@byok-sdk/server 0.15.0 → 0.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +77 -0
  2. package/dist/index.d.ts +6 -1
  3. package/dist/index.js +296 -24
  4. package/dist/index.js.map +1 -1
  5. package/dist/stores/sqlite/device-directory.d.ts +26 -0
  6. package/dist/stores/sqlite/index.d.ts +3 -2
  7. package/dist/types.d.ts +4 -0
  8. package/package.json +4 -4
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/connections.ts","../src/device-selection.ts","../src/event-queue.ts","../src/relay.ts","../src/snapshot.ts","../src/rate-limiter.ts","../src/sqlite-support.ts","../src/stores/sqlite/index.ts","../src/stores.ts","../src/task-handle.ts","../src/index.ts"],"names":["require","createInMemoryCoreStores","createInMemoryCloudStores","KernelSteerRejectedError","STRICT_AGENT_ONLY_CAPABILITY"],"mappings":";;;;;;;;;;;;AAkDO,IAAM,oBAAN,MAAwB;AAAA,EACpB,QAAA,uBAAe,GAAA,EAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtD,QAAA,CAAS,QAAA,EAAkB,YAAA,EAAkC,EAAA,EAAkB;AAC7E,IAAA,IAAA,CAAK,QAAA,CAAS,IAAI,QAAA,EAAU;AAAA,MAC1B,SAAA,EAAW,IAAA;AAAA,MACX,QAAA,EAAU,EAAA;AAAA,MACV,GAAI,aAAa,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,YAAA,CAAa,aAAA,EAAc;AAAA,MAChG,GAAI,YAAA,CAAa,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,CAAC,GAAG,YAAA,CAAa,QAAQ,CAAA,EAAE;AAAA,MACtF,GAAI,YAAA,CAAa,kBAAA,KAAuB,MAAA,GACpC,EAAC,GACD,EAAE,kBAAA,EAAoB,CAAC,GAAG,YAAA,CAAa,kBAAkB,CAAA;AAAE,KAChE,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAA,CAAM,UAAkB,EAAA,EAAkB;AACxC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,QAAA,CAAS,IAAI,QAAA,EAAU,EAAE,WAAW,IAAA,EAAM,QAAA,EAAU,IAAI,CAAA;AAC7D,MAAA;AAAA,IACF;AACA,IAAA,QAAA,CAAS,SAAA,GAAY,IAAA;AACrB,IAAA,QAAA,CAAS,QAAA,GAAW,EAAA;AAAA,EACtB;AAAA,EAEA,IAAI,QAAA,EAAgD;AAClD,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAAA,EACnC;AAAA,EAEA,YAAY,QAAA,EAA2B;AACrC,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,GAAG,SAAA,KAAc,IAAA;AAAA,EACpD;AAAA,EAEA,cAAA,GAAyB;AACvB,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,UAAA,IAAc,KAAK,QAAA,CAAS,MAAA,IAAU,IAAI,UAAA,CAAW,WAAW,KAAA,IAAS,CAAA;AACpF,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,GAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA;AAAA,EACjC;AAAA;AAAA,EAGA,OAAO,QAAA,EAAwB;AAC7B,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,EAC/B;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACtB;AACF,CAAA;ACjFO,SAAS,wBAAA,CACd,UAAA,EACA,KAAA,GAA+B,EAAC,EACZ;AACpB,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,IAAI,MAAM,oBAAA,KAAyB,IAAA,IAAQ,UAAU,YAAA,EAAc,QAAA,CAAS,4BAA4B,CAAA,EAAG;AACzG,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,gBAAA,KAAqB,MAAA,EAAW,OAAO,SAAA,CAAU,QAAA;AAK3D,IAAA,IAAI,CAAC,SAAA,CAAU,YAAA,EAAc,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5D,IAAA,IAAI,SAAA,CAAU,uBAAuB,MAAA,EAAW;AAChD,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,SAAA,CAAU,kBAAkB,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,gBAAA,CAAiB,KAAA,CAAM,CAAC,SAAA,KAAc,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA,EAAG,OAAO,SAAA,CAAU,QAAA;AAAA,EAC/F;AACA,EAAA,OAAO,MAAA;AACT;;;ACpBO,IAAM,kBAAN,MAAyB;AAAA,EACb,SAAkE,EAAC;AAAA,EAC5E,YAAA,GAAe,CAAA;AAAA,EACf,MAAA,GAAS,KAAA;AAAA,EACT,UAA6B,EAAC;AAAA,EACrB,WAAA;AAAA,EACA,gBAAA;AAAA,EACT,eAAA,GAAkB,KAAA;AAAA,EAE1B,WAAA,CAAY,OAAA,GAAqC,EAAC,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,gBAAgB,MAAA,EAAW;AACrC,MAAA,IAAI,CAAC,OAAO,aAAA,CAAc,OAAA,CAAQ,WAAW,CAAA,IAAK,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC1E,QAAA,MAAM,IAAI,SAAA;AAAA,UACR,CAAA,kEAAA,EAAqE,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAC,CAAA;AAAA,SAClG;AAAA,MACF;AACA,MAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,IAC7B;AACA,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA,EAGA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA,EAEA,KAAK,KAAA,EAAgB;AACnB,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,EAAE,UAAU,IAAA,CAAK,YAAA,EAAA,EAAgB,OAAO,CAAA;AACzD,IAAA,IAAA,CAAK,YAAA,EAAa;AAClB,IAAA,IAAA,CAAK,IAAA,EAAK;AAAA,EACZ;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,IAAA,EAAK;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,YAAA,GAAqB;AAC3B,IAAA,MAAM,QAAQ,IAAA,CAAK,WAAA;AACnB,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,IAAA,CAAK,MAAA,CAAO,UAAU,KAAA,EAAO;AACxD,IAAA,IAAA,CAAK,OAAO,MAAA,CAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,SAAS,KAAK,CAAA;AAChD,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,EACzB;AAAA,EAEQ,IAAA,GAAa;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,IAAA,IAAA,CAAK,UAAU,EAAC;AAChB,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,OAAA,EAAQ;AAAA,EACzC;AAAA,EAEQ,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,SAAA,GAA8B;AAC5B,IAAA,MAAM,KAAA,GAAQ,IAAA;AACd,IAAA,OAAO;AAAA,MACL,CAAC,MAAA,CAAO,aAAa,CAAA,GAAsB;AACzC,QAAA,IAAI,WAAW,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,YAAY,KAAA,CAAM,YAAA;AAClD,QAAA,IAAI,mBAAA,GAAsB,KAAA;AAC1B,QAAA,OAAO;AAAA,UACL,MAAM,IAAA,GAAmC;AACvC,YAAA,WAAS;AACP,cAAA,IAAI,MAAM,eAAA,IAAmB,CAAC,mBAAA,IAAuB,KAAA,CAAM,qBAAqB,MAAA,EAAW;AACzF,gBAAA,mBAAA,GAAsB,IAAA;AACtB,gBAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,gBAAA,EAAkB,MAAM,KAAA,EAAM;AAAA,cACtD;AAEA,cAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,QAAA;AAChC,cAAA,IAAI,MAAA,KAAW,MAAA,IAAa,QAAA,GAAW,MAAA,EAAQ,QAAA,GAAW,MAAA;AAC1D,cAAA,IAAI,WAAW,MAAA,EAAW;AACxB,gBAAA,MAAM,SAAS,QAAA,GAAW,MAAA;AAC1B,gBAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AACjC,gBAAA,IAAI,UAAU,MAAA,EAAW;AACvB,kBAAA,QAAA,GAAW,MAAM,QAAA,GAAW,CAAA;AAC5B,kBAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,MAAM,KAAA,EAAM;AAAA,gBAC3C;AAAA,cACF;AACA,cAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,gBAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAW,IAAA,EAAM,IAAA,EAAK;AAAA,cACxC;AACA,cAAA,MAAM,MAAM,WAAA,EAAY;AAAA,YAC1B;AAAA,UACF;AAAA,SACF;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF,CAAA;;;ACzHO,IAAM,+BAAA,GAAkC;AAExC,IAAM,kCAAkC,CAAA,GAAI;AAQnD,IAAM,iBAAA,GAAqC,EAAE,IAAA,EAAM,OAAA,EAAS,QAAQ,kBAAA,EAAmB;AAqDhF,IAAM,iBAAN,MAAkD;AAAA,EAC9C,MAAA,uBAAa,GAAA,EAA4B;AAAA,EACzC,aAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACT,QAAA,GAAW,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOX,cAAA;AAAA,EAOA,YAAY,OAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,WAAA;AAC5B,IAAA,IAAA,CAAK,YAAA,GAAe,aAAA,CAAc,OAAA,CAAQ,oBAAA,IAAwB,iCAAiC,sBAAsB,CAAA;AACzH,IAAA,IAAA,CAAK,YAAA,GAAe,aAAA,CAAc,OAAA,CAAQ,oBAAA,IAAwB,iCAAiC,sBAAsB,CAAA;AAKzH,IAAA,IAAA,CAAK,gBAAgB,IAAI,eAAA,CAAiC,EAAE,WAAA,EAAa,IAAA,CAAK,cAAc,CAAA;AAAA,EAC9F;AAAA;AAAA,EAGA,YAAA,GAA+C;AAC7C,IAAA,OAAO,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,EACtC;AAAA;AAAA,EAGA,gBAAgB,KAAA,EAA8B;AAC5C,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAA,CAAK,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,UAAU,MAAA,EAAsB;AAC9B,IAAA,IAAA,CAAK,KAAA,CAAM,QAAQ,IAAI,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,MAAM,MAAA,EAAsB;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACpC,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,CAAC,KAAA,CAAM,WAAA,EAAa;AAC/C,IAAA,IAAI,KAAA,CAAM,YAAA,KAAiB,MAAA,EAAW,YAAA,CAAa,MAAM,YAAY,CAAA;AACrE,IAAA,KAAA,CAAM,cAAA,EAAe;AACrB,IAAA,KAAA,CAAM,MAAM,KAAA,EAAM;AAClB,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAA,CAAe,QAAgB,EAAA,EAAkB;AAC/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,MAAM,KAAA,GAAQ,QAAA,IAAY,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AAC3C,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,CAAC,KAAA,CAAM,WAAA,EAAa;AAClD,IAAA,KAAA,CAAM,WAAA,GAAc,KAAA;AACpB,IAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,KAAA,EAAO,SAAA,EAAW,IAAI,CAAA;AACxD,IAAA,IAAA,CAAK,gBAAgB,EAAE,IAAA,EAAM,cAAA,EAAgB,MAAA,EAAQ,IAAI,CAAA;AACzD,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AAClC,IAAA,KAAA,MAAW,KAAA,IAAS,OAAO,IAAA,CAAK,mBAAA,CAAoB,OAAO,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,EAAE,CAAA;AAAA,EAC7F;AAAA;AAAA,EAGA,OAAO,MAAA,EAAgD;AACrD,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,MAAM,SAAA,EAAU;AAAA,EAC5C;AAAA;AAAA,EAGA,SAAS,MAAA,EAA+B;AACtC,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,QAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,kBAAA,CAAmB,MAAA,EAAgB,KAAA,EAAkB,EAAA,EAAkB;AACrE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,IAAA,CAAK,WAAA,CAAY,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,mBAAmB,KAAA,EAA+B;AAChD,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAS,GAAI,KAAA;AAC/B,IAAA,MAAM,EAAA,GAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAElC,IAAA,IAAI,QAAA,CAAS,SAAS,YAAA,EAAc;AAClC,MAAA,IAAA,CAAK,YAAA,CAAa,QAAA;AAAA,QAChB,QAAA;AAAA,QACA;AAAA,UACE,GAAI,QAAA,CAAS,OAAA,CAAQ,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,aAAA,EAAc;AAAA,UACxG,GAAI,QAAA,CAAS,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,QAAA,EAAS;AAAA,UACzF,GAAI,QAAA,CAAS,OAAA,CAAQ,kBAAA,KAAuB,MAAA,GACxC,EAAC,GACD,EAAE,kBAAA,EAAoB,QAAA,CAAS,OAAA,CAAQ,kBAAA;AAAmB,SAChE;AAAA,QACA;AAAA,OACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,QAAA,EAAU,EAAE,CAAA;AAEpC,IAAA,MAAM,SAAS,QAAA,CAAS,OAAA;AACxB,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACpC,IAAA,IAAI,UAAU,MAAA,EAAW;AAEzB,IAAA,IAAI,MAAM,WAAA,EAAa;AACrB,MAAA,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,EAAE,QAAA,EAAU,IAAI,CAAA;AACjC,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,mBAAA,CAAoB,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAE,CAAA;AAAA,EACtD;AAAA,EAEA,mBAAA,CACE,KAAA,EACA,MAAA,EACA,QAAA,EACA,EAAA,EACM;AACN,IAAA,QAAQ,SAAS,IAAA;AAAM,MACrB,KAAK,YAAA;AACH,QAAA,IAAI,SAAS,OAAA,CAAQ,OAAA,KAAY,QAAW,KAAA,CAAM,cAAA,GAAiB,SAAS,OAAA,CAAQ,OAAA;AACpF,QAAA,IAAI,SAAS,OAAA,CAAQ,SAAA,KAAc,QAAW,KAAA,CAAM,gBAAA,GAAmB,SAAS,OAAA,CAAQ,SAAA;AACxF,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAC7C,QAAA;AAAA,MACF,KAAK,cAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAC7C,QAAA;AAAA,MACF,KAAK,eAAA;AACH,QAAA,KAAA,MAAW,KAAA,IAAS,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,CAAA;AACtF,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,MAAA;AAAA,UACA,KAAA,CAAM,qCAAA;AAAA,UACN,QAAA,CAAS,EAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA;AAAA,MACF,KAAK,eAAA;AACH,QAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,YAAY,QAAA,EAAU,QAAA,CAAS,SAAS,CAAA;AACjE,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,MAAA;AAAA,UACA,KAAA,CAAM,qCAAA;AAAA,UACN,QAAA,CAAS,EAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA;AAAA,MACF,KAAK,qBAAA;AACH,QAAA,KAAA,CAAM,wCAAwC,QAAA,CAAS,EAAA;AACvD,QAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,kBAAkB,OAAA,EAAS,QAAA,CAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAC9E,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAiB,EAAE,CAAA;AACnD,QAAA;AAAA,MACF,KAAK,wBAAA;AACH,QAAA,IAAA,CAAK,eAAA,CAAgB;AAAA,UACnB,IAAA,EAAM,wBAAA;AAAA,UACN,MAAA;AAAA,UACA,EAAA;AAAA,UACA,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,UAC7B,QAAA,EAAU,SAAS,OAAA,CAAQ,QAAA;AAAA,UAC3B,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAM7B,QAAA,EAAU;AAAA,SACX,CAAA;AACD,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAC7C,QAAA;AAAA,MACF,KAAK,cAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAE,CAAA;AAC5C,QAAA;AAAA,MACF,KAAK,eAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAY,EAAE,CAAA;AAC9C,QAAA;AAAA,MACF,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAE,CAAA;AAC5C,QAAA;AAAA,MACF,KAAK,gBAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAa,EAAE,CAAA;AAC/C,QAAA;AAAA,MACF;AACE,QAAA;AAAA;AACJ,EACF;AAAA;AAAA,EAGA,4BAAA,CAA6B,QAAgB,EAAA,EAAkB;AAC7D,IAAA,IAAA,CAAK,gBAAgB,EAAE,IAAA,EAAM,iCAAA,EAAmC,MAAA,EAAQ,IAAI,CAAA;AAC5E,IAAA,IAAA,CAAK,kBAAA,CAAmB,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAAA,EAC/C;AAAA;AAAA,EAGA,IAAA,GAAa;AACX,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACxC,MAAA,IAAI,KAAA,CAAM,YAAA,KAAiB,MAAA,EAAW,YAAA,CAAa,MAAM,YAAY,CAAA;AACrE,MAAA,KAAA,CAAM,cAAA,EAAe;AACrB,MAAA,KAAA,CAAM,MAAM,KAAA,EAAM;AAAA,IACpB;AACA,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAClB,IAAA,IAAA,CAAK,cAAc,KAAA,EAAM;AACzB,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EAC1B;AAAA,EAEA,WAAA,CAAY,KAAA,EAAuB,MAAA,EAAgB,IAAA,EAAiB,EAAA,EAAkB;AAIpF,IAAA,IAAI,MAAM,eAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AACnD,IAAA,IAAA,CAAK,eAAA,CAAgB;AAAA,MACnB,IAAA,EAAM,YAAA;AAAA,MACN,MAAA;AAAA,MACA,KAAA,EAAO,IAAA;AAAA,MACP,EAAA;AAAA,MACA,GAAI,MAAM,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,KAAA,CAAM,gBAAA,EAAiB;AAAA,MAC3F,GAAI,MAAM,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,KAAA,CAAM,cAAA;AAAe,KACtF,CAAA;AACD,IAAA,IAAI,IAAA,KAAS,UAAA,IAAc,IAAA,KAAS,QAAA,IAAY,SAAS,WAAA,EAAa;AACtE,IAAA,KAAA,CAAM,eAAA,GAAkB,IAAA;AACxB,IAAA,KAAA,CAAM,cAAA,EAAe;AAQrB,IAAA,KAAA,CAAM,MAAM,KAAA,EAAM;AAClB,IAAA,IAAA,CAAK,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAA,CAAiB,QAAgB,KAAA,EAA6B;AAC5D,IAAA,IAAI,KAAA,CAAM,iBAAiB,MAAA,EAAW;AACtC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IAC3B,CAAA,EAAG,KAAK,YAAY,CAAA;AACpB,IAAA,KAAA,CAAM,KAAA,IAAQ;AACd,IAAA,KAAA,CAAM,YAAA,GAAe,KAAA;AAAA,EACvB;AAAA,EAEA,KAAA,CAAM,MAAA,EAAgB,WAAA,GAAc,KAAA,EAAuB;AACzD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,IAAA,IAAI,cAAA;AACJ,IAAA,MAAM,QAAA,GAAW,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC9C,MAAA,cAAA,GAAiB,OAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,MAAM,OAAA,GAA0B;AAAA,MAC9B,KAAA,EAAO,IAAI,eAAA,CAAiC;AAAA,QAC1C,aAAa,IAAA,CAAK,YAAA;AAAA,QAClB,gBAAA,EAAkB;AAAA,OACnB,CAAA;AAAA,MACD,QAAA;AAAA,MACA,cAAA;AAAA,MACA,eAAA,EAAiB,KAAA;AAAA,MACjB,WAAA;AAAA,MACA,OAAO;AAAC,KACV;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAA,EAAQ,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AACF,CAAA;AAEA,SAAS,aAAA,CAAc,OAAe,IAAA,EAAsB;AAC1D,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,EAAG,IAAI,CAAA,gCAAA,CAAkC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,KAAA;AACT;;;AC9UO,SAAS,WAAA,CAAY,SAAsB,OAAA,EAAiD;AACjG,EAAA,IAAI,OAAA,CAAQ,YAAA,KAAiB,MAAA,EAAW,OAAO,WAAA;AAC/C,EAAA,QAAQ,QAAQ,MAAA;AAAQ,IACtB,KAAK,UAAA;AACH,MAAA,OAAO,UAAA;AAAA,IACT,KAAK,QAAA;AACH,MAAA,OAAO,QAAA;AAAA,IACT,KAAK,WAAA;AAAA,IACL,KAAK,kBAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,OAAA,KAAY,SAAY,SAAA,GAAY,eAAA;AAAA,IAC7C,KAAK,SAAA;AACH,MAAA,OAAO,OAAA,KAAY,SAAY,SAAA,GAAY,eAAA;AAAA,IAC7C,KAAK,SAAA;AACH,MAAA,OAAO,OAAA,KAAY,SAAY,SAAA,GAAY,eAAA;AAAA;AAEjD;AAYO,SAAS,aAAa,QAAA,EAA8D;AACzF,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAS,KAAA,KAAU,UAAA,GAAa,aAAa,QAAA,CAAS,KAAA,KAAU,WAAW,QAAA,GAAW,WAAA;AAAA,IAC7F,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,YAAY,QAAA,CAAS,UAAA;AAAA,IACrB,YAAA,EAAc,SAAS,YAAA,KAAiB,MAAA,GAAY,SAAY,CAAC,GAAG,SAAS,YAAY,CAAA;AAAA,IACzF,GAAI,SAAS,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,QAAA,CAAS,QAAA,EAAS;AAAA,IACzE,GAAI,SAAS,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAO;AAAA,IACnE,GAAI,SAAS,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,QAAA,CAAS,SAAA;AAAU,GAC9E;AACF;AAmBO,SAAS,cAAA,CACd,OAAA,EACA,OAAA,EACA,QAAA,EACA,UAAA,EACc;AACd,EAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AAIpC,EAAA,MAAM,UAAA,GAAa,MAAA,EAAQ,UAAA,IAAc,UAAA,EAAY,UAAA;AACrD,EAAA,OAAO;AAAA,IACL,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,KAAA,EAAO,WAAA,CAAY,OAAA,EAAS,OAAO,CAAA;AAAA,IACnC,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,UAAA;AAAA,IACA,GAAI,QAAQ,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAS;AAAA,IACvE,SAAA,EAAW,UAAA,EAAY,SAAA,IAAa,OAAA,CAAQ,SAAA;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAO;AAAA,IACzC,GAAI,SAAS,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,iBAAA,EAAmB,OAAA,CAAQ,UAAA,EAAW;AAAA,IACrF,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB;AAAA,IAC/F,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,IACzF,GAAI,QAAQ,0BAAA,KAA+B,MAAA,GACvC,EAAC,GACD,EAAE,0BAAA,EAA4B,OAAA,CAAQ,0BAAA;AAA2B,GACvE;AACF;AASO,SAAS,aAAA,CAAc,QAAsB,UAAA,EAAuD;AACzG,EAAA,OAAO;AAAA,IACL,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,SAAA,EAAW,YAAY,SAAA,IAAa,KAAA;AAAA,IACpC,UAAU,UAAA,EAAY,QAAA;AAAA,IACtB,GAAI,YAAY,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,UAAA,CAAW,aAAA,EAAc;AAAA,IAC7F,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,QAAA,EAAU,YAAY,QAAA,KAAa,MAAA,GAAY,SAAY,CAAC,GAAG,WAAW,QAAQ,CAAA;AAAA,IAClF,kBAAA,EACE,YAAY,kBAAA,KAAuB,MAAA,GAAY,SAAY,CAAC,GAAG,WAAW,kBAAkB;AAAA,GAChG;AACF;;;AC1FA,IAAM,2BAAA,GAA8B,EAAA;AACpC,IAAM,aAAA,GAAgB,GAAA;AAiBtB,IAAM,2BAAA,GAA8B,GAAA;AASpC,IAAM,4BAAA,GAA+B,GAAA;AAO9B,IAAM,cAAN,MAAkB;AAAA,EACN,iBAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA,uBAAc,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYlC,uBAAA;AAAA;AAAA,EAEA,iBAAA;AAAA;AAAA,EAET,eAAA,GAAkB,CAAA;AAAA,EAE1B,WAAA,CAAY,IAAA,GAA2B,EAAC,EAAG;AACzC,IAAA,MAAM,iBAAA,GAAoB,KAAK,iBAAA,IAAqB,2BAAA;AACpD,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,aAAA;AAC5B,IAAA,MAAM,iBAAA,GAAoB,KAAK,iBAAA,IAAqB,2BAAA;AACpD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,iBAAiB,CAAA,IAAK,qBAAqB,CAAA,EAAG;AACjE,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,gEAAA,EAAmE,iBAAiB,CAAA,CAAE,CAAA;AAAA,IAC5G;AAIA,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,QAAQ,CAAA,EAAG;AACxC,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,qDAAA,EAAwD,KAAK,CAAA,CAAE,CAAA;AAAA,IACrF;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,iBAAiB,CAAA,IAAK,oBAAoB,CAAA,EAAG;AAChE,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,iEAAA,EAAoE,iBAAiB,CAAA,CAAE,CAAA;AAAA,IAC7G;AACA,IAAA,IAAA,CAAK,iBAAA,GAAoB,iBAAA;AACzB,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,iBAAA,GAAoB,iBAAA;AACzB,IAAA,IAAA,CAAK,uBAAA,GAA2B,QAAQ,iBAAA,GAAqB,GAAA;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,GAAA,EAAsB;AAC5B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,sBAAsB,GAAG,CAAA;AAE9B,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,CAAC,MAAA,EAAQ;AAKX,MAAA,IAAA,CAAK,uBAAA,EAAwB;AAC7B,MAAA,MAAA,GAAS,EAAE,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,cAAc,GAAA,EAAI;AACjD,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAAA,IAC9B,CAAA,MAAO;AACL,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,YAAA;AAC/B,MAAA,IAAI,YAAY,CAAA,EAAG;AACjB,QAAA,MAAA,CAAO,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,KAAA,EAAO,OAAO,MAAA,GAAU,SAAA,GAAY,GAAA,GAAQ,IAAA,CAAK,iBAAiB,CAAA;AAChG,QAAA,MAAA,CAAO,YAAA,GAAe,GAAA;AAAA,MACxB;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,OAAO,KAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,IAAU,CAAA;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,sBAAsB,GAAA,EAAmB;AAC/C,IAAA,IAAA,CAAK,eAAA,EAAA;AACL,IAAA,IAAI,IAAA,CAAK,kBAAkB,4BAAA,EAA8B;AACzD,IAAA,IAAA,CAAK,eAAA,GAAkB,CAAA;AACvB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,CAAA,IAAK,KAAK,OAAA,EAAS;AACxC,MAAA,IAAI,GAAA,GAAM,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK,uBAAA,EAAyB;AAC7D,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCQ,uBAAA,GAAgC;AACtC,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,IAAA,GAAO,IAAA,CAAK,iBAAA,EAAmB;AAChD,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,kBAAA,GAAqB,QAAA;AACzB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,CAAA,IAAK,KAAK,OAAA,EAAS;AACxC,MAAA,IAAI,MAAA,CAAO,eAAe,kBAAA,EAAoB;AAC5C,QAAA,kBAAA,GAAqB,MAAA,CAAO,YAAA;AAC5B,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAAA,IACF;AACA,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,OAAO,SAAS,CAAA;AAAA,EAC5D;AACF,CAAA;AAuCO,SAAS,gCAAA,CACd,SACA,aAAA,EAC4B;AAC5B,EAAA,MAAM,QAAA,GAAuC,EAAE,WAAA,EAAa,CAAA,EAAG,iBAAiB,CAAA,EAAE;AAElF,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,MAAA,EAAgB,QAAA,EAAoC;AAChE,QAAA,QAAA,CAAS,WAAA,IAAe,CAAA;AACxB,QAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACjC,QAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxB,UAAA,QAAA,CAAS,OAAO,GAAG,CAAA;AACnB,UAAA,OAAO,IAAA;AAAA,QACT;AACA,QAAA,QAAA,CAAS,eAAA,IAAmB,CAAA;AAC5B,QAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACtB,UAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,UAAA,aAAA,CAAc,QAAA,EAAA,iBAAU,IAAI,IAAA,EAAK,EAAE,aAAa,CAAA;AAAA,QAClD;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AACF,GACF;AACF;ACxQO,SAAS,6CAAA,CACd,IACA,mBAAA,EACA,OAAA,EACA,QAAoC,CAAC,QAAA,KAAa,QAAA,CAAS,KAAA,EAAM,EAC1D;AACP,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,EAAE,CAAA;AAAA,EACV,SAAS,UAAA,EAAY;AACnB,IAAA,MAAM,IAAI,cAAA,CAAe,CAAC,mBAAA,EAAqB,UAAU,GAAG,OAAO,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,mBAAA;AACR;AAeO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAChD,YAAY,KAAA,EAAgB;AAC1B,IAAA,KAAA;AAAA,MACE;AAAA,KAIF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AAGA,IAAM,cAAA,GAAiB,EAAA;AACvB,IAAM,cAAA,GAAiB,CAAA;AAsBhB,SAAS,2BAA2B,WAAA,EAA8B;AACvE,EAAA,MAAM,CAAC,QAAA,EAAU,QAAQ,CAAA,GAAI,WAAA,CAAY,MAAM,GAAG,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,OAAO,QAAQ,CAAA;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAO,QAAQ,CAAA;AAC7B,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,IAAA;AAC/D,EAAA,OAAO,KAAA,GAAQ,cAAA,IAAmB,KAAA,KAAU,cAAA,IAAkB,KAAA,IAAS,cAAA;AACzE;AAEA,IAAI,YAAA;AAgBJ,SAAS,gBAAA,GAAiD;AACxD,EAAA,IAAI,cAAc,OAAO,YAAA;AACzB,EAAA,IAAI,CAAC,0BAAA,CAA2B,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,IAAI,KAAA;AAAA,QACF,gCAAgC,cAAc,CAAA,CAAA,EAAI,cAAc,CAAA,YAAA,EAAe,OAAA,CAAQ,SAAS,IAAI,CAAA;AAAA;AACtG,KACF;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAMA,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAA,YAAA,GAAeA,SAAQ,aAAa,CAAA;AACpC,IAAA,OAAO,YAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,uBAAuB,GAAG,CAAA;AAAA,EACtC;AACF;AAuBA,IAAM,uBAAA,GAA0B,GAAA;AAGhC,IAAM,gBAAA,GAAmB,GAAA;AAEzB,IAAM,eAAA,GAAkB,GAAA;AAkBjB,SAAS,kBAAA,CACd,IAAA,EACA,OAAA,EACA,MAAA,EACc;AACd,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,gBAAA,EAAiB;AAC1C,EAAA,IAAI,SAAS,UAAA,EAAY;AACvB,IAAA,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA,EAAG,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,iBAAiB,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa,IAAA,EAAM,EAAE,OAAA,EAAS,uBAAA,EAAyB,GAAG,OAAA,EAAS,CAAA;AAClF,EAAA,IAAI;AACF,IAAA,MAAA,EAAQ,SAAS,YAAY,CAAA;AAC7B,IAAA,IAAI,SAAS,UAAA,EAAY;AACvB,MAAA,EAAA,CAAG,KAAK,4BAA4B,CAAA;AACpC,MAAA,MAAA,EAAQ,SAAS,WAAW,CAAA;AAAA,IAC9B;AACA,IAAA,OAAO,EAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,6CAAA;AAAA,MACE,EAAA;AAAA,MACA,KAAA;AAAA,MACA,6EAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AACF;AAkBO,SAAS,4BAA4B,MAAA,EAAsB;AAChE,EAAA,IAAI,WAAW,UAAA,EAAY;AAC3B,EAAA,KAAA,MAAW,SAAA,IAAa,CAAC,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAM,CAAA,EAAG;AAClE,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,SAAA,CAAU,WAAW,gBAAgB,CAAA;AAAA,IACvC;AAAA,EACF;AACF;;;ACjKA,IAAM,0BAAA,GAA6B,EAAA;AACnC,IAAM,yBAAA,GAA4B,GAAA;AAClC,IAAM,0BAA0B,EAAA,GAAK,GAAA;AACrC,IAAM,oBAAA,GAAuB,EAAA;AAC7B,IAAM,qBAAA,GAAwB,GAAA;AAE9B,IAAM,MAAA,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiGf,IAAM,oBAAN,MAAwB;AAAA,EACb,EAAA;AAAA,EACT,KAAA,GAAuB,QAAQ,OAAA,EAAQ;AAAA,EACvC,QAAA,GAAW,KAAA;AAAA,EACX,aAAA;AAAA,EAEA,YAAY,IAAA,EAAc;AACxB,IAAA,IAAA,CAAK,EAAA,GAAK,mBAAmB,IAAI,CAAA;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,cAAc,IAAA,CAAK,EAAA,CACtB,OAAA,CAAQ,2FAA2F,EACnG,GAAA,EAAI;AACP,MAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAC7B,QAAA,MAAM,gBAAgB,IAAA,CAAK,EAAA,CACxB,OAAA,CAAQ,iEAAiE,EACzE,GAAA,EAAI;AACP,QAAA,IAAI,aAAA,EAAe,UAAU,qBAAA,EAAuB;AAClD,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,0CAA0C,IAAA,CAAK,SAAA,CAAU,eAAe,KAAK,CAAC,yBACrD,qBAAqB,CAAA;AAAA,WAChD;AAAA,QACF;AAAA,MACF;AACA,MAAA,IAAA,CAAK,EAAA,CAAG,KAAK,MAAM,CAAA;AACnB,MAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAC7B,QAAA,IAAA,CAAK,EAAA,CACF,OAAA,CAAQ,wEAAwE,CAAA,CAChF,IAAI,qBAAqB,CAAA;AAAA,MAC9B;AACA,MAAA,2BAAA,CAA4B,IAAI,CAAA;AAAA,IAClC,SAAS,KAAA,EAAO;AACd,MAAA,6CAAA;AAAA,QACE,IAAA,CAAK,EAAA;AAAA,QACL,KAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAO,SAAA,EAA6D;AAClE,IAAA,IAAI,IAAA,CAAK,UAAU,OAAO,OAAA,CAAQ,OAAO,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAC3F,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,SAAA,CAAU,IAAA,CAAK,EAAE,CAAC,CAAA;AACvD,IAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,MAAA,EAAW,MAAM,MAAS,CAAA;AACzD,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,YAAe,SAAA,EAA6D;AAC1E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,OAAO,EAAA,KAAO;AAC5B,MAAA,EAAA,CAAG,KAAK,iBAAiB,CAAA;AACzB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,EAAE,CAAA;AACjC,QAAA,EAAA,CAAG,KAAK,QAAQ,CAAA;AAChB,QAAA,OAAO,MAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAK,UAAU,CAAA;AAAA,QACpB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,GAAuB;AACrB,IAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW,OAAO,IAAA,CAAK,aAAA;AAClD,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,IAAA,CAAK,EAAA,CAAG,OAAO,CAAA;AAC1D,IAAA,OAAO,IAAA,CAAK,aAAA;AAAA,EACd;AACF,CAAA;AAkBA,SAAS,QAAQ,GAAA,EAA2B;AAC1C,EAAA,OAAO;AAAA,IACL,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,QAAQ,GAAA,CAAI,OAAA;AAAA,IACZ,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,GAAI,GAAA,CAAI,cAAA,KAAmB,IAAA,GAAO,EAAC,GAAI,EAAE,QAAA,EAAU,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,cAAc,CAAA,EAAc;AAAA,IAC9F,GAAI,IAAI,eAAA,KAAoB,IAAA,GAAO,EAAC,GAAI,EAAE,aAAA,EAAe,GAAA,CAAI,eAAA,EAAgB;AAAA,IAC7E,GAAI,IAAI,eAAA,KAAoB,IAAA,GAAO,EAAC,GAAI,EAAE,cAAA,EAAgB,GAAA,CAAI,eAAA,EAA6B;AAAA,IAC3F,GAAI,GAAA,CAAI,iCAAA,KAAsC,IAAA,GAC1C,EAAC,GACD,EAAE,0BAAA,EAA4B,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,iCAAiC,CAAA,EAAyB;AAAA,IAC3G,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,GAAI,IAAI,cAAA,KAAmB,IAAA,GAAO,EAAC,GAAI,EAAE,aAAA,EAAe,GAAA,CAAI,cAAA,EAAe;AAAA,IAC3E,GAAI,GAAA,CAAI,yBAAA,KAA8B,IAAA,GAClC,EAAC,GACD;AAAA,MACE,YAAA,EAAc;AAAA,QACZ,aAAa,GAAA,CAAI,yBAAA;AAAA,QACjB,GAAI,IAAI,mBAAA,KAAwB,IAAA,GAAO,EAAC,GAAI,EAAE,MAAA,EAAQ,GAAA,CAAI,mBAAA;AAAoB;AAChF,KACF;AAAA,IACJ,WAAW,GAAA,CAAI;AAAA,GACjB;AACF;AAEA,SAAS,QAAA,CAAS,EAAA,EAAkB,MAAA,EAAkB,MAAA,EAAyC;AAC7F,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,gEAAgE,CAAA,CAAE,GAAA,CAAI,QAAQ,MAAM,CAAA;AAG3G,EAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,OAAA,CAAQ,GAAG,CAAA;AACpD;AAEA,SAAS,YAAA,CAAa,MAA4B,KAAA,EAAsC;AACtF,EAAA,OAAO,MAAM,OAAA,KAAY,KAAA,EAAO,OAAA,IAAW,IAAA,EAAM,oBAAoB,KAAA,EAAO,eAAA;AAC9E;AAEO,IAAM,yBAAN,MAAyD;AAAA,EAC9D,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,IAAA,CAAK,QAAkB,KAAA,EAAwF;AAC7G,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA,0CAAA;AAAA,QAGA,GAAA,CAAI,MAAA,EAAQ,MAAM,MAAA,EAAQ,KAAA,CAAM,UAAU,KAAA,CAAM,QAAA,KAAa,MAAA,GAAY,IAAA,GAAO,KAAK,SAAA,CAAU,KAAA,CAAM,QAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAC7H,MAAA,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAAA,IAC1C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,iBAAA,CACE,QACA,KAAA,EACqD;AACrD,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,SAAS,EAAA,CAAG,OAAA;AAAA,QAChB,CAAA;AAAA;AAAA,0CAAA;AAAA,OAGF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,QAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AACvF,MAAA,OAAO,EAAE,OAAA,EAAS,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA,EAAI,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,OAAO,MAAM,CAAA,EAAE;AAAA,IAC/F,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,mBAAA,CACE,QACA,KAAA,EAC8C;AAC9C,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AACjD,MAAA,IAAI,YAAY,MAAA,IAAa,OAAA,CAAQ,QAAA,KAAa,KAAA,CAAM,UAAU,OAAO,UAAA;AACzE,MAAA,MAAM,WAAW,EAAA,CAAG,OAAA;AAAA,QAClB;AAAA,OACF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1B,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,OAAO,QAAA,CAAS,eAAe,KAAA,CAAM,SAAA,IAAa,SAAS,YAAA,KAAiB,KAAA,CAAM,cAC9E,SAAA,GACA,UAAA;AAAA,MACN;AAIA,MAAA,IACE,OAAA,CAAQ,YAAA,KAAiB,MAAA,IACzB,CAAC,CAAC,SAAA,EAAW,SAAA,EAAW,SAAS,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,MAAM,GAC1D,OAAO,UAAA;AACT,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,4BAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,SAAA,EAAW,MAAM,WAAW,CAAA;AAC9D,MAAA,OAAO,UAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,gBAAA,CACE,QACA,KAAA,EAC4C;AAC5C,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AACjD,MAAA,IAAI,OAAA,EAAS,QAAA,KAAa,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AACjD,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,QACb,CAAA;AAAA,oFAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,SAAA,EAAW,MAAM,WAAW,CAAA;AAG9D,MAAA,OAAO,GAAA,KAAQ,SACX,MAAA,GACA;AAAA,QACE,WAAW,GAAA,CAAI,UAAA;AAAA,QACf,aAAa,GAAA,CAAI,YAAA;AAAA,QACjB,GAAI,IAAI,aAAA,KAAkB,IAAA,GAAO,EAAC,GAAI,EAAE,YAAA,EAAc,GAAA,CAAI,aAAA;AAAc,OAC1E;AAAA,IACN,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,oBAAA,CACE,QACA,KAAA,EAC4C;AAC5C,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AACjD,MAAA,IAAI,OAAA,EAAS,QAAA,KAAa,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AACjD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,8GAAA;AAAA,OAEF,CAAE,GAAA,CAAI,KAAA,CAAM,YAAA,EAAc,MAAA,EAAQ,MAAM,MAAA,EAAQ,KAAA,CAAM,SAAA,EAAW,KAAA,CAAM,WAAW,CAAA;AAClF,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,QACb,CAAA;AAAA,oFAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,SAAA,EAAW,MAAM,WAAW,CAAA;AAG9D,MAAA,OAAO,GAAA,KAAQ,SACX,MAAA,GACA;AAAA,QACE,WAAW,GAAA,CAAI,UAAA;AAAA,QACf,aAAa,GAAA,CAAI,YAAA;AAAA,QACjB,GAAI,IAAI,aAAA,KAAkB,IAAA,GAAO,EAAC,GAAI,EAAE,YAAA,EAAc,GAAA,CAAI,aAAA;AAAc,OAC1E;AAAA,IACN,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,GAAA,CAAI,QAAkB,MAAA,EAAkD;AACtE,IAAA,OAAO,IAAA,CAAK,YAAY,GAAA,CAAI,CAAC,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EAClE;AAAA,EAEA,OAAA,CAAQ,QAAkB,OAAA,EAA6D;AACrF,IAAA,OAAO,IAAA,CAAK,YAAY,GAAA,CAAI,CAAC,OAAO,OAAA,CAAQ,OAAA,CAAQ,CAAC,MAAA,KAAW;AAC9D,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAC3C,MAAA,OAAO,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,CAAC,OAAO,CAAA;AAAA,IAC9C,CAAC,CAAC,CAAA;AAAA,EACJ;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,KAAA,EAAuD;AAClF,IAAA,0BAAA,CAA2B,MAAM,KAAK,CAAA;AACtC,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,CAAA;AAAA,gDAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,UAAU,EAAA,EAAI,KAAA,CAAM,QAAQ,CAAC,CAAA;AACjD,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,GAAS,KAAA,CAAM,KAAA;AACpC,MAAA,MAAM,QAAA,GAAW,KAAK,KAAA,CAAM,CAAA,EAAG,MAAM,KAAK,CAAA,CAAE,IAAI,OAAO,CAAA;AACvD,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,EAAA,CAAG,EAAE,CAAA;AAC3B,MAAA,OAAO,EAAE,QAAA,EAAU,GAAI,OAAA,IAAW,IAAA,KAAS,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,MAAA,EAAO,GAAI,EAAC,EAAG;AAAA,IAC3F,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,CACE,QACA,KAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA;AAAA,uEAAA;AAAA,OAIF,CAAE,GAAA;AAAA,QACA,KAAA,CAAM,QAAA;AAAA,QACN,MAAM,OAAA,IAAW,IAAA;AAAA,QACjB,MAAM,YAAA,KAAiB,MAAA,GAAY,OAAO,IAAA,CAAK,SAAA,CAAU,MAAM,YAAY,CAAA;AAAA,QAC3E,KAAK,IAAA,EAAK;AAAA,QACV,MAAA;AAAA,QACA,KAAA,CAAM,MAAA;AAAA,QACN,KAAA,CAAM;AAAA,OACR;AACA,MAAA,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAAA,IAC1C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAA,CACE,QACA,KAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AAClD,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,MAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,UAAU,KAAA,CAAM,QAAQ,GAAG,OAAO,QAAA;AAC7D,MAAA,IAAI,QAAA,CAAS,iBAAiB,MAAA,EAAW;AACvC,QAAA,IAAI,MAAM,MAAA,KAAW,WAAA,IAAe,QAAA,CAAS,MAAA,KAAW,aAAa,OAAO,QAAA;AAAA,MAC9E,CAAA,MAAA,IAAW,CAAC,UAAA,EAAY,QAAA,EAAU,WAAW,CAAA,CAAE,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AACxE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,4CAAA;AAAA,OAEF,CAAE,GAAA,CAAI,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,aAAA,IAAiB,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,EAAG,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAClF,MAAA,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAAA,IAC1C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,IAAA,GAAe;AACb,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY;AAAA,EACtC;AACF,CAAA;AAcA,SAAS,eAAe,GAAA,EAAiC;AACvD,EAAA,OAAO;AAAA,IACL,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,IACnB,WAAW,GAAA,CAAI,UAAA;AAAA,IACf,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,YAAY,GAAA,CAAI;AAAA,GAClB;AACF;AAEA,SAAS,mBAAA,CAAoB,EAAA,EAAkB,KAAA,EAAc,MAAA,EAAkB,QAAA,EAAwB;AACrG,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,MAAM,IAAI,aAAA,CAAc,2BAAA,EAA6B,8BAA8B,CAAA;AAAA,EACrF;AACA,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA,wFAAA;AAAA,GACF,CAAE,IAAI,MAAA,EAAQ,QAAA,EAAU,MAAM,GAAA,EAAI,CAAE,aAAa,CAAA;AACnD;AAEA,SAAS,UAAA,CAAW,EAAA,EAAkB,KAAA,EAAc,MAAA,EAAkB,QAAA,EAAsC;AAC1G,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,IACb,CAAA,qGAAA;AAAA,GACF,CAAE,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AACtB,EAAA,OAAO,QAAQ,MAAA,GACX,EAAE,QAAA,EAAU,MAAA,EAAQ,UAAU,YAAA,EAAc,CAAA,EAAG,QAAA,EAAU,CAAA,EAAG,WAAW,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,IAAc,GACjG;AAAA,IACE,QAAA,EAAU,MAAA;AAAA,IACV,QAAA;AAAA,IACA,YAAA,EAAc,MAAA,CAAO,GAAA,CAAI,aAAa,CAAA;AAAA,IACtC,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,WAAW,GAAA,CAAI;AAAA,GACjB;AACN;AAEA,eAAe,aAAA,CACb,EAAA,EACA,KAAA,EACA,MAAA,EACA,KAAA,EACyB;AACzB,EAAA,mBAAA,CAAoB,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AACrD,EAAA,MAAM,WAAW,EAAA,CAAG,OAAA;AAAA,IAClB,CAAA,sFAAA;AAAA,IACA,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,MAAM,SAAS,CAAA;AAC7C,EAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,cAAA,CAAe,QAAQ,CAAA;AAC1D,EAAA,MAAM,SAAS,EAAA,CAAG,OAAA;AAAA,IAChB,CAAA,yEAAA;AAAA,GACF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA;AAClC,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,WAAA,CAAY,GAAG,CAAA;AAChD,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA;AAAA;AAAA,+CAAA;AAAA,GAGF,CAAE,GAAA;AAAA,IACA,MAAA;AAAA,IACA,KAAA,CAAM,QAAA;AAAA,IACN,GAAA;AAAA,IACA,KAAA,CAAM,SAAA;AAAA,IACN,YAAA,CAAa,IAAA;AAAA,IACb,YAAA,CAAa,QAAA;AAAA,IACb,MAAA,CAAO,aAAa,QAAQ,CAAA;AAAA,IAC5B,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA;AAAY,GAC1B;AACA,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA,4EAAA;AAAA,IACA,GAAA,CAAI,GAAA,GAAM,CAAA,EAAG,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACrC,EAAA,OAAO,eAAe,EAAA,CAAG,OAAA;AAAA,IACvB,CAAA,+EAAA;AAAA,IACA,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,GAAG,CAAe,CAAA;AAClD;AAEO,IAAM,qBAAN,MAAiD;AAAA,EACtD,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,MAAA,CAAO,QAAkB,KAAA,EAAoD;AAC3E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO,aAAA,CAAc,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,KAAK,CAAC,CAAA;AAAA,EAC1F;AAAA,EAEA,SAAA,CAAU,QAAkB,KAAA,EAA+C;AACzE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,0BAAA;AAC7B,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,CAAA;AAAA;AAAA,6BAAA;AAAA,OAGF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,UAAU,KAAA,CAAM,QAAA,EAAU,QAAQ,CAAC,CAAA;AACvD,MAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,KAAK,CAAA,CAAE,IAAI,cAAc,CAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,EAAA,CAAG,EAAE,CAAA;AACvB,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,CAAA;AAAA,oEAAA;AAAA,OAEF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAC5B,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS,IAAA,EAAM,GAAA,IAAO,KAAA,CAAM,QAAA;AAAA,QAC5B,OAAA,EAAS,KAAK,MAAA,GAAS,KAAA;AAAA,QACvB,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,CAAC,CAAA,GAAI;AAAA,OAC5C;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,cAAA,CAAe,QAAkB,KAAA,EAAgE;AAC/F,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,mBAAA,CAAoB,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAC1D,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,8CAAA;AAAA,QAEA,GAAA,CAAI,KAAA,CAAM,YAAA,EAAc,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAChD,MAAA,OAAO,WAAW,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,aAAA,CAAc,QAAkB,KAAA,EAA+D;AAC7F,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,mBAAA,CAAoB,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAC1D,MAAA,MAAM,UAAU,UAAA,CAAW,EAAA,EAAI,KAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACjE,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY;AAChD,MAAA,IAAI,KAAA,CAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,EAAU;AACrC,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,2BAAA;AAAA,UACA,CAAA,kBAAA,EAAqB,MAAM,QAAQ,CAAA,OAAA,EAAU,QAAQ,QAAQ,CAAA,8BAAA,EAAiC,MAAM,QAAQ,CAAA,CAAA,CAAA;AAAA,UAC5G,OAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,KAAA,CAAM,QAAA,GAAW,OAAA,CAAQ,YAAA,EAAc;AACzC,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,kCAAA;AAAA,UACA,CAAA,kBAAA,EAAqB,MAAM,QAAQ,CAAA,uBAAA,EAA0B,QAAQ,YAAY,CAAA,wCAAA,EAA2C,MAAM,QAAQ,CAAA,CAAA,CAAA;AAAA,UAC1I,OAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA,6FAAA;AAAA,QACA,GAAA,CAAI,KAAA,CAAM,UAAU,UAAA,EAAY,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACxD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,iFAAA;AAAA,QAEA,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,MAAM,QAAQ,CAAA;AAC5C,MAAA,OAAO,WAAW,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,UAAA,CAAW,QAAkB,QAAA,EAA+C;AAC1E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO,UAAA,CAAW,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAAA,EAClF;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,KAAA,EAA+D;AACpG,IAAA,wBAAA,CAAyB,KAAA,CAAM,aAAa,aAAa,CAAA;AACzD,IAAA,wBAAA,CAAyB,KAAA,CAAM,qBAAqB,qBAAqB,CAAA;AACzE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,YAAA,GAAe,KAAA,CAAM,QAAA,KAAa,MAAA,GAAY,EAAA,GAAK,oBAAA;AACzD,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,QAAA,KAAa,MAAA,GAAY,CAAC,MAAM,CAAA,GAAI,CAAC,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAChF,MAAA,MAAM,QAAQ,EAAA,CAAG,OAAA;AAAA,QACf,CAAA;AAAA,4BAAA,EACsB,YAAY,CAAA,wCAAA;AAAA,OACpC,CAAE,GAAA,CAAI,GAAG,MAAA,EAAQ,MAAM,WAAW,CAAA;AAClC,MAAA,MAAM,UAAU,EAAA,CAAG,OAAA;AAAA,QACjB,CAAA;AAAA,4BAAA,EACsB,YAAY,CAAA,wCAAA;AAAA,OACpC,CAAE,GAAA,CAAI,GAAG,MAAA,EAAQ,MAAM,WAAW,CAAA;AAClC,MAAA,MAAM,UAAU,EAAA,CAAG,OAAA;AAAA,QACjB,CAAA;AAAA,4BAAA,EACsB,YAAY,CAAA,0CAAA;AAAA,OACpC,CAAE,GAAA,CAAI,GAAG,MAAA,EAAQ,MAAM,mBAAmB,CAAA;AAC1C,MAAA,OAAO;AAAA,QACL,YAAA,EAAc,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA;AAAA,QACpC,YAAA,EAAc,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA;AAAA,QACpC,aAAA,EAAe,KAAA,CAAM,MAAA,CAAO,CAAC,GAAA,EAAK,GAAA,KAAQ,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA,EAAG,EAAE;AAAA,OAC3E;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAEO,IAAM,8BAAN,MAAmE;AAAA,EACxE,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,OAAA,CAAQ,QAAkB,KAAA,EAA+E;AACvG,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,OAAO,EAAA,KAAO;AAChD,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AAClD,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,MAAA,IACE,QAAA,CAAS,YAAA,KAAiB,MAAA,IAC1B,CAAC,YAAY,QAAA,EAAU,WAAW,CAAA,CAAE,QAAA,CAAS,SAAS,MAAM,CAAA,EAC5D,OAAO,EAAE,SAAS,QAAA,EAAS;AAE7B,MAAA,MAAM,oBAAqB,EAAA,CAAG,OAAA;AAAA,QAC5B,CAAA,oFAAA;AAAA,OACF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA,CAAiD,uBAAA;AAC3E,MAAA,IAAI,sBAAsB,IAAA,EAAM;AAC9B,QAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,UACb,CAAA,sFAAA;AAAA,SACF,CAAE,GAAA,CAAI,MAAA,EAAQ,QAAA,CAAS,UAAU,iBAAiB,CAAA;AAClD,QAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,UAAA,IAAI,SAAS,MAAA,KAAW,WAAA,EAAa,OAAO,EAAE,SAAS,QAAA,EAAS;AAChE,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,iBAAiB,CAAA,qBAAA,EAAwB,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,QAClG;AACA,QAAA,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,cAAA,CAAe,GAAG,CAAA,EAAE;AAAA,MAC3D;AAEA,MAAA,MAAM,UAAU,MAAM,aAAA,CAAc,EAAA,EAAI,IAAA,CAAK,OAAO,MAAA,EAAQ;AAAA,QAC1D,UAAU,QAAA,CAAS,QAAA;AAAA,QACnB,WAAW,KAAA,CAAM,iBAAA;AAAA,QACjB,aAAa,CAAC,GAAA,KAAQ,MAAM,WAAA,CAAY,GAAA,EAAK,MAAM,iBAAiB;AAAA,OACrE,CAAA;AACD,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY;AACjD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA;AAAA,4CAAA;AAAA,OAIF,CAAE,GAAA,CAAI,WAAA,EAAa,KAAA,CAAM,MAAA,IAAU,IAAA,EAAM,KAAA,CAAM,iBAAA,EAAmB,WAAA,EAAa,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AACnG,MAAA,OAAO,EAAE,SAAS,QAAA,CAAS,EAAA,EAAI,QAAQ,KAAA,CAAM,MAAM,GAAI,OAAA,EAAQ;AAAA,IACjE,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAcA,SAAS,YAAY,GAAA,EAAuC;AAC1D,EAAA,OAAO;AAAA,IACL,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,aAAa,GAAA,CAAI,YAAA;AAAA,IACjB,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,WAAW,GAAA,CAAI,UAAA;AAAA,IACf,WAAW,GAAA,CAAI,UAAA;AAAA,IACf,GAAI,IAAI,iBAAA,KAAsB,IAAA,GAAO,EAAC,GAAI,EAAE,eAAA,EAAiB,GAAA,CAAI,iBAAA;AAAkB,GACrF;AACF;AAEA,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA,6EAAA,CAAA;AAKxB,SAAS,YAAA,CAAa,EAAA,EAAkB,MAAA,EAAkB,IAAA,EAAoD;AAC5G,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,IACb,GAAG,eAAe,CAAA,kEAAA;AAAA,GACpB,CAAE,GAAA,CAAI,MAAA,EAAQ,IAAI,CAAA;AAClB,EAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,WAAA,CAAY,GAAG,CAAA;AACxD;AAEA,SAAS,eAAA,CAAgB,EAAA,EAAkB,MAAA,EAAkB,IAAA,EAAwC;AACnG,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAA;AAC3C,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,MAAM,IAAI,aAAA,CAAc,kBAAA,EAAoB,CAAA,OAAA,EAAU,IAAI,CAAA,oCAAA,CAAsC,CAAA;AAAA,EAClG;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,EAAA,EAAkB,KAAA,EAAc,MAAA,EAAkB,KAAA,EAAiD;AACtH,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AACpD,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,KAAA,KAAU,WAAW,OAAO,QAAA;AACnE,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY;AACpC,EAAA,EAAA,CAAG,QAAQ,+DAA+D,CAAA,CAAE,GAAA,CAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AAClG,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mGAAA;AAAA,GAMF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA,EAAG,KAAA,CAAM,WAAA,EAAa,GAAA,EAAK,GAAG,CAAA;AAC7E,EAAA,OAAO,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAC5C;AAEO,IAAM,oBAAN,MAA+C;AAAA,EACpD,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,WAAA,CAAY,QAAkB,KAAA,EAA0D;AACtF,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO,WAAA,CAAY,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,KAAK,CAAC,CAAA;AAAA,EACxF;AAAA,EAEA,MAAA,CAAO,QAAkB,KAAA,EAAwD;AAC/E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,MAAA,IAAI,QAAQ,QAAA,KAAa,KAAA,CAAM,oBAAoB,OAAA,CAAQ,WAAA,KAAgB,MAAM,mBAAA,EAAqB;AACpG,QAAA,MAAM,IAAI,aAAA;AAAA,UACR,4BAAA;AAAA,UACA,CAAA,gBAAA,EAAmB,MAAM,IAAI,CAAA,sCAAA;AAAA,SAC/B;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,WAAA,EAAa,OAAO,OAAA;AAC1C,MAAA,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,EAAI,MAAA,EAAQ,SAAS,WAAW,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,GAAA,CAAI,QAAkB,IAAA,EAA6D;AACjF,IAAA,OAAO,IAAA,CAAK,YAAY,GAAA,CAAI,CAAC,OAAO,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAC,CAAA;AAAA,EACpE;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,KAAA,EAAiE;AAC5F,IAAA,IAAI,KAAA,CAAM,wBAAwB,MAAA,EAAW;AAC3C,MAAA,wBAAA,CAAyB,KAAA,CAAM,qBAAqB,qBAAqB,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,GAAG,eAAe;AAAA;AAAA;AAAA,4EAAA;AAAA,OAIpB,CAAE,GAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAM,KAAA,IAAS,IAAA;AAAA,QACf,MAAM,KAAA,IAAS,IAAA;AAAA,QACf,MAAM,mBAAA,IAAuB,IAAA;AAAA,QAC7B,MAAM,mBAAA,IAAuB,IAAA;AAAA,QAC7B,MAAM,KAAA,IAAS;AAAA,OACjB;AACA,MAAA,OAAO,IAAA,CAAK,IAAI,WAAW,CAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAA,CAAa,QAAkB,KAAA,EAA2D;AACxF,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,MAAA,IAAI,OAAA,CAAQ,UAAU,WAAA,EAAa;AACjC,QAAA,MAAM,IAAI,cAAc,sBAAA,EAAwB,CAAA,0CAAA,EAA6C,MAAM,IAAI,CAAA,IAAA,EAAO,OAAA,CAAQ,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,MAChI;AACA,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,+BAAA;AAAA,OAEF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,KAAA,CAAM,OAAA,EAAS,KAAA,CAAM,KAAA,EAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,aAAa,CAAA;AACpF,MAAA,EAAA,CAAG,OAAA,CAAQ,4EAA4E,CAAA,CACpF,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY,EAAG,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzD,MAAA,OAAO,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAAA,IAC/C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,eAAA,CAAgB,QAAkB,KAAA,EAA2D;AAC3F,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACtC,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA,6FAAA;AAAA,OACF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,KAAA,CAAM,OAAA,EAAS,MAAM,KAAK,CAAA;AACpD,MAAA,EAAA,CAAG,OAAA,CAAQ,4EAA4E,CAAA,CACpF,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY,EAAG,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzD,MAAA,OAAO,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAAA,IAC/C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,iBAAA,CAAkB,QAAkB,IAAA,EAAiD;AACnF,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAA;AAChD,MAAA,IAAI,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC1B,QAAA,MAAM,IAAI,cAAc,sBAAA,EAAwB,CAAA,OAAA,EAAU,IAAI,CAAA,WAAA,EAAc,OAAA,CAAQ,QAAQ,CAAA,cAAA,CAAgB,CAAA;AAAA,MAC9G;AACA,MAAA,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,EAAI,MAAA,EAAQ,SAAS,gBAAgB,CAAA;AAAA,IAC/D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,WAAA,CAAY,QAAkB,IAAA,EAAiD;AAC7E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,EAAI,MAAA,EAAQ,gBAAgB,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAA,EAAG,SAAS,CAAC,CAAA;AAAA,EACxH;AAAA,EAEA,WAAA,CACE,EAAA,EACA,MAAA,EACA,OAAA,EACA,IAAA,EACqB;AACrB,IAAA,IAAI,CAAC,uBAAA,CAAwB,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,cAAc,sBAAA,EAAwB,CAAA,EAAG,QAAQ,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,2CAAA,CAA6C,CAAA;AAAA,IAC1H;AACA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY;AACzC,IAAA,EAAA,CAAG,OAAA;AAAA,MACD,CAAA;AAAA,uCAAA;AAAA,KAEF,CAAE,GAAA,CAAI,IAAA,EAAM,GAAA,EAAK,IAAA,KAAS,gBAAA,GAAmB,GAAA,GAAM,OAAA,CAAQ,eAAA,IAAmB,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,IAAI,CAAA;AACxG,IAAA,OAAO,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,OAAA,CAAQ,IAAI,CAAA;AAAA,EACjD;AACF,CAAA;AAaA,SAAS,oBAAA,CAAqB,QAAkB,WAAA,EAAuC;AACrF,EAAA,IACE,WAAA,CAAY,QAAA,KAAa,MAAA,IACzB,WAAA,CAAY,IAAA,KAAS,QAAA,IACrB,WAAA,CAAY,KAAA,KAAU,UAAA,IACtB,WAAA,CAAY,aAAA,IAAiB,EAAA,EAC7B;AACF,EAAA,MAAM,IAAI,aAAA;AAAA,IACR,4BAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,IAAM,qBAAN,MAAyB;AAAA,EAIvB,WAAA,CACW,WAAA,EACA,KAAA,EACA,MAAA,EACT,QAAA,EACA;AAJS,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAGT,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,MAAM,MAAM,WAAA,CAAY,EAAA,CAAG,OAAA,CAAQ,sEAAsE,EAAE,GAAA,EAAI;AAG/G,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,QAAQ,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,oBAAoB,CAAC,CAAA;AACpF,MAAA,WAAA,CAAY,EAAA,CAAG,OAAA;AAAA,QACb;AAAA,OACF,CAAE,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,QAAA,CAAS,WAAW,CAAC,CAAA;AAAA,IAChD;AACA,IAAA,MAAM,SAAS,WAAA,CAAY,EAAA,CAAG,OAAA,CAAQ,sEAAsE,EAAE,GAAA,EAAI;AAClH,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,OAAO,WAAW,CAAA;AAAA,EACrD;AAAA,EAjBW,WAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EANF,MAAA;AAAA,EACA,QAAA;AAAA,EAsBT,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAwC;AACpE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,KAAI,CAAE,OAAA,KAAY,IAAA,CAAK,QAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AAClF,IAAA,OAAO,GAAG,mBAAA,CAAoB,MAAM,CAAC,CAAA,KAAA,EAAQ,GAAG,QAAQ,GAAG,CAAA,CAAA;AAAA,EAC7D;AACF,CAAA;AAEO,IAAM,uBAAN,MAAqD;AAAA,EAC1D,YAA6B,QAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAA+B;AAAA,EAA/B,QAAA;AAAA,EAE7B,MAAM,YAAA,CAAa,MAAA,EAAkB,WAAA,EAAiF;AACpH,IAAA,oBAAA,CAAqB,QAAQ,WAAW,CAAA;AACxC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,SAAS,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AACjE,MAAA,MAAM,WAAW,EAAA,CAAG,OAAA;AAAA,QAClB;AAAA,OACF,CAAE,GAAA,CAAI,MAAA,EAAQ,WAAA,CAAY,aAAa,CAAA;AACvC,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,MAAM,QAAA,GAAW,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,YAAY,WAAW,CAAA;AACjE,QAAA,IAAI,QAAA,EAAU,UAAU,WAAA,EAAa;AACnC,UAAA,MAAM,IAAI,aAAA,CAAc,sBAAA,EAAwB,CAAA,OAAA,EAAU,WAAA,CAAY,WAAW,CAAA,oCAAA,CAAsC,CAAA;AAAA,QACzH;AACA,QAAA,OAAO,QAAA,CAAS,OAAA;AAAA,MAClB;AACA,MAAA,MAAM,QAAQ,WAAA,CAAY,EAAA,EAAI,IAAA,CAAK,QAAA,CAAS,OAAO,MAAA,EAAQ;AAAA,QACzD,MAAM,WAAA,CAAY,WAAA;AAAA,QAClB,UAAU,WAAA,CAAY,aAAA;AAAA,QACtB,aAAa,WAAA,CAAY;AAAA,OAC1B,CAAA;AACD,MAAA,IAAI,MAAM,QAAA,KAAa,WAAA,CAAY,iBAAiB,KAAA,CAAM,WAAA,KAAgB,YAAY,WAAA,EAAa;AACjG,QAAA,MAAM,IAAI,aAAA,CAAc,4BAAA,EAA8B,CAAA,OAAA,EAAU,WAAA,CAAY,WAAW,CAAA,+CAAA,CAAiD,CAAA;AAAA,MAC1I;AACA,MAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,QAAA,MAAM,IAAI,aAAA,CAAc,sBAAA,EAAwB,CAAA,OAAA,EAAU,WAAA,CAAY,WAAW,CAAA,oCAAA,CAAsC,CAAA;AAAA,MACzH;AACA,MAAA,MAAM,UAAU,CAAA,KAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,CAAA;AACzD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA,kCAAA;AAAA,OAGF,CAAE,GAAA,CAAI,OAAA,EAAS,MAAA,EAAQ,WAAA,CAAY,aAAA,EAAe,WAAA,CAAY,WAAA,EAAa,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA,EAAG,YAAY,WAAW,CAAA;AACrI,MAAA,OAAO,OAAA;AAAA,IACT,CAAC,CAAA;AACD,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAM,KAAK,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAE;AAAA,EACzE;AAAA,EAEA,aAAA,CAAc,MAAA,EAAkB,MAAA,EAAgB,WAAA,EAAuE;AACrH,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAC3C,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IACE,QAAQ,MAAA,IAAa,GAAA,CAAI,cAAc,MAAA,IAAU,WAAA,CAAY,aAAa,MAAA,IAC1E,GAAA,CAAI,mBAAmB,WAAA,CAAY,aAAA,IAAiB,IAAI,YAAA,KAAiB,WAAA,CAAY,eAAe,CAAC,GAAA,CAAI,UACzG,OAAO,MAAA;AACT,MAAA,OAAO,EAAE,gBAAA,EAAkB,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,cAAc,CAAC,CAAA,EAAG,mBAAA,EAAqB,GAAA,CAAI,YAAA,EAAa;AAAA,IACtG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,MAAA,EAA6C;AAClF,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,SAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AACxD,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IAAI,GAAA,KAAQ,UAAa,GAAA,CAAI,SAAA,KAAc,UAAU,CAAC,GAAA,CAAI,UAAU,OAAO,KAAA;AAC3E,MAAA,OAAO,aAAa,EAAA,EAAI,MAAA,EAAQ,GAAA,CAAI,YAA2B,GAAG,KAAA,KAAU,WAAA;AAAA,IAC9E,CAAC,CAAA;AACD,IAAA,OAAO,QAAQ,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,GAAI,MAAA;AAAA,EACxD;AACF,CAAA;AAEO,IAAM,yBAAN,MAAyD;AAAA,EAC9D,YAA6B,QAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAA+B;AAAA,EAA/B,QAAA;AAAA,EAE7B,MAAM,eAAA,CAAgB,MAAA,EAAgB,MAAA,EAAuB,KAAa,GAAA,EAA+B;AACvG,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,KAAK,OAAO,KAAA;AAC/E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,UAAA,CAAW,IAAA,CAAK,QAAA,CAAS,MAAA,EAAQ,GAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AACzG,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,eAAA,CAAgB,UAAU,GAAG,CAAA;AAAA,EAC3D;AAAA,EAEA,oBAAoB,MAAA,EAA6C;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAC3C,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,8CAA8C,CAAA,CAAE,IAAI,MAAM,CAAA;AACjF,MAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,MAAA,CAAO,IAAI,SAAS,CAAA;AAAA,IAC7D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAA,CAAa,QAAgB,IAAA,EAA4C;AACvE,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,OAAO,EAAA,KAAO;AACjD,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IAAI,QAAQ,MAAA,EAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gBAAA,EAAiB;AACpE,MAAA,IAAI,OAAO,IAAA,CAAK,MAAM,MAAM,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA,EAAG;AACjD,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,wBAAA,EAA2B,IAAI,SAAS,CAAA,WAAA,EAAc,IAAA,CAAK,MAAM,CAAA,CAAA,EAAG;AAAA,MAClG;AACA,MAAA,IAAI,MAAM,KAAK,QAAA,CAAS,MAAA,CAAO,OAAO,IAAI,CAAA,KAAM,IAAI,YAAA,EAAc;AAChE,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,MACrD;AACA,MAAA,EAAA,CAAG,OAAA,CAAQ,0DAA0D,CAAA,CAAE,GAAA,CAAI,MAAM,MAAM,CAAA;AACvF,MAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,IACpB,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAY,MAAA,EAAqD;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAC3C,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IAAI,GAAA,KAAQ,UAAa,CAAC,GAAA,CAAI,YAAY,GAAA,CAAI,IAAA,KAAS,MAAM,OAAO,MAAA;AACpE,MAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,GAAA,CAAI,IAAA,CAAK,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,UAAA,EAAY,GAAA,CAAI,IAAA,CAAK,UAAU,CAAA;AACrF,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAa,GAAA,CAAI,YAAA,EAAa,EAAE;AAAA,IACtE,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAGO,SAAS,0BAAA,CACd,SACA,YAAA,EACsB;AACtB,EAAA,MAAM,WAAA,GAAc,IAAI,iBAAA,CAAkB,OAAA,CAAQ,IAAI,CAAA;AACtD,EAAA,MAAM,OAAA,GAAU,IAAI,iBAAA,CAAkB,WAAA,EAAa,aAAa,KAAK,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,WAAA,EAAa,aAAa,KAAK,CAAA;AACtE,EAAA,MAAM,KAAA,GAAQ,IAAI,sBAAA,CAAuB,WAAA,EAAa,aAAa,KAAK,CAAA;AACxE,EAAA,MAAM,aAAA,GAAgB,IAAI,2BAAA,CAA4B,WAAA,EAAa,aAAa,KAAK,CAAA;AACrF,EAAA,MAAM,WAAW,IAAI,kBAAA;AAAA,IACnB,WAAA;AAAA,IACA,YAAA,CAAa,KAAA;AAAA,IACb,YAAA,CAAa,MAAA;AAAA,IACb,QAAQ,QAAA,IAAY;AAAA,GACtB;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,oBAAA,CAAqB,QAAQ,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,IAAI,sBAAA,CAAuB,QAAQ,CAAA;AAE5D,EAAA,MAAM,eAAe,wBAAA,CAAyB,EAAE,OAAO,YAAA,CAAa,KAAA,EAAO,CAAA,CAAE,MAAA;AAC7E,EAAA,MAAM,IAAA,GAAmB;AAAA,IACvB,GAAG,YAAA;AAAA,IACH,OAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA,EAAO,IAAI,kBAAA,CAAmB,YAAA,CAAa,OAAO,OAAO;AAAA,GAC3D;AACA,EAAA,MAAM,aAAA,GAAgB,yBAAA;AAAA,IACpB,YAAA,CAAa,KAAA;AAAA,IACb,YAAA,CAAa,MAAA;AAAA,IACb,OAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,KAAA,GAAqB;AAAA,IACzB,GAAG,aAAA,CAAc,MAAA;AAAA,IACjB,KAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO,EAAE,MAAM,KAAA,EAAO,gBAAA,EAAkB,OAAO,MAAM,WAAA,CAAY,OAAM,EAAE;AAC3E;;;AC//BO,IAAM,2BAAA,GAA8B,MAAM,IAAA,GAAO,IAAA;AAQxD,SAAS,WAAA,GAAqB;AAC5B,EAAA,OAAO,EAAE,GAAA,EAAK,sBAAM,IAAI,MAAK,EAAE;AACjC;AAWO,SAAS,eAAe,SAAA,EAA6B;AAC1D,EAAA,OAAO,QAAA,CAAS,CAAA,QAAA,EAAW,SAAS,CAAA,CAAE,CAAA;AACxC;AAiCO,SAAS,oBAAoB,OAAA,EAAqD;AACvF,EAAA,MAAM,QAAQ,WAAA,EAAY;AAC1B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,MAAM,MAAA,GACJ,OAAA,CAAQ,OAAA,EAAS,IAAA,KAAS,QAAA,GACtB,0BAAA;AAAA,IACE;AAAA,MACE,IAAA,EAAM,QAAQ,OAAA,CAAQ,IAAA;AAAA,MACtB,GAAI,OAAA,CAAQ,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,OAAA,CAAQ,OAAA,CAAQ,QAAA;AAAS,KACzF;AAAA,IACA,EAAE,OAAO,MAAA;AAAO,GAClB,GACA,MAAA;AACN,EAAA,MAAM,YAAA,GAAe,WAAW,MAAA,GAAYC,wBAAAA,CAAyB,EAAE,KAAA,EAAO,EAAE,MAAA,GAAS,MAAA;AACzF,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,YAAA;AAC7B,EAAA,MAAM,aAAA,GACJ,MAAA,KAAW,MAAA,GAAYC,yBAAAA,CAA0B,KAAA,EAAO,QAAQ,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,OAAO,CAAA,GAAI,MAAA;AAChG,EAAA,MAAM,MAAA,GAAS,MAAA,EAAQ,KAAA,IAAS,aAAA,CAAe,MAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,MAAA,EAAQ,gBAAA,IAAoB,aAAA,CAAe,gBAAA;AAEpE,EAAA,MAAM,WAAA,GAAc,gCAAA;AAAA,IAClB,IAAI,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAAA,IACjC,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA;AAExC,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC/B,IAAI,WAAA,GAAsB;AACxB,MAAA,OAAO,YAAY,QAAA,CAAS,WAAA;AAAA,IAC9B,CAAA;AAAA,IACA,IAAI,UAAA,GAAqB;AACvB,MAAA,OAAO,MAAM,KAAA,EAAM;AAAA,IACrB,CAAA;AAAA,IACA,IAAI,eAAA,GAA0B;AAC5B,MAAA,OAAO,YAAY,QAAA,CAAS,eAAA;AAAA,IAC9B;AAAA,GACF;AAOA,EAAA,KAAK,IAAA,CAAK,KAAA,CAAM,gBAAA,CAAiB,OAAA,CAAQ,MAAA,EAAQ;AAAA,IAC/C,OAAA,EAAS,EAAA;AAAA,IACT,cAAA,EAAgB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,GAAI,KAAA;AAAA,IACnD,cAAA,EAAgB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IAC/C,cAAA,EAAgB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IAC/C,iBAAA,EAAmB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,GAAI,KAAA;AAAA,IACtD,iBAAA,EAAmB;AAAA,GACpB,CAAA;AAED,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,iBAAiB,IAAA,CAAK,OAAA,EAAS,OAAA,CAAQ,WAAW,CAAA,EAAE;AAAA,IAC9E,OAAO,EAAE,GAAG,QAAQ,WAAA,EAAa,WAAA,CAAY,SAAS,KAAA,EAAM;AAAA,IAC5D,gBAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAO,MAAM,MAAA,EAAQ,KAAA,EAAM,IAAK,QAAQ,OAAA;AAAQ,GAClD;AACF;AAWA,SAAS,cAAc,KAAA,EAA8C;AACnE,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO;AAAA,IACL,MAAM,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,UAAA,EAA8B;AACnE,MAAA,MAAM,OAAO,MAAM,KAAA,CAAM,cAAA,CAAe,MAAA,EAAQ,UAAU,UAAU,CAAA;AACpE,MAAA,IAAI,MAAM,KAAA,IAAS,CAAA;AACnB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,mBAAA,CAAoB,MAAA,EAAQ,QAAA,EAAU,UAAU,UAAA,EAA8B;AAClF,MAAA,MAAM,OAAO,MAAM,KAAA,CAAM,oBAAoB,MAAA,EAAQ,QAAA,EAAU,UAAU,UAAU,CAAA;AACnF,MAAA,IAAI,MAAM,KAAA,IAAS,CAAA;AACnB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,OAAO,MAAM;AAAA,GACf;AACF;AAWA,SAAS,gBAAA,CAAiB,OAAqB,WAAA,EAA8C;AAC3F,EAAA,OAAO;AAAA,IACL,QAAQ,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,IACrD,WAAW,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,SAAA,CAAU,QAAQ,KAAK,CAAA;AAAA,IAC3D,gBAAgB,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,cAAA,CAAe,QAAQ,KAAK,CAAA;AAAA,IACrE,eAAe,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,aAAA,CAAc,QAAQ,KAAK,CAAA;AAAA,IACnE,UAAA,EAAY,CAAC,MAAA,EAAQ,QAAA,KAAa;AAChC,MAAA,WAAA,CAAY,MAAM,QAAA,EAAA,iBAAU,IAAI,IAAA,EAAK,EAAE,aAAa,CAAA;AACpD,MAAA,OAAO,KAAA,CAAM,UAAA,CAAW,MAAA,EAAQ,QAAQ,CAAA;AAAA,IAC1C,CAAA;AAAA,IACA,gBAAgB,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,cAAA,CAAe,QAAQ,KAAK;AAAA,GACvE;AACF;ACtMA,SAAS,qBAAA,CACP,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EACQ;AACR,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,eAAA;AACH,MAAA,OAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA,CAAA;AAAA,IAC9E,KAAK,kBAAA;AACH,MAAA,OAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,qBAAA,EAAwB,KAAK,CAAA,CAAA,CAAA;AAAA,IACjE,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,kBAAA,EAAqB,OAAA,IAAW,WAAW,CAAA,0BAAA,CAAA;AAAA;AAEnF;AA2BO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,MAAA;AAAA,EACA,IAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,OAAA;AAAA,EAET,WAAA,CACE,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,qBAAA,CAAsB,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AACzD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;AAGA,IAAM,kCAA0C,IAAI,GAAA,CAAe,CAAC,UAAA,EAAY,QAAA,EAAU,WAAW,CAAC,CAAA;AAgBtG,SAAS,WAAA,CAAY,YAAgC,KAAA,EAAsC;AACzF,EAAA,OAAO,eAAA,CAAgB,GAAA,CAAI,KAAK,CAAA,GAAI,eAAA,GAAkB,UAAA;AACxD;AAyBO,SAAS,gBAAA,CAAiB,QAAgB,IAAA,EAAkC;AAIjF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA;AAE3C,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IAEA,MAAA,GAAyC;AACvC,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AAAA,IACjC,CAAA;AAAA,IAEA,MAAM,OAAO,MAAA,EAAgC;AAC3C,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,WAAW,IAAA,CAAK,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAIvE,MAAA,IAAI,OAAA,CAAQ,iBAAiB,MAAA,EAAW;AACxC,MAAA,IAAA,CAAK,MAAM,kBAAA,CAAmB,MAAA,EAAQ,WAAA,EAAa,OAAA,CAAQ,aAAa,WAAW,CAAA;AAAA,IACrF,CAAA;AAAA,IAEA,MAAM,QAAQ,IAAA,EAA+C;AAC3D,MAAA,MAAM,KAAK,KAAA,CAAM,WAAA,CAAY,IAAA,CAAK,MAAA,EAAQ,QAAQ,IAAI,CAAA;AAItD,MAAA,IAAA,CAAK,KAAA,CAAM,mBAAmB,MAAA,EAAQ,SAAA,EAAA,qBAAe,IAAA,EAAK,EAAE,aAAa,CAAA;AAAA,IAC3E,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,MAAA,EAAiB,IAAA,EAA+C;AAC3E,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK,QAAQ,MAAA,EAAQ;AAAA,QAC/C,GAAI,MAAM,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AAAA,QACxE,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,OAC1C,CAAA;AACD,MAAA,IAAA,CAAK,KAAA,CAAM,mBAAmB,MAAA,EAAQ,SAAA,EAAA,qBAAe,IAAA,EAAK,EAAE,aAAa,CAAA;AAAA,IAC3E,CAAA;AAAA,IAEA,MAAM,MAAM,IAAA,EAA6B;AACvC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,CAAK,MAAM,SAAA,CAAU,IAAA,CAAK,QAAQ,MAAA,EAAQ,EAAE,MAAM,CAAA;AAAA,MAC1D,SAAS,MAAA,EAAQ;AACf,QAAA,IAAI,EAAE,MAAA,YAAkBC,oBAAA,CAAA,EAA2B,MAAM,MAAA;AACzD,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAKzC,QAAA,IAAI,KAAA,KAAU,QAAW,MAAM,MAAA;AAC/B,QAAA,MAAM,IAAI,kBAAA,CAAmB,MAAA,EAAQ,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA,EAAG,KAAA,EAAO,MAAA,CAAO,OAAO,CAAA;AAAA,MAC7F;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,GAA8B;AAIlC,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA;AACpD,MAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,MAAA,MAAM,QAAA;AACN,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA;AAC3C,MAAA,IAAI,WAAW,MAAA,EAAW;AAIxB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,MAAM,CAAA,2CAAA,CAA6C,CAAA;AAAA,MAC7E;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,GACF;AACF;AChFA,IAAM,yBAAA,GAA4B,GAAA;AAElC,IAAM,yBAAA,GAA4B,GAAA;AAElC,IAAM,yBAAA,GAA4B,CAAA;AAElC,IAAM,wBAAA,GAA2B,CAAA;AAEjC,IAAM,kBAAA,GAAqB,EAAA;AAEpB,IAAM,uBAAA,GAA0B;AAyKhC,SAAS,iBAAiB,IAAA,EAA2C;AAC1E,EAAA,MAAM,WAAA,GAAc,KAAK,GAAA,EAAI;AAC7B,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,SAAS,CAAA;AAC5C,EAAA,MAAM,gBAAA,GAAmB,KAAK,gBAAA,IAAoB,2BAAA;AAClD,EAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,IAAkB,yBAAA;AAE9C,EAAA,MAAM,WAAA,GAAc,IAAI,iBAAA,EAAkB;AAC1C,EAAA,MAAM,KAAA,GAAQ,IAAI,cAAA,CAAe;AAAA,IAC/B,WAAA;AAAA,IACA,GAAI,KAAK,oBAAA,KAAyB,MAAA,GAAY,EAAC,GAAI,EAAE,oBAAA,EAAsB,IAAA,CAAK,oBAAA,EAAqB;AAAA,IACrG,GAAI,KAAK,oBAAA,KAAyB,MAAA,GAAY,EAAC,GAAI,EAAE,oBAAA,EAAsB,IAAA,CAAK,oBAAA;AAAqB,GACtG,CAAA;AAED,EAAA,MAAM,cAAc,mBAAA,CAAoB;AAAA,IACtC,MAAA;AAAA,IACA,gBAAA;AAAA,IACA,GAAI,KAAK,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAS,IAAA,CAAK,OAAA,EAAQ;AAAA,IAC9D,GAAI,KAAK,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAU;AAAA,IACpE,WAAA;AAAA,IACA,aAAA,EAAe,CAAC,QAAA,EAAU,EAAA,KAAO,KAAA,CAAM,eAAA,CAAgB,EAAE,IAAA,EAAM,qBAAA,EAAuB,QAAA,EAAU,EAAA,EAAI;AAAA,GACrG,CAAA;AAED,EAAA,MAAM,WAAA,GACJ,KAAK,WAAA,IACL,qBAAA;AAAA,IACE,WAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,kBAAkB,CAAC,CAAA;AAAA,IACpE,WAAA,CAAY;AAAA,GACd;AAEF,EAAA,MAAM,QAAmB,eAAA,CAAgB;AAAA,IACvC,MAAM,WAAA,CAAY,IAAA;AAAA,IAClB,OAAO,WAAA,CAAY,KAAA;AAAA,IACnB,kBAAkB,WAAA,CAAY,gBAAA;AAAA,IAC9B,QAAQ,WAAA,CAAY,MAAA;AAAA,IACpB,WAAA;AAAA,IACA,OAAO,WAAA,CAAY,KAAA;AAAA,IACnB,cAAc,yBAAA,EAA0B;AAAA;AAAA;AAAA,IAGxC,mBAAmB,IAAA,CAAK,SAAA;AAAA,IACxB,QAAA,EAAU,KAAA;AAAA,IACV,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAC,GAAI,EAAE,YAAA,EAAc,IAAA,CAAK,YAAA,EAAa;AAAA,IAC7E,gBAAA;AAAA,IACA,cAAA;AAAA,IACA,kBAAA,EAAoB,iBAAiB,cAAc;AAAA,GACpD,CAAA;AAMD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA2B;AAElD,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AACtB,EAAA,IAAI,IAAA,CAAK,iBAAiB,IAAA,EAAM;AAI9B,IAAA,IAAA,CAAK,IAAI,UAAA,EAAY,CAAC,CAAA,KAAM,CAAA,CAAE,KAAK,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,KAAK,GAAA,EAAI,GAAI,WAAA,EAAY,EAAG,GAAG,CAAC,CAAA;AAAA,EAC3F;AAIA,EAAA,IAAA,CAAK,GAAA,CAAI,KAAK,CAAC,CAAA,KAAM,MAAM,KAAA,CAAM,CAAA,CAAE,GAAA,CAAI,GAAG,CAAC,CAAA;AAE3C,EAAA,eAAe,YAAY,MAAA,EAAsD;AAC/E,IAAA,OAAO,gBAAgB,MAAM,KAAA,CAAM,oBAAA,CAAqB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACzE;AAEA,EAAA,eAAe,aAAa,MAAA,EAAqD;AAC/E,IAAA,OAAO,KAAA,CAAM,cAAA,CAAe,MAAA,EAAQ,MAAM,CAAA;AAAA,EAC5C;AAEA,EAAA,eAAe,YAAY,OAAA,EAA6C;AACtE,IAAA,MAAM,CAAC,OAAA,EAAS,QAAQ,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI,CAAC,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA,EAAG,YAAA,CAAa,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA;AACzG,IAAA,OAAO,cAAA,CAAe,SAAS,OAAA,EAAS,QAAA,EAAU,WAAW,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,EAClF;AASA,EAAA,eAAe,cAAc,MAAA,EAAgD;AAC3E,IAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,eAAA,CAAgB,QAAQ,MAAM,CAAA;AAC1D,IAAA,OAAO,YAAY,MAAA,GAAY,MAAA,GAAA,CAAa,MAAM,WAAA,CAAY,OAAO,CAAA,EAAG,KAAA;AAAA,EAC1E;AAcA,EAAA,KAAA,CAAM,cAAA,GAAiB,CACrB,MAAA,EACA,8BAAA,EACA,0BACA,UAAA,KACS;AACT,IAAA,KAAA,CAAM,YAAY;AAKhB,MAAA,IAAI,mCAAmC,MAAA,EAAW;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,MAAM,CAAA;AACxC,MAAA,IACE,OAAA,KAAY,MAAA,IACZ,OAAA,CAAQ,gBAAA,KAAqB,8BAAA,EAC7B;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,eAAA,CAAgB,QAAQ,MAAM,CAAA;AAC1D,MAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,MAAA,MAAM,gBAAA,GAAmB,MAAM,WAAA,CAAY,MAAA,CAAO,MAAA;AAAA,QAChD,IAAI,aAAY,CAAE,MAAA;AAAA,UAChB,KAAK,SAAA,CAAU;AAAA,YACb,MAAA,EAAQ,wBAAA;AAAA,YACR,MAAA;AAAA,YACA,MAAA;AAAA,YACA,UAAU,OAAA,CAAQ,QAAA;AAAA,YAClB,eAAe,OAAA,CAAQ,aAAA;AAAA,YACvB,UAAU,OAAA,CAAQ,QAAA;AAAA,YAClB,yBAAyB,OAAA,CAAQ,gBAAA;AAAA,YACjC,iBAAiB,OAAA,CAAQ,QAAA;AAAA,YACzB;AAAA,WACD;AAAA;AACH,OACF;AACA,MAAA,MAAM,WAAW,MAAM,WAAA,CAAY,KAAA,CAAM,SAAA,CAAU,eAAe,MAAA,EAAQ;AAAA,QACxE,MAAA;AAAA,QACA,gBAAA;AAAA,QACA,0BAA0B,OAAA,CAAQ,gBAAA;AAAA,QAClC,kBAAkB,OAAA,CAAQ,QAAA;AAAA,QAC1B,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,mBAAA;AAAA,UACN,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAAA,UAC7E,QAAA,EAAU,SAAA;AAAA,UACV,UAAA,EAAY,MAAA;AAAA,UACZ,EAAA,EAAI;AAAA;AACN,OACD,CAAA;AACD,MAAA,IAAI,QAAA,CAAS,MAAA,KAAW,SAAA,IAAa,QAAA,CAAS,WAAW,UAAA,EAAY;AACnE,QAAA,KAAA,CAAM,4BAAA,CAA6B,QAAQ,UAAU,CAAA;AAAA,MACvD;AAAA,IACF,CAAA,GAAG,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,EAC5B,CAAA;AAEA,EAAA,eAAe,4BAAA,GAA2D;AACxE,IAAA,MAAM,aAAgC,EAAC;AACvC,IAAA,KAAA,MAAW,QAAA,IAAY,WAAA,CAAY,GAAA,EAAI,EAAG;AACxC,MAAA,IAAI,CAAC,WAAA,CAAY,WAAA,CAAY,QAAQ,CAAA,EAAG;AACxC,MAAA,MAAM,SAAS,MAAM,WAAA,CAAY,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,QAAQ,CAAA;AACnE,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,OAAA,EAAS;AAC5C,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,QAAA;AAAA,QACA,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,kBAAA,EAAoB,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA,EAAG;AAAA,OAChD,CAAA;AAAA,IACH;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAEA,EAAA,eAAe,mBAAmB,QAAA,EAA0D;AAC1F,IAAA,OAAA,CAAQ,MAAM,WAAA,CAAY,KAAA,CAAM,QAAQ,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA,GAAI,YAAA;AAAA,EAClE;AAEA,EAAA,eAAe,iBAAiB,QAAA,EAAiC;AAC/D,IAAA,IAAI,CAAC,WAAA,CAAY,WAAA,CAAY,QAAQ,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,OAAA,EAAU,QAAQ,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC/F;AAEA,EAAA,eAAe,gBAAA,CACb,OACA,gBAAA,EACqB;AACrB,IAAA,MAAM,UAAA,GAAa,YAAA,IAAgB,KAAA,GAAQ,KAAA,CAAM,UAAA,GAAa,MAAA;AAC9D,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,KAAa,MAAA,GAAY,SAAY,cAAA,CAAe,KAAA,CAAM,MAAM,QAAQ,CAAA;AAC/F,IAAA,MAAM,YAAA,GACJ,MAAM,YAAA,KAAiB,MAAA,GAAY,SAAY,uBAAA,CAAwB,KAAA,CAAM,MAAM,YAAY,CAAA;AACjG,IAAA,MAAM,aAAA,GACJ,MAAM,aAAA,KAAkB,MAAA,GAAY,SAAY,mCAAA,CAAoC,KAAA,CAAM,MAAM,aAAa,CAAA;AAC/G,IAAA,MAAM,kBAAA,GACJ,MAAM,kBAAA,KAAuB,MAAA,GACzB,SACA,iCAAA,CAAkC,KAAA,CAAM,MAAM,kBAAkB,CAAA;AACtE,IAAA,IAAI,aAAA,KAAkB,MAAA,IAAa,KAAA,CAAM,mBAAA,KAAwB,MAAA,EAAW;AAC1E,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AACA,IAAA,MAAM,sBACJ,aAAA,KAAkB,MAAA,GAAY,SAAY,+BAAA,CAAgC,KAAA,CAAM,MAAM,mBAAmB,CAAA;AAC3G,IAAA,MAAM,iBAAA,GACJ,MAAM,iBAAA,KAAsB,MAAA,GAAY,SAAY,uBAAA,CAAwB,KAAA,CAAM,MAAM,iBAAiB,CAAA;AAC3G,IAAA,MAAM,gBAAA,GACJ,MAAM,gBAAA,KAAqB,MAAA,GAAY,SAAY,sBAAA,CAAuB,KAAA,CAAM,MAAM,gBAAgB,CAAA;AAExG,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,KAAA,CAAM,QAAA,KAAa,MAAA,EAAW;AAC1D,MAAA,MAAM,IAAI,MAAM,6EAA6E,CAAA;AAAA,IAC/F;AACA,IAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,QAAA,KAAa,MAAA,EAAW;AACxD,MAAA,MAAM,IAAI,MAAM,2FAA2F,CAAA;AAAA,IAC7G;AACA,IAAA,IAAI,aAAA,KAAkB,MAAA,IAAa,YAAA,KAAiB,MAAA,EAAW;AAC7D,MAAA,MAAM,IAAI,MAAM,iEAAiE,CAAA;AAAA,IACnF;AAEA,IAAA,MAAM,WACJ,KAAA,CAAM,QAAA,IACN,wBAAA,CAAyB,MAAM,8BAA6B,EAAG;AAAA,MAC7D,GAAI,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAiB;AAAA,MAC7D,sBAAsB,QAAA,KAAa;AAAA,KACpC,CAAA;AAGH,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,MAAM,sFAAsF,CAAA;AAAA,IACxG;AACA,IAAA,MAAM,iBAAiB,QAAQ,CAAA;AAM/B,IAAA,MAAM,YAAA,GAAe,MAAM,kBAAA,CAAmB,QAAQ,CAAA;AACtD,IAAA,IAAI,sBAAsB,MAAA,IAAa,EAAE,cAAc,QAAA,CAAS,oBAAoB,KAAK,KAAA,CAAA,EAAQ;AAC/F,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,UAAU,QAAQ,CAAA,gGAAA;AAAA,OACpB;AAAA,IACF;AACA,IAAA,IAAI,qBAAqB,MAAA,EAAW;AAClC,MAAA,IAAI,EAAE,YAAA,EAAc,QAAA,CAAS,mBAAmB,KAAK,KAAA,CAAA,EAAQ;AAC3D,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,UAAU,QAAQ,CAAA,wGAAA;AAAA,SACpB;AAAA,MACF;AACA,MAAA,MAAM,kBAAA,GAAqB,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA,EAAG,kBAAA;AACtD,MAAA,IAAI,uBAAuB,MAAA,EAAW;AACpC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,UAAU,QAAQ,CAAA,8FAAA;AAAA,SACpB;AAAA,MACF;AACA,MAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,kBAAkB,CAAA;AAC7C,MAAA,MAAM,OAAA,GAAU,iBAAiB,MAAA,CAAO,CAAC,cAAc,CAAC,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACjF,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,MAAM,CAAA,OAAA,EAAU,QAAQ,wCAAwC,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAChG;AAAA,IACF;AACA,IAAA,IACE,iBAAA,KAAsB,UACtB,KAAA,CAAM,OAAA,KAAY,UAClB,KAAA,CAAM,OAAA,KAAY,kBAAkB,SAAA,EACpC;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,iBAAA,EAAoB,KAAA,CAAM,OAAO,CAAA,4CAAA,EAA+C,kBAAkB,SAAS,CAAA;AAAA,OAC7G;AAAA,IACF;AACA,IAAA,IAAI,aAAa,MAAA,IAAa,YAAA,EAAc,QAAA,CAASC,4BAA4B,MAAM,IAAA,EAAM;AAC3F,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,UAAU,QAAQ,CAAA,6EAAA;AAAA,OACpB;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAA2B,KAAA,CAAM,MAAA,IAAU,EAAE,MAAM,SAAA,EAAU;AACnE,IAAA,MAAM,OAAA,GAAU,iBAAA,EAAmB,SAAA,IAAa,KAAA,CAAM,OAAA;AACtD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb,GAAI,MAAM,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU;AAAA,MACtE,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,MAAA;AAAA,MACA,GAAI,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAQ;AAAA,MAC3C,GAAI,iBAAA,KAAsB,MAAA,GAAY,EAAC,GAAI,EAAE,iBAAA;AAAkB,KACjE;AAKA,IAAA,MAAM,MAAA,GAAS,UAAA,CAAW,MAAA,CAAO,UAAA,EAAW;AAC5C,IAAA,KAAA,CAAM,UAAU,MAAM,CAAA;AACtB,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,OAAO,YAAY;AAC5B,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,IAAa,YAAA,KAAiB,KAAA,CAAA,IAAa,gBAAA,EAAkB;AAC5E,UAAA,OAAO,KAAA,CAAM,4BAAA,CAA6B,MAAA,EAAQ,QAAA,EAAU;AAAA,YAC1D,MAAA;AAAA,YACA,OAAA,EAAS;AAAA,cACP,GAAG,MAAA;AAAA,cACH,QAAA;AAAA,cACA,YAAA;AAAA,cACA,GAAI,kBAAA,KAAuB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,kBAAA,EAAmB;AAAA,cACjE,GAAI,aAAA,KAAkB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAc;AAAA,cACvD,GAAI,gBAAA,KAAqB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,gBAAA;AAAiB,aAC/D;AAAA,YACA,GAAI,mBAAA,KAAwB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,mBAAA;AAAoB,WACpE,CAAA;AAAA,QACH;AACA,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,IAAa,YAAA,KAAiB,KAAA,CAAA,EAAW;AACxD,UAAA,IAAI,eAAe,KAAA,CAAA,EAAW;AAC5B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AACA,UAAA,OAAO,KAAA,CAAM,uBAAA,CAAwB,MAAA,EAAQ,QAAA,EAAU;AAAA,YACrD,MAAA;AAAA,YACA,OAAA,EAAS;AAAA,cACP,GAAG,MAAA;AAAA,cACH,UAAA;AAAA,cACA,QAAA;AAAA,cACA,YAAA;AAAA,cACA,GAAI,kBAAA,KAAuB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,kBAAA,EAAmB;AAAA,cACjE,GAAI,aAAA,KAAkB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAc;AAAA,cACvD,GAAI,gBAAA,KAAqB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,gBAAA;AAAiB,aAC/D;AAAA,YACA,GAAI,mBAAA,KAAwB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,mBAAA;AAAoB,WACpE,CAAA;AAAA,QACH;AACA,QAAA,IAAI,aAAa,KAAA,CAAA,EAAW;AAC1B,UAAA,OAAO,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ,QAAA,EAAU;AAAA,YAC/C,MAAA;AAAA,YACA,OAAA,EAAS;AAAA,cACP,GAAG,MAAA;AAAA,cACH,QAAA;AAAA,cACA,GAAI,UAAA,KAAe,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAW;AAAA,cACjD,GAAI,kBAAA,KAAuB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,kBAAA,EAAmB;AAAA,cACjE,GAAI,gBAAA,KAAqB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,gBAAA;AAAiB;AAC/D,WACD,CAAA;AAAA,QACH;AACA,QAAA,IAAI,qBAAqB,KAAA,CAAA,EAAW;AAClC,UAAA,OAAO,KAAA,CAAM,mBAAA,CAAoB,MAAA,EAAQ,QAAA,EAAU;AAAA,YACjD,MAAA;AAAA,YACA,OAAA,EAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,UAAA,KAAe,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAW,EAAI,gBAAA;AAAiB,WAC7F,CAAA;AAAA,QACH;AACA,QAAA,OAAO,KAAA,CAAM,YAAA,CAAa,MAAA,EAAQ,QAAA,EAAU;AAAA,UAC1C,MAAA;AAAA,UACA,OAAA,EAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,UAAA,KAAe,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAW;AAAG,SAC3E,CAAA;AAAA,MACH,CAAA,GAAG;AAAA,IACL,SAAS,KAAA,EAAO;AACd,MAAA,KAAA,CAAM,MAAM,MAAM,CAAA;AAClB,MAAA,MAAM,KAAA;AAAA,IACR;AAIA,IAAA,MAAM,SAAA,GAAY,SAAS,QAAA,CAAS,EAAA;AACpC,IAAA,UAAA,CAAW,GAAA,CAAI,SAAS,MAAA,EAAQ;AAAA,MAC9B,SAAA;AAAA,MACA,GAAI,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA;AAAW,KAClD,CAAA;AACD,IAAA,KAAA,CAAM,cAAA,CAAe,QAAA,CAAS,MAAA,EAAQ,SAAS,CAAA;AAC/C,IAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAAA,EAClC;AAEA,EAAA,SAAS,UAAU,MAAA,EAA4B;AAC7C,IAAA,OAAO,iBAAiB,MAAA,EAAQ;AAAA,MAC9B,MAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW,aAAA;AAAA,MACX,YAAY,OAAO,EAAA,KAAO,aAAa,MAAM,YAAA,CAAa,EAAE,CAAC;AAAA,KAC9D,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IAEA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMP,MAAM,kBAAkB,KAAA,EAAyD;AAC/E,QAAA,IAAI,KAAA,CAAM,SAAA,KAAc,IAAA,CAAK,SAAA,EAAW;AACtC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,KAAA,CAAM,SAAS,CAAA,sCAAA,EAAyC,KAAK,SAAS,CAAA;AAAA,WAChG;AAAA,QACF;AACA,QAAA,OAAO,KAAA,CAAM,kBAAkB,MAAA,EAAQ;AAAA,UACrC,WAAW,KAAA,CAAM,SAAA;AAAA,UACjB,GAAI,MAAM,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA;AAAM,SAC3D,CAAA;AAAA,MACH;AAAA,KACF;AAAA,IAEA,SAAS,KAAA,EAA2C;AAClD,MAAA,OAAO,gBAAA,CAAiB,OAAO,KAAK,CAAA;AAAA,IACtC,CAAA;AAAA,IAEA,yBAAyB,KAAA,EAA2D;AAClF,MAAA,IAAI,OAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAK,KAAA,EAAO,YAAY,CAAA,EAAG;AAC7D,QAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,MACzE;AACA,MAAA,IAAI,OAAO,KAAA,CAAM,QAAA,KAAa,YAAY,KAAA,CAAM,QAAA,CAAS,WAAW,CAAA,EAAG;AACrE,QAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,MAC7E;AACA,MAAA,IAAI,KAAA,CAAM,QAAA,KAAa,MAAA,IAAa,KAAA,CAAM,iBAAiB,MAAA,EAAW;AACpE,QAAA,MAAM,IAAI,MAAM,uEAAuE,CAAA;AAAA,MACzF;AACA,MAAA,OAAO,gBAAA,CAAiB,OAAO,IAAI,CAAA;AAAA,IACrC,CAAA;AAAA,IAEA,MAAM,wBAAwB,KAAA,EAA+C;AAC3E,MAAA,MAAM,OAAA,GAAU,6BAAA,CAA8B,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA;AACjE,MAAA,MAAM,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACrC,MAAA,MAAM,MAAM,uBAAA,CAAwB,MAAA,EAAQ,MAAM,QAAA,EAAU,EAAE,SAAS,CAAA;AAAA,IACzE,CAAA;AAAA,IAEA,MAAM,2BACJ,KAAA,EAC4C;AAC5C,MAAA,MAAM,OAAA,GAAU,gCAAA,CAAiC,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA;AACpE,MAAA,MAAM,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACrC,MAAA,OAAA,CAAQ,MAAM,KAAA,CAAM,0BAAA,CAA2B,QAAQ,KAAA,CAAM,QAAA,EAAU,OAAO,CAAA,EAAG,MAAA;AAAA,IACnF,CAAA;AAAA,IAEA,MAAM,uBAAA,CACJ,QAAA,EACA,QAAA,EACA,SAAA,EACwD;AAGxD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,KAAA,CAAM,QAAA,CAAS,GAAA;AAAA,QAC9C,MAAA;AAAA,QACA,6BAAA,CAA8B,QAAA,EAAU,QAAA,EAAU,SAAS;AAAA,OAC7D;AACA,MAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,MAAA,IAAI,OAAA;AACJ,MAAA,IAAI;AACF,QAAA,OAAA,GAAU,iCAAiC,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,MAC1E,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,OAAO,KAAA,CAAM,4BAAA,CAA6B,MAAA,EAAQ,QAAA,EAAU;AAAA,QAC1D,WAAW,OAAA,CAAQ,SAAA;AAAA,QACnB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,KAAA,EAAO;AAAA,MACL,MAAM,IAAI,MAAA,EAAmD;AAC3D,QAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,eAAA,CAAgB,QAAQ,MAAM,CAAA;AAC1D,QAAA,OAAO,OAAA,KAAY,MAAA,GAAY,MAAA,GAAY,WAAA,CAAY,OAAO,CAAA;AAAA,MAChE,CAAA;AAAA,MACA,MAAM,IAAA,CAAK,KAAA,GAAuB,EAAC,EAAsB;AACvD,QAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,gBAAA,CAAiB,MAAA,EAAQ;AAAA,UAChD,KAAA,EAAO,MAAM,KAAA,IAAS,uBAAA;AAAA,UACtB,GAAI,MAAM,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA;AAAO,SAC9D,CAAA;AACD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,MAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,KAAY,WAAA,CAAY,OAAO,CAAC,CAAC,CAAA;AAAA,UAC7E,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA;AAAW,SACzE;AAAA,MACF;AAAA,KACF;AAAA,IAEA,KAAA,EAAO;AAAA,MACL,eAAe,MAAA,EAA6C;AAC1D,QAAA,OAAO,WAAA,CAAY,KAAA,CAAM,KAAA,CAAM,cAAA,CAAe,QAAQ,MAAM,CAAA;AAAA,MAC9D;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,MAAM,GAAA,CAAI,QAAA,EAAkB,QAAA,EAAoB,OAAA,EAA0D;AACxG,QAAA,MAAM,SAAS,MAAM,KAAA,CAAM,gBAAgB,MAAA,EAAQ,QAAA,EAAU,UAAU,OAAO,CAAA;AAC9E,QAAA,OAAO,MAAA,KAAW,SACd,MAAA,GACA;AAAA,UACE,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,SAAS,MAAA,CAAO,OAAA;AAAA,UAChB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,YAAY,MAAA,CAAO;AAAA,SACrB;AAAA,MACN;AAAA,KACF;AAAA,IAEA,QAAA,EAAU;AAAA,MACR,MAAM,IAAA,GAA+B;AACnC,QAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,WAAA,CAAY,MAAM,CAAA;AAC9C,QAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAA,KAAW,aAAA,CAAc,MAAA,EAAQ,WAAA,CAAY,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAC,CAAC,CAAA;AAAA,MACxF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,SAAA,EAAW,MAAM,KAAA,CAAM,YAAA;AAAa,KACtC;AAAA,IAEA,OAAA,EAAS;AAAA,MACP,MAAM,OAAO,QAAA,EAAiC;AAI5C,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AACzC,QAAA,WAAA,CAAY,OAAO,QAAQ,CAAA;AAAA,MAC7B;AAAA,KACF;AAAA,IAEA,OAAA,EAAS;AAAA,MACP,eAAe,KAAA,EAA+D;AAC5E,QAAA,OAAO,WAAA,CAAY,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,QAAQ,KAAK,CAAA;AAAA,MAC9D;AAAA,KACF;AAAA,IAEA,IAAA,GAAa;AACX,MAAA,KAAA,CAAM,IAAA,EAAK;AACX,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,KAAK,YAAY,KAAA,EAAM;AAAA,IACzB,CAAA;AAAA,IAEA,MAAM,KAAA,GAAuB;AAC3B,MAAA,KAAA,CAAM,IAAA,EAAK;AACX,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,MAAM,YAAY,KAAA,EAAM;AAAA,IAC1B,CAAA;AAAA,IAEA,MAAM,KAAA,GAA2B;AAC/B,MAAA,MAAM,iBAAA,GAAoB,MAAA,CAAO,WAAA,CAAY,WAAA,CAAY,GAAA,CAAI,CAAC,KAAA,KAAU,CAAC,KAAA,EAAO,CAAC,CAAC,CAAC,CAAA;AAInF,MAAA,IAAI,MAAA;AACJ,MAAA,GAAG;AACD,QAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,gBAAA,CAAiB,MAAA,EAAQ;AAAA,UAChD,KAAA,EAAO,uBAAA;AAAA,UACP,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,SAC1C,CAAA;AACD,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACnC,UAAA,iBAAA,CAAkB,eAAA,CAAgB,SAAS,MAAM,WAAA,CAAY,QAAQ,MAAM,CAAC,CAAC,CAAA,IAAK,CAAA;AAAA,QACpF;AACA,QAAA,MAAA,GAAS,IAAA,CAAK,UAAA;AAAA,MAChB,SAAS,MAAA,KAAW,MAAA;AAEpB,MAAA,OAAO;AAAA,QACL,oBAAA,EAAsB,YAAY,cAAA,EAAe;AAAA,QACjD,iBAAA;AAAA,QACA,WAAA,EAAa,YAAY,QAAA,CAAS,WAAA;AAAA,QAClC,UAAA,EAAY,YAAY,QAAA,CAAS,UAAA;AAAA,QACjC,eAAA,EAAiB,YAAY,QAAA,CAAS,eAAA;AAAA,QACtC,QAAA,EAAU,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB;AAAA,IACF;AAAA,GACF;AACF;AAGA,SAAS,eAAA,CAAgB,SAAsB,OAAA,EAAiD;AAC9F,EAAA,OAAO,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,MAAA,EAAW,MAAS,CAAA,CAAE,KAAA;AAChE;AAOA,SAAS,iBAAiB,MAAA,EAAwB;AAChD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,wBAAwB,CAAA;AAC5D,EAAA,OAAO,KAAK,GAAA,CAAI,yBAAA,EAA2B,KAAK,GAAA,CAAI,yBAAA,EAA2B,OAAO,CAAC,CAAA;AACzF","file":"index.js","sourcesContent":["import type { RuntimeInfo, ToolsetId } from '@byok-sdk/protocol';\n\n/**\n * What this process has OBSERVED about a device's live connection.