@algosuite/vo-mcp 0.2.0-beta.64 → 0.2.0-beta.65

package/dist/runner-supervisor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/runner/control-plane-auth-stub.mjs", "../src/runner-supervisor.mjs", "../../../scripts/virtual-office/code-runner/installation-token.mjs", "../../../scripts/virtual-office/code-runner/control-plane-heartbeat-body.mjs", "../../../scripts/virtual-office/code-runner/control-plane-promote.mjs", "../../../scripts/virtual-office/code-runner/control-plane-task-list.mjs", "../../../scripts/virtual-office/code-runner/control-plane-resume.mjs", "../../../scripts/virtual-office/code-runner/control-plane-autonomous-admission.mjs", "../../../scripts/virtual-office/code-runner/control-plane-merge.mjs", "../../../scripts/virtual-office/code-runner/control-plane-weekly-tokens.mjs", "../../../scripts/virtual-office/code-runner/control-plane-telemetry-relay.mjs", "../../../scripts/virtual-office/code-runner/claim-gate-notice.mjs", "../../../scripts/virtual-office/code-runner/control-plane-knowledge-context.mjs", "../../../scripts/virtual-office/code-runner/control-plane-prepared-job.mjs", "../../../scripts/virtual-office/code-runner/control-plane-client.mjs", "../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs", "../src/runner/bundled-runtime-updater.mjs", "../../../scripts/virtual-office/runner-bootstrap/runtime-authorization.mjs", "../../../scripts/virtual-office/runner-bootstrap/runtime-staged-tree.mjs", "../src/runner/bundled-runtime-store.mjs", "../../../scripts/virtual-office/code-runner/legacy-orphan-sweep.mjs", "../../../scripts/virtual-office/code-runner/orphan-agent-reaper.mjs", "../src/runner/supervisor-activation.mjs", "../src/runner/supervisor-child-entry.mjs", "../src/runner/update-drain-gate.mjs", "../src/runner/supervisor-child-env.mjs", "../src/runner-readiness.mjs", "../src/runner/supervisor-credential-reader.mjs", "../src/runner/respawn-circuit.mjs", "../src/runner/supervisor-child-health.mjs"],
-  "sourcesContent": ["/**\n * Control-plane auth stub for the bundled `vo-mcp runner`.\n *\n * Replaces the daemon's lazy Firebase/SMOKE_* fallback\n * (`scripts/virtual-office/orchestrator-firestore/auth.mjs`), which pulls\n * `vo-config.mjs` (hardcoded Nexus Firebase project) + the firebase-admin chain.\n * A BYO runner ALWAYS authenticates with its own scoped `vo_credential` \u2014 read\n * from the OS keychain by `runner-cli.mjs` and injected as\n * `VO_CONTROL_PLANE_ADMIN_TOKEN` \u2014 so `control-plane-client.mjs`'s `resolveBearer`\n * returns early on the token and NEVER reaches this fallback. It exists only so\n * the bundle has nothing to resolve into the firebase chain; if it ever runs,\n * it fails LOUDLY with the fix.\n *\n * esbuild swaps this in for the heavy original at bundle time (see scripts/bundle.mjs).\n */\nexport async function getFirebaseAuth() {\n  throw new Error(\n    'vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner ' +\n      'authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN).',\n  );\n}\n", "/**\n * Persistent host supervisor for remote Mission Control maintenance.\n * The task daemon is a replaceable child; this process stays alive while it is\n * updated or repaired. Pairing credentials remain in the existing OS store.\n */\nimport { spawn } from 'node:child_process';\nimport { randomUUID } from 'node:crypto';\nimport { createRequire } from 'node:module';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, join } from 'node:path';\nimport { createControlPlaneClient } from '../../../scripts/virtual-office/code-runner/control-plane-client.mjs';\nimport { runHostMaintenance } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { stageAndActivateBundledUpdate } from './runner/bundled-runtime-updater.mjs';\nimport { runLegacyOrphanSweep } from '../../../scripts/virtual-office/code-runner/legacy-orphan-sweep.mjs';\nimport { activationSupervisorInstanceId, runtimeRootFromEnv } from './runner/bundled-runtime-store.mjs';\nimport { finishPendingActivation } from './runner/supervisor-activation.mjs';\nimport { resolveSupervisorChildEntry } from './runner/supervisor-child-entry.mjs';\nimport { awaitRunnerUpdateDrain } from './runner/update-drain-gate.mjs';\nimport { prepareSupervisorAuth, resolveSupervisorRunnerId } from './runner/supervisor-child-env.mjs';\nimport {\n  RUNNER_GITHUB_READINESS_TIMEOUT_MS,\n  RUNNER_IDENTITY_READINESS_TIMEOUT_MS,\n  RUNNER_READINESS_DEFERRAL_ACK_TYPE,\n  parseRunnerReadinessDeferralRequest,\n} from './runner-readiness.mjs';\nimport { readStoredCredentialIsolated } from './runner/supervisor-credential-reader.mjs';\nimport { createRespawnCircuit } from './runner/respawn-circuit.mjs';\nimport {\n  attachSupervisorChildTerminationCustody,\n  beginSupervisorHealthyStateCommit,\n  createSupervisorDegradationState,\n  createSupervisorControlRecoveryFence,\n  createSupervisorReadinessDeferralTracker,\n  createSupervisorStartupDeferral,\n  resolveSupervisorChildStartAuthority,\n  shouldRespawnSupervisorChild,\n  shouldRecoverSupervisorChildAfterAction,\n  supervisorChildHasExited,\n  supervisorChildIsRunning,\n  verifySupervisorChildHealth,\n} from './runner/supervisor-child-health.mjs';\n\nconst DEFAULT_CONTROL_PLANE_URL = 'https://vo-control-plane-bzjphrajaq-uc.a.run.app';\nconst POLL_MS = 5000;\nconst CHILD_START_MS = 1500;\n// The child performs identity auth plus the bounded GitHub preflight before\n// opening its local status port. Cover both transport deadlines plus startup\n// margin without changing the independent child-stop deadlines.\nconst CHILD_READINESS_TIMEOUT_MS = RUNNER_IDENTITY_READINESS_TIMEOUT_MS\n  + RUNNER_GITHUB_READINESS_TIMEOUT_MS\n  + 10_000;\nconst SUPERVISOR_CAPABILITIES = ['bundled-runtime-slots-v1', 'legacy-orphan-purge-v1'];\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst selfPath = fileURLToPath(import.meta.url);\nconst bundledChildEntry = join(dirname(selfPath), 'runner-cli.js');\nconst supervisorRuntimeRoot = runtimeRootFromEnv(process.env);\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst runnerId = resolveSupervisorRunnerId(process.env);\n\nfunction packageVersion() {\n  try { return createRequire(import.meta.url)('../package.json').version || 'unknown'; } catch { return 'unknown'; }\n}\n\nconst requestedSupervisorInstanceId = UUID_RE.test(String(process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID || ''))\n  ? process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID\n  : randomUUID();\nconst supervisorInstanceId = activationSupervisorInstanceId(\n  runtimeRootFromEnv(process.env), requestedSupervisorInstanceId,\n);\nconst supervisorVersion = packageVersion();\nconst supervisorControlIdentity = {\n  supervisorInstanceId,\n  supervisorVersion,\n  capabilities: SUPERVISOR_CAPABILITIES,\n};\n\nlet lastResolvedChildDescriptor = null;\n\n/**\n * Resolved on EVERY spawn, never cached at module scope: a slot activated after\n * this process started must take effect on the next child restart, not on the\n * next whole-app restart (nothing forces one).\n */\nfunction spawnChild(childEnv) {\n  const resolved = resolveSupervisorChildEntry({\n    runtimeRoot: supervisorRuntimeRoot,\n    bundledEntry: bundledChildEntry,\n    bundledVersion: supervisorVersion,\n  });\n  if (resolved.descriptor !== lastResolvedChildDescriptor) {\n    console.error(`[vo-runner supervisor] child entry -> ${resolved.descriptor} (${resolved.detail})`);\n    lastResolvedChildDescriptor = resolved.descriptor;\n  }\n  return spawn(process.execPath, resolved.args, {\n    env: childEnv,\n    stdio: ['inherit', 'inherit', 'inherit', 'ipc'],\n    windowsHide: true,\n  });\n}\n\nfunction spawnPreviousChild(entry, childEnv) {\n  const previous = spawn(process.execPath, [entry, 'runner'], {\n    env: childEnv,\n    stdio: ['inherit', 'inherit', 'inherit', 'ipc'],\n    windowsHide: true,\n  });\n  attachSupervisorChildTerminationCustody(\n    previous,\n    () => {},\n    (error) => {\n      console.error(\n        `[vo-runner supervisor] rollback child process error: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    },\n  );\n  return previous;\n}\n\nasync function localStatus() {\n  try {\n    const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);\n    const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });\n    if (!response.ok) return null;\n    const body = await response.json();\n    return body?.ok === true ? body : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function waitForLocalRunner(child) {\n  const deadline = Date.now() + CHILD_READINESS_TIMEOUT_MS;\n  while (Date.now() < deadline) {\n    if (supervisorChildHasExited(child)) return false;\n    const status = await localStatus();\n    if (status?.running === true && Number(status.pid) === Number(child.pid)) return true;\n    await sleep(500);\n  }\n  return false;\n}\n\nasync function waitForChildExit(child, timeoutMs) {\n  if (!child || supervisorChildHasExited(child)) return true;\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (exited) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      child.off('exit', onExit);\n      resolve(exited);\n    };\n    const onExit = () => finish(true);\n    const timer = setTimeout(() => finish(false), timeoutMs);\n    child.once('exit', onExit);\n    if (supervisorChildHasExited(child)) finish(true);\n  });\n}\n\nasync function stopChild(child) {\n  if (!child || supervisorChildHasExited(child)) return;\n  child.kill(process.platform === 'win32' ? undefined : 'SIGTERM');\n  if (await waitForChildExit(child, 15_000)) return;\n  if (supervisorChildIsRunning(child)) child.kill('SIGKILL');\n  // Keep the deliberate-stop fence through the forced-kill exit. Returning\n  // immediately after kill() lets a later exit look like a crash and consume\n  // breaker budget during legitimate maintenance.\n  await waitForChildExit(child, 5_000);\n}\n\nasync function main() {\n  // Read keychain-backed credentials in a process that exits before npm ever\n  // attempts to replace this package. Windows otherwise keeps the keyring DLL\n  // locked for the full supervisor lifetime and global self-updates fail.\n  const stored = readStoredCredentialIsolated();\n  const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;\n  const pairedSupervisor = !String(process.env.VO_CONTROL_PLANE_ADMIN_TOKEN || '').trim();\n  const supervisorAuthInput = {\n    baseEnv: process.env,\n    storedCredential: stored,\n    controlPlaneUrl,\n  };\n  const {\n    childEnv,\n    clientEnv,\n    operatorId,\n    startupRetryAfterMs,\n  } = await prepareSupervisorAuth(supervisorAuthInput);\n  Object.assign(childEnv, {\n    VO_RUNNER_SUPERVISOR_INSTANCE_ID: supervisorInstanceId,\n    VO_RUNNER_SUPERVISOR_VERSION: supervisorVersion,\n    VO_RUNNER_SUPERVISOR_CAPABILITIES: SUPERVISOR_CAPABILITIES.join(','),\n  });\n  const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });\n  const runtimeRoot = runtimeRootFromEnv(process.env);\n  let child = null;\n  let stopping = false;\n  let handling = false;\n  const expectedChildStops = new WeakSet();\n  const healthNeutralizedChildren = new WeakSet();\n  // Activation failed but the process stays alive to accept remote repair.\n  // Distinct from `stopping`: we refuse to SERVE work, we do not refuse to be FIXED.\n  const degradationState = createSupervisorDegradationState();\n  const markSupervisorDegraded = () => {\n    degradationState.markDegraded();\n    process.exitCode = 1;\n  };\n  const respawnCircuit = createRespawnCircuit();\n  const controlRecoveryFence = createSupervisorControlRecoveryFence();\n  const startupDeferral = createSupervisorStartupDeferral({\n    retryAfterMs: startupRetryAfterMs,\n  });\n  let startupNeedsReadinessRefresh = startupRetryAfterMs !== null;\n  let deferredControlRecoveryGeneration = null;\n\n  const stopChildExpectedly = async (target) => {\n    if (!target) return;\n    expectedChildStops.add(target);\n    healthNeutralizedChildren.add(target);\n    try {\n      await stopChild(target);\n    } finally {\n      // If a pathological process still has not emitted exit after SIGKILL,\n      // retain its exact-child tag. WeakSet ownership disappears with the\n      // process object and cannot mask a different child's real crash.\n      if (supervisorChildHasExited(target)) expectedChildStops.delete(target);\n    }\n  };\n\n  const readinessDeferrals = createSupervisorReadinessDeferralTracker({\n    currentChild: () => child,\n    releaseCurrentChild: (target) => {\n      if (child === target) child = null;\n    },\n    onCaptured: ({ retryAfterMs, recoveryGeneration }) => {\n      startupNeedsReadinessRefresh = true;\n      if (Number.isInteger(recoveryGeneration)\n        && degradationState.snapshot().generation === recoveryGeneration) {\n        deferredControlRecoveryGeneration = recoveryGeneration;\n      }\n      startupDeferral.reopen(retryAfterMs);\n      console.warn(\n        `[vo-runner supervisor] child deferred by GitHub readiness for ${retryAfterMs}ms; `\n        + 'preserving control polling without consuming rapid-exit breaker budget',\n      );\n    },\n  });\n  const isChildReadinessDeferred = (target) => readinessDeferrals.isDeferred(target);\n  const captureChildReadinessDeferral = (target) => readinessDeferrals.capture(target);\n\n  const respawn = () => {\n    if (!startupDeferral.hasStarted()) return;\n    if (!shouldRespawnSupervisorChild({\n      stopping,\n      degraded: degradationState.isDegraded(),\n      handling,\n      child,\n    })) return;\n    try {\n      child = launchChild();\n      void verifyChildHealth(child, false, 'automatic relaunch');\n    } catch (error) {\n      markSupervisorDegraded();\n      console.error(\n        `[vo-runner supervisor] child relaunch failed; entering degraded mode: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  };\n  const launchChild = () => {\n    const next = spawnChild(childEnv);\n    const startedAt = Date.now();\n    next.on('message', (message) => {\n      const request = parseRunnerReadinessDeferralRequest(message);\n      if (!request || !readinessDeferrals.recordPending(next, request)) return;\n      // The request is exact-child state before the ACK is attempted. Only a\n      // matching ACK received by the child authorizes its reserved exit 75.\n      try {\n        next.send({\n          type: RUNNER_READINESS_DEFERRAL_ACK_TYPE,\n          nonce: request.nonce,\n        }, (error) => {\n          if (error) console.warn(`[vo-runner supervisor] readiness deferral ACK failed: ${error.message}`);\n        });\n      } catch (error) {\n        console.warn(\n          `[vo-runner supervisor] readiness deferral ACK failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    });\n    attachSupervisorChildTerminationCustody(\n      next,\n      () => {\n        // A supervisor-requested stop is not a crash and must not consume the\n        // breaker. Every otherwise-unexpected termination can form a loop,\n        // including an asynchronous spawn error, external signal, or a faulty\n        // child reporting a misleading zero code.\n        if (stopping || expectedChildStops.delete(next)) {\n          readinessDeferrals.forget(next);\n          return;\n        }\n        if (captureChildReadinessDeferral(next)) return;\n        readinessDeferrals.forget(next);\n        const decision = respawnCircuit.recordExit(startedAt, Date.now());\n        if (decision.tripped) {\n          markSupervisorDegraded();\n          console.error(\n            `[vo-runner supervisor] child exited rapidly ${decision.rapidExits} times; `\n            + 'entering degraded mode to stop startup/token churn while remote repair remains available',\n          );\n          return;\n        }\n        setTimeout(respawn, decision.delayMs);\n      },\n      (error) => {\n        console.error(\n          `[vo-runner supervisor] child process error: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      },\n    );\n    return next;\n  };\n\n  const verifyChildHealth = async (target, degradeOnExit, context) => {\n    const commitSupervisorHealthyState = beginSupervisorHealthyStateCommit({\n      degradationState,\n      target,\n      currentChild: () => child,\n      allowRecovery: degradeOnExit,\n      clearStaleExitCode: () => {\n        process.exitCode = undefined;\n      },\n    });\n    const commitSupervisorDegradedState = degradationState.beginDegradationProof({\n      target,\n      currentChild: () => child,\n      onDegraded: (message) => {\n        markSupervisorDegraded();\n        console.error(`[vo-runner supervisor] ${message}`);\n      },\n    });\n    return verifySupervisorChildHealth({\n      target,\n      degradeOnExit,\n      context,\n      waitBeforeProbe: () => sleep(CHILD_START_MS),\n      waitForLocalRunner,\n      stopExpectedly: stopChildExpectedly,\n      isReadinessDeferredExit: isChildReadinessDeferred,\n      isExpectedStop: (candidate) => healthNeutralizedChildren.has(candidate),\n      markHealthy: commitSupervisorHealthyState,\n      markDegraded: commitSupervisorDegradedState,\n    });\n  };\n\n  const deferChildAdmission = (retryAfterMs) => {\n    startupNeedsReadinessRefresh = true;\n    if (startupDeferral.hasStarted()) startupDeferral.reopen(retryAfterMs);\n    else startupDeferral.defer(retryAfterMs);\n    console.warn(\n      `[vo-runner supervisor] GitHub readiness embargoed child startup for ${retryAfterMs}ms; `\n      + 'control polling remains active',\n    );\n  };\n\n  const refreshSupervisorChildAdmission = async () => {\n    if (!pairedSupervisor) return true;\n    const refreshed = await prepareSupervisorAuth({\n      ...supervisorAuthInput,\n      baseEnv: childEnv,\n    });\n    if (refreshed.operatorId !== operatorId) {\n      throw new Error('runner readiness operator identity changed during supervisor admission');\n    }\n    if (refreshed.startupRetryAfterMs !== null) {\n      deferChildAdmission(refreshed.startupRetryAfterMs);\n      return false;\n    }\n    if (refreshed.repositoryScope.length > 0) {\n      const repositoryScope = refreshed.repositoryScope.join(',');\n      childEnv.VO_CODE_RUNNER_REPOS = repositoryScope;\n      clientEnv.VO_CODE_RUNNER_REPOS = repositoryScope;\n    }\n    startupNeedsReadinessRefresh = false;\n    return true;\n  };\n\n  const ensureHealthyChildAfterControl = async () => {\n    if (!child || supervisorChildHasExited(child)) {\n      const recoveryGeneration = degradationState.snapshot().generation;\n      if (!startupDeferral.hasStarted() && startupDeferral.isPending()) {\n        deferredControlRecoveryGeneration = recoveryGeneration;\n        return false;\n      }\n      try {\n        if (!(await refreshSupervisorChildAdmission())) {\n          deferredControlRecoveryGeneration = recoveryGeneration;\n          return false;\n        }\n        if (!startupDeferral.hasStarted() && !startupDeferral.consumeIfReady()) return false;\n        child = launchChild();\n        readinessDeferrals.recordRecoveryGeneration(child, recoveryGeneration);\n      } catch (error) {\n        markSupervisorDegraded();\n        console.error(\n          `[vo-runner supervisor] control recovery relaunch failed; entering degraded mode: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n        return false;\n      }\n    }\n    return verifyChildHealth(child, true, 'control recovery relaunch');\n  };\n\n  const startInitialChild = async (recoveryGeneration = null) => {\n    const activationChild = launchChild();\n    child = activationChild;\n    if (Number.isInteger(recoveryGeneration)) {\n      readinessDeferrals.recordRecoveryGeneration(activationChild, recoveryGeneration);\n    }\n    void verifyChildHealth(\n      activationChild,\n      Number.isInteger(recoveryGeneration),\n      Number.isInteger(recoveryGeneration) ? 'deferred control recovery' : 'initial child',\n    );\n\n    if (!(await finishPendingActivation({\n      client,\n      child: activationChild,\n      runtimeRoot,\n      operatorId,\n      runnerId,\n      selfPath,\n      packageVersion: supervisorVersion,\n      supervisorIdentity: supervisorControlIdentity,\n      waitForLocalRunner,\n      isReadinessDeferred: isChildReadinessDeferred,\n      localStatus,\n      stopChild: stopChildExpectedly,\n      launchPreviousChild: (entry) => spawnPreviousChild(entry, childEnv),\n      log: (message) => console.error(`[vo-runner supervisor] ${message}`),\n    }))) {\n      // A child-reported GitHub embargo is not an activation verdict. Its exact\n      // exit handler re-opened admission, so leave the pending slot durable and\n      // retry attestation only after that deadline.\n      if (captureChildReadinessDeferral(activationChild)) {\n        console.warn('[vo-runner supervisor] activation attestation deferred with GitHub readiness; pending slot remains durable');\n        return false;\n      }\n      // DO NOT EXIT HERE. The control-action poll loop below is the ONLY remote\n      // repair channel this host has \u2014 the daemon never opens an inbound port by\n      // design. Degrade instead: refuse to SERVE work, but stay available to BE FIXED.\n      markSupervisorDegraded();\n      await stopChildExpectedly(activationChild);\n      if (child === activationChild) child = null;\n      console.error('[vo-runner supervisor] activation FAILED \u2014 entering degraded mode: not serving tasks, still polling for remote control actions');\n      return false;\n    }\n    return true;\n  };\n\n  const attemptInitialChildStart = async () => {\n    if (startupDeferral.hasStarted() || startupDeferral.isPending()) return false;\n    const beforeRefresh = resolveSupervisorChildStartAuthority({\n      degradationState,\n      deferredRecoveryGeneration: deferredControlRecoveryGeneration,\n    });\n    if (!beforeRefresh.allowed) return false;\n    if (startupNeedsReadinessRefresh) {\n      try {\n        if (!(await refreshSupervisorChildAdmission())) return false;\n      } catch (error) {\n        markSupervisorDegraded();\n        deferredControlRecoveryGeneration = null;\n        startupDeferral.consumeIfReady();\n        console.error(\n          `[vo-runner supervisor] deferred readiness refresh failed; entering degraded mode: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n        return false;\n      }\n    }\n    const afterRefresh = resolveSupervisorChildStartAuthority({\n      degradationState,\n      deferredRecoveryGeneration: deferredControlRecoveryGeneration,\n    });\n    if (!afterRefresh.allowed) return false;\n    if (!startupDeferral.consumeIfReady()) return false;\n    deferredControlRecoveryGeneration = null;\n    return startInitialChild(afterRefresh.recoveryGeneration);\n  };\n\n  await attemptInitialChildStart();\n\n  const shutdown = async () => {\n    if (stopping) return;\n    stopping = true;\n    await stopChild(child);\n  };\n  process.on('SIGINT', () => { void shutdown().finally(() => process.exit(0)); });\n  process.on('SIGTERM', () => { void shutdown().finally(() => process.exit(0)); });\n\n  while (!stopping) {\n    try {\n      await attemptInitialChildStart();\n      const action = await client.pollRunnerControl({\n        runnerId,\n        ...(operatorId ? { operatorId } : {}),\n        ...supervisorControlIdentity,\n      });\n      if (!action) {\n        await sleep(POLL_MS);\n        continue;\n      }\n      // Any newer control action supersedes delayed recovery authority from an\n      // earlier action. A fresh exact-action fence may establish a new one.\n      deferredControlRecoveryGeneration = null;\n      handling = true;\n      const controlIdentity = { runnerId, ...(operatorId ? { operatorId } : {}), ...supervisorControlIdentity };\n      // D9 (incident 2026-08-30): an update restart must DRAIN in-flight tasks\n      // first, and at the cap must name itself on every task it kills.\n      const bundledAction = action.kind === 'update' || action.kind === 'reinstall';\n      const drain = await awaitRunnerUpdateDrain({\n        readStatus: localStatus, drainable: bundledAction, env: process.env,\n        isChildRunning: () => supervisorChildIsRunning(child),\n        failInFlightTask: (taskId, patch) => client.postProgress(taskId, { status: 'failed', message: patch.message, result: patch.result, ...(patch.runnerId ? { runner_id: patch.runnerId } : {}), ...(patch.runnerInstanceId ? { runner_instance_id: patch.runnerInstanceId } : {}) }),\n        log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n      });\n      if (!drain.proceed) {\n        await client.completeRunnerControl(action.actionId, { ...controlIdentity, status: 'failed', detail: drain.detail });\n        handling = false;\n        respawn();\n        continue;\n      }\n      controlRecoveryFence.markBeforeStop(child);\n      await stopChildExpectedly(child);\n      const result = bundledAction\n        ? stageAndActivateBundledUpdate({\n          runtimeRoot,\n          packageSpec: `@algosuite/vo-mcp@${action.desired_package_version}`,\n          expectedVersion: action.desired_package_version,\n          expectedIntegrity: action.desired_package_integrity,\n          action: {\n            actionId: action.actionId,\n            runnerId,\n            operatorId: operatorId || '',\n            supervisorInstanceId,\n          },\n          env: process.env,\n          force: action.kind === 'reinstall',\n        })\n        : action.kind === 'purge-orphans'\n          ? runLegacyOrphanSweep({\n            protectedPids: [process.pid],\n            log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n          })\n          : runHostMaintenance(action.kind, {\n            env: clientEnv,\n            log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n          });\n      if (result.ok && result.handoff) {\n        if (drain.capped) console.warn(`[vo-runner supervisor] ${drain.detail}`);\n        console.warn(`[vo-runner supervisor] activated ${result.active.version}; exiting for new-process attestation`);\n        return;\n      }\n      // The normal action path consumes any exact-child fence before awaiting,\n      // so reporting errors cannot trigger it again. A childless pre-existing\n      // degradation requires a successful repair/reconnect action; cleanup or\n      // failed maintenance cannot silently re-enable service.\n      const recoveryAuthorized = shouldRecoverSupervisorChildAfterAction({\n        stoppedChild: controlRecoveryFence.consume(),\n        actionKind: action.kind,\n        actionSucceeded: result.ok,\n      });\n      const relaunchedHealthy = recoveryAuthorized\n        ? await ensureHealthyChildAfterControl()\n        : false;\n      if (!relaunchedHealthy) result.ok = false;\n      await client.completeRunnerControl(action.actionId, {\n        ...controlIdentity,\n        status: result.ok ? 'succeeded' : 'failed',\n        detail: result.ok\n          ? (result.detail ? `${result.detail}; runner ${packageVersion()} reconnected`.slice(0, 1000) : `runner ${packageVersion()} reconnected`)\n          : `maintenance exited ${result.status}${result.detail ? `: ${result.detail}` : ''}${\n            relaunchedHealthy ? '' : '; runner relaunch did not become healthy'\n          }`,\n      });\n      handling = false;\n      respawn();\n    } catch (error) {\n      console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);\n      // Recover only when this exact control iteration fenced a live child\n      // before stopping it. Poll/defer/reporting failures have no such token\n      // and must not clear a pre-existing activation or breaker degradation.\n      await controlRecoveryFence.recoverOnce(() => ensureHealthyChildAfterControl());\n      handling = false;\n      await sleep(POLL_MS);\n    }\n  }\n}\n\nmain().catch((error) => {\n  console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);\n  process.exitCode = 1;\n});\n", "/**\n * GitHub App installation-token minting for the runner (M3).\n *\n * Split out of control-plane-client.mjs, which sits at its 400-line cap.\n *\n * The control plane keys the mint on the authenticated operator\n * (ctx.operator_id), so a token covers only that operator's installation.\n *\n * Two distinct grants come out of here:\n *  - the DEFAULT full grant, used by the daemon to push and run `gh pr create`.\n *    It only works if the App grants BOTH `Contents: write` and\n *    `Pull requests: write` \u2014 see docs/vo/github-app-setup-2026-06-18.md.\n *  - a READ-ONLY grant (`readOnly: true`), used for the token handed to an\n *    agent process so it can read a PRIVATE repo without being able to publish.\n */\n\n/** Ceiling for the OPTIONAL read-token mint, so a hung plane can't stall a task. */\nconst READ_TOKEN_TIMEOUT_MS = 15_000;\n\n/**\n * @param {object} opts\n * @param {(method: string, path: string, body?: unknown) => Promise<Response>} opts.req\n * @param {boolean} [opts.required] fail closed instead of returning null on a miss\n * @param {boolean} [opts.readOnly] ask for a narrowed, non-publishing grant\n * @param {string|null} [opts.repo] narrow the grant to this one `owner/name`\n * @returns {Promise<{ token: string, expiresAt: string | null } | null>}\n */\nexport async function fetchInstallationToken({ req, required = false, readOnly = false, repo = null }) {\n  const fail = (reason) => {\n    if (required) throw new Error(`installation-token required: ${reason}`);\n    return null;\n  };\n  try {\n    // The read-only grant gets a longer explicit ceiling. The client also\n    // supplies its default task-request ceiling for the publish mint; required\n    // mode propagates that timeout and therefore cannot silently fall back.\n    const res = await req(\n      'POST',\n      '/api/v1/github/installation-token',\n      readOnly ? { scope: 'read', ...(repo ? { repo } : {}) } : {},\n      readOnly ? { timeoutMs: READ_TOKEN_TIMEOUT_MS } : {},\n    );\n    if (!res.ok) return fail(`HTTP ${res.status}`);\n    const json = await res.json();\n    if (!json || !json.token) return fail('missing token');\n    // Fail CLOSED when a read-only grant can't be confirmed. The runner and the\n    // control plane deploy independently, so a new runner can reach an older\n    // revision that ignores `scope` and hands back a FULL write token. Injecting\n    // that into an agent process is the exact failure this token exists to\n    // prevent, so drop it: no token is the safe, pre-change state.\n    if (readOnly && json.scope !== 'read') return fail('control plane did not confirm a read-only grant');\n    // ci_readable (plane 2026-08-16): false while the App installation has not\n    // accepted checks:read/statuses:read \u2014 the watcher logs it so the gap is visible.\n    return { token: json.token, expiresAt: json.expires_at || null, ...(typeof json.ci_readable === 'boolean' ? { ciReadable: json.ci_readable } : {}) };\n  } catch (err) {\n    if (required) throw err;\n    return null;\n  }\n}\n", "/**\n * control-plane-heartbeat-body \u2014 the runner heartbeat's request body, built pure.\n *\n * Split out of `control-plane-client.mjs` on 2026-09-04 (PR #10336 steward pass)\n * when that module crossed its 400-line VO orchestration cap. The construction\n * is the part worth isolating anyway: it is pure, it is the exact surface the\n * plane's strict schema validates, and every field here is OMITTED rather than\n * sent null \u2014 a null on this route is a 400, and the 2026-07-25 outage was hours\n * of diagnosis because a rejected field looked identical to a powered-off host.\n *\n * Adding a field is therefore a three-place change, all in the same PR: this\n * builder, the plane's `runner-heartbeat-v1` schema, and the status type the\n * dashboard reads. The lockstep test pins that.\n */\n\n/**\n * @param {object} input heartbeat inputs as the daemon's loop tick collects them.\n * @returns {object} the wire body, with absent/empty fields omitted.\n */\nexport function buildRunnerHeartbeatBody({\n  runnerId,\n  runnerInstanceId,\n  operatorId,\n  uptimeSec,\n  activeTasks,\n  maxConcurrency,\n  effectiveConcurrency,\n  measuredTaskSlots,\n  measuredCpuSlots,\n  measuredMemorySlots,\n  version,\n  daemonVersion,\n  nodeVersion,\n  defaultAgent,\n  supervisorInstanceId,\n  supervisorVersion,\n  supervisorCapabilities,\n  servedRepos,\n  servedOperators,\n  availableAgents,\n  accountUsage,\n  availableLocalModels,\n  prepared_job_shadow: preparedJobShadow,\n} = {}) {\n  // ADR-004 \u00A7 11.1b-2 counts-only tally rides along when the shadow pass produced one.\n  const body = { runner_id: runnerId, ...(preparedJobShadow ? { prepared_job_shadow: preparedJobShadow } : {}) };\n  if (runnerInstanceId) body.runner_instance_id = runnerInstanceId;\n  if (operatorId) body.operator_id = operatorId;\n  if (typeof uptimeSec === 'number') body.uptime_sec = uptimeSec;\n  if (typeof activeTasks === 'number') body.active_tasks = activeTasks;\n  if (typeof maxConcurrency === 'number') body.max_concurrency = maxConcurrency;\n  if (typeof effectiveConcurrency === 'number') body.effective_concurrency = effectiveConcurrency;\n  if (typeof measuredTaskSlots === 'number') body.measured_task_slots = measuredTaskSlots;\n  if (typeof measuredCpuSlots === 'number') body.measured_cpu_slots = measuredCpuSlots;\n  if (typeof measuredMemorySlots === 'number') body.measured_memory_slots = measuredMemorySlots;\n  if (version) body.version = version;\n  if (daemonVersion) body.daemon_version = daemonVersion;\n  // The Node runtime this daemon RUNS on, so a runtime-level abort is\n  // attributable to a build. Public version string only, no host detail.\n  if (nodeVersion) body.node_version = nodeVersion;\n  if (defaultAgent) body.default_agent = defaultAgent;\n  if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n  if (supervisorVersion) body.supervisor_version = supervisorVersion;\n  if (Array.isArray(supervisorCapabilities) && supervisorCapabilities.length > 0) {\n    body.supervisor_capabilities = supervisorCapabilities;\n  }\n  if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;\n  if (Array.isArray(servedOperators) && servedOperators.length > 0) {\n    body.served_operator_ids = servedOperators;\n  }\n  if (Array.isArray(availableAgents) && availableAgents.length > 0) {\n    body.available_agents = availableAgents;\n  }\n  if (Array.isArray(accountUsage) && accountUsage.length > 0) {\n    body.account_usage = accountUsage;\n  }\n  if (Array.isArray(availableLocalModels) && availableLocalModels.length > 0) {\n    body.available_local_models = availableLocalModels;\n  }\n  return body;\n}\n", "/**\n * F35 (2026-08-17): ask the plane to mark a PARTIAL draft READY once its lineage cannot continue\n * and CI is green (`POST /api/v1/admin/pr/promote-draft`, admin-only \u2014 the plane-side sweep is\n * the caller). The plane re-checks every precondition server-side and never merges; the ordinary\n * receipt-gated merge decides afterwards. Errors carry the plane's status + code like resume.\n */\nexport async function promoteDraftPrRequest(req, prNumber, automationContext, onUnauthorized = () => {}) {\n  const res = await req('POST', '/api/v1/admin/pr/promote-draft', { prNumber, automationContext }, { timeoutMs: 60_000 });\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('promote-draft unauthorized (401)');\n  }\n  const json = await res.json().catch(() => ({}));\n  if (res.ok && json?.ok === true) {\n    return {\n      status: json.promoted === true ? (json.auto_merge_disarmed === true ? 'promoted (auto-merge disarmed)' : 'promoted') : json.already_ready === true ? 'already_ready' : 'unchanged',\n      headSha: typeof json.head_sha === 'string' ? json.head_sha : null,\n      reason: typeof json.blocked_reason === 'string' ? json.blocked_reason : null,\n    };\n  }\n  const code = typeof json?.error === 'string' ? json.error : null;\n  const err = new Error(`promote-draft failed: HTTP ${res.status}${code ? ` (${code})` : ''}${json?.reason ? ` \u2014 ${json.reason}` : ''}`);\n  err.status = res.status;\n  err.code = code;\n  throw err;\n}\n", "const PAGE_SIZE = 500;\n\n/** Paginate the runner-only raw adoption view; it deliberately skips PR reconciliation. */\nexport async function listAllPrOpenedTasks(request) {\n  const tasks = [];\n  let beforeCreatedAt = '';\n  let beforeId = '';\n  for (;;) {\n    const params = new URLSearchParams({\n      status: 'pr_opened', limit: String(PAGE_SIZE), runner_adoption: '1',\n    });\n    if (beforeCreatedAt) {\n      params.set('before_created_at', beforeCreatedAt);\n      params.set('before_id', beforeId);\n    }\n    const res = await request('GET', `/api/v1/code-task?${params}`);\n    if (!res.ok) throw new Error(`listPrOpenedTasks failed: HTTP ${res.status}`);\n    const json = await res.json();\n    const page = Array.isArray(json?.tasks) ? json.tasks : [];\n    tasks.push(...page);\n    if (page.length < PAGE_SIZE) return tasks;\n    const last = page.at(-1);\n    if (!last?.created_at || !last?.code_task_id) {\n      throw new Error('listPrOpenedTasks pagination cursor missing');\n    }\n    beforeCreatedAt = last.created_at;\n    beforeId = last.code_task_id;\n  }\n}\n", "export async function resumeCodeTaskRequest(\n  req,\n  taskId,\n  { automaticRateLimit = false, automaticContinuation = false } = {},\n  onUnauthorized = () => {},\n) {\n  const res = await req(\n    'POST',\n    `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`,\n    automaticRateLimit\n      ? { automatic_rate_limit: true }\n      : automaticContinuation ? { automatic_continuation: true } : {},\n  );\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('resume unauthorized (401)');\n  }\n  if (!res.ok) {\n    // Carry the plane's refusal code so the watcher can tell a TERMINAL refusal\n    // (budget too small / ceiling reached / exhausted \u2014 no retry will ever\n    // succeed) from a transient coordination failure it should back off on.\n    let code = null;\n    try {\n      const body = await res.json();\n      code = typeof body?.error === 'string' ? body.error : null;\n    } catch { /* non-JSON body: keep code null */ }\n    const err = new Error(`resume failed: HTTP ${res.status}${code ? ` (${code})` : ''}`);\n    err.status = res.status;\n    err.code = code;\n    throw err;\n  }\n  const json = await res.json();\n  const task = json && json.task ? json.task : null;\n  // A 200 with an EXISTING active child (`deduplicated: true`) is not a new continuation; the flag\n  // rides along non-enumerably so persisted/logged task shapes stay byte-identical.\n  if (task && typeof json.deduplicated === 'boolean') Object.defineProperty(task, 'deduplicated', { value: json.deduplicated, enumerable: false });\n  return task;\n}\n", "export function makeAutonomousDispatchAdmissionClient(req, timeoutMs, onUnauthorized = () => {}) {\n  return {\n    async reserveAutonomousDispatchBudget({ requestedBudgetUsd, reservationId, occurrenceKey }) {\n      const res = await req('POST', '/api/v1/autonomous-dispatch/admission', {\n        requested_budget_usd: requestedBudgetUsd,\n        reservation_id: reservationId,\n        dispatch_occurrence_key: occurrenceKey,\n      }, { timeoutMs });\n      if (res.status === 401) {\n        onUnauthorized();\n        throw new Error('autonomous dispatch admission unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`autonomous dispatch admission failed: HTTP ${res.status}`);\n      const body = await res.json();\n      return {\n        allowed: body?.allowed === true,\n        reason: typeof body?.reason === 'string' ? body.reason : '',\n      };\n    },\n\n    async releaseAutonomousDispatchBudget(reservationId) {\n      const res = await req('POST', '/api/v1/autonomous-dispatch/reservation/release', {\n        reservation_id: reservationId,\n      }, { timeoutMs });\n      if (res.status === 401) {\n        onUnauthorized();\n        throw new Error('autonomous dispatch release unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`autonomous dispatch release failed: HTTP ${res.status}`);\n      return true;\n    },\n  };\n}\n", "export async function mergeVerifiedPrRequest(req, prNumber, automationContext, onUnauthorized) {\n  const res = await req(\n    'POST', '/api/v1/admin/pr/merge', { prNumber, automationContext }, { timeoutMs: 120_000 },\n  );\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('gated merge unauthorized (401)');\n  }\n  const json = await res.json().catch(() => ({}));\n  if (res.ok && json?.ok === true) {\n    const result = json?.result && typeof json.result === 'object' ? json.result : {};\n    const status = result.merged === true || result.status === 'merged'\n      ? 'merged'\n      : result.status === 'auto-merge-enabled' || String(result.action || '').includes('auto-merge')\n        ? 'queued'\n        : 'accepted';\n    return {\n      status,\n      detail: typeof result.detail === 'string' ? result.detail : null,\n      actionReceiptId: typeof json.action_receipt_id === 'string' ? json.action_receipt_id : null,\n    };\n  }\n  const captureStoreRetry = json?.action_status === 'not_attempted'\n    && (json?.error === 'capture_preflight_unavailable'\n      || json?.error === 'decision_outcome_intent_failed');\n  if (res.status === 503\n    && (json?.error === 'verify_unavailable' || json?.error === 'merge_unavailable'\n      || captureStoreRetry)) {\n    return { status: 'retry', reason: json.reason || json.message || json.error || 'verification unavailable' };\n  }\n  return {\n    status: 'blocked',\n    reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,\n    actionReceiptId: typeof json?.action_receipt_id === 'string' ? json.action_receipt_id : null,\n  };\n}\n", "/**\n * control-plane-weekly-tokens \u2014 `POST /api/v1/weekly-tokens` request helper,\n * extracted from control-plane-client.mjs (at its 400-line cap) so the client\n * could grow a sibling telemetry-relay method. Behaviour is unchanged.\n *\n * Report this machine's rolling-7-day Claude Code token usage (the real\n * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when\n * available). The daemon authenticates as admin, so the target `operatorId`\n * is named explicitly. Best-effort; throws on a non-2xx so the caller can\n * log + move on.\n *\n * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.\n * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).\n */\nexport async function postWeeklyTokensRequest(\n  taskReq,\n  { operatorId, runnerId, tokens, claudeWeeklyPct, claudeWeeklyResetsAt },\n  onUnauthorized = () => {},\n) {\n  const body = {\n    operator_id: operatorId,\n    runner_id: runnerId,\n    input_tokens: tokens.input_tokens,\n    output_tokens: tokens.output_tokens,\n    cache_creation_tokens: tokens.cache_creation_tokens,\n    cache_read_tokens: tokens.cache_read_tokens,\n  };\n  if (typeof claudeWeeklyPct === 'number') {\n    body.claude_weekly_pct = claudeWeeklyPct;\n  }\n  if (claudeWeeklyResetsAt !== undefined) {\n    body.claude_weekly_resets_at = claudeWeeklyResetsAt;\n  }\n  const res = await taskReq('POST', '/api/v1/weekly-tokens', body);\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('weekly-tokens unauthorized (401)');\n  }\n  if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);\n  return true;\n}\n", "/**\n * control-plane-telemetry-relay \u2014 `POST /api/v1/telemetry/relay` request\n * helper for the runner's telemetry forwarder (telemetry-forwarder.mjs).\n *\n * The daemon never holds the vo-telemetry ingest token: it hands a batch of\n * local vo-mcp events to the control plane, which relays each one to\n * vo-telemetry and returns per-event results (a PREFIX of the batch \u2014 the\n * relay halts on the first upstream fault so the forwarder's byte cursor can\n * never advance past an event the store did not accept).\n *\n * Returns `{ status, body }` and never throws on HTTP status \u2014 the forwarder\n * owns the backoff/disable policy. Network errors DO throw (fetch rejects).\n * A 30 s timeout covers up to MAX_EVENTS_PER_RELAY sequential upstream POSTs.\n */\nexport const TELEMETRY_RELAY_TIMEOUT_MS = 30_000;\n\nexport async function relayTelemetryEventsRequest(req, { events, source }, onUnauthorized = () => {}) {\n  const res = await req('POST', '/api/v1/telemetry/relay', { events, ...(source ? { source } : {}) }, {\n    timeoutMs: TELEMETRY_RELAY_TIMEOUT_MS,\n  });\n  if (res.status === 401) onUnauthorized();\n  let body = null;\n  try { body = await res.json(); } catch { body = null; }\n  return { status: res.status, body };\n}\n", "// Runner-side display of the control plane's claim-admission gate (2026-08-15).\n//\n// The claim route answers a DENIED runner with the benign queue-empty shape\n// (`task: null`) plus a `claim_gate` reason \u2014 by design, so pre-gate daemons keep\n// polling instead of crashing. Before this module the daemon dropped that field\n// on the floor and a below-target runner simply looked idle forever (\"no\n// pending task\" every 5s) with nothing on the host saying WHY. Now the reason is\n// logged once per distinct verdict (not every poll) and kept for /status.\n//\n// Pure apart from the injected `log`; the daemon's claim loop stays untouched.\n\nconst REASON_HELP = {\n  daemon_version_below_floor: 'this daemon is older than the approved release target \u2014 it idles until the governed updater brings it current (operator override: VO_RUNNER_CLAIM_MIN_DAEMON_VERSION / VO_RUNNER_CLAIM_VERSION_GATE=off on the control plane)',\n  daemon_version_unreported: 'this daemon reports no parseable version in its heartbeat \u2014 too old for the updater to manage, so it may not claim work',\n  no_fresh_heartbeat: 'the control plane has no fresh heartbeat from this runner \u2014 claims resume once heartbeats land',\n  runner_denylisted: 'this runner id is on the operator quarantine list (VO_RUNNER_CLAIM_DENYLIST)',\n};\n\nexport function describeClaimGate(gate) {\n  if (!gate || gate.allowed !== false) return null;\n  const reason = String(gate.reason || 'denied');\n  const floor = gate.floor_version ? ` (floor ${gate.floor_version})` : '';\n  return `claim gate: DENIED \u2014 ${reason}${floor}: ${(Object.hasOwn(REASON_HELP, reason) ? REASON_HELP[reason] : null) ?? 'the control plane refused this runner\\'s claims'}`;\n}\n\n/**\n * Track the latest verdict and log only on change (denied\u2192allowed logs the recovery too).\n * @returns {{ current: () => (object|null), observe: (json: unknown) => void }}\n */\nexport function makeClaimGateNotice({ log = () => {} } = {}) {\n  let last = null; // last DENIED verdict signature, or null when allowed\n  let current = null;\n  return {\n    current: () => current,\n    observe(json) {\n      const gate = json && typeof json === 'object' ? json.claim_gate : null;\n      const denied = gate && gate.allowed === false ? gate : null;\n      current = denied ? { ...denied, observed_at: new Date().toISOString() } : null;\n      const signature = denied ? `${denied.reason}|${denied.floor_version ?? ''}` : null;\n      if (signature === last) return;\n      if (denied) log(describeClaimGate(denied));\n      else if (last !== null) log('claim gate: allowed again \u2014 this runner may claim work');\n      last = signature;\n    },\n  };\n}\n", "/**\n * getTaskKnowledgeContext resilience.\n *\n * Incident 2026-08-29: tasks 8ca414ed (05:11:57Z) and eb5fd089 (05:28Z) both\n * failed at preparing_worktree because the knowledge-context fetch timed out\n * at the shared 5000ms task-request cap while the server itself measured\n * 3.4s/4.9s/6.99s over the same window (an embeddings leg was added\n * 2026-08-27). A single 5s-capped attempt was a coin flip. The fail-closed\n * refusal in task-prompt.mjs is deliberate and stays \u2014 this module only\n * widens the single attempt into a per-endpoint timeout floor plus a bounded\n * retry, so a slow-but-healthy server response is no longer indistinguishable\n * from a hung one. Every other control-plane endpoint is untouched and keeps\n * its original single-attempt policy.\n */\n\nexport const MIN_KNOWLEDGE_CONTEXT_TIMEOUT_MS = 15_000;\nconst RETRY_DELAYS_MS = [2_000, 6_000];\nconst MAX_ATTEMPTS = RETRY_DELAYS_MS.length + 1;\n\nfunction isRetryableStatus(status) {\n  return status >= 500 && status <= 599;\n}\n\nfunction defaultSleep(ms) {\n  return new Promise((resolve) => { setTimeout(resolve, ms); });\n}\n\n/**\n * `req` is the control-plane client's low-level request function:\n * `(method, path, body, { timeoutMs }) => Promise<Response-like>`. It throws\n * on timeout or transport failure and resolves (never rejects) for any HTTP\n * status, including 4xx/5xx \u2014 matching `control-plane-client.mjs`'s `req()`.\n */\nexport async function getTaskKnowledgeContextRequest(req, taskId, { query } = {}, {\n  taskRequestTimeoutMs,\n  invalidateToken = () => {},\n  sleep = defaultSleep,\n  log = () => {},\n} = {}) {\n  const body = {};\n  if (typeof query === 'string' && query.trim()) body.query = query;\n  const path = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;\n  const timeoutMs = Math.max(Number(taskRequestTimeoutMs) || 0, MIN_KNOWLEDGE_CONTEXT_TIMEOUT_MS);\n\n  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {\n    let res;\n    let cause;\n    try {\n      res = await req('POST', path, body, { timeoutMs });\n    } catch (err) {\n      cause = err;\n    }\n    if (!cause) {\n      if (res.status === 401) {\n        invalidateToken();\n        throw new Error('knowledge-context unauthorized (401)');\n      }\n      if (res.status === 404) return null;\n      if (res.ok) return res.json();\n      if (!isRetryableStatus(res.status)) {\n        throw new Error(`knowledge-context failed: HTTP ${res.status}`);\n      }\n      cause = new Error(`knowledge-context failed: HTTP ${res.status}`);\n    }\n    if (attempt === MAX_ATTEMPTS) throw cause;\n    const delayMs = RETRY_DELAYS_MS[attempt - 1];\n    log(`knowledge-context attempt ${attempt}/${MAX_ATTEMPTS} failed (${cause.message}); retrying in ${delayMs}ms`);\n    await sleep(delayMs);\n  }\n  /* c8 ignore next */\n  throw new Error('knowledge-context retry loop exited unexpectedly');\n}\n", "/**\n * control-plane-prepared-job \u2014 ADR-004 \u00A7 11.1 slice B, the fetch half.\n *\n * Reads the plane's PREPARED JOB for one code task from\n * `GET /api/v1/code-task/:id/prepared-job` (shipped DARK in slice A, PR #10218)\n * so the runner can compare it against its OWN local composition.\n *\n * SHADOW-ONLY: nothing here may change what the runner spawns. This module\n * therefore NEVER throws. Every fault \u2014 transport, timeout, 401, the 409\n * `router_mode_unsupported` refusal, a 5xx, a non-JSON body \u2014 comes back as a\n * structured refusal the caller records as a shadow observation. A dispatch is\n * never failed by a shadow read.\n */\n\n/**\n * Runner-local env knobs the plane must be TOLD about; it does not share the\n * runner's process.\n *\n * This list MUST stay byte-identical to `ENV_QUERY_KEYS` in\n * `cloud-run/vo-control-plane/src/routes/code-task-prepared-job.ts`. A key\n * present on one side only makes the plane compose a DIFFERENT job for a\n * reason that has nothing to do with drift \u2014 which is exactly the signal this\n * slice exists to measure, so the two lists are pinned equal by\n * prepared-job-shadow.test.mjs rather than left to review.\n */\nexport const PREPARED_JOB_ENV_QUERY_KEYS = [\n  'VO_CODE_RUNNER_NO_WEB',\n  'VO_CODE_RUNNER_NO_WORKFLOW',\n  'VO_CODE_RUNNER_NO_CONSENSUS',\n  'VO_CODE_RUNNER_PERMISSION_MODE',\n  'VO_CODE_RUNNER_DEFAULT_BUDGET_USD',\n  'VO_CODE_RUNNER_META_REASONING_EFFORT',\n  'VO_CODE_RUNNER_ALLOW_MISSING_KNOWLEDGE_CONTEXT',\n  'VO_ENABLE_CONTEXT7',\n];\n\n/** The plane accepts a query env value only when 0 < length <= 64 (same route). */\nexport const PREPARED_JOB_ENV_VALUE_MAX = 64;\n\n/**\n * Build the query string for one prepared-job read.\n *\n * Returns `{ query, sent, dropped }`. `dropped` names any allow-listed key the\n * runner HAS set but the plane will refuse for length \u2014 a real divergence\n * cause that must be visible in the record rather than inferred from a\n * mismatching prompt.\n */\nexport function preparedJobQuery({ agent = 'claude', env = {} } = {}) {\n  const params = new URLSearchParams();\n  params.set('agent', String(agent));\n  const sent = [];\n  const dropped = [];\n  for (const key of PREPARED_JOB_ENV_QUERY_KEYS) {\n    const raw = env?.[key];\n    if (typeof raw !== 'string' || raw.length === 0) continue;\n    if (raw.length > PREPARED_JOB_ENV_VALUE_MAX) { dropped.push(key); continue; }\n    params.set(key, raw);\n    sent.push(key);\n  }\n  return { query: params.toString(), sent, dropped };\n}\n\n/** Read the plane's error code out of a non-2xx body without ever throwing. */\nasync function refusalCode(res) {\n  try {\n    const body = await res.json();\n    return typeof body?.error === 'string' && body.error ? body.error : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Fetch the prepared job. Resolves to\n *   { ok: true,  job, composition, envSent, envDropped }\n *   { ok: false, reason, status, envSent, envDropped }\n * and never rejects.\n *\n * @param {Function} req              the control-plane client's raw request fn\n * @param {string}   taskId\n * @param {object}   [options]        { agent, env, timeoutMs }\n * @param {Function} [invalidateToken] called on 401 so the next real call re-auths\n */\nexport async function getPreparedJobRequest(req, taskId, options = {}, invalidateToken = () => {}) {\n  const { agent = 'claude', env = {}, timeoutMs = 15_000 } = options;\n  const { query, sent, dropped } = preparedJobQuery({ agent, env });\n  const envMeta = { envSent: sent, envDropped: dropped };\n  if (typeof taskId !== 'string' || taskId.length === 0) {\n    return { ok: false, reason: 'missing_task_id', status: 0, ...envMeta };\n  }\n  const path = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;\n  let res;\n  try {\n    res = await req('GET', path, undefined, { timeoutMs });\n  } catch (err) {\n    return { ok: false, reason: `transport: ${err?.message || String(err)}`, status: 0, ...envMeta };\n  }\n  if (res?.status === 401) {\n    try { invalidateToken(); } catch { /* shadow-only */ }\n    return { ok: false, reason: 'unauthorized', status: 401, ...envMeta };\n  }\n  if (!res?.ok) {\n    const code = await refusalCode(res);\n    return { ok: false, reason: code || `http_${res?.status ?? 'unknown'}`, status: res?.status ?? 0, ...envMeta };\n  }\n  let body;\n  try {\n    body = await res.json();\n  } catch (err) {\n    return { ok: false, reason: `unreadable_body: ${err?.message || String(err)}`, status: res.status, ...envMeta };\n  }\n  const job = body?.prepared_job;\n  if (!job || typeof job !== 'object') {\n    return { ok: false, reason: 'no_prepared_job_in_body', status: res.status, ...envMeta };\n  }\n  return {\n    ok: true,\n    job,\n    composition: body?.composition && typeof body.composition === 'object' ? body.composition : {},\n    ...envMeta,\n  };\n}\n", "/**\n * control-plane-client \u2014 the runner's OUTBOUND link to vo-control-plane.\n *\n * Increment 6 (Code-from-Anywhere). The daemon never exposes a port; it reaches\n * OUT to the control-plane (no inbound hole, no Tailscale \u2014 design \u00A72). Auth:\n * prefer the static admin token (`VO_CONTROL_PLANE_ADMIN_TOKEN`, the V1 local\n * dogfood path); fall back to a per-user Firebase ID token via the shared\n * orchestrator auth (`SMOKE_*` creds \u2192 allow-listed operator \u2192 admin).\n *\n * Covers task claim/progress/context/private attachments/resume and governed merge.\n */\n\nimport { fetchInstallationToken } from './installation-token.mjs';\nimport { buildRunnerHeartbeatBody } from './control-plane-heartbeat-body.mjs';\nimport { promoteDraftPrRequest } from './control-plane-promote.mjs';\nimport { listAllPrOpenedTasks } from './control-plane-task-list.mjs';\nimport { resumeCodeTaskRequest } from './control-plane-resume.mjs';\nimport { makeAutonomousDispatchAdmissionClient } from './control-plane-autonomous-admission.mjs';\nimport { mergeVerifiedPrRequest } from './control-plane-merge.mjs';\nimport { postWeeklyTokensRequest } from './control-plane-weekly-tokens.mjs';\nimport { relayTelemetryEventsRequest } from './control-plane-telemetry-relay.mjs';\nimport { makeClaimGateNotice } from './claim-gate-notice.mjs';\nimport { getTaskKnowledgeContextRequest } from './control-plane-knowledge-context.mjs'; import { getPreparedJobRequest } from './control-plane-prepared-job.mjs';\n\nlet cachedFirebaseToken = null;\nexport class ClaimAuthorityChangedError extends Error {\n  constructor() {\n    super('code-task claim authority changed');\n    this.name = 'ClaimAuthorityChangedError'; this.code = 'code_task_claim_authority_changed';\n  }\n}\n\nasync function resolveBearer(env) {\n  const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;\n  if (adminToken) return adminToken;\n  if (cachedFirebaseToken) return cachedFirebaseToken;\n  // Lazy import \u2014 Firebase auth is only needed when no admin token is present.\n  const { getFirebaseAuth } = await import('../orchestrator-firestore/auth.mjs');\n  const auth = await getFirebaseAuth({ env });\n  if (!auth || !auth.idToken) {\n    throw new Error(\n      'no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY',\n    );\n  }\n  cachedFirebaseToken = auth.idToken;\n  return cachedFirebaseToken;\n}\n\n/**\n * Build a client. `baseUrl` defaults to `env.VO_CONTROL_PLANE_URL`. `fetchImpl`,\n * `env`, and `sleep` (the retry backoff delay function) are injectable for\n * tests and packaged runner handoff.\n */\nexport function createControlPlaneClient({\n  baseUrl,\n  env = process.env,\n  fetchImpl = fetch,\n  heartbeatTimeoutMs = Math.min(\n    Math.max(Number(env.VO_CODE_RUNNER_HEARTBEAT_TIMEOUT_MS) || 15_000, 1_000),\n    60_000,\n  ),\n  taskRequestTimeoutMs = Math.min(\n    Math.max(Number(env.VO_CODE_RUNNER_TASK_REQUEST_TIMEOUT_MS) || 5_000, 100),\n    60_000,\n  ),\n  runnerId,\n  runnerInstanceId,\n  sleep,\n} = {}) {\n  const resolvedBaseUrl = baseUrl ?? env.VO_CONTROL_PLANE_URL ?? '';\n  if (!resolvedBaseUrl) throw new Error('VO_CONTROL_PLANE_URL is required for the code-runner daemon');\n  const root = resolvedBaseUrl.replace(/\\/+$/, '');\n\n  async function req(method, path, body, { timeoutMs } = {}) {\n    const bearer = await resolveBearer(env);\n    const controller = timeoutMs ? new AbortController() : null;\n    let timeoutId;\n    const request = Promise.resolve(fetchImpl(`${root}${path}`, {\n      method,\n      headers: {\n        'content-type': 'application/json',\n        authorization: `Bearer ${bearer}`,\n      },\n      body: body === undefined ? undefined : JSON.stringify(body),\n      ...(controller ? { signal: controller.signal } : {}),\n    }));\n    if (!timeoutMs) return request;\n    const timeout = new Promise((_, reject) => {\n      timeoutId = setTimeout(() => {\n        controller.abort();\n        reject(new Error(`control-plane ${path} timed out after ${timeoutMs}ms`));\n      }, timeoutMs);\n    });\n    try {\n      return await Promise.race([request, timeout]);\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n  const taskReq = (method, path, body, options = {}) => req(method, path, body, { timeoutMs: taskRequestTimeoutMs, ...options }); const claimGate = makeClaimGateNotice({ log: (m) => console.warn(`[code-runner ${new Date().toISOString()}] ${m}`) }); // deny-site visibility\n  return { getClaimGate: () => claimGate.current(), // last DENIED claim-gate verdict (null when allowed) \u2014 for /status + tests\n    ...makeAutonomousDispatchAdmissionClient(\n      req, taskRequestTimeoutMs, () => { cachedFirebaseToken = null; },\n    ),\n    /**\n     * Claim the next pending task. Returns the task or null (empty queue).\n     * `repos` (optional `owner/name` list) and `operatorIds` (optional\n     * `operator_id` list) scope the claim so this daemon only picks up tasks it\n     * serves \u2014 the control-plane filters by both (logical AND), so another\n     * operator's task never lands on (or bills) this machine.\n     */\n    async claim(runnerId, repos, operatorIds, session = {}) {\n      const body = { runner_id: runnerId };\n      if (Array.isArray(repos) && repos.length > 0) body.repos = repos;\n      if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;\n      if (session.runnerInstanceId) { body.runner_instance_id = session.runnerInstanceId; body.runner_progress_protocol_version = 2; }\n      if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;\n      if (session.defaultAgent) body.default_agent = session.defaultAgent;\n      if (Array.isArray(session.availableAgents)) {\n        body.available_agents = session.availableAgents\n          .filter((entry) => entry?.installed === true && entry?.authenticated === true)\n          .map((entry) => entry.agent);\n      }\n      const res = await taskReq('POST', '/api/v1/code-task/claim', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null; // force re-auth next call\n        throw new Error('claim unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);\n      const json = await res.json(); claimGate.observe(json); // 2026-08-15: a DENIED verdict is logged once + kept for /status instead of reading as an idle queue\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).\n     * Server derives operator/tenant from the daemon's authenticated principal.\n     * Returns the created task, or throws on a non-2xx response.\n     */\n    async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns, dispatch_mode, tier, agent, model, dispatch_occurrence_key, autonomous_reservation_id, on_behalf_of_operator_id, repair_pr_number, repair_kind, repair_head_sha, repair_chain }) {\n      const body = { repo, prompt };\n      if (typeof max_budget_usd === 'number') body.max_budget_usd = max_budget_usd;\n      if (typeof max_turns === 'number') body.max_turns = max_turns;\n      for (const [key, value] of Object.entries({ dispatch_mode, tier, agent, model, repair_kind, repair_head_sha })) {\n        if (value) body[key] = value;\n      }\n      if (dispatch_occurrence_key) body.dispatch_occurrence_key = dispatch_occurrence_key;\n      if (autonomous_reservation_id) body.autonomous_reservation_id = autonomous_reservation_id; if (on_behalf_of_operator_id) body.on_behalf_of_operator_id = on_behalf_of_operator_id;\n      if (Number.isInteger(repair_pr_number) && repair_pr_number > 0) body.repair_pr_number = repair_pr_number;\n      if (repair_chain) body.repair_chain = repair_chain;\n      const res = await taskReq('POST', '/api/v1/code-task', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('enqueue unauthorized (401)');\n      }\n      if (!res.ok) {\n        // Carry the plane's refusal code (repair_not_needed / dispatch_occurrence_exists /\n        // repair_state_unavailable / autonomous_reservation_invalid \u2026) so callers can tell a\n        // policy answer from a real fault \u2014 same contract as control-plane-resume.mjs.\n        let code = null;\n        try { const errBody = await res.json(); code = typeof errBody?.error === 'string' ? errBody.error : null; } catch { /* non-JSON body */ }\n        const err = new Error(`enqueue failed: HTTP ${res.status}${code ? ` (${code})` : ''}`);\n        err.status = res.status; err.code = code;\n        throw err;\n      }\n      const json = await res.json();\n      const task = json && json.task ? json.task : null;\n      // `deduplicated` (plane returned an EXISTING task for this occurrence/repair) rides along\n      // non-enumerably so logs/persistence of the task stay byte-identical.\n      if (task && typeof json.deduplicated === 'boolean') Object.defineProperty(task, 'deduplicated', { value: json.deduplicated, enumerable: false });\n      return task;\n    },\n\n    /**\n     * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses\n     * this after the runner opens a partial draft PR and CI is no longer pending.\n     */\n    async resumeCodeTask(taskId, { automaticRateLimit = false, automaticContinuation = false } = {}) {\n      return resumeCodeTaskRequest(taskReq, taskId, { automaticRateLimit, automaticContinuation }, () => {\n        cachedFirebaseToken = null;\n      });\n    },\n\n    /**\n     * Send a CI-green PR through the production verify-before-act merge route.\n     * The server inspects the current diff, applies deterministic blockers, runs\n     * consensus, records a receipt, and direct-merges only the inspected SHA.\n     */\n    /** F35: promote a PARTIAL draft to READY via the plane (admin-only; server re-checks; never merges). */\n    promoteDraftPr: (prNumber, automationContext) => promoteDraftPrRequest(req, prNumber, automationContext, () => { cachedFirebaseToken = null; }),\n    async mergeVerifiedPr(prNumber, automationContext) {\n      return mergeVerifiedPrRequest(\n        req, prNumber, automationContext, () => { cachedFirebaseToken = null; },\n      );\n    },\n\n    /**\n     * Append progress / set terminal status. Returns\n     *   { task }            \u2014 applied\n     *   { terminal: true }  \u2014 task already terminal (operator cancelled): STOP\n     */\n    async postProgress(taskId, patch) {\n      const progress = {\n        ...patch,\n        ...(patch.runner_id ? {} : runnerId ? { runner_id: runnerId } : {}),\n        ...(patch.runner_instance_id ? {} : runnerInstanceId ? { runner_instance_id: runnerInstanceId } : {}),\n      };\n      const res = await taskReq('PATCH', `/api/v1/code-task/${taskId}/progress`, progress);\n      if (res.status === 409) {\n        const conflict = await res.json().catch(() => ({}));\n        if (conflict?.error === 'code_task_claim_authority_changed') {\n          throw new ClaimAuthorityChangedError();\n        }\n        return { terminal: true };\n      }\n      if (res.status === 404) return { terminal: true, missing: true };\n      if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return { task: json && json.task };\n    },\n\n    async getTask(taskId) {\n      const res = await taskReq('GET', `/api/v1/code-task/${taskId}`);\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json ? json.task : null;\n    },\n    async listPrOpenedTasks() {\n      return listAllPrOpenedTasks(taskReq);\n    },\n    async downloadTaskAttachment(taskId, attachmentId) {\n      const path = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;\n      const res = await taskReq('GET', path);\n      if (res.status === 401) cachedFirebaseToken = null;\n      if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);\n      return Buffer.from(await res.arrayBuffer());\n    },\n\n    // Raised per-attempt timeout (>=15s) + bounded retry \u2014 see control-plane-knowledge-context.mjs.\n    async getTaskKnowledgeContext(taskId, { query } = {}) {\n      return getTaskKnowledgeContextRequest(req, taskId, { query }, {\n        taskRequestTimeoutMs,\n        invalidateToken: () => { cachedFirebaseToken = null; },\n        sleep,\n        log: (m) => console.warn(`[code-runner ${new Date().toISOString()}] ${m}`),\n      });\n    },\n\n    /** ADR-004 \u00A7 11.1b: the plane's prepared job, for SHADOW comparison. Never throws. */\n    getPreparedJob: (taskId, options) => getPreparedJobRequest(req, taskId, options, () => { cachedFirebaseToken = null; }),\n    /** Weekly Claude token usage report \u2014 see control-plane-weekly-tokens.mjs. */\n    async postWeeklyTokens(report) {\n      return postWeeklyTokensRequest(taskReq, report, () => { cachedFirebaseToken = null; });\n    },\n\n    /**\n     * Relay a batch of this machine's local vo-mcp events to vo-telemetry via\n     * the control plane (telemetry-forwarder.mjs). Returns { status, body };\n     * the forwarder owns backoff/disable policy. See control-plane-telemetry-relay.mjs.\n     */\n    async relayTelemetryEvents(batch) {\n      return relayTelemetryEventsRequest(req, batch, () => { cachedFirebaseToken = null; });\n    },\n\n    /**\n     * Send a liveness heartbeat (M2). The control-plane upserts it under the\n     * authenticated operator so the web shows a TRUE \"runner online\" signal.\n     * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.\n     */\n    async postHeartbeat(heartbeat) {\n      const body = buildRunnerHeartbeatBody(heartbeat);\n      const res = await req('POST', '/api/v1/runner/heartbeat', body, {\n        timeoutMs: heartbeatTimeoutMs,\n      });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('heartbeat unauthorized (401)');\n      }\n      if (!res.ok) {\n        // Surface WHICH field the server rejected. `HTTP 400` alone is what made\n        // the 2026-07-25 outage take hours to diagnose: the runner looked\n        // identical to a powered-off machine from the control plane, and the\n        // operator's only clue was a bare status code.\n        //\n        // The server returns issue PATHS and CODES only (never values), so this\n        // is safe to log.\n        let detail = '';\n        try {\n          const body = await res.json();\n          if (Array.isArray(body?.issue_paths) && body.issue_paths.length > 0) {\n            detail = ` (rejected fields: ${body.issue_paths.join(', ')})`;\n          }\n        } catch { /* non-JSON body \u2014 the status code is all we have */ }\n        throw new Error(`heartbeat failed: HTTP ${res.status}${detail}`);\n      }\n      return res.json();\n    },\n\n    async getRunnerStatus({ operatorId } = {}) {\n      const query = operatorId ? `?operator_id=${encodeURIComponent(operatorId)}` : '';\n      const res = await req('GET', `/api/v1/runner/status${query}`, undefined, {\n        timeoutMs: heartbeatTimeoutMs,\n      });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner status unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner status failed: HTTP ${res.status}`);\n      const body = await res.json();\n      return Array.isArray(body?.runners) ? body.runners : [];\n    },\n\n    async pollRunnerControl({ runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities }) {\n      const body = { runner_id: runnerId };\n      if (operatorId) body.operator_id = operatorId;\n      if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n      if (supervisorVersion) body.supervisor_version = supervisorVersion;\n      if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n      const res = await taskReq('POST', '/api/v1/runner/control/poll', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control poll unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);\n      const json = await res.json();\n      const action = json?.action;\n      return action && typeof action.action_id === 'string' && action.action_id\n        ? { ...action, actionId: action.action_id }\n        : null;\n    },\n\n    async completeRunnerControl(actionId, { runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities, status, detail }) {\n      const body = { runner_id: runnerId, status };\n      if (operatorId) body.operator_id = operatorId;\n      if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n      if (supervisorVersion) body.supervisor_version = supervisorVersion;\n      if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n      if (detail) body.detail = detail;\n      const res = await taskReq('POST', `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control completion unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json?.action || null;\n    },\n\n    /** Mint a GitHub App installation token \u2014 see installation-token.mjs. */\n    async getInstallationToken({ required = false, readOnly = false, repo = null } = {}) {\n      return fetchInstallationToken({ req: taskReq, required, readOnly, repo });\n    },\n\n    /**\n     * Read the operator's dispatch-mode config (Fast\u2192Ultracode effort setting).\n     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'marathon'; 'ultracode' legacy),\n     * defaulting to 'standard' on any error. Never throws \u2014 best-effort.\n     */\n    async getDispatchMode() {\n      try {\n        const res = await taskReq('GET', '/api/v1/dispatch-mode-config');\n        if (!res.ok) return 'standard';\n        const json = await res.json();\n        return json?.dispatchMode || 'standard';\n      } catch {\n        return 'standard';\n      }\n    },\n  };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { win32 } from 'node:path';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\nconst NPM_CLI_SUFFIX = `\\\\${win32.join('node_modules', 'npm', 'bin', 'npm-cli.js').toLowerCase()}`;\n\nfunction escapeRegExp(value) {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n  let value = String(raw || '')\n    .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n    .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n    .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n  for (const [name, secret] of Object.entries(env)) {\n    if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n    const text = String(secret || '');\n    if (text.length < 4) continue;\n    value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n  }\n  value = value.replace(/\\s+/gu, ' ').trim();\n  if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n  return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nfunction isNpmCliPath(value) {\n  return typeof value === 'string'\n    && win32.isAbsolute(value)\n    && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);\n}\n\n/**\n * Resolve npm's JavaScript entrypoint without executing a Windows `.cmd` shim.\n *\n * The desktop app can run from a bundled node.exe that does not carry npm, so\n * resolution also checks the exact npm layout below absolute PATH entries. No\n * candidate controls the executable or package argv: process.execPath remains\n * the executable and the package spec remains allow-listed below.\n */\nexport function resolveNpmCli({\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  const candidates = [];\n  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);\n  candidates.push(win32.join(win32.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n\n  const pathValue = env.PATH ?? env.Path ?? env.path ?? '';\n  for (const entry of pathValue.split(';')) {\n    const trimmed = entry.trim();\n    if (!win32.isAbsolute(trimmed)) continue;\n    candidates.push(win32.join(trimmed, 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n  }\n\n  const seen = new Set();\n  for (const candidate of candidates) {\n    const normalized = win32.normalize(candidate);\n    const key = normalized.toLowerCase();\n    if (seen.has(key) || !isNpmCliPath(normalized)) continue;\n    seen.add(key);\n    if (fileExists(normalized)) return normalized;\n  }\n  return null;\n}\n\nexport function buildMaintenanceCommand(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  if (!['update', 'reinstall'].includes(kind)) return null;\n  if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const command = platform === 'win32' ? execPath : 'npm';\n  const args = [...