{"version":3,"sources":["../src/infra/constants.ts","../src/infra/errors.ts","../src/infra/jwks-loader.ts","../src/handlers/guards.ts","../src/handlers/verify.ts","../src/handlers/inspect.ts","../src/handlers/decode.ts","../src/handlers/issue.ts","../src/infra/path-safety.ts","../src/handlers/bundle.ts","../src/schemas/verify.ts","../src/schemas/inspect.ts","../src/schemas/decode.ts","../src/schemas/issue.ts","../src/schemas/bundle.ts","../src/server.ts","../src/infra/policy.ts","../src/infra/key-loader.ts","../src/stdout-fence.ts"],"names":["readFile","base64urlDecode","total","decode","verifyLocal","checks","parseReceiptClaims","base64urlEncode","issueWire02","IssueError","nodePath","lstat","mkdir","rename","rm","randomUUID","mkdtemp","buildKeyPatterns","join","sha256Hex","writeFile","sign","stat","z","MetaSchema","ERRORS","McpServer","validateKeypair","derivePublicKey"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIO,IAAM,WAAA,GAAc;AACpB,IAAM,cAAA,GAAiB;AACvB,IAAM,oBAAA,GAAuB;AAC7B,IAAM,qBAAA,GAAwB;AAC9B,IAAM,0BAAA,GAA6B;AACnC,IAAM,uBAAA,GAA0B;AAChC,IAAM,wBAAA,GAA2B;AACjC,IAAM,2BAAA,GAA8B;AACpC,IAAM,wBAAA,GAA2B;AACjC,IAAM,uBAAA,GAA0B;;;ACehC,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAC/B,IAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA0B,OAAA,EAAiB,OAAA,EAAwB;AAC7E,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA,EAC/C,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,gBAAA,EAAkB,SAAS,OAAO,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,mBAAA,EAAqB,SAAS,OAAO,CAAA;AAC3C,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAEO,IAAM,aAAA,GAAN,cAA4B,cAAA,CAAe;AAAA,EAChD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF;AAEO,IAAM,cAAA,GAAN,cAA6B,cAAA,CAAe;AAAA,EACjD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,oBAAA,EAAsB,SAAS,OAAO,CAAA;AAC5C,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,qBAAA,EAAuB,SAAS,OAAO,CAAA;AAC7C,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAEO,IAAM,kBAAA,GAAN,cAAiC,cAAA,CAAe;AAAA,EACrD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF;AAOO,SAAS,cAAA,CAAe,MAAc,iBAAA,EAAqC;AAChF,EAAA,IAAI,MAAA,GAAS,IAAA;AACb,EAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,MAAA;AACT;;;AC3EA,eAAsB,aAAa,QAAA,EAA2C;AAC5E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMA,iBAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,CAAA,0BAAA,EAA6B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC5F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,cAAc,CAAA,6BAAA,EAAgC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACpF;AAEA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,IAAA,IAAQ,EAAE,UAAU,MAAA,CAAA,EAAS;AACxE,IAAA,MAAM,IAAI,cAAc,kCAAkC,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA;AACb,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,cAAc,8BAA8B,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,IAAA,EAAM;AAC3B,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC7C,IAAA,MAAM,CAAA,GAAI,GAAA;AAGV,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC5C,IAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,QAAA,EAAU;AAC7B,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,CAAA,CAAE,QAAQ,OAAA,EAAS;AAE9C,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,CAAE,GAAA,KAAQ,WAAW,CAAA,CAAE,GAAA,GAAM,CAAA,IAAA,EAAO,OAAA,CAAQ,MAAM,CAAA,CAAA;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAYC,sBAAA,CAAgB,CAAA,CAAE,CAAC,CAAA;AACrC,MAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,SAAA,EAAW,CAAA;AAAA,MACjC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAA,CAAgB,MAAsB,GAAA,EAAqC;AACzF,EAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAC5C,EAAA,OAAO,KAAA,EAAO,SAAA;AAChB;;;ACzDO,SAAS,YAAA,CAAa,KAAa,MAAA,EAAiD;AACzF,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,aAAA,EAAe;AAC5C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,uBAAA,EAA0B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,aAAa,CAAA,MAAA,CAAA;AAAA,MACnG,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,aAAA,EAAgB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,aAAa,CAAA;AAAA,OACpF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,UACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAA,IAAc,UAAA,CAAW,OAAA,KAAY,KAAA,EAAO;AAC9C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,SAAS,QAAQ,CAAA,8BAAA,CAAA;AAAA,MACvB,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS,SAAS,QAAQ,CAAA,8BAAA;AAAA,OAC5B;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,cAAA,CAAe,OAAgB,IAAA,EAAgC;AACtE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AAAA,EACzC;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,CAAA;AAGxD,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAIC,MAAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAAA,MAAAA,IAAS,cAAA,CAAe,IAAA,EAAM,OAAO,CAAA;AAAA,IACvC;AACA,IAAA,OAAOA,MAAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,EAAG;AAC/D,IAAA,KAAA,IAAS,cAAA,CAAe,GAAG,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAA;AACT;AAaA,SAAS,uBAAA,CAAwB,KAAA,EAAgB,KAAA,EAAe,IAAA,EAAgC;AAC9F,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,CAAA;AAC3B,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA;AAChC,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,CAAA,GAAI,CAAA;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,WAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,MAAM,CAAA;AAErF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,MAAA,KAAA,IAAS,uBAAA,CAAwB,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,OAAO,CAAA;AACzD,MAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA;AAC/D,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,QAAQ,CAAC,CAAA;AACxB,IAAA,KAAA,IAAS,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,CAAC,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AACxD,IAAA,KAAA,IAAS,uBAAA,CAAwB,CAAA,EAAG,KAAA,EAAO,OAAO,CAAA;AAClD,IAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,EAC5B;AACA,EAAA,OAAO,KAAA;AACT;AAYO,SAAS,eAAA,CACd,OACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,aAAA,GAAgB,CAAA;AAG5C,EAAA,MAAM,UAAA,GAAa,eAAe,KAAK,CAAA;AACvC,EAAA,IAAI,aAAa,KAAA,EAAO;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,CAAA,+BAAA,EAAkC,UAAU,CAAA,2BAAA,EAA8B,KAAK,CAAA,MAAA,CAAA;AAAA,MACrF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,UAAU,CAAA,iBAAA,EAAoB,KAAK,CAAA;AAAA,OAChE;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAIA,EAAA,MAAM,cAAA,GAAiB,uBAAA,CAAwB,KAAA,EAAO,KAAK,CAAA;AAC3D,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,+DAA+D,KAAK,CAAA,MAAA,CAAA;AAAA,MAC1E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,+CAA+C,KAAK,CAAA,MAAA;AAAA,OAC/D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,GAAA,EACA,QAAA,GAAmB,EAAA,EACnB,eAAuB,CAAA,EACd;AACT,EAAA,IAAI,YAAA,GAAe,UAAU,OAAO,KAAA;AACpC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,IAAA;AACpD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,MAAM,CAAC,IAAA,KAAS,iBAAiB,IAAA,EAAM,QAAA,EAAU,YAAA,GAAe,CAAC,CAAC,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,GAA8B,CAAA,CAAE,KAAA;AAAA,IAAM,CAAC,KAAA,KAC1D,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAU,eAAe,CAAC;AAAA,GACpD;AACF;AASA,IAAM,2BAAA,GAA8B,sCAAA;AAU7B,SAAS,oBAAA,CACd,cAAA,EAKA,EAAA,GAAsB,2BAAA,EACd;AACR,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,OAAA,EAAS,KAAA;AAAA,IACT,EAAA;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,SAAS,cAAA,CAAe,OAAA;AAAA,MACxB,mBAAmB,cAAA,CAAe,iBAAA;AAAA,MAClC,SAAS,cAAA,CAAe;AAAA;AAC1B,GACF;AACA,EAAA,OAAO,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,QAAQ,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AAC/D;AASA,IAAM,iBAAA,GAAoB,iDAAA;AAC1B,IAAM,0BAA0B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAiB,CAAA,CAAE,MAAA;AAQrE,SAAS,gBAAA,CAAiB,MAAc,MAAA,EAAwC;AACrF,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,CAAO,kBAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,EAAU;AAC9B,IAAA,OAAO,EAAE,MAAM,SAAA,EAAW,KAAA,EAAO,eAAe,OAAA,CAAQ,MAAA,EAAQ,aAAA,EAAe,OAAA,CAAQ,MAAA,EAAO;AAAA,EAChG;AAIA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,uBAAuB,CAAA;AAEjE,EAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,UAAU,CAAC,CAAA;AAC3E,EAAA,MAAM,YAAY,aAAA,GAAgB,iBAAA;AAClC,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AACvD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,SAAA,EAAW,IAAA;AAAA,IACX,eAAe,OAAA,CAAQ,MAAA;AAAA,IACvB,eAAe,YAAA,CAAa;AAAA,GAC9B;AACF;;;AC5PA,SAAS,iBAAiB,MAAA,EAGxB;AACA,EAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAI,MAAA;AAG3B,EAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,IAAA,OAAO;AAAA,MACL,SAAA,EAAWD,sBAAAA,CAAgB,KAAA,CAAM,oBAAoB,CAAA;AAAA,MACrD,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAGA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,EAAE,MAAA,EAAO,GAAIE,aAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAGnB,IAAA,MAAM,WAAA,GAAc,KAAK,IAAA,CAAK,MAAA;AAAA,MAC5B,CAAC,CAAA,KACC,CAAA,CAAE,GAAA,KAAQ,KAAA,IACV,EAAE,GAAA,KAAQ,SAAA,IACV,OAAO,CAAA,CAAE,MAAM,QAAA,KACd,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,EAAE,GAAA,KAAQ,OAAA;AAAA,KACtC;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AAGA,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,UAAU,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACrD,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAO;AAAA,UACL,SAAA,EAAWF,sBAAAA,CAAgB,OAAA,CAAQ,CAAW,CAAA;AAAA,UAC9C,SAAA,EAAW;AAAA,SACb;AAAA,MACF;AACA,MAAA,MAAM,MAAA,CAAO,MAAA;AAAA,QACX,IAAI,KAAA,CAAM,CAAA,wDAAA,EAA2D,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,QAC3E,EAAE,WAAW,qBAAA;AAA+B,OAC9C;AAAA,IACF;AAGA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,OAAO;AAAA,QACL,SAAA,EAAWA,sBAAAA,CAAgB,WAAA,CAAY,CAAC,EAAE,CAAW,CAAA;AAAA,QACrD,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,iCAAA,EAAoC,YAAY,MAAM,CAAA,sCAAA;AAAA,OACxD;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAQ;AAC5B,IAAA,MAAM,EAAE,MAAA,EAAO,GAAIE,aAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAEnB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,OAAA,CAAQ,QAAA,EAAU,GAAG,CAAA;AACjD,MAAA,IAAI,GAAA,EAAK;AACP,QAAA,OAAO,EAAE,SAAA,EAAW,GAAA,EAAK,SAAA,EAAW,aAAA,EAAc;AAAA,MACpD;AACA,MAAA,MAAM,OAAO,MAAA,CAAO,IAAI,MAAM,CAAA,wCAAA,EAA2C,GAAG,GAAG,CAAA,EAAG;AAAA,QAChF,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACjC,MAAA,OAAO,EAAE,WAAW,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAA,CAAE,SAAA,EAAW,WAAW,aAAA,EAAc;AAAA,IAC9E;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,wCAAA,EAA2C,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,8BAAA;AAAA,OACpE;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,CAAO,MAAA;AAAA,IACX,IAAI,KAAA;AAAA,MACF;AAAA,KACF;AAAA,IACA,EAAE,WAAW,sBAAA;AAAgC,GAC/C;AACF;AAEA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,iBAAiB,MAAM,CAAA;AACxC,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AACrB,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AAAA,EACvB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAA,GACF,IAAgC,SAAA,IAAoC,sBAAA;AACxE,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,wBAAwB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA;AAAA,QACA,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACxD,QAAQ;AAAC,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAMC,oBAAA,CAAY,KAAA,CAAM,KAAK,SAAA,EAAW;AAAA,IACrD,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,UAAU,KAAA,CAAM;AAAA,GACjB,CAAA;AAED,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,MAAMC,OAAAA,GAAS;AAAA,MACb,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,IAAA,EAAK;AAAA,MAClC,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAK;AAAA,MAC/B,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA;AAAK,KACjC;AAEA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,gBAAA,EAAkB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,kBAAA,EAAoB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,IAAA,MAAM,aAAA,GAAyC;AAAA,MAC7C,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,GAAI,MAAA,CAAO,GAAA,KAAQ,UAAa,EAAE,GAAA,EAAK,OAAO,GAAA,EAAI;AAAA,MAClD,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,aAAa,MAAA,CAAO;AAAA,KACtB;AAEA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,qBAAA,EAAwB,OAAO,OAAO,CAAA,eAAA,EAAkB,OAAO,IAAA,IAAQ,SAAS,CAAA,MAAA,EAAS,MAAA,CAAO,GAAG,CAAA,CAAA,CAAA;AAAA,MACnG;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAA,EAAAA,OAAAA;AAAA,QACA,aAAA;AAAA,QACA,SAAA;AAAA,QACA,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAqE,EAAC;AAC5E,EAAA,IAAI,MAAA,CAAO,SAAS,qBAAA,EAAuB;AACzC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,WAAA,EAAa;AACtC,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,gBAAA,EAAkB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAChF,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,oBAAA,EAAsB;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,kBAAA,EAAoB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAClF,CAAA,MAAO;AACL,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,MAAA,GAAS,gBAAA;AAAA,IACb,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,IAAA,EAAO,OAAO,OAAO,CAAA,CAAA;AAAA,IACxD;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAA,EAAY;AAAA,MACV,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAI,OAAO,SAAA,GACP;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,eAAe,MAAA,CAAO,aAAA;AAAA,UACtB,eAAe,MAAA,CAAO;AAAA;AACxB,UAEF;AAAC;AACP,GACF;AACF;AChPA,eAAsB,cAAc,MAAA,EAA6D;AAC/F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,cAAA,EAAgB,MAAM,CAAA;AAC9D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUF,aAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAAA,EACpB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACzE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,GAAU,SAAA;AACd,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAKG,0BAAmB,OAAO,CAAA;AACrC,IAAA,IAAI,GAAG,EAAA,EAAI;AACT,MAAA,OAAA,GAAU,EAAA,CAAG,OAAA;AAAA,IACf;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,OAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,GAAA;AAAA,IAChB,UAAU,OAAA,CAAQ;AAAA,GACpB;AAEA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,WAAW,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EAClE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,OAAA,CAAQ,GAAA;AAAA,EAClC;AAGA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,WAAA;AAGJ,EAAA,MAAM,mBAAA,GAAsB,KAAA,CAAM,WAAA,IAAe,MAAA,CAAO,SAAA,CAAU,mBAAA;AAClE,EAAA,IAAI,mBAAA,EAAqB;AACvB,IAAA,WAAA,GAAc,EAAE,GAAG,OAAA,EAAQ;AAE3B,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,cAAA,IAAkB,UAAA,IAAc,WAAA,EAAa;AAChE,MAAA,WAAA,CAAY,QAAA,GAAW,sBAAA;AACvB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AACA,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,aAAA,IAAiB,SAAA,IAAa,WAAA,EAAa;AAC9D,MAAA,WAAA,CAAY,OAAA,GAAU,sBAAA;AACtB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,6DAAA;AAAA,IACA,EAAA;AAAA,IACA,YAAY,OAAO,CAAA,CAAA;AAAA,IACnB,CAAA,QAAA,EAAW,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA,CAAA;AAAA,IAC/B,CAAA,UAAA,EAAa,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA;AAAA,GACnC;AAEA,EAAA,IAAI,YAAY,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,WAAA,CAAY,QAAQ,CAAA,CAAE,CAAA;AACzE,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,QAAA,EAAU,KAAA,CAAM,IAAA,CAAK,EAAA,EAAI,sCAAsC,CAAA;AAEnE,EAAA,MAAM,KAAK,gBAAA,CAAiB,KAAA,CAAM,IAAA,CAAK,IAAI,GAAG,MAAM,CAAA;AACpD,EAAA,OAAO;AAAA,IACL,MAAM,EAAA,CAAG,IAAA;AAAA,IACT,UAAA,EAAY;AAAA,MACV,MAAA;AAAA,MACA,WAAA;AAAA,MACA,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB,EAAC;AAAA,MACnD,QAAA;AAAA,MACA,QAAA,EAAU,KAAA;AAAA,MACV,GAAI,GAAG,SAAA,GACH;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,EAAA,CAAG,SAAA;AAAA,UACd,eAAe,EAAA,CAAG,aAAA;AAAA,UAClB,eAAe,EAAA,CAAG;AAAA;AACpB,UAEF;AAAC;AACP,GACF;AACF;AC5GA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUH,aAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAExB,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT;AAAA,QACE,iCAAA;AAAA,QACA,EAAA;AAAA,QACA,WAAW,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA,CAAA;AAAA,QAC1C,EAAA;AAAA,QACA,YAAY,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,OAC9C,CAAE,KAAK,IAAI,CAAA;AAAA,MACX;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,MAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA,EAAU,KAAA;AAAA,QACV,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,kBAAkB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACxE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;AChDA,SAAS,gBAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUI,uBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