\n *\n * This is not a second authority over anything durable. The device row\n * (`DeviceRecord`, `@byok-sdk/cloud`) owns identity and the capability list\n * every admission gate reads; the mailbox owns delivery. What lives here is the\n * part of `conn.hello` the kernel deliberately does not persist — the runtime\n * DISCOVERY block and the client's self-reported version/toolset inventory —\n * plus \"when did we last hear from this device at all\".\n *\n * Why the kernel does not persist it: `conn.hello.runtimes` describes what a\n * device build could run, changes on every daemon restart, and authorizes\n * nothing (the steer gate reads the CLAIM snapshot, never this). Storing it\n * durably would create a stale second description of a device that outlives the\n * process that saw it. Keeping it as an in-process observation is honest about\n * its lifetime: restart the server and it is gone, exactly like the connection\n * it describes.\n *\n * `connected` is therefore \"observed alive and not since forgotten\", not \"a\n * socket is open\" — there are no sockets any more. Two observations set it: the\n * device's own `conn.hello` over `POST /byok/messages`, and a `GET /byok/events`\n * poll (a device that is polling is present even if it never announced). One\n * clears it: revocation, which deletes the device row and everything scoped to\n * it.\n */\nexport interface DeviceConnection {\n connected: boolean;\n /** ISO-8601 instant of the most recent observation. */\n lastSeen: string;\n clientVersion?: string;\n runtimes?: RuntimeInfo[];\n configuredToolsets?: ToolsetId[];\n}\n\n/** `conn.hello`'s discovery half, as observed on one accepted announcement. */\nexport interface DeviceAnnouncement {\n readonly clientVersion?: string;\n readonly runtimes?: readonly RuntimeInfo[];\n readonly configuredToolsets?: readonly ToolsetId[];\n}\n\n/**\n * In-process device observations, in first-observation order.\n *\n * Insertion order is load-bearing for ambient dispatch selection\n * (`device-selection.ts`): \"the first connected device\" must be stable and\n * explainable, and a `Map` gives that for free without a second index.\n */\nexport class DeviceConnections {\n readonly #devices = new Map<string, DeviceConnection>();\n\n /**\n * Record an accepted `conn.hello`. Discovery fields are REPLACED wholesale,\n * never merged: a daemon that restarted with a runtime removed must not keep\n * advertising it because an older hello mentioned it.\n */\n announce(deviceId: string, announcement: DeviceAnnouncement, at: string): void {\n this.#devices.set(deviceId, {\n connected: true,\n lastSeen: at,\n ...(announcement.clientVersion === undefined ? {} : { clientVersion: announcement.clientVersion }),\n ...(announcement.runtimes === undefined ? {} : { runtimes: [...announcement.runtimes] }),\n ...(announcement.configuredToolsets === undefined\n ? {}\n : { configuredToolsets: [...announcement.configuredToolsets] }),\n });\n }\n\n /**\n * Record any other sign of life (an inbound envelope, a long-poll read).\n * Deliberately additive: it refreshes `lastSeen` and marks the device present\n * without touching the discovery block, because none of those signals carry\n * one and clearing it would lose what the last hello said.\n */\n touch(deviceId: string, at: string): void {\n const existing = this.#devices.get(deviceId);\n if (existing === undefined) {\n this.#devices.set(deviceId, { connected: true, lastSeen: at });\n return;\n }\n existing.connected = true;\n existing.lastSeen = at;\n }\n\n get(deviceId: string): DeviceConnection | undefined {\n return this.#devices.get(deviceId);\n }\n\n isConnected(deviceId: string): boolean {\n return this.#devices.get(deviceId)?.connected === true;\n }\n\n connectedCount(): number {\n let count = 0;\n for (const connection of this.#devices.values()) if (connection.connected) count += 1;\n return count;\n }\n\n /** Device ids in first-observation order — the order ambient selection walks. */\n ids(): readonly string[] {\n return [...this.#devices.keys()];\n }\n\n /** Drop everything scoped to a device. Called when its registration is deleted (§6.3). */\n forget(deviceId: string): void {\n this.#devices.delete(deviceId);\n }\n\n clear(): void {\n this.#devices.clear();\n }\n}\n","import { STRICT_AGENT_ONLY_CAPABILITY, type ToolsetId } from '@byok-sdk/protocol';\n\n/**\n * Ambient device selection for a `dispatch()` that named no `deviceId`.\n *\n * `DispatchInput.deviceId` stays optional (ADR-034), so this rule survives the\n * fold. It is a SCHEDULING convenience and nothing more: every admission gate\n * that actually protects something — Agent capability, strict-agent-only,\n * egress, toolset selection — runs afterwards against the durable device row\n * inside the kernel, on the device this picked exactly as on one the caller\n * named. Picking wrong therefore costs a refusal, never a wrongly-authorized\n * dispatch.\n *\n * \"First connected\" means first OBSERVED (`connections.ts` preserves\n * first-observation order), which is stable and explainable, unlike any\n * load-shaped ordering this package has no information to compute.\n */\nexport interface DeviceCandidate {\n readonly deviceId: string;\n /** The durable capability list from the device's last accepted `conn.hello`. */\n readonly capabilities: readonly string[] | undefined;\n /** The logical toolset inventory the same announcement reported, if any. */\n readonly configuredToolsets: readonly ToolsetId[] | undefined;\n}\n\nexport interface AmbientSelectionQuery {\n /** Every toolset must be present; an unknown inventory is never guessed at. */\n readonly requiredToolsets?: readonly ToolsetId[];\n /** Agent-bound dispatch is the only caller allowed to land on a strict-agent-only device. */\n readonly allowStrictAgentOnly?: boolean;\n}\n\nexport function pickFirstConnectedDevice(\n candidates: readonly DeviceCandidate[],\n query: AmbientSelectionQuery = {},\n): string | undefined {\n for (const candidate of candidates) {\n if (query.allowStrictAgentOnly !== true && candidate.capabilities?.includes(STRICT_AGENT_ONLY_CAPABILITY)) {\n continue;\n }\n if (query.requiredToolsets === undefined) return candidate.deviceId;\n // A device that never advertised toolset selection, or never reported an\n // inventory at all, is skipped rather than assumed adequate: \"unknown\" is\n // not \"has them\", and guessing here would send a task to a device that\n // fails it locally.\n if (!candidate.capabilities?.includes('toolset-selection')) continue;\n if (candidate.configuredToolsets === undefined) continue;\n const configured = new Set(candidate.configuredToolsets);\n if (query.requiredToolsets.every((toolsetId) => configured.has(toolsetId))) return candidate.deviceId;\n }\n return undefined;\n}\n","/**\n * A tiny append-only, multi-reader async queue. `push` never blocks; `close`\n * marks the queue done. `subscribe()` returns a fresh async iterator that\n * always replays from the beginning of the retained buffer, so a consumer that\n * calls `events()` at any point still sees everything still retained for that\n * task's lifetime.\n *\n * Bounded, deliberately (WP3B §3): this queue is a NOTIFICATION relay, not a\n * record of what happened — the durable facts live in the cloud stores a\n * `ByokServer` reads back (`tasks.get`, `TaskHandle.result()`). A consumer that\n * stops iterating must therefore cost bounded memory, not unbounded growth. On\n * overflow the OLDEST entries are dropped and, exactly once per queue, a\n * caller-supplied `truncationMarker` is appended so a reader can tell a\n * complete feed from a clipped one instead of silently seeing a gap.\n *\n * Framework-agnostic on purpose (no Node/WS/Hono types here) so it can be\n * unit-tested and reused regardless of transport.\n */\nexport interface AsyncEventQueueOptions<T> {\n /**\n * Maximum entries retained before drop-oldest engages. Omitted means\n * unbounded — only appropriate for a queue whose producer is itself bounded.\n */\n readonly maxBuffered?: number;\n /**\n * Appended once, after the first drop, so the truncation is observable.\n * Omitted means a bounded queue that drops silently.\n */\n readonly truncationMarker?: T;\n}\n\nexport class AsyncEventQueue<T> {\n private readonly buffer: Array<{ readonly sequence: number; readonly value: T }> = [];\n private nextSequence = 0;\n private closed = false;\n private waiters: Array<() => void> = [];\n private readonly maxBuffered: number | undefined;\n private readonly truncationMarker: T | undefined;\n private truncationNoted = false;\n\n constructor(options: AsyncEventQueueOptions<T> = {}) {\n if (options.maxBuffered !== undefined) {\n if (!Number.isSafeInteger(options.maxBuffered) || options.maxBuffered <= 0) {\n throw new TypeError(\n `AsyncEventQueue: maxBuffered must be a positive safe integer, got ${String(options.maxBuffered)}`,\n );\n }\n this.maxBuffered = options.maxBuffered;\n }\n this.truncationMarker = options.truncationMarker;\n }\n\n /** True once this queue has dropped at least one entry. */\n get truncated(): boolean {\n return this.truncationNoted;\n }\n\n push(value: T): void {\n if (this.closed) return;\n this.buffer.push({ sequence: this.nextSequence++, value });\n this.enforceBound();\n this.wake();\n }\n\n close(): void {\n if (this.closed) return;\n this.closed = true;\n this.wake();\n }\n\n /**\n * Drop the oldest entries back down to the bound. The marker is queue\n * metadata, not a buffered entry: every subscriber observes it at most once\n * after the first drop, while all retained capacity remains available to\n * real events.\n */\n private enforceBound(): void {\n const limit = this.maxBuffered;\n if (limit === undefined || this.buffer.length <= limit) return;\n this.buffer.splice(0, this.buffer.length - limit);\n this.truncationNoted = true;\n }\n\n private wake(): void {\n const waiters = this.waiters;\n this.waiters = [];\n for (const resolve of waiters) resolve();\n }\n\n private waitForMore(): Promise<void> {\n return new Promise((resolve) => this.waiters.push(resolve));\n }\n\n /** Async-iterate the buffer from index 0, waiting for new pushes until closed. */\n subscribe(): AsyncIterable<T> {\n const queue = this;\n return {\n [Symbol.asyncIterator](): AsyncIterator<T> {\n let sequence = queue.buffer[0]?.sequence ?? queue.nextSequence;\n let truncationDelivered = false;\n return {\n async next(): Promise<IteratorResult<T>> {\n for (;;) {\n if (queue.truncationNoted && !truncationDelivered && queue.truncationMarker !== undefined) {\n truncationDelivered = true;\n return { value: queue.truncationMarker, done: false };\n }\n\n const oldest = queue.buffer[0]?.sequence;\n if (oldest !== undefined && sequence < oldest) sequence = oldest;\n if (oldest !== undefined) {\n const offset = sequence - oldest;\n const entry = queue.buffer[offset];\n if (entry !== undefined) {\n sequence = entry.sequence + 1;\n return { value: entry.value, done: false };\n }\n }\n if (queue.closed) {\n return { value: undefined, done: true };\n }\n await queue.waitForMore();\n }\n },\n };\n },\n };\n }\n}\n","import type { InboundCommitted, ByokCloudObserver } from '@byok-sdk/cloud';\nimport type { RuntimeId, TaskState } from '@byok-sdk/protocol';\nimport { AsyncEventQueue } from './event-queue';\nimport type { DeviceConnections } from './connections';\nimport type { ByokServerEvent, ServerTaskEvent } from './types';\n\n/** Per-task {@link ServerTaskEvent} retention before drop-oldest engages. */\nexport const DEFAULT_TASK_EVENT_BUFFER_LIMIT = 1000;\n/** How long a terminal task's relay state is retained before reclamation, ms. */\nexport const DEFAULT_TASK_EVENT_RETENTION_MS = 5 * 60_000;\n\n/**\n * The relay's own truncation marker. A single `error` entry, appended once, is\n * the whole contract: it says \"entries were dropped from this feed\", not what\n * they were — a reader that needs the facts reads them back\n * (`ByokServer.tasks.get`, `TaskHandle.result()`).\n */\nconst TRUNCATION_MARKER: ServerTaskEvent = { kind: 'error', reason: 'events_truncated' };\n\ninterface TaskRelayState {\n readonly queue: AsyncEventQueue<ServerTaskEvent>;\n readonly terminal: Promise<void>;\n settleTerminal: () => void;\n terminalSettled: boolean;\n provisional: boolean;\n readonly early: Array<{ readonly envelope: InboundCommitted['envelope']; readonly at: string }>;\n latestApprovalRequestSourceEnvelopeId?: string;\n claimedRuntime?: RuntimeId;\n claimedHarnessId?: string;\n reclaimTimer?: ReturnType<typeof setTimeout>;\n}\n\nexport interface TaskEventRelayOptions {\n readonly connections: DeviceConnections;\n readonly taskEventBufferLimit?: number;\n readonly taskEventRetentionMs?: number;\n}\n\n/**\n * Post-commit fan-out: cloud kernel envelopes -> `ServerTaskEvent` /\n * `ByokServerEvent`.\n *\n * The invariant this file exists to keep (WP3B §3): **the relay holds\n * notifications, never state**. It never answers \"what is this task\", \"what did\n * it produce\" or \"who owns it\" — every one of those is read back from the\n * kernel's durable stores on demand. What it owns is per-task delivery\n * plumbing: a bounded replayable queue, and one promise that settles when the\n * task reaches a terminal so `TaskHandle.result()` has something to await\n * before it reads the answer back.\n *\n * The two small facts it does carry are delivery bookkeeping, not a read model:\n * `terminalSettled` (so the FIRST terminal is the one that settles the promise,\n * matching the store's own first-terminal-wins rule, and a later stale terminal\n * is not announced as a second one) and `claimedRuntime` (echoed onto the\n * `task.state` event stream because the pre-fold feed carried it there; the\n * authoritative copy is `TaskAttempt.claimedRuntime`).\n *\n * Dispatch first {@link provision}s a known task id, then activates it with\n * {@link noteDispatched} after the kernel has accepted its offer. Envelopes\n * that arrive in that narrow interval are buffered, not dropped. An envelope\n * naming a task this server never dispatched is folded for nobody and allocates nothing —\n * otherwise a device could grow this map without bound by guessing task ids,\n * and the kernel's gate deliberately treats such an envelope as a harmless\n * store no-op rather than a rejection.\n *\n * `onInboundCommitted` runs inline on the kernel's request path and must stay\n * synchronous and cheap; anything needing a store read goes through\n * {@link onTaskActivity}, which the composition sets and which owns its own\n * failure handling.\n */\nexport class TaskEventRelay implements ByokCloudObserver {\n readonly #tasks = new Map<string, TaskRelayState>();\n readonly #serverEvents: AsyncEventQueue<ByokServerEvent>;\n readonly #connections: DeviceConnections;\n readonly #bufferLimit: number;\n readonly #retentionMs: number;\n #stopped = false;\n\n /**\n * Called once per committed task-progress observation for a dispatched task.\n * The composition uses it to run the implicit-approval-resume check, which\n * needs a store read and therefore cannot happen inline here.\n */\n onTaskActivity: ((\n taskId: string,\n pendingRequestSourceEnvelopeId: string | undefined,\n activitySourceEnvelopeId: string,\n activityAt: string,\n ) => void) | undefined;\n\n constructor(options: TaskEventRelayOptions) {\n this.#connections = options.connections;\n this.#bufferLimit = positiveLimit(options.taskEventBufferLimit ?? DEFAULT_TASK_EVENT_BUFFER_LIMIT, 'taskEventBufferLimit');\n this.#retentionMs = positiveLimit(options.taskEventRetentionMs ?? DEFAULT_TASK_EVENT_RETENTION_MS, 'taskEventRetentionMs');\n // The cross-task feed is long-lived and never closed, so it is bounded on\n // the same budget. It drops silently: `ByokServerEvent` has no member that\n // could carry a truncation notice, and inventing one would be a wire-shaped\n // event no server action produced.\n this.#serverEvents = new AsyncEventQueue<ByokServerEvent>({ maxBuffered: this.#bufferLimit });\n }\n\n /** The cross-task embedder feed backing `ByokServer.events.subscribe()`. */\n serverEvents(): AsyncIterable<ByokServerEvent> {\n return this.#serverEvents.subscribe();\n }\n\n /** Publish one cross-task event (rate-limit episodes, host-side transitions). */\n emitServerEvent(event: ByokServerEvent): void {\n if (this.#stopped) return;\n this.#serverEvents.push(event);\n }\n\n /** Pre-register a task id before its offer enqueue can become observable. */\n provision(taskId: string): void {\n this.#open(taskId, true);\n }\n\n /** Forget an enqueue that failed before it produced an offer. */\n abort(taskId: string): void {\n const state = this.#tasks.get(taskId);\n if (state === undefined || !state.provisional) return;\n if (state.reclaimTimer !== undefined) clearTimeout(state.reclaimTimer);\n state.settleTerminal();\n state.queue.close();\n this.#tasks.delete(taskId);\n }\n\n /**\n * Open the relay for a task this server just dispatched, and publish its\n * `Offered` origin on both feeds. `at` is the offer envelope's own timestamp,\n * so the feed and the snapshot agree on when the task began.\n */\n noteDispatched(taskId: string, at: string): void {\n const existing = this.#tasks.get(taskId);\n const state = existing ?? this.#open(taskId);\n if (existing !== undefined && !state.provisional) return;\n state.provisional = false;\n state.queue.push({ kind: 'state', state: 'Offered', at });\n this.emitServerEvent({ kind: 'task.created', taskId, at });\n const early = state.early.splice(0);\n for (const input of early) this.#handleTaskEnvelope(state, taskId, input.envelope, input.at);\n }\n\n /** The per-task feed backing `TaskHandle.events()`, replayed from the start of what is retained. */\n events(taskId: string): AsyncIterable<ServerTaskEvent> {\n return this.#open(taskId).queue.subscribe();\n }\n\n /** Settles when this task first reaches a terminal — the barrier `TaskHandle.result()` awaits. */\n terminal(taskId: string): Promise<void> {\n return this.#open(taskId).terminal;\n }\n\n /**\n * Host-side transitions the wire never carries: an accepted cancellation, and\n * an approval the operator resolved through `TaskHandle.approve`/`reject`.\n * Published here so the two feeds report the same task history whichever side\n * moved it, and (for a terminal) so `result()` is not left waiting on a device\n * message that a cancelled task will never send.\n */\n noteHostTransition(taskId: string, state: TaskState, at: string): void {\n const existing = this.#tasks.get(taskId);\n if (existing === undefined) return;\n this.#transition(existing, taskId, state, at);\n }\n\n onInboundCommitted(input: InboundCommitted): void {\n if (this.#stopped) return;\n const { deviceId, envelope } = input;\n const at = new Date().toISOString();\n\n if (envelope.type === 'conn.hello') {\n this.#connections.announce(\n deviceId,\n {\n ...(envelope.payload.clientVersion === undefined ? {} : { clientVersion: envelope.payload.clientVersion }),\n ...(envelope.payload.runtimes === undefined ? {} : { runtimes: envelope.payload.runtimes }),\n ...(envelope.payload.configuredToolsets === undefined\n ? {}\n : { configuredToolsets: envelope.payload.configuredToolsets }),\n },\n at,\n );\n return;\n }\n // Any committed envelope is a sign of life from an authenticated device.\n this.#connections.touch(deviceId, at);\n\n const taskId = envelope.task_id;\n if (taskId === undefined) return;\n const state = this.#tasks.get(taskId);\n if (state === undefined) return;\n\n if (state.provisional) {\n state.early.push({ envelope, at });\n return;\n }\n this.#handleTaskEnvelope(state, taskId, envelope, at);\n }\n\n #handleTaskEnvelope(\n state: TaskRelayState,\n taskId: string,\n envelope: InboundCommitted['envelope'],\n at: string,\n ): void {\n switch (envelope.type) {\n case 'task.claim':\n if (envelope.payload.runtime !== undefined) state.claimedRuntime = envelope.payload.runtime;\n if (envelope.payload.harnessId !== undefined) state.claimedHarnessId = envelope.payload.harnessId;\n this.#transition(state, taskId, 'Claimed', at);\n return;\n case 'task.started':\n this.#transition(state, taskId, 'Running', at);\n return;\n case 'task.progress':\n for (const event of envelope.payload.events) state.queue.push({ kind: 'agent', event });\n this.onTaskActivity?.(\n taskId,\n state.latestApprovalRequestSourceEnvelopeId,\n envelope.id,\n envelope.ts,\n );\n return;\n case 'task.artifact':\n state.queue.push({ kind: 'artifact', artifact: envelope.payload });\n this.onTaskActivity?.(\n taskId,\n state.latestApprovalRequestSourceEnvelopeId,\n envelope.id,\n envelope.ts,\n );\n return;\n case 'task.await_approval':\n state.latestApprovalRequestSourceEnvelopeId = envelope.id;\n state.queue.push({ kind: 'await_approval', summary: envelope.payload.summary });\n this.#transition(state, taskId, 'AwaitApproval', at);\n return;\n case 'task.approval_resolved':\n this.emitServerEvent({\n kind: 'task.approval_resolved',\n taskId,\n at,\n approvalId: envelope.payload.approvalId,\n decision: envelope.payload.decision,\n resolvedBy: envelope.payload.resolvedBy,\n // Whether the reporting daemon advertised `approval-targeting` was a\n // property of its live WS registration, which no longer exists. The\n // durable capability list is a device-build fact rather than a\n // per-report one, so this reports the honest answer for the transport\n // that remains: not targeted.\n targeted: false,\n });\n this.#transition(state, taskId, 'Running', at);\n return;\n case 'task.decline':\n this.#transition(state, taskId, 'Failed', at);\n return;\n case 'task.complete':\n this.#transition(state, taskId, 'Complete', at);\n return;\n case 'task.fail':\n this.#transition(state, taskId, 'Failed', at);\n return;\n case 'task.cancelled':\n this.#transition(state, taskId, 'Cancelled', at);\n return;\n default:\n return;\n }\n }\n\n /** Publish an implicit resolution the composition inferred from later task traffic. */\n emitImplicitApprovalResolved(taskId: string, at: string): void {\n this.emitServerEvent({ kind: 'task.approval_resolved_implicit', taskId, at });\n this.noteHostTransition(taskId, 'Running', at);\n }\n\n /** Close every feed and drop every timer. Safe to call more than once. */\n stop(): void {\n if (this.#stopped) return;\n this.#stopped = true;\n for (const state of this.#tasks.values()) {\n if (state.reclaimTimer !== undefined) clearTimeout(state.reclaimTimer);\n state.settleTerminal();\n state.queue.close();\n }\n this.#tasks.clear();\n this.#serverEvents.close();\n this.#connections.clear();\n }\n\n #transition(state: TaskRelayState, taskId: string, next: TaskState, at: string): void {\n // First terminal wins here for the same reason it wins in the receipt\n // store: a later stale terminal changed no durable fact, so announcing it\n // would make the feed disagree with the read model.\n if (state.terminalSettled) return;\n state.queue.push({ kind: 'state', state: next, at });\n this.emitServerEvent({\n kind: 'task.state',\n taskId,\n state: next,\n at,\n ...(state.claimedHarnessId === undefined ? {} : { claimedHarnessId: state.claimedHarnessId }),\n ...(state.claimedRuntime === undefined ? {} : { claimedRuntime: state.claimedRuntime }),\n });\n if (next !== 'Complete' && next !== 'Failed' && next !== 'Cancelled') return;\n state.terminalSettled = true;\n state.settleTerminal();\n // The feed ENDS at the terminal, right after the terminal event is pushed —\n // that transition is the last thing that will ever happen to this task, so\n // a `for await` over `events()` completes there instead of hanging. Closing\n // does not empty the buffer (`event-queue.ts`), so a reader that subscribes\n // later still replays the whole history from the start and then ends;\n // `taskEventRetentionMs` below only decides when the buffer is RECLAIMED,\n // and must never be what terminates an iterator.\n state.queue.close();\n this.#scheduleReclaim(taskId, state);\n }\n\n /**\n * Drop a terminal task's plumbing after the retention window. The queue was\n * already closed at the terminal; this only stops retaining what it buffered,\n * after which the durable read model (`tasks.get`, `result()`) is the only\n * answer — which is where the facts lived all along.\n */\n #scheduleReclaim(taskId: string, state: TaskRelayState): void {\n if (state.reclaimTimer !== undefined) return;\n const timer = setTimeout(() => {\n this.#tasks.delete(taskId);\n }, this.#retentionMs);\n timer.unref?.();\n state.reclaimTimer = timer;\n }\n\n #open(taskId: string, provisional = false): TaskRelayState {\n const existing = this.#tasks.get(taskId);\n if (existing !== undefined) return existing;\n let settleTerminal!: () => void;\n const terminal = new Promise<void>((resolve) => {\n settleTerminal = resolve;\n });\n const created: TaskRelayState = {\n queue: new AsyncEventQueue<ServerTaskEvent>({\n maxBuffered: this.#bufferLimit,\n truncationMarker: TRUNCATION_MARKER,\n }),\n terminal,\n settleTerminal,\n terminalSettled: false,\n provisional,\n early: [],\n };\n this.#tasks.set(taskId, created);\n return created;\n }\n}\n\nfunction positiveLimit(value: number, name: string): number {\n if (!Number.isSafeInteger(value) || value <= 0) {\n throw new TypeError(`${name} must be a positive safe integer`);\n }\n return value;\n}\n","import type { DeviceRecord, PendingApproval, TaskAttempt, TerminalResult } from '@byok-sdk/cloud';\nimport type { TaskState } from '@byok-sdk/protocol';\nimport type { DeviceConnection } from './connections';\nimport type { MachineInfo, TaskResult, TaskSnapshot } from './types';\n\n/**\n * Projections from the cloud kernel's read model onto this package's public\n * shapes. Pure functions, deliberately: every input is a value the caller has\n * already read from a store, so there is exactly one place the mapping lives\n * and no way for a second copy of it to drift.\n */\n\n/**\n * What this server calls a task the kernel calls a `TaskAttempt`.\n *\n * The order of the gates is the whole contract, and it mirrors the kernel's own\n * (`ByokCloud.readTaskResult`):\n *\n * 1. an accepted host cancellation OUTRANKS everything a runtime reports later.\n * `cancel()` is authoritative the moment the kernel records it, so the task\n * reads `Cancelled` immediately and a late `task.complete` — which the wire\n * still answers as a success — cannot move it;\n * 2. a terminal attempt is its own terminal;\n * 3. an unresolved approval on the task's timeline is `AwaitApproval`. The\n * kernel has no such attempt STATUS on purpose (ADR-028: no execution state\n * in the cloud) — the pause is derived from the durable approval timeline,\n * which is the same single authority `approveTask`'s staleness gate reads;\n * 4. otherwise the attempt's own coarse status.\n */\nexport function toTaskState(attempt: TaskAttempt, pending: PendingApproval | undefined): TaskState {\n if (attempt.cancellation !== undefined) return 'Cancelled';\n switch (attempt.status) {\n case 'complete':\n return 'Complete';\n case 'failed':\n return 'Failed';\n case 'cancelled':\n case 'cancel_requested':\n return 'Cancelled';\n case 'offered':\n return pending === undefined ? 'Offered' : 'AwaitApproval';\n case 'claimed':\n return pending === undefined ? 'Claimed' : 'AwaitApproval';\n case 'running':\n return pending === undefined ? 'Running' : 'AwaitApproval';\n }\n}\n\n/**\n * The kernel's typed terminal read model, narrowed to this package's\n * {@link TaskResult}.\n *\n * Deliberately LOSSY in one direction: `taskId`, `recordedAt`, `agentRef`,\n * `usage` and `terminalCause` exist on `TerminalResult` and have no place here.\n * They are all reachable through the kernel (`readTaskResult`), and copying\n * them into a second shape would make this projection something a caller has to\n * keep in sync rather than a narrowing of one authority.\n */\nexport function toTaskResult(terminal: TerminalResult | undefined): TaskResult | undefined {\n if (terminal === undefined) return undefined;\n return {\n state: terminal.state === 'complete' ? 'Complete' : terminal.state === 'failed' ? 'Failed' : 'Cancelled',\n summary: terminal.summary,\n sessionRef: terminal.sessionRef,\n artifactRefs: terminal.artifactRefs === undefined ? undefined : [...terminal.artifactRefs],\n ...(terminal.document === undefined ? {} : { document: terminal.document }),\n ...(terminal.reason === undefined ? {} : { reason: terminal.reason }),\n ...(terminal.retryable === undefined ? {} : { retryable: terminal.retryable }),\n };\n}\n\n/**\n * The dispatch-time facts the kernel does not persist.\n *\n * `TaskAttempt` records ownership and disposition, not the request that opened\n * it — it carries no `createdAt` and no `sessionRef`. Both are needed by the\n * public snapshot, and both are known exactly once, at dispatch, so this\n * process keeps them keyed by task id rather than inventing a durable column or\n * quietly reporting the attempt's last-mutation time as its creation time.\n * Deliberately not TTL-reclaimed: it is the exact peer of the in-memory attempt\n * store this composition is built on, and it must not forget a task that store\n * still answers for.\n */\nexport interface DispatchFacts {\n readonly createdAt: string;\n readonly sessionRef?: string;\n}\n\nexport function toTaskSnapshot(\n attempt: TaskAttempt,\n pending: PendingApproval | undefined,\n terminal: TerminalResult | undefined,\n dispatched: DispatchFacts | undefined,\n): TaskSnapshot {\n const result = toTaskResult(terminal);\n // The terminal's own `sessionRef` wins: a runtime that resumed or minted a\n // session is reporting the one the work actually ran under, which is a\n // stronger fact than whatever the offer asked for.\n const sessionRef = result?.sessionRef ?? dispatched?.sessionRef;\n return {\n taskId: attempt.taskId,\n state: toTaskState(attempt, pending),\n deviceId: attempt.deviceId,\n sessionRef,\n ...(attempt.agentRef === undefined ? {} : { agentRef: attempt.agentRef }),\n createdAt: dispatched?.createdAt ?? attempt.updatedAt,\n updatedAt: attempt.updatedAt,\n ...(result === undefined ? {} : { result }),\n ...(pending?.approvalId === undefined ? {} : { pendingApprovalId: pending.approvalId }),\n ...(attempt.claimedHarnessId === undefined ? {} : { claimedHarnessId: attempt.claimedHarnessId }),\n ...(attempt.claimedRuntime === undefined ? {} : { claimedRuntime: attempt.claimedRuntime }),\n ...(attempt.claimedRuntimeCapabilities === undefined\n ? {}\n : { claimedRuntimeCapabilities: attempt.claimedRuntimeCapabilities }),\n };\n}\n\n/**\n * A device row joined with what this process observed of its connection.\n *\n * The identity half is durable and tenant-owned; the connection half is an\n * in-process observation that dies with the server — see `connections.ts` for\n * why `conn.hello`'s runtime discovery block is deliberately not persisted.\n */\nexport function toMachineInfo(device: DeviceRecord, connection: DeviceConnection | undefined): MachineInfo {\n return {\n deviceId: device.deviceId,\n deviceName: device.deviceName,\n connected: connection?.connected ?? false,\n lastSeen: connection?.lastSeen,\n ...(connection?.clientVersion === undefined ? {} : { clientVersion: connection.clientVersion }),\n harnesses: device.harnesses,\n runtimes: connection?.runtimes === undefined ? undefined : [...connection.runtimes],\n configuredToolsets:\n connection?.configuredToolsets === undefined ? undefined : [...connection.configuredToolsets],\n };\n}\n","/**\n * M4 Phase 4 (part A): per-key token bucket, used by `ConnectionHub`\n * (`hub.ts`) to rate-limit inbound daemon->server envelopes per device.\n * Framework-agnostic on purpose (no hub/transport types here) so it stays\n * unit-testable in isolation, mirroring `event-queue.ts`'s own\n * transport-agnostic split.\n *\n * Token bucket, not a fixed window: `burst` tokens are available immediately\n * (accommodating a legitimate short spike — e.g. a reconnect's redelivery\n * catch-up), refilling continuously at `messagesPerSecond` tokens/sec up to\n * that same `burst` ceiling. A bucket is created lazily per key on first use\n * and persists for as long as it stays active — deliberately NOT reset when\n * a device disconnects/reconnects (see `ConnectionHub`'s own use of this\n * class): resetting on reconnect would let a device that just got\n * disconnected for exceeding its budget immediately burst again on\n * reconnect, defeating the limit entirely. It IS dropped once idle long\n * enough that keeping it around would be pointless — see\n * `evictIdleBucketsIfDue`.\n *\n * Construction validates `messagesPerSecond`/`burst` fail-fast (throws\n * `TypeError` on anything non-finite or <= 0) rather than silently building\n * a limiter that either divides into `NaN` token math or (an `Infinity`\n * burst/rate) never actually limits anything.\n *\n * Finding R5 (cross-model re-review — F10 residual): `burst` specifically\n * must be `>= 1`, not merely `> 0`. A `0 < burst < 1` value used to pass\n * the old `<= 0` check cleanly, but `consume()`'s own debit logic\n * (`if (bucket.tokens < 1) return false;`) can NEVER succeed once the\n * bucket's own CEILING (`burst`) is itself below 1 — `Math.min(this.burst,\n * ...)` caps refill there, so `tokens` can never reach 1 no matter how\n * long the bucket sits idle. The old validation let this construct\n * silently — a limiter that rejects every single message, forever, for\n * every key, is not a rate LIMIT, it's a permanent, total block; that\n * should be a construction-time error, not a runtime surprise discovered\n * once real traffic starts getting rejected.\n */\n\nexport interface RateLimiterOptions {\n /** Sustained refill rate, tokens (i.e. messages) per second. Must be a finite number > 0. Default 50. */\n messagesPerSecond?: number;\n /** Bucket capacity — how many messages may arrive back-to-back before the limit engages. Must be a finite number >= 1 (finding R5 — see the module doc comment for why `< 1` can never let a single message through, ever). Default 100. */\n burst?: number;\n /** Hard cap on how many distinct keys (finding R5) this limiter tracks at once — see {@link DEFAULT_MAX_TRACKED_DEVICES}'s own doc comment. Must be a finite number >= 1. Default 10,000. */\n maxTrackedDevices?: number;\n}\n\nconst DEFAULT_MESSAGES_PER_SECOND = 50;\nconst DEFAULT_BURST = 100;\n/**\n * Finding R5 (cross-model re-review — F10 residual): hard cap on\n * `RateLimiter.buckets`' size — see {@link RateLimiter.evictOldestIfAtCapacity}\n * for the eviction policy this backs. Without a HARD cap, the existing idle\n * sweep (`evictIdleBucketsIfDue`) only ever reclaims a bucket once it's\n * been quiet for `idleEvictionThresholdMs` — a flood of many THOUSANDS of\n * genuinely-distinct, ACTIVELY-used keys arriving faster than they ever go\n * idle (a legitimately huge fleet, or a same-shape Sybil-style attack\n * registering many fake device ids) would otherwise grow `buckets` without\n * bound regardless of the idle sweep, exactly the unbounded-growth shape\n * this codebase caps everywhere else (`MAX_PENDING_APPROVALS`,\n * `MAX_TRACKED_TASKS`, `MAX_LIVE_TASK_ANCHORS`, ...). 10,000 is generously\n * sized for any plausible real deployment while still being a genuine,\n * enforced ceiling — not a real-world limit this is expected to ever\n * approach in ordinary operation.\n */\nconst DEFAULT_MAX_TRACKED_DEVICES = 10_000;\n\n/**\n * Sweep cadence for idle-bucket eviction (`evictIdleBucketsIfDue`), in\n * number of `consume()` calls across ALL keys — not a wall-clock timer, so\n * this class stays fully synchronous and framework-agnostic (per this\n * file's own top doc comment): no timer handle to create, `unref`, or clean\n * up on shutdown, and no lifecycle wiring needed in `ConnectionHub`.\n */\nconst EVICTION_SWEEP_EVERY_N_CALLS = 1000;\n\ninterface Bucket {\n tokens: number;\n lastRefillMs: number;\n}\n\nexport class RateLimiter {\n private readonly messagesPerSecond: number;\n private readonly burst: number;\n private readonly buckets = new Map<string, Bucket>();\n /**\n * Wall-clock idle duration (ms) after which a bucket is GUARANTEED to\n * already be refilled to `burst`, regardless of its actual token count at\n * last touch — i.e. the time to go from 0 tokens to `burst` at this\n * instance's configured rate. `evictIdleBucketsIfDue` uses this as the\n * eviction threshold: dropping an entry idle at least this long and\n * recreating it fresh (tokens = burst) on the next `consume()` is\n * therefore behaviorally IDENTICAL to refilling it in place would have\n * been — both cap at `burst` — so eviction is semantically invisible to\n * the caller.\n */\n private readonly idleEvictionThresholdMs: number;\n /** Finding R5: hard cap on `buckets.size` — see {@link DEFAULT_MAX_TRACKED_DEVICES}'s own doc comment. */\n private readonly maxTrackedDevices: number;\n /** Calls to `consume()` since the last sweep — see `EVICTION_SWEEP_EVERY_N_CALLS`. */\n private callsSinceSweep = 0;\n\n constructor(opts: RateLimiterOptions = {}) {\n const messagesPerSecond = opts.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND;\n const burst = opts.burst ?? DEFAULT_BURST;\n const maxTrackedDevices = opts.maxTrackedDevices ?? DEFAULT_MAX_TRACKED_DEVICES;\n if (!Number.isFinite(messagesPerSecond) || messagesPerSecond <= 0) {\n throw new TypeError(`RateLimiter: messagesPerSecond must be a finite number > 0, got ${messagesPerSecond}`);\n }\n // Finding R5: `< 1`, not `<= 0` — see the module doc comment for why a\n // burst between 0 and 1 (exclusive) constructs a limiter that can never\n // let a single message through, ever, for any key.\n if (!Number.isFinite(burst) || burst < 1) {\n throw new TypeError(`RateLimiter: burst must be a finite number >= 1, got ${burst}`);\n }\n if (!Number.isFinite(maxTrackedDevices) || maxTrackedDevices < 1) {\n throw new TypeError(`RateLimiter: maxTrackedDevices must be a finite number >= 1, got ${maxTrackedDevices}`);\n }\n this.messagesPerSecond = messagesPerSecond;\n this.burst = burst;\n this.maxTrackedDevices = maxTrackedDevices;\n this.idleEvictionThresholdMs = (burst / messagesPerSecond) * 1000;\n }\n\n /**\n * Debit one token from `key`'s bucket, refilling first for however much\n * wall-clock time has elapsed since its last refill. Returns `false`\n * (and debits nothing) when the bucket is currently empty — the caller is\n * over budget right now.\n */\n consume(key: string): boolean {\n const now = Date.now();\n this.evictIdleBucketsIfDue(now);\n\n let bucket = this.buckets.get(key);\n if (!bucket) {\n // Finding R5: enforce the hard cap right before growing the map with\n // a genuinely NEW key — see `evictOldestIfAtCapacity`'s own doc\n // comment for the eviction policy and its equivalence/best-effort\n // split.\n this.evictOldestIfAtCapacity();\n bucket = { tokens: this.burst, lastRefillMs: now };\n this.buckets.set(key, bucket);\n } else {\n const elapsedMs = now - bucket.lastRefillMs;\n if (elapsedMs > 0) {\n bucket.tokens = Math.min(this.burst, bucket.tokens + (elapsedMs / 1000) * this.messagesPerSecond);\n bucket.lastRefillMs = now;\n }\n }\n\n if (bucket.tokens < 1) return false;\n bucket.tokens -= 1;\n return true;\n }\n\n /**\n * Every `EVICTION_SWEEP_EVERY_N_CALLS` calls to `consume()`, drops every\n * bucket idle for at least `idleEvictionThresholdMs` (see that field's doc\n * comment for why this is safe). Without this, `buckets` would hold one\n * permanent entry per historical key forever — every device that ever\n * connected, even long after it disconnected for good — growing without\n * bound over a long-lived server's lifetime.\n */\n private evictIdleBucketsIfDue(now: number): void {\n this.callsSinceSweep++;\n if (this.callsSinceSweep < EVICTION_SWEEP_EVERY_N_CALLS) return;\n this.callsSinceSweep = 0;\n for (const [key, bucket] of this.buckets) {\n if (now - bucket.lastRefillMs >= this.idleEvictionThresholdMs) {\n this.buckets.delete(key);\n }\n }\n }\n\n /**\n * Finding R5 (cross-model re-review — F10 residual): called right before\n * inserting a bucket for a genuinely NEW key, evicting the single\n * LEAST-RECENTLY-refilled entry if `buckets` is already at\n * `maxTrackedDevices` — an O(n) scan, but one that only ever runs once\n * the map is already at its hard ceiling (a rare/bounded event under\n * ordinary operation, not a per-call cost), mirroring this codebase's own\n * established \"acceptable O(n) for a rare/bounded case\" precedent (e.g.\n * `audit-log.ts`'s `compactPreservingLiveTasks` during rotation).\n *\n * Equivalence split (stated explicitly, not left implied):\n * - For any evicted bucket that was ALREADY idle for at least\n * `idleEvictionThresholdMs` (i.e. `evictIdleBucketsIfDue` would have\n * reclaimed it anyway, just not yet — sweeps only run every\n * `EVICTION_SWEEP_EVERY_N_CALLS` calls, not continuously), eviction is\n * PROVABLY equivalent to an in-place refill: both cap at `burst`, so a\n * caller can never observe the difference (see `idleEvictionThresholdMs`'s\n * own doc comment for the identical reasoning `evictIdleBucketsIfDue`\n * already relies on).\n * - For a bucket evicted EARLY — still within its idle threshold, forced\n * out only because `buckets` is at capacity (many thousands of\n * genuinely-distinct, actively-used keys, not a quiet one) — this is\n * BEST-EFFORT, not equivalence-preserving: whatever partial token debt\n * that key had is discarded, and its very next `consume()` call starts\n * completely fresh (`tokens: this.burst`), a strictly MORE permissive\n * outcome than if it had kept its place. This is an accepted,\n * deliberately bounded trade-off — it only ever engages under\n * cardinality far beyond any plausible real deployment — favoring\n * bounded memory over perfect per-key continuity in that one extreme\n * case.\n */\n private evictOldestIfAtCapacity(): void {\n if (this.buckets.size < this.maxTrackedDevices) return;\n let oldestKey: string | undefined;\n let oldestLastRefillMs = Infinity;\n for (const [key, bucket] of this.buckets) {\n if (bucket.lastRefillMs < oldestLastRefillMs) {\n oldestLastRefillMs = bucket.lastRefillMs;\n oldestKey = key;\n }\n }\n if (oldestKey !== undefined) this.buckets.delete(oldestKey);\n }\n}\n\n/**\n * The counting `InboundRateLimiter` (`@byok-sdk/cloud`'s store port) this\n * package composes the kernel with.\n *\n * Position matters and is not this adapter's choice: the kernel debits one\n * token at step 0 of its inbound gate, BEFORE the type-allow check, for every\n * envelope that reaches it. That is exactly the choke point the old\n * `ConnectionHub.handleInbound` occupied, which is why both `envelopesIn` (one\n * per envelope, every outcome) and `rateLimitEvents` (one per REJECTED\n * envelope, never coalesced) are counted here and nowhere else.\n *\n * The `device.rate_limited` embedder event is the one thing that IS coalesced,\n * matching the pre-fold rule: an episode fires exactly one event, and only a\n * subsequent SUCCESSFUL consume by that device re-arms it. So a flood produces\n * one event and N counter increments, and a device that recovers and floods\n * again produces a second, distinct event.\n */\nexport interface InboundRateLimiterCounters {\n /** Every envelope handed to the kernel's inbound gate, whatever the gate then decides. */\n envelopesIn: number;\n /** Envelopes the bucket refused. Per envelope — see the episode rule above. */\n rateLimitEvents: number;\n}\n\nexport interface CountingInboundRateLimiter {\n /** The port `CloudStores.rateLimiter` is composed with. */\n readonly limiter: { consume(tenant: string, deviceId: string): Promise<boolean> };\n readonly counters: InboundRateLimiterCounters;\n}\n\n/**\n * Adapt a {@link RateLimiter} to the kernel's `(tenant, deviceId)` port.\n *\n * The bucket key is `${tenant}:${deviceId}` rather than the bare device id: a\n * device id is only unique within its tenant, and a shared key space would let\n * one tenant's flood spend another's budget for a colliding id.\n */\nexport function createCountingInboundRateLimiter(\n limiter: RateLimiter,\n onRateLimited: (deviceId: string, at: string) => void,\n): CountingInboundRateLimiter {\n const counters: InboundRateLimiterCounters = { envelopesIn: 0, rateLimitEvents: 0 };\n /** Devices currently inside a rate-limit episode — see the coalescing rule above. */\n const episodes = new Set<string>();\n\n return {\n counters,\n limiter: {\n async consume(tenant: string, deviceId: string): Promise<boolean> {\n counters.envelopesIn += 1;\n const key = `${tenant}:${deviceId}`;\n if (limiter.consume(key)) {\n episodes.delete(key);\n return true;\n }\n counters.rateLimitEvents += 1;\n if (!episodes.has(key)) {\n episodes.add(key);\n onRateLimited(deviceId, new Date().toISOString());\n }\n return false;\n },\n },\n };\n}\n","import { chmodSync, existsSync, mkdirSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { dirname } from 'node:path';\nimport type { DatabaseSync, DatabaseSyncOptions } from 'node:sqlite';\n\nexport type SqliteOpenStep = 'after-open' | 'after-wal';\n\n/** Test-only seam for proving that post-open initialization failures release the native handle. */\nexport interface SqliteOpenFaultSeam {\n onStep?(step: SqliteOpenStep): void;\n close?(db: DatabaseSync): void;\n}\n\n/**\n * Preserve the initialization error after deterministically releasing an\n * already-open SQLite handle. If cleanup itself fails, surface both failures\n * instead of losing the reason construction failed or pretending ownership\n * was returned.\n */\nexport function closeSqliteDatabaseAfterInitializationFailure(\n db: DatabaseSync,\n initializationError: unknown,\n message: string,\n close: (db: DatabaseSync) => void = (database) => database.close(),\n): never {\n try {\n close(db);\n } catch (closeError) {\n throw new AggregateError([initializationError, closeError], message);\n }\n throw initializationError;\n}\n\n/**\n * Thrown when `node:sqlite` isn't available in the running Node.js binary.\n * `node:sqlite` shipped in Node.js 22.5.0 (https://nodejs.org/api/sqlite.html)\n * and remains marked experimental there (an `ExperimentalWarning` on stderr\n * is expected and harmless — not an error). The SQLite-backed embedded store\n * composition deliberately\n * depend on nothing else — no `better-sqlite3` or other native module —\n * because staying at zero native dependencies is required to keep\n * `@byok-sdk/server` trivially packageable across platforms. The tradeoff is\n * that this composition simply doesn't work below Node 22.5; this error says so\n * clearly and up front, instead of letting a cryptic `Cannot find module\n * 'node:sqlite'` surface from deep inside a query.\n */\nexport class SqliteUnavailableError extends Error {\n constructor(cause: unknown) {\n super(\n 'node:sqlite is unavailable in this Node.js runtime. The SQLite-backed reference ' +\n 'store composition requires Node.js 22.5+ with the built-in ' +\n '`node:sqlite` module (no native dependency is used or allowed here). Upgrade Node.js, ' +\n 'or select the default in-memory server storage instead.',\n );\n this.name = 'SqliteUnavailableError';\n this.cause = cause;\n }\n}\n\n/** `node:sqlite`'s minimum Node.js version (https://nodejs.org/api/sqlite.html). */\nconst MIN_NODE_MAJOR = 22;\nconst MIN_NODE_MINOR = 5;\n\n/**\n * Whether `nodeVersion` (a `major.minor.patch` string shaped like\n * `process.versions.node`) is new enough to have `node:sqlite` at all.\n * Exported only for this package's own tests to exercise the guard\n * deterministically (this dev/CI machine is already on a qualifying Node,\n * so the real \"unavailable\" path can't be triggered end-to-end here) — not\n * re-exported from `index.ts`, so not part of the public package API.\n * Unparsable input returns `true` (don't false-negative on a version string\n * shape this hasn't seen before): `loadSqliteModule`'s own `require` call is\n * the real, authoritative gate; this check only exists to turn the common\n * case (a too-old Node) into a clear message instead of a cryptic one.\n *\n * Not a sufficient capability check on its own: `node:sqlite` shipped in\n * Node 22.5.0 behind the `--experimental-sqlite` flag and only became usable\n * unflagged in a later 22.x release (https://nodejs.org/api/sqlite.html), so\n * a runtime that satisfies this version check can still fail to actually\n * load the module. Use {@link isSqliteAvailable} when the question is \"can I\n * use `node:sqlite` right now\", not \"is the Node version new enough for it\n * to exist at all\".\n */\nexport function isSqliteCapableNodeVersion(nodeVersion: string): boolean {\n const [majorStr, minorStr] = nodeVersion.split('.');\n const major = Number(majorStr);\n const minor = Number(minorStr);\n if (!Number.isFinite(major) || !Number.isFinite(minor)) return true;\n return major > MIN_NODE_MAJOR || (major === MIN_NODE_MAJOR && minor >= MIN_NODE_MINOR);\n}\n\nlet sqliteModule: typeof import('node:sqlite') | undefined;\n\n/**\n * Synchronously load `node:sqlite` via `createRequire` rather than a dynamic\n * `import()`. Every reference store in this package (`InMemoryTaskStore`,\n * `LocalDiskBlobStore`) constructs synchronously via `new`, and\n * `node:sqlite`'s own API (`DatabaseSync`) is itself fully synchronous — an\n * async factory here would be the odd one out and would leak into every\n * caller (`createByokServer`, the example, tests). `node:sqlite` is a\n * built-in, so `require('node:sqlite')` resolves it even from this\n * `\"type\": \"module\"` package. Throws {@link SqliteUnavailableError} (not a\n * raw `MODULE_NOT_FOUND`/version-mismatch trace) when it can't be loaded —\n * checking the Node version first (see {@link isSqliteCapableNodeVersion})\n * gives the common \"Node too old\" case a specific, actionable message\n * before even attempting the `require`.\n */\nfunction loadSqliteModule(): typeof import('node:sqlite') {\n if (sqliteModule) return sqliteModule;\n if (!isSqliteCapableNodeVersion(process.versions.node)) {\n throw new SqliteUnavailableError(\n new Error(\n `node:sqlite requires Node.js ${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}+; detected ${process.versions.node}`,\n ),\n );\n }\n try {\n const require = createRequire(import.meta.url);\n sqliteModule = require('node:sqlite') as typeof import('node:sqlite');\n return sqliteModule;\n } catch (err) {\n throw new SqliteUnavailableError(err);\n }\n}\n\n/**\n * Whether `node:sqlite` can ACTUALLY be loaded right now — the authoritative\n * capability check, in contrast to {@link isSqliteCapableNodeVersion}'s\n * version-string heuristic. This is what this package's own test suite uses\n * to decide whether to skip the SQLite-backed reference-store tests (rather\n * than fail them), and what anything else should call before assuming a\n * `SqliteTaskStore`/`SqliteBlobStore` can be constructed: it attempts the\n * real `require('node:sqlite')` (via {@link loadSqliteModule}, memoized) and\n * reports whether that succeeded, so it agrees with reality regardless of\n * whether the current runtime is old, too-new-but-flagged, or fully capable.\n */\nexport function isSqliteAvailable(): boolean {\n try {\n loadSqliteModule();\n return true;\n } catch {\n return false;\n }\n}\n\n/** Busy-timeout (ms) shared by both SQLite stores: long enough that two same-process `DatabaseSync` connections opened against the same file back-to-back (e.g. a test proving restart-safety by opening a \"second instance\" against the same path) don't spuriously throw `SQLITE_BUSY` under momentary write-lock contention. */\nconst DEFAULT_BUSY_TIMEOUT_MS = 5_000;\n\n/** POSIX mode both SQLite reference-store db files (and their WAL/SHM siblings) are secured to — owner read/write only, no group/other access. Matches the convention the client-side device credential store already uses (`packages/client/src/daemon/store.ts`). */\nconst SECURE_FILE_MODE = 0o600;\n/** POSIX mode applied to a freshly-created directory holding a SQLite reference-store db file — owner read/write/execute only. Same rationale as {@link SECURE_FILE_MODE}. */\nconst SECURE_DIR_MODE = 0o700;\n\n/**\n * Open (or create) a `node:sqlite` `DatabaseSync` at `path`, applying the\n * pragmas both reference SQLite stores share: WAL journaling for a\n * file-backed database (allows a reader and a writer to proceed without\n * blocking each other, and is what makes \"close instance A, open instance B\n * on the same file\" — the restart-safety story — reliable) and a busy\n * timeout (see {@link DEFAULT_BUSY_TIMEOUT_MS}). WAL is skipped for\n * `:memory:`, where it's meaningless. For a file-backed path whose parent\n * directory doesn't exist yet, creates it (recursively) at\n * {@link SECURE_DIR_MODE} — mirroring the client-side device store's\n * convention of never leaving a credential directory at a permissive\n * default mode. Throws {@link SqliteUnavailableError} if `node:sqlite`\n * itself can't be loaded (Node <22.5, or a flagged intermediate 22.x — see\n * {@link isSqliteAvailable}) — callers don't need their own guard for that;\n * this is the single choke point.\n */\nexport function openSqliteDatabase(\n path: string,\n options?: DatabaseSyncOptions,\n faults?: SqliteOpenFaultSeam,\n): DatabaseSync {\n const { DatabaseSync } = loadSqliteModule();\n if (path !== ':memory:') {\n mkdirSync(dirname(path), { recursive: true, mode: SECURE_DIR_MODE });\n }\n const db = new DatabaseSync(path, { timeout: DEFAULT_BUSY_TIMEOUT_MS, ...options });\n try {\n faults?.onStep?.('after-open');\n if (path !== ':memory:') {\n db.exec('PRAGMA journal_mode = WAL;');\n faults?.onStep?.('after-wal');\n }\n return db;\n } catch (error) {\n closeSqliteDatabaseAfterInitializationFailure(\n db,\n error,\n 'SQLite open initialization failed and its native handle could not be closed',\n faults?.close,\n );\n }\n}\n\n/**\n * Restrict `dbPath` and its WAL/SHM sibling files (`<path>-wal`,\n * `<path>-shm` — created by SQLite itself once WAL mode is active and a\n * write has happened) to owner-only read/write ({@link SECURE_FILE_MODE}).\n * Both SQLite reference stores hold sensitive bytes on disk with no other\n * access-control layer of their own — `SqliteBlobStore` an HMAC signing\n * secret plus arbitrary uploaded blob content, `SqliteTaskStore` task\n * instructions and device/session refs — so a real (non-`:memory:`)\n * database file must not be left at whatever permissive mode the process'\n * umask would otherwise give it.\n *\n * Call this AFTER the schema has been created against `dbPath` (so the\n * WAL/SHM files, which SQLite creates lazily on first write, already exist)\n * — a sibling file that doesn't exist yet is silently skipped rather than\n * treated as an error. No-op for `:memory:`.\n */\nexport function secureSqliteFilePermissions(dbPath: string): void {\n if (dbPath === ':memory:') return;\n for (const candidate of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {\n if (existsSync(candidate)) {\n chmodSync(candidate, SECURE_FILE_MODE);\n }\n }\n}\n","import {\n ByokCoreError,\n CoreConflictError,\n InMemoryQuotaStore,\n assertCanonicalTimestamp,\n createInMemoryCoreStores,\n isLegalObjectTransition,\n type Clock,\n type ContentHash,\n type CoreStores,\n type MailboxAppendInput,\n type MailboxCursorState,\n type MailboxMessage,\n type MailboxPage,\n type MailboxReadQuery,\n type MailboxRecordDeliveryInput,\n type MailboxAdvanceCursorInput,\n type MailboxRetentionInput,\n type MailboxRetentionResult,\n type MailboxStore,\n type ObjectCommitInput,\n type ObjectListQuery,\n type ObjectManifestEntry,\n type ObjectManifestInput,\n type ObjectReferenceInput,\n type ObjectStore,\n type StorageReservation,\n type TenantId,\n} from '@byok-sdk/core';\nimport {\n assertTaskAttemptListLimit,\n createInMemoryCloudStores,\n type AgentMessageAdmission,\n type AgentRef,\n type BlobContentProxy,\n type CloudBlobStore,\n type BlobObservation,\n type BlobReadResult,\n type BlobWriteResult,\n type CloudCrypto,\n type CloudStores,\n type TaskAttempt,\n type TaskAttemptListQuery,\n type TaskAttemptPage,\n type TaskAttemptStatus,\n type TaskAttemptStore,\n type TaskCancellationMutation,\n type TaskCancellationRequest,\n type TaskCancellationStore,\n} from '@byok-sdk/cloud';\nimport { byokBlobContentPath, type RuntimeCapabilities, type RuntimeId } from '@byok-sdk/protocol';\nimport type { DatabaseSync } from 'node:sqlite';\nimport {\n closeSqliteDatabaseAfterInitializationFailure,\n openSqliteDatabase,\n secureSqliteFilePermissions,\n} from '../../sqlite-support';\n\nconst DEFAULT_MAILBOX_READ_LIMIT = 50;\nconst DEFAULT_OBJECT_LIST_LIMIT = 100;\nconst DEFAULT_BLOB_URL_TTL_MS = 15 * 60_000;\nconst SIGNING_SECRET_BYTES = 32;\nconst SQLITE_SCHEMA_VERSION = '1';\n\nconst SCHEMA = `\nCREATE TABLE IF NOT EXISTS byok_sqlite_meta (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS mailbox_cursor (\n tenant_id TEXT NOT NULL,\n device_id TEXT NOT NULL,\n next_seq INTEGER NOT NULL DEFAULT 1,\n delivered_seq INTEGER NOT NULL DEFAULT 0,\n acked_seq INTEGER NOT NULL DEFAULT 0,\n updated_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, device_id)\n);\nCREATE TABLE IF NOT EXISTS mailbox_message (\n tenant_id TEXT NOT NULL,\n device_id TEXT NOT NULL,\n seq INTEGER NOT NULL,\n message_id TEXT NOT NULL,\n body TEXT NOT NULL,\n body_hash TEXT NOT NULL,\n byte_size TEXT NOT NULL,\n state TEXT NOT NULL CHECK (state IN ('pending', 'acked', 'expired')),\n appended_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, device_id, seq),\n UNIQUE (tenant_id, device_id, message_id)\n);\nCREATE TABLE IF NOT EXISTS task_attempt (\n tenant_id TEXT NOT NULL,\n task_id TEXT NOT NULL,\n device_id TEXT NOT NULL,\n agent_ref_json TEXT,\n owner_device_id TEXT,\n claimed_runtime TEXT,\n claimed_runtime_capabilities_json TEXT,\n status TEXT NOT NULL,\n terminal_cause TEXT,\n cancellation_requested_at TEXT,\n cancellation_reason TEXT,\n cancellation_message_id TEXT,\n updated_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, task_id)\n);\nCREATE TABLE IF NOT EXISTS agent_message_admission (\n tenant_id TEXT NOT NULL,\n task_id TEXT NOT NULL,\n message_id TEXT NOT NULL,\n payload_body TEXT NOT NULL,\n terminal_body TEXT,\n PRIMARY KEY (tenant_id, task_id)\n);\nCREATE TABLE IF NOT EXISTS object_manifest (\n tenant_id TEXT NOT NULL,\n hash TEXT NOT NULL,\n byte_size TEXT NOT NULL,\n content_type TEXT NOT NULL,\n state TEXT NOT NULL CHECK (state IN ('pending', 'committed', 'delete_pending', 'deleted')),\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL,\n delete_pending_at TEXT,\n PRIMARY KEY (tenant_id, hash)\n);\nCREATE TABLE IF NOT EXISTS object_reference (\n tenant_id TEXT NOT NULL,\n hash TEXT NOT NULL,\n ref_kind TEXT NOT NULL,\n ref_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, hash, ref_kind, ref_id),\n FOREIGN KEY (tenant_id, hash) REFERENCES object_manifest(tenant_id, hash) ON DELETE CASCADE\n);\nCREATE TABLE IF NOT EXISTS blob (\n blob_id TEXT PRIMARY KEY,\n tenant_id TEXT NOT NULL,\n reservation_id TEXT NOT NULL,\n content_hash TEXT NOT NULL,\n byte_size TEXT NOT NULL,\n content_type TEXT NOT NULL,\n uploaded INTEGER NOT NULL DEFAULT 0,\n data BLOB,\n UNIQUE (tenant_id, reservation_id)\n);\n`;\n\nexport interface SqliteEmbeddedStoreOptions {\n readonly path: string;\n readonly urlTtlMs?: number;\n}\n\nexport interface SqliteEmbeddedStores {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n readonly blobContentProxy: BlobContentProxy;\n close(): Promise<void>;\n}\n\n/** One serialized owner for the synchronous SQLite handle and every transaction on it. */\nclass SqliteCoordinator {\n readonly db: DatabaseSync;\n #tail: Promise<void> = Promise.resolve();\n #closing = false;\n #closePromise: Promise<void> | undefined;\n\n constructor(path: string) {\n this.db = openSqliteDatabase(path);\n try {\n const hasMetadata = this.db\n .prepare(\"SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'byok_sqlite_meta'\")\n .get() as { present: number } | undefined;\n if (hasMetadata !== undefined) {\n const schemaVersion = this.db\n .prepare(\"SELECT value FROM byok_sqlite_meta WHERE key = 'schema_version'\")\n .get() as { value: string } | undefined;\n if (schemaVersion?.value !== SQLITE_SCHEMA_VERSION) {\n throw new Error(\n `Unsupported BYOK SQLite schema version ${JSON.stringify(schemaVersion?.value)}; ` +\n `this build requires ${SQLITE_SCHEMA_VERSION}`,\n );\n }\n }\n this.db.exec(SCHEMA);\n if (hasMetadata === undefined) {\n this.db\n .prepare(\"INSERT INTO byok_sqlite_meta (key, value) VALUES ('schema_version', ?)\")\n .run(SQLITE_SCHEMA_VERSION);\n }\n secureSqliteFilePermissions(path);\n } catch (error) {\n closeSqliteDatabaseAfterInitializationFailure(\n this.db,\n error,\n 'SQLite embedded composition initialization failed and its native handle could not be closed',\n );\n }\n }\n\n run<T>(operation: (db: DatabaseSync) => T | Promise<T>): Promise<T> {\n if (this.#closing) return Promise.reject(new Error('SQLite embedded composition is closed'));\n const result = this.#tail.then(() => operation(this.db));\n this.#tail = result.then(() => undefined, () => undefined);\n return result;\n }\n\n transaction<T>(operation: (db: DatabaseSync) => T | Promise<T>): Promise<T> {\n return this.run(async (db) => {\n db.exec('BEGIN IMMEDIATE');\n try {\n const result = await operation(db);\n db.exec('COMMIT');\n return result;\n } catch (error) {\n try {\n db.exec('ROLLBACK');\n } catch {\n // The original failure remains authoritative.\n }\n throw error;\n }\n });\n }\n\n close(): Promise<void> {\n if (this.#closePromise !== undefined) return this.#closePromise;\n this.#closing = true;\n this.#closePromise = this.#tail.then(() => this.db.close());\n return this.#closePromise;\n }\n}\n\ninterface TaskRow extends Record<string, unknown> {\n tenant_id: string;\n task_id: string;\n device_id: string;\n agent_ref_json: string | null;\n owner_device_id: string | null;\n claimed_runtime: string | null;\n claimed_runtime_capabilities_json: string | null;\n status: string;\n terminal_cause: string | null;\n cancellation_requested_at: string | null;\n cancellation_reason: string | null;\n cancellation_message_id: string | null;\n updated_at: string;\n}\n\nfunction taskRow(row: TaskRow): TaskAttempt {\n return {\n tenantId: row.tenant_id as TenantId,\n taskId: row.task_id,\n deviceId: row.device_id,\n ...(row.agent_ref_json === null ? {} : { agentRef: JSON.parse(row.agent_ref_json) as AgentRef }),\n ...(row.owner_device_id === null ? {} : { ownerDeviceId: row.owner_device_id }),\n ...(row.claimed_runtime === null ? {} : { claimedRuntime: row.claimed_runtime as RuntimeId }),\n ...(row.claimed_runtime_capabilities_json === null\n ? {}\n : { claimedRuntimeCapabilities: JSON.parse(row.claimed_runtime_capabilities_json) as RuntimeCapabilities }),\n status: row.status as TaskAttemptStatus,\n ...(row.terminal_cause === null ? {} : { terminalCause: row.terminal_cause }),\n ...(row.cancellation_requested_at === null\n ? {}\n : {\n cancellation: {\n requestedAt: row.cancellation_requested_at,\n ...(row.cancellation_reason === null ? {} : { reason: row.cancellation_reason }),\n },\n }),\n updatedAt: row.updated_at,\n };\n}\n\nfunction readTask(db: DatabaseSync, tenant: TenantId, taskId: string): TaskAttempt | undefined {\n const row = db.prepare('SELECT * FROM task_attempt WHERE tenant_id = ? AND task_id = ?').get(tenant, taskId) as\n | TaskRow\n | undefined;\n return row === undefined ? undefined : taskRow(row);\n}\n\nfunction sameAgentRef(left: AgentRef | undefined, right: AgentRef | undefined): boolean {\n return left?.agentId === right?.agentId && left?.profileRevision === right?.profileRevision;\n}\n\nexport class SqliteTaskAttemptStore implements TaskAttemptStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n open(tenant: TenantId, input: { taskId: string; deviceId: string; agentRef?: AgentRef }): Promise<TaskAttempt> {\n return this.coordinator.run((db) => {\n db.prepare(\n `INSERT OR IGNORE INTO task_attempt\n (tenant_id, task_id, device_id, agent_ref_json, status, updated_at)\n VALUES (?, ?, ?, ?, 'offered', ?)`,\n ).run(tenant, input.taskId, input.deviceId, input.agentRef === undefined ? null : JSON.stringify(input.agentRef), this.#now());\n return readTask(db, tenant, input.taskId)!;\n });\n }\n\n reserveAgentOffer(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; agentRef: AgentRef },\n ): Promise<{ attempt: TaskAttempt; created: boolean }> {\n return this.coordinator.run((db) => {\n const result = db.prepare(\n `INSERT OR IGNORE INTO task_attempt\n (tenant_id, task_id, device_id, agent_ref_json, status, updated_at)\n VALUES (?, ?, ?, ?, 'offered', ?)`,\n ).run(tenant, input.taskId, input.deviceId, JSON.stringify(input.agentRef), this.#now());\n return { attempt: readTask(db, tenant, input.taskId)!, created: Number(result.changes) === 1 };\n });\n }\n\n reserveAgentMessage(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; messageId: string; payloadBody: string },\n ): Promise<'reserved' | 'pending' | 'rejected'> {\n return this.coordinator.run((db) => {\n const attempt = readTask(db, tenant, input.taskId);\n if (attempt === undefined || attempt.deviceId !== input.deviceId) return 'rejected';\n const existing = db.prepare(\n 'SELECT message_id, payload_body FROM agent_message_admission WHERE tenant_id = ? AND task_id = ?',\n ).get(tenant, input.taskId) as { message_id: string; payload_body: string } | undefined;\n if (existing !== undefined) {\n return existing.message_id === input.messageId && existing.payload_body === input.payloadBody\n ? 'pending'\n : 'rejected';\n }\n // The shared coordinator serializes cancellation and admission. An\n // existing exact message can reconcile its product outcome after the\n // task changes state; only a new reservation needs a live task.\n if (\n attempt.cancellation !== undefined ||\n !['offered', 'claimed', 'running'].includes(attempt.status)\n ) return 'rejected';\n db.prepare(\n `INSERT INTO agent_message_admission (tenant_id, task_id, message_id, payload_body)\n VALUES (?, ?, ?, ?)`,\n ).run(tenant, input.taskId, input.messageId, input.payloadBody);\n return 'reserved';\n });\n }\n\n readAgentMessage(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; messageId: string; payloadBody: string },\n ): Promise<AgentMessageAdmission | undefined> {\n return this.coordinator.run((db) => {\n const attempt = readTask(db, tenant, input.taskId);\n if (attempt?.deviceId !== input.deviceId) return undefined;\n const row = db.prepare(\n `SELECT message_id, payload_body, terminal_body FROM agent_message_admission\n WHERE tenant_id = ? AND task_id = ? AND message_id = ? AND payload_body = ?`,\n ).get(tenant, input.taskId, input.messageId, input.payloadBody) as\n | { message_id: string; payload_body: string; terminal_body: string | null }\n | undefined;\n return row === undefined\n ? undefined\n : {\n messageId: row.message_id,\n payloadBody: row.payload_body,\n ...(row.terminal_body === null ? {} : { terminalBody: row.terminal_body }),\n };\n });\n }\n\n finalizeAgentMessage(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; messageId: string; payloadBody: string; terminalBody: string },\n ): Promise<AgentMessageAdmission | undefined> {\n return this.coordinator.run((db) => {\n const attempt = readTask(db, tenant, input.taskId);\n if (attempt?.deviceId !== input.deviceId) return undefined;\n db.prepare(\n `UPDATE agent_message_admission SET terminal_body = ?\n WHERE tenant_id = ? AND task_id = ? AND message_id = ? AND payload_body = ? AND terminal_body IS NULL`,\n ).run(input.terminalBody, tenant, input.taskId, input.messageId, input.payloadBody);\n const row = db.prepare(\n `SELECT message_id, payload_body, terminal_body FROM agent_message_admission\n WHERE tenant_id = ? AND task_id = ? AND message_id = ? AND payload_body = ?`,\n ).get(tenant, input.taskId, input.messageId, input.payloadBody) as\n | { message_id: string; payload_body: string; terminal_body: string | null }\n | undefined;\n return row === undefined\n ? undefined\n : {\n messageId: row.message_id,\n payloadBody: row.payload_body,\n ...(row.terminal_body === null ? {} : { terminalBody: row.terminal_body }),\n };\n });\n }\n\n get(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined> {\n return this.coordinator.run((db) => readTask(db, tenant, taskId));\n }\n\n getMany(tenant: TenantId, taskIds: readonly string[]): Promise<readonly TaskAttempt[]> {\n return this.coordinator.run((db) => taskIds.flatMap((taskId) => {\n const attempt = readTask(db, tenant, taskId);\n return attempt === undefined ? [] : [attempt];\n }));\n }\n\n async list(tenant: TenantId, query: TaskAttemptListQuery): Promise<TaskAttemptPage> {\n assertTaskAttemptListLimit(query.limit);\n return this.coordinator.run((db) => {\n const rows = db.prepare(\n `SELECT * FROM task_attempt WHERE tenant_id = ? AND task_id > ?\n ORDER BY task_id COLLATE BINARY LIMIT ?`,\n ).all(tenant, query.cursor ?? '', query.limit + 1) as unknown as TaskRow[];\n const hasMore = rows.length > query.limit;\n const attempts = rows.slice(0, query.limit).map(taskRow);\n const last = attempts.at(-1);\n return { attempts, ...(hasMore && last !== undefined ? { nextCursor: last.taskId } : {}) };\n });\n }\n\n claim(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; runtime?: RuntimeId; capabilities?: RuntimeCapabilities },\n ): Promise<TaskAttempt | undefined> {\n return this.coordinator.run((db) => {\n db.prepare(\n `UPDATE task_attempt SET owner_device_id = ?, claimed_runtime = ?, claimed_runtime_capabilities_json = ?,\n status = 'claimed', updated_at = ?\n WHERE tenant_id = ? AND task_id = ? AND device_id = ? AND owner_device_id IS NULL\n AND cancellation_requested_at IS NULL AND status = 'offered'`,\n ).run(\n input.deviceId,\n input.runtime ?? null,\n input.capabilities === undefined ? null : JSON.stringify(input.capabilities),\n this.#now(),\n tenant,\n input.taskId,\n input.deviceId,\n );\n return readTask(db, tenant, input.taskId);\n });\n }\n\n recordStatus(\n tenant: TenantId,\n input: { taskId: string; status: TaskAttemptStatus; agentRef?: AgentRef; terminalCause?: string },\n ): Promise<TaskAttempt | undefined> {\n return this.coordinator.run((db) => {\n const existing = readTask(db, tenant, input.taskId);\n if (existing === undefined) return undefined;\n if (!sameAgentRef(existing.agentRef, input.agentRef)) return existing;\n if (existing.cancellation !== undefined) {\n if (input.status !== 'cancelled' || existing.status === 'cancelled') return existing;\n } else if (['complete', 'failed', 'cancelled'].includes(existing.status)) {\n return existing;\n }\n db.prepare(\n `UPDATE task_attempt SET status = ?, terminal_cause = ?, updated_at = ?\n WHERE tenant_id = ? AND task_id = ?`,\n ).run(input.status, input.terminalCause ?? null, this.#now(), tenant, input.taskId);\n return readTask(db, tenant, input.taskId);\n });\n }\n\n #now(): string {\n return this.clock.now().toISOString();\n }\n}\n\ninterface MailboxRow extends Record<string, unknown> {\n tenant_id: string;\n device_id: string;\n seq: number;\n message_id: string;\n body: string;\n body_hash: string;\n byte_size: string;\n state: 'pending' | 'acked' | 'expired';\n appended_at: string;\n}\n\nfunction mailboxMessage(row: MailboxRow): MailboxMessage {\n return {\n tenantId: row.tenant_id as TenantId,\n deviceId: row.device_id,\n seq: Number(row.seq),\n messageId: row.message_id,\n body: row.body,\n bodyHash: row.body_hash as ContentHash,\n byteSize: BigInt(row.byte_size),\n state: row.state,\n appendedAt: row.appended_at,\n };\n}\n\nfunction ensureMailboxCursor(db: DatabaseSync, clock: Clock, tenant: TenantId, deviceId: string): void {\n if (deviceId.length === 0) {\n throw new ByokCoreError('mailbox_message_not_found', 'Device id must not be empty.');\n }\n db.prepare(\n `INSERT OR IGNORE INTO mailbox_cursor (tenant_id, device_id, updated_at) VALUES (?, ?, ?)`,\n ).run(tenant, deviceId, clock.now().toISOString());\n}\n\nfunction readCursor(db: DatabaseSync, clock: Clock, tenant: TenantId, deviceId: string): MailboxCursorState {\n const row = db.prepare(\n `SELECT delivered_seq, acked_seq, updated_at FROM mailbox_cursor WHERE tenant_id = ? AND device_id = ?