(npmCli ? [npmCli] : []), 'install', '-g', packageSpec];\n  if (kind === 'reinstall') args.push('--force');\n  return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n  spawn = spawnSync,\n  log = () => {},\n} = {}) {\n  if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n  let command;\n  try {\n    command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });\n  } catch (error) {\n    return {\n      ok: false,\n      status: 2,\n      command: null,\n      args: [],\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env),\n    };\n  }\n  if (!command) return { ok: false, status: 2, command: null, args: [] };\n  log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n  const result = spawn(command.command, command.args, {\n    stdio: ['ignore', 'pipe', 'pipe'],\n    encoding: 'utf8',\n    env,\n    shell: false,\n    windowsHide: true,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  const detail = sanitizeMaintenanceDiagnostic(\n    [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n    env,\n  );\n  if (detail) log(`runner maintenance result: ${detail}`);\n  return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from 'node:fs';\nimport { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport { resolveNpmCli, sanitizeMaintenanceDiagnostic } from '../../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport {\n  validateRuntimeAuthorization,\n  validateStagedRuntimeAuthorization,\n} from '../../../../scripts/virtual-office/runner-bootstrap/runtime-authorization.mjs';\nimport { activateSlot, atomicWriteJson, hashFileSha512, hashRuntimeTree, slotPaths, validateSlot } from './bundled-runtime-store.mjs';\n\nconst PACKAGE_NAME = '@algosuite/vo-mcp';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst MAX_TARBALL_BYTES = 100 * 1024 * 1024;\nconst PUBLIC_REGISTRY = 'https://registry.npmjs.org/';\n\nexport function buildMinimalMaintenanceEnv(env = process.env, runtimeRoot = '') {\n  const allowed = new Set([\n    'PATH', 'Path', 'path', 'PATHEXT', 'SystemRoot', 'SYSTEMROOT', 'WINDIR', 'COMSPEC',\n    'TEMP', 'TMP', 'TMPDIR', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',\n    'ProgramFiles', 'ProgramFiles(x86)', 'ProgramW6432', 'LANG', 'LC_ALL',\n  ]);\n  const clean = {};\n  for (const [key, value] of Object.entries(env)) {\n    if (allowed.has(key) && typeof value === 'string') clean[key] = value;\n  }\n  return {\n    ...clean,\n    npm_config_ignore_scripts: 'true',\n    npm_config_bin_links: 'false',\n    npm_config_audit: 'false',\n    npm_config_fund: 'false',\n    npm_config_update_notifier: 'false',\n    npm_config_registry: PUBLIC_REGISTRY,\n    ...(runtimeRoot ? {\n      npm_config_userconfig: join(runtimeRoot, 'maintenance', 'user.npmrc'),\n      npm_config_globalconfig: join(runtimeRoot, 'maintenance', 'global.npmrc'),\n      npm_config_cache: join(runtimeRoot, 'maintenance', 'npm-cache'),\n    } : {}),\n  };\n}\n\nfunction defaultRun(command, args, options) {\n  return spawnSync(command, args, {\n    cwd: options.cwd,\n    encoding: 'utf8',\n    env: options.env,\n    shell: false,\n    windowsHide: true,\n    stdio: ['ignore', 'pipe', 'pipe'],\n    timeout: options.timeout ?? 120_000,\n  });\n}\n\nfunction commandRunner({ platform, execPath, env, fileExists, run }) {\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const npmCommand = platform === 'win32' ? execPath : 'npm';\n  const prefix = npmCli ? [npmCli] : [];\n  return {\n    npm(args, options) { return run(npmCommand, [...prefix, ...args], options); },\n    node(args, options) { return run(execPath, args, options); },\n  };\n}\n\nfunction parseJsonOutput(result, operation) {\n  if (result?.status !== 0) {\n    throw new Error(`${operation} failed: ${String(result?.stderr || result?.error?.message || `exit ${result?.status ?? 1}`)}`);\n  }\n  try { return JSON.parse(String(result.stdout || '')); } catch { throw new Error(`${operation} returned invalid JSON`); }\n}\n\nfunction tarballIntegrity(file) {\n  return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\nfunction assertNoLinks(root) {\n  const pending = [root];\n  while (pending.length) {\n    const current = pending.pop();\n    const stat = lstatSync(current);\n    if (stat.isSymbolicLink()) throw new Error('installed runtime contains a link/reparse point');\n    if (!stat.isDirectory()) continue;\n    for (const entry of readdirSync(current)) pending.push(join(current, entry));\n  }\n}\n\nexport function validateDependencyLock(payloadRoot, expected) {\n  const lock = JSON.parse(readFileSync(join(payloadRoot, 'package-lock.json'), 'utf8'));\n  if (Number(lock.lockfileVersion) < 3 || !lock.packages || typeof lock.packages !== 'object') {\n    throw new Error('runtime dependency lock is missing or unsupported');\n  }\n  let foundPackage = false;\n  for (const [key, item] of Object.entries(lock.packages)) {\n    if (!key) continue;\n    if (item?.link === true) throw new Error(`runtime dependency lock contains link: ${key}`);\n    const isRunner = key.replaceAll('\\\\', '/').endsWith('node_modules/@algosuite/vo-mcp');\n    if (isRunner) {\n      foundPackage = item.version === expected.version && item.integrity === expected.integrity;\n      continue;\n    }\n    if (!INTEGRITY_RE.test(String(item?.integrity || ''))) throw new Error(`dependency lacks sha512 integrity: ${key}`);\n    if (!String(item?.resolved || '').startsWith('https://registry.npmjs.org/')) {\n      throw new Error(`dependency is not registry-pinned: ${key}`);\n    }\n  }\n  if (!foundPackage) throw new Error('installed runner package does not match registry integrity');\n}\n\nexport function writeAuthorizedInstallSeed(payloadRoot, tarball, runtimeAuthorization) {\n  const authorization = validateRuntimeAuthorization(runtimeAuthorization);\n  const stagingRoot = resolve(payloadRoot, '..', '..');\n  const tarballFromStaging = relative(stagingRoot, resolve(tarball));\n  if (!tarballFromStaging || tarballFromStaging === '..'\n    || tarballFromStaging.startsWith(`..${sep}`)\n    || isAbsolute(tarballFromStaging)) {\n    throw new Error('authorized runtime tarball escaped staging root');\n  }\n  const relativeTarball = relative(payloadRoot, resolve(tarball)).replaceAll('\\\\', '/');\n  if (!relativeTarball || isAbsolute(relativeTarball)\n    || relativeTarball.includes('\\n') || relativeTarball.includes('\\r')) {\n    throw new Error('authorized runtime tarball path invalid');\n  }\n  const fileSpec = `file:${relativeTarball}`;\n  const packageRecord = { name: 'algohq-runner-runtime', version: '0.0.0', private: true,\n    dependencies: { [PACKAGE_NAME]: fileSpec } };\n  const packages = structuredClone(authorization.dependency_lock.packages);\n  packages[`node_modules/${PACKAGE_NAME}`].resolved = fileSpec;\n  const lock = { name: packageRecord.name, version: packageRecord.version,\n    lockfileVersion: authorization.dependency_lock.source_lockfile_version,\n    requires: true, packages: { '': packageRecord, ...packages } };\n  writeFileSync(join(payloadRoot, 'package.json'), `${JSON.stringify(packageRecord)}\\n`, { mode: 0o600 });\n  writeFileSync(join(payloadRoot, 'package-lock.json'), `${JSON.stringify(lock)}\\n`, { mode: 0o600 });\n  return { fileSpec, lock };\n}\n\nfunction buildActive(slotId, metadata, paths) {\n  return {\n    slot_id: slotId,\n    version: metadata.version,\n    integrity: metadata.integrity,\n    entry_sha512: hashFileSha512(paths.entry),\n    supervisor_sha512: hashFileSha512(paths.supervisor),\n    tree_sha512: hashRuntimeTree(paths.slotRoot ?? paths.payloadRoot),\n  };\n}\n\nfunction installSlot({\n  runtimeRoot, metadata, tarball, runner, npmEnv, runOptions, force, runtimeAuthorization,\n}) {\n  const digest = createHash('sha256').update(metadata.integrity).digest('hex').slice(0, 16);\n  const suffix = force ? `${digest}-${randomUUID().slice(0, 8)}` : digest;\n  const slotId = `vo-mcp-${metadata.version}-${suffix}`;\n  const finalPaths = slotPaths(runtimeRoot, slotId);\n  if (!force && existsSync(finalPaths.slotRoot)) {\n    const manifest = JSON.parse(readFileSync(finalPaths.manifest, 'utf8'));\n    const active = buildActive(slotId, metadata, finalPaths);\n    const validated = validateSlot(runtimeRoot, active);\n    if (validated.ok && manifest.integrity === metadata.integrity) {\n      if (runtimeAuthorization) {\n        validateStagedRuntimeAuthorization({\n          payloadRoot: finalPaths.slotRoot, authorization: runtimeAuthorization,\n        });\n      }\n      return { active, created: false };\n    }\n  }\n\n  const staging = join(runtimeRoot, 'staging', randomUUID());\n  const payload = join(staging, 'payload');\n  let installedSlot = false;\n  try {\n    mkdirSync(payload, { recursive: true });\n    let installArgs;\n    if (runtimeAuthorization) {\n      writeAuthorizedInstallSeed(payload, tarball, runtimeAuthorization);\n      installArgs = ['ci', '--ignore-scripts', '--no-bin-links', '--no-audit', '--no-fund',\n        `--registry=${PUBLIC_REGISTRY}`];\n    } else {\n      writeFileSync(join(payload, 'package.json'), `${JSON.stringify({\n        name: 'algohq-runner-runtime', version: '0.0.0', private: true,\n      })}\\n`);\n      installArgs = ['install', '--ignore-scripts', '--no-bin-links', '--no-audit', '--no-fund',\n        '--package-lock=true', '--save-exact', `--registry=${PUBLIC_REGISTRY}`, tarball];\n    }\n    const install = runner.npm(installArgs,\n      { ...runOptions, cwd: payload, env: npmEnv, timeout: 180_000 });\n    if (install.status !== 0) throw new Error(`npm install failed: ${install.stderr || install.error?.message || install.status}`);\n    assertNoLinks(payload);\n    validateDependencyLock(payload, metadata);\n    if (runtimeAuthorization) {\n      validateStagedRuntimeAuthorization({ payloadRoot: payload, authorization: runtimeAuthorization });\n    }\n\n    const stagedPaths = {\n      entry: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp'),\n      supervisor: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js'),\n      packageJson: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'package.json'),\n      credentialHelper: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js'),\n      slotRoot: payload,\n    };\n    const pkg = JSON.parse(readFileSync(stagedPaths.packageJson, 'utf8'));\n    if (pkg.name !== PACKAGE_NAME || pkg.version !== metadata.version) throw new Error('installed package identity mismatch');\n    if (!lstatSync(stagedPaths.credentialHelper).isFile()) throw new Error('installed credential helper is missing');\n    const smoke = runner.node([stagedPaths.entry, 'runner', '--version'], { ...runOptions, cwd: payload, env: npmEnv, timeout: 30_000 });\n    if (smoke.status !== 0 || String(smoke.stdout || '').trim() !== `vo-mcp runner ${metadata.version}`) {\n      throw new Error('bundled runtime smoke check failed');\n    }\n    const active = buildActive(slotId, metadata, stagedPaths);\n    atomicWriteJson(join(payload, 'runtime-manifest.json'), { schema_version: 1, ...active });\n    mkdirSync(join(runtimeRoot, 'slots'), { recursive: true });\n    if (existsSync(finalPaths.slotRoot)) throw new Error('immutable runtime slot already exists');\n    renameSync(payload, finalPaths.slotRoot);\n    installedSlot = true;\n    const validated = validateSlot(runtimeRoot, active);\n    if (!validated.ok) throw new Error(`staged runtime validation failed: ${validated.detail}`);\n    return { active, created: true };\n  } catch (error) {\n    if (installedSlot) rmSync(finalPaths.slotRoot, { recursive: true, force: true });\n    throw error;\n  } finally {\n    rmSync(staging, { recursive: true, force: true });\n  }\n}\n\nexport function stageBundledRuntimeSlot(options) {\n  const {\n    runtimeRoot,\n    packageSpec,\n    expectedVersion,\n    expectedIntegrity,\n    platform = process.platform,\n    execPath = process.execPath,\n    env = process.env,\n    fileExists = existsSync,\n    run = defaultRun,\n    force = false,\n    runtimeAuthorization = null,\n  } = options;\n  if (!runtimeRoot || !isAbsolute(runtimeRoot)) return { ok: false, status: 2, detail: 'bundled runtime root unavailable' };\n  if (!expectedVersion || !PACKAGE_SPEC_RE.test(`${PACKAGE_NAME}@${expectedVersion}`)) {\n    return { ok: false, status: 2, detail: 'invalid expected runner version' };\n  }\n  if (!expectedIntegrity || !INTEGRITY_RE.test(expectedIntegrity)) {\n    return { ok: false, status: 2, detail: 'invalid expected runner integrity' };\n  }\n  const exactSpec = `${PACKAGE_NAME}@${expectedVersion}`;\n  if (packageSpec !== exactSpec) return { ok: false, status: 2, detail: 'runner package spec does not match authorized version' };\n  const resolvedRoot = resolve(runtimeRoot);\n  const npmEnv = buildMinimalMaintenanceEnv(env, resolvedRoot);\n  const runOptions = { env: npmEnv, cwd: resolvedRoot };\n  let tarDir = null;\n  try {\n    mkdirSync(resolvedRoot, { recursive: true });\n    mkdirSync(join(resolvedRoot, 'maintenance'), { recursive: true });\n    writeFileSync(npmEnv.npm_config_userconfig, '', { mode: 0o600 });\n    writeFileSync(npmEnv.npm_config_globalconfig, '', { mode: 0o600 });\n    const runner = commandRunner({ platform, execPath, env: npmEnv, fileExists, run });\n    const metadata = { version: expectedVersion, integrity: expectedIntegrity };\n    tarDir = join(resolvedRoot, 'staging', randomUUID());\n    mkdirSync(tarDir, { recursive: true });\n    const packed = parseJsonOutput(runner.npm([\n      'pack', exactSpec, '--ignore-scripts', '--json', '--pack-destination', tarDir, `--registry=${PUBLIC_REGISTRY}`,\n    ], runOptions), 'npm pack');\n    const record = Array.isArray(packed) ? packed[0] : packed;\n    const tarball = join(tarDir, basename(String(record?.filename || '')));\n    if (!existsSync(tarball) || !basename(tarball).endsWith('.tgz')) throw new Error('npm pack returned no tarball');\n    if (lstatSync(tarball).size > MAX_TARBALL_BYTES) throw new Error('runner package tarball exceeds size limit');\n    if (record.integrity !== metadata.integrity || tarballIntegrity(tarball) !== metadata.integrity) {\n      throw new Error('runner package sha512 integrity mismatch');\n    }\n    const installed = installSlot({\n      runtimeRoot: resolvedRoot, metadata, tarball, runner, npmEnv, runOptions, force,\n      runtimeAuthorization,\n    });\n    return { ok: true, status: 0, ...installed };\n  } catch (error) {\n    return { ok: false, status: 1, detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env) };\n  } finally {\n    if (tarDir) rmSync(tarDir, { recursive: true, force: true });\n  }\n}\n\nexport function stageAndActivateBundledUpdate(options) {\n  const staged = stageBundledRuntimeSlot(options);\n  if (!staged.ok) return staged;\n  try {\n    activateSlot(resolve(options.runtimeRoot), staged.active, options.action);\n    return { ...staged, handoff: true };\n  } catch (error) {\n    return {\n      ok: false,\n      status: 1,\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), options.env ?? process.env),\n    };\n  }\n}\n\nexport const __test = { INTEGRITY_RE, PACKAGE_SPEC_RE, PUBLIC_REGISTRY, assertNoLinks, tarballIntegrity };\n", "import { createHash } from 'node:crypto';\nimport { readFileSync } from 'node:fs';\nimport { dirname, posix, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport {\n  compareStagedRuntime,\n  isOmittedOptionalPackage,\n} from './runtime-staged-tree.mjs';\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nexport const BETA13_WINDOWS_X64_AUTHORIZATION = resolve(\n  HERE,\n  'authorizations',\n  'vo-mcp-0.2.0-beta.13-win32-x64.json',\n);\n\nconst EXPECTED = Object.freeze({\n  authorizationId: 'vo-mcp-0.2.0-beta.13-win32-x64-v1',\n  packageName: '@algosuite/vo-mcp',\n  version: '0.2.0-beta.13',\n  registry: 'https://registry.npmjs.org/',\n  tarballUrl: 'https://registry.npmjs.org/@algosuite/vo-mcp/-/vo-mcp-0.2.0-beta.13.tgz',\n  integrity: 'sha512-TQa5VaEFsaleHbAZZp+zS4u5U/0zQBIGOiPDGn9IqfZfdMltH2dY81nTftvu5EUABthE1xTCrdSzJjO9mzkNag==',\n  tarballSha256: 'c1e39e8bb2df7f53f48e46e77ffb617452a01849469ff4757b4384a478c1cbff',\n  npmShasumSha1: 'f076649b31294aa38deb7852f38a889e0d0fbe44',\n  gitHead: 'ba00db90720416fa7474581eb823c6255221880f',\n  sourceLockSha256: 'f8bbb5e81a0057ee2d60145580ec07f7e7055d999bdd038515c6c4e88af6cc92',\n  canonicalEntriesSha256: '7f6b2f93ccb93ad625ed244dc59ac556792e478178fc690ad2ca2c6f3a2325d2',\n  entryCount: 107,\n  optionalEntryCount: 13,\n  installedEntryCount: 96,\n  treeAlgorithm: 'algohq-node-modules-manifest-sha256-v1',\n  treeSha256: '9c8b0749d7ae1e2c132ef08c5b5655673ae88432859c561806276c9eb18f4874',\n  treeFileCount: 3538,\n  treeDirectoryCount: 553,\n  treeByteCount: 20566445,\n  treeManifestByteCount: 412062,\n});\n\nconst SRI_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst SHA256_RE = /^[a-f0-9]{64}$/u;\n\nfunction canonical(value) {\n  if (Array.isArray(value)) return value.map(canonical);\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));\n  }\n  return value;\n}\n\nfunction sha256Canonical(value) {\n  return createHash('sha256').update(`${JSON.stringify(canonical(value))}\\n`, 'utf8').digest('hex');\n}\n\nfunction assertEqual(actual, expected, label) {\n  if (actual !== expected) throw new Error(`runtime authorization ${label} mismatch`);\n}\n\nfunction isOmittedOnWindowsX64(entry) {\n  return isOmittedOptionalPackage(entry, { os: 'win32', arch: 'x64' });\n}\n\nexport function validateRuntimeAuthorization(value) {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('runtime authorization must be an object');\n  }\n  assertEqual(value.schema_version, 1, 'schema version');\n  assertEqual(value.authorization_id, EXPECTED.authorizationId, 'id');\n  assertEqual(value.package?.name, EXPECTED.packageName, 'package name');\n  assertEqual(value.package?.version, EXPECTED.version, 'package version');\n  assertEqual(value.package?.registry, EXPECTED.registry, 'registry');\n  assertEqual(value.package?.tarball_url, EXPECTED.tarballUrl, 'tarball URL');\n  assertEqual(value.package?.sri_sha512, EXPECTED.integrity, 'package integrity');\n  assertEqual(value.package?.tarball_sha256, EXPECTED.tarballSha256, 'tarball sha256');\n  assertEqual(value.package?.npm_shasum_sha1, EXPECTED.npmShasumSha1, 'npm shasum');\n  assertEqual(value.package?.git_head, EXPECTED.gitHead, 'git head');\n  assertEqual(value.package?.packed_file_count, 25, 'packed file count');\n  assertEqual(value.package?.packed_bytes, 846151, 'packed byte count');\n  assertEqual(value.package?.unpacked_bytes, 3350387, 'unpacked byte count');\n\n  assertEqual(value.platform?.os, 'win32', 'operating system');\n  assertEqual(value.platform?.arch, 'x64', 'architecture');\n  assertEqual(value.platform?.package_node_engine, '>=22.5.0', 'package node engine');\n  if (!/^24\\.15\\.0$/u.test(String(value.platform?.authorization_builder_node || ''))\n    || value.platform?.authorization_builder_npm !== '11.12.1') {\n    throw new Error('runtime authorization builder toolchain mismatch');\n  }\n\n  for (const [key, expected] of Object.entries({\n    ignore_scripts: true,\n    bin_links: false,\n    include_optional: true,\n    omit_dev: true,\n    audit: false,\n    fund: false,\n    reject_links_reparse_points: true,\n    reject_hardlinks: true,\n    remove_generated_node_modules_package_lock_before_tree_validation: true,\n  })) assertEqual(value.install_contract?.[key], expected, `install contract ${key}`);\n  assertEqual(value.install_contract?.allowed_registry_prefix, EXPECTED.registry, 'registry prefix');\n\n  const lock = value.dependency_lock;\n  if (!lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {\n    throw new Error('runtime authorization dependency set missing');\n  }\n  assertEqual(lock.source_lockfile_version, 3, 'lockfile version');\n  assertEqual(lock.source_lock_sha256, EXPECTED.sourceLockSha256, 'source lock sha256');\n  assertEqual(lock.canonical_entries_sha256, EXPECTED.canonicalEntriesSha256, 'entry-set sha256');\n  assertEqual(lock.entry_count, EXPECTED.entryCount, 'entry count');\n  assertEqual(lock.integrity_entry_count, EXPECTED.entryCount, 'integrity count');\n  assertEqual(lock.optional_entry_count, EXPECTED.optionalEntryCount, 'optional count');\n  assertEqual(lock.windows_x64_installed_entry_count, EXPECTED.installedEntryCount, 'installed count');\n\n  const entries = Object.entries(lock.packages);\n  assertEqual(entries.length, EXPECTED.entryCount, 'package map count');\n  for (const [key, entry] of entries) {\n    if (!key.startsWith('node_modules/') || key.includes('\\\\') || posix.normalize(key) !== key\n      || key.split('/').includes('..')) {\n      throw new Error(`runtime authorization has unsafe package path: ${key}`);\n    }\n    if (!entry || typeof entry !== 'object' || entry.link === true) {\n      throw new Error(`runtime authorization contains a linked package: ${key}`);\n    }\n    if (!SRI_RE.test(String(entry.integrity || ''))) {\n      throw new Error(`runtime authorization package lacks sha512 integrity: ${key}`);\n    }\n    if (!String(entry.resolved || '').startsWith(EXPECTED.registry)) {\n      throw new Error(`runtime authorization package is outside the public registry: ${key}`);\n    }\n    if (entry.hasInstallScript === true) {\n      throw new Error(`runtime authorization package declares an install script: ${key}`);\n    }\n  }\n  const runner = lock.packages['node_modules/@algosuite/vo-mcp'];\n  assertEqual(runner?.version, EXPECTED.version, 'runner dependency version');\n  assertEqual(runner?.integrity, EXPECTED.integrity, 'runner dependency integrity');\n  assertEqual(sha256Canonical(lock.packages), EXPECTED.canonicalEntriesSha256, 'computed entry-set sha256');\n\n  const omitted = entries.filter(([, entry]) => isOmittedOnWindowsX64(entry)).map(([key]) => key).sort();\n  const declaredOmitted = [...(lock.windows_x64_omitted_optional_entries || [])].sort();\n  assertEqual(JSON.stringify(declaredOmitted), JSON.stringify(omitted), 'omitted optional entries');\n  assertEqual(entries.length - omitted.length, EXPECTED.installedEntryCount, 'derived installed count');\n\n  const tree = value.installed_tree;\n  assertEqual(tree?.algorithm, EXPECTED.treeAlgorithm, 'tree algorithm');\n  if (!SHA256_RE.test(String(tree?.sha256 || ''))) throw new Error('runtime authorization tree hash invalid');\n  assertEqual(tree.sha256, EXPECTED.treeSha256, 'tree sha256');\n  assertEqual(tree.file_count, EXPECTED.treeFileCount, 'tree file count');\n  assertEqual(tree.directory_count, EXPECTED.treeDirectoryCount, 'tree directory count');\n  assertEqual(tree.byte_count, EXPECTED.treeByteCount, 'tree byte count');\n  assertEqual(tree.canonical_manifest_byte_count, EXPECTED.treeManifestByteCount, 'tree manifest byte count');\n  assertEqual(tree.reparse_point_count, 0, 'tree reparse count');\n  assertEqual(tree.hardlinked_file_count, 0, 'tree hardlink count');\n  return value;\n}\n\nexport function readRuntimeAuthorization(file = BETA13_WINDOWS_X64_AUTHORIZATION) {\n  return validateRuntimeAuthorization(JSON.parse(readFileSync(file, 'utf8')));\n}\n\nexport function validateStagedRuntimeAuthorization(options) {\n  const authorization = validateRuntimeAuthorization(options?.authorization || readRuntimeAuthorization());\n  return compareStagedRuntime({ ...options, authorization });\n}\n\nif (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {\n  readRuntimeAuthorization(process.argv[2] ? resolve(process.argv[2]) : undefined);\n  process.stdout.write('AlgoHQ runtime authorization valid\\n');\n}\n\nexport const __test = { canonical, isOmittedOnWindowsX64, sha256Canonical };\n", "import { execFileSync } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n  existsSync,\n  lstatSync,\n  readFileSync,\n  readdirSync,\n} from 'node:fs';\nimport { isAbsolute, join, relative, resolve, sep, win32 } from 'node:path';\n\nconst WINDOWS_REPARSE_ATTRIBUTE = 0x400;\nconst RUNNER_LOCK_KEY = 'node_modules/@algosuite/vo-mcp';\nexport const INSTALLED_TREE_ALGORITHM = 'algohq-node-modules-manifest-sha256-v1';\n\nfunction canonical(value) {\n  if (Array.isArray(value)) return value.map(canonical);\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));\n  }\n  return value;\n}\n\nfunction canonicalJson(value) {\n  return JSON.stringify(canonical(value));\n}\n\nfunction hasFileAttribute(value, bit) {\n  if (typeof value === 'bigint') return (value & BigInt(bit)) !== 0n;\n  return Number.isSafeInteger(value) && (value & bit) !== 0;\n}\n\nexport function isReparseStat(stats) {\n  if (!stats || typeof stats !== 'object') return false;\n  if (typeof stats.isSymbolicLink === 'function' && stats.isSymbolicLink()) return true;\n  if (stats.reparseTag !== undefined && stats.reparseTag !== null && stats.reparseTag !== 0) return true;\n  return ['fileAttributes', 'fileAttribute', 'attributes']\n    .some((key) => hasFileAttribute(stats[key], WINDOWS_REPARSE_ATTRIBUTE));\n}\n\nexport function platformConstraintAllows(values, target) {\n  if (!Array.isArray(values) || values.length === 0) return true;\n  if (values.some((value) => value === `!${target}`)) return false;\n  const positive = values.filter((value) => typeof value === 'string' && !value.startsWith('!'));\n  return positive.length === 0 || positive.includes(target);\n}\n\nexport function isOmittedOptionalPackage(entry, platform = { os: 'win32', arch: 'x64' }) {\n  return entry?.optional === true && (\n    !platformConstraintAllows(entry.os, platform.os)\n    || !platformConstraintAllows(entry.cpu, platform.arch)\n  );\n}\n\nfunction assertContained(root, candidate, label) {\n  const rel = relative(root, candidate);\n  if (rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel))) return;\n  throw new Error(`staged runtime ${label} escapes the payload root`);\n}\n\nfunction normalizeReportedPath(root, candidate) {\n  const absolute = resolve(String(candidate || ''));\n  assertContained(root, absolute, 'reparse point');\n  return absolute;\n}\n\nexport function listWindowsReparsePoints(root, {\n  execFile = execFileSync, env = process.env, platform = process.platform,\n} = {}) {\n  if (platform !== 'win32') return [];\n  const systemRoot = String(env.SystemRoot || env.SYSTEMROOT || '');\n  if (!win32.isAbsolute(systemRoot) || win32.normalize(systemRoot) !== systemRoot) {\n    throw new Error('staged runtime trusted PowerShell root unavailable');\n  }\n  const system32 = win32.join(systemRoot, 'System32');\n  const powershell = win32.join(system32, 'WindowsPowerShell', 'v1.0', 'powershell.exe');\n  const script = [\n    '$ErrorActionPreference = \"Stop\"',\n    '$root = [IO.Path]::GetFullPath($env:ALGOHQ_REPARSE_ROOT)',\n    '$items = @((Get-Item -LiteralPath $root -Force)) + @(Get-ChildItem -LiteralPath $root -Force -Recurse)',\n    'foreach ($item in $items) {',\n    '  if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {',\n    '    [Console]::Out.WriteLine($item.FullName)',\n    '  }',\n    '}',\n  ].join('; ');\n  const output = execFile(powershell, [\n    '-NoLogo',\n    '-NoProfile',\n    '-NonInteractive',\n    '-Command',\n    script,\n  ], {\n    cwd: system32,\n    encoding: 'utf8',\n    env: { SystemRoot: systemRoot, ALGOHQ_REPARSE_ROOT: win32.resolve(root) },\n    windowsHide: true,\n  });\n  return String(output || '').split(/\\r?\\n/u).filter(Boolean)\n    .map((item) => normalizeReportedPath(root, item));\n}\n\nfunction normalizedRunnerRecord(actual, expected) {\n  const normalized = structuredClone(actual);\n  if (normalized?.resolved === expected?.resolved) return normalized;\n  if (typeof normalized?.resolved !== 'string' || !normalized.resolved.startsWith('file:')) {\n    return normalized;\n  }\n  const fileName = normalized.resolved.slice('file:'.length).replaceAll('\\\\', '/').split('/').at(-1);\n  const expectedFileNames = new Set([\n    String(expected.resolved || '').split('/').at(-1),\n    `algosuite-vo-mcp-${expected.version}.tgz`,\n  ]);\n  if (expectedFileNames.has(fileName)) normalized.resolved = expected.resolved;\n  return normalized;\n}\n\nfunction validateLock(lock, authorization) {\n  if (!lock || typeof lock !== 'object' || Array.isArray(lock)) {\n    throw new Error('staged runtime package-lock must be an object');\n  }\n  if (lock.lockfileVersion !== authorization.dependency_lock.source_lockfile_version) {\n    throw new Error('staged runtime package-lock version mismatch');\n  }\n  if (!lock.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {\n    throw new Error('staged runtime package-lock package map missing');\n  }\n  const expected = authorization.dependency_lock.packages;\n  const actual = Object.fromEntries(Object.entries(lock.packages).filter(([key]) => key !== ''));\n  const expectedKeys = Object.keys(expected).sort();\n  const actualKeys = Object.keys(actual).sort();\n  if (canonicalJson(actualKeys) !== canonicalJson(expectedKeys)) {\n    throw new Error('staged runtime package-lock package set mismatch');\n  }\n  for (const key of expectedKeys) {\n    const record = key === RUNNER_LOCK_KEY\n      ? normalizedRunnerRecord(actual[key], expected[key])\n      : actual[key];\n    if (canonicalJson(record) !== canonicalJson(expected[key])) {\n      throw new Error(`staged runtime package-lock record mismatch: ${key}`);\n    }\n  }\n  return { actual, expected };\n}\n\nfunction checkPathKind(path, expectedKind, fsOps, label) {\n  if (!fsOps.exists(path)) throw new Error(`staged runtime ${label} missing`);\n  const stats = fsOps.lstat(path);\n  if (isReparseStat(stats) || fsOps.isReparsePoint(path, stats)) {\n    throw new Error(`staged runtime ${label} is a reparse point`);\n  }\n  if (expectedKind === 'directory' && !stats.isDirectory()) {\n    throw new Error(`staged runtime ${label} is not a directory`);\n  }\n  if (expectedKind === 'file' && !stats.isFile()) {\n    throw new Error(`staged runtime ${label} is not a regular file`);\n  }\n  if (expectedKind === 'file' && Number(stats.nlink) > 1) {\n    throw new Error(`staged runtime ${label} is hardlinked`);\n  }\n  return stats;\n}\n\nfunction verifyInstalledPackages(payloadRoot, packageRecords, platform, fsOps) {\n  const omitted = [];\n  let installed = 0;\n  for (const [key, entry] of Object.entries(packageRecords)) {\n    const path = resolve(payloadRoot, key);\n    assertContained(payloadRoot, path, 'package path');\n    const shouldOmit = isOmittedOptionalPackage(entry, platform);\n    if (shouldOmit) {\n      omitted.push(key);\n      if (fsOps.exists(path)) throw new Error(`staged runtime optional package should be omitted: ${key}`);\n      continue;\n    }\n    checkPathKind(path, 'directory', fsOps, `installed package ${key}`);\n    installed += 1;\n  }\n  return { installed, omitted: omitted.sort() };\n}\n\nfunction treeRecord(kind, path, stats, fileHash = '') {\n  if (kind === 'd') return `d\\t${path}\\r\\n`;\n  return `f\\t${path}\\t${stats.size}\\t${fileHash}\\r\\n`;\n}\n\nexport function computeInstalledTree(nodeModulesRoot, fsOps = {}) {\n  const ops = {\n    exists: existsSync,\n    lstat: lstatSync,\n    readdir: (path) => readdirSync(path, { withFileTypes: true }),\n    readFile: readFileSync,\n    isReparsePoint: () => false,\n    listReparsePoints: listWindowsReparsePoints,\n    ...fsOps,\n  };\n  const root = resolve(nodeModulesRoot);\n  checkPathKind(root, 'directory', ops, 'node_modules root');\n  const reported = ops.listReparsePoints(root);\n  if (!Array.isArray(reported)) throw new Error('staged runtime reparse probe returned an invalid result');\n  if (reported.length > 0) throw new Error('staged runtime tree contains a Windows reparse point');\n\n  let fileCount = 0;\n  let directoryCount = 1;\n  let byteCount = 0;\n  const entries = [];\n  function walk(absolute, relativePath) {\n    for (const entry of ops.readdir(absolute)) {\n      const childRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;\n      if (childRelative === '.package-lock.json') continue;\n      const child = resolve(absolute, entry.name);\n      assertContained(root, child, 'tree entry');\n      const stats = ops.lstat(child);\n      if (isReparseStat(stats) || ops.isReparsePoint(child, stats)) {\n        throw new Error(`staged runtime tree contains a reparse point: ${childRelative}`);\n      }\n      if (stats.isDirectory()) {\n        directoryCount += 1;\n        entries.push({ kind: 'd', path: childRelative, stats });\n        walk(child, childRelative);\n      } else if (stats.isFile()) {\n        if (Number(stats.nlink) > 1) {\n          throw new Error(`staged runtime tree contains a hardlinked file: ${childRelative}`);\n        }\n        fileCount += 1;\n        byteCount += Number(stats.size);\n        const digest = createHash('sha256').update(ops.readFile(child)).digest('hex');\n        entries.push({ kind: 'f', path: childRelative, stats, digest });\n      } else {\n        throw new Error(`staged runtime tree contains a non-file entry: ${childRelative}`);\n      }\n    }\n  }\n  walk(root, '');\n  entries.sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));\n  const manifest = treeRecord('d', '', { size: 0 }) + entries\n    .map((entry) => treeRecord(entry.kind, entry.path, entry.stats, entry.digest))\n    .join('');\n  return {\n    algorithm: INSTALLED_TREE_ALGORITHM,\n    sha256: createHash('sha256').update(manifest, 'utf8').digest('hex'),\n    file_count: fileCount,\n    directory_count: directoryCount,\n    byte_count: byteCount,\n    canonical_manifest_byte_count: Buffer.byteLength(manifest),\n    reparse_point_count: 0,\n    hardlinked_file_count: 0,\n  };\n}\n\nexport function compareStagedRuntime({\n  payloadRoot,\n  nodeModulesRoot = join(payloadRoot, 'node_modules'),\n  packageLockFile = join(payloadRoot, 'package-lock.json'),\n  authorization,\n  fsOps = {},\n}) {\n  const payload = resolve(payloadRoot);\n  const modules = resolve(nodeModulesRoot);\n  const lockFile = resolve(packageLockFile);\n  if (modules !== resolve(payload, 'node_modules') || lockFile !== resolve(payload, 'package-lock.json')) {\n    throw new Error('staged runtime paths do not identify one canonical payload');\n  }\n  const ops = {\n    exists: existsSync,\n    lstat: lstatSync,\n    readFile: readFileSync,\n    isReparsePoint: () => false,\n    ...fsOps,\n  };\n  checkPathKind(lockFile, 'file', ops, 'package-lock');\n  const lock = JSON.parse(ops.readFile(lockFile, 'utf8'));\n  const { expected } = validateLock(lock, authorization);\n  const platform = { os: authorization.platform.os, arch: authorization.platform.arch };\n  const packages = verifyInstalledPackages(payload, expected, platform, ops);\n  const declaredOmitted = [...authorization.dependency_lock.windows_x64_omitted_optional_entries].sort();\n  if (canonicalJson(packages.omitted) !== canonicalJson(declaredOmitted)) {\n    throw new Error('staged runtime optional omission list mismatch');\n  }\n  if (packages.installed !== Object.keys(expected).length - packages.omitted.length) {\n    throw new Error('staged runtime installed package count mismatch');\n  }\n  const tree = computeInstalledTree(modules, fsOps);\n  if (canonicalJson(tree) !== canonicalJson(authorization.installed_tree)) {\n    throw new Error('staged runtime installed tree mismatch');\n  }\n  return { ok: true, packageCount: Object.keys(expected).length, ...packages, tree };\n}\n\nexport const __test = { canonical, canonicalJson, normalizeReportedPath, normalizedRunnerRecord };\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n  closeSync,\n  existsSync,\n  fsyncSync,\n  lstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, isAbsolute, join, relative, resolve } from 'node:path';\n\nconst SLOT_ID_RE = /^vo-mcp-[0-9A-Za-z._-]{1,96}$/u;\nconst ACTION_ID_RE = /^[0-9A-Za-z._-]{1,128}$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst VERSION_RE = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst ENTRY_REL = join('node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp');\nconst SUPERVISOR_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js');\nconst PACKAGE_REL = join('node_modules', '@algosuite', 'vo-mcp', 'package.json');\nconst CREDENTIAL_HELPER_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js');\nconst MANIFEST_FILE = 'runtime-manifest.json';\n\nfunction within(parent, candidate) {\n  const rel = relative(resolve(parent), resolve(candidate));\n  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));\n}\n\n/**\n * Mirror of the desktop app's runtime-root resolution: RUNNER_RUNTIME_DIR\n * under Tauri's BaseDirectory::AppData for the app identifier. MUST stay in\n * lockstep with packages/vo-runner-app/src-tauri/src/runtime_slots.rs\n * (`RUNNER_RUNTIME_DIR`) and tauri.conf.json (`identifier`), or supervisors\n * and the app would stage/read different roots.\n */\nconst APP_IDENTIFIER = 'ai.algosuite.vo-runner';\nconst RUNNER_RUNTIME_DIR = 'runner-runtime';\n\nexport function defaultRuntimeRoot({ platform = process.platform, env = process.env, home = homedir() } = {}) {\n  if (platform === 'win32') {\n    const appData = String(env.APPDATA || '').trim();\n    return appData && isAbsolute(appData) ? join(appData, APP_IDENTIFIER, RUNNER_RUNTIME_DIR) : null;\n  }\n  if (!home) return null;\n  if (platform === 'darwin') {\n    return join(home, 'Library', 'Application Support', APP_IDENTIFIER, RUNNER_RUNTIME_DIR);\n  }\n  const xdg = String(env.XDG_CONFIG_HOME || '').trim();\n  const base = xdg && isAbsolute(xdg) ? xdg : join(home, '.config');\n  return join(base, APP_IDENTIFIER, RUNNER_RUNTIME_DIR);\n}\n\n/**\n * Explicit VO_RUNNER_RUNTIME_ROOT always wins, and a SET-but-invalid value\n * still fails closed (null \u2014 a misconfiguration must not silently fall back).\n * When the variable is ABSENT, derive the app-convention default: a\n * supervisor launched by an env-stripping wrapper (live-observed on\n * vo-code-runner-JacksPC, 2026-07-21: every bundled update hard-failed\n * \"bundled runtime root unavailable\") can then still stage/activate the\n * governed update into the exact directory the desktop app reads.\n */\nexport function runtimeRootFromEnv(env = process.env, { platform, home } = {}) {\n  const value = String(env.VO_RUNNER_RUNTIME_ROOT || '').trim();\n  if (value) return isAbsolute(value) ? resolve(value) : null;\n  const derived = defaultRuntimeRoot({ platform, env, home });\n  return derived ? resolve(derived) : null;\n}\n\nexport function hashFileSha512(file) {\n  return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\n/** Digest every executable payload byte and relative path, excluding only the self-referential manifest. */\nexport function hashRuntimeTree(root) {\n  const hasher = createHash('sha512');\n  const files = [];\n  const visit = (directory, prefix = '') => {\n    const rootStat = lstatSync(directory);\n    if (rootStat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n    if (!rootStat.isDirectory()) throw new Error('runtime tree root is not a directory');\n    for (const name of readdirSync(directory).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) {\n      const absolute = join(directory, name);\n      const relativePath = prefix ? `${prefix}/${name}` : name;\n      const stat = lstatSync(absolute);\n      if (stat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n      if (stat.isDirectory()) visit(absolute, relativePath);\n      else if (stat.isFile() && relativePath !== MANIFEST_FILE) files.push({ absolute, relativePath, size: stat.size });\n      else if (!stat.isFile()) throw new Error('runtime tree contains a non-regular file');\n    }\n  };\n  visit(root);\n  files.sort((a, b) => Buffer.compare(Buffer.from(a.relativePath), Buffer.from(b.relativePath)));\n  for (const file of files) {\n    const pathBytes = Buffer.from(file.relativePath, 'utf8');\n    hasher.update(`${pathBytes.length}:`);\n    hasher.update(pathBytes);\n    hasher.update(`:${file.size}:`);\n    hasher.update(readFileSync(file.absolute));\n    hasher.update('\\n');\n  }\n  return `sha512-${hasher.digest('base64')}`;\n}\n\nexport function atomicWriteJson(file, value) {\n  mkdirSync(dirname(file), { recursive: true });\n  const temp = join(dirname(file), `.${randomUUID()}.tmp`);\n  const fd = openSync(temp, 'wx', 0o600);\n  try {\n    writeFileSync(fd, `${JSON.stringify(value, null, 2)}\\n`, 'utf8');\n    fsyncSync(fd);\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(temp, file);\n    // A file fsync does not make the directory entry durable on POSIX. Windows\n    // cannot open directories this way, so keep the durability upgrade best-effort.\n    if (process.platform !== 'win32') {\n      try {\n        const parentFd = openSync(dirname(file), 'r');\n        try { fsyncSync(parentFd); } finally { closeSync(parentFd); }\n      } catch { /* current.json remains atomically committed */ }\n    }\n  } finally {\n    rmSync(temp, { force: true });\n  }\n}\n\nexport function readActivation(runtimeRoot) {\n  const file = join(runtimeRoot, 'current.json');\n  if (!existsSync(file)) return null;\n  try {\n    const value = JSON.parse(readFileSync(file, 'utf8'));\n    return value?.schema_version === 1 ? value : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function slotPaths(runtimeRoot, slotId) {\n  if (!SLOT_ID_RE.test(slotId)) throw new Error('invalid runtime slot id');\n  const slotRoot = join(runtimeRoot, 'slots', slotId);\n  return {\n    slotRoot,\n    entry: join(slotRoot, ENTRY_REL),\n    supervisor: join(slotRoot, SUPERVISOR_REL),\n    packageJson: join(slotRoot, PACKAGE_REL),\n    credentialHelper: join(slotRoot, CREDENTIAL_HELPER_REL),\n    manifest: join(slotRoot, MANIFEST_FILE),\n  };\n}\n\nfunction validActive(active) {\n  return active\n    && SLOT_ID_RE.test(active.slot_id)\n    && VERSION_RE.test(active.version)\n    && INTEGRITY_RE.test(active.integrity)\n    && INTEGRITY_RE.test(active.entry_sha512)\n    && INTEGRITY_RE.test(active.supervisor_sha512)\n    && INTEGRITY_RE.test(active.tree_sha512);\n}\n\nexport function validateSlot(runtimeRoot, active) {\n  if (!validActive(active)) return { ok: false, detail: 'invalid activation metadata' };\n  const paths = slotPaths(runtimeRoot, active.slot_id);\n  try {\n    const manifest = JSON.parse(readFileSync(paths.manifest, 'utf8'));\n    const pkg = JSON.parse(readFileSync(paths.packageJson, 'utf8'));\n    const expected = {\n      slot_id: active.slot_id,\n      version: active.version,\n      integrity: active.integrity,\n      entry_sha512: active.entry_sha512,\n      supervisor_sha512: active.supervisor_sha512,\n      tree_sha512: active.tree_sha512,\n    };\n    for (const [key, value] of Object.entries(expected)) {\n      if (manifest?.[key] !== value) return { ok: false, detail: `manifest ${key} mismatch` };\n    }\n    if (manifest?.schema_version !== 1 || pkg?.name !== '@algosuite/vo-mcp' || pkg?.version !== active.version) {\n      return { ok: false, detail: 'package identity mismatch' };\n    }\n    if (lstatSync(paths.entry).isSymbolicLink() || lstatSync(paths.supervisor).isSymbolicLink()\n      || lstatSync(paths.credentialHelper).isSymbolicLink()) {\n      return { ok: false, detail: 'runtime entry cannot be a link' };\n    }\n    if (!within(paths.slotRoot, realpathSync(paths.entry)) || !within(paths.slotRoot, realpathSync(paths.supervisor))\n      || !within(paths.slotRoot, realpathSync(paths.credentialHelper))) {\n      return { ok: false, detail: 'runtime entry escaped its slot' };\n    }\n    if (hashFileSha512(paths.entry) !== active.entry_sha512) return { ok: false, detail: 'entry hash mismatch' };\n    if (hashFileSha512(paths.supervisor) !== active.supervisor_sha512) return { ok: false, detail: 'supervisor hash mismatch' };\n    if (hashRuntimeTree(paths.slotRoot) !== active.tree_sha512) return { ok: false, detail: 'runtime tree hash mismatch' };\n    return { ok: true, paths, manifest };\n  } catch (error) {\n    return { ok: false, detail: error instanceof Error ? error.message : String(error) };\n  }\n}\n\nexport function journalActivation(runtimeRoot, actionId, state, detail = '') {\n  if (!ACTION_ID_RE.test(actionId)) throw new Error('invalid runner action id');\n  atomicWriteJson(join(runtimeRoot, 'transactions', `${actionId}.json`), {\n    schema_version: 1,\n    action_id: actionId,\n    state,\n    detail: String(detail).slice(0, 400),\n    updated_at: new Date().toISOString(),\n  });\n}\n\nexport function activateSlot(runtimeRoot, active, action) {\n  if (!validActive(active)) throw new Error('cannot activate invalid runtime metadata');\n  if (!ACTION_ID_RE.test(action.actionId)) throw new Error('invalid runner action id');\n  if (!UUID_RE.test(String(action.supervisorInstanceId || ''))) throw new Error('invalid claiming supervisor instance id');\n  const validated = validateSlot(runtimeRoot, active);\n  if (!validated.ok) throw new Error(`cannot activate invalid runtime slot: ${validated.detail}`);\n  const current = readActivation(runtimeRoot);\n  if (current?.pending) throw new Error('another runtime activation is still pending');\n  const pointer = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active,\n    previous: validActive(current?.active) ? current.active : null,\n    pending: {\n      action_id: action.actionId,\n      runner_id: String(action.runnerId || ''),\n      operator_id: String(action.operatorId || ''),\n      supervisor_instance_id: action.supervisorInstanceId,\n      activated_at: new Date().toISOString(),\n      ack_attempts: 0,\n    },\n  };\n  // The pointer rename is the transaction commit and therefore the last\n  // fallible write. A crash before it leaves the previous runtime selected.\n  journalActivation(runtimeRoot, action.actionId, 'prepared', `${active.version} ${active.integrity}`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n  return pointer;\n}\n\nexport function activationSupervisorInstanceId(runtimeRoot, fallback) {\n  const current = runtimeRoot ? readActivation(runtimeRoot) : null;\n  const pending = String(current?.pending?.supervisor_instance_id || '');\n  if (UUID_RE.test(pending)) return pending;\n  return UUID_RE.test(String(fallback || '')) ? fallback : null;\n}\n\nexport function recordActivationRetry(runtimeRoot, pointer, detail) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before retry');\n  }\n  const attempts = Math.max(0, Number(current.pending.ack_attempts || 0)) + 1;\n  const updated = {\n    ...current,\n    pending: { ...current.pending, ack_attempts: attempts, last_error: String(detail).slice(0, 240) },\n  };\n  atomicWriteJson(join(runtimeRoot, 'current.json'), updated);\n  journalActivation(runtimeRoot, current.pending.action_id, 'ack-retry', `attempt ${attempts}: ${detail}`);\n  return updated;\n}\n\n/** One-time migration for an old desktop launcher that has no control action. */\nexport function bootstrapSlot(runtimeRoot, active, bootstrapId) {\n  if (!ACTION_ID_RE.test(bootstrapId)) throw new Error('invalid bootstrap id');\n  const validated = validateSlot(runtimeRoot, active);\n  if (!validated.ok) throw new Error(`cannot bootstrap invalid runtime slot: ${validated.detail}`);\n  const current = readActivation(runtimeRoot);\n  if (current?.pending) throw new Error('another runtime activation is still pending');\n  if (current?.active?.slot_id === active.slot_id && current.active.integrity === active.integrity) return current;\n  const pointer = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active,\n    previous: validActive(current?.active) ? current.active : null,\n    pending: null,\n  };\n  journalActivation(runtimeRoot, bootstrapId, 'bootstrap-prepared', `${active.version} ${active.integrity}`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n  try { journalActivation(runtimeRoot, bootstrapId, 'bootstrap-activated', `${active.version} active`); } catch { /* best effort */ }\n  return pointer;\n}\n\n/** Restore the exact pre-bootstrap pointer without overwriting a newer activation. */\nexport function restoreBootstrapActivation(runtimeRoot, expectedActive, prior, rollbackId) {\n  if (!ACTION_ID_RE.test(rollbackId)) throw new Error('invalid bootstrap rollback id');\n  const current = readActivation(runtimeRoot);\n  if (current?.active?.slot_id !== expectedActive?.slot_id\n    || current?.active?.tree_sha512 !== expectedActive?.tree_sha512) {\n    throw new Error('bootstrap activation changed before rollback');\n  }\n  if (prior?.schema_version === 1) {\n    atomicWriteJson(join(runtimeRoot, 'current.json'), prior);\n  } else {\n    const quarantine = join(runtimeRoot, 'quarantine', `${rollbackId}-current.json`);\n    mkdirSync(dirname(quarantine), { recursive: true });\n    renameSync(join(runtimeRoot, 'current.json'), quarantine);\n  }\n  try { journalActivation(runtimeRoot, rollbackId, 'bootstrap-pointer-restored', expectedActive.version); }\n  catch { /* the restored pointer is authoritative */ }\n}\n\nexport function attestCurrentSupervisor({ runtimeRoot, selfPath, version }) {\n  const pointer = readActivation(runtimeRoot);\n  if (!pointer?.pending || !validActive(pointer.active)) return { ok: false, detail: 'no pending activation' };\n  const validated = validateSlot(runtimeRoot, pointer.active);\n  if (!validated.ok) return validated;\n  try {\n    if (realpathSync(selfPath) !== realpathSync(validated.paths.supervisor)) {\n      return { ok: false, detail: 'running supervisor is not the activated supervisor' };\n    }\n  } catch {\n    return { ok: false, detail: 'could not resolve running supervisor path' };\n  }\n  if (version !== pointer.active.version) return { ok: false, detail: 'running supervisor version mismatch' };\n  return { ok: true, pointer, active: pointer.active, paths: validated.paths };\n}\n\nexport function finalizeActivation(runtimeRoot, pointer) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before finalization');\n  }\n  journalActivation(runtimeRoot, pointer.pending.action_id, 'attesting', `${pointer.active.version} verified`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), {\n    schema_version: 1,\n    generation: pointer.generation,\n    active: pointer.active,\n    previous: pointer.previous || null,\n    pending: null,\n  });\n  // current.json is authoritative. A journal-only failure must never turn a\n  // committed activation into a false update failure.\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'attested', `${pointer.active.version} active`); } catch { /* best effort */ }\n}\n\nexport function rollbackActivation(runtimeRoot, pointer, detail) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before rollback');\n  }\n  journalActivation(runtimeRoot, pointer.pending.action_id, 'rolling-back', detail);\n  const rolledBack = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active: validActive(pointer?.previous) ? pointer.previous : null,\n    previous: null,\n    pending: {\n      ...pointer.pending,\n      terminal_status: 'failed',\n      terminal_detail: String(detail).slice(0, 400),\n      rolled_back_at: new Date().toISOString(),\n    },\n  };\n  atomicWriteJson(join(runtimeRoot, 'current.json'), rolledBack);\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'rolled-back', detail); } catch { /* best effort */ }\n  return rolledBack;\n}\n\nexport function acknowledgeActivationFailure(runtimeRoot, pointer) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id\n    || current?.pending?.terminal_status !== 'failed') {\n    throw new Error('runtime rollback acknowledgement obligation changed');\n  }\n  atomicWriteJson(join(runtimeRoot, 'current.json'), { ...current, pending: null });\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'failure-acknowledged', pointer.pending.terminal_detail); }\n  catch { /* current.json is authoritative */ }\n}\n\nexport const __test = { ACTION_ID_RE, ENTRY_REL, INTEGRITY_RE, SLOT_ID_RE, SUPERVISOR_REL, UUID_RE, VERSION_RE, validActive, within };\n", "/**\n * legacy-orphan-sweep \u2014 operator-triggered reclamation of agent processes\n * leaked by PRE-REAPER daemons (they never recorded their spawns, so the\n * recorded-PID orphan-agent-reaper can NEVER touch them by design).\n *\n * This is deliberately NOT automatic: it runs only when a human presses the\n * \"Clear stuck agents\" control in AlgoHQ (a governed `purge-orphans` runner\n * control action), and only a supervisor advertising the\n * `legacy-orphan-purge-v1` capability will claim one.\n *\n * Because there are no records to trust, selection is by evidence that ALL\n * hold simultaneously:\n *   1. The command line matches a RUNNER-ONLY agent spawn signature\n *      (`claude \u2026 --output-format stream-json` headless / `codex exec --json`).\n *      Interactive agent sessions and detached watchers never match.\n *   2. The parent process is dead \u2014 absent, or its pid was reused by a process\n *      created AFTER the child (an orphan's parent can never be younger).\n *      A live daemon's agents always have a live parent, so a running peer\n *      runner's work is structurally unselectable.\n *   3. The process predates the sweep cutoff (nothing racing the relaunch).\n *   4. The pid is not the supervisor itself or otherwise protected.\n * Selection is capped, oldest-first, and every kill is logged with its\n * command-line evidence. The decision core is pure and unit-tested; OS shims\n * are injected. Reuses the reaper's hardened epoch conversion + tree kill.\n */\nimport { spawnSync } from 'node:child_process';\nimport { killProcessTree, windowsPowershellExe } from './orphan-agent-reaper.mjs';\n\nexport const LEGACY_PURGE_CAPABILITY = 'legacy-orphan-purge-v1';\nexport const MAX_LEGACY_KILLS = 50;\n/** Ignore anything created within this window before the sweep (races). */\nexport const SWEEP_RECENCY_BUFFER_MS = 5_000;\n\nconst SIGNATURES = [\n  {\n    signature: 'claude-headless',\n    // claude-args.mjs always emits `-p --output-format stream-json --verbose`.\n    test: (cl) => /(?:^|[\\\\/\"\\s])claude(?:\\.exe|\\.cmd|\\.ps1)?(?:\"|\\s)/iu.test(cl) && /--output-format[\\s\"=]+stream-json/iu.test(cl),\n  },\n  {\n    signature: 'codex-headless',\n    // openai-compatible-runner always emits `exec --json`.\n    test: (cl) => /(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd|\\.ps1)?(?:\"|\\s)/iu.test(cl) && /\\bexec\\b/u.test(cl) && /--json\\b/u.test(cl),\n  },\n];\n\n/** Which runner-agent signature (if any) a raw command line matches. */\nexport function matchAgentSignature(commandLine) {\n  if (typeof commandLine !== 'string' || !commandLine) return null;\n  for (const { signature, test } of SIGNATURES) {\n    if (test(commandLine)) return signature;\n  }\n  return null;\n}\n\n/**\n * Pure selection. `processes` is an array of\n * `{ pid, ppid, creationMs, commandLine }`; returns `{ kills }` where each\n * kill is `{ pid, signature, commandLine }`, oldest-first, capped.\n */\nexport function selectLegacyOrphans({ processes, cutoffMs, protectedPids = new Set() }) {\n  const byPid = new Map();\n  for (const proc of processes) {\n    if (Number.isInteger(proc?.pid) && proc.pid > 0) byPid.set(proc.pid, proc);\n  }\n  const kills = [];\n  for (const proc of byPid.values()) {\n    if (protectedPids.has(proc.pid)) continue;\n    if (!(Number.isFinite(proc.creationMs) && proc.creationMs < cutoffMs)) continue;\n    const signature = matchAgentSignature(proc.commandLine);\n    if (!signature) continue;\n    const parent = Number.isInteger(proc.ppid) && proc.ppid > 0 ? byPid.get(proc.ppid) : undefined;\n    const parentDead = !parent || (Number.isFinite(parent.creationMs) && parent.creationMs > proc.creationMs);\n    if (!parentDead) continue;\n    kills.push({ pid: proc.pid, creationMs: proc.creationMs, signature, commandLine: proc.commandLine });\n  }\n  kills.sort((a, b) => a.creationMs - b.creationMs);\n  return { kills: kills.slice(0, MAX_LEGACY_KILLS) };\n}\n\n/** One `ps -eo pid=,ppid=,etimes=,args=` line \u2192 process row (null on junk). */\nexport function parsePosixSweepLine(line, nowMs) {\n  const match = /^\\s*(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(.+)$/u.exec(line ?? '');\n  if (!match) return null;\n  const pid = Number(match[1]);\n  if (!Number.isInteger(pid) || pid <= 0) return null;\n  return {\n    pid,\n    ppid: Number(match[2]),\n    creationMs: nowMs - Number(match[3]) * 1000,\n    commandLine: match[4],\n  };\n}\n\n/**\n * Enumerate `{ pid, ppid, creationMs, commandLine }` for every visible\n * process. Windows via CIM (one compact JSON object per line so arbitrary\n * command-line content cannot break parsing; epoch via\n * DateTimeOffset.ToUnixTimeMilliseconds() \u2014 the manual UTC-offset form was\n * empirically \u22128h and silently disabled the recorded reaper before the same\n * guard was added there). Unenumerable rows are skipped (safe direction).\n */\nexport function listProcessesForSweep({ platform = process.platform, spawn = spawnSync, nowMs = Date.now(), env = process.env, warn = console.warn } = {}) {\n  const rows = [];\n  if (platform === 'win32') {\n    const ps =\n      \"Get-CimInstance Win32_Process | Where-Object { $_.CreationDate } | ForEach-Object { @{ p = $_.ProcessId; pp = $_.ParentProcessId; c = (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()); cl = [string]$_.CommandLine } | ConvertTo-Json -Compress }\";\n    const result = spawn(windowsPowershellExe(env), ['-NoProfile', '-NonInteractive', '-Command', ps], {\n      windowsHide: true,\n      encoding: 'utf8',\n      timeout: 30_000,\n      maxBuffer: 64 * 1024 * 1024,\n    });\n    if (result.error || result.status !== 0) {\n      // Failure must remain a NO-KILL sweep (safe direction) but never a silent\n      // one: an empty enumeration is indistinguishable from \"no orphans\", so a\n      // permanently broken shim would look healthy while processes accumulate.\n      // Throwing (not returning []) makes runLegacyOrphanSweep report the\n      // operator-triggered purge action as FAILED instead of \"0 scanned\".\n      const cause = result.error ? result.error.message : `powershell exit ${result.status}`;\n      warn(`[orphan-sweep] process enumeration failed (${cause}); sweeping nothing this cycle`);\n      throw new Error(`process enumeration failed (${cause}); swept nothing`);\n    }\n    for (const line of String(result.stdout ?? '').split(/\\r?\\n/u)) {\n      if (!line.trim()) continue;\n      try {\n        const parsed = JSON.parse(line);\n        const pid = Number(parsed?.p);\n        if (!Number.isInteger(pid) || pid <= 0) continue;\n        rows.push({\n          pid,\n          ppid: Number(parsed.pp),\n          creationMs: Number(parsed.c),\n          commandLine: typeof parsed.cl === 'string' ? parsed.cl : '',\n        });\n      } catch {\n        // one unparseable row must never abort the sweep enumeration\n      }\n    }\n    return rows;\n  }\n  const result = spawn('ps', ['-eo', 'pid=,ppid=,etimes=,args='], { encoding: 'utf8', timeout: 30_000, maxBuffer: 64 * 1024 * 1024 });\n  if (result.error || result.status !== 0) {\n    const cause = result.error ? result.error.message : `ps exit ${result.status}`;\n    warn(`[orphan-sweep] process enumeration failed (${cause}); sweeping nothing this cycle`);\n    throw new Error(`process enumeration failed (${cause}); swept nothing`);\n  }\n  for (const line of String(result.stdout ?? '').split('\\n')) {\n    const row = parsePosixSweepLine(line, nowMs);\n    if (row) rows.push(row);\n  }\n  return rows;\n}\n\n/**\n * Execute the sweep. Never throws; returns\n * `{ ok, status, detail, killed: [{ pid, signature }] }` shaped for the\n * supervisor's action-completion contract. `detail` carries the evidence\n * summary that ends up on the AlgoHQ action record.\n */\nexport function runLegacyOrphanSweep({\n  nowMs = Date.now(),\n  protectedPids = [process.pid],\n  listProcesses = listProcessesForSweep,\n  killTree = killProcessTree,\n  log = () => {},\n} = {}) {\n  try {\n    const processes = listProcesses({ nowMs });\n    const { kills } = selectLegacyOrphans({\n      processes,\n      cutoffMs: nowMs - SWEEP_RECENCY_BUFFER_MS,\n      protectedPids: new Set(protectedPids),\n    });\n    const killed = [];\n    for (const kill of kills) {\n      const done = killTree(kill.pid);\n      log(`legacy-orphan-sweep ${done ? 'killed' : 'FAILED to kill'} pid=${kill.pid} sig=${kill.signature} cmd=${String(kill.commandLine).slice(0, 200)}`);\n      if (done) killed.push({ pid: kill.pid, signature: kill.signature });\n    }\n    const failed = kills.length - killed.length;\n    const detail = kills.length === 0\n      ? `no orphaned agent processes matched the sweep criteria (${processes.length} scanned)`\n      : `purged ${killed.length} of ${kills.length} orphaned agent process tree(s)${failed > 0 ? ` (${failed} kill(s) failed)` : ''}: ${killed.map((k) => `${k.pid}:${k.signature}`).join(', ').slice(0, 700)}`;\n    return { ok: true, status: 0, detail, killed };\n  } catch (error) {\n    return { ok: false, status: 1, detail: `legacy sweep error: ${error instanceof Error ? error.message : String(error)}`.slice(0, 500), killed: [] };\n  }\n}\n", "/**\n * Orphaned-agent process reaper.\n *\n * The runner spawns agent CLIs (claude/codex/\u2026) as child processes. When the\n * DAEMON itself restarts (crash, `update`/`reinstall` control, host reboot mid-\n * task), any still-running agent children are detached from the new daemon and\n * are never reclaimed \u2014 they leak RAM until the machine is rebooted. The\n * existing `terminal-process-cleanup` only kills the child the CURRENT process\n * still tracks; it deliberately never scans for unrelated processes.\n *\n * This module closes that gap SAFELY. Every spawned agent records its pid, its\n * spawning daemon instance id, and its spawn time under a per-instance registry\n * directory. On daemon startup the reaper considers only OTHER instances'\n * records and kills a process ONLY when ALL of these hold:\n *\n *   1. the recording daemon instance is provably DEAD (its recorded daemon pid\n *      is not live, or its creation time no longer matches) \u2014 so a concurrent\n *      live peer runner's agents are never touched;\n *   2. the agent pid is still live; AND\n *   3. the live process's OS creation time still matches the recorded spawn\n *      time within tolerance \u2014 so a REUSED pid (now some innocent process)\n *      is never killed.\n *\n * It never matches by process name and never touches a pid it did not itself\n * record. Decision logic is pure (`selectOrphanKills`) and fully unit-tested;\n * the OS shims (`listProcessCreationTimes`, `killProcessTree`) are injected.\n */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nconst REGISTRY_ROOT_NAME = 'algohq-runner-agent-pids';\nconst DAEMON_RECORD = 'daemon.json';\n/** A reused pid is created long after the original; 30s covers spawn/clock skew. */\nexport const CREATION_MATCH_TOLERANCE_MS = 30_000;\n\nexport function registryRoot(tmp = os.tmpdir()) {\n  return path.join(tmp, REGISTRY_ROOT_NAME);\n}\n\nfunction instanceDir(root, instanceId) {\n  return path.join(root, String(instanceId).replace(/[^A-Za-z0-9_-]/g, ''));\n}\n\n/** Record this daemon instance so peers can tell it is alive vs. orphaned. */\nexport function registerDaemonInstance({\n  root = registryRoot(),\n  instanceId,\n  daemonPid = process.pid,\n  daemonStartedAtMs = Date.now(),\n} = {}) {\n  if (!instanceId) return null;\n  const dir = instanceDir(root, instanceId);\n  mkdirSync(dir, { recursive: true });\n  const file = path.join(dir, DAEMON_RECORD);\n  writeFileSync(file, JSON.stringify({ daemonPid, daemonStartedAtMs, instanceId }), {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  return file;\n}\n\n/** Record a spawned agent's pid under its daemon instance. Never throws. */\nexport function recordAgentPid({\n  root = registryRoot(),\n  instanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  pid,\n  agentId = '',\n  startedAtMs = Date.now(),\n} = {}) {\n  if (!instanceId || !Number.isInteger(pid) || pid <= 0) return false;\n  try {\n    const dir = instanceDir(root, instanceId);\n    mkdirSync(dir, { recursive: true });\n    writeFileSync(\n      path.join(dir, `${pid}.json`),\n      JSON.stringify({ pid, agentId, startedAtMs, instanceId }),\n      { encoding: 'utf8', mode: 0o600 },\n    );\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Drop an agent record once its own process tree has been reaped. Never throws. */\nexport function unrecordAgentPid({\n  root = registryRoot(),\n  instanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  pid,\n} = {}) {\n  if (!instanceId || !Number.isInteger(pid)) return false;\n  try {\n    rmSync(path.join(instanceDir(root, instanceId), `${pid}.json`), { force: true });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * One-call daemon startup hook: publishes this instance id (so in-process\n * spawns can self-record), records the daemon, and reaps orphaned agent trees\n * left by dead prior instances. Synchronous and swallow-safe \u2014 never blocks the\n * runner from coming up.\n */\nexport function bootstrapOrphanReaper({ instanceId, log = () => {} } = {}) {\n  if (!instanceId) return { killed: 0, prunedDirs: 0 };\n  process.env.VO_RUNNER_INSTANCE_ID = instanceId;\n  try {\n    registerDaemonInstance({ instanceId });\n  } catch {\n    /* best effort \u2014 reap still runs */\n  }\n  return reapOrphanedAgents({ currentInstanceId: instanceId, log });\n}\n\n/** Read every instance's records from disk into the shape selectOrphanKills wants. */\nexport function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {\n  const instances = [];\n  if (!existsSync(root)) return instances;\n  let dirents;\n  try {\n    dirents = readdirSync(root, { withFileTypes: true });\n  } catch {\n    return instances;\n  }\n  for (const dirent of dirents) {\n    if (!dirent.isDirectory()) continue;\n    if (currentInstanceId && dirent.name === instanceDirName(currentInstanceId)) continue;\n    const dir = path.join(root, dirent.name);\n    let daemon = null;\n    const agents = [];\n    let files;\n    try {\n      files = readdirSync(dir);\n    } catch {\n      continue;\n    }\n    for (const name of files) {\n      let parsed;\n      try {\n        parsed = JSON.parse(readFileSync(path.join(dir, name), 'utf8'));\n      } catch {\n        continue;\n      }\n      if (name === DAEMON_RECORD) {\n        if (Number.isInteger(parsed?.daemonPid)) {\n          daemon = { pid: parsed.daemonPid, startedAtMs: Number(parsed.daemonStartedAtMs) || 0 };\n        }\n      } else if (Number.isInteger(parsed?.pid)) {\n        agents.push({ pid: parsed.pid, agentId: String(parsed.agentId || ''), startedAtMs: Number(parsed.startedAtMs) || 0 });\n      }\n    }\n    instances.push({ instanceId: dirent.name, dir, daemon, agents });\n  }\n  return instances;\n}\n\nfunction instanceDirName(instanceId) {\n  return String(instanceId).replace(/[^A-Za-z0-9_-]/g, '');\n}\n\nfunction creationMatches(live, recordedStartedAtMs, toleranceMs) {\n  if (!live || !Number.isFinite(live.creationMs)) return false;\n  if (!Number.isFinite(recordedStartedAtMs) || recordedStartedAtMs <= 0) return false;\n  return Math.abs(live.creationMs - recordedStartedAtMs) <= toleranceMs;\n}\n\n/**\n * PURE decision core. Given the on-disk registry (other instances only) and a\n * map of live pid \u2192 { creationMs }, decide which pids to kill and which\n * instance dirs to prune.\n *\n * - An instance whose daemon record is still live (pid alive + creation match)\n *   is a running PEER: skip it entirely (no kills, no prune).\n * - Otherwise the instance is dead: kill each recorded agent that is still live\n *   AND whose creation time matches (guards pid reuse), then prune its dir.\n */\nexport function selectOrphanKills({ instances = [], liveProcesses = new Map(), toleranceMs = CREATION_MATCH_TOLERANCE_MS } = {}) {\n  const kills = [];\n  const pruneDirs = [];\n  for (const instance of instances) {\n    // Require a PRESENT daemon record before killing anything. Without it we\n    // cannot distinguish a truly-crashed instance from a peer that just created\n    // its dir and has not written daemon.json yet, so we conservatively prune\n    // the stale/malformed dir but never kill. (registerDaemonInstance writes\n    // daemon.json before any agent is spawned, so a real instance with agent\n    // records always has one.)\n    if (!instance.daemon) {\n      if (instance.dir) pruneDirs.push(instance.dir);\n      continue;\n    }\n    const daemonLive =\n      liveProcesses.has(instance.daemon.pid) &&\n      creationMatches(liveProcesses.get(instance.daemon.pid), instance.daemon.startedAtMs, toleranceMs);\n    if (daemonLive) continue; // live peer runner \u2014 never touch its agents\n    for (const agent of instance.agents) {\n      const live = liveProcesses.get(agent.pid);\n      if (live && creationMatches(live, agent.startedAtMs, toleranceMs)) {\n        kills.push({ pid: agent.pid, agentId: agent.agentId, instanceId: instance.instanceId });\n      }\n    }\n    if (instance.dir) pruneDirs.push(instance.dir);\n  }\n  return { kills, pruneDirs };\n}\n\nfunction windowsSystemRoot(env = process.env) {\n  return env.SystemRoot || env.WINDIR || 'C:\\\\Windows';\n}\n\n/**\n * Absolute Windows PowerShell path. Never resolve `powershell` from PATH: the\n * reaper runs with the daemon's privileges, so a PATH-planted powershell.exe\n * would receive every process command line on the host. Same resolution as\n * runner-bootstrap/windows-bound-process-termination.mjs.\n */\nexport function windowsPowershellExe(env = process.env) {\n  return path.join(windowsSystemRoot(env), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');\n}\n\n/** Windows: map every process to its creation time in epoch ms via CIM. */\nexport function listProcessCreationTimes({ platform = process.platform, spawn = spawnSync, env = process.env, warn = console.warn } = {}) {\n  const map = new Map();\n  if (platform === 'win32') {\n    // Epoch conversion via DateTimeOffset.ToUnixTimeMilliseconds() \u2014 the manual\n    // `(CreationDate - Get-Date '1970-01-01Z')` form is off by the local UTC\n    // offset (empirically \u22128h on a PST host), which would push every creation\n    // time outside the match window and silently disable the reaper.\n    const ps =\n      \"Get-CimInstance Win32_Process | ForEach-Object { '{0} {1}' -f $_.ProcessId, (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()) }\";\n    const result = spawn(windowsPowershellExe(env), ['-NoProfile', '-NonInteractive', '-Command', ps], {\n      windowsHide: true,\n      encoding: 'utf8',\n      timeout: 20_000,\n      maxBuffer: 32 * 1024 * 1024,\n    });\n    if (result.error || result.status !== 0 || typeof result.stdout !== 'string') {\n      // An enumeration failure must stay a NO-KILL cycle (safe direction), but\n      // never a silent one \u2014 a permanently failing shim reads as \"no orphans\"\n      // and the fleet leaks agent processes until reboot.\n      warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `powershell exit ${result.status}`}); reaping nothing this cycle`);\n      return map;\n    }\n    for (const line of result.stdout.split(/\\r?\\n/)) {\n      const m = line.trim().match(/^(\\d+)\\s+(-?\\d+)$/);\n      if (m) map.set(Number(m[1]), { creationMs: Number(m[2]) });\n    }\n    return map;\n  }\n  // POSIX: ps lstart \u2192 epoch ms (macOS/Linux runner). Windows is the primary\n  // target and is verified end-to-end; this branch is validated via the pure\n  // parsePosixPsLine() unit tests.\n  const result = spawn('ps', ['-eo', 'pid=,lstart='], { encoding: 'utf8', timeout: 20_000, maxBuffer: 32 * 1024 * 1024 });\n  if (result.error || result.status !== 0 || typeof result.stdout !== 'string') {\n    warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `ps exit ${result.status}`}); reaping nothing this cycle`);\n    return map;\n  }\n  for (const line of result.stdout.split(/\\r?\\n/)) {\n    const parsed = parsePosixPsLine(line);\n    if (parsed) map.set(parsed.pid, { creationMs: parsed.creationMs });\n  }\n  return map;\n}\n\n/**\n * Parse one `ps -eo pid=,lstart=` line into { pid, creationMs } or null.\n * Handles padded pids, the single-digit-day double space (\"Mon Jan  5 \u2026\"), and\n * unparseable lines (\u2192 null, so the caller skips them \u2014 the safe direction).\n */\nexport function parsePosixPsLine(line) {\n  const trimmed = String(line ?? '').trim();\n  const sp = trimmed.indexOf(' ');\n  if (sp <= 0) return null;\n  const pid = Number(trimmed.slice(0, sp));\n  const when = Date.parse(trimmed.slice(sp + 1).trim());\n  if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(when)) return null;\n  return { pid, creationMs: when };\n}\n\n/** Kill an exact pid's whole tree. Windows taskkill /T /F, else SIGKILL by pgid. */\nexport function killProcessTree(pid, { platform = process.platform, spawn = spawnSync, env = process.env } = {}) {\n  if (!Number.isInteger(pid) || pid <= 0) return false;\n  if (platform === 'win32') {\n    // Absolute path for the same reason as windowsPowershellExe(): a PATH-planted\n    // taskkill.exe would execute with daemon privileges and could silently no-op\n    // every kill while the sweep logs success.\n    const taskkill = path.join(windowsSystemRoot(env), 'System32', 'taskkill.exe');\n    const r = spawn(taskkill, ['/PID', String(pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore', timeout: 15_000 });\n    return !r.error && r.status === 0;\n  }\n  try {\n    process.kill(-pid, 'SIGKILL');\n    return true;\n  } catch {\n    try {\n      process.kill(pid, 'SIGKILL');\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n\n/**\n * EFFECTFUL entry point: run at daemon startup. Reaps orphaned agent trees from\n * dead prior instances and prunes their registry dirs. Never throws \u2014 a reaper\n * failure must not block the runner from coming up.\n */\nexport function reapOrphanedAgents({\n  root = registryRoot(),\n  currentInstanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  toleranceMs = CREATION_MATCH_TOLERANCE_MS,\n  listProcesses = listProcessCreationTimes,\n  killTree = killProcessTree,\n  log = () => {},\n} = {}) {\n  try {\n    const instances = readRegistry({ root, currentInstanceId });\n    if (instances.length === 0) return { killed: 0, prunedDirs: 0 };\n    const liveProcesses = listProcesses();\n    const { kills, pruneDirs } = selectOrphanKills({ instances, liveProcesses, toleranceMs });\n    let killed = 0;\n    for (const kill of kills) {\n      if (killTree(kill.pid)) {\n        killed += 1;\n        log(`reaped orphaned agent pid ${kill.pid}${kill.agentId ? ` (${kill.agentId})` : ''} from dead instance ${kill.instanceId}`);\n      }\n    }\n    let prunedDirs = 0;\n    for (const dir of pruneDirs) {\n      try {\n        rmSync(dir, { recursive: true, force: true });\n        prunedDirs += 1;\n      } catch {\n        /* leave it; next startup retries */\n      }\n    }\n    if (killed > 0 || prunedDirs > 0) log(`orphan reap: killed ${killed} agent tree(s), pruned ${prunedDirs} dead instance record(s)`);\n    return { killed, prunedDirs };\n  } catch (error) {\n    log(`orphan reap skipped: ${error instanceof Error ? error.message : String(error)}`);\n    return { killed: 0, prunedDirs: 0 };\n  }\n}\n", "import {\n  acknowledgeActivationFailure,\n  attestCurrentSupervisor,\n  finalizeActivation,\n  readActivation,\n  recordActivationRetry,\n  rollbackActivation,\n  validateSlot,\n} from './bundled-runtime-store.mjs';\n\nconst MAX_ACK_ATTEMPTS = 3;\nconst delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nexport async function waitForAuthoritativeRunnerHeartbeat({\n  client,\n  runnerId,\n  operatorId,\n  runnerInstanceId,\n  excludeRunnerInstanceId,\n  daemonVersion,\n  supervisorIdentity,\n  timeoutMs = 60_000,\n  pollMs = 1_000,\n}) {\n  if (!runnerInstanceId && !excludeRunnerInstanceId) throw new Error('runner instance identity proof unavailable');\n  const deadline = Date.now() + timeoutMs;\n  while (Date.now() < deadline) {\n    try {\n      const runners = await client.getRunnerStatus({ ...(operatorId ? { operatorId } : {}) });\n      const runner = runners.find((item) => item?.runner_id === runnerId\n        && item.status === 'online'\n        && (runnerInstanceId\n          ? item.runner_meta?.runner_instance_id === runnerInstanceId\n          : Boolean(item.runner_meta?.runner_instance_id)\n            && item.runner_meta.runner_instance_id !== excludeRunnerInstanceId)\n        && item.runner_meta?.daemon_version === daemonVersion\n        && item.runner_meta?.supervisor_instance_id === supervisorIdentity.supervisorInstanceId\n        && item.runner_meta?.supervisor_version === supervisorIdentity.supervisorVersion\n        && supervisorIdentity.capabilities.every((value) => item.runner_meta?.supervisor_capabilities?.includes(value))\n        && Array.isArray(item.runner_meta?.available_agents)\n        // The default agent must be INSTALLED for the activated runtime to be the\n        // one that will serve. Whether it is AUTHENTICATED is a serving gate the\n        // heartbeat already reports (available_agents[].authenticated) and the\n        // plane already dispatches on; it is not part of the runtime's identity.\n        // Requiring it here made an expired or never-done agent login fail every\n        // activation closed: the child was stopped after 60 s, the supervisor\n        // degraded, and the host went silent until a human restarted the app\n        // (FintonLaptop, 2026-09-04: claude installed, authenticated:false).