,uBAAgB,SAAS,CAAA;AAExC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAEA,eAAsB,YAAY,MAAA,EAA2D;AAC3F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,YAAA,EAAc,MAAM,CAAA;AAC5D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yFAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACtC,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,MAAA;AACvD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AAC/C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,2BAAA,EAA8B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,gBAAgB,CAAA,MAAA,CAAA;AAAA,MAC1G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,gBAAA,EAAmB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OAC1F;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAc,gBAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI;AAIF,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAC,KAAA,CAAM,OAAO,MAAA,EAAQ;AACxC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uEAAA;AAAA,QACN,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EACE;AAAA,SACJ;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,cAAc,KAAA,CAAM,MAAA,EAAQ,MAAA,GAC9B,EAAE,QAAQ,KAAA,CAAM,MAAA,CAAO,MAAA,EAAQ,GAAA,EAAK,MAAM,MAAA,CAAO,GAAA,EAAK,SAAS,KAAA,CAAM,MAAA,CAAO,SAAQ,GACpF,KAAA,CAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,MAAMC,oBAAA,CAAY;AAAA,MAC/B,KAAK,OAAA,CAAQ,QAAA;AAAA,MACb,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,MAAA,EAAQ,WAAA;AAAA,MACR,UAAA,EAAY,QAAQ,SAAA,CAAU,UAAA;AAAA,MAC9B,GAAA,EAAK,QAAQ,SAAA,CAAU;AAAA,KACxB,CAAA;AAGD,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAIL,aAAAA,CAAgC,OAAO,GAAG,CAAA;AAC9D,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,GAAI,QAAQ,GAAA,KAAQ,KAAA,CAAA,GAAY,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAc,GAAI,EAAC;AAAA,MAClE,GAAI,QAAQ,OAAA,KAAY,KAAA,CAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAoB,GAAI;AAAC,KAClF;AAGA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,oBAAA,EAAuB,cAAc,GAAG,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,CAAA;AAAA,MAChG;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAEpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAeM,mBAAA,EAAY;AAC7B,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,MAClC,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACpJA,IAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,EACrC,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAUM,SAAS,mBAAmB,CAAA,EAAiB;AAClD,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,mBAAmB,wBAAwB,CAAA;AAAA,EACvD;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,mBAAmB,qCAAqC,CAAA;AAAA,EACpE;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,mBAAmB,2DAA2D,CAAA;AAAA,EAC1F;AAEA,EAAA,IAAaC,mBAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,mBAAmB,gCAAgC,CAAA;AAAA,EAC/D;AAGA,EAAA,MAAM,UAAA,GAAsBA,8BAAU,CAAC,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,KAAK,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5F,IAAA,MAAM,IAAI,mBAAmB,oCAAoC,CAAA;AAAA,EACnE;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,mBAAmB,0DAA0D,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,CAAA,CAAE,SAAS,GAAA,EAAK;AAClB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,yCAAA,EAA4C,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACtF;AAGA,EAAA,IAAI,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,mBAAmB,gDAAgD,CAAA;AAAA,EAC/E;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,mBAAmB,0CAA0C,CAAA;AAAA,EACzE;AAIA,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC9B,EAAA,MAAM,QAAA,GAAA,CAAY,YAAY,CAAA,GAAI,CAAA,CAAE,MAAM,CAAA,EAAG,QAAQ,CAAA,GAAI,CAAA,EAAG,WAAA,EAAY;AACxE,EAAA,IAAI,sBAAA,CAAuB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAA,CAAS,WAAA,EAAa,CAAA,CAAE,CAAA;AAAA,EACxF;AACF;AAMO,SAAS,iBAAA,CAAkB,UAAkB,YAAA,EAA8B;AAChF,EAAA,kBAAA,CAAmB,YAAY,CAAA;AAE/B,EAAA,MAAM,cAAA,GAA0BA,4BAAQ,QAAQ,CAAA;AAChD,EAAA,MAAM,QAAA,GAAoBA,mBAAA,CAAA,OAAA,CAAQ,cAAA,EAAgB,YAAY,CAAA;AAK9D,EAAA,MAAM,GAAA,GAAeA,mBAAA,CAAA,QAAA,CAAS,cAAA,EAAgB,QAAQ,CAAA;AACtD,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,IAAK,GAAA,CAAI,WAAW,GAAG,CAAA,IAAcA,mBAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3E,IAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,EACrE;AAEA,EAAA,OAAO,QAAA;AACT;AAMA,eAAe,iBAAiB,aAAA,EAAsC;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAMC,cAAA,CAAM,aAAa,CAAA;AACvC,IAAA,IAAI,KAAA,CAAM,gBAAe,EAAG;AAC1B,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,oBAAA,EAAuB,aAAa,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,oBAAoB,MAAM,GAAA;AAE7C,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACtD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAMA,eAAsB,SAAA,CAAU,UAAkB,YAAA,EAAuC;AACvF,EAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,QAAA,EAAU,YAAY,CAAA;AAGzD,EAAA,MAAM,iBAAiB,QAAQ,CAAA;AAG/B,EAAA,MAAM,iBAAiB,QAAQ,CAAA;AAE/B,EAAA,MAAMC,eAAM,QAAA,EAAU,EAAE,WAAW,KAAA,EAAO,IAAA,EAAM,KAAO,CAAA;AACvD,EAAA,OAAO,QAAA;AACT;AAOA,eAAsB,cAAA,CAAe,SAAiB,SAAA,EAAkC;AACtF,EAAA,IAAI;AACF,IAAA,MAAMC,eAAA,CAAO,SAAS,SAAS,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI;AACF,MAAA,MAAMC,YAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAMA,eAAsB,cAAc,QAAA,EAAmC;AACrE,EAAA,MAAM,iBAAiB,QAAQ,CAAA;AAC/B,EAAA,MAAM,MAAA,GAAkBJ,mBAAA,CAAA,IAAA,CAAK,QAAA,EAAU,CAAA,KAAA,EAAQK,mBAAA,GAAa,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AAC1E,EAAA,OAAOC,iBAAQ,MAAM,CAAA;AACvB;;;AClKA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,OACE,IAAA,CAAK,SAAA;AAAA,IACH,KAAA;AAAA,IACA,CAAC,MAAM,GAAA,KAAQ;AACb,MAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,GAAA,KAAQ,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AAClE,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,KAAA,MAAW,KAAK,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA,CAAE,MAAK,EAAG;AAClE,UAAA,MAAA,CAAO,CAAC,CAAA,GAAK,GAAA,CAAgC,CAAC,CAAA;AAAA,QAChD;AACA,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF,GAAI,IAAA;AAER;AAKA,SAASC,iBAAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUV,uBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,uBAAgB,SAAS,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAKA,SAAS,kBAAA,GAA6B;AACpC,EAAA,MAAM,EAAA,GAAA,qBAAS,IAAA,EAAK,EAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,GAAG,CAAA;AACxD,EAAA,MAAM,IAAA,GAAOQ,mBAAAA,EAAW,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA;AACpC,EAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC7B;AAEA,eAAsB,mBACpB,MAAA,EACwB;AACxB,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,oBAAA,EAAsB,MAAM,CAAA;AACpE,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,2BAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,sEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,OAAO,mBAAA,EAAqB;AAC7D,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA,CAAA;AAAA,MAC7G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,GAAG,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA;AAAA,OAClG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,iBAAA,GAAoB,CAAA;AACxB,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,QAAA,EAAU;AAC9B,IAAA,iBAAA,IAAqB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,MAAA;AAAA,EACnD;AACA,EAAA,IAAI,iBAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AACtD,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,oCAAA,EAAuC,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA,CAAA;AAAA,MACjH,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,oBAAA,EAAuB,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OACtG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,WAAA,IAAe,kBAAA,EAAmB;AAC3D,EAAA,IAAI;AACF,IAAA,kBAAA,CAAmB,UAAU,CAAA;AAAA,EAC/B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACjF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,sBAAA;AAAA,QACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,OAC1D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAcE,iBAAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AAEF,IAAA,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAS,CAAA;AAG/C,IAAA,MAAM,WAAA,GAAcC,aAAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAC5C,IAAA,MAAMN,cAAAA,CAAM,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AASxC,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,IAAI,UAAA,GAAa,CAAA;AAIjB,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,IAAA,MAAM,gBAA0B,EAAC;AAEjC,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAE9C,MAAA,IAAI,MAAA,CAAO,QAAQ,OAAA,EAAS;AAC1B,QAAA,MAAM,IAAI,cAAA,CAAe,iBAAA,EAAmB,0CAA0C,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA;AAC5B,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AACzC,MAAA,MAAM,IAAA,GAAO,MAAMO,gBAAA,CAAU,IAAI,CAAA;AAEjC,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1B,MAAA,UAAA,CAAW,IAAI,IAAI,CAAA;AACnB,MAAA,aAAA,CAAc,KAAK,IAAI,CAAA;AAIvB,MAAA,MAAM,QAAA,GAAW,GAAG,IAAI,CAAA,IAAA,CAAA;AACxB,MAAA,MAAM,QAAA,GAAWD,aAAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAC3C,MAAA,MAAME,mBAAU,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAC/C,MAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,QACX,KAAA,EAAO,CAAA;AAAA,QACP,IAAA,EAAM,YAAY,QAAQ,CAAA,CAAA;AAAA,QAC1B,MAAA,EAAQ,IAAA;AAAA,QACR,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AACD,MAAA,UAAA,IAAc,IAAA,CAAK,MAAA;AAAA,IACrB;AAMA,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,MAAA,CAAO,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AAIvD,IAAA,MAAM,YAAA,GAAe,CAAC,GAAG,aAAa,EAAE,IAAA,EAAK;AAC7C,IAAA,MAAM,aAAA,GAAgB,GAAG,OAAA,CAAQ,UAAU,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AACrE,IAAA,MAAM,QAAA,GAAW,MAAMD,gBAAA,CAAU,IAAI,aAAY,CAAE,MAAA,CAAO,aAAa,CAAC,CAAA;AAExE,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,SAAA,EAAW,QAAA;AAAA,MACX,YAAA,EAAc,cAAA;AAAA,MACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MACnC,aAAa,OAAA,CAAQ,UAAA;AAAA,MACrB,eAAe,OAAA,CAAQ,MAAA;AAAA,MACvB,QAAA,EAAU,OAAA;AAAA,MACV,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC,KACvD;AAGA,IAAA,MAAM,YAAA,GAAe,oBAAoB,QAAQ,CAAA;AACjD,IAAA,MAAMC,kBAAA,CAAUF,cAAK,OAAA,EAAS,eAAe,GAAG,YAAA,EAAc,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,YAAY,CAAA;AAC3D,IAAA,MAAM,cAAA,GAAiB,MAAMC,gBAAA,CAAU,aAAa,CAAA;AAMpD,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AACjD,IAAA,MAAM,cAAc,MAAME,WAAA;AAAA,MACxB,iBAAA;AAAA,MACA,QAAQ,SAAA,CAAU,UAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACpB;AACA,IAAA,MAAMD,kBAAA,CAAUF,cAAK,OAAA,EAAS,cAAc,GAAG,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC3E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,WAAW,CAAA,CAAE,MAAA;AAGpD,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,GAAS,CAAA;AAGnC,IAAA,MAAM,SAAA,GAAYA,aAAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,UAAU,CAAA;AAGpD,IAAA,IAAI;AACF,MAAA,MAAMI,cAAK,SAAS,CAAA;AAEpB,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uDAAuD,UAAU,CAAA,CAAA;AAAA,QACvE,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,qBAAA;AAAA,UACN,OAAA,EAAS,+BAA+B,UAAU,CAAA;AAAA,SACpD;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,CAAe,SAAS,SAAS,CAAA;AACvC,IAAA,OAAA,GAAU,KAAA,CAAA;AAEV,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,gBAAA,EAAmB,UAAU,CAAA,EAAA,EAAK,SAAS,WAAW,UAAU,CAAA,OAAA,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAMpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,QAAA;AAAA,QACA,UAAA,EAAY,UAAA;AAAA,QACZ,cAAc,OAAA,CAAQ,MAAA;AAAA,QACtB,SAAA;AAAA,QACA,UAAA;AAAA,QACA,WAAW,QAAA,CAAS,UAAA;AAAA,QACpB;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAI;AACF,QAAA,MAAMR,YAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,QAC5C,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,MAC5C,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACnUO,IAAM,iBAAA,GAAoBS,MAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,EAC/E,sBAAsBA,KAAA,CACnB,MAAA,GACA,QAAA,EAAS,CACT,SAAS,qDAAqD,CAAA;AAAA,EACjE,MAAMA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,+CAA+C,CAAA;AAAA,EACpF,QAAQA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,uCAAuC,CAAA;AAAA,EAC9E,UAAUA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC;AACpF,CAAC,CAAA;AAID,IAAM,UAAA,GAAaA,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,WAAA,GAAcA,MAAE,MAAA,CAAO;AAAA,EAC3B,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,MAAA,EAAQA,MAAE,OAAA,EAAQ;AAAA,EAClB,OAAA,EAASA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAO,UAAA;AAAA,EACP,EAAA,EAAIA,MAAE,OAAA,EAAQ;AAAA,EACd,IAAA,EAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAASA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAASA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAQA,KAAA,CAAE,KAAA,CAAM,WAAW,CAAA;AAAA,EAC3B,aAAA,EAAeA,KAAA,CAAE,MAAA,CAAOA,KAAA,CAAE,MAAA,IAAUA,KAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC,CAAA;AClCM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sCAAsC,CAAA;AAAA,EAC/D,WAAA,EAAaA,KAAAA,CACV,OAAA,EAAQ,CACR,QAAA,GACA,OAAA,CAAQ,KAAK,CAAA,CACb,QAAA,CAAS,yDAAyD;AACvE,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,mBAAA,GAAsBA,MAAE,MAAA,CAAO;AAAA,EAC1C,KAAA,EAAOC,WAAAA;AAAA,EACP,MAAA,EAAQD,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,WAAA,EAAaA,MAAE,MAAA,CAAO;AAAA,IACpB,OAAA,EAASA,MAAE,MAAA,EAAO;AAAA,IAClB,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC5B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,GAChC,CAAA;AAAA,EACD,WAAA,EAAaA,KAAAA,CAAE,MAAA,CAAOA,KAAAA,CAAE,MAAA,IAAUA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EACxD,QAAA,EAAUA,MAAE,OAAA,EAAQ;AAAA,EACpB,QAAA,EAAUA,KAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;AC/BM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qCAAqC;AAChE,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOC,WAAAA;AAAA,EACP,MAAA,EAAQD,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,OAAA,EAASA,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACzC,QAAA,EAAUA,KAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;ACbM,IAAM,gBAAA,GAAmBA,MAAE,MAAA,CAAO;AAAA,EACvC,IAAA,EAAMA,MACH,IAAA,CAAK,CAAC,YAAY,WAAW,CAAC,CAAA,CAC9B,QAAA,CAAS,gFAAgF,CAAA;AAAA,EAC5F,IAAA,EAAMA,MACH,MAAA,EAAO,CACP,IAAI,CAAC,CAAA,CACL,GAAA,CAAI,GAAG,CAAA,CACP,MAAA;AAAA,IACC,CAAC,MACC,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,IACrB,2DAAA,CAA4D,KAAK,CAAC,CAAA;AAAA,IACpE;AAAA,MACE,OAAA,EACE;AAAA;AACJ,GACF,CACC,SAAS,mFAAmF,CAAA;AAAA,EAC/F,GAAA,EAAKA,KAAAA,CACF,MAAA,EAAO,CACP,GAAA,CAAI,IAAI,CAAA,CACR,QAAA,EAAS,CACT,QAAA,CAAS,qDAAqD,CAAA;AAAA,EACjE,SAASA,KAAAA,CACN,KAAA;AAAA,IACCA,MAAE,IAAA,CAAK;AAAA,MACL,QAAA;AAAA,MACA,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,SAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH,CACC,UAAS,CACT,MAAA;AAAA,IACC,CAAC,GAAA,KACC,CAAC,GAAA,IAAQ,IAAI,IAAI,GAAG,CAAA,CAAE,IAAA,KAAS,GAAA,CAAI,MAAA,IAAU,CAAC,GAAG,GAAG,CAAA,CAAE,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAG,CAAA,KAAM,CAAA,KAAM,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC3F,EAAE,SAAS,6CAAA;AAA8C,GAC3D,CACC,SAAS,mEAAmE,CAAA;AAAA,EAC/E,aAAaA,KAAAA,CACV,MAAA,EAAO,CACP,QAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,KAAK,CAAC,KAAA,CAAM,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AAAA,IAC1C,OAAA,EAAS;AAAA,GACV,CAAA,CACA,QAAA,CAAS,mEAAmE,CAAA;AAAA,EAC/E,UAAA,EAAYA,KAAAA,CACT,MAAA,CAAOA,KAAAA,CAAE,MAAA,EAAO,EAAGA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,kDAAkD,CAAA;AAAA,EAC9D,MAAA,EAAQA,MACL,MAAA,CAAO;AAAA,IACN,GAAA,EAAKA,MACF,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,IAAI,CAAA,CACR,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG,EAAE,SAAS,2BAAA,EAA6B,CAAA,CAChF,QAAA,CAAS,kCAAkC,CAAA;AAAA,IAC9C,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gBAAgB,CAAA;AAAA,IACjE,MAAA,EAAQA,KAAAA,CACL,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,CAAA,CAC7B,QAAA,EAAS,CACT,QAAA,CAAS,yCAAyC;AAAA,GACtD,CAAA,CACA,QAAA,EAAS,CACT,SAAS,sBAAsB,CAAA;AAAA,EAClC,WAAA,EAAaA,KAAAA,CACV,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,QAAA,EAAS,CACT,QAAA,EAAS,CACT,QAAA,CAAS,2DAA2D;AACzE,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsBA,MAAE,MAAA,CAAO;AAAA,EACnC,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAASA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AAC/B,CAAC,CAAA;AAEM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,KAAA,EAAOC,WAAAA;AAAA,EACP,EAAA,EAAID,MAAE,OAAA,EAAQ;AAAA,EACd,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,aAAA,EAAe;AACjB,CAAC,CAAA;AC5GM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,UAAUA,KAAAA,CACP,KAAA,CAAMA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,KAAM,CAAC,CAAA,CAC5B,IAAI,CAAC,CAAA,CACL,IAAI,GAAG,CAAA,CACP,SAAS,uCAAuC,CAAA;AAAA,EACnD,QAAA,EAAUA,KAAAA,CACP,MAAA,CAAOA,KAAAA,CAAE,MAAA,EAAO,EAAGA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,8CAA8C,CAAA;AAAA,EAC1D,WAAA,EAAaA,KAAAA,CACV,MAAA,EAAO,CACP,GAAA,CAAI,GAAG,CAAA,CACP,QAAA,EAAS,CACT,QAAA,CAAS,4DAA4D;AAC1E,CAAC,CAAA;AAID,IAAMC,WAAAA,GAAaD,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOC,WAAAA;AAAA,EACP,EAAA,EAAID,MAAE,OAAA,EAAQ;AAAA,EACd,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,EACvB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,cAAA,EAAgBA,MAAE,MAAA;AACpB,CAAC,CAAA;;;ACHD,SAAS,QAAA,CAAS,KAAoB,UAAA,EAA6C;AACjF,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,eAAe,GAAA,CAAI,OAAA;AAAA,IACnB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,iBAAA,EAAmB;AAAA,GACrB;AACF;AAEA,SAAS,6BAAA,CACP,QACA,IAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAiB,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AAAA,IACtD,mBAAmB,EAAE,KAAA,EAAO,IAAA,EAAM,GAAG,OAAO,UAAA,EAAW;AAAA,IACvD,SAAS,MAAA,CAAO;AAAA,GAClB;AACF;AAEA,IAAM,qBAAA,GAAyC;AAAA,EAC7C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,IAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAMA,IAAM,sBAAA,GAA0C;AAAA,EAC9C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,uBAAA,GAA2C;AAAA,EAC/C,YAAA,EAAc,KAAA;AAAA,EACd,eAAA,EAAiB,IAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,eAAA,GAAkB,EAAA;AAGxB,IAAM,uBAAA,GAA0B,IAAA;AAEhC,SAAS,mBAAA,CACP,IAAA,EACA,IAAA,EACA,OAAA,EACgB;AAChB,EAAA,MAAM,QAAA,GAAWE,cAAO,IAAI,CAAA;AAC5B,EAAA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,MAAA,EAAiB,IAAA,EAAM,SAAS,CAAA;AAAA,IAClD,iBAAA,EAAmB;AAAA,MACjB,KAAA,EAAO,IAAA;AAAA,MACP,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,UAAU,SAAA,IAAa,KAAA;AAAA,MAClC,WAAA,EAAa,UAAU,WAAA,IAAe;AAAA,KACxC;AAAA,IACA,OAAA,EAAS;AAAA,GACX;AACF;AA2BO,SAAS,oBAAoB,OAAA,EAAmC;AACrE,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAQ,GAAI,OAAA;AAGrC,EAAA,MAAM,eAAA,GAAkB,CAAC,aAAA,EAAe,cAAA,EAAgB,aAAa,CAAA;AACrE,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,eAAA,CAAgB,KAAK,YAAY,CAAA;AACjC,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,eAAA,CAAgB,KAAK,oBAAoB,CAAA;AAAA,IAC3C;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,EAAE,GAAG,SAAS,OAAA,EAAS,WAAW,GAAG,eAAA,EAAgB;AAClE,EAAA,MAAM,cAAA,GAAiB,OAAO,MAAA,CAAO,eAAA;AACrC,EAAA,IAAI,cAAA,GAAiB,CAAA;AAErB,EAAA,eAAe,WAAA,CACb,QAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACyB;AAEzB,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,yBAAA;AAAA,QACA,uBAAuB,cAAc,CAAA,qBAAA;AAAA,OACvC;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,EAAM,eAAe,CAAA,EAAG;AAC5C,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,sBAAA;AAAA,QACA,0CAA0C,eAAe,CAAA;AAAA,OAC3D;AAAA,IACF;AAGA,IAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,IAAA,EAAM,MAAM,CAAA;AACpD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,OAAO,6BAAA,CAA8B,iBAAiB,IAAI,CAAA;AAAA,IAC5D;AAcA,IAAA,cAAA,EAAA;AACA,IAAA,MAAM,cAAA,GAAiB,UAAU,MAAM,CAAA;AAIvC,IAAA,KAAK,cAAA,CACF,QAAQ,MAAM;AACb,MAAA,cAAA,EAAA;AAAA,IACF,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAKjB,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC9D,MAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,MAAA,CAAO,IAAI,MAAM,CAAA,MAAA,EAAS,QAAQ,qBAAqB,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,EAAA,CAAI,CAAC,CAAA;AAAA,MAC3F,CAAA,EAAG,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA;AAEhC,MAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,IAChB,CAAC,CAAA;AAGD,IAAA,MAAM,gBAAA,GAA6C,CAAC,cAAA,EAAgB,cAAc,CAAA;AAElF,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,EAAS;AAC7B,MAAA,MAAM,aAAA,GAAgB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC7D,QAAA,MAAM,UAAU,MAAM;AACpB,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,mBAAmB,CAAC,CAAA;AAAA,QACvC,CAAA;AACA,QAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AACxD,QAAA,YAAA,GAAe,MAAM,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,MAClE,CAAC,CAAA;AACD,MAAA,gBAAA,CAAiB,KAAK,aAAa,CAAA;AAAA,IACrC;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,gBAAgB,CAAA;AAOlD,MAAA,MAAM,UAAA,GAAa,6BAAA,CAA8B,MAAA,EAAQ,IAAI,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,qBAAqB,UAAU,CAAA;AACnD,MAAA,IAAI,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,kBAAA,EAAoB;AAClD,QAAA,OAAO,mBAAA;AAAA,UACL,IAAA;AAAA,UACA,wBAAA;AAAA,UACA,CAAA,YAAA,EAAe,WAAW,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,kBAAkB,CAAA;AAAA,SAC1F;AAAA,MACF;AAEA,MAAA,OAAO,UAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,MACzE;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,oBAAA,EAAsB,OAAO,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,gBAAA,EAAkB,OAAO,CAAA;AAAA,IAC5D,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,YAAA,IAAe;AAAA,IACjB;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,IAAIC,gBAAA;AAAA,IACjB,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAQ;AAAA;AAAA;AAAA,IAG7B;AAAA,MACE,cAAc,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,OAAM,EAAE;AAAA,MAC9C,oBAAA,EAAsB;AAAA;AACxB,GACF;AAGA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,MAAM,CAAA;AAGhD,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,mIAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,cAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EACE,8HAAA;AAAA,MACF,WAAA,EAAa,kBAAA;AAAA,MACb,YAAA,EAAc,mBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,cAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,aAAA,CAAc,EAAE,OAAO,IAAA,EAAsB,MAAwB,CAAC,CAAA;AAAA,MACjF,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,yHAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAwB,CAAC,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAKA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,QAAA;AAAA,MACE,YAAA;AAAA,MACA;AAAA,QACE,KAAA,EAAO,6BAAA;AAAA,QACP,WAAA,EACE,iPAAA;AAAA,QACF,WAAA,EAAa,gBAAA;AAAA,QACb,YAAA,EAAc,iBAAA;AAAA,QACd,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,QACE,YAAA;AAAA,QACA,IAAA;AAAA,QACA,CAAC,WAAW,WAAA,CAAY,EAAE,OAAO,IAAA,EAAoB,MAAA,EAAQ,OAAgB,CAAC,CAAA;AAAA,QAC7E,KAAA,CAAmC;AAAA;AACtC,KACJ;AAGA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,QAAA;AAAA,QACE,oBAAA;AAAA,QACA;AAAA,UACE,KAAA,EAAO,wBAAA;AAAA,UACP,WAAA,EACE,6JAAA;AAAA,UACF,WAAA,EAAa,iBAAA;AAAA,UACb,YAAA,EAAc,kBAAA;AAAA,UACd,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,UACE,oBAAA;AAAA,UACA,IAAA;AAAA,UACA,CAAC,WAAW,kBAAA,CAAmB,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,UACrF,KAAA,CAAmC;AAAA;AACtC,OACJ;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AChYA,IAAM,gBAAA,GAAmBH,MAAE,MAAA,CAAO;AAAA,EAChC,OAAA,EAASA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACjC,eAAeA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AACrC,CAAC,CAAA;AAED,IAAM,eAAA,GAAkBA,MAAE,MAAA,CAAO;AAAA,EAC/B,cAAA,EAAgBA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACzC,aAAA,EAAeA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,mBAAA,EAAqBA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AAChD,CAAC,CAAA;AAED,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EAC5B,aAAA,EAAeA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EACzD,kBAAA,EAAoBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EAC9D,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAM,CAAA;AAAA,EAC3D,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EACvD,gBAAA,EAAkBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAO,CAAA;AAAA,EAC7D,mBAAA,EAAqBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EAC5D,gBAAA,EAAkBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,QAAU,CAAA;AAAA,EAChE,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM;AAC7D,CAAC,CAAA;AAKD,IAAM,gBAAA,GAAmBA,MAAE,MAAA,CAAO;AAAA,EAChC,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EACnC,OAAA,EAASA,KAAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EACtB,aAAA,EAAeA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,SAAA,EAAW,eAAA,CAAgB,QAAA,CAAS,EAAE,CAAA;AAAA,EACtC,KAAA,EAAOA,KAAAA,CAAE,MAAA,CAAOA,KAAAA,CAAE,MAAA,IAAU,gBAAgB,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAAA,EACzD,MAAA,EAAQ,YAAA,CAAa,QAAA,CAAS,EAAE,CAAA;AAAA,EAChC,IAAA,EAAM,iBAAiB,QAAA;AACzB,CAAC,CAAA;AAID,IAAM,cAAA,GAA+B;AAAA,EACnC,OAAA,EAAS,GAAA;AAAA,EACT,aAAA,EAAe,KAAA;AAAA,EACf,WAAW,EAAE,cAAA,EAAgB,OAAO,aAAA,EAAe,KAAA,EAAO,qBAAqB,KAAA,EAAM;AAAA,EACrF,OAAO,EAAC;AAAA,EACR,MAAA,EAAQ;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,kBAAA,EAAoB,KAAA;AAAA,IACpB,eAAA,EAAiB,GAAA;AAAA,IACjB,eAAA,EAAiB,EAAA;AAAA,IACjB,gBAAA,EAAkB,MAAA;AAAA,IAClB,mBAAA,EAAqB,GAAA;AAAA,IACrB,gBAAA,EAAkB,QAAA;AAAA,IAClB,eAAA,EAAiB;AAAA;AAErB,CAAA;AAEO,SAAS,gBAAA,GAAiC;AAC/C,EAAA,OAAO,gBAAgB,cAAc,CAAA;AACvC;AAOA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/C,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,CAAI,mBAAmB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EAC1D;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA,GAAI,GAAA,GAAM,mBAAA,CAAoB,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,OAAO,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AACjC;AAQA,eAAsB,kBAAkB,KAAA,EAA+C;AACrF,EAAA,MAAM,YAAY,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,oBAAoB,KAAK,CAAA;AAC/E,EAAA,OAAOJ,iBAAU,SAAS,CAAA;AAC5B;AAEA,eAAsB,WACpB,QAAA,EACiD;AACjD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMnB,iBAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,4BAAA,EAA+B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,MAAMsB,aAAAA,CAAK,QAAQ,CAAA;AAC7B,IAAA,IAAI,CAAA,CAAE,OAAO,CAAA,EAAO;AAClB,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,0CAA0C,QAAQ,CAAA;AAAA;AAAA,OACpD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,gBAAgB,CAAA,+BAAA,EAAkC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACxF;AAEA,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OAAO,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAC5F,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,MAAA,CAAO,IAAI,CAAA;AAChD,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,IAAA,EAAK;AACrC;ACnHA,eAAsB,cAAc,SAAA,EAAuC;AACzE,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,MAAM,CAAA,EAAG;AAChC,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACpC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,qBAAA,EAAwB,OAAO,CAAA,oBAAA,CAAsB,CAAA;AAAA,IAC9E;AACA,IAAA,GAAA,GAAM,QAAA;AAAA,EACR,CAAA,MAAA,IAAW,SAAA,CAAU,UAAA,CAAW,OAAO,CAAA,EAAG;AACxC,IAAA,MAAM,QAAA,GAAW,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AAClC,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAMtB,iBAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,IACxC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,CAAA,yBAAA,EAA4B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,QAC3F,EAAE,OAAO,GAAA;AAAI,OACf;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,2BAA2B,SAAS,CAAA,sCAAA;AAAA,KACtC;AAAA,EACF;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,4BAAA,EAA8B,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACrE;AAGA,EAAA,IACE,OAAO,GAAA,KAAQ,QAAA,IACf,GAAA,KAAQ,IAAA,IACR,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,OAAO,GAAA,CAAA,EACT;AACA,IAAA,MAAM,IAAI,aAAa,yCAAyC,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC1C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,sDAAA,EAAyD,OAAO,CAAA,CAAE,GAAG,CAAC,CAAA,KAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AAEA,EAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,YAAY,OAAO,CAAA,CAAE,MAAM,QAAA,EAAU;AACtD,IAAA,MAAM,IAAI,aAAa,8CAA8C,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,UAAA,GAAgC;AAAA,IACpC,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,GAAG,CAAA,CAAE,CAAA;AAAA,IACL,GAAG,CAAA,CAAE;AAAA,GACP;AAGA,EAAA,MAAM,KAAA,GAAQ,MAAM2B,sBAAA,CAAgB,UAAU,CAAA;AAC9C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAa,uDAAuD,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,UAAA,GAAa1B,sBAAAA,CAAgB,UAAA,CAAW,CAAC,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAM2B,sBAAA,CAAgB,UAAU,CAAA;AAIlD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC7B,IAAA,GAAA,GAAM,CAAA,CAAE,GAAA;AAAA,EACV,CAAA,MAAO;AACL,IAAA,MAAM,MAAA,GAASrB,uBAAgB,SAAS,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,MAAMY,gBAAAA,CAAU,MAAM,CAAA;AACnC,IAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,EAAE,UAAA,EAAY,SAAA,EAAW,GAAA,EAAI;AACtC;;;AC5FA,IAAM,cAAA,GAAiB,IAAI,IAAA,GAAO,IAAA;AAE3B,SAAS,kBAAA,GAAiC;AAC/C,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,QAAQ,MAAM,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,WAAA,GAAc,CAAA;AAElB,EAAA,SAAS,oBAAoB,IAAA,EAAoB;AAE/C,IAAA,MAAM,YAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,YAAY,cAAA,EAAgB;AAC9B,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sBAAA,EAAyB,SAAS,CAAA,2BAAA,EAA8B,cAAc,CAAA;AAAA,OAChF;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sCAAA,EAAyC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OAC7D;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,MAAA;AAEZ,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACzB,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAIA,IAAA,MAAM,QAAQ,IAAA,IAAQ,GAAA;AACtB,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAC9B,IAAA,MAAM,WAAW,OAAA,IAAW,GAAA;AAC5B,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAE9B,IAAA,IAAI,KAAA,KAAU,aAAa,QAAA,CAAA,EAAW;AAEpC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,IAAa,CAAC,KAAA,EAAO;AAEvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,8BAAA;AAAA,MACA,CAAA,kFAAA,EAAqF,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KACzG;AAAA,EACF;AAEA,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAE/B,IAAA,MAAA,GAAS,MAAM,GAAA,EAAI;AACnB,IAAA,WAAA,GAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA;AAE/C,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,MAAA,mBAAA,CAAoB,OAAO,CAAA;AAAA,IAC7B;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,SACnB,KAAA,EACA,kBAAA,EACA,QAAA,EACS;AAET,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,EAAA;AAEJ,IAAA,IAAI,OAAO,uBAAuB,UAAA,EAAY;AAC5C,MAAA,EAAA,GAAK,kBAAA;AAAA,IACP,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,kBAAA;AACX,MAAA,EAAA,GAAK,QAAA;AAAA,IACP;AAGA,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAI9E,IAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,WAAA,GAAc,aAAa,cAAA,EAAgB;AAC7C,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,iCAAiC,cAAc,CAAA,wBAAA;AAAA,OACjD;AAAA,IACF;AAEA,IAAA,MAAA,IAAU,GAAA;AACV,IAAA,WAAA,IAAe,UAAA;AACf,IAAA,aAAA,EAAc;AAGd,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,aAAA,CAAc,KAAA,EAAO,QAAA,EAAU,EAAE,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,aAAA,CAAc,OAAO,EAAmB,CAAA;AAAA,EACjD,CAAA;AAEA,EAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,YAAA;AAGvB,EAAA,OAAO,SAAS,QAAA,GAAiB;AAE/B,IAAA,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,mBAAA,CAAoB,MAAA,CAAO,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,MAAA,GAAS,EAAA;AACT,IAAA,WAAA,GAAc,CAAA;AACd,IAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,aAAA;AAAA,EACzB,CAAA;AACF","file":"index.cjs","sourcesContent":["/**\n * MCP Server constants -- zero imports\n */\n\nexport const SERVER_NAME = 'peac-mcp-server';\nexport const SERVER_VERSION = '0.16.5';\nexport const MCP_PROTOCOL_VERSION = '2025-11-25';\nexport const DEFAULT_MAX_JWS_BYTES = 16_384; // 16 KB\nexport const DEFAULT_MAX_RESPONSE_BYTES = 65_536; // 64 KB\nexport const DEFAULT_TOOL_TIMEOUT_MS = 30_000; // 30 s\nexport const DEFAULT_MAX_CLAIMS_BYTES = 262_144; // 256 KB\nexport const DEFAULT_MAX_BUNDLE_RECEIPTS = 256;\nexport const DEFAULT_MAX_BUNDLE_BYTES = 16_777_216; // 16 MB\nexport const DEFAULT_MAX_TTL_SECONDS = 86_400; // 24 hours\n\n// HTTP transport defaults\nexport const DEFAULT_HTTP_PORT = 3000;\nexport const DEFAULT_HTTP_HOST = '127.0.0.1'; // localhost only; 0.0.0.0 requires explicit opt-in\nexport const DEFAULT_MAX_REQUEST_BYTES = 1_048_576; // 1 MB\nexport const DEFAULT_RATE_LIMIT_RPM = 100;\nexport const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000; // 30 min\nexport const DEFAULT_MAX_SESSIONS = 100;\n","/**\n * MCP Server error hierarchy -- zero external imports\n *\n * Error codes use the E_MCP_* taxonomy for MCP-server-specific errors.\n * Protocol errors (E_INVALID_SIGNATURE, etc.) are passed through as nested detail.