    // Sanitize error messages -- never expose key bytes\n    const rawMessage = err instanceof Error ? err.message : String(err);\n    const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n    if (err instanceof IssueError) {\n      return {\n        text: `Issue failed: ${safeMessage}`,\n        structured: {\n          ok: false,\n          code: 'E_MCP_ISSUE_FAILED',\n          message: safeMessage,\n        },\n        isError: true,\n      };\n    }\n\n    if (err instanceof McpServerError) {\n      return {\n        text: `Issue failed: ${safeMessage}`,\n        structured: {\n          ok: false,\n          code: err.code,\n          message: safeMessage,\n        },\n        isError: true,\n      };\n    }\n\n    return {\n      text: `Issue failed: ${safeMessage}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_ISSUE_FAILED',\n        message: safeMessage,\n      },\n      isError: true,\n    };\n  }\n}\n","/**\n * TOCTOU-hardened filesystem utilities for bundle creation\n *\n * All path operations validate against symlink injection and traversal.\n * Zero MCP SDK imports.\n */\n\nimport { lstat, mkdir, rename, rm, mkdtemp } from 'node:fs/promises';\nimport * as nodePath from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { PathTraversalError } from './errors.js';\n\n/**\n * Windows reserved device names (case-insensitive, even with extensions).\n * Windows treats CON, CON.txt, NUL, PRN, COM1..COM9, LPT1..LPT9 as special.\n */\nconst WINDOWS_RESERVED_NAMES = new Set([\n  'con',\n  'prn',\n  'aux',\n  'nul',\n  'com1',\n  'com2',\n  'com3',\n  'com4',\n  'com5',\n  'com6',\n  'com7',\n  'com8',\n  'com9',\n  'lpt1',\n  'lpt2',\n  'lpt3',\n  'lpt4',\n  'lpt5',\n  'lpt6',\n  'lpt7',\n  'lpt8',\n  'lpt9',\n]);\n\n/**\n * Assert that a path is a safe single-segment relative name.\n *\n * v1 restriction: no nested directories (single path segment only).\n * Rejects absolute paths, `..`, empty strings, multi-segment paths, names >255 chars,\n * null bytes, colons (drive letters, NTFS ADS), Windows reserved device names,\n * and trailing dots/spaces (Windows normalizes these).\n */\nexport function assertRelativePath(p: string): void {\n  if (!p || p.trim().length === 0) {\n    throw new PathTraversalError('Path must not be empty');\n  }\n\n  // Reject null bytes (injection vector)\n  if (p.includes('\\0')) {\n    throw new PathTraversalError('Null bytes are not allowed in paths');\n  }\n\n  // Reject colons (blocks drive letters C: and NTFS ADS file.txt:stream)\n  if (p.includes(':')) {\n    throw new PathTraversalError('Colons are not allowed in paths (drive letters, NTFS ADS)');\n  }\n\n  if (nodePath.isAbsolute(p)) {\n    throw new PathTraversalError('Absolute paths are not allowed');\n  }\n\n  // Normalize to detect .. traversal\n  const normalized = nodePath.normalize(p);\n  if (normalized.startsWith('..') || normalized.includes('/..') || normalized.includes('\\\\..')) {\n    throw new PathTraversalError('Path traversal (..) is not allowed');\n  }\n\n  // v1: single segment only -- no slashes\n  if (p.includes('/') || p.includes('\\\\')) {\n    throw new PathTraversalError('Nested directories are not allowed (single segment only)');\n  }\n\n  if (p.length > 255) {\n    throw new PathTraversalError(`Path segment exceeds 255 characters (got ${p.length})`);\n  }\n\n  // Reject hidden files/dirs\n  if (p.startsWith('.')) {\n    throw new PathTraversalError('Hidden paths (starting with .) are not allowed');\n  }\n\n  // Reject trailing dots and spaces (Windows normalizes these, causing confusion)\n  if (p.endsWith('.') || p.endsWith(' ')) {\n    throw new PathTraversalError('Trailing dots and spaces are not allowed');\n  }\n\n  // Reject Windows reserved device names (case-insensitive, even with extensions)\n  // Check the base name before the first dot: \"CON.txt\" -> \"con\"\n  const dotIndex = p.indexOf('.');\n  const baseName = (dotIndex >= 0 ? p.slice(0, dotIndex) : p).toLowerCase();\n  if (WINDOWS_RESERVED_NAMES.has(baseName)) {\n    throw new PathTraversalError(`Windows reserved device name: ${baseName.toUpperCase()}`);\n  }\n}\n\n/**\n * Validate and resolve an output path within a base directory.