`,\n ).get(tenant, deviceId) as { delivered_seq: number; acked_seq: number; updated_at: string } | undefined;\n return row === undefined\n ? { tenantId: tenant, deviceId, deliveredSeq: 0, ackedSeq: 0, updatedAt: clock.now().toISOString() }\n : {\n tenantId: tenant,\n deviceId,\n deliveredSeq: Number(row.delivered_seq),\n ackedSeq: Number(row.acked_seq),\n updatedAt: row.updated_at,\n };\n}\n\nasync function appendMailbox(\n db: DatabaseSync,\n clock: Clock,\n tenant: TenantId,\n input: MailboxAppendInput,\n): Promise<MailboxMessage> {\n ensureMailboxCursor(db, clock, tenant, input.deviceId);\n const existing = db.prepare(\n `SELECT * FROM mailbox_message WHERE tenant_id = ? AND device_id = ? AND message_id = ?`,\n ).get(tenant, input.deviceId, input.messageId) as MailboxRow | undefined;\n if (existing !== undefined) return mailboxMessage(existing);\n const cursor = db.prepare(\n `SELECT next_seq FROM mailbox_cursor WHERE tenant_id = ? AND device_id = ?`,\n ).get(tenant, input.deviceId) as { next_seq: number };\n const seq = Number(cursor.next_seq);\n const materialized = await input.materialize(seq);\n db.prepare(\n `INSERT INTO mailbox_message\n (tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?)`,\n ).run(\n tenant,\n input.deviceId,\n seq,\n input.messageId,\n materialized.body,\n materialized.bodyHash,\n String(materialized.byteSize),\n clock.now().toISOString(),\n );\n db.prepare(\n `UPDATE mailbox_cursor SET next_seq = ? WHERE tenant_id = ? AND device_id = ?`,\n ).run(seq + 1, tenant, input.deviceId);\n return mailboxMessage(db.prepare(\n `SELECT * FROM mailbox_message WHERE tenant_id = ? AND device_id = ? AND seq = ?`,\n ).get(tenant, input.deviceId, seq) as MailboxRow);\n}\n\nexport class SqliteMailboxStore implements MailboxStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n append(tenant: TenantId, input: MailboxAppendInput): Promise<MailboxMessage> {\n return this.coordinator.transaction((db) => appendMailbox(db, this.clock, tenant, input));\n }\n\n readAfter(tenant: TenantId, query: MailboxReadQuery): Promise<MailboxPage> {\n return this.coordinator.run((db) => {\n const limit = query.limit ?? DEFAULT_MAILBOX_READ_LIMIT;\n const rows = db.prepare(\n `SELECT * FROM mailbox_message\n WHERE tenant_id = ? AND device_id = ? AND state = 'pending' AND seq > ?\n ORDER BY seq LIMIT ?`,\n ).all(tenant, query.deviceId, query.afterSeq, limit + 1) as unknown as MailboxRow[];\n const page = rows.slice(0, limit).map(mailboxMessage);\n const last = page.at(-1);\n const lost = db.prepare(\n `SELECT MAX(seq) AS lost FROM mailbox_message\n WHERE tenant_id = ? AND device_id = ? AND state = 'expired'`,\n ).get(tenant, query.deviceId) as { lost: number | null };\n return {\n messages: page,\n nextSeq: last?.seq ?? query.afterSeq,\n hasMore: rows.length > limit,\n recoverableFrom: Number(lost.lost ?? 0) + 1,\n };\n });\n }\n\n recordDelivery(tenant: TenantId, input: MailboxRecordDeliveryInput): Promise<MailboxCursorState> {\n return this.coordinator.run((db) => {\n ensureMailboxCursor(db, this.clock, tenant, input.deviceId);\n db.prepare(\n `UPDATE mailbox_cursor SET delivered_seq = MAX(delivered_seq, ?)\n WHERE tenant_id = ? AND device_id = ?`,\n ).run(input.deliveredSeq, tenant, input.deviceId);\n return readCursor(db, this.clock, tenant, input.deviceId);\n });\n }\n\n advanceCursor(tenant: TenantId, input: MailboxAdvanceCursorInput): Promise<MailboxCursorState> {\n return this.coordinator.transaction((db) => {\n ensureMailboxCursor(db, this.clock, tenant, input.deviceId);\n const current = readCursor(db, this.clock, tenant, input.deviceId);\n const observedAt = this.clock.now().toISOString();\n if (input.ackedSeq < current.ackedSeq) {\n throw new CoreConflictError(\n 'mailbox_cursor_regression',\n `Cursor for device ${input.deviceId} is at ${current.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,\n current,\n observedAt,\n );\n }\n if (input.ackedSeq > current.deliveredSeq) {\n throw new CoreConflictError(\n 'mailbox_cursor_ahead_of_delivery',\n `Cursor for device ${input.deviceId} was delivered through ${current.deliveredSeq}; refusing to acknowledge future cursor ${input.ackedSeq}.`,\n current,\n observedAt,\n );\n }\n db.prepare(\n `UPDATE mailbox_cursor SET acked_seq = ?, updated_at = ? WHERE tenant_id = ? AND device_id = ?`,\n ).run(input.ackedSeq, observedAt, tenant, input.deviceId);\n db.prepare(\n `UPDATE mailbox_message SET state = 'acked'\n WHERE tenant_id = ? AND device_id = ? AND state = 'pending' AND seq <= ?`,\n ).run(tenant, input.deviceId, input.ackedSeq);\n return readCursor(db, this.clock, tenant, input.deviceId);\n });\n }\n\n readCursor(tenant: TenantId, deviceId: string): Promise<MailboxCursorState> {\n return this.coordinator.run((db) => readCursor(db, this.clock, tenant, deviceId));\n }\n\n async collectRetired(tenant: TenantId, input: MailboxRetentionInput): Promise<MailboxRetentionResult> {\n assertCanonicalTimestamp(input.ackedBefore, 'ackedBefore');\n assertCanonicalTimestamp(input.expireUnackedBefore, 'expireUnackedBefore');\n return this.coordinator.transaction((db) => {\n const deviceClause = input.deviceId === undefined ? '' : ' AND device_id = ?';\n const params = input.deviceId === undefined ? [tenant] : [tenant, input.deviceId];\n const acked = db.prepare(\n `SELECT byte_size FROM mailbox_message\n WHERE tenant_id = ?${deviceClause} AND state = 'acked' AND appended_at < ?`,\n ).all(...params, input.ackedBefore) as unknown as Array<{ byte_size: string }>;\n const deleted = db.prepare(\n `DELETE FROM mailbox_message\n WHERE tenant_id = ?${deviceClause} AND state = 'acked' AND appended_at < ?`,\n ).run(...params, input.ackedBefore);\n const expired = db.prepare(\n `UPDATE mailbox_message SET state = 'expired'\n WHERE tenant_id = ?${deviceClause} AND state = 'pending' AND appended_at < ?`,\n ).run(...params, input.expireUnackedBefore);\n return {\n deletedCount: Number(deleted.changes),\n expiredCount: Number(expired.changes),\n releasedBytes: acked.reduce((sum, row) => sum + BigInt(row.byte_size), 0n),\n };\n });\n }\n}\n\nexport class SqliteTaskCancellationStore implements TaskCancellationStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n request(tenant: TenantId, input: TaskCancellationRequest): Promise<TaskCancellationMutation | undefined> {\n return this.coordinator.transaction(async (db) => {\n const existing = readTask(db, tenant, input.taskId);\n if (existing === undefined) return undefined;\n if (\n existing.cancellation === undefined &&\n ['complete', 'failed', 'cancelled'].includes(existing.status)\n ) return { attempt: existing };\n\n const existingMessageId = (db.prepare(\n `SELECT cancellation_message_id FROM task_attempt WHERE tenant_id = ? AND task_id = ?`,\n ).get(tenant, input.taskId) as { cancellation_message_id: string | null }).cancellation_message_id;\n if (existingMessageId !== null) {\n const row = db.prepare(\n `SELECT * FROM mailbox_message WHERE tenant_id = ? AND device_id = ? AND message_id = ?`,\n ).get(tenant, existing.deviceId, existingMessageId) as MailboxRow | undefined;\n if (row === undefined) {\n if (existing.status === 'cancelled') return { attempt: existing };\n throw new Error(`Cancellation delivery ${existingMessageId} is missing for task ${input.taskId}`);\n }\n return { attempt: existing, message: mailboxMessage(row) };\n }\n\n const message = await appendMailbox(db, this.clock, tenant, {\n deviceId: existing.deviceId,\n messageId: input.proposedMessageId,\n materialize: (seq) => input.materialize(seq, input.proposedMessageId),\n });\n const requestedAt = this.clock.now().toISOString();\n db.prepare(\n `UPDATE task_attempt SET\n status = CASE WHEN owner_device_id IS NULL THEN 'cancelled' ELSE 'cancel_requested' END,\n cancellation_requested_at = ?, cancellation_reason = ?, cancellation_message_id = ?, updated_at = ?\n WHERE tenant_id = ? AND task_id = ?`,\n ).run(requestedAt, input.reason ?? null, input.proposedMessageId, requestedAt, tenant, input.taskId);\n return { attempt: readTask(db, tenant, input.taskId)!, message };\n });\n }\n}\n\ninterface ManifestRow extends Record<string, unknown> {\n tenant_id: string;\n hash: string;\n byte_size: string;\n content_type: string;\n state: ObjectManifestEntry['state'];\n created_at: string;\n updated_at: string;\n delete_pending_at: string | null;\n ref_count: number;\n}\n\nfunction manifestRow(row: ManifestRow): ObjectManifestEntry {\n return {\n tenantId: row.tenant_id as TenantId,\n hash: row.hash as ContentHash,\n byteSize: BigInt(row.byte_size),\n contentType: row.content_type,\n state: row.state,\n refCount: Number(row.ref_count),\n createdAt: row.created_at,\n updatedAt: row.updated_at,\n ...(row.delete_pending_at === null ? {} : { deletePendingAt: row.delete_pending_at }),\n };\n}\n\nconst MANIFEST_SELECT = `\nSELECT m.*, COUNT(r.ref_id) AS ref_count\nFROM object_manifest m\nLEFT JOIN object_reference r ON r.tenant_id = m.tenant_id AND r.hash = m.hash`;\n\nfunction readManifest(db: DatabaseSync, tenant: TenantId, hash: ContentHash): ObjectManifestEntry | undefined {\n const row = db.prepare(\n `${MANIFEST_SELECT} WHERE m.tenant_id = ? AND m.hash = ? GROUP BY m.tenant_id, m.hash`,\n ).get(tenant, hash) as ManifestRow | undefined;\n return row === undefined ? undefined : manifestRow(row);\n}\n\nfunction requireManifest(db: DatabaseSync, tenant: TenantId, hash: ContentHash): ObjectManifestEntry {\n const entry = readManifest(db, tenant, hash);\n if (entry === undefined) {\n throw new ByokCoreError('object_not_found', `Object ${hash} has no manifest row in this tenant.`);\n }\n return entry;\n}\n\nfunction putManifest(db: DatabaseSync, clock: Clock, tenant: TenantId, input: ObjectManifestInput): ObjectManifestEntry {\n const existing = readManifest(db, tenant, input.hash);\n if (existing !== undefined && existing.state !== 'deleted') return existing;\n const now = clock.now().toISOString();\n db.prepare('DELETE FROM object_reference WHERE tenant_id = ? AND hash = ?').run(tenant, input.hash);\n db.prepare(\n `INSERT INTO object_manifest\n (tenant_id, hash, byte_size, content_type, state, created_at, updated_at, delete_pending_at)\n VALUES (?, ?, ?, ?, 'pending', ?, ?, NULL)\n ON CONFLICT (tenant_id, hash) DO UPDATE SET\n byte_size = excluded.byte_size, content_type = excluded.content_type, state = 'pending',\n created_at = excluded.created_at, updated_at = excluded.updated_at, delete_pending_at = NULL`,\n ).run(tenant, input.hash, String(input.byteSize), input.contentType, now, now);\n return readManifest(db, tenant, input.hash)!;\n}\n\nexport class SqliteObjectStore implements ObjectStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n putManifest(tenant: TenantId, input: ObjectManifestInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => putManifest(db, this.clock, tenant, input));\n }\n\n commit(tenant: TenantId, input: ObjectCommitInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n const current = requireManifest(db, tenant, input.hash);\n if (current.byteSize !== input.observedByteSize || current.contentType !== input.observedContentType) {\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n `Observed object ${input.hash} does not match the declared manifest.`,\n );\n }\n if (current.state === 'committed') return current;\n return this.#transition(db, tenant, current, 'committed');\n });\n }\n\n get(tenant: TenantId, hash: ContentHash): Promise<ObjectManifestEntry | undefined> {\n return this.coordinator.run((db) => readManifest(db, tenant, hash));\n }\n\n async list(tenant: TenantId, query: ObjectListQuery): Promise<readonly ObjectManifestEntry[]> {\n if (query.deletePendingBefore !== undefined) {\n assertCanonicalTimestamp(query.deletePendingBefore, 'deletePendingBefore');\n }\n return this.coordinator.run((db) => {\n const rows = db.prepare(\n `${MANIFEST_SELECT}\n WHERE m.tenant_id = ? AND (? IS NULL OR m.state = ?)\n AND (? IS NULL OR (m.delete_pending_at IS NOT NULL AND m.delete_pending_at < ?))\n GROUP BY m.tenant_id, m.hash ORDER BY m.hash COLLATE BINARY LIMIT ?`,\n ).all(\n tenant,\n query.state ?? null,\n query.state ?? null,\n query.deletePendingBefore ?? null,\n query.deletePendingBefore ?? null,\n query.limit ?? DEFAULT_OBJECT_LIST_LIMIT,\n ) as unknown as ManifestRow[];\n return rows.map(manifestRow);\n });\n }\n\n addReference(tenant: TenantId, input: ObjectReferenceInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n const current = requireManifest(db, tenant, input.hash);\n if (current.state !== 'committed') {\n throw new ByokCoreError('object_state_invalid', `Only committed objects can be referenced; ${input.hash} is ${current.state}.`);\n }\n db.prepare(\n `INSERT OR IGNORE INTO object_reference (tenant_id, hash, ref_kind, ref_id, created_at)\n VALUES (?, ?, ?, ?, ?)`,\n ).run(tenant, input.hash, input.refKind, input.refId, this.clock.now().toISOString());\n db.prepare('UPDATE object_manifest SET updated_at = ? WHERE tenant_id = ? AND hash = ?')\n .run(this.clock.now().toISOString(), tenant, input.hash);\n return requireManifest(db, tenant, input.hash);\n });\n }\n\n removeReference(tenant: TenantId, input: ObjectReferenceInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n requireManifest(db, tenant, input.hash);\n db.prepare(\n `DELETE FROM object_reference WHERE tenant_id = ? AND hash = ? AND ref_kind = ? AND ref_id = ?`,\n ).run(tenant, input.hash, input.refKind, input.refId);\n db.prepare('UPDATE object_manifest SET updated_at = ? WHERE tenant_id = ? AND hash = ?')\n .run(this.clock.now().toISOString(), tenant, input.hash);\n return requireManifest(db, tenant, input.hash);\n });\n }\n\n markDeletePending(tenant: TenantId, hash: ContentHash): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n const current = requireManifest(db, tenant, hash);\n if (current.refCount !== 0) {\n throw new ByokCoreError('object_state_invalid', `Object ${hash} still has ${current.refCount} reference(s).`);\n }\n return this.#transition(db, tenant, current, 'delete_pending');\n });\n }\n\n markDeleted(tenant: TenantId, hash: ContentHash): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => this.#transition(db, tenant, requireManifest(db, tenant, hash), 'deleted'));\n }\n\n #transition(\n db: DatabaseSync,\n tenant: TenantId,\n current: ObjectManifestEntry,\n next: ObjectManifestEntry['state'],\n ): ObjectManifestEntry {\n if (!isLegalObjectTransition(current.state, next)) {\n throw new ByokCoreError('object_state_invalid', `${current.state} to ${next} is not a legal object manifest transition.`);\n }\n const now = this.clock.now().toISOString();\n db.prepare(\n `UPDATE object_manifest SET state = ?, updated_at = ?, delete_pending_at = ?\n WHERE tenant_id = ? AND hash = ?`,\n ).run(next, now, next === 'delete_pending' ? now : current.deletePendingAt ?? null, tenant, current.hash);\n return requireManifest(db, tenant, current.hash);\n }\n}\n\ninterface BlobRow extends Record<string, unknown> {\n blob_id: string;\n tenant_id: string;\n reservation_id: string;\n content_hash: string;\n byte_size: string;\n content_type: string;\n uploaded: number;\n data: Uint8Array | null;\n}\n\nfunction assertReservedObject(tenant: TenantId, reservation: StorageReservation): void {\n if (\n reservation.tenantId === tenant &&\n reservation.kind === 'object' &&\n reservation.state === 'reserved' &&\n reservation.expectedBytes >= 0n\n ) return;\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n 'An upload grant requires a reserved object reservation owned by this tenant.',\n );\n}\n\nclass SqliteBlobRegistry {\n readonly secret: Uint8Array;\n readonly urlTtlMs: number;\n\n constructor(\n readonly coordinator: SqliteCoordinator,\n readonly clock: Clock,\n readonly crypto: CloudCrypto,\n urlTtlMs: number,\n ) {\n this.urlTtlMs = urlTtlMs;\n const row = coordinator.db.prepare(\"SELECT value FROM byok_sqlite_meta WHERE key = 'blob_signing_secret'\").get() as\n | { value: string }\n | undefined;\n if (row === undefined) {\n const bytes = globalThis.crypto.getRandomValues(new Uint8Array(SIGNING_SECRET_BYTES));\n coordinator.db.prepare(\n \"INSERT OR IGNORE INTO byok_sqlite_meta (key, value) VALUES ('blob_signing_secret', ?)\",\n ).run(Buffer.from(bytes).toString('base64url'));\n }\n const stored = coordinator.db.prepare(\"SELECT value FROM byok_sqlite_meta WHERE key = 'blob_signing_secret'\").get() as { value: string };\n this.secret = Buffer.from(stored.value, 'base64url');\n }\n\n async signUrl(blobId: string, action: 'put' | 'get'): Promise<string> {\n const exp = this.clock.now().getTime() + this.urlTtlMs;\n const sig = await this.crypto.hmacSha256(this.secret, `${blobId}:${action}:${exp}`);\n return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;\n }\n}\n\nexport class SqliteCloudBlobStore implements CloudBlobStore {\n constructor(private readonly registry: SqliteBlobRegistry) {}\n\n async createUpload(tenant: TenantId, reservation: StorageReservation): Promise<{ blobId: string; uploadUrl: string }> {\n assertReservedObject(tenant, reservation);\n const blobId = await this.registry.coordinator.transaction((db) => {\n const existing = db.prepare(\n 'SELECT * FROM blob WHERE tenant_id = ? AND reservation_id = ?',\n ).get(tenant, reservation.reservationId) as BlobRow | undefined;\n if (existing !== undefined) {\n const manifest = readManifest(db, tenant, reservation.contentHash);\n if (manifest?.state === 'committed') {\n throw new ByokCoreError('object_state_invalid', `Object ${reservation.contentHash} is already committed and immutable.`);\n }\n return existing.blob_id;\n }\n const entry = putManifest(db, this.registry.clock, tenant, {\n hash: reservation.contentHash,\n byteSize: reservation.expectedBytes,\n contentType: reservation.contentType,\n });\n if (entry.byteSize !== reservation.expectedBytes || entry.contentType !== reservation.contentType) {\n throw new ByokCoreError('storage_integrity_mismatch', `Object ${reservation.contentHash} already binds a different storage declaration.`);\n }\n if (entry.state === 'committed') {\n throw new ByokCoreError('object_state_invalid', `Object ${reservation.contentHash} is already committed and immutable.`);\n }\n const created = `blob_${this.registry.crypto.randomUuid()}`;\n db.prepare(\n `INSERT INTO blob\n (blob_id, tenant_id, reservation_id, content_hash, byte_size, content_type)\n VALUES (?, ?, ?, ?, ?, ?)`,\n ).run(created, tenant, reservation.reservationId, reservation.contentHash, String(reservation.expectedBytes), reservation.contentType);\n return created;\n });\n return { blobId, uploadUrl: await this.registry.signUrl(blobId, 'put') };\n }\n\n observeUpload(tenant: TenantId, blobId: string, reservation: StorageReservation): Promise<BlobObservation | undefined> {\n return this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (\n row === undefined || row.tenant_id !== tenant || reservation.tenantId !== tenant ||\n row.reservation_id !== reservation.reservationId || row.content_hash !== reservation.contentHash || !row.uploaded\n ) return undefined;\n return { observedByteSize: BigInt(row.data?.byteLength ?? 0), observedContentType: row.content_type };\n });\n }\n\n async getDownloadUrl(tenant: TenantId, blobId: string): Promise<string | undefined> {\n const found = await this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (row === undefined || row.tenant_id !== tenant || !row.uploaded) return false;\n return readManifest(db, tenant, row.content_hash as ContentHash)?.state === 'committed';\n });\n return found ? this.registry.signUrl(blobId, 'get') : undefined;\n }\n}\n\nexport class SqliteBlobContentProxy implements BlobContentProxy {\n constructor(private readonly registry: SqliteBlobRegistry) {}\n\n async verifySignedUrl(blobId: string, action: 'put' | 'get', sig: string, exp: number): Promise<boolean> {\n if (!Number.isFinite(exp) || this.registry.clock.now().getTime() > exp) return false;\n const expected = await this.registry.crypto.hmacSha256(this.registry.secret, `${blobId}:${action}:${exp}`);\n return this.registry.crypto.timingSafeEqual(expected, sig);\n }\n\n expectedUploadBytes(blobId: string): Promise<bigint | undefined> {\n return this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT byte_size FROM blob WHERE blob_id = ?').get(blobId) as { byte_size: string } | undefined;\n return row === undefined ? undefined : BigInt(row.byte_size);\n });\n }\n\n writeContent(blobId: string, data: Uint8Array): Promise<BlobWriteResult> {\n return this.registry.coordinator.run(async (db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (row === undefined) return { ok: false, reason: 'unknown blobId' };\n if (BigInt(data.length) !== BigInt(row.byte_size)) {\n return { ok: false, reason: `size mismatch: declared ${row.byte_size}, received ${data.length}` };\n }\n if (await this.registry.crypto.sha256(data) !== row.content_hash) {\n return { ok: false, reason: 'contentHash mismatch' };\n }\n db.prepare('UPDATE blob SET data = ?, uploaded = 1 WHERE blob_id = ?').run(data, blobId);\n return { ok: true };\n });\n }\n\n readContent(blobId: string): Promise<BlobReadResult | undefined> {\n return this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (row === undefined || !row.uploaded || row.data === null) return undefined;\n const data = new Uint8Array(row.data.buffer, row.data.byteOffset, row.data.byteLength);\n return { ok: true, content: { data, contentType: row.content_type } };\n });\n }\n}\n\n/** Mixed embedded composition: exactly six durable interfaces, every other port unchanged in-memory. */\nexport function createSqliteEmbeddedStores(\n options: SqliteEmbeddedStoreOptions,\n dependencies: { readonly clock: Clock; readonly crypto: CloudCrypto },\n): SqliteEmbeddedStores {\n const coordinator = new SqliteCoordinator(options.path);\n const objects = new SqliteObjectStore(coordinator, dependencies.clock);\n const mailbox = new SqliteMailboxStore(coordinator, dependencies.clock);\n const tasks = new SqliteTaskAttemptStore(coordinator, dependencies.clock);\n const cancellations = new SqliteTaskCancellationStore(coordinator, dependencies.clock);\n const registry = new SqliteBlobRegistry(\n coordinator,\n dependencies.clock,\n dependencies.crypto,\n options.urlTtlMs ?? DEFAULT_BLOB_URL_TTL_MS,\n );\n const blobs = new SqliteCloudBlobStore(registry);\n const blobContentProxy = new SqliteBlobContentProxy(registry);\n\n const inMemoryCore = createInMemoryCoreStores({ clock: dependencies.clock }).stores;\n const core: CoreStores = {\n ...inMemoryCore,\n mailbox,\n objects,\n quota: new InMemoryQuotaStore(dependencies.clock, objects),\n };\n const inMemoryCloud = createInMemoryCloudStores(\n dependencies.clock,\n dependencies.crypto,\n objects,\n mailbox,\n );\n const cloud: CloudStores = {\n ...inMemoryCloud.stores,\n tasks,\n cancellations,\n blobs,\n };\n return { core, cloud, blobContentProxy, close: () => coordinator.close() };\n}\n","import {\n createInMemoryCoreStores,\n tenantId,\n type Clock,\n type CoreStores,\n type MailboxStore,\n type TenantId,\n} from '@byok-sdk/core';\nimport {\n createInMemoryCloudStores,\n createWebCrypto,\n type BlobContentProxy,\n type CloudCrypto,\n type CloudStores,\n type InboundDedupStore,\n} from '@byok-sdk/cloud';\nimport { RateLimiter, createCountingInboundRateLimiter, type RateLimiterOptions } from './rate-limiter';\nimport type { DeviceConnections } from './connections';\nimport { createSqliteEmbeddedStores } from './stores/sqlite';\nimport type { ByokServerStorage } from './types';\n\n/**\n * The store composition this façade hands the cloud kernel.\n *\n * Same parts as `@byok-sdk/cloud`'s own in-memory composition, with three\n * decorators layered on ports the kernel already calls, and nothing else:\n *\n * - `rateLimiter` becomes this package's token bucket, which is also where\n * `envelopesIn` and `rateLimitEvents` are counted (the kernel debits it at\n * gate step 0, for every envelope, before any other decision — the exact\n * choke point `ConnectionHub.handleInbound` used to be);\n * - `dedup` counts the already-seen answers that back `dedupDrops`;\n * - `mailbox` reports each device-scoped read, which is how a device that only\n * ever long-polls still counts as present.\n *\n * Decorators rather than kernel changes, deliberately: each counter is a fact\n * about a call this composition already makes, so it is observable from the\n * outside, and the kernel keeps no observability surface it would then have to\n * keep honest for every other deployment.\n */\n\n/** Per-product blob size ceiling (§7): 100MB unless overridden. */\nexport const DEFAULT_MAX_BLOB_SIZE_BYTES = 100 * 1024 * 1024;\n\n/**\n * Real time, deliberately — the same choice `@byok-sdk/cloud`'s in-memory\n * composition makes and for the same reason: a daemon compares the `expiresAt`\n * it is handed against its own wall clock, so a frozen clock would make every\n * minted token look expired.\n */\nfunction systemClock(): Clock {\n return { now: () => new Date() };\n}\n\n/**\n * The one tenant an embedded server serves.\n *\n * An embedded `createByokServer` is a single product's coordinator, not a\n * multi-tenant control plane: there is no surface on it that could name a\n * second tenant and no request that could carry one. Deriving the id from\n * `productId` keeps that visible — one product, one tenant, and a device paired\n * into this instance can only ever land in it.\n */\nexport function serverTenantId(productId: string): TenantId {\n return tenantId(`product:${productId}`);\n}\n\n/** Live counter reads; every field is derived from a call the kernel already makes. */\nexport interface FacadeCounters {\n /** Every envelope the kernel's inbound gate was handed, whatever it decided. */\n readonly envelopesIn: number;\n /** Inbound envelopes recognized as an already-seen `(device, envelope id)` pair. */\n readonly dedupDrops: number;\n /** Inbound envelopes the bucket refused — one per envelope, never coalesced. */\n readonly rateLimitEvents: number;\n}\n\nexport interface FacadeStoreComposition {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n readonly blobContentProxy: BlobContentProxy;\n readonly clock: Clock;\n readonly crypto: CloudCrypto;\n readonly counters: FacadeCounters;\n close(): Promise<void>;\n}\n\nexport interface FacadeStoreOptions {\n readonly tenant: TenantId;\n readonly maxBlobSizeBytes: number;\n readonly storage?: ByokServerStorage;\n readonly rateLimit?: RateLimiterOptions;\n /** Where a device's own liveness observations are recorded. */\n readonly connections: DeviceConnections;\n /** Fired once per rate-limit EPISODE, not per refused envelope. */\n readonly onRateLimited: (deviceId: string, at: string) => void;\n}\n\nexport function composeFacadeStores(options: FacadeStoreOptions): FacadeStoreComposition {\n const clock = systemClock();\n const crypto = createWebCrypto();\n const sqlite =\n options.storage?.kind === 'sqlite'\n ? createSqliteEmbeddedStores(\n {\n path: options.storage.path,\n ...(options.storage.urlTtlMs === undefined ? {} : { urlTtlMs: options.storage.urlTtlMs }),\n },\n { clock, crypto },\n )\n : undefined;\n const inMemoryCore = sqlite === undefined ? createInMemoryCoreStores({ clock }).stores : undefined;\n const core = sqlite?.core ?? inMemoryCore!;\n const inMemoryCloud =\n sqlite === undefined ? createInMemoryCloudStores(clock, crypto, core.objects, core.mailbox) : undefined;\n const stores = sqlite?.cloud ?? inMemoryCloud!.stores;\n const blobContentProxy = sqlite?.blobContentProxy ?? inMemoryCloud!.blobContentProxy;\n\n const rateLimiter = createCountingInboundRateLimiter(\n new RateLimiter(options.rateLimit),\n options.onRateLimited,\n );\n const dedup = countingDedup(stores.dedup);\n\n const counters: FacadeCounters = {\n get envelopesIn(): number {\n return rateLimiter.counters.envelopesIn;\n },\n get dedupDrops(): number {\n return dedup.drops();\n },\n get rateLimitEvents(): number {\n return rateLimiter.counters.rateLimitEvents;\n },\n };\n\n // Blob uploads reserve against the tenant's storage entitlement (`quota`), so\n // a composition that never writes one has working coordination and 4xx blob\n // routes. The embedded server has exactly one tenant and one configured\n // ceiling, so the entitlement is that ceiling — there is no second party here\n // to negotiate one.\n void core.quota.writeEntitlement(options.tenant, {\n version: 1n,\n hardLimitBytes: BigInt(options.maxBlobSizeBytes) * 1024n,\n maxObjectBytes: BigInt(options.maxBlobSizeBytes),\n maxInlineBytes: BigInt(options.maxBlobSizeBytes),\n mailboxLimitBytes: BigInt(options.maxBlobSizeBytes) * 1024n,\n retentionPolicyId: 'byok-server-embedded',\n });\n\n return {\n core: { ...core, mailbox: observingMailbox(core.mailbox, options.connections) },\n cloud: { ...stores, rateLimiter: rateLimiter.limiter, dedup },\n blobContentProxy,\n clock,\n crypto,\n counters,\n close: () => sqlite?.close() ?? Promise.resolve(),\n };\n}\n\ninterface CountingDedupStore extends InboundDedupStore {\n drops(): number;\n}\n\n/**\n * Count the dedup hits the kernel resolves. A hit is a wire-level SUCCESS\n * (§8.2) that re-ran nothing, so it is invisible in the response and this\n * counter is the only place an embedder can see it happening at all.\n */\nfunction countingDedup(inner: InboundDedupStore): CountingDedupStore {\n let drops = 0;\n return {\n async checkAndRecord(tenant, deviceId, envelopeId): Promise<boolean> {\n const seen = await inner.checkAndRecord(tenant, deviceId, envelopeId);\n if (seen) drops += 1;\n return seen;\n },\n async checkAndRecordAgent(tenant, deviceId, agentRef, envelopeId): Promise<boolean> {\n const seen = await inner.checkAndRecordAgent(tenant, deviceId, agentRef, envelopeId);\n if (seen) drops += 1;\n return seen;\n },\n drops: () => drops,\n };\n}\n\n/**\n * Mark a device present when it reads its mailbox.\n *\n * `GET /byok/events` is the long-poll transport's whole receive half, and a\n * device sitting on it is as connected as a device gets now — a poll is the\n * only sign of life a daemon with nothing to say ever produces. `readCursor` is\n * the one call every poll makes exactly once, before any hold, which makes it\n * the honest place to observe it.\n */\nfunction observingMailbox(inner: MailboxStore, connections: DeviceConnections): MailboxStore {\n return {\n append: (tenant, input) => inner.append(tenant, input),\n readAfter: (tenant, query) => inner.readAfter(tenant, query),\n recordDelivery: (tenant, input) => inner.recordDelivery(tenant, input),\n advanceCursor: (tenant, input) => inner.advanceCursor(tenant, input),\n readCursor: (tenant, deviceId) => {\n connections.touch(deviceId, new Date().toISOString());\n return inner.readCursor(tenant, deviceId);\n },\n collectRetired: (tenant, input) => inner.collectRetired(tenant, input),\n };\n}\n","import {\n SteerRejectedError as KernelSteerRejectedError,\n type ByokCloud,\n type SteerRejectionCode,\n type TenantId,\n} from '@byok-sdk/cloud';\nimport type { RuntimeId, TaskState } from '@byok-sdk/protocol';\nimport type { TaskEventRelay } from './relay';\nimport type { ServerTaskEvent, TaskHandle, TaskResult } from './types';\n\nfunction steerRejectionMessage(\n taskId: string,\n code: SteerRejectionCode,\n state: TaskState,\n runtime: RuntimeId | undefined,\n): string {\n switch (code) {\n case 'task_terminal':\n return `cannot steer task ${taskId}: task is already terminal (state ${state})`;\n case 'task_not_running':\n return `cannot steer task ${taskId}: not running (state ${state})`;\n case 'steer_unsupported_runtime':\n return `cannot steer task ${taskId}: claimed runtime ${runtime ?? '(unknown)'} does not support steering`;\n }\n}\n\n/**\n * Thrown by {@link TaskHandle.steer} when the kernel refuses the steer.\n *\n * This package keeps its OWN class rather than re-exporting the kernel's, and\n * that is deliberate rather than a leftover. The two carry the same `taskId`,\n * `code` and `runtime`, and differ in exactly one field: the kernel reports\n * `status: TaskAttemptStatus` — its coarse, execution-free attempt disposition\n * (`running`, `offered`, …) — while this surface reports `state: TaskState`,\n * the WIRE vocabulary every other member of this package speaks\n * (`TaskSnapshot.state`, `ServerTaskEvent`, `HubStats.taskCountsByState`).\n * `AwaitApproval` is the reason they cannot be the same field: it is derived\n * from the durable approval timeline and has no attempt status at all\n * (ADR-028), so a `TaskAttemptStatus -> TaskState` mapping inside the kernel\n * would have to report `Running` for a task this façade calls `AwaitApproval`.\n *\n * So the state here is not translated from the kernel's field — it is READ,\n * through the very projection `byok.tasks.get(taskId)` answers with, at the\n * moment of the refusal. One authority, two readers, no second mapping.\n *\n * Deviation from design packet §1.2, which had this class move to\n * `@byok-sdk/cloud` with the server re-exporting it: the wire `TaskState`\n * vocabulary is host-facing and lives here, so the class that carries it does\n * too. `SteerRejectionCode` and `StaleApprovalError` are unaffected and stay\n * kernel re-exports.\n */\nexport class SteerRejectedError extends Error {\n readonly taskId: string;\n readonly code: SteerRejectionCode;\n /** The task's state at the moment the steer was refused. */\n readonly state: TaskState;\n /** `TaskSnapshot.claimedRuntime` — `undefined` when nothing was ever recorded, which is itself a reason `steer_unsupported_runtime` can fire. */\n readonly runtime: RuntimeId | undefined;\n\n constructor(\n taskId: string,\n code: SteerRejectionCode,\n state: TaskState,\n runtime: RuntimeId | undefined,\n ) {\n super(steerRejectionMessage(taskId, code, state, runtime));\n this.name = 'SteerRejectedError';\n this.taskId = taskId;\n this.code = code;\n this.state = state;\n this.runtime = runtime;\n }\n}\n\n/** The three states this surface calls terminal — the same set {@link TaskResult} is defined over. */\nconst TERMINAL_STATES: ReadonlySet<TaskState> = new Set<TaskState>(['Complete', 'Failed', 'Cancelled']);\n\n/**\n * The refusal code for a state THIS surface has already decided.\n *\n * Not a translation of the kernel's `status` — that field is never read here.\n * The kernel's own precedence is \"terminal first, so a terminal attempt reports\n * the more specific truth\" (`steer-control.ts`), and it applies that rule to its\n * attempt status; this applies the identical rule to the one `TaskState` the\n * façade answers `tasks.get()` with, which is the same value already being put\n * on the error. Without it the two halves of one error contradict each other:\n * an accepted host cancellation is terminal here immediately (`snapshot.ts`\n * gate 1) while the kernel still calls the attempt `cancel_requested` and\n * therefore live, producing `code: 'task_not_running'` on an error whose own\n * `state` says `Cancelled`.\n */\nfunction refusalCode(kernelCode: SteerRejectionCode, state: TaskState): SteerRejectionCode {\n return TERMINAL_STATES.has(state) ? 'task_terminal' : kernelCode;\n}\n\nexport interface TaskHandleDeps {\n readonly tenant: TenantId;\n readonly cloud: ByokCloud;\n readonly relay: TaskEventRelay;\n /**\n * The task's current `TaskSnapshot.state`, or `undefined` when the attempt is\n * gone. The snapshot projection itself — never a second derivation.\n */\n readonly readState: (taskId: string) => Promise<TaskState | undefined>;\n /** The read-back this handle's `result()` answers with. */\n readonly readResult: (taskId: string) => Promise<TaskResult | undefined>;\n}\n\n/**\n * One in-flight task's control surface.\n *\n * The §3 invariant it exists to keep: **the handle is not a second authority.**\n * Every mutation is a kernel call, and `result()` is a READ-BACK — it waits for\n * the relay's terminal barrier and then asks the store what the terminal was,\n * so `handle.result()` and `byok.tasks.get(taskId).result` are physically the\n * same fact rather than two copies that can disagree. Nothing about the task is\n * cached here.\n */\nexport function createTaskHandle(taskId: string, deps: TaskHandleDeps): TaskHandle {\n // Captured once, at construction. Looking the barrier up later would resurrect\n // relay state for a task whose terminal was already reclaimed, and then wait\n // on a promise nothing is left to settle.\n const terminal = deps.relay.terminal(taskId);\n\n return {\n taskId,\n\n events(): AsyncIterable<ServerTaskEvent> {\n return deps.relay.events(taskId);\n },\n\n async cancel(reason?: string): Promise<void> {\n const attempt = await deps.cloud.cancelTask(deps.tenant, taskId, reason);\n // An already-terminal task comes back untouched: there was nothing to\n // cancel, its terminal already settled the barrier, and announcing a\n // `Cancelled` transition would contradict the recorded result.\n if (attempt.cancellation === undefined) return;\n deps.relay.noteHostTransition(taskId, 'Cancelled', attempt.cancellation.requestedAt);\n },\n\n async approve(opts?: { approvalId?: string }): Promise<void> {\n await deps.cloud.approveTask(deps.tenant, taskId, opts);\n // Cloud atomically records the host decision in the one approval\n // timeline before this notification is enqueued. The relay remains a\n // notification projection, never a second writer for that authority.\n deps.relay.noteHostTransition(taskId, 'Running', new Date().toISOString());\n },\n\n async reject(reason?: string, opts?: { approvalId?: string }): Promise<void> {\n await deps.cloud.rejectTask(deps.tenant, taskId, {\n ...