\n        && item.runner_meta.available_agents.some((agent) => agent.agent === item.runner_meta.default_agent\n          && agent.installed === true));\n      if (runner) return runner;\n    } catch { /* bounded retry */ }\n    await delay(pollMs);\n  }\n  throw new Error('authoritative child heartbeat attestation timed out');\n}\n\n/**\n * Complete a slot handoff only from the activated package and logical Tauri\n * supervisor lease. Local path/version/hash and child readiness are proven\n * before a cloud heartbeat or terminal action acknowledgement is emitted.\n */\nexport async function finishPendingActivation({\n  client,\n  child,\n  runtimeRoot,\n  operatorId,\n  runnerId,\n  selfPath,\n  packageVersion,\n  supervisorIdentity,\n  waitForLocalRunner,\n  isReadinessDeferred = () => false,\n  localStatus,\n  waitForCloudRunner = waitForAuthoritativeRunnerHeartbeat,\n  cloudTimeoutMs,\n  cloudPollMs,\n  stopChild,\n  launchPreviousChild,\n  log = () => {},\n}) {\n  const pointer = runtimeRoot ? readActivation(runtimeRoot) : null;\n  if (!pointer?.pending) return true;\n  const runnerIdForAction = pointer.pending.runner_id || runnerId;\n  const operatorIdForAction = pointer.pending.operator_id || operatorId;\n  if (pointer.pending.terminal_status === 'failed') {\n    try {\n      await client.completeRunnerControl(pointer.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail: pointer.pending.terminal_detail,\n      });\n      acknowledgeActivationFailure(runtimeRoot, pointer);\n      return true;\n    } catch (error) {\n      log(`activation failure acknowledgement remains pending: ${error instanceof Error ? error.message : String(error)}`);\n      await stopChild(child);\n      return false;\n    }\n  }\n  let attestation;\n  try {\n    attestation = attestCurrentSupervisor({ runtimeRoot, selfPath, version: packageVersion });\n    if (!attestation.ok) throw new Error(attestation.detail);\n    if (!(await waitForLocalRunner(child))) {\n      // A supervisor-authenticated exit-75 readiness embargo is neither a bad\n      // runtime nor an attestation failure. Preserve the active/pending pointer\n      // exactly; the supervisor will re-probe and retry this same slot later.\n      if (isReadinessDeferred(child)) return false;\n      throw new Error('activated runner did not become locally ready');\n    }\n  } catch (error) {\n    let detail = `activation attestation failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n    let rolledBack = null;\n    try {\n      rolledBack = rollbackActivation(runtimeRoot, pointer, detail);\n    } catch (rollbackError) {\n      detail = `${detail}; rollback pending: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n    }\n    try {\n      await client.completeRunnerControl(pointer.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail,\n      });\n      if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n    } catch {\n      // current.json retains the terminal acknowledgement obligation.\n    } finally {\n      await stopChild(child);\n    }\n    return false;\n  }\n\n  let activatedRunnerInstanceId = null;\n  try {\n    const status = await localStatus();\n    activatedRunnerInstanceId = status?.runnerInstanceId || null;\n    await waitForCloudRunner({\n      client,\n      runnerId: runnerIdForAction,\n      operatorId: operatorIdForAction,\n      runnerInstanceId: status?.runnerInstanceId,\n      daemonVersion: `vo-mcp/${attestation.active.version}`,\n      supervisorIdentity,\n      timeoutMs: cloudTimeoutMs,\n      pollMs: cloudPollMs,\n    });\n    await client.completeRunnerControl(pointer.pending.action_id, {\n      runnerId: runnerIdForAction,\n      ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n      ...supervisorIdentity,\n      status: 'succeeded',\n      detail: `attested new supervisor ${attestation.active.version} ${attestation.active.integrity}`,\n    });\n    finalizeActivation(runtimeRoot, attestation.pointer);\n    return true;\n  } catch (error) {\n    const failure = `activation acknowledgement failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n    let retry;\n    try { retry = recordActivationRetry(runtimeRoot, attestation.pointer, failure); }\n    catch (retryError) {\n      log(`activation retry could not be recorded: ${retryError instanceof Error ? retryError.message : String(retryError)}`);\n      await stopChild(child);\n      return false;\n    }\n    if (retry.pending.ack_attempts < MAX_ACK_ATTEMPTS) {\n      log(`activation acknowledgement pending (${retry.pending.ack_attempts}/${MAX_ACK_ATTEMPTS})`);\n      await stopChild(child);\n      return false;\n    }\n\n    const previous = validateSlot(runtimeRoot, retry.previous);\n    let detail = `${failure}; retry limit reached; previous runtime restored`.slice(0, 400);\n    let rollbackChild = null;\n    let rolledBack = null;\n    try {\n      if (!previous.ok) throw new Error(`previous runtime invalid: ${previous.detail}`, { cause: error });\n      rolledBack = rollbackActivation(runtimeRoot, retry, detail);\n      await stopChild(child);\n      rollbackChild = launchPreviousChild(previous.paths.entry);\n      if (!(await waitForLocalRunner(rollbackChild))) throw new Error('previous runner did not become locally ready', { cause: error });\n      const status = await localStatus();\n      await waitForCloudRunner({\n        client,\n        runnerId: runnerIdForAction,\n        operatorId: operatorIdForAction,\n        runnerInstanceId: status?.runnerInstanceId,\n        excludeRunnerInstanceId: status?.runnerInstanceId ? undefined : activatedRunnerInstanceId,\n        daemonVersion: `vo-mcp/${retry.previous.version}`,\n        supervisorIdentity,\n        timeoutMs: cloudTimeoutMs,\n        pollMs: cloudPollMs,\n      });\n    } catch (rollbackError) {\n      detail = `${detail}; rollback proof failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n    }\n    try {\n      await client.completeRunnerControl(retry.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail,\n      });\n      if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n    } catch { /* current.json retains the terminal acknowledgement obligation */ }\n    if (rollbackChild) await stopChild(rollbackChild);\n    else await stopChild(child);\n    return false;\n  }\n}\n\nexport const __test = { MAX_ACK_ATTEMPTS };\n", "/**\n * Resolve the runner child entry on EVERY (re)spawn instead of once at module\n * load.\n *\n * The supervisor used to compute `join(dirname(selfPath), 'runner-cli.js')` at\n * module scope and reuse that single path for every child it ever spawned. A\n * staged runtime slot could therefore be activated (current.json rewritten,\n * child restarted) and the host would keep running the OLD daemon until the\n * whole desktop app was restarted \u2014 which nothing forces. That is the same\n * silently-inert-update class as the 2026-08-06 slot-cache-poisoning incident:\n * the update reports success, the bytes on disk are new, and the process\n * serving work is unchanged.\n *\n * Rules encoded here:\n *  - Re-read the activation pointer on every call; never cache.\n *  - Fall back to the bundled self-relative entry whenever there is no slot,\n *    the pointer is unreadable, an activation is still mid-transaction, or the\n *    slot fails full hash validation. Fail closed, never fail open.\n *  - NEVER downgrade: an active slot older than (or equal to) the bundled\n *    version keeps the bundled path. Mirrors the strictly-newer compare in\n *    cloud-run/vo-control-plane/src/routes/runner-auto-update.ts.\n */\nimport { readActivation, validateSlot } from './bundled-runtime-store.mjs';\n\n/** Tolerates an optional \"name/\" prefix so `vo-mcp/0.2.0` parses too. */\nconst VERSION_RE = /^(?:[\\w.-]+\\/)?(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?$/u;\n\nexport function parseRuntimeVersion(value) {\n  if (typeof value !== 'string') return null;\n  const match = VERSION_RE.exec(value.trim());\n  if (!match) return null;\n  const prerelease = match[4]\n    ? match[4].split('.').map((part) => (/^\\d+$/u.test(part) ? Number(part) : part))\n    : null;\n  return { release: [Number(match[1]), Number(match[2]), Number(match[3])], prerelease };\n}\n\n/** semver-style compare: -1 when a < b, 0 when equal, 1 when a > b. */\nexport function compareRuntimeVersions(a, b) {\n  for (let i = 0; i < 3; i += 1) {\n    const av = a.release[i] ?? 0;\n    const bv = b.release[i] ?? 0;\n    if (av !== bv) return av < bv ? -1 : 1;\n  }\n  if (!a.prerelease && !b.prerelease) return 0;\n  if (!a.prerelease) return 1; // release > any prerelease of the same core\n  if (!b.prerelease) return -1;\n  const len = Math.max(a.prerelease.length, b.prerelease.length);\n  for (let i = 0; i < len; i += 1) {\n    const av = a.prerelease[i];\n    const bv = b.prerelease[i];\n    if (av === undefined) return -1; // shorter prerelease sorts first\n    if (bv === undefined) return 1;\n    if (av === bv) continue;\n    const aNum = typeof av === 'number';\n    const bNum = typeof bv === 'number';\n    if (aNum && bNum) return av < bv ? -1 : 1;\n    if (aNum !== bNum) return aNum ? -1 : 1; // numeric identifiers sort first\n    return String(av) < String(bv) ? -1 : 1;\n  }\n  return 0;\n}\n\n/**\n * @returns {{ args: string[], entry: string, source: 'bundled'|'active-slot',\n *   version: string, descriptor: string, detail: string }}\n *   `descriptor` is a stable identity for change detection/logging.\n */\nexport function resolveSupervisorChildEntry({\n  runtimeRoot,\n  bundledEntry,\n  bundledVersion,\n  readPointer = readActivation,\n  validate = validateSlot,\n}) {\n  const bundled = (detail) => ({\n    // The bundled entry is `dist/runner-cli.js`, which IS the daemon and takes\n    // no subcommand. The slot entry is `bin/vo-mcp`, the multiplexed CLI, which\n    // needs the `runner` subcommand \u2014 the same argv the proven rollback path\n    // (`launchPreviousChild`) uses.\n    args: [bundledEntry],\n    entry: bundledEntry,\n    source: 'bundled',\n    version: String(bundledVersion || 'unknown'),\n    descriptor: `bundled ${bundledVersion || 'unknown'} ${bundledEntry}`,\n    detail,\n  });\n\n  if (!runtimeRoot) return bundled('no runtime root');\n\n  let pointer;\n  try {\n    pointer = readPointer(runtimeRoot);\n  } catch (error) {\n    return bundled(`activation pointer unreadable: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  if (!pointer?.active) return bundled('no activated runtime slot');\n  // Mid-transaction. finishPendingActivation() owns that handoff (it attests\n  // from the NEW supervisor process); adopting the slot here would run a new\n  // daemon under an un-attested old supervisor.\n  if (pointer.pending) return bundled('runtime activation still pending');\n\n  const activeVersion = parseRuntimeVersion(pointer.active.version);\n  const currentVersion = parseRuntimeVersion(bundledVersion);\n  // An unparseable version on either side means the never-downgrade rule cannot\n  // be PROVEN, so it is enforced by refusing the slot.\n  if (!activeVersion) return bundled(`active slot version unparseable: ${String(pointer.active.version)}`);\n  if (!currentVersion) return bundled(`bundled version unparseable: ${String(bundledVersion)}`);\n  if (compareRuntimeVersions(activeVersion, currentVersion) <= 0) {\n    return bundled(`active slot ${pointer.active.version} is not newer than bundled ${bundledVersion}`);\n  }\n\n  let validated;\n  try {\n    validated = validate(runtimeRoot, pointer.active);\n  } catch (error) {\n    return bundled(`slot validation threw: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  if (!validated?.ok) return bundled(`active slot invalid: ${validated?.detail || 'unknown'}`);\n\n  const entry = validated.paths.entry;\n  return {\n    args: [entry, 'runner'],\n    entry,\n    source: 'active-slot',\n    version: pointer.active.version,\n    descriptor: `active-slot ${pointer.active.version} ${entry}`,\n    detail: `activated slot ${pointer.active.slot_id}`,\n  };\n}\n", "/**\n * Drain in-flight code tasks BEFORE a staged update restarts the runner child.\n *\n * Incident 2026-08-30 ~08:0x: both fleet runners (FintonLaptop, JacksPC)\n * restarted near-simultaneously on a staged-update delivery and killed the\n * in-flight continuations of two tasks (7f98ab24 at preparing_worktree,\n * 2c7ea978 at agent_working). Both went status=failed with NO error_message on\n * the plane, and both runners heartbeated fresh seconds later \u2014 so the plane\n * recorded a silent death with no cause. Cost: two $2 recovery resumes.\n *\n * The pre-existing guard in runner-supervisor.mjs was a SINGLE check that\n * failed the control action outright, and it read\n * `beforeStop && activeTasks > 0` \u2014 an unreadable `/status` (null) fell\n * through to the restart, which is exactly the fail-open shape that kills work.\n *\n * What this module changes, and nothing else (the two-track staging/delivery\n * mechanism is untouched \u2014 this gates only the APPLICATION of the restart):\n *  - update/reinstall actions WAIT for the child to go idle, re-checking on an\n *    interval, instead of failing the action on the first busy check.\n *  - An unreadable `/status` from a RUNNING child counts as busy, not idle.\n *    A child that is not running has nothing to drain and proceeds at once, so\n *    the supervisor's only remote repair channel can never be self-blocked.\n *  - The wait is hard-capped (default 45 min). At the cap the restart proceeds,\n *    but every in-flight task is first marked terminal on the plane with a\n *    message that NAMES the update restart. Never kill silently.\n *  - Non-update control actions (repair/maintenance/purge) keep the legacy\n *    single-check defer, including its legacy fail-open on an unreadable\n *    status: blocking remote repair for up to 45 minutes behind an\n *    unresponsive status port would be a worse failure than the one fixed here.\n *\n * Task ids come from the runner's OWN in-flight registry, surfaced on\n * `GET /status` as `activeTaskIds` (scripts/virtual-office/code-runner-daemon.mjs\n * \u2192 control-server.mjs). The same status snapshot carries `runnerId` /\n * `runnerInstanceId`, which the terminal patch MUST echo: the plane rejects a\n * protocol-v2 progress patch that omits them\n * (cloud-run/vo-control-plane/src/storage/code-task-progress-merge.ts:63).\n */\n\nexport const DEFAULT_DRAIN_CAP_MS = 45 * 60 * 1000;\nexport const DEFAULT_DRAIN_CHECK_MS = 30_000;\nconst MAX_DRAIN_CAP_MS = 6 * 60 * 60 * 1000;\nconst MIN_DRAIN_CHECK_MS = 1_000;\nconst MAX_DRAIN_CHECK_MS = 5 * 60 * 1000;\n\n/** Terminal message + result stamped on tasks killed by a capped drain. */\nexport const UPDATE_RESTART_ERROR_MESSAGE = 'runner update restart after drain timeout';\nexport const UPDATE_RESTART_RESULT = 'runner_update_restart';\n\nconst sleepMs = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nfunction positiveNumber(raw) {\n  if (raw === undefined || raw === null || String(raw).trim() === '') return null;\n  const value = Number(raw);\n  return Number.isFinite(value) && value >= 0 ? value : null;\n}\n\n/**\n * `VO_RUNNER_UPDATE_DRAIN_CAP_MIN` (minutes) is the operator-facing knob;\n * `VO_RUNNER_UPDATE_DRAIN_CAP_MS` wins when both are set (tests use it).\n * 0 disables draining entirely \u2014 the restart proceeds immediately, but the\n * cap path still marks in-flight tasks, so nothing dies unexplained.\n */\nexport function resolveDrainCapMs(env = {}) {\n  const ms = positiveNumber(env.VO_RUNNER_UPDATE_DRAIN_CAP_MS);\n  if (ms !== null) return Math.min(ms, MAX_DRAIN_CAP_MS);\n  const minutes = positiveNumber(env.VO_RUNNER_UPDATE_DRAIN_CAP_MIN);\n  if (minutes !== null) return Math.min(minutes * 60_000, MAX_DRAIN_CAP_MS);\n  return DEFAULT_DRAIN_CAP_MS;\n}\n\nexport function resolveDrainCheckMs(env = {}) {\n  const ms = positiveNumber(env.VO_RUNNER_UPDATE_DRAIN_CHECK_MS);\n  if (ms === null) return DEFAULT_DRAIN_CHECK_MS;\n  return Math.min(Math.max(ms, MIN_DRAIN_CHECK_MS), MAX_DRAIN_CHECK_MS);\n}\n\n/**\n * Normalize one `/status` snapshot into the drain view.\n * `known:false` means \"a child is running but did not answer\" \u2014 busy for the\n * update path, idle for the legacy path (see the module header).\n * @returns {{ count: number, ids: string[], known: boolean,\n *   runnerId: string|null, runnerInstanceId: string|null }}\n */\nexport function readActiveTasks(status, { childRunning = true } = {}) {\n  if (!childRunning) {\n    return { count: 0, ids: [], known: true, runnerId: null, runnerInstanceId: null };\n  }\n  if (!status || status.ok === false) {\n    return { count: 0, ids: [], known: false, runnerId: null, runnerInstanceId: null };\n  }\n  const ids = Array.isArray(status.activeTaskIds)\n    ? status.activeTaskIds.map((id) => String(id)).filter(Boolean)\n    : [];\n  const reported = Number(status.activeTasks);\n  const count = Number.isFinite(reported) && reported >= 0 ? reported : ids.length;\n  return {\n    count: Math.max(count, ids.length),\n    ids,\n    known: true,\n    runnerId: status.runnerId ? String(status.runnerId) : null,\n    runnerInstanceId: status.runnerInstanceId ? String(status.runnerInstanceId) : null,\n  };\n}\n\n/**\n * Pure one-iteration decision.\n * @returns {{ action: 'proceed'|'wait'|'cap', busy: number|'unknown' }}\n */\nexport function decideDrainStep({ active, elapsedMs, capMs }) {\n  const busy = active.known ? active.count : 'unknown';\n  if (active.known && active.count === 0) return { action: 'proceed', busy };\n  if (elapsedMs >= capMs) return { action: 'cap', busy };\n  return { action: 'wait', busy };\n}\n\nfunction describeBusy(active) {\n  if (!active.known) return 'status unreadable from a running child (assumed busy)';\n  const ids = active.ids.length > 0 ? ` [${active.ids.join(', ')}]` : ' [ids unavailable]';\n  return `${active.count} active task(s)${ids}`;\n}\n\nasync function markCappedTasks({ active, failInFlightTask, log }) {\n  if (active.ids.length === 0) {\n    if (active.count > 0 || !active.known) {\n      log(`update drain cap reached with ${describeBusy(active)} \u2014 cannot annotate tasks the runner did not name`);\n    }\n    return [];\n  }\n  const marked = [];\n  for (const taskId of active.ids) {\n    try {\n      await failInFlightTask(taskId, {\n        message: UPDATE_RESTART_ERROR_MESSAGE,\n        result: UPDATE_RESTART_RESULT,\n        runnerId: active.runnerId,\n        runnerInstanceId: active.runnerInstanceId,\n      });\n      marked.push(taskId);\n    } catch (error) {\n      log(`could not mark task ${taskId} before update restart: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  return marked;\n}\n\n/**\n * Gate the application of a staged-update restart on the runner going idle.\n *\n * @param {object} options\n * @param {() => Promise<object|null>} options.readStatus   local `GET /status`\n * @param {() => boolean} options.isChildRunning            live child liveness\n * @param {(taskId: string, patch: object) => Promise<unknown>} options.failInFlightTask\n * @param {boolean} options.drainable  true only for update/reinstall actions\n * @param {object} [options.env]       cap/interval knobs\n * @param {() => number} [options.now] injected clock (tests)\n * @param {(ms: number) => Promise<void>} [options.sleep] injected sleep (tests)\n * @param {(message: string) => void} [options.log]\n * @returns {Promise<{ proceed: boolean, detail: string, capped: boolean,\n *   waitedMs: number, checks: number, markedTaskIds: string[] }>}\n */\nexport async function awaitRunnerUpdateDrain({\n  readStatus,\n  isChildRunning = () => true,\n  failInFlightTask = async () => {},\n  drainable = false,\n  env = {},\n  now = Date.now,\n  sleep = sleepMs,\n  log = () => {},\n} = {}) {\n  const capMs = resolveDrainCapMs(env);\n  const checkMs = resolveDrainCheckMs(env);\n  const startedAt = now();\n  let checks = 0;\n  let lastReported = null;\n\n  const snapshot = async () => {\n    checks += 1;\n    const childRunning = Boolean(isChildRunning());\n    let status;\n    try {\n      status = await readStatus();\n    } catch {\n      status = null;\n    }\n    return readActiveTasks(status, { childRunning });\n  };\n\n  // Legacy single-check defer for non-update actions. Unchanged on purpose:\n  // an unreadable status still proceeds so remote repair is never self-blocked.\n  if (!drainable) {\n    const active = await snapshot();\n    if (active.known && active.count > 0) {\n      return {\n        proceed: false,\n        detail: `deferred safely: ${active.count} active task(s); retry when the runner is idle`,\n        capped: false,\n        waitedMs: 0,\n        checks,\n        markedTaskIds: [],\n      };\n    }\n    return { proceed: true, detail: 'runner idle', capped: false, waitedMs: 0, checks, markedTaskIds: [] };\n  }\n\n  for (;;) {\n    const active = await snapshot();\n    const elapsedMs = now() - startedAt;\n    const step = decideDrainStep({ active, elapsedMs, capMs });\n\n    if (step.action === 'proceed') {\n      if (lastReported !== null) {\n        log(`update drain complete after ${Math.round(elapsedMs / 1000)}s \u2014 runner idle, applying staged update restart`);\n      }\n      return { proceed: true, detail: 'runner idle', capped: false, waitedMs: elapsedMs, checks, markedTaskIds: [] };\n    }\n\n    if (step.action === 'cap') {\n      log(`update drain cap reached after ${Math.round(elapsedMs / 1000)}s (cap ${Math.round(capMs / 1000)}s) \u2014 ${describeBusy(active)}; marking task(s) before restart`);\n      const markedTaskIds = await markCappedTasks({ active, failInFlightTask, log });\n      return {\n        proceed: true,\n        capped: true,\n        detail: `update restart applied after drain cap; marked ${markedTaskIds.length} task(s) as \"${UPDATE_RESTART_ERROR_MESSAGE}\"`,\n        waitedMs: elapsedMs,\n        checks,\n        markedTaskIds,\n      };\n    }\n\n    // Log the first deferral and every real change, not every poll: a 45-minute\n    // cap at a 30s interval would otherwise emit ~90 identical lines.\n    const fingerprint = `${step.busy}:${active.ids.join(',')}`;\n    if (fingerprint !== lastReported) {\n      lastReported = fingerprint;\n      log(`deferring staged update restart \u2014 ${describeBusy(active)}; re-checking every ${Math.round(checkMs / 1000)}s until idle (cap ${Math.round(capMs / 1000)}s)`);\n    }\n    await sleep(Math.max(1, Math.min(checkMs, capMs - elapsedMs)));\n  }\n}\n", "import { hostname as systemHostname } from 'node:os';\nimport {\n  pairedOperatorScope,\n  probeRunnerReadiness,\n  runnerReadinessRetryDelayMs,\n  runnerRepositoryScopeFromEnv,\n} from '../runner-readiness.mjs';\n\n/** Keep the supervisor's control-queue identity byte-identical to the daemon. */\nexport function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {\n  const explicit = String(env.VO_CODE_RUNNER_ID || '').trim();\n  return explicit || `vo-code-runner-${hostname()}`;\n}\n\n/** Build the daemon environment without mislabeling a paired credential as admin. */\nexport function buildSupervisorChildEnv({\n  baseEnv = {},\n  controlPlaneUrl,\n  explicitAdminToken = null,\n  pairedOperatorId = null,\n} = {}) {\n  const childEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n  };\n  const adminToken = typeof explicitAdminToken === 'string' ? explicitAdminToken.trim() : '';\n  const operatorId = typeof pairedOperatorId === 'string' ? pairedOperatorId.trim() : '';\n\n  if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;\n  else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;\n\n  if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;\n  return childEnv;\n}\n\n/** Resolve auth provenance once so the supervisor and child use the same scope. */\nexport async function prepareSupervisorAuth({\n  baseEnv = {},\n  storedCredential = null,\n  controlPlaneUrl,\n  probeReadiness = probeRunnerReadiness,\n} = {}) {\n  const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();\n  const token = explicitAdminToken || storedCredential?.vo_credential;\n  if (!token) throw new Error('runner is not paired; run `vo-mcp pair` once on this host');\n\n  let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || '')\n    .split(/[\\s,]+/u)\n    .filter(Boolean)[0] || undefined;\n  let repositoryScope = runnerRepositoryScopeFromEnv(baseEnv);\n  let startupRetryAfterMs = null;\n  let githubReady = null;\n  let readinessError = null;\n  if (!explicitAdminToken) {\n    const readiness = await probeReadiness({\n      controlPlaneUrl,\n      token,\n      requireGithub: true,\n      repositories: repositoryScope,\n    });\n    const pairedScope = pairedOperatorScope(readiness)\n      || (readiness?.paired === true && typeof readiness.operatorId === 'string'\n        ? readiness.operatorId.trim()\n        : '');\n    operatorId = pairedScope || undefined;\n    if (!operatorId) throw new Error('runner readiness failed: paired operator scope is missing');\n    if (readiness.ok && Array.isArray(readiness.repositoryScope)) {\n      repositoryScope = [...readiness.repositoryScope];\n      githubReady = true;\n    } else {\n      githubReady = false;\n      readinessError = typeof readiness?.error === 'string' ? readiness.error : 'github_not_ready';\n      startupRetryAfterMs = runnerReadinessRetryDelayMs(readiness);\n    }\n  }\n\n  const effectiveBaseEnv = repositoryScope.length > 0\n    ? { ...baseEnv, VO_CODE_RUNNER_REPOS: repositoryScope.join(',') }\n    : baseEnv;\n\n  const childEnv = buildSupervisorChildEnv({\n    baseEnv: effectiveBaseEnv,\n    controlPlaneUrl,\n    explicitAdminToken,\n    pairedOperatorId: explicitAdminToken ? null : operatorId,\n  });\n  const clientEnv = {\n    ...effectiveBaseEnv,\n    VO_CONTROL_PLANE_ADMIN_TOKEN: token,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n    ...(operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}),\n  };\n  return {\n    childEnv,\n    clientEnv,\n    operatorId,\n    repositoryScope,\n    githubReady,\n    readinessError,\n    startupRetryAfterMs,\n  };\n}\n", "/**\n * Server-backed readiness probe for a paired BYO runner.\n *\n * The credential itself is opaque, so its mere presence is not proof that it is\n * usable or still bound to an operator. `/auth/me` supplies that truth from the\n * authenticated control-plane context. Before daemon startup, the optional\n * GitHub probe uses App-JWT GETs to verify the caller-owned installation,\n * publication grants, and selected repositories without minting a one-hour\n * token. Read/publish tokens are created only for actual task work.\n */\nimport { createHash, randomUUID } from 'node:crypto';\n\nexport const RUNNER_GITHUB_READINESS_TIMEOUT_MS = 50_000;\nexport const RUNNER_IDENTITY_READINESS_TIMEOUT_MS = 10_000;\nexport const RUNNER_READINESS_MAX_REPOSITORIES = 4;\nexport const RUNNER_READINESS_MAX_TIMER_DELAY_MS = 2_147_000_000;\nexport const RUNNER_READINESS_TRANSIENT_MAX_RETRY_AFTER_MS = 300_000;\nexport const RUNNER_READINESS_IPC_ACK_TIMEOUT_MS = 5_000;\nexport const RUNNER_READINESS_DEFERRAL_MESSAGE_TYPE = 'vo-runner-readiness-deferred-v1';\nexport const RUNNER_READINESS_DEFERRAL_ACK_TYPE = 'vo-runner-readiness-deferred-ack-v1';\nconst RUNNER_REPOSITORY = /^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/u;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\n\nexport function runnerRepositoryScopeFromEnv(env = {}) {\n  return String(env.VO_CODE_RUNNER_REPOS || '')\n    .split(/[\\s,]+/u)\n    .map((repo) => repo.trim())\n    .filter(Boolean);\n}\n\nexport function normalizeRunnerRepositoryScope(repositories) {\n  if (!Array.isArray(repositories) || repositories.length < 1) {\n    throw new Error('VO_CODE_RUNNER_REPOS must name at least one owner/name repository');\n  }\n  if (repositories.length > RUNNER_READINESS_MAX_REPOSITORIES) {\n    throw new Error(`VO_CODE_RUNNER_REPOS supports at most ${RUNNER_READINESS_MAX_REPOSITORIES} repositories`);\n  }\n  const normalized = repositories.map((repo) => {\n    const [owner, name] = typeof repo === 'string' ? repo.split('/') : [];\n    if (typeof repo !== 'string' || repo.length > 140 || !RUNNER_REPOSITORY.test(repo)\n      || owner === '.' || owner === '..' || name === '.' || name === '..') {\n      throw new Error('VO_CODE_RUNNER_REPOS entries must be canonical owner/name repositories');\n    }\n    return repo.toLowerCase();\n  });\n  if (new Set(normalized).size !== normalized.length) {\n    throw new Error('VO_CODE_RUNNER_REPOS entries must be unique');\n  }\n  const owners = new Set(normalized.map((repo) => repo.split('/')[0]));\n  if (owners.size !== 1) {\n    throw new Error('VO_CODE_RUNNER_REPOS entries must share one owner');\n  }\n  return Object.freeze(normalized.sort());\n}\n\nexport function runnerRepositoryScopeDigest(repositories) {\n  const scope = normalizeRunnerRepositoryScope(repositories);\n  return createHash('sha256').update(JSON.stringify({\n    version: 1,\n    repositories: scope,\n  }), 'utf8').digest('hex');\n}\n\nexport function runnerReadinessRetryDelayMs(readiness) {\n  if (readiness?.paired !== true || readiness?.githubReady !== false) return null;\n  if (Number.isFinite(readiness.retryAfterMs) && readiness.retryAfterMs > 0) {\n    return Math.ceil(readiness.retryAfterMs);\n  }\n  return null;\n}\n\n/**\n * One shared CLI/supervisor failure disposition. Only a parent-ACKed,\n * server-authorized readiness deferral may use reserved exit 75; ordinary\n * readiness failures and failed IPC custody remain ordinary exit 1 and\n * therefore consume breaker budget.\n */\nexport function runnerReadinessFailureDisposition(readiness, delivery = null) {\n  const retryAfterMs = runnerReadinessRetryDelayMs(readiness);\n  if (retryAfterMs === null) {\n    return Object.freeze({ action: 'exit', exitCode: 1, retryAfterMs: null });\n  }\n  if (delivery?.attempted === true) {\n    return Object.freeze({\n      action: 'exit',\n      exitCode: delivery.delivered === true ? 75 : 1,\n      retryAfterMs,\n    });\n  }\n  return Object.freeze({ action: 'wait', exitCode: null, retryAfterMs });\n}\n\nexport function parseRunnerReadinessDeferralRequest(message) {\n  if (message?.type !== RUNNER_READINESS_DEFERRAL_MESSAGE_TYPE\n    || !UUID_RE.test(String(message.nonce || ''))\n    || !Number.isFinite(message.retryAfterMs)\n    || message.retryAfterMs <= 0) return null;\n  return Object.freeze({\n    nonce: message.nonce,\n    retryAfterMs: Math.ceil(message.retryAfterMs),\n    error: typeof message.error === 'string' ? message.error : null,\n  });\n}\n\nexport async function notifySupervisorReadinessDeferral({\n  processLike,\n  retryAfterMs,\n  error = null,\n  ackTimeoutMs = RUNNER_READINESS_IPC_ACK_TIMEOUT_MS,\n}) {\n  if (processLike?.connected !== true || typeof processLike.send !== 'function') {\n    return Object.freeze({ attempted: false, delivered: false });\n  }\n  if (typeof processLike.on !== 'function' || typeof processLike.off !== 'function') {\n    return Object.freeze({ attempted: true, delivered: false });\n  }\n  const nonce = randomUUID();\n  const delivered = await new Promise((resolve) => {\n    let settled = false;\n    const onMessage = (message) => {\n      if (message?.type === RUNNER_READINESS_DEFERRAL_ACK_TYPE && message.nonce === nonce) {\n        finish(true);\n      }\n    };\n    const onDisconnect = () => finish(false);\n    const finish = (value) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      processLike.off('message', onMessage);\n      processLike.off('disconnect', onDisconnect);\n      resolve(value);\n    };\n    const timer = setTimeout(() => finish(false), ackTimeoutMs);\n    processLike.on('message', onMessage);\n    processLike.on('disconnect', onDisconnect);\n    try {\n      processLike.send({\n        type: RUNNER_READINESS_DEFERRAL_MESSAGE_TYPE,\n        nonce,\n        retryAfterMs,\n        error,\n      }, (sendError) => {\n        if (sendError) finish(false);\n      });\n    } catch {\n      finish(false);\n    }\n  });\n  return Object.freeze({ attempted: true, delivered });\n}\n\nexport async function waitForRunnerReadinessRetry(delayMs, {\n  nowMs = () => Date.now(),\n  wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n} = {}) {\n  if (!Number.isFinite(delayMs) || delayMs <= 0) {\n    throw new TypeError('runner readiness retry delay is invalid');\n  }\n  const deadline = nowMs() + Math.ceil(delayMs);\n  while (nowMs() < deadline) {\n    await wait(Math.min(RUNNER_READINESS_MAX_TIMER_DELAY_MS, deadline - nowMs()));\n  }\n}\n\nfunction failed({\n  paired = false,\n  operatorId = null,\n  tenantId = null,\n  githubReady = null,\n  retryAfterMs = null,\n  error,\n  message,\n}) {\n  return {\n    ok: false,\n    paired,\n    operatorId,\n    tenantId,\n    githubReady,\n    ...(Number.isFinite(retryAfterMs) && retryAfterMs > 0 ? { retryAfterMs } : {}),\n    error,\n    message,\n  };\n}\n\nfunction responseRetryAfterMs(response, body) {\n  const transientReadinessFailure = response.status === 503\n    && body?.error === 'github_installation_readiness_retryable';\n  if (response.status !== 429 && !transientReadinessFailure) return null;\n  const bound = (retryAfterMs) => transientReadinessFailure\n    ? Math.min(RUNNER_READINESS_TRANSIENT_MAX_RETRY_AFTER_MS, retryAfterMs)\n    : retryAfterMs;\n  const value = response.headers?.get?.('retry-after')?.trim() ?? '';\n  const seconds = Number(value);\n  if (value && Number.isFinite(seconds) && seconds >= 0) {\n    return bound(Math.max(1_000, Math.ceil(seconds * 1_000)));\n  }\n  const at = value ? Date.parse(value) : Number.NaN;\n  if (Number.isFinite(at)) {\n    return bound(Math.max(1_000, Math.ceil(at - Date.now())));\n  }\n  return bound(60_000);\n}\n\nasync function responseBody(response) {\n  try {\n    const value = await response.json();\n    return value && typeof value === 'object' ? value : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction serverMessage(body, fallback) {\n  return typeof body.message === 'string' && body.message.trim() ? body.message.trim() : fallback;\n}\n\nasync function fetchJsonWithTimeout(fetchImpl, url, init, timeoutMs) {\n  const controller = new AbortController();\n  let timer;\n  const timeout = new Promise((_, reject) => {\n    timer = setTimeout(() => {\n      controller.abort();\n      reject(new Error(`request aborted after ${timeoutMs}ms`));\n    }, timeoutMs);\n  });\n  try {\n    const requestAndBody = (async () => {\n      const response = await fetchImpl(url, { ...init, signal: controller.signal });\n      return { response, body: await responseBody(response) };\n    })();\n    return await Promise.race([requestAndBody, timeout]);\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * @param {{\n *   controlPlaneUrl: string,\n *   token: string,\n *   fetchImpl?: typeof fetch,\n *   requireGithub?: boolean,\n *   repositories?: readonly string[],\n *   timeoutMs?: number,\n *   githubTimeoutMs?: number,\n * }} input\n */\nexport async function probeRunnerReadiness({\n  controlPlaneUrl,\n  token,\n  fetchImpl = fetch,\n  requireGithub = false,\n  repositories = [],\n  timeoutMs = RUNNER_IDENTITY_READINESS_TIMEOUT_MS,\n  // The server performs at most five sequential App-JWT GETs (installation plus\n  // every one of at most four configured repositories), each bounded at 8s.\n  // Keep a transport margin while preventing a stuck proof from hanging startup.\n  githubTimeoutMs = RUNNER_GITHUB_READINESS_TIMEOUT_MS,\n}) {\n  const base = controlPlaneUrl.replace(/\\/+$/u, '');\n  const headers = { authorization: `Bearer ${token}` };\n  let identityResponse;\n  let identity;\n  try {\n    ({ response: identityResponse, body: identity } = await fetchJsonWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/auth/me`,\n      { headers },\n      timeoutMs,\n    ));\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      error: 'control_plane_unreachable',\n      message: `AlgoHQ could not be reached: ${detail}`,\n    });\n  }\n\n  if (!identityResponse.ok) {\n    return failed({\n      error: 'credential_rejected',\n      message: 'The saved pairing is expired or revoked. Pair this computer again.',\n    });\n  }\n  if (\n    identity.provisioned !== true ||\n    identity.role !== 'operator' ||\n    typeof identity.operator_id !== 'string' ||\n    !identity.operator_id.trim() ||\n    typeof identity.tenant_id !== 'string' ||\n    !identity.tenant_id.trim()\n  ) {\n    return failed({\n      error: 'operator_identity_missing',\n      message: 'The pairing credential is valid but has no operator identity. Pair this computer again.',\n    });\n  }\n\n  const operatorId = identity.operator_id.trim();\n  const tenantId = identity.tenant_id.trim();\n  if (!requireGithub) {\n    return {\n      ok: true,\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: null,\n      error: null,\n      message: 'Paired to AlgoHQ.',\n    };\n  }\n\n  let repositoryScope = null;\n  try {\n    if (!Array.isArray(repositories)) {\n      throw new Error('VO_CODE_RUNNER_REPOS must be a repository array');\n    }\n    if (repositories.length > 0) repositoryScope = normalizeRunnerRepositoryScope(repositories);\n  } catch (error) {\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error: 'github_repository_scope_invalid',\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n\n  let githubResponse;\n  let github;\n  try {\n    const readinessUrl = new URL(`${base}/api/v1/github/installation-readiness`);\n    for (const repo of repositoryScope ?? []) readinessUrl.searchParams.append('repo', repo);\n    ({ response: githubResponse, body: github } = await fetchJsonWithTimeout(\n      fetchImpl,\n      readinessUrl.toString(),\n      { headers },\n      githubTimeoutMs,\n    ));\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error: 'github_preflight_unreachable',\n      message: `GitHub publication readiness could not be checked: ${detail}`,\n    });\n  }\n\n  const repositorySelection = github.repository_selection;\n  const repositoriesVerified = github.repositories_verified;\n  const returnedScope = github.repository_scope;\n  let normalizedReturnedScope = null;\n  try {\n    normalizedReturnedScope = normalizeRunnerRepositoryScope(returnedScope);\n  } catch {\n    // The shape check below fails closed with the server's actionable response.\n  }\n  const effectiveScope = repositoryScope ?? normalizedReturnedScope;\n  const sourceVerified = repositoryScope === null\n    ? github.repository_scope_source === 'persisted_installation_singleton'\n      && normalizedReturnedScope?.length === 1\n    : github.repository_scope_source === 'runner_config';\n  const repositoryScopeVerified = effectiveScope !== null\n    && normalizedReturnedScope !== null\n    && Array.isArray(returnedScope)\n    && returnedScope.length === normalizedReturnedScope.length\n    && returnedScope.every((repo, index) => repo === normalizedReturnedScope[index])\n    && normalizedReturnedScope.length === effectiveScope.length\n    && normalizedReturnedScope.every((repo, index) => repo === effectiveScope[index])\n    && github.repository_scope_sha256 === runnerRepositoryScopeDigest(effectiveScope)\n    && repositoriesVerified === effectiveScope.length\n    && sourceVerified\n    && (repositorySelection === 'all' || repositorySelection === 'selected');\n  if (!githubResponse.ok || github.configured !== true || github.verified !== true\n    || github.publication_ready !== true\n    || !repositoryScopeVerified) {\n    const error = typeof github.error === 'string' && github.error ? github.error : 'github_not_ready';\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      retryAfterMs: responseRetryAfterMs(githubResponse, github),\n      error,\n      message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`),\n    });\n  }\n\n  return {\n    ok: true,\n    paired: true,\n    operatorId,\n    tenantId,\n    githubReady: true,\n    repositoryScope: effectiveScope,\n    repositoryScopeSource: github.repository_scope_source,\n    error: null,\n    message: `Paired with a verified Algosuite GitHub App installation (${repositoriesVerified} repos).`,\n  };\n}\n\nexport function pairedOperatorScope(readiness) {\n  return readiness?.ok === true &&\n    readiness?.paired === true &&\n    typeof readiness.operatorId === 'string' &&\n    readiness.operatorId.trim()\n    ? readiness.operatorId.trim()\n    : null;\n}\n", "import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport function defaultCredentialHelperPath(metaUrl = import.meta.url) {\n  const moduleDir = dirname(fileURLToPath(metaUrl));\n  const bundled = join(moduleDir, 'supervisor-credential-helper.js');\n  const source = join(moduleDir, '..', 'supervisor-credential-helper.mjs');\n  return existsSync(source) ? source : bundled;\n}\n\n/** Read the OS-keychain credential without loading its native module here. */\nexport function readStoredCredentialIsolated({\n  spawn = spawnSync,\n  execPath = process.execPath,\n  helperPath = defaultCredentialHelperPath(),\n  helperArgs = [],\n  env = process.env,\n} = {}) {\n  const result = spawn(execPath, [helperPath, ...helperArgs], {\n    env,\n    encoding: 'utf8',\n    stdio: ['ignore', 'pipe', 'pipe'],\n    shell: false,\n    windowsHide: true,\n    timeout: 10_000,\n  });\n  if (result.status !== 0) {\n    throw new Error('runner credential helper could not read the paired credential');\n  }\n  try {\n    const parsed = JSON.parse(String(result.stdout || ''));\n    return parsed && typeof parsed === 'object' ? parsed : null;\n  } catch {\n    throw new Error('runner credential helper returned an invalid credential');\n  }\n}\n", "/** Pure rapid-exit circuit used by the persistent runner supervisor. */\nexport const DEFAULT_RESPAWN_CIRCUIT = Object.freeze({\n  baseDelayMs: 2_000,\n  maxDelayMs: 30_000,\n  healthyResetMs: 60_000,\n  maxRapidExits: 5,\n});\n\nexport function createRespawnCircuit(options = {}) {\n  const config = { ...DEFAULT_RESPAWN_CIRCUIT, ...options };\n  for (const [key, value] of Object.entries(config)) {\n    if (!Number.isInteger(value) || value < 1) throw new Error(`${key} must be a positive integer`);\n  }\n  let rapidExits = 0;\n\n  return Object.freeze({\n    recordExit(startedAt, exitedAt) {\n      if (!Number.isFinite(startedAt) || !Number.isFinite(exitedAt) || exitedAt < startedAt) {\n        throw new Error('respawn circuit timestamps are invalid');\n      }\n      const uptimeMs = exitedAt - startedAt;\n      rapidExits = uptimeMs >= config.healthyResetMs ? 0 : rapidExits + 1;\n      const tripped = rapidExits >= config.maxRapidExits;\n      const delayMs = Math.min(\n        config.maxDelayMs,\n        config.baseDelayMs * (2 ** Math.max(0, rapidExits - 1)),\n      );\n      return Object.freeze({ rapidExits, uptimeMs, delayMs, tripped });\n    },\n    snapshot() {\n      return Object.freeze({ rapidExits, tripped: rapidExits >= config.maxRapidExits });\n    },\n  });\n}\n", "/**\n * Readiness proof for one supervisor-owned runner child.\n *\n * All timing and state effects are injected so the race between an asynchronous\n * health probe and process exit can be exercised without starting a real child.\n */\nconst terminatedChildren = new WeakSet();\n\n/**\n * Install one exact-child terminal-event account while retaining an `error`\n * listener for the child's full lifetime. Node may emit an asynchronous spawn\n * `error` without `exit`, or may emit both; only the first terminal event\n * receives termination authority.\n */\nexport function attachSupervisorChildTerminationCustody(\n  target,\n  onTerminated,\n  onObservedError = () => {},\n) {\n  let accounted = false;\n  const account = (kind, error = null) => {\n    terminatedChildren.add(target);\n    if (accounted) return false;\n    accounted = true;\n    onTerminated(Object.freeze({ target, kind, error }));\n    return true;\n  };\n  target.on('error', (error) => {\n    onObservedError(error);\n    // ChildProcess also uses `error` for failed IPC sends and failed kills.\n    // Those do not prove a live process terminated. A spawn failure is the\n    // narrow terminal case: Node leaves pid unset and may emit exit afterward.\n    if (target.pid === undefined || target.pid === null) account('error', error);\n  });\n  target.on('exit', () => { account('exit'); });\n  return Object.freeze({ accounted: () => accounted });\n}\n\nexport function supervisorChildHasExited(target) {\n  // Node preserves exitCode=null for signal-terminated children and reports the\n  // terminal state through signalCode instead. An asynchronous spawn error can\n  // leave both fields null, so exact-object error custody is terminal too.\n  return terminatedChildren.has(target)\n    || target.exitCode !== null\n    || (target.signalCode ?? null) !== null;\n}\n\nexport function supervisorChildIsRunning(target) {\n  return !supervisorChildHasExited(target);\n}\n\nexport function shouldRespawnSupervisorChild({ stopping, degraded, handling, child }) {\n  return !stopping && !degraded && !handling && (!child || supervisorChildHasExited(child));\n}\n\nexport function shouldDeferSupervisorReadinessExit({\n  target,\n  currentChild,\n  retryAfterMs,\n}) {\n  return target === currentChild\n    && target?.exitCode === 75\n    && Number.isFinite(retryAfterMs)\n    && retryAfterMs > 0;\n}\n\n/**\n * Exact-child custody for a child-reported GitHub readiness embargo. The\n * supervisor records the nonce before acknowledging it to the child, then one\n * idempotent capture transition is shared by health, activation, and exit-event\n * orderings. A later exit listener can therefore never reinterpret an already\n * captured exit as a crash.\n */\nexport function createSupervisorReadinessDeferralTracker({\n  currentChild,\n  releaseCurrentChild,\n  onCaptured,\n}) {\n  const pending = new WeakMap();\n  const terminal = new WeakSet();\n  const recoveryGenerations = new WeakMap();\n\n  return Object.freeze({\n    recordPending(target, request) {\n      if (!target || target !== currentChild() || terminal.has(target) || pending.has(target)\n        || typeof request?.nonce !== 'string' || !request.nonce\n        || !Number.isFinite(request.retryAfterMs) || request.retryAfterMs <= 0) return false;\n      pending.set(target, Object.freeze({\n        nonce: request.nonce,\n        retryAfterMs: Math.ceil(request.retryAfterMs),\n      }));\n      return true;\n    },\n    recordRecoveryGeneration(target, generation) {\n      if (!target || !Number.isInteger(generation)) return false;\n      recoveryGenerations.set(target, generation);\n      return true;\n    },\n    isDeferred(target) {\n      const request = target ? pending.get(target) : null;\n      return Boolean(target) && (terminal.has(target) || shouldDeferSupervisorReadinessExit({\n        target,\n        currentChild: currentChild(),\n        retryAfterMs: request?.retryAfterMs,\n      }));\n    },\n    capture(target) {\n      if (!target) return false;\n      if (terminal.has(target)) return true;\n      const request = pending.get(target);\n      if (!shouldDeferSupervisorReadinessExit({\n        target,\n        currentChild: currentChild(),\n        retryAfterMs: request?.retryAfterMs,\n      })) return false;\n      const recoveryGeneration = recoveryGenerations.get(target);\n      terminal.add(target);\n      pending.delete(target);\n      recoveryGenerations.delete(target);\n      releaseCurrentChild(target);\n      onCaptured(Object.freeze({\n        target,\n        retryAfterMs: request.retryAfterMs,\n        recoveryGeneration: Number.isInteger(recoveryGeneration) ? recoveryGeneration : null,\n      }));\n      return true;\n    },\n    forget(target) {\n      if (!target) return;\n      pending.delete(target);\n      recoveryGenerations.delete(target);\n    },\n  });\n}\n\nexport function resolveSupervisorChildStartAuthority({\n  degradationState,\n  deferredRecoveryGeneration,\n}) {\n  const snapshot = degradationState.snapshot();\n  const exactRecovery = Number.isInteger(deferredRecoveryGeneration)\n    && deferredRecoveryGeneration === snapshot.generation;\n  return Object.freeze({\n    allowed: !snapshot.degraded || exactRecovery,\n    recoveryGeneration: exactRecovery ? deferredRecoveryGeneration : null,\n  });\n}\n\n/**\n * One-shot startup gate for a server-provided readiness Retry-After deadline.\n * Waiting behind this gate never spawns a process, so it cannot consume the\n * rapid-exit breaker. A later upstream response may extend the same unspent\n * start authority; once consumed it can never be reused by another poll.\n */\nexport function createSupervisorStartupDeferral({\n  retryAfterMs = null,\n  nowMs = () => Date.now(),\n} = {}) {\n  let started = false;\n  let notBefore = null;\n  const defer = (delayMs) => {\n    if (started || !Number.isFinite(delayMs) || delayMs <= 0) return false;\n    const candidate = nowMs() + Math.ceil(delayMs);\n    notBefore = notBefore === null ? candidate : Math.max(notBefore, candidate);\n    return true;\n  };\n  defer(retryAfterMs);\n\n  return Object.freeze({\n    defer,\n    reopen(delayMs) {\n      if (!Number.isFinite(delayMs) || delayMs <= 0) return false;\n      started = false;\n      notBefore = null;\n      return defer(delayMs);\n    },\n    isPending() {\n      return !started && notBefore !== null && nowMs() < notBefore;\n    },\n    remainingMs() {\n      return started || notBefore === null ? 0 : Math.max(0, notBefore - nowMs());\n    },\n    consumeIfReady() {\n      if (started || (notBefore !== null && nowMs() < notBefore)) return false;\n      started = true;\n      notBefore = null;\n      return true;\n    },\n    hasStarted() {\n      return started;\n    },\n  });\n}\n\n/**\n * Generation-fenced degradation state. A health proof may clear only the\n * generation it observed when it began, and only for the same current child.\n */\nexport function createSupervisorDegradationState() {\n  let degraded = false;\n  let generation = 0;\n\n  return {\n    isDegraded() {\n      return degraded;\n    },\n    markDegraded() {\n      degraded = true;\n      generation += 1;\n    },\n    beginHealthProof({ target, currentChild, allowRecovery, onRecovery }) {\n      const observedGeneration = generation;\n      return () => {\n        if (currentChild() !== target || generation !== observedGeneration) return false;\n        if (degraded && !allowRecovery) return false;\n        const recovered = degraded;\n        degraded = false;\n        if (recovered) onRecovery?.();\n        return true;\n      };\n    },\n    beginDegradationProof({ target, currentChild, onDegraded }) {\n      const observedGeneration = generation;\n      return (message) => {\n        if (currentChild() !== target || generation !== observedGeneration) return false;\n        onDegraded(message);\n        return true;\n      };\n    },\n    snapshot() {\n      return { degraded, generation };\n    },\n  };\n}\n\n/**\n * Begin one exact-child, exact-generation healthy-state commit. The stale\n * non-zero supervisor exit status is cleared only inside the same successful\n * commit that recovers degradation; stale or wrong-child proofs have no exit\n * status authority.\n */\nexport function beginSupervisorHealthyStateCommit({\n  degradationState,\n  target,\n  currentChild,\n  allowRecovery,\n  clearStaleExitCode,\n}) {\n  return degradationState.beginHealthProof({\n    target,\n    currentChild,\n    allowRecovery,\n    onRecovery: clearStaleExitCode,\n  });\n}\n\nconst RUNNER_RECOVERY_ACTIONS = new Set(['update', 'reinstall', 'reconnect']);\n\nexport function shouldRecoverSupervisorChildAfterAction({\n  stoppedChild,\n  actionKind,\n  actionSucceeded,\n}) {\n  // An action that deliberately stopped a live child must restore service even\n  // when its maintenance work failed. With no such child, only a successful\n  // runner repair/reconnect may clear pre-existing degradation; unrelated host\n  // cleanup and failed maintenance are not recovery authority.\n  return Boolean(stoppedChild)\n    || (actionSucceeded === true && RUNNER_RECOVERY_ACTIONS.has(actionKind));\n}\n\n/**\n * One-shot proof that the current control action took responsibility for a\n * live child before stopping it. Generic polling failures never arm this\n * fence, so they cannot accidentally relaunch a previously degraded runner.\n */\nexport function createSupervisorControlRecoveryFence() {\n  let targetStoppedForControl = null;\n  const consume = () => {\n    const target = targetStoppedForControl;\n    targetStoppedForControl = null;\n    return target;\n  };\n\n  return {\n    markBeforeStop(target) {\n      targetStoppedForControl = target && supervisorChildIsRunning(target) ? target : null;\n      return targetStoppedForControl !== null;\n    },\n    consume,\n    async recoverOnce(recover) {\n      // Consume before awaiting so a failed recovery cannot leak authority into\n      // a later, unrelated poll iteration.\n      const target = consume();\n      if (!target) return false;\n      await recover(target);\n      return true;\n    },\n  };\n}\n\nexport async function verifySupervisorChildHealth({\n  target,\n  degradeOnExit,\n  context,\n  waitBeforeProbe,\n  waitForLocalRunner,\n  stopExpectedly,\n  markHealthy,\n  markDegraded,\n  isReadinessDeferredExit = () => false,\n  isExpectedStop = () => false,\n}) {\n  try {\n    await waitBeforeProbe();\n    const healthy = supervisorChildIsRunning(target) && await waitForLocalRunner(target);\n    // The health probe is asynchronous. Node may publish exitCode or signalCode\n    // while it is pending, so decisions below must use a fresh observation,\n    // not the value from before the await.\n    const exited = supervisorChildHasExited(target);\n    if (isExpectedStop(target)) return false;\n    if (exited && isReadinessDeferredExit(target)) return false;\n    if (healthy && !exited) {\n      // A caller may reject a stale success when a newer degradation or child\n      // generation superseded this asynchronous proof.\n      if (markHealthy() !== false) return true;\n      if (supervisorChildIsRunning(target)) await stopExpectedly(target);\n      return false;\n    }\n    // Ordinary rapid exits remain governed by the backoff circuit. A live\n    // child that never proves readiness, or any failed control-action\n    // recovery, must fail closed immediately instead of occupying the slot.\n    if (!exited || degradeOnExit) {\n      const committed = markDegraded(`${context} did not become healthy; entering degraded mode`) !== false;\n      if (!committed) return false;\n      if (supervisorChildIsRunning(target)) await stopExpectedly(target);\n    }\n    return false;\n  } catch (error) {\n    if (isExpectedStop(target)) return false;\n    const committed = markDegraded(\n      `${context} health proof failed; entering degraded mode: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n    ) !== false;\n    if (!committed) return false;\n    if (supervisorChildIsRunning(target)) await stopExpectedly(target).catch(() => {});\n    return false;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAeA,eAAsB,kBAAkB;AACtC,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AApBA;AAAA;AAAA;AAAA;;;ACKA,SAAS,aAAa;AACtB,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,iBAAAC,sBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACQ9B,IAAM,wBAAwB;AAU9B,eAAsB,uBAAuB,EAAE,KAAK,WAAW,OAAO,WAAW,OAAO,OAAO,KAAK,GAAG;AACrG,QAAM,OAAO,CAAC,WAAW;AACvB,QAAI,SAAU,OAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AACtE,WAAO;AAAA,EACT;AACA,MAAI;AAIF,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA;AAAA,MACA,WAAW,EAAE,OAAO,QAAQ,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG,IAAI,CAAC;AAAA,MAC3D,WAAW,EAAE,WAAW,sBAAsB,IAAI,CAAC;AAAA,IACrD;AACA,QAAI,CAAC,IAAI,GAAI,QAAO,KAAK,QAAQ,IAAI,MAAM,EAAE;AAC7C,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,KAAK,eAAe;AAMrD,QAAI,YAAY,KAAK,UAAU,OAAQ,QAAO,KAAK,iDAAiD;AAGpG,WAAO,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,cAAc,MAAM,GAAI,OAAO,KAAK,gBAAgB,YAAY,EAAE,YAAY,KAAK,YAAY,IAAI,CAAC,EAAG;AAAA,EACrJ,SAAS,KAAK;AACZ,QAAI,SAAU,OAAM;AACpB,WAAO;AAAA,EACT;AACF;;;ACvCO,SAAS,yBAAyB;AAAA,EACvC,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,sBAAAC;AAAA,EACA,mBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AACvB,IAAI,CAAC,GAAG;AAEN,QAAM,OAAO,EAAE,WAAWF,WAAU,GAAI,oBAAoB,EAAE,qBAAqB,kBAAkB,IAAI,CAAC,EAAG;AAC7G,MAAI,iBAAkB,MAAK,qBAAqB;AAChD,MAAI,WAAY,MAAK,cAAc;AACnC,MAAI,OAAO,cAAc,SAAU,MAAK,aAAa;AACrD,MAAI,OAAO,gBAAgB,SAAU,MAAK,eAAe;AACzD,MAAI,OAAO,mBAAmB,SAAU,MAAK,kBAAkB;AAC/D,MAAI,OAAO,yBAAyB,SAAU,MAAK,wBAAwB;AAC3E,MAAI,OAAO,sBAAsB,SAAU,MAAK,sBAAsB;AACtE,MAAI,OAAO,qBAAqB,SAAU,MAAK,qBAAqB;AACpE,MAAI,OAAO,wBAAwB,SAAU,MAAK,wBAAwB;AAC1E,MAAI,QAAS,MAAK,UAAU;AAC5B,MAAI,cAAe,MAAK,iBAAiB;AAGzC,MAAI,YAAa,MAAK,eAAe;AACrC,MAAI,aAAc,MAAK,gBAAgB;AACvC,MAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,MAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,MAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,GAAG;AAC9E,SAAK,0BAA0B;AAAA,EACjC;AACA,MAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,SAAK,sBAAsB;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,SAAK,mBAAmB;AAAA,EAC1B;AACA,MAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,SAAK,gBAAgB;AAAA,EACvB;AACA,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,SAAS,GAAG;AAC1E,SAAK,yBAAyB;AAAA,EAChC;AACA,SAAO;AACT;;;AC1EA,eAAsB,sBAAsB,KAAK,UAAU,mBAAmB,iBAAiB,MAAM;AAAC,GAAG;AACvG,QAAM,MAAM,MAAM,IAAI,QAAQ,kCAAkC,EAAE,UAAU,kBAAkB,GAAG,EAAE,WAAW,IAAO,CAAC;AACtH,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,MAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,WAAO;AAAA,MACL,QAAQ,KAAK,aAAa,OAAQ,KAAK,wBAAwB,OAAO,mCAAmC,aAAc,KAAK,kBAAkB,OAAO,kBAAkB;AAAA,MACvK,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,MAC7D,QAAQ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB;AAAA,IAC1E;AAAA,EACF;AACA,QAAM,OAAO,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAC5D,QAAM,MAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,GAAG,MAAM,SAAS,WAAM,KAAK,MAAM,KAAK,EAAE,EAAE;AACrI,MAAI,SAAS,IAAI;AACjB,MAAI,OAAO;AACX,QAAM;AACR;;;ACzBA,IAAM,YAAY;AAGlB,eAAsB,qBAAqB,SAAS;AAClD,QAAM,QAAQ,CAAC;AACf,MAAI,kBAAkB;AACtB,MAAI,WAAW;AACf,aAAS;AACP,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,QAAQ;AAAA,MAAa,OAAO,OAAO,SAAS;AAAA,MAAG,iBAAiB;AAAA,IAClE,CAAC;AACD,QAAI,iBAAiB;AACnB,aAAO,IAAI,qBAAqB,eAAe;AAC/C,aAAO,IAAI,aAAa,QAAQ;AAAA,IAClC;AACA,UAAM,MAAM,MAAM,QAAQ,OAAO,qBAAqB,MAAM,EAAE;AAC9D,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAC3E,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,OAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC;AACxD,UAAM,KAAK,GAAG,IAAI;AAClB,QAAI,KAAK,SAAS,UAAW,QAAO;AACpC,UAAM,OAAO,KAAK,GAAG,EAAE;AACvB,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,cAAc;AAC5C,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AACA,sBAAkB,KAAK;AACvB,eAAW,KAAK;AAAA,EAClB;AACF;;;AC5BA,eAAsB,sBACpB,KACA,QACA,EAAE,qBAAqB,OAAO,wBAAwB,MAAM,IAAI,CAAC,GACjE,iBAAiB,MAAM;AAAC,GACxB;AACA,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,qBAAqB,mBAAmB,MAAM,CAAC;AAAA,IAC/C,qBACI,EAAE,sBAAsB,KAAK,IAC7B,wBAAwB,EAAE,wBAAwB,KAAK,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AACA,MAAI,CAAC,IAAI,IAAI;AAIX,QAAI,OAAO;AACX,QAAI;AACF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAAA,IACxD,QAAQ;AAAA,IAAsC;AAC9C,UAAM,MAAM,IAAI,MAAM,uBAAuB,IAAI,MAAM,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,EAAE;AACpF,QAAI,SAAS,IAAI;AACjB,QAAI,OAAO;AACX,UAAM;AAAA,EACR;AACA,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAM,OAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAG7C,MAAI,QAAQ,OAAO,KAAK,iBAAiB,UAAW,QAAO,eAAe,MAAM,gBAAgB,EAAE,OAAO,KAAK,cAAc,YAAY,MAAM,CAAC;AAC/I,SAAO;AACT;;;ACrCO,SAAS,sCAAsC,KAAK,WAAW,iBAAiB,MAAM;AAAC,GAAG;AAC/F,SAAO;AAAA,IACL,MAAM,gCAAgC,EAAE,oBAAoB,eAAe,cAAc,GAAG;AAC1F,YAAM,MAAM,MAAM,IAAI,QAAQ,yCAAyC;AAAA,QACrE,sBAAsB;AAAA,QACtB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,MAC3B,GAAG,EAAE,UAAU,CAAC;AAChB,UAAI,IAAI,WAAW,KAAK;AACtB,uBAAe;AACf,cAAM,IAAI,MAAM,kDAAkD;AAAA,MACpE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8CAA8C,IAAI,MAAM,EAAE;AACvF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO;AAAA,QACL,SAAS,MAAM,YAAY;AAAA,QAC3B,QAAQ,OAAO,MAAM,WAAW,WAAW,KAAK,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,IAEA,MAAM,gCAAgC,eAAe;AACnD,YAAM,MAAM,MAAM,IAAI,QAAQ,mDAAmD;AAAA,QAC/E,gBAAgB;AAAA,MAClB,GAAG,EAAE,UAAU,CAAC;AAChB,UAAI,IAAI,WAAW,KAAK;AACtB,uBAAe;AACf,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,4CAA4C,IAAI,MAAM,EAAE;AACrF,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AChCA,eAAsB,uBAAuB,KAAK,UAAU,mBAAmB,gBAAgB;AAC7F,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IAAQ;AAAA,IAA0B,EAAE,UAAU,kBAAkB;AAAA,IAAG,EAAE,WAAW,KAAQ;AAAA,EAC1F;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AACA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,MAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,UAAM,SAAS,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,CAAC;AAChF,UAAM,SAAS,OAAO,WAAW,QAAQ,OAAO,WAAW,WACvD,WACA,OAAO,WAAW,wBAAwB,OAAO,OAAO,UAAU,EAAE,EAAE,SAAS,YAAY,IACzF,WACA;AACN,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,MAC5D,iBAAiB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,IACzF;AAAA,EACF;AACA,QAAM,oBAAoB,MAAM,kBAAkB,oBAC5C,MAAM,UAAU,mCACf,MAAM,UAAU;AACvB,MAAI,IAAI,WAAW,QACb,MAAM,UAAU,wBAAwB,MAAM,UAAU,uBACvD,oBAAoB;AACzB,WAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,UAAU,KAAK,WAAW,KAAK,SAAS,2BAA2B;AAAA,EAC5G;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,IAC1E,iBAAiB,OAAO,MAAM,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACF;;;ACrBA,eAAsB,wBACpB,SACA,EAAE,YAAY,UAAAC,WAAU,QAAQ,iBAAiB,qBAAqB,GACtE,iBAAiB,MAAM;AAAC,GACxB;AACA,QAAM,OAAO;AAAA,IACX,aAAa;AAAA,IACb,WAAWA;AAAA,IACX,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,uBAAuB,OAAO;AAAA,IAC9B,mBAAmB,OAAO;AAAA,EAC5B;AACA,MAAI,OAAO,oBAAoB,UAAU;AACvC,SAAK,oBAAoB;AAAA,EAC3B;AACA,MAAI,yBAAyB,QAAW;AACtC,SAAK,0BAA0B;AAAA,EACjC;AACA,QAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,IAAI;AAC/D,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,SAAO;AACT;;;AC1BO,IAAM,6BAA6B;AAE1C,eAAsB,4BAA4B,KAAK,EAAE,QAAQ,OAAO,GAAG,iBAAiB,MAAM;AAAC,GAAG;AACpG,QAAM,MAAM,MAAM,IAAI,QAAQ,2BAA2B,EAAE,QAAQ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,GAAG;AAAA,IAClG,WAAW;AAAA,EACb,CAAC;AACD,MAAI,IAAI,WAAW,IAAK,gBAAe;AACvC,MAAI,OAAO;AACX,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtD,SAAO,EAAE,QAAQ,IAAI,QAAQ,KAAK;AACpC;;;ACbA,IAAM,cAAc;AAAA,EAClB,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,oBAAoB;AAAA,EACpB,mBAAmB;AACrB;AAEO,SAAS,kBAAkB,MAAM;AACtC,MAAI,CAAC,QAAQ,KAAK,YAAY,MAAO,QAAO;AAC5C,QAAM,SAAS,OAAO,KAAK,UAAU,QAAQ;AAC7C,QAAM,QAAQ,KAAK,gBAAgB,WAAW,KAAK,aAAa,MAAM;AACtE,SAAO,6BAAwB,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,aAAa,MAAM,IAAI,YAAY,MAAM,IAAI,SAAS,gDAAiD;AAC1K;AAMO,SAAS,oBAAoB,EAAE,MAAM,MAAM;AAAC,EAAE,IAAI,CAAC,GAAG;AAC3D,MAAI,OAAO;AACX,MAAI,UAAU;AACd,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AACZ,YAAM,OAAO,QAAQ,OAAO,SAAS,WAAW,KAAK,aAAa;AAClE,YAAM,SAAS,QAAQ,KAAK,YAAY,QAAQ,OAAO;AACvD,gBAAU,SAAS,EAAE,GAAG,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI;AAC1E,YAAM,YAAY,SAAS,GAAG,OAAO,MAAM,IAAI,OAAO,iBAAiB,EAAE,KAAK;AAC9E,UAAI,cAAc,KAAM;AACxB,UAAI,OAAQ,KAAI,kBAAkB,MAAM,CAAC;AAAA,eAChC,SAAS,KAAM,KAAI,6DAAwD;AACpF,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC9BO,IAAM,mCAAmC;AAChD,IAAM,kBAAkB,CAAC,KAAO,GAAK;AACrC,IAAM,eAAe,gBAAgB,SAAS;AAE9C,SAAS,kBAAkB,QAAQ;AACjC,SAAO,UAAU,OAAO,UAAU;AACpC;AAEA,SAAS,aAAa,IAAI;AACxB,SAAO,IAAI,QAAQ,CAACC,aAAY;AAAE,eAAWA,UAAS,EAAE;AAAA,EAAG,CAAC;AAC9D;AAQA,eAAsB,+BAA+B,KAAK,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AAAA,EAChF;AAAA,EACA,kBAAkB,MAAM;AAAA,EAAC;AAAA,EACzB,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,QAAM,OAAO,CAAC;AACd,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,QAAQ;AAC5D,QAAMC,QAAO,qBAAqB,mBAAmB,MAAM,CAAC;AAC5D,QAAM,YAAY,KAAK,IAAI,OAAO,oBAAoB,KAAK,GAAG,gCAAgC;AAE9F,WAAS,UAAU,GAAG,WAAW,cAAc,WAAW,GAAG;AAC3D,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,IAAI,QAAQA,OAAM,MAAM,EAAE,UAAU,CAAC;AAAA,IACnD,SAAS,KAAK;AACZ,cAAQ;AAAA,IACV;AACA,QAAI,CAAC,OAAO;AACV,UAAI,IAAI,WAAW,KAAK;AACtB,wBAAgB;AAChB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,IAAI,GAAI,QAAO,IAAI,KAAK;AAC5B,UAAI,CAAC,kBAAkB,IAAI,MAAM,GAAG;AAClC,cAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAAA,MAChE;AACA,cAAQ,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAAA,IAClE;AACA,QAAI,YAAY,aAAc,OAAM;AACpC,UAAM,UAAU,gBAAgB,UAAU,CAAC;AAC3C,QAAI,6BAA6B,OAAO,IAAI,YAAY,YAAY,MAAM,OAAO,kBAAkB,OAAO,IAAI;AAC9G,UAAMD,OAAM,OAAO;AAAA,EACrB;AAEA,QAAM,IAAI,MAAM,kDAAkD;AACpE;;;AC9CO,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,6BAA6B;AAUnC,SAAS,iBAAiB,EAAE,QAAQ,UAAU,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG;AACpE,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,SAAS,OAAO,KAAK,CAAC;AACjC,QAAM,OAAO,CAAC;AACd,QAAM,UAAU,CAAC;AACjB,aAAW,OAAO,6BAA6B;AAC7C,UAAM,MAAM,MAAM,GAAG;AACrB,QAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG;AACjD,QAAI,IAAI,SAAS,4BAA4B;AAAE,cAAQ,KAAK,GAAG;AAAG;AAAA,IAAU;AAC5E,WAAO,IAAI,KAAK,GAAG;AACnB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO,EAAE,OAAO,OAAO,SAAS,GAAG,MAAM,QAAQ;AACnD;AAGA,eAAe,YAAY,KAAK;AAC9B,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,OAAO,MAAM,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAaA,eAAsB,sBAAsB,KAAK,QAAQ,UAAU,CAAC,GAAG,kBAAkB,MAAM;AAAC,GAAG;AACjG,QAAM,EAAE,QAAQ,UAAU,MAAM,CAAC,GAAG,YAAY,KAAO,IAAI;AAC3D,QAAM,EAAE,OAAO,MAAM,QAAQ,IAAI,iBAAiB,EAAE,OAAO,IAAI,CAAC;AAChE,QAAM,UAAU,EAAE,SAAS,MAAM,YAAY,QAAQ;AACrD,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,mBAAmB,QAAQ,GAAG,GAAG,QAAQ;AAAA,EACvE;AACA,QAAME,QAAO,qBAAqB,mBAAmB,MAAM,CAAC,iBAAiB,KAAK;AAClF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,IAAI,OAAOA,OAAM,QAAW,EAAE,UAAU,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,KAAK,WAAW,OAAO,GAAG,CAAC,IAAI,QAAQ,GAAG,GAAG,QAAQ;AAAA,EACjG;AACA,MAAI,KAAK,WAAW,KAAK;AACvB,QAAI;AAAE,sBAAgB;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,KAAK,GAAG,QAAQ;AAAA,EACtE;AACA,MAAI,CAAC,KAAK,IAAI;AACZ,UAAM,OAAO,MAAM,YAAY,GAAG;AAClC,WAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,QAAQ,KAAK,UAAU,SAAS,IAAI,QAAQ,KAAK,UAAU,GAAG,GAAG,QAAQ;AAAA,EAC/G;AACA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB,KAAK,WAAW,OAAO,GAAG,CAAC,IAAI,QAAQ,IAAI,QAAQ,GAAG,QAAQ;AAAA,EAChH;AACA,QAAM,MAAM,MAAM;AAClB,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B,QAAQ,IAAI,QAAQ,GAAG,QAAQ;AAAA,EACxF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,aAAa,MAAM,eAAe,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc,CAAC;AAAA,IAC7F,GAAG;AAAA,EACL;AACF;;;ACjGA,IAAI,sBAAsB;AACnB,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,cAAc;AACZ,UAAM,mCAAmC;AACzC,SAAK,OAAO;AAA8B,SAAK,OAAO;AAAA,EACxD;AACF;AAEA,eAAe,cAAc,KAAK;AAChC,QAAM,aAAa,IAAI;AACvB,MAAI,WAAY,QAAO;AACvB,MAAI,oBAAqB,QAAO;AAEhC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,OAAO,MAAMA,iBAAgB,EAAE,IAAI,CAAC;AAC1C,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,wBAAsB,KAAK;AAC3B,SAAO;AACT;AAOO,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,MAAM,QAAQ;AAAA,EACd,YAAY;AAAA,EACZ,qBAAqB,KAAK;AAAA,IACxB,KAAK,IAAI,OAAO,IAAI,mCAAmC,KAAK,MAAQ,GAAK;AAAA,IACzE;AAAA,EACF;AAAA,EACA,uBAAuB,KAAK;AAAA,IAC1B,KAAK,IAAI,OAAO,IAAI,sCAAsC,KAAK,KAAO,GAAG;AAAA,IACzE;AAAA,EACF;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA,OAAAC;AACF,IAAI,CAAC,GAAG;AACN,QAAM,kBAAkB,WAAW,IAAI,wBAAwB;AAC/D,MAAI,CAAC,gBAAiB,OAAM,IAAI,MAAM,6DAA6D;AACnG,QAAM,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAE/C,iBAAe,IAAI,QAAQC,OAAM,MAAM,EAAE,UAAU,IAAI,CAAC,GAAG;AACzD,UAAM,SAAS,MAAM,cAAc,GAAG;AACtC,UAAM,aAAa,YAAY,IAAI,gBAAgB,IAAI;AACvD,QAAI;AACJ,UAAM,UAAU,QAAQ,QAAQ,UAAU,GAAG,IAAI,GAAGA,KAAI,IAAI;AAAA,MAC1D;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC1D,GAAI,aAAa,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACpD,CAAC,CAAC;AACF,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,WAAW;AACzC,kBAAY,WAAW,MAAM;AAC3B,mBAAW,MAAM;AACjB,eAAO,IAAI,MAAM,iBAAiBA,KAAI,oBAAoB,SAAS,IAAI,CAAC;AAAA,MAC1E,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AACF,aAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,IAC9C,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AACA,QAAM,UAAU,CAAC,QAAQA,OAAM,MAAM,UAAU,CAAC,MAAM,IAAI,QAAQA,OAAM,MAAM,EAAE,WAAW,sBAAsB,GAAG,QAAQ,CAAC;AAAG,QAAM,YAAY,oBAAoB,EAAE,KAAK,CAAC,MAAM,QAAQ,KAAK,iBAAgB,oBAAI,KAAK,GAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AACpP,SAAO;AAAA,IAAE,cAAc,MAAM,UAAU,QAAQ;AAAA;AAAA,IAC7C,GAAG;AAAA,MACD;AAAA,MAAK;AAAA,MAAsB,MAAM;AAAE,8BAAsB;AAAA,MAAM;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,MAAMF,WAAU,OAAO,aAAa,UAAU,CAAC,GAAG;AACtD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,MAAK,QAAQ;AAC3D,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,QAAQ,kBAAkB;AAAE,aAAK,qBAAqB,QAAQ;AAAkB,aAAK,mCAAmC;AAAA,MAAG;AAC/H,UAAI,QAAQ,oBAAoB,QAAQ,eAAgB,MAAK,kBAAkB;AAC/E,UAAI,QAAQ,aAAc,MAAK,gBAAgB,QAAQ;AACvD,UAAI,MAAM,QAAQ,QAAQ,eAAe,GAAG;AAC1C,aAAK,mBAAmB,QAAQ,gBAC7B,OAAO,CAAC,UAAU,OAAO,cAAc,QAAQ,OAAO,kBAAkB,IAAI,EAC5E,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,MAC/B;AACA,YAAM,MAAM,MAAM,QAAQ,QAAQ,2BAA2B,IAAI;AACjE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,EAAE;AAC/D,YAAM,OAAO,MAAM,IAAI,KAAK;AAAG,gBAAU,QAAQ,IAAI;AACrD,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,gBAAgB,WAAW,eAAe,MAAM,OAAO,OAAO,yBAAyB,2BAA2B,0BAA0B,kBAAkB,aAAa,iBAAiB,aAAa,GAAG;AAChP,YAAM,OAAO,EAAE,MAAM,OAAO;AAC5B,UAAI,OAAO,mBAAmB,SAAU,MAAK,iBAAiB;AAC9D,UAAI,OAAO,cAAc,SAAU,MAAK,YAAY;AACpD,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,EAAE,eAAe,MAAM,OAAO,OAAO,aAAa,gBAAgB,CAAC,GAAG;AAC9G,YAAI,MAAO,MAAK,GAAG,IAAI;AAAA,MACzB;AACA,UAAI,wBAAyB,MAAK,0BAA0B;AAC5D,UAAI,0BAA2B,MAAK,4BAA4B;AAA2B,UAAI,yBAA0B,MAAK,2BAA2B;AACzJ,UAAI,OAAO,UAAU,gBAAgB,KAAK,mBAAmB,EAAG,MAAK,mBAAmB;AACxF,UAAI,aAAc,MAAK,eAAe;AACtC,YAAM,MAAM,MAAM,QAAQ,QAAQ,qBAAqB,IAAI;AAC3D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,4BAA4B;AAAA,MAC9C;AACA,UAAI,CAAC,IAAI,IAAI;AAIX,YAAI,OAAO;AACX,YAAI;AAAE,gBAAM,UAAU,MAAM,IAAI,KAAK;AAAG,iBAAO,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ;AAAA,QAAM,QAAQ;AAAA,QAAsB;AACxI,cAAM,MAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,EAAE;AACrF,YAAI,SAAS,IAAI;AAAQ,YAAI,OAAO;AACpC,cAAM;AAAA,MACR;AACA,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,OAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAG7C,UAAI,QAAQ,OAAO,KAAK,iBAAiB,UAAW,QAAO,eAAe,MAAM,gBAAgB,EAAE,OAAO,KAAK,cAAc,YAAY,MAAM,CAAC;AAC/I,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,eAAe,QAAQ,EAAE,qBAAqB,OAAO,wBAAwB,MAAM,IAAI,CAAC,GAAG;AAC/F,aAAO,sBAAsB,SAAS,QAAQ,EAAE,oBAAoB,sBAAsB,GAAG,MAAM;AACjG,8BAAsB;AAAA,MACxB,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,gBAAgB,CAAC,UAAU,sBAAsB,sBAAsB,KAAK,UAAU,mBAAmB,MAAM;AAAE,4BAAsB;AAAA,IAAM,CAAC;AAAA,IAC9I,MAAM,gBAAgB,UAAU,mBAAmB;AACjD,aAAO;AAAA,QACL;AAAA,QAAK;AAAA,QAAU;AAAA,QAAmB,MAAM;AAAE,gCAAsB;AAAA,QAAM;AAAA,MACxE;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,WAAW;AAAA,QACf,GAAG;AAAA,QACH,GAAI,MAAM,YAAY,CAAC,IAAIA,YAAW,EAAE,WAAWA,UAAS,IAAI,CAAC;AAAA,QACjE,GAAI,MAAM,qBAAqB,CAAC,IAAI,mBAAmB,EAAE,oBAAoB,iBAAiB,IAAI,CAAC;AAAA,MACrG;AACA,YAAM,MAAM,MAAM,QAAQ,SAAS,qBAAqB,MAAM,aAAa,QAAQ;AACnF,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,YAAI,UAAU,UAAU,qCAAqC;AAC3D,gBAAM,IAAI,2BAA2B;AAAA,QACvC;AACA,eAAO,EAAE,UAAU,KAAK;AAAA,MAC1B;AACA,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAC/D,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,EAAE;AAClE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,QAAQ,KAAK,KAAK;AAAA,IACnC;AAAA,IAEA,MAAM,QAAQ,QAAQ;AACpB,YAAM,MAAM,MAAM,QAAQ,OAAO,qBAAqB,MAAM,EAAE;AAC9D,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,KAAK,OAAO;AAAA,IAC5B;AAAA,IACA,MAAM,oBAAoB;AACxB,aAAO,qBAAqB,OAAO;AAAA,IACrC;AAAA,IACA,MAAM,uBAAuB,QAAQ,cAAc;AACjD,YAAME,QAAO,qBAAqB,mBAAmB,MAAM,CAAC,eAAe,mBAAmB,YAAY,CAAC;AAC3G,YAAM,MAAM,MAAM,QAAQ,OAAOA,KAAI;AACrC,UAAI,IAAI,WAAW,IAAK,uBAAsB;AAC9C,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,aAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC;AAAA,IAC5C;AAAA;AAAA,IAGA,MAAM,wBAAwB,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AACpD,aAAO,+BAA+B,KAAK,QAAQ,EAAE,MAAM,GAAG;AAAA,QAC5D;AAAA,QACA,iBAAiB,MAAM;AAAE,gCAAsB;AAAA,QAAM;AAAA,QACrD,OAAAD;AAAA,QACA,KAAK,CAAC,MAAM,QAAQ,KAAK,iBAAgB,oBAAI,KAAK,GAAE,YAAY,CAAC,KAAK,CAAC,EAAE;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,gBAAgB,CAAC,QAAQ,YAAY,sBAAsB,KAAK,QAAQ,SAAS,MAAM;AAAE,4BAAsB;AAAA,IAAM,CAAC;AAAA;AAAA,IAEtH,MAAM,iBAAiB,QAAQ;AAC7B,aAAO,wBAAwB,SAAS,QAAQ,MAAM;AAAE,8BAAsB;AAAA,MAAM,CAAC;AAAA,IACvF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,qBAAqB,OAAO;AAChC,aAAO,4BAA4B,KAAK,OAAO,MAAM;AAAE,8BAAsB;AAAA,MAAM,CAAC;AAAA,IACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,cAAc,WAAW;AAC7B,YAAM,OAAO,yBAAyB,SAAS;AAC/C,YAAM,MAAM,MAAM,IAAI,QAAQ,4BAA4B,MAAM;AAAA,QAC9D,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,UAAI,CAAC,IAAI,IAAI;AAQX,YAAI,SAAS;AACb,YAAI;AACF,gBAAME,QAAO,MAAM,IAAI,KAAK;AAC5B,cAAI,MAAM,QAAQA,OAAM,WAAW,KAAKA,MAAK,YAAY,SAAS,GAAG;AACnE,qBAAS,sBAAsBA,MAAK,YAAY,KAAK,IAAI,CAAC;AAAA,UAC5D;AAAA,QACF,QAAQ;AAAA,QAAuD;AAC/D,cAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,GAAG,MAAM,EAAE;AAAA,MACjE;AACA,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA,IAEA,MAAM,gBAAgB,EAAE,WAAW,IAAI,CAAC,GAAG;AACzC,YAAM,QAAQ,aAAa,gBAAgB,mBAAmB,UAAU,CAAC,KAAK;AAC9E,YAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,KAAK,IAAI,QAAW;AAAA,QACvE,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,QAAQ,MAAM,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IACxD;AAAA,IAEA,MAAM,kBAAkB,EAAE,UAAAH,WAAU,YAAY,sBAAAI,uBAAsB,mBAAAC,oBAAmB,aAAa,GAAG;AACvG,YAAM,OAAO,EAAE,WAAWL,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,UAAII,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,YAAM,MAAM,MAAM,QAAQ,QAAQ,+BAA+B,IAAI;AACrE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,MAAM;AACrB,aAAO,UAAU,OAAO,OAAO,cAAc,YAAY,OAAO,YAC5D,EAAE,GAAG,QAAQ,UAAU,OAAO,UAAU,IACxC;AAAA,IACN;AAAA,IAEA,MAAM,sBAAsB,UAAU,EAAE,UAAAL,WAAU,YAAY,sBAAAI,uBAAsB,mBAAAC,oBAAmB,cAAc,QAAQ,OAAO,GAAG;AACrI,YAAM,OAAO,EAAE,WAAWL,WAAU,OAAO;AAC3C,UAAI,WAAY,MAAK,cAAc;AACnC,UAAII,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,UAAI,OAAQ,MAAK,SAAS;AAC1B,YAAM,MAAM,MAAM,QAAQ,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,aAAa,IAAI;AACzG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,UAAU;AAAA,IACzB;AAAA;AAAA,IAGA,MAAM,qBAAqB,EAAE,WAAW,OAAO,WAAW,OAAO,OAAO,KAAK,IAAI,CAAC,GAAG;AACnF,aAAO,uBAAuB,EAAE,KAAK,SAAS,UAAU,UAAU,KAAK,CAAC;AAAA,IAC1E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,kBAAkB;AACtB,UAAI;AACF,cAAM,MAAM,MAAM,QAAQ,OAAO,8BAA8B;AAC/D,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,eAAO,MAAM,gBAAgB;AAAA,MAC/B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AChXA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAEhG,SAAS,aAAa,OAAO;AAC3B,SAAO,MAAM,QAAQ,wBAAwB,MAAM;AACrD;AAGO,SAAS,8BAA8B,KAAK,MAAM,CAAC,GAAG;AAC3D,MAAI,QAAQ,OAAO,OAAO,EAAE,EACzB,QAAQ,kDAAkD,YAAY,EACtE,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,sEAAsE,gBAAgB;AACjG,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,CAAC,6CAA6C,KAAK,IAAI,EAAG;AAC9D,UAAM,OAAO,OAAO,UAAU,EAAE;AAChC,QAAI,KAAK,SAAS,EAAG;AACrB,YAAQ,MAAM,QAAQ,IAAI,OAAO,aAAa,IAAI,GAAG,IAAI,GAAG,YAAY;AAAA,EAC1E;AACA,UAAQ,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACzC,MAAI,MAAM,UAAU,qBAAsB,QAAO;AACjD,SAAO,GAAG,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC;AACpD;AAEA,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAM,WAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;AAEO,SAAS,mBAAmB,MAAM;AAAA,EACvC,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AAAA,EACb,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI,SAAS,YAAa,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAChF,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,MAAM,EAAE,UAAU,aAAa,KAAK,UAAU,WAAW,CAAC;AAAA,EAC9F,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,CAAC;AAAA,MACP,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG;AAAA,IACnG;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AACrE,MAAI,uBAAuB,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,CAAC,EAAE;AACtE,QAAM,SAASA,OAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,IAClD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACD,QAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,QAAM,SAAS;AAAA,IACb,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAQ,KAAI,8BAA8B,MAAM,EAAE;AACtD,SAAO,EAAE,IAAI,WAAW,GAAG,QAAQ,SAAS,QAAQ,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC1F;;;AC/HA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC;AAAA,EACE,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,aAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,cAAAC;AAAA,EACA,UAAAC;AAAA,EACA,iBAAAC;AAAA,OACK;AACP,SAAS,UAAU,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,UAAS,OAAAC,YAAW;AACnE,SAAS,aAAAC,kBAAiB;;;ACZ1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,SAAS,OAAO,WAAAC,gBAAe;AACxC,SAAS,qBAAqB;;;ACH9B,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B;AAAA,EACE,cAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY,MAAM,UAAU,SAAS,KAAK,SAAAC,cAAa;AAEhE,IAAM,4BAA4B;AAClC,IAAM,kBAAkB;AACjB,IAAM,2BAA2B;AAExC,SAAS,UAAU,OAAO;AACxB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,SAAS;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,EAChG;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAO;AAC5B,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,SAAS,iBAAiB,OAAO,KAAK;AACpC,MAAI,OAAO,UAAU,SAAU,SAAQ,QAAQ,OAAO,GAAG,OAAO;AAChE,SAAO,OAAO,cAAc,KAAK,MAAM,QAAQ,SAAS;AAC1D;AAEO,SAAS,cAAc,OAAO;AACnC,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,OAAO,MAAM,mBAAmB,cAAc,MAAM,eAAe,EAAG,QAAO;AACjF,MAAI,MAAM,eAAe,UAAa,MAAM,eAAe,QAAQ,MAAM,eAAe,EAAG,QAAO;AAClG,SAAO,CAAC,kBAAkB,iBAAiB,YAAY,EACpD,KAAK,CAAC,QAAQ,iBAAiB,MAAM,GAAG,GAAG,yBAAyB,CAAC;AAC1E;AAEO,SAAS,yBAAyB,QAAQ,QAAQ;AACvD,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,EAAG,QAAO;AAC1D,MAAI,OAAO,KAAK,CAAC,UAAU,UAAU,IAAI,MAAM,EAAE,EAAG,QAAO;AAC3D,QAAM,WAAW,OAAO,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,CAAC;AAC7F,SAAO,SAAS,WAAW,KAAK,SAAS,SAAS,MAAM;AAC1D;AAEO,SAAS,yBAAyB,OAAO,WAAW,EAAE,IAAI,SAAS,MAAM,MAAM,GAAG;AACvF,SAAO,OAAO,aAAa,SACzB,CAAC,yBAAyB,MAAM,IAAI,SAAS,EAAE,KAC5C,CAAC,yBAAyB,MAAM,KAAK,SAAS,IAAI;AAEzD;AAEA,SAAS,gBAAgB,MAAM,WAAW,OAAO;AAC/C,QAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,QAAQ,MAAO,CAAC,IAAI,WAAW,KAAK,GAAG,EAAE,KAAK,QAAQ,QAAQ,CAAC,WAAW,GAAG,EAAI;AACrF,QAAM,IAAI,MAAM,kBAAkB,KAAK,2BAA2B;AACpE;AAEA,SAAS,sBAAsB,MAAM,WAAW;AAC9C,QAAM,WAAW,QAAQ,OAAO,aAAa,EAAE,CAAC;AAChD,kBAAgB,MAAM,UAAU,eAAe;AAC/C,SAAO;AACT;AAEO,SAAS,yBAAyB,MAAM;AAAA,EAC7C,WAAW;AAAA,EAAc,MAAM,QAAQ;AAAA,EAAK,WAAW,QAAQ;AACjE,IAAI,CAAC,GAAG;AACN,MAAI,aAAa,QAAS,QAAO,CAAC;AAClC,QAAM,aAAa,OAAO,IAAI,cAAc,IAAI,cAAc,EAAE;AAChE,MAAI,CAACA,OAAM,WAAW,UAAU,KAAKA,OAAM,UAAU,UAAU,MAAM,YAAY;AAC/E,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAWA,OAAM,KAAK,YAAY,UAAU;AAClD,QAAM,aAAaA,OAAM,KAAK,UAAU,qBAAqB,QAAQ,gBAAgB;AACrF,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACX,QAAM,SAAS,SAAS,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AAAA,IACD,KAAK;AAAA,IACL,UAAU;AAAA,IACV,KAAK,EAAE,YAAY,YAAY,qBAAqBA,OAAM,QAAQ,IAAI,EAAE;AAAA,IACxE,aAAa;AAAA,EACf,CAAC;AACD,SAAO,OAAO,UAAU,EAAE,EAAE,MAAM,QAAQ,EAAE,OAAO,OAAO,EACvD,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC;AACpD;AAEA,SAAS,uBAAuB,QAAQ,UAAU;AAChD,QAAM,aAAa,gBAAgB,MAAM;AACzC,MAAI,YAAY,aAAa,UAAU,SAAU,QAAO;AACxD,MAAI,OAAO,YAAY,aAAa,YAAY,CAAC,WAAW,SAAS,WAAW,OAAO,GAAG;AACxF,WAAO;AAAA,EACT;AACA,QAAM,WAAW,WAAW,SAAS,MAAM,QAAQ,MAAM,EAAE,WAAW,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AACjG,QAAM,oBAAoB,oBAAI,IAAI;AAAA,IAChC,OAAO,SAAS,YAAY,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AAAA,IAChD,oBAAoB,SAAS,OAAO;AAAA,EACtC,CAAC;AACD,MAAI,kBAAkB,IAAI,QAAQ,EAAG,YAAW,WAAW,SAAS;AACpE,SAAO;AACT;AAEA,SAAS,aAAa,MAAM,eAAe;AACzC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GAAG;AAC5D,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,MAAI,KAAK,oBAAoB,cAAc,gBAAgB,yBAAyB;AAClF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,MAAI,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG;AACvF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,WAAW,cAAc,gBAAgB;AAC/C,QAAM,SAAS,OAAO,YAAY,OAAO,QAAQ,KAAK,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;AAC7F,QAAM,eAAe,OAAO,KAAK,QAAQ,EAAE,KAAK;AAChD,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,KAAK;AAC5C,MAAI,cAAc,UAAU,MAAM,cAAc,YAAY,GAAG;AAC7D,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,aAAW,OAAO,cAAc;AAC9B,UAAM,SAAS,QAAQ,kBACnB,uBAAuB,OAAO,GAAG,GAAG,SAAS,GAAG,CAAC,IACjD,OAAO,GAAG;AACd,QAAI,cAAc,MAAM,MAAM,cAAc,SAAS,GAAG,CAAC,GAAG;AAC1D,YAAM,IAAI,MAAM,gDAAgD,GAAG,EAAE;AAAA,IACvE;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,SAAS;AAC5B;AAEA,SAAS,cAAcC,OAAM,cAAc,OAAO,OAAO;AACvD,MAAI,CAAC,MAAM,OAAOA,KAAI,EAAG,OAAM,IAAI,MAAM,kBAAkB,KAAK,UAAU;AAC1E,QAAM,QAAQ,MAAM,MAAMA,KAAI;AAC9B,MAAI,cAAc,KAAK,KAAK,MAAM,eAAeA,OAAM,KAAK,GAAG;AAC7D,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB;AAAA,EAC9D;AACA,MAAI,iBAAiB,eAAe,CAAC,MAAM,YAAY,GAAG;AACxD,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB;AAAA,EAC9D;AACA,MAAI,iBAAiB,UAAU,CAAC,MAAM,OAAO,GAAG;AAC9C,UAAM,IAAI,MAAM,kBAAkB,KAAK,wBAAwB;AAAA,EACjE;AACA,MAAI,iBAAiB,UAAU,OAAO,MAAM,KAAK,IAAI,GAAG;AACtD,UAAM,IAAI,MAAM,kBAAkB,KAAK,gBAAgB;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,aAAa,gBAAgB,UAAU,OAAO;AAC7E,QAAM,UAAU,CAAC;AACjB,MAAI,YAAY;AAChB,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,cAAc,GAAG;AACzD,UAAMA,QAAO,QAAQ,aAAa,GAAG;AACrC,oBAAgB,aAAaA,OAAM,cAAc;AACjD,UAAM,aAAa,yBAAyB,OAAO,QAAQ;AAC3D,QAAI,YAAY;AACd,cAAQ,KAAK,GAAG;AAChB,UAAI,MAAM,OAAOA,KAAI,EAAG,OAAM,IAAI,MAAM,sDAAsD,GAAG,EAAE;AACnG;AAAA,IACF;AACA,kBAAcA,OAAM,aAAa,OAAO,qBAAqB,GAAG,EAAE;AAClE,iBAAa;AAAA,EACf;AACA,SAAO,EAAE,WAAW,SAAS,QAAQ,KAAK,EAAE;AAC9C;AAEA,SAAS,WAAW,MAAMA,OAAM,OAAO,WAAW,IAAI;AACpD,MAAI,SAAS,IAAK,QAAO,KAAMA,KAAI;AAAA;AACnC,SAAO,KAAMA,KAAI,IAAK,MAAM,IAAI,IAAK,QAAQ;AAAA;AAC/C;AAEO,SAAS,qBAAqB,iBAAiB,QAAQ,CAAC,GAAG;AAChE,QAAM,MAAM;AAAA,IACV,QAAQF;AAAA,IACR,OAAO;AAAA,IACP,SAAS,CAACE,UAAS,YAAYA,OAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IAC5D,UAAU;AAAA,IACV,gBAAgB,MAAM;AAAA,IACtB,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL;AACA,QAAM,OAAO,QAAQ,eAAe;AACpC,gBAAc,MAAM,aAAa,KAAK,mBAAmB;AACzD,QAAM,WAAW,IAAI,kBAAkB,IAAI;AAC3C,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,OAAM,IAAI,MAAM,yDAAyD;AACvG,MAAI,SAAS,SAAS,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAE/F,MAAI,YAAY;AAChB,MAAI,iBAAiB;AACrB,MAAI,YAAY;AAChB,QAAM,UAAU,CAAC;AACjB,WAAS,KAAK,UAAU,cAAc;AACpC,eAAW,SAAS,IAAI,QAAQ,QAAQ,GAAG;AACzC,YAAM,gBAAgB,eAAe,GAAG,YAAY,IAAI,MAAM,IAAI,KAAK,MAAM;AAC7E,UAAI,kBAAkB,qBAAsB;AAC5C,YAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI;AAC1C,sBAAgB,MAAM,OAAO,YAAY;AACzC,YAAM,QAAQ,IAAI,MAAM,KAAK;AAC7B,UAAI,cAAc,KAAK,KAAK,IAAI,eAAe,OAAO,KAAK,GAAG;AAC5D,cAAM,IAAI,MAAM,iDAAiD,aAAa,EAAE;AAAA,MAClF;AACA,UAAI,MAAM,YAAY,GAAG;AACvB,0BAAkB;AAClB,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,eAAe,MAAM,CAAC;AACtD,aAAK,OAAO,aAAa;AAAA,MAC3B,WAAW,MAAM,OAAO,GAAG;AACzB,YAAI,OAAO,MAAM,KAAK,IAAI,GAAG;AAC3B,gBAAM,IAAI,MAAM,mDAAmD,aAAa,EAAE;AAAA,QACpF;AACA,qBAAa;AACb,qBAAa,OAAO,MAAM,IAAI;AAC9B,cAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,IAAI,SAAS,KAAK,CAAC,EAAE,OAAO,KAAK;AAC5E,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,eAAe,OAAO,OAAO,CAAC;AAAA,MAChE,OAAO;AACL,cAAM,IAAI,MAAM,kDAAkD,aAAa,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACA,OAAK,MAAM,EAAE;AACb,UAAQ,KAAK,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,QAAM,WAAW,WAAW,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,QACjD,IAAI,CAAC,UAAU,WAAW,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,EAC5E,KAAK,EAAE;AACV,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,WAAW,QAAQ,EAAE,OAAO,UAAU,MAAM,EAAE,OAAO,KAAK;AAAA,IAClE,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,+BAA+B,OAAO,WAAW,QAAQ;AAAA,IACzD,qBAAqB;AAAA,IACrB,uBAAuB;AAAA,EACzB;AACF;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA,kBAAkB,KAAK,aAAa,cAAc;AAAA,EAClD,kBAAkB,KAAK,aAAa,mBAAmB;AAAA,EACvD;AAAA,EACA,QAAQ,CAAC;AACX,GAAG;AACD,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,QAAQ,eAAe;AACvC,QAAM,WAAW,QAAQ,eAAe;AACxC,MAAI,YAAY,QAAQ,SAAS,cAAc,KAAK,aAAa,QAAQ,SAAS,mBAAmB,GAAG;AACtG,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,MAAM;AAAA,IACV,QAAQF;AAAA,IACR,OAAO;AAAA,IACP,UAAU;AAAA,IACV,gBAAgB,MAAM;AAAA,IACtB,GAAG;AAAA,EACL;AACA,gBAAc,UAAU,QAAQ,KAAK,cAAc;AACnD,QAAM,OAAO,KAAK,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC;AACtD,QAAM,EAAE,SAAS,IAAI,aAAa,MAAM,aAAa;AACrD,QAAM,WAAW,EAAE,IAAI,cAAc,SAAS,IAAI,MAAM,cAAc,SAAS,KAAK;AACpF,QAAM,WAAW,wBAAwB,SAAS,UAAU,UAAU,GAAG;AACzE,QAAM,kBAAkB,CAAC,GAAG,cAAc,gBAAgB,oCAAoC,EAAE,KAAK;AACrG,MAAI,cAAc,SAAS,OAAO,MAAM,cAAc,eAAe,GAAG;AACtE,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,SAAS,cAAc,OAAO,KAAK,QAAQ,EAAE,SAAS,SAAS,QAAQ,QAAQ;AACjF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,OAAO,qBAAqB,SAAS,KAAK;AAChD,MAAI,cAAc,IAAI,MAAM,cAAc,cAAc,cAAc,GAAG;AACvE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO,EAAE,IAAI,MAAM,cAAc,OAAO,KAAK,QAAQ,EAAE,QAAQ,GAAG,UAAU,KAAK;AACnF;;;ADrRA,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAC5C,IAAM,mCAAmCG;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,WAAW,OAAO,OAAO;AAAA,EAC7B,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,eAAe;AAAA,EACf,eAAe;AAAA,EACf,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,uBAAuB;AACzB,CAAC;AAED,IAAM,SAAS;AACf,IAAM,YAAY;AAElB,SAASC,WAAU,OAAO;AACxB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAIA,UAAS;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAKA,WAAU,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,EAChG;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAO;AAC9B,SAAOC,YAAW,QAAQ,EAAE,OAAO,GAAG,KAAK,UAAUD,WAAU,KAAK,CAAC,CAAC;AAAA,GAAM,MAAM,EAAE,OAAO,KAAK;AAClG;AAEA,SAAS,YAAY,QAAQ,UAAU,OAAO;AAC5C,MAAI,WAAW,SAAU,OAAM,IAAI,MAAM,yBAAyB,KAAK,WAAW;AACpF;AAEA,SAAS,sBAAsB,OAAO;AACpC,SAAO,yBAAyB,OAAO,EAAE,IAAI,SAAS,MAAM,MAAM,CAAC;AACrE;AAEO,SAAS,6BAA6B,OAAO;AAClD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,cAAY,MAAM,gBAAgB,GAAG,gBAAgB;AACrD,cAAY,MAAM,kBAAkB,SAAS,iBAAiB,IAAI;AAClE,cAAY,MAAM,SAAS,MAAM,SAAS,aAAa,cAAc;AACrE,cAAY,MAAM,SAAS,SAAS,SAAS,SAAS,iBAAiB;AACvE,cAAY,MAAM,SAAS,UAAU,SAAS,UAAU,UAAU;AAClE,cAAY,MAAM,SAAS,aAAa,SAAS,YAAY,aAAa;AAC1E,cAAY,MAAM,SAAS,YAAY,SAAS,WAAW,mBAAmB;AAC9E,cAAY,MAAM,SAAS,gBAAgB,SAAS,eAAe,gBAAgB;AACnF,cAAY,MAAM,SAAS,iBAAiB,SAAS,eAAe,YAAY;AAChF,cAAY,MAAM,SAAS,UAAU,SAAS,SAAS,UAAU;AACjE,cAAY,MAAM,SAAS,mBAAmB,IAAI,mBAAmB;AACrE,cAAY,MAAM,SAAS,cAAc,QAAQ,mBAAmB;AACpE,cAAY,MAAM,SAAS,gBAAgB,SAAS,qBAAqB;AAEzE,cAAY,MAAM,UAAU,IAAI,SAAS,kBAAkB;AAC3D,cAAY,MAAM,UAAU,MAAM,OAAO,cAAc;AACvD,cAAY,MAAM,UAAU,qBAAqB,YAAY,qBAAqB;AAClF,MAAI,CAAC,eAAe,KAAK,OAAO,MAAM,UAAU,8BAA8B,EAAE,CAAC,KAC5E,MAAM,UAAU,8BAA8B,WAAW;AAC5D,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ;AAAA,IAC3C,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,OAAO;AAAA,IACP,MAAM;AAAA,IACN,6BAA6B;AAAA,IAC7B,kBAAkB;AAAA,IAClB,mEAAmE;AAAA,EACrE,CAAC,EAAG,aAAY,MAAM,mBAAmB,GAAG,GAAG,UAAU,oBAAoB,GAAG,EAAE;AAClF,cAAY,MAAM,kBAAkB,yBAAyB,SAAS,UAAU,iBAAiB;AAEjG,QAAM,OAAO,MAAM;AACnB,MAAI,CAAC,MAAM,YAAY,OAAO,KAAK,aAAa,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG;AACxF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,cAAY,KAAK,yBAAyB,GAAG,kBAAkB;AAC/D,cAAY,KAAK,oBAAoB,SAAS,kBAAkB,oBAAoB;AACpF,cAAY,KAAK,0BAA0B,SAAS,wBAAwB,kBAAkB;AAC9F,cAAY,KAAK,aAAa,SAAS,YAAY,aAAa;AAChE,cAAY,KAAK,uBAAuB,SAAS,YAAY,iBAAiB;AAC9E,cAAY,KAAK,sBAAsB,SAAS,oBAAoB,gBAAgB;AACpF,cAAY,KAAK,mCAAmC,SAAS,qBAAqB,iBAAiB;AAEnG,QAAM,UAAU,OAAO,QAAQ,KAAK,QAAQ;AAC5C,cAAY,QAAQ,QAAQ,SAAS,YAAY,mBAAmB;AACpE,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,CAAC,IAAI,WAAW,eAAe,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM,UAAU,GAAG,MAAM,OAClF,IAAI,MAAM,GAAG,EAAE,SAAS,IAAI,GAAG;AAClC,YAAM,IAAI,MAAM,kDAAkD,GAAG,EAAE;AAAA,IACzE;AACA,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,SAAS,MAAM;AAC9D,YAAM,IAAI,MAAM,oDAAoD,GAAG,EAAE;AAAA,IAC3E;AACA,QAAI,CAAC,OAAO,KAAK,OAAO,MAAM,aAAa,EAAE,CAAC,GAAG;AAC/C,YAAM,IAAI,MAAM,yDAAyD,GAAG,EAAE;AAAA,IAChF;AACA,QAAI,CAAC,OAAO,MAAM,YAAY,EAAE,EAAE,WAAW,SAAS,QAAQ,GAAG;AAC/D,YAAM,IAAI,MAAM,iEAAiE,GAAG,EAAE;AAAA,IACxF;AACA,QAAI,MAAM,qBAAqB,MAAM;AACnC,YAAM,IAAI,MAAM,6DAA6D,GAAG,EAAE;AAAA,IACpF;AAAA,EACF;AACA,QAAM,SAAS,KAAK,SAAS,gCAAgC;AAC7D,cAAY,QAAQ,SAAS,SAAS,SAAS,2BAA2B;AAC1E,cAAY,QAAQ,WAAW,SAAS,WAAW,6BAA6B;AAChF,cAAY,gBAAgB,KAAK,QAAQ,GAAG,SAAS,wBAAwB,2BAA2B;AAExG,QAAM,UAAU,QAAQ,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,sBAAsB,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,MAAM,GAAG,EAAE,KAAK;AACrG,QAAM,kBAAkB,CAAC,GAAI,KAAK,wCAAwC,CAAC,CAAE,EAAE,KAAK;AACpF,cAAY,KAAK,UAAU,eAAe,GAAG,KAAK,UAAU,OAAO,GAAG,0BAA0B;AAChG,cAAY,QAAQ,SAAS,QAAQ,QAAQ,SAAS,qBAAqB,yBAAyB;AAEpG,QAAM,OAAO,MAAM;AACnB,cAAY,MAAM,WAAW,SAAS,eAAe,gBAAgB;AACrE,MAAI,CAAC,UAAU,KAAK,OAAO,MAAM,UAAU,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;AAC1G,cAAY,KAAK,QAAQ,SAAS,YAAY,aAAa;AAC3D,cAAY,KAAK,YAAY,SAAS,eAAe,iBAAiB;AACtE,cAAY,KAAK,iBAAiB,SAAS,oBAAoB,sBAAsB;AACrF,cAAY,KAAK,YAAY,SAAS,eAAe,iBAAiB;AACtE,cAAY,KAAK,+BAA+B,SAAS,uBAAuB,0BAA0B;AAC1G,cAAY,KAAK,qBAAqB,GAAG,oBAAoB;AAC7D,cAAY,KAAK,uBAAuB,GAAG,qBAAqB;AAChE,SAAO;AACT;AAEO,SAAS,yBAAyB,OAAO,kCAAkC;AAChF,SAAO,6BAA6B,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC,CAAC;AAC5E;AAEO,SAAS,mCAAmC,SAAS;AAC1D,QAAM,gBAAgB,6BAA6B,SAAS,iBAAiB,yBAAyB,CAAC;AACvG,SAAO,qBAAqB,EAAE,GAAG,SAAS,cAAc,CAAC;AAC3D;AAEA,IAAI,QAAQ,KAAK,CAAC,KAAKH,SAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,cAAc,YAAY,GAAG,GAAG;AAClF,2BAAyB,QAAQ,KAAK,CAAC,IAAIA,SAAQ,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAS;AAC/E,UAAQ,OAAO,MAAM,sCAAsC;AAC7D;;;AExKA,SAAS,cAAAI,aAAY,kBAAkB;AACvC;AAAA,EACE;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,WAAAC,UAAS,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,gBAAe;AAE7D,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,eAAe;AACrB,IAAM,aAAa;AACnB,IAAM,UAAU;AAChB,IAAM,YAAYF,MAAK,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAC9E,IAAM,iBAAiBA,MAAK,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAClG,IAAM,cAAcA,MAAK,gBAAgB,cAAc,UAAU,cAAc;AAC/E,IAAM,wBAAwBA,MAAK,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AACpH,IAAM,gBAAgB;AAEtB,SAAS,OAAO,QAAQ,WAAW;AACjC,QAAM,MAAMC,UAASC,SAAQ,MAAM,GAAGA,SAAQ,SAAS,CAAC;AACxD,SAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAACH,YAAW,GAAG;AAChE;AASA,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAEpB,SAAS,mBAAmB,EAAE,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI,CAAC,GAAG;AAC5G,MAAI,aAAa,SAAS;AACxB,UAAM,UAAU,OAAO,IAAI,WAAW,EAAE,EAAE,KAAK;AAC/C,WAAO,WAAWA,YAAW,OAAO,IAAIC,MAAK,SAAS,gBAAgB,kBAAkB,IAAI;AAAA,EAC9F;AACA,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,aAAa,UAAU;AACzB,WAAOA,MAAK,MAAM,WAAW,uBAAuB,gBAAgB,kBAAkB;AAAA,EACxF;AACA,QAAM,MAAM,OAAO,IAAI,mBAAmB,EAAE,EAAE,KAAK;AACnD,QAAM,OAAO,OAAOD,YAAW,GAAG,IAAI,MAAMC,MAAK,MAAM,SAAS;AAChE,SAAOA,MAAK,MAAM,gBAAgB,kBAAkB;AACtD;AAWO,SAAS,mBAAmB,MAAM,QAAQ,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,GAAG;AAC7E,QAAM,QAAQ,OAAO,IAAI,0BAA0B,EAAE,EAAE,KAAK;AAC5D,MAAI,MAAO,QAAOD,YAAW,KAAK,IAAIG,SAAQ,KAAK,IAAI;AACvD,QAAM,UAAU,mBAAmB,EAAE,UAAU,KAAK,KAAK,CAAC;AAC1D,SAAO,UAAUA,SAAQ,OAAO,IAAI;AACtC;AAEO,SAAS,eAAe,MAAM;AACnC,SAAO,UAAUT,YAAW,QAAQ,EAAE,OAAOG,cAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAGO,SAAS,gBAAgB,MAAM;AACpC,QAAM,SAASH,YAAW,QAAQ;AAClC,QAAM,QAAQ,CAAC;AACf,QAAM,QAAQ,CAAC,WAAW,SAAS,OAAO;AACxC,UAAM,WAAWE,WAAU,SAAS;AACpC,QAAI,SAAS,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC3F,QAAI,CAAC,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACnF,eAAW,QAAQE,aAAY,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG;AACxG,YAAM,WAAWG,MAAK,WAAW,IAAI;AACrC,YAAM,eAAe,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK;AACpD,YAAM,OAAOL,WAAU,QAAQ;AAC/B,UAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AACvF,UAAI,KAAK,YAAY,EAAG,OAAM,UAAU,YAAY;AAAA,eAC3C,KAAK,OAAO,KAAK,iBAAiB,cAAe,OAAM,KAAK,EAAE,UAAU,cAAc,MAAM,KAAK,KAAK,CAAC;AAAA,eACvG,CAAC,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,0CAA0C;AAAA,IACrF;AAAA,EACF;AACA,QAAM,IAAI;AACV,QAAM,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,EAAE,YAAY,GAAG,OAAO,KAAK,EAAE,YAAY,CAAC,CAAC;AAC7F,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,OAAO,KAAK,KAAK,cAAc,MAAM;AACvD,WAAO,OAAO,GAAG,UAAU,MAAM,GAAG;AACpC,WAAO,OAAO,SAAS;AACvB,WAAO,OAAO,IAAI,KAAK,IAAI,GAAG;AAC9B,WAAO,OAAOC,cAAa,KAAK,QAAQ,CAAC;AACzC,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO,UAAU,OAAO,OAAO,QAAQ,CAAC;AAC1C;AAEO,SAAS,gBAAgB,MAAM,OAAO;AAC3C,YAAUE,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,OAAOE,MAAKF,SAAQ,IAAI,GAAG,IAAI,WAAW,CAAC,MAAM;AACvD,QAAM,KAAK,SAAS,MAAM,MAAM,GAAK;AACrC,MAAI;AACF,kBAAc,IAAI,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AAC/D,cAAU,EAAE;AAAA,EACd,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACA,MAAI;AACF,eAAW,MAAM,IAAI;AAGrB,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI;AACF,cAAM,WAAW,SAASA,SAAQ,IAAI,GAAG,GAAG;AAC5C,YAAI;AAAE,oBAAU,QAAQ;AAAA,QAAG,UAAE;AAAU,oBAAU,QAAQ;AAAA,QAAG;AAAA,MAC9D,QAAQ;AAAA,MAAkD;AAAA,IAC5D;AAAA,EACF,UAAE;AACA,WAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EAC9B;AACF;AAEO,SAAS,eAAe,aAAa;AAC1C,QAAM,OAAOE,MAAK,aAAa,cAAc;AAC7C,MAAI,CAACN,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,QAAQ,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC;AACnD,WAAO,OAAO,mBAAmB,IAAI,QAAQ;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,aAAa,QAAQ;AAC7C,MAAI,CAAC,WAAW,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACvE,QAAM,WAAWI,MAAK,aAAa,SAAS,MAAM;AAClD,SAAO;AAAA,IACL;AAAA,IACA,OAAOA,MAAK,UAAU,SAAS;AAAA,IAC/B,YAAYA,MAAK,UAAU,cAAc;AAAA,IACzC,aAAaA,MAAK,UAAU,WAAW;AAAA,IACvC,kBAAkBA,MAAK,UAAU,qBAAqB;AAAA,IACtD,UAAUA,MAAK,UAAU,aAAa;AAAA,EACxC;AACF;AAEA,SAAS,YAAY,QAAQ;AAC3B,SAAO,UACF,WAAW,KAAK,OAAO,OAAO,KAC9B,WAAW,KAAK,OAAO,OAAO,KAC9B,aAAa,KAAK,OAAO,SAAS,KAClC,aAAa,KAAK,OAAO,YAAY,KACrC,aAAa,KAAK,OAAO,iBAAiB,KAC1C,aAAa,KAAK,OAAO,WAAW;AAC3C;AAEO,SAAS,aAAa,aAAa,QAAQ;AAChD,MAAI,CAAC,YAAY,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACpF,QAAM,QAAQ,UAAU,aAAa,OAAO,OAAO;AACnD,MAAI;AACF,UAAM,WAAW,KAAK,MAAMJ,cAAa,MAAM,UAAU,MAAM,CAAC;AAChE,UAAM,MAAM,KAAK,MAAMA,cAAa,MAAM,aAAa,MAAM,CAAC;AAC9D,UAAM,WAAW;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,SAAS,OAAO;AAAA,MAChB,WAAW,OAAO;AAAA,MAClB,cAAc,OAAO;AAAA,MACrB,mBAAmB,OAAO;AAAA,MAC1B,aAAa,OAAO;AAAA,IACtB;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,WAAW,GAAG,MAAM,MAAO,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,GAAG,YAAY;AAAA,IACxF;AACA,QAAI,UAAU,mBAAmB,KAAK,KAAK,SAAS,uBAAuB,KAAK,YAAY,OAAO,SAAS;AAC1G,aAAO,EAAE,IAAI,OAAO,QAAQ,4BAA4B;AAAA,IAC1D;AACA,QAAID,WAAU,MAAM,KAAK,EAAE,eAAe,KAAKA,WAAU,MAAM,UAAU,EAAE,eAAe,KACrFA,WAAU,MAAM,gBAAgB,EAAE,eAAe,GAAG;AACvD,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,UAAU,CAAC,KAC3G,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,gBAAgB,CAAC,GAAG;AAClE,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO,aAAc,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AAC3G,QAAI,eAAe,MAAM,UAAU,MAAM,OAAO,kBAAmB,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAC1H,QAAI,gBAAgB,MAAM,QAAQ,MAAM,OAAO,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AACrH,WAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,EACrF;AACF;AAEO,SAAS,kBAAkB,aAAa,UAAU,OAAO,SAAS,IAAI;AAC3E,MAAI,CAAC,aAAa,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AAC5E,kBAAgBK,MAAK,aAAa,gBAAgB,GAAG,QAAQ,OAAO,GAAG;AAAA,IACrE,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX;AAAA,IACA,QAAQ,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,IACnC,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC,CAAC;AACH;AAEO,SAAS,aAAa,aAAa,QAAQ,QAAQ;AACxD,MAAI,CAAC,YAAY,MAAM,EAAG,OAAM,IAAI,MAAM,0CAA0C;AACpF,MAAI,CAAC,aAAa,KAAK,OAAO,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AACnF,MAAI,CAAC,QAAQ,KAAK,OAAO,OAAO,wBAAwB,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACvH,QAAM,YAAY,aAAa,aAAa,MAAM;AAClD,MAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,yCAAyC,UAAU,MAAM,EAAE;AAC9F,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,6CAA6C;AACnF,QAAM,UAAU;AAAA,IACd,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB;AAAA,IACA,UAAU,YAAY,SAAS,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC1D,SAAS;AAAA,MACP,WAAW,OAAO;AAAA,MAClB,WAAW,OAAO,OAAO,YAAY,EAAE;AAAA,MACvC,aAAa,OAAO,OAAO,cAAc,EAAE;AAAA,MAC3C,wBAAwB,OAAO;AAAA,MAC/B,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,cAAc;AAAA,IAChB;AAAA,EACF;AAGA,oBAAkB,aAAa,OAAO,UAAU,YAAY,GAAG,OAAO,OAAO,IAAI,OAAO,SAAS,EAAE;AACnG,kBAAgBA,MAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,SAAO;AACT;AAEO,SAAS,+BAA+B,aAAa,UAAU;AACpE,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,SAAS,0BAA0B,EAAE;AACrE,MAAI,QAAQ,KAAK,OAAO,EAAG,QAAO;AAClC,SAAO,QAAQ,KAAK,OAAO,YAAY,EAAE,CAAC,IAAI,WAAW;AAC3D;AAEO,SAAS,sBAAsB,aAAa,SAAS,QAAQ;AAClE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,IAAI,GAAG,OAAO,QAAQ,QAAQ,gBAAgB,CAAC,CAAC,IAAI;AAC1E,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,SAAS,EAAE,GAAG,QAAQ,SAAS,cAAc,UAAU,YAAY,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE;AAAA,EAClG;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,WAAW,QAAQ,KAAK,MAAM,EAAE;AACvG,SAAO;AACT;AA0CO,SAAS,wBAAwB,EAAE,aAAa,UAAAG,WAAU,QAAQ,GAAG;AAC1E,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,CAAC,SAAS,WAAW,CAAC,YAAY,QAAQ,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAC3G,QAAM,YAAY,aAAa,aAAa,QAAQ,MAAM;AAC1D,MAAI,CAAC,UAAU,GAAI,QAAO;AAC1B,MAAI;AACF,QAAI,aAAaA,SAAQ,MAAM,aAAa,UAAU,MAAM,UAAU,GAAG;AACvE,aAAO,EAAE,IAAI,OAAO,QAAQ,qDAAqD;AAAA,IACnF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,4CAA4C;AAAA,EAC1E;AACA,MAAI,YAAY,QAAQ,OAAO,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,sCAAsC;AAC1G,SAAO,EAAE,IAAI,MAAM,SAAS,QAAQ,QAAQ,QAAQ,OAAO,UAAU,MAAM;AAC7E;AAEO,SAAS,mBAAmB,aAAa,SAAS;AACvD,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,GAAG,QAAQ,OAAO,OAAO,WAAW;AAC3G,kBAAgBC,MAAK,aAAa,cAAc,GAAG;AAAA,IACjD,gBAAgB;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ,YAAY;AAAA,IAC9B,SAAS;AAAA,EACX,CAAC;AAGD,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,YAAY,GAAG,QAAQ,OAAO,OAAO,SAAS;AAAA,EAAG,QAAQ;AAAA,EAAoB;AAC/I;AAEO,SAAS,mBAAmB,aAAa,SAAS,QAAQ;AAC/D,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,gBAAgB,MAAM;AAChF,QAAM,aAAa;AAAA,IACjB,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB,QAAQ,YAAY,SAAS,QAAQ,IAAI,QAAQ,WAAW;AAAA,IAC5D,UAAU;AAAA,IACV,SAAS;AAAA,MACP,GAAG,QAAQ;AAAA,MACX,iBAAiB;AAAA,MACjB,iBAAiB,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,MAC5C,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzC;AAAA,EACF;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,UAAU;AAC7D,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,eAAe,MAAM;AAAA,EAAG,QAAQ;AAAA,EAAoB;AACpH,SAAO;AACT;AAEO,SAAS,6BAA6B,aAAa,SAAS;AACjE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,aAClD,SAAS,SAAS,oBAAoB,UAAU;AACnD,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,EAAE,GAAG,SAAS,SAAS,KAAK,CAAC;AAChF,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,wBAAwB,QAAQ,QAAQ,eAAe;AAAA,EAAG,QACpH;AAAA,EAAsC;AAC9C;;;AHrWA,IAAM,eAAe;AACrB,IAAMC,mBAAkB;AACxB,IAAMC,gBAAe;AACrB,IAAM,oBAAoB,MAAM,OAAO;AACvC,IAAM,kBAAkB;AAEjB,SAAS,2BAA2B,MAAM,QAAQ,KAAK,cAAc,IAAI;AAC9E,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAc;AAAA,IAAc;AAAA,IAAU;AAAA,IACzE;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAe;AAAA,IAAW;AAAA,IAC3D;AAAA,IAAgB;AAAA,IAAqB;AAAA,IAAgB;AAAA,IAAQ;AAAA,EAC/D,CAAC;AACD,QAAM,QAAQ,CAAC;AACf,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,QAAQ,IAAI,GAAG,KAAK,OAAO,UAAU,SAAU,OAAM,GAAG,IAAI;AAAA,EAClE;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,2BAA2B;AAAA,IAC3B,sBAAsB;AAAA,IACtB,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,4BAA4B;AAAA,IAC5B,qBAAqB;AAAA,IACrB,GAAI,cAAc;AAAA,MAChB,uBAAuBC,MAAK,aAAa,eAAe,YAAY;AAAA,MACpE,yBAAyBA,MAAK,aAAa,eAAe,cAAc;AAAA,MACxE,kBAAkBA,MAAK,aAAa,eAAe,WAAW;AAAA,IAChE,IAAI,CAAC;AAAA,EACP;AACF;AAEA,SAAS,WAAW,SAAS,MAAM,SAAS;AAC1C,SAAOC,WAAU,SAAS,MAAM;AAAA,IAC9B,KAAK,QAAQ;AAAA,IACb,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,IACb,OAAO;AAAA,IACP,aAAa;AAAA,IACb,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,SAAS,QAAQ,WAAW;AAAA,EAC9B,CAAC;AACH;AAEA,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,YAAY,IAAI,GAAG;AACnE,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,aAAa,aAAa,UAAU,WAAW;AACrD,QAAM,SAAS,SAAS,CAAC,MAAM,IAAI,CAAC;AACpC,SAAO;AAAA,IACL,IAAI,MAAM,SAAS;AAAE,aAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO;AAAA,IAAG;AAAA,IAC5E,KAAK,MAAM,SAAS;AAAE,aAAO,IAAI,UAAU,MAAM,OAAO;AAAA,IAAG;AAAA,EAC7D;AACF;AAEA,SAAS,gBAAgB,QAAQ,WAAW;AAC1C,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,SAAS,YAAY,OAAO,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,QAAQ,UAAU,CAAC,EAAE,CAAC,EAAE;AAAA,EAC7H;AACA,MAAI;AAAE,WAAO,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,MAAM,GAAG,SAAS,wBAAwB;AAAA,EAAG;AACzH;AAEA,SAAS,iBAAiB,MAAM;AAC9B,SAAO,UAAUC,YAAW,QAAQ,EAAE,OAAOC,cAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAEA,SAAS,cAAc,MAAM;AAC3B,QAAM,UAAU,CAAC,IAAI;AACrB,SAAO,QAAQ,QAAQ;AACrB,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,OAAOC,WAAU,OAAO;AAC9B,QAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,iDAAiD;AAC5F,QAAI,CAAC,KAAK,YAAY,EAAG;AACzB,eAAW,SAASC,aAAY,OAAO,EAAG,SAAQ,KAAKL,MAAK,SAAS,KAAK,CAAC;AAAA,EAC7E;AACF;AAEO,SAAS,uBAAuB,aAAa,UAAU;AAC5D,QAAM,OAAO,KAAK,MAAMG,cAAaH,MAAK,aAAa,mBAAmB,GAAG,MAAM,CAAC;AACpF,MAAI,OAAO,KAAK,eAAe,IAAI,KAAK,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,UAAU;AAC3F,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,MAAI,eAAe;AACnB,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACvD,QAAI,CAAC,IAAK;AACV,QAAI,MAAM,SAAS,KAAM,OAAM,IAAI,MAAM,0CAA0C,GAAG,EAAE;AACxF,UAAM,WAAW,IAAI,WAAW,MAAM,GAAG,EAAE,SAAS,gCAAgC;AACpF,QAAI,UAAU;AACZ,qBAAe,KAAK,YAAY,SAAS,WAAW,KAAK,cAAc,SAAS;AAChF;AAAA,IACF;AACA,QAAI,CAACD,cAAa,KAAK,OAAO,MAAM,aAAa,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAClH,QAAI,CAAC,OAAO,MAAM,YAAY,EAAE,EAAE,WAAW,6BAA6B,GAAG;AAC3E,YAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AACA,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,4DAA4D;AACjG;AAEO,SAAS,2BAA2B,aAAa,SAAS,sBAAsB;AACrF,QAAM,gBAAgB,6BAA6B,oBAAoB;AACvE,QAAM,cAAcO,SAAQ,aAAa,MAAM,IAAI;AACnD,QAAM,qBAAqBC,UAAS,aAAaD,SAAQ,OAAO,CAAC;AACjE,MAAI,CAAC,sBAAsB,uBAAuB,QAC7C,mBAAmB,WAAW,KAAKE,IAAG,EAAE,KACxCC,YAAW,kBAAkB,GAAG;AACnC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,kBAAkBF,UAAS,aAAaD,SAAQ,OAAO,CAAC,EAAE,WAAW,MAAM,GAAG;AACpF,MAAI,CAAC,mBAAmBG,YAAW,eAAe,KAC7C,gBAAgB,SAAS,IAAI,KAAK,gBAAgB,SAAS,IAAI,GAAG;AACrE,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,WAAW,QAAQ,eAAe;AACxC,QAAM,gBAAgB;AAAA,IAAE,MAAM;AAAA,IAAyB,SAAS;AAAA,IAAS,SAAS;AAAA,IAChF,cAAc,EAAE,CAAC,YAAY,GAAG,SAAS;AAAA,EAAE;AAC7C,QAAM,WAAW,gBAAgB,cAAc,gBAAgB,QAAQ;AACvE,WAAS,gBAAgB,YAAY,EAAE,EAAE,WAAW;AACpD,QAAM,OAAO;AAAA,IAAE,MAAM,cAAc;AAAA,IAAM,SAAS,cAAc;AAAA,IAC9D,iBAAiB,cAAc,gBAAgB;AAAA,IAC/C,UAAU;AAAA,IAAM,UAAU,EAAE,IAAI,eAAe,GAAG,SAAS;AAAA,EAAE;AAC/D,EAAAC,eAAcV,MAAK,aAAa,cAAc,GAAG,GAAG,KAAK,UAAU,aAAa,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACtG,EAAAU,eAAcV,MAAK,aAAa,mBAAmB,GAAG,GAAG,KAAK,UAAU,IAAI,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAClG,SAAO,EAAE,UAAU,KAAK;AAC1B;AAEA,SAAS,YAAY,QAAQ,UAAU,OAAO;AAC5C,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,SAAS;AAAA,IAClB,WAAW,SAAS;AAAA,IACpB,cAAc,eAAe,MAAM,KAAK;AAAA,IACxC,mBAAmB,eAAe,MAAM,UAAU;AAAA,IAClD,aAAa,gBAAgB,MAAM,YAAY,MAAM,WAAW;AAAA,EAClE;AACF;AAEA,SAAS,YAAY;AAAA,EACnB;AAAA,EAAa;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAO;AACrE,GAAG;AACD,QAAM,SAASE,YAAW,QAAQ,EAAE,OAAO,SAAS,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACxF,QAAM,SAAS,QAAQ,GAAG,MAAM,IAAIS,YAAW,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK;AACjE,QAAM,SAAS,UAAU,SAAS,OAAO,IAAI,MAAM;AACnD,QAAM,aAAa,UAAU,aAAa,MAAM;AAChD,MAAI,CAAC,SAASC,YAAW,WAAW,QAAQ,GAAG;AAC7C,UAAM,WAAW,KAAK,MAAMT,cAAa,WAAW,UAAU,MAAM,CAAC;AACrE,UAAM,SAAS,YAAY,QAAQ,UAAU,UAAU;AACvD,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,UAAU,MAAM,SAAS,cAAc,SAAS,WAAW;AAC7D,UAAI,sBAAsB;AACxB,2CAAmC;AAAA,UACjC,aAAa,WAAW;AAAA,UAAU,eAAe;AAAA,QACnD,CAAC;AAAA,MACH;AACA,aAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,UAAUH,MAAK,aAAa,WAAWW,YAAW,CAAC;AACzD,QAAM,UAAUX,MAAK,SAAS,SAAS;AACvC,MAAI,gBAAgB;AACpB,MAAI;AACF,IAAAa,WAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,QAAI;AACJ,QAAI,sBAAsB;AACxB,iCAA2B,SAAS,SAAS,oBAAoB;AACjE,oBAAc;AAAA,QAAC;AAAA,QAAM;AAAA,QAAoB;AAAA,QAAkB;AAAA,QAAc;AAAA,QACvE,cAAc,eAAe;AAAA,MAAE;AAAA,IACnC,OAAO;AACL,MAAAH,eAAcV,MAAK,SAAS,cAAc,GAAG,GAAG,KAAK,UAAU;AAAA,QAC7D,MAAM;AAAA,QAAyB,SAAS;AAAA,QAAS,SAAS;AAAA,MAC5D,CAAC,CAAC;AAAA,CAAI;AACN,oBAAc;AAAA,QAAC;AAAA,QAAW;AAAA,QAAoB;AAAA,QAAkB;AAAA,QAAc;AAAA,QAC5E;AAAA,QAAuB;AAAA,QAAgB,cAAc,eAAe;AAAA,QAAI;AAAA,MAAO;AAAA,IACnF;AACA,UAAM,UAAU,OAAO;AAAA,MAAI;AAAA,MACzB,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,KAAQ;AAAA,IAAC;AAChE,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,uBAAuB,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,MAAM,EAAE;AAC7H,kBAAc,OAAO;AACrB,2BAAuB,SAAS,QAAQ;AACxC,QAAI,sBAAsB;AACxB,yCAAmC,EAAE,aAAa,SAAS,eAAe,qBAAqB,CAAC;AAAA,IAClG;AAEA,UAAM,cAAc;AAAA,MAClB,OAAOA,MAAK,SAAS,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAAA,MAC5E,YAAYA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAAA,MAChG,aAAaA,MAAK,SAAS,gBAAgB,cAAc,UAAU,cAAc;AAAA,MACjF,kBAAkBA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AAAA,MACjH,UAAU;AAAA,IACZ;AACA,UAAM,MAAM,KAAK,MAAMG,cAAa,YAAY,aAAa,MAAM,CAAC;AACpE,QAAI,IAAI,SAAS,gBAAgB,IAAI,YAAY,SAAS,QAAS,OAAM,IAAI,MAAM,qCAAqC;AACxH,QAAI,CAACC,WAAU,YAAY,gBAAgB,EAAE,OAAO,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAC/G,UAAM,QAAQ,OAAO,KAAK,CAAC,YAAY,OAAO,UAAU,WAAW,GAAG,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,IAAO,CAAC;AACnI,QAAI,MAAM,WAAW,KAAK,OAAO,MAAM,UAAU,EAAE,EAAE,KAAK,MAAM,iBAAiB,SAAS,OAAO,IAAI;AACnG,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AACA,UAAM,SAAS,YAAY,QAAQ,UAAU,WAAW;AACxD,oBAAgBJ,MAAK,SAAS,uBAAuB,GAAG,EAAE,gBAAgB,GAAG,GAAG,OAAO,CAAC;AACxF,IAAAa,WAAUb,MAAK,aAAa,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,QAAIY,YAAW,WAAW,QAAQ,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC5F,IAAAE,YAAW,SAAS,WAAW,QAAQ;AACvC,oBAAgB;AAChB,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,qCAAqC,UAAU,MAAM,EAAE;AAC1F,WAAO,EAAE,QAAQ,SAAS,KAAK;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,cAAe,CAAAC,QAAO,WAAW,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/E,UAAM;AAAA,EACR,UAAE;AACA,IAAAA,QAAO,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAClD;AACF;AAEO,SAAS,wBAAwB,SAAS;AAC/C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,MAAM,QAAQ;AAAA,IACd,aAAaH;AAAA,IACb,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,uBAAuB;AAAA,EACzB,IAAI;AACJ,MAAI,CAAC,eAAe,CAACH,YAAW,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,mCAAmC;AACxH,MAAI,CAAC,mBAAmB,CAACX,iBAAgB,KAAK,GAAG,YAAY,IAAI,eAAe,EAAE,GAAG;AACnF,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,kCAAkC;AAAA,EAC3E;AACA,MAAI,CAAC,qBAAqB,CAACC,cAAa,KAAK,iBAAiB,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,oCAAoC;AAAA,EAC7E;AACA,QAAM,YAAY,GAAG,YAAY,IAAI,eAAe;AACpD,MAAI,gBAAgB,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,wDAAwD;AAC9H,QAAM,eAAeO,SAAQ,WAAW;AACxC,QAAM,SAAS,2BAA2B,KAAK,YAAY;AAC3D,QAAM,aAAa,EAAE,KAAK,QAAQ,KAAK,aAAa;AACpD,MAAI,SAAS;AACb,MAAI;AACF,IAAAO,WAAU,cAAc,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAA,WAAUb,MAAK,cAAc,aAAa,GAAG,EAAE,WAAW,KAAK,CAAC;AAChE,IAAAU,eAAc,OAAO,uBAAuB,IAAI,EAAE,MAAM,IAAM,CAAC;AAC/D,IAAAA,eAAc,OAAO,yBAAyB,IAAI,EAAE,MAAM,IAAM,CAAC;AACjE,UAAM,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,QAAQ,YAAY,IAAI,CAAC;AACjF,UAAM,WAAW,EAAE,SAAS,iBAAiB,WAAW,kBAAkB;AAC1E,aAASV,MAAK,cAAc,WAAWW,YAAW,CAAC;AACnD,IAAAE,WAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AACrC,UAAM,SAAS,gBAAgB,OAAO,IAAI;AAAA,MACxC;AAAA,MAAQ;AAAA,MAAW;AAAA,MAAoB;AAAA,MAAU;AAAA,MAAsB;AAAA,MAAQ,cAAc,eAAe;AAAA,IAC9G,GAAG,UAAU,GAAG,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,OAAO,CAAC,IAAI;AACnD,UAAM,UAAUb,MAAK,QAAQ,SAAS,OAAO,QAAQ,YAAY,EAAE,CAAC,CAAC;AACrE,QAAI,CAACY,YAAW,OAAO,KAAK,CAAC,SAAS,OAAO,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAC/G,QAAIR,WAAU,OAAO,EAAE,OAAO,kBAAmB,OAAM,IAAI,MAAM,2CAA2C;AAC5G,QAAI,OAAO,cAAc,SAAS,aAAa,iBAAiB,OAAO,MAAM,SAAS,WAAW;AAC/F,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,UAAM,YAAY,YAAY;AAAA,MAC5B,aAAa;AAAA,MAAc;AAAA,MAAU;AAAA,MAAS;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAY;AAAA,MAC1E;AAAA,IACF,CAAC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,GAAG,UAAU;AAAA,EAC7C,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG,EAAE;AAAA,EACpI,UAAE;AACA,QAAI,OAAQ,CAAAW,QAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7D;AACF;AAEO,SAAS,8BAA8B,SAAS;AACrD,QAAM,SAAS,wBAAwB,OAAO;AAC9C,MAAI,CAAC,OAAO,GAAI,QAAO;AACvB,MAAI;AACF,iBAAaT,SAAQ,QAAQ,WAAW,GAAG,OAAO,QAAQ,QAAQ,MAAM;AACxE,WAAO,EAAE,GAAG,QAAQ,SAAS,KAAK;AAAA,EACpC,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,QAAQ,OAAO,QAAQ,GAAG;AAAA,IAC1H;AAAA,EACF;AACF;;;AIzRA,SAAS,aAAAU,kBAAiB;;;ACE1B,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,aAAY,aAAAC,YAAW,eAAAC,cAAa,gBAAAC,eAAc,UAAAC,SAAQ,iBAAAC,sBAAqB;AACxF,OAAO,QAAQ;AACf,OAAO,UAAU;AAmLjB,SAAS,kBAAkB,MAAM,QAAQ,KAAK;AAC5C,SAAO,IAAI,cAAc,IAAI,UAAU;AACzC;AAQO,SAAS,qBAAqB,MAAM,QAAQ,KAAK;AACtD,SAAO,KAAK,KAAK,kBAAkB,GAAG,GAAG,YAAY,qBAAqB,QAAQ,gBAAgB;AACpG;AA8DO,SAAS,gBAAgB,KAAK,EAAE,WAAW,QAAQ,UAAU,OAAAC,SAAQC,YAAW,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG;AAC/G,MAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG,QAAO;AAC/C,MAAI,aAAa,SAAS;AAIxB,UAAM,WAAW,KAAK,KAAK,kBAAkB,GAAG,GAAG,YAAY,cAAc;AAC7E,UAAM,IAAID,OAAM,UAAU,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,aAAa,MAAM,OAAO,UAAU,SAAS,KAAO,CAAC;AACpH,WAAO,CAAC,EAAE,SAAS,EAAE,WAAW;AAAA,EAClC;AACA,MAAI;AACF,YAAQ,KAAK,CAAC,KAAK,SAAS;AAC5B,WAAO;AAAA,EACT,QAAQ;AACN,QAAI;AACF,cAAQ,KAAK,KAAK,SAAS;AAC3B,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ADnRO,IAAM,mBAAmB;AAEzB,IAAM,0BAA0B;AAEvC,IAAM,aAAa;AAAA,EACjB;AAAA,IACE,WAAW;AAAA;AAAA,IAEX,MAAM,CAAC,OAAO,uDAAuD,KAAK,EAAE,KAAK,sCAAsC,KAAK,EAAE;AAAA,EAChI;AAAA,EACA;AAAA,IACE,WAAW;AAAA;AAAA,IAEX,MAAM,CAAC,OAAO,sDAAsD,KAAK,EAAE,KAAK,YAAY,KAAK,EAAE,KAAK,YAAY,KAAK,EAAE;AAAA,EAC7H;AACF;AAGO,SAAS,oBAAoB,aAAa;AAC/C,MAAI,OAAO,gBAAgB,YAAY,CAAC,YAAa,QAAO;AAC5D,aAAW,EAAE,WAAW,KAAK,KAAK,YAAY;AAC5C,QAAI,KAAK,WAAW,EAAG,QAAO;AAAA,EAChC;AACA,SAAO;AACT;AAOO,SAAS,oBAAoB,EAAE,WAAW,UAAU,gBAAgB,oBAAI,IAAI,EAAE,GAAG;AACtF,QAAM,QAAQ,oBAAI,IAAI;AACtB,aAAW,QAAQ,WAAW;AAC5B,QAAI,OAAO,UAAU,MAAM,GAAG,KAAK,KAAK,MAAM,EAAG,OAAM,IAAI,KAAK,KAAK,IAAI;AAAA,EAC3E;AACA,QAAM,QAAQ,CAAC;AACf,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,QAAI,cAAc,IAAI,KAAK,GAAG,EAAG;AACjC,QAAI,EAAE,OAAO,SAAS,KAAK,UAAU,KAAK,KAAK,aAAa,UAAW;AACvE,UAAM,YAAY,oBAAoB,KAAK,WAAW;AACtD,QAAI,CAAC,UAAW;AAChB,UAAM,SAAS,OAAO,UAAU,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI;AACrF,UAAM,aAAa,CAAC,UAAW,OAAO,SAAS,OAAO,UAAU,KAAK,OAAO,aAAa,KAAK;AAC9F,QAAI,CAAC,WAAY;AACjB,UAAM,KAAK,EAAE,KAAK,KAAK,KAAK,YAAY,KAAK,YAAY,WAAW,aAAa,KAAK,YAAY,CAAC;AAAA,EACrG;AACA,QAAM,KAAK,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;AAChD,SAAO,EAAE,OAAO,MAAM,MAAM,GAAG,gBAAgB,EAAE;AACnD;AAGO,SAAS,oBAAoB,MAAM,OAAO;AAC/C,QAAM,QAAQ,qCAAqC,KAAK,QAAQ,EAAE;AAClE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,MAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG,QAAO;AAC/C,SAAO;AAAA,IACL;AAAA,IACA,MAAM,OAAO,MAAM,CAAC,CAAC;AAAA,IACrB,YAAY,QAAQ,OAAO,MAAM,CAAC,CAAC,IAAI;AAAA,IACvC,aAAa,MAAM,CAAC;AAAA,EACtB;AACF;AAUO,SAAS,sBAAsB,EAAE,WAAW,QAAQ,UAAU,OAAAE,SAAQC,YAAW,QAAQ,KAAK,IAAI,GAAG,MAAM,QAAQ,KAAK,OAAO,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzJ,QAAM,OAAO,CAAC;AACd,MAAI,aAAa,SAAS;AACxB,UAAM,KACJ;AACF,UAAMC,UAASF,OAAM,qBAAqB,GAAG,GAAG,CAAC,cAAc,mBAAmB,YAAY,EAAE,GAAG;AAAA,MACjG,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AACD,QAAIE,QAAO,SAASA,QAAO,WAAW,GAAG;AAMvC,YAAM,QAAQA,QAAO,QAAQA,QAAO,MAAM,UAAU,mBAAmBA,QAAO,MAAM;AACpF,WAAK,8CAA8C,KAAK,gCAAgC;AACxF,YAAM,IAAI,MAAM,+BAA+B,KAAK,kBAAkB;AAAA,IACxE;AACA,eAAW,QAAQ,OAAOA,QAAO,UAAU,EAAE,EAAE,MAAM,QAAQ,GAAG;AAC9D,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,cAAM,MAAM,OAAO,QAAQ,CAAC;AAC5B,YAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG;AACxC,aAAK,KAAK;AAAA,UACR;AAAA,UACA,MAAM,OAAO,OAAO,EAAE;AAAA,UACtB,YAAY,OAAO,OAAO,CAAC;AAAA,UAC3B,aAAa,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AAAA,QAC3D,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAASF,OAAM,MAAM,CAAC,OAAO,0BAA0B,GAAG,EAAE,UAAU,QAAQ,SAAS,KAAQ,WAAW,KAAK,OAAO,KAAK,CAAC;AAClI,MAAI,OAAO,SAAS,OAAO,WAAW,GAAG;AACvC,UAAM,QAAQ,OAAO,QAAQ,OAAO,MAAM,UAAU,WAAW,OAAO,MAAM;AAC5E,SAAK,8CAA8C,KAAK,gCAAgC;AACxF,UAAM,IAAI,MAAM,+BAA+B,KAAK,kBAAkB;AAAA,EACxE;AACA,aAAW,QAAQ,OAAO,OAAO,UAAU,EAAE,EAAE,MAAM,IAAI,GAAG;AAC1D,UAAM,MAAM,oBAAoB,MAAM,KAAK;AAC3C,QAAI,IAAK,MAAK,KAAK,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAQO,SAAS,qBAAqB;AAAA,EACnC,QAAQ,KAAK,IAAI;AAAA,EACjB,gBAAgB,CAAC,QAAQ,GAAG;AAAA,EAC5B,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI;AACF,UAAM,YAAY,cAAc,EAAE,MAAM,CAAC;AACzC,UAAM,EAAE,MAAM,IAAI,oBAAoB;AAAA,MACpC;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,eAAe,IAAI,IAAI,aAAa;AAAA,IACtC,CAAC;AACD,UAAM,SAAS,CAAC;AAChB,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,SAAS,KAAK,GAAG;AAC9B,UAAI,uBAAuB,OAAO,WAAW,gBAAgB,QAAQ,KAAK,GAAG,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,EAAE;AACnJ,UAAI,KAAM,QAAO,KAAK,EAAE,KAAK,KAAK,KAAK,WAAW,KAAK,UAAU,CAAC;AAAA,IACpE;AACA,UAAMG,UAAS,MAAM,SAAS,OAAO;AACrC,UAAM,SAAS,MAAM,WAAW,IAC5B,2DAA2D,UAAU,MAAM,cAC3E,UAAU,OAAO,MAAM,OAAO,MAAM,MAAM,kCAAkCA,UAAS,IAAI,KAAKA,OAAM,qBAAqB,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;AACzM,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,QAAQ,OAAO;AAAA,EAC/C,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,EAAE;AAAA,EACnJ;AACF;;;AElLA,IAAM,mBAAmB;AACzB,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,eAAsB,oCAAoC;AAAA,EACxD;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,SAAS;AACX,GAAG;AACD,MAAI,CAAC,oBAAoB,CAAC,wBAAyB,OAAM,IAAI,MAAM,4CAA4C;AAC/G,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI;AACF,YAAM,UAAU,MAAM,OAAO,gBAAgB,EAAE,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG,CAAC;AACtF,YAAM,SAAS,QAAQ,KAAK,CAAC,SAAS,MAAM,cAAcA,aACrD,KAAK,WAAW,aACf,mBACA,KAAK,aAAa,uBAAuB,mBACzC,QAAQ,KAAK,aAAa,kBAAkB,KACzC,KAAK,YAAY,uBAAuB,4BAC5C,KAAK,aAAa,mBAAmB,iBACrC,KAAK,aAAa,2BAA2B,mBAAmB,wBAChE,KAAK,aAAa,uBAAuB,mBAAmB,qBAC5D,mBAAmB,aAAa,MAAM,CAAC,UAAU,KAAK,aAAa,yBAAyB,SAAS,KAAK,CAAC,KAC3G,MAAM,QAAQ,KAAK,aAAa,gBAAgB,KAShD,KAAK,YAAY,iBAAiB,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,YAAY,iBACjF,MAAM,cAAc,IAAI,CAAC;AAChC,UAAI,OAAQ,QAAO;AAAA,IACrB,QAAQ;AAAA,IAAsB;AAC9B,UAAM,MAAM,MAAM;AAAA,EACpB;AACA,QAAM,IAAI,MAAM,qDAAqD;AACvE;AAOA,eAAsB,wBAAwB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAA;AAAA,EACA,UAAAC;AAAA,EACA,gBAAAC;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA,sBAAsB,MAAM;AAAA,EAC5B,aAAAC;AAAA,EACA,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,MAAM,MAAM;AAAA,EAAC;AACf,GAAG;AACD,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,QAAM,oBAAoB,QAAQ,QAAQ,aAAaL;AACvD,QAAM,sBAAsB,QAAQ,QAAQ,eAAe;AAC3D,MAAI,QAAQ,QAAQ,oBAAoB,UAAU;AAChD,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ,QAAQ,QAAQ;AAAA,MAC1B,CAAC;AACD,mCAA6B,aAAa,OAAO;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnH,YAAMK,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,wBAAwB,EAAE,aAAa,UAAAJ,WAAU,SAASC,gBAAe,CAAC;AACxF,QAAI,CAAC,YAAY,GAAI,OAAM,IAAI,MAAM,YAAY,MAAM;AACvD,QAAI,CAAE,MAAMC,oBAAmB,KAAK,GAAI;AAItC,UAAI,oBAAoB,KAAK,EAAG,QAAO;AACvC,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAAA,EACF,SAAS,OAAO;AACd,QAAI,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AACpH,QAAI,aAAa;AACjB,QAAI;AACF,mBAAa,mBAAmB,aAAa,SAAS,MAAM;AAAA,IAC9D,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,uBAAuB,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IACxI;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAER,UAAE;AACA,YAAME,WAAU,KAAK;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AAEA,MAAI,4BAA4B;AAChC,MAAI;AACF,UAAM,SAAS,MAAMD,aAAY;AACjC,gCAA4B,QAAQ,oBAAoB;AACxD,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,kBAAkB,QAAQ;AAAA,MAC1B,eAAe,UAAU,YAAY,OAAO,OAAO;AAAA,MACnD;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,MAC5D,UAAU;AAAA,MACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,MACjE,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,2BAA2B,YAAY,OAAO,OAAO,IAAI,YAAY,OAAO,SAAS;AAAA,IAC/F,CAAC;AACD,uBAAmB,aAAa,YAAY,OAAO;AACnD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AAC3H,QAAI;AACJ,QAAI;AAAE,cAAQ,sBAAsB,aAAa,YAAY,SAAS,OAAO;AAAA,IAAG,SACzE,YAAY;AACjB,UAAI,2CAA2C,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC,EAAE;AACtH,YAAMC,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AACA,QAAI,MAAM,QAAQ,eAAe,kBAAkB;AACjD,UAAI,uCAAuC,MAAM,QAAQ,YAAY,IAAI,gBAAgB,GAAG;AAC5F,YAAMA,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,aAAa,aAAa,MAAM,QAAQ;AACzD,QAAI,SAAS,GAAG,OAAO,mDAAmD,MAAM,GAAG,GAAG;AACtF,QAAI,gBAAgB;AACpB,QAAI,aAAa;AACjB,QAAI;AACF,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,6BAA6B,SAAS,MAAM,IAAI,EAAE,OAAO,MAAM,CAAC;AAClG,mBAAa,mBAAmB,aAAa,OAAO,MAAM;AAC1D,YAAMA,WAAU,KAAK;AACrB,sBAAgB,oBAAoB,SAAS,MAAM,KAAK;AACxD,UAAI,CAAE,MAAMF,oBAAmB,aAAa,EAAI,OAAM,IAAI,MAAM,gDAAgD,EAAE,OAAO,MAAM,CAAC;AAChI,YAAM,SAAS,MAAMC,aAAY;AACjC,YAAM,mBAAmB;AAAA,QACvB;AAAA,QACA,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,kBAAkB,QAAQ;AAAA,QAC1B,yBAAyB,QAAQ,mBAAmB,SAAY;AAAA,QAChE,eAAe,UAAU,MAAM,SAAS,OAAO;AAAA,QAC/C;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,4BAA4B,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IAC7I;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,MAAM,QAAQ,WAAW;AAAA,QAC1D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAAqE;AAC7E,QAAI,cAAe,OAAMC,WAAU,aAAa;AAAA,QAC3C,OAAMA,WAAU,KAAK;AAC1B,WAAO;AAAA,EACT;AACF;;;AC9LA,IAAMC,cAAa;AAEZ,SAAS,oBAAoB,OAAO;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQA,YAAW,KAAK,MAAM,KAAK,CAAC;AAC1C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,MAAM,CAAC,IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,SAAU,SAAS,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,IAAK,IAC7E;AACJ,SAAO,EAAE,SAAS,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW;AACvF;AAGO,SAAS,uBAAuB,GAAG,GAAG;AAC3C,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG;AAC7B,UAAM,KAAK,EAAE,QAAQ,CAAC,KAAK;AAC3B,UAAM,KAAK,EAAE,QAAQ,CAAC,KAAK;AAC3B,QAAI,OAAO,GAAI,QAAO,KAAK,KAAK,KAAK;AAAA,EACvC;AACA,MAAI,CAAC,EAAE,cAAc,CAAC,EAAE,WAAY,QAAO;AAC3C,MAAI,CAAC,EAAE,WAAY,QAAO;AAC1B,MAAI,CAAC,EAAE,WAAY,QAAO;AAC1B,QAAM,MAAM,KAAK,IAAI,EAAE,WAAW,QAAQ,EAAE,WAAW,MAAM;AAC7D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAC/B,UAAM,KAAK,EAAE,WAAW,CAAC;AACzB,UAAM,KAAK,EAAE,WAAW,CAAC;AACzB,QAAI,OAAO,OAAW,QAAO;AAC7B,QAAI,OAAO,OAAW,QAAO;AAC7B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,OAAO,OAAO;AAC3B,UAAM,OAAO,OAAO,OAAO;AAC3B,QAAI,QAAQ,KAAM,QAAO,KAAK,KAAK,KAAK;AACxC,QAAI,SAAS,KAAM,QAAO,OAAO,KAAK;AACtC,WAAO,OAAO,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK;AAAA,EACxC;AACA,SAAO;AACT;AAOO,SAAS,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EACd,WAAW;AACb,GAAG;AACD,QAAM,UAAU,CAAC,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAK3B,MAAM,CAAC,YAAY;AAAA,IACnB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,OAAO,kBAAkB,SAAS;AAAA,IAC3C,YAAY,WAAW,kBAAkB,SAAS,IAAI,YAAY;AAAA,IAClE;AAAA,EACF;AAEA,MAAI,CAAC,YAAa,QAAO,QAAQ,iBAAiB;AAElD,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,WAAW;AAAA,EACnC,SAAS,OAAO;AACd,WAAO,QAAQ,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EAC3G;AACA,MAAI,CAAC,SAAS,OAAQ,QAAO,QAAQ,2BAA2B;AAIhE,MAAI,QAAQ,QAAS,QAAO,QAAQ,kCAAkC;AAEtE,QAAM,gBAAgB,oBAAoB,QAAQ,OAAO,OAAO;AAChE,QAAM,iBAAiB,oBAAoB,cAAc;AAGzD,MAAI,CAAC,cAAe,QAAO,QAAQ,oCAAoC,OAAO,QAAQ,OAAO,OAAO,CAAC,EAAE;AACvG,MAAI,CAAC,eAAgB,QAAO,QAAQ,gCAAgC,OAAO,cAAc,CAAC,EAAE;AAC5F,MAAI,uBAAuB,eAAe,cAAc,KAAK,GAAG;AAC9D,WAAO,QAAQ,eAAe,QAAQ,OAAO,OAAO,8BAA8B,cAAc,EAAE;AAAA,EACpG;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,SAAS,aAAa,QAAQ,MAAM;AAAA,EAClD,SAAS,OAAO;AACd,WAAO,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EACnG;AACA,MAAI,CAAC,WAAW,GAAI,QAAO,QAAQ,wBAAwB,WAAW,UAAU,SAAS,EAAE;AAE3F,QAAM,QAAQ,UAAU,MAAM;AAC9B,SAAO;AAAA,IACL,MAAM,CAAC,OAAO,QAAQ;AAAA,IACtB;AAAA,IACA,QAAQ;AAAA,IACR,SAAS,QAAQ,OAAO;AAAA,IACxB,YAAY,eAAe,QAAQ,OAAO,OAAO,IAAI,KAAK;AAAA,IAC1D,QAAQ,kBAAkB,QAAQ,OAAO,OAAO;AAAA,EAClD;AACF;;;AC3FO,IAAM,uBAAuB,KAAK,KAAK;AACvC,IAAM,yBAAyB;AACtC,IAAM,mBAAmB,IAAI,KAAK,KAAK;AACvC,IAAM,qBAAqB;AAC3B,IAAM,qBAAqB,IAAI,KAAK;AAG7B,IAAM,+BAA+B;AACrC,IAAM,wBAAwB;AAErC,IAAM,UAAU,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAExE,SAAS,eAAe,KAAK;AAC3B,MAAI,QAAQ,UAAa,QAAQ,QAAQ,OAAO,GAAG,EAAE,KAAK,MAAM,GAAI,QAAO;AAC3E,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,SAAS,KAAK,KAAK,SAAS,IAAI,QAAQ;AACxD;AAQO,SAAS,kBAAkB,MAAM,CAAC,GAAG;AAC1C,QAAM,KAAK,eAAe,IAAI,6BAA6B;AAC3D,MAAI,OAAO,KAAM,QAAO,KAAK,IAAI,IAAI,gBAAgB;AACrD,QAAM,UAAU,eAAe,IAAI,8BAA8B;AACjE,MAAI,YAAY,KAAM,QAAO,KAAK,IAAI,UAAU,KAAQ,gBAAgB;AACxE,SAAO;AACT;AAEO,SAAS,oBAAoB,MAAM,CAAC,GAAG;AAC5C,QAAM,KAAK,eAAe,IAAI,+BAA+B;AAC7D,MAAI,OAAO,KAAM,QAAO;AACxB,SAAO,KAAK,IAAI,KAAK,IAAI,IAAI,kBAAkB,GAAG,kBAAkB;AACtE;AASO,SAAS,gBAAgB,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAC,GAAG;AACpE,MAAI,CAAC,cAAc;AACjB,WAAO,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,OAAO,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAClF;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,OAAO;AAClC,WAAO,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,OAAO,OAAO,UAAU,MAAM,kBAAkB,KAAK;AAAA,EACnF;AACA,QAAM,MAAM,MAAM,QAAQ,OAAO,aAAa,IAC1C,OAAO,cAAc,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EAAE,OAAO,OAAO,IAC3D,CAAC;AACL,QAAM,WAAW,OAAO,OAAO,WAAW;AAC1C,QAAM,QAAQ,OAAO,SAAS,QAAQ,KAAK,YAAY,IAAI,WAAW,IAAI;AAC1E,SAAO;AAAA,IACL,OAAO,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,IACjC;AAAA,IACA,OAAO;AAAA,IACP,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACtD,kBAAkB,OAAO,mBAAmB,OAAO,OAAO,gBAAgB,IAAI;AAAA,EAChF;AACF;AAMO,SAAS,gBAAgB,EAAE,QAAQ,WAAW,MAAM,GAAG;AAC5D,QAAM,OAAO,OAAO,QAAQ,OAAO,QAAQ;AAC3C,MAAI,OAAO,SAAS,OAAO,UAAU,EAAG,QAAO,EAAE,QAAQ,WAAW,KAAK;AACzE,MAAI,aAAa,MAAO,QAAO,EAAE,QAAQ,OAAO,KAAK;AACrD,SAAO,EAAE,QAAQ,QAAQ,KAAK;AAChC;AAEA,SAAS,aAAa,QAAQ;AAC5B,MAAI,CAAC,OAAO,MAAO,QAAO;AAC1B,QAAM,MAAM,OAAO,IAAI,SAAS,IAAI,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC,MAAM;AACpE,SAAO,GAAG,OAAO,KAAK,kBAAkB,GAAG;AAC7C;AAEA,eAAe,gBAAgB,EAAE,QAAQ,kBAAkB,IAAI,GAAG;AAChE,MAAI,OAAO,IAAI,WAAW,GAAG;AAC3B,QAAI,OAAO,QAAQ,KAAK,CAAC,OAAO,OAAO;AACrC,UAAI,iCAAiC,aAAa,MAAM,CAAC,uDAAkD;AAAA,IAC7G;AACA,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SAAS,CAAC;AAChB,aAAW,UAAU,OAAO,KAAK;AAC/B,QAAI;AACF,YAAM,iBAAiB,QAAQ;AAAA,QAC7B,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,kBAAkB,OAAO;AAAA,MAC3B,CAAC;AACD,aAAO,KAAK,MAAM;AAAA,IACpB,SAAS,OAAO;AACd,UAAI,uBAAuB,MAAM,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAiBA,eAAsB,uBAAuB;AAAA,EAC3C;AAAA,EACA,iBAAiB,MAAM;AAAA,EACvB,mBAAmB,YAAY;AAAA,EAAC;AAAA,EAChC,YAAY;AAAA,EACZ,MAAM,CAAC;AAAA,EACP,MAAM,KAAK;AAAA,EACX,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,QAAM,QAAQ,kBAAkB,GAAG;AACnC,QAAM,UAAU,oBAAoB,GAAG;AACvC,QAAM,YAAY,IAAI;AACtB,MAAI,SAAS;AACb,MAAI,eAAe;AAEnB,QAAM,WAAW,YAAY;AAC3B,cAAU;AACV,UAAM,eAAe,QAAQ,eAAe,CAAC;AAC7C,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,WAAW;AAAA,IAC5B,QAAQ;AACN,eAAS;AAAA,IACX;AACA,WAAO,gBAAgB,QAAQ,EAAE,aAAa,CAAC;AAAA,EACjD;AAIA,MAAI,CAAC,WAAW;AACd,UAAM,SAAS,MAAM,SAAS;AAC9B,QAAI,OAAO,SAAS,OAAO,QAAQ,GAAG;AACpC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,oBAAoB,OAAO,KAAK;AAAA,QACxC,QAAQ;AAAA,QACR,UAAU;AAAA,QACV;AAAA,QACA,eAAe,CAAC;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,SAAS,MAAM,QAAQ,eAAe,QAAQ,OAAO,UAAU,GAAG,QAAQ,eAAe,CAAC,EAAE;AAAA,EACvG;AAEA,aAAS;AACP,UAAM,SAAS,MAAM,SAAS;AAC9B,UAAM,YAAY,IAAI,IAAI;AAC1B,UAAM,OAAO,gBAAgB,EAAE,QAAQ,WAAW,MAAM,CAAC;AAEzD,QAAI,KAAK,WAAW,WAAW;AAC7B,UAAI,iBAAiB,MAAM;AACzB,YAAI,+BAA+B,KAAK,MAAM,YAAY,GAAI,CAAC,sDAAiD;AAAA,MAClH;AACA,aAAO,EAAE,SAAS,MAAM,QAAQ,eAAe,QAAQ,OAAO,UAAU,WAAW,QAAQ,eAAe,CAAC,EAAE;AAAA,IAC/G;AAEA,QAAI,KAAK,WAAW,OAAO;AACzB,UAAI,kCAAkC,KAAK,MAAM,YAAY,GAAI,CAAC,UAAU,KAAK,MAAM,QAAQ,GAAI,CAAC,aAAQ,aAAa,MAAM,CAAC,kCAAkC;AAClK,YAAM,gBAAgB,MAAM,gBAAgB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;AAC7E,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ,kDAAkD,cAAc,MAAM,gBAAgB,4BAA4B;AAAA,QAC1H,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAIA,UAAM,cAAc,GAAG,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,CAAC;AACxD,QAAI,gBAAgB,cAAc;AAChC,qBAAe;AACf,UAAI,0CAAqC,aAAa,MAAM,CAAC,uBAAuB,KAAK,MAAM,UAAU,GAAI,CAAC,qBAAqB,KAAK,MAAM,QAAQ,GAAI,CAAC,IAAI;AAAA,IACjK;AACA,UAAMA,OAAM,KAAK,IAAI,GAAG,KAAK,IAAI,SAAS,QAAQ,SAAS,CAAC,CAAC;AAAA,EAC/D;AACF;;;AC/OA,SAAS,YAAY,sBAAsB;;;ACU3C,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AAEhC,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,oCAAoC;AAE1C,IAAM,gDAAgD;AAEtD,IAAM,yCAAyC;AAC/C,IAAM,qCAAqC;AAClD,IAAM,oBAAoB;AAC1B,IAAMC,WAAU;AAET,SAAS,6BAA6B,MAAM,CAAC,GAAG;AACrD,SAAO,OAAO,IAAI,wBAAwB,EAAE,EACzC,MAAM,SAAS,EACf,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACnB;AAEO,SAAS,+BAA+B,cAAc;AAC3D,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC3D,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MAAI,aAAa,SAAS,mCAAmC;AAC3D,UAAM,IAAI,MAAM,yCAAyC,iCAAiC,eAAe;AAAA,EAC3G;AACA,QAAM,aAAa,aAAa,IAAI,CAAC,SAAS;AAC5C,UAAM,CAAC,OAAO,IAAI,IAAI,OAAO,SAAS,WAAW,KAAK,MAAM,GAAG,IAAI,CAAC;AACpE,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,OAAO,CAAC,kBAAkB,KAAK,IAAI,KAC5E,UAAU,OAAO,UAAU,QAAQ,SAAS,OAAO,SAAS,MAAM;AACrE,YAAM,IAAI,MAAM,wEAAwE;AAAA,IAC1F;AACA,WAAO,KAAK,YAAY;AAAA,EAC1B,CAAC;AACD,MAAI,IAAI,IAAI,UAAU,EAAE,SAAS,WAAW,QAAQ;AAClD,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,QAAM,SAAS,IAAI,IAAI,WAAW,IAAI,CAAC,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACnE,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO,OAAO,OAAO,WAAW,KAAK,CAAC;AACxC;AAEO,SAAS,4BAA4B,cAAc;AACxD,QAAM,QAAQ,+BAA+B,YAAY;AACzD,SAAOC,YAAW,QAAQ,EAAE,OAAO,KAAK,UAAU;AAAA,IAChD,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC,GAAG,MAAM,EAAE,OAAO,KAAK;AAC1B;AAEO,SAAS,4BAA4B,WAAW;AACrD,MAAI,WAAW,WAAW,QAAQ,WAAW,gBAAgB,MAAO,QAAO;AAC3E,MAAI,OAAO,SAAS,UAAU,YAAY,KAAK,UAAU,eAAe,GAAG;AACzE,WAAO,KAAK,KAAK,UAAU,YAAY;AAAA,EACzC;AACA,SAAO;AACT;AAuBO,SAAS,oCAAoC,SAAS;AAC3D,MAAI,SAAS,SAAS,0CACjB,CAACC,SAAQ,KAAK,OAAO,QAAQ,SAAS,EAAE,CAAC,KACzC,CAAC,OAAO,SAAS,QAAQ,YAAY,KACrC,QAAQ,gBAAgB,EAAG,QAAO;AACvC,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,QAAQ;AAAA,IACf,cAAc,KAAK,KAAK,QAAQ,YAAY;AAAA,IAC5C,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,EAC7D,CAAC;AACH;AA+DA,SAAS,OAAO;AAAA,EACd,SAAS;AAAA,EACT,aAAa;AAAA,EACb,WAAW;AAAA,EACX,cAAc;AAAA,EACd,eAAe;AAAA,EACf;AAAA,EACA;AACF,GAAG;AACD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,OAAO,SAAS,YAAY,KAAK,eAAe,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,IAC5E;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,UAAU,MAAM;AAC5C,QAAM,4BAA4B,SAAS,WAAW,OACjD,MAAM,UAAU;AACrB,MAAI,SAAS,WAAW,OAAO,CAAC,0BAA2B,QAAO;AAClE,QAAM,QAAQ,CAAC,iBAAiB,4BAC5B,KAAK,IAAI,+CAA+C,YAAY,IACpE;AACJ,QAAM,QAAQ,SAAS,SAAS,MAAM,aAAa,GAAG,KAAK,KAAK;AAChE,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,SAAS,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG;AACrD,WAAO,MAAM,KAAK,IAAI,KAAO,KAAK,KAAK,UAAU,GAAK,CAAC,CAAC;AAAA,EAC1D;AACA,QAAM,KAAK,QAAQ,KAAK,MAAM,KAAK,IAAI,OAAO;AAC9C,MAAI,OAAO,SAAS,EAAE,GAAG;AACvB,WAAO,MAAM,KAAK,IAAI,KAAO,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC;AAAA,EAC1D;AACA,SAAO,MAAM,GAAM;AACrB;AAEA,eAAe,aAAa,UAAU;AACpC,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAM,UAAU;AACrC,SAAO,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;AACzF;AAEA,eAAe,qBAAqB,WAAW,KAAK,MAAM,WAAW;AACnE,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI;AACJ,QAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,WAAW;AACzC,YAAQ,WAAW,MAAM;AACvB,iBAAW,MAAM;AACjB,aAAO,IAAI,MAAM,yBAAyB,SAAS,IAAI,CAAC;AAAA,IAC1D,GAAG,SAAS;AAAA,EACd,CAAC;AACD,MAAI;AACF,UAAM,kBAAkB,YAAY;AAClC,YAAM,WAAW,MAAM,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAC5E,aAAO,EAAE,UAAU,MAAM,MAAM,aAAa,QAAQ,EAAE;AAAA,IACxD,GAAG;AACH,WAAO,MAAM,QAAQ,KAAK,CAAC,gBAAgB,OAAO,CAAC;AAAA,EACrD,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAaA,eAAsB,qBAAqB;AAAA,EACzC;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,eAAe,CAAC;AAAA,EAChB,YAAY;AAAA;AAAA;AAAA;AAAA,EAIZ,kBAAkB;AACpB,GAAG;AACD,QAAM,OAAO,gBAAgB,QAAQ,SAAS,EAAE;AAChD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,UAAU,kBAAkB,MAAM,SAAS,IAAI,MAAM;AAAA,MACtD;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS,gCAAgC,MAAM;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,iBAAiB,IAAI;AACxB,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBAAgB,QACzB,SAAS,SAAS,cAClB,OAAO,SAAS,gBAAgB,YAChC,CAAC,SAAS,YAAY,KAAK,KAC3B,OAAO,SAAS,cAAc,YAC9B,CAAC,SAAS,UAAU,KAAK,GACzB;AACA,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,SAAS,YAAY,KAAK;AAC7C,QAAM,WAAW,SAAS,UAAU,KAAK;AACzC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI,kBAAkB;AACtB,MAAI;AACF,QAAI,CAAC,MAAM,QAAQ,YAAY,GAAG;AAChC,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AACA,QAAI,aAAa,SAAS,EAAG,mBAAkB,+BAA+B,YAAY;AAAA,EAC5F,SAAS,OAAO;AACd,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,GAAG,IAAI,uCAAuC;AAC3E,eAAW,QAAQ,mBAAmB,CAAC,EAAG,cAAa,aAAa,OAAO,QAAQ,IAAI;AACvF,KAAC,EAAE,UAAU,gBAAgB,MAAM,OAAO,IAAI,MAAM;AAAA,MAClD;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,sDAAsD,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AAEA,QAAM,sBAAsB,OAAO;AACnC,QAAM,uBAAuB,OAAO;AACpC,QAAM,gBAAgB,OAAO;AAC7B,MAAI,0BAA0B;AAC9B,MAAI;AACF,8BAA0B,+BAA+B,aAAa;AAAA,EACxE,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,mBAAmB;AAC1C,QAAM,iBAAiB,oBAAoB,OACvC,OAAO,4BAA4B,sCAChC,yBAAyB,WAAW,IACvC,OAAO,4BAA4B;AACvC,QAAM,0BAA0B,mBAAmB,QAC9C,4BAA4B,QAC5B,MAAM,QAAQ,aAAa,KAC3B,cAAc,WAAW,wBAAwB,UACjD,cAAc,MAAM,CAAC,MAAM,UAAU,SAAS,wBAAwB,KAAK,CAAC,KAC5E,wBAAwB,WAAW,eAAe,UAClD,wBAAwB,MAAM,CAAC,MAAM,UAAU,SAAS,eAAe,KAAK,CAAC,KAC7E,OAAO,4BAA4B,4BAA4B,cAAc,KAC7E,yBAAyB,eAAe,UACxC,mBACC,wBAAwB,SAAS,wBAAwB;AAC/D,MAAI,CAAC,eAAe,MAAM,OAAO,eAAe,QAAQ,OAAO,aAAa,QACvE,OAAO,sBAAsB,QAC7B,CAAC,yBAAyB;AAC7B,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,OAAO,QAAQ;AAChF,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,cAAc,qBAAqB,gBAAgB,MAAM;AAAA,MACzD;AAAA,MACA,SAAS,cAAc,QAAQ,6CAA6C,eAAe,MAAM,IAAI;AAAA,IACvG,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,uBAAuB,OAAO;AAAA,IAC9B,OAAO;AAAA,IACP,SAAS,6DAA6D,oBAAoB;AAAA,EAC5F;AACF;AAEO,SAAS,oBAAoB,WAAW;AAC7C,SAAO,WAAW,OAAO,QACvB,WAAW,WAAW,QACtB,OAAO,UAAU,eAAe,YAChC,UAAU,WAAW,KAAK,IACxB,UAAU,WAAW,KAAK,IAC1B;AACN;;;ADrZO,SAAS,0BAA0B,MAAM,CAAC,GAAG,WAAW,gBAAgB;AAC7E,QAAM,WAAW,OAAO,IAAI,qBAAqB,EAAE,EAAE,KAAK;AAC1D,SAAO,YAAY,kBAAkB,SAAS,CAAC;AACjD;AAGO,SAAS,wBAAwB;AAAA,EACtC,UAAU,CAAC;AAAA,EACX;AAAA,EACA,qBAAqB;AAAA,EACrB,mBAAmB;AACrB,IAAI,CAAC,GAAG;AACN,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,sBAAsB;AAAA,EACxB;AACA,QAAM,aAAa,OAAO,uBAAuB,WAAW,mBAAmB,KAAK,IAAI;AACxF,QAAM,aAAa,OAAO,qBAAqB,WAAW,iBAAiB,KAAK,IAAI;AAEpF,MAAI,WAAY,UAAS,+BAA+B;AAAA,MACnD,QAAO,SAAS;AAErB,MAAI,WAAY,UAAS,8BAA8B;AACvD,SAAO;AACT;AAGA,eAAsB,sBAAsB;AAAA,EAC1C,UAAU,CAAC;AAAA,EACX,mBAAmB;AAAA,EACnB;AAAA,EACA,iBAAiB;AACnB,IAAI,CAAC,GAAG;AACN,QAAM,qBAAqB,QAAQ,8BAA8B,KAAK;AACtE,QAAM,QAAQ,sBAAsB,kBAAkB;AACtD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AAEvF,MAAI,aAAa,OAAO,QAAQ,+BAA+B,EAAE,EAC9D,MAAM,SAAS,EACf,OAAO,OAAO,EAAE,CAAC,KAAK;AACzB,MAAI,kBAAkB,6BAA6B,OAAO;AAC1D,MAAI,sBAAsB;AAC1B,MAAI,cAAc;AAClB,MAAI,iBAAiB;AACrB,MAAI,CAAC,oBAAoB;AACvB,UAAM,YAAY,MAAM,eAAe;AAAA,MACrC;AAAA,MACA;AAAA,MACA,eAAe;AAAA,MACf,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,cAAc,oBAAoB,SAAS,MAC3C,WAAW,WAAW,QAAQ,OAAO,UAAU,eAAe,WAC9D,UAAU,WAAW,KAAK,IAC1B;AACN,iBAAa,eAAe;AAC5B,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2DAA2D;AAC5F,QAAI,UAAU,MAAM,MAAM,QAAQ,UAAU,eAAe,GAAG;AAC5D,wBAAkB,CAAC,GAAG,UAAU,eAAe;AAC/C,oBAAc;AAAA,IAChB,OAAO;AACL,oBAAc;AACd,uBAAiB,OAAO,WAAW,UAAU,WAAW,UAAU,QAAQ;AAC1E,4BAAsB,4BAA4B,SAAS;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,mBAAmB,gBAAgB,SAAS,IAC9C,EAAE,GAAG,SAAS,sBAAsB,gBAAgB,KAAK,GAAG,EAAE,IAC9D;AAEJ,QAAM,WAAW,wBAAwB;AAAA,IACvC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,kBAAkB,qBAAqB,OAAO;AAAA,EAChD,CAAC;AACD,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,GAAI,aAAa,EAAE,6BAA6B,WAAW,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AErGA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,UAAS,QAAAC,aAAY;AAC9B,SAAS,iBAAAC,sBAAqB;AAEvB,SAAS,4BAA4B,UAAU,YAAY,KAAK;AACrE,QAAM,YAAYF,SAAQE,eAAc,OAAO,CAAC;AAChD,QAAM,UAAUD,MAAK,WAAW,iCAAiC;AACjE,QAAM,SAASA,MAAK,WAAW,MAAM,kCAAkC;AACvE,SAAOF,YAAW,MAAM,IAAI,SAAS;AACvC;AAGO,SAAS,6BAA6B;AAAA,EAC3C,OAAAI,SAAQL;AAAA,EACR,WAAW,QAAQ;AAAA,EACnB,aAAa,4BAA4B;AAAA,EACzC,aAAa,CAAC;AAAA,EACd,MAAM,QAAQ;AAChB,IAAI,CAAC,GAAG;AACN,QAAM,SAASK,OAAM,UAAU,CAAC,YAAY,GAAG,UAAU,GAAG;AAAA,IAC1D;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AACrD,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;;;ACpCO,IAAM,0BAA0B,OAAO,OAAO;AAAA,EACnD,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,eAAe;AACjB,CAAC;AAEM,SAAS,qBAAqB,UAAU,CAAC,GAAG;AACjD,QAAM,SAAS,EAAE,GAAG,yBAAyB,GAAG,QAAQ;AACxD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,GAAG,6BAA6B;AAAA,EAChG;AACA,MAAI,aAAa;AAEjB,SAAO,OAAO,OAAO;AAAA,IACnB,WAAW,WAAW,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,SAAS,KAAK,CAAC,OAAO,SAAS,QAAQ,KAAK,WAAW,WAAW;AACrF,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,YAAM,WAAW,WAAW;AAC5B,mBAAa,YAAY,OAAO,iBAAiB,IAAI,aAAa;AAClE,YAAM,UAAU,cAAc,OAAO;AACrC,YAAM,UAAU,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,OAAO,cAAe,KAAK,KAAK,IAAI,GAAG,aAAa,CAAC;AAAA,MACvD;AACA,aAAO,OAAO,OAAO,EAAE,YAAY,UAAU,SAAS,QAAQ,CAAC;AAAA,IACjE;AAAA,IACA,WAAW;AACT,aAAO,OAAO,OAAO,EAAE,YAAY,SAAS,cAAc,OAAO,cAAc,CAAC;AAAA,IAClF;AAAA,EACF,CAAC;AACH;;;AC3BA,IAAM,qBAAqB,oBAAI,QAAQ;AAQhC,SAAS,wCACd,QACA,cACA,kBAAkB,MAAM;AAAC,GACzB;AACA,MAAI,YAAY;AAChB,QAAM,UAAU,CAAC,MAAM,QAAQ,SAAS;AACtC,uBAAmB,IAAI,MAAM;AAC7B,QAAI,UAAW,QAAO;AACtB,gBAAY;AACZ,iBAAa,OAAO,OAAO,EAAE,QAAQ,MAAM,MAAM,CAAC,CAAC;AACnD,WAAO;AAAA,EACT;AACA,SAAO,GAAG,SAAS,CAAC,UAAU;AAC5B,oBAAgB,KAAK;AAIrB,QAAI,OAAO,QAAQ,UAAa,OAAO,QAAQ,KAAM,SAAQ,SAAS,KAAK;AAAA,EAC7E,CAAC;AACD,SAAO,GAAG,QAAQ,MAAM;AAAE,YAAQ,MAAM;AAAA,EAAG,CAAC;AAC5C,SAAO,OAAO,OAAO,EAAE,WAAW,MAAM,UAAU,CAAC;AACrD;AAEO,SAAS,yBAAyB,QAAQ;AAI/C,SAAO,mBAAmB,IAAI,MAAM,KAC/B,OAAO,aAAa,SACnB,OAAO,cAAc,UAAU;AACvC;AAEO,SAAS,yBAAyB,QAAQ;AAC/C,SAAO,CAAC,yBAAyB,MAAM;AACzC;AAEO,SAAS,6BAA6B,EAAE,UAAU,UAAU,UAAU,MAAM,GAAG;AACpF,SAAO,CAAC,YAAY,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,yBAAyB,KAAK;AACzF;AAEO,SAAS,mCAAmC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AACF,GAAG;AACD,SAAO,WAAW,gBACb,QAAQ,aAAa,MACrB,OAAO,SAAS,YAAY,KAC5B,eAAe;AACtB;AASO,SAAS,yCAAyC;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AACF,GAAG;AACD,QAAM,UAAU,oBAAI,QAAQ;AAC5B,QAAM,WAAW,oBAAI,QAAQ;AAC7B,QAAM,sBAAsB,oBAAI,QAAQ;AAExC,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc,QAAQ,SAAS;AAC7B,UAAI,CAAC,UAAU,WAAW,aAAa,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KACjF,OAAO,SAAS,UAAU,YAAY,CAAC,QAAQ,SAC/C,CAAC,OAAO,SAAS,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,EAAG,QAAO;AACjF,cAAQ,IAAI,QAAQ,OAAO,OAAO;AAAA,QAChC,OAAO,QAAQ;AAAA,QACf,cAAc,KAAK,KAAK,QAAQ,YAAY;AAAA,MAC9C,CAAC,CAAC;AACF,aAAO;AAAA,IACT;AAAA,IACA,yBAAyB,QAAQ,YAAY;AAC3C,UAAI,CAAC,UAAU,CAAC,OAAO,UAAU,UAAU,EAAG,QAAO;AACrD,0BAAoB,IAAI,QAAQ,UAAU;AAC1C,aAAO;AAAA,IACT;AAAA,IACA,WAAW,QAAQ;AACjB,YAAM,UAAU,SAAS,QAAQ,IAAI,MAAM,IAAI;AAC/C,aAAO,QAAQ,MAAM,MAAM,SAAS,IAAI,MAAM,KAAK,mCAAmC;AAAA,QACpF;AAAA,QACA,cAAc,aAAa;AAAA,QAC3B,cAAc,SAAS;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,QAAQ,QAAQ;AACd,UAAI,CAAC,OAAQ,QAAO;AACpB,UAAI,SAAS,IAAI,MAAM,EAAG,QAAO;AACjC,YAAM,UAAU,QAAQ,IAAI,MAAM;AAClC,UAAI,CAAC,mCAAmC;AAAA,QACtC;AAAA,QACA,cAAc,aAAa;AAAA,QAC3B,cAAc,SAAS;AAAA,MACzB,CAAC,EAAG,QAAO;AACX,YAAM,qBAAqB,oBAAoB,IAAI,MAAM;AACzD,eAAS,IAAI,MAAM;AACnB,cAAQ,OAAO,MAAM;AACrB,0BAAoB,OAAO,MAAM;AACjC,0BAAoB,MAAM;AAC1B,iBAAW,OAAO,OAAO;AAAA,QACvB;AAAA,QACA,cAAc,QAAQ;AAAA,QACtB,oBAAoB,OAAO,UAAU,kBAAkB,IAAI,qBAAqB;AAAA,MAClF,CAAC,CAAC;AACF,aAAO;AAAA,IACT;AAAA,IACA,OAAO,QAAQ;AACb,UAAI,CAAC,OAAQ;AACb,cAAQ,OAAO,MAAM;AACrB,0BAAoB,OAAO,MAAM;AAAA,IACnC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qCAAqC;AAAA,EACnD;AAAA,EACA;AACF,GAAG;AACD,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,gBAAgB,OAAO,UAAU,0BAA0B,KAC5D,+BAA+B,SAAS;AAC7C,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,CAAC,SAAS,YAAY;AAAA,IAC/B,oBAAoB,gBAAgB,6BAA6B;AAAA,EACnE,CAAC;AACH;AAQO,SAAS,gCAAgC;AAAA,EAC9C,eAAe;AAAA,EACf,QAAQ,MAAM,KAAK,IAAI;AACzB,IAAI,CAAC,GAAG;AACN,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,QAAM,QAAQ,CAAC,YAAY;AACzB,QAAI,WAAW,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,EAAG,QAAO;AACjE,UAAM,YAAY,MAAM,IAAI,KAAK,KAAK,OAAO;AAC7C,gBAAY,cAAc,OAAO,YAAY,KAAK,IAAI,WAAW,SAAS;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,YAAY;AAElB,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,OAAO,SAAS;AACd,UAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,EAAG,QAAO;AACtD,gBAAU;AACV,kBAAY;AACZ,aAAO,MAAM,OAAO;AAAA,IACtB;AAAA,IACA,YAAY;AACV,aAAO,CAAC,WAAW,cAAc,QAAQ,MAAM,IAAI;AAAA,IACrD;AAAA,IACA,cAAc;AACZ,aAAO,WAAW,cAAc,OAAO,IAAI,KAAK,IAAI,GAAG,YAAY,MAAM,CAAC;AAAA,IAC5E;AAAA,IACA,iBAAiB;AACf,UAAI,WAAY,cAAc,QAAQ,MAAM,IAAI,UAAY,QAAO;AACnE,gBAAU;AACV,kBAAY;AACZ,aAAO;AAAA,IACT;AAAA,IACA,aAAa;AACX,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAMO,SAAS,mCAAmC;AACjD,MAAI,WAAW;AACf,MAAI,aAAa;AAEjB,SAAO;AAAA,IACL,aAAa;AACX,aAAO;AAAA,IACT;AAAA,IACA,eAAe;AACb,iBAAW;AACX,oBAAc;AAAA,IAChB;AAAA,IACA,iBAAiB,EAAE,QAAQ,cAAc,eAAe,WAAW,GAAG;AACpE,YAAM,qBAAqB;AAC3B,aAAO,MAAM;AACX,YAAI,aAAa,MAAM,UAAU,eAAe,mBAAoB,QAAO;AAC3E,YAAI,YAAY,CAAC,cAAe,QAAO;AACvC,cAAM,YAAY;AAClB,mBAAW;AACX,YAAI,UAAW,cAAa;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,sBAAsB,EAAE,QAAQ,cAAc,WAAW,GAAG;AAC1D,YAAM,qBAAqB;AAC3B,aAAO,CAAC,YAAY;AAClB,YAAI,aAAa,MAAM,UAAU,eAAe,mBAAoB,QAAO;AAC3E,mBAAW,OAAO;AAClB,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,WAAW;AACT,aAAO,EAAE,UAAU,WAAW;AAAA,IAChC;AAAA,EACF;AACF;AAQO,SAAS,kCAAkC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAG;AACD,SAAO,iBAAiB,iBAAiB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,CAAC;AACH;AAEA,IAAM,0BAA0B,oBAAI,IAAI,CAAC,UAAU,aAAa,WAAW,CAAC;AAErE,SAAS,wCAAwC;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,GAAG;AAKD,SAAO,QAAQ,YAAY,KACrB,oBAAoB,QAAQ,wBAAwB,IAAI,UAAU;AAC1E;AAOO,SAAS,uCAAuC;AACrD,MAAI,0BAA0B;AAC9B,QAAM,UAAU,MAAM;AACpB,UAAM,SAAS;AACf,8BAA0B;AAC1B,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,eAAe,QAAQ;AACrB,gCAA0B,UAAU,yBAAyB,MAAM,IAAI,SAAS;AAChF,aAAO,4BAA4B;AAAA,IACrC;AAAA,IACA;AAAA,IACA,MAAM,YAAY,SAAS;AAGzB,YAAM,SAAS,QAAQ;AACvB,UAAI,CAAC,OAAQ,QAAO;AACpB,YAAM,QAAQ,MAAM;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B,MAAM;AAAA,EAChC,iBAAiB,MAAM;AACzB,GAAG;AACD,MAAI;AACF,UAAM,gBAAgB;AACtB,UAAM,UAAU,yBAAyB,MAAM,KAAK,MAAMA,oBAAmB,MAAM;AAInF,UAAM,SAAS,yBAAyB,MAAM;AAC9C,QAAI,eAAe,MAAM,EAAG,QAAO;AACnC,QAAI,UAAU,wBAAwB,MAAM,EAAG,QAAO;AACtD,QAAI,WAAW,CAAC,QAAQ;AAGtB,UAAI,YAAY,MAAM,MAAO,QAAO;AACpC,UAAI,yBAAyB,MAAM,EAAG,OAAM,eAAe,MAAM;AACjE,aAAO;AAAA,IACT;AAIA,QAAI,CAAC,UAAU,eAAe;AAC5B,YAAM,YAAY,aAAa,GAAG,OAAO,iDAAiD,MAAM;AAChG,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,yBAAyB,MAAM,EAAG,OAAM,eAAe,MAAM;AAAA,IACnE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,eAAe,MAAM,EAAG,QAAO;AACnC,UAAM,YAAY;AAAA,MAChB,GAAG,OAAO,iDACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF,MAAM;AACN,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,yBAAyB,MAAM,EAAG,OAAM,eAAe,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,WAAO;AAAA,EACT;AACF;;;A5BnTA,IAAM,4BAA4B;AAClC,IAAM,UAAU;AAChB,IAAM,iBAAiB;AAIvB,IAAM,6BAA6B,uCAC/B,qCACA;AACJ,IAAM,0BAA0B,CAAC,4BAA4B,wBAAwB;AACrF,IAAMC,WAAU;AAChB,IAAM,WAAWC,eAAc,YAAY,GAAG;AAC9C,IAAM,oBAAoBC,MAAKC,SAAQ,QAAQ,GAAG,eAAe;AACjE,IAAM,wBAAwB,mBAAmB,QAAQ,GAAG;AAC5D,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,IAAM,WAAW,0BAA0B,QAAQ,GAAG;AAEtD,SAAS,iBAAiB;AACxB,MAAI;AAAE,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EAAW,QAAQ;AAAE,WAAO;AAAA,EAAW;AACnH;AAEA,IAAM,gCAAgCJ,SAAQ,KAAK,OAAO,QAAQ,IAAI,oCAAoC,EAAE,CAAC,IACzG,QAAQ,IAAI,mCACZK,YAAW;AACf,IAAM,uBAAuB;AAAA,EAC3B,mBAAmB,QAAQ,GAAG;AAAA,EAAG;AACnC;AACA,IAAM,oBAAoB,eAAe;AACzC,IAAM,4BAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA,cAAc;AAChB;AAEA,IAAI,8BAA8B;AAOlC,SAAS,WAAW,UAAU;AAC5B,QAAM,WAAW,4BAA4B;AAAA,IAC3C,aAAa;AAAA,IACb,cAAc;AAAA,IACd,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,SAAS,eAAe,6BAA6B;AACvD,YAAQ,MAAM,yCAAyC,SAAS,UAAU,KAAK,SAAS,MAAM,GAAG;AACjG,kCAA8B,SAAS;AAAA,EACzC;AACA,SAAO,MAAM,QAAQ,UAAU,SAAS,MAAM;AAAA,IAC5C,KAAK;AAAA,IACL,OAAO,CAAC,WAAW,WAAW,WAAW,KAAK;AAAA,IAC9C,aAAa;AAAA,EACf,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAO,UAAU;AAC3C,QAAM,WAAW,MAAM,QAAQ,UAAU,CAAC,OAAO,QAAQ,GAAG;AAAA,IAC1D,KAAK;AAAA,IACL,OAAO,CAAC,WAAW,WAAW,WAAW,KAAK;AAAA,IAC9C,aAAa;AAAA,EACf,CAAC;AACD;AAAA,IACE;AAAA,IACA,MAAM;AAAA,IAAC;AAAA,IACP,CAAC,UAAU;AACT,cAAQ;AAAA,QACN,wDAAwD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAChH;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc;AAC3B,MAAI;AACF,UAAM,OAAO,OAAO,QAAQ,IAAI,+BAA+B,IAAI;AACnE,UAAM,WAAW,MAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AACpG,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,MAAM,OAAO,OAAO,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBAAmB,OAAO;AACvC,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,yBAAyB,KAAK,EAAG,QAAO;AAC5C,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,QAAQ,YAAY,QAAQ,OAAO,OAAO,GAAG,MAAM,OAAO,MAAM,GAAG,EAAG,QAAO;AACjF,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,iBAAiB,OAAO,WAAW;AAChD,MAAI,CAAC,SAAS,yBAAyB,KAAK,EAAG,QAAO;AACtD,SAAO,IAAI,QAAQ,CAACD,aAAY;AAC9B,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,WAAW;AACzB,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,YAAM,IAAI,QAAQ,MAAM;AACxB,MAAAA,SAAQ,MAAM;AAAA,IAChB;AACA,UAAM,SAAS,MAAM,OAAO,IAAI;AAChC,UAAM,QAAQ,WAAW,MAAM,OAAO,KAAK,GAAG,SAAS;AACvD,UAAM,KAAK,QAAQ,MAAM;AACzB,QAAI,yBAAyB,KAAK,EAAG,QAAO,IAAI;AAAA,EAClD,CAAC;AACH;AAEA,eAAe,UAAU,OAAO;AAC9B,MAAI,CAAC,SAAS,yBAAyB,KAAK,EAAG;AAC/C,QAAM,KAAK,QAAQ,aAAa,UAAU,SAAY,SAAS;AAC/D,MAAI,MAAM,iBAAiB,OAAO,IAAM,EAAG;AAC3C,MAAI,yBAAyB,KAAK,EAAG,OAAM,KAAK,SAAS;AAIzD,QAAM,iBAAiB,OAAO,GAAK;AACrC;AAEA,eAAe,OAAO;AAIpB,QAAM,SAAS,6BAA6B;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,wBAAwB;AAC5D,QAAM,mBAAmB,CAAC,OAAO,QAAQ,IAAI,gCAAgC,EAAE,EAAE,KAAK;AACtF,QAAM,sBAAsB;AAAA,IAC1B,SAAS,QAAQ;AAAA,IACjB,kBAAkB;AAAA,IAClB;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,sBAAsB,mBAAmB;AACnD,SAAO,OAAO,UAAU;AAAA,IACtB,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,mCAAmC,wBAAwB,KAAK,GAAG;AAAA,EACrE,CAAC;AACD,QAAM,SAAS,yBAAyB,EAAE,SAAS,iBAAiB,KAAK,UAAU,CAAC;AACpF,QAAM,cAAc,mBAAmB,QAAQ,GAAG;AAClD,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,WAAW;AACf,QAAM,qBAAqB,oBAAI,QAAQ;AACvC,QAAM,4BAA4B,oBAAI,QAAQ;AAG9C,QAAM,mBAAmB,iCAAiC;AAC1D,QAAM,yBAAyB,MAAM;AACnC,qBAAiB,aAAa;AAC9B,YAAQ,WAAW;AAAA,EACrB;AACA,QAAM,iBAAiB,qBAAqB;AAC5C,QAAM,uBAAuB,qCAAqC;AAClE,QAAM,kBAAkB,gCAAgC;AAAA,IACtD,cAAc;AAAA,EAChB,CAAC;AACD,MAAI,+BAA+B,wBAAwB;AAC3D,MAAI,oCAAoC;AAExC,QAAM,sBAAsB,OAAO,WAAW;AAC5C,QAAI,CAAC,OAAQ;AACb,uBAAmB,IAAI,MAAM;AAC7B,8BAA0B,IAAI,MAAM;AACpC,QAAI;AACF,YAAM,UAAU,MAAM;AAAA,IACxB,UAAE;AAIA,UAAI,yBAAyB,MAAM,EAAG,oBAAmB,OAAO,MAAM;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,qBAAqB,yCAAyC;AAAA,IAClE,cAAc,MAAM;AAAA,IACpB,qBAAqB,CAAC,WAAW;AAC/B,UAAI,UAAU,OAAQ,SAAQ;AAAA,IAChC;AAAA,IACA,YAAY,CAAC,EAAE,cAAc,mBAAmB,MAAM;AACpD,qCAA+B;AAC/B,UAAI,OAAO,UAAU,kBAAkB,KAClC,iBAAiB,SAAS,EAAE,eAAe,oBAAoB;AAClE,4CAAoC;AAAA,MACtC;AACA,sBAAgB,OAAO,YAAY;AACnC,cAAQ;AAAA,QACN,iEAAiE,YAAY;AAAA,MAE/E;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,2BAA2B,CAAC,WAAW,mBAAmB,WAAW,MAAM;AACjF,QAAM,gCAAgC,CAAC,WAAW,mBAAmB,QAAQ,MAAM;AAEnF,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,gBAAgB,WAAW,EAAG;AACnC,QAAI,CAAC,6BAA6B;AAAA,MAChC;AAAA,MACA,UAAU,iBAAiB,WAAW;AAAA,MACtC;AAAA,MACA;AAAA,IACF,CAAC,EAAG;AACJ,QAAI;AACF,cAAQ,YAAY;AACpB,WAAK,kBAAkB,OAAO,OAAO,oBAAoB;AAAA,IAC3D,SAAS,OAAO;AACd,6BAAuB;AACvB,cAAQ;AAAA,QACN,yEAAyE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACjI;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,MAAM;AACxB,UAAM,OAAO,WAAW,QAAQ;AAChC,UAAM,YAAY,KAAK,IAAI;AAC3B,SAAK,GAAG,WAAW,CAAC,YAAY;AAC9B,YAAM,UAAU,oCAAoC,OAAO;AAC3D,UAAI,CAAC,WAAW,CAAC,mBAAmB,cAAc,MAAM,OAAO,EAAG;AAGlE,UAAI;AACF,aAAK,KAAK;AAAA,UACR,MAAM;AAAA,UACN,OAAO,QAAQ;AAAA,QACjB,GAAG,CAAC,UAAU;AACZ,cAAI,MAAO,SAAQ,KAAK,yDAAyD,MAAM,OAAO,EAAE;AAAA,QAClG,CAAC;AAAA,MACH,SAAS,OAAO;AACd,gBAAQ;AAAA,UACN,yDAAyD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACjH;AAAA,MACF;AAAA,IACF,CAAC;AACD;AAAA,MACE;AAAA,MACA,MAAM;AAKJ,YAAI,YAAY,mBAAmB,OAAO,IAAI,GAAG;AAC/C,6BAAmB,OAAO,IAAI;AAC9B;AAAA,QACF;AACA,YAAI,8BAA8B,IAAI,EAAG;AACzC,2BAAmB,OAAO,IAAI;AAC9B,cAAM,WAAW,eAAe,WAAW,WAAW,KAAK,IAAI,CAAC;AAChE,YAAI,SAAS,SAAS;AACpB,iCAAuB;AACvB,kBAAQ;AAAA,YACN,+CAA+C,SAAS,UAAU;AAAA,UAEpE;AACA;AAAA,QACF;AACA,mBAAW,SAAS,SAAS,OAAO;AAAA,MACtC;AAAA,MACA,CAAC,UAAU;AACT,gBAAQ;AAAA,UACN,+CAA+C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACvG;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,oBAAoB,OAAO,QAAQ,eAAe,YAAY;AAClE,UAAM,+BAA+B,kCAAkC;AAAA,MACrE;AAAA,MACA;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,eAAe;AAAA,MACf,oBAAoB,MAAM;AACxB,gBAAQ,WAAW;AAAA,MACrB;AAAA,IACF,CAAC;AACD,UAAM,gCAAgC,iBAAiB,sBAAsB;AAAA,MAC3E;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,YAAY,CAAC,YAAY;AACvB,+BAAuB;AACvB,gBAAQ,MAAM,0BAA0B,OAAO,EAAE;AAAA,MACnD;AAAA,IACF,CAAC;AACD,WAAO,4BAA4B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,MAAM,MAAM,cAAc;AAAA,MAC3C;AAAA,MACA,gBAAgB;AAAA,MAChB,yBAAyB;AAAA,MACzB,gBAAgB,CAAC,cAAc,0BAA0B,IAAI,SAAS;AAAA,MACtE,aAAa;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,sBAAsB,CAAC,iBAAiB;AAC5C,mCAA+B;AAC/B,QAAI,gBAAgB,WAAW,EAAG,iBAAgB,OAAO,YAAY;AAAA,QAChE,iBAAgB,MAAM,YAAY;AACvC,YAAQ;AAAA,MACN,uEAAuE,YAAY;AAAA,IAErF;AAAA,EACF;AAEA,QAAM,kCAAkC,YAAY;AAClD,QAAI,CAAC,iBAAkB,QAAO;AAC9B,UAAM,YAAY,MAAM,sBAAsB;AAAA,MAC5C,GAAG;AAAA,MACH,SAAS;AAAA,IACX,CAAC;AACD,QAAI,UAAU,eAAe,YAAY;AACvC,YAAM,IAAI,MAAM,wEAAwE;AAAA,IAC1F;AACA,QAAI,UAAU,wBAAwB,MAAM;AAC1C,0BAAoB,UAAU,mBAAmB;AACjD,aAAO;AAAA,IACT;AACA,QAAI,UAAU,gBAAgB,SAAS,GAAG;AACxC,YAAM,kBAAkB,UAAU,gBAAgB,KAAK,GAAG;AAC1D,eAAS,uBAAuB;AAChC,gBAAU,uBAAuB;AAAA,IACnC;AACA,mCAA+B;AAC/B,WAAO;AAAA,EACT;AAEA,QAAM,iCAAiC,YAAY;AACjD,QAAI,CAAC,SAAS,yBAAyB,KAAK,GAAG;AAC7C,YAAM,qBAAqB,iBAAiB,SAAS,EAAE;AACvD,UAAI,CAAC,gBAAgB,WAAW,KAAK,gBAAgB,UAAU,GAAG;AAChE,4CAAoC;AACpC,eAAO;AAAA,MACT;AACA,UAAI;AACF,YAAI,CAAE,MAAM,gCAAgC,GAAI;AAC9C,8CAAoC;AACpC,iBAAO;AAAA,QACT;AACA,YAAI,CAAC,gBAAgB,WAAW,KAAK,CAAC,gBAAgB,eAAe,EAAG,QAAO;AAC/E,gBAAQ,YAAY;AACpB,2BAAmB,yBAAyB,OAAO,kBAAkB;AAAA,MACvE,SAAS,OAAO;AACd,+BAAuB;AACvB,gBAAQ;AAAA,UACN,oFACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,kBAAkB,OAAO,MAAM,2BAA2B;AAAA,EACnE;AAEA,QAAM,oBAAoB,OAAO,qBAAqB,SAAS;AAC7D,UAAM,kBAAkB,YAAY;AACpC,YAAQ;AACR,QAAI,OAAO,UAAU,kBAAkB,GAAG;AACxC,yBAAmB,yBAAyB,iBAAiB,kBAAkB;AAAA,IACjF;AACA,SAAK;AAAA,MACH;AAAA,MACA,OAAO,UAAU,kBAAkB;AAAA,MACnC,OAAO,UAAU,kBAAkB,IAAI,8BAA8B;AAAA,IACvE;AAEA,QAAI,CAAE,MAAM,wBAAwB;AAAA,MAClC;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,MACpB;AAAA,MACA,qBAAqB;AAAA,MACrB;AAAA,MACA,WAAW;AAAA,MACX,qBAAqB,CAAC,UAAU,mBAAmB,OAAO,QAAQ;AAAA,MAClE,KAAK,CAAC,YAAY,QAAQ,MAAM,0BAA0B,OAAO,EAAE;AAAA,IACrE,CAAC,GAAI;AAIH,UAAI,8BAA8B,eAAe,GAAG;AAClD,gBAAQ,KAAK,4GAA4G;AACzH,eAAO;AAAA,MACT;AAIA,6BAAuB;AACvB,YAAM,oBAAoB,eAAe;AACzC,UAAI,UAAU,gBAAiB,SAAQ;AACvC,cAAQ,MAAM,qIAAgI;AAC9I,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,QAAM,2BAA2B,YAAY;AAC3C,QAAI,gBAAgB,WAAW,KAAK,gBAAgB,UAAU,EAAG,QAAO;AACxE,UAAM,gBAAgB,qCAAqC;AAAA,MACzD;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,cAAc,QAAS,QAAO;AACnC,QAAI,8BAA8B;AAChC,UAAI;AACF,YAAI,CAAE,MAAM,gCAAgC,EAAI,QAAO;AAAA,MACzD,SAAS,OAAO;AACd,+BAAuB;AACvB,4CAAoC;AACpC,wBAAgB,eAAe;AAC/B,gBAAQ;AAAA,UACN,qFACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,eAAe,qCAAqC;AAAA,MACxD;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,aAAa,QAAS,QAAO;AAClC,QAAI,CAAC,gBAAgB,eAAe,EAAG,QAAO;AAC9C,wCAAoC;AACpC,WAAO,kBAAkB,aAAa,kBAAkB;AAAA,EAC1D;AAEA,QAAM,yBAAyB;AAE/B,QAAM,WAAW,YAAY;AAC3B,QAAI,SAAU;AACd,eAAW;AACX,UAAM,UAAU,KAAK;AAAA,EACvB;AACA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAC9E,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAE/E,SAAO,CAAC,UAAU;AAChB,QAAI;AACF,YAAM,yBAAyB;AAC/B,YAAM,SAAS,MAAM,OAAO,kBAAkB;AAAA,QAC5C;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAG;AAAA,MACL,CAAC;AACD,UAAI,CAAC,QAAQ;AACX,cAAM,MAAM,OAAO;AACnB;AAAA,MACF;AAGA,0CAAoC;AACpC,iBAAW;AACX,YAAM,kBAAkB,EAAE,UAAU,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,GAAI,GAAG,0BAA0B;AAGxG,YAAM,gBAAgB,OAAO,SAAS,YAAY,OAAO,SAAS;AAClE,YAAM,QAAQ,MAAM,uBAAuB;AAAA,QACzC,YAAY;AAAA,QAAa,WAAW;AAAA,QAAe,KAAK,QAAQ;AAAA,QAChE,gBAAgB,MAAM,yBAAyB,KAAK;AAAA,QACpD,kBAAkB,CAAC,QAAQ,UAAU,OAAO,aAAa,QAAQ,EAAE,QAAQ,UAAU,SAAS,MAAM,SAAS,QAAQ,MAAM,QAAQ,GAAI,MAAM,WAAW,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC,GAAI,GAAI,MAAM,mBAAmB,EAAE,oBAAoB,MAAM,iBAAiB,IAAI,CAAC,EAAG,CAAC;AAAA,QAChR,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACD,UAAI,CAAC,MAAM,SAAS;AAClB,cAAM,OAAO,sBAAsB,OAAO,UAAU,EAAE,GAAG,iBAAiB,QAAQ,UAAU,QAAQ,MAAM,OAAO,CAAC;AAClH,mBAAW;AACX,gBAAQ;AACR;AAAA,MACF;AACA,2BAAqB,eAAe,KAAK;AACzC,YAAM,oBAAoB,KAAK;AAC/B,YAAM,SAAS,gBACX,8BAA8B;AAAA,QAC9B;AAAA,QACA,aAAa,qBAAqB,OAAO,uBAAuB;AAAA,QAChE,iBAAiB,OAAO;AAAA,QACxB,mBAAmB,OAAO;AAAA,QAC1B,QAAQ;AAAA,UACN,UAAU,OAAO;AAAA,UACjB;AAAA,UACA,YAAY,cAAc;AAAA,UAC1B;AAAA,QACF;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,OAAO,OAAO,SAAS;AAAA,MACzB,CAAC,IACC,OAAO,SAAS,kBACd,qBAAqB;AAAA,QACrB,eAAe,CAAC,QAAQ,GAAG;AAAA,QAC3B,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC,IACC,mBAAmB,OAAO,MAAM;AAAA,QAChC,KAAK;AAAA,QACL,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACL,UAAI,OAAO,MAAM,OAAO,SAAS;AAC/B,YAAI,MAAM,OAAQ,SAAQ,KAAK,0BAA0B,MAAM,MAAM,EAAE;AACvE,gBAAQ,KAAK,oCAAoC,OAAO,OAAO,OAAO,uCAAuC;AAC7G;AAAA,MACF;AAKA,YAAM,qBAAqB,wCAAwC;AAAA,QACjE,cAAc,qBAAqB,QAAQ;AAAA,QAC3C,YAAY,OAAO;AAAA,QACnB,iBAAiB,OAAO;AAAA,MAC1B,CAAC;AACD,YAAM,oBAAoB,qBACtB,MAAM,+BAA+B,IACrC;AACJ,UAAI,CAAC,kBAAmB,QAAO,KAAK;AACpC,YAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,QAClD,GAAG;AAAA,QACH,QAAQ,OAAO,KAAK,cAAc;AAAA,QAClC,QAAQ,OAAO,KACV,OAAO,SAAS,GAAG,OAAO,MAAM,YAAY,eAAe,CAAC,eAAe,MAAM,GAAG,GAAI,IAAI,UAAU,eAAe,CAAC,iBACvH,sBAAsB,OAAO,MAAM,GAAG,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,EAAE,GAC/E,oBAAoB,KAAK,0CAC3B;AAAA,MACJ,CAAC;AACD,iBAAW;AACX,cAAQ;AAAA,IACV,SAAS,OAAO;AACd,cAAQ,MAAM,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAIhG,YAAM,qBAAqB,YAAY,MAAM,+BAA+B,CAAC;AAC7E,iBAAW;AACX,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACvG,UAAQ,WAAW;AACrB,CAAC;",