\n * Does NOT create the directory -- only validates and returns the resolved path.\n */\nexport function resolveOutputPath(basePath: string, relativePath: string): string {\n  assertRelativePath(relativePath);\n\n  const normalizedBase = nodePath.resolve(basePath);\n  const resolved = nodePath.resolve(normalizedBase, relativePath);\n\n  // Defense-in-depth: use path.relative to check containment.\n  // If the resolved path escapes basePath, relative() produces a string\n  // starting with '..' -- this is cross-platform safe unlike string prefix checks.\n  const rel = nodePath.relative(normalizedBase, resolved);\n  if (rel.startsWith('..') || rel.startsWith('/') || nodePath.isAbsolute(rel)) {\n    throw new PathTraversalError('Resolved path escapes base directory');\n  }\n\n  return resolved;\n}\n\n/**\n * Check that a path component is not a symlink.\n * Throws PathTraversalError if the component is a symlink.\n */\nasync function assertNotSymlink(componentPath: string): Promise<void> {\n  try {\n    const stats = await lstat(componentPath);\n    if (stats.isSymbolicLink()) {\n      throw new PathTraversalError(`Symlink detected at ${componentPath}`);\n    }\n  } catch (err) {\n    if (err instanceof PathTraversalError) throw err;\n    // ENOENT is fine -- the component doesn't exist yet\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return;\n    throw err;\n  }\n}\n\n/**\n * Create a directory under basePath with per-component symlink checks.\n * Returns the resolved path of the created directory.\n */\nexport async function safeMkdir(basePath: string, relativePath: string): Promise<string> {\n  const resolved = resolveOutputPath(basePath, relativePath);\n\n  // Check base path itself is not a symlink\n  await assertNotSymlink(basePath);\n\n  // Check that target does not already exist as a symlink\n  await assertNotSymlink(resolved);\n\n  await mkdir(resolved, { recursive: false, mode: 0o700 });\n  return resolved;\n}\n\n/**\n * Atomically move a temp directory to a final path.\n * Uses rename() which is atomic on the same filesystem.\n * Cleans up temp dir on failure.\n */\nexport async function atomicWriteDir(tempDir: string, finalPath: string): Promise<void> {\n  try {\n    await rename(tempDir, finalPath);\n  } catch (err) {\n    // Clean up temp dir on failure\n    try {\n      await rm(tempDir, { recursive: true, force: true });\n    } catch {\n      // Best-effort cleanup\n    }\n    throw err;\n  }\n}\n\n/**\n * Create a temporary directory under basePath.\n * Uses a `.tmp-<uuid>` prefix to avoid collisions.\n */\nexport async function createTempDir(basePath: string): Promise<string> {\n  await assertNotSymlink(basePath);\n  const prefix = nodePath.join(basePath, `.tmp-${randomUUID().slice(0, 8)}-`);\n  return mkdtemp(prefix);\n}\n","/**\n * Bundle handler -- ZERO MCP SDK imports\n *\n * Creates a signed evidence bundle directory from receipt JWS strings.\n * Requires issuerKey + issuerId + bundleDir on ServerContext.\n */\n\nimport { writeFile, rm, stat, mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { sign, sha256Hex, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { BundleInput } from '../schemas/bundle.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\nimport { assertRelativePath, createTempDir, atomicWriteDir } from '../infra/path-safety.js';\nimport { SERVER_VERSION } from '../infra/constants.js';\n\n/**\n * Stable JSON stringify with sorted keys at all levels.\n * Produces deterministic output regardless of property insertion order.\n * Uses 2-space indentation for human readability.\n */\nfunction stableJsonStringify(value: unknown): string {\n  return (\n    JSON.stringify(\n      value,\n      (_key, val) => {\n        if (val !