@algosuite/vo-mcp 0.2.0-beta.2 → 0.2.0-beta.21

package/dist/runner-supervisor.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/runner/control-plane-auth-stub.mjs", "../src/runner-supervisor.mjs", "../../../scripts/virtual-office/code-runner/control-plane-client.mjs", "../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs", "../src/runner/bundled-runtime-updater.mjs", "../../../scripts/virtual-office/runner-bootstrap/runtime-authorization.mjs", "../../../scripts/virtual-office/runner-bootstrap/runtime-staged-tree.mjs", "../src/runner/bundled-runtime-store.mjs", "../../../scripts/virtual-office/code-runner/legacy-orphan-sweep.mjs", "../../../scripts/virtual-office/code-runner/orphan-agent-reaper.mjs", "../src/runner/supervisor-activation.mjs", "../src/runner/supervisor-child-env.mjs", "../src/runner-readiness.mjs", "../src/runner/supervisor-credential-reader.mjs"],
+  "sourcesContent": ["/**\n * Control-plane auth stub for the bundled `vo-mcp runner`.\n *\n * Replaces the daemon's lazy Firebase/SMOKE_* fallback\n * (`scripts/virtual-office/orchestrator-firestore/auth.mjs`), which pulls\n * `vo-config.mjs` (hardcoded Nexus Firebase project) + the firebase-admin chain.\n * A BYO runner ALWAYS authenticates with its own scoped `vo_credential` \u2014 read\n * from the OS keychain by `runner-cli.mjs` and injected as\n * `VO_CONTROL_PLANE_ADMIN_TOKEN` \u2014 so `control-plane-client.mjs`'s `resolveBearer`\n * returns early on the token and NEVER reaches this fallback. It exists only so\n * the bundle has nothing to resolve into the firebase chain; if it ever runs,\n * it fails LOUDLY with the fix.\n *\n * esbuild swaps this in for the heavy original at bundle time (see scripts/bundle.mjs).\n */\nexport async function getFirebaseAuth() {\n  throw new Error(\n    'vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner ' +\n      'authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN).',\n  );\n}\n", "/**\n * Persistent host supervisor for remote Mission Control maintenance.\n * The task daemon is a replaceable child; this process stays alive while it is\n * updated or repaired. Pairing credentials remain in the existing OS store.\n */\nimport { spawn } from 'node:child_process';\nimport { randomUUID } from 'node:crypto';\nimport { createRequire } from 'node:module';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, join } from 'node:path';\nimport { createControlPlaneClient } from '../../../scripts/virtual-office/code-runner/control-plane-client.mjs';\nimport { runHostMaintenance } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { stageAndActivateBundledUpdate } from './runner/bundled-runtime-updater.mjs';\nimport { runLegacyOrphanSweep } from '../../../scripts/virtual-office/code-runner/legacy-orphan-sweep.mjs';\nimport { activationSupervisorInstanceId, runtimeRootFromEnv } from './runner/bundled-runtime-store.mjs';\nimport { finishPendingActivation } from './runner/supervisor-activation.mjs';\nimport { prepareSupervisorAuth, resolveSupervisorRunnerId } from './runner/supervisor-child-env.mjs';\nimport { readStoredCredentialIsolated } from './runner/supervisor-credential-reader.mjs';\n\nconst DEFAULT_CONTROL_PLANE_URL = 'https://vo-control-plane-bzjphrajaq-uc.a.run.app';\nconst POLL_MS = 5000;\nconst CHILD_START_MS = 1500;\nconst SUPERVISOR_CAPABILITIES = ['bundled-runtime-slots-v1', 'legacy-orphan-purge-v1'];\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst selfPath = fileURLToPath(import.meta.url);\nconst childEntry = join(dirname(selfPath), 'runner-cli.js');\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst runnerId = resolveSupervisorRunnerId(process.env);\n\nfunction packageVersion() {\n  try { return createRequire(import.meta.url)('../package.json').version || 'unknown'; } catch { return 'unknown'; }\n}\n\nconst requestedSupervisorInstanceId = UUID_RE.test(String(process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID || ''))\n  ? process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID\n  : randomUUID();\nconst supervisorInstanceId = activationSupervisorInstanceId(\n  runtimeRootFromEnv(process.env), requestedSupervisorInstanceId,\n);\nconst supervisorVersion = packageVersion();\nconst supervisorControlIdentity = {\n  supervisorInstanceId,\n  supervisorVersion,\n  capabilities: SUPERVISOR_CAPABILITIES,\n};\n\nfunction spawnChild(childEnv) {\n  return spawn(process.execPath, [childEntry], {\n    env: childEnv,\n    stdio: 'inherit',\n    windowsHide: true,\n  });\n}\n\nfunction spawnPreviousChild(entry, childEnv) {\n  return spawn(process.execPath, [entry, 'runner'], {\n    env: childEnv,\n    stdio: 'inherit',\n    windowsHide: true,\n  });\n}\n\nasync function localStatus() {\n  try {\n    const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);\n    const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });\n    if (!response.ok) return null;\n    const body = await response.json();\n    return body?.ok === true ? body : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function waitForLocalRunner(child) {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    if (child.exitCode !== null) return false;\n    const status = await localStatus();\n    if (status?.running === true && Number(status.pid) === Number(child.pid)) return true;\n    await sleep(500);\n  }\n  return false;\n}\n\nasync function stopChild(child) {\n  if (!child || child.exitCode !== null) return;\n  child.kill(process.platform === 'win32' ? undefined : 'SIGTERM');\n  await Promise.race([\n    new Promise((resolve) => child.once('exit', resolve)),\n    sleep(15_000),\n  ]);\n  if (child.exitCode === null) child.kill('SIGKILL');\n}\n\nasync function main() {\n  // Read keychain-backed credentials in a process that exits before npm ever\n  // attempts to replace this package. Windows otherwise keeps the keyring DLL\n  // locked for the full supervisor lifetime and global self-updates fail.\n  const stored = readStoredCredentialIsolated();\n  const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;\n  const { childEnv, clientEnv, operatorId } = await prepareSupervisorAuth({\n    baseEnv: process.env,\n    storedCredential: stored,\n    controlPlaneUrl,\n  });\n  Object.assign(childEnv, {\n    VO_RUNNER_SUPERVISOR_INSTANCE_ID: supervisorInstanceId,\n    VO_RUNNER_SUPERVISOR_VERSION: supervisorVersion,\n    VO_RUNNER_SUPERVISOR_CAPABILITIES: SUPERVISOR_CAPABILITIES.join(','),\n  });\n  const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });\n  const runtimeRoot = runtimeRootFromEnv(process.env);\n  let child = null;\n  let stopping = false;\n  let handling = false;\n\n  const respawn = () => {\n    if (!stopping && !handling && (!child || child.exitCode !== null)) child = launchChild();\n  };\n  const launchChild = () => {\n    const next = spawnChild(childEnv);\n    next.on('exit', () => setTimeout(respawn, 2000));\n    return next;\n  };\n  child = launchChild();\n\n  if (!(await finishPendingActivation({\n    client,\n    child,\n    runtimeRoot,\n    operatorId,\n    runnerId,\n    selfPath,\n    packageVersion: supervisorVersion,\n    supervisorIdentity: supervisorControlIdentity,\n    waitForLocalRunner,\n    localStatus,\n    stopChild,\n    launchPreviousChild: (entry) => spawnPreviousChild(entry, childEnv),\n    log: (message) => console.error(`[vo-runner supervisor] ${message}`),\n  }))) {\n    stopping = true;\n    return;\n  }\n\n  const shutdown = async () => {\n    if (stopping) return;\n    stopping = true;\n    await stopChild(child);\n  };\n  process.on('SIGINT', () => { void shutdown().finally(() => process.exit(0)); });\n  process.on('SIGTERM', () => { void shutdown().finally(() => process.exit(0)); });\n\n  while (!stopping) {\n    try {\n      const action = await client.pollRunnerControl({\n        runnerId,\n        ...(operatorId ? { operatorId } : {}),\n        ...supervisorControlIdentity,\n      });\n      if (!action) {\n        await sleep(POLL_MS);\n        continue;\n      }\n      handling = true;\n      const beforeStop = await localStatus();\n      if (beforeStop && Number(beforeStop.activeTasks || 0) > 0) {\n        await client.completeRunnerControl(action.actionId, {\n          runnerId,\n          ...(operatorId ? { operatorId } : {}),\n          ...supervisorControlIdentity,\n          status: 'failed',\n          detail: `deferred safely: ${beforeStop.activeTasks} active task(s); retry when the runner is idle`,\n        });\n        handling = false;\n        continue;\n      }\n      await stopChild(child);\n      const bundledAction = action.kind === 'update' || action.kind === 'reinstall';\n      const result = bundledAction\n        ? stageAndActivateBundledUpdate({\n          runtimeRoot,\n          packageSpec: `@algosuite/vo-mcp@${action.desired_package_version}`,\n          expectedVersion: action.desired_package_version,\n          expectedIntegrity: action.desired_package_integrity,\n          action: {\n            actionId: action.actionId,\n            runnerId,\n            operatorId: operatorId || '',\n            supervisorInstanceId,\n          },\n          env: process.env,\n          force: action.kind === 'reinstall',\n        })\n        : action.kind === 'purge-orphans'\n          ? runLegacyOrphanSweep({\n            protectedPids: [process.pid],\n            log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n          })\n          : runHostMaintenance(action.kind, {\n            env: clientEnv,\n            log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n          });\n      if (result.ok && result.handoff) {\n        console.warn(`[vo-runner supervisor] activated ${result.active.version}; exiting for new-process attestation`);\n        return;\n      }\n      child = launchChild();\n      await sleep(CHILD_START_MS);\n      if (child.exitCode !== null || !(await waitForLocalRunner(child))) result.ok = false;\n      await client.completeRunnerControl(action.actionId, {\n        runnerId,\n        ...(operatorId ? { operatorId } : {}),\n        ...supervisorControlIdentity,\n        status: result.ok ? 'succeeded' : 'failed',\n        detail: result.ok\n          ? (result.detail ? `${result.detail}; runner ${packageVersion()} reconnected`.slice(0, 1000) : `runner ${packageVersion()} reconnected`)\n          : `maintenance exited ${result.status}${result.detail ? `: ${result.detail}` : ''}`,\n      });\n      handling = false;\n    } catch (error) {\n      console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);\n      handling = false;\n      await sleep(POLL_MS);\n    }\n  }\n}\n\nmain().catch((error) => {\n  console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);\n  process.exitCode = 1;\n});\n", "/**\n * control-plane-client \u2014 the runner's OUTBOUND link to vo-control-plane.\n *\n * Increment 6 (Code-from-Anywhere). The daemon never exposes a port; it reaches\n * OUT to the control-plane (no inbound hole, no Tailscale \u2014 design \u00A72). Auth:\n * prefer the static admin token (`VO_CONTROL_PLANE_ADMIN_TOKEN`, the V1 local\n * dogfood path); fall back to a per-user Firebase ID token via the shared\n * orchestrator auth (`SMOKE_*` creds \u2192 allow-listed operator \u2192 admin).\n *\n * Covers task claim/progress/context/private attachments/resume and governed merge.\n */\n\nlet cachedFirebaseToken = null;\n\nasync function resolveBearer(env) {\n  const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;\n  if (adminToken) return adminToken;\n  if (cachedFirebaseToken) return cachedFirebaseToken;\n  // Lazy import \u2014 Firebase auth is only needed when no admin token is present.\n  const { getFirebaseAuth } = await import('../orchestrator-firestore/auth.mjs');\n  const auth = await getFirebaseAuth({ env });\n  if (!auth || !auth.idToken) {\n    throw new Error(\n      'no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY',\n    );\n  }\n  cachedFirebaseToken = auth.idToken;\n  return cachedFirebaseToken;\n}\n\n/**\n * Build a client. `baseUrl` defaults to `env.VO_CONTROL_PLANE_URL`. `fetchImpl`\n * and `env` are injectable for tests and packaged runner handoff.\n */\nexport function createControlPlaneClient({\n  baseUrl,\n  env = process.env,\n  fetchImpl = fetch,\n  heartbeatTimeoutMs = Math.min(\n    Math.max(Number(env.VO_CODE_RUNNER_HEARTBEAT_TIMEOUT_MS) || 15_000, 1_000),\n    60_000,\n  ),\n} = {}) {\n  const resolvedBaseUrl = baseUrl ?? env.VO_CONTROL_PLANE_URL ?? '';\n  if (!resolvedBaseUrl) {\n    throw new Error('VO_CONTROL_PLANE_URL is required for the code-runner daemon');\n  }\n  const root = resolvedBaseUrl.replace(/\\/+$/, '');\n\n  async function req(method, path, body, { timeoutMs } = {}) {\n    const bearer = await resolveBearer(env);\n    const controller = timeoutMs ? new AbortController() : null;\n    let timeoutId;\n    const request = Promise.resolve(fetchImpl(`${root}${path}`, {\n      method,\n      headers: {\n        'content-type': 'application/json',\n        authorization: `Bearer ${bearer}`,\n      },\n      body: body === undefined ? undefined : JSON.stringify(body),\n      ...(controller ? { signal: controller.signal } : {}),\n    }));\n    if (!timeoutMs) return request;\n    const timeout = new Promise((_, reject) => {\n      timeoutId = setTimeout(() => {\n        controller.abort();\n        reject(new Error(`control-plane ${path} timed out after ${timeoutMs}ms`));\n      }, timeoutMs);\n    });\n    try {\n      return await Promise.race([request, timeout]);\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  return {\n    /**\n     * Claim the next pending task. Returns the task or null (empty queue).\n     * `repos` (optional `owner/name` list) and `operatorIds` (optional\n     * `operator_id` list) scope the claim so this daemon only picks up tasks it\n     * serves \u2014 the control-plane filters by both (logical AND), so another\n     * operator's task never lands on (or bills) this machine.\n     */\n    async claim(runnerId, repos, operatorIds, session = {}) {\n      const body = { runner_id: runnerId };\n      if (Array.isArray(repos) && repos.length > 0) body.repos = repos;\n      if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;\n      if (session.runnerInstanceId) body.runner_instance_id = session.runnerInstanceId;\n      if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;\n      if (session.defaultAgent) body.default_agent = session.defaultAgent;\n      if (Array.isArray(session.availableAgents)) {\n        body.available_agents = session.availableAgents\n          .filter((entry) => entry?.installed === true && entry?.authenticated === true)\n          .map((entry) => entry.agent);\n      }\n      const res = await req('POST', '/api/v1/code-task/claim', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null; // force re-auth next call\n        throw new Error('claim unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).\n     * Server derives operator/tenant from the daemon's authenticated principal.\n     * Returns the created task, or throws on a non-2xx response.\n     */\n    async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns }) {\n      const body = { repo, prompt };\n      if (typeof max_budget_usd === 'number') body.max_budget_usd = max_budget_usd;\n      if (typeof max_turns === 'number') body.max_turns = max_turns;\n      const res = await req('POST', '/api/v1/code-task', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('enqueue unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`enqueue failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses\n     * this after the runner opens a partial draft PR and CI is no longer pending.\n     */\n    async resumeCodeTask(taskId) {\n      const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`, {});\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('resume unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`resume failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Send a CI-green PR through the production verify-before-act merge route.\n     * The server inspects the current diff, applies deterministic blockers, runs\n     * consensus, records a receipt, and direct-merges only the inspected SHA.\n     */\n    async mergeVerifiedPr(prNumber, automationContext) {\n      const res = await req('POST', '/api/v1/admin/pr/merge', { prNumber, automationContext });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('gated merge unauthorized (401)');\n      }\n      const json = await res.json().catch(() => ({}));\n      if (res.ok && json?.ok === true) {\n        const result = json?.result && typeof json.result === 'object' ? json.result : {};\n        const status = result.merged === true || result.status === 'merged'\n          ? 'merged'\n          : result.status === 'auto-merge-enabled' || String(result.action || '').includes('auto-merge')\n            ? 'queued'\n            : 'accepted';\n        return {\n          status,\n          detail: typeof result.detail === 'string' ? result.detail : null,\n          actionReceiptId: typeof json.action_receipt_id === 'string' ? json.action_receipt_id : null,\n        };\n      }\n      if (res.status === 503 && json?.error === 'verify_unavailable') {\n        return { status: 'retry', reason: json.reason || 'verification unavailable' };\n      }\n      return {\n        status: 'blocked',\n        reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,\n        actionReceiptId: typeof json?.action_receipt_id === 'string' ? json.action_receipt_id : null,\n      };\n    },\n\n    /**\n     * Append progress / set terminal status. Returns\n     *   { task }            \u2014 applied\n     *   { terminal: true }  \u2014 task already terminal (operator cancelled): STOP\n     */\n    async postProgress(taskId, patch) {\n      const res = await req('PATCH', `/api/v1/code-task/${taskId}/progress`, patch);\n      if (res.status === 409) return { terminal: true };\n      if (res.status === 404) return { terminal: true, missing: true };\n      if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return { task: json && json.task };\n    },\n\n    async getTask(taskId) {\n      const res = await req('GET', `/api/v1/code-task/${taskId}`);\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json ? json.task : null;\n    },\n    async downloadTaskAttachment(taskId, attachmentId) {\n      const path = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;\n      const res = await req('GET', path);\n      if (res.status === 401) cachedFirebaseToken = null;\n      if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);\n      return Buffer.from(await res.arrayBuffer());\n    },\n\n    async getTaskKnowledgeContext(taskId, { query } = {}) {\n      const body = {};\n      if (typeof query === 'string' && query.trim()) body.query = query;\n      const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('knowledge-context unauthorized (401)');\n      }\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`knowledge-context failed: HTTP ${res.status}`);\n      return res.json();\n    },\n\n    /**\n     * Report this machine's rolling-7-day Claude Code token usage (the real\n     * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when\n     * available). The daemon authenticates as admin, so the target `operatorId`\n     * is named explicitly. Best-effort; throws on a non-2xx so the caller can\n     * log + move on.\n     *\n     * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.\n     * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).\n     */\n    async postWeeklyTokens({ operatorId, runnerId, tokens, claudeWeeklyPct, claudeWeeklyResetsAt }) {\n      const body = {\n        operator_id: operatorId,\n        runner_id: runnerId,\n        input_tokens: tokens.input_tokens,\n        output_tokens: tokens.output_tokens,\n        cache_creation_tokens: tokens.cache_creation_tokens,\n        cache_read_tokens: tokens.cache_read_tokens,\n      };\n      if (typeof claudeWeeklyPct === 'number') {\n        body.claude_weekly_pct = claudeWeeklyPct;\n      }\n      if (claudeWeeklyResetsAt !== undefined) {\n        body.claude_weekly_resets_at = claudeWeeklyResetsAt;\n      }\n      const res = await req('POST', '/api/v1/weekly-tokens', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('weekly-tokens unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);\n      return true;\n    },\n\n    /**\n     * Send a liveness heartbeat (M2). The control-plane upserts it under the\n     * authenticated operator so the web shows a TRUE \"runner online\" signal.\n     * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.\n     */\n    async postHeartbeat({ runnerId, runnerInstanceId, operatorId, uptimeSec, activeTasks, maxConcurrency, effectiveConcurrency, measuredTaskSlots, measuredCpuSlots, measuredMemorySlots, version, daemonVersion, defaultAgent, supervisorInstanceId, supervisorVersion, supervisorCapabilities, servedRepos, servedOperators, availableAgents, accountUsage, availableLocalModels }) {\n      const body = { runner_id: runnerId };\n      if (runnerInstanceId) body.runner_instance_id = runnerInstanceId;\n      if (operatorId) body.operator_id = operatorId;\n      if (typeof uptimeSec === 'number') body.uptime_sec = uptimeSec;\n      if (typeof activeTasks === 'number') body.active_tasks = activeTasks;\n      if (typeof maxConcurrency === 'number') body.max_concurrency = maxConcurrency;\n      if (typeof effectiveConcurrency === 'number') body.effective_concurrency = effectiveConcurrency;\n      if (typeof measuredTaskSlots === 'number') body.measured_task_slots = measuredTaskSlots;\n      if (typeof measuredCpuSlots === 'number') body.measured_cpu_slots = measuredCpuSlots;\n      if (typeof measuredMemorySlots === 'number') body.measured_memory_slots = measuredMemorySlots;\n      if (version) body.version = version;\n      if (daemonVersion) body.daemon_version = daemonVersion;\n      if (defaultAgent) body.default_agent = defaultAgent;\n      if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n      if (supervisorVersion) body.supervisor_version = supervisorVersion;\n      if (Array.isArray(supervisorCapabilities) && supervisorCapabilities.length > 0) {\n        body.supervisor_capabilities = supervisorCapabilities;\n      }\n      if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;\n      if (Array.isArray(servedOperators) && servedOperators.length > 0) {\n        body.served_operator_ids = servedOperators;\n      }\n      if (Array.isArray(availableAgents) && availableAgents.length > 0) {\n        body.available_agents = availableAgents;\n      }\n      if (Array.isArray(accountUsage) && accountUsage.length > 0) {\n        body.account_usage = accountUsage;\n      }\n      if (Array.isArray(availableLocalModels) && availableLocalModels.length > 0) {\n        body.available_local_models = availableLocalModels;\n      }\n      const res = await req('POST', '/api/v1/runner/heartbeat', body, {\n        timeoutMs: heartbeatTimeoutMs,\n      });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('heartbeat unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`heartbeat failed: HTTP ${res.status}`);\n      return res.json();\n    },\n\n    async getRunnerStatus({ operatorId } = {}) {\n      const query = operatorId ? `?operator_id=${encodeURIComponent(operatorId)}` : '';\n      const res = await req('GET', `/api/v1/runner/status${query}`, undefined, {\n        timeoutMs: heartbeatTimeoutMs,\n      });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner status unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner status failed: HTTP ${res.status}`);\n      const body = await res.json();\n      return Array.isArray(body?.runners) ? body.runners : [];\n    },\n\n    async pollRunnerControl({ runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities }) {\n      const body = { runner_id: runnerId };\n      if (operatorId) body.operator_id = operatorId;\n      if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n      if (supervisorVersion) body.supervisor_version = supervisorVersion;\n      if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n      const res = await req('POST', '/api/v1/runner/control/poll', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control poll unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);\n      const json = await res.json();\n      const action = json?.action;\n      return action && typeof action.action_id === 'string' && action.action_id\n        ? { ...action, actionId: action.action_id }\n        : null;\n    },\n\n    async completeRunnerControl(actionId, { runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities, status, detail }) {\n      const body = { runner_id: runnerId, status };\n      if (operatorId) body.operator_id = operatorId;\n      if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n      if (supervisorVersion) body.supervisor_version = supervisorVersion;\n      if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n      if (detail) body.detail = detail;\n      const res = await req('POST', `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control completion unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json?.action || null;\n    },\n\n    /**\n     * Mint a short-lived (~1h), repo-scoped GitHub App installation token for\n     * THIS runner's operator (M3). The control-plane keys the mint on the\n     * authenticated operator (ctx.operator_id), so the token covers only that\n     * operator's installation.