\n */\n\nexport type McpServerErrorCode =\n  | 'E_MCP_KEY_LOAD'\n  | 'E_MCP_POLICY_LOAD'\n  | 'E_MCP_JWKS_LOAD'\n  | 'E_MCP_INPUT_TOO_LARGE'\n  | 'E_MCP_OUTPUT_TOO_LARGE'\n  | 'E_MCP_TOOL_DISABLED'\n  | 'E_MCP_TOOL_TIMEOUT'\n  | 'E_MCP_KEY_RESOLUTION'\n  | 'E_MCP_KID_REQUIRED'\n  | 'E_MCP_JWKS_NO_MATCH'\n  | 'E_MCP_INVALID_INPUT'\n  | 'E_MCP_HANDLER_ERROR'\n  | 'E_MCP_STDOUT_FENCE_VIOLATION'\n  | 'E_MCP_KEY_REQUIRED'\n  | 'E_MCP_ISSUE_FAILED'\n  | 'E_MCP_BUNDLE_FAILED'\n  | 'E_MCP_PATH_TRAVERSAL'\n  | 'E_MCP_BUNDLE_DIR_REQUIRED'\n  | 'E_MCP_CANCELLED';\n\nexport class McpServerError extends Error {\n  readonly code: McpServerErrorCode;\n\n  constructor(code: McpServerErrorCode, message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'McpServerError';\n    this.code = code;\n  }\n}\n\nexport class KeyLoadError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_KEY_LOAD', message, options);\n    this.name = 'KeyLoadError';\n  }\n}\n\nexport class PolicyLoadError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_POLICY_LOAD', message, options);\n    this.name = 'PolicyLoadError';\n  }\n}\n\nexport class JwksLoadError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_JWKS_LOAD', message, options);\n    this.name = 'JwksLoadError';\n  }\n}\n\nexport class IssueToolError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_ISSUE_FAILED', message, options);\n    this.name = 'IssueToolError';\n  }\n}\n\nexport class BundleToolError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_BUNDLE_FAILED', message, options);\n    this.name = 'BundleToolError';\n  }\n}\n\nexport class PathTraversalError extends McpServerError {\n  constructor(message: string, options?: ErrorOptions) {\n    super('E_MCP_PATH_TRAVERSAL', message, options);\n    this.name = 'PathTraversalError';\n  }\n}\n\n/**\n * Strip key-like material from output strings (Trust Gate 1 helper).\n *\n * Replaces matches of each pattern with `[REDACTED]`.\n */\nexport function sanitizeOutput(text: string, sensitivePatterns: RegExp[]): string {\n  let result = text;\n  for (const pattern of sensitivePatterns) {\n    result = result.replace(pattern, '[REDACTED]');\n  }\n  return result;\n}\n","/**\n * JWKS file loader for verifier-side key resolution\n *\n * Loads a local JWKS JSON file, filters for Ed25519 keys,\n * and provides kid-based lookup.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { base64urlDecode } from '@peac/crypto';\nimport { JwksLoadError } from './errors.js';\n\nexport interface JwksKeyEntry {\n  kid: string;\n  publicKey: Uint8Array;\n}\n\nexport async function loadJwksFile(filePath: string): Promise<JwksKeyEntry[]> {\n  let raw: string;\n  try {\n    raw = await readFile(filePath, 'utf-8');\n  } catch (err) {\n    throw new JwksLoadError(\n      `Failed to read JWKS file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n      { cause: err }\n    );\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new JwksLoadError(`JWKS file is not valid JSON: ${filePath}`, { cause: err });\n  }\n\n  if (typeof parsed !== 'object' || parsed === null || !('keys' in parsed)) {\n    throw new JwksLoadError('JWKS must contain a \"keys\" array');\n  }\n\n  const jwks = parsed as { keys: unknown[] };\n  if (!Array.isArray(jwks.keys)) {\n    throw new JwksLoadError('JWKS \"keys\" must be an array');\n  }\n\n  const entries: JwksKeyEntry[] = [];\n  for (const key of jwks.keys) {\n    if (typeof key !== 'object' || key === null) continue;\n    const k = key as Record<string, unknown>;\n\n    // Filter for Ed25519 only (reject non-EdDSA alg values)\n    if (k.kty !== 'OKP' || k.crv !== 'Ed25519') continue;\n    if (typeof k.x !== 'string') continue;\n    if (k.alg !== undefined && k.alg !== 'EdDSA') continue;\n\n    const kid = typeof k.kid === 'string' ? k.kid : `key-${entries.length}`;\n    try {\n      const publicKey = base64urlDecode(k.x);\n      if (publicKey.length === 32) {\n        entries.push({ kid, publicKey });\n      }\n    } catch {\n      // Skip keys with invalid base64url encoding\n    }\n  }\n\n  return entries;\n}\n\nexport function resolveKeyByKid(keys: JwksKeyEntry[], kid: string): Uint8Array | undefined {\n  const entry = keys.find((k) => k.kid === kid);\n  return entry?.publicKey;\n}\n","/**\n * Handler guards -- enforces policy limits and tool enablement\n *\n * ZERO MCP SDK imports.\n */\n\nimport type { PolicyConfig } from '../infra/policy.js';\nimport type { HandlerResult } from './types.js';\n\n/**\n * Check if the JWS input exceeds the configured max size.\n * Returns an error result if too large, undefined if OK.\n */\nexport function checkJwsSize(jws: string, policy: PolicyConfig): HandlerResult | undefined {\n  const byteLength = new TextEncoder().encode(jws).length;\n  if (byteLength > policy.limits.max_jws_bytes) {\n    return {\n      text: `Input rejected: JWS is ${byteLength} bytes, exceeding limit of ${policy.limits.max_jws_bytes} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `JWS input is ${byteLength} bytes, limit is ${policy.limits.max_jws_bytes}`,\n      },\n      isError: true,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Check if the tool is enabled in policy.\n * Returns an error result if disabled, undefined if OK.\n */\nexport function checkToolEnabled(\n  toolName: string,\n  policy: PolicyConfig\n): HandlerResult | undefined {\n  const toolConfig = policy.tools[toolName];\n  if (toolConfig && toolConfig.enabled === false) {\n    return {\n      text: `Tool \"${toolName}\" is disabled by server policy`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_TOOL_DISABLED',\n        message: `Tool \"${toolName}\" is disabled by server policy`,\n      },\n      isError: true,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Recursively sum byte lengths of all string values in an object graph.\n * Depth is bounded by checkObjectDepth (called first in wrapHandler).\n * Uses a WeakSet to guard against cyclic references.\n */\nfunction sumStringBytes(value: unknown, seen?: WeakSet<object>): number {\n  if (typeof value === 'string') {\n    return new TextEncoder().encode(value).length;\n  }\n  if (typeof value !== 'object' || value === null) return 0;\n\n  // Cycle guard: skip objects we've already visited\n  const visited = seen ?? new WeakSet<object>();\n  if (visited.has(value as object)) return 0;\n  visited.add(value as object);\n\n  if (Array.isArray(value)) {\n    let total = 0;\n    for (const item of value) {\n      total += sumStringBytes(item, visited);\n    }\n    return total;\n  }\n  let total = 0;\n  for (const v of Object.values(value as Record<string, unknown>)) {\n    total += sumStringBytes(v, visited);\n  }\n  return total;\n}\n\n/**\n * Bounded serialized-size estimator. Walks the object graph and estimates\n * JSON serialized bytes WITHOUT materializing the full string. Aborts early\n * when the estimate exceeds the limit (returns Infinity). This prevents\n * memory exhaustion from adversarial inputs with many small non-string values\n * (e.g. large arrays of numbers) that would bypass string-only counting.\n *\n * Accuracy: conservative overestimate for numbers (uses String(n).length),\n * exact for strings (JSON.stringify escapes), exact for structural overhead.\n * Uses a WeakSet cycle guard consistent with sumStringBytes.\n */\nfunction estimateSerializedBytes(value: unknown, limit: number, seen?: WeakSet<object>): number {\n  if (value === null) return 4; // \"null\"\n  if (value === undefined) return 0; // omitted in JSON\n  if (typeof value === 'boolean') return value ? 4 : 5; // \"true\" / \"false\"\n  if (typeof value === 'number') return String(value).length;\n  if (typeof value === 'string') return Buffer.byteLength(JSON.stringify(value), 'utf8');\n\n  if (typeof value !== 'object') return 0;\n\n  const visited = seen ?? new WeakSet<object>();\n  if (visited.has(value as object)) return 0;\n  visited.add(value as object);\n\n  let total = 2; // {} or []\n\n  if (Array.isArray(value)) {\n    for (let i = 0; i < value.length; i++) {\n      if (i > 0) total += 1; // comma\n      total += estimateSerializedBytes(value[i], limit, visited);\n      if (total > limit) return Infinity; // early exit\n    }\n    return total;\n  }\n\n  const entries = Object.entries(value as Record<string, unknown>);\n  for (let i = 0; i < entries.length; i++) {\n    if (i > 0) total += 1; // comma\n    const [k, v] = entries[i];\n    total += Buffer.byteLength(JSON.stringify(k), 'utf8') + 1; // key + colon\n    total += estimateSerializedBytes(v, limit, visited);\n    if (total > limit) return Infinity; // early exit\n  }\n  return total;\n}\n\n/**\n * Check total input size across all string fields (recursive).\n * Prevents memory exhaustion from oversized jwks, public_key_base64url, etc.\n * Traverses the full object graph so nested payloads cannot bypass the limit.\n * Uses 2x max_jws_bytes as the total budget.\n *\n * Also applies a bounded serialized-size estimate (without materializing\n * the full JSON string) to catch large non-string structures like arrays\n * of numbers that bypass string-only counting.\n */\nexport function checkInputSizes(\n  input: Record<string, unknown>,\n  policy: PolicyConfig\n): HandlerResult | undefined {\n  const limit = policy.limits.max_jws_bytes * 2;\n\n  // Primary check: recursive string byte sum\n  const totalBytes = sumStringBytes(input);\n  if (totalBytes > limit) {\n    return {\n      text: `Input rejected: total input is ${totalBytes} bytes, exceeding limit of ${limit} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Total input is ${totalBytes} bytes, limit is ${limit}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Fallback: bounded serialized-size estimate catches large non-string structures\n  // without materializing the full JSON string (prevents allocation attacks)\n  const estimatedBytes = estimateSerializedBytes(input, limit);\n  if (estimatedBytes > limit) {\n    return {\n      text: `Input rejected: estimated serialized input exceeds limit of ${limit} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Estimated serialized input exceeds limit of ${limit} bytes`,\n      },\n      isError: true,\n    };\n  }\n\n  return undefined;\n}\n\n/**\n * Check that an object does not exceed maximum nesting depth.\n * Prevents stack overflow from deeply nested input params.\n */\nexport function checkObjectDepth(\n  obj: unknown,\n  maxDepth: number = 10,\n  currentDepth: number = 0\n): boolean {\n  if (currentDepth > maxDepth) return false;\n  if (typeof obj !== 'object' || obj === null) return true;\n  if (Array.isArray(obj)) {\n    return obj.every((item) => checkObjectDepth(item, maxDepth, currentDepth + 1));\n  }\n  return Object.values(obj as Record<string, unknown>).every((value) =>\n    checkObjectDepth(value, maxDepth, currentDepth + 1)\n  );\n}\n\n/**\n * Conservative placeholder id for envelope size estimation.\n * The MCP SDK does not expose the JSON-RPC request id to tool handlers,\n * so we budget for a typical UUID-length string id (36 chars + quotes = 38\n * bytes in JSON). This ensures the size cap is never underestimated due to\n * a longer-than-expected id from the client.\n */\nconst CONSERVATIVE_ID_PLACEHOLDER = '00000000-0000-0000-0000-000000000000';\n\n/**\n * Measure the byte length of a full JSON-RPC 2.0 response envelope.\n * This models the exact line that will be serialized to stdout by the\n * MCP SDK, including the request id and trailing newline.\n *\n * The +1 accounts for the line-feed delimiter that separates JSON-RPC\n * messages on the stdio transport.\n */\nexport function measureEnvelopeBytes(\n  callToolResult: {\n    content: unknown;\n    structuredContent?: unknown;\n    isError?: boolean;\n  },\n  id: string | number = CONSERVATIVE_ID_PLACEHOLDER\n): number {\n  const envelope = {\n    jsonrpc: '2.0',\n    id,\n    result: {\n      content: callToolResult.content,\n      structuredContent: callToolResult.structuredContent,\n      isError: callToolResult.isError,\n    },\n  };\n  return Buffer.byteLength(JSON.stringify(envelope), 'utf8') + 1; // +1 for \\n\n}\n\nexport interface TruncationResult {\n  text: string;\n  truncated: boolean;\n  originalBytes: number;\n  returnedBytes: number;\n}\n\nconst TRUNCATION_SUFFIX = '\\n\\n[TRUNCATED: response exceeded policy limit]';\nconst TRUNCATION_SUFFIX_BYTES = new TextEncoder().encode(TRUNCATION_SUFFIX).length;\n\n/**\n * Truncate response text to stay within max_response_bytes.\n * Guarantees the final byte length is <= maxBytes by computing the\n * suffix size exactly and slicing the body budget accordingly.\n * Returns truncation metadata for structured output signaling.\n */\nexport function truncateResponse(text: string, policy: PolicyConfig): TruncationResult {\n  const maxBytes = policy.limits.max_response_bytes;\n  const encoded = new TextEncoder().encode(text);\n  if (encoded.length <= maxBytes) {\n    return { text, truncated: false, originalBytes: encoded.length, returnedBytes: encoded.length };\n  }\n\n  // Budget for body = maxBytes - suffix bytes. If maxBytes is tiny,\n  // clamp to 0 so we still return the suffix as signal.\n  const bodyBudget = Math.max(0, maxBytes - TRUNCATION_SUFFIX_BYTES);\n  // Truncate at byte boundary, avoiding mid-character cuts via TextDecoder\n  const truncatedText = new TextDecoder().decode(encoded.slice(0, bodyBudget));\n  const finalText = truncatedText + TRUNCATION_SUFFIX;\n  const finalEncoded = new TextEncoder().encode(finalText);\n  return {\n    text: finalText,\n    truncated: true,\n    originalBytes: encoded.length,\n    returnedBytes: finalEncoded.length,\n  };\n}\n","/**\n * Verify handler -- ZERO MCP SDK imports\n *\n * Resolves key from input or context, delegates to verifyLocal.\n *\n * Append-only check name registry (stable contract):\n *   signature, schema, expiry, issuer_binding, audience_binding\n */\n\nimport { verifyLocal } from '@peac/protocol';\nimport { base64urlDecode, decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { VerifyInput } from '../schemas/verify.js';\nimport { resolveKeyByKid } from '../infra/jwks-loader.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nfunction resolvePublicKey(params: HandlerParams<VerifyInput>): {\n  publicKey: Uint8Array;\n  keySource: string;\n} {\n  const { input, context } = params;\n\n  // Priority 1: inline public key\n  if (input.public_key_base64url) {\n    return {\n      publicKey: base64urlDecode(input.public_key_base64url),\n      keySource: 'inline',\n    };\n  }\n\n  // Priority 2: inline JWKS\n  if (input.jwks) {\n    const jwks = JSON.parse(input.jwks) as { keys?: Array<Record<string, unknown>> };\n    if (!jwks.keys?.length) {\n      throw new Error('Provided JWKS contains no keys');\n    }\n\n    const { header } = decode(input.jws);\n    const kid = header.kid;\n\n    // Collect Ed25519 keys (reject non-EdDSA alg values)\n    const ed25519Keys = jwks.keys.filter(\n      (k) =>\n        k.kty === 'OKP' &&\n        k.crv === 'Ed25519' &&\n        typeof k.x === 'string' &&\n        (k.alg === undefined || k.alg === 'EdDSA')\n    );\n\n    if (ed25519Keys.length === 0) {\n      throw new Error('Provided JWKS contains no Ed25519 keys');\n    }\n\n    // If kid present, match by kid\n    if (kid) {\n      const matched = ed25519Keys.find((k) => k.kid === kid);\n      if (matched) {\n        return {\n          publicKey: base64urlDecode(matched.x as string),\n          keySource: 'inline-jwks',\n        };\n      }\n      throw Object.assign(\n        new Error(`No matching Ed25519 key found in provided JWKS for kid=\"${kid}\"`),\n        { errorCode: 'E_MCP_JWKS_NO_MATCH' as const }\n      );\n    }\n\n    // No kid: single-key fallback\n    if (ed25519Keys.length === 1) {\n      return {\n        publicKey: base64urlDecode(ed25519Keys[0].x as string),\n        keySource: 'inline-jwks',\n      };\n    }\n\n    throw Object.assign(\n      new Error(\n        `JWS has no kid and JWKS contains ${ed25519Keys.length} Ed25519 keys -- provide kid to select`\n      ),\n      { errorCode: 'E_MCP_KID_REQUIRED' as const }\n    );\n  }\n\n  // Priority 3: server-configured JWKS\n  if (context.jwksKeys?.length) {\n    const { header } = decode(input.jws);\n    const kid = header.kid;\n\n    if (kid) {\n      const key = resolveKeyByKid(context.jwksKeys, kid);\n      if (key) {\n        return { publicKey: key, keySource: 'server-jwks' };\n      }\n      throw Object.assign(new Error(`No matching key in server JWKS for kid=\"${kid}\"`), {\n        errorCode: 'E_MCP_JWKS_NO_MATCH' as const,\n      });\n    }\n\n    // No kid: single-key fallback\n    if (context.jwksKeys.length === 1) {\n      return { publicKey: context.jwksKeys[0].publicKey, keySource: 'server-jwks' };\n    }\n\n    throw Object.assign(\n      new Error(\n        `JWS has no kid and server JWKS contains ${context.jwksKeys.length} keys -- provide kid to select`\n      ),\n      { errorCode: 'E_MCP_KID_REQUIRED' as const }\n    );\n  }\n\n  throw Object.assign(\n    new Error(\n      'No public key available: provide public_key_base64url, jwks, or configure --jwks-file'\n    ),\n    { errorCode: 'E_MCP_KEY_RESOLUTION' as const }\n  );\n}\n\nexport async function handleVerify(params: HandlerParams<VerifyInput>): Promise<HandlerResult> {\n  const { input, policy } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_verify', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: JWS size limit\n  const sizeResult = checkJwsSize(input.jws, policy);\n  if (sizeResult) return sizeResult;\n\n  let publicKey: Uint8Array;\n  let keySource: string;\n  try {\n    const resolved = resolvePublicKey(params);\n    publicKey = resolved.publicKey;\n    keySource = resolved.keySource;\n  } catch (err) {\n    const code =\n      ((err as Record<string, unknown>).errorCode as string | undefined) ?? 