== null && typeof val === 'object' && !Array.isArray(val)) {\n          const sorted: Record<string, unknown> = {};\n          for (const k of Object.keys(val as Record<string, unknown>).sort()) {\n            sorted[k] = (val as Record<string, unknown>)[k];\n          }\n          return sorted;\n        }\n        return val;\n      },\n      2\n    ) + '\\n'\n  );\n}\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n  const privB64 = base64urlEncode(privateKey);\n  const pubB64 = base64urlEncode(publicKey);\n  const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\n/**\n * Generate a default bundle directory name with timestamp + random suffix.\n */\nfunction generateBundleName(): string {\n  const ts = new Date().toISOString().replace(/[:.]/g, '-');\n  const rand = randomUUID().slice(0, 8);\n  return `bundle-${ts}-${rand}`;\n}\n\nexport async function handleCreateBundle(\n  params: HandlerParams<BundleInput>\n): Promise<HandlerResult> {\n  const { input, policy, context } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_create_bundle', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: bundleDir must be configured\n  if (!context.bundleDir) {\n    return {\n      text: 'Bundle creation failed: server not configured with --bundle-dir',\n      structured: {\n        ok: false,\n        code: 'E_MCP_BUNDLE_DIR_REQUIRED',\n        message: 'Server requires --bundle-dir for peac_create_bundle',\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: issuer key + id must be configured (for manifest signing)\n  if (!context.issuerKey || !context.issuerId) {\n    return {\n      text: 'Bundle creation failed: server not configured with issuer key and ID',\n      structured: {\n        ok: false,\n        code: 'E_MCP_KEY_REQUIRED',\n        message: 'Server requires --issuer-key and --issuer-id for peac_create_bundle',\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: receipt count limit\n  if (input.receipts.length > policy.limits.max_bundle_receipts) {\n    return {\n      text: `Input rejected: ${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: total byte size\n  let totalReceiptBytes = 0;\n  for (const r of input.receipts) {\n    totalReceiptBytes += new TextEncoder().encode(r).length;\n  }\n  if (totalReceiptBytes > policy.limits.max_bundle_bytes) {\n    return {\n      text: `Input rejected: total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Validate or generate output_path\n  const outputName = input.output_path ?? generateBundleName();\n  try {\n    assertRelativePath(outputName);\n  } catch (err) {\n    return {\n      text: `Bundle creation failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_PATH_TRAVERSAL',\n        message: err instanceof Error ? err.message : String(err),\n      },\n      isError: true,\n    };\n  }\n\n  // Build Trust Gate 1 patterns\n  const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n  let tempDir: string | undefined;\n  try {\n    // Create temp working directory (0o700: owner-only access)\n    tempDir = await createTempDir(context.bundleDir);\n\n    // Write receipts and compute hashes\n    const receiptsDir = join(tempDir, 'receipts');\n    await mkdir(receiptsDir, { mode: 0o700 });\n\n    interface ReceiptEntry {\n      index: number;\n      file: string;\n      sha256: string;\n      length: number;\n    }\n\n    const entries: ReceiptEntry[] = [];\n    let totalBytes = 0;\n\n    // Dedup by sha256: identical receipts produce one file and one manifest\n    // entry. This is explicit behavior, not an accident of hash-named files.\n    const seenHashes = new Set<string>();\n    const receiptHashes: string[] = [];\n\n    for (let i = 0; i < input.receipts.length; i++) {\n      // Check cancellation at each iteration to avoid unnecessary disk I/O\n      if (params.signal?.aborted) {\n        throw new McpServerError('E_MCP_CANCELLED', 'Request cancelled during bundle creation');\n      }\n\n      const jws = input.receipts[i];\n      const data = new TextEncoder().encode(jws);\n      const hash = await sha256Hex(data);\n\n      if (seenHashes.has(hash)) continue; // skip duplicate receipt\n      seenHashes.add(hash);\n      receiptHashes.push(hash);\n\n      // Name receipt files by content hash for input-order independence.