\n     *\n     * Returns { token, expiresAt } on success. In legacy/admin mode it returns\n     * null on a miss so the caller may use ambient `gh`. In scoped-operator mode\n     * callers pass `{ required: true }`, which fails closed instead of letting a\n     * missing/mis-scoped installation fall through to the runner machine's `gh`.\n     *\n     * The minted token is only usable for push + PR if the GitHub App grants\n     * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr\n     * create) \u2014 see docs/vo/github-app-setup-2026-06-18.md. A token missing\n     * either scope fails at push (\u2192 ambient fallback) or at `gh pr create`.\n     */\n    async getInstallationToken({ required = false } = {}) {\n      const fail = (reason) => {\n        if (required) throw new Error(`installation-token required: ${reason}`);\n        return null;\n      };\n      try {\n        const res = await req('POST', '/api/v1/github/installation-token', {});\n        if (!res.ok) return fail(`HTTP ${res.status}`);\n        const json = await res.json();\n        if (!json || !json.token) return fail('missing token');\n        return { token: json.token, expiresAt: json.expires_at || null };\n      } catch (err) {\n        if (required) throw err;\n        return null;\n      }\n    },\n\n    /**\n     * Read the operator's dispatch-mode config (Fast\u2192Ultracode effort setting).\n     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'ultracode'),\n     * defaulting to 'standard' on any error. Never throws \u2014 best-effort.\n     */\n    async getDispatchMode() {\n      try {\n        const res = await req('GET', '/api/v1/dispatch-mode-config');\n        if (!res.ok) return 'standard';\n        const json = await res.json();\n        return json?.dispatchMode || 'standard';\n      } catch {\n        return 'standard';\n      }\n    },\n  };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { win32 } from 'node:path';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\nconst NPM_CLI_SUFFIX = `\\\\${win32.join('node_modules', 'npm', 'bin', 'npm-cli.js').toLowerCase()}`;\n\nfunction escapeRegExp(value) {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n  let value = String(raw || '')\n    .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n    .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n    .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n  for (const [name, secret] of Object.entries(env)) {\n    if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n    const text = String(secret || '');\n    if (text.length < 4) continue;\n    value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n  }\n  value = value.replace(/\\s+/gu, ' ').trim();\n  if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n  return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nfunction isNpmCliPath(value) {\n  return typeof value === 'string'\n    && win32.isAbsolute(value)\n    && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);\n}\n\n/**\n * Resolve npm's JavaScript entrypoint without executing a Windows `.cmd` shim.\n *\n * The desktop app can run from a bundled node.exe that does not carry npm, so\n * resolution also checks the exact npm layout below absolute PATH entries. No\n * candidate controls the executable or package argv: process.execPath remains\n * the executable and the package spec remains allow-listed below.\n */\nexport function resolveNpmCli({\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  const candidates = [];\n  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);\n  candidates.push(win32.join(win32.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n\n  const pathValue = env.PATH ?? env.Path ?? env.path ?? '';\n  for (const entry of pathValue.split(';')) {\n    const trimmed = entry.trim();\n    if (!win32.isAbsolute(trimmed)) continue;\n    candidates.push(win32.join(trimmed, 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n  }\n\n  const seen = new Set();\n  for (const candidate of candidates) {\n    const normalized = win32.normalize(candidate);\n    const key = normalized.toLowerCase();\n    if (seen.has(key) || !isNpmCliPath(normalized)) continue;\n    seen.add(key);\n    if (fileExists(normalized)) return normalized;\n  }\n  return null;\n}\n\nexport function buildMaintenanceCommand(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  if (!['update', 'reinstall'].includes(kind)) return null;\n  if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const command = platform === 'win32' ? execPath : 'npm';\n  const args = [...(npmCli ? [npmCli] : []), 'install', '-g', packageSpec];\n  if (kind === 'reinstall') args.push('--force');\n  return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n  spawn = spawnSync,\n  log = () => {},\n} = {}) {\n  if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n  let command;\n  try {\n    command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });\n  } catch (error) {\n    return {\n      ok: false,\n      status: 2,\n      command: null,\n      args: [],\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env),\n    };\n  }\n  if (!command) return { ok: false, status: 2, command: null, args: [] };\n  log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n  const result = spawn(command.command, command.args, {\n    stdio: ['ignore', 'pipe', 'pipe'],\n    encoding: 'utf8',\n    env,\n    shell: false,\n    windowsHide: true,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  const detail = sanitizeMaintenanceDiagnostic(\n    [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n    env,\n  );\n  if (detail) log(`runner maintenance result: ${detail}`);\n  return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from 'node:fs';\nimport { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport { resolveNpmCli, sanitizeMaintenanceDiagnostic } from '../../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport {\n  validateRuntimeAuthorization,\n  validateStagedRuntimeAuthorization,\n} from '../../../../scripts/virtual-office/runner-bootstrap/runtime-authorization.mjs';\nimport { activateSlot, atomicWriteJson, hashFileSha512, hashRuntimeTree, slotPaths, validateSlot } from './bundled-runtime-store.mjs';\n\nconst PACKAGE_NAME = '@algosuite/vo-mcp';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst MAX_TARBALL_BYTES = 100 * 1024 * 1024;\nconst PUBLIC_REGISTRY = 'https://registry.npmjs.org/';\n\nexport function buildMinimalMaintenanceEnv(env = process.env, runtimeRoot = '') {\n  const allowed = new Set([\n    'PATH', 'Path', 'path', 'PATHEXT', 'SystemRoot', 'SYSTEMROOT', 'WINDIR', 'COMSPEC',\n    'TEMP', 'TMP', 'TMPDIR', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',\n    'ProgramFiles', 'ProgramFiles(x86)', 'ProgramW6432', 'LANG', 'LC_ALL',\n  ]);\n  const clean = {};\n  for (const [key, value] of Object.entries(env)) {\n    if (allowed.has(key) && typeof value === 'string') clean[key] = value;\n  }\n  return {\n    ...clean,\n    npm_config_ignore_scripts: 'true',\n    npm_config_bin_links: 'false',\n    npm_config_audit: 'false',\n    npm_config_fund: 'false',\n    npm_config_update_notifier: 'false',\n    npm_config_registry: PUBLIC_REGISTRY,\n    ...(runtimeRoot ? {\n      npm_config_userconfig: join(runtimeRoot, 'maintenance', 'user.npmrc'),\n      npm_config_globalconfig: join(runtimeRoot, 'maintenance', 'global.npmrc'),\n      npm_config_cache: join(runtimeRoot, 'maintenance', 'npm-cache'),\n    } : {}),\n  };\n}\n\nfunction defaultRun(command, args, options) {\n  return spawnSync(command, args, {\n    cwd: options.cwd,\n    encoding: 'utf8',\n    env: options.env,\n    shell: false,\n    windowsHide: true,\n    stdio: ['ignore', 'pipe', 'pipe'],\n    timeout: options.timeout ?? 120_000,\n  });\n}\n\nfunction commandRunner({ platform, execPath, env, fileExists, run }) {\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const npmCommand = platform === 'win32' ? execPath : 'npm';\n  const prefix = npmCli ? [npmCli] : [];\n  return {\n    npm(args, options) { return run(npmCommand, [...prefix, ...args], options); },\n    node(args, options) { return run(execPath, args, options); },\n  };\n}\n\nfunction parseJsonOutput(result, operation) {\n  if (result?.status !== 0) {\n    throw new Error(`${operation} failed: ${String(result?.stderr || result?.error?.message || `exit ${result?.status ?? 1}`)}`);\n  }\n  try { return JSON.parse(String(result.stdout || '')); } catch { throw new Error(`${operation} returned invalid JSON`); }\n}\n\nfunction tarballIntegrity(file) {\n  return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\nfunction assertNoLinks(root) {\n  const pending = [root];\n  while (pending.length) {\n    const current = pending.pop();\n    const stat = lstatSync(current);\n    if (stat.isSymbolicLink()) throw new Error('installed runtime contains a link/reparse point');\n    if (!stat.isDirectory()) continue;\n    for (const entry of readdirSync(current)) pending.push(join(current, entry));\n  }\n}\n\nexport function validateDependencyLock(payloadRoot, expected) {\n  const lock = JSON.parse(readFileSync(join(payloadRoot, 'package-lock.json'), 'utf8'));\n  if (Number(lock.lockfileVersion) < 3 || !lock.packages || typeof lock.packages !== 'object') {\n    throw new Error('runtime dependency lock is missing or unsupported');\n  }\n  let foundPackage = false;\n  for (const [key, item] of Object.entries(lock.packages)) {\n    if (!key) continue;\n    if (item?.link === true) throw new Error(`runtime dependency lock contains link: ${key}`);\n    const isRunner = key.replaceAll('\\\\', '/').endsWith('node_modules/@algosuite/vo-mcp');\n    if (isRunner) {\n      foundPackage = item.version === expected.version && item.integrity === expected.integrity;\n      continue;\n    }\n    if (!INTEGRITY_RE.test(String(item?.integrity || ''))) throw new Error(`dependency lacks sha512 integrity: ${key}`);\n    if (!String(item?.resolved || '').startsWith('https://registry.npmjs.org/')) {\n      throw new Error(`dependency is not registry-pinned: ${key}`);\n    }\n  }\n  if (!foundPackage) throw new Error('installed runner package does not match registry integrity');\n}\n\nexport function writeAuthorizedInstallSeed(payloadRoot, tarball, runtimeAuthorization) {\n  const authorization = validateRuntimeAuthorization(runtimeAuthorization);\n  const stagingRoot = resolve(payloadRoot, '..', '..');\n  const tarballFromStaging = relative(stagingRoot, resolve(tarball));\n  if (!tarballFromStaging || tarballFromStaging === '..'\n    || tarballFromStaging.startsWith(`..${sep}`)\n    || isAbsolute(tarballFromStaging)) {\n    throw new Error('authorized runtime tarball escaped staging root');\n  }\n  const relativeTarball = relative(payloadRoot, resolve(tarball)).replaceAll('\\\\', '/');\n  if (!relativeTarball || isAbsolute(relativeTarball)\n    || relativeTarball.includes('\\n') || relativeTarball.includes('\\r')) {\n    throw new Error('authorized runtime tarball path invalid');\n  }\n  const fileSpec = `file:${relativeTarball}`;\n  const packageRecord = { name: 'algohq-runner-runtime', version: '0.0.0', private: true,\n    dependencies: { [PACKAGE_NAME]: fileSpec } };\n  const packages = structuredClone(authorization.dependency_lock.packages);\n  packages[`node_modules/${PACKAGE_NAME}`].resolved = fileSpec;\n  const lock = { name: packageRecord.name, version: packageRecord.version,\n    lockfileVersion: authorization.dependency_lock.source_lockfile_version,\n    requires: true, packages: { '': packageRecord, ...packages } };\n  writeFileSync(join(payloadRoot, 'package.json'), `${JSON.stringify(packageRecord)}\\n`, { mode: 0o600 });\n  writeFileSync(join(payloadRoot, 'package-lock.json'), `${JSON.stringify(lock)}\\n`, { mode: 0o600 });\n  return { fileSpec, lock };\n}\n\nfunction buildActive(slotId, metadata, paths) {\n  return {\n    slot_id: slotId,\n    version: metadata.version,\n    integrity: metadata.integrity,\n    entry_sha512: hashFileSha512(paths.entry),\n    supervisor_sha512: hashFileSha512(paths.supervisor),\n    tree_sha512: hashRuntimeTree(paths.slotRoot ?? paths.payloadRoot),\n  };\n}\n\nfunction installSlot({\n  runtimeRoot, metadata, tarball, runner, npmEnv, runOptions, force, runtimeAuthorization,\n}) {\n  const digest = createHash('sha256').update(metadata.integrity).digest('hex').slice(0, 16);\n  const suffix = force ? `${digest}-${randomUUID().slice(0, 8)}` : digest;\n  const slotId = `vo-mcp-${metadata.version}-${suffix}`;\n  const finalPaths = slotPaths(runtimeRoot, slotId);\n  if (!force && existsSync(finalPaths.slotRoot)) {\n    const manifest = JSON.parse(readFileSync(finalPaths.manifest, 'utf8'));\n    const active = buildActive(slotId, metadata, finalPaths);\n    const validated = validateSlot(runtimeRoot, active);\n    if (validated.ok && manifest.integrity === metadata.integrity) {\n      if (runtimeAuthorization) {\n        validateStagedRuntimeAuthorization({\n          payloadRoot: finalPaths.slotRoot, authorization: runtimeAuthorization,\n        });\n      }\n      return { active, created: false };\n    }\n  }\n\n  const staging = join(runtimeRoot, 'staging', randomUUID());\n  const payload = join(staging, 'payload');\n  let installedSlot = false;\n  try {\n    mkdirSync(payload, { recursive: true });\n    let installArgs;\n    if (runtimeAuthorization) {\n      writeAuthorizedInstallSeed(payload, tarball, runtimeAuthorization);\n      installArgs = ['ci', '--ignore-scripts', '--no-bin-links', '--no-audit', '--no-fund',\n        `--registry=${PUBLIC_REGISTRY}`];\n    } else {\n      writeFileSync(join(payload, 'package.json'), `${JSON.stringify({\n        name: 'algohq-runner-runtime', version: '0.0.0', private: true,\n      })}\\n`);\n      installArgs = ['install', '--ignore-scripts', '--no-bin-links', '--no-audit', '--no-fund',\n        '--package-lock=true', '--save-exact', `--registry=${PUBLIC_REGISTRY}`, tarball];\n    }\n    const install = runner.npm(installArgs,\n      { ...runOptions, cwd: payload, env: npmEnv, timeout: 180_000 });\n    if (install.status !== 0) throw new Error(`npm install failed: ${install.stderr || install.error?.message || install.status}`);\n    assertNoLinks(payload);\n    validateDependencyLock(payload, metadata);\n    if (runtimeAuthorization) {\n      validateStagedRuntimeAuthorization({ payloadRoot: payload, authorization: runtimeAuthorization });\n    }\n\n    const stagedPaths = {\n      entry: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp'),\n      supervisor: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js'),\n      packageJson: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'package.json'),\n      credentialHelper: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js'),\n      slotRoot: payload,\n    };\n    const pkg = JSON.parse(readFileSync(stagedPaths.packageJson, 'utf8'));\n    if (pkg.name !== PACKAGE_NAME || pkg.version !== metadata.version) throw new Error('installed package identity mismatch');\n    if (!lstatSync(stagedPaths.credentialHelper).isFile()) throw new Error('installed credential helper is missing');\n    const smoke = runner.node([stagedPaths.entry, 'runner', '--version'], { ...runOptions, cwd: payload, env: npmEnv, timeout: 30_000 });\n    if (smoke.status !== 0 || String(smoke.stdout || '').trim() !== `vo-mcp runner ${metadata.version}`) {\n      throw new Error('bundled runtime smoke check failed');\n    }\n    const active = buildActive(slotId, metadata, stagedPaths);\n    atomicWriteJson(join(payload, 'runtime-manifest.json'), { schema_version: 1, ...active });\n    mkdirSync(join(runtimeRoot, 'slots'), { recursive: true });\n    if (existsSync(finalPaths.slotRoot)) throw new Error('immutable runtime slot already exists');\n    renameSync(payload, finalPaths.slotRoot);\n    installedSlot = true;\n    const validated = validateSlot(runtimeRoot, active);\n    if (!validated.ok) throw new Error(`staged runtime validation failed: ${validated.detail}`);\n    return { active, created: true };\n  } catch (error) {\n    if (installedSlot) rmSync(finalPaths.slotRoot, { recursive: true, force: true });\n    throw error;\n  } finally {\n    rmSync(staging, { recursive: true, force: true });\n  }\n}\n\nexport function stageBundledRuntimeSlot(options) {\n  const {\n    runtimeRoot,\n    packageSpec,\n    expectedVersion,\n    expectedIntegrity,\n    platform = process.platform,\n    execPath = process.execPath,\n    env = process.env,\n    fileExists = existsSync,\n    run = defaultRun,\n    force = false,\n    runtimeAuthorization = null,\n  } = options;\n  if (!runtimeRoot || !isAbsolute(runtimeRoot)) return { ok: false, status: 2, detail: 'bundled runtime root unavailable' };\n  if (!expectedVersion || !PACKAGE_SPEC_RE.test(`${PACKAGE_NAME}@${expectedVersion}`)) {\n    return { ok: false, status: 2, detail: 'invalid expected runner version' };\n  }\n  if (!expectedIntegrity || !INTEGRITY_RE.test(expectedIntegrity)) {\n    return { ok: false, status: 2, detail: 'invalid expected runner integrity' };\n  }\n  const exactSpec = `${PACKAGE_NAME}@${expectedVersion}`;\n  if (packageSpec !== exactSpec) return { ok: false, status: 2, detail: 'runner package spec does not match authorized version' };\n  const resolvedRoot = resolve(runtimeRoot);\n  const npmEnv = buildMinimalMaintenanceEnv(env, resolvedRoot);\n  const runOptions = { env: npmEnv, cwd: resolvedRoot };\n  let tarDir = null;\n  try {\n    mkdirSync(resolvedRoot, { recursive: true });\n    mkdirSync(join(resolvedRoot, 'maintenance'), { recursive: true });\n    writeFileSync(npmEnv.npm_config_userconfig, '', { mode: 0o600 });\n    writeFileSync(npmEnv.npm_config_globalconfig, '', { mode: 0o600 });\n    const runner = commandRunner({ platform, execPath, env: npmEnv, fileExists, run });\n    const metadata = { version: expectedVersion, integrity: expectedIntegrity };\n    tarDir = join(resolvedRoot, 'staging', randomUUID());\n    mkdirSync(tarDir, { recursive: true });\n    const packed = parseJsonOutput(runner.npm([\n      'pack', exactSpec, '--ignore-scripts', '--json', '--pack-destination', tarDir, `--registry=${PUBLIC_REGISTRY}`,\n    ], runOptions), 'npm pack');\n    const record = Array.isArray(packed) ? packed[0] : packed;\n    const tarball = join(tarDir, basename(String(record?.filename || '')));\n    if (!existsSync(tarball) || !basename(tarball).endsWith('.tgz')) throw new Error('npm pack returned no tarball');\n    if (lstatSync(tarball).size > MAX_TARBALL_BYTES) throw new Error('runner package tarball exceeds size limit');\n    if (record.integrity !== metadata.integrity || tarballIntegrity(tarball) !== metadata.integrity) {\n      throw new Error('runner package sha512 integrity mismatch');\n    }\n    const installed = installSlot({\n      runtimeRoot: resolvedRoot, metadata, tarball, runner, npmEnv, runOptions, force,\n      runtimeAuthorization,\n    });\n    return { ok: true, status: 0, ...installed };\n  } catch (error) {\n    return { ok: false, status: 1, detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env) };\n  } finally {\n    if (tarDir) rmSync(tarDir, { recursive: true, force: true });\n  }\n}\n\nexport function stageAndActivateBundledUpdate(options) {\n  const staged = stageBundledRuntimeSlot(options);\n  if (!staged.ok) return staged;\n  try {\n    activateSlot(resolve(options.runtimeRoot), staged.active, options.action);\n    return { ...staged, handoff: true };\n  } catch (error) {\n    return {\n      ok: false,\n      status: 1,\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), options.env ?? process.env),\n    };\n  }\n}\n\nexport const __test = { INTEGRITY_RE, PACKAGE_SPEC_RE, PUBLIC_REGISTRY, assertNoLinks, tarballIntegrity };\n", "import { createHash } from 'node:crypto';\nimport { readFileSync } from 'node:fs';\nimport { dirname, posix, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport {\n  compareStagedRuntime,\n  isOmittedOptionalPackage,\n} from './runtime-staged-tree.mjs';\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nexport const BETA13_WINDOWS_X64_AUTHORIZATION = resolve(\n  HERE,\n  'authorizations',\n  'vo-mcp-0.2.0-beta.13-win32-x64.json',\n);\n\nconst EXPECTED = Object.freeze({\n  authorizationId: 'vo-mcp-0.2.0-beta.13-win32-x64-v1',\n  packageName: '@algosuite/vo-mcp',\n  version: '0.2.0-beta.13',\n  registry: 'https://registry.npmjs.org/',\n  tarballUrl: 'https://registry.npmjs.org/@algosuite/vo-mcp/-/vo-mcp-0.2.0-beta.13.tgz',\n  integrity: 'sha512-TQa5VaEFsaleHbAZZp+zS4u5U/0zQBIGOiPDGn9IqfZfdMltH2dY81nTftvu5EUABthE1xTCrdSzJjO9mzkNag==',\n  tarballSha256: 'c1e39e8bb2df7f53f48e46e77ffb617452a01849469ff4757b4384a478c1cbff',\n  npmShasumSha1: 'f076649b31294aa38deb7852f38a889e0d0fbe44',\n  gitHead: 'ba00db90720416fa7474581eb823c6255221880f',\n  sourceLockSha256: 'f8bbb5e81a0057ee2d60145580ec07f7e7055d999bdd038515c6c4e88af6cc92',\n  canonicalEntriesSha256: '7f6b2f93ccb93ad625ed244dc59ac556792e478178fc690ad2ca2c6f3a2325d2',\n  entryCount: 107,\n  optionalEntryCount: 13,\n  installedEntryCount: 96,\n  treeAlgorithm: 'algohq-node-modules-manifest-sha256-v1',\n  treeSha256: '9c8b0749d7ae1e2c132ef08c5b5655673ae88432859c561806276c9eb18f4874',\n  treeFileCount: 3538,\n  treeDirectoryCount: 553,\n  treeByteCount: 20566445,\n  treeManifestByteCount: 412062,\n});\n\nconst SRI_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst SHA256_RE = /^[a-f0-9]{64}$/u;\n\nfunction canonical(value) {\n  if (Array.isArray(value)) return value.map(canonical);\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));\n  }\n  return value;\n}\n\nfunction sha256Canonical(value) {\n  return createHash('sha256').update(`${JSON.stringify(canonical(value))}\\n`, 'utf8').digest('hex');\n}\n\nfunction assertEqual(actual, expected, label) {\n  if (actual !