'E_MCP_KEY_RESOLUTION';\n    return {\n      text: `Verification failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        ok: false,\n        code,\n        message: err instanceof Error ? err.message : String(err),\n        checks: [],\n      },\n      isError: true,\n    };\n  }\n\n  const result = await verifyLocal(input.jws, publicKey, {\n    issuer: input.issuer,\n    audience: input.audience,\n  });\n\n  if (result.valid) {\n    const checks = [\n      { name: 'signature', passed: true },\n      { name: 'schema', passed: true },\n      { name: 'expiry', passed: true },\n    ];\n\n    if (input.issuer) {\n      checks.push({ name: 'issuer_binding', passed: true });\n    }\n    if (input.audience) {\n      checks.push({ name: 'audience_binding', passed: true });\n    }\n\n    const claims = result.claims as Record<string, unknown>;\n    const claimsSummary: Record<string, unknown> = {\n      iss: claims.iss,\n      kind: claims.kind,\n      type: claims.type,\n      jti: claims.jti,\n      ...(claims.sub !== undefined && { sub: claims.sub }),\n      variant: result.variant,\n      wireVersion: result.wireVersion,\n    };\n\n    const tr = truncateResponse(\n      `Verification PASSED (${result.variant} receipt, kind=${claims.kind ?? 'unknown'}, kid=${result.kid})`,\n      policy\n    );\n    return {\n      text: tr.text,\n      structured: {\n        ok: true,\n        variant: result.variant,\n        checks,\n        claimsSummary,\n        keySource,\n        ...(tr.truncated\n          ? {\n              _truncation: {\n                truncated: tr.truncated,\n                originalBytes: tr.originalBytes,\n                returnedBytes: tr.returnedBytes,\n              },\n            }\n          : {}),\n      },\n    };\n  }\n\n  // Failure case\n  const checks: Array<{ name: string; passed: boolean; message?: string }> = [];\n  if (result.code === 'E_INVALID_SIGNATURE') {\n    checks.push({ name: 'signature', passed: false, message: result.message });\n  } else if (result.code === 'E_INVALID_FORMAT') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: false, message: result.message });\n  } else if (result.code === 'E_EXPIRED') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: true });\n    checks.push({ name: 'expiry', passed: false, message: result.message });\n  } else if (result.code === 'E_INVALID_ISSUER') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: true });\n    checks.push({ name: 'issuer_binding', passed: false, message: result.message });\n  } else if (result.code === 'E_INVALID_AUDIENCE') {\n    checks.push({ name: 'signature', passed: true });\n    checks.push({ name: 'schema', passed: true });\n    checks.push({ name: 'audience_binding', passed: false, message: result.message });\n  } else {\n    checks.push({ name: result.code, passed: false, message: result.message });\n  }\n\n  const trFail = truncateResponse(\n    `Verification FAILED: ${result.code} -- ${result.message}`,\n    policy\n  );\n  return {\n    text: trFail.text,\n    structured: {\n      ok: false,\n      code: result.code,\n      message: result.message,\n      checks,\n      keySource,\n      ...(trFail.truncated\n        ? {\n            _truncation: {\n              truncated: trFail.truncated,\n              originalBytes: trFail.originalBytes,\n              returnedBytes: trFail.returnedBytes,\n            },\n          }\n        : {}),\n    },\n  };\n}\n","/**\n * Inspect handler -- ZERO MCP SDK imports\n *\n * Decodes JWS (without verifying) and extracts metadata.\n * Respects policy redaction settings.\n */\n\nimport { decode } from '@peac/crypto';\nimport { parseReceiptClaims } from '@peac/schema';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { InspectInput } from '../schemas/inspect.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleInspect(params: HandlerParams<InspectInput>): Promise<HandlerResult> {\n  const { input, policy } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_inspect', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: JWS size limit\n  const sizeResult = checkJwsSize(input.jws, policy);\n  if (sizeResult) return sizeResult;\n\n  let header: Record<string, unknown>;\n  let payload: Record<string, unknown>;\n  try {\n    const decoded = decode<Record<string, unknown>>(input.jws);\n    header = decoded.header as unknown as Record<string, unknown>;\n    payload = decoded.payload;\n  } catch (err) {\n    return {\n      text: `Inspect failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        error: err instanceof Error ? err.message : String(err),\n        code: 'E_MCP_INVALID_INPUT',\n      },\n      isError: true,\n    };\n  }\n\n  // Classify variant (don't throw on failure)\n  let variant = 'unknown';\n  try {\n    const pr = parseReceiptClaims(payload);\n    if (pr.ok) {\n      variant = pr.variant;\n    }\n  } catch {\n    // classification failure is non-fatal\n  }\n\n  const payloadMeta: Record<string, unknown> = {\n    variant,\n    issuer: payload.iss,\n    audience: payload.aud,\n  };\n\n  if (typeof payload.iat === 'number') {\n    payloadMeta.issuedAt = new Date(payload.iat * 1000).toISOString();\n  }\n  if (typeof payload.exp === 'number') {\n    payloadMeta.expiresAt = new Date(payload.exp * 1000).toISOString();\n  }\n  if (typeof payload.rid === 'string') {\n    payloadMeta.receiptId = payload.rid;\n  }\n\n  // Apply redaction\n  let redacted = false;\n  let fullPayload: Record<string, unknown> | undefined;\n\n  // Gate: full_claims only honored when policy permits (inspect_full_claims)\n  const effectiveFullClaims = input.full_claims && policy.redaction.inspect_full_claims;\n  if (effectiveFullClaims) {\n    fullPayload = { ...payload };\n\n    if (policy.redaction.strip_evidence && 'evidence' in fullPayload) {\n      fullPayload.evidence = '[REDACTED by policy]';\n      redacted = true;\n    }\n    if (policy.redaction.strip_payment && 'payment' in fullPayload) {\n      fullPayload.payment = '[REDACTED by policy]';\n      redacted = true;\n    }\n  }\n\n  const lines = [\n    'WARNING: Signature NOT verified (use peac_verify to verify)',\n    '',\n    `Variant: ${variant}`,\n    `Issuer: ${payload.iss ?? 'N/A'}`,\n    `Audience: ${payload.aud ?? 'N/A'}`,\n  ];\n\n  if (payloadMeta.issuedAt) lines.push(`Issued At: ${payloadMeta.issuedAt}`);\n  if (payloadMeta.expiresAt) lines.push(`Expires At: ${payloadMeta.expiresAt}`);\n  if (payloadMeta.receiptId) lines.push(`Receipt ID: ${payloadMeta.receiptId}`);\n  if (redacted) lines.push('', 'Note: Some fields redacted by policy');\n\n  const tr = truncateResponse(lines.join('\\n'), policy);\n  return {\n    text: tr.text,\n    structured: {\n      header,\n      payloadMeta,\n      ...(fullPayload !== undefined ? { fullPayload } : {}),\n      redacted,\n      verified: false,\n      ...(tr.truncated\n        ? {\n            _truncation: {\n              truncated: tr.truncated,\n              originalBytes: tr.originalBytes,\n              returnedBytes: tr.returnedBytes,\n            },\n          }\n        : {}),\n    },\n  };\n}\n","/**\n * Decode handler -- ZERO MCP SDK imports\n *\n * Raw JWS decode. Returns header and payload without verification.\n * Text output is bounded by policy limits.\n */\n\nimport { decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { DecodeInput } from '../schemas/decode.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleDecode(params: HandlerParams<DecodeInput>): Promise<HandlerResult> {\n  const { input, policy } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_decode', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: JWS size limit\n  const sizeResult = checkJwsSize(input.jws, policy);\n  if (sizeResult) return sizeResult;\n\n  try {\n    const decoded = decode<Record<string, unknown>>(input.jws);\n    const header = decoded.header as unknown as Record<string, unknown>;\n    const payload = decoded.payload;\n\n    const tr = truncateResponse(\n      [\n        'WARNING: Signature NOT verified',\n        '',\n        `Header: ${JSON.stringify(header, null, 2)}`,\n        '',\n        `Payload: ${JSON.stringify(payload, null, 2)}`,\n      ].join('\\n'),\n      policy\n    );\n\n    return {\n      text: tr.text,\n      structured: {\n        header,\n        payload,\n        verified: false,\n        ...(tr.truncated\n          ? {\n              _truncation: {\n                truncated: tr.truncated,\n                originalBytes: tr.originalBytes,\n                returnedBytes: tr.returnedBytes,\n              },\n            }\n          : {}),\n      },\n    };\n  } catch (err) {\n    return {\n      text: `Decode failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        error: err instanceof Error ? err.message : String(err),\n        code: 'E_MCP_INVALID_INPUT',\n      },\n      isError: true,\n    };\n  }\n}\n","/**\n * Issue handler -- Wire 0.2 only, ZERO MCP SDK imports\n *\n * Signs and returns a Wire 0.2 PEAC record JWS (in-memory only, no side-effects).\n * Requires issuerKey + issuerId on ServerContext.\n */\n\nimport { issueWire02, IssueError } from '@peac/protocol';\nimport { decode, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { IssueInput } from '../schemas/issue.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n * Matches base64url-encoded private key bytes and public key bytes.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n  const privB64 = base64urlEncode(privateKey);\n  const pubB64 = base64urlEncode(publicKey);\n  // Escape any regex-special chars in base64url strings (none expected, but defensive)\n  const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\nexport async function handleIssue(params: HandlerParams<IssueInput>): Promise<HandlerResult> {\n  const { input, policy, context } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_issue', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: issuer key + id must be configured\n  if (!context.issuerKey || !context.issuerId) {\n    return {\n      text: 'Issue failed: server not configured with issuer key and ID (--issuer-key + --issuer-id)',\n      structured: {\n        ok: false,\n        code: 'E_MCP_KEY_REQUIRED',\n        message: 'Server requires --issuer-key and --issuer-id for peac_issue',\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: check claims byte size\n  const inputJson = JSON.stringify(input);\n  const inputBytes = new TextEncoder().encode(inputJson).length;\n  if (inputBytes > policy.limits.max_claims_bytes) {\n    return {\n      text: `Input rejected: claims are ${inputBytes} bytes, exceeding limit of ${policy.limits.max_claims_bytes} bytes`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Claims input is ${inputBytes} bytes, limit is ${policy.limits.max_claims_bytes}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Build Trust Gate 1 patterns from actual key\n  const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n  try {\n    // Build policy block: PolicyBlock requires digest (non-optional per kernel type).\n    // If caller provides policy without digest, return a clear error rather than\n    // silently discarding the policy metadata.\n    if (input.policy && !input.policy.digest) {\n      return {\n        text: 'Issue failed: policy.digest is required when policy block is provided',\n        structured: {\n          ok: false,\n          code: 'E_MCP_ISSUE_FAILED',\n          message:\n            'policy.digest is required when policy block is provided (uri/version alone is insufficient for binding)',\n        },\n        isError: true,\n      };\n    }\n    const policyBlock = input.policy?.digest\n      ? { digest: input.policy.digest, uri: input.policy.uri, version: input.policy.version }\n      : undefined;\n\n    const result = await issueWire02({\n      iss: context.issuerId,\n      kind: input.kind,\n      type: input.type,\n      sub: input.sub,\n      pillars: input.pillars,\n      occurred_at: input.occurred_at,\n      extensions: input.extensions,\n      policy: policyBlock,\n      privateKey: context.issuerKey.privateKey,\n      kid: context.issuerKey.kid,\n    });\n\n    // Decode JWS to extract claims summary\n    const { payload } = decode<Record<string, unknown>>(result.jws);\n    const claimsSummary = {\n      iss: payload.iss as string,\n      kind: payload.kind as string,\n      type: payload.type as string,\n      iat: payload.iat as number,\n      jti: payload.jti as string,\n      ...(payload.sub !== undefined ? { sub: payload.sub as string } : {}),\n      ...(payload.pillars !== undefined ? { pillars: payload.pillars as string[] } : {}),\n    };\n\n    // Trust Gate 1: scan output for key bytes\n    const tr = truncateResponse(\n      `Receipt issued: jti=${claimsSummary.jti}, kind=${claimsSummary.kind}, type=${claimsSummary.type}`,\n      policy\n    );\n    const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n    return {\n      text: safeText,\n      structured: {\n        ok: true,\n        jws: result.jws,\n        claimsSummary,\n      },\n    };\n  } catch (err) {\n    // Sanitize error messages -- never expose key bytes\n    const rawMessage = err instanceof Error ? err.message : String(err);\n    const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n    if (err instanceof IssueError) {\n      return {\n        text: `Issue failed: ${safeMessage}`,\n        structured: {\n          ok: false,\n          code: 'E_MCP_ISSUE_FAILED',\n          message: safeMessage,\n        },\n        isError: true,\n      };\n    }\n\n    if (err instanceof McpServerError) {\n      return {\n        text: `Issue failed: ${safeMessage}`,\n        structured: {\n          ok: false,\n          code: err.code,\n          message: safeMessage,\n        },\n        isError: true,\n      };\n    }\n\n    return {\n      text: `Issue failed: ${safeMessage}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_ISSUE_FAILED',\n        message: safeMessage,\n      },\n      isError: true,\n    };\n  }\n}\n","/**\n * TOCTOU-hardened filesystem utilities for bundle creation\n *\n * All path operations validate against symlink injection and traversal.\n * Zero MCP SDK imports.\n */\n\nimport { lstat, mkdir, rename, rm, mkdtemp } from 'node:fs/promises';\nimport * as nodePath from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { PathTraversalError } from './errors.js';\n\n/**\n * Windows reserved device names (case-insensitive, even with extensions).\n * Windows treats CON, CON.txt, NUL, PRN, COM1..COM9, LPT1..LPT9 as special.\n */\nconst WINDOWS_RESERVED_NAMES = new Set([\n  'con',\n  'prn',\n  'aux',\n  'nul',\n  'com1',\n  'com2',\n  'com3',\n  'com4',\n  'com5',\n  'com6',\n  'com7',\n  'com8',\n  'com9',\n  'lpt1',\n  'lpt2',\n  'lpt3',\n  'lpt4',\n  'lpt5',\n  'lpt6',\n  'lpt7',\n  'lpt8',\n  'lpt9',\n]);\n\n/**\n * Assert that a path is a safe single-segment relative name.\n *\n * v1 restriction: no nested directories (single path segment only).\n * Rejects absolute paths, `..`, empty strings, multi-segment paths, names >255 chars,\n * null bytes, colons (drive letters, NTFS ADS), Windows reserved device names,\n * and trailing dots/spaces (Windows normalizes these).