+  "sourcesContent": ["/**\n * Control-plane auth stub for the bundled `vo-mcp runner`.\n *\n * Replaces the daemon's lazy Firebase/SMOKE_* fallback\n * (`scripts/virtual-office/orchestrator-firestore/auth.mjs`), which pulls\n * `vo-config.mjs` (hardcoded Nexus Firebase project) + the firebase-admin chain.\n * A BYO runner ALWAYS authenticates with its own scoped `vo_credential` \u2014 read\n * from the OS keychain by `runner-cli.mjs` and injected as\n * `VO_CONTROL_PLANE_ADMIN_TOKEN` \u2014 so `control-plane-client.mjs`'s `resolveBearer`\n * returns early on the token and NEVER reaches this fallback. It exists only so\n * the bundle has nothing to resolve into the firebase chain; if it ever runs,\n * it fails LOUDLY with the fix.\n *\n * esbuild swaps this in for the heavy original at bundle time (see scripts/bundle.mjs).\n */\nexport async function getFirebaseAuth() {\n  throw new Error(\n    'vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner ' +\n      'authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN).',\n  );\n}\n", "/**\n * Persistent host supervisor for remote Mission Control maintenance.\n * The task daemon is a replaceable child; this process stays alive while it is\n * updated or repaired. Pairing credentials remain in the existing OS store.\n */\nimport { spawn } from 'node:child_process';\nimport { randomUUID } from 'node:crypto';\nimport { createRequire } from 'node:module';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, join } from 'node:path';\nimport { createControlPlaneClient } from '../../../scripts/virtual-office/code-runner/control-plane-client.mjs';\nimport { runHostMaintenance } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { stageAndActivateBundledUpdate } from './runner/bundled-runtime-updater.mjs';\nimport { runLegacyOrphanSweep } from '../../../scripts/virtual-office/code-runner/legacy-orphan-sweep.mjs';\nimport { activationSupervisorInstanceId, runtimeRootFromEnv } from './runner/bundled-runtime-store.mjs';\nimport { finishPendingActivation } from './runner/supervisor-activation.mjs';\nimport { resolveSupervisorChildEntry } from './runner/supervisor-child-entry.mjs';\nimport { awaitRunnerUpdateDrain } from './runner/update-drain-gate.mjs';\nimport { prepareSupervisorAuth, resolveSupervisorRunnerId } from './runner/supervisor-child-env.mjs';\nimport {\n  RUNNER_GITHUB_READINESS_TIMEOUT_MS,\n  RUNNER_IDENTITY_READINESS_TIMEOUT_MS,\n  RUNNER_READINESS_DEFERRAL_ACK_TYPE,\n  parseRunnerReadinessDeferralRequest,\n} from './runner-readiness.mjs';\nimport { readStoredCredentialIsolated } from './runner/supervisor-credential-reader.mjs';\nimport { createRespawnCircuit } from './runner/respawn-circuit.mjs';\nimport {\n  attachSupervisorChildTerminationCustody,\n  describeChildTermination,\n  beginSupervisorHealthyStateCommit,\n  createSupervisorDegradationState,\n  createSupervisorControlRecoveryFence,\n  createSupervisorReadinessDeferralTracker,\n  createSupervisorStartupDeferral,\n  resolveSupervisorChildStartAuthority,\n  shouldRespawnSupervisorChild,\n  shouldRecoverSupervisorChildAfterAction,\n  supervisorChildHasExited,\n  supervisorChildIsRunning,\n  verifySupervisorChildHealth,\n} from './runner/supervisor-child-health.mjs';\n\nconst DEFAULT_CONTROL_PLANE_URL = 'https://vo-control-plane-bzjphrajaq-uc.a.run.app';\nconst POLL_MS = 5000;\nconst CHILD_START_MS = 1500;\n// The child performs identity auth plus the bounded GitHub preflight before\n// opening its local status port. Cover both transport deadlines plus startup\n// margin without changing the independent child-stop deadlines.\nconst CHILD_READINESS_TIMEOUT_MS = RUNNER_IDENTITY_READINESS_TIMEOUT_MS\n  + RUNNER_GITHUB_READINESS_TIMEOUT_MS\n  + 10_000;\nconst SUPERVISOR_CAPABILITIES = ['bundled-runtime-slots-v1', 'legacy-orphan-purge-v1'];\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst selfPath = fileURLToPath(import.meta.url);\nconst bundledChildEntry = join(dirname(selfPath), 'runner-cli.js');\nconst supervisorRuntimeRoot = runtimeRootFromEnv(process.env);\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst runnerId = resolveSupervisorRunnerId(process.env);\n\nfunction packageVersion() {\n  try { return createRequire(import.meta.url)('../package.json').version || 'unknown'; } catch { return 'unknown'; }\n}\n\nconst requestedSupervisorInstanceId = UUID_RE.test(String(process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID || ''))\n  ? process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID\n  : randomUUID();\nconst supervisorInstanceId = activationSupervisorInstanceId(\n  runtimeRootFromEnv(process.env), requestedSupervisorInstanceId,\n);\nconst supervisorVersion = packageVersion();\nconst supervisorControlIdentity = {\n  supervisorInstanceId,\n  supervisorVersion,\n  capabilities: SUPERVISOR_CAPABILITIES,\n};\n\nlet lastResolvedChildDescriptor = null;\n\n/**\n * Resolved on EVERY spawn, never cached at module scope: a slot activated after\n * this process started must take effect on the next child restart, not on the\n * next whole-app restart (nothing forces one).\n */\nfunction spawnChild(childEnv) {\n  const resolved = resolveSupervisorChildEntry({\n    runtimeRoot: supervisorRuntimeRoot,\n    bundledEntry: bundledChildEntry,\n    bundledVersion: supervisorVersion,\n  });\n  if (resolved.descriptor !== lastResolvedChildDescriptor) {\n    console.error(`[vo-runner supervisor] child entry -> ${resolved.descriptor} (${resolved.detail})`);\n    lastResolvedChildDescriptor = resolved.descriptor;\n  }\n  return spawn(process.execPath, resolved.args, {\n    env: childEnv,\n    stdio: ['inherit', 'inherit', 'inherit', 'ipc'],\n    windowsHide: true,\n  });\n}\n\nfunction spawnPreviousChild(entry, childEnv) {\n  const previous = spawn(process.execPath, [entry, 'runner'], {\n    env: childEnv,\n    stdio: ['inherit', 'inherit', 'inherit', 'ipc'],\n    windowsHide: true,\n  });\n  attachSupervisorChildTerminationCustody(\n    previous,\n    () => {},\n    (error) => {\n      console.error(\n        `[vo-runner supervisor] rollback child process error: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    },\n  );\n  return previous;\n}\n\nasync function localStatus() {\n  try {\n    const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);\n    const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });\n    if (!response.ok) return null;\n    const body = await response.json();\n    return body?.ok === true ? body : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function waitForLocalRunner(child) {\n  const deadline = Date.now() + CHILD_READINESS_TIMEOUT_MS;\n  while (Date.now() < deadline) {\n    if (supervisorChildHasExited(child)) return false;\n    const status = await localStatus();\n    if (status?.running === true && Number(status.pid) === Number(child.pid)) return true;\n    await sleep(500);\n  }\n  return false;\n}\n\nasync function waitForChildExit(child, timeoutMs) {\n  if (!child || supervisorChildHasExited(child)) return true;\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (exited) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      child.off('exit', onExit);\n      resolve(exited);\n    };\n    const onExit = () => finish(true);\n    const timer = setTimeout(() => finish(false), timeoutMs);\n    child.once('exit', onExit);\n    if (supervisorChildHasExited(child)) finish(true);\n  });\n}\n\nasync function stopChild(child) {\n  if (!child || supervisorChildHasExited(child)) return;\n  child.kill(process.platform === 'win32' ? undefined : 'SIGTERM');\n  if (await waitForChildExit(child, 15_000)) return;\n  if (supervisorChildIsRunning(child)) child.kill('SIGKILL');\n  // Keep the deliberate-stop fence through the forced-kill exit. Returning\n  // immediately after kill() lets a later exit look like a crash and consume\n  // breaker budget during legitimate maintenance.\n  await waitForChildExit(child, 5_000);\n}\n\nasync function main() {\n  // Read keychain-backed credentials in a process that exits before npm ever\n  // attempts to replace this package. Windows otherwise keeps the keyring DLL\n  // locked for the full supervisor lifetime and global self-updates fail.\n  const stored = readStoredCredentialIsolated();\n  const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;\n  const pairedSupervisor = !String(process.env.VO_CONTROL_PLANE_ADMIN_TOKEN || '').trim();\n  const supervisorAuthInput = {\n    baseEnv: process.env,\n    storedCredential: stored,\n    controlPlaneUrl,\n  };\n  const {\n    childEnv,\n    clientEnv,\n    operatorId,\n    startupRetryAfterMs,\n  } = await prepareSupervisorAuth(supervisorAuthInput);\n  Object.assign(childEnv, {\n    VO_RUNNER_SUPERVISOR_INSTANCE_ID: supervisorInstanceId,\n    VO_RUNNER_SUPERVISOR_VERSION: supervisorVersion,\n    VO_RUNNER_SUPERVISOR_CAPABILITIES: SUPERVISOR_CAPABILITIES.join(','),\n  });\n  const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });\n  const runtimeRoot = runtimeRootFromEnv(process.env);\n  let child = null;\n  let stopping = false;\n  let handling = false;\n  const expectedChildStops = new WeakSet();\n  const healthNeutralizedChildren = new WeakSet();\n  // Activation failed but the process stays alive to accept remote repair.\n  // Distinct from `stopping`: we refuse to SERVE work, we do not refuse to be FIXED.\n  const degradationState = createSupervisorDegradationState();\n  const markSupervisorDegraded = () => {\n    degradationState.markDegraded();\n    process.exitCode = 1;\n  };\n  const respawnCircuit = createRespawnCircuit();\n  const controlRecoveryFence = createSupervisorControlRecoveryFence();\n  const startupDeferral = createSupervisorStartupDeferral({\n    retryAfterMs: startupRetryAfterMs,\n  });\n  let startupNeedsReadinessRefresh = startupRetryAfterMs !== null;\n  let deferredControlRecoveryGeneration = null;\n\n  const stopChildExpectedly = async (target) => {\n    if (!target) return;\n    expectedChildStops.add(target);\n    healthNeutralizedChildren.add(target);\n    try {\n      await stopChild(target);\n    } finally {\n      // If a pathological process still has not emitted exit after SIGKILL,\n      // retain its exact-child tag. WeakSet ownership disappears with the\n      // process object and cannot mask a different child's real crash.\n      if (supervisorChildHasExited(target)) expectedChildStops.delete(target);\n    }\n  };\n\n  const readinessDeferrals = createSupervisorReadinessDeferralTracker({\n    currentChild: () => child,\n    releaseCurrentChild: (target) => {\n      if (child === target) child = null;\n    },\n    onCaptured: ({ retryAfterMs, recoveryGeneration }) => {\n      startupNeedsReadinessRefresh = true;\n      if (Number.isInteger(recoveryGeneration)\n        && degradationState.snapshot().generation === recoveryGeneration) {\n        deferredControlRecoveryGeneration = recoveryGeneration;\n      }\n      startupDeferral.reopen(retryAfterMs);\n      console.warn(\n        `[vo-runner supervisor] child deferred by GitHub readiness for ${retryAfterMs}ms; `\n        + 'preserving control polling without consuming rapid-exit breaker budget',\n      );\n    },\n  });\n  const isChildReadinessDeferred = (target) => readinessDeferrals.isDeferred(target);\n  const captureChildReadinessDeferral = (target) => readinessDeferrals.capture(target);\n\n  const respawn = () => {\n    if (!startupDeferral.hasStarted()) return;\n    if (!shouldRespawnSupervisorChild({\n      stopping,\n      degraded: degradationState.isDegraded(),\n      handling,\n      child,\n    })) return;\n    try {\n      child = launchChild();\n      void verifyChildHealth(child, false, 'automatic relaunch');\n    } catch (error) {\n      markSupervisorDegraded();\n      console.error(\n        `[vo-runner supervisor] child relaunch failed; entering degraded mode: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  };\n  const launchChild = () => {\n    const next = spawnChild(childEnv);\n    const startedAt = Date.now();\n    next.on('message', (message) => {\n      const request = parseRunnerReadinessDeferralRequest(message);\n      if (!request || !readinessDeferrals.recordPending(next, request)) return;\n      // The request is exact-child state before the ACK is attempted. Only a\n      // matching ACK received by the child authorizes its reserved exit 75.\n      try {\n        next.send({\n          type: RUNNER_READINESS_DEFERRAL_ACK_TYPE,\n          nonce: request.nonce,\n        }, (error) => {\n          if (error) console.warn(`[vo-runner supervisor] readiness deferral ACK failed: ${error.message}`);\n        });\n      } catch (error) {\n        console.warn(\n          `[vo-runner supervisor] readiness deferral ACK failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    });\n    attachSupervisorChildTerminationCustody(\n      next,\n      (record) => {\n        // A supervisor-requested stop is not a crash and must not consume the\n        // breaker. Every otherwise-unexpected termination can form a loop,\n        // including an asynchronous spawn error, external signal, or a faulty\n        // child reporting a misleading zero code.\n        if (stopping || expectedChildStops.delete(next)) {\n          readinessDeferrals.forget(next);\n          return;\n        }\n        if (captureChildReadinessDeferral(next)) return;\n        readinessDeferrals.forget(next);\n        // Say HOW it died, before any respawn decision. Without this the\n        // Windows libuv abort leaves no trace the operator or a later\n        // investigation can read: the process is simply gone and the next\n        // child starts. Names the runtime, because the daemon runs the\n        // bundled Node rather than whatever is on the operator's PATH.\n        console.error(`[vo-runner supervisor] child ${describeChildTermination(record)}`);\n        const decision = respawnCircuit.recordExit(startedAt, Date.now());\n        if (decision.tripped) {\n          markSupervisorDegraded();\n          console.error(\n            `[vo-runner supervisor] child exited rapidly ${decision.rapidExits} times; `\n            + 'entering degraded mode to stop startup/token churn while remote repair remains available',\n          );\n          return;\n        }\n        setTimeout(respawn, decision.delayMs);\n      },\n      (error) => {\n        console.error(\n          `[vo-runner supervisor] child process error: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      },\n    );\n    return next;\n  };\n\n  const verifyChildHealth = async (target, degradeOnExit, context) => {\n    const commitSupervisorHealthyState = beginSupervisorHealthyStateCommit({\n      degradationState,\n      target,\n      currentChild: () => child,\n      allowRecovery: degradeOnExit,\n      clearStaleExitCode: () => {\n        process.exitCode = undefined;\n      },\n    });\n    const commitSupervisorDegradedState = degradationState.beginDegradationProof({\n      target,\n      currentChild: () => child,\n      onDegraded: (message) => {\n        markSupervisorDegraded();\n        console.error(`[vo-runner supervisor] ${message}`);\n      },\n    });\n    return verifySupervisorChildHealth({\n      target,\n      degradeOnExit,\n      context,\n      waitBeforeProbe: () => sleep(CHILD_START_MS),\n      waitForLocalRunner,\n      stopExpectedly: stopChildExpectedly,\n      isReadinessDeferredExit: isChildReadinessDeferred,\n      isExpectedStop: (candidate) => healthNeutralizedChildren.has(candidate),\n      markHealthy: commitSupervisorHealthyState,\n      markDegraded: commitSupervisorDegradedState,\n    });\n  };\n\n  const deferChildAdmission = (retryAfterMs) => {\n    startupNeedsReadinessRefresh = true;\n    if (startupDeferral.hasStarted()) startupDeferral.reopen(retryAfterMs);\n    else startupDeferral.defer(retryAfterMs);\n    console.warn(\n      `[vo-runner supervisor] GitHub readiness embargoed child startup for ${retryAfterMs}ms; `\n      + 'control polling remains active',\n    );\n  };\n\n  const refreshSupervisorChildAdmission = async () => {\n    if (!pairedSupervisor) return true;\n    const refreshed = await prepareSupervisorAuth({\n      ...supervisorAuthInput,\n      baseEnv: childEnv,\n    });\n    if (refreshed.operatorId !== operatorId) {\n      throw new Error('runner readiness operator identity changed during supervisor admission');\n    }\n    if (refreshed.startupRetryAfterMs !== null) {\n      deferChildAdmission(refreshed.startupRetryAfterMs);\n      return false;\n    }\n    if (refreshed.repositoryScope.length > 0) {\n      const repositoryScope = refreshed.repositoryScope.join(',');\n      childEnv.VO_CODE_RUNNER_REPOS = repositoryScope;\n      clientEnv.VO_CODE_RUNNER_REPOS = repositoryScope;\n    }\n    startupNeedsReadinessRefresh = false;\n    return true;\n  };\n\n  const ensureHealthyChildAfterControl = async () => {\n    if (!child || supervisorChildHasExited(child)) {\n      const recoveryGeneration = degradationState.snapshot().generation;\n      if (!startupDeferral.hasStarted() && startupDeferral.isPending()) {\n        deferredControlRecoveryGeneration = recoveryGeneration;\n        return false;\n      }\n      try {\n        if (!(await refreshSupervisorChildAdmission())) {\n          deferredControlRecoveryGeneration = recoveryGeneration;\n          return false;\n        }\n        if (!startupDeferral.hasStarted() && !startupDeferral.consumeIfReady()) return false;\n        child = launchChild();\n        readinessDeferrals.recordRecoveryGeneration(child, recoveryGeneration);\n      } catch (error) {\n        markSupervisorDegraded();\n        console.error(\n          `[vo-runner supervisor] control recovery relaunch failed; entering degraded mode: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n        return false;\n      }\n    }\n    return verifyChildHealth(child, true, 'control recovery relaunch');\n  };\n\n  const startInitialChild = async (recoveryGeneration = null) => {\n    const activationChild = launchChild();\n    child = activationChild;\n    if (Number.isInteger(recoveryGeneration)) {\n      readinessDeferrals.recordRecoveryGeneration(activationChild, recoveryGeneration);\n    }\n    void verifyChildHealth(\n      activationChild,\n      Number.isInteger(recoveryGeneration),\n      Number.isInteger(recoveryGeneration) ? 'deferred control recovery' : 'initial child',\n    );\n\n    if (!(await finishPendingActivation({\n      client,\n      child: activationChild,\n      runtimeRoot,\n      operatorId,\n      runnerId,\n      selfPath,\n      packageVersion: supervisorVersion,\n      supervisorIdentity: supervisorControlIdentity,\n      waitForLocalRunner,\n      isReadinessDeferred: isChildReadinessDeferred,\n      localStatus,\n      stopChild: stopChildExpectedly,\n      launchPreviousChild: (entry) => spawnPreviousChild(entry, childEnv),\n      log: (message) => console.error(`[vo-runner supervisor] ${message}`),\n    }))) {\n      // A child-reported GitHub embargo is not an activation verdict. Its exact\n      // exit handler re-opened admission, so leave the pending slot durable and\n      // retry attestation only after that deadline.\n      if (captureChildReadinessDeferral(activationChild)) {\n        console.warn('[vo-runner supervisor] activation attestation deferred with GitHub readiness; pending slot remains durable');\n        return false;\n      }\n      // DO NOT EXIT HERE. The control-action poll loop below is the ONLY remote\n      // repair channel this host has \u2014 the daemon never opens an inbound port by\n      // design. Degrade instead: refuse to SERVE work, but stay available to BE FIXED.\n      markSupervisorDegraded();\n      await stopChildExpectedly(activationChild);\n      if (child === activationChild) child = null;\n      console.error('[vo-runner supervisor] activation FAILED \u2014 entering degraded mode: not serving tasks, still polling for remote control actions');\n      return false;\n    }\n    return true;\n  };\n\n  const attemptInitialChildStart = async () => {\n    if (startupDeferral.hasStarted() || startupDeferral.isPending()) return false;\n    const beforeRefresh = resolveSupervisorChildStartAuthority({\n      degradationState,\n      deferredRecoveryGeneration: deferredControlRecoveryGeneration,\n    });\n    if (!beforeRefresh.allowed) return false;\n    if (startupNeedsReadinessRefresh) {\n      try {\n        if (!(await refreshSupervisorChildAdmission())) return false;\n      } catch (error) {\n        markSupervisorDegraded();\n        deferredControlRecoveryGeneration = null;\n        startupDeferral.consumeIfReady();\n        console.error(\n          `[vo-runner supervisor] deferred readiness refresh failed; entering degraded mode: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n        return false;\n      }\n    }\n    const afterRefresh = resolveSupervisorChildStartAuthority({\n      degradationState,\n      deferredRecoveryGeneration: deferredControlRecoveryGeneration,\n    });\n    if (!afterRefresh.allowed) return false;\n    if (!startupDeferral.consumeIfReady()) return false;\n    deferredControlRecoveryGeneration = null;\n    return startInitialChild(afterRefresh.recoveryGeneration);\n  };\n\n  await attemptInitialChildStart();\n\n  const shutdown = async () => {\n    if (stopping) return;\n    stopping = true;\n    await stopChild(child);\n  };\n  process.on('SIGINT', () => { void shutdown().finally(() => process.exit(0)); });\n  process.on('SIGTERM', () => { void shutdown().finally(() => process.exit(0)); });\n\n  while (!stopping) {\n    try {\n      await attemptInitialChildStart();\n      const action = await client.pollRunnerControl({\n        runnerId,\n        ...(operatorId ? { operatorId } : {}),\n        ...supervisorControlIdentity,\n      });\n      if (!action) {\n        await sleep(POLL_MS);\n        continue;\n      }\n      // Any newer control action supersedes delayed recovery authority from an\n      // earlier action. A fresh exact-action fence may establish a new one.\n      deferredControlRecoveryGeneration = null;\n      handling = true;\n      const controlIdentity = { runnerId, ...(operatorId ? { operatorId } : {}), ...supervisorControlIdentity };\n      // D9 (incident 2026-08-30): an update restart must DRAIN in-flight tasks\n      // first, and at the cap must name itself on every task it kills.\n      const bundledAction = action.kind === 'update' || action.kind === 'reinstall';\n      const drain = await awaitRunnerUpdateDrain({\n        readStatus: localStatus, drainable: bundledAction, env: process.env,\n        isChildRunning: () => supervisorChildIsRunning(child),\n        failInFlightTask: (taskId, patch) => client.postProgress(taskId, { status: 'failed', message: patch.message, result: patch.result, ...(patch.runnerId ? { runner_id: patch.runnerId } : {}), ...(patch.runnerInstanceId ? { runner_instance_id: patch.runnerInstanceId } : {}) }),\n        log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n      });\n      if (!drain.proceed) {\n        await client.completeRunnerControl(action.actionId, { ...controlIdentity, status: 'failed', detail: drain.detail });\n        handling = false;\n        respawn();\n        continue;\n      }\n      controlRecoveryFence.markBeforeStop(child);\n      await stopChildExpectedly(child);\n      const result = bundledAction\n        ? stageAndActivateBundledUpdate({\n          runtimeRoot,\n          packageSpec: `@algosuite/vo-mcp@${action.desired_package_version}`,\n          expectedVersion: action.desired_package_version,\n          expectedIntegrity: action.desired_package_integrity,\n          action: {\n            actionId: action.actionId,\n            runnerId,\n            operatorId: operatorId || '',\n            supervisorInstanceId,\n          },\n          env: process.env,\n          force: action.kind === 'reinstall',\n        })\n        : action.kind === 'purge-orphans'\n          ? runLegacyOrphanSweep({\n            protectedPids: [process.pid],\n            log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n          })\n          : runHostMaintenance(action.kind, {\n            env: clientEnv,\n            log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n          });\n      if (result.ok && result.handoff) {\n        if (drain.capped) console.warn(`[vo-runner supervisor] ${drain.detail}`);\n        console.warn(`[vo-runner supervisor] activated ${result.active.version}; exiting for new-process attestation`);\n        return;\n      }\n      // The normal action path consumes any exact-child fence before awaiting,\n      // so reporting errors cannot trigger it again. A childless pre-existing\n      // degradation requires a successful repair/reconnect action; cleanup or\n      // failed maintenance cannot silently re-enable service.\n      const recoveryAuthorized = shouldRecoverSupervisorChildAfterAction({\n        stoppedChild: controlRecoveryFence.consume(),\n        actionKind: action.kind,\n        actionSucceeded: result.ok,\n      });\n      const relaunchedHealthy = recoveryAuthorized\n        ? await ensureHealthyChildAfterControl()\n        : false;\n      if (!relaunchedHealthy) result.ok = false;\n      await client.completeRunnerControl(action.actionId, {\n        ...controlIdentity,\n        status: result.ok ? 'succeeded' : 'failed',\n        detail: result.ok\n          ? (result.detail ? `${result.detail}; runner ${packageVersion()} reconnected`.slice(0, 1000) : `runner ${packageVersion()} reconnected`)\n          : `maintenance exited ${result.status}${result.detail ? `: ${result.detail}` : ''}${\n            relaunchedHealthy ? '' : '; runner relaunch did not become healthy'\n          }`,\n      });\n      handling = false;\n      respawn();\n    } catch (error) {\n      console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);\n      // Recover only when this exact control iteration fenced a live child\n      // before stopping it. Poll/defer/reporting failures have no such token\n      // and must not clear a pre-existing activation or breaker degradation.\n      await controlRecoveryFence.recoverOnce(() => ensureHealthyChildAfterControl());\n      handling = false;\n      await sleep(POLL_MS);\n    }\n  }\n}\n\nmain().catch((error) => {\n  console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);\n  process.exitCode = 1;\n});\n", "/**\n * GitHub App installation-token minting for the runner (M3).\n *\n * Split out of control-plane-client.mjs, which sits at its 400-line cap.\n *\n * The control plane keys the mint on the authenticated operator\n * (ctx.operator_id), so a token covers only that operator's installation.\n *\n * Two distinct grants come out of here:\n *  - the DEFAULT full grant, used by the daemon to push and run `gh pr create`.\n *    It only works if the App grants BOTH `Contents: write` and\n *    `Pull requests: write` \u2014 see docs/vo/github-app-setup-2026-06-18.md.\n *  - a READ-ONLY grant (`readOnly: true`), used for the token handed to an\n *    agent process so it can read a PRIVATE repo without being able to publish.\n */\n\n/** Ceiling for the OPTIONAL read-token mint, so a hung plane can't stall a task. */\nconst READ_TOKEN_TIMEOUT_MS = 15_000;\n\n/**\n * @param {object} opts\n * @param {(method: string, path: string, body?: unknown) => Promise<Response>} opts.req\n * @param {boolean} [opts.required] fail closed instead of returning null on a miss\n * @param {boolean} [opts.readOnly] ask for a narrowed, non-publishing grant\n * @param {string|null} [opts.repo] narrow the grant to this one `owner/name`\n * @returns {Promise<{ token: string, expiresAt: string | null } | null>}\n */\nexport async function fetchInstallationToken({ req, required = false, readOnly = false, repo = null }) {\n  const fail = (reason) => {\n    if (required) throw new Error(`installation-token required: ${reason}`);\n    return null;\n  };\n  try {\n    // The read-only grant gets a longer explicit ceiling. The client also\n    // supplies its default task-request ceiling for the publish mint; required\n    // mode propagates that timeout and therefore cannot silently fall back.\n    const res = await req(\n      'POST',\n      '/api/v1/github/installation-token',\n      readOnly ? { scope: 'read', ...(repo ? { repo } : {}) } : {},\n      readOnly ? { timeoutMs: READ_TOKEN_TIMEOUT_MS } : {},\n    );\n    if (!res.ok) return fail(`HTTP ${res.status}`);\n    const json = await res.json();\n    if (!json || !json.token) return fail('missing token');\n    // Fail CLOSED when a read-only grant can't be confirmed. The runner and the\n    // control plane deploy independently, so a new runner can reach an older\n    // revision that ignores `scope` and hands back a FULL write token. Injecting\n    // that into an agent process is the exact failure this token exists to\n    // prevent, so drop it: no token is the safe, pre-change state.\n    if (readOnly && json.scope !== 'read') return fail('control plane did not confirm a read-only grant');\n    // ci_readable (plane 2026-08-16): false while the App installation has not\n    // accepted checks:read/statuses:read \u2014 the watcher logs it so the gap is visible.\n    return { token: json.token, expiresAt: json.expires_at || null, ...(typeof json.ci_readable === 'boolean' ? { ciReadable: json.ci_readable } : {}) };\n  } catch (err) {\n    if (required) throw err;\n    return null;\n  }\n}\n", "/**\n * control-plane-heartbeat-body \u2014 the runner heartbeat's request body, built pure.\n *\n * Split out of `control-plane-client.mjs` on 2026-09-04 (PR #10336 steward pass)\n * when that module crossed its 400-line VO orchestration cap. The construction\n * is the part worth isolating anyway: it is pure, it is the exact surface the\n * plane's strict schema validates, and every field here is OMITTED rather than\n * sent null \u2014 a null on this route is a 400, and the 2026-07-25 outage was hours\n * of diagnosis because a rejected field looked identical to a powered-off host.\n *\n * Adding a field is therefore a three-place change, all in the same PR: this\n * builder, the plane's `runner-heartbeat-v1` schema, and the status type the\n * dashboard reads. The lockstep test pins that.\n */\n\n/**\n * @param {object} input heartbeat inputs as the daemon's loop tick collects them.\n * @returns {object} the wire body, with absent/empty fields omitted.\n */\nexport function buildRunnerHeartbeatBody({\n  runnerId,\n  runnerInstanceId,\n  operatorId,\n  uptimeSec,\n  activeTasks,\n  maxConcurrency,\n  effectiveConcurrency,\n  measuredTaskSlots,\n  measuredCpuSlots,\n  measuredMemorySlots,\n  version,\n  daemonVersion,\n  nodeVersion,\n  defaultAgent,\n  supervisorInstanceId,\n  supervisorVersion,\n  supervisorCapabilities,\n  servedRepos,\n  servedOperators,\n  availableAgents,\n  accountUsage,\n  availableLocalModels,\n  prepared_job_shadow: preparedJobShadow,\n} = {}) {\n  // ADR-004 \u00A7 11.1b-2 counts-only tally rides along when the shadow pass produced one.\n  const body = { runner_id: runnerId, ...(preparedJobShadow ? { prepared_job_shadow: preparedJobShadow } : {}) };\n  if (runnerInstanceId) body.runner_instance_id = runnerInstanceId;\n  if (operatorId) body.operator_id = operatorId;\n  if (typeof uptimeSec === 'number') body.uptime_sec = uptimeSec;\n  if (typeof activeTasks === 'number') body.active_tasks = activeTasks;\n  if (typeof maxConcurrency === 'number') body.max_concurrency = maxConcurrency;\n  if (typeof effectiveConcurrency === 'number') body.effective_concurrency = effectiveConcurrency;\n  if (typeof measuredTaskSlots === 'number') body.measured_task_slots = measuredTaskSlots;\n  if (typeof measuredCpuSlots === 'number') body.measured_cpu_slots = measuredCpuSlots;\n  if (typeof measuredMemorySlots === 'number') body.measured_memory_slots = measuredMemorySlots;\n  if (version) body.version = version;\n  if (daemonVersion) body.daemon_version = daemonVersion;\n  // The Node runtime this daemon RUNS on, so a runtime-level abort is\n  // attributable to a build. Public version string only, no host detail.\n  if (nodeVersion) body.node_version = nodeVersion;\n  if (defaultAgent) body.default_agent = defaultAgent;\n  if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n  if (supervisorVersion) body.supervisor_version = supervisorVersion;\n  if (Array.isArray(supervisorCapabilities) && supervisorCapabilities.length > 0) {\n    body.supervisor_capabilities = supervisorCapabilities;\n  }\n  if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;\n  if (Array.isArray(servedOperators) && servedOperators.length > 0) {\n    body.served_operator_ids = servedOperators;\n  }\n  if (Array.isArray(availableAgents) && availableAgents.length > 0) {\n    body.available_agents = availableAgents;\n  }\n  if (Array.isArray(accountUsage) && accountUsage.length > 0) {\n    body.account_usage = accountUsage;\n  }\n  if (Array.isArray(availableLocalModels) && availableLocalModels.length > 0) {\n    body.available_local_models = availableLocalModels;\n  }\n  return body;\n}\n", "/**\n * F35 (2026-08-17): ask the plane to mark a PARTIAL draft READY once its lineage cannot continue\n * and CI is green (`POST /api/v1/admin/pr/promote-draft`, admin-only \u2014 the plane-side sweep is\n * the caller). The plane re-checks every precondition server-side and never merges; the ordinary\n * receipt-gated merge decides afterwards. Errors carry the plane's status + code like resume.\n */\nexport async function promoteDraftPrRequest(req, prNumber, automationContext, onUnauthorized = () => {}) {\n  const res = await req('POST', '/api/v1/admin/pr/promote-draft', { prNumber, automationContext }, { timeoutMs: 60_000 });\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('promote-draft unauthorized (401)');\n  }\n  const json = await res.json().catch(() => ({}));\n  if (res.ok && json?.ok === true) {\n    return {\n      status: json.promoted === true ? (json.auto_merge_disarmed === true ? 'promoted (auto-merge disarmed)' : 'promoted') : json.already_ready === true ? 'already_ready' : 'unchanged',\n      headSha: typeof json.head_sha === 'string' ? json.head_sha : null,\n      reason: typeof json.blocked_reason === 'string' ? json.blocked_reason : null,\n    };\n  }\n  const code = typeof json?.error === 'string' ? json.error : null;\n  const err = new Error(`promote-draft failed: HTTP ${res.status}${code ? ` (${code})` : ''}${json?.reason ? ` \u2014 ${json.reason}` : ''}`);\n  err.status = res.status;\n  err.code = code;\n  throw err;\n}\n", "const PAGE_SIZE = 500;\n\n/** Paginate the runner-only raw adoption view; it deliberately skips PR reconciliation. */\nexport async function listAllPrOpenedTasks(request) {\n  const tasks = [];\n  let beforeCreatedAt = '';\n  let beforeId = '';\n  for (;;) {\n    const params = new URLSearchParams({\n      status: 'pr_opened', limit: String(PAGE_SIZE), runner_adoption: '1',\n    });\n    if (beforeCreatedAt) {\n      params.set('before_created_at', beforeCreatedAt);\n      params.set('before_id', beforeId);\n    }\n    const res = await request('GET', `/api/v1/code-task?${params}`);\n    if (!res.ok) throw new Error(`listPrOpenedTasks failed: HTTP ${res.status}`);\n    const json = await res.json();\n    const page = Array.isArray(json?.tasks) ? json.tasks : [];\n    tasks.push(...page);\n    if (page.length < PAGE_SIZE) return tasks;\n    const last = page.at(-1);\n    if (!last?.created_at || !last?.code_task_id) {\n      throw new Error('listPrOpenedTasks pagination cursor missing');\n    }\n    beforeCreatedAt = last.created_at;\n    beforeId = last.code_task_id;\n  }\n}\n", "export async function resumeCodeTaskRequest(\n  req,\n  taskId,\n  { automaticRateLimit = false, automaticContinuation = false } = {},\n  onUnauthorized = () => {},\n) {\n  const res = await req(\n    'POST',\n    `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`,\n    automaticRateLimit\n      ? { automatic_rate_limit: true }\n      : automaticContinuation ? { automatic_continuation: true } : {},\n  );\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('resume unauthorized (401)');\n  }\n  if (!res.ok) {\n    // Carry the plane's refusal code so the watcher can tell a TERMINAL refusal\n    // (budget too small / ceiling reached / exhausted \u2014 no retry will ever\n    // succeed) from a transient coordination failure it should back off on.\n    let code = null;\n    try {\n      const body = await res.json();\n      code = typeof body?.error === 'string' ? body.error : null;\n    } catch { /* non-JSON body: keep code null */ }\n    const err = new Error(`resume failed: HTTP ${res.status}${code ? ` (${code})` : ''}`);\n    err.status = res.status;\n    err.code = code;\n    throw err;\n  }\n  const json = await res.json();\n  const task = json && json.task ? json.task : null;\n  // A 200 with an EXISTING active child (`deduplicated: true`) is not a new continuation; the flag\n  // rides along non-enumerably so persisted/logged task shapes stay byte-identical.\n  if (task && typeof json.deduplicated === 'boolean') Object.defineProperty(task, 'deduplicated', { value: json.deduplicated, enumerable: false });\n  return task;\n}\n", "export function makeAutonomousDispatchAdmissionClient(req, timeoutMs, onUnauthorized = () => {}) {\n  return {\n    async reserveAutonomousDispatchBudget({ requestedBudgetUsd, reservationId, occurrenceKey }) {\n      const res = await req('POST', '/api/v1/autonomous-dispatch/admission', {\n        requested_budget_usd: requestedBudgetUsd,\n        reservation_id: reservationId,\n        dispatch_occurrence_key: occurrenceKey,\n      }, { timeoutMs });\n      if (res.status === 401) {\n        onUnauthorized();\n        throw new Error('autonomous dispatch admission unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`autonomous dispatch admission failed: HTTP ${res.status}`);\n      const body = await res.json();\n      return {\n        allowed: body?.allowed === true,\n        reason: typeof body?.reason === 'string' ? body.reason : '',\n      };\n    },\n\n    async releaseAutonomousDispatchBudget(reservationId) {\n      const res = await req('POST', '/api/v1/autonomous-dispatch/reservation/release', {\n        reservation_id: reservationId,\n      }, { timeoutMs });\n      if (res.status === 401) {\n        onUnauthorized();\n        throw new Error('autonomous dispatch release unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`autonomous dispatch release failed: HTTP ${res.status}`);\n      return true;\n    },\n  };\n}\n", "export async function mergeVerifiedPrRequest(req, prNumber, automationContext, onUnauthorized) {\n  const res = await req(\n    'POST', '/api/v1/admin/pr/merge', { prNumber, automationContext }, { timeoutMs: 120_000 },\n  );\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('gated merge unauthorized (401)');\n  }\n  const json = await res.json().catch(() => ({}));\n  if (res.ok && json?.ok === true) {\n    const result = json?.result && typeof json.result === 'object' ? json.result : {};\n    const status = result.merged === true || result.status === 'merged'\n      ? 'merged'\n      : result.status === 'auto-merge-enabled' || String(result.action || '').includes('auto-merge')\n        ? 'queued'\n        : 'accepted';\n    return {\n      status,\n      detail: typeof result.detail === 'string' ? result.detail : null,\n      actionReceiptId: typeof json.action_receipt_id === 'string' ? json.action_receipt_id : null,\n    };\n  }\n  const captureStoreRetry = json?.action_status === 'not_attempted'\n    && (json?.error === 'capture_preflight_unavailable'\n      || json?.error === 'decision_outcome_intent_failed');\n  if (res.status === 503\n    && (json?.error === 'verify_unavailable' || json?.error === 'merge_unavailable'\n      || captureStoreRetry)) {\n    return { status: 'retry', reason: json.reason || json.message || json.error || 'verification unavailable' };\n  }\n  return {\n    status: 'blocked',\n    reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,\n    actionReceiptId: typeof json?.action_receipt_id === 'string' ? json.action_receipt_id : null,\n  };\n}\n", "/**\n * control-plane-weekly-tokens \u2014 `POST /api/v1/weekly-tokens` request helper,\n * extracted from control-plane-client.mjs (at its 400-line cap) so the client\n * could grow a sibling telemetry-relay method. Behaviour is unchanged.\n *\n * Report this machine's rolling-7-day Claude Code token usage (the real\n * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when\n * available). The daemon authenticates as admin, so the target `operatorId`\n * is named explicitly. Best-effort; throws on a non-2xx so the caller can\n * log + move on.\n *\n * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.\n * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).\n */\nexport async function postWeeklyTokensRequest(\n  taskReq,\n  { operatorId, runnerId, tokens, claudeWeeklyPct, claudeWeeklyResetsAt },\n  onUnauthorized = () => {},\n) {\n  const body = {\n    operator_id: operatorId,\n    runner_id: runnerId,\n    input_tokens: tokens.input_tokens,\n    output_tokens: tokens.output_tokens,\n    cache_creation_tokens: tokens.cache_creation_tokens,\n    cache_read_tokens: tokens.cache_read_tokens,\n  };\n  if (typeof claudeWeeklyPct === 'number') {\n    body.claude_weekly_pct = claudeWeeklyPct;\n  }\n  if (claudeWeeklyResetsAt !== undefined) {\n    body.claude_weekly_resets_at = claudeWeeklyResetsAt;\n  }\n  const res = await taskReq('POST', '/api/v1/weekly-tokens', body);\n  if (res.status === 401) {\n    onUnauthorized();\n    throw new Error('weekly-tokens unauthorized (401)');\n  }\n  if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);\n  return true;\n}\n", "/**\n * control-plane-telemetry-relay \u2014 `POST /api/v1/telemetry/relay` request\n * helper for the runner's telemetry forwarder (telemetry-forwarder.mjs).\n *\n * The daemon never holds the vo-telemetry ingest token: it hands a batch of\n * local vo-mcp events to the control plane, which relays each one to\n * vo-telemetry and returns per-event results (a PREFIX of the batch \u2014 the\n * relay halts on the first upstream fault so the forwarder's byte cursor can\n * never advance past an event the store did not accept).\n *\n * Returns `{ status, body }` and never throws on HTTP status \u2014 the forwarder\n * owns the backoff/disable policy. Network errors DO throw (fetch rejects).\n * A 30 s timeout covers up to MAX_EVENTS_PER_RELAY sequential upstream POSTs.\n */\nexport const TELEMETRY_RELAY_TIMEOUT_MS = 30_000;\n\nexport async function relayTelemetryEventsRequest(req, { events, source }, onUnauthorized = () => {}) {\n  const res = await req('POST', '/api/v1/telemetry/relay', { events, ...(source ? { source } : {}) }, {\n    timeoutMs: TELEMETRY_RELAY_TIMEOUT_MS,\n  });\n  if (res.status === 401) onUnauthorized();\n  let body = null;\n  try { body = await res.json(); } catch { body = null; }\n  return { status: res.status, body };\n}\n", "// Runner-side display of the control plane's claim-admission gate (2026-08-15).\n//\n// The claim route answers a DENIED runner with the benign queue-empty shape\n// (`task: null`) plus a `claim_gate` reason \u2014 by design, so pre-gate daemons keep\n// polling instead of crashing. Before this module the daemon dropped that field\n// on the floor and a below-target runner simply looked idle forever (\"no\n// pending task\" every 5s) with nothing on the host saying WHY. Now the reason is\n// logged once per distinct verdict (not every poll) and kept for /status.\n//\n// Pure apart from the injected `log`; the daemon's claim loop stays untouched.\n\nconst REASON_HELP = {\n  daemon_version_below_floor: 'this daemon is older than the approved release target \u2014 it idles until the governed updater brings it current (operator override: VO_RUNNER_CLAIM_MIN_DAEMON_VERSION / VO_RUNNER_CLAIM_VERSION_GATE=off on the control plane)',\n  daemon_version_unreported: 'this daemon reports no parseable version in its heartbeat \u2014 too old for the updater to manage, so it may not claim work',\n  no_fresh_heartbeat: 'the control plane has no fresh heartbeat from this runner \u2014 claims resume once heartbeats land',\n  runner_denylisted: 'this runner id is on the operator quarantine list (VO_RUNNER_CLAIM_DENYLIST)',\n};\n\nexport function describeClaimGate(gate) {\n  if (!gate || gate.allowed !== false) return null;\n  const reason = String(gate.reason || 'denied');\n  const floor = gate.floor_version ? ` (floor ${gate.floor_version})` : '';\n  return `claim gate: DENIED \u2014 ${reason}${floor}: ${(Object.hasOwn(REASON_HELP, reason) ? REASON_HELP[reason] : null) ?? 'the control plane refused this runner\\'s claims'}`;\n}\n\n/**\n * Track the latest verdict and log only on change (denied\u2192allowed logs the recovery too).\n * @returns {{ current: () => (object|null), observe: (json: unknown) => void }}\n */\nexport function makeClaimGateNotice({ log = () => {} } = {}) {\n  let last = null; // last DENIED verdict signature, or null when allowed\n  let current = null;\n  return {\n    current: () => current,\n    observe(json) {\n      const gate = json && typeof json === 'object' ? json.claim_gate : null;\n      const denied = gate && gate.allowed === false ? gate : null;\n      current = denied ? { ...denied, observed_at: new Date().toISOString() } : null;\n      const signature = denied ? `${denied.reason}|${denied.floor_version ?? ''}` : null;\n      if (signature === last) return;\n      if (denied) log(describeClaimGate(denied));\n      else if (last !== null) log('claim gate: allowed again \u2014 this runner may claim work');\n      last = signature;\n    },\n  };\n}\n", "/**\n * getTaskKnowledgeContext resilience.\n *\n * Incident 2026-08-29: tasks 8ca414ed (05:11:57Z) and eb5fd089 (05:28Z) both\n * failed at preparing_worktree because the knowledge-context fetch timed out\n * at the shared 5000ms task-request cap while the server itself measured\n * 3.4s/4.9s/6.99s over the same window (an embeddings leg was added\n * 2026-08-27). A single 5s-capped attempt was a coin flip. The fail-closed\n * refusal in task-prompt.mjs is deliberate and stays \u2014 this module only\n * widens the single attempt into a per-endpoint timeout floor plus a bounded\n * retry, so a slow-but-healthy server response is no longer indistinguishable\n * from a hung one. Every other control-plane endpoint is untouched and keeps\n * its original single-attempt policy.\n */\n\nexport const MIN_KNOWLEDGE_CONTEXT_TIMEOUT_MS = 15_000;\nconst RETRY_DELAYS_MS = [2_000, 6_000];\nconst MAX_ATTEMPTS = RETRY_DELAYS_MS.length + 1;\n\nfunction isRetryableStatus(status) {\n  return status >= 500 && status <= 599;\n}\n\nfunction defaultSleep(ms) {\n  return new Promise((resolve) => { setTimeout(resolve, ms); });\n}\n\n/**\n * `req` is the control-plane client's low-level request function:\n * `(method, path, body, { timeoutMs }) => Promise<Response-like>`. It throws\n * on timeout or transport failure and resolves (never rejects) for any HTTP\n * status, including 4xx/5xx \u2014 matching `control-plane-client.mjs`'s `req()`.\n */\nexport async function getTaskKnowledgeContextRequest(req, taskId, { query } = {}, {\n  taskRequestTimeoutMs,\n  invalidateToken = () => {},\n  sleep = defaultSleep,\n  log = () => {},\n} = {}) {\n  const body = {};\n  if (typeof query === 'string' && query.trim()) body.query = query;\n  const path = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;\n  const timeoutMs = Math.max(Number(taskRequestTimeoutMs) || 0, MIN_KNOWLEDGE_CONTEXT_TIMEOUT_MS);\n\n  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {\n    let res;\n    let cause;\n    try {\n      res = await req('POST', path, body, { timeoutMs });\n    } catch (err) {\n      cause = err;\n    }\n    if (!cause) {\n      if (res.status === 401) {\n        invalidateToken();\n        throw new Error('knowledge-context unauthorized (401)');\n      }\n      if (res.status === 404) return null;\n      if (res.ok) return res.json();\n      if (!isRetryableStatus(res.status)) {\n        throw new Error(`knowledge-context failed: HTTP ${res.status}`);\n      }\n      cause = new Error(`knowledge-context failed: HTTP ${res.status}`);\n    }\n    if (attempt === MAX_ATTEMPTS) throw cause;\n    const delayMs = RETRY_DELAYS_MS[attempt - 1];\n    log(`knowledge-context attempt ${attempt}/${MAX_ATTEMPTS} failed (${cause.message}); retrying in ${delayMs}ms`);\n    await sleep(delayMs);\n  }\n  /* c8 ignore next */\n  throw new Error('knowledge-context retry loop exited unexpectedly');\n}\n", "/**\n * control-plane-prepared-job \u2014 ADR-004 \u00A7 11.1 slice B, the fetch half.\n *\n * Reads the plane's PREPARED JOB for one code task from\n * `GET /api/v1/code-task/:id/prepared-job` (shipped DARK in slice A, PR #10218)\n * so the runner can compare it against its OWN local composition.\n *\n * SHADOW-ONLY: nothing here may change what the runner spawns. This module\n * therefore NEVER throws. Every fault \u2014 transport, timeout, 401, the 409\n * `router_mode_unsupported` refusal, a 5xx, a non-JSON body \u2014 comes back as a\n * structured refusal the caller records as a shadow observation. A dispatch is\n * never failed by a shadow read.\n */\n\n/**\n * Runner-local env knobs the plane must be TOLD about; it does not share the\n * runner's process.\n *\n * This list MUST stay byte-identical to `ENV_QUERY_KEYS` in\n * `cloud-run/vo-control-plane/src/routes/code-task-prepared-job.ts`. A key\n * present on one side only makes the plane compose a DIFFERENT job for a\n * reason that has nothing to do with drift \u2014 which is exactly the signal this\n * slice exists to measure, so the two lists are pinned equal by\n * prepared-job-shadow.test.mjs rather than left to review.\n */\nexport const PREPARED_JOB_ENV_QUERY_KEYS = [\n  'VO_CODE_RUNNER_NO_WEB',\n  'VO_CODE_RUNNER_NO_WORKFLOW',\n  'VO_CODE_RUNNER_NO_CONSENSUS',\n  'VO_CODE_RUNNER_PERMISSION_MODE',\n  'VO_CODE_RUNNER_DEFAULT_BUDGET_USD',\n  'VO_CODE_RUNNER_META_REASONING_EFFORT',\n  'VO_CODE_RUNNER_ALLOW_MISSING_KNOWLEDGE_CONTEXT',\n  'VO_ENABLE_CONTEXT7',\n];\n\n/** The plane accepts a query env value only when 0 < length <= 64 (same route). */\nexport const PREPARED_JOB_ENV_VALUE_MAX = 64;\n\n/**\n * Build the query string for one prepared-job read.\n *\n * Returns `{ query, sent, dropped }`. `dropped` names any allow-listed key the\n * runner HAS set but the plane will refuse for length \u2014 a real divergence\n * cause that must be visible in the record rather than inferred from a\n * mismatching prompt.\n */\nexport function preparedJobQuery({ agent = 'claude', env = {} } = {}) {\n  const params = new URLSearchParams();\n  params.set('agent', String(agent));\n  const sent = [];\n  const dropped = [];\n  for (const key of PREPARED_JOB_ENV_QUERY_KEYS) {\n    const raw = env?.[key];\n    if (typeof raw !== 'string' || raw.length === 0) continue;\n    if (raw.length > PREPARED_JOB_ENV_VALUE_MAX) { dropped.push(key); continue; }\n    params.set(key, raw);\n    sent.push(key);\n  }\n  return { query: params.toString(), sent, dropped };\n}\n\n/** Read the plane's error code out of a non-2xx body without ever throwing. */\nasync function refusalCode(res) {\n  try {\n    const body = await res.json();\n    return typeof body?.error === 'string' && body.error ? body.error : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Fetch the prepared job. Resolves to\n *   { ok: true,  job, composition, envSent, envDropped }\n *   { ok: false, reason, status, envSent, envDropped }\n * and never rejects.\n *\n * @param {Function} req              the control-plane client's raw request fn\n * @param {string}   taskId\n * @param {object}   [options]        { agent, env, timeoutMs }\n * @param {Function} [invalidateToken] called on 401 so the next real call re-auths\n */\nexport async function getPreparedJobRequest(req, taskId, options = {}, invalidateToken = () => {}) {\n  const { agent = 'claude', env = {}, timeoutMs = 15_000 } = options;\n  const { query, sent, dropped } = preparedJobQuery({ agent, env });\n  const envMeta = { envSent: sent, envDropped: dropped };\n  if (typeof taskId !== 'string' || taskId.length === 0) {\n    return { ok: false, reason: 'missing_task_id', status: 0, ...envMeta };\n  }\n  const path = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;\n  let res;\n  try {\n    res = await req('GET', path, undefined, { timeoutMs });\n  } catch (err) {\n    return { ok: false, reason: `transport: ${err?.message || String(err)}`, status: 0, ...envMeta };\n  }\n  if (res?.status === 401) {\n    try { invalidateToken(); } catch { /* shadow-only */ }\n    return { ok: false, reason: 'unauthorized', status: 401, ...envMeta };\n  }\n  if (!res?.ok) {\n    const code = await refusalCode(res);\n    return { ok: false, reason: code || `http_${res?.status ?? 'unknown'}`, status: res?.status ?? 0, ...envMeta };\n  }\n  let body;\n  try {\n    body = await res.json();\n  } catch (err) {\n    return { ok: false, reason: `unreadable_body: ${err?.message || String(err)}`, status: res.status, ...envMeta };\n  }\n  const job = body?.prepared_job;\n  if (!job || typeof job !== 'object') {\n    return { ok: false, reason: 'no_prepared_job_in_body', status: res.status, ...envMeta };\n  }\n  return {\n    ok: true,\n    job,\n    composition: body?.composition && typeof body.composition === 'object' ? body.composition : {},\n    ...envMeta,\n  };\n}\n", "/**\n * control-plane-client \u2014 the runner's OUTBOUND link to vo-control-plane.\n *\n * Increment 6 (Code-from-Anywhere). The daemon never exposes a port; it reaches\n * OUT to the control-plane (no inbound hole, no Tailscale \u2014 design \u00A72). Auth:\n * prefer the static admin token (`VO_CONTROL_PLANE_ADMIN_TOKEN`, the V1 local\n * dogfood path); fall back to a per-user Firebase ID token via the shared\n * orchestrator auth (`SMOKE_*` creds \u2192 allow-listed operator \u2192 admin).\n *\n * Covers task claim/progress/context/private attachments/resume and governed merge.\n */\n\nimport { fetchInstallationToken } from './installation-token.mjs';\nimport { buildRunnerHeartbeatBody } from './control-plane-heartbeat-body.mjs';\nimport { promoteDraftPrRequest } from './control-plane-promote.mjs';\nimport { listAllPrOpenedTasks } from './control-plane-task-list.mjs';\nimport { resumeCodeTaskRequest } from './control-plane-resume.mjs';\nimport { makeAutonomousDispatchAdmissionClient } from './control-plane-autonomous-admission.mjs';\nimport { mergeVerifiedPrRequest } from './control-plane-merge.mjs';\nimport { postWeeklyTokensRequest } from './control-plane-weekly-tokens.mjs';\nimport { relayTelemetryEventsRequest } from './control-plane-telemetry-relay.mjs';\nimport { makeClaimGateNotice } from './claim-gate-notice.mjs';\nimport { getTaskKnowledgeContextRequest } from './control-plane-knowledge-context.mjs'; import { getPreparedJobRequest } from './control-plane-prepared-job.mjs';\n\nlet cachedFirebaseToken = null;\nexport class ClaimAuthorityChangedError extends Error {\n  constructor() {\n    super('code-task claim authority changed');\n    this.name = 'ClaimAuthorityChangedError'; this.code = 'code_task_claim_authority_changed';\n  }\n}\n\nasync function resolveBearer(env) {\n  const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;\n  if (adminToken) return adminToken;\n  if (cachedFirebaseToken) return cachedFirebaseToken;\n  // Lazy import \u2014 Firebase auth is only needed when no admin token is present.\n  const { getFirebaseAuth } = await import('../orchestrator-firestore/auth.mjs');\n  const auth = await getFirebaseAuth({ env });\n  if (!auth || !auth.idToken) {\n    throw new Error(\n      'no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY',\n    );\n  }\n  cachedFirebaseToken = auth.idToken;\n  return cachedFirebaseToken;\n}\n\n/**\n * Build a client. `baseUrl` defaults to `env.VO_CONTROL_PLANE_URL`. `fetchImpl`,\n * `env`, and `sleep` (the retry backoff delay function) are injectable for\n * tests and packaged runner handoff.\n */\nexport function createControlPlaneClient({\n  baseUrl,\n  env = process.env,\n  fetchImpl = fetch,\n  heartbeatTimeoutMs = Math.min(\n    Math.max(Number(env.VO_CODE_RUNNER_HEARTBEAT_TIMEOUT_MS) || 15_000, 1_000),\n    60_000,\n  ),\n  taskRequestTimeoutMs = Math.min(\n    Math.max(Number(env.VO_CODE_RUNNER_TASK_REQUEST_TIMEOUT_MS) || 5_000, 100),\n    60_000,\n  ),\n  runnerId,\n  runnerInstanceId,\n  sleep,\n} = {}) {\n  const resolvedBaseUrl = baseUrl ?? env.VO_CONTROL_PLANE_URL ?? '';\n  if (!resolvedBaseUrl) throw new Error('VO_CONTROL_PLANE_URL is required for the code-runner daemon');\n  const root = resolvedBaseUrl.replace(/\\/+$/, '');\n\n  async function req(method, path, body, { timeoutMs } = {}) {\n    const bearer = await resolveBearer(env);\n    const controller = timeoutMs ? new AbortController() : null;\n    let timeoutId;\n    const request = Promise.resolve(fetchImpl(`${root}${path}`, {\n      method,\n      headers: {\n        'content-type': 'application/json',\n        authorization: `Bearer ${bearer}`,\n      },\n      body: body === undefined ? undefined : JSON.stringify(body),\n      ...(controller ? { signal: controller.signal } : {}),\n    }));\n    if (!timeoutMs) return request;\n    const timeout = new Promise((_, reject) => {\n      timeoutId = setTimeout(() => {\n        controller.abort();\n        reject(new Error(`control-plane ${path} timed out after ${timeoutMs}ms`));\n      }, timeoutMs);\n    });\n    try {\n      return await Promise.race([request, timeout]);\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n  const taskReq = (method, path, body, options = {}) => req(method, path, body, { timeoutMs: taskRequestTimeoutMs, ...options }); const claimGate = makeClaimGateNotice({ log: (m) => console.warn(`[code-runner ${new Date().toISOString()}] ${m}`) }); // deny-site visibility\n  return { getClaimGate: () => claimGate.current(), // last DENIED claim-gate verdict (null when allowed) \u2014 for /status + tests\n    ...makeAutonomousDispatchAdmissionClient(\n      req, taskRequestTimeoutMs, () => { cachedFirebaseToken = null; },\n    ),\n    /**\n     * Claim the next pending task. Returns the task or null (empty queue).\n     * `repos` (optional `owner/name` list) and `operatorIds` (optional\n     * `operator_id` list) scope the claim so this daemon only picks up tasks it\n     * serves \u2014 the control-plane filters by both (logical AND), so another\n     * operator's task never lands on (or bills) this machine.\n     */\n    async claim(runnerId, repos, operatorIds, session = {}) {\n      const body = { runner_id: runnerId };\n      if (Array.isArray(repos) && repos.length > 0) body.repos = repos;\n      if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;\n      if (session.runnerInstanceId) { body.runner_instance_id = session.runnerInstanceId; body.runner_progress_protocol_version = 2; }\n      if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;\n      if (session.defaultAgent) body.default_agent = session.defaultAgent;\n      if (Array.isArray(session.availableAgents)) {\n        body.available_agents = session.availableAgents\n          .filter((entry) => entry?.installed === true && entry?.authenticated === true)\n          .map((entry) => entry.agent);\n      }\n      const res = await taskReq('POST', '/api/v1/code-task/claim', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null; // force re-auth next call\n        throw new Error('claim unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);\n      const json = await res.json(); claimGate.observe(json); // 2026-08-15: a DENIED verdict is logged once + kept for /status instead of reading as an idle queue\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).\n     * Server derives operator/tenant from the daemon's authenticated principal.\n     * Returns the created task, or throws on a non-2xx response.\n     */\n    async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns, dispatch_mode, tier, agent, model, dispatch_occurrence_key, autonomous_reservation_id, on_behalf_of_operator_id, repair_pr_number, repair_kind, repair_head_sha, repair_chain }) {\n      const body = { repo, prompt };\n      if (typeof max_budget_usd === 'number') body.max_budget_usd = max_budget_usd;\n      if (typeof max_turns === 'number') body.max_turns = max_turns;\n      for (const [key, value] of Object.entries({ dispatch_mode, tier, agent, model, repair_kind, repair_head_sha })) {\n        if (value) body[key] = value;\n      }\n      if (dispatch_occurrence_key) body.dispatch_occurrence_key = dispatch_occurrence_key;\n      if (autonomous_reservation_id) body.autonomous_reservation_id = autonomous_reservation_id; if (on_behalf_of_operator_id) body.on_behalf_of_operator_id = on_behalf_of_operator_id;\n      if (Number.isInteger(repair_pr_number) && repair_pr_number > 0) body.repair_pr_number = repair_pr_number;\n      if (repair_chain) body.repair_chain = repair_chain;\n      const res = await taskReq('POST', '/api/v1/code-task', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('enqueue unauthorized (401)');\n      }\n      if (!res.ok) {\n        // Carry the plane's refusal code (repair_not_needed / dispatch_occurrence_exists /\n        // repair_state_unavailable / autonomous_reservation_invalid \u2026) so callers can tell a\n        // policy answer from a real fault \u2014 same contract as control-plane-resume.mjs.\n        let code = null;\n        try { const errBody = await res.json(); code = typeof errBody?.error === 'string' ? errBody.error : null; } catch { /* non-JSON body */ }\n        const err = new Error(`enqueue failed: HTTP ${res.status}${code ? ` (${code})` : ''}`);\n        err.status = res.status; err.code = code;\n        throw err;\n      }\n      const json = await res.json();\n      const task = json && json.task ? json.task : null;\n      // `deduplicated` (plane returned an EXISTING task for this occurrence/repair) rides along\n      // non-enumerably so logs/persistence of the task stay byte-identical.\n      if (task && typeof json.deduplicated === 'boolean') Object.defineProperty(task, 'deduplicated', { value: json.deduplicated, enumerable: false });\n      return task;\n    },\n\n    /**\n     * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses\n     * this after the runner opens a partial draft PR and CI is no longer pending.\n     */\n    async resumeCodeTask(taskId, { automaticRateLimit = false, automaticContinuation = false } = {}) {\n      return resumeCodeTaskRequest(taskReq, taskId, { automaticRateLimit, automaticContinuation }, () => {\n        cachedFirebaseToken = null;\n      });\n    },\n\n    /**\n     * Send a CI-green PR through the production verify-before-act merge route.\n     * The server inspects the current diff, applies deterministic blockers, runs\n     * consensus, records a receipt, and direct-merges only the inspected SHA.\n     */\n    /** F35: promote a PARTIAL draft to READY via the plane (admin-only; server re-checks; never merges). */\n    promoteDraftPr: (prNumber, automationContext) => promoteDraftPrRequest(req, prNumber, automationContext, () => { cachedFirebaseToken = null; }),\n    async mergeVerifiedPr(prNumber, automationContext) {\n      return mergeVerifiedPrRequest(\n        req, prNumber, automationContext, () => { cachedFirebaseToken = null; },\n      );\n    },\n\n    /**\n     * Append progress / set terminal status. Returns\n     *   { task }            \u2014 applied\n     *   { terminal: true }  \u2014 task already terminal (operator cancelled): STOP\n     */\n    async postProgress(taskId, patch) {\n      const progress = {\n        ...patch,\n        ...(patch.runner_id ? {} : runnerId ? { runner_id: runnerId } : {}),\n        ...(patch.runner_instance_id ? {} : runnerInstanceId ? { runner_instance_id: runnerInstanceId } : {}),\n      };\n      const res = await taskReq('PATCH', `/api/v1/code-task/${taskId}/progress`, progress);\n      if (res.status === 409) {\n        const conflict = await res.json().catch(() => ({}));\n        if (conflict?.error === 'code_task_claim_authority_changed') {\n          throw new ClaimAuthorityChangedError();\n        }\n        return { terminal: true };\n      }\n      if (res.status === 404) return { terminal: true, missing: true };\n      if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return { task: json && json.task };\n    },\n\n    async getTask(taskId) {\n      const res = await taskReq('GET', `/api/v1/code-task/${taskId}`);\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json ? json.task : null;\n    },\n    async listPrOpenedTasks() {\n      return listAllPrOpenedTasks(taskReq);\n    },\n    async downloadTaskAttachment(taskId, attachmentId) {\n      const path = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;\n      const res = await taskReq('GET', path);\n      if (res.status === 401) cachedFirebaseToken = null;\n      if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);\n      return Buffer.from(await res.arrayBuffer());\n    },\n\n    // Raised per-attempt timeout (>=15s) + bounded retry \u2014 see control-plane-knowledge-context.mjs.\n    async getTaskKnowledgeContext(taskId, { query } = {}) {\n      return getTaskKnowledgeContextRequest(req, taskId, { query }, {\n        taskRequestTimeoutMs,\n        invalidateToken: () => { cachedFirebaseToken = null; },\n        sleep,\n        log: (m) => console.warn(`[code-runner ${new Date().toISOString()}] ${m}`),\n      });\n    },\n\n    /** ADR-004 \u00A7 11.1b: the plane's prepared job, for SHADOW comparison. Never throws. */\n    getPreparedJob: (taskId, options) => getPreparedJobRequest(req, taskId, options, () => { cachedFirebaseToken = null; }),\n    /** Weekly Claude token usage report \u2014 see control-plane-weekly-tokens.mjs. */\n    async postWeeklyTokens(report) {\n      return postWeeklyTokensRequest(taskReq, report, () => { cachedFirebaseToken = null; });\n    },\n\n    /**\n     * Relay a batch of this machine's local vo-mcp events to vo-telemetry via\n     * the control plane (telemetry-forwarder.mjs). Returns { status, body };\n     * the forwarder owns backoff/disable policy. See control-plane-telemetry-relay.mjs.\n     */\n    async relayTelemetryEvents(batch) {\n      return relayTelemetryEventsRequest(req, batch, () => { cachedFirebaseToken = null; });\n    },\n\n    /**\n     * Send a liveness heartbeat (M2). The control-plane upserts it under the\n     * authenticated operator so the web shows a TRUE \"runner online\" signal.\n     * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.\n     */\n    async postHeartbeat(heartbeat) {\n      const body = buildRunnerHeartbeatBody(heartbeat);\n      const res = await req('POST', '/api/v1/runner/heartbeat', body, {\n        timeoutMs: heartbeatTimeoutMs,\n      });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('heartbeat unauthorized (401)');\n      }\n      if (!res.ok) {\n        // Surface WHICH field the server rejected. `HTTP 400` alone is what made\n        // the 2026-07-25 outage take hours to diagnose: the runner looked\n        // identical to a powered-off machine from the control plane, and the\n        // operator's only clue was a bare status code.\n        //\n        // The server returns issue PATHS and CODES only (never values), so this\n        // is safe to log.\n        let detail = '';\n        try {\n          const body = await res.json();\n          if (Array.isArray(body?.issue_paths) && body.issue_paths.length > 0) {\n            detail = ` (rejected fields: ${body.issue_paths.join(', ')})`;\n          }\n        } catch { /* non-JSON body \u2014 the status code is all we have */ }\n        throw new Error(`heartbeat failed: HTTP ${res.status}${detail}`);\n      }\n      return res.json();\n    },\n\n    async getRunnerStatus({ operatorId } = {}) {\n      const query = operatorId ? `?operator_id=${encodeURIComponent(operatorId)}` : '';\n      const res = await req('GET', `/api/v1/runner/status${query}`, undefined, {\n        timeoutMs: heartbeatTimeoutMs,\n      });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner status unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner status failed: HTTP ${res.status}`);\n      const body = await res.json();\n      return Array.isArray(body?.runners) ? body.runners : [];\n    },\n\n    async pollRunnerControl({ runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities }) {\n      const body = { runner_id: runnerId };\n      if (operatorId) body.operator_id = operatorId;\n      if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n      if (supervisorVersion) body.supervisor_version = supervisorVersion;\n      if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n      const res = await taskReq('POST', '/api/v1/runner/control/poll', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control poll unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);\n      const json = await res.json();\n      const action = json?.action;\n      return action && typeof action.action_id === 'string' && action.action_id\n        ? { ...action, actionId: action.action_id }\n        : null;\n    },\n\n    async completeRunnerControl(actionId, { runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities, status, detail }) {\n      const body = { runner_id: runnerId, status };\n      if (operatorId) body.operator_id = operatorId;\n      if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n      if (supervisorVersion) body.supervisor_version = supervisorVersion;\n      if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n      if (detail) body.detail = detail;\n      const res = await taskReq('POST', `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control completion unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json?.action || null;\n    },\n\n    /** Mint a GitHub App installation token \u2014 see installation-token.mjs. */\n    async getInstallationToken({ required = false, readOnly = false, repo = null } = {}) {\n      return fetchInstallationToken({ req: taskReq, required, readOnly, repo });\n    },\n\n    /**\n     * Read the operator's dispatch-mode config (Fast\u2192Ultracode effort setting).\n     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'marathon'; 'ultracode' legacy),\n     * defaulting to 'standard' on any error. Never throws \u2014 best-effort.\n     */\n    async getDispatchMode() {\n      try {\n        const res = await taskReq('GET', '/api/v1/dispatch-mode-config');\n        if (!res.ok) return 'standard';\n        const json = await res.json();\n        return json?.dispatchMode || 'standard';\n      } catch {\n        return 'standard';\n      }\n    },\n  };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { win32 } from 'node:path';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\nconst NPM_CLI_SUFFIX = `\\\\${win32.join('node_modules', 'npm', 'bin', 'npm-cli.js').toLowerCase()}`;\n\nfunction escapeRegExp(value) {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n  let value = String(raw || '')\n    .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n    .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n    .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n  for (const [name, secret] of Object.entries(env)) {\n    if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n    const text = String(secret || '');\n    if (text.length < 4) continue;\n    value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n  }\n  value = value.replace(/\\s+/gu, ' ').trim();\n  if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n  return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nfunction isNpmCliPath(value) {\n  return typeof value === 'string'\n    && win32.isAbsolute(value)\n    && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);\n}\n\n/**\n * Resolve npm's JavaScript entrypoint without executing a Windows `.cmd` shim.\n *\n * The desktop app can run from a bundled node.exe that does not carry npm, so\n * resolution also checks the exact npm layout below absolute PATH entries. No\n * candidate controls the executable or package argv: process.execPath remains\n * the executable and the package spec remains allow-listed below.\n */\nexport function resolveNpmCli({\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  const candidates = [];\n  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);\n  candidates.push(win32.join(win32.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n\n  const pathValue = env.PATH ?? env.Path ?? env.path ?? '';\n  for (const entry of pathValue.split(';')) {\n    const trimmed = entry.trim();\n    if (!win32.isAbsolute(trimmed)) continue;\n    candidates.push(win32.join(trimmed, 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n  }\n\n  const seen = new Set();\n  for (const candidate of candidates) {\n    const normalized = win32.normalize(candidate);\n    const key = normalized.toLowerCase();\n    if (seen.has(key) || !isNpmCliPath(normalized)) continue;\n    seen.add(key);\n    if (fileExists(normalized)) return normalized;\n  }\n  return null;\n}\n\nexport function buildMaintenanceCommand(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  if (!['update', 'reinstall'].includes(kind)) return null;\n  if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const command = platform === 'win32' ? execPath : 'npm';\n  const args = [...(npmCli ? [npmCli] : []), 'install', '-g', packageSpec];\n  if (kind === 'reinstall') args.push('--force');\n  return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n  spawn = spawnSync,\n  log = () => {},\n} = {}) {\n  if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n  let command;\n  try {\n    command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });\n  } catch (error) {\n    return {\n      ok: false,\n      status: 2,\n      command: null,\n      args: [],\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env),\n    };\n  }\n  if (!command) return { ok: false, status: 2, command: null, args: [] };\n  log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n  const result = spawn(command.command, command.args, {\n    stdio: ['ignore', 'pipe', 'pipe'],\n    encoding: 'utf8',\n    env,\n    shell: false,\n    windowsHide: true,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  const detail = sanitizeMaintenanceDiagnostic(\n    [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n    env,\n  );\n  if (detail) log(`runner maintenance result: ${detail}`);\n  return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from 'node:fs';\nimport { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport { resolveNpmCli, sanitizeMaintenanceDiagnostic } from '../../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport {\n  validateRuntimeAuthorization,\n  validateStagedRuntimeAuthorization,\n} from '../../../../scripts/virtual-office/runner-bootstrap/runtime-authorization.mjs';\nimport { activateSlot, atomicWriteJson, hashFileSha512, hashRuntimeTree, slotPaths, validateSlot } from './bundled-runtime-store.mjs';\n\nconst PACKAGE_NAME = '@algosuite/vo-mcp';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst MAX_TARBALL_BYTES = 100 * 1024 * 1024;\nconst PUBLIC_REGISTRY = 'https://registry.npmjs.org/';\n\nexport function buildMinimalMaintenanceEnv(env = process.env, runtimeRoot = '') {\n  const allowed = new Set([\n    'PATH', 'Path', 'path', 'PATHEXT', 'SystemRoot', 'SYSTEMROOT', 'WINDIR', 'COMSPEC',\n    'TEMP', 'TMP', 'TMPDIR', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',\n    'ProgramFiles', 'ProgramFiles(x86)', 'ProgramW6432', 'LANG', 'LC_ALL',\n  ]);\n  const clean = {};\n  for (const [key, value] of Object.entries(env)) {\n    if (allowed.has(key) && typeof value === 'string') clean[key] = value;\n  }\n  return {\n    ...clean,\n    npm_config_ignore_scripts: 'true',\n    npm_config_bin_links: 'false',\n    npm_config_audit: 'false',\n    npm_config_fund: 'false',\n    npm_config_update_notifier: 'false',\n    npm_config_registry: PUBLIC_REGISTRY,\n    ...(runtimeRoot ? {\n      npm_config_userconfig: join(runtimeRoot, 'maintenance', 'user.npmrc'),\n      npm_config_globalconfig: join(runtimeRoot, 'maintenance', 'global.npmrc'),\n      npm_config_cache: join(runtimeRoot, 'maintenance', 'npm-cache'),\n    } : {}),\n  };\n}\n\nfunction defaultRun(command, args, options) {\n  return spawnSync(command, args, {\n    cwd: options.cwd,\n    encoding: 'utf8',\n    env: options.env,\n    shell: false,\n    windowsHide: true,\n    stdio: ['ignore', 'pipe', 'pipe'],\n    timeout: options.timeout ?? 120_000,\n  });\n}\n\nfunction commandRunner({ platform, execPath, env, fileExists, run }) {\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const npmCommand = platform === 'win32' ? execPath : 'npm';\n  const prefix = npmCli ? [npmCli] : [];\n  return {\n    npm(args, options) { return run(npmCommand, [...prefix, ...args], options); },\n    node(args, options) { return run(execPath, args, options); },\n  };\n}\n\nfunction parseJsonOutput(result, operation) {\n  if (result?.status !== 0) {\n    throw new Error(`${operation} failed: ${String(result?.stderr || result?.error?.message || `exit ${result?.status ?? 