== expected) throw new Error(`runtime authorization ${label} mismatch`);\n}\n\nfunction isOmittedOnWindowsX64(entry) {\n  return isOmittedOptionalPackage(entry, { os: 'win32', arch: 'x64' });\n}\n\nexport function validateRuntimeAuthorization(value) {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('runtime authorization must be an object');\n  }\n  assertEqual(value.schema_version, 1, 'schema version');\n  assertEqual(value.authorization_id, EXPECTED.authorizationId, 'id');\n  assertEqual(value.package?.name, EXPECTED.packageName, 'package name');\n  assertEqual(value.package?.version, EXPECTED.version, 'package version');\n  assertEqual(value.package?.registry, EXPECTED.registry, 'registry');\n  assertEqual(value.package?.tarball_url, EXPECTED.tarballUrl, 'tarball URL');\n  assertEqual(value.package?.sri_sha512, EXPECTED.integrity, 'package integrity');\n  assertEqual(value.package?.tarball_sha256, EXPECTED.tarballSha256, 'tarball sha256');\n  assertEqual(value.package?.npm_shasum_sha1, EXPECTED.npmShasumSha1, 'npm shasum');\n  assertEqual(value.package?.git_head, EXPECTED.gitHead, 'git head');\n  assertEqual(value.package?.packed_file_count, 25, 'packed file count');\n  assertEqual(value.package?.packed_bytes, 846151, 'packed byte count');\n  assertEqual(value.package?.unpacked_bytes, 3350387, 'unpacked byte count');\n\n  assertEqual(value.platform?.os, 'win32', 'operating system');\n  assertEqual(value.platform?.arch, 'x64', 'architecture');\n  assertEqual(value.platform?.package_node_engine, '>=22.5.0', 'package node engine');\n  if (!/^24\\.15\\.0$/u.test(String(value.platform?.authorization_builder_node || ''))\n    || value.platform?.authorization_builder_npm !== '11.12.1') {\n    throw new Error('runtime authorization builder toolchain mismatch');\n  }\n\n  for (const [key, expected] of Object.entries({\n    ignore_scripts: true,\n    bin_links: false,\n    include_optional: true,\n    omit_dev: true,\n    audit: false,\n    fund: false,\n    reject_links_reparse_points: true,\n    reject_hardlinks: true,\n    remove_generated_node_modules_package_lock_before_tree_validation: true,\n  })) assertEqual(value.install_contract?.[key], expected, `install contract ${key}`);\n  assertEqual(value.install_contract?.allowed_registry_prefix, EXPECTED.registry, 'registry prefix');\n\n  const lock = value.dependency_lock;\n  if (!lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {\n    throw new Error('runtime authorization dependency set missing');\n  }\n  assertEqual(lock.source_lockfile_version, 3, 'lockfile version');\n  assertEqual(lock.source_lock_sha256, EXPECTED.sourceLockSha256, 'source lock sha256');\n  assertEqual(lock.canonical_entries_sha256, EXPECTED.canonicalEntriesSha256, 'entry-set sha256');\n  assertEqual(lock.entry_count, EXPECTED.entryCount, 'entry count');\n  assertEqual(lock.integrity_entry_count, EXPECTED.entryCount, 'integrity count');\n  assertEqual(lock.optional_entry_count, EXPECTED.optionalEntryCount, 'optional count');\n  assertEqual(lock.windows_x64_installed_entry_count, EXPECTED.installedEntryCount, 'installed count');\n\n  const entries = Object.entries(lock.packages);\n  assertEqual(entries.length, EXPECTED.entryCount, 'package map count');\n  for (const [key, entry] of entries) {\n    if (!key.startsWith('node_modules/') || key.includes('\\\\') || posix.normalize(key) !== key\n      || key.split('/').includes('..')) {\n      throw new Error(`runtime authorization has unsafe package path: ${key}`);\n    }\n    if (!entry || typeof entry !== 'object' || entry.link === true) {\n      throw new Error(`runtime authorization contains a linked package: ${key}`);\n    }\n    if (!SRI_RE.test(String(entry.integrity || ''))) {\n      throw new Error(`runtime authorization package lacks sha512 integrity: ${key}`);\n    }\n    if (!String(entry.resolved || '').startsWith(EXPECTED.registry)) {\n      throw new Error(`runtime authorization package is outside the public registry: ${key}`);\n    }\n    if (entry.hasInstallScript === true) {\n      throw new Error(`runtime authorization package declares an install script: ${key}`);\n    }\n  }\n  const runner = lock.packages['node_modules/@algosuite/vo-mcp'];\n  assertEqual(runner?.version, EXPECTED.version, 'runner dependency version');\n  assertEqual(runner?.integrity, EXPECTED.integrity, 'runner dependency integrity');\n  assertEqual(sha256Canonical(lock.packages), EXPECTED.canonicalEntriesSha256, 'computed entry-set sha256');\n\n  const omitted = entries.filter(([, entry]) => isOmittedOnWindowsX64(entry)).map(([key]) => key).sort();\n  const declaredOmitted = [...(lock.windows_x64_omitted_optional_entries || [])].sort();\n  assertEqual(JSON.stringify(declaredOmitted), JSON.stringify(omitted), 'omitted optional entries');\n  assertEqual(entries.length - omitted.length, EXPECTED.installedEntryCount, 'derived installed count');\n\n  const tree = value.installed_tree;\n  assertEqual(tree?.algorithm, EXPECTED.treeAlgorithm, 'tree algorithm');\n  if (!SHA256_RE.test(String(tree?.sha256 || ''))) throw new Error('runtime authorization tree hash invalid');\n  assertEqual(tree.sha256, EXPECTED.treeSha256, 'tree sha256');\n  assertEqual(tree.file_count, EXPECTED.treeFileCount, 'tree file count');\n  assertEqual(tree.directory_count, EXPECTED.treeDirectoryCount, 'tree directory count');\n  assertEqual(tree.byte_count, EXPECTED.treeByteCount, 'tree byte count');\n  assertEqual(tree.canonical_manifest_byte_count, EXPECTED.treeManifestByteCount, 'tree manifest byte count');\n  assertEqual(tree.reparse_point_count, 0, 'tree reparse count');\n  assertEqual(tree.hardlinked_file_count, 0, 'tree hardlink count');\n  return value;\n}\n\nexport function readRuntimeAuthorization(file = BETA13_WINDOWS_X64_AUTHORIZATION) {\n  return validateRuntimeAuthorization(JSON.parse(readFileSync(file, 'utf8')));\n}\n\nexport function validateStagedRuntimeAuthorization(options) {\n  const authorization = validateRuntimeAuthorization(options?.authorization || readRuntimeAuthorization());\n  return compareStagedRuntime({ ...options, authorization });\n}\n\nif (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {\n  readRuntimeAuthorization(process.argv[2] ? resolve(process.argv[2]) : undefined);\n  process.stdout.write('AlgoHQ runtime authorization valid\\n');\n}\n\nexport const __test = { canonical, isOmittedOnWindowsX64, sha256Canonical };\n", "import { execFileSync } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n  existsSync,\n  lstatSync,\n  readFileSync,\n  readdirSync,\n} from 'node:fs';\nimport { isAbsolute, join, relative, resolve, sep, win32 } from 'node:path';\n\nconst WINDOWS_REPARSE_ATTRIBUTE = 0x400;\nconst RUNNER_LOCK_KEY = 'node_modules/@algosuite/vo-mcp';\nexport const INSTALLED_TREE_ALGORITHM = 'algohq-node-modules-manifest-sha256-v1';\n\nfunction canonical(value) {\n  if (Array.isArray(value)) return value.map(canonical);\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));\n  }\n  return value;\n}\n\nfunction canonicalJson(value) {\n  return JSON.stringify(canonical(value));\n}\n\nfunction hasFileAttribute(value, bit) {\n  if (typeof value === 'bigint') return (value & BigInt(bit)) !== 0n;\n  return Number.isSafeInteger(value) && (value & bit) !== 0;\n}\n\nexport function isReparseStat(stats) {\n  if (!stats || typeof stats !== 'object') return false;\n  if (typeof stats.isSymbolicLink === 'function' && stats.isSymbolicLink()) return true;\n  if (stats.reparseTag !== undefined && stats.reparseTag !== null && stats.reparseTag !== 0) return true;\n  return ['fileAttributes', 'fileAttribute', 'attributes']\n    .some((key) => hasFileAttribute(stats[key], WINDOWS_REPARSE_ATTRIBUTE));\n}\n\nexport function platformConstraintAllows(values, target) {\n  if (!Array.isArray(values) || values.length === 0) return true;\n  if (values.some((value) => value === `!${target}`)) return false;\n  const positive = values.filter((value) => typeof value === 'string' && !value.startsWith('!'));\n  return positive.length === 0 || positive.includes(target);\n}\n\nexport function isOmittedOptionalPackage(entry, platform = { os: 'win32', arch: 'x64' }) {\n  return entry?.optional === true && (\n    !platformConstraintAllows(entry.os, platform.os)\n    || !platformConstraintAllows(entry.cpu, platform.arch)\n  );\n}\n\nfunction assertContained(root, candidate, label) {\n  const rel = relative(root, candidate);\n  if (rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel))) return;\n  throw new Error(`staged runtime ${label} escapes the payload root`);\n}\n\nfunction normalizeReportedPath(root, candidate) {\n  const absolute = resolve(String(candidate || ''));\n  assertContained(root, absolute, 'reparse point');\n  return absolute;\n}\n\nexport function listWindowsReparsePoints(root, {\n  execFile = execFileSync, env = process.env, platform = process.platform,\n} = {}) {\n  if (platform !== 'win32') return [];\n  const systemRoot = String(env.SystemRoot || env.SYSTEMROOT || '');\n  if (!win32.isAbsolute(systemRoot) || win32.normalize(systemRoot) !== systemRoot) {\n    throw new Error('staged runtime trusted PowerShell root unavailable');\n  }\n  const system32 = win32.join(systemRoot, 'System32');\n  const powershell = win32.join(system32, 'WindowsPowerShell', 'v1.0', 'powershell.exe');\n  const script = [\n    '$ErrorActionPreference = \"Stop\"',\n    '$root = [IO.Path]::GetFullPath($env:ALGOHQ_REPARSE_ROOT)',\n    '$items = @((Get-Item -LiteralPath $root -Force)) + @(Get-ChildItem -LiteralPath $root -Force -Recurse)',\n    'foreach ($item in $items) {',\n    '  if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {',\n    '    [Console]::Out.WriteLine($item.FullName)',\n    '  }',\n    '}',\n  ].join('; ');\n  const output = execFile(powershell, [\n    '-NoLogo',\n    '-NoProfile',\n    '-NonInteractive',\n    '-Command',\n    script,\n  ], {\n    cwd: system32,\n    encoding: 'utf8',\n    env: { SystemRoot: systemRoot, ALGOHQ_REPARSE_ROOT: win32.resolve(root) },\n    windowsHide: true,\n  });\n  return String(output || '').split(/\\r?\\n/u).filter(Boolean)\n    .map((item) => normalizeReportedPath(root, item));\n}\n\nfunction normalizedRunnerRecord(actual, expected) {\n  const normalized = structuredClone(actual);\n  if (normalized?.resolved === expected?.resolved) return normalized;\n  if (typeof normalized?.resolved !== 'string' || !normalized.resolved.startsWith('file:')) {\n    return normalized;\n  }\n  const fileName = normalized.resolved.slice('file:'.length).replaceAll('\\\\', '/').split('/').at(-1);\n  const expectedFileNames = new Set([\n    String(expected.resolved || '').split('/').at(-1),\n    `algosuite-vo-mcp-${expected.version}.tgz`,\n  ]);\n  if (expectedFileNames.has(fileName)) normalized.resolved = expected.resolved;\n  return normalized;\n}\n\nfunction validateLock(lock, authorization) {\n  if (!lock || typeof lock !== 'object' || Array.isArray(lock)) {\n    throw new Error('staged runtime package-lock must be an object');\n  }\n  if (lock.lockfileVersion !== authorization.dependency_lock.source_lockfile_version) {\n    throw new Error('staged runtime package-lock version mismatch');\n  }\n  if (!lock.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {\n    throw new Error('staged runtime package-lock package map missing');\n  }\n  const expected = authorization.dependency_lock.packages;\n  const actual = Object.fromEntries(Object.entries(lock.packages).filter(([key]) => key !== ''));\n  const expectedKeys = Object.keys(expected).sort();\n  const actualKeys = Object.keys(actual).sort();\n  if (canonicalJson(actualKeys) !== canonicalJson(expectedKeys)) {\n    throw new Error('staged runtime package-lock package set mismatch');\n  }\n  for (const key of expectedKeys) {\n    const record = key === RUNNER_LOCK_KEY\n      ? normalizedRunnerRecord(actual[key], expected[key])\n      : actual[key];\n    if (canonicalJson(record) !== canonicalJson(expected[key])) {\n      throw new Error(`staged runtime package-lock record mismatch: ${key}`);\n    }\n  }\n  return { actual, expected };\n}\n\nfunction checkPathKind(path, expectedKind, fsOps, label) {\n  if (!fsOps.exists(path)) throw new Error(`staged runtime ${label} missing`);\n  const stats = fsOps.lstat(path);\n  if (isReparseStat(stats) || fsOps.isReparsePoint(path, stats)) {\n    throw new Error(`staged runtime ${label} is a reparse point`);\n  }\n  if (expectedKind === 'directory' && !stats.isDirectory()) {\n    throw new Error(`staged runtime ${label} is not a directory`);\n  }\n  if (expectedKind === 'file' && !stats.isFile()) {\n    throw new Error(`staged runtime ${label} is not a regular file`);\n  }\n  if (expectedKind === 'file' && Number(stats.nlink) > 1) {\n    throw new Error(`staged runtime ${label} is hardlinked`);\n  }\n  return stats;\n}\n\nfunction verifyInstalledPackages(payloadRoot, packageRecords, platform, fsOps) {\n  const omitted = [];\n  let installed = 0;\n  for (const [key, entry] of Object.entries(packageRecords)) {\n    const path = resolve(payloadRoot, key);\n    assertContained(payloadRoot, path, 'package path');\n    const shouldOmit = isOmittedOptionalPackage(entry, platform);\n    if (shouldOmit) {\n      omitted.push(key);\n      if (fsOps.exists(path)) throw new Error(`staged runtime optional package should be omitted: ${key}`);\n      continue;\n    }\n    checkPathKind(path, 'directory', fsOps, `installed package ${key}`);\n    installed += 1;\n  }\n  return { installed, omitted: omitted.sort() };\n}\n\nfunction treeRecord(kind, path, stats, fileHash = '') {\n  if (kind === 'd') return `d\\t${path}\\r\\n`;\n  return `f\\t${path}\\t${stats.size}\\t${fileHash}\\r\\n`;\n}\n\nexport function computeInstalledTree(nodeModulesRoot, fsOps = {}) {\n  const ops = {\n    exists: existsSync,\n    lstat: lstatSync,\n    readdir: (path) => readdirSync(path, { withFileTypes: true }),\n    readFile: readFileSync,\n    isReparsePoint: () => false,\n    listReparsePoints: listWindowsReparsePoints,\n    ...fsOps,\n  };\n  const root = resolve(nodeModulesRoot);\n  checkPathKind(root, 'directory', ops, 'node_modules root');\n  const reported = ops.listReparsePoints(root);\n  if (!Array.isArray(reported)) throw new Error('staged runtime reparse probe returned an invalid result');\n  if (reported.length > 0) throw new Error('staged runtime tree contains a Windows reparse point');\n\n  let fileCount = 0;\n  let directoryCount = 1;\n  let byteCount = 0;\n  const entries = [];\n  function walk(absolute, relativePath) {\n    for (const entry of ops.readdir(absolute)) {\n      const childRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;\n      if (childRelative === '.package-lock.json') continue;\n      const child = resolve(absolute, entry.name);\n      assertContained(root, child, 'tree entry');\n      const stats = ops.lstat(child);\n      if (isReparseStat(stats) || ops.isReparsePoint(child, stats)) {\n        throw new Error(`staged runtime tree contains a reparse point: ${childRelative}`);\n      }\n      if (stats.isDirectory()) {\n        directoryCount += 1;\n        entries.push({ kind: 'd', path: childRelative, stats });\n        walk(child, childRelative);\n      } else if (stats.isFile()) {\n        if (Number(stats.nlink) > 1) {\n          throw new Error(`staged runtime tree contains a hardlinked file: ${childRelative}`);\n        }\n        fileCount += 1;\n        byteCount += Number(stats.size);\n        const digest = createHash('sha256').update(ops.readFile(child)).digest('hex');\n        entries.push({ kind: 'f', path: childRelative, stats, digest });\n      } else {\n        throw new Error(`staged runtime tree contains a non-file entry: ${childRelative}`);\n      }\n    }\n  }\n  walk(root, '');\n  entries.sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));\n  const manifest = treeRecord('d', '', { size: 0 }) + entries\n    .map((entry) => treeRecord(entry.kind, entry.path, entry.stats, entry.digest))\n    .join('');\n  return {\n    algorithm: INSTALLED_TREE_ALGORITHM,\n    sha256: createHash('sha256').update(manifest, 'utf8').digest('hex'),\n    file_count: fileCount,\n    directory_count: directoryCount,\n    byte_count: byteCount,\n    canonical_manifest_byte_count: Buffer.byteLength(manifest),\n    reparse_point_count: 0,\n    hardlinked_file_count: 0,\n  };\n}\n\nexport function compareStagedRuntime({\n  payloadRoot,\n  nodeModulesRoot = join(payloadRoot, 'node_modules'),\n  packageLockFile = join(payloadRoot, 'package-lock.json'),\n  authorization,\n  fsOps = {},\n}) {\n  const payload = resolve(payloadRoot);\n  const modules = resolve(nodeModulesRoot);\n  const lockFile = resolve(packageLockFile);\n  if (modules !== resolve(payload, 'node_modules') || lockFile !== resolve(payload, 'package-lock.json')) {\n    throw new Error('staged runtime paths do not identify one canonical payload');\n  }\n  const ops = {\n    exists: existsSync,\n    lstat: lstatSync,\n    readFile: readFileSync,\n    isReparsePoint: () => false,\n    ...fsOps,\n  };\n  checkPathKind(lockFile, 'file', ops, 'package-lock');\n  const lock = JSON.parse(ops.readFile(lockFile, 'utf8'));\n  const { expected } = validateLock(lock, authorization);\n  const platform = { os: authorization.platform.os, arch: authorization.platform.arch };\n  const packages = verifyInstalledPackages(payload, expected, platform, ops);\n  const declaredOmitted = [...authorization.dependency_lock.windows_x64_omitted_optional_entries].sort();\n  if (canonicalJson(packages.omitted) !== canonicalJson(declaredOmitted)) {\n    throw new Error('staged runtime optional omission list mismatch');\n  }\n  if (packages.installed !== Object.keys(expected).length - packages.omitted.length) {\n    throw new Error('staged runtime installed package count mismatch');\n  }\n  const tree = computeInstalledTree(modules, fsOps);\n  if (canonicalJson(tree) !== canonicalJson(authorization.installed_tree)) {\n    throw new Error('staged runtime installed tree mismatch');\n  }\n  return { ok: true, packageCount: Object.keys(expected).length, ...packages, tree };\n}\n\nexport const __test = { canonical, canonicalJson, normalizeReportedPath, normalizedRunnerRecord };\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n  closeSync,\n  existsSync,\n  fsyncSync,\n  lstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, isAbsolute, join, relative, resolve } from 'node:path';\n\nconst SLOT_ID_RE = /^vo-mcp-[0-9A-Za-z._-]{1,96}$/u;\nconst ACTION_ID_RE = /^[0-9A-Za-z._-]{1,128}$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst VERSION_RE = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst ENTRY_REL = join('node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp');\nconst SUPERVISOR_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js');\nconst PACKAGE_REL = join('node_modules', '@algosuite', 'vo-mcp', 'package.json');\nconst CREDENTIAL_HELPER_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js');\nconst MANIFEST_FILE = 'runtime-manifest.json';\n\nfunction within(parent, candidate) {\n  const rel = relative(resolve(parent), resolve(candidate));\n  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));\n}\n\n/**\n * Mirror of the desktop app's runtime-root resolution: RUNNER_RUNTIME_DIR\n * under Tauri's BaseDirectory::AppData for the app identifier. MUST stay in\n * lockstep with packages/vo-runner-app/src-tauri/src/runtime_slots.rs\n * (`RUNNER_RUNTIME_DIR`) and tauri.conf.json (`identifier`), or supervisors\n * and the app would stage/read different roots.\n */\nconst APP_IDENTIFIER = 'ai.algosuite.vo-runner';\nconst RUNNER_RUNTIME_DIR = 'runner-runtime';\n\nexport function defaultRuntimeRoot({ platform = process.platform, env = process.env, home = homedir() } = {}) {\n  if (platform === 'win32') {\n    const appData = String(env.APPDATA || '').trim();\n    return appData && isAbsolute(appData) ? join(appData, APP_IDENTIFIER, RUNNER_RUNTIME_DIR) : null;\n  }\n  if (!home) return null;\n  if (platform === 'darwin') {\n    return join(home, 'Library', 'Application Support', APP_IDENTIFIER, RUNNER_RUNTIME_DIR);\n  }\n  const xdg = String(env.XDG_CONFIG_HOME || '').trim();\n  const base = xdg && isAbsolute(xdg) ? xdg : join(home, '.config');\n  return join(base, APP_IDENTIFIER, RUNNER_RUNTIME_DIR);\n}\n\n/**\n * Explicit VO_RUNNER_RUNTIME_ROOT always wins, and a SET-but-invalid value\n * still fails closed (null \u2014 a misconfiguration must not silently fall back).\n * When the variable is ABSENT, derive the app-convention default: a\n * supervisor launched by an env-stripping wrapper (live-observed on\n * vo-code-runner-JacksPC, 2026-07-21: every bundled update hard-failed\n * \"bundled runtime root unavailable\") can then still stage/activate the\n * governed update into the exact directory the desktop app reads.\n */\nexport function runtimeRootFromEnv(env = process.env, { platform, home } = {}) {\n  const value = String(env.VO_RUNNER_RUNTIME_ROOT || '').trim();\n  if (value) return isAbsolute(value) ? resolve(value) : null;\n  const derived = defaultRuntimeRoot({ platform, env, home });\n  return derived ? resolve(derived) : null;\n}\n\nexport function hashFileSha512(file) {\n  return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\n/** Digest every executable payload byte and relative path, excluding only the self-referential manifest. */\nexport function hashRuntimeTree(root) {\n  const hasher = createHash('sha512');\n  const files = [];\n  const visit = (directory, prefix = '') => {\n    const rootStat = lstatSync(directory);\n    if (rootStat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n    if (!rootStat.isDirectory()) throw new Error('runtime tree root is not a directory');\n    for (const name of readdirSync(directory).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) {\n      const absolute = join(directory, name);\n      const relativePath = prefix ? `${prefix}/${name}` : name;\n      const stat = lstatSync(absolute);\n      if (stat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n      if (stat.isDirectory()) visit(absolute, relativePath);\n      else if (stat.isFile() && relativePath !