\n      // Same receipt set in any order produces identical file structure.\n      const fileName = `${hash}.jws`;\n      const filePath = join(receiptsDir, fileName);\n      await writeFile(filePath, data, { mode: 0o600 });\n      entries.push({\n        index: i,\n        file: `receipts/${fileName}`,\n        sha256: hash,\n        length: data.length,\n      });\n      totalBytes += data.length;\n    }\n\n    // Sort entries by sha256 for canonical ordering.\n    // Note: the manifest includes `created_at` (wall-clock time), so manifest\n    // content and its signature will differ across runs. Only `bundle_id` is\n    // fully deterministic (content-addressable from policy + receipt hashes).\n    entries.sort((a, b) => a.sha256.localeCompare(b.sha256));\n\n    // Compute content-addressable bundle_id: deterministic identifier\n    // independent of wall-clock time. Same policy + same receipts = same bundle_id.\n    const sortedHashes = [...receiptHashes].sort();\n    const bundleIdInput = `${context.policyHash}:${sortedHashes.join(':')}`;\n    const bundleId = await sha256Hex(new TextEncoder().encode(bundleIdInput));\n\n    const manifest = {\n      bundle_id: bundleId,\n      tool_version: SERVER_VERSION,\n      created_at: new Date().toISOString(),\n      policy_hash: context.policyHash,\n      receipt_count: entries.length,\n      receipts: entries,\n      ...(input.metadata ? { metadata: input.metadata } : {}),\n    };\n\n    // Write manifest.json with canonical key ordering (0o600: owner rw)\n    const manifestJson = stableJsonStringify(manifest);\n    await writeFile(join(tempDir, 'manifest.json'), manifestJson, { mode: 0o600 });\n    totalBytes += new TextEncoder().encode(manifestJson).length;\n\n    // Compute manifest hash for the response (caller uses this for integrity checks)\n    const manifestBytes = new TextEncoder().encode(manifestJson);\n    const manifestSha256 = await sha256Hex(manifestBytes);\n\n    // Sign the canonical manifest object. The signature covers the full\n    // manifest including `created_at`, so it is NOT reproducible across runs.\n    // Parse the stable-stringified JSON back so the sign() function\n    // receives an object whose property order matches the on-disk file.\n    const canonicalManifest = JSON.parse(manifestJson) as Record<string, unknown>;\n    const manifestJws = await sign(\n      canonicalManifest,\n      context.issuerKey.privateKey,\n      context.issuerKey.kid\n    );\n    await writeFile(join(tempDir, 'manifest.jws'), manifestJws, { mode: 0o600 });\n    totalBytes += new TextEncoder().encode(manifestJws).length;\n\n    // File count: unique receipts + manifest.json + manifest.jws\n    const fileCount = entries.length + 2;\n\n    // Atomic move to final path\n    const finalPath = join(context.bundleDir, outputName);\n\n    // Check final path doesn't already exist\n    try {\n      await stat(finalPath);\n      // If we get here, it exists -- error\n      return {\n        text: `Bundle creation failed: output path already exists: ${outputName}`,\n        structured: {\n          ok: false,\n          code: 'E_MCP_BUNDLE_FAILED',\n          message: `Output path already exists: ${outputName}`,\n        },\n        isError: true,\n      };\n    } catch (err) {\n      // ENOENT is expected -- path doesn't exist yet\n      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n        throw err;\n      }\n    }\n\n    await atomicWriteDir(tempDir, finalPath);\n    tempDir = undefined; // Don't clean up -- rename succeeded\n\n    const tr = truncateResponse(\n      `Bundle created: ${outputName} (${fileCount} files, ${totalBytes} bytes)`,\n      policy\n    );\n    const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n    // Return metadata only -- full manifest and manifestJws live on disk.\n    // This prevents multi-KB JSON in MCP responses (client/UI stability).\n    // Return bundleName (relative to --bundle-dir), not absolute path --\n    // the absolute path leaks host filesystem layout to the LLM context.