\n */\nexport function assertRelativePath(p: string): void {\n  if (!p || p.trim().length === 0) {\n    throw new PathTraversalError('Path must not be empty');\n  }\n\n  // Reject null bytes (injection vector)\n  if (p.includes('\\0')) {\n    throw new PathTraversalError('Null bytes are not allowed in paths');\n  }\n\n  // Reject colons (blocks drive letters C: and NTFS ADS file.txt:stream)\n  if (p.includes(':')) {\n    throw new PathTraversalError('Colons are not allowed in paths (drive letters, NTFS ADS)');\n  }\n\n  if (nodePath.isAbsolute(p)) {\n    throw new PathTraversalError('Absolute paths are not allowed');\n  }\n\n  // Normalize to detect .. traversal\n  const normalized = nodePath.normalize(p);\n  if (normalized.startsWith('..') || normalized.includes('/..') || normalized.includes('\\\\..')) {\n    throw new PathTraversalError('Path traversal (..) is not allowed');\n  }\n\n  // v1: single segment only -- no slashes\n  if (p.includes('/') || p.includes('\\\\')) {\n    throw new PathTraversalError('Nested directories are not allowed (single segment only)');\n  }\n\n  if (p.length > 255) {\n    throw new PathTraversalError(`Path segment exceeds 255 characters (got ${p.length})`);\n  }\n\n  // Reject hidden files/dirs\n  if (p.startsWith('.')) {\n    throw new PathTraversalError('Hidden paths (starting with .) are not allowed');\n  }\n\n  // Reject trailing dots and spaces (Windows normalizes these, causing confusion)\n  if (p.endsWith('.') || p.endsWith(' ')) {\n    throw new PathTraversalError('Trailing dots and spaces are not allowed');\n  }\n\n  // Reject Windows reserved device names (case-insensitive, even with extensions)\n  // Check the base name before the first dot: \"CON.txt\" -> \"con\"\n  const dotIndex = p.indexOf('.');\n  const baseName = (dotIndex >= 0 ? p.slice(0, dotIndex) : p).toLowerCase();\n  if (WINDOWS_RESERVED_NAMES.has(baseName)) {\n    throw new PathTraversalError(`Windows reserved device name: ${baseName.toUpperCase()}`);\n  }\n}\n\n/**\n * Validate and resolve an output path within a base directory.\n * Does NOT create the directory -- only validates and returns the resolved path.\n */\nexport function resolveOutputPath(basePath: string, relativePath: string): string {\n  assertRelativePath(relativePath);\n\n  const normalizedBase = nodePath.resolve(basePath);\n  const resolved = nodePath.resolve(normalizedBase, relativePath);\n\n  // Defense-in-depth: use path.relative to check containment.\n  // If the resolved path escapes basePath, relative() produces a string\n  // starting with '..' -- this is cross-platform safe unlike string prefix checks.\n  const rel = nodePath.relative(normalizedBase, resolved);\n  if (rel.startsWith('..') || rel.startsWith('/') || nodePath.isAbsolute(rel)) {\n    throw new PathTraversalError('Resolved path escapes base directory');\n  }\n\n  return resolved;\n}\n\n/**\n * Check that a path component is not a symlink.\n * Throws PathTraversalError if the component is a symlink.\n */\nasync function assertNotSymlink(componentPath: string): Promise<void> {\n  try {\n    const stats = await lstat(componentPath);\n    if (stats.isSymbolicLink()) {\n      throw new PathTraversalError(`Symlink detected at ${componentPath}`);\n    }\n  } catch (err) {\n    if (err instanceof PathTraversalError) throw err;\n    // ENOENT is fine -- the component doesn't exist yet\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return;\n    throw err;\n  }\n}\n\n/**\n * Create a directory under basePath with per-component symlink checks.\n * Returns the resolved path of the created directory.\n */\nexport async function safeMkdir(basePath: string, relativePath: string): Promise<string> {\n  const resolved = resolveOutputPath(basePath, relativePath);\n\n  // Check base path itself is not a symlink\n  await assertNotSymlink(basePath);\n\n  // Check that target does not already exist as a symlink\n  await assertNotSymlink(resolved);\n\n  await mkdir(resolved, { recursive: false, mode: 0o700 });\n  return resolved;\n}\n\n/**\n * Atomically move a temp directory to a final path.\n * Uses rename() which is atomic on the same filesystem.\n * Cleans up temp dir on failure.\n */\nexport async function atomicWriteDir(tempDir: string, finalPath: string): Promise<void> {\n  try {\n    await rename(tempDir, finalPath);\n  } catch (err) {\n    // Clean up temp dir on failure\n    try {\n      await rm(tempDir, { recursive: true, force: true });\n    } catch {\n      // Best-effort cleanup\n    }\n    throw err;\n  }\n}\n\n/**\n * Create a temporary directory under basePath.\n * Uses a `.tmp-<uuid>` prefix to avoid collisions.\n */\nexport async function createTempDir(basePath: string): Promise<string> {\n  await assertNotSymlink(basePath);\n  const prefix = nodePath.join(basePath, `.tmp-${randomUUID().slice(0, 8)}-`);\n  return mkdtemp(prefix);\n}\n","/**\n * Bundle handler -- ZERO MCP SDK imports\n *\n * Creates a signed evidence bundle directory from receipt JWS strings.\n * Requires issuerKey + issuerId + bundleDir on ServerContext.\n */\n\nimport { writeFile, rm, stat, mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { sign, sha256Hex, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { BundleInput } from '../schemas/bundle.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\nimport { assertRelativePath, createTempDir, atomicWriteDir } from '../infra/path-safety.js';\nimport { SERVER_VERSION } from '../infra/constants.js';\n\n/**\n * Stable JSON stringify with sorted keys at all levels.\n * Produces deterministic output regardless of property insertion order.\n * Uses 2-space indentation for human readability.\n */\nfunction stableJsonStringify(value: unknown): string {\n  return (\n    JSON.stringify(\n      value,\n      (_key, val) => {\n        if (val !== null && typeof val === 'object' && !Array.isArray(val)) {\n          const sorted: Record<string, unknown> = {};\n          for (const k of Object.keys(val as Record<string, unknown>).sort()) {\n            sorted[k] = (val as Record<string, unknown>)[k];\n          }\n          return sorted;\n        }\n        return val;\n      },\n      2\n    ) + '\\n'\n  );\n}\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n  const privB64 = base64urlEncode(privateKey);\n  const pubB64 = base64urlEncode(publicKey);\n  const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\n/**\n * Generate a default bundle directory name with timestamp + random suffix.\n */\nfunction generateBundleName(): string {\n  const ts = new Date().toISOString().replace(/[:.]/g, '-');\n  const rand = randomUUID().slice(0, 8);\n  return `bundle-${ts}-${rand}`;\n}\n\nexport async function handleCreateBundle(\n  params: HandlerParams<BundleInput>\n): Promise<HandlerResult> {\n  const { input, policy, context } = params;\n\n  // Guard: tool enablement\n  const disabledResult = checkToolEnabled('peac_create_bundle', policy);\n  if (disabledResult) return disabledResult;\n\n  // Guard: bundleDir must be configured\n  if (!context.bundleDir) {\n    return {\n      text: 'Bundle creation failed: server not configured with --bundle-dir',\n      structured: {\n        ok: false,\n        code: 'E_MCP_BUNDLE_DIR_REQUIRED',\n        message: 'Server requires --bundle-dir for peac_create_bundle',\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: issuer key + id must be configured (for manifest signing)\n  if (!context.issuerKey || !context.issuerId) {\n    return {\n      text: 'Bundle creation failed: server not configured with issuer key and ID',\n      structured: {\n        ok: false,\n        code: 'E_MCP_KEY_REQUIRED',\n        message: 'Server requires --issuer-key and --issuer-id for peac_create_bundle',\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: receipt count limit\n  if (input.receipts.length > policy.limits.max_bundle_receipts) {\n    return {\n      text: `Input rejected: ${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Guard: total byte size\n  let totalReceiptBytes = 0;\n  for (const r of input.receipts) {\n    totalReceiptBytes += new TextEncoder().encode(r).length;\n  }\n  if (totalReceiptBytes > policy.limits.max_bundle_bytes) {\n    return {\n      text: `Input rejected: total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_INPUT_TOO_LARGE',\n        message: `Total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n      },\n      isError: true,\n    };\n  }\n\n  // Validate or generate output_path\n  const outputName = input.output_path ?? generateBundleName();\n  try {\n    assertRelativePath(outputName);\n  } catch (err) {\n    return {\n      text: `Bundle creation failed: ${err instanceof Error ? err.message : String(err)}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_PATH_TRAVERSAL',\n        message: err instanceof Error ? err.message : String(err),\n      },\n      isError: true,\n    };\n  }\n\n  // Build Trust Gate 1 patterns\n  const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n  let tempDir: string | undefined;\n  try {\n    // Create temp working directory (0o700: owner-only access)\n    tempDir = await createTempDir(context.bundleDir);\n\n    // Write receipts and compute hashes\n    const receiptsDir = join(tempDir, 'receipts');\n    await mkdir(receiptsDir, { mode: 0o700 });\n\n    interface ReceiptEntry {\n      index: number;\n      file: string;\n      sha256: string;\n      length: number;\n    }\n\n    const entries: ReceiptEntry[] = [];\n    let totalBytes = 0;\n\n    // Dedup by sha256: identical receipts produce one file and one manifest\n    // entry. This is explicit behavior, not an accident of hash-named files.\n    const seenHashes = new Set<string>();\n    const receiptHashes: string[] = [];\n\n    for (let i = 0; i < input.receipts.length; i++) {\n      // Check cancellation at each iteration to avoid unnecessary disk I/O\n      if (params.signal?.aborted) {\n        throw new McpServerError('E_MCP_CANCELLED', 'Request cancelled during bundle creation');\n      }\n\n      const jws = input.receipts[i];\n      const data = new TextEncoder().encode(jws);\n      const hash = await sha256Hex(data);\n\n      if (seenHashes.has(hash)) continue; // skip duplicate receipt\n      seenHashes.add(hash);\n      receiptHashes.push(hash);\n\n      // Name receipt files by content hash for input-order independence.\n      // Same receipt set in any order produces identical file structure.\n      const fileName = `${hash}.jws`;\n      const filePath = join(receiptsDir, fileName);\n      await writeFile(filePath, data, { mode: 0o600 });\n      entries.push({\n        index: i,\n        file: `receipts/${fileName}`,\n        sha256: hash,\n        length: data.length,\n      });\n      totalBytes += data.length;\n    }\n\n    // Sort entries by sha256 for canonical ordering.\n    // Note: the manifest includes `created_at` (wall-clock time), so manifest\n    // content and its signature will differ across runs. Only `bundle_id` is\n    // fully deterministic (content-addressable from policy + receipt hashes).\n    entries.sort((a, b) => a.sha256.localeCompare(b.sha256));\n\n    // Compute content-addressable bundle_id: deterministic identifier\n    // independent of wall-clock time. Same policy + same receipts = same bundle_id.\n    const sortedHashes = [...receiptHashes].sort();\n    const bundleIdInput = `${context.policyHash}:${sortedHashes.join(':')}`;\n    const bundleId = await sha256Hex(new TextEncoder().encode(bundleIdInput));\n\n    const manifest = {\n      bundle_id: bundleId,\n      tool_version: SERVER_VERSION,\n      created_at: new Date().toISOString(),\n      policy_hash: context.policyHash,\n      receipt_count: entries.length,\n      receipts: entries,\n      ...(input.metadata ? { metadata: input.metadata } : {}),\n    };\n\n    // Write manifest.json with canonical key ordering (0o600: owner rw)\n    const manifestJson = stableJsonStringify(manifest);\n    await writeFile(join(tempDir, 'manifest.json'), manifestJson, { mode: 0o600 });\n    totalBytes += new TextEncoder().encode(manifestJson).length;\n\n    // Compute manifest hash for the response (caller uses this for integrity checks)\n    const manifestBytes = new TextEncoder().encode(manifestJson);\n    const manifestSha256 = await sha256Hex(manifestBytes);\n\n    // Sign the canonical manifest object. The signature covers the full\n    // manifest including `created_at`, so it is NOT reproducible across runs.\n    // Parse the stable-stringified JSON back so the sign() function\n    // receives an object whose property order matches the on-disk file.\n    const canonicalManifest = JSON.parse(manifestJson) as Record<string, unknown>;\n    const manifestJws = await sign(\n      canonicalManifest,\n      context.issuerKey.privateKey,\n      context.issuerKey.kid\n    );\n    await writeFile(join(tempDir, 'manifest.jws'), manifestJws, { mode: 0o600 });\n    totalBytes += new TextEncoder().encode(manifestJws).length;\n\n    // File count: unique receipts + manifest.json + manifest.jws\n    const fileCount = entries.length + 2;\n\n    // Atomic move to final path\n    const finalPath = join(context.bundleDir, outputName);\n\n    // Check final path doesn't already exist\n    try {\n      await stat(finalPath);\n      // If we get here, it exists -- error\n      return {\n        text: `Bundle creation failed: output path already exists: ${outputName}`,\n        structured: {\n          ok: false,\n          code: 'E_MCP_BUNDLE_FAILED',\n          message: `Output path already exists: ${outputName}`,\n        },\n        isError: true,\n      };\n    } catch (err) {\n      // ENOENT is expected -- path doesn't exist yet\n      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n        throw err;\n      }\n    }\n\n    await atomicWriteDir(tempDir, finalPath);\n    tempDir = undefined; // Don't clean up -- rename succeeded\n\n    const tr = truncateResponse(\n      `Bundle created: ${outputName} (${fileCount} files, ${totalBytes} bytes)`,\n      policy\n    );\n    const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n    // Return metadata only -- full manifest and manifestJws live on disk.\n    // This prevents multi-KB JSON in MCP responses (client/UI stability).\n    // Return bundleName (relative to --bundle-dir), not absolute path --\n    // the absolute path leaks host filesystem layout to the LLM context.\n    return {\n      text: safeText,\n      structured: {\n        ok: true,\n        bundleId: bundleId,\n        bundleName: outputName,\n        receiptCount: entries.length,\n        fileCount,\n        totalBytes,\n        createdAt: manifest.created_at,\n        manifestSha256,\n      },\n    };\n  } catch (err) {\n    // Clean up temp dir on failure\n    if (tempDir) {\n      try {\n        await rm(tempDir, { recursive: true, force: true });\n      } catch {\n        // Best-effort cleanup\n      }\n    }\n\n    const rawMessage = err instanceof Error ? err.message : String(err);\n    const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n    if (err instanceof McpServerError) {\n      return {\n        text: `Bundle creation failed: ${safeMessage}`,\n        structured: {\n          ok: false,\n          code: err.code,\n          message: safeMessage,\n        },\n        isError: true,\n      };\n    }\n\n    return {\n      text: `Bundle creation failed: ${safeMessage}`,\n      structured: {\n        ok: false,\n        code: 'E_MCP_BUNDLE_FAILED',\n        message: safeMessage,\n      },\n      isError: true,\n    };\n  }\n}\n","/**\n * Verify tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const VerifyInputSchema = z.object({\n  jws: z.string().describe('JWS compact serialization (header.payload.signature)'),\n  public_key_base64url: z\n    .string()\n    .optional()\n    .describe('Ed25519 public key in base64url encoding (32 bytes)'),\n  jwks: z.string().optional().describe('Inline JWKS JSON containing the verifying key'),\n  issuer: z.string().optional().describe('Expected issuer URI for binding check'),\n  audience: z.string().optional().describe('Expected audience URI for binding check'),\n});\n\nexport type VerifyInput = z.infer<typeof VerifyInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nconst CheckSchema = z.object({\n  name: z.string(),\n  passed: z.boolean(),\n  message: z.string().optional(),\n});\n\nexport const VerifyOutputSchema = z.object({\n  _meta: MetaSchema,\n  ok: z.boolean(),\n  code: z.string().optional(),\n  message: z.string().optional(),\n  variant: z.string().optional(),\n  checks: z.array(CheckSchema),\n  claimsSummary: z.record(z.string(), z.unknown()).optional(),\n  keySource: z.string().optional(),\n});\n\nexport type VerifyOutput = z.infer<typeof VerifyOutputSchema>;\n","/**\n * Inspect tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const InspectInputSchema = z.object({\n  jws: z.string().describe('JWS compact serialization to inspect'),\n  full_claims: z\n    .boolean()\n    .optional()\n    .default(false)\n    .describe('Include full decoded claims (may be redacted by policy)'),\n});\n\nexport type InspectInput = z.infer<typeof InspectInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nexport const InspectOutputSchema = z.object({\n  _meta: MetaSchema,\n  header: z.record(z.string(), z.unknown()),\n  payloadMeta: z.object({\n    variant: z.string(),\n    issuer: z.string().optional(),\n    audience: z.string().optional(),\n    issuedAt: z.string().optional(),\n    expiresAt: z.string().optional(),\n    receiptId: z.string().optional(),\n  }),\n  fullPayload: z.record(z.string(), z.unknown()).optional(),\n  redacted: z.boolean(),\n  verified: z.literal(false),\n});\n\nexport type InspectOutput = z.infer<typeof InspectOutputSchema>;\n","/**\n * Decode tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const DecodeInputSchema = z.object({\n  jws: z.string().describe('JWS compact serialization to decode'),\n});\n\nexport type DecodeInput = z.infer<typeof DecodeInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nexport const DecodeOutputSchema = z.object({\n  _meta: MetaSchema,\n  header: z.record(z.string(), z.unknown()),\n  payload: z.record(z.string(), z.unknown()),\n  verified: z.literal(false),\n});\n\nexport type DecodeOutput = z.infer<typeof DecodeOutputSchema>;\n","/**\n * Issue tool schemas -- Wire 0.2 only\n *\n * The MCP peac_issue tool accepts Wire 0.2 fields exclusively.