== MANIFEST_FILE) files.push({ absolute, relativePath, size: stat.size });\n      else if (!stat.isFile()) throw new Error('runtime tree contains a non-regular file');\n    }\n  };\n  visit(root);\n  files.sort((a, b) => Buffer.compare(Buffer.from(a.relativePath), Buffer.from(b.relativePath)));\n  for (const file of files) {\n    const pathBytes = Buffer.from(file.relativePath, 'utf8');\n    hasher.update(`${pathBytes.length}:`);\n    hasher.update(pathBytes);\n    hasher.update(`:${file.size}:`);\n    hasher.update(readFileSync(file.absolute));\n    hasher.update('\\n');\n  }\n  return `sha512-${hasher.digest('base64')}`;\n}\n\nexport function atomicWriteJson(file, value) {\n  mkdirSync(dirname(file), { recursive: true });\n  const temp = join(dirname(file), `.${randomUUID()}.tmp`);\n  const fd = openSync(temp, 'wx', 0o600);\n  try {\n    writeFileSync(fd, `${JSON.stringify(value, null, 2)}\\n`, 'utf8');\n    fsyncSync(fd);\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(temp, file);\n    // A file fsync does not make the directory entry durable on POSIX. Windows\n    // cannot open directories this way, so keep the durability upgrade best-effort.\n    if (process.platform !== 'win32') {\n      try {\n        const parentFd = openSync(dirname(file), 'r');\n        try { fsyncSync(parentFd); } finally { closeSync(parentFd); }\n      } catch { /* current.json remains atomically committed */ }\n    }\n  } finally {\n    rmSync(temp, { force: true });\n  }\n}\n\nexport function readActivation(runtimeRoot) {\n  const file = join(runtimeRoot, 'current.json');\n  if (!existsSync(file)) return null;\n  try {\n    const value = JSON.parse(readFileSync(file, 'utf8'));\n    return value?.schema_version === 1 ? value : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function slotPaths(runtimeRoot, slotId) {\n  if (!SLOT_ID_RE.test(slotId)) throw new Error('invalid runtime slot id');\n  const slotRoot = join(runtimeRoot, 'slots', slotId);\n  return {\n    slotRoot,\n    entry: join(slotRoot, ENTRY_REL),\n    supervisor: join(slotRoot, SUPERVISOR_REL),\n    packageJson: join(slotRoot, PACKAGE_REL),\n    credentialHelper: join(slotRoot, CREDENTIAL_HELPER_REL),\n    manifest: join(slotRoot, MANIFEST_FILE),\n  };\n}\n\nfunction validActive(active) {\n  return active\n    && SLOT_ID_RE.test(active.slot_id)\n    && VERSION_RE.test(active.version)\n    && INTEGRITY_RE.test(active.integrity)\n    && INTEGRITY_RE.test(active.entry_sha512)\n    && INTEGRITY_RE.test(active.supervisor_sha512)\n    && INTEGRITY_RE.test(active.tree_sha512);\n}\n\nexport function validateSlot(runtimeRoot, active) {\n  if (!validActive(active)) return { ok: false, detail: 'invalid activation metadata' };\n  const paths = slotPaths(runtimeRoot, active.slot_id);\n  try {\n    const manifest = JSON.parse(readFileSync(paths.manifest, 'utf8'));\n    const pkg = JSON.parse(readFileSync(paths.packageJson, 'utf8'));\n    const expected = {\n      slot_id: active.slot_id,\n      version: active.version,\n      integrity: active.integrity,\n      entry_sha512: active.entry_sha512,\n      supervisor_sha512: active.supervisor_sha512,\n      tree_sha512: active.tree_sha512,\n    };\n    for (const [key, value] of Object.entries(expected)) {\n      if (manifest?.[key] !== value) return { ok: false, detail: `manifest ${key} mismatch` };\n    }\n    if (manifest?.schema_version !== 1 || pkg?.name !== '@algosuite/vo-mcp' || pkg?.version !== active.version) {\n      return { ok: false, detail: 'package identity mismatch' };\n    }\n    if (lstatSync(paths.entry).isSymbolicLink() || lstatSync(paths.supervisor).isSymbolicLink()\n      || lstatSync(paths.credentialHelper).isSymbolicLink()) {\n      return { ok: false, detail: 'runtime entry cannot be a link' };\n    }\n    if (!within(paths.slotRoot, realpathSync(paths.entry)) || !within(paths.slotRoot, realpathSync(paths.supervisor))\n      || !within(paths.slotRoot, realpathSync(paths.credentialHelper))) {\n      return { ok: false, detail: 'runtime entry escaped its slot' };\n    }\n    if (hashFileSha512(paths.entry) !== active.entry_sha512) return { ok: false, detail: 'entry hash mismatch' };\n    if (hashFileSha512(paths.supervisor) !== active.supervisor_sha512) return { ok: false, detail: 'supervisor hash mismatch' };\n    if (hashRuntimeTree(paths.slotRoot) !== active.tree_sha512) return { ok: false, detail: 'runtime tree hash mismatch' };\n    return { ok: true, paths, manifest };\n  } catch (error) {\n    return { ok: false, detail: error instanceof Error ? error.message : String(error) };\n  }\n}\n\nexport function journalActivation(runtimeRoot, actionId, state, detail = '') {\n  if (!ACTION_ID_RE.test(actionId)) throw new Error('invalid runner action id');\n  atomicWriteJson(join(runtimeRoot, 'transactions', `${actionId}.json`), {\n    schema_version: 1,\n    action_id: actionId,\n    state,\n    detail: String(detail).slice(0, 400),\n    updated_at: new Date().toISOString(),\n  });\n}\n\nexport function activateSlot(runtimeRoot, active, action) {\n  if (!validActive(active)) throw new Error('cannot activate invalid runtime metadata');\n  if (!ACTION_ID_RE.test(action.actionId)) throw new Error('invalid runner action id');\n  if (!UUID_RE.test(String(action.supervisorInstanceId || ''))) throw new Error('invalid claiming supervisor instance id');\n  const validated = validateSlot(runtimeRoot, active);\n  if (!validated.ok) throw new Error(`cannot activate invalid runtime slot: ${validated.detail}`);\n  const current = readActivation(runtimeRoot);\n  if (current?.pending) throw new Error('another runtime activation is still pending');\n  const pointer = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active,\n    previous: validActive(current?.active) ? current.active : null,\n    pending: {\n      action_id: action.actionId,\n      runner_id: String(action.runnerId || ''),\n      operator_id: String(action.operatorId || ''),\n      supervisor_instance_id: action.supervisorInstanceId,\n      activated_at: new Date().toISOString(),\n      ack_attempts: 0,\n    },\n  };\n  // The pointer rename is the transaction commit and therefore the last\n  // fallible write. A crash before it leaves the previous runtime selected.\n  journalActivation(runtimeRoot, action.actionId, 'prepared', `${active.version} ${active.integrity}`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n  return pointer;\n}\n\nexport function activationSupervisorInstanceId(runtimeRoot, fallback) {\n  const current = runtimeRoot ? readActivation(runtimeRoot) : null;\n  const pending = String(current?.pending?.supervisor_instance_id || '');\n  if (UUID_RE.test(pending)) return pending;\n  return UUID_RE.test(String(fallback || '')) ? fallback : null;\n}\n\nexport function recordActivationRetry(runtimeRoot, pointer, detail) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before retry');\n  }\n  const attempts = Math.max(0, Number(current.pending.ack_attempts || 0)) + 1;\n  const updated = {\n    ...current,\n    pending: { ...current.pending, ack_attempts: attempts, last_error: String(detail).slice(0, 240) },\n  };\n  atomicWriteJson(join(runtimeRoot, 'current.json'), updated);\n  journalActivation(runtimeRoot, current.pending.action_id, 'ack-retry', `attempt ${attempts}: ${detail}`);\n  return updated;\n}\n\n/** One-time migration for an old desktop launcher that has no control action. */\nexport function bootstrapSlot(runtimeRoot, active, bootstrapId) {\n  if (!ACTION_ID_RE.test(bootstrapId)) throw new Error('invalid bootstrap id');\n  const validated = validateSlot(runtimeRoot, active);\n  if (!validated.ok) throw new Error(`cannot bootstrap invalid runtime slot: ${validated.detail}`);\n  const current = readActivation(runtimeRoot);\n  if (current?.pending) throw new Error('another runtime activation is still pending');\n  if (current?.active?.slot_id === active.slot_id && current.active.integrity === active.integrity) return current;\n  const pointer = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active,\n    previous: validActive(current?.active) ? current.active : null,\n    pending: null,\n  };\n  journalActivation(runtimeRoot, bootstrapId, 'bootstrap-prepared', `${active.version} ${active.integrity}`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n  try { journalActivation(runtimeRoot, bootstrapId, 'bootstrap-activated', `${active.version} active`); } catch { /* best effort */ }\n  return pointer;\n}\n\n/** Restore the exact pre-bootstrap pointer without overwriting a newer activation. */\nexport function restoreBootstrapActivation(runtimeRoot, expectedActive, prior, rollbackId) {\n  if (!ACTION_ID_RE.test(rollbackId)) throw new Error('invalid bootstrap rollback id');\n  const current = readActivation(runtimeRoot);\n  if (current?.active?.slot_id !== expectedActive?.slot_id\n    || current?.active?.tree_sha512 !== expectedActive?.tree_sha512) {\n    throw new Error('bootstrap activation changed before rollback');\n  }\n  if (prior?.schema_version === 1) {\n    atomicWriteJson(join(runtimeRoot, 'current.json'), prior);\n  } else {\n    const quarantine = join(runtimeRoot, 'quarantine', `${rollbackId}-current.json`);\n    mkdirSync(dirname(quarantine), { recursive: true });\n    renameSync(join(runtimeRoot, 'current.json'), quarantine);\n  }\n  try { journalActivation(runtimeRoot, rollbackId, 'bootstrap-pointer-restored', expectedActive.version); }\n  catch { /* the restored pointer is authoritative */ }\n}\n\nexport function attestCurrentSupervisor({ runtimeRoot, selfPath, version }) {\n  const pointer = readActivation(runtimeRoot);\n  if (!pointer?.pending || !validActive(pointer.active)) return { ok: false, detail: 'no pending activation' };\n  const validated = validateSlot(runtimeRoot, pointer.active);\n  if (!validated.ok) return validated;\n  try {\n    if (realpathSync(selfPath) !== realpathSync(validated.paths.supervisor)) {\n      return { ok: false, detail: 'running supervisor is not the activated supervisor' };\n    }\n  } catch {\n    return { ok: false, detail: 'could not resolve running supervisor path' };\n  }\n  if (version !== pointer.active.version) return { ok: false, detail: 'running supervisor version mismatch' };\n  return { ok: true, pointer, active: pointer.active, paths: validated.paths };\n}\n\nexport function finalizeActivation(runtimeRoot, pointer) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before finalization');\n  }\n  journalActivation(runtimeRoot, pointer.pending.action_id, 'attesting', `${pointer.active.version} verified`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), {\n    schema_version: 1,\n    generation: pointer.generation,\n    active: pointer.active,\n    previous: pointer.previous || null,\n    pending: null,\n  });\n  // current.json is authoritative. A journal-only failure must never turn a\n  // committed activation into a false update failure.\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'attested', `${pointer.active.version} active`); } catch { /* best effort */ }\n}\n\nexport function rollbackActivation(runtimeRoot, pointer, detail) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before rollback');\n  }\n  journalActivation(runtimeRoot, pointer.pending.action_id, 'rolling-back', detail);\n  const rolledBack = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active: validActive(pointer?.previous) ? pointer.previous : null,\n    previous: null,\n    pending: {\n      ...pointer.pending,\n      terminal_status: 'failed',\n      terminal_detail: String(detail).slice(0, 400),\n      rolled_back_at: new Date().toISOString(),\n    },\n  };\n  atomicWriteJson(join(runtimeRoot, 'current.json'), rolledBack);\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'rolled-back', detail); } catch { /* best effort */ }\n  return rolledBack;\n}\n\nexport function acknowledgeActivationFailure(runtimeRoot, pointer) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id\n    || current?.pending?.terminal_status !== 'failed') {\n    throw new Error('runtime rollback acknowledgement obligation changed');\n  }\n  atomicWriteJson(join(runtimeRoot, 'current.json'), { ...current, pending: null });\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'failure-acknowledged', pointer.pending.terminal_detail); }\n  catch { /* current.json is authoritative */ }\n}\n\nexport const __test = { ACTION_ID_RE, ENTRY_REL, INTEGRITY_RE, SLOT_ID_RE, SUPERVISOR_REL, UUID_RE, VERSION_RE, validActive, within };\n", "/**\n * legacy-orphan-sweep \u2014 operator-triggered reclamation of agent processes\n * leaked by PRE-REAPER daemons (they never recorded their spawns, so the\n * recorded-PID orphan-agent-reaper can NEVER touch them by design).\n *\n * This is deliberately NOT automatic: it runs only when a human presses the\n * \"Clear stuck agents\" control in AlgoHQ (a governed `purge-orphans` runner\n * control action), and only a supervisor advertising the\n * `legacy-orphan-purge-v1` capability will claim one.\n *\n * Because there are no records to trust, selection is by evidence that ALL\n * hold simultaneously:\n *   1. The command line matches a RUNNER-ONLY agent spawn signature\n *      (`claude \u2026 --output-format stream-json` headless / `codex exec --json`).\n *      Interactive agent sessions and detached watchers never match.\n *   2. The parent process is dead \u2014 absent, or its pid was reused by a process\n *      created AFTER the child (an orphan's parent can never be younger).\n *      A live daemon's agents always have a live parent, so a running peer\n *      runner's work is structurally unselectable.\n *   3. The process predates the sweep cutoff (nothing racing the relaunch).\n *   4. The pid is not the supervisor itself or otherwise protected.\n * Selection is capped, oldest-first, and every kill is logged with its\n * command-line evidence. The decision core is pure and unit-tested; OS shims\n * are injected. Reuses the reaper's hardened epoch conversion + tree kill.\n */\nimport { spawnSync } from 'node:child_process';\nimport { killProcessTree, windowsPowershellExe } from './orphan-agent-reaper.mjs';\n\nexport const LEGACY_PURGE_CAPABILITY = 'legacy-orphan-purge-v1';\nexport const MAX_LEGACY_KILLS = 50;\n/** Ignore anything created within this window before the sweep (races). */\nexport const SWEEP_RECENCY_BUFFER_MS = 5_000;\n\nconst SIGNATURES = [\n  {\n    signature: 'claude-headless',\n    // claude-args.mjs always emits `-p --output-format stream-json --verbose`.\n    test: (cl) => /(?:^|[\\\\/\"\\s])claude(?:\\.exe|\\.cmd|\\.ps1)?(?:\"|\\s)/iu.test(cl) && /--output-format[\\s\"=]+stream-json/iu.test(cl),\n  },\n  {\n    signature: 'codex-headless',\n    // openai-compatible-runner always emits `exec --json`.\n    test: (cl) => /(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd|\\.ps1)?(?:\"|\\s)/iu.test(cl) && /\\bexec\\b/u.test(cl) && /--json\\b/u.test(cl),\n  },\n];\n\n/** Which runner-agent signature (if any) a raw command line matches. */\nexport function matchAgentSignature(commandLine) {\n  if (typeof commandLine !== 'string' || !commandLine) return null;\n  for (const { signature, test } of SIGNATURES) {\n    if (test(commandLine)) return signature;\n  }\n  return null;\n}\n\n/**\n * Pure selection. `processes` is an array of\n * `{ pid, ppid, creationMs, commandLine }`; returns `{ kills }` where each\n * kill is `{ pid, signature, commandLine }`, oldest-first, capped.\n */\nexport function selectLegacyOrphans({ processes, cutoffMs, protectedPids = new Set() }) {\n  const byPid = new Map();\n  for (const proc of processes) {\n    if (Number.isInteger(proc?.pid) && proc.pid > 0) byPid.set(proc.pid, proc);\n  }\n  const kills = [];\n  for (const proc of byPid.values()) {\n    if (protectedPids.has(proc.pid)) continue;\n    if (!(Number.isFinite(proc.creationMs) && proc.creationMs < cutoffMs)) continue;\n    const signature = matchAgentSignature(proc.commandLine);\n    if (!signature) continue;\n    const parent = Number.isInteger(proc.ppid) && proc.ppid > 0 ? byPid.get(proc.ppid) : undefined;\n    const parentDead = !parent || (Number.isFinite(parent.creationMs) && parent.creationMs > proc.creationMs);\n    if (!parentDead) continue;\n    kills.push({ pid: proc.pid, creationMs: proc.creationMs, signature, commandLine: proc.commandLine });\n  }\n  kills.sort((a, b) => a.creationMs - b.creationMs);\n  return { kills: kills.slice(0, MAX_LEGACY_KILLS) };\n}\n\n/** One `ps -eo pid=,ppid=,etimes=,args=` line \u2192 process row (null on junk). */\nexport function parsePosixSweepLine(line, nowMs) {\n  const match = /^\\s*(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(.+)$/u.exec(line ?? '');\n  if (!match) return null;\n  const pid = Number(match[1]);\n  if (!Number.isInteger(pid) || pid <= 0) return null;\n  return {\n    pid,\n    ppid: Number(match[2]),\n    creationMs: nowMs - Number(match[3]) * 1000,\n    commandLine: match[4],\n  };\n}\n\n/**\n * Enumerate `{ pid, ppid, creationMs, commandLine }` for every visible\n * process. Windows via CIM (one compact JSON object per line so arbitrary\n * command-line content cannot break parsing; epoch via\n * DateTimeOffset.ToUnixTimeMilliseconds() \u2014 the manual UTC-offset form was\n * empirically \u22128h and silently disabled the recorded reaper before the same\n * guard was added there). Unenumerable rows are skipped (safe direction).\n */\nexport function listProcessesForSweep({ platform = process.platform, spawn = spawnSync, nowMs = Date.now(), env = process.env, warn = console.warn } = {}) {\n  const rows = [];\n  if (platform === 'win32') {\n    const ps =\n      \"Get-CimInstance Win32_Process | Where-Object { $_.CreationDate } | ForEach-Object { @{ p = $_.ProcessId; pp = $_.ParentProcessId; c = (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()); cl = [string]$_.CommandLine } | ConvertTo-Json -Compress }\";\n    const result = spawn(windowsPowershellExe(env), ['-NoProfile', '-NonInteractive', '-Command', ps], {\n      windowsHide: true,\n      encoding: 'utf8',\n      timeout: 30_000,\n      maxBuffer: 64 * 1024 * 1024,\n    });\n    if (result.error || result.status !== 0) {\n      // Failure must remain a NO-KILL sweep (safe direction) but never a silent\n      // one: an empty enumeration is indistinguishable from \"no orphans\", so a\n      // permanently broken shim would look healthy while processes accumulate.\n      // Throwing (not returning []) makes runLegacyOrphanSweep report the\n      // operator-triggered purge action as FAILED instead of \"0 scanned\".\n      const cause = result.error ? result.error.message : `powershell exit ${result.status}`;\n      warn(`[orphan-sweep] process enumeration failed (${cause}); sweeping nothing this cycle`);\n      throw new Error(`process enumeration failed (${cause}); swept nothing`);\n    }\n    for (const line of String(result.stdout ?? '').split(/\\r?\\n/u)) {\n      if (!line.trim()) continue;\n      try {\n        const parsed = JSON.parse(line);\n        const pid = Number(parsed?.p);\n        if (!Number.isInteger(pid) || pid <= 0) continue;\n        rows.push({\n          pid,\n          ppid: Number(parsed.pp),\n          creationMs: Number(parsed.c),\n          commandLine: typeof parsed.cl === 'string' ? parsed.cl : '',\n        });\n      } catch {\n        // one unparseable row must never abort the sweep enumeration\n      }\n    }\n    return rows;\n  }\n  const result = spawn('ps', ['-eo', 'pid=,ppid=,etimes=,args='], { encoding: 'utf8', timeout: 30_000, maxBuffer: 64 * 1024 * 1024 });\n  if (result.error || result.status !== 0) {\n    const cause = result.error ? result.error.message : `ps exit ${result.status}`;\n    warn(`[orphan-sweep] process enumeration failed (${cause}); sweeping nothing this cycle`);\n    throw new Error(`process enumeration failed (${cause}); swept nothing`);\n  }\n  for (const line of String(result.stdout ?? '').split('\\n')) {\n    const row = parsePosixSweepLine(line, nowMs);\n    if (row) rows.push(row);\n  }\n  return rows;\n}\n\n/**\n * Execute the sweep. Never throws; returns\n * `{ ok, status, detail, killed: [{ pid, signature }] }` shaped for the\n * supervisor's action-completion contract. `detail` carries the evidence\n * summary that ends up on the AlgoHQ action record.\n */\nexport function runLegacyOrphanSweep({\n  nowMs = Date.now(),\n  protectedPids = [process.pid],\n  listProcesses = listProcessesForSweep,\n  killTree = killProcessTree,\n  log = () => {},\n} = {}) {\n  try {\n    const processes = listProcesses({ nowMs });\n    const { kills } = selectLegacyOrphans({\n      processes,\n      cutoffMs: nowMs - SWEEP_RECENCY_BUFFER_MS,\n      protectedPids: new Set(protectedPids),\n    });\n    const killed = [];\n    for (const kill of kills) {\n      const done = killTree(kill.pid);\n      log(`legacy-orphan-sweep ${done ? 'killed' : 'FAILED to kill'} pid=${kill.pid} sig=${kill.signature} cmd=${String(kill.commandLine).slice(0, 200)}`);\n      if (done) killed.push({ pid: kill.pid, signature: kill.signature });\n    }\n    const failed = kills.length - killed.length;\n    const detail = kills.length === 0\n      ? `no orphaned agent processes matched the sweep criteria (${processes.length} scanned)`\n      : `purged ${killed.length} of ${kills.length} orphaned agent process tree(s)${failed > 0 ? ` (${failed} kill(s) failed)` : ''}: ${killed.map((k) => `${k.pid}:${k.signature}`).join(', ').slice(0, 700)}`;\n    return { ok: true, status: 0, detail, killed };\n  } catch (error) {\n    return { ok: false, status: 1, detail: `legacy sweep error: ${error instanceof Error ? error.message : String(error)}`.slice(0, 500), killed: [] };\n  }\n}\n", "/**\n * Orphaned-agent process reaper.\n *\n * The runner spawns agent CLIs (claude/codex/\u2026) as child processes. When the\n * DAEMON itself restarts (crash, `update`/`reinstall` control, host reboot mid-\n * task), any still-running agent children are detached from the new daemon and\n * are never reclaimed \u2014 they leak RAM until the machine is rebooted. The\n * existing `terminal-process-cleanup` only kills the child the CURRENT process\n * still tracks; it deliberately never scans for unrelated processes.\n *\n * This module closes that gap SAFELY. Every spawned agent records its pid, its\n * spawning daemon instance id, and its spawn time under a per-instance registry\n * directory. On daemon startup the reaper considers only OTHER instances'\n * records and kills a process ONLY when ALL of these hold:\n *\n *   1. the recording daemon instance is provably DEAD (its recorded daemon pid\n *      is not live, or its creation time no longer matches) \u2014 so a concurrent\n *      live peer runner's agents are never touched;\n *   2. the agent pid is still live; AND\n *   3. the live process's OS creation time still matches the recorded spawn\n *      time within tolerance \u2014 so a REUSED pid (now some innocent process)\n *      is never killed.\n *\n * It never matches by process name and never touches a pid it did not itself\n * record. Decision logic is pure (`selectOrphanKills`) and fully unit-tested;\n * the OS shims (`listProcessCreationTimes`, `killProcessTree`) are injected.