(opts?.approvalId === undefined ? {} : { approvalId: opts.approvalId }),\n ...(reason === undefined ? {} : { reason }),\n });\n deps.relay.noteHostTransition(taskId, 'Running', new Date().toISOString());\n },\n\n async steer(text: string): Promise<void> {\n try {\n await deps.cloud.steerTask(deps.tenant, taskId, { text });\n } catch (caught) {\n if (!(caught instanceof KernelSteerRejectedError)) throw caught;\n const state = await deps.readState(taskId);\n // A refused steer is a non-event, so nothing it did could have removed\n // the attempt between the gate and this read. If the attempt is gone\n // anyway, the store lost it: report the kernel's own refusal rather\n // than inventing a `TaskState` for a task that no longer has one.\n if (state === undefined) throw caught;\n throw new SteerRejectedError(taskId, refusalCode(caught.code, state), state, caught.runtime);\n }\n },\n\n async result(): Promise<TaskResult> {\n // Notification delivery is not terminal liveness authority. A terminal\n // can be durable before a TaskHandle is constructed (or after relay\n // reclamation), so always ask the durable projection before waiting.\n const alreadyRecorded = await deps.readResult(taskId);\n if (alreadyRecorded !== undefined) return alreadyRecorded;\n await terminal;\n const result = await deps.readResult(taskId);\n if (result === undefined) {\n // The barrier only settles on a fact the store wrote, so an absent\n // read-back means the store lost it. Fail loudly rather than inventing\n // a terminal the task never reached.\n throw new Error(`task ${taskId} reached a terminal with no recorded result`);\n }\n return result;\n },\n };\n}\n","import { Hono } from 'hono';\nimport {\n agentHomeProjectionRequestKey,\n createByokCloud,\n createHmacTokenSigner,\n fullCapabilityDeclaration,\n pendingApproval,\n type ByokCloud,\n type EnqueuedOffer,\n type PairingCodeInfo,\n type PendingApproval,\n type TaskAttempt,\n type TenantId,\n type TerminalResult,\n} from '@byok-sdk/cloud';\nimport {\n AgentContentReadPayloadSchema,\n AgentEgressPolicySchema,\n AgentHomeProjectionPayloadSchema,\n AgentMessageEgressRequirementSchema,\n AgentMessageServerContextSchema,\n AgentRefSchema,\n DispatchSelectionSchema,\n RequiredToolsetsSchema,\n STRICT_AGENT_ONLY_CAPABILITY,\n TASK_STATES,\n TerminalProjectionSelectionSchema,\n type AgentHomeProjectionPayload,\n type AgentRef,\n type PermissionPolicy,\n type TaskState,\n} from '@byok-sdk/protocol';\nimport type { MailboxRetentionInput, MailboxRetentionResult } from '@byok-sdk/core';\nimport { DeviceConnections } from './connections';\nimport { pickFirstConnectedDevice, type DeviceCandidate } from './device-selection';\nimport { TaskEventRelay } from './relay';\nimport { toMachineInfo, toTaskResult, toTaskSnapshot, type DispatchFacts } from './snapshot';\nimport { composeFacadeStores, serverTenantId, DEFAULT_MAX_BLOB_SIZE_BYTES } from './stores';\nimport { createTaskHandle } from './task-handle';\nimport type {\n ByokServerEvent,\n AgentContentReadRequest,\n AgentHomeProjectionRequest,\n AgentHomeProjectionStatusReadback,\n AgentEgressReceipt,\n ByokServerStorage,\n CreateByokServerOptions,\n DispatchInput,\n FreshAgentEgressDispatchInput,\n HubStats,\n MachineInfo,\n TaskHandle,\n TaskResult,\n TaskSnapshot,\n} from './types';\n\nexport type {\n ByokServerEvent,\n AgentContentReadRequest,\n AgentHomeProjectionRequest,\n AgentHomeProjectionStatusReadback,\n AgentEgressReceipt,\n ByokServerStorage,\n CreateByokServerOptions,\n DispatchInput,\n FreshAgentEgressDispatchInput,\n HubStats,\n MachineInfo,\n ServerTaskEvent,\n TaskHandle,\n TaskResult,\n TaskSnapshot,\n} from './types';\n/**\n * M5 (approval targeting, docs/protocol.md §5.3): `TaskHandle.approve`/`reject`'s\n * `opts.approvalId` targeting throws this when the id names an approval the\n * task has already superseded, so a caller needs it to `instanceof`-check and\n * inspect the two ids. Re-exported from `@byok-sdk/cloud`, which owns the gate\n * both the embedded and the hosted surface are decided by — one class, one\n * `instanceof` that works across both.\n */\nexport { StaleApprovalError } from '@byok-sdk/cloud';\n/**\n * S0 (GAP-002): `TaskHandle.steer` throws this when the runtime that claimed\n * the task cannot be steered, when the task isn't running, or when it's already\n * terminal. The GATE is the kernel's — it reads the claim-time capability\n * snapshot and nothing else — and so is the `code`. The CLASS is this\n * package's, because it carries `state: TaskState`, the wire vocabulary this\n * surface speaks and the kernel deliberately has no field for. See\n * `task-handle.ts` for the full reasoning and for why `SteerRejectionCode` and\n * {@link StaleApprovalError} stay kernel re-exports.\n */\nexport { SteerRejectedError } from './task-handle';\nexport type { SteerRejectionCode } from '@byok-sdk/cloud';\n/**\n * Auth v2 types an embedder needs to talk about devices and tokens. All owned\n * by `@byok-sdk/cloud` now — this package no longer has an auth plane of its\n * own to keep in agreement with one.\n */\nexport type { AccessTokenClaims, DeviceRecord, PairingCodeInfo, TenantId, TokenSigner } from '@byok-sdk/cloud';\nexport { createHmacTokenSigner } from '@byok-sdk/cloud';\n/** Cutoffs and result of {@link ByokServer.mailbox.collectRetired}, owned by `@byok-sdk/core`. */\nexport type { MailboxRetentionInput, MailboxRetentionResult } from '@byok-sdk/core';\nexport { SqliteUnavailableError } from './sqlite-support';\nexport type { RateLimiterOptions } from './rate-limiter';\nexport { DEFAULT_TASK_EVENT_BUFFER_LIMIT, DEFAULT_TASK_EVENT_RETENTION_MS } from './relay';\n\n/** `GET /byok/events` hold duration (§8): ~50s unless overridden (e.g. for tests). */\nconst DEFAULT_LONG_POLL_HOLD_MS = 50_000;\n/** Ceiling on how often a held poll re-reads the mailbox, ms. */\nconst MAX_LONG_POLL_INTERVAL_MS = 250;\n/** Floor on the same, so a short test hold still re-reads several times. */\nconst MIN_LONG_POLL_INTERVAL_MS = 5;\n/** Attempts a held poll makes across its window; sets the re-read interval with the hold. */\nconst LONG_POLL_READS_PER_HOLD = 8;\n/** Bytes of HMAC secret minted when an embedder supplies no {@link TokenSigner}. */\nconst TOKEN_SECRET_BYTES = 32;\n/** Page size `tasks.list()` uses when the caller names none. */\nexport const DEFAULT_TASK_PAGE_LIMIT = 100;\n\n/** Input to {@link ByokServer.pairing.createPairingCode}. */\nexport interface CreatePairingCodeInput {\n /**\n * The product the redeeming device pairs into. Must be this instance's own\n * `productId`: an embedded server serves exactly one product, and a code for\n * some other product would mint a device every bearer-authed route then\n * refuses (`instanceProductId`, `@byok-sdk/cloud`). Fail closed rather than\n * silently issuing an unusable code.\n *\n * The TENANT is not a parameter: it is derived from `productId` once, at\n * construction (`serverTenantId`, `stores.ts`), because this surface has no\n * second tenant to name.\n */\n readonly productId: string;\n /** Overrides the default single-use code lifetime. */\n readonly ttlMs?: number;\n}\n\n/** One bounded page of this server's tasks. */\nexport interface TaskPage {\n readonly tasks: readonly TaskSnapshot[];\n /**\n * Pass as the next call's `cursor`. ABSENT means the walk is over — a caller\n * stops on absence, not on an empty page, so a page that exactly fills\n * `limit` with nothing after it still terminates.\n */\n readonly nextCursor?: string;\n}\n\n/** Query for {@link ByokServer.tasks.list}. */\nexport interface TaskListQuery {\n /** Maximum snapshots in the page. Defaults to {@link DEFAULT_TASK_PAGE_LIMIT}. */\n readonly limit?: number;\n /** The `nextCursor` from the previous page; absent starts at the beginning. */\n readonly cursor?: string;\n}\n\n/** The object `createByokServer` returns — the SaaS-embedder-facing surface. */\nexport interface ByokServer {\n /** Hono app exposing every device route, plus the opt-in `/healthz`. Mount it, or use its `.fetch` with `@hono/node-server`. */\n hono: Hono;\n pairing: {\n /** Mint a single-use pairing code for this server's product and tenant (docs/protocol.md §6.1). */\n createPairingCode(input: CreatePairingCodeInput): Promise<PairingCodeInfo>;\n };\n dispatch(input: DispatchInput): Promise<TaskHandle>;\n /** Dispatch a fresh Agent execution whose runtime will mint its session after start. */\n dispatchFreshAgentEgress(input: FreshAgentEgressDispatchInput): Promise<TaskHandle>;\n /** Enqueue one capability-gated, exact-identity content-read request. */\n requestAgentContentRead(input: AgentContentReadRequest): Promise<void>;\n /** Enqueue one task-free, exact-device Agent-home projection. */\n enqueueAgentHomeProjection(input: AgentHomeProjectionRequest): Promise<AgentHomeProjectionStatusReadback>;\n /** Durable desired-state and terminal-outcome readback for one exact device-and-Agent request. */\n readAgentHomeProjection(\n deviceId: string,\n agentRef: AgentRef,\n requestId: string,\n ): Promise<AgentHomeProjectionStatusReadback | undefined>;\n tasks: {\n get(taskId: string): Promise<TaskSnapshot | undefined>;\n /**\n * One bounded page, keyset-paged by task id. Paged rather than \"all of\n * them\" because the underlying store is: an unbounded `list()` would have\n * to walk every page internally and hand back a snapshot that was never\n * consistent at any single instant.\n */\n list(query?: TaskListQuery): Promise<TaskPage>;\n };\n /** Trusted embedder access to committed blob download grants. */\n blobs: {\n getDownloadUrl(blobId: string): Promise<string | undefined>;\n };\n /** Reliable Agent egress receipt readback. */\n egress: {\n get(deviceId: string, agentRef: AgentRef, eventId: string): Promise<AgentEgressReceipt | undefined>;\n };\n machines: {\n list(): Promise<MachineInfo[]>;\n };\n events: {\n subscribe(): AsyncIterable<ByokServerEvent>;\n };\n /**\n * Device revocation (§6.3) — server-side only, no wire message. Revoking a\n * device DELETES its registration, so its next `/byok/challenge`,\n * `/byok/token`, or authed HTTP call gets a 401 — the same answer as for a\n * device id that was never registered — and its only recourse is to re-run\n * `/byok/pair`. The device-scoped state the row owned (outstanding challenge\n * nonces, presence, inbound dedup) is deleted with it; what the device DID\n * (tasks, receipts) is history and survives.\n *\n * DEVICE-ID ONLY. The hosted control plane's own revocation is tenant-first\n * (a tenant may only revoke a device it owns), but an embedded server owns\n * exactly ONE tenant and binds it here itself: `TenantId` is a branded type an\n * embedder cannot mint, and nothing on this surface — `ByokServer`,\n * `MachineInfo`, `PairingCodeInfo` — hands one back, so a tenant-first\n * parameter would make this method uncallable from outside the package rather\n * than safer. The scoping it provided is unchanged, just not the caller's to\n * state: a device id this server does not know resolves to nothing and is a\n * silent no-op.\n */\n devices: {\n revoke(deviceId: string): Promise<void>;\n };\n /**\n * Mailbox retention for this server's tenant — the host control-plane\n * operation core defines (`MailboxStore.collectRetired`), forwarded verbatim.\n *\n * A pass-through, deliberately, and NOT a retention policy: the caller names\n * both cutoffs, so this package invents no TTL, runs no timer, and holds no\n * second opinion about when a device's undelivered work is declared lost.\n * Nothing in `@byok-sdk/core`, `@byok-sdk/cloud` or this façade drives the\n * sweep on its own, which is exactly why an embedder needs a way to reach it:\n * without one, an embedded server retires nothing, ever, and the\n * `cursor_too_old` floor can never move.\n *\n * Acked rows appended before `ackedBefore` are DELETED; unacked rows appended\n * before `expireUnackedBefore` are dead-lettered as `expired` and stay\n * visible, which is what moves `recoverableFrom` and turns a device polling\n * from a lost cursor into a `409 cursor_too_old` resync instead of a silently\n * short page. Both cutoffs must be canonical ISO-8601 UTC.\n */\n mailbox: {\n collectRetired(input: MailboxRetentionInput): Promise<MailboxRetentionResult>;\n };\n /**\n * Release what this instance holds: the relay's per-task feeds and their\n * reclamation timers, and the connection observations. Call it on shutdown so\n * nothing keeps the process alive or leaks a handle in tests; safe to call\n * more than once. SQLite embedders that need to await handle release should\n * call {@link ByokServer.close} instead.\n */\n stop(): void;\n /** Drain pending store calls and release the selected storage authority. */\n close(): Promise<void>;\n /**\n * A plain, serializable snapshot of this server's current state. See\n * {@link HubStats} for the field-by-field contract.\n *\n * Async because `taskCountsByState` is COMPUTED from the durable task store\n * on every call rather than mirrored into a counter this package would then\n * have to keep in agreement with it — that mirror was the second task\n * authority the fold exists to remove. Deliberately in-process only: never\n * exposed over HTTP by this SDK itself (see\n * `CreateByokServerOptions.healthzRoute`); an embedder that wants any of it\n * surfaced remotely builds its own authenticated route around this method.\n */\n stats(): Promise<HubStats>;\n}\n\n/**\n * Embedded reference coordinator: a thin façade over `@byok-sdk/cloud`'s\n * kernel, composed against the explicitly selected embedded stores.\n *\n * What that means concretely — and it is the whole point of WP3B — is that this\n * package owns NO coordination semantics any more. Pairing, tokens, the inbound\n * gate, task ownership, first-terminal-wins, approvals, steering, cancellation,\n * long-poll redelivery and the `cursor_too_old` floor are all the kernel's, and\n * a device cannot tell this from a hosted deployment. What is left here is the\n * embedded shape: one product, one tenant, a `TaskHandle` for hosts that want\n * one, an in-process notification relay, and the observability an embedder used\n * to get from the hub.\n *\n * State is in-memory by default. Explicit SQLite mode persists the six\n * coordination interfaces whose contracts cross a process restart; all other\n * ports remain process-local.\n */\nexport function createByokServer(opts: CreateByokServerOptions): ByokServer {\n const startedAtMs = Date.now();\n const tenant = serverTenantId(opts.productId);\n const maxBlobSizeBytes = opts.maxBlobSizeBytes ?? DEFAULT_MAX_BLOB_SIZE_BYTES;\n const longPollHoldMs = opts.longPollHoldMs ?? DEFAULT_LONG_POLL_HOLD_MS;\n\n const connections = new DeviceConnections();\n const relay = new TaskEventRelay({\n connections,\n ...(opts.taskEventBufferLimit === undefined ? {} : { taskEventBufferLimit: opts.taskEventBufferLimit }),\n ...(opts.taskEventRetentionMs === undefined ? {} : { taskEventRetentionMs: opts.taskEventRetentionMs }),\n });\n\n const composition = composeFacadeStores({\n tenant,\n maxBlobSizeBytes,\n ...(opts.storage === undefined ? {} : { storage: opts.storage }),\n ...(opts.rateLimit === undefined ? {} : { rateLimit: opts.rateLimit }),\n connections,\n onRateLimited: (deviceId, at) => relay.emitServerEvent({ kind: 'device.rate_limited', deviceId, at }),\n });\n\n const tokenSigner =\n opts.tokenSigner ??\n createHmacTokenSigner(\n globalThis.crypto.getRandomValues(new Uint8Array(TOKEN_SECRET_BYTES)),\n composition.clock,\n );\n\n const cloud: ByokCloud = createByokCloud({\n core: composition.core,\n cloud: composition.cloud,\n blobContentProxy: composition.blobContentProxy,\n crypto: composition.crypto,\n tokenSigner,\n clock: composition.clock,\n capabilities: fullCapabilityDeclaration(),\n // S1: the product this instance serves is part of every bearer-authed\n // route's decision, not just of the pairing claims.\n instanceProductId: opts.productId,\n observer: relay,\n ...(opts.agentMessage === undefined ? {} : { agentMessage: opts.agentMessage }),\n maxBlobSizeBytes,\n longPollHoldMs,\n longPollIntervalMs: longPollInterval(longPollHoldMs),\n });\n\n /**\n * Dispatch input the kernel does not persist. See `DispatchFacts` for why\n * this exists and why it is not TTL-reclaimed.\n */\n const dispatched = new Map<string, DispatchFacts>();\n\n const hono = new Hono();\n if (opts.healthzRoute === true) {\n // Deliberately UNAUTHENTICATED and minimal: a liveness probe must not need\n // a device credential, and the body carries no device ids and no counts.\n // `stats()` is the richer surface and is never routed anywhere by this SDK.\n hono.get('/healthz', (c) => c.json({ ok: true, uptimeMs: Date.now() - startedAtMs }, 200));\n }\n // Everything else IS the kernel. Mounted as a fallthrough rather than\n // re-declared route by route so this package can never publish a route the\n // kernel does not serve, or shadow one it does.\n hono.all('*', (c) => cloud.fetch(c.req.raw));\n\n async function readPending(taskId: string): Promise<PendingApproval | undefined> {\n return pendingApproval(await cloud.readApprovalTimeline(tenant, taskId));\n }\n\n async function readTerminal(taskId: string): Promise<TerminalResult | undefined> {\n return cloud.readTaskResult(tenant, taskId);\n }\n\n async function projectTask(attempt: TaskAttempt): Promise<TaskSnapshot> {\n const [pending, terminal] = await Promise.all([readPending(attempt.taskId), readTerminal(attempt.taskId)]);\n return toTaskSnapshot(attempt, pending, terminal, dispatched.get(attempt.taskId));\n }\n\n /**\n * The state `byok.tasks.get(taskId)` would report right now.\n *\n * Deliberately routed through `projectTask` rather than re-deriving it: a\n * refused steer reports the same `TaskState` the snapshot does, because it is\n * literally the snapshot's, read at the moment of the refusal.\n */\n async function readTaskState(taskId: string): Promise<TaskState | undefined> {\n const attempt = await cloud.readTaskAttempt(tenant, taskId);\n return attempt === undefined ? undefined : (await projectTask(attempt)).state;\n }\n\n /**\n * M4 Phase 3 hardening: the daemon resolved a pending approval entirely\n * locally and never sent `task.approval_resolved`, but its next\n * progress/artifact message proves, after the fact, that it did. Recorded on\n * the same timeline as any other resolution so the read model resumes, and\n * announced as `task.approval_resolved_implicit` so an embedder can tell the\n * inferred path from the reported one.\n *\n * Runs off the relay's request path, not on it: it needs a store read, and\n * the kernel's observer contract is synchronous and inline. A failure here\n * changes nothing durable — the next message re-runs the same check.\n */\n relay.onTaskActivity = (\n taskId: string,\n pendingRequestSourceEnvelopeId: string | undefined,\n activitySourceEnvelopeId: string,\n activityAt: string,\n ): void => {\n void (async () => {\n // The relay captured this request identity when it observed the native\n // `task.await_approval`. An activity that committed before that request\n // is therefore never retroactively allowed to resolve it after an async\n // timeline read observes the newer pending slot.\n if (pendingRequestSourceEnvelopeId === undefined) return;\n const pending = await readPending(taskId);\n if (\n pending === undefined ||\n pending.sourceEnvelopeId !== pendingRequestSourceEnvelopeId\n ) {\n return;\n }\n const attempt = await cloud.readTaskAttempt(tenant, taskId);\n if (attempt === undefined) return;\n const sourceEnvelopeId = await composition.crypto.sha256(\n new TextEncoder().encode(\n JSON.stringify({\n domain: 'byok:implicit-approval',\n tenant,\n taskId,\n deviceId: attempt.deviceId,\n ownerDeviceId: attempt.ownerDeviceId,\n agentRef: attempt.agentRef,\n requestSourceEnvelopeId: pending.sourceEnvelopeId,\n requestRevision: pending.revision,\n activitySourceEnvelopeId,\n }),\n ),\n );\n const resolved = await composition.cloud.approvals.resolvePending(tenant, {\n taskId,\n sourceEnvelopeId,\n expectedSourceEnvelopeId: pending.sourceEnvelopeId,\n expectedRevision: pending.revision,\n event: {\n type: 'approval_resolved',\n ...(pending.approvalId === undefined ? {} : { approvalId: pending.approvalId }),\n decision: 'approve',\n resolvedBy: 'host',\n at: activityAt,\n },\n });\n if (resolved.status === 'applied' || resolved.status === 'replayed') {\n relay.emitImplicitApprovalResolved(taskId, activityAt);\n }\n })().catch(() => undefined);\n };\n\n async function candidatesInObservationOrder(): Promise<DeviceCandidate[]> {\n const candidates: DeviceCandidate[] = [];\n for (const deviceId of connections.ids()) {\n if (!connections.isConnected(deviceId)) continue;\n const device = await composition.cloud.devices.get(tenant, deviceId);\n if (device === undefined || device.revoked) continue;\n candidates.push({\n deviceId,\n capabilities: device.capabilities,\n configuredToolsets: connections.get(deviceId)?.configuredToolsets,\n });\n }\n return candidates;\n }\n\n async function deviceCapabilities(deviceId: string): Promise<readonly string[] | undefined> {\n return (await composition.cloud.devices.get(tenant, deviceId))?.capabilities;\n }\n\n async function requireConnected(deviceId: string): Promise<void> {\n if (!connections.isConnected(deviceId)) throw new Error(`device ${deviceId} is not connected`);\n }\n\n async function dispatchInternal(\n input: DispatchInput | FreshAgentEgressDispatchInput,\n freshAgentEgress: boolean,\n ): Promise<TaskHandle> {\n const sessionRef = 'sessionRef' in input ? input.sessionRef : undefined;\n const agentRef = input.agentRef === undefined ? undefined : AgentRefSchema.parse(input.agentRef);\n const egressPolicy =\n input.egressPolicy === undefined ? undefined : AgentEgressPolicySchema.parse(input.egressPolicy);\n const messageEgress =\n input.messageEgress === undefined ? undefined : AgentMessageEgressRequirementSchema.parse(input.messageEgress);\n const terminalProjection =\n input.terminalProjection === undefined\n ? undefined\n : TerminalProjectionSelectionSchema.parse(input.terminalProjection);\n if (messageEgress === undefined && input.agentMessageContext !== undefined) {\n throw new Error('agentMessageContext requires messageEgress');\n }\n const agentMessageContext =\n messageEgress === undefined ? undefined : AgentMessageServerContextSchema.parse(input.agentMessageContext);\n const dispatchSelection =\n input.dispatchSelection === undefined ? undefined : DispatchSelectionSchema.parse(input.dispatchSelection);\n const requiredToolsets =\n input.requiredToolsets === undefined ? undefined : RequiredToolsetsSchema.parse(input.requiredToolsets);\n\n if (agentRef !== undefined && input.deviceId === undefined) {\n throw new Error('Agent-bound dispatch requires an explicit deviceId for capability admission');\n }\n if (egressPolicy !== undefined && agentRef === undefined) {\n throw new Error('Agent egress policy requires an explicit AgentRef; legacy task dispatch cannot consume it');\n }\n if (messageEgress !== undefined && egressPolicy === undefined) {\n throw new Error('Agent message egress requires the typed Agent egress offer path');\n }\n\n const deviceId =\n input.deviceId ??\n pickFirstConnectedDevice(await candidatesInObservationOrder(), {\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n allowStrictAgentOnly: agentRef !== undefined,\n });\n // No queue-until-connect: reject clearly instead of silently enqueuing a\n // task nothing will ever claim.\n if (deviceId === undefined) {\n throw new Error('no connected device to dispatch to (M0 does not queue tasks until a device connects)');\n }\n await requireConnected(deviceId);\n\n // The gates the kernel does not run, in the pre-fold order. Everything\n // below the kernel DOES run (strict-agent-only, agent-home-contract, the\n // egress/message/terminal-projection capabilities) is left to it rather\n // than duplicated here, so there is one place each admission is decided.\n const capabilities = await deviceCapabilities(deviceId);\n if (dispatchSelection !== undefined && !(capabilities?.includes('dispatch-selection') ?? false)) {\n throw new Error(\n `device ${deviceId} did not advertise dispatch-selection capability; refusing authoritative provider/model dispatch`,\n );\n }\n if (requiredToolsets !== undefined) {\n if (!(capabilities?.includes('toolset-selection') ?? false)) {\n throw new Error(\n `device ${deviceId} did not advertise toolset-selection capability; refusing a task whose semantics require local MCP tools`,\n );\n }\n const configuredToolsets = connections.get(deviceId)?.configuredToolsets;\n if (configuredToolsets === undefined) {\n throw new Error(\n `device ${deviceId} did not advertise its configured toolset inventory; refusing to guess from runtime capability`,\n );\n }\n const configured = new Set(configuredToolsets);\n const missing = requiredToolsets.filter((toolsetId) => !configured.has(toolsetId));\n if (missing.length > 0) {\n throw new Error(`device ${deviceId} is missing required MCP toolset(s): ${missing.join(', ')}`);\n }\n }\n if (\n dispatchSelection !== undefined &&\n input.runtime !== undefined &&\n input.runtime !== dispatchSelection.runtimeId\n ) {\n throw new Error(\n `dispatch runtime ${input.runtime} does not match dispatchSelection.runtimeId ${dispatchSelection.runtimeId}`,\n );\n }\n if (agentRef === undefined && capabilities?.includes(STRICT_AGENT_ONLY_CAPABILITY) === true) {\n throw new Error(\n `device ${deviceId} advertises strict-agent-only; legacy task dispatch is refused before enqueue`,\n );\n }\n\n const policy: PermissionPolicy = input.policy ?? { mode: 'confirm' };\n const runtime = dispatchSelection?.runtimeId ?? input.runtime;\n const common = {\n ...(input.harnessId === undefined ? {} : { harnessId: input.harnessId }),\n instruction: input.instruction,\n policy,\n ...(runtime === undefined ? {} : { runtime }),\n ...(dispatchSelection === undefined ? {} : { dispatchSelection }),\n };\n\n // A known id lets the relay exist before enqueue can make the offer\n // observable. Inbound claim/terminal traffic racing append is buffered by\n // that provisional relay state and reconciled once the offer succeeds.\n const taskId = globalThis.crypto.randomUUID();\n relay.provision(taskId);\n let enqueued: EnqueuedOffer;\n try {\n enqueued = await (async () => {\n if (agentRef !== undefined && egressPolicy !== undefined && freshAgentEgress) {\n return cloud.enqueueFreshAgentEgressOffer(tenant, deviceId, {\n taskId,\n payload: {\n ...common,\n agentRef,\n egressPolicy,\n ...(terminalProjection === undefined ? {} : { terminalProjection }),\n ...(messageEgress === undefined ? {} : { messageEgress }),\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n },\n ...(agentMessageContext === undefined ? {} : { agentMessageContext }),\n });\n }\n if (agentRef !== undefined && egressPolicy !== undefined) {\n if (sessionRef === undefined) {\n throw new Error(\n 'Agent egress resume dispatch requires an exact sessionRef; use dispatchFreshAgentEgress for fresh execution',\n );\n }\n return cloud.enqueueAgentEgressOffer(tenant, deviceId, {\n taskId,\n payload: {\n ...common,\n sessionRef,\n agentRef,\n egressPolicy,\n ...(terminalProjection === undefined ? {} : { terminalProjection }),\n ...(messageEgress === undefined ? {} : { messageEgress }),\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n },\n ...(agentMessageContext === undefined ? {} : { agentMessageContext }),\n });\n }\n if (agentRef !== undefined) {\n return cloud.enqueueAgentOffer(tenant, deviceId, {\n taskId,\n payload: {\n ...common,\n agentRef,\n ...(sessionRef === undefined ? {} : { sessionRef }),\n ...(terminalProjection === undefined ? {} : { terminalProjection }),\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n },\n });\n }\n if (requiredToolsets !== undefined) {\n return cloud.enqueueToolsetOffer(tenant, deviceId, {\n taskId,\n payload: { ...common, ...(sessionRef === undefined ? {} : { sessionRef }), requiredToolsets },\n });\n }\n return cloud.enqueueOffer(tenant, deviceId, {\n taskId,\n payload: { ...common, ...(sessionRef === undefined ? {} : { sessionRef }) },\n });\n })();\n } catch (error) {\n relay.abort(taskId);\n throw error;\n }\n\n // The offer envelope's own timestamp, so the feed and the snapshot agree on\n // when the task began rather than each stamping its own \"now\".\n const createdAt = enqueued.envelope.ts;\n dispatched.set(enqueued.taskId, {\n createdAt,\n ...(sessionRef === undefined ? {} : { sessionRef }),\n });\n relay.noteDispatched(enqueued.taskId, createdAt);\n return handleFor(enqueued.taskId);\n }\n\n function handleFor(taskId: string): TaskHandle {\n return createTaskHandle(taskId, {\n tenant,\n cloud,\n relay,\n readState: readTaskState,\n readResult: async (id) => toTaskResult(await readTerminal(id)),\n });\n }\n\n return {\n hono,\n\n pairing: {\n // `async`, not a plain function that throws: the declared contract is a\n // promise, and a guard that threw synchronously would refuse a\n // cross-product mint through a channel no `await`/`.catch()` caller of a\n // promise-returning method handles. Fail closed, on the same channel as\n // every other failure of this method.\n async createPairingCode(input: CreatePairingCodeInput): Promise<PairingCodeInfo> {\n if (input.productId !== opts.productId) {\n throw new Error(\n `pairing code product ${input.productId} does not match this server's product ${opts.productId}`,\n );\n }\n return cloud.createPairingCode(tenant, {\n productId: input.productId,\n ...(input.ttlMs === undefined ? {} : { ttlMs: input.ttlMs }),\n });\n },\n },\n\n dispatch(input: DispatchInput): Promise<TaskHandle> {\n return dispatchInternal(input, false);\n },\n\n dispatchFreshAgentEgress(input: FreshAgentEgressDispatchInput): Promise<TaskHandle> {\n if (Object.prototype.hasOwnProperty.call(input, 'sessionRef')) {\n throw new Error('fresh Agent egress dispatch must not carry sessionRef');\n }\n if (typeof input.deviceId !== 'string' || input.deviceId.length === 0) {\n throw new Error('fresh Agent egress dispatch requires an explicit deviceId');\n }\n if (input.agentRef === undefined || input.egressPolicy === undefined) {\n throw new Error('fresh Agent egress dispatch requires exact AgentRef and egress policy');\n }\n return dispatchInternal(input, true);\n },\n\n async requestAgentContentRead(input: AgentContentReadRequest): Promise<void> {\n const payload = AgentContentReadPayloadSchema.parse(input.payload);\n await requireConnected(input.deviceId);\n await cloud.enqueueAgentContentRead(tenant, input.deviceId, { payload });\n },\n\n async enqueueAgentHomeProjection(\n input: AgentHomeProjectionRequest,\n ): Promise<AgentHomeProjectionStatusReadback> {\n const payload = AgentHomeProjectionPayloadSchema.parse(input.payload);\n await requireConnected(input.deviceId);\n return (await cloud.enqueueAgentHomeProjection(tenant, input.deviceId, payload)).status;\n },\n\n async readAgentHomeProjection(\n deviceId: string,\n agentRef: AgentRef,\n requestId: string,\n ): Promise<AgentHomeProjectionStatusReadback | undefined> {\n // The durable request lookup is exact to the device and AgentRef. The\n // stored request remains the authority for the projection hash.\n const stored = await composition.cloud.receipts.get(\n tenant,\n agentHomeProjectionRequestKey(deviceId, agentRef, requestId),\n );\n if (stored === undefined) return undefined;\n let desired: AgentHomeProjectionPayload;\n try {\n desired = AgentHomeProjectionPayloadSchema.parse(JSON.parse(stored.body));\n } catch {\n return undefined;\n }\n return cloud.getAgentHomeProjectionStatus(tenant, deviceId, {\n requestId: desired.requestId,\n agentRef: desired.agentRef,\n projectionHash: desired.projectionHash,\n });\n },\n\n tasks: {\n async get(taskId: string): Promise<TaskSnapshot | undefined> {\n const attempt = await cloud.readTaskAttempt(tenant, taskId);\n return attempt === undefined ? undefined : projectTask(attempt);\n },\n async list(query: TaskListQuery = {}): Promise<TaskPage> {\n const page = await cloud.listTaskAttempts(tenant, {\n limit: query.limit ?? DEFAULT_TASK_PAGE_LIMIT,\n ...(query.cursor === undefined ? {} : { cursor: query.cursor }),\n });\n return {\n tasks: await Promise.all(page.attempts.map((attempt) => projectTask(attempt))),\n ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }),\n };\n },\n },\n\n blobs: {\n getDownloadUrl(blobId: string): Promise<string | undefined> {\n return composition.cloud.blobs.getDownloadUrl(tenant, blobId);\n },\n },\n\n egress: {\n async get(deviceId: string, agentRef: AgentRef, eventId: string): Promise<AgentEgressReceipt | undefined> {\n const record = await cloud.readAgentEgress(tenant, deviceId, agentRef, eventId);\n return record === undefined\n ? undefined\n : {\n deviceId: record.deviceId,\n payload: record.payload,\n receiptId: record.receiptId,\n recordedAt: record.recordedAt,\n };\n },\n },\n\n machines: {\n async list(): Promise<MachineInfo[]> {\n const devices = await cloud.listDevices(tenant);\n return devices.map((device) => toMachineInfo(device, connections.get(device.deviceId)));\n },\n },\n\n events: {\n subscribe: () => relay.serverEvents(),\n },\n\n devices: {\n async revoke(deviceId: string): Promise<void> {\n // §6.3: a tenant can only revoke a device it owns. This server owns one\n // tenant and supplies it here, so a device id belonging to nobody\n // addresses nothing and touches nothing.\n await cloud.revokeDevice(tenant, deviceId);\n connections.forget(deviceId);\n },\n },\n\n mailbox: {\n collectRetired(input: MailboxRetentionInput): Promise<MailboxRetentionResult> {\n return composition.core.mailbox.collectRetired(tenant, input);\n },\n },\n\n stop(): void {\n relay.stop();\n dispatched.clear();\n void composition.close();\n },\n\n async close(): Promise<void> {\n relay.stop();\n dispatched.clear();\n await composition.close();\n },\n\n async stats(): Promise<HubStats> {\n const taskCountsByState = Object.fromEntries(TASK_STATES.map((state) => [state, 0])) as Record<\n TaskState,\n number\n >;\n let cursor: string | undefined;\n do {\n const page = await cloud.listTaskAttempts(tenant, {\n limit: DEFAULT_TASK_PAGE_LIMIT,\n ...(cursor === undefined ? {} : { cursor }),\n });\n for (const attempt of page.attempts) {\n taskCountsByState[toStateForCount(attempt, await readPending(attempt.taskId))] += 1;\n }\n cursor = page.nextCursor;\n } while (cursor !== undefined);\n\n return {\n connectedDeviceCount: connections.connectedCount(),\n taskCountsByState,\n envelopesIn: composition.counters.envelopesIn,\n dedupDrops: composition.counters.dedupDrops,\n rateLimitEvents: composition.counters.rateLimitEvents,\n uptimeMs: Date.now() - startedAtMs,\n };\n },\n };\n}\n\n/** Same projection `tasks.get` uses; named so the count and the snapshot can never disagree. */\nfunction toStateForCount(attempt: TaskAttempt, pending: PendingApproval | undefined): TaskState {\n return toTaskSnapshot(attempt, pending, undefined, undefined).state;\n}\n\n/**\n * A held poll re-reads the mailbox on a fraction of its own window, clamped so\n * a long production hold does not busy-loop and a short test hold still gets\n * several reads instead of exactly one.\n */\nfunction longPollInterval(holdMs: number): number {\n const derived = Math.floor(holdMs / LONG_POLL_READS_PER_HOLD);\n return Math.max(MIN_LONG_POLL_INTERVAL_MS, Math.min(MAX_LONG_POLL_INTERVAL_MS, derived));\n}\n"]}
1