\n    return {\n      text: safeText,\n      structured: {\n        ok: true,\n        bundleId: bundleId,\n        bundleName: outputName,\n        receiptCount: entries.length,\n        fileCount,\n        totalBytes,\n        createdAt: manifest.created_at,\n        manifestSha256,\n      },\n    };\n  } catch (err) {\n    // Clean up temp dir on failure\n    if (tempDir) {\n      try {\n        await rm(tempDir, { recursive: true, force: true });\n      } catch {\n        // Best-effort cleanup\n      }\n    }\n\n    const rawMessage = err instanceof Error ? err.message : String(err);\n    const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n    if (err instanceof McpServerError) {\n      return {\n        text: `Bundle creation failed: ${safeMessage}`,\n        structured: {\n          ok: false,\n          code: err.code,\n          message: safeMessage,\n        },\n        isError: true,\n      };\n    }\n\n    return {\n      text: `Bundle creation failed: ${safeMessage}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_BUNDLE_FAILED',\n        message: safeMessage,\n      },\n      isError: true,\n    };\n  }\n}\n","/**\n * Verify tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const VerifyInputSchema = z.object({\n  jws: z.string().describe('JWS compact serialization (header.payload.signature)'),\n  public_key_base64url: z\n    .string()\n    .optional()\n    .describe('Ed25519 public key in base64url encoding (32 bytes)'),\n  jwks: z.string().optional().describe('Inline JWKS JSON containing the verifying key'),\n  issuer: z.string().optional().describe('Expected issuer URI for binding check'),\n  audience: z.string().optional().describe('Expected audience URI for binding check'),\n});\n\nexport type VerifyInput = z.infer<typeof VerifyInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nconst CheckSchema = z.object({\n  name: z.string(),\n  passed: z.boolean(),\n  message: z.string().optional(),\n});\n\nexport const VerifyOutputSchema = z.object({\n  _meta: MetaSchema,\n  ok: z.boolean(),\n  code: z.string().optional(),\n  message: z.string().optional(),\n  variant: z.string().optional(),\n  checks: z.array(CheckSchema),\n  claimsSummary: z.record(z.string(), z.unknown()).optional(),\n  keySource: z.string().optional(),\n});\n\nexport type VerifyOutput = z.infer<typeof VerifyOutputSchema>;\n","/**\n * Inspect tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const InspectInputSchema = z.object({\n  jws: z.string().describe('JWS compact serialization to inspect'),\n  full_claims: z\n    .boolean()\n    .optional()\n    .default(false)\n    .describe('Include full decoded claims (may be redacted by policy)'),\n});\n\nexport type InspectInput = z.infer<typeof InspectInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nexport const InspectOutputSchema = z.object({\n  _meta: MetaSchema,\n  header: z.record(z.string(), z.unknown()),\n  payloadMeta: z.object({\n    variant: z.string(),\n    issuer: z.string().optional(),\n    audience: z.string().optional(),\n    issuedAt: z.string().optional(),\n    expiresAt: z.string().optional(),\n    receiptId: z.string().optional(),\n  }),\n  fullPayload: z.record(z.string(), z.unknown()).optional(),\n  redacted: z.boolean(),\n  verified: z.literal(false),\n});\n\nexport type InspectOutput = z.infer<typeof InspectOutputSchema>;\n","/**\n * Decode tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const DecodeInputSchema = z.object({\n  jws: z.string().describe('JWS compact serialization to decode'),\n});\n\nexport type DecodeInput = z.infer<typeof DecodeInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nexport const DecodeOutputSchema = z.object({\n  _meta: MetaSchema,\n  header: z.record(z.string(), z.unknown()),\n  payload: z.record(z.string(), z.unknown()),\n  verified: z.literal(false),\n});\n\nexport type DecodeOutput = z.infer<typeof DecodeOutputSchema>;\n","/**\n * Issue tool schemas -- Wire 0.2 only\n *\n * The MCP peac_issue tool accepts Wire 0.2 fields exclusively.\n * No wire_version discriminator: the MCP server is a forward-looking\n * adoption surface; agents should only issue Wire 0.2 receipts.