\n */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nconst REGISTRY_ROOT_NAME = 'algohq-runner-agent-pids';\nconst DAEMON_RECORD = 'daemon.json';\n/** A reused pid is created long after the original; 30s covers spawn/clock skew. */\nexport const CREATION_MATCH_TOLERANCE_MS = 30_000;\n\nexport function registryRoot(tmp = os.tmpdir()) {\n  return path.join(tmp, REGISTRY_ROOT_NAME);\n}\n\nfunction instanceDir(root, instanceId) {\n  return path.join(root, String(instanceId).replace(/[^A-Za-z0-9_-]/g, ''));\n}\n\n/** Record this daemon instance so peers can tell it is alive vs. orphaned. */\nexport function registerDaemonInstance({\n  root = registryRoot(),\n  instanceId,\n  daemonPid = process.pid,\n  daemonStartedAtMs = Date.now(),\n} = {}) {\n  if (!instanceId) return null;\n  const dir = instanceDir(root, instanceId);\n  mkdirSync(dir, { recursive: true });\n  const file = path.join(dir, DAEMON_RECORD);\n  writeFileSync(file, JSON.stringify({ daemonPid, daemonStartedAtMs, instanceId }), {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  return file;\n}\n\n/** Record a spawned agent's pid under its daemon instance. Never throws. */\nexport function recordAgentPid({\n  root = registryRoot(),\n  instanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  pid,\n  agentId = '',\n  startedAtMs = Date.now(),\n} = {}) {\n  if (!instanceId || !Number.isInteger(pid) || pid <= 0) return false;\n  try {\n    const dir = instanceDir(root, instanceId);\n    mkdirSync(dir, { recursive: true });\n    writeFileSync(\n      path.join(dir, `${pid}.json`),\n      JSON.stringify({ pid, agentId, startedAtMs, instanceId }),\n      { encoding: 'utf8', mode: 0o600 },\n    );\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Drop an agent record once its own process tree has been reaped. Never throws. */\nexport function unrecordAgentPid({\n  root = registryRoot(),\n  instanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  pid,\n} = {}) {\n  if (!instanceId || !Number.isInteger(pid)) return false;\n  try {\n    rmSync(path.join(instanceDir(root, instanceId), `${pid}.json`), { force: true });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * One-call daemon startup hook: publishes this instance id (so in-process\n * spawns can self-record), records the daemon, and reaps orphaned agent trees\n * left by dead prior instances. Synchronous and swallow-safe \u2014 never blocks the\n * runner from coming up.\n */\nexport function bootstrapOrphanReaper({ instanceId, log = () => {} } = {}) {\n  if (!instanceId) return { killed: 0, prunedDirs: 0 };\n  process.env.VO_RUNNER_INSTANCE_ID = instanceId;\n  try {\n    registerDaemonInstance({ instanceId });\n  } catch {\n    /* best effort \u2014 reap still runs */\n  }\n  return reapOrphanedAgents({ currentInstanceId: instanceId, log });\n}\n\n/** Read every instance's records from disk into the shape selectOrphanKills wants. */\nexport function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {\n  const instances = [];\n  if (!existsSync(root)) return instances;\n  let dirents;\n  try {\n    dirents = readdirSync(root, { withFileTypes: true });\n  } catch {\n    return instances;\n  }\n  for (const dirent of dirents) {\n    if (!dirent.isDirectory()) continue;\n    if (currentInstanceId && dirent.name === instanceDirName(currentInstanceId)) continue;\n    const dir = path.join(root, dirent.name);\n    let daemon = null;\n    const agents = [];\n    let files;\n    try {\n      files = readdirSync(dir);\n    } catch {\n      continue;\n    }\n    for (const name of files) {\n      let parsed;\n      try {\n        parsed = JSON.parse(readFileSync(path.join(dir, name), 'utf8'));\n      } catch {\n        continue;\n      }\n      if (name === DAEMON_RECORD) {\n        if (Number.isInteger(parsed?.daemonPid)) {\n          daemon = { pid: parsed.daemonPid, startedAtMs: Number(parsed.daemonStartedAtMs) || 0 };\n        }\n      } else if (Number.isInteger(parsed?.pid)) {\n        agents.push({ pid: parsed.pid, agentId: String(parsed.agentId || ''), startedAtMs: Number(parsed.startedAtMs) || 0 });\n      }\n    }\n    instances.push({ instanceId: dirent.name, dir, daemon, agents });\n  }\n  return instances;\n}\n\nfunction instanceDirName(instanceId) {\n  return String(instanceId).replace(/[^A-Za-z0-9_-]/g, '');\n}\n\nfunction creationMatches(live, recordedStartedAtMs, toleranceMs) {\n  if (!live || !Number.isFinite(live.creationMs)) return false;\n  if (!Number.isFinite(recordedStartedAtMs) || recordedStartedAtMs <= 0) return false;\n  return Math.abs(live.creationMs - recordedStartedAtMs) <= toleranceMs;\n}\n\n/**\n * PURE decision core. Given the on-disk registry (other instances only) and a\n * map of live pid \u2192 { creationMs }, decide which pids to kill and which\n * instance dirs to prune.\n *\n * - An instance whose daemon record is still live (pid alive + creation match)\n *   is a running PEER: skip it entirely (no kills, no prune).\n * - Otherwise the instance is dead: kill each recorded agent that is still live\n *   AND whose creation time matches (guards pid reuse), then prune its dir.\n */\nexport function selectOrphanKills({ instances = [], liveProcesses = new Map(), toleranceMs = CREATION_MATCH_TOLERANCE_MS } = {}) {\n  const kills = [];\n  const pruneDirs = [];\n  for (const instance of instances) {\n    // Require a PRESENT daemon record before killing anything. Without it we\n    // cannot distinguish a truly-crashed instance from a peer that just created\n    // its dir and has not written daemon.json yet, so we conservatively prune\n    // the stale/malformed dir but never kill. (registerDaemonInstance writes\n    // daemon.json before any agent is spawned, so a real instance with agent\n    // records always has one.)\n    if (!instance.daemon) {\n      if (instance.dir) pruneDirs.push(instance.dir);\n      continue;\n    }\n    const daemonLive =\n      liveProcesses.has(instance.daemon.pid) &&\n      creationMatches(liveProcesses.get(instance.daemon.pid), instance.daemon.startedAtMs, toleranceMs);\n    if (daemonLive) continue; // live peer runner \u2014 never touch its agents\n    for (const agent of instance.agents) {\n      const live = liveProcesses.get(agent.pid);\n      if (live && creationMatches(live, agent.startedAtMs, toleranceMs)) {\n        kills.push({ pid: agent.pid, agentId: agent.agentId, instanceId: instance.instanceId });\n      }\n    }\n    if (instance.dir) pruneDirs.push(instance.dir);\n  }\n  return { kills, pruneDirs };\n}\n\nfunction windowsSystemRoot(env = process.env) {\n  return env.SystemRoot || env.WINDIR || 'C:\\\\Windows';\n}\n\n/**\n * Absolute Windows PowerShell path. Never resolve `powershell` from PATH: the\n * reaper runs with the daemon's privileges, so a PATH-planted powershell.exe\n * would receive every process command line on the host. Same resolution as\n * runner-bootstrap/windows-bound-process-termination.mjs.\n */\nexport function windowsPowershellExe(env = process.env) {\n  return path.join(windowsSystemRoot(env), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');\n}\n\n/** Windows: map every process to its creation time in epoch ms via CIM. */\nexport function listProcessCreationTimes({ platform = process.platform, spawn = spawnSync, env = process.env, warn = console.warn } = {}) {\n  const map = new Map();\n  if (platform === 'win32') {\n    // Epoch conversion via DateTimeOffset.ToUnixTimeMilliseconds() \u2014 the manual\n    // `(CreationDate - Get-Date '1970-01-01Z')` form is off by the local UTC\n    // offset (empirically \u22128h on a PST host), which would push every creation\n    // time outside the match window and silently disable the reaper.\n    const ps =\n      \"Get-CimInstance Win32_Process | ForEach-Object { '{0} {1}' -f $_.ProcessId, (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()) }\";\n    const result = spawn(windowsPowershellExe(env), ['-NoProfile', '-NonInteractive', '-Command', ps], {\n      windowsHide: true,\n      encoding: 'utf8',\n      timeout: 20_000,\n      maxBuffer: 32 * 1024 * 1024,\n    });\n    if (result.error || result.status !== 0 || typeof result.stdout !== 'string') {\n      // An enumeration failure must stay a NO-KILL cycle (safe direction), but\n      // never a silent one \u2014 a permanently failing shim reads as \"no orphans\"\n      // and the fleet leaks agent processes until reboot.\n      warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `powershell exit ${result.status}`}); reaping nothing this cycle`);\n      return map;\n    }\n    for (const line of result.stdout.split(/\\r?\\n/)) {\n      const m = line.trim().match(/^(\\d+)\\s+(-?\\d+)$/);\n      if (m) map.set(Number(m[1]), { creationMs: Number(m[2]) });\n    }\n    return map;\n  }\n  // POSIX: ps lstart \u2192 epoch ms (macOS/Linux runner). Windows is the primary\n  // target and is verified end-to-end; this branch is validated via the pure\n  // parsePosixPsLine() unit tests.\n  const result = spawn('ps', ['-eo', 'pid=,lstart='], { encoding: 'utf8', timeout: 20_000, maxBuffer: 32 * 1024 * 1024 });\n  if (result.error || result.status !== 0 || typeof result.stdout !== 'string') {\n    warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `ps exit ${result.status}`}); reaping nothing this cycle`);\n    return map;\n  }\n  for (const line of result.stdout.split(/\\r?\\n/)) {\n    const parsed = parsePosixPsLine(line);\n    if (parsed) map.set(parsed.pid, { creationMs: parsed.creationMs });\n  }\n  return map;\n}\n\n/**\n * Parse one `ps -eo pid=,lstart=` line into { pid, creationMs } or null.\n * Handles padded pids, the single-digit-day double space (\"Mon Jan  5 \u2026\"), and\n * unparseable lines (\u2192 null, so the caller skips them \u2014 the safe direction).\n */\nexport function parsePosixPsLine(line) {\n  const trimmed = String(line ?? '').trim();\n  const sp = trimmed.indexOf(' ');\n  if (sp <= 0) return null;\n  const pid = Number(trimmed.slice(0, sp));\n  const when = Date.parse(trimmed.slice(sp + 1).trim());\n  if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(when)) return null;\n  return { pid, creationMs: when };\n}\n\n/** Kill an exact pid's whole tree. Windows taskkill /T /F, else SIGKILL by pgid. */\nexport function killProcessTree(pid, { platform = process.platform, spawn = spawnSync, env = process.env } = {}) {\n  if (!Number.isInteger(pid) || pid <= 0) return false;\n  if (platform === 'win32') {\n    // Absolute path for the same reason as windowsPowershellExe(): a PATH-planted\n    // taskkill.exe would execute with daemon privileges and could silently no-op\n    // every kill while the sweep logs success.\n    const taskkill = path.join(windowsSystemRoot(env), 'System32', 'taskkill.exe');\n    const r = spawn(taskkill, ['/PID', String(pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore', timeout: 15_000 });\n    return !r.error && r.status === 0;\n  }\n  try {\n    process.kill(-pid, 'SIGKILL');\n    return true;\n  } catch {\n    try {\n      process.kill(pid, 'SIGKILL');\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n\n/**\n * EFFECTFUL entry point: run at daemon startup. Reaps orphaned agent trees from\n * dead prior instances and prunes their registry dirs. Never throws \u2014 a reaper\n * failure must not block the runner from coming up.\n */\nexport function reapOrphanedAgents({\n  root = registryRoot(),\n  currentInstanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  toleranceMs = CREATION_MATCH_TOLERANCE_MS,\n  listProcesses = listProcessCreationTimes,\n  killTree = killProcessTree,\n  log = () => {},\n} = {}) {\n  try {\n    const instances = readRegistry({ root, currentInstanceId });\n    if (instances.length === 0) return { killed: 0, prunedDirs: 0 };\n    const liveProcesses = listProcesses();\n    const { kills, pruneDirs } = selectOrphanKills({ instances, liveProcesses, toleranceMs });\n    let killed = 0;\n    for (const kill of kills) {\n      if (killTree(kill.pid)) {\n        killed += 1;\n        log(`reaped orphaned agent pid ${kill.pid}${kill.agentId ? ` (${kill.agentId})` : ''} from dead instance ${kill.instanceId}`);\n      }\n    }\n    let prunedDirs = 0;\n    for (const dir of pruneDirs) {\n      try {\n        rmSync(dir, { recursive: true, force: true });\n        prunedDirs += 1;\n      } catch {\n        /* leave it; next startup retries */\n      }\n    }\n    if (killed > 0 || prunedDirs > 0) log(`orphan reap: killed ${killed} agent tree(s), pruned ${prunedDirs} dead instance record(s)`);\n    return { killed, prunedDirs };\n  } catch (error) {\n    log(`orphan reap skipped: ${error instanceof Error ? error.message : String(error)}`);\n    return { killed: 0, prunedDirs: 0 };\n  }\n}\n", "import {\n  acknowledgeActivationFailure,\n  attestCurrentSupervisor,\n  finalizeActivation,\n  readActivation,\n  recordActivationRetry,\n  rollbackActivation,\n  validateSlot,\n} from './bundled-runtime-store.mjs';\n\nconst MAX_ACK_ATTEMPTS = 3;\nconst delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nexport async function waitForAuthoritativeRunnerHeartbeat({\n  client,\n  runnerId,\n  operatorId,\n  runnerInstanceId,\n  excludeRunnerInstanceId,\n  daemonVersion,\n  supervisorIdentity,\n  timeoutMs = 60_000,\n  pollMs = 1_000,\n}) {\n  if (!runnerInstanceId && !excludeRunnerInstanceId) throw new Error('runner instance identity proof unavailable');\n  const deadline = Date.now() + timeoutMs;\n  while (Date.now() < deadline) {\n    try {\n      const runners = await client.getRunnerStatus({ ...(operatorId ? { operatorId } : {}) });\n      const runner = runners.find((item) => item?.runner_id === runnerId\n        && item.status === 'online'\n        && (runnerInstanceId\n          ? item.runner_meta?.runner_instance_id === runnerInstanceId\n          : Boolean(item.runner_meta?.runner_instance_id)\n            && item.runner_meta.runner_instance_id !== excludeRunnerInstanceId)\n        && item.runner_meta?.daemon_version === daemonVersion\n        && item.runner_meta?.supervisor_instance_id === supervisorIdentity.supervisorInstanceId\n        && item.runner_meta?.supervisor_version === supervisorIdentity.supervisorVersion\n        && supervisorIdentity.capabilities.every((value) => item.runner_meta?.supervisor_capabilities?.includes(value))\n        && Array.isArray(item.runner_meta?.available_agents)\n        && item.runner_meta.available_agents.some((agent) => agent.agent === item.runner_meta.default_agent\n          && agent.installed === true && agent.authenticated === true));\n      if (runner) return runner;\n    } catch { /* bounded retry */ }\n    await delay(pollMs);\n  }\n  throw new Error('authoritative child heartbeat attestation timed out');\n}\n\n/**\n * Complete a slot handoff only from the activated package and logical Tauri\n * supervisor lease. Local path/version/hash and child readiness are proven\n * before a cloud heartbeat or terminal action acknowledgement is emitted.\n */\nexport async function finishPendingActivation({\n  client,\n  child,\n  runtimeRoot,\n  operatorId,\n  runnerId,\n  selfPath,\n  packageVersion,\n  supervisorIdentity,\n  waitForLocalRunner,\n  localStatus,\n  waitForCloudRunner = waitForAuthoritativeRunnerHeartbeat,\n  cloudTimeoutMs,\n  cloudPollMs,\n  stopChild,\n  launchPreviousChild,\n  log = () => {},\n}) {\n  const pointer = runtimeRoot ? readActivation(runtimeRoot) : null;\n  if (!pointer?.pending) return true;\n  const runnerIdForAction = pointer.pending.runner_id || runnerId;\n  const operatorIdForAction = pointer.pending.operator_id || operatorId;\n  if (pointer.pending.terminal_status === 'failed') {\n    try {\n      await client.completeRunnerControl(pointer.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail: pointer.pending.terminal_detail,\n      });\n      acknowledgeActivationFailure(runtimeRoot, pointer);\n      return true;\n    } catch (error) {\n      log(`activation failure acknowledgement remains pending: ${error instanceof Error ? error.message : String(error)}`);\n      await stopChild(child);\n      return false;\n    }\n  }\n  let attestation;\n  try {\n    attestation = attestCurrentSupervisor({ runtimeRoot, selfPath, version: packageVersion });\n    if (!attestation.ok) throw new Error(attestation.detail);\n    if (!(await waitForLocalRunner(child))) throw new Error('activated runner did not become locally ready');\n  } catch (error) {\n    let detail = `activation attestation failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n    let rolledBack = null;\n    try {\n      rolledBack = rollbackActivation(runtimeRoot, pointer, detail);\n    } catch (rollbackError) {\n      detail = `${detail}; rollback pending: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n    }\n    try {\n      await client.completeRunnerControl(pointer.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail,\n      });\n      if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n    } catch {\n      // current.json retains the terminal acknowledgement obligation.\n    } finally {\n      await stopChild(child);\n    }\n    return false;\n  }\n\n  let activatedRunnerInstanceId = null;\n  try {\n    const status = await localStatus();\n    activatedRunnerInstanceId = status?.runnerInstanceId || null;\n    await waitForCloudRunner({\n      client,\n      runnerId: runnerIdForAction,\n      operatorId: operatorIdForAction,\n      runnerInstanceId: status?.runnerInstanceId,\n      daemonVersion: `vo-mcp/${attestation.active.version}`,\n      supervisorIdentity,\n      timeoutMs: cloudTimeoutMs,\n      pollMs: cloudPollMs,\n    });\n    await client.completeRunnerControl(pointer.pending.action_id, {\n      runnerId: runnerIdForAction,\n      ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n      ...supervisorIdentity,\n      status: 'succeeded',\n      detail: `attested new supervisor ${attestation.active.version} ${attestation.active.integrity}`,\n    });\n    finalizeActivation(runtimeRoot, attestation.pointer);\n    return true;\n  } catch (error) {\n    const failure = `activation acknowledgement failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n    let retry;\n    try { retry = recordActivationRetry(runtimeRoot, attestation.pointer, failure); }\n    catch (retryError) {\n      log(`activation retry could not be recorded: ${retryError instanceof Error ? retryError.message : String(retryError)}`);\n      await stopChild(child);\n      return false;\n    }\n    if (retry.pending.ack_attempts < MAX_ACK_ATTEMPTS) {\n      log(`activation acknowledgement pending (${retry.pending.ack_attempts}/${MAX_ACK_ATTEMPTS})`);\n      await stopChild(child);\n      return false;\n    }\n\n    const previous = validateSlot(runtimeRoot, retry.previous);\n    let detail = `${failure}; retry limit reached; previous runtime restored`.slice(0, 400);\n    let rollbackChild = null;\n    let rolledBack = null;\n    try {\n      if (!previous.ok) throw new Error(`previous runtime invalid: ${previous.detail}`, { cause: error });\n      rolledBack = rollbackActivation(runtimeRoot, retry, detail);\n      await stopChild(child);\n      rollbackChild = launchPreviousChild(previous.paths.entry);\n      if (!(await waitForLocalRunner(rollbackChild))) throw new Error('previous runner did not become locally ready', { cause: error });\n      const status = await localStatus();\n      await waitForCloudRunner({\n        client,\n        runnerId: runnerIdForAction,\n        operatorId: operatorIdForAction,\n        runnerInstanceId: status?.runnerInstanceId,\n        excludeRunnerInstanceId: status?.runnerInstanceId ? undefined : activatedRunnerInstanceId,\n        daemonVersion: `vo-mcp/${retry.previous.version}`,\n        supervisorIdentity,\n        timeoutMs: cloudTimeoutMs,\n        pollMs: cloudPollMs,\n      });\n    } catch (rollbackError) {\n      detail = `${detail}; rollback proof failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n    }\n    try {\n      await client.completeRunnerControl(retry.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail,\n      });\n      if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n    } catch { /* current.json retains the terminal acknowledgement obligation */ }\n    if (rollbackChild) await stopChild(rollbackChild);\n    else await stopChild(child);\n    return false;\n  }\n}\n\nexport const __test = { MAX_ACK_ATTEMPTS };\n", "import { hostname as systemHostname } from 'node:os';\nimport { pairedOperatorScope, probeRunnerReadiness } from '../runner-readiness.mjs';\n\n/** Keep the supervisor's control-queue identity byte-identical to the daemon. */\nexport function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {\n  const explicit = String(env.VO_CODE_RUNNER_ID || '').trim();\n  return explicit || `vo-code-runner-${hostname()}`;\n}\n\n/** Build the daemon environment without mislabeling a paired credential as admin. */\nexport function buildSupervisorChildEnv({\n  baseEnv = {},\n  controlPlaneUrl,\n  explicitAdminToken = null,\n  pairedOperatorId = null,\n} = {}) {\n  const childEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n  };\n  const adminToken = typeof explicitAdminToken === 'string' ? explicitAdminToken.trim() : '';\n  const operatorId = typeof pairedOperatorId === 'string' ? pairedOperatorId.trim() : '';\n\n  if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;\n  else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;\n\n  if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;\n  return childEnv;\n}\n\n/** Resolve auth provenance once so the supervisor and child use the same scope. */\nexport async function prepareSupervisorAuth({\n  baseEnv = {},\n  storedCredential = null,\n  controlPlaneUrl,\n  probeReadiness = probeRunnerReadiness,\n} = {}) {\n  const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();\n  const token = explicitAdminToken || storedCredential?.vo_credential;\n  if (!token) throw new Error('runner is not paired; run `vo-mcp pair` once on this host');\n\n  let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || '')\n    .split(/[\\s,]+/u)\n    .filter(Boolean)[0] || undefined;\n  if (!explicitAdminToken) {\n    const readiness = await probeReadiness({ controlPlaneUrl, token, requireGithub: true });\n    if (!readiness.ok) throw new Error(`runner readiness failed: ${readiness.message}`);\n    operatorId = pairedOperatorScope(readiness) || undefined;\n    if (!operatorId) throw new Error('runner readiness failed: paired operator scope is missing');\n  }\n\n  const childEnv = buildSupervisorChildEnv({\n    baseEnv,\n    controlPlaneUrl,\n    explicitAdminToken,\n    pairedOperatorId: explicitAdminToken ? null : operatorId,\n  });\n  const clientEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_ADMIN_TOKEN: token,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n    ...(operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}),\n  };\n  return { childEnv, clientEnv, operatorId };\n}\n", "/**\n * Server-backed readiness probe for a paired BYO runner.\n *\n * The credential itself is opaque, so its mere presence is not proof that it is\n * usable or still bound to an operator. `/auth/me` supplies that truth from the\n * authenticated control-plane context. Before daemon startup, the optional\n * GitHub probe also proves the operator can mint an installation token, so a\n * task is never claimed only to fail at publication setup.