+ {"version":3,"sources":["../src/connections.ts","../src/device-selection.ts","../src/event-queue.ts","../src/relay.ts","../src/snapshot.ts","../src/rate-limiter.ts","../src/sqlite-support.ts","../src/stores/sqlite/device-directory.ts","../src/stores/sqlite/index.ts","../src/stores.ts","../src/task-handle.ts","../src/index.ts"],"names":["require","createInMemoryCoreStores","createInMemoryCloudStores","KernelSteerRejectedError","capabilities","STRICT_AGENT_ONLY_CAPABILITY"],"mappings":";;;;;;;;;;;;AAkDO,IAAM,oBAAN,MAAwB;AAAA,EACpB,QAAA,uBAAe,GAAA,EAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtD,QAAA,CAAS,QAAA,EAAkB,YAAA,EAAkC,EAAA,EAAkB;AAC7E,IAAA,IAAA,CAAK,QAAA,CAAS,IAAI,QAAA,EAAU;AAAA,MAC1B,SAAA,EAAW,IAAA;AAAA,MACX,QAAA,EAAU,EAAA;AAAA,MACV,GAAI,aAAa,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,YAAA,CAAa,aAAA,EAAc;AAAA,MAChG,GAAI,YAAA,CAAa,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,CAAC,GAAG,YAAA,CAAa,QAAQ,CAAA,EAAE;AAAA,MACtF,GAAI,YAAA,CAAa,kBAAA,KAAuB,MAAA,GACpC,EAAC,GACD,EAAE,kBAAA,EAAoB,CAAC,GAAG,YAAA,CAAa,kBAAkB,CAAA;AAAE,KAChE,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAA,CAAM,UAAkB,EAAA,EAAkB;AACxC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,QAAA,CAAS,IAAI,QAAA,EAAU,EAAE,WAAW,IAAA,EAAM,QAAA,EAAU,IAAI,CAAA;AAC7D,MAAA;AAAA,IACF;AACA,IAAA,QAAA,CAAS,SAAA,GAAY,IAAA;AACrB,IAAA,QAAA,CAAS,QAAA,GAAW,EAAA;AAAA,EACtB;AAAA,EAEA,IAAI,QAAA,EAAgD;AAClD,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAAA,EACnC;AAAA,EAEA,YAAY,QAAA,EAA2B;AACrC,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,GAAG,SAAA,KAAc,IAAA;AAAA,EACpD;AAAA,EAEA,cAAA,GAAyB;AACvB,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,UAAA,IAAc,KAAK,QAAA,CAAS,MAAA,IAAU,IAAI,UAAA,CAAW,WAAW,KAAA,IAAS,CAAA;AACpF,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,GAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA;AAAA,EACjC;AAAA;AAAA,EAGA,OAAO,QAAA,EAAwB;AAC7B,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,EAC/B;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACtB;AACF,CAAA;ACjFO,SAAS,wBAAA,CACd,UAAA,EACA,KAAA,GAA+B,EAAC,EACZ;AACpB,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,IAAI,MAAM,oBAAA,KAAyB,IAAA,IAAQ,UAAU,YAAA,EAAc,QAAA,CAAS,4BAA4B,CAAA,EAAG;AACzG,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,gBAAA,KAAqB,MAAA,EAAW,OAAO,SAAA,CAAU,QAAA;AAK3D,IAAA,IAAI,CAAC,SAAA,CAAU,YAAA,EAAc,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5D,IAAA,IAAI,SAAA,CAAU,uBAAuB,MAAA,EAAW;AAChD,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,SAAA,CAAU,kBAAkB,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,gBAAA,CAAiB,KAAA,CAAM,CAAC,SAAA,KAAc,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA,EAAG,OAAO,SAAA,CAAU,QAAA;AAAA,EAC/F;AACA,EAAA,OAAO,MAAA;AACT;;;ACpBO,IAAM,kBAAN,MAAyB;AAAA,EACb,SAAkE,EAAC;AAAA,EAC5E,YAAA,GAAe,CAAA;AAAA,EACf,MAAA,GAAS,KAAA;AAAA,EACT,UAA6B,EAAC;AAAA,EACrB,WAAA;AAAA,EACA,gBAAA;AAAA,EACT,eAAA,GAAkB,KAAA;AAAA,EAE1B,WAAA,CAAY,OAAA,GAAqC,EAAC,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,gBAAgB,MAAA,EAAW;AACrC,MAAA,IAAI,CAAC,OAAO,aAAA,CAAc,OAAA,CAAQ,WAAW,CAAA,IAAK,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC1E,QAAA,MAAM,IAAI,SAAA;AAAA,UACR,CAAA,kEAAA,EAAqE,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAC,CAAA;AAAA,SAClG;AAAA,MACF;AACA,MAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,IAC7B;AACA,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA,EAGA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA,EAEA,KAAK,KAAA,EAAgB;AACnB,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,EAAE,UAAU,IAAA,CAAK,YAAA,EAAA,EAAgB,OAAO,CAAA;AACzD,IAAA,IAAA,CAAK,YAAA,EAAa;AAClB,IAAA,IAAA,CAAK,IAAA,EAAK;AAAA,EACZ;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,IAAA,EAAK;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,YAAA,GAAqB;AAC3B,IAAA,MAAM,QAAQ,IAAA,CAAK,WAAA;AACnB,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,IAAA,CAAK,MAAA,CAAO,UAAU,KAAA,EAAO;AACxD,IAAA,IAAA,CAAK,OAAO,MAAA,CAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,SAAS,KAAK,CAAA;AAChD,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,EACzB;AAAA,EAEQ,IAAA,GAAa;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,IAAA,IAAA,CAAK,UAAU,EAAC;AAChB,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,OAAA,EAAQ;AAAA,EACzC;AAAA,EAEQ,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,SAAA,GAA8B;AAC5B,IAAA,MAAM,KAAA,GAAQ,IAAA;AACd,IAAA,OAAO;AAAA,MACL,CAAC,MAAA,CAAO,aAAa,CAAA,GAAsB;AACzC,QAAA,IAAI,WAAW,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,YAAY,KAAA,CAAM,YAAA;AAClD,QAAA,IAAI,mBAAA,GAAsB,KAAA;AAC1B,QAAA,OAAO;AAAA,UACL,MAAM,IAAA,GAAmC;AACvC,YAAA,WAAS;AACP,cAAA,IAAI,MAAM,eAAA,IAAmB,CAAC,mBAAA,IAAuB,KAAA,CAAM,qBAAqB,MAAA,EAAW;AACzF,gBAAA,mBAAA,GAAsB,IAAA;AACtB,gBAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,gBAAA,EAAkB,MAAM,KAAA,EAAM;AAAA,cACtD;AAEA,cAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,QAAA;AAChC,cAAA,IAAI,MAAA,KAAW,MAAA,IAAa,QAAA,GAAW,MAAA,EAAQ,QAAA,GAAW,MAAA;AAC1D,cAAA,IAAI,WAAW,MAAA,EAAW;AACxB,gBAAA,MAAM,SAAS,QAAA,GAAW,MAAA;AAC1B,gBAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AACjC,gBAAA,IAAI,UAAU,MAAA,EAAW;AACvB,kBAAA,QAAA,GAAW,MAAM,QAAA,GAAW,CAAA;AAC5B,kBAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,MAAM,KAAA,EAAM;AAAA,gBAC3C;AAAA,cACF;AACA,cAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,gBAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAW,IAAA,EAAM,IAAA,EAAK;AAAA,cACxC;AACA,cAAA,MAAM,MAAM,WAAA,EAAY;AAAA,YAC1B;AAAA,UACF;AAAA,SACF;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF,CAAA;;;ACzHO,IAAM,+BAAA,GAAkC;AAExC,IAAM,kCAAkC,CAAA,GAAI;AAQnD,IAAM,iBAAA,GAAqC,EAAE,IAAA,EAAM,OAAA,EAAS,QAAQ,kBAAA,EAAmB;AAqDhF,IAAM,iBAAN,MAAkD;AAAA,EAC9C,MAAA,uBAAa,GAAA,EAA4B;AAAA,EACzC,aAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACT,QAAA,GAAW,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOX,cAAA;AAAA,EAOA,YAAY,OAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,WAAA;AAC5B,IAAA,IAAA,CAAK,YAAA,GAAe,aAAA,CAAc,OAAA,CAAQ,oBAAA,IAAwB,iCAAiC,sBAAsB,CAAA;AACzH,IAAA,IAAA,CAAK,YAAA,GAAe,aAAA,CAAc,OAAA,CAAQ,oBAAA,IAAwB,iCAAiC,sBAAsB,CAAA;AAKzH,IAAA,IAAA,CAAK,gBAAgB,IAAI,eAAA,CAAiC,EAAE,WAAA,EAAa,IAAA,CAAK,cAAc,CAAA;AAAA,EAC9F;AAAA;AAAA,EAGA,YAAA,GAA+C;AAC7C,IAAA,OAAO,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,EACtC;AAAA;AAAA,EAGA,gBAAgB,KAAA,EAA8B;AAC5C,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAA,CAAK,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,UAAU,MAAA,EAAsB;AAC9B,IAAA,IAAA,CAAK,KAAA,CAAM,QAAQ,IAAI,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,MAAM,MAAA,EAAsB;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACpC,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,CAAC,KAAA,CAAM,WAAA,EAAa;AAC/C,IAAA,IAAI,KAAA,CAAM,YAAA,KAAiB,MAAA,EAAW,YAAA,CAAa,MAAM,YAAY,CAAA;AACrE,IAAA,KAAA,CAAM,cAAA,EAAe;AACrB,IAAA,KAAA,CAAM,MAAM,KAAA,EAAM;AAClB,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAA,CAAe,QAAgB,EAAA,EAAkB;AAC/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,MAAM,KAAA,GAAQ,QAAA,IAAY,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AAC3C,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,CAAC,KAAA,CAAM,WAAA,EAAa;AAClD,IAAA,KAAA,CAAM,WAAA,GAAc,KAAA;AACpB,IAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,KAAA,EAAO,SAAA,EAAW,IAAI,CAAA;AACxD,IAAA,IAAA,CAAK,gBAAgB,EAAE,IAAA,EAAM,cAAA,EAAgB,MAAA,EAAQ,IAAI,CAAA;AACzD,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AAClC,IAAA,KAAA,MAAW,KAAA,IAAS,OAAO,IAAA,CAAK,mBAAA,CAAoB,OAAO,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,EAAE,CAAA;AAAA,EAC7F;AAAA;AAAA,EAGA,OAAO,MAAA,EAAgD;AACrD,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,MAAM,SAAA,EAAU;AAAA,EAC5C;AAAA;AAAA,EAGA,SAAS,MAAA,EAA+B;AACtC,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,QAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,kBAAA,CAAmB,MAAA,EAAgB,KAAA,EAAkB,EAAA,EAAkB;AACrE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,IAAA,CAAK,WAAA,CAAY,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,mBAAmB,KAAA,EAA+B;AAChD,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAS,GAAI,KAAA;AAC/B,IAAA,MAAM,EAAA,GAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAElC,IAAA,IAAI,QAAA,CAAS,SAAS,YAAA,EAAc;AAClC,MAAA,IAAA,CAAK,YAAA,CAAa,QAAA;AAAA,QAChB,QAAA;AAAA,QACA;AAAA,UACE,GAAI,QAAA,CAAS,OAAA,CAAQ,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,aAAA,EAAc;AAAA,UACxG,GAAI,QAAA,CAAS,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,QAAA,EAAS;AAAA,UACzF,GAAI,QAAA,CAAS,OAAA,CAAQ,kBAAA,KAAuB,MAAA,GACxC,EAAC,GACD,EAAE,kBAAA,EAAoB,QAAA,CAAS,OAAA,CAAQ,kBAAA;AAAmB,SAChE;AAAA,QACA;AAAA,OACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,QAAA,EAAU,EAAE,CAAA;AAEpC,IAAA,MAAM,SAAS,QAAA,CAAS,OAAA;AACxB,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACpC,IAAA,IAAI,UAAU,MAAA,EAAW;AAEzB,IAAA,IAAI,MAAM,WAAA,EAAa;AACrB,MAAA,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,EAAE,QAAA,EAAU,IAAI,CAAA;AACjC,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,mBAAA,CAAoB,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAE,CAAA;AAAA,EACtD;AAAA,EAEA,mBAAA,CACE,KAAA,EACA,MAAA,EACA,QAAA,EACA,EAAA,EACM;AACN,IAAA,QAAQ,SAAS,IAAA;AAAM,MACrB,KAAK,YAAA;AACH,QAAA,IAAI,SAAS,OAAA,CAAQ,OAAA,KAAY,QAAW,KAAA,CAAM,cAAA,GAAiB,SAAS,OAAA,CAAQ,OAAA;AACpF,QAAA,IAAI,SAAS,OAAA,CAAQ,SAAA,KAAc,QAAW,KAAA,CAAM,gBAAA,GAAmB,SAAS,OAAA,CAAQ,SAAA;AACxF,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAC7C,QAAA;AAAA,MACF,KAAK,cAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAC7C,QAAA;AAAA,MACF,KAAK,eAAA;AACH,QAAA,KAAA,MAAW,KAAA,IAAS,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,CAAA;AACtF,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,MAAA;AAAA,UACA,KAAA,CAAM,qCAAA;AAAA,UACN,QAAA,CAAS,EAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA;AAAA,MACF,KAAK,eAAA;AACH,QAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,YAAY,QAAA,EAAU,QAAA,CAAS,SAAS,CAAA;AACjE,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,MAAA;AAAA,UACA,KAAA,CAAM,qCAAA;AAAA,UACN,QAAA,CAAS,EAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA;AAAA,MACF,KAAK,qBAAA;AACH,QAAA,KAAA,CAAM,wCAAwC,QAAA,CAAS,EAAA;AACvD,QAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,kBAAkB,OAAA,EAAS,QAAA,CAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAC9E,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAiB,EAAE,CAAA;AACnD,QAAA;AAAA,MACF,KAAK,wBAAA;AACH,QAAA,IAAA,CAAK,eAAA,CAAgB;AAAA,UACnB,IAAA,EAAM,wBAAA;AAAA,UACN,MAAA;AAAA,UACA,EAAA;AAAA,UACA,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,UAC7B,QAAA,EAAU,SAAS,OAAA,CAAQ,QAAA;AAAA,UAC3B,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAM7B,QAAA,EAAU;AAAA,SACX,CAAA;AACD,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAC7C,QAAA;AAAA,MACF,KAAK,cAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAE,CAAA;AAC5C,QAAA;AAAA,MACF,KAAK,eAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAY,EAAE,CAAA;AAC9C,QAAA;AAAA,MACF,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAE,CAAA;AAC5C,QAAA;AAAA,MACF,KAAK,gBAAA;AACH,QAAA,IAAA,CAAK,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAa,EAAE,CAAA;AAC/C,QAAA;AAAA,MACF;AACE,QAAA;AAAA;AACJ,EACF;AAAA;AAAA,EAGA,4BAAA,CAA6B,QAAgB,EAAA,EAAkB;AAC7D,IAAA,IAAA,CAAK,gBAAgB,EAAE,IAAA,EAAM,iCAAA,EAAmC,MAAA,EAAQ,IAAI,CAAA;AAC5E,IAAA,IAAA,CAAK,kBAAA,CAAmB,MAAA,EAAQ,SAAA,EAAW,EAAE,CAAA;AAAA,EAC/C;AAAA;AAAA,EAGA,IAAA,GAAa;AACX,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACxC,MAAA,IAAI,KAAA,CAAM,YAAA,KAAiB,MAAA,EAAW,YAAA,CAAa,MAAM,YAAY,CAAA;AACrE,MAAA,KAAA,CAAM,cAAA,EAAe;AACrB,MAAA,KAAA,CAAM,MAAM,KAAA,EAAM;AAAA,IACpB;AACA,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAClB,IAAA,IAAA,CAAK,cAAc,KAAA,EAAM;AACzB,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EAC1B;AAAA,EAEA,WAAA,CAAY,KAAA,EAAuB,MAAA,EAAgB,IAAA,EAAiB,EAAA,EAAkB;AAIpF,IAAA,IAAI,MAAM,eAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AACnD,IAAA,IAAA,CAAK,eAAA,CAAgB;AAAA,MACnB,IAAA,EAAM,YAAA;AAAA,MACN,MAAA;AAAA,MACA,KAAA,EAAO,IAAA;AAAA,MACP,EAAA;AAAA,MACA,GAAI,MAAM,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,KAAA,CAAM,gBAAA,EAAiB;AAAA,MAC3F,GAAI,MAAM,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,KAAA,CAAM,cAAA;AAAe,KACtF,CAAA;AACD,IAAA,IAAI,IAAA,KAAS,UAAA,IAAc,IAAA,KAAS,QAAA,IAAY,SAAS,WAAA,EAAa;AACtE,IAAA,KAAA,CAAM,eAAA,GAAkB,IAAA;AACxB,IAAA,KAAA,CAAM,cAAA,EAAe;AAQrB,IAAA,KAAA,CAAM,MAAM,KAAA,EAAM;AAClB,IAAA,IAAA,CAAK,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAA,CAAiB,QAAgB,KAAA,EAA6B;AAC5D,IAAA,IAAI,KAAA,CAAM,iBAAiB,MAAA,EAAW;AACtC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IAC3B,CAAA,EAAG,KAAK,YAAY,CAAA;AACpB,IAAA,KAAA,CAAM,KAAA,IAAQ;AACd,IAAA,KAAA,CAAM,YAAA,GAAe,KAAA;AAAA,EACvB;AAAA,EAEA,KAAA,CAAM,MAAA,EAAgB,WAAA,GAAc,KAAA,EAAuB;AACzD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,IAAA,IAAI,cAAA;AACJ,IAAA,MAAM,QAAA,GAAW,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC9C,MAAA,cAAA,GAAiB,OAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,MAAM,OAAA,GAA0B;AAAA,MAC9B,KAAA,EAAO,IAAI,eAAA,CAAiC;AAAA,QAC1C,aAAa,IAAA,CAAK,YAAA;AAAA,QAClB,gBAAA,EAAkB;AAAA,OACnB,CAAA;AAAA,MACD,QAAA;AAAA,MACA,cAAA;AAAA,MACA,eAAA,EAAiB,KAAA;AAAA,MACjB,WAAA;AAAA,MACA,OAAO;AAAC,KACV;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAA,EAAQ,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AACF,CAAA;AAEA,SAAS,aAAA,CAAc,OAAe,IAAA,EAAsB;AAC1D,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,EAAG,IAAI,CAAA,gCAAA,CAAkC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,KAAA;AACT;;;AC9UO,SAAS,WAAA,CAAY,SAAsB,OAAA,EAAiD;AACjG,EAAA,IAAI,OAAA,CAAQ,YAAA,KAAiB,MAAA,EAAW,OAAO,WAAA;AAC/C,EAAA,QAAQ,QAAQ,MAAA;AAAQ,IACtB,KAAK,UAAA;AACH,MAAA,OAAO,UAAA;AAAA,IACT,KAAK,QAAA;AACH,MAAA,OAAO,QAAA;AAAA,IACT,KAAK,WAAA;AAAA,IACL,KAAK,kBAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,OAAA,KAAY,SAAY,SAAA,GAAY,eAAA;AAAA,IAC7C,KAAK,SAAA;AACH,MAAA,OAAO,OAAA,KAAY,SAAY,SAAA,GAAY,eAAA;AAAA,IAC7C,KAAK,SAAA;AACH,MAAA,OAAO,OAAA,KAAY,SAAY,SAAA,GAAY,eAAA;AAAA;AAEjD;AAYO,SAAS,aAAa,QAAA,EAA8D;AACzF,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAS,KAAA,KAAU,UAAA,GAAa,aAAa,QAAA,CAAS,KAAA,KAAU,WAAW,QAAA,GAAW,WAAA;AAAA,IAC7F,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,YAAY,QAAA,CAAS,UAAA;AAAA,IACrB,YAAA,EAAc,SAAS,YAAA,KAAiB,MAAA,GAAY,SAAY,CAAC,GAAG,SAAS,YAAY,CAAA;AAAA,IACzF,GAAI,SAAS,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,QAAA,CAAS,QAAA,EAAS;AAAA,IACzE,GAAI,SAAS,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAO;AAAA,IACnE,GAAI,SAAS,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,QAAA,CAAS,SAAA;AAAU,GAC9E;AACF;AAmBO,SAAS,cAAA,CACd,OAAA,EACA,OAAA,EACA,QAAA,EACA,UAAA,EACc;AACd,EAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AAIpC,EAAA,MAAM,UAAA,GAAa,MAAA,EAAQ,UAAA,IAAc,UAAA,EAAY,UAAA;AACrD,EAAA,OAAO;AAAA,IACL,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,KAAA,EAAO,WAAA,CAAY,OAAA,EAAS,OAAO,CAAA;AAAA,IACnC,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,UAAA;AAAA,IACA,GAAI,QAAQ,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAS;AAAA,IACvE,SAAA,EAAW,UAAA,EAAY,SAAA,IAAa,OAAA,CAAQ,SAAA;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAO;AAAA,IACzC,GAAI,SAAS,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,iBAAA,EAAmB,OAAA,CAAQ,UAAA,EAAW;AAAA,IACrF,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB;AAAA,IAC/F,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,IACzF,GAAI,QAAQ,0BAAA,KAA+B,MAAA,GACvC,EAAC,GACD,EAAE,0BAAA,EAA4B,OAAA,CAAQ,0BAAA;AAA2B,GACvE;AACF;AASO,SAAS,aAAA,CAAc,QAAsB,UAAA,EAAuD;AACzG,EAAA,OAAO;AAAA,IACL,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,SAAA,EAAW,YAAY,SAAA,IAAa,KAAA;AAAA,IACpC,UAAU,UAAA,EAAY,QAAA;AAAA,IACtB,GAAI,YAAY,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,UAAA,CAAW,aAAA,EAAc;AAAA,IAC7F,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,QAAA,EAAU,YAAY,QAAA,KAAa,MAAA,GAAY,SAAY,CAAC,GAAG,WAAW,QAAQ,CAAA;AAAA,IAClF,kBAAA,EACE,YAAY,kBAAA,KAAuB,MAAA,GAAY,SAAY,CAAC,GAAG,WAAW,kBAAkB;AAAA,GAChG;AACF;;;AC1FA,IAAM,2BAAA,GAA8B,EAAA;AACpC,IAAM,aAAA,GAAgB,GAAA;AAiBtB,IAAM,2BAAA,GAA8B,GAAA;AASpC,IAAM,4BAAA,GAA+B,GAAA;AAO9B,IAAM,cAAN,MAAkB;AAAA,EACN,iBAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA,uBAAc,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYlC,uBAAA;AAAA;AAAA,EAEA,iBAAA;AAAA;AAAA,EAET,eAAA,GAAkB,CAAA;AAAA,EAE1B,WAAA,CAAY,IAAA,GAA2B,EAAC,EAAG;AACzC,IAAA,MAAM,iBAAA,GAAoB,KAAK,iBAAA,IAAqB,2BAAA;AACpD,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,aAAA;AAC5B,IAAA,MAAM,iBAAA,GAAoB,KAAK,iBAAA,IAAqB,2BAAA;AACpD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,iBAAiB,CAAA,IAAK,qBAAqB,CAAA,EAAG;AACjE,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,gEAAA,EAAmE,iBAAiB,CAAA,CAAE,CAAA;AAAA,IAC5G;AAIA,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,QAAQ,CAAA,EAAG;AACxC,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,qDAAA,EAAwD,KAAK,CAAA,CAAE,CAAA;AAAA,IACrF;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,iBAAiB,CAAA,IAAK,oBAAoB,CAAA,EAAG;AAChE,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,iEAAA,EAAoE,iBAAiB,CAAA,CAAE,CAAA;AAAA,IAC7G;AACA,IAAA,IAAA,CAAK,iBAAA,GAAoB,iBAAA;AACzB,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,iBAAA,GAAoB,iBAAA;AACzB,IAAA,IAAA,CAAK,uBAAA,GAA2B,QAAQ,iBAAA,GAAqB,GAAA;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,GAAA,EAAsB;AAC5B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,sBAAsB,GAAG,CAAA;AAE9B,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,CAAC,MAAA,EAAQ;AAKX,MAAA,IAAA,CAAK,uBAAA,EAAwB;AAC7B,MAAA,MAAA,GAAS,EAAE,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,cAAc,GAAA,EAAI;AACjD,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAAA,IAC9B,CAAA,MAAO;AACL,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,YAAA;AAC/B,MAAA,IAAI,YAAY,CAAA,EAAG;AACjB,QAAA,MAAA,CAAO,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,KAAA,EAAO,OAAO,MAAA,GAAU,SAAA,GAAY,GAAA,GAAQ,IAAA,CAAK,iBAAiB,CAAA;AAChG,QAAA,MAAA,CAAO,YAAA,GAAe,GAAA;AAAA,MACxB;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,OAAO,KAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,IAAU,CAAA;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,sBAAsB,GAAA,EAAmB;AAC/C,IAAA,IAAA,CAAK,eAAA,EAAA;AACL,IAAA,IAAI,IAAA,CAAK,kBAAkB,4BAAA,EAA8B;AACzD,IAAA,IAAA,CAAK,eAAA,GAAkB,CAAA;AACvB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,CAAA,IAAK,KAAK,OAAA,EAAS;AACxC,MAAA,IAAI,GAAA,GAAM,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK,uBAAA,EAAyB;AAC7D,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCQ,uBAAA,GAAgC;AACtC,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,IAAA,GAAO,IAAA,CAAK,iBAAA,EAAmB;AAChD,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,kBAAA,GAAqB,QAAA;AACzB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,CAAA,IAAK,KAAK,OAAA,EAAS;AACxC,MAAA,IAAI,MAAA,CAAO,eAAe,kBAAA,EAAoB;AAC5C,QAAA,kBAAA,GAAqB,MAAA,CAAO,YAAA;AAC5B,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAAA,IACF;AACA,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,OAAO,SAAS,CAAA;AAAA,EAC5D;AACF,CAAA;AAuCO,SAAS,gCAAA,CACd,SACA,aAAA,EAC4B;AAC5B,EAAA,MAAM,QAAA,GAAuC,EAAE,WAAA,EAAa,CAAA,EAAG,iBAAiB,CAAA,EAAE;AAElF,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,MAAA,EAAgB,QAAA,EAAoC;AAChE,QAAA,QAAA,CAAS,WAAA,IAAe,CAAA;AACxB,QAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACjC,QAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxB,UAAA,QAAA,CAAS,OAAO,GAAG,CAAA;AACnB,UAAA,OAAO,IAAA;AAAA,QACT;AACA,QAAA,QAAA,CAAS,eAAA,IAAmB,CAAA;AAC5B,QAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACtB,UAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,UAAA,aAAA,CAAc,QAAA,EAAA,iBAAU,IAAI,IAAA,EAAK,EAAE,aAAa,CAAA;AAAA,QAClD;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AACF,GACF;AACF;ACxQO,SAAS,6CAAA,CACd,IACA,mBAAA,EACA,OAAA,EACA,QAAoC,CAAC,QAAA,KAAa,QAAA,CAAS,KAAA,EAAM,EAC1D;AACP,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,EAAE,CAAA;AAAA,EACV,SAAS,UAAA,EAAY;AACnB,IAAA,MAAM,IAAI,cAAA,CAAe,CAAC,mBAAA,EAAqB,UAAU,GAAG,OAAO,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,mBAAA;AACR;AAeO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAChD,YAAY,KAAA,EAAgB;AAC1B,IAAA,KAAA;AAAA,MACE;AAAA,KAIF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AAGA,IAAM,cAAA,GAAiB,EAAA;AACvB,IAAM,cAAA,GAAiB,CAAA;AAsBhB,SAAS,2BAA2B,WAAA,EAA8B;AACvE,EAAA,MAAM,CAAC,QAAA,EAAU,QAAQ,CAAA,GAAI,WAAA,CAAY,MAAM,GAAG,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,OAAO,QAAQ,CAAA;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAO,QAAQ,CAAA;AAC7B,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,IAAA;AAC/D,EAAA,OAAO,KAAA,GAAQ,cAAA,IAAmB,KAAA,KAAU,cAAA,IAAkB,KAAA,IAAS,cAAA;AACzE;AAEA,IAAI,YAAA;AAgBJ,SAAS,gBAAA,GAAiD;AACxD,EAAA,IAAI,cAAc,OAAO,YAAA;AACzB,EAAA,IAAI,CAAC,0BAAA,CAA2B,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,IAAI,KAAA;AAAA,QACF,gCAAgC,cAAc,CAAA,CAAA,EAAI,cAAc,CAAA,YAAA,EAAe,OAAA,CAAQ,SAAS,IAAI,CAAA;AAAA;AACtG,KACF;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAMA,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAA,YAAA,GAAeA,SAAQ,aAAa,CAAA;AACpC,IAAA,OAAO,YAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,uBAAuB,GAAG,CAAA;AAAA,EACtC;AACF;AAuBA,IAAM,uBAAA,GAA0B,GAAA;AAGhC,IAAM,gBAAA,GAAmB,GAAA;AAEzB,IAAM,eAAA,GAAkB,GAAA;AAkBjB,SAAS,kBAAA,CACd,IAAA,EACA,OAAA,EACA,MAAA,EACc;AACd,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,gBAAA,EAAiB;AAC1C,EAAA,IAAI,SAAS,UAAA,EAAY;AACvB,IAAA,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA,EAAG,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,iBAAiB,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa,IAAA,EAAM,EAAE,OAAA,EAAS,uBAAA,EAAyB,GAAG,OAAA,EAAS,CAAA;AAClF,EAAA,IAAI;AACF,IAAA,MAAA,EAAQ,SAAS,YAAY,CAAA;AAC7B,IAAA,IAAI,SAAS,UAAA,EAAY;AACvB,MAAA,EAAA,CAAG,KAAK,4BAA4B,CAAA;AACpC,MAAA,MAAA,EAAQ,SAAS,WAAW,CAAA;AAAA,IAC9B;AACA,IAAA,OAAO,EAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,6CAAA;AAAA,MACE,EAAA;AAAA,MACA,KAAA;AAAA,MACA,6EAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AACF;AAkBO,SAAS,4BAA4B,MAAA,EAAsB;AAChE,EAAA,IAAI,WAAW,UAAA,EAAY;AAC3B,EAAA,KAAA,MAAW,SAAA,IAAa,CAAC,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAM,CAAA,EAAG;AAClE,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,SAAA,CAAU,WAAW,gBAAgB,CAAA;AAAA,IACvC;AAAA,EACF;AACF;AChNO,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAwB7B,SAAS,cAAA,CAAe,KAAU,KAAA,EAAuB;AACvD,EAAA,MAAM,KAAA,GAAQ,IAAI,KAAK,CAAA;AACvB,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,KAAK,CAAA,CAAE,CAAA;AACrG,EAAA,OAAO,KAAA;AACT;AACA,SAAS,aAAa,KAAA,EAAmC;AACvD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAA,IAAA,KAAQ,OAAO,IAAA,KAAS,QAAQ,CAAA,EAAG;AACzE,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,KAAK,CAAC,CAAA;AACjC;AACA,SAAS,QAAQ,GAAA,EAAwB;AACvC,EAAA,MAAM,QAAQ,GAAA,CAAI,eAAA;AAClB,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,CAAC,OAAO,aAAA,CAAc,KAAK,CAAA,IAAK,KAAA,GAAQ,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAAA,IACzC,QAAA,EAAU,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAAA,IACzC,SAAA,EAAW,cAAA,CAAe,GAAA,EAAK,YAAY,CAAA;AAAA,IAC3C,UAAA,EAAY,cAAA,CAAe,GAAA,EAAK,aAAa,CAAA;AAAA,IAC7C,eAAA,EAAiB,cAAA,CAAe,GAAA,EAAK,mBAAmB,CAAA;AAAA,IACxD,UAAA,EAAY,cAAA,CAAe,GAAA,EAAK,cAAc,CAAA;AAAA,IAC9C,aAAA,EAAe,KAAA;AAAA,IACf,OAAA,EAAS,KAAA;AAAA,IACT,GAAI,GAAA,CAAI,UAAA,KAAe,IAAA,GAAO,EAAC,GAAI,EAAE,SAAA,EAAW,cAAA,CAAe,GAAA,EAAK,YAAY,CAAA,EAAE;AAAA,IAClF,GAAI,GAAA,CAAI,iBAAA,KAAsB,IAAA,GAAO,EAAC,GAAI;AAAA,MACxC,YAAA,EAAc,aAAa,IAAA,CAAK,KAAA,CAAM,eAAe,GAAA,EAAK,mBAAmB,CAAC,CAAC;AAAA,KACjF;AAAA,IACA,GAAI,GAAA,CAAI,cAAA,KAAmB,IAAA,GAAO,EAAC,GAAI;AAAA,MACrC,SAAA,EAAW,uBAAuB,KAAA,CAAM,IAAA,CAAK,MAAM,cAAA,CAAe,GAAA,EAAK,gBAAgB,CAAC,CAAC;AAAA;AAC3F,GACF;AACF;AAGO,IAAM,wBAAN,MAAuD;AAAA,EAC5D,YAA6B,WAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EAA2B;AAAA,EAA3B,WAAA;AAAA,EAE7B,QAAA,CAAS,QAAkB,KAAA,EAAkD;AAC3E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAA,EAAA,KAAM;AAGxC,MAAA,MAAM,QAAQ,EAAA,CAAG,OAAA,CAAQ,4DAA4D,CAAA,CAAE,GAAA,CAAI,MAAM,QAAQ,CAAA;AACzG,MAAA,IAAI,KAAA,KAAU,UAAa,KAAA,CAAM,SAAA,KAAc,QAAQ,MAAM,IAAI,MAAM,6CAA6C,CAAA;AACpH,MAAA,IAAI,KAAA,CAAM,cAAc,MAAA,EAAW;AACjC,QAAA,EAAA,CAAG,OAAA,CAAQ,2GAA2G,CAAA,CACnH,GAAA,CAAI,MAAA,EAAQ,MAAM,SAAA,EAAW,KAAA,CAAM,SAAA,EAAW,KAAA,CAAM,QAAQ,CAAA;AAAA,MACjE;AACA,MAAA,EAAA,CAAG,OAAA,CAAQ,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yDAAA,CAOyC,CAAA,CACjD,GAAA;AAAA,QAAI,MAAA;AAAA,QAAQ,KAAA,CAAM,QAAA;AAAA,QAAU,KAAA,CAAM,SAAA;AAAA,QAAW,MAAM,SAAA,IAAa,IAAA;AAAA,QAC/D,KAAA,CAAM,UAAA;AAAA,QAAY,KAAA,CAAM,eAAA;AAAA,QAAiB,KAAA,CAAM,UAAA;AAAA,QAAY,KAAA,CAAM;AAAA,OAAa;AAClF,MAAA,OAAO,OAAA,CAAQ,GAAG,OAAA,CAAQ,sEAAsE,EAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAE,CAAA;AAAA,IAChI,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,GAAA,CAAI,QAAkB,QAAA,EAAqD;AACzE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAA,EAAA,KAAM;AAChC,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sEAAsE,CAAA,CAAE,GAAA,CAAI,QAAQ,QAAQ,CAAA;AACnH,MAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,OAAA,CAAQ,GAAG,CAAA;AAAA,IACpD,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAA,CAAO,QAAkB,QAAA,EAAiC;AACxD,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAA,EAAA,KAAM;AAChC,MAAA,EAAA,CAAG,OAAA,CAAQ,oEAAoE,CAAA,CAAE,GAAA,CAAI,QAAQ,QAAQ,CAAA;AAAA,IACvG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAK,MAAA,EAAoD;AACvD,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAA,EAAA,KAAM,EAAA,CAAG,OAAA,CAAQ,uEAAuE,CAAA,CACjH,GAAA,CAAI,MAAM,CAAA,CAAE,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC7B;AAAA,EAEA,kBAAkB,QAAA,EAAqD;AACrE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAA,EAAA,KAAM;AAChC,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,oDAAoD,CAAA,CAAE,IAAI,QAAQ,CAAA;AACzF,MAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,OAAA,CAAQ,GAAG,CAAA;AAAA,IACpD,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,kBAAA,CAAmB,QAAkB,KAAA,EAEC;AACpC,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAA,EAAA,KAAM;AACxC,MAAA,MAAM,GAAA,GAAM,GAAG,OAAA,CAAQ,sEAAsE,EAAE,GAAA,CAAI,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACzH,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAC9B,MAAA,OAAA,CAAQ,GAAG,CAAA;AACX,MAAA,MAAM,oBAAA,GAAuB,YAAA,CAAa,KAAA,CAAM,YAAY,CAAA;AAC5D,MAAA,MAAM,YAAY,sBAAA,CAAuB,KAAA,CAAM,KAAA,CAAM,SAAA,IAAa,EAAE,CAAA;AACpE,MAAA,EAAA,CAAG,OAAA,CAAQ,6GAA6G,CAAA,CACrH,GAAA,CAAI,KAAK,SAAA,CAAU,oBAAoB,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAC9F,MAAA,OAAO,OAAA,CAAQ,GAAG,OAAA,CAAQ,sEAAsE,EAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAE,CAAA;AAAA,IAChI,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,SAAA,CAAU,MAAA,EAAkB,QAAA,EAAmD;AACnF,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AACtC,IAAA,MAAM,YAAA,GAAe,MAAM,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AAC/C,IAAA,MAAM,gBAAA,GAAmB,IAAI,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,CAAC,IAAA,KAAS,CAAC,IAAA,CAAK,QAAA,EAAU,IAAI,CAAC,CAAC,CAAA;AAClF,IAAA,MAAM,kBAAkB,IAAI,GAAA;AAAA,MAC1B,OAAA,CAAQ,MAAA,CAAO,CAAC,MAAA,KAAW,CAAC,MAAA,CAAO,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,MAAA,KAAW,MAAA,CAAO,QAAQ;AAAA,KAC7E;AACA,IAAA,MAAM,0BAA0B,MAAA,CAAO,WAAA;AAAA,MACrC,gBAAgB,GAAA,CAAI,CAAC,UAAU,CAAC,KAAA,EAAO,CAAC,CAAC;AAAA,KAC3C;AACA,IAAA,KAAA,MAAW,QAAQ,YAAA,EAAc;AAC/B,MAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzC,MAAA,uBAAA,CAAwB,IAAA,CAAK,KAAK,CAAA,IAAK,CAAA;AAAA,IACzC;AACA,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,MAAA;AAAA,MACV,uBAAA,EAAyB,QAAQ,MAAA,CAAO,CAAC,WAAW,CAAC,MAAA,CAAO,OAAO,CAAA,CAAE,MAAA;AAAA,MACrE,oBAAoB,OAAA,CAAQ,MAAA,CAAO,CAAC,MAAA,KAAW,MAAA,CAAO,OAAO,CAAA,CAAE,MAAA;AAAA,MAC/D,qBAAA,EAAuB,MAAA,CAAO,MAAA,CAAO,uBAAuB,CAAA,CAAE,MAAA;AAAA,QAC5D,CAAC,KAAA,EAAO,KAAA,KAAU,KAAA,GAAQ,KAAA;AAAA,QAC1B;AAAA,OACF;AAAA,MACA,uBAAA;AAAA,MACA,SAAS,CAAC,GAAG,OAAO,CAAA,CACjB,IAAA,CAAK,CAAC,IAAA,EAAM,KAAA,KAAU,IAAA,CAAK,QAAA,CAAS,cAAc,KAAA,CAAM,QAAQ,CAAC,CAAA,CACjE,GAAA,CAAI,CAAC,MAAA,KAAkC;AACtC,QAAA,MAAM,OAAO,MAAA,CAAO,OAAA,GAAU,SAAY,gBAAA,CAAiB,GAAA,CAAI,OAAO,QAAQ,CAAA;AAC9E,QAAA,OAAO;AAAA,UACL,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,YAAY,MAAA,CAAO,UAAA;AAAA,UACnB,SAAS,MAAA,CAAO,OAAA;AAAA,UAChB,GAAI,IAAA,KAAS,MAAA,GACT,EAAC,GACD;AAAA,YACE,QAAA,EAAU;AAAA,cACR,OAAO,IAAA,CAAK,KAAA;AAAA,cACZ,GAAI,KAAK,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAO;AAAA,cAC3D,GAAI,KAAK,kBAAA,KAAuB,MAAA,GAC5B,EAAC,GACD,EAAE,kBAAA,EAAoB,IAAA,CAAK,kBAAA,EAAmB;AAAA,cAClD,GAAI,KAAK,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,IAAA,CAAK,aAAA,EAAc;AAAA,cAChF,GAAI,KAAK,gBAAA,KAAqB,MAAA,GAC1B,EAAC,GACD,EAAE,gBAAA,EAAkB,IAAA,CAAK,gBAAA,EAAiB;AAAA,cAC9C,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS;AAAA,cACjE,YAAY,IAAA,CAAK,UAAA;AAAA,cACjB,WAAW,IAAA,CAAK;AAAA;AAClB;AACF,SACN;AAAA,MACF,CAAC;AAAA,KACL;AAAA,EACF;AAEF,CAAA;;;ACpIA,IAAM,0BAAA,GAA6B,EAAA;AACnC,IAAM,yBAAA,GAA4B,GAAA;AAClC,IAAM,0BAA0B,EAAA,GAAK,GAAA;AACrC,IAAM,oBAAA,GAAuB,EAAA;AAC7B,IAAM,qBAAA,GAAwB,GAAA;AAI9B,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAUvB,IAAM,MAAA,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAkGf,IAAM,oBAAN,MAAwB;AAAA,EACb,EAAA;AAAA,EACT,KAAA,GAAuB,QAAQ,OAAA,EAAQ;AAAA,EACvC,QAAA,GAAW,KAAA;AAAA,EACX,aAAA;AAAA,EAEA,WAAA,CAAY,MAAc,SAAA,EAAqC;AAC7D,IAAA,IAAA,CAAK,EAAA,GAAK,mBAAmB,IAAI,CAAA;AACjC,IAAA,IAAI;AAGF,MAAA,IAAA,CAAK,EAAA,CAAG,KAAK,iBAAiB,CAAA;AAC9B,MAAA,IAAI;AACF,QAAA,MAAM,cAAc,IAAA,CAAK,EAAA,CACtB,OAAA,CAAQ,2FAA2F,EACnG,GAAA,EAAI;AACP,QAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAC7B,UAAA,MAAM,UAAU,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,iEAAiE,EAC9F,GAAA,EAAI;AACP,UAAA,IAAI,OAAA,EAAS,KAAA,KAAU,qBAAA,IAAyB,EAAG,OAAA,EAAS,KAAA,KAAU,GAAA,IAAO,SAAA,KAAc,UAAA,IAAgB,OAAA,EAAS,KAAA,KAAU,GAAA,IAAO,cAAc,UAAA,CAAA,EAAc;AAC/J,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,IAAA,CAAK,SAAA,CAAU,SAAS,KAAK,CAAC,CAAA,sBAAA,EAC/D,qBAAqB,CAAA,2JAAA,CAA6J,CAAA;AAAA,UAC7M;AAEA,UAAA,KAAA,MAAW,UAAA,IAAc;AAAA,YACvB,0FAAA;AAAA,YACA,4GAAA;AAAA,YACA,mPAAA;AAAA,YACA,0FAAA;AAAA,YACA,iHAAA;AAAA,YACA,qEAAA;AAAA,YACA;AAAA,WACF,EAAG;AACD,YAAA,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,CAAA,OAAA,EAAU,UAAU,CAAA,QAAA,CAAU,CAAA;AAAA,UAChD;AACA,UAAA,IAAI,OAAA,EAAS,UAAU,qBAAA,EAAuB;AAG5C,YAAA,KAAA,MAAW,KAAA,IAAS,CAAC,cAAA,EAAgB,iBAAA,EAAmB,yBAAyB,CAAA,EAAG;AAClF,cAAA,IAAI,IAAA,CAAK,GAAG,OAAA,CAAQ,CAAA,cAAA,EAAiB,KAAK,CAAA,QAAA,CAAU,CAAA,CAAE,GAAA,EAAI,KAAM,KAAA,CAAA,EAAW;AACzE,gBAAA,MAAM,IAAI,MAAM,uIAAuI,CAAA;AAAA,cACzJ;AAAA,YACF;AACA,YAAA,IAAI,KAAK,EAAA,CAAG,OAAA,CAAQ,kGAAkG,CAAA,CAAE,GAAA,OAAU,KAAA,CAAA,EAAW;AAC3I,cAAA,MAAM,IAAI,MAAM,2IAA2I,CAAA;AAAA,YAC7J;AACA,YAAA,IAAI,KAAK,EAAA,CAAG,OAAA,CAAQ,4DAA4D,CAAA,CAAE,GAAA,OAAU,KAAA,CAAA,EAAW;AACrG,cAAA,MAAM,IAAI,MAAM,mEAAmE,CAAA;AAAA,YACrF;AACA,YAAA,IAAA,CAAK,EAAA,CAAG,KAAK,cAAc,CAAA;AAAA,UAC7B;AACA,UAAA,IAAI,OAAA,EAAS,UAAU,GAAA,EAAK;AAC1B,YAAA,MAAM,aAAa,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,6DAA6D,EAAE,GAAA,EAAI;AACtG,YAAA,IAAI,UAAA,KAAe,KAAA,CAAA,EAAW,MAAM,IAAI,MAAM,sDAAsD,CAAA;AACpG,YAAA,IAAA,CAAK,EAAA,CAAG,KAAK,aAAa,CAAA;AAAA,UAC5B;AACA,UAAA,IAAI,OAAA,EAAS,UAAU,qBAAA,EAAuB;AAC5C,YAAA,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,oEAAoE,CAAA,CAAE,IAAI,qBAAqB,CAAA;AAAA,UACjH;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,WAAW,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,+EAA+E,EAAE,GAAA,EAAI;AACtH,UAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAClG,UAAA,IAAA,CAAK,EAAA,CAAG,KAAK,MAAM,CAAA;AACnB,UAAA,IAAA,CAAK,EAAA,CAAG,KAAK,cAAc,CAAA;AAC3B,UAAA,IAAA,CAAK,EAAA,CAAG,KAAK,aAAa,CAAA;AAC1B,UAAA,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,wEAAwE,CAAA,CAAE,IAAI,qBAAqB,CAAA;AAAA,QACrH;AACA,QAAA,IAAA,CAAK,EAAA,CAAG,QAAQ,qLAAqL,CAAA;AACrM,QAAA,MAAM,iBAAiB,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,oCAAoC,EAAE,GAAA,EAAI;AAEjF,QAAA,MAAM,eAAA,GAAkB,CAAC,WAAA,EAAa,KAAA,EAAO,QAAQ,aAAa,CAAA;AAClE,QAAA,IAAI,cAAA,CAAe,MAAA,KAAW,eAAA,CAAgB,MAAA,IAAU,cAAA,CAAe,IAAA,CAAK,CAAC,MAAA,EAAQ,KAAA,KACnF,MAAA,CAAO,IAAA,KAAS,eAAA,CAAgB,KAAK,CAAA,IAAK,MAAA,CAAO,IAAA,KAAS,MAAA,IAAU,MAAA,CAAO,OAAA,KAAY,CAAA,IACvF,MAAA,CAAO,EAAA,MAAQ,KAAA,GAAQ,CAAA,GAAI,KAAA,GAAQ,CAAA,GAAI,CAAA,CAAE,CAAA,EAAG;AAC5C,UAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,QAC9D;AACA,QAAA,IAAA,CAAK,EAAA,CAAG,KAAK,QAAQ,CAAA;AAAA,MACvB,SAAS,KAAA,EAAO;AACd,QAAA,IAAA,CAAK,EAAA,CAAG,KAAK,UAAU,CAAA;AACvB,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,2BAAA,CAA4B,IAAI,CAAA;AAAA,IAClC,SAAS,KAAA,EAAO;AACd,MAAA,6CAAA;AAAA,QACE,IAAA,CAAK,EAAA;AAAA,QAAI,KAAA;AAAA,QACT;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAO,SAAA,EAA6D;AAClE,IAAA,IAAI,IAAA,CAAK,UAAU,OAAO,OAAA,CAAQ,OAAO,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAC3F,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,SAAA,CAAU,IAAA,CAAK,EAAE,CAAC,CAAA;AACvD,IAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,MAAA,EAAW,MAAM,MAAS,CAAA;AACzD,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,YAAe,SAAA,EAA6D;AAC1E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,OAAO,EAAA,KAAO;AAC5B,MAAA,EAAA,CAAG,KAAK,iBAAiB,CAAA;AACzB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,EAAE,CAAA;AACjC,QAAA,EAAA,CAAG,KAAK,QAAQ,CAAA;AAChB,QAAA,OAAO,MAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAK,UAAU,CAAA;AAAA,QACpB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,GAAuB;AACrB,IAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW,OAAO,IAAA,CAAK,aAAA;AAClD,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,IAAA,CAAK,EAAA,CAAG,OAAO,CAAA;AAC1D,IAAA,OAAO,IAAA,CAAK,aAAA;AAAA,EACd;AACF,CAAA;AAkBA,SAAS,QAAQ,GAAA,EAA2B;AAC1C,EAAA,OAAO;AAAA,IACL,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,QAAQ,GAAA,CAAI,OAAA;AAAA,IACZ,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,GAAI,GAAA,CAAI,cAAA,KAAmB,IAAA,GAAO,EAAC,GAAI,EAAE,QAAA,EAAU,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,cAAc,CAAA,EAAc;AAAA,IAC9F,GAAI,IAAI,eAAA,KAAoB,IAAA,GAAO,EAAC,GAAI,EAAE,aAAA,EAAe,GAAA,CAAI,eAAA,EAAgB;AAAA,IAC7E,GAAI,IAAI,eAAA,KAAoB,IAAA,GAAO,EAAC,GAAI,EAAE,cAAA,EAAgB,GAAA,CAAI,eAAA,EAA6B;AAAA,IAC3F,GAAI,GAAA,CAAI,iCAAA,KAAsC,IAAA,GAC1C,EAAC,GACD,EAAE,0BAAA,EAA4B,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,iCAAiC,CAAA,EAAyB;AAAA,IAC3G,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,GAAI,IAAI,cAAA,KAAmB,IAAA,GAAO,EAAC,GAAI,EAAE,aAAA,EAAe,GAAA,CAAI,cAAA,EAAe;AAAA,IAC3E,GAAI,GAAA,CAAI,yBAAA,KAA8B,IAAA,GAClC,EAAC,GACD;AAAA,MACE,YAAA,EAAc;AAAA,QACZ,aAAa,GAAA,CAAI,yBAAA;AAAA,QACjB,GAAI,IAAI,mBAAA,KAAwB,IAAA,GAAO,EAAC,GAAI,EAAE,MAAA,EAAQ,GAAA,CAAI,mBAAA;AAAoB;AAChF,KACF;AAAA,IACJ,WAAW,GAAA,CAAI;AAAA,GACjB;AACF;AAEA,SAAS,QAAA,CAAS,EAAA,EAAkB,MAAA,EAAkB,MAAA,EAAyC;AAC7F,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,gEAAgE,CAAA,CAAE,GAAA,CAAI,QAAQ,MAAM,CAAA;AAG3G,EAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,OAAA,CAAQ,GAAG,CAAA;AACpD;AAEA,SAAS,YAAA,CAAa,MAA4B,KAAA,EAAsC;AACtF,EAAA,OAAO,MAAM,OAAA,KAAY,KAAA,EAAO,OAAA,IAAW,IAAA,EAAM,oBAAoB,KAAA,EAAO,eAAA;AAC9E;AAGA,IAAM,4BAAN,MAA+D;AAAA,EAC7D,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,MAAA,CAAO,QAAkB,KAAA,EAA8F;AAGrH,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,SAAS,EAAA,CAAG,OAAA;AAAA,QAChB,CAAA;AAAA,gDAAA;AAAA,OAEF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,GAAA,EAAK,KAAA,CAAM,IAAA,EAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAa,CAAA;AACnE,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,IAAI,MAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,EAAI,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,OAAO,MAAM,CAAA,EAAE;AAAA,IAC9F,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,GAAA,CAAI,QAAkB,GAAA,EAAkD;AACtE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO,KAAK,KAAA,CAAM,EAAA,EAAI,MAAA,EAAQ,GAAG,CAAC,CAAA;AAAA,EACjE;AAAA,EAEA,KAAA,CAAM,EAAA,EAAkB,MAAA,EAAkB,GAAA,EAAyC;AACjF,IAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,+EAA+E,CAAA,CACnG,GAAA,CAAI,QAAQ,GAAG,CAAA;AAClB,IAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,EAAE,QAAA,EAAU,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,UAAA,EAAY,GAAA,CAAI,WAAA,EAAY;AAAA,EAC9G;AACF,CAAA;AAEO,IAAM,yBAAN,MAAyD;AAAA,EAC9D,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,IAAA,CAAK,QAAkB,KAAA,EAAwF;AAC7G,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA,0CAAA;AAAA,QAGA,GAAA,CAAI,MAAA,EAAQ,MAAM,MAAA,EAAQ,KAAA,CAAM,UAAU,KAAA,CAAM,QAAA,KAAa,MAAA,GAAY,IAAA,GAAO,KAAK,SAAA,CAAU,KAAA,CAAM,QAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAC7H,MAAA,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAAA,IAC1C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,iBAAA,CACE,QACA,KAAA,EACqD;AACrD,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,SAAS,EAAA,CAAG,OAAA;AAAA,QAChB,CAAA;AAAA;AAAA,0CAAA;AAAA,OAGF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,QAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AACvF,MAAA,OAAO,EAAE,OAAA,EAAS,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA,EAAI,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,OAAO,MAAM,CAAA,EAAE;AAAA,IAC/F,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,mBAAA,CACE,QACA,KAAA,EAC8C;AAC9C,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AACjD,MAAA,IAAI,YAAY,MAAA,IAAa,OAAA,CAAQ,QAAA,KAAa,KAAA,CAAM,UAAU,OAAO,UAAA;AACzE,MAAA,MAAM,WAAW,EAAA,CAAG,OAAA;AAAA,QAClB;AAAA,OACF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1B,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,OAAO,QAAA,CAAS,eAAe,KAAA,CAAM,SAAA,IAAa,SAAS,YAAA,KAAiB,KAAA,CAAM,cAC9E,SAAA,GACA,UAAA;AAAA,MACN;AAIA,MAAA,IACE,OAAA,CAAQ,YAAA,KAAiB,MAAA,IACzB,CAAC,CAAC,SAAA,EAAW,SAAA,EAAW,SAAS,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,MAAM,GAC1D,OAAO,UAAA;AACT,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,4BAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,SAAA,EAAW,MAAM,WAAW,CAAA;AAC9D,MAAA,OAAO,UAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,gBAAA,CACE,QACA,KAAA,EAC4C;AAC5C,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AACjD,MAAA,IAAI,OAAA,EAAS,QAAA,KAAa,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AACjD,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,QACb,CAAA;AAAA,oFAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,SAAA,EAAW,MAAM,WAAW,CAAA;AAG9D,MAAA,OAAO,GAAA,KAAQ,SACX,MAAA,GACA;AAAA,QACE,WAAW,GAAA,CAAI,UAAA;AAAA,QACf,aAAa,GAAA,CAAI,YAAA;AAAA,QACjB,GAAI,IAAI,aAAA,KAAkB,IAAA,GAAO,EAAC,GAAI,EAAE,YAAA,EAAc,GAAA,CAAI,aAAA;AAAc,OAC1E;AAAA,IACN,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,oBAAA,CACE,QACA,KAAA,EAC4C;AAC5C,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AACjD,MAAA,IAAI,OAAA,EAAS,QAAA,KAAa,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AACjD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,8GAAA;AAAA,OAEF,CAAE,GAAA,CAAI,KAAA,CAAM,YAAA,EAAc,MAAA,EAAQ,MAAM,MAAA,EAAQ,KAAA,CAAM,SAAA,EAAW,KAAA,CAAM,WAAW,CAAA;AAClF,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,QACb,CAAA;AAAA,oFAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,KAAA,CAAM,SAAA,EAAW,MAAM,WAAW,CAAA;AAG9D,MAAA,OAAO,GAAA,KAAQ,SACX,MAAA,GACA;AAAA,QACE,WAAW,GAAA,CAAI,UAAA;AAAA,QACf,aAAa,GAAA,CAAI,YAAA;AAAA,QACjB,GAAI,IAAI,aAAA,KAAkB,IAAA,GAAO,EAAC,GAAI,EAAE,YAAA,EAAc,GAAA,CAAI,aAAA;AAAc,OAC1E;AAAA,IACN,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,GAAA,CAAI,QAAkB,MAAA,EAAkD;AACtE,IAAA,OAAO,IAAA,CAAK,YAAY,GAAA,CAAI,CAAC,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EAClE;AAAA,EAEA,OAAA,CAAQ,QAAkB,OAAA,EAA6D;AACrF,IAAA,OAAO,IAAA,CAAK,YAAY,GAAA,CAAI,CAAC,OAAO,OAAA,CAAQ,OAAA,CAAQ,CAAC,MAAA,KAAW;AAC9D,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAC3C,MAAA,OAAO,