\n */\n\nimport { z } from 'zod';\n\nexport const IssueInputSchema = z.object({\n  kind: z\n    .enum(['evidence', 'challenge'])\n    .describe('Structural kind: evidence (records interaction) or challenge (requests action)'),\n  type: z\n    .string()\n    .min(1)\n    .max(256)\n    .refine(\n      (v) =>\n        /^https?:\\/\\//.test(v) ||\n        /^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.[a-zA-Z0-9._-]+\\/[a-zA-Z0-9]/.test(v),\n      {\n        message:\n          'type must be reverse-DNS (e.g. org.peacprotocol/payment) or absolute URI (https://...)',\n      }\n    )\n    .describe('Semantic type in reverse-DNS or absolute URI form (e.g. org.peacprotocol/payment)'),\n  sub: z\n    .string()\n    .max(2048)\n    .optional()\n    .describe('Subject identifier (resource or interaction target)'),\n  pillars: z\n    .array(\n      z.enum([\n        'access',\n        'attribution',\n        'commerce',\n        'compliance',\n        'consent',\n        'identity',\n        'privacy',\n        'provenance',\n        'purpose',\n        'safety',\n      ])\n    )\n    .optional()\n    .refine(\n      (arr) =>\n        !arr || (new Set(arr).size === arr.length && [...arr].sort().every((v, i) => v === arr[i])),\n      { message: 'pillars must be unique and sorted ascending' }\n    )\n    .describe('Evidence pillars from closed 10-value taxonomy (sorted ascending)'),\n  occurred_at: z\n    .string()\n    .optional()\n    .refine((v) => !v || !isNaN(Date.parse(v)), {\n      message: 'occurred_at must be a valid ISO 8601 timestamp',\n    })\n    .describe('ISO 8601 timestamp when interaction occurred (evidence kind only)'),\n  extensions: z\n    .record(z.string(), z.unknown())\n    .optional()\n    .describe('Extension groups keyed by reverse-DNS identifier'),\n  policy: z\n    .object({\n      uri: z\n        .string()\n        .url()\n        .max(2048)\n        .refine((v) => v.startsWith('https://'), { message: 'policy.uri must use HTTPS' })\n        .describe('Policy document URI (HTTPS only)'),\n      version: z.string().max(256).optional().describe('Policy version'),\n      digest: z\n        .string()\n        .regex(/^sha256:[0-9a-f]{64}$/)\n        .optional()\n        .describe('Policy digest in sha256:<64 hex> format'),\n    })\n    .optional()\n    .describe('Policy binding block'),\n  ttl_seconds: z\n    .number()\n    .int()\n    .positive()\n    .optional()\n    .describe('Reserved for future use (Wire 0.2 receipts do not expire)'),\n});\n\nexport type IssueInput = z.infer<typeof IssueInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nconst ClaimsSummarySchema = z.object({\n  iss: z.string(),\n  kind: z.string(),\n  type: z.string(),\n  iat: z.number(),\n  jti: z.string(),\n  sub: z.string().optional(),\n  pillars: z.array(z.string()).optional(),\n});\n\nexport const IssueOutputSchema = z.object({\n  _meta: MetaSchema,\n  ok: z.boolean(),\n  jws: z.string(),\n  claimsSummary: ClaimsSummarySchema,\n});\n\nexport type IssueOutput = z.infer<typeof IssueOutputSchema>;\n","/**\n * Bundle tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const BundleInputSchema = z.object({\n  receipts: z\n    .array(z.string().max(16_384))\n    .min(1)\n    .max(256)\n    .describe('Receipt JWS strings to bundle (1-256)'),\n  metadata: z\n    .record(z.string(), z.unknown())\n    .optional()\n    .describe('Optional metadata to include in the manifest'),\n  output_path: z\n    .string()\n    .max(255)\n    .optional()\n    .describe('Output directory name (single segment within --bundle-dir)'),\n});\n\nexport type BundleInput = z.infer<typeof BundleInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nexport const BundleOutputSchema = z.object({\n  _meta: MetaSchema,\n  ok: z.boolean(),\n  bundleId: z.string(),\n  bundleName: z.string(),\n  receiptCount: z.number(),\n  fileCount: z.number(),\n  totalBytes: z.number(),\n  createdAt: z.string(),\n  manifestSha256: z.string(),\n});\n\nexport type BundleOutput = z.infer<typeof BundleOutputSchema>;\n"]}