\n * No wire_version discriminator: the MCP server is a forward-looking\n * adoption surface; agents should only issue Wire 0.2 receipts.\n */\n\nimport { z } from 'zod';\n\nexport const IssueInputSchema = z.object({\n  kind: z\n    .enum(['evidence', 'challenge'])\n    .describe('Structural kind: evidence (records interaction) or challenge (requests action)'),\n  type: z\n    .string()\n    .min(1)\n    .max(256)\n    .refine(\n      (v) =>\n        /^https?:\\/\\//.test(v) ||\n        /^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.[a-zA-Z0-9._-]+\\/[a-zA-Z0-9]/.test(v),\n      {\n        message:\n          'type must be reverse-DNS (e.g. org.peacprotocol/payment) or absolute URI (https://...)',\n      }\n    )\n    .describe('Semantic type in reverse-DNS or absolute URI form (e.g. org.peacprotocol/payment)'),\n  sub: z\n    .string()\n    .max(2048)\n    .optional()\n    .describe('Subject identifier (resource or interaction target)'),\n  pillars: z\n    .array(\n      z.enum([\n        'access',\n        'attribution',\n        'commerce',\n        'compliance',\n        'consent',\n        'identity',\n        'privacy',\n        'provenance',\n        'purpose',\n        'safety',\n      ])\n    )\n    .optional()\n    .refine(\n      (arr) =>\n        !arr || (new Set(arr).size === arr.length && [...arr].sort().every((v, i) => v === arr[i])),\n      { message: 'pillars must be unique and sorted ascending' }\n    )\n    .describe('Evidence pillars from closed 10-value taxonomy (sorted ascending)'),\n  occurred_at: z\n    .string()\n    .optional()\n    .refine((v) => !v || !isNaN(Date.parse(v)), {\n      message: 'occurred_at must be a valid ISO 8601 timestamp',\n    })\n    .describe('ISO 8601 timestamp when interaction occurred (evidence kind only)'),\n  extensions: z\n    .record(z.string(), z.unknown())\n    .optional()\n    .describe('Extension groups keyed by reverse-DNS identifier'),\n  policy: z\n    .object({\n      uri: z\n        .string()\n        .url()\n        .max(2048)\n        .refine((v) => v.startsWith('https://'), { message: 'policy.uri must use HTTPS' })\n        .describe('Policy document URI (HTTPS only)'),\n      version: z.string().max(256).optional().describe('Policy version'),\n      digest: z\n        .string()\n        .regex(/^sha256:[0-9a-f]{64}$/)\n        .optional()\n        .describe('Policy digest in sha256:<64 hex> format'),\n    })\n    .optional()\n    .describe('Policy binding block'),\n  ttl_seconds: z\n    .number()\n    .int()\n    .positive()\n    .optional()\n    .describe('Reserved for future use (Wire 0.2 receipts do not expire)'),\n});\n\nexport type IssueInput = z.infer<typeof IssueInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nconst ClaimsSummarySchema = z.object({\n  iss: z.string(),\n  kind: z.string(),\n  type: z.string(),\n  iat: z.number(),\n  jti: z.string(),\n  sub: z.string().optional(),\n  pillars: z.array(z.string()).optional(),\n});\n\nexport const IssueOutputSchema = z.object({\n  _meta: MetaSchema,\n  ok: z.boolean(),\n  jws: z.string(),\n  claimsSummary: ClaimsSummarySchema,\n});\n\nexport type IssueOutput = z.infer<typeof IssueOutputSchema>;\n","/**\n * Bundle tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const BundleInputSchema = z.object({\n  receipts: z\n    .array(z.string().max(16_384))\n    .min(1)\n    .max(256)\n    .describe('Receipt JWS strings to bundle (1-256)'),\n  metadata: z\n    .record(z.string(), z.unknown())\n    .optional()\n    .describe('Optional metadata to include in the manifest'),\n  output_path: z\n    .string()\n    .max(255)\n    .optional()\n    .describe('Output directory name (single segment within --bundle-dir)'),\n});\n\nexport type BundleInput = z.infer<typeof BundleInputSchema>;\n\nconst MetaSchema = z.object({\n  serverVersion: z.string(),\n  policyHash: z.string(),\n  protocolVersion: z.string(),\n});\n\nexport const BundleOutputSchema = z.object({\n  _meta: MetaSchema,\n  ok: z.boolean(),\n  bundleId: z.string(),\n  bundleName: z.string(),\n  receiptCount: z.number(),\n  fileCount: z.number(),\n  totalBytes: z.number(),\n  createdAt: z.string(),\n  manifestSha256: z.string(),\n});\n\nexport type BundleOutput = z.infer<typeof BundleOutputSchema>;\n","/**\n * MCP Server binding -- the only module that registers tools with @modelcontextprotocol/sdk\n *\n * Registers pure tool handlers with the MCP server.\n * Injects _meta audit block into every response.\n */\n\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { CallToolResult, ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport { ERRORS } from '@peac/kernel';\nimport { SERVER_NAME } from './infra/constants.js';\nimport type { PolicyConfig } from './infra/policy.js';\nimport type { ServerContext, HandlerResult } from './handlers/types.js';\nimport { handleVerify } from './handlers/verify.js';\nimport { handleInspect } from './handlers/inspect.js';\nimport { handleDecode } from './handlers/decode.js';\nimport { handleIssue } from './handlers/issue.js';\nimport { handleCreateBundle } from './handlers/bundle.js';\nimport { checkInputSizes, checkObjectDepth, measureEnvelopeBytes } from './handlers/guards.js';\nimport type { VerifyInput } from './schemas/verify.js';\nimport type { InspectInput } from './schemas/inspect.js';\nimport type { DecodeInput } from './schemas/decode.js';\nimport type { IssueInput } from './schemas/issue.js';\nimport type { BundleInput } from './schemas/bundle.js';\nimport { VerifyInputSchema, VerifyOutputSchema } from './schemas/verify.js';\nimport { InspectInputSchema, InspectOutputSchema } from './schemas/inspect.js';\nimport { DecodeInputSchema, DecodeOutputSchema } from './schemas/decode.js';\nimport { IssueInputSchema, IssueOutputSchema } from './schemas/issue.js';\nimport { BundleInputSchema, BundleOutputSchema } from './schemas/bundle.js';\n\nexport interface ServerOptions {\n  version: string;\n  policy: PolicyConfig;\n  policyHash: string;\n  protocolVersion: string;\n  context: ServerContext;\n}\n\nfunction makeMeta(ctx: ServerContext, serverName: string): Record<string, unknown> {\n  return {\n    serverName,\n    serverVersion: ctx.version,\n    policyHash: ctx.policyHash,\n    protocolVersion: ctx.protocolVersion,\n    wireFormatVersion: '0.2',\n  };\n}\n\nfunction handlerResultToCallToolResult(\n  result: HandlerResult,\n  meta: Record<string, unknown>\n): CallToolResult {\n  return {\n    content: [{ type: 'text' as const, text: result.text }],\n    structuredContent: { _meta: meta, ...result.structured },\n    isError: result.isError,\n  };\n}\n\nconst PURE_TOOL_ANNOTATIONS: ToolAnnotations = {\n  readOnlyHint: true,\n  destructiveHint: false,\n  idempotentHint: true,\n  openWorldHint: false,\n};\n\n// peac_issue: pure in-memory signing, no filesystem or network side-effects.\n// readOnlyHint: true -- produces a JWS string, does not mutate state.\n// idempotentHint: false -- each call includes a fresh `iat` timestamp.\n// openWorldHint: false -- closed world; no external I/O or filesystem access.\nconst ISSUE_TOOL_ANNOTATIONS: ToolAnnotations = {\n  readOnlyHint: true,\n  destructiveHint: false,\n  idempotentHint: false,\n  openWorldHint: false,\n};\n\nconst BUNDLE_TOOL_ANNOTATIONS: ToolAnnotations = {\n  readOnlyHint: false,\n  destructiveHint: true,\n  idempotentHint: false,\n  openWorldHint: true,\n};\n\nconst MAX_INPUT_DEPTH = 10;\n\n// Largest legitimate input: a 256-receipt bundle call (259 elements); the rest is headroom.\nconst MAX_TOOL_INPUT_ELEMENTS = 1024;\n\nfunction errorCallToolResult(\n  meta: Record<string, unknown>,\n  code: string,\n  message: string\n): CallToolResult {\n  const errorDef = ERRORS[code];\n  return {\n    content: [{ type: 'text' as const, text: message }],\n    structuredContent: {\n      _meta: meta,\n      ok: false,\n      code,\n      message,\n      retryable: errorDef?.retryable ?? false,\n      next_action: errorDef?.next_action ?? 'none',\n    },\n    isError: true,\n  };\n}\n\n/**\n * Narrowed type for McpServer.registerTool that avoids TS2589\n * deep instantiation errors from cross-version Zod generics.\n *\n * The MCP SDK and our workspace may pin different Zod versions.\n * Zod schema objects are structurally identical at runtime (the SDK\n * duck-types via _def presence check), but TypeScript cannot resolve\n * the deep generic chain across version boundaries.\n *\n * This type accurately describes the runtime contract: inputSchema\n * accepts any object with Zod-like structure (which our schemas are).\n * See package.json for actual pinned versions.\n */\ntype RegisterToolBridge = (\n  name: string,\n  config: {\n    title?: string;\n    description?: string;\n    inputSchema?: unknown;\n    outputSchema?: unknown;\n    annotations?: ToolAnnotations;\n  },\n  cb: (args: Record<string, unknown>, extra: Record<string, unknown>) => Promise<CallToolResult>\n) => unknown;\n\nexport function createPeacMcpServer(options: ServerOptions): McpServer {\n  const { version, policy, context } = options;\n\n  // Compute registered tool list upfront for capability discovery\n  const registeredTools = ['peac_verify', 'peac_inspect', 'peac_decode'];\n  if (context.issuerKey && context.issuerId) {\n    registeredTools.push('peac_issue');\n    if (context.bundleDir) {\n      registeredTools.push('peac_create_bundle');\n    }\n  }\n\n  const meta = { ...makeMeta(context, SERVER_NAME), registeredTools };\n  const maxConcurrency = policy.limits.max_concurrency;\n  let activeHandlers = 0;\n\n  async function wrapHandler(\n    toolName: string,\n    args: Record<string, unknown>,\n    handlerFn: (signal?: AbortSignal) => Promise<HandlerResult>,\n    signal?: AbortSignal\n  ): Promise<CallToolResult> {\n    // Cancellation: if already aborted before we start, return immediately\n    if (signal?.aborted) {\n      return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n    }\n\n    // Concurrency guard\n    if (activeHandlers >= maxConcurrency) {\n      return errorCallToolResult(\n        meta,\n        'E_MCP_CONCURRENCY_LIMIT',\n        `Server at capacity (${maxConcurrency} concurrent handlers)`\n      );\n    }\n\n    // Input depth guard\n    if (!checkObjectDepth(args, MAX_INPUT_DEPTH)) {\n      return errorCallToolResult(\n        meta,\n        'E_MCP_INPUT_TOO_DEEP',\n        `Input exceeds maximum nesting depth of ${MAX_INPUT_DEPTH}`\n      );\n    }\n\n    // Input size guard (recursive sum of all string bytes)\n    const inputSizeResult = checkInputSizes(args, policy);\n    if (inputSizeResult) {\n      return handlerResultToCallToolResult(inputSizeResult, meta);\n    }\n\n    // Reserve concurrency slot. Released when the handler settles (not when\n    // timeout fires), so inflight CPU work stays bounded by maxConcurrency.\n    // The slot release is detached -- wrapHandler returns the timeout error\n    // immediately without waiting for the handler to finish.\n    //\n    // IMPORTANT: If a handler promise never settles, the concurrency slot is\n    // permanently leaked. This is by design -- Node.js cannot forcibly cancel\n    // arbitrary user code. All built-in handlers (verify, inspect, decode) are\n    // pure synchronous-ish operations that will always settle. Future handlers\n    // with network I/O should accept AbortSignal and honor cancellation.\n    // If leaked slots become an operational concern, add a watchdog that logs\n    // when a handler exceeds 2x tool_timeout_ms without settling.\n    activeHandlers++;\n    const handlerPromise = handlerFn(signal);\n\n    // Detached slot release: fires when handler settles, regardless of timeout.\n    // The void + catch ensure no unhandled rejection if handler throws.\n    void handlerPromise\n      .finally(() => {\n        activeHandlers--;\n      })\n      .catch(() => {});\n\n    // Timeout + cancellation race -- handlerPromise keeps running even if\n    // timeout or cancellation fires. Timer is cleared when the handler\n    // resolves to avoid unnecessary timers accumulating under load.\n    let timedOut = false;\n    let cancelled = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const timeoutPromise = new Promise<never>((_resolve, reject) => {\n      timer = setTimeout(() => {\n        timedOut = true;\n        reject(new Error(`Tool \"${toolName}\" timed out after ${policy.limits.tool_timeout_ms}ms`));\n      }, policy.limits.tool_timeout_ms);\n      // Prevent timeout timer from keeping Node.js alive during shutdown\n      timer.unref?.();\n    });\n\n    // Build race participants: handler vs timeout vs (optional) cancellation\n    const raceParticipants: Promise<HandlerResult>[] = [handlerPromise, timeoutPromise];\n\n    let abortCleanup: (() => void) | undefined;\n    if (signal && !signal.aborted) {\n      const cancelPromise = new Promise<never>((_resolve, reject) => {\n        const onAbort = () => {\n          cancelled = true;\n          reject(new Error('Request cancelled'));\n        };\n        signal.addEventListener('abort', onAbort, { once: true });\n        abortCleanup = () => signal.removeEventListener('abort', onAbort);\n      });\n      raceParticipants.push(cancelPromise);\n    }\n\n    try {\n      const result = await Promise.race(raceParticipants);\n\n      // Output size cap -- measure the full JSON-RPC envelope that will be\n      // serialized to stdout, not just the tool result. This is the actual\n      // risk surface for downstream clients parsing the response line.\n      // Uses conservative UUID-length id placeholder (default) since the\n      // MCP SDK doesn't expose the request id to tool handlers.\n      const callResult = handlerResultToCallToolResult(result, meta);\n      const outputBytes = measureEnvelopeBytes(callResult);\n      if (outputBytes > policy.limits.max_response_bytes) {\n        return errorCallToolResult(\n          meta,\n          'E_MCP_OUTPUT_TOO_LARGE',\n          `Response is ${outputBytes} bytes, exceeding limit of ${policy.limits.max_response_bytes}`\n        );\n      }\n\n      return callResult;\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      if (cancelled) {\n        return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n      }\n      if (timedOut) {\n        return errorCallToolResult(meta, 'E_MCP_TOOL_TIMEOUT', message);\n      }\n      return errorCallToolResult(meta, 'E_MCP_INTERNAL', message);\n    } finally {\n      clearTimeout(timer);\n      abortCleanup?.