1}`)}`);\n  }\n  try { return JSON.parse(String(result.stdout || '')); } catch { throw new Error(`${operation} returned invalid JSON`); }\n}\n\nfunction tarballIntegrity(file) {\n  return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\nfunction assertNoLinks(root) {\n  const pending = [root];\n  while (pending.length) {\n    const current = pending.pop();\n    const stat = lstatSync(current);\n    if (stat.isSymbolicLink()) throw new Error('installed runtime contains a link/reparse point');\n    if (!stat.isDirectory()) continue;\n    for (const entry of readdirSync(current)) pending.push(join(current, entry));\n  }\n}\n\nexport function validateDependencyLock(payloadRoot, expected) {\n  const lock = JSON.parse(readFileSync(join(payloadRoot, 'package-lock.json'), 'utf8'));\n  if (Number(lock.lockfileVersion) < 3 || !lock.packages || typeof lock.packages !== 'object') {\n    throw new Error('runtime dependency lock is missing or unsupported');\n  }\n  let foundPackage = false;\n  for (const [key, item] of Object.entries(lock.packages)) {\n    if (!key) continue;\n    if (item?.link === true) throw new Error(`runtime dependency lock contains link: ${key}`);\n    const isRunner = key.replaceAll('\\\\', '/').endsWith('node_modules/@algosuite/vo-mcp');\n    if (isRunner) {\n      foundPackage = item.version === expected.version && item.integrity === expected.integrity;\n      continue;\n    }\n    if (!INTEGRITY_RE.test(String(item?.integrity || ''))) throw new Error(`dependency lacks sha512 integrity: ${key}`);\n    if (!String(item?.resolved || '').startsWith('https://registry.npmjs.org/')) {\n      throw new Error(`dependency is not registry-pinned: ${key}`);\n    }\n  }\n  if (!foundPackage) throw new Error('installed runner package does not match registry integrity');\n}\n\nexport function writeAuthorizedInstallSeed(payloadRoot, tarball, runtimeAuthorization) {\n  const authorization = validateRuntimeAuthorization(runtimeAuthorization);\n  const stagingRoot = resolve(payloadRoot, '..', '..');\n  const tarballFromStaging = relative(stagingRoot, resolve(tarball));\n  if (!tarballFromStaging || tarballFromStaging === '..'\n    || tarballFromStaging.startsWith(`..${sep}`)\n    || isAbsolute(tarballFromStaging)) {\n    throw new Error('authorized runtime tarball escaped staging root');\n  }\n  const relativeTarball = relative(payloadRoot, resolve(tarball)).replaceAll('\\\\', '/');\n  if (!relativeTarball || isAbsolute(relativeTarball)\n    || relativeTarball.includes('\\n') || relativeTarball.includes('\\r')) {\n    throw new Error('authorized runtime tarball path invalid');\n  }\n  const fileSpec = `file:${relativeTarball}`;\n  const packageRecord = { name: 'algohq-runner-runtime', version: '0.0.0', private: true,\n    dependencies: { [PACKAGE_NAME]: fileSpec } };\n  const packages = structuredClone(authorization.dependency_lock.packages);\n  packages[`node_modules/${PACKAGE_NAME}`].resolved = fileSpec;\n  const lock = { name: packageRecord.name, version: packageRecord.version,\n    lockfileVersion: authorization.dependency_lock.source_lockfile_version,\n    requires: true, packages: { '': packageRecord, ...packages } };\n  writeFileSync(join(payloadRoot, 'package.json'), `${JSON.stringify(packageRecord)}\\n`, { mode: 0o600 });\n  writeFileSync(join(payloadRoot, 'package-lock.json'), `${JSON.stringify(lock)}\\n`, { mode: 0o600 });\n  return { fileSpec, lock };\n}\n\nfunction buildActive(slotId, metadata, paths) {\n  return {\n    slot_id: slotId,\n    version: metadata.version,\n    integrity: metadata.integrity,\n    entry_sha512: hashFileSha512(paths.entry),\n    supervisor_sha512: hashFileSha512(paths.supervisor),\n    tree_sha512: hashRuntimeTree(paths.slotRoot ?? paths.payloadRoot),\n  };\n}\n\nfunction installSlot({\n  runtimeRoot, metadata, tarball, runner, npmEnv, runOptions, force, runtimeAuthorization,\n}) {\n  const digest = createHash('sha256').update(metadata.integrity).digest('hex').slice(0, 16);\n  const suffix = force ? `${digest}-${randomUUID().slice(0, 8)}` : digest;\n  const slotId = `vo-mcp-${metadata.version}-${suffix}`;\n  const finalPaths = slotPaths(runtimeRoot, slotId);\n  if (!force && existsSync(finalPaths.slotRoot)) {\n    const manifest = JSON.parse(readFileSync(finalPaths.manifest, 'utf8'));\n    const active = buildActive(slotId, metadata, finalPaths);\n    const validated = validateSlot(runtimeRoot, active);\n    if (validated.ok && manifest.integrity === metadata.integrity) {\n      if (runtimeAuthorization) {\n        validateStagedRuntimeAuthorization({\n          payloadRoot: finalPaths.slotRoot, authorization: runtimeAuthorization,\n        });\n      }\n      return { active, created: false };\n    }\n  }\n\n  const staging = join(runtimeRoot, 'staging', randomUUID());\n  const payload = join(staging, 'payload');\n  let installedSlot = false;\n  try {\n    mkdirSync(payload, { recursive: true });\n    let installArgs;\n    if (runtimeAuthorization) {\n      writeAuthorizedInstallSeed(payload, tarball, runtimeAuthorization);\n      installArgs = ['ci', '--ignore-scripts', '--no-bin-links', '--no-audit', '--no-fund',\n        `--registry=${PUBLIC_REGISTRY}`];\n    } else {\n      writeFileSync(join(payload, 'package.json'), `${JSON.stringify({\n        name: 'algohq-runner-runtime', version: '0.0.0', private: true,\n      })}\\n`);\n      installArgs = ['install', '--ignore-scripts', '--no-bin-links', '--no-audit', '--no-fund',\n        '--package-lock=true', '--save-exact', `--registry=${PUBLIC_REGISTRY}`, tarball];\n    }\n    const install = runner.npm(installArgs,\n      { ...runOptions, cwd: payload, env: npmEnv, timeout: 180_000 });\n    if (install.status !== 0) throw new Error(`npm install failed: ${install.stderr || install.error?.message || install.status}`);\n    assertNoLinks(payload);\n    validateDependencyLock(payload, metadata);\n    if (runtimeAuthorization) {\n      validateStagedRuntimeAuthorization({ payloadRoot: payload, authorization: runtimeAuthorization });\n    }\n\n    const stagedPaths = {\n      entry: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp'),\n      supervisor: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js'),\n      packageJson: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'package.json'),\n      credentialHelper: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js'),\n      slotRoot: payload,\n    };\n    const pkg = JSON.parse(readFileSync(stagedPaths.packageJson, 'utf8'));\n    if (pkg.name !== PACKAGE_NAME || pkg.version !== metadata.version) throw new Error('installed package identity mismatch');\n    if (!lstatSync(stagedPaths.credentialHelper).isFile()) throw new Error('installed credential helper is missing');\n    const smoke = runner.node([stagedPaths.entry, 'runner', '--version'], { ...runOptions, cwd: payload, env: npmEnv, timeout: 30_000 });\n    if (smoke.status !== 0 || String(smoke.stdout || '').trim() !== `vo-mcp runner ${metadata.version}`) {\n      throw new Error('bundled runtime smoke check failed');\n    }\n    const active = buildActive(slotId, metadata, stagedPaths);\n    atomicWriteJson(join(payload, 'runtime-manifest.json'), { schema_version: 1, ...active });\n    mkdirSync(join(runtimeRoot, 'slots'), { recursive: true });\n    if (existsSync(finalPaths.slotRoot)) throw new Error('immutable runtime slot already exists');\n    renameSync(payload, finalPaths.slotRoot);\n    installedSlot = true;\n    const validated = validateSlot(runtimeRoot, active);\n    if (!validated.ok) throw new Error(`staged runtime validation failed: ${validated.detail}`);\n    return { active, created: true };\n  } catch (error) {\n    if (installedSlot) rmSync(finalPaths.slotRoot, { recursive: true, force: true });\n    throw error;\n  } finally {\n    rmSync(staging, { recursive: true, force: true });\n  }\n}\n\nexport function stageBundledRuntimeSlot(options) {\n  const {\n    runtimeRoot,\n    packageSpec,\n    expectedVersion,\n    expectedIntegrity,\n    platform = process.platform,\n    execPath = process.execPath,\n    env = process.env,\n    fileExists = existsSync,\n    run = defaultRun,\n    force = false,\n    runtimeAuthorization = null,\n  } = options;\n  if (!runtimeRoot || !isAbsolute(runtimeRoot)) return { ok: false, status: 2, detail: 'bundled runtime root unavailable' };\n  if (!expectedVersion || !PACKAGE_SPEC_RE.test(`${PACKAGE_NAME}@${expectedVersion}`)) {\n    return { ok: false, status: 2, detail: 'invalid expected runner version' };\n  }\n  if (!expectedIntegrity || !INTEGRITY_RE.test(expectedIntegrity)) {\n    return { ok: false, status: 2, detail: 'invalid expected runner integrity' };\n  }\n  const exactSpec = `${PACKAGE_NAME}@${expectedVersion}`;\n  if (packageSpec !== exactSpec) return { ok: false, status: 2, detail: 'runner package spec does not match authorized version' };\n  const resolvedRoot = resolve(runtimeRoot);\n  const npmEnv = buildMinimalMaintenanceEnv(env, resolvedRoot);\n  const runOptions = { env: npmEnv, cwd: resolvedRoot };\n  let tarDir = null;\n  try {\n    mkdirSync(resolvedRoot, { recursive: true });\n    mkdirSync(join(resolvedRoot, 'maintenance'), { recursive: true });\n    writeFileSync(npmEnv.npm_config_userconfig, '', { mode: 0o600 });\n    writeFileSync(npmEnv.npm_config_globalconfig, '', { mode: 0o600 });\n    const runner = commandRunner({ platform, execPath, env: npmEnv, fileExists, run });\n    const metadata = { version: expectedVersion, integrity: expectedIntegrity };\n    tarDir = join(resolvedRoot, 'staging', randomUUID());\n    mkdirSync(tarDir, { recursive: true });\n    const packed = parseJsonOutput(runner.npm([\n      'pack', exactSpec, '--ignore-scripts', '--json', '--pack-destination', tarDir, `--registry=${PUBLIC_REGISTRY}`,\n    ], runOptions), 'npm pack');\n    const record = Array.isArray(packed) ? packed[0] : packed;\n    const tarball = join(tarDir, basename(String(record?.filename || '')));\n    if (!existsSync(tarball) || !basename(tarball).endsWith('.tgz')) throw new Error('npm pack returned no tarball');\n    if (lstatSync(tarball).size > MAX_TARBALL_BYTES) throw new Error('runner package tarball exceeds size limit');\n    if (record.integrity !== metadata.integrity || tarballIntegrity(tarball) !== metadata.integrity) {\n      throw new Error('runner package sha512 integrity mismatch');\n    }\n    const installed = installSlot({\n      runtimeRoot: resolvedRoot, metadata, tarball, runner, npmEnv, runOptions, force,\n      runtimeAuthorization,\n    });\n    return { ok: true, status: 0, ...installed };\n  } catch (error) {\n    return { ok: false, status: 1, detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env) };\n  } finally {\n    if (tarDir) rmSync(tarDir, { recursive: true, force: true });\n  }\n}\n\nexport function stageAndActivateBundledUpdate(options) {\n  const staged = stageBundledRuntimeSlot(options);\n  if (!staged.ok) return staged;\n  try {\n    activateSlot(resolve(options.runtimeRoot), staged.active, options.action);\n    return { ...staged, handoff: true };\n  } catch (error) {\n    return {\n      ok: false,\n      status: 1,\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), options.env ?? process.env),\n    };\n  }\n}\n\nexport const __test = { INTEGRITY_RE, PACKAGE_SPEC_RE, PUBLIC_REGISTRY, assertNoLinks, tarballIntegrity };\n", "import { createHash } from 'node:crypto';\nimport { readFileSync } from 'node:fs';\nimport { dirname, posix, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport {\n  compareStagedRuntime,\n  isOmittedOptionalPackage,\n} from './runtime-staged-tree.mjs';\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nexport const BETA13_WINDOWS_X64_AUTHORIZATION = resolve(\n  HERE,\n  'authorizations',\n  'vo-mcp-0.2.0-beta.13-win32-x64.json',\n);\n\nconst EXPECTED = Object.freeze({\n  authorizationId: 'vo-mcp-0.2.0-beta.13-win32-x64-v1',\n  packageName: '@algosuite/vo-mcp',\n  version: '0.2.0-beta.13',\n  registry: 'https://registry.npmjs.org/',\n  tarballUrl: 'https://registry.npmjs.org/@algosuite/vo-mcp/-/vo-mcp-0.2.0-beta.13.tgz',\n  integrity: 'sha512-TQa5VaEFsaleHbAZZp+zS4u5U/0zQBIGOiPDGn9IqfZfdMltH2dY81nTftvu5EUABthE1xTCrdSzJjO9mzkNag==',\n  tarballSha256: 'c1e39e8bb2df7f53f48e46e77ffb617452a01849469ff4757b4384a478c1cbff',\n  npmShasumSha1: 'f076649b31294aa38deb7852f38a889e0d0fbe44',\n  gitHead: 'ba00db90720416fa7474581eb823c6255221880f',\n  sourceLockSha256: 'f8bbb5e81a0057ee2d60145580ec07f7e7055d999bdd038515c6c4e88af6cc92',\n  canonicalEntriesSha256: '7f6b2f93ccb93ad625ed244dc59ac556792e478178fc690ad2ca2c6f3a2325d2',\n  entryCount: 107,\n  optionalEntryCount: 13,\n  installedEntryCount: 96,\n  treeAlgorithm: 'algohq-node-modules-manifest-sha256-v1',\n  treeSha256: '9c8b0749d7ae1e2c132ef08c5b5655673ae88432859c561806276c9eb18f4874',\n  treeFileCount: 3538,\n  treeDirectoryCount: 553,\n  treeByteCount: 20566445,\n  treeManifestByteCount: 412062,\n});\n\nconst SRI_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst SHA256_RE = /^[a-f0-9]{64}$/u;\n\nfunction canonical(value) {\n  if (Array.isArray(value)) return value.map(canonical);\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));\n  }\n  return value;\n}\n\nfunction sha256Canonical(value) {\n  return createHash('sha256').update(`${JSON.stringify(canonical(value))}\\n`, 'utf8').digest('hex');\n}\n\nfunction assertEqual(actual, expected, label) {\n  if (actual !== expected) throw new Error(`runtime authorization ${label} mismatch`);\n}\n\nfunction isOmittedOnWindowsX64(entry) {\n  return isOmittedOptionalPackage(entry, { os: 'win32', arch: 'x64' });\n}\n\nexport function validateRuntimeAuthorization(value) {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('runtime authorization must be an object');\n  }\n  assertEqual(value.schema_version, 1, 'schema version');\n  assertEqual(value.authorization_id, EXPECTED.authorizationId, 'id');\n  assertEqual(value.package?.name, EXPECTED.packageName, 'package name');\n  assertEqual(value.package?.version, EXPECTED.version, 'package version');\n  assertEqual(value.package?.registry, EXPECTED.registry, 'registry');\n  assertEqual(value.package?.tarball_url, EXPECTED.tarballUrl, 'tarball URL');\n  assertEqual(value.package?.sri_sha512, EXPECTED.integrity, 'package integrity');\n  assertEqual(value.package?.tarball_sha256, EXPECTED.tarballSha256, 'tarball sha256');\n  assertEqual(value.package?.npm_shasum_sha1, EXPECTED.npmShasumSha1, 'npm shasum');\n  assertEqual(value.package?.git_head, EXPECTED.gitHead, 'git head');\n  assertEqual(value.package?.packed_file_count, 25, 'packed file count');\n  assertEqual(value.package?.packed_bytes, 846151, 'packed byte count');\n  assertEqual(value.package?.unpacked_bytes, 3350387, 'unpacked byte count');\n\n  assertEqual(value.platform?.os, 'win32', 'operating system');\n  assertEqual(value.platform?.arch, 'x64', 'architecture');\n  assertEqual(value.platform?.package_node_engine, '>=22.5.0', 'package node engine');\n  if (!/^24\\.15\\.0$/u.test(String(value.platform?.authorization_builder_node || ''))\n    || value.platform?.authorization_builder_npm !== '11.12.1') {\n    throw new Error('runtime authorization builder toolchain mismatch');\n  }\n\n  for (const [key, expected] of Object.entries({\n    ignore_scripts: true,\n    bin_links: false,\n    include_optional: true,\n    omit_dev: true,\n    audit: false,\n    fund: false,\n    reject_links_reparse_points: true,\n    reject_hardlinks: true,\n    remove_generated_node_modules_package_lock_before_tree_validation: true,\n  })) assertEqual(value.install_contract?.[key], expected, `install contract ${key}`);\n  assertEqual(value.install_contract?.allowed_registry_prefix, EXPECTED.registry, 'registry prefix');\n\n  const lock = value.dependency_lock;\n  if (!lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {\n    throw new Error('runtime authorization dependency set missing');\n  }\n  assertEqual(lock.source_lockfile_version, 3, 'lockfile version');\n  assertEqual(lock.source_lock_sha256, EXPECTED.sourceLockSha256, 'source lock sha256');\n  assertEqual(lock.canonical_entries_sha256, EXPECTED.canonicalEntriesSha256, 'entry-set sha256');\n  assertEqual(lock.entry_count, EXPECTED.entryCount, 'entry count');\n  assertEqual(lock.integrity_entry_count, EXPECTED.entryCount, 'integrity count');\n  assertEqual(lock.optional_entry_count, EXPECTED.optionalEntryCount, 'optional count');\n  assertEqual(lock.windows_x64_installed_entry_count, EXPECTED.installedEntryCount, 'installed count');\n\n  const entries = Object.entries(lock.packages);\n  assertEqual(entries.length, EXPECTED.entryCount, 'package map count');\n  for (const [key, entry] of entries) {\n    if (!key.startsWith('node_modules/') || key.includes('\\\\') || posix.normalize(key) !== key\n      || key.split('/').includes('..')) {\n      throw new Error(`runtime authorization has unsafe package path: ${key}`);\n    }\n    if (!entry || typeof entry !== 'object' || entry.link === true) {\n      throw new Error(`runtime authorization contains a linked package: ${key}`);\n    }\n    if (!SRI_RE.test(String(entry.integrity || ''))) {\n      throw new Error(`runtime authorization package lacks sha512 integrity: ${key}`);\n    }\n    if (!String(entry.resolved || '').startsWith(EXPECTED.registry)) {\n      throw new Error(`runtime authorization package is outside the public registry: ${key}`);\n    }\n    if (entry.hasInstallScript === true) {\n      throw new Error(`runtime authorization package declares an install script: ${key}`);\n    }\n  }\n  const runner = lock.packages['node_modules/@algosuite/vo-mcp'];\n  assertEqual(runner?.version, EXPECTED.version, 'runner dependency version');\n  assertEqual(runner?.integrity, EXPECTED.integrity, 'runner dependency integrity');\n  assertEqual(sha256Canonical(lock.packages), EXPECTED.canonicalEntriesSha256, 'computed entry-set sha256');\n\n  const omitted = entries.filter(([, entry]) => isOmittedOnWindowsX64(entry)).map(([key]) => key).sort();\n  const declaredOmitted = [...(lock.windows_x64_omitted_optional_entries || [])].sort();\n  assertEqual(JSON.stringify(declaredOmitted), JSON.stringify(omitted), 'omitted optional entries');\n  assertEqual(entries.length - omitted.length, EXPECTED.installedEntryCount, 'derived installed count');\n\n  const tree = value.installed_tree;\n  assertEqual(tree?.algorithm, EXPECTED.treeAlgorithm, 'tree algorithm');\n  if (!SHA256_RE.test(String(tree?.sha256 || ''))) throw new Error('runtime authorization tree hash invalid');\n  assertEqual(tree.sha256, EXPECTED.treeSha256, 'tree sha256');\n  assertEqual(tree.file_count, EXPECTED.treeFileCount, 'tree file count');\n  assertEqual(tree.directory_count, EXPECTED.treeDirectoryCount, 'tree directory count');\n  assertEqual(tree.byte_count, EXPECTED.treeByteCount, 'tree byte count');\n  assertEqual(tree.canonical_manifest_byte_count, EXPECTED.treeManifestByteCount, 'tree manifest byte count');\n  assertEqual(tree.reparse_point_count, 0, 'tree reparse count');\n  assertEqual(tree.hardlinked_file_count, 0, 'tree hardlink count');\n  return value;\n}\n\nexport function readRuntimeAuthorization(file = BETA13_WINDOWS_X64_AUTHORIZATION) {\n  return validateRuntimeAuthorization(JSON.parse(readFileSync(file, 'utf8')));\n}\n\nexport function validateStagedRuntimeAuthorization(options) {\n  const authorization = validateRuntimeAuthorization(options?.authorization || readRuntimeAuthorization());\n  return compareStagedRuntime({ ...options, authorization });\n}\n\nif (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {\n  readRuntimeAuthorization(process.argv[2] ? resolve(process.argv[2]) : undefined);\n  process.stdout.write('AlgoHQ runtime authorization valid\\n');\n}\n\nexport const __test = { canonical, isOmittedOnWindowsX64, sha256Canonical };\n", "import { execFileSync } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n  existsSync,\n  lstatSync,\n  readFileSync,\n  readdirSync,\n} from 'node:fs';\nimport { isAbsolute, join, relative, resolve, sep, win32 } from 'node:path';\n\nconst WINDOWS_REPARSE_ATTRIBUTE = 0x400;\nconst RUNNER_LOCK_KEY = 'node_modules/@algosuite/vo-mcp';\nexport const INSTALLED_TREE_ALGORITHM = 'algohq-node-modules-manifest-sha256-v1';\n\nfunction canonical(value) {\n  if (Array.isArray(value)) return value.map(canonical);\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));\n  }\n  return value;\n}\n\nfunction canonicalJson(value) {\n  return JSON.stringify(canonical(value));\n}\n\nfunction hasFileAttribute(value, bit) {\n  if (typeof value === 'bigint') return (value & BigInt(bit)) !== 0n;\n  return Number.isSafeInteger(value) && (value & bit) !== 0;\n}\n\nexport function isReparseStat(stats) {\n  if (!stats || typeof stats !== 'object') return false;\n  if (typeof stats.isSymbolicLink === 'function' && stats.isSymbolicLink()) return true;\n  if (stats.reparseTag !== undefined && stats.reparseTag !== null && stats.reparseTag !== 0) return true;\n  return ['fileAttributes', 'fileAttribute', 'attributes']\n    .some((key) => hasFileAttribute(stats[key], WINDOWS_REPARSE_ATTRIBUTE));\n}\n\nexport function platformConstraintAllows(values, target) {\n  if (!Array.isArray(values) || values.length === 0) return true;\n  if (values.some((value) => value === `!${target}`)) return false;\n  const positive = values.filter((value) => typeof value === 'string' && !value.startsWith('!'));\n  return positive.length === 0 || positive.includes(target);\n}\n\nexport function isOmittedOptionalPackage(entry, platform = { os: 'win32', arch: 'x64' }) {\n  return entry?.optional === true && (\n    !platformConstraintAllows(entry.os, platform.os)\n    || !platformConstraintAllows(entry.cpu, platform.arch)\n  );\n}\n\nfunction assertContained(root, candidate, label) {\n  const rel = relative(root, candidate);\n  if (rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel))) return;\n  throw new Error(`staged runtime ${label} escapes the payload root`);\n}\n\nfunction normalizeReportedPath(root, candidate) {\n  const absolute = resolve(String(candidate || ''));\n  assertContained(root, absolute, 'reparse point');\n  return absolute;\n}\n\nexport function listWindowsReparsePoints(root, {\n  execFile = execFileSync, env = process.env, platform = process.platform,\n} = {}) {\n  if (platform !== 'win32') return [];\n  const systemRoot = String(env.SystemRoot || env.SYSTEMROOT || '');\n  if (!win32.isAbsolute(systemRoot) || win32.normalize(systemRoot) !== systemRoot) {\n    throw new Error('staged runtime trusted PowerShell root unavailable');\n  }\n  const system32 = win32.join(systemRoot, 'System32');\n  const powershell = win32.join(system32, 'WindowsPowerShell', 'v1.0', 'powershell.exe');\n  const script = [\n    '$ErrorActionPreference = \"Stop\"',\n    '$root = [IO.Path]::GetFullPath($env:ALGOHQ_REPARSE_ROOT)',\n    '$items = @((Get-Item -LiteralPath $root -Force)) + @(Get-ChildItem -LiteralPath $root -Force -Recurse)',\n    'foreach ($item in $items) {',\n    '  if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {',\n    '    [Console]::Out.WriteLine($item.FullName)',\n    '  }',\n    '}',\n  ].join('; ');\n  const output = execFile(powershell, [\n    '-NoLogo',\n    '-NoProfile',\n    '-NonInteractive',\n    '-Command',\n    script,\n  ], {\n    cwd: system32,\n    encoding: 'utf8',\n    env: { SystemRoot: systemRoot, ALGOHQ_REPARSE_ROOT: win32.resolve(root) },\n    windowsHide: true,\n  });\n  return String(output || '').split(/\\r?\\n/u).filter(Boolean)\n    .map((item) => normalizeReportedPath(root, item));\n}\n\nfunction normalizedRunnerRecord(actual, expected) {\n  const normalized = structuredClone(actual);\n  if (normalized?.resolved === expected?.resolved) return normalized;\n  if (typeof normalized?.resolved !== 'string' || !normalized.resolved.startsWith('file:')) {\n    return normalized;\n  }\n  const fileName = normalized.resolved.slice('file:'.length).replaceAll('\\\\', '/').split('/').at(-1);\n  const expectedFileNames = new Set([\n    String(expected.resolved || '').split('/').at(-1),\n    `algosuite-vo-mcp-${expected.version}.tgz`,\n  ]);\n  if (expectedFileNames.has(fileName)) normalized.resolved = expected.resolved;\n  return normalized;\n}\n\nfunction validateLock(lock, authorization) {\n  if (!lock || typeof lock !== 'object' || Array.isArray(lock)) {\n    throw new Error('staged runtime package-lock must be an object');\n  }\n  if (lock.lockfileVersion !== authorization.dependency_lock.source_lockfile_version) {\n    throw new Error('staged runtime package-lock version mismatch');\n  }\n  if (!lock.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {\n    throw new Error('staged runtime package-lock package map missing');\n  }\n  const expected = authorization.dependency_lock.packages;\n  const actual = Object.fromEntries(Object.entries(lock.packages).filter(([key]) => key !== ''));\n  const expectedKeys = Object.keys(expected).sort();\n  const actualKeys = Object.keys(actual).sort();\n  if (canonicalJson(actualKeys) !== canonicalJson(expectedKeys)) {\n    throw new Error('staged runtime package-lock package set mismatch');\n  }\n  for (const key of expectedKeys) {\n    const record = key === RUNNER_LOCK_KEY\n      ? normalizedRunnerRecord(actual[key], expected[key])\n      : actual[key];\n    if (canonicalJson(record) !== canonicalJson(expected[key])) {\n      throw new Error(`staged runtime package-lock record mismatch: ${key}`);\n    }\n  }\n  return { actual, expected };\n}\n\nfunction checkPathKind(path, expectedKind, fsOps, label) {\n  if (!fsOps.exists(path)) throw new Error(`staged runtime ${label} missing`);\n  const stats = fsOps.lstat(path);\n  if (isReparseStat(stats) || fsOps.isReparsePoint(path, stats)) {\n    throw new Error(`staged runtime ${label} is a reparse point`);\n  }\n  if (expectedKind === 'directory' && !stats.isDirectory()) {\n    throw new Error(`staged runtime ${label} is not a directory`);\n  }\n  if (expectedKind === 'file' && !stats.isFile()) {\n    throw new Error(`staged runtime ${label} is not a regular file`);\n  }\n  if (expectedKind === 'file' && Number(stats.nlink) > 1) {\n    throw new Error(`staged runtime ${label} is hardlinked`);\n  }\n  return stats;\n}\n\nfunction verifyInstalledPackages(payloadRoot, packageRecords, platform, fsOps) {\n  const omitted = [];\n  let installed = 0;\n  for (const [key, entry] of Object.entries(packageRecords)) {\n    const path = resolve(payloadRoot, key);\n    assertContained(payloadRoot, path, 'package path');\n    const shouldOmit = isOmittedOptionalPackage(entry, platform);\n    if (shouldOmit) {\n      omitted.push(key);\n      if (fsOps.exists(path)) throw new Error(`staged runtime optional package should be omitted: ${key}`);\n      continue;\n    }\n    checkPathKind(path, 'directory', fsOps, `installed package ${key}`);\n    installed += 1;\n  }\n  return { installed, omitted: omitted.sort() };\n}\n\nfunction treeRecord(kind, path, stats, fileHash = '') {\n  if (kind === 'd') return `d\\t${path}\\r\\n`;\n  return `f\\t${path}\\t${stats.size}\\t${fileHash}\\r\\n`;\n}\n\nexport function computeInstalledTree(nodeModulesRoot, fsOps = {}) {\n  const ops = {\n    exists: existsSync,\n    lstat: lstatSync,\n    readdir: (path) => readdirSync(path, { withFileTypes: true }),\n    readFile: readFileSync,\n    isReparsePoint: () => false,\n    listReparsePoints: listWindowsReparsePoints,\n    ...fsOps,\n  };\n  const root = resolve(nodeModulesRoot);\n  checkPathKind(root, 'directory', ops, 'node_modules root');\n  const reported = ops.listReparsePoints(root);\n  if (!Array.isArray(reported)) throw new Error('staged runtime reparse probe returned an invalid result');\n  if (reported.length > 0) throw new Error('staged runtime tree contains a Windows reparse point');\n\n  let fileCount = 0;\n  let directoryCount = 1;\n  let byteCount = 0;\n  const entries = [];\n  function walk(absolute, relativePath) {\n    for (const entry of ops.readdir(absolute)) {\n      const childRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;\n      if (childRelative === '.package-lock.json') continue;\n      const child = resolve(absolute, entry.name);\n      assertContained(root, child, 'tree entry');\n      const stats = ops.lstat(child);\n      if (isReparseStat(stats) || ops.isReparsePoint(child, stats)) {\n        throw new Error(`staged runtime tree contains a reparse point: ${childRelative}`);\n      }\n      if (stats.isDirectory()) {\n        directoryCount += 1;\n        entries.push({ kind: 'd', path: childRelative, stats });\n        walk(child, childRelative);\n      } else if (stats.isFile()) {\n        if (Number(stats.nlink) > 1) {\n          throw new Error(`staged runtime tree contains a hardlinked file: ${childRelative}`);\n        }\n        fileCount += 1;\n        byteCount += Number(stats.size);\n        const digest = createHash('sha256').update(ops.readFile(child)).digest('hex');\n        entries.push({ kind: 'f', path: childRelative, stats, digest });\n      } else {\n        throw new Error(`staged runtime tree contains a non-file entry: ${childRelative}`);\n      }\n    }\n  }\n  walk(root, '');\n  entries.sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));\n  const manifest = treeRecord('d', '', { size: 0 }) + entries\n    .map((entry) => treeRecord(entry.kind, entry.path, entry.stats, entry.digest))\n    .join('');\n  return {\n    algorithm: INSTALLED_TREE_ALGORITHM,\n    sha256: createHash('sha256').update(manifest, 'utf8').digest('hex'),\n    file_count: fileCount,\n    directory_count: directoryCount,\n    byte_count: byteCount,\n    canonical_manifest_byte_count: Buffer.byteLength(manifest),\n    reparse_point_count: 0,\n    hardlinked_file_count: 0,\n  };\n}\n\nexport function compareStagedRuntime({\n  payloadRoot,\n  nodeModulesRoot = join(payloadRoot, 'node_modules'),\n  packageLockFile = join(payloadRoot, 'package-lock.json'),\n  authorization,\n  fsOps = {},\n}) {\n  const payload = resolve(payloadRoot);\n  const modules = resolve(nodeModulesRoot);\n  const lockFile = resolve(packageLockFile);\n  if (modules !== resolve(payload, 'node_modules') || lockFile !== resolve(payload, 'package-lock.json')) {\n    throw new Error('staged runtime paths do not identify one canonical payload');\n  }\n  const ops = {\n    exists: existsSync,\n    lstat: lstatSync,\n    readFile: readFileSync,\n    isReparsePoint: () => false,\n    ...fsOps,\n  };\n  checkPathKind(lockFile, 'file', ops, 'package-lock');\n  const lock = JSON.parse(ops.readFile(lockFile, 'utf8'));\n  const { expected } = validateLock(lock, authorization);\n  const platform = { os: authorization.platform.os, arch: authorization.platform.arch };\n  const packages = verifyInstalledPackages(payload, expected, platform, ops);\n  const declaredOmitted = [...authorization.dependency_lock.windows_x64_omitted_optional_entries].sort();\n  if (canonicalJson(packages.omitted) !== canonicalJson(declaredOmitted)) {\n    throw new Error('staged runtime optional omission list mismatch');\n  }\n  if (packages.installed !== Object.keys(expected).length - packages.omitted.length) {\n    throw new Error('staged runtime installed package count mismatch');\n  }\n  const tree = computeInstalledTree(modules, fsOps);\n  if (canonicalJson(tree) !== canonicalJson(authorization.installed_tree)) {\n    throw new Error('staged runtime installed tree mismatch');\n  }\n  return { ok: true, packageCount: Object.keys(expected).length, ...packages, tree };\n}\n\nexport const __test = { canonical, canonicalJson, normalizeReportedPath, normalizedRunnerRecord };\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n  closeSync,\n  existsSync,\n  fsyncSync,\n  lstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, isAbsolute, join, relative, resolve } from 'node:path';\n\nconst SLOT_ID_RE = /^vo-mcp-[0-9A-Za-z._-]{1,96}$/u;\nconst ACTION_ID_RE = /^[0-9A-Za-z._-]{1,128}$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst VERSION_RE = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst ENTRY_REL = join('node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp');\nconst SUPERVISOR_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js');\nconst PACKAGE_REL = join('node_modules', '@algosuite', 'vo-mcp', 'package.json');\nconst CREDENTIAL_HELPER_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js');\nconst MANIFEST_FILE = 'runtime-manifest.json';\n\nfunction within(parent, candidate) {\n  const rel = relative(resolve(parent), resolve(candidate));\n  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));\n}\n\n/**\n * Mirror of the desktop app's runtime-root resolution: RUNNER_RUNTIME_DIR\n * under Tauri's BaseDirectory::AppData for the app identifier. MUST stay in\n * lockstep with packages/vo-runner-app/src-tauri/src/runtime_slots.rs\n * (`RUNNER_RUNTIME_DIR`) and tauri.conf.json (`identifier`), or supervisors\n * and the app would stage/read different roots.\n */\nconst APP_IDENTIFIER = 'ai.algosuite.vo-runner';\nconst RUNNER_RUNTIME_DIR = 'runner-runtime';\n\nexport function defaultRuntimeRoot({ platform = process.platform, env = process.env, home = homedir() } = {}) {\n  if (platform === 'win32') {\n    const appData = String(env.APPDATA || '').trim();\n    return appData && isAbsolute(appData) ? join(appData, APP_IDENTIFIER, RUNNER_RUNTIME_DIR) : null;\n  }\n  if (!home) return null;\n  if (platform === 'darwin') {\n    return join(home, 'Library', 'Application Support', APP_IDENTIFIER, RUNNER_RUNTIME_DIR);\n  }\n  const xdg = String(env.XDG_CONFIG_HOME || '').trim();\n  const base = xdg && isAbsolute(xdg) ? xdg : join(home, '.config');\n  return join(base, APP_IDENTIFIER, RUNNER_RUNTIME_DIR);\n}\n\n/**\n * Explicit VO_RUNNER_RUNTIME_ROOT always wins, and a SET-but-invalid value\n * still fails closed (null \u2014 a misconfiguration must not silently fall back).\n * When the variable is ABSENT, derive the app-convention default: a\n * supervisor launched by an env-stripping wrapper (live-observed on\n * vo-code-runner-JacksPC, 2026-07-21: every bundled update hard-failed\n * \"bundled runtime root unavailable\") can then still stage/activate the\n * governed update into the exact directory the desktop app reads.\n */\nexport function runtimeRootFromEnv(env = process.env, { platform, home } = {}) {\n  const value = String(env.VO_RUNNER_RUNTIME_ROOT || '').trim();\n  if (value) return isAbsolute(value) ? resolve(value) : null;\n  const derived = defaultRuntimeRoot({ platform, env, home });\n  return derived ? resolve(derived) : null;\n}\n\nexport function hashFileSha512(file) {\n  return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\n/** Digest every executable payload byte and relative path, excluding only the self-referential manifest. */\nexport function hashRuntimeTree(root) {\n  const hasher = createHash('sha512');\n  const files = [];\n  const visit = (directory, prefix = '') => {\n    const rootStat = lstatSync(directory);\n    if (rootStat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n    if (!rootStat.isDirectory()) throw new Error('runtime tree root is not a directory');\n    for (const name of readdirSync(directory).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) {\n      const absolute = join(directory, name);\n      const relativePath = prefix ? `${prefix}/${name}` : name;\n      const stat = lstatSync(absolute);\n      if (stat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n      if (stat.isDirectory()) visit(absolute, relativePath);\n      else if (stat.isFile() && relativePath !== MANIFEST_FILE) files.push({ absolute, relativePath, size: stat.size });\n      else if (!stat.isFile()) throw new Error('runtime tree contains a non-regular file');\n    }\n  };\n  visit(root);\n  files.sort((a, b) => Buffer.compare(Buffer.from(a.relativePath), Buffer.from(b.relativePath)));\n  for (const file of files) {\n    const pathBytes = Buffer.from(file.relativePath, 'utf8');\n    hasher.update(`${pathBytes.length}:`);\n    hasher.update(pathBytes);\n    hasher.update(`:${file.size}:`);\n    hasher.update(readFileSync(file.absolute));\n    hasher.update('\\n');\n  }\n  return `sha512-${hasher.digest('base64')}`;\n}\n\nexport function atomicWriteJson(file, value) {\n  mkdirSync(dirname(file), { recursive: true });\n  const temp = join(dirname(file), `.${randomUUID()}.tmp`);\n  const fd = openSync(temp, 'wx', 0o600);\n  try {\n    writeFileSync(fd, `${JSON.stringify(value, null, 2)}\\n`, 'utf8');\n    fsyncSync(fd);\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(temp, file);\n    // A file fsync does not make the directory entry durable on POSIX. Windows\n    // cannot open directories this way, so keep the durability upgrade best-effort.\n    if (process.platform !== 'win32') {\n      try {\n        const parentFd = openSync(dirname(file), 'r');\n        try { fsyncSync(parentFd); } finally { closeSync(parentFd); }\n      } catch { /* current.json remains atomically committed */ }\n    }\n  } finally {\n    rmSync(temp, { force: true });\n  }\n}\n\nexport function readActivation(runtimeRoot) {\n  const file = join(runtimeRoot, 'current.json');\n  if (!existsSync(file)) return null;\n  try {\n    const value = JSON.parse(readFileSync(file, 'utf8'));\n    return value?.schema_version === 1 ? value : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function slotPaths(runtimeRoot, slotId) {\n  if (!SLOT_ID_RE.test(slotId)) throw new Error('invalid runtime slot id');\n  const slotRoot = join(runtimeRoot, 'slots', slotId);\n  return {\n    slotRoot,\n    entry: join(slotRoot, ENTRY_REL),\n    supervisor: join(slotRoot, SUPERVISOR_REL),\n    packageJson: join(slotRoot, PACKAGE_REL),\n    credentialHelper: join(slotRoot, CREDENTIAL_HELPER_REL),\n    manifest: join(slotRoot, MANIFEST_FILE),\n  };\n}\n\nfunction validActive(active) {\n  return active\n    && SLOT_ID_RE.test(active.slot_id)\n    && VERSION_RE.test(active.version)\n    && INTEGRITY_RE.test(active.integrity)\n    && INTEGRITY_RE.test(active.entry_sha512)\n    && INTEGRITY_RE.test(active.supervisor_sha512)\n    && INTEGRITY_RE.test(active.tree_sha512);\n}\n\nexport function validateSlot(runtimeRoot, active) {\n  if (!validActive(active)) return { ok: false, detail: 'invalid activation metadata' };\n  const paths = slotPaths(runtimeRoot, active.slot_id);\n  try {\n    const manifest = JSON.parse(readFileSync(paths.manifest, 'utf8'));\n    const pkg = JSON.parse(readFileSync(paths.packageJson, 'utf8'));\n    const expected = {\n      slot_id: active.slot_id,\n      version: active.version,\n      integrity: active.integrity,\n      entry_sha512: active.entry_sha512,\n      supervisor_sha512: active.supervisor_sha512,\n      tree_sha512: active.tree_sha512,\n    };\n    for (const [key, value] of Object.entries(expected)) {\n      if (manifest?.[key] !== value) return { ok: false, detail: `manifest ${key} mismatch` };\n    }\n    if (manifest?.schema_version !== 1 || pkg?.name !== '@algosuite/vo-mcp' || pkg?.version !== active.version) {\n      return { ok: false, detail: 'package identity mismatch' };\n    }\n    if (lstatSync(paths.entry).isSymbolicLink() || lstatSync(paths.supervisor).isSymbolicLink()\n      || lstatSync(paths.credentialHelper).isSymbolicLink()) {\n      return { ok: false, detail: 'runtime entry cannot be a link' };\n    }\n    if (!within(paths.slotRoot, realpathSync(paths.entry)) || !within(paths.slotRoot, realpathSync(paths.supervisor))\n      || !within(paths.slotRoot, realpathSync(paths.credentialHelper))) {\n      return { ok: false, detail: 'runtime entry escaped its slot' };\n    }\n    if (hashFileSha512(paths.entry) !== active.entry_sha512) return { ok: false, detail: 'entry hash mismatch' };\n    if (hashFileSha512(paths.supervisor) !== active.supervisor_sha512) return { ok: false, detail: 'supervisor hash mismatch' };\n    if (hashRuntimeTree(paths.slotRoot) !== active.tree_sha512) return { ok: false, detail: 'runtime tree hash mismatch' };\n    return { ok: true, paths, manifest };\n  } catch (error) {\n    return { ok: false, detail: error instanceof Error ? error.message : String(error) };\n  }\n}\n\nexport function journalActivation(runtimeRoot, actionId, state, detail = '') {\n  if (!ACTION_ID_RE.test(actionId)) throw new Error('invalid runner action id');\n  atomicWriteJson(join(runtimeRoot, 'transactions', `${actionId}.json`), {\n    schema_version: 1,\n    action_id: actionId,\n    state,\n    detail: String(detail).slice(0, 400),\n    updated_at: new Date().toISOString(),\n  });\n}\n\nexport function activateSlot(runtimeRoot, active, action) {\n  if (!validActive(active)) throw new Error('cannot activate invalid runtime metadata');\n  if (!ACTION_ID_RE.test(action.actionId)) throw new Error('invalid runner action id');\n  if (!UUID_RE.test(String(action.supervisorInstanceId || ''))) throw new Error('invalid claiming supervisor instance id');\n  const validated = validateSlot(runtimeRoot, active);\n  if (!validated.ok) throw new Error(`cannot activate invalid runtime slot: ${validated.detail}`);\n  const current = readActivation(runtimeRoot);\n  if (current?.pending) throw new Error('another runtime activation is still pending');\n  const pointer = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active,\n    previous: validActive(current?.active) ? current.active : null,\n    pending: {\n      action_id: action.actionId,\n      runner_id: String(action.runnerId || ''),\n      operator_id: String(action.operatorId || ''),\n      supervisor_instance_id: action.supervisorInstanceId,\n      activated_at: new Date().toISOString(),\n      ack_attempts: 0,\n    },\n  };\n  // The pointer rename is the transaction commit and therefore the last\n  // fallible write. A crash before it leaves the previous runtime selected.\n  journalActivation(runtimeRoot, action.actionId, 'prepared', `${active.version} ${active.integrity}`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n  return pointer;\n}\n\nexport function activationSupervisorInstanceId(runtimeRoot, fallback) {\n  const current = runtimeRoot ? readActivation(runtimeRoot) : null;\n  const pending = String(current?.pending?.supervisor_instance_id || '');\n  if (UUID_RE.test(pending)) return pending;\n  return UUID_RE.test(String(fallback || '')) ? fallback : null;\n}\n\nexport function recordActivationRetry(runtimeRoot, pointer, detail) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before retry');\n  }\n  const attempts = Math.max(0, Number(current.pending.ack_attempts || 0)) + 1;\n  const updated = {\n    ...current,\n    pending: { ...current.pending, ack_attempts: attempts, last_error: String(detail).slice(0, 240) },\n  };\n  atomicWriteJson(join(runtimeRoot, 'current.json'), updated);\n  journalActivation(runtimeRoot, current.pending.action_id, 'ack-retry', `attempt ${attempts}: ${detail}`);\n  return updated;\n}\n\n/** One-time migration for an old desktop launcher that has no control action. */\nexport function bootstrapSlot(runtimeRoot, active, bootstrapId) {\n  if (!ACTION_ID_RE.test(bootstrapId)) throw new Error('invalid bootstrap id');\n  const validated = validateSlot(runtimeRoot, active);\n  if (!validated.ok) throw new Error(`cannot bootstrap invalid runtime slot: ${validated.detail}`);\n  const current = readActivation(runtimeRoot);\n  if (current?.pending) throw new Error('another runtime activation is still pending');\n  if (current?.active?.slot_id === active.slot_id && current.active.integrity === active.integrity) return current;\n  const pointer = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active,\n    previous: validActive(current?.active) ? current.active : null,\n    pending: null,\n  };\n  journalActivation(runtimeRoot, bootstrapId, 'bootstrap-prepared', `${active.version} ${active.integrity}`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n  try { journalActivation(runtimeRoot, bootstrapId, 'bootstrap-activated', `${active.version} active`); } catch { /* best effort */ }\n  return pointer;\n}\n\n/** Restore the exact pre-bootstrap pointer without overwriting a newer activation. */\nexport function restoreBootstrapActivation(runtimeRoot, expectedActive, prior, rollbackId) {\n  if (!ACTION_ID_RE.test(rollbackId)) throw new Error('invalid bootstrap rollback id');\n  const current = readActivation(runtimeRoot);\n  if (current?.active?.slot_id !== expectedActive?.slot_id\n    || current?.active?.tree_sha512 !== expectedActive?.tree_sha512) {\n    throw new Error('bootstrap activation changed before rollback');\n  }\n  if (prior?.schema_version === 1) {\n    atomicWriteJson(join(runtimeRoot, 'current.json'), prior);\n  } else {\n    const quarantine = join(runtimeRoot, 'quarantine', `${rollbackId}-current.json`);\n    mkdirSync(dirname(quarantine), { recursive: true });\n    renameSync(join(runtimeRoot, 'current.json'), quarantine);\n  }\n  try { journalActivation(runtimeRoot, rollbackId, 'bootstrap-pointer-restored', expectedActive.version); }\n  catch { /* the restored pointer is authoritative */ }\n}\n\nexport function attestCurrentSupervisor({ runtimeRoot, selfPath, version }) {\n  const pointer = readActivation(runtimeRoot);\n  if (!pointer?.pending || !validActive(pointer.active)) return { ok: false, detail: 'no pending activation' };\n  const validated = validateSlot(runtimeRoot, pointer.active);\n  if (!validated.ok) return validated;\n  try {\n    if (realpathSync(selfPath) !== realpathSync(validated.paths.supervisor)) {\n      return { ok: false, detail: 'running supervisor is not the activated supervisor' };\n    }\n  } catch {\n    return { ok: false, detail: 'could not resolve running supervisor path' };\n  }\n  if (version !== pointer.active.version) return { ok: false, detail: 'running supervisor version mismatch' };\n  return { ok: true, pointer, active: pointer.active, paths: validated.paths };\n}\n\nexport function finalizeActivation(runtimeRoot, pointer) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before finalization');\n  }\n  journalActivation(runtimeRoot, pointer.pending.action_id, 'attesting', `${pointer.active.version} verified`);\n  atomicWriteJson(join(runtimeRoot, 'current.json'), {\n    schema_version: 1,\n    generation: pointer.generation,\n    active: pointer.active,\n    previous: pointer.previous || null,\n    pending: null,\n  });\n  // current.json is authoritative. A journal-only failure must never turn a\n  // committed activation into a false update failure.\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'attested', `${pointer.active.version} active`); } catch { /* best effort */ }\n}\n\nexport function rollbackActivation(runtimeRoot, pointer, detail) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id) {\n    throw new Error('runtime activation generation changed before rollback');\n  }\n  journalActivation(runtimeRoot, pointer.pending.action_id, 'rolling-back', detail);\n  const rolledBack = {\n    schema_version: 1,\n    generation: randomUUID(),\n    active: validActive(pointer?.previous) ? pointer.previous : null,\n    previous: null,\n    pending: {\n      ...pointer.pending,\n      terminal_status: 'failed',\n      terminal_detail: String(detail).slice(0, 400),\n      rolled_back_at: new Date().toISOString(),\n    },\n  };\n  atomicWriteJson(join(runtimeRoot, 'current.json'), rolledBack);\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'rolled-back', detail); } catch { /* best effort */ }\n  return rolledBack;\n}\n\nexport function acknowledgeActivationFailure(runtimeRoot, pointer) {\n  const current = readActivation(runtimeRoot);\n  if (current?.generation !== pointer?.generation\n    || current?.pending?.action_id !== pointer?.pending?.action_id\n    || current?.pending?.terminal_status !== 'failed') {\n    throw new Error('runtime rollback acknowledgement obligation changed');\n  }\n  atomicWriteJson(join(runtimeRoot, 'current.json'), { ...current, pending: null });\n  try { journalActivation(runtimeRoot, pointer.pending.action_id, 'failure-acknowledged', pointer.pending.terminal_detail); }\n  catch { /* current.json is authoritative */ }\n}\n\nexport const __test = { ACTION_ID_RE, ENTRY_REL, INTEGRITY_RE, SLOT_ID_RE, SUPERVISOR_REL, UUID_RE, VERSION_RE, validActive, within };\n", "/**\n * legacy-orphan-sweep \u2014 operator-triggered reclamation of agent processes\n * leaked by PRE-REAPER daemons (they never recorded their spawns, so the\n * recorded-PID orphan-agent-reaper can NEVER touch them by design).\n *\n * This is deliberately NOT automatic: it runs only when a human presses the\n * \"Clear stuck agents\" control in AlgoHQ (a governed `purge-orphans` runner\n * control action), and only a supervisor advertising the\n * `legacy-orphan-purge-v1` capability will claim one.\n *\n * Because there are no records to trust, selection is by evidence that ALL\n * hold simultaneously:\n *   1. The command line matches a RUNNER-ONLY agent spawn signature\n *      (`claude \u2026 --output-format stream-json` headless / `codex exec --json`).\n *      Interactive agent sessions and detached watchers never match.\n *   2. The parent process is dead \u2014 absent, or its pid was reused by a process\n *      created AFTER the child (an orphan's parent can never be younger).\n *      A live daemon's agents always have a live parent, so a running peer\n *      runner's work is structurally unselectable.\n *   3. The process predates the sweep cutoff (nothing racing the relaunch).\n *   4. The pid is not the supervisor itself or otherwise protected.\n * Selection is capped, oldest-first, and every kill is logged with its\n * command-line evidence. The decision core is pure and unit-tested; OS shims\n * are injected. Reuses the reaper's hardened epoch conversion + tree kill.\n */\nimport { spawnSync } from 'node:child_process';\nimport { killProcessTree, windowsPowershellExe } from './orphan-agent-reaper.mjs';\n\nexport const LEGACY_PURGE_CAPABILITY = 'legacy-orphan-purge-v1';\nexport const MAX_LEGACY_KILLS = 50;\n/** Ignore anything created within this window before the sweep (races). */\nexport const SWEEP_RECENCY_BUFFER_MS = 5_000;\n\nconst SIGNATURES = [\n  {\n    signature: 'claude-headless',\n    // claude-args.mjs always emits `-p --output-format stream-json --verbose`.\n    test: (cl) => /(?:^|[\\\\/\"\\s])claude(?:\\.exe|\\.cmd|\\.ps1)?(?:\"|\\s)/iu.test(cl) && /--output-format[\\s\"=]+stream-json/iu.test(cl),\n  },\n  {\n    signature: 'codex-headless',\n    // openai-compatible-runner always emits `exec --json`.\n    test: (cl) => /(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd|\\.ps1)?(?:\"|\\s)/iu.test(cl) && /\\bexec\\b/u.test(cl) && /--json\\b/u.test(cl),\n  },\n];\n\n/** Which runner-agent signature (if any) a raw command line matches. */\nexport function matchAgentSignature(commandLine) {\n  if (typeof commandLine !== 'string' || !commandLine) return null;\n  for (const { signature, test } of SIGNATURES) {\n    if (test(commandLine)) return signature;\n  }\n  return null;\n}\n\n/**\n * Pure selection. `processes` is an array of\n * `{ pid, ppid, creationMs, commandLine }`; returns `{ kills }` where each\n * kill is `{ pid, signature, commandLine }`, oldest-first, capped.\n */\nexport function selectLegacyOrphans({ processes, cutoffMs, protectedPids = new Set() }) {\n  const byPid = new Map();\n  for (const proc of processes) {\n    if (Number.isInteger(proc?.pid) && proc.pid > 0) byPid.set(proc.pid, proc);\n  }\n  const kills = [];\n  for (const proc of byPid.values()) {\n    if (protectedPids.has(proc.pid)) continue;\n    if (!(Number.isFinite(proc.creationMs) && proc.creationMs < cutoffMs)) continue;\n    const signature = matchAgentSignature(proc.commandLine);\n    if (!signature) continue;\n    const parent = Number.isInteger(proc.ppid) && proc.ppid > 0 ? byPid.get(proc.ppid) : undefined;\n    const parentDead = !parent || (Number.isFinite(parent.creationMs) && parent.creationMs > proc.creationMs);\n    if (!parentDead) continue;\n    kills.push({ pid: proc.pid, creationMs: proc.creationMs, signature, commandLine: proc.commandLine });\n  }\n  kills.sort((a, b) => a.creationMs - b.creationMs);\n  return { kills: kills.slice(0, MAX_LEGACY_KILLS) };\n}\n\n/** One `ps -eo pid=,ppid=,etimes=,args=` line \u2192 process row (null on junk). */\nexport function parsePosixSweepLine(line, nowMs) {\n  const match = /^\\s*(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(.+)$/u.exec(line ?? '');\n  if (!match) return null;\n  const pid = Number(match[1]);\n  if (!Number.isInteger(pid) || pid <= 0) return null;\n  return {\n    pid,\n    ppid: Number(match[2]),\n    creationMs: nowMs - Number(match[3]) * 1000,\n    commandLine: match[4],\n  };\n}\n\n/**\n * Enumerate `{ pid, ppid, creationMs, commandLine }` for every visible\n * process. Windows via CIM (one compact JSON object per line so arbitrary\n * command-line content cannot break parsing; epoch via\n * DateTimeOffset.ToUnixTimeMilliseconds() \u2014 the manual UTC-offset form was\n * empirically \u22128h and silently disabled the recorded reaper before the same\n * guard was added there). Unenumerable rows are skipped (safe direction).\n */\nexport function listProcessesForSweep({ platform = process.platform, spawn = spawnSync, nowMs = Date.now(), env = process.env, warn = console.warn } = {}) {\n  const rows = [];\n  if (platform === 'win32') {\n    const ps =\n      \"Get-CimInstance Win32_Process | Where-Object { $_.CreationDate } | ForEach-Object { @{ p = $_.ProcessId; pp = $_.ParentProcessId; c = (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()); cl = [string]$_.CommandLine } | ConvertTo-Json -Compress }\";\n    const result = spawn(windowsPowershellExe(env), ['-NoProfile', '-NonInteractive', '-Command', ps], {\n      windowsHide: true,\n      encoding: 'utf8',\n      timeout: 30_000,\n      maxBuffer: 64 * 1024 * 1024,\n    });\n    if (result.error || result.status !== 0) {\n      // Failure must remain a NO-KILL sweep (safe direction) but never a silent\n      // one: an empty enumeration is indistinguishable from \"no orphans\", so a\n      // permanently broken shim would look healthy while processes accumulate.\n      // Throwing (not returning []) makes runLegacyOrphanSweep report the\n      // operator-triggered purge action as FAILED instead of \"0 scanned\".\n      const cause = result.error ? result.error.message : `powershell exit ${result.status}`;\n      warn(`[orphan-sweep] process enumeration failed (${cause}); sweeping nothing this cycle`);\n      throw new Error(`process enumeration failed (${cause}); swept nothing`);\n    }\n    for (const line of String(result.stdout ?? '').split(/\\r?\\n/u)) {\n      if (!line.trim()) continue;\n      try {\n        const parsed = JSON.parse(line);\n        const pid = Number(parsed?.p);\n        if (!Number.isInteger(pid) || pid <= 0) continue;\n        rows.push({\n          pid,\n          ppid: Number(parsed.pp),\n          creationMs: Number(parsed.c),\n          commandLine: typeof parsed.cl === 'string' ? parsed.cl : '',\n        });\n      } catch {\n        // one unparseable row must never abort the sweep enumeration\n      }\n    }\n    return rows;\n  }\n  const result = spawn('ps', ['-eo', 'pid=,ppid=,etimes=,args='], { encoding: 'utf8', timeout: 30_000, maxBuffer: 64 * 1024 * 1024 });\n  if (result.error || result.status !== 0) {\n    const cause = result.error ? result.error.message : `ps exit ${result.status}`;\n    warn(`[orphan-sweep] process enumeration failed (${cause}); sweeping nothing this cycle`);\n    throw new Error(`process enumeration failed (${cause}); swept nothing`);\n  }\n  for (const line of String(result.stdout ?? '').split('\\n')) {\n    const row = parsePosixSweepLine(line, nowMs);\n    if (row) rows.push(row);\n  }\n  return rows;\n}\n\n/**\n * Execute the sweep. Never throws; returns\n * `{ ok, status, detail, killed: [{ pid, signature }] }` shaped for the\n * supervisor's action-completion contract. `detail` carries the evidence\n * summary that ends up on the AlgoHQ action record.\n */\nexport function runLegacyOrphanSweep({\n  nowMs = Date.now(),\n  protectedPids = [process.pid],\n  listProcesses = listProcessesForSweep,\n  killTree = killProcessTree,\n  log = () => {},\n} = {}) {\n  try {\n    const processes = listProcesses({ nowMs });\n    const { kills } = selectLegacyOrphans({\n      processes,\n      cutoffMs: nowMs - SWEEP_RECENCY_BUFFER_MS,\n      protectedPids: new Set(protectedPids),\n    });\n    const killed = [];\n    for (const kill of kills) {\n      const done = killTree(kill.pid);\n      log(`legacy-orphan-sweep ${done ? 'killed' : 'FAILED to kill'} pid=${kill.pid} sig=${kill.signature} cmd=${String(kill.commandLine).slice(0, 200)}`);\n      if (done) killed.push({ pid: kill.pid, signature: kill.signature });\n    }\n    const failed = kills.length - killed.length;\n    const detail = kills.length === 0\n      ? `no orphaned agent processes matched the sweep criteria (${processes.length} scanned)`\n      : `purged ${killed.length} of ${kills.length} orphaned agent process tree(s)${failed > 0 ? ` (${failed} kill(s) failed)` : ''}: ${killed.map((k) => `${k.pid}:${k.signature}`).join(', ').slice(0, 700)}`;\n    return { ok: true, status: 0, detail, killed };\n  } catch (error) {\n    return { ok: false, status: 1, detail: `legacy sweep error: ${error instanceof Error ? error.message : String(error)}`.slice(0, 500), killed: [] };\n  }\n}\n", "/**\n * Orphaned-agent process reaper.\n *\n * The runner spawns agent CLIs (claude/codex/\u2026) as child processes. When the\n * DAEMON itself restarts (crash, `update`/`reinstall` control, host reboot mid-\n * task), any still-running agent children are detached from the new daemon and\n * are never reclaimed \u2014 they leak RAM until the machine is rebooted. The\n * existing `terminal-process-cleanup` only kills the child the CURRENT process\n * still tracks; it deliberately never scans for unrelated processes.\n *\n * This module closes that gap SAFELY. Every spawned agent records its pid, its\n * spawning daemon instance id, and its spawn time under a per-instance registry\n * directory. On daemon startup the reaper considers only OTHER instances'\n * records and kills a process ONLY when ALL of these hold:\n *\n *   1. the recording daemon instance is provably DEAD (its recorded daemon pid\n *      is not live, or its creation time no longer matches) \u2014 so a concurrent\n *      live peer runner's agents are never touched;\n *   2. the agent pid is still live; AND\n *   3. the live process's OS creation time still matches the recorded spawn\n *      time within tolerance \u2014 so a REUSED pid (now some innocent process)\n *      is never killed.\n *\n * It never matches by process name and never touches a pid it did not itself\n * record. Decision logic is pure (`selectOrphanKills`) and fully unit-tested;\n * the OS shims (`listProcessCreationTimes`, `killProcessTree`) are injected.\n */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nconst REGISTRY_ROOT_NAME = 'algohq-runner-agent-pids';\nconst DAEMON_RECORD = 'daemon.json';\n/** A reused pid is created long after the original; 30s covers spawn/clock skew. */\nexport const CREATION_MATCH_TOLERANCE_MS = 30_000;\n\nexport function registryRoot(tmp = os.tmpdir()) {\n  return path.join(tmp, REGISTRY_ROOT_NAME);\n}\n\nfunction instanceDir(root, instanceId) {\n  return path.join(root, String(instanceId).replace(/[^A-Za-z0-9_-]/g, ''));\n}\n\n/** Record this daemon instance so peers can tell it is alive vs. orphaned. */\nexport function registerDaemonInstance({\n  root = registryRoot(),\n  instanceId,\n  daemonPid = process.pid,\n  daemonStartedAtMs = Date.now(),\n} = {}) {\n  if (!instanceId) return null;\n  const dir = instanceDir(root, instanceId);\n  mkdirSync(dir, { recursive: true });\n  const file = path.join(dir, DAEMON_RECORD);\n  writeFileSync(file, JSON.stringify({ daemonPid, daemonStartedAtMs, instanceId }), {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  return file;\n}\n\n/** Record a spawned agent's pid under its daemon instance. Never throws. */\nexport function recordAgentPid({\n  root = registryRoot(),\n  instanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  pid,\n  agentId = '',\n  startedAtMs = Date.now(),\n} = {}) {\n  if (!instanceId || !Number.isInteger(pid) || pid <= 0) return false;\n  try {\n    const dir = instanceDir(root, instanceId);\n    mkdirSync(dir, { recursive: true });\n    writeFileSync(\n      path.join(dir, `${pid}.json`),\n      JSON.stringify({ pid, agentId, startedAtMs, instanceId }),\n      { encoding: 'utf8', mode: 0o600 },\n    );\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Drop an agent record once its own process tree has been reaped. Never throws. */\nexport function unrecordAgentPid({\n  root = registryRoot(),\n  instanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  pid,\n} = {}) {\n  if (!instanceId || !Number.isInteger(pid)) return false;\n  try {\n    rmSync(path.join(instanceDir(root, instanceId), `${pid}.json`), { force: true });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * One-call daemon startup hook: publishes this instance id (so in-process\n * spawns can self-record), records the daemon, and reaps orphaned agent trees\n * left by dead prior instances. Synchronous and swallow-safe \u2014 never blocks the\n * runner from coming up.\n */\nexport function bootstrapOrphanReaper({ instanceId, log = () => {} } = {}) {\n  if (!instanceId) return { killed: 0, prunedDirs: 0 };\n  process.env.VO_RUNNER_INSTANCE_ID = instanceId;\n  try {\n    registerDaemonInstance({ instanceId });\n  } catch {\n    /* best effort \u2014 reap still runs */\n  }\n  return reapOrphanedAgents({ currentInstanceId: instanceId, log });\n}\n\n/** Read every instance's records from disk into the shape selectOrphanKills wants. */\nexport function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {\n  const instances = [];\n  if (!existsSync(root)) return instances;\n  let dirents;\n  try {\n    dirents = readdirSync(root, { withFileTypes: true });\n  } catch {\n    return instances;\n  }\n  for (const dirent of dirents) {\n    if (!dirent.isDirectory()) continue;\n    if (currentInstanceId && dirent.name === instanceDirName(currentInstanceId)) continue;\n    const dir = path.join(root, dirent.name);\n    let daemon = null;\n    const agents = [];\n    let files;\n    try {\n      files = readdirSync(dir);\n    } catch {\n      continue;\n    }\n    for (const name of files) {\n      let parsed;\n      try {\n        parsed = JSON.parse(readFileSync(path.join(dir, name), 'utf8'));\n      } catch {\n        continue;\n      }\n      if (name === DAEMON_RECORD) {\n        if (Number.isInteger(parsed?.daemonPid)) {\n          daemon = { pid: parsed.daemonPid, startedAtMs: Number(parsed.daemonStartedAtMs) || 0 };\n        }\n      } else if (Number.isInteger(parsed?.pid)) {\n        agents.push({ pid: parsed.pid, agentId: String(parsed.agentId || ''), startedAtMs: Number(parsed.startedAtMs) || 0 });\n      }\n    }\n    instances.push({ instanceId: dirent.name, dir, daemon, agents });\n  }\n  return instances;\n}\n\nfunction instanceDirName(instanceId) {\n  return String(instanceId).replace(/[^A-Za-z0-9_-]/g, '');\n}\n\nfunction creationMatches(live, recordedStartedAtMs, toleranceMs) {\n  if (!live || !Number.isFinite(live.creationMs)) return false;\n  if (!Number.isFinite(recordedStartedAtMs) || recordedStartedAtMs <= 0) return false;\n  return Math.abs(live.creationMs - recordedStartedAtMs) <= toleranceMs;\n}\n\n/**\n * PURE decision core. Given the on-disk registry (other instances only) and a\n * map of live pid \u2192 { creationMs }, decide which pids to kill and which\n * instance dirs to prune.\n *\n * - An instance whose daemon record is still live (pid alive + creation match)\n *   is a running PEER: skip it entirely (no kills, no prune).\n * - Otherwise the instance is dead: kill each recorded agent that is still live\n *   AND whose creation time matches (guards pid reuse), then prune its dir.\n */\nexport function selectOrphanKills({ instances = [], liveProcesses = new Map(), toleranceMs = CREATION_MATCH_TOLERANCE_MS } = {}) {\n  const kills = [];\n  const pruneDirs = [];\n  for (const instance of instances) {\n    // Require a PRESENT daemon record before killing anything. Without it we\n    // cannot distinguish a truly-crashed instance from a peer that just created\n    // its dir and has not written daemon.json yet, so we conservatively prune\n    // the stale/malformed dir but never kill. (registerDaemonInstance writes\n    // daemon.json before any agent is spawned, so a real instance with agent\n    // records always has one.)\n    if (!instance.daemon) {\n      if (instance.dir) pruneDirs.push(instance.dir);\n      continue;\n    }\n    const daemonLive =\n      liveProcesses.has(instance.daemon.pid) &&\n      creationMatches(liveProcesses.get(instance.daemon.pid), instance.daemon.startedAtMs, toleranceMs);\n    if (daemonLive) continue; // live peer runner \u2014 never touch its agents\n    for (const agent of instance.agents) {\n      const live = liveProcesses.get(agent.pid);\n      if (live && creationMatches(live, agent.startedAtMs, toleranceMs)) {\n        kills.push({ pid: agent.pid, agentId: agent.agentId, instanceId: instance.instanceId });\n      }\n    }\n    if (instance.dir) pruneDirs.push(instance.dir);\n  }\n  return { kills, pruneDirs };\n}\n\nfunction windowsSystemRoot(env = process.env) {\n  return env.SystemRoot || env.WINDIR || 'C:\\\\Windows';\n}\n\n/**\n * Absolute Windows PowerShell path. Never resolve `powershell` from PATH: the\n * reaper runs with the daemon's privileges, so a PATH-planted powershell.exe\n * would receive every process command line on the host. Same resolution as\n * runner-bootstrap/windows-bound-process-termination.mjs.\n */\nexport function windowsPowershellExe(env = process.env) {\n  return path.join(windowsSystemRoot(env), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');\n}\n\n/** Windows: map every process to its creation time in epoch ms via CIM. */\nexport function listProcessCreationTimes({ platform = process.platform, spawn = spawnSync, env = process.env, warn = console.warn } = {}) {\n  const map = new Map();\n  if (platform === 'win32') {\n    // Epoch conversion via DateTimeOffset.ToUnixTimeMilliseconds() \u2014 the manual\n    // `(CreationDate - Get-Date '1970-01-01Z')` form is off by the local UTC\n    // offset (empirically \u22128h on a PST host), which would push every creation\n    // time outside the match window and silently disable the reaper.\n    const ps =\n      \"Get-CimInstance Win32_Process | ForEach-Object { '{0} {1}' -f $_.ProcessId, (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()) }\";\n    const result = spawn(windowsPowershellExe(env), ['-NoProfile', '-NonInteractive', '-Command', ps], {\n      windowsHide: true,\n      encoding: 'utf8',\n      timeout: 20_000,\n      maxBuffer: 32 * 1024 * 1024,\n    });\n    if (result.error || result.status !== 0 || typeof result.stdout !== 'string') {\n      // An enumeration failure must stay a NO-KILL cycle (safe direction), but\n      // never a silent one \u2014 a permanently failing shim reads as \"no orphans\"\n      // and the fleet leaks agent processes until reboot.\n      warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `powershell exit ${result.status}`}); reaping nothing this cycle`);\n      return map;\n    }\n    for (const line of result.stdout.split(/\\r?\\n/)) {\n      const m = line.trim().match(/^(\\d+)\\s+(-?\\d+)$/);\n      if (m) map.set(Number(m[1]), { creationMs: Number(m[2]) });\n    }\n    return map;\n  }\n  // POSIX: ps lstart \u2192 epoch ms (macOS/Linux runner). Windows is the primary\n  // target and is verified end-to-end; this branch is validated via the pure\n  // parsePosixPsLine() unit tests.\n  const result = spawn('ps', ['-eo', 'pid=,lstart='], { encoding: 'utf8', timeout: 20_000, maxBuffer: 32 * 1024 * 1024 });\n  if (result.error || result.status !== 0 || typeof result.stdout !== 'string') {\n    warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `ps exit ${result.status}`}); reaping nothing this cycle`);\n    return map;\n  }\n  for (const line of result.stdout.split(/\\r?\\n/)) {\n    const parsed = parsePosixPsLine(line);\n    if (parsed) map.set(parsed.pid, { creationMs: parsed.creationMs });\n  }\n  return map;\n}\n\n/**\n * Parse one `ps -eo pid=,lstart=` line into { pid, creationMs } or null.\n * Handles padded pids, the single-digit-day double space (\"Mon Jan  5 \u2026\"), and\n * unparseable lines (\u2192 null, so the caller skips them \u2014 the safe direction).\n */\nexport function parsePosixPsLine(line) {\n  const trimmed = String(line ?? '').trim();\n  const sp = trimmed.indexOf(' ');\n  if (sp <= 0) return null;\n  const pid = Number(trimmed.slice(0, sp));\n  const when = Date.parse(trimmed.slice(sp + 1).trim());\n  if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(when)) return null;\n  return { pid, creationMs: when };\n}\n\n/** Kill an exact pid's whole tree. Windows taskkill /T /F, else SIGKILL by pgid. */\nexport function killProcessTree(pid, { platform = process.platform, spawn = spawnSync, env = process.env } = {}) {\n  if (!Number.isInteger(pid) || pid <= 0) return false;\n  if (platform === 'win32') {\n    // Absolute path for the same reason as windowsPowershellExe(): a PATH-planted\n    // taskkill.exe would execute with daemon privileges and could silently no-op\n    // every kill while the sweep logs success.\n    const taskkill = path.join(windowsSystemRoot(env), 'System32', 'taskkill.exe');\n    const r = spawn(taskkill, ['/PID', String(pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore', timeout: 15_000 });\n    return !r.error && r.status === 0;\n  }\n  try {\n    process.kill(-pid, 'SIGKILL');\n    return true;\n  } catch {\n    try {\n      process.kill(pid, 'SIGKILL');\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n\n/**\n * EFFECTFUL entry point: run at daemon startup. Reaps orphaned agent trees from\n * dead prior instances and prunes their registry dirs. Never throws \u2014 a reaper\n * failure must not block the runner from coming up.\n */\nexport function reapOrphanedAgents({\n  root = registryRoot(),\n  currentInstanceId = process.env.VO_RUNNER_INSTANCE_ID,\n  toleranceMs = CREATION_MATCH_TOLERANCE_MS,\n  listProcesses = listProcessCreationTimes,\n  killTree = killProcessTree,\n  log = () => {},\n} = {}) {\n  try {\n    const instances = readRegistry({ root, currentInstanceId });\n    if (instances.length === 0) return { killed: 0, prunedDirs: 0 };\n    const liveProcesses = listProcesses();\n    const { kills, pruneDirs } = selectOrphanKills({ instances, liveProcesses, toleranceMs });\n    let killed = 0;\n    for (const kill of kills) {\n      if (killTree(kill.pid)) {\n        killed += 1;\n        log(`reaped orphaned agent pid ${kill.pid}${kill.agentId ? ` (${kill.agentId})` : ''} from dead instance ${kill.instanceId}`);\n      }\n    }\n    let prunedDirs = 0;\n    for (const dir of pruneDirs) {\n      try {\n        rmSync(dir, { recursive: true, force: true });\n        prunedDirs += 1;\n      } catch {\n        /* leave it; next startup retries */\n      }\n    }\n    if (killed > 0 || prunedDirs > 0) log(`orphan reap: killed ${killed} agent tree(s), pruned ${prunedDirs} dead instance record(s)`);\n    return { killed, prunedDirs };\n  } catch (error) {\n    log(`orphan reap skipped: ${error instanceof Error ? error.message : String(error)}`);\n    return { killed: 0, prunedDirs: 0 };\n  }\n}\n", "import {\n  acknowledgeActivationFailure,\n  attestCurrentSupervisor,\n  finalizeActivation,\n  readActivation,\n  recordActivationRetry,\n  rollbackActivation,\n  validateSlot,\n} from './bundled-runtime-store.mjs';\n\nconst MAX_ACK_ATTEMPTS = 3;\nconst delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nexport async function waitForAuthoritativeRunnerHeartbeat({\n  client,\n  runnerId,\n  operatorId,\n  runnerInstanceId,\n  excludeRunnerInstanceId,\n  daemonVersion,\n  supervisorIdentity,\n  timeoutMs = 60_000,\n  pollMs = 1_000,\n}) {\n  if (!runnerInstanceId && !excludeRunnerInstanceId) throw new Error('runner instance identity proof unavailable');\n  const deadline = Date.now() + timeoutMs;\n  while (Date.now() < deadline) {\n    try {\n      const runners = await client.getRunnerStatus({ ...(operatorId ? { operatorId } : {}) });\n      const runner = runners.find((item) => item?.runner_id === runnerId\n        && item.status === 'online'\n        && (runnerInstanceId\n          ? item.runner_meta?.runner_instance_id === runnerInstanceId\n          : Boolean(item.runner_meta?.runner_instance_id)\n            && item.runner_meta.runner_instance_id !== excludeRunnerInstanceId)\n        && item.runner_meta?.daemon_version === daemonVersion\n        && item.runner_meta?.supervisor_instance_id === supervisorIdentity.supervisorInstanceId\n        && item.runner_meta?.supervisor_version === supervisorIdentity.supervisorVersion\n        && supervisorIdentity.capabilities.every((value) => item.runner_meta?.supervisor_capabilities?.includes(value))\n        && Array.isArray(item.runner_meta?.available_agents)\n        // The default agent must be INSTALLED for the activated runtime to be the\n        // one that will serve. Whether it is AUTHENTICATED is a serving gate the\n        // heartbeat already reports (available_agents[].authenticated) and the\n        // plane already dispatches on; it is not part of the runtime's identity.\n        // Requiring it here made an expired or never-done agent login fail every\n        // activation closed: the child was stopped after 60 s, the supervisor\n        // degraded, and the host went silent until a human restarted the app\n        // (FintonLaptop, 2026-09-04: claude installed, authenticated:false).\n        && item.runner_meta.available_agents.some((agent) => agent.agent === item.runner_meta.default_agent\n          && agent.installed === true));\n      if (runner) return runner;\n    } catch { /* bounded retry */ }\n    await delay(pollMs);\n  }\n  throw new Error('authoritative child heartbeat attestation timed out');\n}\n\n/**\n * Complete a slot handoff only from the activated package and logical Tauri\n * supervisor lease. Local path/version/hash and child readiness are proven\n * before a cloud heartbeat or terminal action acknowledgement is emitted.\n */\nexport async function finishPendingActivation({\n  client,\n  child,\n  runtimeRoot,\n  operatorId,\n  runnerId,\n  selfPath,\n  packageVersion,\n  supervisorIdentity,\n  waitForLocalRunner,\n  isReadinessDeferred = () => false,\n  localStatus,\n  waitForCloudRunner = waitForAuthoritativeRunnerHeartbeat,\n  cloudTimeoutMs,\n  cloudPollMs,\n  stopChild,\n  launchPreviousChild,\n  log = () => {},\n}) {\n  const pointer = runtimeRoot ? readActivation(runtimeRoot) : null;\n  if (!pointer?.pending) return true;\n  const runnerIdForAction = pointer.pending.runner_id || runnerId;\n  const operatorIdForAction = pointer.pending.operator_id || operatorId;\n  if (pointer.pending.terminal_status === 'failed') {\n    try {\n      await client.completeRunnerControl(pointer.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail: pointer.pending.terminal_detail,\n      });\n      acknowledgeActivationFailure(runtimeRoot, pointer);\n      return true;\n    } catch (error) {\n      log(`activation failure acknowledgement remains pending: ${error instanceof Error ? error.message : String(error)}`);\n      await stopChild(child);\n      return false;\n    }\n  }\n  let attestation;\n  try {\n    attestation = attestCurrentSupervisor({ runtimeRoot, selfPath, version: packageVersion });\n    if (!attestation.ok) throw new Error(attestation.detail);\n    if (!(await waitForLocalRunner(child))) {\n      // A supervisor-authenticated exit-75 readiness embargo is neither a bad\n      // runtime nor an attestation failure. Preserve the active/pending pointer\n      // exactly; the supervisor will re-probe and retry this same slot later.\n      if (isReadinessDeferred(child)) return false;\n      throw new Error('activated runner did not become locally ready');\n    }\n  } catch (error) {\n    let detail = `activation attestation failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n    let rolledBack = null;\n    try {\n      rolledBack = rollbackActivation(runtimeRoot, pointer, detail);\n    } catch (rollbackError) {\n      detail = `${detail}; rollback pending: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n    }\n    try {\n      await client.completeRunnerControl(pointer.