\n */\n\nfunction failed({ paired = false, operatorId = null, tenantId = null, githubReady = null, error, message }) {\n  return { ok: false, paired, operatorId, tenantId, githubReady, error, message };\n}\n\nasync function responseBody(response) {\n  try {\n    const value = await response.json();\n    return value && typeof value === 'object' ? value : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction serverMessage(body, fallback) {\n  return typeof body.message === 'string' && body.message.trim() ? body.message.trim() : fallback;\n}\n\nasync function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    return await fetchImpl(url, { ...init, signal: controller.signal });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * @param {{\n *   controlPlaneUrl: string,\n *   token: string,\n *   fetchImpl?: typeof fetch,\n *   requireGithub?: boolean,\n *   timeoutMs?: number,\n * }} input\n */\nexport async function probeRunnerReadiness({\n  controlPlaneUrl,\n  token,\n  fetchImpl = fetch,\n  requireGithub = false,\n  timeoutMs = 10_000,\n}) {\n  const base = controlPlaneUrl.replace(/\\/+$/u, '');\n  const headers = { authorization: `Bearer ${token}` };\n  let identityResponse;\n  try {\n    identityResponse = await fetchWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/auth/me`,\n      { headers },\n      timeoutMs,\n    );\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      error: 'control_plane_unreachable',\n      message: `AlgoHQ could not be reached: ${detail}`,\n    });\n  }\n\n  const identity = await responseBody(identityResponse);\n  if (!identityResponse.ok) {\n    return failed({\n      error: 'credential_rejected',\n      message: 'The saved pairing is expired or revoked. Pair this computer again.',\n    });\n  }\n  if (\n    identity.provisioned !== true ||\n    identity.role !== 'operator' ||\n    typeof identity.operator_id !== 'string' ||\n    !identity.operator_id.trim() ||\n    typeof identity.tenant_id !== 'string' ||\n    !identity.tenant_id.trim()\n  ) {\n    return failed({\n      error: 'operator_identity_missing',\n      message: 'The pairing credential is valid but has no operator identity. Pair this computer again.',\n    });\n  }\n\n  const operatorId = identity.operator_id.trim();\n  const tenantId = identity.tenant_id.trim();\n  if (!requireGithub) {\n    return {\n      ok: true,\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: null,\n      error: null,\n      message: 'Paired to AlgoHQ.',\n    };\n  }\n\n  let githubResponse;\n  try {\n    githubResponse = await fetchWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/github/installation-token`,\n      {\n        method: 'POST',\n        headers: { ...headers, 'content-type': 'application/json' },\n        body: '{}',\n      },\n      timeoutMs,\n    );\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error: 'github_preflight_unreachable',\n      message: `GitHub publication readiness could not be checked: ${detail}`,\n    });\n  }\n\n  const github = await responseBody(githubResponse);\n  if (!githubResponse.ok || typeof github.token !== 'string' || !github.token) {\n    const error = typeof github.error === 'string' && github.error ? github.error : 'github_not_ready';\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error,\n      message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`),\n    });\n  }\n\n  return {\n    ok: true,\n    paired: true,\n    operatorId,\n    tenantId,\n    githubReady: true,\n    error: null,\n    message: 'Paired and ready to publish through the Algosuite GitHub App.',\n  };\n}\n\nexport function pairedOperatorScope(readiness) {\n  return readiness?.ok === true &&\n    readiness?.paired === true &&\n    typeof readiness.operatorId === 'string' &&\n    readiness.operatorId.trim()\n    ? readiness.operatorId.trim()\n    : null;\n}\n", "import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport function defaultCredentialHelperPath(metaUrl = import.meta.url) {\n  const moduleDir = dirname(fileURLToPath(metaUrl));\n  const bundled = join(moduleDir, 'supervisor-credential-helper.js');\n  const source = join(moduleDir, '..', 'supervisor-credential-helper.mjs');\n  return existsSync(source) ? source : bundled;\n}\n\n/** Read the OS-keychain credential without loading its native module here. */\nexport function readStoredCredentialIsolated({\n  spawn = spawnSync,\n  execPath = process.execPath,\n  helperPath = defaultCredentialHelperPath(),\n  helperArgs = [],\n  env = process.env,\n} = {}) {\n  const result = spawn(execPath, [helperPath, ...helperArgs], {\n    env,\n    encoding: 'utf8',\n    stdio: ['ignore', 'pipe', 'pipe'],\n    shell: false,\n    windowsHide: true,\n    timeout: 10_000,\n  });\n  if (result.status !== 0) {\n    throw new Error('runner credential helper could not read the paired credential');\n  }\n  try {\n    const parsed = JSON.parse(String(result.stdout || ''));\n    return parsed && typeof parsed === 'object' ? parsed : null;\n  } catch {\n    throw new Error('runner credential helper returned an invalid credential');\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAeA,eAAsB,kBAAkB;AACtC,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AApBA;AAAA;AAAA;AAAA;;;ACKA,SAAS,aAAa;AACtB,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,iBAAAC,sBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACG9B,IAAI,sBAAsB;AAE1B,eAAe,cAAc,KAAK;AAChC,QAAM,aAAa,IAAI;AACvB,MAAI,WAAY,QAAO;AACvB,MAAI,oBAAqB,QAAO;AAEhC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,OAAO,MAAMA,iBAAgB,EAAE,IAAI,CAAC;AAC1C,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,wBAAsB,KAAK;AAC3B,SAAO;AACT;AAMO,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,MAAM,QAAQ;AAAA,EACd,YAAY;AAAA,EACZ,qBAAqB,KAAK;AAAA,IACxB,KAAK,IAAI,OAAO,IAAI,mCAAmC,KAAK,MAAQ,GAAK;AAAA,IACzE;AAAA,EACF;AACF,IAAI,CAAC,GAAG;AACN,QAAM,kBAAkB,WAAW,IAAI,wBAAwB;AAC/D,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAE/C,iBAAe,IAAI,QAAQC,OAAM,MAAM,EAAE,UAAU,IAAI,CAAC,GAAG;AACzD,UAAM,SAAS,MAAM,cAAc,GAAG;AACtC,UAAM,aAAa,YAAY,IAAI,gBAAgB,IAAI;AACvD,QAAI;AACJ,UAAM,UAAU,QAAQ,QAAQ,UAAU,GAAG,IAAI,GAAGA,KAAI,IAAI;AAAA,MAC1D;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC1D,GAAI,aAAa,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACpD,CAAC,CAAC;AACF,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,WAAW;AACzC,kBAAY,WAAW,MAAM;AAC3B,mBAAW,MAAM;AACjB,eAAO,IAAI,MAAM,iBAAiBA,KAAI,oBAAoB,SAAS,IAAI,CAAC;AAAA,MAC1E,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AACF,aAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,IAC9C,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,MAAM,MAAMC,WAAU,OAAO,aAAa,UAAU,CAAC,GAAG;AACtD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,MAAK,QAAQ;AAC3D,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,QAAQ,iBAAkB,MAAK,qBAAqB,QAAQ;AAChE,UAAI,QAAQ,oBAAoB,QAAQ,eAAgB,MAAK,kBAAkB;AAC/E,UAAI,QAAQ,aAAc,MAAK,gBAAgB,QAAQ;AACvD,UAAI,MAAM,QAAQ,QAAQ,eAAe,GAAG;AAC1C,aAAK,mBAAmB,QAAQ,gBAC7B,OAAO,CAAC,UAAU,OAAO,cAAc,QAAQ,OAAO,kBAAkB,IAAI,EAC5E,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,MAC/B;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,2BAA2B,IAAI;AAC7D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,EAAE;AAC/D,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,gBAAgB,UAAU,GAAG;AACjE,YAAM,OAAO,EAAE,MAAM,OAAO;AAC5B,UAAI,OAAO,mBAAmB,SAAU,MAAK,iBAAiB;AAC9D,UAAI,OAAO,cAAc,SAAU,MAAK,YAAY;AACpD,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,IAAI;AACvD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,4BAA4B;AAAA,MAC9C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,eAAe,QAAQ;AAC3B,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1F,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,uBAAuB,IAAI,MAAM,EAAE;AAChE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,UAAU,mBAAmB;AACjD,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,EAAE,UAAU,kBAAkB,CAAC;AACvF,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,cAAM,SAAS,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,CAAC;AAChF,cAAM,SAAS,OAAO,WAAW,QAAQ,OAAO,WAAW,WACvD,WACA,OAAO,WAAW,wBAAwB,OAAO,OAAO,UAAU,EAAE,EAAE,SAAS,YAAY,IACzF,WACA;AACN,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,UAC5D,iBAAiB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,QACzF;AAAA,MACF;AACA,UAAI,IAAI,WAAW,OAAO,MAAM,UAAU,sBAAsB;AAC9D,eAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,UAAU,2BAA2B;AAAA,MAC9E;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,QAC1E,iBAAiB,OAAO,MAAM,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,MAAM,MAAM,IAAI,SAAS,qBAAqB,MAAM,aAAa,KAAK;AAC5E,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,KAAK;AAChD,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAC/D,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,EAAE;AAClE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,QAAQ,KAAK,KAAK;AAAA,IACnC;AAAA,IAEA,MAAM,QAAQ,QAAQ;AACpB,YAAM,MAAM,MAAM,IAAI,OAAO,qBAAqB,MAAM,EAAE;AAC1D,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,KAAK,OAAO;AAAA,IAC5B;AAAA,IACA,MAAM,uBAAuB,QAAQ,cAAc;AACjD,YAAMD,QAAO,qBAAqB,mBAAmB,MAAM,CAAC,eAAe,mBAAmB,YAAY,CAAC;AAC3G,YAAM,MAAM,MAAM,IAAI,OAAOA,KAAI;AACjC,UAAI,IAAI,WAAW,IAAK,uBAAsB;AAC9C,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,aAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC;AAAA,IAC5C;AAAA,IAEA,MAAM,wBAAwB,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC;AACd,UAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,QAAQ;AAC5D,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,sBAAsB,IAAI;AACvG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAC3E,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,MAAM,iBAAiB,EAAE,YAAY,UAAAC,WAAU,QAAQ,iBAAiB,qBAAqB,GAAG;AAC9F,YAAM,OAAO;AAAA,QACX,aAAa;AAAA,QACb,WAAWA;AAAA,QACX,cAAc,OAAO;AAAA,QACrB,eAAe,OAAO;AAAA,QACtB,uBAAuB,OAAO;AAAA,QAC9B,mBAAmB,OAAO;AAAA,MAC5B;AACA,UAAI,OAAO,oBAAoB,UAAU;AACvC,aAAK,oBAAoB;AAAA,MAC3B;AACA,UAAI,yBAAyB,QAAW;AACtC,aAAK,0BAA0B;AAAA,MACjC;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,yBAAyB,IAAI;AAC3D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,cAAc,EAAE,UAAAA,WAAU,kBAAkB,YAAY,WAAW,aAAa,gBAAgB,sBAAsB,mBAAmB,kBAAkB,qBAAqB,SAAS,eAAe,cAAc,sBAAAC,uBAAsB,mBAAAC,oBAAmB,wBAAwB,aAAa,iBAAiB,iBAAiB,cAAc,qBAAqB,GAAG;AAChX,YAAM,OAAO,EAAE,WAAWF,UAAS;AACnC,UAAI,iBAAkB,MAAK,qBAAqB;AAChD,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAO,cAAc,SAAU,MAAK,aAAa;AACrD,UAAI,OAAO,gBAAgB,SAAU,MAAK,eAAe;AACzD,UAAI,OAAO,mBAAmB,SAAU,MAAK,kBAAkB;AAC/D,UAAI,OAAO,yBAAyB,SAAU,MAAK,wBAAwB;AAC3E,UAAI,OAAO,sBAAsB,SAAU,MAAK,sBAAsB;AACtE,UAAI,OAAO,qBAAqB,SAAU,MAAK,qBAAqB;AACpE,UAAI,OAAO,wBAAwB,SAAU,MAAK,wBAAwB;AAC1E,UAAI,QAAS,MAAK,UAAU;AAC5B,UAAI,cAAe,MAAK,iBAAiB;AACzC,UAAI,aAAc,MAAK,gBAAgB;AACvC,UAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,GAAG;AAC9E,aAAK,0BAA0B;AAAA,MACjC;AACA,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,sBAAsB;AAAA,MAC7B;AACA,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,mBAAmB;AAAA,MAC1B;AACA,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,aAAK,gBAAgB;AAAA,MACvB;AACA,UAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,SAAS,GAAG;AAC1E,aAAK,yBAAyB;AAAA,MAChC;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,4BAA4B,MAAM;AAAA,QAC9D,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,EAAE;AACnE,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA,IAEA,MAAM,gBAAgB,EAAE,WAAW,IAAI,CAAC,GAAG;AACzC,YAAM,QAAQ,aAAa,gBAAgB,mBAAmB,UAAU,CAAC,KAAK;AAC9E,YAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,KAAK,IAAI,QAAW;AAAA,QACvE,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,QAAQ,MAAM,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IACxD;AAAA,IAEA,MAAM,kBAAkB,EAAE,UAAAF,WAAU,YAAY,sBAAAC,uBAAsB,mBAAAC,oBAAmB,aAAa,GAAG;AACvG,YAAM,OAAO,EAAE,WAAWF,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,UAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,YAAM,MAAM,MAAM,IAAI,QAAQ,+BAA+B,IAAI;AACjE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,MAAM;AACrB,aAAO,UAAU,OAAO,OAAO,cAAc,YAAY,OAAO,YAC5D,EAAE,GAAG,QAAQ,UAAU,OAAO,UAAU,IACxC;AAAA,IACN;AAAA,IAEA,MAAM,sBAAsB,UAAU,EAAE,UAAAF,WAAU,YAAY,sBAAAC,uBAAsB,mBAAAC,oBAAmB,cAAc,QAAQ,OAAO,GAAG;AACrI,YAAM,OAAO,EAAE,WAAWF,WAAU,OAAO;AAC3C,UAAI,WAAY,MAAK,cAAc;AACnC,UAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,UAAI,OAAQ,MAAK,SAAS;AAC1B,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,aAAa,IAAI;AACrG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,UAAU;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBA,MAAM,qBAAqB,EAAE,WAAW,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC,WAAW;AACvB,YAAI,SAAU,OAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AACtE,eAAO;AAAA,MACT;AACA,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,QAAQ,qCAAqC,CAAC,CAAC;AACrE,YAAI,CAAC,IAAI,GAAI,QAAO,KAAK,QAAQ,IAAI,MAAM,EAAE;AAC7C,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,KAAK,eAAe;AACrD,eAAO,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,cAAc,KAAK;AAAA,MACjE,SAAS,KAAK;AACZ,YAAI,SAAU,OAAM;AACpB,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,kBAAkB;AACtB,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,eAAO,MAAM,gBAAgB;AAAA,MAC/B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AC7YA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAEhG,SAAS,aAAa,OAAO;AAC3B,SAAO,MAAM,QAAQ,wBAAwB,MAAM;AACrD;AAGO,SAAS,8BAA8B,KAAK,MAAM,CAAC,GAAG;AAC3D,MAAI,QAAQ,OAAO,OAAO,EAAE,EACzB,QAAQ,kDAAkD,YAAY,EACtE,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,sEAAsE,gBAAgB;AACjG,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,CAAC,6CAA6C,KAAK,IAAI,EAAG;AAC9D,UAAM,OAAO,OAAO,UAAU,EAAE;AAChC,QAAI,KAAK,SAAS,EAAG;AACrB,YAAQ,MAAM,QAAQ,IAAI,OAAO,aAAa,IAAI,GAAG,IAAI,GAAG,YAAY;AAAA,EAC1E;AACA,UAAQ,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACzC,MAAI,MAAM,UAAU,qBAAsB,QAAO;AACjD,SAAO,GAAG,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC;AACpD;AAEA,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAM,WAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;AAEO,SAAS,mBAAmB,MAAM;AAAA,EACvC,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AAAA,EACb,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI,SAAS,YAAa,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAChF,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,MAAM,EAAE,UAAU,aAAa,KAAK,UAAU,WAAW,CAAC;AAAA,EAC9F,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,CAAC;AAAA,MACP,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG;AAAA,IACnG;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AACrE,MAAI,uBAAuB,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,CAAC,EAAE;AACtE,QAAM,SAASA,OAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,IAClD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACD,QAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,QAAM,SAAS;AAAA,IACb,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAQ,KAAI,8BAA8B,MAAM,EAAE;AACtD,SAAO,EAAE,IAAI,WAAW,GAAG,QAAQ,SAAS,QAAQ,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC1F;;;AC/HA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC;AAAA,EACE,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,aAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,cAAAC;AAAA,EACA,UAAAC;AAAA,EACA,iBAAAC;AAAA,OACK;AACP,SAAS,UAAU,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,UAAS,OAAAC,YAAW;AACnE,SAAS,aAAAC,kBAAiB;;;ACZ1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,SAAS,OAAO,WAAAC,gBAAe;AACxC,SAAS,qBAAqB;;;ACH9B,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B;AAAA,EACE,cAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY,MAAM,UAAU,SAAS,KAAK,SAAAC,cAAa;AAEhE,IAAM,4BAA4B;AAClC,IAAM,kBAAkB;AACjB,IAAM,2BAA2B;AAExC,SAAS,UAAU,OAAO;AACxB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,SAAS;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,EAChG;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAO;AAC5B,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,SAAS,iBAAiB,OAAO,KAAK;AACpC,MAAI,OAAO,UAAU,SAAU,SAAQ,QAAQ,OAAO,GAAG,OAAO;AAChE,SAAO,OAAO,cAAc,KAAK,MAAM,QAAQ,SAAS;AAC1D;AAEO,SAAS,cAAc,OAAO;AACnC,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,OAAO,MAAM,mBAAmB,cAAc,MAAM,eAAe,EAAG,QAAO;AACjF,MAAI,MAAM,eAAe,UAAa,MAAM,eAAe,QAAQ,MAAM,eAAe,EAAG,QAAO;AAClG,SAAO,CAAC,kBAAkB,iBAAiB,YAAY,EACpD,KAAK,CAAC,QAAQ,iBAAiB,MAAM,GAAG,GAAG,yBAAyB,CAAC;AAC1E;AAEO,SAAS,yBAAyB,QAAQ,QAAQ;AACvD,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,EAAG,QAAO;AAC1D,MAAI,OAAO,KAAK,CAAC,UAAU,UAAU,IAAI,MAAM,EAAE,EAAG,QAAO;AAC3D,QAAM,WAAW,OAAO,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,CAAC;AAC7F,SAAO,SAAS,WAAW,KAAK,SAAS,SAAS,MAAM;AAC1D;AAEO,SAAS,yBAAyB,OAAO,WAAW,EAAE,IAAI,SAAS,MAAM,MAAM,GAAG;AACvF,SAAO,OAAO,aAAa,SACzB,CAAC,yBAAyB,MAAM,IAAI,SAAS,EAAE,KAC5C,CAAC,yBAAyB,MAAM,KAAK,SAAS,IAAI;AAEzD;AAEA,SAAS,gBAAgB,MAAM,WAAW,OAAO;AAC/C,QAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,QAAQ,MAAO,CAAC,IAAI,WAAW,KAAK,GAAG,EAAE,KAAK,QAAQ,QAAQ,CAAC,WAAW,GAAG,EAAI;AACrF,QAAM,IAAI,MAAM,kBAAkB,KAAK,2BAA2B;AACpE;AAEA,SAAS,sBAAsB,MAAM,WAAW;AAC9C,QAAM,WAAW,QAAQ,OAAO,aAAa,EAAE,CAAC;AAChD,kBAAgB,MAAM,UAAU,eAAe;AAC/C,SAAO;AACT;AAEO,SAAS,yBAAyB,MAAM;AAAA,EAC7C,WAAW;AAAA,EAAc,MAAM,QAAQ;AAAA,EAAK,WAAW,QAAQ;AACjE,IAAI,CAAC,GAAG;AACN,MAAI,aAAa,QAAS,QAAO,CAAC;AAClC,QAAM,aAAa,OAAO,IAAI,cAAc,IAAI,cAAc,EAAE;AAChE,MAAI,CAACA,OAAM,WAAW,UAAU,KAAKA,OAAM,UAAU,UAAU,MAAM,YAAY;AAC/E,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAWA,OAAM,KAAK,YAAY,UAAU;AAClD,QAAM,aAAaA,OAAM,KAAK,UAAU,qBAAqB,QAAQ,gBAAgB;AACrF,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACX,QAAM,SAAS,SAAS,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AAAA,IACD,KAAK;AAAA,IACL,UAAU;AAAA,IACV,KAAK,EAAE,YAAY,YAAY,qBAAqBA,OAAM,QAAQ,IAAI,EAAE;AAAA,IACxE,aAAa;AAAA,EACf,CAAC;AACD,SAAO,OAAO,UAAU,EAAE,EAAE,MAAM,QAAQ,EAAE,OAAO,OAAO,EACvD,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC;AACpD;AAEA,SAAS,uBAAuB,QAAQ,UAAU;AAChD,QAAM,aAAa,gBAAgB,MAAM;AACzC,MAAI,YAAY,aAAa,UAAU,SAAU,QAAO;AACxD,MAAI,OAAO,YAAY,aAAa,YAAY,CAAC,WAAW,SAAS,WAAW,OAAO,GAAG;AACxF,WAAO;AAAA,EACT;AACA,QAAM,WAAW,WAAW,SAAS,MAAM,QAAQ,MAAM,EAAE,WAAW,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AACjG,QAAM,oBAAoB,oBAAI,IAAI;AAAA,IAChC,OAAO,SAAS,YAAY,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AAAA,IAChD,oBAAoB,SAAS,OAAO;AAAA,EACtC,CAAC;AACD,MAAI,kBAAkB,IAAI,QAAQ,EAAG,YAAW,WAAW,SAAS;AACpE,SAAO;AACT;AAEA,SAAS,aAAa,MAAM,eAAe;AACzC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GAAG;AAC5D,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,MAAI,KAAK,oBAAoB,cAAc,gBAAgB,yBAAyB;AAClF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,MAAI,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG;AACvF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,WAAW,cAAc,gBAAgB;AAC/C,QAAM,SAAS,OAAO,YAAY,OAAO,QAAQ,KAAK,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;AAC7F,QAAM,eAAe,OAAO,KAAK,QAAQ,EAAE,KAAK;AAChD,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,KAAK;AAC5C,MAAI,cAAc,UAAU,MAAM,cAAc,YAAY,GAAG;AAC7D,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,aAAW,OAAO,cAAc;AAC9B,UAAM,SAAS,QAAQ,kBACnB,uBAAuB,OAAO,GAAG,GAAG,SAAS,GAAG,CAAC,IACjD,OAAO,GAAG;AACd,QAAI,cAAc,MAAM,MAAM,cAAc,SAAS,GAAG,CAAC,GAAG;AAC1D,YAAM,IAAI,MAAM,gDAAgD,GAAG,EAAE;AAAA,IACvE;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,SAAS;AAC5B;AAEA,SAAS,cAAcC,OAAM,cAAc,OAAO,OAAO;AACvD,MAAI,CAAC,MAAM,OAAOA,KAAI,EAAG,OAAM,IAAI,MAAM,kBAAkB,KAAK,UAAU;AAC1E,QAAM,QAAQ,MAAM,MAAMA,KAAI;AAC9B,MAAI,cAAc,KAAK,KAAK,MAAM,eAAeA,OAAM,KAAK,GAAG;AAC7D,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB;AAAA,EAC9D;AACA,MAAI,iBAAiB,eAAe,CAAC,MAAM,YAAY,GAAG;AACxD,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB;AAAA,EAC9D;AACA,MAAI,iBAAiB,UAAU,CAAC,MAAM,OAAO,GAAG;AAC9C,UAAM,IAAI,MAAM,kBAAkB,KAAK,wBAAwB;AAAA,EACjE;AACA,MAAI,iBAAiB,UAAU,OAAO,MAAM,KAAK,IAAI,GAAG;AACtD,UAAM,IAAI,MAAM,kBAAkB,KAAK,gBAAgB;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,aAAa,gBAAgB,UAAU,OAAO;AAC7E,QAAM,UAAU,CAAC;AACjB,MAAI,YAAY;AAChB,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,cAAc,GAAG;AACzD,UAAMA,QAAO,QAAQ,aAAa,GAAG;AACrC,oBAAgB,aAAaA,OAAM,cAAc;AACjD,UAAM,aAAa,yBAAyB,OAAO,QAAQ;AAC3D,QAAI,YAAY;AACd,cAAQ,KAAK,GAAG;AAChB,UAAI,MAAM,OAAOA,KAAI,EAAG,OAAM,IAAI,MAAM,sDAAsD,GAAG,EAAE;AACnG;AAAA,IACF;AACA,kBAAcA,OAAM,aAAa,OAAO,qBAAqB,GAAG,EAAE;AAClE,iBAAa;AAAA,EACf;AACA,SAAO,EAAE,WAAW,SAAS,QAAQ,KAAK,EAAE;AAC9C;AAEA,SAAS,WAAW,MAAMA,OAAM,OAAO,WAAW,IAAI;AACpD,MAAI,SAAS,IAAK,QAAO,KAAMA,KAAI;AAAA;AACnC,SAAO,KAAMA,KAAI,IAAK,MAAM,IAAI,IAAK,QAAQ;AAAA;AAC/C;AAEO,SAAS,qBAAqB,iBAAiB,QAAQ,CAAC,GAAG;AAChE,QAAM,MAAM;AAAA,IACV,QAAQF;AAAA,IACR,OAAO;AAAA,IACP,SAAS,CAACE,UAAS,YAAYA,OAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IAC5D,UAAU;AAAA,IACV,gBAAgB,MAAM;AAAA,IACtB,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL;AACA,QAAM,OAAO,QAAQ,eAAe;AACpC,gBAAc,MAAM,aAAa,KAAK,mBAAmB;AACzD,QAAM,WAAW,IAAI,kBAAkB,IAAI;AAC3C,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,OAAM,IAAI,MAAM,yDAAyD;AACvG,MAAI,SAAS,SAAS,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAE/F,MAAI,YAAY;AAChB,MAAI,iBAAiB;AACrB,MAAI,YAAY;AAChB,QAAM,UAAU,CAAC;AACjB,WAAS,KAAK,UAAU,cAAc;AACpC,eAAW,SAAS,IAAI,QAAQ,QAAQ,GAAG;AACzC,YAAM,gBAAgB,eAAe,GAAG,YAAY,IAAI,MAAM,IAAI,KAAK,MAAM;AAC7E,UAAI,kBAAkB,qBAAsB;AAC5C,YAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI;AAC1C,sBAAgB,MAAM,OAAO,YAAY;AACzC,YAAM,QAAQ,IAAI,MAAM,KAAK;AAC7B,UAAI,cAAc,KAAK,KAAK,IAAI,eAAe,OAAO,KAAK,GAAG;AAC5D,cAAM,IAAI,MAAM,iDAAiD,aAAa,EAAE;AAAA,MAClF;AACA,UAAI,MAAM,YAAY,GAAG;AACvB,0BAAkB;AAClB,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,eAAe,MAAM,CAAC;AACtD,aAAK,OAAO,aAAa;AAAA,MAC3B,WAAW,MAAM,OAAO,GAAG;AACzB,YAAI,OAAO,MAAM,KAAK,IAAI,GAAG;AAC3B,gBAAM,IAAI,MAAM,mDAAmD,aAAa,EAAE;AAAA,QACpF;AACA,qBAAa;AACb,qBAAa,OAAO,MAAM,IAAI;AAC9B,cAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,IAAI,SAAS,KAAK,CAAC,EAAE,OAAO,KAAK;AAC5E,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,eAAe,OAAO,OAAO,CAAC;AAAA,MAChE,OAAO;AACL,cAAM,IAAI,MAAM,kDAAkD,aAAa,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACA,OAAK,MAAM,EAAE;AACb,UAAQ,KAAK,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,QAAM,WAAW,WAAW,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,QACjD,IAAI,CAAC,UAAU,WAAW,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,EAC5E,KAAK,EAAE;AACV,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,WAAW,QAAQ,EAAE,OAAO,UAAU,MAAM,EAAE,OAAO,KAAK;AAAA,IAClE,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,+BAA+B,OAAO,WAAW,QAAQ;AAAA,IACzD,qBAAqB;AAAA,IACrB,uBAAuB;AAAA,EACzB;AACF;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA,kBAAkB,KAAK,aAAa,cAAc;AAAA,EAClD,kBAAkB,KAAK,aAAa,mBAAmB;AAAA,EACvD;AAAA,EACA,QAAQ,CAAC;AACX,GAAG;AACD,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,QAAQ,eAAe;AACvC,QAAM,WAAW,QAAQ,eAAe;AACxC,MAAI,YAAY,QAAQ,SAAS,cAAc,KAAK,aAAa,QAAQ,SAAS,mBAAmB,GAAG;AACtG,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,MAAM;AAAA,IACV,QAAQF;AAAA,IACR,OAAO;AAAA,IACP,UAAU;AAAA,IACV,gBAAgB,MAAM;AAAA,IACtB,GAAG;AAAA,EACL;AACA,gBAAc,UAAU,QAAQ,KAAK,cAAc;AACnD,QAAM,OAAO,KAAK,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC;AACtD,QAAM,EAAE,SAAS,IAAI,aAAa,MAAM,aAAa;AACrD,QAAM,WAAW,EAAE,IAAI,cAAc,SAAS,IAAI,MAAM,cAAc,SAAS,KAAK;AACpF,QAAM,WAAW,wBAAwB,SAAS,UAAU,UAAU,GAAG;AACzE,QAAM,kBAAkB,CAAC,GAAG,cAAc,gBAAgB,oCAAoC,EAAE,KAAK;AACrG,MAAI,cAAc,SAAS,OAAO,MAAM,cAAc,eAAe,GAAG;AACtE,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