();\n    }\n  }\n\n  const server = new McpServer(\n    { name: SERVER_NAME, version },\n    // listChanged: false -- tool set is static per server instance (determined\n    // at startup from CLI flags). The server never emits notifications/tools/list_changed.\n    {\n      capabilities: { tools: { listChanged: false } },\n      maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS,\n    }\n  );\n\n  // Bind with narrowed types to bridge workspace Zod <-> SDK Zod boundary\n  const register = server.registerTool.bind(server) as RegisterToolBridge;\n\n  // -- peac_verify --\n  register(\n    'peac_verify',\n    {\n      title: 'Verify PEAC Receipt',\n      description:\n        'Verify a PEAC receipt: check Ed25519 signature, validate claims, and return structured check results. Read-only, no side effects.',\n      inputSchema: VerifyInputSchema,\n      outputSchema: VerifyOutputSchema,\n      annotations: PURE_TOOL_ANNOTATIONS,\n    },\n    async (args, extra) =>\n      wrapHandler(\n        'peac_verify',\n        args,\n        (signal) => handleVerify({ input: args as VerifyInput, policy, context, signal }),\n        (extra as { signal?: AbortSignal }).signal\n      )\n  );\n\n  // -- peac_inspect --\n  register(\n    'peac_inspect',\n    {\n      title: 'Inspect PEAC Receipt',\n      description:\n        'Inspect a PEAC receipt without verifying the signature. Returns decoded header, payload metadata, and timestamps. Read-only.',\n      inputSchema: InspectInputSchema,\n      outputSchema: InspectOutputSchema,\n      annotations: PURE_TOOL_ANNOTATIONS,\n    },\n    async (args, extra) =>\n      wrapHandler(\n        'peac_inspect',\n        args,\n        (signal) => handleInspect({ input: args as InspectInput, policy, context, signal }),\n        (extra as { signal?: AbortSignal }).signal\n      )\n  );\n\n  // -- peac_decode --\n  register(\n    'peac_decode',\n    {\n      title: 'Decode PEAC Receipt',\n      description:\n        'Raw-decode a PEAC receipt JWS into header and payload objects. No signature check. Use peac_verify for trusted results.',\n      inputSchema: DecodeInputSchema,\n      outputSchema: DecodeOutputSchema,\n      annotations: PURE_TOOL_ANNOTATIONS,\n    },\n    async (args, extra) =>\n      wrapHandler(\n        'peac_decode',\n        args,\n        (signal) => handleDecode({ input: args as DecodeInput, policy, context, signal }),\n        (extra as { signal?: AbortSignal }).signal\n      )\n  );\n\n  // -- Privileged tools (conditionally registered) --\n\n  // peac_issue: requires issuerKey + issuerId\n  if (context.issuerKey && context.issuerId) {\n    register(\n      'peac_issue',\n      {\n        title: 'Issue Wire 0.2 PEAC Receipt',\n        description:\n          'Sign and return a Wire 0.2 PEAC receipt JWS. Accepts kind, type, pillars, extensions, and policy fields. Wire 0.2 only: Wire 0.1 fields are not accepted. Requires server configured with an Ed25519 issuer key (--issuer-key and --issuer-id).',\n        inputSchema: IssueInputSchema,\n        outputSchema: IssueOutputSchema,\n        annotations: ISSUE_TOOL_ANNOTATIONS,\n      },\n      async (args, extra) =>\n        wrapHandler(\n          'peac_issue',\n          args,\n          (signal) => handleIssue({ input: args as IssueInput, policy, context, signal }),\n          (extra as { signal?: AbortSignal }).signal\n        )\n    );\n\n    // peac_create_bundle: additionally requires bundleDir\n    if (context.bundleDir) {\n      register(\n        'peac_create_bundle',\n        {\n          title: 'Create Evidence Bundle',\n          description:\n            'Create a signed evidence bundle directory from one or more receipt JWS strings. Writes files to disk. Requires --issuer-key, --issuer-id, and --bundle-dir.',\n          inputSchema: BundleInputSchema,\n          outputSchema: BundleOutputSchema,\n          annotations: BUNDLE_TOOL_ANNOTATIONS,\n        },\n        async (args, extra) =>\n          wrapHandler(\n            'peac_create_bundle',\n            args,\n            (signal) => handleCreateBundle({ input: args as BundleInput, policy, context, signal }),\n            (extra as { signal?: AbortSignal }).signal\n          )\n      );\n    }\n  }\n\n  return server;\n}\n\nexport { McpServer };\n","/**\n * Static policy loader (load once, hash, never reload)\n */\n\nimport { readFile, stat } from 'node:fs/promises';\nimport { z } from 'zod';\nimport { sha256Hex } from '@peac/crypto';\nimport { PolicyLoadError } from './errors.js';\n\nconst ToolPolicySchema = z.object({\n  enabled: z.boolean().default(true),\n  allowed_kinds: z.array(z.string()).optional(),\n});\n\nconst RedactionSchema = z.object({\n  strip_evidence: z.boolean().default(false),\n  strip_payment: z.boolean().default(false),\n  inspect_full_claims: z.boolean().default(false),\n});\n\nconst LimitsSchema = z.object({\n  max_jws_bytes: z.number().int().positive().default(16_384),\n  max_response_bytes: z.number().int().positive().default(65_536),\n  tool_timeout_ms: z.number().int().positive().default(30_000),\n  max_concurrency: z.number().int().positive().default(10),\n  max_claims_bytes: z.number().int().positive().default(262_144),\n  max_bundle_receipts: z.number().int().positive().default(256),\n  max_bundle_bytes: z.number().int().positive().default(16_777_216),\n  max_ttl_seconds: z.number().int().positive().default(86_400),\n});\n\n// JWKS config: file-only. URL fetch is not implemented (SSRF surface).\n// When allow_network + URL fetch is added, gate it behind allow_network\n// with strict allowlist, timeouts, max-size, and no-redirect policy.\nconst JwksConfigSchema = z.object({\n  file: z.string().optional(),\n});\n\nexport const PolicySchema = z.object({\n  version: z.literal('1'),\n  allow_network: z.boolean().default(false),\n  redaction: RedactionSchema.prefault({}),\n  tools: z.record(z.string(), ToolPolicySchema).prefault({}),\n  limits: LimitsSchema.prefault({}),\n  jwks: JwksConfigSchema.optional(),\n});\n\nexport type PolicyConfig = z.infer<typeof PolicySchema>;\n\nconst DEFAULT_POLICY: PolicyConfig = {\n  version: '1',\n  allow_network: false,\n  redaction: { strip_evidence: false, strip_payment: false, inspect_full_claims: false },\n  tools: {},\n  limits: {\n    max_jws_bytes: 16_384,\n    max_response_bytes: 65_536,\n    tool_timeout_ms: 30_000,\n    max_concurrency: 10,\n    max_claims_bytes: 262_144,\n    max_bundle_receipts: 256,\n    max_bundle_bytes: 16_777_216,\n    max_ttl_seconds: 86_400,\n  },\n};\n\nexport function getDefaultPolicy(): PolicyConfig {\n  return structuredClone(DEFAULT_POLICY);\n}\n\n/**\n * Deep stable stringify: recursively sorts all object keys at every level\n * so semantically identical policies always produce the same hash regardless\n * of insertion order. Arrays preserve element order (order-significant).\n */\nfunction deepStableStringify(value: unknown): string {\n  if (value === null || typeof value !== 'object') {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return '[' + value.map(deepStableStringify).join(',') + ']';\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const pairs = keys.map((k) => JSON.stringify(k) + ':' + deepStableStringify(obj[k]));\n  return '{' + pairs.join(',') + '}';\n}\n\n/**\n * Compute the policy hash from a canonical JSON representation.\n * Accepts either raw JSON string or a PolicyConfig object.\n * When given a PolicyConfig, uses deep stable stringify (recursive key sort)\n * so semantically identical policies always hash identically.\n */\nexport async function computePolicyHash(input: string | PolicyConfig): Promise<string> {\n  const canonical = typeof input === 'string' ? input : deepStableStringify(input);\n  return sha256Hex(canonical);\n}\n\nexport async function loadPolicy(\n  filePath: string\n): Promise<{ policy: PolicyConfig; hash: string }> {\n  let raw: string;\n  try {\n    raw = await readFile(filePath, 'utf-8');\n  } catch (err) {\n    throw new PolicyLoadError(\n      `Failed to read policy file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n      { cause: err }\n    );\n  }\n\n  // Warn on world-writable permissions (0o002)\n  try {\n    const s = await stat(filePath);\n    if (s.mode & 0o002) {\n      process.stderr.write(\n        `[peac-mcp-server] WARNING: Policy file ${filePath} is world-writable\\n`\n      );\n    }\n  } catch {\n    // stat failure is non-fatal\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new PolicyLoadError(`Policy file is not valid JSON: ${filePath}`, { cause: err });\n  }\n\n  const result = PolicySchema.safeParse(parsed);\n  if (!result.success) {\n    const issues = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ');\n    throw new PolicyLoadError(`Policy validation failed: ${issues}`);\n  }\n\n  // Hash the materialized policy (after Zod defaults applied) for determinism\n  const hash = await computePolicyHash(result.data);\n  return { policy: result.data, hash };\n}\n","/**\n * Issuer key loader (no ambient key discovery)\n *\n * Supports `env:VAR_NAME` and `file:/path` schemes.\n * Reads JWK JSON, validates Ed25519, derives public key.\n * NEVER logs key bytes.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport {\n  base64urlDecode,\n  base64urlEncode,\n  derivePublicKey,\n  validateKeypair,\n  sha256Hex,\n} from '@peac/crypto';\nimport type { Ed25519PrivateJwk } from '@peac/crypto';\nimport { KeyLoadError } from './errors.js';\n\nexport interface LoadedKey {\n  privateKey: Uint8Array;\n  publicKey: Uint8Array;\n  kid: string;\n}\n\nexport async function loadIssuerKey(schemeUri: string): Promise<LoadedKey> {\n  let raw: string;\n\n  if (schemeUri.startsWith('env:')) {\n    const varName = schemeUri.slice(4);\n    const envValue = process.env[varName];\n    if (!envValue) {\n      throw new KeyLoadError(`Environment variable ${varName} is not set or empty`);\n    }\n    raw = envValue;\n  } else if (schemeUri.startsWith('file:')) {\n    const filePath = schemeUri.slice(5);\n    try {\n      raw = await readFile(filePath, 'utf-8');\n    } catch (err) {\n      throw new KeyLoadError(\n        `Failed to read key file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n        { cause: err }\n      );\n    }\n  } else {\n    throw new KeyLoadError(\n      `Unsupported key scheme: ${schemeUri} (expected env:VAR_NAME or file:/path)`\n    );\n  }\n\n  let jwk: unknown;\n  try {\n    jwk = JSON.parse(raw);\n  } catch (err) {\n    throw new KeyLoadError('Key data is not valid JSON', { cause: err });\n  }\n\n  // Validate JWK structure\n  if (\n    typeof jwk !== 'object' ||\n    jwk === null ||\n    !('kty' in jwk) ||\n    !('crv' in jwk) ||\n    !('d' in jwk)\n  ) {\n    throw new KeyLoadError('JWK must contain kty, crv, and d fields');\n  }\n\n  const j = jwk as Record<string, unknown>;\n  if (j.kty !== 'OKP' || j.crv !== 'Ed25519') {\n    throw new KeyLoadError(\n      `JWK must be Ed25519 (kty: OKP, crv: Ed25519), got kty=${String(j.kty)} crv=${String(j.crv)}`\n    );\n  }\n\n  if (typeof j.d !== 'string' || typeof j.x !== 'string') {\n    throw new KeyLoadError('JWK d and x fields must be base64url strings');\n  }\n\n  const ed25519Jwk: Ed25519PrivateJwk = {\n    kty: 'OKP',\n    crv: 'Ed25519',\n    x: j.x as string,\n    d: j.d as string,\n  };\n\n  // Validate keypair consistency\n  const valid = await validateKeypair(ed25519Jwk);\n  if (!valid) {\n    throw new KeyLoadError('JWK keypair validation failed: d does not derive to x');\n  }\n\n  const privateKey = base64urlDecode(ed25519Jwk.d);\n  const publicKey = await derivePublicKey(privateKey);\n\n  // Extract kid. Falls back to a deterministic derivation from the public key\n  // (truncated SHA-256 of base64url-encoded public key) so runs are reproducible.\n  let kid: string;\n  if (typeof j.kid === 'string') {\n    kid = j.kid;\n  } else {\n    const pubB64 = base64urlEncode(publicKey);\n    const hash = await sha256Hex(pubB64);\n    kid = hash.slice(0, 16);\n  }\n\n  return { privateKey, publicKey, kid };\n}\n","/**\n * Stdout fence (line-buffered JSON-RPC validator)\n *\n * Monkey-patches process.stdout.write at startup.\n * Buffers bytes, splits on newline, validates each complete line\n * as JSON-RPC 2.0. Invalid lines cause a fail-fast throw.\n *\n * Returns a teardown function that restores the original write.\n */\n\nimport { McpServerError } from './infra/errors.js';\n\ntype WriteCallback = (err?: Error | null) => void;\n\n// 4 MB max line/buffer length -- prevents memory exhaustion from\n// unbounded writes without newlines or a single huge JSON-RPC message\nconst MAX_LINE_BYTES = 4 * 1024 * 1024;\n\nexport function installStdoutFence(): () => void {\n  const originalWrite = process.stdout.write.bind(process.stdout);\n  let buffer = '';\n  let bufferBytes = 0;\n\n  function validateJsonRpcLine(line: string): void {\n    // Guard: reject lines that exceed the byte budget before attempting JSON.parse\n    const lineBytes = new TextEncoder().encode(line).length;\n    if (lineBytes > MAX_LINE_BYTES) {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: line is ${lineBytes} bytes, exceeding limit of ${MAX_LINE_BYTES}`\n      );\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(line);\n    } catch {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: non-JSON line detected: ${line.slice(0, 100)}`\n      );\n    }\n\n    if (typeof parsed !== 'object' || parsed === null) {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n      );\n    }\n\n    const obj = parsed as Record<string, unknown>;\n\n    if (obj.jsonrpc !== '2.0') {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n      );\n    }\n\n    // Require valid JSON-RPC 2.0 response shape: id + (result or error),\n    // or a notification (method without id). Reject anything else.\n    const hasId = 'id' in obj;\n    const hasResult = 'result' in obj;\n    const hasError = 'error' in obj;\n    const hasMethod = 'method' in obj;\n\n    if (hasId && (hasResult || hasError)) {\n      // Valid response\n      return;\n    }\n    if (hasMethod && !hasId) {\n      // Valid notification (server -> client, e.g. notifications/*)\n      return;\n    }\n\n    throw new McpServerError(\n      'E_MCP_STDOUT_FENCE_VIOLATION',\n      `Stdout fence: malformed JSON-RPC 2.0 message (expected response or notification): ${line.slice(0, 100)}`\n    );\n  }\n\n  function processBuffer(): void {\n    const lines = buffer.split('\\n');\n    // Keep the last segment (incomplete line or empty string after trailing newline)\n    buffer = lines.pop()!;\n    bufferBytes = new TextEncoder().encode(buffer).length;\n\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (trimmed.length === 0) continue; // skip blank lines\n      validateJsonRpcLine(trimmed);\n    }\n  }\n\n  const patchedWrite = function (\n    chunk: string | Uint8Array,\n    encodingOrCallback?: BufferEncoding | WriteCallback,\n    callback?: WriteCallback\n  ): boolean {\n    // Normalize arguments\n    let encoding: BufferEncoding | undefined;\n    let cb: WriteCallback | undefined;\n\n    if (typeof encodingOrCallback === 'function') {\n      cb = encodingOrCallback;\n    } else {\n      encoding = encodingOrCallback;\n      cb = callback;\n    }\n\n    // Convert chunk to string\n    const str = typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk);\n\n    // Cap buffer growth before appending -- prevents memory exhaustion from\n    // writes that never include a newline (e.g. broken serializer)\n    const chunkBytes = new TextEncoder().encode(str).length;\n    if (bufferBytes + chunkBytes > MAX_LINE_BYTES) {\n      throw new McpServerError(\n        'E_MCP_STDOUT_FENCE_VIOLATION',\n        `Stdout fence: buffer exceeded ${MAX_LINE_BYTES} bytes without a newline`\n      );\n    }\n\n    buffer += str;\n    bufferBytes += chunkBytes;\n    processBuffer();\n\n    // Forward to original write\n    if (encoding) {\n      return originalWrite(chunk, encoding, cb);\n    }\n    return originalWrite(chunk, cb as WriteCallback);\n  };\n\n  process.stdout.write = patchedWrite as typeof process.stdout.write;\n\n  // Teardown: flush remaining buffer, restore original\n  return function teardown(): void {\n    // Validate any remaining buffered content\n    if (buffer.trim().length > 0) {\n      validateJsonRpcLine(buffer.trim());\n    }\n    buffer = '';\n    bufferBytes = 0;\n    process.stdout.write = originalWrite;\n  };\n}\n"]}