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail,\n      });\n      if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n    } catch {\n      // current.json retains the terminal acknowledgement obligation.\n    } finally {\n      await stopChild(child);\n    }\n    return false;\n  }\n\n  let activatedRunnerInstanceId = null;\n  try {\n    const status = await localStatus();\n    activatedRunnerInstanceId = status?.runnerInstanceId || null;\n    await waitForCloudRunner({\n      client,\n      runnerId: runnerIdForAction,\n      operatorId: operatorIdForAction,\n      runnerInstanceId: status?.runnerInstanceId,\n      daemonVersion: `vo-mcp/${attestation.active.version}`,\n      supervisorIdentity,\n      timeoutMs: cloudTimeoutMs,\n      pollMs: cloudPollMs,\n    });\n    await client.completeRunnerControl(pointer.pending.action_id, {\n      runnerId: runnerIdForAction,\n      ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n      ...supervisorIdentity,\n      status: 'succeeded',\n      detail: `attested new supervisor ${attestation.active.version} ${attestation.active.integrity}`,\n    });\n    finalizeActivation(runtimeRoot, attestation.pointer);\n    return true;\n  } catch (error) {\n    const failure = `activation acknowledgement failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n    let retry;\n    try { retry = recordActivationRetry(runtimeRoot, attestation.pointer, failure); }\n    catch (retryError) {\n      log(`activation retry could not be recorded: ${retryError instanceof Error ? retryError.message : String(retryError)}`);\n      await stopChild(child);\n      return false;\n    }\n    if (retry.pending.ack_attempts < MAX_ACK_ATTEMPTS) {\n      log(`activation acknowledgement pending (${retry.pending.ack_attempts}/${MAX_ACK_ATTEMPTS})`);\n      await stopChild(child);\n      return false;\n    }\n\n    const previous = validateSlot(runtimeRoot, retry.previous);\n    let detail = `${failure}; retry limit reached; previous runtime restored`.slice(0, 400);\n    let rollbackChild = null;\n    let rolledBack = null;\n    try {\n      if (!previous.ok) throw new Error(`previous runtime invalid: ${previous.detail}`, { cause: error });\n      rolledBack = rollbackActivation(runtimeRoot, retry, detail);\n      await stopChild(child);\n      rollbackChild = launchPreviousChild(previous.paths.entry);\n      if (!(await waitForLocalRunner(rollbackChild))) throw new Error('previous runner did not become locally ready', { cause: error });\n      const status = await localStatus();\n      await waitForCloudRunner({\n        client,\n        runnerId: runnerIdForAction,\n        operatorId: operatorIdForAction,\n        runnerInstanceId: status?.runnerInstanceId,\n        excludeRunnerInstanceId: status?.runnerInstanceId ? undefined : activatedRunnerInstanceId,\n        daemonVersion: `vo-mcp/${retry.previous.version}`,\n        supervisorIdentity,\n        timeoutMs: cloudTimeoutMs,\n        pollMs: cloudPollMs,\n      });\n    } catch (rollbackError) {\n      detail = `${detail}; rollback proof failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n    }\n    try {\n      await client.completeRunnerControl(retry.pending.action_id, {\n        runnerId: runnerIdForAction,\n        ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n        ...supervisorIdentity,\n        status: 'failed',\n        detail,\n      });\n      if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n    } catch { /* current.json retains the terminal acknowledgement obligation */ }\n    if (rollbackChild) await stopChild(rollbackChild);\n    else await stopChild(child);\n    return false;\n  }\n}\n\nexport const __test = { MAX_ACK_ATTEMPTS };\n", "/**\n * Resolve the runner child entry on EVERY (re)spawn instead of once at module\n * load.\n *\n * The supervisor used to compute `join(dirname(selfPath), 'runner-cli.js')` at\n * module scope and reuse that single path for every child it ever spawned. A\n * staged runtime slot could therefore be activated (current.json rewritten,\n * child restarted) and the host would keep running the OLD daemon until the\n * whole desktop app was restarted \u2014 which nothing forces. That is the same\n * silently-inert-update class as the 2026-08-06 slot-cache-poisoning incident:\n * the update reports success, the bytes on disk are new, and the process\n * serving work is unchanged.\n *\n * Rules encoded here:\n *  - Re-read the activation pointer on every call; never cache.\n *  - Fall back to the bundled self-relative entry whenever there is no slot,\n *    the pointer is unreadable, an activation is still mid-transaction, or the\n *    slot fails full hash validation. Fail closed, never fail open.\n *  - NEVER downgrade: an active slot older than (or equal to) the bundled\n *    version keeps the bundled path. Mirrors the strictly-newer compare in\n *    cloud-run/vo-control-plane/src/routes/runner-auto-update.ts.\n */\nimport { readActivation, validateSlot } from './bundled-runtime-store.mjs';\n\n/** Tolerates an optional \"name/\" prefix so `vo-mcp/0.2.0` parses too. */\nconst VERSION_RE = /^(?:[\\w.-]+\\/)?(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?$/u;\n\nexport function parseRuntimeVersion(value) {\n  if (typeof value !== 'string') return null;\n  const match = VERSION_RE.exec(value.trim());\n  if (!match) return null;\n  const prerelease = match[4]\n    ? match[4].split('.').map((part) => (/^\\d+$/u.test(part) ? Number(part) : part))\n    : null;\n  return { release: [Number(match[1]), Number(match[2]), Number(match[3])], prerelease };\n}\n\n/** semver-style compare: -1 when a < b, 0 when equal, 1 when a > b. */\nexport function compareRuntimeVersions(a, b) {\n  for (let i = 0; i < 3; i += 1) {\n    const av = a.release[i] ?? 0;\n    const bv = b.release[i] ?? 0;\n    if (av !== bv) return av < bv ? -1 : 1;\n  }\n  if (!a.prerelease && !b.prerelease) return 0;\n  if (!a.prerelease) return 1; // release > any prerelease of the same core\n  if (!b.prerelease) return -1;\n  const len = Math.max(a.prerelease.length, b.prerelease.length);\n  for (let i = 0; i < len; i += 1) {\n    const av = a.prerelease[i];\n    const bv = b.prerelease[i];\n    if (av === undefined) return -1; // shorter prerelease sorts first\n    if (bv === undefined) return 1;\n    if (av === bv) continue;\n    const aNum = typeof av === 'number';\n    const bNum = typeof bv === 'number';\n    if (aNum && bNum) return av < bv ? -1 : 1;\n    if (aNum !== bNum) return aNum ? -1 : 1; // numeric identifiers sort first\n    return String(av) < String(bv) ? -1 : 1;\n  }\n  return 0;\n}\n\n/**\n * @returns {{ args: string[], entry: string, source: 'bundled'|'active-slot',\n *   version: string, descriptor: string, detail: string }}\n *   `descriptor` is a stable identity for change detection/logging.\n */\nexport function resolveSupervisorChildEntry({\n  runtimeRoot,\n  bundledEntry,\n  bundledVersion,\n  readPointer = readActivation,\n  validate = validateSlot,\n}) {\n  const bundled = (detail) => ({\n    // The bundled entry is `dist/runner-cli.js`, which IS the daemon and takes\n    // no subcommand. The slot entry is `bin/vo-mcp`, the multiplexed CLI, which\n    // needs the `runner` subcommand \u2014 the same argv the proven rollback path\n    // (`launchPreviousChild`) uses.\n    args: [bundledEntry],\n    entry: bundledEntry,\n    source: 'bundled',\n    version: String(bundledVersion || 'unknown'),\n    descriptor: `bundled ${bundledVersion || 'unknown'} ${bundledEntry}`,\n    detail,\n  });\n\n  if (!runtimeRoot) return bundled('no runtime root');\n\n  let pointer;\n  try {\n    pointer = readPointer(runtimeRoot);\n  } catch (error) {\n    return bundled(`activation pointer unreadable: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  if (!pointer?.active) return bundled('no activated runtime slot');\n  // Mid-transaction. finishPendingActivation() owns that handoff (it attests\n  // from the NEW supervisor process); adopting the slot here would run a new\n  // daemon under an un-attested old supervisor.\n  if (pointer.pending) return bundled('runtime activation still pending');\n\n  const activeVersion = parseRuntimeVersion(pointer.active.version);\n  const currentVersion = parseRuntimeVersion(bundledVersion);\n  // An unparseable version on either side means the never-downgrade rule cannot\n  // be PROVEN, so it is enforced by refusing the slot.\n  if (!activeVersion) return bundled(`active slot version unparseable: ${String(pointer.active.version)}`);\n  if (!currentVersion) return bundled(`bundled version unparseable: ${String(bundledVersion)}`);\n  if (compareRuntimeVersions(activeVersion, currentVersion) <= 0) {\n    return bundled(`active slot ${pointer.active.version} is not newer than bundled ${bundledVersion}`);\n  }\n\n  let validated;\n  try {\n    validated = validate(runtimeRoot, pointer.active);\n  } catch (error) {\n    return bundled(`slot validation threw: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  if (!validated?.ok) return bundled(`active slot invalid: ${validated?.detail || 'unknown'}`);\n\n  const entry = validated.paths.entry;\n  return {\n    args: [entry, 'runner'],\n    entry,\n    source: 'active-slot',\n    version: pointer.active.version,\n    descriptor: `active-slot ${pointer.active.version} ${entry}`,\n    detail: `activated slot ${pointer.active.slot_id}`,\n  };\n}\n", "/**\n * Drain in-flight code tasks BEFORE a staged update restarts the runner child.\n *\n * Incident 2026-08-30 ~08:0x: both fleet runners (FintonLaptop, JacksPC)\n * restarted near-simultaneously on a staged-update delivery and killed the\n * in-flight continuations of two tasks (7f98ab24 at preparing_worktree,\n * 2c7ea978 at agent_working). Both went status=failed with NO error_message on\n * the plane, and both runners heartbeated fresh seconds later \u2014 so the plane\n * recorded a silent death with no cause. Cost: two $2 recovery resumes.\n *\n * The pre-existing guard in runner-supervisor.mjs was a SINGLE check that\n * failed the control action outright, and it read\n * `beforeStop && activeTasks > 0` \u2014 an unreadable `/status` (null) fell\n * through to the restart, which is exactly the fail-open shape that kills work.\n *\n * What this module changes, and nothing else (the two-track staging/delivery\n * mechanism is untouched \u2014 this gates only the APPLICATION of the restart):\n *  - update/reinstall actions WAIT for the child to go idle, re-checking on an\n *    interval, instead of failing the action on the first busy check.\n *  - An unreadable `/status` from a RUNNING child counts as busy, not idle.\n *    A child that is not running has nothing to drain and proceeds at once, so\n *    the supervisor's only remote repair channel can never be self-blocked.\n *  - The wait is hard-capped (default 45 min). At the cap the restart proceeds,\n *    but every in-flight task is first marked terminal on the plane with a\n *    message that NAMES the update restart. Never kill silently.\n *  - Non-update control actions (repair/maintenance/purge) keep the legacy\n *    single-check defer, including its legacy fail-open on an unreadable\n *    status: blocking remote repair for up to 45 minutes behind an\n *    unresponsive status port would be a worse failure than the one fixed here.\n *\n * Task ids come from the runner's OWN in-flight registry, surfaced on\n * `GET /status` as `activeTaskIds` (scripts/virtual-office/code-runner-daemon.mjs\n * \u2192 control-server.mjs). The same status snapshot carries `runnerId` /\n * `runnerInstanceId`, which the terminal patch MUST echo: the plane rejects a\n * protocol-v2 progress patch that omits them\n * (cloud-run/vo-control-plane/src/storage/code-task-progress-merge.ts:63).\n */\n\nexport const DEFAULT_DRAIN_CAP_MS = 45 * 60 * 1000;\nexport const DEFAULT_DRAIN_CHECK_MS = 30_000;\nconst MAX_DRAIN_CAP_MS = 6 * 60 * 60 * 1000;\nconst MIN_DRAIN_CHECK_MS = 1_000;\nconst MAX_DRAIN_CHECK_MS = 5 * 60 * 1000;\n\n/** Terminal message + result stamped on tasks killed by a capped drain. */\nexport const UPDATE_RESTART_ERROR_MESSAGE = 'runner update restart after drain timeout';\nexport const UPDATE_RESTART_RESULT = 'runner_update_restart';\n\nconst sleepMs = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nfunction positiveNumber(raw) {\n  if (raw === undefined || raw === null || String(raw).trim() === '') return null;\n  const value = Number(raw);\n  return Number.isFinite(value) && value >= 0 ? value : null;\n}\n\n/**\n * `VO_RUNNER_UPDATE_DRAIN_CAP_MIN` (minutes) is the operator-facing knob;\n * `VO_RUNNER_UPDATE_DRAIN_CAP_MS` wins when both are set (tests use it).\n * 0 disables draining entirely \u2014 the restart proceeds immediately, but the\n * cap path still marks in-flight tasks, so nothing dies unexplained.\n */\nexport function resolveDrainCapMs(env = {}) {\n  const ms = positiveNumber(env.VO_RUNNER_UPDATE_DRAIN_CAP_MS);\n  if (ms !== null) return Math.min(ms, MAX_DRAIN_CAP_MS);\n  const minutes = positiveNumber(env.VO_RUNNER_UPDATE_DRAIN_CAP_MIN);\n  if (minutes !== null) return Math.min(minutes * 60_000, MAX_DRAIN_CAP_MS);\n  return DEFAULT_DRAIN_CAP_MS;\n}\n\nexport function resolveDrainCheckMs(env = {}) {\n  const ms = positiveNumber(env.VO_RUNNER_UPDATE_DRAIN_CHECK_MS);\n  if (ms === null) return DEFAULT_DRAIN_CHECK_MS;\n  return Math.min(Math.max(ms, MIN_DRAIN_CHECK_MS), MAX_DRAIN_CHECK_MS);\n}\n\n/**\n * Normalize one `/status` snapshot into the drain view.\n * `known:false` means \"a child is running but did not answer\" \u2014 busy for the\n * update path, idle for the legacy path (see the module header).\n * @returns {{ count: number, ids: string[], known: boolean,\n *   runnerId: string|null, runnerInstanceId: string|null }}\n */\nexport function readActiveTasks(status, { childRunning = true } = {}) {\n  if (!childRunning) {\n    return { count: 0, ids: [], known: true, runnerId: null, runnerInstanceId: null };\n  }\n  if (!status || status.ok === false) {\n    return { count: 0, ids: [], known: false, runnerId: null, runnerInstanceId: null };\n  }\n  const ids = Array.isArray(status.activeTaskIds)\n    ? status.activeTaskIds.map((id) => String(id)).filter(Boolean)\n    : [];\n  const reported = Number(status.activeTasks);\n  const count = Number.isFinite(reported) && reported >= 0 ? reported : ids.length;\n  return {\n    count: Math.max(count, ids.length),\n    ids,\n    known: true,\n    runnerId: status.runnerId ? String(status.runnerId) : null,\n    runnerInstanceId: status.runnerInstanceId ? String(status.runnerInstanceId) : null,\n  };\n}\n\n/**\n * Pure one-iteration decision.\n * @returns {{ action: 'proceed'|'wait'|'cap', busy: number|'unknown' }}\n */\nexport function decideDrainStep({ active, elapsedMs, capMs }) {\n  const busy = active.known ? active.count : 'unknown';\n  if (active.known && active.count === 0) return { action: 'proceed', busy };\n  if (elapsedMs >= capMs) return { action: 'cap', busy };\n  return { action: 'wait', busy };\n}\n\nfunction describeBusy(active) {\n  if (!active.known) return 'status unreadable from a running child (assumed busy)';\n  const ids = active.ids.length > 0 ? ` [${active.ids.join(', ')}]` : ' [ids unavailable]';\n  return `${active.count} active task(s)${ids}`;\n}\n\nasync function markCappedTasks({ active, failInFlightTask, log }) {\n  if (active.ids.length === 0) {\n    if (active.count > 0 || !active.known) {\n      log(`update drain cap reached with ${describeBusy(active)} \u2014 cannot annotate tasks the runner did not name`);\n    }\n    return [];\n  }\n  const marked = [];\n  for (const taskId of active.ids) {\n    try {\n      await failInFlightTask(taskId, {\n        message: UPDATE_RESTART_ERROR_MESSAGE,\n        result: UPDATE_RESTART_RESULT,\n        runnerId: active.runnerId,\n        runnerInstanceId: active.runnerInstanceId,\n      });\n      marked.push(taskId);\n    } catch (error) {\n      log(`could not mark task ${taskId} before update restart: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  return marked;\n}\n\n/**\n * Gate the application of a staged-update restart on the runner going idle.\n *\n * @param {object} options\n * @param {() => Promise<object|null>} options.readStatus   local `GET /status`\n * @param {() => boolean} options.isChildRunning            live child liveness\n * @param {(taskId: string, patch: object) => Promise<unknown>} options.failInFlightTask\n * @param {boolean} options.drainable  true only for update/reinstall actions\n * @param {object} [options.env]       cap/interval knobs\n * @param {() => number} [options.now] injected clock (tests)\n * @param {(ms: number) => Promise<void>} [options.sleep] injected sleep (tests)\n * @param {(message: string) => void} [options.log]\n * @returns {Promise<{ proceed: boolean, detail: string, capped: boolean,\n *   waitedMs: number, checks: number, markedTaskIds: string[] }>}\n */\nexport async function awaitRunnerUpdateDrain({\n  readStatus,\n  isChildRunning = () => true,\n  failInFlightTask = async () => {},\n  drainable = false,\n  env = {},\n  now = Date.now,\n  sleep = sleepMs,\n  log = () => {},\n} = {}) {\n  const capMs = resolveDrainCapMs(env);\n  const checkMs = resolveDrainCheckMs(env);\n  const startedAt = now();\n  let checks = 0;\n  let lastReported = null;\n\n  const snapshot = async () => {\n    checks += 1;\n    const childRunning = Boolean(isChildRunning());\n    let status;\n    try {\n      status = await readStatus();\n    } catch {\n      status = null;\n    }\n    return readActiveTasks(status, { childRunning });\n  };\n\n  // Legacy single-check defer for non-update actions. Unchanged on purpose:\n  // an unreadable status still proceeds so remote repair is never self-blocked.\n  if (!drainable) {\n    const active = await snapshot();\n    if (active.known && active.count > 0) {\n      return {\n        proceed: false,\n        detail: `deferred safely: ${active.count} active task(s); retry when the runner is idle`,\n        capped: false,\n        waitedMs: 0,\n        checks,\n        markedTaskIds: [],\n      };\n    }\n    return { proceed: true, detail: 'runner idle', capped: false, waitedMs: 0, checks, markedTaskIds: [] };\n  }\n\n  for (;;) {\n    const active = await snapshot();\n    const elapsedMs = now() - startedAt;\n    const step = decideDrainStep({ active, elapsedMs, capMs });\n\n    if (step.action === 'proceed') {\n      if (lastReported !== null) {\n        log(`update drain complete after ${Math.round(elapsedMs / 1000)}s \u2014 runner idle, applying staged update restart`);\n      }\n      return { proceed: true, detail: 'runner idle', capped: false, waitedMs: elapsedMs, checks, markedTaskIds: [] };\n    }\n\n    if (step.action === 'cap') {\n      log(`update drain cap reached after ${Math.round(elapsedMs / 1000)}s (cap ${Math.round(capMs / 1000)}s) \u2014 ${describeBusy(active)}; marking task(s) before restart`);\n      const markedTaskIds = await markCappedTasks({ active, failInFlightTask, log });\n      return {\n        proceed: true,\n        capped: true,\n        detail: `update restart applied after drain cap; marked ${markedTaskIds.length} task(s) as \"${UPDATE_RESTART_ERROR_MESSAGE}\"`,\n        waitedMs: elapsedMs,\n        checks,\n        markedTaskIds,\n      };\n    }\n\n    // Log the first deferral and every real change, not every poll: a 45-minute\n    // cap at a 30s interval would otherwise emit ~90 identical lines.\n    const fingerprint = `${step.busy}:${active.ids.join(',')}`;\n    if (fingerprint !== lastReported) {\n      lastReported = fingerprint;\n      log(`deferring staged update restart \u2014 ${describeBusy(active)}; re-checking every ${Math.round(checkMs / 1000)}s until idle (cap ${Math.round(capMs / 1000)}s)`);\n    }\n    await sleep(Math.max(1, Math.min(checkMs, capMs - elapsedMs)));\n  }\n}\n", "import { hostname as systemHostname } from 'node:os';\nimport {\n  pairedOperatorScope,\n  probeRunnerReadiness,\n  runnerReadinessRetryDelayMs,\n  runnerRepositoryScopeFromEnv,\n} from '../runner-readiness.mjs';\n\n/** Keep the supervisor's control-queue identity byte-identical to the daemon. */\nexport function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {\n  const explicit = String(env.VO_CODE_RUNNER_ID || '').trim();\n  return explicit || `vo-code-runner-${hostname()}`;\n}\n\n/** Build the daemon environment without mislabeling a paired credential as admin. */\nexport function buildSupervisorChildEnv({\n  baseEnv = {},\n  controlPlaneUrl,\n  explicitAdminToken = null,\n  pairedOperatorId = null,\n} = {}) {\n  const childEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n  };\n  const adminToken = typeof explicitAdminToken === 'string' ? explicitAdminToken.trim() : '';\n  const operatorId = typeof pairedOperatorId === 'string' ? pairedOperatorId.trim() : '';\n\n  if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;\n  else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;\n\n  if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;\n  return childEnv;\n}\n\n/** Resolve auth provenance once so the supervisor and child use the same scope. */\nexport async function prepareSupervisorAuth({\n  baseEnv = {},\n  storedCredential = null,\n  controlPlaneUrl,\n  probeReadiness = probeRunnerReadiness,\n} = {}) {\n  const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();\n  const token = explicitAdminToken || storedCredential?.vo_credential;\n  if (!token) throw new Error('runner is not paired; run `vo-mcp pair` once on this host');\n\n  let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || '')\n    .split(/[\\s,]+/u)\n    .filter(Boolean)[0] || undefined;\n  let repositoryScope = runnerRepositoryScopeFromEnv(baseEnv);\n  let startupRetryAfterMs = null;\n  let githubReady = null;\n  let readinessError = null;\n  if (!explicitAdminToken) {\n    const readiness = await probeReadiness({\n      controlPlaneUrl,\n      token,\n      requireGithub: true,\n      repositories: repositoryScope,\n    });\n    const pairedScope = pairedOperatorScope(readiness)\n      || (readiness?.paired === true && typeof readiness.operatorId === 'string'\n        ? readiness.operatorId.trim()\n        : '');\n    operatorId = pairedScope || undefined;\n    if (!operatorId) throw new Error('runner readiness failed: paired operator scope is missing');\n    if (readiness.ok && Array.isArray(readiness.repositoryScope)) {\n      repositoryScope = [...readiness.repositoryScope];\n      githubReady = true;\n    } else {\n      githubReady = false;\n      readinessError = typeof readiness?.error === 'string' ? readiness.error : 'github_not_ready';\n      startupRetryAfterMs = runnerReadinessRetryDelayMs(readiness);\n    }\n  }\n\n  const effectiveBaseEnv = repositoryScope.length > 0\n    ? { ...baseEnv, VO_CODE_RUNNER_REPOS: repositoryScope.join(',') }\n    : baseEnv;\n\n  const childEnv = buildSupervisorChildEnv({\n    baseEnv: effectiveBaseEnv,\n    controlPlaneUrl,\n    explicitAdminToken,\n    pairedOperatorId: explicitAdminToken ? null : operatorId,\n  });\n  const clientEnv = {\n    ...effectiveBaseEnv,\n    VO_CONTROL_PLANE_ADMIN_TOKEN: token,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n    ...(operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}),\n  };\n  return {\n    childEnv,\n    clientEnv,\n    operatorId,\n    repositoryScope,\n    githubReady,\n    readinessError,\n    startupRetryAfterMs,\n  };\n}\n", "/**\n * Server-backed readiness probe for a paired BYO runner.\n *\n * The credential itself is opaque, so its mere presence is not proof that it is\n * usable or still bound to an operator. `/auth/me` supplies that truth from the\n * authenticated control-plane context. Before daemon startup, the optional\n * GitHub probe uses App-JWT GETs to verify the caller-owned installation,\n * publication grants, and selected repositories without minting a one-hour\n * token. Read/publish tokens are created only for actual task work.\n */\nimport { createHash, randomUUID } from 'node:crypto';\n\nexport const RUNNER_GITHUB_READINESS_TIMEOUT_MS = 50_000;\nexport const RUNNER_IDENTITY_READINESS_TIMEOUT_MS = 10_000;\nexport const RUNNER_READINESS_MAX_REPOSITORIES = 4;\nexport const RUNNER_READINESS_MAX_TIMER_DELAY_MS = 2_147_000_000;\nexport const RUNNER_READINESS_TRANSIENT_MAX_RETRY_AFTER_MS = 300_000;\nexport const RUNNER_READINESS_IPC_ACK_TIMEOUT_MS = 5_000;\nexport const RUNNER_READINESS_DEFERRAL_MESSAGE_TYPE = 'vo-runner-readiness-deferred-v1';\nexport const RUNNER_READINESS_DEFERRAL_ACK_TYPE = 'vo-runner-readiness-deferred-ack-v1';\nconst RUNNER_REPOSITORY = /^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/u;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\n\nexport function runnerRepositoryScopeFromEnv(env = {}) {\n  return String(env.VO_CODE_RUNNER_REPOS || '')\n    .split(/[\\s,]+/u)\n    .map((repo) => repo.trim())\n    .filter(Boolean);\n}\n\nexport function normalizeRunnerRepositoryScope(repositories) {\n  if (!Array.isArray(repositories) || repositories.length < 1) {\n    throw new Error('VO_CODE_RUNNER_REPOS must name at least one owner/name repository');\n  }\n  if (repositories.length > RUNNER_READINESS_MAX_REPOSITORIES) {\n    throw new Error(`VO_CODE_RUNNER_REPOS supports at most ${RUNNER_READINESS_MAX_REPOSITORIES} repositories`);\n  }\n  const normalized = repositories.map((repo) => {\n    const [owner, name] = typeof repo === 'string' ? repo.split('/') : [];\n    if (typeof repo !== 'string' || repo.length > 140 || !RUNNER_REPOSITORY.test(repo)\n      || owner === '.' || owner === '..' || name === '.' || name === '..') {\n      throw new Error('VO_CODE_RUNNER_REPOS entries must be canonical owner/name repositories');\n    }\n    return repo.toLowerCase();\n  });\n  if (new Set(normalized).size !== normalized.length) {\n    throw new Error('VO_CODE_RUNNER_REPOS entries must be unique');\n  }\n  const owners = new Set(normalized.map((repo) => repo.split('/')[0]));\n  if (owners.size !== 1) {\n    throw new Error('VO_CODE_RUNNER_REPOS entries must share one owner');\n  }\n  return Object.freeze(normalized.sort());\n}\n\nexport function runnerRepositoryScopeDigest(repositories) {\n  const scope = normalizeRunnerRepositoryScope(repositories);\n  return createHash('sha256').update(JSON.stringify({\n    version: 1,\n    repositories: scope,\n  }), 'utf8').digest('hex');\n}\n\nexport function runnerReadinessRetryDelayMs(readiness) {\n  if (readiness?.paired !== true || readiness?.githubReady !== false) return null;\n  if (Number.isFinite(readiness.retryAfterMs) && readiness.retryAfterMs > 0) {\n    return Math.ceil(readiness.retryAfterMs);\n  }\n  return null;\n}\n\n/**\n * One shared CLI/supervisor failure disposition. Only a parent-ACKed,\n * server-authorized readiness deferral may use reserved exit 75; ordinary\n * readiness failures and failed IPC custody remain ordinary exit 1 and\n * therefore consume breaker budget.\n */\nexport function runnerReadinessFailureDisposition(readiness, delivery = null) {\n  const retryAfterMs = runnerReadinessRetryDelayMs(readiness);\n  if (retryAfterMs === null) {\n    return Object.freeze({ action: 'exit', exitCode: 1, retryAfterMs: null });\n  }\n  if (delivery?.attempted === true) {\n    return Object.freeze({\n      action: 'exit',\n      exitCode: delivery.delivered === true ? 75 : 1,\n      retryAfterMs,\n    });\n  }\n  return Object.freeze({ action: 'wait', exitCode: null, retryAfterMs });\n}\n\nexport function parseRunnerReadinessDeferralRequest(message) {\n  if (message?.type !== RUNNER_READINESS_DEFERRAL_MESSAGE_TYPE\n    || !UUID_RE.test(String(message.nonce || ''))\n    || !Number.isFinite(message.retryAfterMs)\n    || message.retryAfterMs <= 0) return null;\n  return Object.freeze({\n    nonce: message.nonce,\n    retryAfterMs: Math.ceil(message.retryAfterMs),\n    error: typeof message.error === 'string' ? message.error : null,\n  });\n}\n\nexport async function notifySupervisorReadinessDeferral({\n  processLike,\n  retryAfterMs,\n  error = null,\n  ackTimeoutMs = RUNNER_READINESS_IPC_ACK_TIMEOUT_MS,\n}) {\n  if (processLike?.connected !== true || typeof processLike.send !== 'function') {\n    return Object.freeze({ attempted: false, delivered: false });\n  }\n  if (typeof processLike.on !== 'function' || typeof processLike.off !== 'function') {\n    return Object.freeze({ attempted: true, delivered: false });\n  }\n  const nonce = randomUUID();\n  const delivered = await new Promise((resolve) => {\n    let settled = false;\n    const onMessage = (message) => {\n      if (message?.type === RUNNER_READINESS_DEFERRAL_ACK_TYPE && message.nonce === nonce) {\n        finish(true);\n      }\n    };\n    const onDisconnect = () => finish(false);\n    const finish = (value) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      processLike.off('message', onMessage);\n      processLike.off('disconnect', onDisconnect);\n      resolve(value);\n    };\n    const timer = setTimeout(() => finish(false), ackTimeoutMs);\n    processLike.on('message', onMessage);\n    processLike.on('disconnect', onDisconnect);\n    try {\n      processLike.send({\n        type: RUNNER_READINESS_DEFERRAL_MESSAGE_TYPE,\n        nonce,\n        retryAfterMs,\n        error,\n      }, (sendError) => {\n        if (sendError) finish(false);\n      });\n    } catch {\n      finish(false);\n    }\n  });\n  return Object.freeze({ attempted: true, delivered });\n}\n\nexport async function waitForRunnerReadinessRetry(delayMs, {\n  nowMs = () => Date.now(),\n  wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n} = {}) {\n  if (!Number.isFinite(delayMs) || delayMs <= 0) {\n    throw new TypeError('runner readiness retry delay is invalid');\n  }\n  const deadline = nowMs() + Math.ceil(delayMs);\n  while (nowMs() < deadline) {\n    await wait(Math.min(RUNNER_READINESS_MAX_TIMER_DELAY_MS, deadline - nowMs()));\n  }\n}\n\nfunction failed({\n  paired = false,\n  operatorId = null,\n  tenantId = null,\n  githubReady = null,\n  retryAfterMs = null,\n  error,\n  message,\n}) {\n  return {\n    ok: false,\n    paired,\n    operatorId,\n    tenantId,\n    githubReady,\n    ...(Number.isFinite(retryAfterMs) && retryAfterMs > 0 ? { retryAfterMs } : {}),\n    error,\n    message,\n  };\n}\n\nfunction responseRetryAfterMs(response, body) {\n  const transientReadinessFailure = response.status === 503\n    && body?.error === 'github_installation_readiness_retryable';\n  if (response.status !== 429 && !transientReadinessFailure) return null;\n  const bound = (retryAfterMs) => transientReadinessFailure\n    ? Math.min(RUNNER_READINESS_TRANSIENT_MAX_RETRY_AFTER_MS, retryAfterMs)\n    : retryAfterMs;\n  const value = response.headers?.get?.('retry-after')?.trim() ?? '';\n  const seconds = Number(value);\n  if (value && Number.isFinite(seconds) && seconds >= 0) {\n    return bound(Math.max(1_000, Math.ceil(seconds * 1_000)));\n  }\n  const at = value ? Date.parse(value) : Number.NaN;\n  if (Number.isFinite(at)) {\n    return bound(Math.max(1_000, Math.ceil(at - Date.now())));\n  }\n  return bound(60_000);\n}\n\nasync function responseBody(response) {\n  try {\n    const value = await response.json();\n    return value && typeof value === 'object' ? value : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction serverMessage(body, fallback) {\n  return typeof body.message === 'string' && body.message.trim() ? body.message.trim() : fallback;\n}\n\nasync function fetchJsonWithTimeout(fetchImpl, url, init, timeoutMs) {\n  const controller = new AbortController();\n  let timer;\n  const timeout = new Promise((_, reject) => {\n    timer = setTimeout(() => {\n      controller.abort();\n      reject(new Error(`request aborted after ${timeoutMs}ms`));\n    }, timeoutMs);\n  });\n  try {\n    const requestAndBody = (async () => {\n      const response = await fetchImpl(url, { ...init, signal: controller.signal });\n      return { response, body: await responseBody(response) };\n    })();\n    return await Promise.race([requestAndBody, timeout]);\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * @param {{\n *   controlPlaneUrl: string,\n *   token: string,\n *   fetchImpl?: typeof fetch,\n *   requireGithub?: boolean,\n *   repositories?: readonly string[],\n *   timeoutMs?: number,\n *   githubTimeoutMs?: number,\n * }} input\n */\nexport async function probeRunnerReadiness({\n  controlPlaneUrl,\n  token,\n  fetchImpl = fetch,\n  requireGithub = false,\n  repositories = [],\n  timeoutMs = RUNNER_IDENTITY_READINESS_TIMEOUT_MS,\n  // The server performs at most five sequential App-JWT GETs (installation plus\n  // every one of at most four configured repositories), each bounded at 8s.\n  // Keep a transport margin while preventing a stuck proof from hanging startup.\n  githubTimeoutMs = RUNNER_GITHUB_READINESS_TIMEOUT_MS,\n}) {\n  const base = controlPlaneUrl.replace(/\\/+$/u, '');\n  const headers = { authorization: `Bearer ${token}` };\n  let identityResponse;\n  let identity;\n  try {\n    ({ response: identityResponse, body: identity } = await fetchJsonWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/auth/me`,\n      { headers },\n      timeoutMs,\n    ));\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      error: 'control_plane_unreachable',\n      message: `AlgoHQ could not be reached: ${detail}`,\n    });\n  }\n\n  if (!identityResponse.ok) {\n    return failed({\n      error: 'credential_rejected',\n      message: 'The saved pairing is expired or revoked. Pair this computer again.',\n    });\n  }\n  if (\n    identity.provisioned !== true ||\n    identity.role !== 'operator' ||\n    typeof identity.operator_id !== 'string' ||\n    !identity.operator_id.trim() ||\n    typeof identity.tenant_id !== 'string' ||\n    !identity.tenant_id.trim()\n  ) {\n    return failed({\n      error: 'operator_identity_missing',\n      message: 'The pairing credential is valid but has no operator identity. Pair this computer again.',\n    });\n  }\n\n  const operatorId = identity.operator_id.trim();\n  const tenantId = identity.tenant_id.trim();\n  if (!requireGithub) {\n    return {\n      ok: true,\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: null,\n      error: null,\n      message: 'Paired to AlgoHQ.',\n    };\n  }\n\n  let repositoryScope = null;\n  try {\n    if (!Array.isArray(repositories)) {\n      throw new Error('VO_CODE_RUNNER_REPOS must be a repository array');\n    }\n    if (repositories.length > 0) repositoryScope = normalizeRunnerRepositoryScope(repositories);\n  } catch (error) {\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error: 'github_repository_scope_invalid',\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n\n  let githubResponse;\n  let github;\n  try {\n    const readinessUrl = new URL(`${base}/api/v1/github/installation-readiness`);\n    for (const repo of repositoryScope ?? []) readinessUrl.searchParams.append('repo', repo);\n    ({ response: githubResponse, body: github } = await fetchJsonWithTimeout(\n      fetchImpl,\n      readinessUrl.toString(),\n      { headers },\n      githubTimeoutMs,\n    ));\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error: 'github_preflight_unreachable',\n      message: `GitHub publication readiness could not be checked: ${detail}`,\n    });\n  }\n\n  const repositorySelection = github.repository_selection;\n  const repositoriesVerified = github.repositories_verified;\n  const returnedScope = github.repository_scope;\n  let normalizedReturnedScope = null;\n  try {\n    normalizedReturnedScope = normalizeRunnerRepositoryScope(returnedScope);\n  } catch {\n    // The shape check below fails closed with the server's actionable response.\n  }\n  const effectiveScope = repositoryScope ?? normalizedReturnedScope;\n  const sourceVerified = repositoryScope === null\n    ? github.repository_scope_source === 'persisted_installation_singleton'\n      && normalizedReturnedScope?.length === 1\n    : github.repository_scope_source === 'runner_config';\n  const repositoryScopeVerified = effectiveScope !== null\n    && normalizedReturnedScope !== null\n    && Array.isArray(returnedScope)\n    && returnedScope.length === normalizedReturnedScope.length\n    && returnedScope.every((repo, index) => repo === normalizedReturnedScope[index])\n    && normalizedReturnedScope.length === effectiveScope.length\n    && normalizedReturnedScope.every((repo, index) => repo === effectiveScope[index])\n    && github.repository_scope_sha256 === runnerRepositoryScopeDigest(effectiveScope)\n    && repositoriesVerified === effectiveScope.length\n    && sourceVerified\n    && (repositorySelection === 'all' || repositorySelection === 'selected');\n  if (!githubResponse.ok || github.configured !== true || github.verified !== true\n    || github.publication_ready !== true\n    || !repositoryScopeVerified) {\n    const error = typeof github.error === 'string' && github.error ? github.error : 'github_not_ready';\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      retryAfterMs: responseRetryAfterMs(githubResponse, github),\n      error,\n      message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`),\n    });\n  }\n\n  return {\n    ok: true,\n    paired: true,\n    operatorId,\n    tenantId,\n    githubReady: true,\n    repositoryScope: effectiveScope,\n    repositoryScopeSource: github.repository_scope_source,\n    error: null,\n    message: `Paired with a verified Algosuite GitHub App installation (${repositoriesVerified} repos).`,\n  };\n}\n\nexport function pairedOperatorScope(readiness) {\n  return readiness?.ok === true &&\n    readiness?.paired === true &&\n    typeof readiness.operatorId === 'string' &&\n    readiness.operatorId.trim()\n    ? readiness.operatorId.trim()\n    : null;\n}\n", "import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport function defaultCredentialHelperPath(metaUrl = import.meta.url) {\n  const moduleDir = dirname(fileURLToPath(metaUrl));\n  const bundled = join(moduleDir, 'supervisor-credential-helper.js');\n  const source = join(moduleDir, '..', 'supervisor-credential-helper.mjs');\n  return existsSync(source) ? source : bundled;\n}\n\n/** Read the OS-keychain credential without loading its native module here. */\nexport function readStoredCredentialIsolated({\n  spawn = spawnSync,\n  execPath = process.execPath,\n  helperPath = defaultCredentialHelperPath(),\n  helperArgs = [],\n  env = process.env,\n} = {}) {\n  const result = spawn(execPath, [helperPath, ...helperArgs], {\n    env,\n    encoding: 'utf8',\n    stdio: ['ignore', 'pipe', 'pipe'],\n    shell: false,\n    windowsHide: true,\n    timeout: 10_000,\n  });\n  if (result.status !== 0) {\n    throw new Error('runner credential helper could not read the paired credential');\n  }\n  try {\n    const parsed = JSON.parse(String(result.stdout || ''));\n    return parsed && typeof parsed === 'object' ? parsed : null;\n  } catch {\n    throw new Error('runner credential helper returned an invalid credential');\n  }\n}\n", "/** Pure rapid-exit circuit used by the persistent runner supervisor. */\nexport const DEFAULT_RESPAWN_CIRCUIT = Object.freeze({\n  baseDelayMs: 2_000,\n  maxDelayMs: 30_000,\n  healthyResetMs: 60_000,\n  maxRapidExits: 5,\n});\n\nexport function createRespawnCircuit(options = {}) {\n  const config = { ...DEFAULT_RESPAWN_CIRCUIT, ...options };\n  for (const [key, value] of Object.entries(config)) {\n    if (!Number.isInteger(value) || value < 1) throw new Error(`${key} must be a positive integer`);\n  }\n  let rapidExits = 0;\n\n  return Object.freeze({\n    recordExit(startedAt, exitedAt) {\n      if (!Number.isFinite(startedAt) || !Number.isFinite(exitedAt) || exitedAt < startedAt) {\n        throw new Error('respawn circuit timestamps are invalid');\n      }\n      const uptimeMs = exitedAt - startedAt;\n      rapidExits = uptimeMs >= config.healthyResetMs ? 0 : rapidExits + 1;\n      const tripped = rapidExits >= config.maxRapidExits;\n      const delayMs = Math.min(\n        config.maxDelayMs,\n        config.baseDelayMs * (2 ** Math.max(0, rapidExits - 1)),\n      );\n      return Object.freeze({ rapidExits, uptimeMs, delayMs, tripped });\n    },\n    snapshot() {\n      return Object.freeze({ rapidExits, tripped: rapidExits >= config.maxRapidExits });\n    },\n  });\n}\n", "/**\n * Readiness proof for one supervisor-owned runner child.\n *\n * All timing and state effects are injected so the race between an asynchronous\n * health probe and process exit can be exercised without starting a real child.\n */\nconst terminatedChildren = new WeakSet();\n\n/**\n * Install one exact-child terminal-event account while retaining an `error`\n * listener for the child's full lifetime. Node may emit an asynchronous spawn\n * `error` without `exit`, or may emit both; only the first terminal event\n * receives termination authority.\n *\n * The record carries HOW the child died, not merely that it did. Node hands the\n * exit listener `(code, signal)` and this used to discard both, which is why the\n * Windows libuv abort\n * (`Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\\win\\async.c`)\n * has only ever been an anecdote: the supervisor knew the daemon exited and\n * nothing about whether it aborted, was signalled, or returned cleanly. An\n * abort() on Windows surfaces as a non-zero code with no signal, which is\n * indistinguishable from a clean exit once the code is thrown away.\n */\nexport function attachSupervisorChildTerminationCustody(\n  target,\n  onTerminated,\n  onObservedError = () => {},\n) {\n  let accounted = false;\n  const account = (kind, { error = null, code = null, signal = null } = {}) => {\n    terminatedChildren.add(target);\n    if (accounted) return false;\n    accounted = true;\n    onTerminated(Object.freeze({ target, kind, error, code, signal }));\n    return true;\n  };\n  target.on('error', (error) => {\n    onObservedError(error);\n    // ChildProcess also uses `error` for failed IPC sends and failed kills.\n    // Those do not prove a live process terminated. A spawn failure is the\n    // narrow terminal case: Node leaves pid unset and may emit exit afterward.\n    // No code/signal exists for a process that never started.\n    if (target.pid === undefined || target.pid === null) account('error', { error });\n  });\n  target.on('exit', (code, signal) => {\n    account('exit', { code: code ?? null, signal: signal ?? null });\n  });\n  return Object.freeze({ accounted: () => accounted });\n}\n\n/**\n * One line describing how a child died, for the supervisor's log.\n *\n * Names the runtime because that is the attribution the abort investigation\n * lacked: the daemon runs the BUNDLED Node, not whatever is on the operator's\n * PATH, and a crash blamed on the wrong build is worse than an unattributed one\n * (docs/vo/roadmap-log/2026-09-04-runner-exit-abort.md).\n */\nexport function describeChildTermination(record, runtime = process.version) {\n  if (!record || typeof record !== 'object') return `unknown termination on Node ${runtime}`;\n  if (record.kind === 'error') {\n    const detail = record.error instanceof Error ? record.error.message : String(record.error ?? 'no detail');\n    return `spawn error on Node ${runtime}: ${detail}`;\n  }\n  if (record.signal) return `killed by ${record.signal} on Node ${runtime}`;\n  if (record.code === 0) return `exited cleanly (code 0) on Node ${runtime}`;\n  if (record.code === null) return `exited with no reported code or signal on Node ${runtime}`;\n  return `exited with code ${record.code} on Node ${runtime}`;\n}\n\nexport function supervisorChildHasExited(target) {\n  // Node preserves exitCode=null for signal-terminated children and reports the\n  // terminal state through signalCode instead. An asynchronous spawn error can\n  // leave both fields null, so exact-object error custody is terminal too.\n  return terminatedChildren.has(target)\n    || target.exitCode !== null\n    || (target.signalCode ?? null) !== null;\n}\n\nexport function supervisorChildIsRunning(target) {\n  return !supervisorChildHasExited(target);\n}\n\nexport function shouldRespawnSupervisorChild({ stopping, degraded, handling, child }) {\n  return !stopping && !degraded && !handling && (!child || supervisorChildHasExited(child));\n}\n\nexport function shouldDeferSupervisorReadinessExit({\n  target,\n  currentChild,\n  retryAfterMs,\n}) {\n  return target === currentChild\n    && target?.exitCode === 75\n    && Number.isFinite(retryAfterMs)\n    && retryAfterMs > 0;\n}\n\n/**\n * Exact-child custody for a child-reported GitHub readiness embargo. The\n * supervisor records the nonce before acknowledging it to the child, then one\n * idempotent capture transition is shared by health, activation, and exit-event\n * orderings. A later exit listener can therefore never reinterpret an already\n * captured exit as a crash.\n */\nexport function createSupervisorReadinessDeferralTracker({\n  currentChild,\n  releaseCurrentChild,\n  onCaptured,\n}) {\n  const pending = new WeakMap();\n  const terminal = new WeakSet();\n  const recoveryGenerations = new WeakMap();\n\n  return Object.freeze({\n    recordPending(target, request) {\n      if (!target || target !== currentChild() || terminal.has(target) || pending.has(target)\n        || typeof request?.nonce !== 'string' || !request.nonce\n        || !Number.isFinite(request.retryAfterMs) || request.retryAfterMs <= 0) return false;\n      pending.set(target, Object.freeze({\n        nonce: request.nonce,\n        retryAfterMs: Math.ceil(request.retryAfterMs),\n      }));\n      return true;\n    },\n    recordRecoveryGeneration(target, generation) {\n      if (!target || !Number.isInteger(generation)) return false;\n      recoveryGenerations.set(target, generation);\n      return true;\n    },\n    isDeferred(target) {\n      const request = target ? pending.get(target) : null;\n      return Boolean(target) && (terminal.has(target) || shouldDeferSupervisorReadinessExit({\n        target,\n        currentChild: currentChild(),\n        retryAfterMs: request?.retryAfterMs,\n      }));\n    },\n    capture(target) {\n      if (!target) return false;\n      if (terminal.has(target)) return true;\n      const request = pending.get(target);\n      if (!shouldDeferSupervisorReadinessExit({\n        target,\n        currentChild: currentChild(),\n        retryAfterMs: request?.retryAfterMs,\n      })) return false;\n      const recoveryGeneration = recoveryGenerations.get(target);\n      terminal.add(target);\n      pending.delete(target);\n      recoveryGenerations.delete(target);\n      releaseCurrentChild(target);\n      onCaptured(Object.freeze({\n        target,\n        retryAfterMs: request.retryAfterMs,\n        recoveryGeneration: Number.isInteger(recoveryGeneration) ? recoveryGeneration : null,\n      }));\n      return true;\n    },\n    forget(target) {\n      if (!target) return;\n      pending.delete(target);\n      recoveryGenerations.delete(target);\n    },\n  });\n}\n\nexport function resolveSupervisorChildStartAuthority({\n  degradationState,\n  deferredRecoveryGeneration,\n}) {\n  const snapshot = degradationState.snapshot();\n  const exactRecovery = Number.isInteger(deferredRecoveryGeneration)\n    && deferredRecoveryGeneration === snapshot.generation;\n  return Object.freeze({\n    allowed: !snapshot.degraded || exactRecovery,\n    recoveryGeneration: exactRecovery ? deferredRecoveryGeneration : null,\n  });\n}\n\n/**\n * One-shot startup gate for a server-provided readiness Retry-After deadline.\n * Waiting behind this gate never spawns a process, so it cannot consume the\n * rapid-exit breaker. A later upstream response may extend the same unspent\n * start authority; once consumed it can never be reused by another poll.\n */\nexport function createSupervisorStartupDeferral({\n  retryAfterMs = null,\n  nowMs = () => Date.now(),\n} = {}) {\n  let started = false;\n  let notBefore = null;\n  const defer = (delayMs) => {\n    if (started || !Number.isFinite(delayMs) || delayMs <= 0) return false;\n    const candidate = nowMs() + Math.ceil(delayMs);\n    notBefore = notBefore === null ? candidate : Math.max(notBefore, candidate);\n    return true;\n  };\n  defer(retryAfterMs);\n\n  return Object.freeze({\n    defer,\n    reopen(delayMs) {\n      if (!Number.isFinite(delayMs) || delayMs <= 0) return false;\n      started = false;\n      notBefore = null;\n      return defer(delayMs);\n    },\n    isPending() {\n      return !started && notBefore !== null && nowMs() < notBefore;\n    },\n    remainingMs() {\n      return started || notBefore === null ? 0 : Math.max(0, notBefore - nowMs());\n    },\n    consumeIfReady() {\n      if (started || (notBefore !== null && nowMs() < notBefore)) return false;\n      started = true;\n      notBefore = null;\n      return true;\n    },\n    hasStarted() {\n      return started;\n    },\n  });\n}\n\n/**\n * Generation-fenced degradation state. A health proof may clear only the\n * generation it observed when it began, and only for the same current child.\n */\nexport function createSupervisorDegradationState() {\n  let degraded = false;\n  let generation = 0;\n\n  return {\n    isDegraded() {\n      return degraded;\n    },\n    markDegraded() {\n      degraded = true;\n      generation += 1;\n    },\n    beginHealthProof({ target, currentChild, allowRecovery, onRecovery }) {\n      const observedGeneration = generation;\n      return () => {\n        if (currentChild() !== target || generation !== observedGeneration) return false;\n        if (degraded && !allowRecovery) return false;\n        const recovered = degraded;\n        degraded = false;\n        if (recovered) onRecovery?.();\n        return true;\n      };\n    },\n    beginDegradationProof({ target, currentChild, onDegraded }) {\n      const observedGeneration = generation;\n      return (message) => {\n        if (currentChild() !== target || generation !== observedGeneration) return false;\n        onDegraded(message);\n        return true;\n      };\n    },\n    snapshot() {\n      return { degraded, generation };\n    },\n  };\n}\n\n/**\n * Begin one exact-child, exact-generation healthy-state commit. The stale\n * non-zero supervisor exit status is cleared only inside the same successful\n * commit that recovers degradation; stale or wrong-child proofs have no exit\n * status authority.\n */\nexport function beginSupervisorHealthyStateCommit({\n  degradationState,\n  target,\n  currentChild,\n  allowRecovery,\n  clearStaleExitCode,\n}) {\n  return degradationState.beginHealthProof({\n    target,\n    currentChild,\n    allowRecovery,\n    onRecovery: clearStaleExitCode,\n  });\n}\n\nconst RUNNER_RECOVERY_ACTIONS = new Set(['update', 'reinstall', 'reconnect']);\n\nexport function shouldRecoverSupervisorChildAfterAction({\n  stoppedChild,\n  actionKind,\n  actionSucceeded,\n}) {\n  // An action that deliberately stopped a live child must restore service even\n  // when its maintenance work failed. With no such child, only a successful\n  // runner repair/reconnect may clear pre-existing degradation; unrelated host\n  // cleanup and failed maintenance are not recovery authority.\n  return Boolean(stoppedChild)\n    || (actionSucceeded === true && RUNNER_RECOVERY_ACTIONS.has(actionKind));\n}\n\n/**\n * One-shot proof that the current control action took responsibility for a\n * live child before stopping it. Generic polling failures never arm this\n * fence, so they cannot accidentally relaunch a previously degraded runner.\n */\nexport function createSupervisorControlRecoveryFence() {\n  let targetStoppedForControl = null;\n  const consume = () => {\n    const target = targetStoppedForControl;\n    targetStoppedForControl = null;\n    return target;\n  };\n\n  return {\n    markBeforeStop(target) {\n      targetStoppedForControl = target && supervisorChildIsRunning(target) ? target : null;\n      return targetStoppedForControl !== null;\n    },\n    consume,\n    async recoverOnce(recover) {\n      // Consume before awaiting so a failed recovery cannot leak authority into\n      // a later, unrelated poll iteration.\n      const target = consume();\n      if (!target) return false;\n      await recover(target);\n      return true;\n    },\n  };\n}\n\nexport async function verifySupervisorChildHealth({\n  target,\n  degradeOnExit,\n  context,\n  waitBeforeProbe,\n  waitForLocalRunner,\n  stopExpectedly,\n  markHealthy,\n  markDegraded,\n  isReadinessDeferredExit = () => false,\n  isExpectedStop = () => false,\n}) {\n  try {\n    await waitBeforeProbe();\n    const healthy = supervisorChildIsRunning(target) && await waitForLocalRunner(target);\n    // The health probe is asynchronous. Node may publish exitCode or signalCode\n    // while it is pending, so decisions below must use a fresh observation,\n    // not the value from before the await.\n    const exited = supervisorChildHasExited(target);\n    if (isExpectedStop(target)) return false;\n    if (exited && isReadinessDeferredExit(target)) return false;\n    if (healthy && !exited) {\n      // A caller may reject a stale success when a newer degradation or child\n      // generation superseded this asynchronous proof.\n      if (markHealthy() !== false) return true;\n      if (supervisorChildIsRunning(target)) await stopExpectedly(target);\n      return false;\n    }\n    // Ordinary rapid exits remain governed by the backoff circuit. A live\n    // child that never proves readiness, or any failed control-action\n    // recovery, must fail closed immediately instead of occupying the slot.\n    if (!exited || degradeOnExit) {\n      const committed = markDegraded(`${context} did not become healthy; entering degraded mode`) !== false;\n      if (!committed) return false;\n      if (supervisorChildIsRunning(target)) await stopExpectedly(target);\n    }\n    return false;\n  } catch (error) {\n    if (isExpectedStop(target)) return false;\n    const committed = markDegraded(\n      `${context} health proof failed; entering degraded mode: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n    ) !== false;\n    if (!committed) return false;\n    if (supervisorChildIsRunning(target)) await stopExpectedly(target).catch(() => {});\n    return false;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAeA,eAAsB,kBAAkB;AACtC,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AApBA;AAAA;AAAA;AAAA;;;ACKA,SAAS,aAAa;AACtB,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,iBAAAC,sBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACQ9B,IAAM,wBAAwB;AAU9B,eAAsB,uBAAuB,EAAE,KAAK,WAAW,OAAO,WAAW,OAAO,OAAO,KAAK,GAAG;AACrG,QAAM,OAAO,CAAC,WAAW;AACvB,QAAI,SAAU,OAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AACtE,WAAO;AAAA,EACT;AACA,MAAI;AAIF,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA;AAAA,MACA,WAAW,EAAE,OAAO,QAAQ,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG,IAAI,CAAC;AAAA,MAC3D,WAAW,EAAE,WAAW,sBAAsB,IAAI,CAAC;AAAA,IACrD;AACA,QAAI,CAAC,IAAI,GAAI,QAAO,KAAK,QAAQ,IAAI,MAAM,EAAE;AAC7C,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,KAAK,eAAe;AAMrD,QAAI,YAAY,KAAK,UAAU,OAAQ,QAAO,KAAK,iDAAiD;AAGpG,WAAO,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,cAAc,MAAM,GAAI,OAAO,KAAK,gBAAgB,YAAY,EAAE,YAAY,KAAK,YAAY,IAAI,CAAC,EAAG;AAAA,EACrJ,SAAS,KAAK;AACZ,QAAI,SAAU,OAAM;AACpB,WAAO;AAAA,EACT;AACF;;;ACvCO,SAAS,yBAAyB;AAAA,EACvC,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,sBAAAC;AAAA,EACA,mBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AACvB,IAAI,CAAC,GAAG;AAEN,QAAM,OAAO,EAAE,WAAWF,WAAU,GAAI,oBAAoB,EAAE,qBAAqB,kBAAkB,IAAI,CAAC,EAAG;AAC7G,MAAI,iBAAkB,MAAK,qBAAqB;AAChD,MAAI,WAAY,MAAK,cAAc;AACnC,MAAI,OAAO,cAAc,SAAU,MAAK,aAAa;AACrD,MAAI,OAAO,gBAAgB,SAAU,MAAK,eAAe;AACzD,MAAI,OAAO,mBAAmB,SAAU,MAAK,kBAAkB;AAC/D,MAAI,OAAO,yBAAyB,SAAU,MAAK,wBAAwB;AAC3E,MAAI,OAAO,sBAAsB,SAAU,MAAK,sBAAsB;AACtE,MAAI,OAAO,qBAAqB,SAAU,MAAK,qBAAqB;AACpE,MAAI,OAAO,wBAAwB,SAAU,MAAK,wBAAwB;AAC1E,MAAI,QAAS,MAAK,UAAU;AAC5B,MAAI,cAAe,MAAK,iBAAiB;AAGzC,MAAI,YAAa,MAAK,eAAe;AACrC,MAAI,aAAc,MAAK,gBAAgB;AACvC,MAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,MAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,MAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,GAAG;AAC9E,SAAK,0BAA0B;AAAA,EACjC;AACA,MAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,SAAK,sBAAsB;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,SAAK,mBAAmB;AAAA,EAC1B;AACA,MAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,SAAK,gBAAgB;AAAA,EACvB;AACA,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,SAAS,GAAG;AAC1E,SAAK,yBAAyB;AAAA,EAChC;AACA,SAAO;AACT;;;AC1EA,eAAsB,sBAAsB,KAAK,UAAU,mBAAmB,iBAAiB,MAAM;AAAC,GAAG;AACvG,QAAM,MAAM,MAAM,IAAI,QAAQ,kCAAkC,EAAE,UAAU,kBAAkB,GAAG,EAAE,WAAW,IAAO,CAAC;AACtH,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,MAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,WAAO;AAAA,MACL,QAAQ,KAAK,aAAa,OAAQ,KAAK,wBAAwB,OAAO,mCAAmC,aAAc,KAAK,kBAAkB,OAAO,kBAAkB;AAAA,MACvK,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,MAC7D,QAAQ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB;AAAA,IAC1E;AAAA,EACF;AACA,QAAM,OAAO,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAC5D,QAAM,MAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,GAAG,MAAM,SAAS,WAAM,KAAK,MAAM,KAAK,EAAE,EAAE;AACrI,MAAI,SAAS,IAAI;AACjB,MAAI,OAAO;AACX,QAAM;AACR;;;ACzBA,IAAM,YAAY;AAGlB,eAAsB,qBAAqB,SAAS;AAClD,QAAM,QAAQ,CAAC;AACf,MAAI,kBAAkB;AACtB,MAAI,WAAW;AACf,aAAS;AACP,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,QAAQ;AAAA,MAAa,OAAO,OAAO,SAAS;AAAA,MAAG,iBAAiB;AAAA,IAClE,CAAC;AACD,QAAI,iBAAiB;AACnB,aAAO,IAAI,qBAAqB,eAAe;AAC/C,aAAO,IAAI,aAAa,QAAQ;AAAA,IAClC;AACA,UAAM,MAAM,MAAM,QAAQ,OAAO,qBAAqB,MAAM,EAAE;AAC9D,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAC3E,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,OAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC;AACxD,UAAM,KAAK,GAAG,IAAI;AAClB,QAAI,KAAK,SAAS,UAAW,QAAO;AACpC,UAAM,OAAO,KAAK,GAAG,EAAE;AACvB,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,cAAc;AAC5C,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AACA,sBAAkB,KAAK;AACvB,eAAW,KAAK;AAAA,EAClB;AACF;;;AC5BA,eAAsB,sBACpB,KACA,QACA,EAAE,qBAAqB,OAAO,wBAAwB,MAAM,IAAI,CAAC,GACjE,iBAAiB,MAAM;AAAC,GACxB;AACA,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,qBAAqB,mBAAmB,MAAM,CAAC;AAAA,IAC/C,qBACI,EAAE,sBAAsB,KAAK,IAC7B,wBAAwB,EAAE,wBAAwB,KAAK,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AACA,MAAI,CAAC,IAAI,IAAI;AAIX,QAAI,OAAO;AACX,QAAI;AACF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAAA,IACxD,QAAQ;AAAA,IAAsC;AAC9C,UAAM,MAAM,IAAI,MAAM,uBAAuB,IAAI,MAAM,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,EAAE;AACpF,QAAI,SAAS,IAAI;AACjB,QAAI,OAAO;AACX,UAAM;AAAA,EACR;AACA,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAM,OAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAG7C,MAAI,QAAQ,OAAO,KAAK,iBAAiB,UAAW,QAAO,eAAe,MAAM,gBAAgB,EAAE,OAAO,KAAK,cAAc,YAAY,MAAM,CAAC;AAC/I,SAAO;AACT;;;ACrCO,SAAS,sCAAsC,KAAK,WAAW,iBAAiB,MAAM;AAAC,GAAG;AAC/F,SAAO;AAAA,IACL,MAAM,gCAAgC,EAAE,oBAAoB,eAAe,cAAc,GAAG;AAC1F,YAAM,MAAM,MAAM,IAAI,QAAQ,yCAAyC;AAAA,QACrE,sBAAsB;AAAA,QACtB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,MAC3B,GAAG,EAAE,UAAU,CAAC;AAChB,UAAI,IAAI,WAAW,KAAK;AACtB,uBAAe;AACf,cAAM,IAAI,MAAM,kDAAkD;AAAA,MACpE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8CAA8C,IAAI,MAAM,EAAE;AACvF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO;AAAA,QACL,SAAS,MAAM,YAAY;AAAA,QAC3B,QAAQ,OAAO,MAAM,WAAW,WAAW,KAAK,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,IAEA,MAAM,gCAAgC,eAAe;AACnD,YAAM,MAAM,MAAM,IAAI,QAAQ,mDAAmD;AAAA,QAC/E,gBAAgB;AAAA,MAClB,GAAG,EAAE,UAAU,CAAC;AAChB,UAAI,IAAI,WAAW,KAAK;AACtB,uBAAe;AACf,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,4CAA4C,IAAI,MAAM,EAAE;AACrF,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AChCA,eAAsB,uBAAuB,KAAK,UAAU,mBAAmB,gBAAgB;AAC7F,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IAAQ;AAAA,IAA0B,EAAE,UAAU,kBAAkB;AAAA,IAAG,EAAE,WAAW,KAAQ;AAAA,EAC1F;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AACA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,MAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,UAAM,SAAS,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,CAAC;AAChF,UAAM,SAAS,OAAO,WAAW,QAAQ,OAAO,WAAW,WACvD,WACA,OAAO,WAAW,wBAAwB,OAAO,OAAO,UAAU,EAAE,EAAE,SAAS,YAAY,IACzF,WACA;AACN,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,MAC5D,iBAAiB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,IACzF;AAAA,EACF;AACA,QAAM,oBAAoB,MAAM,kBAAkB,oBAC5C,MAAM,UAAU,mCACf,MAAM,UAAU;AACvB,MAAI,IAAI,WAAW,QACb,MAAM,UAAU,wBAAwB,MAAM,UAAU,uBACvD,oBAAoB;AACzB,WAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,UAAU,KAAK,WAAW,KAAK,SAAS,2BAA2B;AAAA,EAC5G;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,IAC1E,iBAAiB,OAAO,MAAM,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACF;;;ACrBA,eAAsB,wBACpB,SACA,EAAE,YAAY,UAAAC,WAAU,QAAQ,iBAAiB,qBAAqB,GACtE,iBAAiB,MAAM;AAAC,GACxB;AACA,QAAM,OAAO;AAAA,IACX,aAAa;AAAA,IACb,WAAWA;AAAA,IACX,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,uBAAuB,OAAO;AAAA,IAC9B,mBAAmB,OAAO;AAAA,EAC5B;AACA,MAAI,OAAO,oBAAoB,UAAU;AACvC,SAAK,oBAAoB;AAAA,EAC3B;AACA,MAAI,yBAAyB,QAAW;AACtC,SAAK,0BAA0B;AAAA,EACjC;AACA,QAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,IAAI;AAC/D,MAAI,IAAI,WAAW,KAAK;AACtB,mBAAe;AACf,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,SAAO;AACT;;;AC1BO,IAAM,6BAA6B;AAE1C,eAAsB,4BAA4B,KAAK,EAAE,QAAQ,OAAO,GAAG,iBAAiB,MAAM;AAAC,GAAG;AACpG,QAAM,MAAM,MAAM,IAAI,QAAQ,2BAA2B,EAAE,QAAQ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,GAAG;AAAA,IAClG,WAAW;AAAA,EACb,CAAC;AACD,MAAI,IAAI,WAAW,IAAK,gBAAe;AACvC,MAAI,OAAO;AACX,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtD,SAAO,EAAE,QAAQ,IAAI,QAAQ,KAAK;AACpC;;;ACbA,IAAM,cAAc;AAAA,EAClB,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,oBAAoB;AAAA,EACpB,mBAAmB;AACrB;AAEO,SAAS,kBAAkB,MAAM;AACtC,MAAI,CAAC,QAAQ,KAAK,YAAY,MAAO,QAAO;AAC5C,QAAM,SAAS,OAAO,KAAK,UAAU,QAAQ;AAC7C,QAAM,QAAQ,KAAK,gBAAgB,WAAW,KAAK,aAAa,MAAM;AACtE,SAAO,6BAAwB,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,aAAa,MAAM,IAAI,YAAY,MAAM,IAAI,SAAS,gDAAiD;AAC1K;AAMO,SAAS,oBAAoB,EAAE,MAAM,MAAM;AAAC,EAAE,IAAI,CAAC,GAAG;AAC3D,MAAI,OAAO;AACX,MAAI,UAAU;AACd,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AACZ,YAAM,OAAO,QAAQ,OAAO,SAAS,WAAW,KAAK,aAAa;AAClE,YAAM,SAAS,QAAQ,KAAK,YAAY,QAAQ,OAAO;AACvD,gBAAU,SAAS,EAAE,GAAG,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI;AAC1E,YAAM,YAAY,SAAS,GAAG,OAAO,MAAM,IAAI,OAAO,iBAAiB,EAAE,KAAK;AAC9E,UAAI,cAAc,KAAM;AACxB,UAAI,OAAQ,KAAI,kBAAkB,MAAM,CAAC;AAAA,eAChC,SAAS,KAAM,KAAI,6DAAwD;AACpF,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC9BO,IAAM,mCAAmC;AAChD,IAAM,kBAAkB,CAAC,KAAO,GAAK;AACrC,IAAM,eAAe,gBAAgB,SAAS;AAE9C,SAAS,kBAAkB,QAAQ;AACjC,SAAO,UAAU,OAAO,UAAU;AACpC;AAEA,SAAS,aAAa,IAAI;AACxB,SAAO,IAAI,QAAQ,CAACC,aAAY;AAAE,eAAWA,UAAS,EAAE;AAAA,EAAG,CAAC;AAC9D;AAQA,eAAsB,+BAA+B,KAAK,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AAAA,EAChF;AAAA,EACA,kBAAkB,MAAM;AAAA,EAAC;AAAA,EACzB,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,QAAM,OAAO,CAAC;AACd,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,QAAQ;AAC5D,QAAMC,QAAO,qBAAqB,mBAAmB,MAAM,CAAC;AAC5D,QAAM,YAAY,KAAK,IAAI,OAAO,oBAAoB,KAAK,GAAG,gCAAgC;AAE9F,WAAS,UAAU,GAAG,WAAW,cAAc,WAAW,GAAG;AAC3D,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,IAAI,QAAQA,OAAM,MAAM,EAAE,UAAU,CAAC;AAAA,IACnD,SAAS,KAAK;AACZ,cAAQ;AAAA,IACV;AACA,QAAI,CAAC,OAAO;AACV,UAAI,IAAI,WAAW,KAAK;AACtB,wBAAgB;AAChB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,IAAI,GAAI,QAAO,IAAI,KAAK;AAC5B,UAAI,CAAC,kBAAkB,IAAI,MAAM,GAAG;AAClC,cAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAAA,MAChE;AACA,cAAQ,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAAA,IAClE;AACA,QAAI,YAAY,aAAc,OAAM;AACpC,UAAM,UAAU,gBAAgB,UAAU,CAAC;AAC3C,QAAI,6BAA6B,OAAO,IAAI,YAAY,YAAY,MAAM,OAAO,kBAAkB,OAAO,IAAI;AAC9G,UAAMD,OAAM,OAAO;AAAA,EACrB;AAEA,QAAM,IAAI,MAAM,kDAAkD;AACpE;;;AC9CO,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,6BAA6B;AAUnC,SAAS,iBAAiB,EAAE,QAAQ,UAAU,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG;AACpE,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,SAAS,OAAO,KAAK,CAAC;AACjC,QAAM,OAAO,CAAC;AACd,QAAM,UAAU,CAAC;AACjB,aAAW,OAAO,6BAA6B;AAC7C,UAAM,MAAM,MAAM,GAAG;AACrB,QAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG;AACjD,QAAI,IAAI,SAAS,4BAA4B;AAAE,cAAQ,KAAK,GAAG;AAAG;AAAA,IAAU;AAC5E,WAAO,IAAI,KAAK,GAAG;AACnB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO,EAAE,OAAO,OAAO,SAAS,GAAG,MAAM,QAAQ;AACnD;AAGA,eAAe,YAAY,KAAK;AAC9B,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,OAAO,MAAM,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAaA,eAAsB,sBAAsB,KAAK,QAAQ,UAAU,CAAC,GAAG,kBAAkB,MAAM;AAAC,GAAG;AACjG,QAAM,EAAE,QAAQ,UAAU,MAAM,CAAC,GAAG,YAAY,KAAO,IAAI;AAC3D,QAAM,EAAE,OAAO,MAAM,QAAQ,IAAI,iBAAiB,EAAE,OAAO,IAAI,CAAC;AAChE,QAAM,UAAU,EAAE,SAAS,MAAM,YAAY,QAAQ;AACrD,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,mBAAmB,QAAQ,GAAG,GAAG,QAAQ;AAAA,EACvE;AACA,QAAME,QAAO,qBAAqB,mBAAmB,MAAM,CAAC,iBAAiB,KAAK;AAClF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,IAAI,OAAOA,OAAM,QAAW,EAAE,UAAU,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,KAAK,WAAW,OAAO,GAAG,CAAC,IAAI,QAAQ,GAAG,GAAG,QAAQ;AAAA,EACjG;AACA,MAAI,KAAK,WAAW,KAAK;AACvB,QAAI;AAAE,sBAAgB;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,KAAK,GAAG,QAAQ;AAAA,EACtE;AACA,MAAI,CAAC,KAAK,IAAI;AACZ,UAAM,OAAO,MAAM,YAAY,GAAG;AAClC,WAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,QAAQ,KAAK,UAAU,SAAS,IAAI,QAAQ,KAAK,UAAU,GAAG,GAAG,QAAQ;AAAA,EAC/G;AACA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB,KAAK,WAAW,OAAO,GAAG,CAAC,IAAI,QAAQ,IAAI,QAAQ,GAAG,QAAQ;AAAA,EAChH;AACA,QAAM,MAAM,MAAM;AAClB,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B,QAAQ,IAAI,QAAQ,GAAG,QAAQ;AAAA,EACxF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,aAAa,MAAM,eAAe,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc,CAAC;AAAA,IAC7F,GAAG;AAAA,EACL;AACF;;;ACjGA,IAAI,sBAAsB;AACnB,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,cAAc;AACZ,UAAM,mCAAmC;AACzC,SAAK,OAAO;AAA8B,SAAK,OAAO;AAAA,EACxD;AACF;AAEA,eAAe,cAAc,KAAK;AAChC,QAAM,aAAa,IAAI;AACvB,MAAI,WAAY,QAAO;AACvB,MAAI,oBAAqB,QAAO;AAEhC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,OAAO,MAAMA,iBAAgB,EAAE,IAAI,CAAC;AAC1C,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,wBAAsB,KAAK;AAC3B,SAAO;AACT;AAOO,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,MAAM,QAAQ;AAAA,EACd,YAAY;AAAA,EACZ,qBAAqB,KAAK;AAAA,IACxB,KAAK,IAAI,OAAO,IAAI,mCAAmC,KAAK,MAAQ,GAAK;AAAA,IACzE;AAAA,EACF;AAAA,EACA,uBAAuB,KAAK;AAAA,IAC1B,KAAK,IAAI,OAAO,IAAI,sCAAsC,KAAK,KAAO,GAAG;AAAA,IACzE;AAAA,EACF;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA,OAAAC;AACF,IAAI,CAAC,GAAG;AACN,QAAM,kBAAkB,WAAW,IAAI,wBAAwB;AAC/D,MAAI,CAAC,gBAAiB,OAAM,IAAI,MAAM,6DAA6D;AACnG,QAAM,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAE/C,iBAAe,IAAI,QAAQC,OAAM,MAAM,EAAE,UAAU,IAAI,CAAC,GAAG;AACzD,UAAM,SAAS,MAAM,cAAc,GAAG;AACtC,UAAM,aAAa,YAAY,IAAI,gBAAgB,IAAI;AACvD,QAAI;AACJ,UAAM,UAAU,QAAQ,QAAQ,UAAU,GAAG,IAAI,GAAGA,KAAI,IAAI;AAAA,MAC1D;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC1D,GAAI,aAAa,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACpD,CAAC,CAAC;AACF,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,WAAW;AACzC,kBAAY,WAAW,MAAM;AAC3B,mBAAW,MAAM;AACjB,eAAO,IAAI,MAAM,iBAAiBA,KAAI,oBAAoB,SAAS,IAAI,CAAC;AAAA,MAC1E,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AACF,aAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,IAC9C,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AACA,QAAM,UAAU,CAAC,QAAQA,OAAM,MAAM,UAAU,CAAC,MAAM,IAAI,QAAQA,OAAM,MAAM,EAAE,WAAW,sBAAsB,GAAG,QAAQ,CAAC;AAAG,QAAM,YAAY,oBAAoB,EAAE,KAAK,CAAC,MAAM,QAAQ,KAAK,iBAAgB,oBAAI,KAAK,GAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AACpP,SAAO;AAAA,IAAE,cAAc,MAAM,UAAU,QAAQ;AAAA;AAAA,IAC7C,GAAG;AAAA,MACD;AAAA,MAAK;AAAA,MAAsB,MAAM;AAAE,8BAAsB;AAAA,MAAM;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,MAAMF,WAAU,OAAO,aAAa,UAAU,CAAC,GAAG;AACtD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,MAAK,QAAQ;AAC3D,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,QAAQ,kBAAkB;AAAE,aAAK,qBAAqB,QAAQ;AAAkB,aAAK,mCAAmC;AAAA,MAAG;AAC/H,UAAI,QAAQ,oBAAoB,QAAQ,eAAgB,MAAK,kBAAkB;AAC/E,UAAI,QAAQ,aAAc,MAAK,gBAAgB,QAAQ;AACvD,UAAI,MAAM,QAAQ,QAAQ,eAAe,GAAG;AAC1C,aAAK,mBAAmB,QAAQ,gBAC7B,OAAO,CAAC,UAAU,OAAO,cAAc,QAAQ,OAAO,kBAAkB,IAAI,EAC5E,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,MAC/B;AACA,YAAM,MAAM,MAAM,QAAQ,QAAQ,2BAA2B,IAAI;AACjE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,EAAE;AAC/D,YAAM,OAAO,MAAM,IAAI,KAAK;AAAG,gBAAU,QAAQ,IAAI;AACrD,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,gBAAgB,WAAW,eAAe,MAAM,OAAO,OAAO,yBAAyB,2BAA2B,0BAA0B,kBAAkB,aAAa,iBAAiB,aAAa,GAAG;AAChP,YAAM,OAAO,EAAE,MAAM,OAAO;AAC5B,UAAI,OAAO,mBAAmB,SAAU,MAAK,iBAAiB;AAC9D,UAAI,OAAO,cAAc,SAAU,MAAK,YAAY;AACpD,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,EAAE,eAAe,MAAM,OAAO,OAAO,aAAa,gBAAgB,CAAC,GAAG;AAC9G,YAAI,MAAO,MAAK,GAAG,IAAI;AAAA,MACzB;AACA,UAAI,wBAAyB,MAAK,0BAA0B;AAC5D,UAAI,0BAA2B,MAAK,4BAA4B;AAA2B,UAAI,yBAA0B,MAAK,2BAA2B;AACzJ,UAAI,OAAO,UAAU,gBAAgB,KAAK,mBAAmB,EAAG,MAAK,mBAAmB;AACxF,UAAI,aAAc,MAAK,eAAe;AACtC,YAAM,MAAM,MAAM,QAAQ,QAAQ,qBAAqB,IAAI;AAC3D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,4BAA4B;AAAA,MAC9C;AACA,UAAI,CAAC,IAAI,IAAI;AAIX,YAAI,OAAO;AACX,YAAI;AAAE,gBAAM,UAAU,MAAM,IAAI,KAAK;AAAG,iBAAO,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ;AAAA,QAAM,QAAQ;AAAA,QAAsB;AACxI,cAAM,MAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,EAAE;AACrF,YAAI,SAAS,IAAI;AAAQ,YAAI,OAAO;AACpC,cAAM;AAAA,MACR;AACA,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,OAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAG7C,UAAI,QAAQ,OAAO,KAAK,iBAAiB,UAAW,QAAO,eAAe,MAAM,gBAAgB,EAAE,OAAO,KAAK,cAAc,YAAY,MAAM,CAAC;AAC/I,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,eAAe,QAAQ,EAAE,qBAAqB,OAAO,wBAAwB,MAAM,IAAI,CAAC,GAAG;AAC/F,aAAO,sBAAsB,SAAS,QAAQ,EAAE,oBAAoB,sBAAsB,GAAG,MAAM;AACjG,8BAAsB;AAAA,MACxB,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,gBAAgB,CAAC,UAAU,sBAAsB,sBAAsB,KAAK,UAAU,mBAAmB,MAAM;AAAE,4BAAsB;AAAA,IAAM,CAAC;AAAA,IAC9I,MAAM,gBAAgB,UAAU,mBAAmB;AACjD,aAAO;AAAA,QACL;AAAA,QAAK;AAAA,QAAU;AAAA,QAAmB,MAAM;AAAE,gCAAsB;AAAA,QAAM;AAAA,MACxE;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,WAAW;AAAA,QACf,GAAG;AAAA,QACH,GAAI,MAAM,YAAY,CAAC,IAAIA,YAAW,EAAE,WAAWA,UAAS,IAAI,CAAC;AAAA,QACjE,GAAI,MAAM,qBAAqB,CAAC,IAAI,mBAAmB,EAAE,oBAAoB,iBAAiB,IAAI,CAAC;AAAA,MACrG;AACA,YAAM,MAAM,MAAM,QAAQ,SAAS,qBAAqB,MAAM,aAAa,QAAQ;AACnF,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,YAAI,UAAU,UAAU,qCAAqC;AAC3D,gBAAM,IAAI,2BAA2B;AAAA,QACvC;AACA,eAAO,EAAE,UAAU,KAAK;AAAA,MAC1B;AACA,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAC/D,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,EAAE;AAClE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,QAAQ,KAAK,KAAK;AAAA,IACnC;AAAA,IAEA,MAAM,QAAQ,QAAQ;AACpB,YAAM,MAAM,MAAM,QAAQ,OAAO,qBAAqB,MAAM,EAAE;AAC9D,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,KAAK,OAAO;AAAA,IAC5B;AAAA,IACA,MAAM,oBAAoB;AACxB,aAAO,qBAAqB,OAAO;AAAA,IACrC;AAAA,IACA,MAAM,uBAAuB,QAAQ,cAAc;AACjD,YAAME,QAAO,qBAAqB,mBAAmB,MAAM,CAAC,eAAe,mBAAmB,YAAY,CAAC;AAC3G,YAAM,MAAM,MAAM,QAAQ,OAAOA,KAAI;AACrC,UAAI,IAAI,WAAW,IAAK,uBAAsB;AAC9C,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,aAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC;AAAA,IAC5C;AAAA;AAAA,IAGA,MAAM,wBAAwB,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AACpD,aAAO,+BAA+B,KAAK,QAAQ,EAAE,MAAM,GAAG;AAAA,QAC5D;AAAA,QACA,iBAAiB,MAAM;AAAE,gCAAsB;AAAA,QAAM;AAAA,QACrD,OAAAD;AAAA,QACA,KAAK,CAAC,MAAM,QAAQ,KAAK,iBAAgB,oBAAI,KAAK,GAAE,YAAY,CAAC,KAAK,CAAC,EAAE;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,gBAAgB,CAAC,QAAQ,YAAY,sBAAsB,KAAK,QAAQ,SAAS,MAAM;AAAE,4BAAsB;AAAA,IAAM,CAAC;AAAA;AAAA,IAEtH,MAAM,iBAAiB,QAAQ;AAC7B,aAAO,wBAAwB,SAAS,QAAQ,MAAM;AAAE,8BAAsB;AAAA,MAAM,CAAC;AAAA,IACvF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,qBAAqB,OAAO;AAChC,aAAO,4BAA4B,KAAK,OAAO,MAAM;AAAE,8BAAsB;AAAA,MAAM,CAAC;AAAA,IACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,cAAc,WAAW;AAC7B,YAAM,OAAO,yBAAyB,SAAS;AAC/C,YAAM,MAAM,MAAM,IAAI,QAAQ,4BAA4B,MAAM;AAAA,QAC9D,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,UAAI,CAAC,IAAI,IAAI;AAQX,YAAI,SAAS;AACb,YAAI;AACF,gBAAME,QAAO,MAAM,IAAI,KAAK;AAC5B,cAAI,MAAM,QAAQA,OAAM,WAAW,KAAKA,MAAK,YAAY,SAAS,GAAG;AACnE,qBAAS,sBAAsBA,MAAK,YAAY,KAAK,IAAI,CAAC;AAAA,UAC5D;AAAA,QACF,QAAQ;AAAA,QAAuD;AAC/D,cAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,GAAG,MAAM,EAAE;AAAA,MACjE;AACA,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA,IAEA,MAAM,gBAAgB,EAAE,WAAW,IAAI,CAAC,GAAG;AACzC,YAAM,QAAQ,aAAa,gBAAgB,mBAAmB,UAAU,CAAC,KAAK;AAC9E,YAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,KAAK,IAAI,QAAW;AAAA,QACvE,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,QAAQ,MAAM,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IACxD;AAAA,IAEA,MAAM,kBAAkB,EAAE,UAAAH,WAAU,YAAY,sBAAAI,uBAAsB,mBAAAC,oBAAmB,aAAa,GAAG;AACvG,YAAM,OAAO,EAAE,WAAWL,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,UAAII,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,YAAM,MAAM,MAAM,QAAQ,QAAQ,+BAA+B,IAAI;AACrE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,MAAM;AACrB,aAAO,UAAU,OAAO,OAAO,cAAc,YAAY,OAAO,YAC5D,EAAE,GAAG,QAAQ,UAAU,OAAO,UAAU,IACxC;AAAA,IACN;AAAA,IAEA,MAAM,sBAAsB,UAAU,EAAE,UAAAL,WAAU,YAAY,sBAAAI,uBAAsB,mBAAAC,oBAAmB,cAAc,QAAQ,OAAO,GAAG;AACrI,YAAM,OAAO,EAAE,WAAWL,WAAU,OAAO;AAC3C,UAAI,WAAY,MAAK,cAAc;AACnC,UAAII,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,UAAI,OAAQ,MAAK,SAAS;AAC1B,YAAM,MAAM,MAAM,QAAQ,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,aAAa,IAAI;AACzG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,UAAU;AAAA,IACzB;AAAA;AAAA,IAGA,MAAM,qBAAqB,EAAE,WAAW,OAAO,WAAW,OAAO,OAAO,KAAK,IAAI,CAAC,GAAG;AACnF,aAAO,uBAAuB,EAAE,KAAK,SAAS,UAAU,UAAU,KAAK,CAAC;AAAA,IAC1E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,kBAAkB;AACtB,UAAI;AACF,cAAM,MAAM,MAAM,QAAQ,OAAO,8BAA8B;AAC/D,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,eAAO,MAAM,gBAAgB;AAAA,MAC/B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AChXA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAEhG,SAAS,aAAa,OAAO;AAC3B,SAAO,MAAM,QAAQ,wBAAwB,MAAM;AACrD;AAGO,SAAS,8BAA8B,KAAK,MAAM,CAAC,GAAG;AAC3D,MAAI,QAAQ,OAAO,OAAO,EAAE,EACzB,QAAQ,kDAAkD,YAAY,EACtE,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,sEAAsE,gBAAgB;AACjG,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,CAAC,6CAA6C,KAAK,IAAI,EAAG;AAC9D,UAAM,OAAO,OAAO,UAAU,EAAE;AAChC,QAAI,KAAK,SAAS,EAAG;AACrB,YAAQ,MAAM,QAAQ,IAAI,OAAO,aAAa,IAAI,GAAG,IAAI,GAAG,YAAY;AAAA,EAC1E;AACA,UAAQ,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACzC,MAAI,MAAM,UAAU,qBAAsB,QAAO;AACjD,SAAO,GAAG,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC;AACpD;AAEA,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAM,WAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;AAEO,SAAS,mBAAmB,MAAM;AAAA,EACvC,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AAAA,EACb,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI,SAAS,YAAa,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAChF,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,MAAM,EAAE,UAAU,aAAa,KAAK,UAAU,WAAW,CAAC;AAAA,EAC9F,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,CAAC;AAAA,MACP,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG;AAAA,IACnG;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AACrE,MAAI,uBAAuB,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,CAAC,EAAE;AACtE,QAAM,SAASA,OAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,IAClD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACD,QAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,QAAM,SAAS;AAAA,IACb,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAQ,KAAI,8BAA8B,MAAM,EAAE;AACtD,SAAO,EAAE,IAAI,WAAW,GAAG,QAAQ,SAAS,QAAQ,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC1F;;;AC/HA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC;AAAA,EACE,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,aAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,cAAAC;AAAA,EACA,UAAAC;AAAA,EACA,iBAAAC;AAAA,OACK;AACP,SAAS,UAAU,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,UAAS,OAAAC,YAAW;AACnE,SAAS,aAAAC,kBAAiB;;;ACZ1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,SAAS,OAAO,WAAAC,gBAAe;AACxC,SAAS,qBAAqB;;;ACH9B,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B;AAAA,EACE,cAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY,MAAM,UAAU,SAAS,KAAK,SAAAC,cAAa;AAEhE,IAAM,4BAA4B;AAClC,IAAM,kBAAkB;AACjB,IAAM,2BAA2B;AAExC,SAAS,UAAU,OAAO;AACxB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,SAAS;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,EAChG;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAO;AAC5B,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,SAAS,iBAAiB,OAAO,KAAK;AACpC,MAAI,OAAO,UAAU,SAAU,SAAQ,QAAQ,OAAO,GAAG,OAAO;AAChE,SAAO,OAAO,cAAc,KAAK,MAAM,QAAQ,SAAS;AAC1D;AAEO,SAAS,cAAc,OAAO;AACnC,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,OAAO,MAAM,mBAAmB,cAAc,MAAM,eAAe,EAAG,QAAO;AACjF,MAAI,MAAM,eAAe,UAAa,MAAM,eAAe,QAAQ,MAAM,eAAe,EAAG,QAAO;AAClG,SAAO,CAAC,kBAAkB,iBAAiB,YAAY,EACpD,KAAK,CAAC,QAAQ,iBAAiB,MAAM,GAAG,GAAG,yBAAyB,CAAC;AAC1E;AAEO,SAAS,yBAAyB,QAAQ,QAAQ;AACvD,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,EAAG,QAAO;AAC1D,MAAI,OAAO,KAAK,CAAC,UAAU,UAAU,IAAI,MAAM,EAAE,EAAG,QAAO;AAC3D,QAAM,WAAW,OAAO,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,CAAC;AAC7F,SAAO,SAAS,WAAW,KAAK,SAAS,SAAS,MAAM;AAC1D;AAEO,SAAS,yBAAyB,OAAO,WAAW,EAAE,IAAI,SAAS,MAAM,MAAM,GAAG;AACvF,SAAO,OAAO,aAAa,SACzB,CAAC,yBAAyB,MAAM,IAAI,SAAS,EAAE,KAC5C,CAAC,yBAAyB,MAAM,KAAK,SAAS,IAAI;AAEzD;AAEA,SAAS,gBAAgB,MAAM,WAAW,OAAO;AAC/C,QAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,QAAQ,MAAO,CAAC,IAAI,WAAW,KAAK,GAAG,EAAE,KAAK,QAAQ,QAAQ,CAAC,WAAW,GAAG,EAAI;AACrF,QAAM,IAAI,MAAM,kBAAkB,KAAK,2BAA2B;AACpE;AAEA,SAAS,sBAAsB,MAAM,WAAW;AAC9C,QAAM,WAAW,QAAQ,OAAO,aAAa,EAAE,CAAC;AAChD,kBAAgB,MAAM,UAAU,eAAe;AAC/C,SAAO;AACT;AAEO,SAAS,yBAAyB,MAAM;AAAA,EAC7C,WAAW;AAAA,EAAc,MAAM,QAAQ;AAAA,EAAK,WAAW,QAAQ;AACjE,IAAI,CAAC,GAAG;AACN,MAAI,aAAa,QAAS,QAAO,CAAC;AAClC,QAAM,aAAa,OAAO,IAAI,cAAc,IAAI,cAAc,EAAE;AAChE,MAAI,CAACA,OAAM,WAAW,UAAU,KAAKA,OAAM,UAAU,UAAU,MAAM,YAAY;AAC/E,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAWA,OAAM,KAAK,YAAY,UAAU;AAClD,QAAM,aAAaA,OAAM,KAAK,UAAU,qBAAqB,QAAQ,gBAAgB;AACrF,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACX,QAAM,SAAS,SAAS,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AAAA,IACD,KAAK;AAAA,IACL,UAAU;AAAA,IACV,KAAK,EAAE,YAAY,YAAY,qBAAqBA,OAAM,QAAQ,IAAI,EAAE;AAAA,IACxE,aAAa;AAAA,EACf,CAAC;AACD,SAAO,OAAO,UAAU,EAAE,EAAE,MAAM,QAAQ,EAAE,OAAO,OAAO,EACvD,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC;AACpD;AAEA,SAAS,uBAAuB,QAAQ,UAAU;AAChD,QAAM,aAAa,gBAAgB,MAAM;AACzC,MAAI,YAAY,aAAa,UAAU,SAAU,QAAO;AACxD,MAAI,OAAO,YAAY,aAAa,YAAY,CAAC,WAAW,SAAS,WAAW,OAAO,GAAG;AACxF,WAAO;AAAA,EACT;AACA,QAAM,WAAW,WAAW,SAAS,MAAM,QAAQ,MAAM,EAAE,WAAW,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AACjG,QAAM,oBAAoB,oBAAI,IAAI;AAAA,IAChC,OAAO,SAAS,YAAY,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AAAA,IAChD,oBAAoB,SAAS,OAAO;AAAA,EACtC,CAAC;AACD,MAAI,kBAAkB,IAAI,QAAQ,EAAG,YAAW,WAAW,SAAS;AACpE,SAAO;AACT;AAEA,SAAS,aAAa,MAAM,eAAe;AACzC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GAAG;AAC5D,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,MAAI,KAAK,oBAAoB,cAAc,gBAAgB,yBAAyB;AAClF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,MAAI,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG;AACvF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,WAAW,cAAc,gBAAgB;AAC/C,QAAM,SAAS,OAAO,YAAY,OAAO,QAAQ,KAAK,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;AAC7F,QAAM,eAAe,OAAO,KAAK,QAAQ,EAAE,KAAK;AAChD,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,KAAK;AAC5C,MAAI,cAAc,UAAU,MAAM,cAAc,YAAY,GAAG;AAC7D,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,aAAW,OAAO,cAAc;AAC9B,UAAM,SAAS,QAAQ,kBACnB,uBAAuB,OAAO,GAAG,GAAG,SAAS,GAAG,CAAC,IACjD,OAAO,GAAG;AACd,QAAI,cAAc,MAAM,MAAM,cAAc,SAAS,GAAG,CAAC,GAAG;AAC1D,YAAM,IAAI,MAAM,gDAAgD,GAAG,EAAE;AAAA,IACvE;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,SAAS;AAC5B;AAEA,SAAS,cAAcC,OAAM,cAAc,OAAO,OAAO;AACvD,MAAI,CAAC,MAAM,OAAOA,KAAI,EAAG,OAAM,IAAI,MAAM,kBAAkB,KAAK,UAAU;AAC1E,QAAM,QAAQ,MAAM,MAAMA,KAAI;AAC9B,MAAI,cAAc,KAAK,KAAK,MAAM,eAAeA,OAAM,KAAK,GAAG;AAC7D,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB;AAAA,EAC9D;AACA,MAAI,iBAAiB,eAAe,CAAC,MAAM,YAAY,GAAG;AACxD,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB;AAAA,EAC9D;AACA,MAAI,iBAAiB,UAAU,CAAC,MAAM,OAAO,GAAG;AAC9C,UAAM,IAAI,MAAM,kBAAkB,KAAK,wBAAwB;AAAA,EACjE;AACA,MAAI,iBAAiB,UAAU,OAAO,MAAM,KAAK,IAAI,GAAG;AACtD,UAAM,IAAI,MAAM,kBAAkB,KAAK,gBAAgB;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,aAAa,gBAAgB,UAAU,OAAO;AAC7E,QAAM,UAAU,CAAC;AACjB,MAAI,YAAY;AAChB,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,cAAc,GAAG;AACzD,UAAMA,QAAO,QAAQ,aAAa,GAAG;AACrC,oBAAgB,aAAaA,OAAM,cAAc;AACjD,UAAM,aAAa,yBAAyB,OAAO,QAAQ;AAC3D,QAAI,YAAY;AACd,cAAQ,KAAK,GAAG;AAChB,UAAI,MAAM,OAAOA,KAAI,EAAG,OAAM,IAAI,MAAM,sDAAsD,GAAG,EAAE;AACnG;AAAA,IACF;AACA,kBAAcA,OAAM,aAAa,OAAO,qBAAqB,GAAG,EAAE;AAClE,iBAAa;AAAA,EACf;AACA,SAAO,EAAE,WAAW,SAAS,QAAQ,KAAK,EAAE;AAC9C;AAEA,SAAS,WAAW,MAAMA,OAAM,OAAO,WAAW,IAAI;AACpD,MAAI,SAAS,IAAK,QAAO,KAAMA,KAAI;AAAA;AACnC,SAAO,KAAMA,KAAI,IAAK,MAAM,IAAI,IAAK,QAAQ;AAAA;AAC/C;AAEO,SAAS,qBAAqB,iBAAiB,QAAQ,CAAC,GAAG;AAChE,QAAM,MAAM;AAAA,IACV,QAAQF;AAAA,IACR,OAAO;AAAA,IACP,SAAS,CAACE,UAAS,YAAYA,OAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IAC5D,UAAU;AAAA,IACV,gBAAgB,MAAM;AAAA,IACtB,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL;AACA,QAAM,OAAO,QAAQ,eAAe;AACpC,gBAAc,MAAM,aAAa,KAAK,mBAAmB;AACzD,QAAM,WAAW,IAAI,kBAAkB,IAAI;AAC3C,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,OAAM,IAAI,MAAM,yDAAyD;AACvG,MAAI,SAAS,SAAS,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAE/F,MAAI,YAAY;AAChB,MAAI,iBAAiB;AACrB,MAAI,YAAY;AAChB,QAAM,UAAU,CAAC;AACjB,WAAS,KAAK,UAAU,cAAc;AACpC,eAAW,SAAS,IAAI,QAAQ,QAAQ,GAAG;AACzC,YAAM,gBAAgB,eAAe,GAAG,YAAY,IAAI,MAAM,IAAI,KAAK,MAAM;AAC7E,UAAI,kBAAkB,qBAAsB;AAC5C,YAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI;AAC1C,sBAAgB,MAAM,OAAO,YAAY;AACzC,YAAM,QAAQ,IAAI,MAAM,KAAK;AAC7B,UAAI,cAAc,KAAK,KAAK,IAAI,eAAe,OAAO,KAAK,GAAG;AAC5D,cAAM,IAAI,MAAM,iDAAiD,aAAa,EAAE;AAAA,MAClF;AACA,UAAI,MAAM,YAAY,GAAG;AACvB,0BAAkB;AAClB,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,eAAe,MAAM,CAAC;AACtD,aAAK,OAAO,aAAa;AAAA,MAC3B,WAAW,MAAM,OAAO,GAAG;AACzB,YAAI,OAAO,MAAM,KAAK,IAAI,GAAG;AAC3B,gBAAM,IAAI,MAAM,mDAAmD,aAAa,EAAE;AAAA,QACpF;AACA,qBAAa;AACb,qBAAa,OAAO,MAAM,IAAI;AAC9B,cAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,IAAI,SAAS,KAAK,CAAC,EAAE,OAAO,KAAK;AAC5E,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,eAAe,OAAO,OAAO,CAAC;AAAA,MAChE,OAAO;AACL,cAAM,IAAI,MAAM,kDAAkD,aAAa,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACA,OAAK,MAAM,EAAE;AACb,UAAQ,KAAK,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,QAAM,WAAW,WAAW,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,QACjD,IAAI,CAAC,UAAU,WAAW,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,EAC5E,KAAK,EAAE;AACV,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,WAAW,QAAQ,EAAE,OAAO,UAAU,MAAM,EAAE,OAAO,KAAK;AAAA,IAClE,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,+BAA+B,OAAO,WAAW,QAAQ;AAAA,IACzD,qBAAqB;AAAA,IACrB,uBAAuB;AAAA,EACzB;AACF;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA,kBAAkB,KAAK,aAAa,cAAc;AAAA,EAClD,kBAAkB,KAAK,aAAa,mBAAmB;AAAA,EACvD;AAAA,EACA,QAAQ,CAAC;AACX,GAAG;AACD,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,QAAQ,eAAe;AACvC,QAAM,WAAW,QAAQ,eAAe;AACxC,MAAI,YAAY,QAAQ,SAAS,cAAc,KAAK,aAAa,QAAQ,SAAS,mBAAmB,GAAG;AACtG,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,MAAM;AAAA,IACV,QAAQF;AAAA,IACR,OAAO;AAAA,IACP,UAAU;AAAA,IACV,gBAAgB,MAAM;AAAA,IACtB,GAAG;AAAA,EACL;AACA,gBAAc,UAAU,QAAQ,KAAK,cAAc;AACnD,QAAM,OAAO,KAAK,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC;AACtD,QAAM,EAAE,SAAS,IAAI,aAAa,MAAM,aAAa;AACrD,QAAM,WAAW,EAAE,IAAI,cAAc,SAAS,IAAI,MAAM,cAAc,SAAS,KAAK;AACpF,QAAM,WAAW,wBAAwB,SAAS,UAAU,UAAU,GAAG;AACzE,QAAM,kBAAkB,CAAC,GAAG,cAAc,gBAAgB,oCAAoC,EAAE,KAAK;AACrG,MAAI,cAAc,SAAS,OAAO,MAAM,cAAc,eAAe,GAAG;AACtE,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,SAAS,cAAc,OAAO,KAAK,QAAQ,EAAE,SAAS,SAAS,QAAQ,QAAQ;AACjF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,OAAO,qBAAqB,SAAS,KAAK;AAChD,MAAI,cAAc,IAAI,MAAM,cAAc,cAAc,cAAc,GAAG;AACvE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO,EAAE,IAAI,MAAM,cAAc,OAAO,KAAK,QAAQ,EAAE,QAAQ,GAAG,UAAU,KAAK;AACnF;;;ADrRA,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAC5C,IAAM,mCAAmCG;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,WAAW,OAAO,OAAO;AAAA,EAC7B,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,eAAe;AAAA,EACf,eAAe;AAAA,EACf,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,uBAAuB;AACzB,CAAC;AAED,IAAM,SAAS;AACf,IAAM,YAAY;AAElB,SAASC,WAAU,OAAO;AACxB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAIA,UAAS;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAKA,WAAU,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,EAChG;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAO;AAC9B,SAAOC,YAAW,QAAQ,EAAE,OAAO,GAAG,KAAK,UAAUD,WAAU,KAAK,CAAC,CAAC;AAAA,GAAM,MAAM,EAAE,OAAO,KAAK;AAClG;AAEA,SAAS,YAAY,QAAQ,UAAU,OAAO;AAC5C,MAAI,WAAW,SAAU,OAAM,IAAI,MAAM,yBAAyB,KAAK,WAAW;AACpF;AAEA,SAAS,sBAAsB,OAAO;AACpC,SAAO,yBAAyB,OAAO,EAAE,IAAI,SAAS,MAAM,MAAM,CAAC;AACrE;AAEO,SAAS,6BAA6B,OAAO;AAClD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,cAAY,MAAM,gBAAgB,GAAG,gBAAgB;AACrD,cAAY,MAAM,kBAAkB,SAAS,iBAAiB,IAAI;AAClE,cAAY,MAAM,SAAS,MAAM,SAAS,aAAa,cAAc;AACrE,cAAY,MAAM,SAAS,SAAS,SAAS,SAAS,iBAAiB;AACvE,cAAY,MAAM,SAAS,UAAU,SAAS,UAAU,UAAU;AAClE,cAAY,MAAM,SAAS,aAAa,SAAS,YAAY,aAAa;AAC1E,cAAY,MAAM,SAAS,YAAY,SAAS,WAAW,mBAAmB;AAC9E,cAAY,MAAM,SAAS,gBAAgB,SAAS,eAAe,gBAAgB;AACnF,cAAY,MAAM,SAAS,iBAAiB,SAAS,eAAe,YAAY;AAChF,cAAY,MAAM,SAAS,UAAU,SAAS,SAAS,UAAU;AACjE,cAAY,MAAM,SAAS,mBAAmB,IAAI,mBAAmB;AACrE,cAAY,MAAM,SAAS,cAAc,QAAQ,mBAAmB;AACpE,cAAY,MAAM,SAAS,gBAAgB,SAAS,qBAAqB;AAEzE,cAAY,MAAM,UAAU,IAAI,SAAS,kBAAkB;AAC3D,cAAY,MAAM,UAAU,MAAM,OAAO,cAAc;AACvD,cAAY,MAAM,UAAU,qBAAqB,YAAY,qBAAqB;AAClF,MAAI,CAAC,eAAe,KAAK,OAAO,MAAM,UAAU,8BAA8B,EAAE,CAAC,KAC5E,MAAM,UAAU,8BAA8B,WAAW;AAC5D,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ;AAAA,IAC3C,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,OAAO;AAAA,IACP,MAAM;AAAA,IACN,6BAA6B;AAAA,IAC7B,kBAAkB;AAAA,IAClB,mEAAmE;AAAA,EACrE,CAAC,EAAG,aAAY,MAAM,mBAAmB,GAAG,GAAG,UAAU,oBAAoB,GAAG,EAAE;AAClF,cAAY,MAAM,kBAAkB,yBAAyB,SAAS,UAAU,iBAAiB;AAEjG,QAAM,OAAO,MAAM;AACnB,MAAI,CAAC,MAAM,YAAY,OAAO,KAAK,aAAa,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG;AACxF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,cAAY,KAAK,yBAAyB,GAAG,kBAAkB;AAC/D,cAAY,KAAK,oBAAoB,SAAS,kBAAkB,oBAAoB;AACpF,cAAY,KAAK,0BAA0B,SAAS,wBAAwB,kBAAkB;AAC9F,cAAY,KAAK,aAAa,SAAS,YAAY,aAAa;AAChE,cAAY,KAAK,uBAAuB,SAAS,YAAY,iBAAiB;AAC9E,cAAY,KAAK,sBAAsB,SAAS,oBAAoB,gBAAgB;AACpF,cAAY,KAAK,mCAAmC,SAAS,qBAAqB,iBAAiB;AAEnG,QAAM,UAAU,OAAO,QAAQ,KAAK,QAAQ;AAC5C,cAAY,QAAQ,QAAQ,SAAS,YAAY,mBAAmB;AACpE,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,CAAC,IAAI,WAAW,eAAe,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM,UAAU,GAAG,MAAM,OAClF,IAAI,MAAM,GAAG,EAAE,SAAS,IAAI,GAAG;AAClC,YAAM,IAAI,MAAM,kDAAkD,GAAG,EAAE;AAAA,IACzE;AACA,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,SAAS,MAAM;AAC9D,YAAM,IAAI,MAAM,oDAAoD,GAAG,EAAE;AAAA,IAC3E;AACA,QAAI,CAAC,OAAO,KAAK,OAAO,MAAM,aAAa,EAAE,CAAC,GAAG;AAC/C,YAAM,IAAI,MAAM,yDAAyD,GAAG,EAAE;AAAA,IAChF;AACA,QAAI,CAAC,OAAO,MAAM,YAAY,EAAE,EAAE,WAAW,SAAS,QAAQ,GAAG;AAC/D,YAAM,IAAI,MAAM,iEAAiE,GAAG,EAAE;AAAA,IACxF;AACA,QAAI,MAAM,qBAAqB,MAAM;AACnC,YAAM,IAAI,MAAM,6DAA6D,GAAG,EAAE;AAAA,IACpF;AAAA,EACF;AACA,QAAM,SAAS,KAAK,SAAS,gCAAgC;AAC7D,cAAY,QAAQ,SAAS,SAAS,SAAS,2BAA2B;AAC1E,cAAY,QAAQ,WAAW,SAAS,WAAW,6BAA6B;AAChF,cAAY,gBAAgB,KAAK,QAAQ,GAAG,SAAS,wBAAwB,2BAA2B;AAExG,QAAM,UAAU,QAAQ,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,sBAAsB,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,MAAM,GAAG,EAAE,KAAK;AACrG,QAAM,kBAAkB,CAAC,GAAI,KAAK,wCAAwC,CAAC,CAAE,EAAE,KAAK;AACpF,cAAY,KAAK,UAAU,eAAe,GAAG,KAAK,UAAU,OAAO,GAAG,0BAA0B;AAChG,cAAY,QAAQ,SAAS,QAAQ,QAAQ,SAAS,qBAAqB,yBAAyB;AAEpG,QAAM,OAAO,MAAM;AACnB,cAAY,MAAM,WAAW,SAAS,eAAe,gBAAgB;AACrE,MAAI,CAAC,UAAU,KAAK,OAAO,MAAM,UAAU,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;AAC1G,cAAY,KAAK,QAAQ,SAAS,YAAY,aAAa;AAC3D,cAAY,KAAK,YAAY,SAAS,eAAe,iBAAiB;AACtE,cAAY,KAAK,iBAAiB,SAAS,oBAAoB,sBAAsB;AACrF,cAAY,KAAK,YAAY,SAAS,eAAe,iBAAiB;AACtE,cAAY,KAAK,+BAA+B,SAAS,uBAAuB,0BAA0B;AAC1G,cAAY,KAAK,qBAAqB,GAAG,oBAAoB;AAC7D,cAAY,KAAK,uBAAuB,GAAG,qBAAqB;AAChE,SAAO;AACT;AAEO,SAAS,yBAAyB,OAAO,kCAAkC;AAChF,SAAO,6BAA6B,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC,CAAC;AAC5E;AAEO,SAAS,mCAAmC,SAAS;AAC1D,QAAM,gBAAgB,6BAA6B,SAAS,iBAAiB,yBAAyB,CAAC;AACvG,SAAO,qBAAqB,EAAE,GAAG,SAAS,cAAc,CAAC;AAC3D;AAEA,IAAI,QAAQ,KAAK,CAAC,KAAKH,SAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,cAAc,YAAY,GAAG,GAAG;AAClF,2BAAyB,QAAQ,KAAK,CAAC,IAAIA,SAAQ,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAS;AAC/E,UAAQ,OAAO,MAAM,sCAAsC;AAC7D;;;AExKA,SAAS,cAAAI,aAAY,kBAAkB;AACvC;AAAA,EACE;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,WAAAC,UAAS,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,gBAAe;AAE7D,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,eAAe;AACrB,IAAM,aAAa;AACnB,IAAM,UAAU;AAChB,IAAM,YAAYF,MAAK,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAC9E,IAAM,iBAAiBA,MAAK,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAClG,IAAM,cAAcA,MAAK,gBAAgB,cAAc,UAAU,cAAc;AAC/E,IAAM,wBAAwBA,MAAK,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AACpH,IAAM,gBAAgB;AAEtB,SAAS,OAAO,QAAQ,WAAW;AACjC,QAAM,MAAMC,UAASC,SAAQ,MAAM,GAAGA,SAAQ,SAAS,CAAC;AACxD,SAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAACH,YAAW,GAAG;AAChE;AASA,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAEpB,SAAS,mBAAmB,EAAE,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI,CAAC,GAAG;AAC5G,MAAI,aAAa,SAAS;AACxB,UAAM,UAAU,OAAO,IAAI,WAAW,EAAE,EAAE,KAAK;AAC/C,WAAO,WAAWA,YAAW,OAAO,IAAIC,MAAK,SAAS,gBAAgB,kBAAkB,IAAI;AAAA,EAC9F;AACA,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,aAAa,UAAU;AACzB,WAAOA,MAAK,MAAM,WAAW,uBAAuB,gBAAgB,kBAAkB;AAAA,EACxF;AACA,QAAM,MAAM,OAAO,IAAI,mBAAmB,EAAE,EAAE,KAAK;AACnD,QAAM,OAAO,OAAOD,YAAW,GAAG,IAAI,MAAMC,MAAK,MAAM,SAAS;AAChE,SAAOA,MAAK,MAAM,gBAAgB,kBAAkB;AACtD;AAWO,SAAS,mBAAmB,MAAM,QAAQ,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,GAAG;AAC7E,QAAM,QAAQ,OAAO,IAAI,0BAA0B,EAAE,EAAE,KAAK;AAC5D,MAAI,MAAO,QAAOD,YAAW,KAAK,IAAIG,SAAQ,KAAK,IAAI;AACvD,QAAM,UAAU,mBAAmB,EAAE,UAAU,KAAK,KAAK,CAAC;AAC1D,SAAO,UAAUA,SAAQ,OAAO,IAAI;AACtC;AAEO,SAAS,eAAe,MAAM;AACnC,SAAO,UAAUT,YAAW,QAAQ,EAAE,OAAOG,cAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAGO,SAAS,gBAAgB,MAAM;AACpC,QAAM,SAASH,YAAW,QAAQ;AAClC,QAAM,QAAQ,CAAC;AACf,QAAM,QAAQ,CAAC,WAAW,SAAS,OAAO;AACxC,UAAM,WAAWE,WAAU,SAAS;AACpC,QAAI,SAAS,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC3F,QAAI,CAAC,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACnF,eAAW,QAAQE,aAAY,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG;AACxG,YAAM,WAAWG,MAAK,WAAW,IAAI;AACrC,YAAM,eAAe,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK;AACpD,YAAM,OAAOL,WAAU,QAAQ;AAC/B,UAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AACvF,UAAI,KAAK,YAAY,EAAG,OAAM,UAAU,YAAY;AAAA,eAC3C,KAAK,OAAO,KAAK,iBAAiB,cAAe,OAAM,KAAK,EAAE,UAAU,cAAc,MAAM,KAAK,KAAK,CAAC;AAAA,eACvG,CAAC,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,0CAA0C;AAAA,IACrF;AAAA,EACF;AACA,QAAM,IAAI;AACV,QAAM,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,EAAE,YAAY,GAAG,OAAO,KAAK,EAAE,YAAY,CAAC,CAAC;AAC7F,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,OAAO,KAAK,KAAK,cAAc,MAAM;AACvD,WAAO,OAAO,GAAG,UAAU,MAAM,GAAG;AACpC,WAAO,OAAO,SAAS;AACvB,WAAO,OAAO,IAAI,KAAK,IAAI,GAAG;AAC9B,WAAO,OAAOC,cAAa,KAAK,QAAQ,CAAC;AACzC,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO,UAAU,OAAO,OAAO,QAAQ,CAAC;AAC1C;AAEO,SAAS,gBAAgB,MAAM,OAAO;AAC3C,YAAUE,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,OAAOE,MAAKF,SAAQ,IAAI,GAAG,IAAI,WAAW,CAAC,MAAM;AACvD,QAAM,KAAK,SAAS,MAAM,MAAM,GAAK;AACrC,MAAI;AACF,kBAAc,IAAI,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AAC/D,cAAU,EAAE;AAAA,EACd,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACA,MAAI;AACF,eAAW,MAAM,IAAI;AAGrB,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI;AACF,cAAM,WAAW,SAASA,SAAQ,IAAI,GAAG,GAAG;AAC5C,YAAI;AAAE,oBAAU,QAAQ;AAAA,QAAG,UAAE;AAAU,oBAAU,QAAQ;AAAA,QAAG;AAAA,MAC9D,QAAQ;AAAA,MAAkD;AAAA,IAC5D;AAAA,EACF,UAAE;AACA,WAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EAC9B;AACF;AAEO,SAAS,eAAe,aAAa;AAC1C,QAAM,OAAOE,MAAK,aAAa,cAAc;AAC7C,MAAI,CAACN,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,QAAQ,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC;AACnD,WAAO,OAAO,mBAAmB,IAAI,QAAQ;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,aAAa,QAAQ;AAC7C,MAAI,CAAC,WAAW,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACvE,QAAM,WAAWI,MAAK,aAAa,SAAS,MAAM;AAClD,SAAO;AAAA,IACL;AAAA,IACA,OAAOA,MAAK,UAAU,SAAS;AAAA,IAC/B,YAAYA,MAAK,UAAU,cAAc;AAAA,IACzC,aAAaA,MAAK,UAAU,WAAW;AAAA,IACvC,kBAAkBA,MAAK,UAAU,qBAAqB;AAAA,IACtD,UAAUA,MAAK,UAAU,aAAa;AAAA,EACxC;AACF;AAEA,SAAS,YAAY,QAAQ;AAC3B,SAAO,UACF,WAAW,KAAK,OAAO,OAAO,KAC9B,WAAW,KAAK,OAAO,OAAO,KAC9B,aAAa,KAAK,OAAO,SAAS,KAClC,aAAa,KAAK,OAAO,YAAY,KACrC,aAAa,KAAK,OAAO,iBAAiB,KAC1C,aAAa,KAAK,OAAO,WAAW;AAC3C;AAEO,SAAS,aAAa,aAAa,QAAQ;AAChD,MAAI,CAAC,YAAY,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACpF,QAAM,QAAQ,UAAU,aAAa,OAAO,OAAO;AACnD,MAAI;AACF,UAAM,WAAW,KAAK,MAAMJ,cAAa,MAAM,UAAU,MAAM,CAAC;AAChE,UAAM,MAAM,KAAK,MAAMA,cAAa,MAAM,aAAa,MAAM,CAAC;AAC9D,UAAM,WAAW;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,SAAS,OAAO;AAAA,MAChB,WAAW,OAAO;AAAA,MAClB,cAAc,OAAO;AAAA,MACrB,mBAAmB,OAAO;AAAA,MAC1B,aAAa,OAAO;AAAA,IACtB;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,WAAW,GAAG,MAAM,MAAO,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,GAAG,YAAY;AAAA,IACxF;AACA,QAAI,UAAU,mBAAmB,KAAK,KAAK,SAAS,uBAAuB,KAAK,YAAY,OAAO,SAAS;AAC1G,aAAO,EAAE,IAAI,OAAO,QAAQ,4BAA4B;AAAA,IAC1D;AACA,QAAID,WAAU,MAAM,KAAK,EAAE,eAAe,KAAKA,WAAU,MAAM,UAAU,EAAE,eAAe,KACrFA,WAAU,MAAM,gBAAgB,EAAE,eAAe,GAAG;AACvD,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,UAAU,CAAC,KAC3G,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,gBAAgB,CAAC,GAAG;AAClE,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO,aAAc,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AAC3G,QAAI,eAAe,MAAM,UAAU,MAAM,OAAO,kBAAmB,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAC1H,QAAI,gBAAgB,MAAM,QAAQ,MAAM,OAAO,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AACrH,WAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,EACrF;AACF;AAEO,SAAS,kBAAkB,aAAa,UAAU,OAAO,SAAS,IAAI;AAC3E,MAAI,CAAC,aAAa,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AAC5E,kBAAgBK,MAAK,aAAa,gBAAgB,GAAG,QAAQ,OAAO,GAAG;AAAA,IACrE,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX;AAAA,IACA,QAAQ,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,IACnC,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC,CAAC;AACH;AAEO,SAAS,aAAa,aAAa,QAAQ,QAAQ;AACxD,MAAI,CAAC,YAAY,MAAM,EAAG,OAAM,IAAI,MAAM,0CAA0C;AACpF,MAAI,CAAC,aAAa,KAAK,OAAO,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AACnF,MAAI,CAAC,QAAQ,KAAK,OAAO,OAAO,wBAAwB,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACvH,QAAM,YAAY,aAAa,aAAa,MAAM;AAClD,MAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,yCAAyC,UAAU,MAAM,EAAE;AAC9F,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,6CAA6C;AACnF,QAAM,UAAU;AAAA,IACd,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB;AAAA,IACA,UAAU,YAAY,SAAS,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC1D,SAAS;AAAA,MACP,WAAW,OAAO;AAAA,MAClB,WAAW,OAAO,OAAO,YAAY,EAAE;AAAA,MACvC,aAAa,OAAO,OAAO,cAAc,EAAE;AAAA,MAC3C,wBAAwB,OAAO;AAAA,MAC/B,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,cAAc;AAAA,IAChB;AAAA,EACF;AAGA,oBAAkB,aAAa,OAAO,UAAU,YAAY,GAAG,OAAO,OAAO,IAAI,OAAO,SAAS,EAAE;AACnG,kBAAgBA,MAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,SAAO;AACT;AAEO,SAAS,+BAA+B,aAAa,UAAU;AACpE,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,SAAS,0BAA0B,EAAE;AACrE,MAAI,QAAQ,KAAK,OAAO,EAAG,QAAO;AAClC,SAAO,QAAQ,KAAK,OAAO,YAAY,EAAE,CAAC,IAAI,WAAW;AAC3D;AAEO,SAAS,sBAAsB,aAAa,SAAS,QAAQ;AAClE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,IAAI,GAAG,OAAO,QAAQ,QAAQ,gBAAgB,CAAC,CAAC,IAAI;AAC1E,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,SAAS,EAAE,GAAG,QAAQ,SAAS,cAAc,UAAU,YAAY,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE;AAAA,EAClG;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,WAAW,QAAQ,KAAK,MAAM,EAAE;AACvG,SAAO;AACT;AA0CO,SAAS,wBAAwB,EAAE,aAAa,UAAAG,WAAU,QAAQ,GAAG;AAC1E,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,CAAC,SAAS,WAAW,CAAC,YAAY,QAAQ,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAC3G,QAAM,YAAY,aAAa,aAAa,QAAQ,MAAM;AAC1D,MAAI,CAAC,UAAU,GAAI,QAAO;AAC1B,MAAI;AACF,QAAI,aAAaA,SAAQ,MAAM,aAAa,UAAU,MAAM,UAAU,GAAG;AACvE,aAAO,EAAE,IAAI,OAAO,QAAQ,qDAAqD;AAAA,IACnF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,4CAA4C;AAAA,EAC1E;AACA,MAAI,YAAY,QAAQ,OAAO,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,sCAAsC;AAC1G,SAAO,EAAE,IAAI,MAAM,SAAS,QAAQ,QAAQ,QAAQ,OAAO,UAAU,MAAM;AAC7E;AAEO,SAAS,mBAAmB,aAAa,SAAS;AACvD,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,GAAG,QAAQ,OAAO,OAAO,WAAW;AAC3G,kBAAgBC,MAAK,aAAa,cAAc,GAAG;AAAA,IACjD,gBAAgB;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ,YAAY;AAAA,IAC9B,SAAS;AAAA,EACX,CAAC;AAGD,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,YAAY,GAAG,QAAQ,OAAO,OAAO,SAAS;AAAA,EAAG,QAAQ;AAAA,EAAoB;AAC/I;AAEO,SAAS,mBAAmB,aAAa,SAAS,QAAQ;AAC/D,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,gBAAgB,MAAM;AAChF,QAAM,aAAa;AAAA,IACjB,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB,QAAQ,YAAY,SAAS,QAAQ,IAAI,QAAQ,WAAW;AAAA,IAC5D,UAAU;AAAA,IACV,SAAS;AAAA,MACP,GAAG,QAAQ;AAAA,MACX,iBAAiB;AAAA,MACjB,iBAAiB,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,MAC5C,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzC;AAAA,EACF;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,UAAU;AAC7D,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,eAAe,MAAM;AAAA,EAAG,QAAQ;AAAA,EAAoB;AACpH,SAAO;AACT;AAEO,SAAS,6BAA6B,aAAa,SAAS;AACjE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,aAClD,SAAS,SAAS,oBAAoB,UAAU;AACnD,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,kBAAgBA,MAAK,aAAa,cAAc,GAAG,EAAE,GAAG,SAAS,SAAS,KAAK,CAAC;AAChF,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,wBAAwB,QAAQ,QAAQ,eAAe;AAAA,EAAG,QACpH;AAAA,EAAsC;AAC9C;;;AHrWA,IAAM,eAAe;AACrB,IAAMC,mBAAkB;AACxB,IAAMC,gBAAe;AACrB,IAAM,oBAAoB,MAAM,OAAO;AACvC,IAAM,kBAAkB;AAEjB,SAAS,2BAA2B,MAAM,QAAQ,KAAK,cAAc,IAAI;AAC9E,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAc;AAAA,IAAc;AAAA,IAAU;AAAA,IACzE;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAe;AAAA,IAAW;AAAA,IAC3D;AAAA,IAAgB;AAAA,IAAqB;AAAA,IAAgB;AAAA,IAAQ;AAAA,EAC/D,CAAC;AACD,QAAM,QAAQ,CAAC;AACf,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,QAAQ,IAAI,GAAG,KAAK,OAAO,UAAU,SAAU,OAAM,GAAG,IAAI;AAAA,EAClE;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,2BAA2B;AAAA,IAC3B,sBAAsB;AAAA,IACtB,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,4BAA4B;AAAA,IAC5B,qBAAqB;AAAA,IACrB,GAAI,cAAc;AAAA,MAChB,uBAAuBC,MAAK,aAAa,eAAe,YAAY;AAAA,MACpE,yBAAyBA,MAAK,aAAa,eAAe,cAAc;AAAA,MACxE,kBAAkBA,MAAK,aAAa,eAAe,WAAW;AAAA,IAChE,IAAI,CAAC;AAAA,EACP;AACF;AAEA,SAAS,WAAW,SAAS,MAAM,SAAS;AAC1C,SAAOC,WAAU,SAAS,MAAM;AAAA,IAC9B,KAAK,QAAQ;AAAA,IACb,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,IACb,OAAO;AAAA,IACP,aAAa;AAAA,IACb,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,SAAS,QAAQ,WAAW;AAAA,EAC9B,CAAC;AACH;AAEA,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,YAAY,IAAI,GAAG;AACnE,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,aAAa,aAAa,UAAU,WAAW;AACrD,QAAM,SAAS,SAAS,CAAC,MAAM,IAAI,CAAC;AACpC,SAAO;AAAA,IACL,IAAI,MAAM,SAAS;AAAE,aAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO;AAAA,IAAG;AAAA,IAC5E,KAAK,MAAM,SAAS;AAAE,aAAO,IAAI,UAAU,MAAM,OAAO;AAAA,IAAG;AAAA,EAC7D;AACF;AAEA,SAAS,gBAAgB,QAAQ,WAAW;AAC1C,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,SAAS,YAAY,OAAO,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,QAAQ,UAAU,CAAC,EAAE,CAAC,EAAE;AAAA,EAC7H;AACA,MAAI;AAAE,WAAO,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,MAAM,GAAG,SAAS,wBAAwB;AAAA,EAAG;AACzH;AAEA,SAAS,iBAAiB,MAAM;AAC9B,SAAO,UAAUC,YAAW,QAAQ,EAAE,OAAOC,cAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAEA,SAAS,cAAc,MAAM;AAC3B,QAAM,UAAU,CAAC,IAAI;AACrB,SAAO,QAAQ,QAAQ;AACrB,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,OAAOC,WAAU,OAAO;AAC9B,QAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,iDAAiD;AAC5F,QAAI,CAAC,KAAK,YAAY,EAAG;AACzB,eAAW,SAASC,aAAY,OAAO,EAAG,SAAQ,KAAKL,MAAK,SAAS,KAAK,CAAC;AAAA,EAC7E;AACF;AAEO,SAAS,uBAAuB,aAAa,UAAU;AAC5D,QAAM,OAAO,KAAK,MAAMG,cAAaH,MAAK,aAAa,mBAAmB,GAAG,MAAM,CAAC;AACpF,MAAI,OAAO,KAAK,eAAe,IAAI,KAAK,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,UAAU;AAC3F,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,MAAI,eAAe;AACnB,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACvD,QAAI,CAAC,IAAK;AACV,QAAI,MAAM,SAAS,KAAM,OAAM,IAAI,MAAM,0CAA0C,GAAG,EAAE;AACxF,UAAM,WAAW,IAAI,WAAW,MAAM,GAAG,EAAE,SAAS,gCAAgC;AACpF,QAAI,UAAU;AACZ,qBAAe,KAAK,YAAY,SAAS,WAAW,KAAK,cAAc,SAAS;AAChF;AAAA,IACF;AACA,QAAI,CAACD,cAAa,KAAK,OAAO,MAAM,aAAa,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAClH,QAAI,CAAC,OAAO,MAAM,YAAY,EAAE,EAAE,WAAW,6BAA6B,GAAG;AAC3E,YAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AACA,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,4DAA4D;AACjG;AAEO,SAAS,2BAA2B,aAAa,SAAS,sBAAsB;AACrF,QAAM,gBAAgB,6BAA6B,oBAAoB;AACvE,QAAM,cAAcO,SAAQ,aAAa,MAAM,IAAI;AACnD,QAAM,qBAAqBC,UAAS,aAAaD,SAAQ,OAAO,CAAC;AACjE,MAAI,CAAC,sBAAsB,uBAAuB,QAC7C,mBAAmB,WAAW,KAAKE,IAAG,EAAE,KACxCC,YAAW,kBAAkB,GAAG;AACnC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,kBAAkBF,UAAS,aAAaD,SAAQ,OAAO,CAAC,EAAE,WAAW,MAAM,GAAG;AACpF,MAAI,CAAC,mBAAmBG,YAAW,eAAe,KAC7C,gBAAgB,SAAS,IAAI,KAAK,gBAAgB,SAAS,IAAI,GAAG;AACrE,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,WAAW,QAAQ,eAAe;AACxC,QAAM,gBAAgB;AAAA,IAAE,MAAM;AAAA,IAAyB,SAAS;AAAA,IAAS,SAAS;AAAA,IAChF,cAAc,EAAE,CAAC,YAAY,GAAG,SAAS;AAAA,EAAE;AAC7C,QAAM,WAAW,gBAAgB,cAAc,gBAAgB,QAAQ;AACvE,WAAS,gBAAgB,YAAY,EAAE,EAAE,WAAW;AACpD,QAAM,OAAO;AAAA,IAAE,MAAM,cAAc;AAAA,IAAM,SAAS,cAAc;AAAA,IAC9D,iBAAiB,cAAc,gBAAgB;AAAA,IAC/C,UAAU;AAAA,IAAM,UAAU,EAAE,IAAI,eAAe,GAAG,SAAS;AAAA,EAAE;AAC/D,EAAAC,eAAcV,MAAK,aAAa,cAAc,GAAG,GAAG,KAAK,UAAU,aAAa,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACtG,EAAAU,eAAcV,MAAK,aAAa,mBAAmB,GAAG,GAAG,KAAK,UAAU,IAAI,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAClG,SAAO,EAAE,UAAU,KAAK;AAC1B;AAEA,SAAS,YAAY,QAAQ,UAAU,OAAO;AAC5C,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,SAAS;AAAA,IAClB,WAAW,SAAS;AAAA,IACpB,cAAc,eAAe,MAAM,KAAK;AAAA,IACxC,mBAAmB,eAAe,MAAM,UAAU;AAAA,IAClD,aAAa,gBAAgB,MAAM,YAAY,MAAM,WAAW;AAAA,EAClE;AACF;AAEA,SAAS,YAAY;AAAA,EACnB;AAAA,EAAa;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAO;AACrE,GAAG;AACD,QAAM,SAASE,YAAW,QAAQ,EAAE,OAAO,SAAS,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACxF,QAAM,SAAS,QAAQ,GAAG,MAAM,IAAIS,YAAW,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK;AACjE,QAAM,SAAS,UAAU,SAAS,OAAO,IAAI,MAAM;AACnD,QAAM,aAAa,UAAU,aAAa,MAAM;AAChD,MAAI,CAAC,SAASC,YAAW,WAAW,QAAQ,GAAG;AAC7C,UAAM,WAAW,KAAK,MAAMT,cAAa,WAAW,UAAU,MAAM,CAAC;AACrE,UAAM,SAAS,YAAY,QAAQ,UAAU,UAAU;AACvD,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,UAAU,MAAM,SAAS,cAAc,SAAS,WAAW;AAC7D,UAAI,sBAAsB;AACxB,2CAAmC;AAAA,UACjC,aAAa,WAAW;AAAA,UAAU,eAAe;AAAA,QACnD,CAAC;AAAA,MACH;AACA,aAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,UAAUH,MAAK,aAAa,WAAWW,YAAW,CAAC;AACzD,QAAM,UAAUX,MAAK,SAAS,SAAS;AACvC,MAAI,gBAAgB;AACpB,MAAI;AACF,IAAAa,WAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,QAAI;AACJ,QAAI,sBAAsB;AACxB,iCAA2B,SAAS,SAAS,oBAAoB;AACjE,oBAAc;AAAA,QAAC;AAAA,QAAM;AAAA,QAAoB;AAAA,QAAkB;AAAA,QAAc;AAAA,QACvE,cAAc,eAAe;AAAA,MAAE;AAAA,IACnC,OAAO;AACL,MAAAH,eAAcV,MAAK,SAAS,cAAc,GAAG,GAAG,KAAK,UAAU;AAAA,QAC7D,MAAM;AAAA,QAAyB,SAAS;AAAA,QAAS,SAAS;AAAA,MAC5D,CAAC,CAAC;AAAA,CAAI;AACN,oBAAc;AAAA,QAAC;AAAA,QAAW;AAAA,QAAoB;AAAA,QAAkB;AAAA,QAAc;AAAA,QAC5E;AAAA,QAAuB;AAAA,QAAgB,cAAc,eAAe;AAAA,QAAI;AAAA,MAAO;AAAA,IACnF;AACA,UAAM,UAAU,OAAO;AAAA,MAAI;AAAA,MACzB,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,KAAQ;AAAA,IAAC;AAChE,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,uBAAuB,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,MAAM,EAAE;AAC7H,kBAAc,OAAO;AACrB,2BAAuB,SAAS,QAAQ;AACxC,QAAI,sBAAsB;AACxB,yCAAmC,EAAE,aAAa,SAAS,eAAe,qBAAqB,CAAC;AAAA,IAClG;AAEA,UAAM,cAAc;AAAA,MAClB,OAAOA,MAAK,SAAS,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAAA,MAC5E,YAAYA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAAA,MAChG,aAAaA,MAAK,SAAS,gBAAgB,cAAc,UAAU,cAAc;AAAA,MACjF,kBAAkBA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AAAA,MACjH,UAAU;AAAA,IACZ;AACA,UAAM,MAAM,KAAK,MAAMG,cAAa,YAAY,aAAa,MAAM,CAAC;AACpE,QAAI,IAAI,SAAS,gBAAgB,IAAI,YAAY,SAAS,QAAS,OAAM,IAAI,MAAM,qCAAqC;AACxH,QAAI,CAACC,WAAU,YAAY,gBAAgB,EAAE,OAAO,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAC/G,UAAM,QAAQ,OAAO,KAAK,CAAC,YAAY,OAAO,UAAU,WAAW,GAAG,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,IAAO,CAAC;AACnI,QAAI,MAAM,WAAW,KAAK,OAAO,MAAM,UAAU,EAAE,EAAE,KAAK,MAAM,iBAAiB,SAAS,OAAO,IAAI;AACnG,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AACA,UAAM,SAAS,YAAY,QAAQ,UAAU,WAAW;AACxD,oBAAgBJ,MAAK,SAAS,uBAAuB,GAAG,EAAE,gBAAgB,GAAG,GAAG,OAAO,CAAC;AACxF,IAAAa,WAAUb,MAAK,aAAa,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,QAAIY,YAAW,WAAW,QAAQ,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC5F,IAAAE,YAAW,SAAS,WAAW,QAAQ;AACvC,oBAAgB;AAChB,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,qCAAqC,UAAU,MAAM,EAAE;AAC1F,WAAO,EAAE,QAAQ,SAAS,KAAK;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,cAAe,CAAAC,QAAO,WAAW,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/E,UAAM;AAAA,EACR,UAAE;AACA,IAAAA,QAAO,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAClD;AACF;AAEO,SAAS,wBAAwB,SAAS;AAC/C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,MAAM,QAAQ;AAAA,IACd,aAAaH;AAAA,IACb,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,uBAAuB;AAAA,EACzB,IAAI;AACJ,MAAI,CAAC,eAAe,CAACH,YAAW,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,mCAAmC;AACxH,MAAI,CAAC,mBAAmB,CAACX,iBAAgB,KAAK,GAAG,YAAY,IAAI,eAAe,EAAE,GAAG;AACnF,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,kCAAkC;AAAA,EAC3E;AACA,MAAI,CAAC,qBAAqB,CAACC,cAAa,KAAK,iBAAiB,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,oCAAoC;AAAA,EAC7E;AACA,QAAM,YAAY,GAAG,YAAY,IAAI,eAAe;AACpD,MAAI,gBAAgB,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,wDAAwD;AAC9H,QAAM,eAAeO,SAAQ,WAAW;AACxC,QAAM,SAAS,2BAA2B,KAAK,YAAY;AAC3D,QAAM,aAAa,EAAE,KAAK,QAAQ,KAAK,aAAa;AACpD,MAAI,SAAS;AACb,MAAI;AACF,IAAAO,WAAU,cAAc,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAA,WAAUb,MAAK,cAAc,aAAa,GAAG,EAAE,WAAW,KAAK,CAAC;AAChE,IAAAU,eAAc,OAAO,uBAAuB,IAAI,EAAE,MAAM,IAAM,CAAC;AAC/D,IAAAA,eAAc,OAAO,yBAAyB,IAAI,EAAE,MAAM,IAAM,CAAC;AACjE,UAAM,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,QAAQ,YAAY,IAAI,CAAC;AACjF,UAAM,WAAW,EAAE,SAAS,iBAAiB,WAAW,kBAAkB;AAC1E,aAASV,MAAK,cAAc,WAAWW,YAAW,CAAC;AACnD,IAAAE,WAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AACrC,UAAM,SAAS,gBAAgB,OAAO,IAAI;AAAA,MACxC;AAAA,MAAQ;AAAA,MAAW;AAAA,MAAoB;AAAA,MAAU;AAAA,MAAsB;AAAA,MAAQ,cAAc,eAAe;AAAA,IAC9G,GAAG,UAAU,GAAG,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,OAAO,CAAC,IAAI;AACnD,UAAM,UAAUb,MAAK,QAAQ,SAAS,OAAO,QAAQ,YAAY,EAAE,CAAC,CAAC;AACrE,QAAI,CAACY,YAAW,OAAO,KAAK,CAAC,SAAS,OAAO,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAC/G,QAAIR,WAAU,OAAO,EAAE,OAAO,kBAAmB,OAAM,IAAI,MAAM,2CAA2C;AAC5G,QAAI,OAAO,cAAc,SAAS,aAAa,iBAAiB,OAAO,MAAM,SAAS,WAAW;AAC/F,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,UAAM,YAAY,YAAY;AAAA,MAC5B,aAAa;AAAA,MAAc;AAAA,MAAU;AAAA,MAAS;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAY;AAAA,MAC1E;AAAA,IACF,CAAC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,GAAG,UAAU;AAAA,EAC7C,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG,EAAE;AAAA,EACpI,UAAE;AACA,QAAI,OAAQ,CAAAW,QAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7D;AACF;AAEO,SAAS,8BAA8B,SAAS;AACrD,QAAM,SAAS,wBAAwB,OAAO;AAC9C,MAAI,CAAC,OAAO,GAAI,QAAO;AACvB,MAAI;AACF,iBAAaT,SAAQ,QAAQ,WAAW,GAAG,OAAO,QAAQ,QAAQ,MAAM;AACxE,WAAO,EAAE,GAAG,QAAQ,SAAS,KAAK;AAAA,EACpC,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,QAAQ,OAAO,QAAQ,GAAG;AAAA,IAC1H;AAAA,EACF;AACF;;;AIzRA,SAAS,aAAAU,kBAAiB;;;ACE1B,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,aAAY,aAAAC,YAAW,eAAAC,cAAa,gBAAAC,eAAc,UAAAC,SAAQ,iBAAAC,sBAAqB;AACxF,OAAO,QAAQ;AACf,OAAO,UAAU;AAmLjB,SAAS,kBAAkB,MAAM,QAAQ,KAAK;AAC5C,SAAO,IAAI,cAAc,IAAI,UAAU;AACzC;AAQO,SAAS,qBAAqB,MAAM,QAAQ,KAAK;AACtD,SAAO,KAAK,KAAK,kBAAkB,GAAG,GAAG,YAAY,qBAAqB,QAAQ,gBAAgB;AACpG;AA8DO,SAAS,gBAAgB,KAAK,EAAE,WAAW,QAAQ,UAAU,OAAAC,SAAQC,YAAW,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG;AAC/G,MAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG,QAAO;AAC/C,MAAI,aAAa,SAAS;AAIxB,UAAM,WAAW,KAAK,KAAK,kBAAkB,GAAG,GAAG,YAAY,cAAc;AAC7E,UAAM,IAAID,OAAM,UAAU,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,aAAa,MAAM,OAAO,UAAU,SAAS,KAAO,CAAC;AACpH,WAAO,CAAC,EAAE,SAAS,EAAE,WAAW;AAAA,EAClC;AACA,MAAI;AACF,YAAQ,KAAK,CAAC,KAAK,SAAS;AAC5B,WAAO;AAAA,EACT,QAAQ;AACN,QAAI;AACF,cAAQ,KAAK,KAAK,SAAS;AAC3B,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ADnRO,IAAM,mBAAmB;AAEzB,IAAM,0BAA0B;AAEvC,IAAM,aAAa;AAAA,EACjB;AAAA,IACE,WAAW;AAAA;AAAA,IAEX,MAAM,CAAC,OAAO,uDAAuD,KAAK,EAAE,KAAK,sCAAsC,KAAK,EAAE;AAAA,EAChI;AAAA,EACA;AAAA,IACE,WAAW;AAAA;AAAA,IAEX,MAAM,CAAC,OAAO,sDAAsD,KAAK,EAAE,KAAK,YAAY,KAAK,EAAE,KAAK,YAAY,KAAK,EAAE;AAAA,EAC7H;AACF;AAGO,SAAS,oBAAoB,aAAa;AAC/C,MAAI,OAAO,gBAAgB,YAAY,CAAC,YAAa,QAAO;AAC5D,aAAW,EAAE,WAAW,KAAK,KAAK,YAAY;AAC5C,QAAI,KAAK,WAAW,EAAG,QAAO;AAAA,EAChC;AACA,SAAO;AACT;AAOO,SAAS,oBAAoB,EAAE,WAAW,UAAU,gBAAgB,oBAAI,IAAI,EAAE,GAAG;AACtF,QAAM,QAAQ,oBAAI,IAAI;AACtB,aAAW,QAAQ,WAAW;AAC5B,QAAI,OAAO,UAAU,MAAM,GAAG,KAAK,KAAK,MAAM,EAAG,OAAM,IAAI,KAAK,KAAK,IAAI;AAAA,EAC3E;AACA,QAAM,QAAQ,CAAC;AACf,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,QAAI,cAAc,IAAI,KAAK,GAAG,EAAG;AACjC,QAAI,EAAE,OAAO,SAAS,KAAK,UAAU,KAAK,KAAK,aAAa,UAAW;AACvE,UAAM,YAAY,oBAAoB,KAAK,WAAW;AACtD,QAAI,CAAC,UAAW;AAChB,UAAM,SAAS,OAAO,UAAU,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI;AACrF,UAAM,aAAa,CAAC,UAAW,OAAO,SAAS,OAAO,UAAU,KAAK,OAAO,aAAa,KAAK;AAC9F,QAAI,CAAC,WAAY;AACjB,UAAM,KAAK,EAAE,KAAK,KAAK,KAAK,YAAY,KAAK,YAAY,WAAW,aAAa,KAAK,YAAY,CAAC;AAAA,EACrG;AACA,QAAM,KAAK,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;AAChD,SAAO,EAAE,OAAO,MAAM,MAAM,GAAG,gBAAgB,EAAE;AACnD;AAGO,SAAS,oBAAoB,MAAM,OAAO;AAC/C,QAAM,QAAQ,qCAAqC,KAAK,QAAQ,EAAE;AAClE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,MAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG,QAAO;AAC/C,SAAO;AAAA,IACL;AAAA,IACA,MAAM,OAAO,MAAM,CAAC,CAAC;AAAA,IACrB,YAAY,QAAQ,OAAO,MAAM,CAAC,CAAC,IAAI;AAAA,IACvC,aAAa,MAAM,CAAC;AAAA,EACtB;AACF;AAUO,SAAS,sBAAsB,EAAE,WAAW,QAAQ,UAAU,OAAAE,SAAQC,YAAW,QAAQ,KAAK,IAAI,GAAG,MAAM,QAAQ,KAAK,OAAO,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzJ,QAAM,OAAO,CAAC;AACd,MAAI,aAAa,SAAS;AACxB,UAAM,KACJ;AACF,UAAMC,UAASF,OAAM,qBAAqB,GAAG,GAAG,CAAC,cAAc,mBAAmB,YAAY,EAAE,GAAG;AAAA,MACjG,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AACD,QAAIE,QAAO,SAASA,QAAO,WAAW,GAAG;AAMvC,YAAM,QAAQA,QAAO,QAAQA,QAAO,MAAM,UAAU,mBAAmBA,QAAO,MAAM;AACpF,WAAK,8CAA8C,KAAK,gCAAgC;AACxF,YAAM,IAAI,MAAM,+BAA+B,KAAK,kBAAkB;AAAA,IACxE;AACA,eAAW,QAAQ,OAAOA,QAAO,UAAU,EAAE,EAAE,MAAM,QAAQ,GAAG;AAC9D,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,cAAM,MAAM,OAAO,QAAQ,CAAC;AAC5B,YAAI,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,EAAG;AACxC,aAAK,KAAK;AAAA,UACR;AAAA,UACA,MAAM,OAAO,OAAO,EAAE;AAAA,UACtB,YAAY,OAAO,OAAO,CAAC;AAAA,UAC3B,aAAa,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AAAA,QAC3D,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAASF,OAAM,MAAM,CAAC,OAAO,0BAA0B,GAAG,EAAE,UAAU,QAAQ,SAAS,KAAQ,WAAW,KAAK,OAAO,KAAK,CAAC;AAClI,MAAI,OAAO,SAAS,OAAO,WAAW,GAAG;AACvC,UAAM,QAAQ,OAAO,QAAQ,OAAO,MAAM,UAAU,WAAW,OAAO,MAAM;AAC5E,SAAK,8CAA8C,KAAK,gCAAgC;AACxF,UAAM,IAAI,MAAM,+BAA+B,KAAK,kBAAkB;AAAA,EACxE;AACA,aAAW,QAAQ,OAAO,OAAO,UAAU,EAAE,EAAE,MAAM,IAAI,GAAG;AAC1D,UAAM,MAAM,oBAAoB,MAAM,KAAK;AAC3C,QAAI,IAAK,MAAK,KAAK,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAQO,SAAS,qBAAqB;AAAA,EACnC,QAAQ,KAAK,IAAI;AAAA,EACjB,gBAAgB,CAAC,QAAQ,GAAG;AAAA,EAC5B,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI;AACF,UAAM,YAAY,cAAc,EAAE,MAAM,CAAC;AACzC,UAAM,EAAE,MAAM,IAAI,oBAAoB;AAAA,MACpC;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,eAAe,IAAI,IAAI,aAAa;AAAA,IACtC,CAAC;AACD,UAAM,SAAS,CAAC;AAChB,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,SAAS,KAAK,GAAG;AAC9B,UAAI,uBAAuB,OAAO,WAAW,gBAAgB,QAAQ,KAAK,GAAG,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,EAAE;AACnJ,UAAI,KAAM,QAAO,KAAK,EAAE,KAAK,KAAK,KAAK,WAAW,KAAK,UAAU,CAAC;AAAA,IACpE;AACA,UAAMG,UAAS,MAAM,SAAS,OAAO;AACrC,UAAM,SAAS,MAAM,WAAW,IAC5B,2DAA2D,UAAU,MAAM,cAC3E,UAAU,OAAO,MAAM,OAAO,MAAM,MAAM,kCAAkCA,UAAS,IAAI,KAAKA,OAAM,qBAAqB,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;AACzM,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,QAAQ,OAAO;AAAA,EAC/C,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,EAAE;AAAA,EACnJ;AACF;;;AElLA,IAAM,mBAAmB;AACzB,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,eAAsB,oCAAoC;AAAA,EACxD;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,SAAS;AACX,GAAG;AACD,MAAI,CAAC,oBAAoB,CAAC,wBAAyB,OAAM,IAAI,MAAM,4CAA4C;AAC/G,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI;AACF,YAAM,UAAU,MAAM,OAAO,gBAAgB,EAAE,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG,CAAC;AACtF,YAAM,SAAS,QAAQ,KAAK,CAAC,SAAS,MAAM,cAAcA,aACrD,KAAK,WAAW,aACf,mBACA,KAAK,aAAa,uBAAuB,mBACzC,QAAQ,KAAK,aAAa,kBAAkB,KACzC,KAAK,YAAY,uBAAuB,4BAC5C,KAAK,aAAa,mBAAmB,iBACrC,KAAK,aAAa,2BAA2B,mBAAmB,wBAChE,KAAK,aAAa,uBAAuB,mBAAmB,qBAC5D,mBAAmB,aAAa,MAAM,CAAC,UAAU,KAAK,aAAa,yBAAyB,SAAS,KAAK,CAAC,KAC3G,MAAM,QAAQ,KAAK,aAAa,gBAAgB,KAShD,KAAK,YAAY,iBAAiB,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,YAAY,iBACjF,MAAM,cAAc,IAAI,CAAC;AAChC,UAAI,OAAQ,QAAO;AAAA,IACrB,QAAQ;AAAA,IAAsB;AAC9B,UAAM,MAAM,MAAM;AAAA,EACpB;AACA,QAAM,IAAI,MAAM,qDAAqD;AACvE;AAOA,eAAsB,wBAAwB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAA;AAAA,EACA,UAAAC;AAAA,EACA,gBAAAC;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA,sBAAsB,MAAM;AAAA,EAC5B,aAAAC;AAAA,EACA,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,MAAM,MAAM;AAAA,EAAC;AACf,GAAG;AACD,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,QAAM,oBAAoB,QAAQ,QAAQ,aAAaL;AACvD,QAAM,sBAAsB,QAAQ,QAAQ,eAAe;AAC3D,MAAI,QAAQ,QAAQ,oBAAoB,UAAU;AAChD,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ,QAAQ,QAAQ;AAAA,MAC1B,CAAC;AACD,mCAA6B,aAAa,OAAO;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnH,YAAMK,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,wBAAwB,EAAE,aAAa,UAAAJ,WAAU,SAASC,gBAAe,CAAC;AACxF,QAAI,CAAC,YAAY,GAAI,OAAM,IAAI,MAAM,YAAY,MAAM;AACvD,QAAI,CAAE,MAAMC,oBAAmB,KAAK,GAAI;AAItC,UAAI,oBAAoB,KAAK,EAAG,QAAO;AACvC,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAAA,EACF,SAAS,OAAO;AACd,QAAI,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AACpH,QAAI,aAAa;AACjB,QAAI;AACF,mBAAa,mBAAmB,aAAa,SAAS,MAAM;AAAA,IAC9D,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,uBAAuB,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IACxI;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAER,UAAE;AACA,YAAME,WAAU,KAAK;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AAEA,MAAI,4BAA4B;AAChC,MAAI;AACF,UAAM,SAAS,MAAMD,aAAY;AACjC,gCAA4B,QAAQ,oBAAoB;AACxD,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,kBAAkB,QAAQ;AAAA,MAC1B,eAAe,UAAU,YAAY,OAAO,OAAO;AAAA,MACnD;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,MAC5D,UAAU;AAAA,MACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,MACjE,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,2BAA2B,YAAY,OAAO,OAAO,IAAI,YAAY,OAAO,SAAS;AAAA,IAC/F,CAAC;AACD,uBAAmB,aAAa,YAAY,OAAO;AACnD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AAC3H,QAAI;AACJ,QAAI;AAAE,cAAQ,sBAAsB,aAAa,YAAY,SAAS,OAAO;AAAA,IAAG,SACzE,YAAY;AACjB,UAAI,2CAA2C,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC,EAAE;AACtH,YAAMC,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AACA,QAAI,MAAM,QAAQ,eAAe,kBAAkB;AACjD,UAAI,uCAAuC,MAAM,QAAQ,YAAY,IAAI,gBAAgB,GAAG;AAC5F,YAAMA,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,aAAa,aAAa,MAAM,QAAQ;AACzD,QAAI,SAAS,GAAG,OAAO,mDAAmD,MAAM,GAAG,GAAG;AACtF,QAAI,gBAAgB;AACpB,QAAI,aAAa;AACjB,QAAI;AACF,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,6BAA6B,SAAS,MAAM,IAAI,EAAE,OAAO,MAAM,CAAC;AAClG,mBAAa,mBAAmB,aAAa,OAAO,MAAM;AAC1D,YAAMA,WAAU,KAAK;AACrB,sBAAgB,oBAAoB,SAAS,MAAM,KAAK;AACxD,UAAI,CAAE,MAAMF,oBAAmB,aAAa,EAAI,OAAM,IAAI,MAAM,gDAAgD,EAAE,OAAO,MAAM,CAAC;AAChI,YAAM,SAAS,MAAMC,aAAY;AACjC,YAAM,mBAAmB;AAAA,QACvB;AAAA,QACA,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,kBAAkB,QAAQ;AAAA,QAC1B,yBAAyB,QAAQ,mBAAmB,SAAY;AAAA,QAChE,eAAe,UAAU,MAAM,SAAS,OAAO;AAAA,QAC/C;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,4BAA4B,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IAC7I;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,MAAM,QAAQ,WAAW;AAAA,QAC1D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAAqE;AAC7E,QAAI,cAAe,OAAMC,WAAU,aAAa;AAAA,QAC3C,OAAMA,WAAU,KAAK;AAC1B,WAAO;AAAA,EACT;AACF;;;AC9LA,IAAMC,cAAa;AAEZ,SAAS,oBAAoB,OAAO;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQA,YAAW,KAAK,MAAM,KAAK,CAAC;AAC1C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,MAAM,CAAC,IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,SAAU,SAAS,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,IAAK,IAC7E;AACJ,SAAO,EAAE,SAAS,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW;AACvF;AAGO,SAAS,uBAAuB,GAAG,GAAG;AAC3C,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG;AAC7B,UAAM,KAAK,EAAE,QAAQ,CAAC,KAAK;AAC3B,UAAM,KAAK,EAAE,QAAQ,CAAC,KAAK;AAC3B,QAAI,OAAO,GAAI,QAAO,KAAK,KAAK,KAAK;AAAA,EACvC;AACA,MAAI,CAAC,EAAE,cAAc,CAAC,EAAE,WAAY,QAAO;AAC3C,MAAI,CAAC,EAAE,WAAY,QAAO;AAC1B,MAAI,CAAC,EAAE,WAAY,QAAO;AAC1B,QAAM,MAAM,KAAK,IAAI,EAAE,WAAW,QAAQ,EAAE,WAAW,MAAM;AAC7D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAC/B,UAAM,KAAK,EAAE,WAAW,CAAC;AACzB,UAAM,KAAK,EAAE,WAAW,CAAC;AACzB,QAAI,OAAO,OAAW,QAAO;AAC7B,QAAI,OAAO,OAAW,QAAO;AAC7B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,OAAO,OAAO;AAC3B,UAAM,OAAO,OAAO,OAAO;AAC3B,QAAI,QAAQ,KAAM,QAAO,KAAK,KAAK,KAAK;AACxC,QAAI,SAAS,KAAM,QAAO,OAAO,KAAK;AACtC,WAAO,OAAO,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK;AAAA,EACxC;AACA,SAAO;AACT;AAOO,SAAS,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EACd,WAAW;AACb,GAAG;AACD,QAAM,UAAU,CAAC,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAK3B,MAAM,CAAC,YAAY;AAAA,IACnB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,OAAO,kBAAkB,SAAS;AAAA,IAC3C,YAAY,WAAW,kBAAkB,SAAS,IAAI,YAAY;AAAA,IAClE;AAAA,EACF;AAEA,MAAI,CAAC,YAAa,QAAO,QAAQ,iBAAiB;AAElD,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,WAAW;AAAA,EACnC,SAAS,OAAO;AACd,WAAO,QAAQ,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EAC3G;AACA,MAAI,CAAC,SAAS,OAAQ,QAAO,QAAQ,2BAA2B;AAIhE,MAAI,QAAQ,QAAS,QAAO,QAAQ,kCAAkC;AAEtE,QAAM,gBAAgB,oBAAoB,QAAQ,OAAO,OAAO;AAChE,QAAM,iBAAiB,oBAAoB,cAAc;AAGzD,MAAI,CAAC,cAAe,QAAO,QAAQ,oCAAoC,OAAO,QAAQ,OAAO,OAAO,CAAC,EAAE;AACvG,MAAI,CAAC,eAAgB,QAAO,QAAQ,gCAAgC,OAAO,cAAc,CAAC,EAAE;AAC5F,MAAI,uBAAuB,eAAe,cAAc,KAAK,GAAG;AAC9D,WAAO,QAAQ,eAAe,QAAQ,OAAO,OAAO,8BAA8B,cAAc,EAAE;AAAA,EACpG;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,SAAS,aAAa,QAAQ,MAAM;AAAA,EAClD,SAAS,OAAO;AACd,WAAO,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EACnG;AACA,MAAI,CAAC,WAAW,GAAI,QAAO,QAAQ,wBAAwB,WAAW,UAAU,SAAS,EAAE;AAE3F,QAAM,QAAQ,UAAU,MAAM;AAC9B,SAAO;AAAA,IACL,MAAM,CAAC,OAAO,QAAQ;AAAA,IACtB;AAAA,IACA,QAAQ;AAAA,IACR,SAAS,QAAQ,OAAO;AAAA,IACxB,YAAY,eAAe,QAAQ,OAAO,OAAO,IAAI,KAAK;AAAA,IAC1D,QAAQ,kBAAkB,QAAQ,OAAO,OAAO;AAAA,EAClD;AACF;;;AC3FO,IAAM,uBAAuB,KAAK,KAAK;AACvC,IAAM,yBAAyB;AACtC,IAAM,mBAAmB,IAAI,KAAK,KAAK;AACvC,IAAM,qBAAqB;AAC3B,IAAM,qBAAqB,IAAI,KAAK;AAG7B,IAAM,+BAA+B;AACrC,IAAM,wBAAwB;AAErC,IAAM,UAAU,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAExE,SAAS,eAAe,KAAK;AAC3B,MAAI,QAAQ,UAAa,QAAQ,QAAQ,OAAO,GAAG,EAAE,KAAK,MAAM,GAAI,QAAO;AAC3E,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,SAAS,KAAK,KAAK,SAAS,IAAI,QAAQ;AACxD;AAQO,SAAS,kBAAkB,MAAM,CAAC,GAAG;AAC1C,QAAM,KAAK,eAAe,IAAI,6BAA6B;AAC3D,MAAI,OAAO,KAAM,QAAO,KAAK,IAAI,IAAI,gBAAgB;AACrD,QAAM,UAAU,eAAe,IAAI,8BAA8B;AACjE,MAAI,YAAY,KAAM,QAAO,KAAK,IAAI,UAAU,KAAQ,gBAAgB;AACxE,SAAO;AACT;AAEO,SAAS,oBAAoB,MAAM,CAAC,GAAG;AAC5C,QAAM,KAAK,eAAe,IAAI,+BAA+B;AAC7D,MAAI,OAAO,KAAM,QAAO;AACxB,SAAO,KAAK,IAAI,KAAK,IAAI,IAAI,kBAAkB,GAAG,kBAAkB;AACtE;AASO,SAAS,gBAAgB,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAC,GAAG;AACpE,MAAI,CAAC,cAAc;AACjB,WAAO,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,OAAO,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAClF;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,OAAO;AAClC,WAAO,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,OAAO,OAAO,UAAU,MAAM,kBAAkB,KAAK;AAAA,EACnF;AACA,QAAM,MAAM,MAAM,QAAQ,OAAO,aAAa,IAC1C,OAAO,cAAc,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EAAE,OAAO,OAAO,IAC3D,CAAC;AACL,QAAM,WAAW,OAAO,OAAO,WAAW;AAC1C,QAAM,QAAQ,OAAO,SAAS,QAAQ,KAAK,YAAY,IAAI,WAAW,IAAI;AAC1E,SAAO;AAAA,IACL,OAAO,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,IACjC;AAAA,IACA,OAAO;AAAA,IACP,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACtD,kBAAkB,OAAO,mBAAmB,OAAO,OAAO,gBAAgB,IAAI;AAAA,EAChF;AACF;AAMO,SAAS,gBAAgB,EAAE,QAAQ,WAAW,MAAM,GAAG;AAC5D,QAAM,OAAO,OAAO,QAAQ,OAAO,QAAQ;AAC3C,MAAI,OAAO,SAAS,OAAO,UAAU,EAAG,QAAO,EAAE,QAAQ,WAAW,KAAK;AACzE,MAAI,aAAa,MAAO,QAAO,EAAE,QAAQ,OAAO,KAAK;AACrD,SAAO,EAAE,QAAQ,QAAQ,KAAK;AAChC;AAEA,SAAS,aAAa,QAAQ;AAC5B,MAAI,CAAC,OAAO,MAAO,QAAO;AAC1B,QAAM,MAAM,OAAO,IAAI,SAAS,IAAI,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC,MAAM;AACpE,SAAO,GAAG,OAAO,KAAK,kBAAkB,GAAG;AAC7C;AAEA,eAAe,gBAAgB,EAAE,QAAQ,kBAAkB,IAAI,GAAG;AAChE,MAAI,OAAO,IAAI,WAAW,GAAG;AAC3B,QAAI,OAAO,QAAQ,KAAK,CAAC,OAAO,OAAO;AACrC,UAAI,iCAAiC,aAAa,MAAM,CAAC,uDAAkD;AAAA,IAC7G;AACA,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SAAS,CAAC;AAChB,aAAW,UAAU,OAAO,KAAK;AAC/B,QAAI;AACF,YAAM,iBAAiB,QAAQ;AAAA,QAC7B,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,kBAAkB,OAAO;AAAA,MAC3B,CAAC;AACD,aAAO,KAAK,MAAM;AAAA,IACpB,SAAS,OAAO;AACd,UAAI,uBAAuB,MAAM,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAiBA,eAAsB,uBAAuB;AAAA,EAC3C;AAAA,EACA,iBAAiB,MAAM;AAAA,EACvB,mBAAmB,YAAY;AAAA,EAAC;AAAA,EAChC,YAAY;AAAA,EACZ,MAAM,CAAC;AAAA,EACP,MAAM,KAAK;AAAA,EACX,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,QAAM,QAAQ,kBAAkB,GAAG;AACnC,QAAM,UAAU,oBAAoB,GAAG;AACvC,QAAM,YAAY,IAAI;AACtB,MAAI,SAAS;AACb,MAAI,eAAe;AAEnB,QAAM,WAAW,YAAY;AAC3B,cAAU;AACV,UAAM,eAAe,QAAQ,eAAe,CAAC;AAC7C,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,WAAW;AAAA,IAC5B,QAAQ;AACN,eAAS;AAAA,IACX;AACA,WAAO,gBAAgB,QAAQ,EAAE,aAAa,CAAC;AAAA,EACjD;AAIA,MAAI,CAAC,WAAW;AACd,UAAM,SAAS,MAAM,SAAS;AAC9B,QAAI,OAAO,SAAS,OAAO,QAAQ,GAAG;AACpC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,oBAAoB,OAAO,KAAK;AAAA,QACxC,QAAQ;AAAA,QACR,UAAU;AAAA,QACV;AAAA,QACA,eAAe,CAAC;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,SAAS,MAAM,QAAQ,eAAe,QAAQ,OAAO,UAAU,GAAG,QAAQ,eAAe,CAAC,EAAE;AAAA,EACvG;AAEA,aAAS;AACP,UAAM,SAAS,MAAM,SAAS;AAC9B,UAAM,YAAY,IAAI,IAAI;AAC1B,UAAM,OAAO,gBAAgB,EAAE,QAAQ,WAAW,MAAM,CAAC;AAEzD,QAAI,KAAK,WAAW,WAAW;AAC7B,UAAI,iBAAiB,MAAM;AACzB,YAAI,+BAA+B,KAAK,MAAM,YAAY,GAAI,CAAC,sDAAiD;AAAA,MAClH;AACA,aAAO,EAAE,SAAS,MAAM,QAAQ,eAAe,QAAQ,OAAO,UAAU,WAAW,QAAQ,eAAe,CAAC,EAAE;AAAA,IAC/G;AAEA,QAAI,KAAK,WAAW,OAAO;AACzB,UAAI,kCAAkC,KAAK,MAAM,YAAY,GAAI,CAAC,UAAU,KAAK,MAAM,QAAQ,GAAI,CAAC,aAAQ,aAAa,MAAM,CAAC,kCAAkC;AAClK,YAAM,gBAAgB,MAAM,gBAAgB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;AAC7E,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ,kDAAkD,cAAc,MAAM,gBAAgB,4BAA4B;AAAA,QAC1H,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAIA,UAAM,cAAc,GAAG,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,CAAC;AACxD,QAAI,gBAAgB,cAAc;AAChC,qBAAe;AACf,UAAI,0CAAqC,aAAa,MAAM,CAAC,uBAAuB,KAAK,MAAM,UAAU,GAAI,CAAC,qBAAqB,KAAK,MAAM,QAAQ,GAAI,CAAC,IAAI;AAAA,IACjK;AACA,UAAMA,OAAM,KAAK,IAAI,GAAG,KAAK,IAAI,SAAS,QAAQ,SAAS,CAAC,CAAC;AAAA,EAC/D;AACF;;;AC/OA,SAAS,YAAY,sBAAsB;;;ACU3C,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AAEhC,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,oCAAoC;AAE1C,IAAM,gDAAgD;AAEtD,IAAM,yCAAyC;AAC/C,IAAM,qCAAqC;AAClD,IAAM,oBAAoB;AAC1B,IAAMC,WAAU;AAET,SAAS,6BAA6B,MAAM,CAAC,GAAG;AACrD,SAAO,OAAO,IAAI,wBAAwB,EAAE,EACzC,MAAM,SAAS,EACf,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACnB;AAEO,SAAS,+BAA+B,cAAc;AAC3D,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC3D,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MAAI,aAAa,SAAS,mCAAmC;AAC3D,UAAM,IAAI,MAAM,yCAAyC,iCAAiC,eAAe;AAAA,EAC3G;AACA,QAAM,aAAa,aAAa,IAAI,CAAC,SAAS;AAC5C,UAAM,CAAC,OAAO,IAAI,IAAI,OAAO,SAAS,WAAW,KAAK,MAAM,GAAG,IAAI,CAAC;AACpE,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,OAAO,CAAC,kBAAkB,KAAK,IAAI,KAC5E,UAAU,OAAO,UAAU,QAAQ,SAAS,OAAO,SAAS,MAAM;AACrE,YAAM,IAAI,MAAM,wEAAwE;AAAA,IAC1F;AACA,WAAO,KAAK,YAAY;AAAA,EAC1B,CAAC;AACD,MAAI,IAAI,IAAI,UAAU,EAAE,SAAS,WAAW,QAAQ;AAClD,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,QAAM,SAAS,IAAI,IAAI,WAAW,IAAI,CAAC,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACnE,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO,OAAO,OAAO,WAAW,KAAK,CAAC;AACxC;AAEO,SAAS,4BAA4B,cAAc;AACxD,QAAM,QAAQ,+BAA+B,YAAY;AACzD,SAAOC,YAAW,QAAQ,EAAE,OAAO,KAAK,UAAU;AAAA,IAChD,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC,GAAG,MAAM,EAAE,OAAO,KAAK;AAC1B;AAEO,SAAS,4BAA4B,WAAW;AACrD,MAAI,WAAW,WAAW,QAAQ,WAAW,gBAAgB,MAAO,QAAO;AAC3E,MAAI,OAAO,SAAS,UAAU,YAAY,KAAK,UAAU,eAAe,GAAG;AACzE,WAAO,KAAK,KAAK,UAAU,YAAY;AAAA,EACzC;AACA,SAAO;AACT;AAuBO,SAAS,oCAAoC,SAAS;AAC3D,MAAI,SAAS,SAAS,0CACjB,CAACC,SAAQ,KAAK,OAAO,QAAQ,SAAS,EAAE,CAAC,KACzC,CAAC,OAAO,SAAS,QAAQ,YAAY,KACrC,QAAQ,gBAAgB,EAAG,QAAO;AACvC,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,QAAQ;AAAA,IACf,cAAc,KAAK,KAAK,QAAQ,YAAY;AAAA,IAC5C,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,EAC7D,CAAC;AACH;AA+DA,SAAS,OAAO;AAAA,EACd,SAAS;AAAA,EACT,aAAa;AAAA,EACb,WAAW;AAAA,EACX,cAAc;AAAA,EACd,eAAe;AAAA,EACf;AAAA,EACA;AACF,GAAG;AACD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,OAAO,SAAS,YAAY,KAAK,eAAe,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,IAC5E;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,UAAU,MAAM;AAC5C,QAAM,4BAA4B,SAAS,WAAW,OACjD,MAAM,UAAU;AACrB,MAAI,SAAS,WAAW,OAAO,CAAC,0BAA2B,QAAO;AAClE,QAAM,QAAQ,CAAC,iBAAiB,4BAC5B,KAAK,IAAI,+CAA+C,YAAY,IACpE;AACJ,QAAM,QAAQ,SAAS,SAAS,MAAM,aAAa,GAAG,KAAK,KAAK;AAChE,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,SAAS,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG;AACrD,WAAO,MAAM,KAAK,IAAI,KAAO,KAAK,KAAK,UAAU,GAAK,CAAC,CAAC;AAAA,EAC1D;AACA,QAAM,KAAK,QAAQ,KAAK,MAAM,KAAK,IAAI,OAAO;AAC9C,MAAI,OAAO,SAAS,EAAE,GAAG;AACvB,WAAO,MAAM,KAAK,IAAI,KAAO,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC;AAAA,EAC1D;AACA,SAAO,MAAM,GAAM;AACrB;AAEA,eAAe,aAAa,UAAU;AACpC,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAM,UAAU;AACrC,SAAO,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;AACzF;AAEA,eAAe,qBAAqB,WAAW,KAAK,MAAM,WAAW;AACnE,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI;AACJ,QAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,WAAW;AACzC,YAAQ,WAAW,MAAM;AACvB,iBAAW,MAAM;AACjB,aAAO,IAAI,MAAM,yBAAyB,SAAS,IAAI,CAAC;AAAA,IAC1D,GAAG,SAAS;AAAA,EACd,CAAC;AACD,MAAI;AACF,UAAM,kBAAkB,YAAY;AAClC,YAAM,WAAW,MAAM,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAC5E,aAAO,EAAE,UAAU,MAAM,MAAM,aAAa,QAAQ,EAAE;AAAA,IACxD,GAAG;AACH,WAAO,MAAM,QAAQ,KAAK,CAAC,gBAAgB,OAAO,CAAC;AAAA,EACrD,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAaA,eAAsB,qBAAqB;AAAA,EACzC;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,eAAe,CAAC;AAAA,EAChB,YAAY;AAAA;AAAA;AAAA;AAAA,EAIZ,kBAAkB;AACpB,GAAG;AACD,QAAM,OAAO,gBAAgB,QAAQ,SAAS,EAAE;AAChD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,UAAU,kBAAkB,MAAM,SAAS,IAAI,MAAM;AAAA,MACtD;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS,gCAAgC,MAAM;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,iBAAiB,IAAI;AACxB,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBAAgB,QACzB,SAAS,SAAS,cAClB,OAAO,SAAS,gBAAgB,YAChC,CAAC,SAAS,YAAY,KAAK,KAC3B,OAAO,SAAS,cAAc,YAC9B,CAAC,SAAS,UAAU,KAAK,GACzB;AACA,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,SAAS,YAAY,KAAK;AAC7C,QAAM,WAAW,SAAS,UAAU,KAAK;AACzC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI,kBAAkB;AACtB,MAAI;AACF,QAAI,CAAC,MAAM,QAAQ,YAAY,GAAG;AAChC,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AACA,QAAI,aAAa,SAAS,EAAG,mBAAkB,+BAA+B,YAAY;AAAA,EAC5F,SAAS,OAAO;AACd,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,GAAG,IAAI,uCAAuC;AAC3E,eAAW,QAAQ,mBAAmB,CAAC,EAAG,cAAa,aAAa,OAAO,QAAQ,IAAI;AACvF,KAAC,EAAE,UAAU,gBAAgB,MAAM,OAAO,IAAI,MAAM;AAAA,MAClD;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,sDAAsD,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AAEA,QAAM,sBAAsB,OAAO;AACnC,QAAM,uBAAuB,OAAO;AACpC,QAAM,gBAAgB,OAAO;AAC7B,MAAI,0BAA0B;AAC9B,MAAI;AACF,8BAA0B,+BAA+B,aAAa;AAAA,EACxE,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,mBAAmB;AAC1C,QAAM,iBAAiB,oBAAoB,OACvC,OAAO,4BAA4B,sCAChC,yBAAyB,WAAW,IACvC,OAAO,4BAA4B;AACvC,QAAM,0BAA0B,mBAAmB,QAC9C,4BAA4B,QAC5B,MAAM,QAAQ,aAAa,KAC3B,cAAc,WAAW,wBAAwB,UACjD,cAAc,MAAM,CAAC,MAAM,UAAU,SAAS,wBAAwB,KAAK,CAAC,KAC5E,wBAAwB,WAAW,eAAe,UAClD,wBAAwB,MAAM,CAAC,MAAM,UAAU,SAAS,eAAe,KAAK,CAAC,KAC7E,OAAO,4BAA4B,4BAA4B,cAAc,KAC7E,yBAAyB,eAAe,UACxC,mBACC,wBAAwB,SAAS,wBAAwB;AAC/D,MAAI,CAAC,eAAe,MAAM,OAAO,eAAe,QAAQ,OAAO,aAAa,QACvE,OAAO,sBAAsB,QAC7B,CAAC,yBAAyB;AAC7B,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,OAAO,QAAQ;AAChF,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,cAAc,qBAAqB,gBAAgB,MAAM;AAAA,MACzD;AAAA,MACA,SAAS,cAAc,QAAQ,6CAA6C,eAAe,MAAM,IAAI;AAAA,IACvG,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,uBAAuB,OAAO;AAAA,IAC9B,OAAO;AAAA,IACP,SAAS,6DAA6D,oBAAoB;AAAA,EAC5F;AACF;AAEO,SAAS,oBAAoB,WAAW;AAC7C,SAAO,WAAW,OAAO,QACvB,WAAW,WAAW,QACtB,OAAO,UAAU,eAAe,YAChC,UAAU,WAAW,KAAK,IACxB,UAAU,WAAW,KAAK,IAC1B;AACN;;;ADrZO,SAAS,0BAA0B,MAAM,CAAC,GAAG,WAAW,gBAAgB;AAC7E,QAAM,WAAW,OAAO,IAAI,qBAAqB,EAAE,EAAE,KAAK;AAC1D,SAAO,YAAY,kBAAkB,SAAS,CAAC;AACjD;AAGO,SAAS,wBAAwB;AAAA,EACtC,UAAU,CAAC;AAAA,EACX;AAAA,EACA,qBAAqB;AAAA,EACrB,mBAAmB;AACrB,IAAI,CAAC,GAAG;AACN,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,sBAAsB;AAAA,EACxB;AACA,QAAM,aAAa,OAAO,uBAAuB,WAAW,mBAAmB,KAAK,IAAI;AACxF,QAAM,aAAa,OAAO,qBAAqB,WAAW,iBAAiB,KAAK,IAAI;AAEpF,MAAI,WAAY,UAAS,+BAA+B;AAAA,MACnD,QAAO,SAAS;AAErB,MAAI,WAAY,UAAS,8BAA8B;AACvD,SAAO;AACT;AAGA,eAAsB,sBAAsB;AAAA,EAC1C,UAAU,CAAC;AAAA,EACX,mBAAmB;AAAA,EACnB;AAAA,EACA,iBAAiB;AACnB,IAAI,CAAC,GAAG;AACN,QAAM,qBAAqB,QAAQ,8BAA8B,KAAK;AACtE,QAAM,QAAQ,sBAAsB,kBAAkB;AACtD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AAEvF,MAAI,aAAa,OAAO,QAAQ,+BAA+B,EAAE,EAC9D,MAAM,SAAS,EACf,OAAO,OAAO,EAAE,CAAC,KAAK;AACzB,MAAI,kBAAkB,6BAA6B,OAAO;AAC1D,MAAI,sBAAsB;AAC1B,MAAI,cAAc;AAClB,MAAI,iBAAiB;AACrB,MAAI,CAAC,oBAAoB;AACvB,UAAM,YAAY,MAAM,eAAe;AAAA,MACrC;AAAA,MACA;AAAA,MACA,eAAe;AAAA,MACf,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,cAAc,oBAAoB,SAAS,MAC3C,WAAW,WAAW,QAAQ,OAAO,UAAU,eAAe,WAC9D,UAAU,WAAW,KAAK,IAC1B;AACN,iBAAa,eAAe;AAC5B,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2DAA2D;AAC5F,QAAI,UAAU,MAAM,MAAM,QAAQ,UAAU,eAAe,GAAG;AAC5D,wBAAkB,CAAC,GAAG,UAAU,eAAe;AAC/C,oBAAc;AAAA,IAChB,OAAO;AACL,oBAAc;AACd,uBAAiB,OAAO,WAAW,UAAU,WAAW,UAAU,QAAQ;AAC1E,4BAAsB,4BAA4B,SAAS;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,mBAAmB,gBAAgB,SAAS,IAC9C,EAAE,GAAG,SAAS,sBAAsB,gBAAgB,KAAK,GAAG,EAAE,IAC9D;AAEJ,QAAM,WAAW,wBAAwB;AAAA,IACvC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,kBAAkB,qBAAqB,OAAO;AAAA,EAChD,CAAC;AACD,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,GAAI,aAAa,EAAE,6BAA6B,WAAW,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AErGA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,UAAS,QAAAC,aAAY;AAC9B,SAAS,iBAAAC,sBAAqB;AAEvB,SAAS,4BAA4B,UAAU,YAAY,KAAK;AACrE,QAAM,YAAYF,SAAQE,eAAc,OAAO,CAAC;AAChD,QAAM,UAAUD,MAAK,WAAW,iCAAiC;AACjE,QAAM,SAASA,MAAK,WAAW,MAAM,kCAAkC;AACvE,SAAOF,YAAW,MAAM,IAAI,SAAS;AACvC;AAGO,SAAS,6BAA6B;AAAA,EAC3C,OAAAI,SAAQL;AAAA,EACR,WAAW,QAAQ;AAAA,EACnB,aAAa,4BAA4B;AAAA,EACzC,aAAa,CAAC;AAAA,EACd,MAAM,QAAQ;AAChB,IAAI,CAAC,GAAG;AACN,QAAM,SAASK,OAAM,UAAU,CAAC,YAAY,GAAG,UAAU,GAAG;AAAA,IAC1D;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AACrD,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;;;ACpCO,IAAM,0BAA0B,OAAO,OAAO;AAAA,EACnD,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,eAAe;AACjB,CAAC;AAEM,SAAS,qBAAqB,UAAU,CAAC,GAAG;AACjD,QAAM,SAAS,EAAE,GAAG,yBAAyB,GAAG,QAAQ;AACxD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,GAAG,6BAA6B;AAAA,EAChG;AACA,MAAI,aAAa;AAEjB,SAAO,OAAO,OAAO;AAAA,IACnB,WAAW,WAAW,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,SAAS,KAAK,CAAC,OAAO,SAAS,QAAQ,KAAK,WAAW,WAAW;AACrF,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,YAAM,WAAW,WAAW;AAC5B,mBAAa,YAAY,OAAO,iBAAiB,IAAI,aAAa;AAClE,YAAM,UAAU,cAAc,OAAO;AACrC,YAAM,UAAU,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,OAAO,cAAe,KAAK,KAAK,IAAI,GAAG,aAAa,CAAC;AAAA,MACvD;AACA,aAAO,OAAO,OAAO,EAAE,YAAY,UAAU,SAAS,QAAQ,CAAC;AAAA,IACjE;AAAA,IACA,WAAW;AACT,aAAO,OAAO,OAAO,EAAE,YAAY,SAAS,cAAc,OAAO,cAAc,CAAC;AAAA,IAClF;AAAA,EACF,CAAC;AACH;;;AC3BA,IAAM,qBAAqB,oBAAI,QAAQ;AAiBhC,SAAS,wCACd,QACA,cACA,kBAAkB,MAAM;AAAC,GACzB;AACA,MAAI,YAAY;AAChB,QAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,MAAM,OAAO,MAAM,SAAS,KAAK,IAAI,CAAC,MAAM;AAC3E,uBAAmB,IAAI,MAAM;AAC7B,QAAI,UAAW,QAAO;AACtB,gBAAY;AACZ,iBAAa,OAAO,OAAO,EAAE,QAAQ,MAAM,OAAO,MAAM,OAAO,CAAC,CAAC;AACjE,WAAO;AAAA,EACT;AACA,SAAO,GAAG,SAAS,CAAC,UAAU;AAC5B,oBAAgB,KAAK;AAKrB,QAAI,OAAO,QAAQ,UAAa,OAAO,QAAQ,KAAM,SAAQ,SAAS,EAAE,MAAM,CAAC;AAAA,EACjF,CAAC;AACD,SAAO,GAAG,QAAQ,CAAC,MAAM,WAAW;AAClC,YAAQ,QAAQ,EAAE,MAAM,QAAQ,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EAChE,CAAC;AACD,SAAO,OAAO,OAAO,EAAE,WAAW,MAAM,UAAU,CAAC;AACrD;AAUO,SAAS,yBAAyB,QAAQ,UAAU,QAAQ,SAAS;AAC1E,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,+BAA+B,OAAO;AACxF,MAAI,OAAO,SAAS,SAAS;AAC3B,UAAM,SAAS,OAAO,iBAAiB,QAAQ,OAAO,MAAM,UAAU,OAAO,OAAO,SAAS,WAAW;AACxG,WAAO,uBAAuB,OAAO,KAAK,MAAM;AAAA,EAClD;AACA,MAAI,OAAO,OAAQ,QAAO,aAAa,OAAO,MAAM,YAAY,OAAO;AACvE,MAAI,OAAO,SAAS,EAAG,QAAO,mCAAmC,OAAO;AACxE,MAAI,OAAO,SAAS,KAAM,QAAO,kDAAkD,OAAO;AAC1F,SAAO,oBAAoB,OAAO,IAAI,YAAY,OAAO;AAC3D;AAEO,SAAS,yBAAyB,QAAQ;AAI/C,SAAO,mBAAmB,IAAI,MAAM,KAC/B,OAAO,aAAa,SACnB,OAAO,cAAc,UAAU;AACvC;AAEO,SAAS,yBAAyB,QAAQ;AAC/C,SAAO,CAAC,yBAAyB,MAAM;AACzC;AAEO,SAAS,6BAA6B,EAAE,UAAU,UAAU,UAAU,MAAM,GAAG;AACpF,SAAO,CAAC,YAAY,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,yBAAyB,KAAK;AACzF;AAEO,SAAS,mCAAmC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AACF,GAAG;AACD,SAAO,WAAW,gBACb,QAAQ,aAAa,MACrB,OAAO,SAAS,YAAY,KAC5B,eAAe;AACtB;AASO,SAAS,yCAAyC;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AACF,GAAG;AACD,QAAM,UAAU,oBAAI,QAAQ;AAC5B,QAAM,WAAW,oBAAI,QAAQ;AAC7B,QAAM,sBAAsB,oBAAI,QAAQ;AAExC,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc,QAAQ,SAAS;AAC7B,UAAI,CAAC,UAAU,WAAW,aAAa,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KACjF,OAAO,SAAS,UAAU,YAAY,CAAC,QAAQ,SAC/C,CAAC,OAAO,SAAS,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,EAAG,QAAO;AACjF,cAAQ,IAAI,QAAQ,OAAO,OAAO;AAAA,QAChC,OAAO,QAAQ;AAAA,QACf,cAAc,KAAK,KAAK,QAAQ,YAAY;AAAA,MAC9C,CAAC,CAAC;AACF,aAAO;AAAA,IACT;AAAA,IACA,yBAAyB,QAAQ,YAAY;AAC3C,UAAI,CAAC,UAAU,CAAC,OAAO,UAAU,UAAU,EAAG,QAAO;AACrD,0BAAoB,IAAI,QAAQ,UAAU;AAC1C,aAAO;AAAA,IACT;AAAA,IACA,WAAW,QAAQ;AACjB,YAAM,UAAU,SAAS,QAAQ,IAAI,MAAM,IAAI;AAC/C,aAAO,QAAQ,MAAM,MAAM,SAAS,IAAI,MAAM,KAAK,mCAAmC;AAAA,QACpF;AAAA,QACA,cAAc,aAAa;AAAA,QAC3B,cAAc,SAAS;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,QAAQ,QAAQ;AACd,UAAI,CAAC,OAAQ,QAAO;AACpB,UAAI,SAAS,IAAI,MAAM,EAAG,QAAO;AACjC,YAAM,UAAU,QAAQ,IAAI,MAAM;AAClC,UAAI,CAAC,mCAAmC;AAAA,QACtC;AAAA,QACA,cAAc,aAAa;AAAA,QAC3B,cAAc,SAAS;AAAA,MACzB,CAAC,EAAG,QAAO;AACX,YAAM,qBAAqB,oBAAoB,IAAI,MAAM;AACzD,eAAS,IAAI,MAAM;AACnB,cAAQ,OAAO,MAAM;AACrB,0BAAoB,OAAO,MAAM;AACjC,0BAAoB,MAAM;AAC1B,iBAAW,OAAO,OAAO;AAAA,QACvB;AAAA,QACA,cAAc,QAAQ;AAAA,QACtB,oBAAoB,OAAO,UAAU,kBAAkB,IAAI,qBAAqB;AAAA,MAClF,CAAC,CAAC;AACF,aAAO;AAAA,IACT;AAAA,IACA,OAAO,QAAQ;AACb,UAAI,CAAC,OAAQ;AACb,cAAQ,OAAO,MAAM;AACrB,0BAAoB,OAAO,MAAM;AAAA,IACnC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qCAAqC;AAAA,EACnD;AAAA,EACA;AACF,GAAG;AACD,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,gBAAgB,OAAO,UAAU,0BAA0B,KAC5D,+BAA+B,SAAS;AAC7C,SAAO,OAAO,OAAO;AAAA,IACnB,SAAS,CAAC,SAAS,YAAY;AAAA,IAC/B,oBAAoB,gBAAgB,6BAA6B;AAAA,EACnE,CAAC;AACH;AAQO,SAAS,gCAAgC;AAAA,EAC9C,eAAe;AAAA,EACf,QAAQ,MAAM,KAAK,IAAI;AACzB,IAAI,CAAC,GAAG;AACN,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,QAAM,QAAQ,CAAC,YAAY;AACzB,QAAI,WAAW,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,EAAG,QAAO;AACjE,UAAM,YAAY,MAAM,IAAI,KAAK,KAAK,OAAO;AAC7C,gBAAY,cAAc,OAAO,YAAY,KAAK,IAAI,WAAW,SAAS;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,YAAY;AAElB,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,OAAO,SAAS;AACd,UAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,EAAG,QAAO;AACtD,gBAAU;AACV,kBAAY;AACZ,aAAO,MAAM,OAAO;AAAA,IACtB;AAAA,IACA,YAAY;AACV,aAAO,CAAC,WAAW,cAAc,QAAQ,MAAM,IAAI;AAAA,IACrD;AAAA,IACA,cAAc;AACZ,aAAO,WAAW,cAAc,OAAO,IAAI,KAAK,IAAI,GAAG,YAAY,MAAM,CAAC;AAAA,IAC5E;AAAA,IACA,iBAAiB;AACf,UAAI,WAAY,cAAc,QAAQ,MAAM,IAAI,UAAY,QAAO;AACnE,gBAAU;AACV,kBAAY;AACZ,aAAO;AAAA,IACT;AAAA,IACA,aAAa;AACX,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAMO,SAAS,mCAAmC;AACjD,MAAI,WAAW;AACf,MAAI,aAAa;AAEjB,SAAO;AAAA,IACL,aAAa;AACX,aAAO;AAAA,IACT;AAAA,IACA,eAAe;AACb,iBAAW;AACX,oBAAc;AAAA,IAChB;AAAA,IACA,iBAAiB,EAAE,QAAQ,cAAc,eAAe,WAAW,GAAG;AACpE,YAAM,qBAAqB;AAC3B,aAAO,MAAM;AACX,YAAI,aAAa,MAAM,UAAU,eAAe,mBAAoB,QAAO;AAC3E,YAAI,YAAY,CAAC,cAAe,QAAO;AACvC,cAAM,YAAY;AAClB,mBAAW;AACX,YAAI,UAAW,cAAa;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,sBAAsB,EAAE,QAAQ,cAAc,WAAW,GAAG;AAC1D,YAAM,qBAAqB;AAC3B,aAAO,CAAC,YAAY;AAClB,YAAI,aAAa,MAAM,UAAU,eAAe,mBAAoB,QAAO;AAC3E,mBAAW,OAAO;AAClB,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,WAAW;AACT,aAAO,EAAE,UAAU,WAAW;AAAA,IAChC;AAAA,EACF;AACF;AAQO,SAAS,kCAAkC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAG;AACD,SAAO,iBAAiB,iBAAiB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,CAAC;AACH;AAEA,IAAM,0BAA0B,oBAAI,IAAI,CAAC,UAAU,aAAa,WAAW,CAAC;AAErE,SAAS,wCAAwC;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,GAAG;AAKD,SAAO,QAAQ,YAAY,KACrB,oBAAoB,QAAQ,wBAAwB,IAAI,UAAU;AAC1E;AAOO,SAAS,uCAAuC;AACrD,MAAI,0BAA0B;AAC9B,QAAM,UAAU,MAAM;AACpB,UAAM,SAAS;AACf,8BAA0B;AAC1B,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,eAAe,QAAQ;AACrB,gCAA0B,UAAU,yBAAyB,MAAM,IAAI,SAAS;AAChF,aAAO,4BAA4B;AAAA,IACrC;AAAA,IACA;AAAA,IACA,MAAM,YAAY,SAAS;AAGzB,YAAM,SAAS,QAAQ;AACvB,UAAI,CAAC,OAAQ,QAAO;AACpB,YAAM,QAAQ,MAAM;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B,MAAM;AAAA,EAChC,iBAAiB,MAAM;AACzB,GAAG;AACD,MAAI;AACF,UAAM,gBAAgB;AACtB,UAAM,UAAU,yBAAyB,MAAM,KAAK,MAAMA,oBAAmB,MAAM;AAInF,UAAM,SAAS,yBAAyB,MAAM;AAC9C,QAAI,eAAe,MAAM,EAAG,QAAO;AACnC,QAAI,UAAU,wBAAwB,MAAM,EAAG,QAAO;AACtD,QAAI,WAAW,CAAC,QAAQ;AAGtB,UAAI,YAAY,MAAM,MAAO,QAAO;AACpC,UAAI,yBAAyB,MAAM,EAAG,OAAM,eAAe,MAAM;AACjE,aAAO;AAAA,IACT;AAIA,QAAI,CAAC,UAAU,eAAe;AAC5B,YAAM,YAAY,aAAa,GAAG,OAAO,iDAAiD,MAAM;AAChG,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,yBAAyB,MAAM,EAAG,OAAM,eAAe,MAAM;AAAA,IACnE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,eAAe,MAAM,EAAG,QAAO;AACnC,UAAM,YAAY;AAAA,MAChB,GAAG,OAAO,iDACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF,MAAM;AACN,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,yBAAyB,MAAM,EAAG,OAAM,eAAe,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,WAAO;AAAA,EACT;AACF;;;A5BlVA,IAAM,4BAA4B;AAClC,IAAM,UAAU;AAChB,IAAM,iBAAiB;AAIvB,IAAM,6BAA6B,uCAC/B,qCACA;AACJ,IAAM,0BAA0B,CAAC,4BAA4B,wBAAwB;AACrF,IAAMC,WAAU;AAChB,IAAM,WAAWC,eAAc,YAAY,GAAG;AAC9C,IAAM,oBAAoBC,MAAKC,SAAQ,QAAQ,GAAG,eAAe;AACjE,IAAM,wBAAwB,mBAAmB,QAAQ,GAAG;AAC5D,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,IAAM,WAAW,0BAA0B,QAAQ,GAAG;AAEtD,SAAS,iBAAiB;AACxB,MAAI;AAAE,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EAAW,QAAQ;AAAE,WAAO;AAAA,EAAW;AACnH;AAEA,IAAM,gCAAgCJ,SAAQ,KAAK,OAAO,QAAQ,IAAI,oCAAoC,EAAE,CAAC,IACzG,QAAQ,IAAI,mCACZK,YAAW;AACf,IAAM,uBAAuB;AAAA,EAC3B,mBAAmB,QAAQ,GAAG;AAAA,EAAG;AACnC;AACA,IAAM,oBAAoB,eAAe;AACzC,IAAM,4BAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA,cAAc;AAChB;AAEA,IAAI,8BAA8B;AAOlC,SAAS,WAAW,UAAU;AAC5B,QAAM,WAAW,4BAA4B;AAAA,IAC3C,aAAa;AAAA,IACb,cAAc;AAAA,IACd,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,SAAS,eAAe,6BAA6B;AACvD,YAAQ,MAAM,yCAAyC,SAAS,UAAU,KAAK,SAAS,MAAM,GAAG;AACjG,kCAA8B,SAAS;AAAA,EACzC;AACA,SAAO,MAAM,QAAQ,UAAU,SAAS,MAAM;AAAA,IAC5C,KAAK;AAAA,IACL,OAAO,CAAC,WAAW,WAAW,WAAW,KAAK;AAAA,IAC9C,aAAa;AAAA,EACf,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAO,UAAU;AAC3C,QAAM,WAAW,MAAM,QAAQ,UAAU,CAAC,OAAO,QAAQ,GAAG;AAAA,IAC1D,KAAK;AAAA,IACL,OAAO,CAAC,WAAW,WAAW,WAAW,KAAK;AAAA,IAC9C,aAAa;AAAA,EACf,CAAC;AACD;AAAA,IACE;AAAA,IACA,MAAM;AAAA,IAAC;AAAA,IACP,CAAC,UAAU;AACT,cAAQ;AAAA,QACN,wDAAwD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAChH;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc;AAC3B,MAAI;AACF,UAAM,OAAO,OAAO,QAAQ,IAAI,+BAA+B,IAAI;AACnE,UAAM,WAAW,MAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AACpG,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,MAAM,OAAO,OAAO,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBAAmB,OAAO;AACvC,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,yBAAyB,KAAK,EAAG,QAAO;AAC5C,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,QAAQ,YAAY,QAAQ,OAAO,OAAO,GAAG,MAAM,OAAO,MAAM,GAAG,EAAG,QAAO;AACjF,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,iBAAiB,OAAO,WAAW;AAChD,MAAI,CAAC,SAAS,yBAAyB,KAAK,EAAG,QAAO;AACtD,SAAO,IAAI,QAAQ,CAACD,aAAY;AAC9B,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,WAAW;AACzB,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,YAAM,IAAI,QAAQ,MAAM;AACxB,MAAAA,SAAQ,MAAM;AAAA,IAChB;AACA,UAAM,SAAS,MAAM,OAAO,IAAI;AAChC,UAAM,QAAQ,WAAW,MAAM,OAAO,KAAK,GAAG,SAAS;AACvD,UAAM,KAAK,QAAQ,MAAM;AACzB,QAAI,yBAAyB,KAAK,EAAG,QAAO,IAAI;AAAA,EAClD,CAAC;AACH;AAEA,eAAe,UAAU,OAAO;AAC9B,MAAI,CAAC,SAAS,yBAAyB,KAAK,EAAG;AAC/C,QAAM,KAAK,QAAQ,aAAa,UAAU,SAAY,SAAS;AAC/D,MAAI,MAAM,iBAAiB,OAAO,IAAM,EAAG;AAC3C,MAAI,yBAAyB,KAAK,EAAG,OAAM,KAAK,SAAS;AAIzD,QAAM,iBAAiB,OAAO,GAAK;AACrC;AAEA,eAAe,OAAO;AAIpB,QAAM,SAAS,6BAA6B;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,wBAAwB;AAC5D,QAAM,mBAAmB,CAAC,OAAO,QAAQ,IAAI,gCAAgC,EAAE,EAAE,KAAK;AACtF,QAAM,sBAAsB;AAAA,IAC1B,SAAS,QAAQ;AAAA,IACjB,kBAAkB;AAAA,IAClB;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,sBAAsB,mBAAmB;AACnD,SAAO,OAAO,UAAU;AAAA,IACtB,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,mCAAmC,wBAAwB,KAAK,GAAG;AAAA,EACrE,CAAC;AACD,QAAM,SAAS,yBAAyB,EAAE,SAAS,iBAAiB,KAAK,UAAU,CAAC;AACpF,QAAM,cAAc,mBAAmB,QAAQ,GAAG;AAClD,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,WAAW;AACf,QAAM,qBAAqB,oBAAI,QAAQ;AACvC,QAAM,4BAA4B,oBAAI,QAAQ;AAG9C,QAAM,mBAAmB,iCAAiC;AAC1D,QAAM,yBAAyB,MAAM;AACnC,qBAAiB,aAAa;AAC9B,YAAQ,WAAW;AAAA,EACrB;AACA,QAAM,iBAAiB,qBAAqB;AAC5C,QAAM,uBAAuB,qCAAqC;AAClE,QAAM,kBAAkB,gCAAgC;AAAA,IACtD,cAAc;AAAA,EAChB,CAAC;AACD,MAAI,+BAA+B,wBAAwB;AAC3D,MAAI,oCAAoC;AAExC,QAAM,sBAAsB,OAAO,WAAW;AAC5C,QAAI,CAAC,OAAQ;AACb,uBAAmB,IAAI,MAAM;AAC7B,8BAA0B,IAAI,MAAM;AACpC,QAAI;AACF,YAAM,UAAU,MAAM;AAAA,IACxB,UAAE;AAIA,UAAI,yBAAyB,MAAM,EAAG,oBAAmB,OAAO,MAAM;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,qBAAqB,yCAAyC;AAAA,IAClE,cAAc,MAAM;AAAA,IACpB,qBAAqB,CAAC,WAAW;AAC/B,UAAI,UAAU,OAAQ,SAAQ;AAAA,IAChC;AAAA,IACA,YAAY,CAAC,EAAE,cAAc,mBAAmB,MAAM;AACpD,qCAA+B;AAC/B,UAAI,OAAO,UAAU,kBAAkB,KAClC,iBAAiB,SAAS,EAAE,eAAe,oBAAoB;AAClE,4CAAoC;AAAA,MACtC;AACA,sBAAgB,OAAO,YAAY;AACnC,cAAQ;AAAA,QACN,iEAAiE,YAAY;AAAA,MAE/E;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,2BAA2B,CAAC,WAAW,mBAAmB,WAAW,MAAM;AACjF,QAAM,gCAAgC,CAAC,WAAW,mBAAmB,QAAQ,MAAM;AAEnF,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,gBAAgB,WAAW,EAAG;AACnC,QAAI,CAAC,6BAA6B;AAAA,MAChC;AAAA,MACA,UAAU,iBAAiB,WAAW;AAAA,MACtC;AAAA,MACA;AAAA,IACF,CAAC,EAAG;AACJ,QAAI;AACF,cAAQ,YAAY;AACpB,WAAK,kBAAkB,OAAO,OAAO,oBAAoB;AAAA,IAC3D,SAAS,OAAO;AACd,6BAAuB;AACvB,cAAQ;AAAA,QACN,yEAAyE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACjI;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,MAAM;AACxB,UAAM,OAAO,WAAW,QAAQ;AAChC,UAAM,YAAY,KAAK,IAAI;AAC3B,SAAK,GAAG,WAAW,CAAC,YAAY;AAC9B,YAAM,UAAU,oCAAoC,OAAO;AAC3D,UAAI,CAAC,WAAW,CAAC,mBAAmB,cAAc,MAAM,OAAO,EAAG;AAGlE,UAAI;AACF,aAAK,KAAK;AAAA,UACR,MAAM;AAAA,UACN,OAAO,QAAQ;AAAA,QACjB,GAAG,CAAC,UAAU;AACZ,cAAI,MAAO,SAAQ,KAAK,yDAAyD,MAAM,OAAO,EAAE;AAAA,QAClG,CAAC;AAAA,MACH,SAAS,OAAO;AACd,gBAAQ;AAAA,UACN,yDAAyD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACjH;AAAA,MACF;AAAA,IACF,CAAC;AACD;AAAA,MACE;AAAA,MACA,CAAC,WAAW;AAKV,YAAI,YAAY,mBAAmB,OAAO,IAAI,GAAG;AAC/C,6BAAmB,OAAO,IAAI;AAC9B;AAAA,QACF;AACA,YAAI,8BAA8B,IAAI,EAAG;AACzC,2BAAmB,OAAO,IAAI;AAM9B,gBAAQ,MAAM,gCAAgC,yBAAyB,MAAM,CAAC,EAAE;AAChF,cAAM,WAAW,eAAe,WAAW,WAAW,KAAK,IAAI,CAAC;AAChE,YAAI,SAAS,SAAS;AACpB,iCAAuB;AACvB,kBAAQ;AAAA,YACN,+CAA+C,SAAS,UAAU;AAAA,UAEpE;AACA;AAAA,QACF;AACA,mBAAW,SAAS,SAAS,OAAO;AAAA,MACtC;AAAA,MACA,CAAC,UAAU;AACT,gBAAQ;AAAA,UACN,+CAA+C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACvG;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,oBAAoB,OAAO,QAAQ,eAAe,YAAY;AAClE,UAAM,+BAA+B,kCAAkC;AAAA,MACrE;AAAA,MACA;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,eAAe;AAAA,MACf,oBAAoB,MAAM;AACxB,gBAAQ,WAAW;AAAA,MACrB;AAAA,IACF,CAAC;AACD,UAAM,gCAAgC,iBAAiB,sBAAsB;AAAA,MAC3E;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,YAAY,CAAC,YAAY;AACvB,+BAAuB;AACvB,gBAAQ,MAAM,0BAA0B,OAAO,EAAE;AAAA,MACnD;AAAA,IACF,CAAC;AACD,WAAO,4BAA4B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,MAAM,MAAM,cAAc;AAAA,MAC3C;AAAA,MACA,gBAAgB;AAAA,MAChB,yBAAyB;AAAA,MACzB,gBAAgB,CAAC,cAAc,0BAA0B,IAAI,SAAS;AAAA,MACtE,aAAa;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,sBAAsB,CAAC,iBAAiB;AAC5C,mCAA+B;AAC/B,QAAI,gBAAgB,WAAW,EAAG,iBAAgB,OAAO,YAAY;AAAA,QAChE,iBAAgB,MAAM,YAAY;AACvC,YAAQ;AAAA,MACN,uEAAuE,YAAY;AAAA,IAErF;AAAA,EACF;AAEA,QAAM,kCAAkC,YAAY;AAClD,QAAI,CAAC,iBAAkB,QAAO;AAC9B,UAAM,YAAY,MAAM,sBAAsB;AAAA,MAC5C,GAAG;AAAA,MACH,SAAS;AAAA,IACX,CAAC;AACD,QAAI,UAAU,eAAe,YAAY;AACvC,YAAM,IAAI,MAAM,wEAAwE;AAAA,IAC1F;AACA,QAAI,UAAU,wBAAwB,MAAM;AAC1C,0BAAoB,UAAU,mBAAmB;AACjD,aAAO;AAAA,IACT;AACA,QAAI,UAAU,gBAAgB,SAAS,GAAG;AACxC,YAAM,kBAAkB,UAAU,gBAAgB,KAAK,GAAG;AAC1D,eAAS,uBAAuB;AAChC,gBAAU,uBAAuB;AAAA,IACnC;AACA,mCAA+B;AAC/B,WAAO;AAAA,EACT;AAEA,QAAM,iCAAiC,YAAY;AACjD,QAAI,CAAC,SAAS,yBAAyB,KAAK,GAAG;AAC7C,YAAM,qBAAqB,iBAAiB,SAAS,EAAE;AACvD,UAAI,CAAC,gBAAgB,WAAW,KAAK,gBAAgB,UAAU,GAAG;AAChE,4CAAoC;AACpC,eAAO;AAAA,MACT;AACA,UAAI;AACF,YAAI,CAAE,MAAM,gCAAgC,GAAI;AAC9C,8CAAoC;AACpC,iBAAO;AAAA,QACT;AACA,YAAI,CAAC,gBAAgB,WAAW,KAAK,CAAC,gBAAgB,eAAe,EAAG,QAAO;AAC/E,gBAAQ,YAAY;AACpB,2BAAmB,yBAAyB,OAAO,kBAAkB;AAAA,MACvE,SAAS,OAAO;AACd,+BAAuB;AACvB,gBAAQ;AAAA,UACN,oFACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,kBAAkB,OAAO,MAAM,2BAA2B;AAAA,EACnE;AAEA,QAAM,oBAAoB,OAAO,qBAAqB,SAAS;AAC7D,UAAM,kBAAkB,YAAY;AACpC,YAAQ;AACR,QAAI,OAAO,UAAU,kBAAkB,GAAG;AACxC,yBAAmB,yBAAyB,iBAAiB,kBAAkB;AAAA,IACjF;AACA,SAAK;AAAA,MACH;AAAA,MACA,OAAO,UAAU,kBAAkB;AAAA,MACnC,OAAO,UAAU,kBAAkB,IAAI,8BAA8B;AAAA,IACvE;AAEA,QAAI,CAAE,MAAM,wBAAwB;AAAA,MAClC;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,MACpB;AAAA,MACA,qBAAqB;AAAA,MACrB;AAAA,MACA,WAAW;AAAA,MACX,qBAAqB,CAAC,UAAU,mBAAmB,OAAO,QAAQ;AAAA,MAClE,KAAK,CAAC,YAAY,QAAQ,MAAM,0BAA0B,OAAO,EAAE;AAAA,IACrE,CAAC,GAAI;AAIH,UAAI,8BAA8B,eAAe,GAAG;AAClD,gBAAQ,KAAK,4GAA4G;AACzH,eAAO;AAAA,MACT;AAIA,6BAAuB;AACvB,YAAM,oBAAoB,eAAe;AACzC,UAAI,UAAU,gBAAiB,SAAQ;AACvC,cAAQ,MAAM,qIAAgI;AAC9I,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,QAAM,2BAA2B,YAAY;AAC3C,QAAI,gBAAgB,WAAW,KAAK,gBAAgB,UAAU,EAAG,QAAO;AACxE,UAAM,gBAAgB,qCAAqC;AAAA,MACzD;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,cAAc,QAAS,QAAO;AACnC,QAAI,8BAA8B;AAChC,UAAI;AACF,YAAI,CAAE,MAAM,gCAAgC,EAAI,QAAO;AAAA,MACzD,SAAS,OAAO;AACd,+BAAuB;AACvB,4CAAoC;AACpC,wBAAgB,eAAe;AAC/B,gBAAQ;AAAA,UACN,qFACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,eAAe,qCAAqC;AAAA,MACxD;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,aAAa,QAAS,QAAO;AAClC,QAAI,CAAC,gBAAgB,eAAe,EAAG,QAAO;AAC9C,wCAAoC;AACpC,WAAO,kBAAkB,aAAa,kBAAkB;AAAA,EAC1D;AAEA,QAAM,yBAAyB;AAE/B,QAAM,WAAW,YAAY;AAC3B,QAAI,SAAU;AACd,eAAW;AACX,UAAM,UAAU,KAAK;AAAA,EACvB;AACA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAC9E,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAE/E,SAAO,CAAC,UAAU;AAChB,QAAI;AACF,YAAM,yBAAyB;AAC/B,YAAM,SAAS,MAAM,OAAO,kBAAkB;AAAA,QAC5C;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAG;AAAA,MACL,CAAC;AACD,UAAI,CAAC,QAAQ;AACX,cAAM,MAAM,OAAO;AACnB;AAAA,MACF;AAGA,0CAAoC;AACpC,iBAAW;AACX,YAAM,kBAAkB,EAAE,UAAU,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,GAAI,GAAG,0BAA0B;AAGxG,YAAM,gBAAgB,OAAO,SAAS,YAAY,OAAO,SAAS;AAClE,YAAM,QAAQ,MAAM,uBAAuB;AAAA,QACzC,YAAY;AAAA,QAAa,WAAW;AAAA,QAAe,KAAK,QAAQ;AAAA,QAChE,gBAAgB,MAAM,yBAAyB,KAAK;AAAA,QACpD,kBAAkB,CAAC,QAAQ,UAAU,OAAO,aAAa,QAAQ,EAAE,QAAQ,UAAU,SAAS,MAAM,SAAS,QAAQ,MAAM,QAAQ,GAAI,MAAM,WAAW,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC,GAAI,GAAI,MAAM,mBAAmB,EAAE,oBAAoB,MAAM,iBAAiB,IAAI,CAAC,EAAG,CAAC;AAAA,QAChR,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACD,UAAI,CAAC,MAAM,SAAS;AAClB,cAAM,OAAO,sBAAsB,OAAO,UAAU,EAAE,GAAG,iBAAiB,QAAQ,UAAU,QAAQ,MAAM,OAAO,CAAC;AAClH,mBAAW;AACX,gBAAQ;AACR;AAAA,MACF;AACA,2BAAqB,eAAe,KAAK;AACzC,YAAM,oBAAoB,KAAK;AAC/B,YAAM,SAAS,gBACX,8BAA8B;AAAA,QAC9B;AAAA,QACA,aAAa,qBAAqB,OAAO,uBAAuB;AAAA,QAChE,iBAAiB,OAAO;AAAA,QACxB,mBAAmB,OAAO;AAAA,QAC1B,QAAQ;AAAA,UACN,UAAU,OAAO;AAAA,UACjB;AAAA,UACA,YAAY,cAAc;AAAA,UAC1B;AAAA,QACF;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,OAAO,OAAO,SAAS;AAAA,MACzB,CAAC,IACC,OAAO,SAAS,kBACd,qBAAqB;AAAA,QACrB,eAAe,CAAC,QAAQ,GAAG;AAAA,QAC3B,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC,IACC,mBAAmB,OAAO,MAAM;AAAA,QAChC,KAAK;AAAA,QACL,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACL,UAAI,OAAO,MAAM,OAAO,SAAS;AAC/B,YAAI,MAAM,OAAQ,SAAQ,KAAK,0BAA0B,MAAM,MAAM,EAAE;AACvE,gBAAQ,KAAK,oCAAoC,OAAO,OAAO,OAAO,uCAAuC;AAC7G;AAAA,MACF;AAKA,YAAM,qBAAqB,wCAAwC;AAAA,QACjE,cAAc,qBAAqB,QAAQ;AAAA,QAC3C,YAAY,OAAO;AAAA,QACnB,iBAAiB,OAAO;AAAA,MAC1B,CAAC;AACD,YAAM,oBAAoB,qBACtB,MAAM,+BAA+B,IACrC;AACJ,UAAI,CAAC,kBAAmB,QAAO,KAAK;AACpC,YAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,QAClD,GAAG;AAAA,QACH,QAAQ,OAAO,KAAK,cAAc;AAAA,QAClC,QAAQ,OAAO,KACV,OAAO,SAAS,GAAG,OAAO,MAAM,YAAY,eAAe,CAAC,eAAe,MAAM,GAAG,GAAI,IAAI,UAAU,eAAe,CAAC,iBACvH,sBAAsB,OAAO,MAAM,GAAG,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,EAAE,GAC/E,oBAAoB,KAAK,0CAC3B;AAAA,MACJ,CAAC;AACD,iBAAW;AACX,cAAQ;AAAA,IACV,SAAS,OAAO;AACd,cAAQ,MAAM,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAIhG,YAAM,qBAAqB,YAAY,MAAM,+BAA+B,CAAC;AAC7E,iBAAW;AACX,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACvG,UAAQ,WAAW;AACrB,CAAC;",
   "names": ["randomUUID", "fileURLToPath", "dirname", "join", "runnerId", "supervisorInstanceId", "supervisorVersion", "runnerId", "resolve", "sleep", "path", "path", "getFirebaseAuth", "runnerId", "sleep", "path", "body", "supervisorInstanceId", "supervisorVersion", "spawn", "createHash", "randomUUID", "existsSync", "lstatSync", "mkdirSync", "readFileSync", "readdirSync", "renameSync", "rmSync", "writeFileSync", "isAbsolute", "join", "relative", "resolve", "sep", "spawnSync", "createHash", "readFileSync", "resolve", "existsSync", "win32", "path", "resolve", "canonical", "createHash", "readFileSync", "createHash", "existsSync", "lstatSync", "readFileSync", "readdirSync", "dirname", "isAbsolute", "join", "relative", "resolve", "selfPath", "join", "PACKAGE_SPEC_RE", "INTEGRITY_RE", "join", "spawnSync", "createHash", "readFileSync", "lstatSync", "readdirSync", "resolve", "relative", "sep", "isAbsolute", "writeFileSync", "randomUUID", "existsSync", "mkdirSync", "renameSync", "rmSync", "spawnSync", "spawnSync", "existsSync", "mkdirSync", "readdirSync", "readFileSync", "rmSync", "writeFileSync", "spawn", "spawnSync", "spawn", "spawnSync", "result", "failed", "resolve", "runnerId", "selfPath", "packageVersion", "waitForLocalRunner", "localStatus", "stopChild", "VERSION_RE", "resolve", "sleep", "createHash", "randomUUID", "UUID_RE", "createHash", "UUID_RE", "spawnSync", "existsSync", "dirname", "join", "fileURLToPath", "spawn", "waitForLocalRunner", "UUID_RE", "fileURLToPath", "join", "dirname", "resolve", "randomUUID"]
 }