,SAAS,cAAc,OAAO,KAAK,QAAQ,EAAE,SAAS,SAAS,QAAQ,QAAQ;AACjF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,OAAO,qBAAqB,SAAS,KAAK;AAChD,MAAI,cAAc,IAAI,MAAM,cAAc,cAAc,cAAc,GAAG;AACvE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO,EAAE,IAAI,MAAM,cAAc,OAAO,KAAK,QAAQ,EAAE,QAAQ,GAAG,UAAU,KAAK;AACnF;;;ADrRA,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAC5C,IAAM,mCAAmCG;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,WAAW,OAAO,OAAO;AAAA,EAC7B,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,eAAe;AAAA,EACf,eAAe;AAAA,EACf,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,uBAAuB;AACzB,CAAC;AAED,IAAM,SAAS;AACf,IAAM,YAAY;AAElB,SAASC,WAAU,OAAO;AACxB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAIA,UAAS;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAKA,WAAU,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,EAChG;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAO;AAC9B,SAAOC,YAAW,QAAQ,EAAE,OAAO,GAAG,KAAK,UAAUD,WAAU,KAAK,CAAC,CAAC;AAAA,GAAM,MAAM,EAAE,OAAO,KAAK;AAClG;AAEA,SAAS,YAAY,QAAQ,UAAU,OAAO;AAC5C,MAAI,WAAW,SAAU,OAAM,IAAI,MAAM,yBAAyB,KAAK,WAAW;AACpF;AAEA,SAAS,sBAAsB,OAAO;AACpC,SAAO,yBAAyB,OAAO,EAAE,IAAI,SAAS,MAAM,MAAM,CAAC;AACrE;AAEO,SAAS,6BAA6B,OAAO;AAClD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,cAAY,MAAM,gBAAgB,GAAG,gBAAgB;AACrD,cAAY,MAAM,kBAAkB,SAAS,iBAAiB,IAAI;AAClE,cAAY,MAAM,SAAS,MAAM,SAAS,aAAa,cAAc;AACrE,cAAY,MAAM,SAAS,SAAS,SAAS,SAAS,iBAAiB;AACvE,cAAY,MAAM,SAAS,UAAU,SAAS,UAAU,UAAU;AAClE,cAAY,MAAM,SAAS,aAAa,SAAS,YAAY,aAAa;AAC1E,cAAY,MAAM,SAAS,YAAY,SAAS,WAAW,mBAAmB;AAC9E,cAAY,MAAM,SAAS,gBAAgB,SAAS,eAAe,gBAAgB;AACnF,cAAY,MAAM,SAAS,iBAAiB,SAAS,eAAe,YAAY;AAChF,cAAY,MAAM,SAAS,UAAU,SAAS,SAAS,UAAU;AACjE,cAAY,MAAM,SAAS,mBAAmB,IAAI,mBAAmB;AACrE,cAAY,MAAM,SAAS,cAAc,QAAQ,mBAAmB;AACpE,cAAY,MAAM,SAAS,gBAAgB,SAAS,qBAAqB;AAEzE,cAAY,MAAM,UAAU,IAAI,SAAS,kBAAkB;AAC3D,cAAY,MAAM,UAAU,MAAM,OAAO,cAAc;AACvD,cAAY,MAAM,UAAU,qBAAqB,YAAY,qBAAqB;AAClF,MAAI,CAAC,eAAe,KAAK,OAAO,MAAM,UAAU,8BAA8B,EAAE,CAAC,KAC5E,MAAM,UAAU,8BAA8B,WAAW;AAC5D,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ;AAAA,IAC3C,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,OAAO;AAAA,IACP,MAAM;AAAA,IACN,6BAA6B;AAAA,IAC7B,kBAAkB;AAAA,IAClB,mEAAmE;AAAA,EACrE,CAAC,EAAG,aAAY,MAAM,mBAAmB,GAAG,GAAG,UAAU,oBAAoB,GAAG,EAAE;AAClF,cAAY,MAAM,kBAAkB,yBAAyB,SAAS,UAAU,iBAAiB;AAEjG,QAAM,OAAO,MAAM;AACnB,MAAI,CAAC,MAAM,YAAY,OAAO,KAAK,aAAa,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG;AACxF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,cAAY,KAAK,yBAAyB,GAAG,kBAAkB;AAC/D,cAAY,KAAK,oBAAoB,SAAS,kBAAkB,oBAAoB;AACpF,cAAY,KAAK,0BAA0B,SAAS,wBAAwB,kBAAkB;AAC9F,cAAY,KAAK,aAAa,SAAS,YAAY,aAAa;AAChE,cAAY,KAAK,uBAAuB,SAAS,YAAY,iBAAiB;AAC9E,cAAY,KAAK,sBAAsB,SAAS,oBAAoB,gBAAgB;AACpF,cAAY,KAAK,mCAAmC,SAAS,qBAAqB,iBAAiB;AAEnG,QAAM,UAAU,OAAO,QAAQ,KAAK,QAAQ;AAC5C,cAAY,QAAQ,QAAQ,SAAS,YAAY,mBAAmB;AACpE,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,CAAC,IAAI,WAAW,eAAe,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM,UAAU,GAAG,MAAM,OAClF,IAAI,MAAM,GAAG,EAAE,SAAS,IAAI,GAAG;AAClC,YAAM,IAAI,MAAM,kDAAkD,GAAG,EAAE;AAAA,IACzE;AACA,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,SAAS,MAAM;AAC9D,YAAM,IAAI,MAAM,oDAAoD,GAAG,EAAE;AAAA,IAC3E;AACA,QAAI,CAAC,OAAO,KAAK,OAAO,MAAM,aAAa,EAAE,CAAC,GAAG;AAC/C,YAAM,IAAI,MAAM,yDAAyD,GAAG,EAAE;AAAA,IAChF;AACA,QAAI,CAAC,OAAO,MAAM,YAAY,EAAE,EAAE,WAAW,SAAS,QAAQ,GAAG;AAC/D,YAAM,IAAI,MAAM,iEAAiE,GAAG,EAAE;AAAA,IACxF;AACA,QAAI,MAAM,qBAAqB,MAAM;AACnC,YAAM,IAAI,MAAM,6DAA6D,GAAG,EAAE;AAAA,IACpF;AAAA,EACF;AACA,QAAM,SAAS,KAAK,SAAS,gCAAgC;AAC7D,cAAY,QAAQ,SAAS,SAAS,SAAS,2BAA2B;AAC1E,cAAY,QAAQ,WAAW,SAAS,WAAW,6BAA6B;AAChF,cAAY,gBAAgB,KAAK,QAAQ,GAAG,SAAS,wBAAwB,2BAA2B;AAExG,QAAM,UAAU,QAAQ,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,sBAAsB,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,MAAM,GAAG,EAAE,KAAK;AACrG,QAAM,kBAAkB,CAAC,GAAI,KAAK,wCAAwC,CAAC,CAAE,EAAE,KAAK;AACpF,cAAY,KAAK,UAAU,eAAe,GAAG,KAAK,UAAU,OAAO,GAAG,0BAA0B;AAChG,cAAY,QAAQ,SAAS,QAAQ,QAAQ,SAAS,qBAAqB,yBAAyB;AAEpG,QAAM,OAAO,MAAM;AACnB,cAAY,MAAM,WAAW,SAAS,eAAe,gBAAgB;AACrE,MAAI,CAAC,UAAU,KAAK,OAAO,MAAM,UAAU,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;AAC1G,cAAY,KAAK,QAAQ,SAAS,YAAY,aAAa;AAC3D,cAAY,KAAK,YAAY,SAAS,eAAe,iBAAiB;AACtE,cAAY,KAAK,iBAAiB,SAAS,oBAAoB,sBAAsB;AACrF,cAAY,KAAK,YAAY,SAAS,eAAe,iBAAiB;AACtE,cAAY,KAAK,+BAA+B,SAAS,uBAAuB,0BAA0B;AAC1G,cAAY,KAAK,qBAAqB,GAAG,oBAAoB;AAC7D,cAAY,KAAK,uBAAuB,GAAG,qBAAqB;AAChE,SAAO;AACT;AAEO,SAAS,yBAAyB,OAAO,kCAAkC;AAChF,SAAO,6BAA6B,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC,CAAC;AAC5E;AAEO,SAAS,mCAAmC,SAAS;AAC1D,QAAM,gBAAgB,6BAA6B,SAAS,iBAAiB,yBAAyB,CAAC;AACvG,SAAO,qBAAqB,EAAE,GAAG,SAAS,cAAc,CAAC;AAC3D;AAEA,IAAI,QAAQ,KAAK,CAAC,KAAKH,SAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,cAAc,YAAY,GAAG,GAAG;AAClF,2BAAyB,QAAQ,KAAK,CAAC,IAAIA,SAAQ,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAS;AAC/E,UAAQ,OAAO,MAAM,sCAAsC;AAC7D;;;AExKA,SAAS,cAAAI,aAAY,kBAAkB;AACvC;AAAA,EACE;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,WAAAC,UAAS,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,gBAAe;AAE7D,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,eAAe;AACrB,IAAM,aAAa;AACnB,IAAM,UAAU;AAChB,IAAM,YAAYF,MAAK,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAC9E,IAAM,iBAAiBA,MAAK,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAClG,IAAM,cAAcA,MAAK,gBAAgB,cAAc,UAAU,cAAc;AAC/E,IAAM,wBAAwBA,MAAK,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AACpH,IAAM,gBAAgB;AAEtB,SAAS,OAAO,QAAQ,WAAW;AACjC,QAAM,MAAMC,UAASC,SAAQ,MAAM,GAAGA,SAAQ,SAAS,CAAC;AACxD,SAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAACH,YAAW,GAAG;AAChE;AASA,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAEpB,SAAS,mBAAmB,EAAE,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI,CAAC,GAAG;AAC5G,MAAI,aAAa,SAAS;AACxB,UAAM,UAAU,OAAO,IAAI,WAAW,EAAE,EAAE,KAAK;AAC/C,WAAO,WAAWA,YAAW,OAAO,IAAIC,MAAK,SAAS,gBAAgB,kBAAkB,IAAI;AAAA,EAC9F;AACA,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,aAAa,UAAU;AACzB,WAAOA,MAAK,MAAM,WAAW,uBAAuB,gBAAgB,kBAAkB;AAAA,EACxF;AACA,QAAM,MAAM,OAAO,IAAI,mBAAmB,EAAE,EAAE,KAAK;AACnD,QAAM,OAAO,OAAOD,YAAW,GAAG,IAAI,MAAMC,MAAK,MAAM,SAAS;AAChE,SAAOA,MAAK,MAAM,gBAAgB,kBAAkB;AACtD;AAWO,SAAS,mBAAmB,MAAM,QAAQ,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,GAAG;AAC7E,QAAM,QAAQ,OAAO,IAAI,0BAA0B,EAAE,EAAE,KAAK;AAC5D,MAAI,MAAO,QAAOD,YAAW,KAAK,IAAIG,SAAQ,KAAK,IAAI;AACvD,QAAM,UAAU,mBAAmB,EAAE,UAAU,KAAK,KAAK,CAAC;AAC1D,SAAO,UAAUA,SAAQ,OAAO,IAAI;AACtC;AAEO,SAAS,eAAe,MAAM;AACnC,SAAO,UAAUT,YAAW,QAAQ,EAAE,OAAOG,cAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAGO,SAAS,gBAAgB,MAAM;AACpC,QAAM,SAASH,YAAW,QAAQ;AAClC,QAAM,QAAQ,CAAC;AACf,QAAM,QAAQ,CAAC,WAAW,SAAS,OAAO;AACxC,UAAM,WAAWE,WAAU,SAAS;AACpC,QAAI,SAAS,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC3F,QAAI,CAAC,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACnF,eAAW,QAAQE,aAAY,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG;AACxG,YAAM,WAAWG,MAAK,WAAW,IAAI;AACrC,YAAM,eAAe,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK;AACpD,YAAM,OAAOL,WAAU,QAAQ;AAC/B,UAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AACvF,UAAI,KAAK,YAAY,EAAG,OAAM,UAAU,YAAY;AAAA,eAC3C,KAAK,OAAO,KAAK,iBAAiB,cAAe,OAAM,KAAK,EAAE,UAAU,cAAc,MAAM,KAAK,KAAK,CAAC;AAAA,eACvG,CAAC,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,0CAA0C;AAAA,IACrF;AAAA,EACF;AACA,QAAM,IAAI;AACV,QAAM,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,EAAE,YAAY,GAAG,OAAO,KAAK,EAAE,YAAY,CAAC,CAAC;AAC7F,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,OAAO,KAAK,KAAK,cAAc,MAAM;AACvD,WAAO,OAAO,GAAG,UAAU,MAAM,GAAG;AACpC,WAAO,OAAO,SAAS;AACvB,WAAO,OAAO,IAAI,KAAK,IAAI,GAAG;AAC9B,WAAO,OAAOC,cAAa,KAAK,QAAQ,CAAC;AACzC,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO,UAAU,OAAO,OAAO,QAAQ,CAAC;AAC1C;AAEO,SAAS,gBAAgB,MAAM,OAAO;AAC3C,YAAUE,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,OAAOE,MAAKF,SAAQ,IAAI,GAAG,IAAI,WAAW,CAAC,MAAM;AACvD,QAAM,KAAK,SAAS,MAAM,MAAM,GAAK;AACrC,MAAI;AACF,kBAAc,IAAI,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AAC/D,cAAU,EAAE;AAAA,EACd,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACA,MAAI;AACF,eAAW,MAAM,IAAI;AAGrB,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI;AACF,cAAM,WAAW,SAASA,SAAQ,IAAI,GAAG,GAAG;AAC5C,YAAI;AAAE,oBAAU,QAAQ;AAAA,QAAG,UAAE;AAAU,oBAAU,QAAQ;AAAA,QAAG;AAAA,MAC9D,QAAQ;AAAA,MAAkD;AAAA,IAC5D;AAAA,EACF,UAAE;AACA,WAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EAC9B;AACF;AAEO,SAAS,eAAe,aAAa;AAC1C,QAAM,OAAOE,MAAK,aAAa,cAAc;AAC7C,MAAI,CAACN,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,QAAQ,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC;AACnD,WAAO,OAAO,mBAAmB,IAAI,QAAQ;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,aAAa,QAAQ;AAC7C,MAAI,CAAC,WAAW,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACvE,QAAM,WAAWI,MAAK,aAAa,SAAS,MAAM;AAClD,SAAO;AAAA,IACL;AAAA,IACA,OAAOA,MAAK,UAAU,SAAS;AAAA,IAC/B,YAAYA,MAAK,UAAU,cAAc;AAAA,IACzC,aAAaA,MAAK,UAAU,WAAW;AAAA,IACvC,kBAAkBA,MAAK,UAAU,qBAAqB;AAAA,IACtD,UAAUA,MAAK,UAAU,aAAa;AAAA,EACxC;AACF;AAEA,SAAS,YAAY,QAAQ;AAC3B,SAAO,UACF,WAAW,KAAK,OAAO,OAAO,KAC9B,WAAW,KAAK,OAAO,OAAO,KAC9B,aAAa,KAAK,OAAO,SAAS,KAClC,aAAa,KAAK,OAAO,YAAY,KACrC,aAAa,KAAK,OAAO,iBAAiB,KAC1C,aAAa,KAAK,OAAO,WAAW;AAC3C;AAEO,SAAS,aAAa,aAAa,QAAQ;AAChD,MAAI,CAAC,YAAY,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACpF,QAAM,QAAQ,UAAU,aAAa,OAAO,OAAO;AACnD,MAAI;AACF,UAAM,WAAW,KAAK,MAAMJ,cAAa,MAAM,UAAU,MAAM,CAAC;AAChE,UAAM,MAAM,KAAK,MAAMA,cAAa,MAAM,aAAa,MAAM,CAAC;AAC9D,UAAM,WAAW;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,SAAS,OAAO;AAAA,MAChB,WAAW,OAAO;AAAA,MAClB,cAAc,OAAO;AAAA,MACrB,mBAAmB,OAAO;AAAA,MAC1B,aAAa,OAAO;AAAA,IACtB;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,WAAW,GAAG,MAAM,MAAO,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,GAAG,YAAY;AAAA,IACxF;AACA,QAAI,UAAU,mBAAmB,KAAK,KAAK,SAAS,uBAAuB,KAAK,YAAY,OAAO,SAAS;AAC1G,aAAO,EAAE,IAAI,OAAO,QAAQ,4BAA4B;AAAA,IAC1D;AACA,QAAID,WAAU,MAAM,KAAK,EAAE,eAAe,KAAKA,WAAU,MAAM,UAAU,EAAE,eAAe,KACrFA,WAAU,MAAM,gBAAgB,EAAE,eAAe,GAAG;AACvD,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,UAAU,CAAC,KAC3G,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,gBAAgB,CAAC,GAAG;AAClE,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO,aAAc,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AAC3G,QAAI,eAAe,MAAM,UAAU,MAAM,OAAO,kBAAmB,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAC1H,QAAI,gBAAgB,MAAM,QAAQ,MAAM,OAAO,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AACrH,WAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,EACrF;AACF;AAEO,SAAS,kBAAkB,aAAa,UAAU,OAAO,SAAS,IAAI;AAC3E,MAAI,CAAC,aAAa,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AAC5E,kBAAgBK,MAAK,aAAa,gBAAgB,GAAG,QAAQ,OAAO,GAAG;AAAA,IACrE,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX;AAAA,IACA,QAAQ,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,IACnC,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC,CAAC;AACH;AAEO,SAAS,aAAa,aAAa,QAAQ,QAAQ;AACxD,MAAI,CAAC,YAAY,MAAM,EAAG,OAAM,IAAI,MAAM,0CAA0C;AACpF,MAAI,CAAC,aAAa,KAAK,OAAO,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AACnF,MAAI,CAAC,QAAQ,KAAK,OAAO,OAAO,wBAAwB,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACvH,QAAM,YAAY,aAAa,aAAa,MAAM;AAClD,MAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,yCAAyC,UAAU,MAAM,EAAE;AAC9F,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,6CAA6C;AACnF,QAAM,UAAU;AAAA,IACd,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB;AAAA,IACA,UAAU,YAAY,SAAS,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC1D,SAAS;AAAA,MACP,WAAW,OAAO;AAAA,MAClB,WAAW,OAAO,OAAO,YAAY,EAAE;AAAA,MACvC,aAAa,OAAO,OAAO,cAAc,EAAE;AAAA,MAC3C,wBAAwB,OAAO;AAAA,MAC/B,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,cAAc;AAAA,IAChB;AAAA,EACF;AAGA,oBAAkB,aAAa,OAAO,UAAU,YAAY,GAAG,OAAO,OAAO,IAAI,OAAO,SAAS,EAAE;AACnG,kBAAgBA,MAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,SAAO;AACT;AAEO,SAAS,+BAA+B,aAAa,UAAU;AACpE,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,SAAS,0BAA0B,EAAE;AACrE,MAAI,QAAQ,KAAK,OAAO,EAAG,QAAO;AAClC,SAAO,QAAQ,KAAK,OAAO,YAAY,EAAE,CAAC,IAAI,WAAW;AAC3D;AAEO,SAAS,sBAAsB,aAAa,SAAS,QAAQ;AAClE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,IAAI,GAAG,OAAO,QAAQ,QAAQ,gBAAgB,CAAC,CAAC,IAAI;AAC1E,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,SAAS,EAAE,GAAG,QAAQ,SAAS,cAAc,UAAU,YAAY,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE;AAAA,EAClG;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,WAAW,QAAQ,KAAK,MAAM,EAAE;AACvG,SAAO;AACT;AA0CO,SAAS,wBAAwB,EAAE,aAAa,UAAAG,WAAU,QAAQ,GAAG;AAC1E,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,CAAC,SAAS,WAAW,CAAC,YAAY,QAAQ,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAC3G,QAAM,YAAY,aAAa,aAAa,QAAQ,MAAM;AAC1D,MAAI,CAAC,UAAU,GAAI,QAAO;AAC1B,MAAI;AACF,QAAI,aAAaA,SAAQ,MAAM,aAAa,UAAU,MAAM,UAAU,GAAG;AACvE,aAAO,EAAE,IAAI,OAAO,QAAQ,qDAAqD;AAAA,IACnF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,4CAA4C;AAAA,EAC1E;AACA,MAAI,YAAY,QAAQ,OAAO,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,sCAAsC;AAC1G,SAAO,EAAE,IAAI,MAAM,SAAS,QAAQ,QAAQ,QAAQ,OAAO,UAAU,MAAM;AAC7E;AAEO,SAAS,mBAAmB,aAAa,SAAS;AACvD,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,GAAG,QAAQ,OAAO,OAAO,WAAW;AAC3G,kBAAgBC,MAAK,aAAa,cAAc,GAAG;AAAA,IACjD,gBAAgB;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ,YAAY;AAAA,IAC9B,SAAS;AAAA,EACX,CAAC;AAGD,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,YAAY,GAAG,QAAQ,OAAO,OAAO,SAAS;AAAA,EAAG,QAAQ;AAAA,EAAoB;AAC/I;AAEO,SAAS,mBAAmB,aAAa,SAAS,QAAQ;AAC/D,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,gBAAgB,MAAM;AAChF,QAAM,aAAa;AAAA,IACjB,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB,QAAQ,YAAY,SAAS,QAAQ,IAAI,QAAQ,WAAW;AAAA,IAC5D,UAAU;AAAA,IACV,SAAS;AAAA,MACP,GAAG,QAAQ;AAAA,MACX,iBAAiB;AAAA,MACjB,iBAAiB,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,MAC5C,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzC;AAAA,EACF;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,UAAU;AAC7D,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,eAAe,MAAM;AAAA,EAAG,QAAQ;AAAA,EAAoB;AACpH,SAAO;AACT;AAEO,SAAS,6BAA6B,aAAa,SAAS;AACjE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,aAClD,SAAS,SAAS,oBAAoB,UAAU;AACnD,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,EAAE,GAAG,SAAS,SAAS,KAAK,CAAC;AAChF,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,wBAAwB,QAAQ,QAAQ,eAAe;AAAA,EAAG,QACpH;AAAA,EAAsC;AAC9C;;;AHrWA,IAAM,eAAe;AACrB,IAAMC,mBAAkB;AACxB,IAAMC,gBAAe;AACrB,IAAM,oBAAoB,MAAM,OAAO;AACvC,IAAM,kBAAkB;AAEjB,SAAS,2BAA2B,MAAM,QAAQ,KAAK,cAAc,IAAI;AAC9E,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAc;AAAA,IAAc;AAAA,IAAU;AAAA,IACzE;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAe;AAAA,IAAW;AAAA,IAC3D;AAAA,IAAgB;AAAA,IAAqB;AAAA,IAAgB;AAAA,IAAQ;AAAA,EAC/D,CAAC;AACD,QAAM,QAAQ,CAAC;AACf,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,QAAQ,IAAI,GAAG,KAAK,OAAO,UAAU,SAAU,OAAM,GAAG,IAAI;AAAA,EAClE;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,2BAA2B;AAAA,IAC3B,sBAAsB;AAAA,IACtB,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,4BAA4B;AAAA,IAC5B,qBAAqB;AAAA,IACrB,GAAI,cAAc;AAAA,MAChB,uBAAuBC,MAAK,aAAa,eAAe,YAAY;AAAA,MACpE,yBAAyBA,MAAK,aAAa,eAAe,cAAc;AAAA,MACxE,kBAAkBA,MAAK,aAAa,eAAe,WAAW;AAAA,IAChE,IAAI,CAAC;AAAA,EACP;AACF;AAEA,SAAS,WAAW,SAAS,MAAM,SAAS;AAC1C,SAAOC,WAAU,SAAS,MAAM;AAAA,IAC9B,KAAK,QAAQ;AAAA,IACb,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,IACb,OAAO;AAAA,IACP,aAAa;AAAA,IACb,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,SAAS,QAAQ,WAAW;AAAA,EAC9B,CAAC;AACH;AAEA,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,YAAY,IAAI,GAAG;AACnE,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,aAAa,aAAa,UAAU,WAAW;AACrD,QAAM,SAAS,SAAS,CAAC,MAAM,IAAI,CAAC;AACpC,SAAO;AAAA,IACL,IAAI,MAAM,SAAS;AAAE,aAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO;AAAA,IAAG;AAAA,IAC5E,KAAK,MAAM,SAAS;AAAE,aAAO,IAAI,UAAU,MAAM,OAAO;AAAA,IAAG;AAAA,EAC7D;AACF;AAEA,SAAS,gBAAgB,QAAQ,WAAW;AAC1C,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,SAAS,YAAY,OAAO,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,QAAQ,UAAU,CAAC,EAAE,CAAC,EAAE;AAAA,EAC7H;AACA,MAAI;AAAE,WAAO,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,MAAM,GAAG,SAAS,wBAAwB;AAAA,EAAG;AACzH;AAEA,SAAS,iBAAiB,MAAM;AAC9B,SAAO,UAAUC,YAAW,QAAQ,EAAE,OAAOC,cAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAEA,SAAS,cAAc,MAAM;AAC3B,QAAM,UAAU,CAAC,IAAI;AACrB,SAAO,QAAQ,QAAQ;AACrB,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,OAAOC,WAAU,OAAO;AAC9B,QAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,iDAAiD;AAC5F,QAAI,CAAC,KAAK,YAAY,EAAG;AACzB,eAAW,SAASC,aAAY,OAAO,EAAG,SAAQ,KAAKL,MAAK,SAAS,KAAK,CAAC;AAAA,EAC7E;AACF;AAEO,SAAS,uBAAuB,aAAa,UAAU;AAC5D,QAAM,OAAO,KAAK,MAAMG,cAAaH,MAAK,aAAa,mBAAmB,GAAG,MAAM,CAAC;AACpF,MAAI,OAAO,KAAK,eAAe,IAAI,KAAK,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,UAAU;AAC3F,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,MAAI,eAAe;AACnB,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACvD,QAAI,CAAC,IAAK;AACV,QAAI,MAAM,SAAS,KAAM,OAAM,IAAI,MAAM,0CAA0C,GAAG,EAAE;AACxF,UAAM,WAAW,IAAI,WAAW,MAAM,GAAG,EAAE,SAAS,gCAAgC;AACpF,QAAI,UAAU;AACZ,qBAAe,KAAK,YAAY,SAAS,WAAW,KAAK,cAAc,SAAS;AAChF;AAAA,IACF;AACA,QAAI,CAACD,cAAa,KAAK,OAAO,MAAM,aAAa,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAClH,QAAI,CAAC,OAAO,MAAM,YAAY,EAAE,EAAE,WAAW,6BAA6B,GAAG;AAC3E,YAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AACA,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,4DAA4D;AACjG;AAEO,SAAS,2BAA2B,aAAa,SAAS,sBAAsB;AACrF,QAAM,gBAAgB,6BAA6B,oBAAoB;AACvE,QAAM,cAAcO,SAAQ,aAAa,MAAM,IAAI;AACnD,QAAM,qBAAqBC,UAAS,aAAaD,SAAQ,OAAO,CAAC;AACjE,MAAI,CAAC,sBAAsB,uBAAuB,QAC7C,mBAAmB,WAAW,KAAKE,IAAG,EAAE,KACxCC,YAAW,kBAAkB,GAAG;AACnC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,kBAAkBF,UAAS,aAAaD,SAAQ,OAAO,CAAC,EAAE,WAAW,MAAM,GAAG;AACpF,MAAI,CAAC,mBAAmBG,YAAW,eAAe,KAC7C,gBAAgB,SAAS,IAAI,KAAK,gBAAgB,SAAS,IAAI,GAAG;AACrE,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,WAAW,QAAQ,eAAe;AACxC,QAAM,gBAAgB;AAAA,IAAE,MAAM;AAAA,IAAyB,SAAS;AAAA,IAAS,SAAS;AAAA,IAChF,cAAc,EAAE,CAAC,YAAY,GAAG,SAAS;AAAA,EAAE;AAC7C,QAAM,WAAW,gBAAgB,cAAc,gBAAgB,QAAQ;AACvE,WAAS,gBAAgB,YAAY,EAAE,EAAE,WAAW;AACpD,QAAM,OAAO;AAAA,IAAE,MAAM,cAAc;AAAA,IAAM,SAAS,cAAc;AAAA,IAC9D,iBAAiB,cAAc,gBAAgB;AAAA,IAC/C,UAAU;AAAA,IAAM,UAAU,EAAE,IAAI,eAAe,GAAG,SAAS;AAAA,EAAE;AAC/D,EAAAC,eAAcV,MAAK,aAAa,cAAc,GAAG,GAAG,KAAK,UAAU,aAAa,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACtG,EAAAU,eAAcV,MAAK,aAAa,mBAAmB,GAAG,GAAG,KAAK,UAAU,IAAI,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAClG,SAAO,EAAE,UAAU,KAAK;AAC1B;AAEA,SAAS,YAAY,QAAQ,UAAU,OAAO;AAC5C,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,SAAS;AAAA,IAClB,WAAW,SAAS;AAAA,IACpB,cAAc,eAAe,MAAM,KAAK;AAAA,IACxC,mBAAmB,eAAe,MAAM,UAAU;AAAA,IAClD,aAAa,gBAAgB,MAAM,YAAY,MAAM,WAAW;AAAA,EAClE;AACF;AAEA,SAAS,YAAY;AAAA,EACnB;AAAA,EAAa;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAO;AACrE,GAAG;AACD,QAAM,SAASE,YAAW,QAAQ,EAAE,OAAO,SAAS,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACxF,QAAM,SAAS,QAAQ,GAAG,MAAM,IAAIS,YAAW,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK;AACjE,QAAM,SAAS,UAAU,SAAS,OAAO,IAAI,MAAM;AACnD,QAAM,aAAa,UAAU,aAAa,MAAM;AAChD,MAAI,CAAC,SAASC,YAAW,WAAW,QAAQ,GAAG;AAC7C,UAAM,WAAW,KAAK,MAAMT,cAAa,WAAW,UAAU,MAAM,CAAC;AACrE,UAAM,SAAS,YAAY,QAAQ,UAAU,UAAU;AACvD,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,UAAU,MAAM,SAAS,cAAc,SAAS,WAAW;AAC7D,UAAI,sBAAsB;AACxB,2CAAmC;AAAA,UACjC,aAAa,WAAW;AAAA,UAAU,eAAe;AAAA,QACnD,CAAC;AAAA,MACH;AACA,aAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,UAAUH,MAAK,aAAa,WAAWW,YAAW,CAAC;AACzD,QAAM,UAAUX,MAAK,SAAS,SAAS;AACvC,MAAI,gBAAgB;AACpB,MAAI;AACF,IAAAa,WAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,QAAI;AACJ,QAAI,sBAAsB;AACxB,iCAA2B,SAAS,SAAS,oBAAoB;AACjE,oBAAc;AAAA,QAAC;AAAA,QAAM;AAAA,QAAoB;AAAA,QAAkB;AAAA,QAAc;AAAA,QACvE,cAAc,eAAe;AAAA,MAAE;AAAA,IACnC,OAAO;AACL,MAAAH,eAAcV,MAAK,SAAS,cAAc,GAAG,GAAG,KAAK,UAAU;AAAA,QAC7D,MAAM;AAAA,QAAyB,SAAS;AAAA,QAAS,SAAS;AAAA,MAC5D,CAAC,CAAC;AAAA,CAAI;AACN,oBAAc;AAAA,QAAC;AAAA,QAAW;AAAA,QAAoB;AAAA,QAAkB;AAAA,QAAc;AAAA,QAC5E;AAAA,QAAuB;AAAA,QAAgB,cAAc,eAAe;AAAA,QAAI;AAAA,MAAO;AAAA,IACnF;AACA,UAAM,UAAU,OAAO;AAAA,MAAI;AAAA,MACzB,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,KAAQ;AAAA,IAAC;AAChE,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,uBAAuB,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,MAAM,EAAE;AAC7H,kBAAc,OAAO;AACrB,2BAAuB,SAAS,QAAQ;AACxC,QAAI,sBAAsB;AACxB,yCAAmC,EAAE,aAAa,SAAS,eAAe,qBAAqB,CAAC;AAAA,IAClG;AAEA,UAAM,cAAc;AAAA,MAClB,OAAOA,MAAK,SAAS,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAAA,MAC5E,YAAYA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAAA,MAChG,aAAaA,MAAK,SAAS,gBAAgB,cAAc,UAAU,cAAc;AAAA,MACjF,kBAAkBA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AAAA,MACjH,UAAU;AAAA,IACZ;AACA,UAAM,MAAM,KAAK,MAAMG,cAAa,YAAY,aAAa,MAAM,CAAC;AACpE,QAAI,IAAI,SAAS,gBAAgB,IAAI,YAAY,SAAS,QAAS,OAAM,IAAI,MAAM,qCAAqC;AACxH,QAAI,CAACC,WAAU,YAAY,gBAAgB,EAAE,OAAO,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAC/G,UAAM,QAAQ,OAAO,KAAK,CAAC,YAAY,OAAO,UAAU,WAAW,GAAG,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,IAAO,CAAC;AACnI,QAAI,MAAM,WAAW,KAAK,OAAO,MAAM,UAAU,EAAE,EAAE,KAAK,MAAM,iBAAiB,SAAS,OAAO,IAAI;AACnG,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AACA,UAAM,SAAS,YAAY,QAAQ,UAAU,WAAW;AACxD,oBAAgBJ,MAAK,SAAS,uBAAuB,GAAG,EAAE,gBAAgB,GAAG,GAAG,OAAO,CAAC;AACxF,IAAAa,WAAUb,MAAK,aAAa,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,QAAIY,YAAW,WAAW,QAAQ,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC5F,IAAAE,YAAW,SAAS,WAAW,QAAQ;AACvC,oBAAgB;AAChB,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,qCAAqC,UAAU,MAAM,EAAE;AAC1F,WAAO,EAAE,QAAQ,SAAS,KAAK;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,cAAe,CAAAC,QAAO,WAAW,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/E,UAAM;AAAA,EACR,UAAE;AACA,IAAAA,QAAO,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAClD;AACF;AAEO,SAAS,wBAAwB,SAAS;AAC/C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,MAAM,QAAQ;AAAA,IACd,aAAaH;AAAA,IACb,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,uBAAuB;AAAA,EACzB,IAAI;AACJ,MAAI,CAAC,eAAe,CAACH,YAAW,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,mCAAmC;AACxH,MAAI,CAAC,mBAAmB,CAACX,iBAAgB,KAAK,GAAG,YAAY,IAAI,eAAe,EAAE,GAAG;AACnF,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,kCAAkC;AAAA,EAC3E;AACA,MAAI,CAAC,qBAAqB,CAACC,cAAa,KAAK,iBAAiB,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,oCAAoC;AAAA,EAC7E;AACA,QAAM,YAAY,GAAG,YAAY,IAAI,eAAe;AACpD,MAAI,gBAAgB,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,wDAAwD;AAC9H,QAAM,eAAeO,SAAQ,WAAW;AACxC,QAAM,SAAS,2BAA2B,KAAK,YAAY;AAC3D,QAAM,aAAa,EAAE,KAAK,QAAQ,KAAK,aAAa;AACpD,MAAI,SAAS;AACb,MAAI;AACF,IAAAO,WAAU,cAAc,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAA,WAAUb,MAAK,cAAc,aAAa,GAAG,EAAE,WAAW,KAAK,CAAC;AAChE,IAAAU,eAAc,OAAO,uBAAuB,IAAI,EAAE,MAAM,IAAM,CAAC;AAC/D,IAAAA,eAAc,OAAO,yBAAyB,IAAI,EAAE,MAAM,IAAM,CAAC;AACjE,UAAM,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,QAAQ,YAAY,IAAI,CAAC;AACjF,UAAM,WAAW,EAAE,SAAS,iBAAiB,WAAW,kBAAkB;AAC1E,aAASV,MAAK,cAAc,WAAWW,YAAW,CAAC;AACnD,IAAAE,WAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AACrC,UAAM,SAAS,gBAAgB,OAAO,IAAI;AAAA,MACxC;AAAA,MAAQ;AAAA,MAAW;AAAA,MAAoB;AAAA,MAAU;AAAA,MAAsB;AAAA,MAAQ,cAAc,eAAe;AAAA,IAC9G,GAAG,UAAU,GAAG,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,OAAO,CAAC,IAAI;AACnD,UAAM,UAAUb,MAAK,QAAQ,SAAS,OAAO,QAAQ,YAAY,EAAE,CAAC,CAAC;AACrE,QAAI,CAACY,YAAW,OAAO,KAAK,CAAC,SAAS,OAAO,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAC/G,QAAIR,WAAU,OAAO,EAAE,OAAO,kBAAmB,OAAM,IAAI,MAAM,2CAA2C;AAC5G,QAAI,OAAO,cAAc,SAAS,aAAa,iBAAiB,OAAO,MAAM,SAAS,WAAW;AAC/F,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,UAAM,YAAY,YAAY;AAAA,MAC5B,aAAa;AAAA,MAAc;AAAA,MAAU;AAAA,MAAS;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAY;AAAA,MAC1E;AAAA,IACF,CAAC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,GAAG,UAAU;AAAA,EAC7C,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG,EAAE;AAAA,EACpI,UAAE;AACA,QAAI,OAAQ,CAAAW,QAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7D;AACF;AAEO,SAAS,8BAA8B,SAAS;AACrD,QAAM,SAAS,wBAAwB,OAAO;AAC9C,MAAI,CAAC,OAAO,GAAI,QAAO;AACvB,MAAI;AACF,iBAAaT,SAAQ,QAAQ,WAAW,GAAG,OAAO,QAAQ,QAAQ,MAAM;AACxE,WAAO,EAAE,GAAG,QAAQ,SAAS,KAAK;AAAA,EACpC,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,QAAQ,OAAO,QAAQ,GAAG;AAAA,IAC1H;AAAA,EACF;AACF;;;AIzRA,SAAS,aAAAU,kBAAiB;;;ACE1B,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,aAAY,aAAAC,YAAW,eAAAC,cAAa,gBAAAC,eAAc,UAAAC,SAAQ,iBAAAC,sBAAqB;AACxF,OAAO,QAAQ;AACf,OAAO,UAAU;AAmLjB,SAAS,kBAAkB,MAAM,QAAQ,KAAK;AAC5C,SAAO,IAAI,cAAc,IAAI,UAAU;AACzC;AAQO,SAAS,qBAAqB,MAAM,QAAQ,KAAK;AACtD,SAAO,KAAK,KAAK,kBAAkB,GAAG,GAAG,YAAY,qBAAqB,QAAQ,gBAAgB;AACpG;AA8DO,SAAS,gBAAgB,KAAK,EAAE,WAAW,QAAQ,UAAU,OAAAC,SAAQC,YAAW,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG;AAC/G,MAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG,QAAO;AAC/C,MAAI,aAAa,SAAS;AAIxB,UAAM,WAAW,KAAK,KAAK,kBAAkB,GAAG,GAAG,YAAY,cAAc;AAC7E,UAAM,IAAID,OAAM,UAAU,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,aAAa,MAAM,OAAO,UAAU,SAAS,KAAO,CAAC;AACpH,WAAO,CAAC,EAAE,SAAS,EAAE,WAAW;AAAA,EAClC;AACA,MAAI;AACF,YAAQ,KAAK,CAAC,KAAK,SAAS;AAC5B,WAAO;AAAA,EACT,QAAQ;AACN,QAAI;AACF,cAAQ,KAAK,KAAK,SAAS;AAC3B,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ADnRO,IAAM,mBAAmB;AAEzB,IAAM,0BAA0B;AAEvC,IAAM,aAAa;AAAA,EACjB;AAAA,IACE,WAAW;AAAA;AAAA,IAEX,MAAM,CAAC,OAAO,uDAAuD,KAAK,EAAE,KAAK,sCAAsC,KAAK,EAAE;AAAA,EAChI;AAAA,EACA;AAAA,IACE,WAAW;AAAA;AAAA,IAEX,MAAM,CAAC,OAAO,sDAAsD,KAAK,EAAE,KAAK,YAAY,KAAK,EAAE,KAAK,YAAY,KAAK,EAAE;AAAA,EAC7H;AACF;AAGO,SAAS,oBAAoB,aAAa;AAC/C,MAAI,OAAO,gBAAgB,YAAY,CAAC,YAAa,QAAO;AAC5D,aAAW,EAAE,WAAW,KAAK,KAAK,YAAY;AAC5C,QAAI,KAAK,WAAW,EAAG,QAAO;AAAA,EAChC;AACA,SAAO;AACT;AAOO,SAAS,oBAAoB,EAAE,WAAW,UAAU,gBAAgB,oBAAI,IAAI,EAAE,GAAG;AACtF,QAAM,QAAQ,oBAAI,IAAI;AACtB,aAAW,QAAQ,WAAW;AAC5B,QAAI,OAAO,UAAU,MAAM,GAAG,KAAK,KAAK,MAAM,EAAG,OAAM,IAAI,KAAK,KAAK,IAAI;AAAA,EAC3E;AACA,QAAM,QAAQ,CAAC;AACf,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,QAAI,cAAc,IAAI,KAAK,GAAG,EAAG;AACjC,QAAI,EAAE,OAAO,SAAS,KAAK,UAAU,KAAK,KAAK,aAAa,UAAW;AACvE,UAAM,YAAY,oBAAoB,KAAK,WAAW;AACtD,QAAI,CAAC,UAAW;AAChB,UAAM,SAAS,OAAO,UAAU,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI;AACrF,UAAM,aAAa,CAAC,UAAW,OAAO,SAAS,OAAO,UAAU,KAAK,OAAO,aAAa,KAAK;AAC9F,QAAI,CAAC,WAAY;AACjB,UAAM,KAAK,EAAE,KAAK,KAAK,KAAK,YAAY,KAAK,YAAY,WAAW,aAAa,KAAK,YAAY,CAAC;AAAA,EACrG;AACA,QAAM,KAAK,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;AAChD,SAAO,EAAE,OAAO,MAAM,MAAM,GAAG,gBAAgB,EAAE;AACnD;AAGO,SAAS,oBAAoB,MAAM,OAAO;AAC/C,QAAM,QAAQ,qCAAqC,KAAK,QAAQ,EAAE;AAClE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,MAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG,QAAO;AAC/C,SAAO;AAAA,IACL;AAAA,IACA,MAAM,OAAO,MAAM,CAAC,CAAC;AAAA,IACrB,YAAY,QAAQ,OAAO,MAAM,CAAC,CAAC,IAAI;AAAA,IACvC,aAAa,MAAM,CAAC;AAAA,EACtB;AACF;AAUO,SAAS,sBAAsB,EAAE,WAAW,QAAQ,UAAU,OAAAE,SAAQC,YAAW,QAAQ,KAAK,IAAI,GAAG,MAAM,QAAQ,KAAK,OAAO,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzJ,QAAM,OAAO,CAAC;AACd,MAAI,aAAa,SAAS;AACxB,UAAM,KACJ;AACF,UAAMC,UAASF,OAAM,qBAAqB,GAAG,GAAG,CAAC,cAAc,mBAAmB,YAAY,EAAE,GAAG;AAAA,MACjG,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AACD,QAAIE,QAAO,SAASA,QAAO,WAAW,GAAG;AAMvC,YAAM,QAAQA,QAAO,QAAQA,QAAO,MAAM,UAAU,mBAAmBA,QAAO,MAAM;AACpF,WAAK,8CAA8C,KAAK,gCAAgC;AACxF,YAAM,IAAI,MAAM,+BAA+B,KAAK,kBAAkB;AAAA,IACxE;AACA,eAAW,QAAQ,OAAOA,QAAO,UAAU,EAAE,EAAE,MAAM,QAAQ,GAAG;AAC9D,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,cAAM,MAAM,OAAO,QAAQ,CAAC;AAC5B,YAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG;AACxC,aAAK,KAAK;AAAA,UACR;AAAA,UACA,MAAM,OAAO,OAAO,EAAE;AAAA,UACtB,YAAY,OAAO,OAAO,CAAC;AAAA,UAC3B,aAAa,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AAAA,QAC3D,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAASF,OAAM,MAAM,CAAC,OAAO,0BAA0B,GAAG,EAAE,UAAU,QAAQ,SAAS,KAAQ,WAAW,KAAK,OAAO,KAAK,CAAC;AAClI,MAAI,OAAO,SAAS,OAAO,WAAW,GAAG;AACvC,UAAM,QAAQ,OAAO,QAAQ,OAAO,MAAM,UAAU,WAAW,OAAO,MAAM;AAC5E,SAAK,8CAA8C,KAAK,gCAAgC;AACxF,UAAM,IAAI,MAAM,+BAA+B,KAAK,kBAAkB;AAAA,EACxE;AACA,aAAW,QAAQ,OAAO,OAAO,UAAU,EAAE,EAAE,MAAM,IAAI,GAAG;AAC1D,UAAM,MAAM,oBAAoB,MAAM,KAAK;AAC3C,QAAI,IAAK,MAAK,KAAK,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAQO,SAAS,qBAAqB;AAAA,EACnC,QAAQ,KAAK,IAAI;AAAA,EACjB,gBAAgB,CAAC,QAAQ,GAAG;AAAA,EAC5B,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI;AACF,UAAM,YAAY,cAAc,EAAE,MAAM,CAAC;AACzC,UAAM,EAAE,MAAM,IAAI,oBAAoB;AAAA,MACpC;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,eAAe,IAAI,IAAI,aAAa;AAAA,IACtC,CAAC;AACD,UAAM,SAAS,CAAC;AAChB,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,SAAS,KAAK,GAAG;AAC9B,UAAI,uBAAuB,OAAO,WAAW,gBAAgB,QAAQ,KAAK,GAAG,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,EAAE;AACnJ,UAAI,KAAM,QAAO,KAAK,EAAE,KAAK,KAAK,KAAK,WAAW,KAAK,UAAU,CAAC;AAAA,IACpE;AACA,UAAMG,UAAS,MAAM,SAAS,OAAO;AACrC,UAAM,SAAS,MAAM,WAAW,IAC5B,2DAA2D,UAAU,MAAM,cAC3E,UAAU,OAAO,MAAM,OAAO,MAAM,MAAM,kCAAkCA,UAAS,IAAI,KAAKA,OAAM,qBAAqB,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;AACzM,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,QAAQ,OAAO;AAAA,EAC/C,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,EAAE;AAAA,EACnJ;AACF;;;AElLA,IAAM,mBAAmB;AACzB,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,eAAsB,oCAAoC;AAAA,EACxD;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,SAAS;AACX,GAAG;AACD,MAAI,CAAC,oBAAoB,CAAC,wBAAyB,OAAM,IAAI,MAAM,4CAA4C;AAC/G,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI;AACF,YAAM,UAAU,MAAM,OAAO,gBAAgB,EAAE,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG,CAAC;AACtF,YAAM,SAAS,QAAQ,KAAK,CAAC,SAAS,MAAM,cAAcA,aACrD,KAAK,WAAW,aACf,mBACA,KAAK,aAAa,uBAAuB,mBACzC,QAAQ,KAAK,aAAa,kBAAkB,KACzC,KAAK,YAAY,uBAAuB,4BAC5C,KAAK,aAAa,mBAAmB,iBACrC,KAAK,aAAa,2BAA2B,mBAAmB,wBAChE,KAAK,aAAa,uBAAuB,mBAAmB,qBAC5D,mBAAmB,aAAa,MAAM,CAAC,UAAU,KAAK,aAAa,yBAAyB,SAAS,KAAK,CAAC,KAC3G,MAAM,QAAQ,KAAK,aAAa,gBAAgB,KAChD,KAAK,YAAY,iBAAiB,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,YAAY,iBACjF,MAAM,cAAc,QAAQ,MAAM,kBAAkB,IAAI,CAAC;AAChE,UAAI,OAAQ,QAAO;AAAA,IACrB,QAAQ;AAAA,IAAsB;AAC9B,UAAM,MAAM,MAAM;AAAA,EACpB;AACA,QAAM,IAAI,MAAM,qDAAqD;AACvE;AAOA,eAAsB,wBAAwB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAA;AAAA,EACA,UAAAC;AAAA,EACA,gBAAAC;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA,aAAAC;AAAA,EACA,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,MAAM,MAAM;AAAA,EAAC;AACf,GAAG;AACD,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,QAAM,oBAAoB,QAAQ,QAAQ,aAAaL;AACvD,QAAM,sBAAsB,QAAQ,QAAQ,eAAe;AAC3D,MAAI,QAAQ,QAAQ,oBAAoB,UAAU;AAChD,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ,QAAQ,QAAQ;AAAA,MAC1B,CAAC;AACD,mCAA6B,aAAa,OAAO;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnH,YAAMK,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,wBAAwB,EAAE,aAAa,UAAAJ,WAAU,SAASC,gBAAe,CAAC;AACxF,QAAI,CAAC,YAAY,GAAI,OAAM,IAAI,MAAM,YAAY,MAAM;AACvD,QAAI,CAAE,MAAMC,oBAAmB,KAAK,EAAI,OAAM,IAAI,MAAM,+CAA+C;AAAA,EACzG,SAAS,OAAO;AACd,QAAI,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AACpH,QAAI,aAAa;AACjB,QAAI;AACF,mBAAa,mBAAmB,aAAa,SAAS,MAAM;AAAA,IAC9D,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,uBAAuB,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IACxI;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAER,UAAE;AACA,YAAME,WAAU,KAAK;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AAEA,MAAI,4BAA4B;AAChC,MAAI;AACF,UAAM,SAAS,MAAMD,aAAY;AACjC,gCAA4B,QAAQ,oBAAoB;AACxD,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,kBAAkB,QAAQ;AAAA,MAC1B,eAAe,UAAU,YAAY,OAAO,OAAO;AAAA,MACnD;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,MAC5D,UAAU;AAAA,MACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,MACjE,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,2BAA2B,YAAY,OAAO,OAAO,IAAI,YAAY,OAAO,SAAS;AAAA,IAC/F,CAAC;AACD,uBAAmB,aAAa,YAAY,OAAO;AACnD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AAC3H,QAAI;AACJ,QAAI;AAAE,cAAQ,sBAAsB,aAAa,YAAY,SAAS,OAAO;AAAA,IAAG,SACzE,YAAY;AACjB,UAAI,2CAA2C,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC,EAAE;AACtH,YAAMC,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AACA,QAAI,MAAM,QAAQ,eAAe,kBAAkB;AACjD,UAAI,uCAAuC,MAAM,QAAQ,YAAY,IAAI,gBAAgB,GAAG;AAC5F,YAAMA,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,aAAa,aAAa,MAAM,QAAQ;AACzD,QAAI,SAAS,GAAG,OAAO,mDAAmD,MAAM,GAAG,GAAG;AACtF,QAAI,gBAAgB;AACpB,QAAI,aAAa;AACjB,QAAI;AACF,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,6BAA6B,SAAS,MAAM,IAAI,EAAE,OAAO,MAAM,CAAC;AAClG,mBAAa,mBAAmB,aAAa,OAAO,MAAM;AAC1D,YAAMA,WAAU,KAAK;AACrB,sBAAgB,oBAAoB,SAAS,MAAM,KAAK;AACxD,UAAI,CAAE,MAAMF,oBAAmB,aAAa,EAAI,OAAM,IAAI,MAAM,gDAAgD,EAAE,OAAO,MAAM,CAAC;AAChI,YAAM,SAAS,MAAMC,aAAY;AACjC,YAAM,mBAAmB;AAAA,QACvB;AAAA,QACA,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,kBAAkB,QAAQ;AAAA,QAC1B,yBAAyB,QAAQ,mBAAmB,SAAY;AAAA,QAChE,eAAe,UAAU,MAAM,SAAS,OAAO;AAAA,QAC/C;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,4BAA4B,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IAC7I;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,MAAM,QAAQ,WAAW;AAAA,QAC1D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAAqE;AAC7E,QAAI,cAAe,OAAMC,WAAU,aAAa;AAAA,QAC3C,OAAMA,WAAU,KAAK;AAC1B,WAAO;AAAA,EACT;AACF;;;ACxMA,SAAS,YAAY,sBAAsB;;;ACU3C,SAAS,OAAO,EAAE,SAAS,OAAO,aAAa,MAAM,WAAW,MAAM,cAAc,MAAM,OAAO,QAAQ,GAAG;AAC1G,SAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,UAAU,aAAa,OAAO,QAAQ;AAChF;AAEA,eAAe,aAAa,UAAU;AACpC,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAM,UAAU;AACrC,SAAO,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;AACzF;AAEA,eAAe,iBAAiB,WAAW,KAAK,MAAM,WAAW;AAC/D,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACF,WAAO,MAAM,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EACpE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAWA,eAAsB,qBAAqB;AAAA,EACzC;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,YAAY;AACd,GAAG;AACD,QAAM,OAAO,gBAAgB,QAAQ,SAAS,EAAE;AAChD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,MAAI;AACJ,MAAI;AACF,uBAAmB,MAAM;AAAA,MACvB;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS,gCAAgC,MAAM;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAM,aAAa,gBAAgB;AACpD,MAAI,CAAC,iBAAiB,IAAI;AACxB,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBAAgB,QACzB,SAAS,SAAS,cAClB,OAAO,SAAS,gBAAgB,YAChC,CAAC,SAAS,YAAY,KAAK,KAC3B,OAAO,SAAS,cAAc,YAC9B,CAAC,SAAS,UAAU,KAAK,GACzB;AACA,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,SAAS,YAAY,KAAK;AAC7C,QAAM,WAAW,SAAS,UAAU,KAAK;AACzC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM;AAAA,MACrB;AAAA,MACA,GAAG,IAAI;AAAA,MACP;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,sDAAsD,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,MAAM,aAAa,cAAc;AAChD,MAAI,CAAC,eAAe,MAAM,OAAO,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO;AAC3E,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,OAAO,QAAQ;AAChF,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA,SAAS,cAAc,QAAQ,6CAA6C,eAAe,MAAM,IAAI;AAAA,IACvG,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACF;AAEO,SAAS,oBAAoB,WAAW;AAC7C,SAAO,WAAW,OAAO,QACvB,WAAW,WAAW,QACtB,OAAO,UAAU,eAAe,YAChC,UAAU,WAAW,KAAK,IACxB,UAAU,WAAW,KAAK,IAC1B;AACN;;;AD7JO,SAAS,0BAA0B,MAAM,CAAC,GAAG,WAAW,gBAAgB;AAC7E,QAAM,WAAW,OAAO,IAAI,qBAAqB,EAAE,EAAE,KAAK;AAC1D,SAAO,YAAY,kBAAkB,SAAS,CAAC;AACjD;AAGO,SAAS,wBAAwB;AAAA,EACtC,UAAU,CAAC;AAAA,EACX;AAAA,EACA,qBAAqB;AAAA,EACrB,mBAAmB;AACrB,IAAI,CAAC,GAAG;AACN,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,sBAAsB;AAAA,EACxB;AACA,QAAM,aAAa,OAAO,uBAAuB,WAAW,mBAAmB,KAAK,IAAI;AACxF,QAAM,aAAa,OAAO,qBAAqB,WAAW,iBAAiB,KAAK,IAAI;AAEpF,MAAI,WAAY,UAAS,+BAA+B;AAAA,MACnD,QAAO,SAAS;AAErB,MAAI,WAAY,UAAS,8BAA8B;AACvD,SAAO;AACT;AAGA,eAAsB,sBAAsB;AAAA,EAC1C,UAAU,CAAC;AAAA,EACX,mBAAmB;AAAA,EACnB;AAAA,EACA,iBAAiB;AACnB,IAAI,CAAC,GAAG;AACN,QAAM,qBAAqB,QAAQ,8BAA8B,KAAK;AACtE,QAAM,QAAQ,sBAAsB,kBAAkB;AACtD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AAEvF,MAAI,aAAa,OAAO,QAAQ,+BAA+B,EAAE,EAC9D,MAAM,SAAS,EACf,OAAO,OAAO,EAAE,CAAC,KAAK;AACzB,MAAI,CAAC,oBAAoB;AACvB,UAAM,YAAY,MAAM,eAAe,EAAE,iBAAiB,OAAO,eAAe,KAAK,CAAC;AACtF,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,4BAA4B,UAAU,OAAO,EAAE;AAClF,iBAAa,oBAAoB,SAAS,KAAK;AAC/C,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2DAA2D;AAAA,EAC9F;AAEA,QAAM,WAAW,wBAAwB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,qBAAqB,OAAO;AAAA,EAChD,CAAC;AACD,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,GAAI,aAAa,EAAE,6BAA6B,WAAW,IAAI,CAAC;AAAA,EAClE;AACA,SAAO,EAAE,UAAU,WAAW,WAAW;AAC3C;;;AEhEA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,UAAS,QAAAC,aAAY;AAC9B,SAAS,iBAAAC,sBAAqB;AAEvB,SAAS,4BAA4B,UAAU,YAAY,KAAK;AACrE,QAAM,YAAYF,SAAQE,eAAc,OAAO,CAAC;AAChD,QAAM,UAAUD,MAAK,WAAW,iCAAiC;AACjE,QAAM,SAASA,MAAK,WAAW,MAAM,kCAAkC;AACvE,SAAOF,YAAW,MAAM,IAAI,SAAS;AACvC;AAGO,SAAS,6BAA6B;AAAA,EAC3C,OAAAI,SAAQL;AAAA,EACR,WAAW,QAAQ;AAAA,EACnB,aAAa,4BAA4B;AAAA,EACzC,aAAa,CAAC;AAAA,EACd,MAAM,QAAQ;AAChB,IAAI,CAAC,GAAG;AACN,QAAM,SAASK,OAAM,UAAU,CAAC,YAAY,GAAG,UAAU,GAAG;AAAA,IAC1D;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AACrD,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;;;AZlBA,IAAM,4BAA4B;AAClC,IAAM,UAAU;AAChB,IAAM,iBAAiB;AACvB,IAAM,0BAA0B,CAAC,4BAA4B,wBAAwB;AACrF,IAAMC,WAAU;AAChB,IAAM,WAAWC,eAAc,YAAY,GAAG;AAC9C,IAAM,aAAaC,MAAKC,SAAQ,QAAQ,GAAG,eAAe;AAC1D,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,IAAM,WAAW,0BAA0B,QAAQ,GAAG;AAEtD,SAAS,iBAAiB;AACxB,MAAI;AAAE,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EAAW,QAAQ;AAAE,WAAO;AAAA,EAAW;AACnH;AAEA,IAAM,gCAAgCJ,SAAQ,KAAK,OAAO,QAAQ,IAAI,oCAAoC,EAAE,CAAC,IACzG,QAAQ,IAAI,mCACZK,YAAW;AACf,IAAM,uBAAuB;AAAA,EAC3B,mBAAmB,QAAQ,GAAG;AAAA,EAAG;AACnC;AACA,IAAM,oBAAoB,eAAe;AACzC,IAAM,4BAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA,cAAc;AAChB;AAEA,SAAS,WAAW,UAAU;AAC5B,SAAO,MAAM,QAAQ,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C,KAAK;AAAA,IACL,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAO,UAAU;AAC3C,SAAO,MAAM,QAAQ,UAAU,CAAC,OAAO,QAAQ,GAAG;AAAA,IAChD,KAAK;AAAA,IACL,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAe,cAAc;AAC3B,MAAI;AACF,UAAM,OAAO,OAAO,QAAQ,IAAI,+BAA+B,IAAI;AACnE,UAAM,WAAW,MAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AACpG,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,MAAM,OAAO,OAAO,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBAAmB,OAAO;AACvC,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,MAAM,aAAa,KAAM,QAAO;AACpC,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,QAAQ,YAAY,QAAQ,OAAO,OAAO,GAAG,MAAM,OAAO,MAAM,GAAG,EAAG,QAAO;AACjF,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAO;AAC9B,MAAI,CAAC,SAAS,MAAM,aAAa,KAAM;AACvC,QAAM,KAAK,QAAQ,aAAa,UAAU,SAAY,SAAS;AAC/D,QAAM,QAAQ,KAAK;AAAA,IACjB,IAAI,QAAQ,CAACD,aAAY,MAAM,KAAK,QAAQA,QAAO,CAAC;AAAA,IACpD,MAAM,IAAM;AAAA,EACd,CAAC;AACD,MAAI,MAAM,aAAa,KAAM,OAAM,KAAK,SAAS;AACnD;AAEA,eAAe,OAAO;AAIpB,QAAM,SAAS,6BAA6B;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,wBAAwB;AAC5D,QAAM,EAAE,UAAU,WAAW,WAAW,IAAI,MAAM,sBAAsB;AAAA,IACtE,SAAS,QAAQ;AAAA,IACjB,kBAAkB;AAAA,IAClB;AAAA,EACF,CAAC;AACD,SAAO,OAAO,UAAU;AAAA,IACtB,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,mCAAmC,wBAAwB,KAAK,GAAG;AAAA,EACrE,CAAC;AACD,QAAM,SAAS,yBAAyB,EAAE,SAAS,iBAAiB,KAAK,UAAU,CAAC;AACpF,QAAM,cAAc,mBAAmB,QAAQ,GAAG;AAClD,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,WAAW;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,MAAM,aAAa,MAAO,SAAQ,YAAY;AAAA,EACzF;AACA,QAAM,cAAc,MAAM;AACxB,UAAM,OAAO,WAAW,QAAQ;AAChC,SAAK,GAAG,QAAQ,MAAM,WAAW,SAAS,GAAI,CAAC;AAC/C,WAAO;AAAA,EACT;AACA,UAAQ,YAAY;AAEpB,MAAI,CAAE,MAAM,wBAAwB;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,CAAC,UAAU,mBAAmB,OAAO,QAAQ;AAAA,IAClE,KAAK,CAAC,YAAY,QAAQ,MAAM,0BAA0B,OAAO,EAAE;AAAA,EACrE,CAAC,GAAI;AACH,eAAW;AACX;AAAA,EACF;AAEA,QAAM,WAAW,YAAY;AAC3B,QAAI,SAAU;AACd,eAAW;AACX,UAAM,UAAU,KAAK;AAAA,EACvB;AACA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAC9E,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAE/E,SAAO,CAAC,UAAU;AAChB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,kBAAkB;AAAA,QAC5C;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAG;AAAA,MACL,CAAC;AACD,UAAI,CAAC,QAAQ;AACX,cAAM,MAAM,OAAO;AACnB;AAAA,MACF;AACA,iBAAW;AACX,YAAM,aAAa,MAAM,YAAY;AACrC,UAAI,cAAc,OAAO,WAAW,eAAe,CAAC,IAAI,GAAG;AACzD,cAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,UAClD;AAAA,UACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,UACnC,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,QAAQ,oBAAoB,WAAW,WAAW;AAAA,QACpD,CAAC;AACD,mBAAW;AACX;AAAA,MACF;AACA,YAAM,UAAU,KAAK;AACrB,YAAM,gBAAgB,OAAO,SAAS,YAAY,OAAO,SAAS;AAClE,YAAM,SAAS,gBACX,8BAA8B;AAAA,QAC9B;AAAA,QACA,aAAa,qBAAqB,OAAO,uBAAuB;AAAA,QAChE,iBAAiB,OAAO;AAAA,QACxB,mBAAmB,OAAO;AAAA,QAC1B,QAAQ;AAAA,UACN,UAAU,OAAO;AAAA,UACjB;AAAA,UACA,YAAY,cAAc;AAAA,UAC1B;AAAA,QACF;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,OAAO,OAAO,SAAS;AAAA,MACzB,CAAC,IACC,OAAO,SAAS,kBACd,qBAAqB;AAAA,QACrB,eAAe,CAAC,QAAQ,GAAG;AAAA,QAC3B,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC,IACC,mBAAmB,OAAO,MAAM;AAAA,QAChC,KAAK;AAAA,QACL,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACL,UAAI,OAAO,MAAM,OAAO,SAAS;AAC/B,gBAAQ,KAAK,oCAAoC,OAAO,OAAO,OAAO,uCAAuC;AAC7G;AAAA,MACF;AACA,cAAQ,YAAY;AACpB,YAAM,MAAM,cAAc;AAC1B,UAAI,MAAM,aAAa,QAAQ,CAAE,MAAM,mBAAmB,KAAK,EAAI,QAAO,KAAK;AAC/E,YAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAG;AAAA,QACH,QAAQ,OAAO,KAAK,cAAc;AAAA,QAClC,QAAQ,OAAO,KACV,OAAO,SAAS,GAAG,OAAO,MAAM,YAAY,eAAe,CAAC,eAAe,MAAM,GAAG,GAAI,IAAI,UAAU,eAAe,CAAC,iBACvH,sBAAsB,OAAO,MAAM,GAAG,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,EAAE;AAAA,MACrF,CAAC;AACD,iBAAW;AAAA,IACb,SAAS,OAAO;AACd,cAAQ,MAAM,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAChG,iBAAW;AACX,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACvG,UAAQ,WAAW;AACrB,CAAC;",
+  "names": ["randomUUID", "fileURLToPath", "dirname", "join", "getFirebaseAuth", "path", "runnerId", "supervisorInstanceId", "supervisorVersion", "spawn", "createHash", "randomUUID", "existsSync", "lstatSync", "mkdirSync", "readFileSync", "readdirSync", "renameSync", "rmSync", "writeFileSync", "isAbsolute", "join", "relative", "resolve", "sep", "spawnSync", "createHash", "readFileSync", "resolve", "existsSync", "win32", "path", "resolve", "canonical", "createHash", "readFileSync", "createHash", "existsSync", "lstatSync", "readFileSync", "readdirSync", "dirname", "isAbsolute", "join", "relative", "resolve", "selfPath", "join", "PACKAGE_SPEC_RE", "INTEGRITY_RE", "join", "spawnSync", "createHash", "readFileSync", "lstatSync", "readdirSync", "resolve", "relative", "sep", "isAbsolute", "writeFileSync", "randomUUID", "existsSync", "mkdirSync", "renameSync", "rmSync", "spawnSync", "spawnSync", "existsSync", "mkdirSync", "readdirSync", "readFileSync", "rmSync", "writeFileSync", "spawn", "spawnSync", "spawn", "spawnSync", "result", "failed", "resolve", "runnerId", "selfPath", "packageVersion", "waitForLocalRunner", "localStatus", "stopChild", "spawnSync", "existsSync", "dirname", "join", "fileURLToPath", "spawn", "UUID_RE", "fileURLToPath", "join", "dirname", "resolve", "randomUUID"]
+}

package/dist/set-key-cli.js

@@ -10,12 +10,25 @@ var PROVIDER_ALIAS = {
   anthropic: "anthropic",
   codex: "openai",
   openai: "openai",
-  cursor: "cursor"
+  cursor: "cursor",
+  meta: "meta",
+  muse: "meta",
+  spark: "meta",
+  "muse-spark": "meta",
+  oai: "oai-compat",
+  "oai-compat": "oai-compat",
+  local: "local",
+  ollama: "local",
+  lmstudio: "local"
 };
 function resolveProvider(name) {
   const key = String(name || "").trim().toLowerCase();
   return PROVIDER_ALIAS[key] || null;
 }
+function resolveRetiredProvider(name) {
+  const key = String(name || "").trim().toLowerCase();
+  return key === "grok" || key === "xai" ? "xai" : null;
+}
 function accountFor(provider) {
   return `${provider}-api-key`;
 }
@@ -63,12 +76,25 @@ function clearAgentKey(provider, { EntryCtor = defaultEntryCtor() } = {}) {
 function hasAgentKey(provider, opts = {}) {
   return getAgentKey(provider, opts) !== null;
 }
+function clearRetiredAgentKey(provider, { EntryCtor = defaultEntryCtor() } = {}) {
+  if (!resolveRetiredProvider(provider) || !EntryCtor) return false;
+  try {
+    new EntryCtor(KEY_SERVICE, accountFor("xai")).deletePassword();
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/set-key-args.mjs
 var PROVIDERS = {
   anthropic: { label: "Anthropic", cli: "claude", selector: "claude", envVar: "ANTHROPIC_API_KEY", hint: "sk-" },
   openai: { label: "OpenAI / Codex", cli: "codex", selector: "codex", envVar: "OPENAI_API_KEY", hint: "sk-" },
-  cursor: { label: "Cursor", cli: "cursor-agent", selector: "cursor", envVar: "CURSOR_API_KEY", hint: "" }
+  cursor: { label: "Cursor", cli: "cursor-agent", selector: "cursor", envVar: "CURSOR_API_KEY", hint: "" },
+  // Optional — most local servers need no key; exists for locally secured
+  // Ollama / LM Studio endpoints only. Never leaves the machine (like all keys).
+  local: { label: "Local models (Ollama / LM Studio)", cli: "codex", selector: "local", envVar: "VO_CODE_RUNNER_LOCAL_API_KEY", hint: "" },
+  meta: { label: "Meta Model API / Muse Spark", cli: "codex", selector: "meta", envVar: "MODEL_API_KEY", hint: "" }
 };
 function parseSetKeyArgs(argv = []) {
   const rest = argv.slice(3);
@@ -85,6 +111,8 @@ function parseSetKeyArgs(argv = []) {
       providerArg = a.slice("--provider=".length);
     }
   }
+  const retiredProvider = resolveRetiredProvider(providerArg);
+  if (retiredProvider) return { provider: null, providerArg, mode, retiredProvider };
   return { provider: resolveProvider(providerArg), providerArg, mode };
 }
 
@@ -126,9 +154,21 @@ function readSecret(promptText) {
   });
 }
 async function main() {
-  const { provider, providerArg, mode } = parseSetKeyArgs(process.argv);
+  const { provider, providerArg, mode, retiredProvider } = parseSetKeyArgs(process.argv);
+  if (retiredProvider) {
+    if (mode === "clear") {
+      log(
+        clearRetiredAgentKey(providerArg) ? "\u2713 Removed the legacy xAI/Grok key from your OS keychain." : "No legacy xAI/Grok key to remove (or keychain unavailable)."
+      );
+      return;
+    }
+    log("Grok/xAI support is retired. This key will not be stored or used.");
+    log("To remove an old local key, run `vo-mcp set-key --provider grok --clear`.");
+    process.exitCode = 1;
+    return;
+  }
   if (!provider) {
-    log(`Unknown --provider "${providerArg}". Use one of: claude, codex, cursor.`);
+    log(`Unknown --provider "${providerArg}". Use one of: claude, codex, cursor, local, meta.`);
     process.exitCode = 1;
     return;
   }