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,CAAC,OAAO,CAAA;AAAA,IAC9C,CAAC,CAAC,CAAA;AAAA,EACJ;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,KAAA,EAAuD;AAClF,IAAA,0BAAA,CAA2B,MAAM,KAAK,CAAA;AACtC,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,CAAA;AAAA,gDAAA;AAAA,OAEF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,UAAU,EAAA,EAAI,KAAA,CAAM,QAAQ,CAAC,CAAA;AACjD,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,GAAS,KAAA,CAAM,KAAA;AACpC,MAAA,MAAM,QAAA,GAAW,KAAK,KAAA,CAAM,CAAA,EAAG,MAAM,KAAK,CAAA,CAAE,IAAI,OAAO,CAAA;AACvD,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,EAAA,CAAG,EAAE,CAAA;AAC3B,MAAA,OAAO,EAAE,QAAA,EAAU,GAAI,OAAA,IAAW,IAAA,KAAS,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,MAAA,EAAO,GAAI,EAAC,EAAG;AAAA,IAC3F,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,CACE,QACA,KAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA;AAAA,uEAAA;AAAA,OAIF,CAAE,GAAA;AAAA,QACA,KAAA,CAAM,QAAA;AAAA,QACN,MAAM,OAAA,IAAW,IAAA;AAAA,QACjB,MAAM,YAAA,KAAiB,MAAA,GAAY,OAAO,IAAA,CAAK,SAAA,CAAU,MAAM,YAAY,CAAA;AAAA,QAC3E,KAAK,IAAA,EAAK;AAAA,QACV,MAAA;AAAA,QACA,KAAA,CAAM,MAAA;AAAA,QACN,KAAA,CAAM;AAAA,OACR;AACA,MAAA,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAAA,IAC1C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAA,CACE,QACA,KAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AAClD,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,MAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,UAAU,KAAA,CAAM,QAAQ,GAAG,OAAO,QAAA;AAC7D,MAAA,IAAI,QAAA,CAAS,iBAAiB,MAAA,EAAW;AACvC,QAAA,IAAI,MAAM,MAAA,KAAW,WAAA,IAAe,QAAA,CAAS,MAAA,KAAW,aAAa,OAAO,QAAA;AAAA,MAC9E,CAAA,MAAA,IAAW,CAAC,UAAA,EAAY,QAAA,EAAU,WAAW,CAAA,CAAE,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AACxE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,4CAAA;AAAA,OAEF,CAAE,GAAA,CAAI,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,aAAA,IAAiB,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,EAAG,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAClF,MAAA,OAAO,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAAA,IAC1C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,IAAA,GAAe;AACb,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY;AAAA,EACtC;AACF,CAAA;AAcA,SAAS,eAAe,GAAA,EAAiC;AACvD,EAAA,OAAO;AAAA,IACL,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,IACnB,WAAW,GAAA,CAAI,UAAA;AAAA,IACf,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,YAAY,GAAA,CAAI;AAAA,GAClB;AACF;AAEA,SAAS,mBAAA,CAAoB,EAAA,EAAkB,KAAA,EAAc,MAAA,EAAkB,QAAA,EAAwB;AACrG,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,MAAM,IAAI,aAAA,CAAc,2BAAA,EAA6B,8BAA8B,CAAA;AAAA,EACrF;AACA,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA,wFAAA;AAAA,GACF,CAAE,IAAI,MAAA,EAAQ,QAAA,EAAU,MAAM,GAAA,EAAI,CAAE,aAAa,CAAA;AACnD;AAEA,SAAS,UAAA,CAAW,EAAA,EAAkB,KAAA,EAAc,MAAA,EAAkB,QAAA,EAAsC;AAC1G,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,IACb,CAAA,qGAAA;AAAA,GACF,CAAE,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AACtB,EAAA,OAAO,QAAQ,MAAA,GACX,EAAE,QAAA,EAAU,MAAA,EAAQ,UAAU,YAAA,EAAc,CAAA,EAAG,QAAA,EAAU,CAAA,EAAG,WAAW,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,IAAc,GACjG;AAAA,IACE,QAAA,EAAU,MAAA;AAAA,IACV,QAAA;AAAA,IACA,YAAA,EAAc,MAAA,CAAO,GAAA,CAAI,aAAa,CAAA;AAAA,IACtC,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,WAAW,GAAA,CAAI;AAAA,GACjB;AACN;AAEA,eAAe,aAAA,CACb,EAAA,EACA,KAAA,EACA,MAAA,EACA,KAAA,EACyB;AACzB,EAAA,mBAAA,CAAoB,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AACrD,EAAA,MAAM,WAAW,EAAA,CAAG,OAAA;AAAA,IAClB,CAAA,sFAAA;AAAA,IACA,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,MAAM,SAAS,CAAA;AAC7C,EAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,cAAA,CAAe,QAAQ,CAAA;AAC1D,EAAA,MAAM,SAAS,EAAA,CAAG,OAAA;AAAA,IAChB,CAAA,yEAAA;AAAA,GACF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA;AAClC,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,WAAA,CAAY,GAAG,CAAA;AAChD,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA;AAAA;AAAA,+CAAA;AAAA,GAGF,CAAE,GAAA;AAAA,IACA,MAAA;AAAA,IACA,KAAA,CAAM,QAAA;AAAA,IACN,GAAA;AAAA,IACA,KAAA,CAAM,SAAA;AAAA,IACN,YAAA,CAAa,IAAA;AAAA,IACb,YAAA,CAAa,QAAA;AAAA,IACb,MAAA,CAAO,aAAa,QAAQ,CAAA;AAAA,IAC5B,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA;AAAY,GAC1B;AACA,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA,4EAAA;AAAA,IACA,GAAA,CAAI,GAAA,GAAM,CAAA,EAAG,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACrC,EAAA,OAAO,eAAe,EAAA,CAAG,OAAA;AAAA,IACvB,CAAA,+EAAA;AAAA,IACA,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,GAAG,CAAe,CAAA;AAClD;AAEO,IAAM,qBAAN,MAAiD;AAAA,EACtD,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,MAAA,CAAO,QAAkB,KAAA,EAAoD;AAC3E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO,aAAA,CAAc,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,KAAK,CAAC,CAAA;AAAA,EAC1F;AAAA,EAEA,SAAA,CAAU,QAAkB,KAAA,EAA+C;AACzE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,0BAAA;AAC7B,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,CAAA;AAAA;AAAA,6BAAA;AAAA,OAGF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,UAAU,KAAA,CAAM,QAAA,EAAU,QAAQ,CAAC,CAAA;AACvD,MAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,KAAK,CAAA,CAAE,IAAI,cAAc,CAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,EAAA,CAAG,EAAE,CAAA;AACvB,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,CAAA;AAAA,oEAAA;AAAA,OAEF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAC5B,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS,IAAA,EAAM,GAAA,IAAO,KAAA,CAAM,QAAA;AAAA,QAC5B,OAAA,EAAS,KAAK,MAAA,GAAS,KAAA;AAAA,QACvB,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,CAAC,CAAA,GAAI;AAAA,OAC5C;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,cAAA,CAAe,QAAkB,KAAA,EAAgE;AAC/F,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,mBAAA,CAAoB,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAC1D,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,8CAAA;AAAA,QAEA,GAAA,CAAI,KAAA,CAAM,YAAA,EAAc,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAChD,MAAA,OAAO,WAAW,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,aAAA,CAAc,QAAkB,KAAA,EAA+D;AAC7F,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,mBAAA,CAAoB,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAC1D,MAAA,MAAM,UAAU,UAAA,CAAW,EAAA,EAAI,KAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACjE,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY;AAChD,MAAA,IAAI,KAAA,CAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,EAAU;AACrC,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,2BAAA;AAAA,UACA,CAAA,kBAAA,EAAqB,MAAM,QAAQ,CAAA,OAAA,EAAU,QAAQ,QAAQ,CAAA,8BAAA,EAAiC,MAAM,QAAQ,CAAA,CAAA,CAAA;AAAA,UAC5G,OAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,KAAA,CAAM,QAAA,GAAW,OAAA,CAAQ,YAAA,EAAc;AACzC,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,kCAAA;AAAA,UACA,CAAA,kBAAA,EAAqB,MAAM,QAAQ,CAAA,uBAAA,EAA0B,QAAQ,YAAY,CAAA,wCAAA,EAA2C,MAAM,QAAQ,CAAA,CAAA,CAAA;AAAA,UAC1I,OAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA,6FAAA;AAAA,QACA,GAAA,CAAI,KAAA,CAAM,UAAU,UAAA,EAAY,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACxD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,iFAAA;AAAA,QAEA,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,MAAM,QAAQ,CAAA;AAC5C,MAAA,OAAO,WAAW,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,UAAA,CAAW,QAAkB,QAAA,EAA+C;AAC1E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO,UAAA,CAAW,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAAA,EAClF;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,KAAA,EAA+D;AACpG,IAAA,wBAAA,CAAyB,KAAA,CAAM,aAAa,aAAa,CAAA;AACzD,IAAA,wBAAA,CAAyB,KAAA,CAAM,qBAAqB,qBAAqB,CAAA;AACzE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,YAAA,GAAe,KAAA,CAAM,QAAA,KAAa,MAAA,GAAY,EAAA,GAAK,oBAAA;AACzD,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,QAAA,KAAa,MAAA,GAAY,CAAC,MAAM,CAAA,GAAI,CAAC,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAChF,MAAA,MAAM,QAAQ,EAAA,CAAG,OAAA;AAAA,QACf,CAAA;AAAA,4BAAA,EACsB,YAAY,CAAA,wCAAA;AAAA,OACpC,CAAE,GAAA,CAAI,GAAG,MAAA,EAAQ,MAAM,WAAW,CAAA;AAClC,MAAA,MAAM,UAAU,EAAA,CAAG,OAAA;AAAA,QACjB,CAAA;AAAA,4BAAA,EACsB,YAAY,CAAA,wCAAA;AAAA,OACpC,CAAE,GAAA,CAAI,GAAG,MAAA,EAAQ,MAAM,WAAW,CAAA;AAClC,MAAA,MAAM,UAAU,EAAA,CAAG,OAAA;AAAA,QACjB,CAAA;AAAA,4BAAA,EACsB,YAAY,CAAA,0CAAA;AAAA,OACpC,CAAE,GAAA,CAAI,GAAG,MAAA,EAAQ,MAAM,mBAAmB,CAAA;AAC1C,MAAA,OAAO;AAAA,QACL,YAAA,EAAc,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA;AAAA,QACpC,YAAA,EAAc,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA;AAAA,QACpC,aAAA,EAAe,KAAA,CAAM,MAAA,CAAO,CAAC,GAAA,EAAK,GAAA,KAAQ,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA,EAAG,EAAE;AAAA,OAC3E;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAEO,IAAM,8BAAN,MAAmE;AAAA,EACxE,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,OAAA,CAAQ,QAAkB,KAAA,EAA+E;AACvG,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,OAAO,EAAA,KAAO;AAChD,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,MAAM,CAAA;AAClD,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,MAAA,IACE,QAAA,CAAS,YAAA,KAAiB,MAAA,IAC1B,CAAC,YAAY,QAAA,EAAU,WAAW,CAAA,CAAE,QAAA,CAAS,SAAS,MAAM,CAAA,EAC5D,OAAO,EAAE,SAAS,QAAA,EAAS;AAE7B,MAAA,MAAM,oBAAqB,EAAA,CAAG,OAAA;AAAA,QAC5B,CAAA,oFAAA;AAAA,OACF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA,CAAiD,uBAAA;AAC3E,MAAA,IAAI,sBAAsB,IAAA,EAAM;AAC9B,QAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,UACb,CAAA,sFAAA;AAAA,SACF,CAAE,GAAA,CAAI,MAAA,EAAQ,QAAA,CAAS,UAAU,iBAAiB,CAAA;AAClD,QAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,UAAA,IAAI,SAAS,MAAA,KAAW,WAAA,EAAa,OAAO,EAAE,SAAS,QAAA,EAAS;AAChE,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,iBAAiB,CAAA,qBAAA,EAAwB,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,QAClG;AACA,QAAA,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,cAAA,CAAe,GAAG,CAAA,EAAE;AAAA,MAC3D;AAEA,MAAA,MAAM,UAAU,MAAM,aAAA,CAAc,EAAA,EAAI,IAAA,CAAK,OAAO,MAAA,EAAQ;AAAA,QAC1D,UAAU,QAAA,CAAS,QAAA;AAAA,QACnB,WAAW,KAAA,CAAM,iBAAA;AAAA,QACjB,aAAa,CAAC,GAAA,KAAQ,MAAM,WAAA,CAAY,GAAA,EAAK,MAAM,iBAAiB;AAAA,OACrE,CAAA;AACD,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY;AACjD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA;AAAA,4CAAA;AAAA,OAIF,CAAE,GAAA,CAAI,WAAA,EAAa,KAAA,CAAM,MAAA,IAAU,IAAA,EAAM,KAAA,CAAM,iBAAA,EAAmB,WAAA,EAAa,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AACnG,MAAA,OAAO,EAAE,SAAS,QAAA,CAAS,EAAA,EAAI,QAAQ,KAAA,CAAM,MAAM,GAAI,OAAA,EAAQ;AAAA,IACjE,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAcA,SAAS,YAAY,GAAA,EAAuC;AAC1D,EAAA,OAAO;AAAA,IACL,UAAU,GAAA,CAAI,SAAA;AAAA,IACd,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,aAAa,GAAA,CAAI,YAAA;AAAA,IACjB,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,WAAW,GAAA,CAAI,UAAA;AAAA,IACf,WAAW,GAAA,CAAI,UAAA;AAAA,IACf,GAAI,IAAI,iBAAA,KAAsB,IAAA,GAAO,EAAC,GAAI,EAAE,eAAA,EAAiB,GAAA,CAAI,iBAAA;AAAkB,GACrF;AACF;AAEA,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA,6EAAA,CAAA;AAKxB,SAAS,YAAA,CAAa,EAAA,EAAkB,MAAA,EAAkB,IAAA,EAAoD;AAC5G,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AAAA,IACb,GAAG,eAAe,CAAA,kEAAA;AAAA,GACpB,CAAE,GAAA,CAAI,MAAA,EAAQ,IAAI,CAAA;AAClB,EAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,WAAA,CAAY,GAAG,CAAA;AACxD;AAEA,SAAS,eAAA,CAAgB,EAAA,EAAkB,MAAA,EAAkB,IAAA,EAAwC;AACnG,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAA;AAC3C,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,MAAM,IAAI,aAAA,CAAc,kBAAA,EAAoB,CAAA,OAAA,EAAU,IAAI,CAAA,oCAAA,CAAsC,CAAA;AAAA,EAClG;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,EAAA,EAAkB,KAAA,EAAc,MAAA,EAAkB,KAAA,EAAiD;AACtH,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AACpD,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,KAAA,KAAU,WAAW,OAAO,QAAA;AACnE,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY;AACpC,EAAA,EAAA,CAAG,QAAQ,+DAA+D,CAAA,CAAE,GAAA,CAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AAClG,EAAA,EAAA,CAAG,OAAA;AAAA,IACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mGAAA;AAAA,GAMF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA,EAAG,KAAA,CAAM,WAAA,EAAa,GAAA,EAAK,GAAG,CAAA;AAC7E,EAAA,OAAO,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAC5C;AAEO,IAAM,oBAAN,MAA+C;AAAA,EACpD,WAAA,CAA6B,aAAiD,KAAA,EAAc;AAA/D,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAiD,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAhE,WAAA;AAAA,EAAiD,KAAA;AAAA,EAE9E,WAAA,CAAY,QAAkB,KAAA,EAA0D;AACtF,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO,WAAA,CAAY,EAAA,EAAI,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,KAAK,CAAC,CAAA;AAAA,EACxF;AAAA,EAEA,MAAA,CAAO,QAAkB,KAAA,EAAwD;AAC/E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,MAAA,IAAI,QAAQ,QAAA,KAAa,KAAA,CAAM,oBAAoB,OAAA,CAAQ,WAAA,KAAgB,MAAM,mBAAA,EAAqB;AACpG,QAAA,MAAM,IAAI,aAAA;AAAA,UACR,4BAAA;AAAA,UACA,CAAA,gBAAA,EAAmB,MAAM,IAAI,CAAA,sCAAA;AAAA,SAC/B;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,WAAA,EAAa,OAAO,OAAA;AAC1C,MAAA,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,EAAI,MAAA,EAAQ,SAAS,WAAW,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,GAAA,CAAI,QAAkB,IAAA,EAA6D;AACjF,IAAA,OAAO,IAAA,CAAK,YAAY,GAAA,CAAI,CAAC,OAAO,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAC,CAAA;AAAA,EACpE;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,KAAA,EAAiE;AAC5F,IAAA,IAAI,KAAA,CAAM,wBAAwB,MAAA,EAAW;AAC3C,MAAA,wBAAA,CAAyB,KAAA,CAAM,qBAAqB,qBAAqB,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAClC,MAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,QACd,GAAG,eAAe;AAAA;AAAA;AAAA,4EAAA;AAAA,OAIpB,CAAE,GAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAM,KAAA,IAAS,IAAA;AAAA,QACf,MAAM,KAAA,IAAS,IAAA;AAAA,QACf,MAAM,mBAAA,IAAuB,IAAA;AAAA,QAC7B,MAAM,mBAAA,IAAuB,IAAA;AAAA,QAC7B,MAAM,KAAA,IAAS;AAAA,OACjB;AACA,MAAA,OAAO,IAAA,CAAK,IAAI,WAAW,CAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAA,CAAa,QAAkB,KAAA,EAA2D;AACxF,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,MAAA,IAAI,OAAA,CAAQ,UAAU,WAAA,EAAa;AACjC,QAAA,MAAM,IAAI,cAAc,sBAAA,EAAwB,CAAA,0CAAA,EAA6C,MAAM,IAAI,CAAA,IAAA,EAAO,OAAA,CAAQ,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,MAChI;AACA,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA,+BAAA;AAAA,OAEF,CAAE,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,KAAA,CAAM,OAAA,EAAS,KAAA,CAAM,KAAA,EAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,aAAa,CAAA;AACpF,MAAA,EAAA,CAAG,OAAA,CAAQ,4EAA4E,CAAA,CACpF,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY,EAAG,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzD,MAAA,OAAO,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAAA,IAC/C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,eAAA,CAAgB,QAAkB,KAAA,EAA2D;AAC3F,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACtC,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA,6FAAA;AAAA,OACF,CAAE,IAAI,MAAA,EAAQ,KAAA,CAAM,MAAM,KAAA,CAAM,OAAA,EAAS,MAAM,KAAK,CAAA;AACpD,MAAA,EAAA,CAAG,OAAA,CAAQ,4EAA4E,CAAA,CACpF,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,WAAA,EAAY,EAAG,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzD,MAAA,OAAO,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAAA,IAC/C,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,iBAAA,CAAkB,QAAkB,IAAA,EAAiD;AACnF,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AAC1C,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAA;AAChD,MAAA,IAAI,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC1B,QAAA,MAAM,IAAI,cAAc,sBAAA,EAAwB,CAAA,OAAA,EAAU,IAAI,CAAA,WAAA,EAAc,OAAA,CAAQ,QAAQ,CAAA,cAAA,CAAgB,CAAA;AAAA,MAC9G;AACA,MAAA,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,EAAI,MAAA,EAAQ,SAAS,gBAAgB,CAAA;AAAA,IAC/D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,WAAA,CAAY,QAAkB,IAAA,EAAiD;AAC7E,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,CAAC,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,EAAI,MAAA,EAAQ,gBAAgB,EAAA,EAAI,MAAA,EAAQ,IAAI,CAAA,EAAG,SAAS,CAAC,CAAA;AAAA,EACxH;AAAA,EAEA,WAAA,CACE,EAAA,EACA,MAAA,EACA,OAAA,EACA,IAAA,EACqB;AACrB,IAAA,IAAI,CAAC,uBAAA,CAAwB,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,cAAc,sBAAA,EAAwB,CAAA,EAAG,QAAQ,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,2CAAA,CAA6C,CAAA;AAAA,IAC1H;AACA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY;AACzC,IAAA,EAAA,CAAG,OAAA;AAAA,MACD,CAAA;AAAA,uCAAA;AAAA,KAEF,CAAE,GAAA,CAAI,IAAA,EAAM,GAAA,EAAK,IAAA,KAAS,gBAAA,GAAmB,GAAA,GAAM,OAAA,CAAQ,eAAA,IAAmB,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,IAAI,CAAA;AACxG,IAAA,OAAO,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,OAAA,CAAQ,IAAI,CAAA;AAAA,EACjD;AACF,CAAA;AAaA,SAAS,oBAAA,CAAqB,QAAkB,WAAA,EAAuC;AACrF,EAAA,IACE,WAAA,CAAY,QAAA,KAAa,MAAA,IACzB,WAAA,CAAY,IAAA,KAAS,QAAA,IACrB,WAAA,CAAY,KAAA,KAAU,UAAA,IACtB,WAAA,CAAY,aAAA,IAAiB,EAAA,EAC7B;AACF,EAAA,MAAM,IAAI,aAAA;AAAA,IACR,4BAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,IAAM,qBAAN,MAAyB;AAAA,EAIvB,WAAA,CACW,WAAA,EACA,KAAA,EACA,MAAA,EACT,QAAA,EACA;AAJS,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAGT,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,MAAM,MAAM,WAAA,CAAY,EAAA,CAAG,OAAA,CAAQ,sEAAsE,EAAE,GAAA,EAAI;AAG/G,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,QAAQ,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,oBAAoB,CAAC,CAAA;AACpF,MAAA,WAAA,CAAY,EAAA,CAAG,OAAA;AAAA,QACb;AAAA,OACF,CAAE,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,QAAA,CAAS,WAAW,CAAC,CAAA;AAAA,IAChD;AACA,IAAA,MAAM,SAAS,WAAA,CAAY,EAAA,CAAG,OAAA,CAAQ,sEAAsE,EAAE,GAAA,EAAI;AAClH,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,OAAO,WAAW,CAAA;AAAA,EACrD;AAAA,EAjBW,WAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EANF,MAAA;AAAA,EACA,QAAA;AAAA,EAsBT,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAwC;AACpE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,KAAI,CAAE,OAAA,KAAY,IAAA,CAAK,QAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AAClF,IAAA,OAAO,GAAG,mBAAA,CAAoB,MAAM,CAAC,CAAA,KAAA,EAAQ,GAAG,QAAQ,GAAG,CAAA,CAAA;AAAA,EAC7D;AACF,CAAA;AAEO,IAAM,uBAAN,MAAqD;AAAA,EAC1D,YAA6B,QAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAA+B;AAAA,EAA/B,QAAA;AAAA,EAE7B,MAAM,YAAA,CAAa,MAAA,EAAkB,WAAA,EAAiF;AACpH,IAAA,oBAAA,CAAqB,QAAQ,WAAW,CAAA;AACxC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,SAAS,WAAA,CAAY,WAAA,CAAY,CAAC,EAAA,KAAO;AACjE,MAAA,MAAM,WAAW,EAAA,CAAG,OAAA;AAAA,QAClB;AAAA,OACF,CAAE,GAAA,CAAI,MAAA,EAAQ,WAAA,CAAY,aAAa,CAAA;AACvC,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,MAAM,QAAA,GAAW,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,YAAY,WAAW,CAAA;AACjE,QAAA,IAAI,QAAA,EAAU,UAAU,WAAA,EAAa;AACnC,UAAA,MAAM,IAAI,aAAA,CAAc,sBAAA,EAAwB,CAAA,OAAA,EAAU,WAAA,CAAY,WAAW,CAAA,oCAAA,CAAsC,CAAA;AAAA,QACzH;AACA,QAAA,OAAO,QAAA,CAAS,OAAA;AAAA,MAClB;AACA,MAAA,MAAM,QAAQ,WAAA,CAAY,EAAA,EAAI,IAAA,CAAK,QAAA,CAAS,OAAO,MAAA,EAAQ;AAAA,QACzD,MAAM,WAAA,CAAY,WAAA;AAAA,QAClB,UAAU,WAAA,CAAY,aAAA;AAAA,QACtB,aAAa,WAAA,CAAY;AAAA,OAC1B,CAAA;AACD,MAAA,IAAI,MAAM,QAAA,KAAa,WAAA,CAAY,iBAAiB,KAAA,CAAM,WAAA,KAAgB,YAAY,WAAA,EAAa;AACjG,QAAA,MAAM,IAAI,aAAA,CAAc,4BAAA,EAA8B,CAAA,OAAA,EAAU,WAAA,CAAY,WAAW,CAAA,+CAAA,CAAiD,CAAA;AAAA,MAC1I;AACA,MAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,QAAA,MAAM,IAAI,aAAA,CAAc,sBAAA,EAAwB,CAAA,OAAA,EAAU,WAAA,CAAY,WAAW,CAAA,oCAAA,CAAsC,CAAA;AAAA,MACzH;AACA,MAAA,MAAM,UAAU,CAAA,KAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,CAAA;AACzD,MAAA,EAAA,CAAG,OAAA;AAAA,QACD,CAAA;AAAA;AAAA,kCAAA;AAAA,OAGF,CAAE,GAAA,CAAI,OAAA,EAAS,MAAA,EAAQ,WAAA,CAAY,aAAA,EAAe,WAAA,CAAY,WAAA,EAAa,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA,EAAG,YAAY,WAAW,CAAA;AACrI,MAAA,OAAO,OAAA;AAAA,IACT,CAAC,CAAA;AACD,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAM,KAAK,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAE;AAAA,EACzE;AAAA,EAEA,aAAA,CAAc,MAAA,EAAkB,MAAA,EAAgB,WAAA,EAAuE;AACrH,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAC3C,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IACE,QAAQ,MAAA,IAAa,GAAA,CAAI,cAAc,MAAA,IAAU,WAAA,CAAY,aAAa,MAAA,IAC1E,GAAA,CAAI,mBAAmB,WAAA,CAAY,aAAA,IAAiB,IAAI,YAAA,KAAiB,WAAA,CAAY,eAAe,CAAC,GAAA,CAAI,UACzG,OAAO,MAAA;AACT,MAAA,OAAO,EAAE,gBAAA,EAAkB,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,cAAc,CAAC,CAAA,EAAG,mBAAA,EAAqB,GAAA,CAAI,YAAA,EAAa;AAAA,IACtG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,MAAA,EAA6C;AAClF,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,SAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AACxD,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IAAI,GAAA,KAAQ,UAAa,GAAA,CAAI,SAAA,KAAc,UAAU,CAAC,GAAA,CAAI,UAAU,OAAO,KAAA;AAC3E,MAAA,OAAO,aAAa,EAAA,EAAI,MAAA,EAAQ,GAAA,CAAI,YAA2B,GAAG,KAAA,KAAU,WAAA;AAAA,IAC9E,CAAC,CAAA;AACD,IAAA,OAAO,QAAQ,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,GAAI,MAAA;AAAA,EACxD;AACF,CAAA;AAEO,IAAM,yBAAN,MAAyD;AAAA,EAC9D,YAA6B,QAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAA+B;AAAA,EAA/B,QAAA;AAAA,EAE7B,MAAM,eAAA,CAAgB,MAAA,EAAgB,MAAA,EAAuB,KAAa,GAAA,EAA+B;AACvG,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,KAAK,OAAO,KAAA;AAC/E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,UAAA,CAAW,IAAA,CAAK,QAAA,CAAS,MAAA,EAAQ,GAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AACzG,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,eAAA,CAAgB,UAAU,GAAG,CAAA;AAAA,EAC3D;AAAA,EAEA,oBAAoB,MAAA,EAA6C;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAC3C,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,8CAA8C,CAAA,CAAE,IAAI,MAAM,CAAA;AACjF,MAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,MAAA,CAAO,IAAI,SAAS,CAAA;AAAA,IAC7D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAA,CAAa,QAAgB,IAAA,EAA4C;AACvE,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,OAAO,EAAA,KAAO;AACjD,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IAAI,QAAQ,MAAA,EAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gBAAA,EAAiB;AACpE,MAAA,IAAI,OAAO,IAAA,CAAK,MAAM,MAAM,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA,EAAG;AACjD,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,wBAAA,EAA2B,IAAI,SAAS,CAAA,WAAA,EAAc,IAAA,CAAK,MAAM,CAAA,CAAA,EAAG;AAAA,MAClG;AACA,MAAA,IAAI,MAAM,KAAK,QAAA,CAAS,MAAA,CAAO,OAAO,IAAI,CAAA,KAAM,IAAI,YAAA,EAAc;AAChE,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,MACrD;AACA,MAAA,EAAA,CAAG,OAAA,CAAQ,0DAA0D,CAAA,CAAE,GAAA,CAAI,MAAM,MAAM,CAAA;AACvF,MAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,IACpB,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,YAAY,MAAA,EAAqD;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,GAAA,CAAI,CAAC,EAAA,KAAO;AAC3C,MAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AACzE,MAAA,IAAI,GAAA,KAAQ,UAAa,CAAC,GAAA,CAAI,YAAY,GAAA,CAAI,IAAA,KAAS,MAAM,OAAO,MAAA;AACpE,MAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,GAAA,CAAI,IAAA,CAAK,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,UAAA,EAAY,GAAA,CAAI,IAAA,CAAK,UAAU,CAAA;AACrF,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAa,GAAA,CAAI,YAAA,EAAa,EAAE;AAAA,IACtE,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAGO,SAAS,0BAAA,CACd,SACA,YAAA,EACsB;AACtB,EAAA,MAAM,cAAc,IAAI,iBAAA,CAAkB,OAAA,CAAQ,IAAA,EAAM,QAAQ,SAAS,CAAA;AACzE,EAAA,MAAM,OAAA,GAAU,IAAI,iBAAA,CAAkB,WAAA,EAAa,aAAa,KAAK,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,WAAA,EAAa,aAAa,KAAK,CAAA;AACtE,EAAA,MAAM,KAAA,GAAQ,IAAI,sBAAA,CAAuB,WAAA,EAAa,aAAa,KAAK,CAAA;AACxE,EAAA,MAAM,aAAA,GAAgB,IAAI,2BAAA,CAA4B,WAAA,EAAa,aAAa,KAAK,CAAA;AACrF,EAAA,MAAM,WAAW,IAAI,kBAAA;AAAA,IACnB,WAAA;AAAA,IACA,YAAA,CAAa,KAAA;AAAA,IACb,YAAA,CAAa,MAAA;AAAA,IACb,QAAQ,QAAA,IAAY;AAAA,GACtB;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,oBAAA,CAAqB,QAAQ,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,IAAI,sBAAA,CAAuB,QAAQ,CAAA;AAE5D,EAAA,MAAM,eAAe,wBAAA,CAAyB,EAAE,OAAO,YAAA,CAAa,KAAA,EAAO,CAAA,CAAE,MAAA;AAC7E,EAAA,MAAM,IAAA,GAAmB;AAAA,IACvB,GAAG,YAAA;AAAA,IACH,OAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA,EAAO,IAAI,kBAAA,CAAmB,YAAA,CAAa,OAAO,OAAO;AAAA,GAC3D;AACA,EAAA,MAAM,aAAA,GAAgB,yBAAA;AAAA,IACpB,YAAA,CAAa,KAAA;AAAA,IACb,YAAA,CAAa,MAAA;AAAA,IACb,OAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,qBAAA,CAAsB,WAAW,CAAA;AACrD,EAAA,MAAM,OAAA,GAAU,IAAI,wBAAA,CAAyB,YAAA,CAAa,OAAO,OAAO,CAAA;AACxE,EAAA,MAAM,KAAA,GAAqB;AAAA,IACzB,GAAG,aAAA,CAAc,MAAA;AAAA,IACjB,OAAA;AAAA,IACA,cAAc,EAAE,KAAA,EAAO,QAAQ,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,EAAE;AAAA,IACnD,SAAS,EAAE,iBAAA,EAAmB,QAAQ,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA,EAAE;AAAA,IACtE,KAAA;AAAA,IACA,QAAA,EAAU,IAAI,yBAAA,CAA0B,WAAA,EAAa,aAAa,KAAK,CAAA;AAAA,IACvE,aAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO,EAAE,MAAM,KAAA,EAAO,gBAAA,EAAkB,OAAO,MAAM,WAAA,CAAY,OAAM,EAAE;AAC3E;;;ACnmCO,IAAM,2BAAA,GAA8B,MAAM,IAAA,GAAO,IAAA;AAQxD,SAAS,WAAA,GAAqB;AAC5B,EAAA,OAAO,EAAE,GAAA,EAAK,sBAAM,IAAI,MAAK,EAAE;AACjC;AAWO,SAAS,eAAe,SAAA,EAA6B;AAC1D,EAAA,OAAO,QAAA,CAAS,CAAA,QAAA,EAAW,SAAS,CAAA,CAAE,CAAA;AACxC;AAiCO,SAAS,oBAAoB,OAAA,EAAqD;AACvF,EAAA,MAAM,QAAQ,WAAA,EAAY;AAC1B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,MAAM,MAAA,GACJ,OAAA,CAAQ,OAAA,EAAS,IAAA,KAAS,QAAA,GACtB,0BAAA;AAAA,IACE;AAAA,MACE,IAAA,EAAM,QAAQ,OAAA,CAAQ,IAAA;AAAA,MACtB,GAAI,OAAA,CAAQ,OAAA,CAAQ,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,OAAA,CAAQ,OAAA,CAAQ,SAAA,EAAU;AAAA,MAC1F,GAAI,OAAA,CAAQ,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,QAAA,EAAU,OAAA,CAAQ,OAAA,CAAQ,QAAA;AAAS,KACzF;AAAA,IACA,EAAE,OAAO,MAAA;AAAO,GAClB,GACA,MAAA;AACN,EAAA,MAAM,YAAA,GAAe,WAAW,MAAA,GAAYC,wBAAAA,CAAyB,EAAE,KAAA,EAAO,EAAE,MAAA,GAAS,MAAA;AACzF,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,YAAA;AAC7B,EAAA,MAAM,aAAA,GACJ,MAAA,KAAW,MAAA,GAAYC,yBAAAA,CAA0B,KAAA,EAAO,QAAQ,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,OAAO,CAAA,GAAI,MAAA;AAChG,EAAA,MAAM,MAAA,GAAS,MAAA,EAAQ,KAAA,IAAS,aAAA,CAAe,MAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,MAAA,EAAQ,gBAAA,IAAoB,aAAA,CAAe,gBAAA;AAEpE,EAAA,MAAM,WAAA,GAAc,gCAAA;AAAA,IAClB,IAAI,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAAA,IACjC,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA;AAExC,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC/B,IAAI,WAAA,GAAsB;AACxB,MAAA,OAAO,YAAY,QAAA,CAAS,WAAA;AAAA,IAC9B,CAAA;AAAA,IACA,IAAI,UAAA,GAAqB;AACvB,MAAA,OAAO,MAAM,KAAA,EAAM;AAAA,IACrB,CAAA;AAAA,IACA,IAAI,eAAA,GAA0B;AAC5B,MAAA,OAAO,YAAY,QAAA,CAAS,eAAA;AAAA,IAC9B;AAAA,GACF;AAOA,EAAA,KAAK,IAAA,CAAK,KAAA,CAAM,gBAAA,CAAiB,OAAA,CAAQ,MAAA,EAAQ;AAAA,IAC/C,OAAA,EAAS,EAAA;AAAA,IACT,cAAA,EAAgB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,GAAI,KAAA;AAAA,IACnD,cAAA,EAAgB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IAC/C,cAAA,EAAgB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IAC/C,iBAAA,EAAmB,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,GAAI,KAAA;AAAA,IACtD,iBAAA,EAAmB;AAAA,GACpB,CAAA;AAED,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,iBAAiB,IAAA,CAAK,OAAA,EAAS,OAAA,CAAQ,WAAW,CAAA,EAAE;AAAA,IAC9E,OAAO,EAAE,GAAG,QAAQ,WAAA,EAAa,WAAA,CAAY,SAAS,KAAA,EAAM;AAAA,IAC5D,gBAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAO,MAAM,MAAA,EAAQ,KAAA,EAAM,IAAK,QAAQ,OAAA;AAAQ,GAClD;AACF;AAWA,SAAS,cAAc,KAAA,EAA8C;AACnE,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO;AAAA,IACL,MAAM,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,UAAA,EAA8B;AACnE,MAAA,MAAM,OAAO,MAAM,KAAA,CAAM,cAAA,CAAe,MAAA,EAAQ,UAAU,UAAU,CAAA;AACpE,MAAA,IAAI,MAAM,KAAA,IAAS,CAAA;AACnB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,mBAAA,CAAoB,MAAA,EAAQ,QAAA,EAAU,UAAU,UAAA,EAA8B;AAClF,MAAA,MAAM,OAAO,MAAM,KAAA,CAAM,oBAAoB,MAAA,EAAQ,QAAA,EAAU,UAAU,UAAU,CAAA;AACnF,MAAA,IAAI,MAAM,KAAA,IAAS,CAAA;AACnB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,OAAO,MAAM;AAAA,GACf;AACF;AAWA,SAAS,gBAAA,CAAiB,OAAqB,WAAA,EAA8C;AAC3F,EAAA,OAAO;AAAA,IACL,QAAQ,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,IACrD,WAAW,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,SAAA,CAAU,QAAQ,KAAK,CAAA;AAAA,IAC3D,gBAAgB,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,cAAA,CAAe,QAAQ,KAAK,CAAA;AAAA,IACrE,eAAe,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,aAAA,CAAc,QAAQ,KAAK,CAAA;AAAA,IACnE,UAAA,EAAY,CAAC,MAAA,EAAQ,QAAA,KAAa;AAChC,MAAA,WAAA,CAAY,MAAM,QAAA,EAAA,iBAAU,IAAI,IAAA,EAAK,EAAE,aAAa,CAAA;AACpD,MAAA,OAAO,KAAA,CAAM,UAAA,CAAW,MAAA,EAAQ,QAAQ,CAAA;AAAA,IAC1C,CAAA;AAAA,IACA,gBAAgB,CAAC,MAAA,EAAQ,UAAU,KAAA,CAAM,cAAA,CAAe,QAAQ,KAAK;AAAA,GACvE;AACF;ACvMA,SAAS,qBAAA,CACP,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EACQ;AACR,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,eAAA;AACH,MAAA,OAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA,CAAA;AAAA,IAC9E,KAAK,kBAAA;AACH,MAAA,OAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,qBAAA,EAAwB,KAAK,CAAA,CAAA,CAAA;AAAA,IACjE,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,kBAAA,EAAqB,OAAA,IAAW,WAAW,CAAA,0BAAA,CAAA;AAAA;AAEnF;AA2BO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,MAAA;AAAA,EACA,IAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,OAAA;AAAA,EAET,WAAA,CACE,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,qBAAA,CAAsB,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AACzD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;AAGA,IAAM,kCAA0C,IAAI,GAAA,CAAe,CAAC,UAAA,EAAY,QAAA,EAAU,WAAW,CAAC,CAAA;AAgBtG,SAAS,WAAA,CAAY,YAAgC,KAAA,EAAsC;AACzF,EAAA,OAAO,eAAA,CAAgB,GAAA,CAAI,KAAK,CAAA,GAAI,eAAA,GAAkB,UAAA;AACxD;AAyBO,SAAS,gBAAA,CAAiB,QAAgB,IAAA,EAAkC;AAIjF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA;AAE3C,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IAEA,MAAA,GAAyC;AACvC,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AAAA,IACjC,CAAA;AAAA,IAEA,MAAM,OAAO,MAAA,EAAgC;AAC3C,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,WAAW,IAAA,CAAK,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAIvE,MAAA,IAAI,OAAA,CAAQ,iBAAiB,MAAA,EAAW;AACxC,MAAA,IAAA,CAAK,MAAM,kBAAA,CAAmB,MAAA,EAAQ,WAAA,EAAa,OAAA,CAAQ,aAAa,WAAW,CAAA;AAAA,IACrF,CAAA;AAAA,IAEA,MAAM,QAAQ,IAAA,EAA+C;AAC3D,MAAA,MAAM,KAAK,KAAA,CAAM,WAAA,CAAY,IAAA,CAAK,MAAA,EAAQ,QAAQ,IAAI,CAAA;AAItD,MAAA,IAAA,CAAK,KAAA,CAAM,mBAAmB,MAAA,EAAQ,SAAA,EAAA,qBAAe,IAAA,EAAK,EAAE,aAAa,CAAA;AAAA,IAC3E,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,MAAA,EAAiB,IAAA,EAA+C;AAC3E,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK,QAAQ,MAAA,EAAQ;AAAA,QAC/C,GAAI,MAAM,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AAAA,QACxE,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,OAC1C,CAAA;AACD,MAAA,IAAA,CAAK,KAAA,CAAM,mBAAmB,MAAA,EAAQ,SAAA,EAAA,qBAAe,IAAA,EAAK,EAAE,aAAa,CAAA;AAAA,IAC3E,CAAA;AAAA,IAEA,MAAM,MAAM,IAAA,EAA6B;AACvC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,CAAK,MAAM,SAAA,CAAU,IAAA,CAAK,QAAQ,MAAA,EAAQ,EAAE,MAAM,CAAA;AAAA,MAC1D,SAAS,MAAA,EAAQ;AACf,QAAA,IAAI,EAAE,MAAA,YAAkBC,oBAAA,CAAA,EAA2B,MAAM,MAAA;AACzD,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAKzC,QAAA,IAAI,KAAA,KAAU,QAAW,MAAM,MAAA;AAC/B,QAAA,MAAM,IAAI,kBAAA,CAAmB,MAAA,EAAQ,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA,EAAG,KAAA,EAAO,MAAA,CAAO,OAAO,CAAA;AAAA,MAC7F;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,GAA8B;AAIlC,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA;AACpD,MAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,MAAA,MAAM,QAAA;AACN,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA;AAC3C,MAAA,IAAI,WAAW,MAAA,EAAW;AAIxB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,MAAM,CAAA,2CAAA,CAA6C,CAAA;AAAA,MAC7E;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,GACF;AACF;AC/EA,IAAM,yBAAA,GAA4B,GAAA;AAElC,IAAM,yBAAA,GAA4B,GAAA;AAElC,IAAM,yBAAA,GAA4B,CAAA;AAElC,IAAM,wBAAA,GAA2B,CAAA;AAEjC,IAAM,kBAAA,GAAqB,EAAA;AAEpB,IAAM,uBAAA,GAA0B;AA6KhC,SAAS,iBAAiB,IAAA,EAA2C;AAC1E,EAAA,MAAM,WAAA,GAAc,KAAK,GAAA,EAAI;AAC7B,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,SAAS,CAAA;AAC5C,EAAA,MAAM,gBAAA,GAAmB,KAAK,gBAAA,IAAoB,2BAAA;AAClD,EAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,IAAkB,yBAAA;AAE9C,EAAA,MAAM,WAAA,GAAc,IAAI,iBAAA,EAAkB;AAC1C,EAAA,MAAM,KAAA,GAAQ,IAAI,cAAA,CAAe;AAAA,IAC/B,WAAA;AAAA,IACA,GAAI,KAAK,oBAAA,KAAyB,MAAA,GAAY,EAAC,GAAI,EAAE,oBAAA,EAAsB,IAAA,CAAK,oBAAA,EAAqB;AAAA,IACrG,GAAI,KAAK,oBAAA,KAAyB,MAAA,GAAY,EAAC,GAAI,EAAE,oBAAA,EAAsB,IAAA,CAAK,oBAAA;AAAqB,GACtG,CAAA;AAED,EAAA,MAAM,cAAc,mBAAA,CAAoB;AAAA,IACtC,MAAA;AAAA,IACA,gBAAA;AAAA,IACA,GAAI,KAAK,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAS,IAAA,CAAK,OAAA,EAAQ;AAAA,IAC9D,GAAI,KAAK,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAU;AAAA,IACpE,WAAA;AAAA,IACA,aAAA,EAAe,CAAC,QAAA,EAAU,EAAA,KAAO,KAAA,CAAM,eAAA,CAAgB,EAAE,IAAA,EAAM,qBAAA,EAAuB,QAAA,EAAU,EAAA,EAAI;AAAA,GACrG,CAAA;AAED,EAAA,MAAM,WAAA,GACJ,KAAK,WAAA,IACL,qBAAA;AAAA,IACE,WAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,kBAAkB,CAAC,CAAA;AAAA,IACpE,WAAA,CAAY;AAAA,GACd;AAEF,EAAA,MAAM,QAAmB,eAAA,CAAgB;AAAA,IACvC,MAAM,WAAA,CAAY,IAAA;AAAA,IAClB,OAAO,WAAA,CAAY,KAAA;AAAA,IACnB,kBAAkB,WAAA,CAAY,gBAAA;AAAA,IAC9B,QAAQ,WAAA,CAAY,MAAA;AAAA,IACpB,WAAA;AAAA,IACA,OAAO,WAAA,CAAY,KAAA;AAAA,IACnB,cAAc,yBAAA,EAA0B;AAAA;AAAA;AAAA,IAGxC,mBAAmB,IAAA,CAAK,SAAA;AAAA,IACxB,QAAA,EAAU,KAAA;AAAA,IACV,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAC,GAAI,EAAE,YAAA,EAAc,IAAA,CAAK,YAAA,EAAa;AAAA,IAC7E,gBAAA;AAAA,IACA,cAAA;AAAA,IACA,kBAAA,EAAoB,iBAAiB,cAAc;AAAA,GACpD,CAAA;AAMD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA2B;AAElD,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AACtB,EAAA,IAAI,IAAA,CAAK,iBAAiB,IAAA,EAAM;AAI9B,IAAA,IAAA,CAAK,IAAI,UAAA,EAAY,CAAC,CAAA,KAAM,CAAA,CAAE,KAAK,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,KAAK,GAAA,EAAI,GAAI,WAAA,EAAY,EAAG,GAAG,CAAC,CAAA;AAAA,EAC3F;AAIA,EAAA,IAAA,CAAK,GAAA,CAAI,KAAK,CAAC,CAAA,KAAM,MAAM,KAAA,CAAM,CAAA,CAAE,GAAA,CAAI,GAAG,CAAC,CAAA;AAE3C,EAAA,eAAe,YAAY,MAAA,EAAsD;AAC/E,IAAA,OAAO,gBAAgB,MAAM,KAAA,CAAM,oBAAA,CAAqB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACzE;AAEA,EAAA,eAAe,aAAa,MAAA,EAAqD;AAC/E,IAAA,OAAO,KAAA,CAAM,cAAA,CAAe,MAAA,EAAQ,MAAM,CAAA;AAAA,EAC5C;AAEA,EAAA,eAAe,YAAY,OAAA,EAA6C;AACtE,IAAA,MAAM,CAAC,OAAA,EAAS,QAAQ,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI,CAAC,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA,EAAG,YAAA,CAAa,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA;AACzG,IAAA,OAAO,cAAA,CAAe,SAAS,OAAA,EAAS,QAAA,EAAU,WAAW,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,EAClF;AASA,EAAA,eAAe,cAAc,MAAA,EAAgD;AAC3E,IAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,eAAA,CAAgB,QAAQ,MAAM,CAAA;AAC1D,IAAA,OAAO,YAAY,MAAA,GAAY,MAAA,GAAA,CAAa,MAAM,WAAA,CAAY,OAAO,CAAA,EAAG,KAAA;AAAA,EAC1E;AAcA,EAAA,KAAA,CAAM,cAAA,GAAiB,CACrB,MAAA,EACA,8BAAA,EACA,0BACA,UAAA,KACS;AACT,IAAA,KAAA,CAAM,YAAY;AAKhB,MAAA,IAAI,mCAAmC,MAAA,EAAW;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,MAAM,CAAA;AACxC,MAAA,IACE,OAAA,KAAY,MAAA,IACZ,OAAA,CAAQ,gBAAA,KAAqB,8BAAA,EAC7B;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,eAAA,CAAgB,QAAQ,MAAM,CAAA;AAC1D,MAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,MAAA,MAAM,gBAAA,GAAmB,MAAM,WAAA,CAAY,MAAA,CAAO,MAAA;AAAA,QAChD,IAAI,aAAY,CAAE,MAAA;AAAA,UAChB,KAAK,SAAA,CAAU;AAAA,YACb,MAAA,EAAQ,wBAAA;AAAA,YACR,MAAA;AAAA,YACA,MAAA;AAAA,YACA,UAAU,OAAA,CAAQ,QAAA;AAAA,YAClB,eAAe,OAAA,CAAQ,aAAA;AAAA,YACvB,UAAU,OAAA,CAAQ,QAAA;AAAA,YAClB,yBAAyB,OAAA,CAAQ,gBAAA;AAAA,YACjC,iBAAiB,OAAA,CAAQ,QAAA;AAAA,YACzB;AAAA,WACD;AAAA;AACH,OACF;AACA,MAAA,MAAM,WAAW,MAAM,WAAA,CAAY,KAAA,CAAM,SAAA,CAAU,eAAe,MAAA,EAAQ;AAAA,QACxE,MAAA;AAAA,QACA,gBAAA;AAAA,QACA,0BAA0B,OAAA,CAAQ,gBAAA;AAAA,QAClC,kBAAkB,OAAA,CAAQ,QAAA;AAAA,QAC1B,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,mBAAA;AAAA,UACN,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAAA,UAC7E,QAAA,EAAU,SAAA;AAAA,UACV,UAAA,EAAY,MAAA;AAAA,UACZ,EAAA,EAAI;AAAA;AACN,OACD,CAAA;AACD,MAAA,IAAI,QAAA,CAAS,MAAA,KAAW,SAAA,IAAa,QAAA,CAAS,WAAW,UAAA,EAAY;AACnE,QAAA,KAAA,CAAM,4BAAA,CAA6B,QAAQ,UAAU,CAAA;AAAA,MACvD;AAAA,IACF,CAAA,GAAG,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,EAC5B,CAAA;AAEA,EAAA,eAAe,4BAAA,GAA2D;AACxE,IAAA,MAAM,aAAgC,EAAC;AACvC,IAAA,KAAA,MAAW,QAAA,IAAY,WAAA,CAAY,GAAA,EAAI,EAAG;AACxC,MAAA,IAAI,CAAC,WAAA,CAAY,WAAA,CAAY,QAAQ,CAAA,EAAG;AACxC,MAAA,MAAM,SAAS,MAAM,WAAA,CAAY,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,QAAQ,CAAA;AACnE,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,OAAA,EAAS;AAC5C,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,QAAA;AAAA,QACA,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,kBAAA,EAAoB,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA,EAAG;AAAA,OAChD,CAAA;AAAA,IACH;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAEA,EAAA,eAAe,mBAAmB,QAAA,EAA0D;AAC1F,IAAA,OAAA,CAAQ,MAAM,WAAA,CAAY,KAAA,CAAM,QAAQ,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA,GAAI,YAAA;AAAA,EAClE;AAEA,EAAA,eAAe,iBAAiB,QAAA,EAAiC;AAC/D,IAAA,IAAI,CAAC,WAAA,CAAY,WAAA,CAAY,QAAQ,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,OAAA,EAAU,QAAQ,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC/F;AAGA,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,eAAe,oBAAA,CAAqB,OAAsD,KAAA,EAAqC;AAC7H,IAAA,MAAM,UAAA,GAAa,EAAE,GAAG,KAAA,EAAM;AAC9B,IAAA,MAAM,SAAS,UAAA,CAAW,MAAA;AAC1B,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,OAAO,gBAAA,CAAiB,YAAY,KAAK,CAAA;AACnE,IAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,CAAO,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,mCAAmC,CAAA;AAC1G,IAAA,IAAI,MAAM,QAAA,KAAa,MAAA,EAAW,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAC/F,IAAA,IAAI,YAAY,GAAA,CAAI,MAAM,GAAG,MAAM,IAAI,MAAM,8EAA8E,CAAA;AAC3H,IAAA,WAAA,CAAY,IAAI,MAAM,CAAA;AACtB,IAAA,IAAI;AAAE,MAAA,OAAO,MAAM,gBAAA,CAAiB,UAAA,EAAY,KAAK,CAAA;AAAA,IAAG,CAAA,SACxD;AAAU,MAAA,WAAA,CAAY,OAAO,MAAM,CAAA;AAAA,IAAG;AAAA,EACxC;AAEA,EAAA,eAAe,gBAAA,CACb,OACA,gBAAA,EACqB;AACrB,IAAA,MAAM,UAAA,GAAa,YAAA,IAAgB,KAAA,GAAQ,KAAA,CAAM,UAAA,GAAa,MAAA;AAC9D,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,KAAa,MAAA,GAAY,SAAY,cAAA,CAAe,KAAA,CAAM,MAAM,QAAQ,CAAA;AAC/F,IAAA,MAAM,YAAA,GACJ,MAAM,YAAA,KAAiB,MAAA,GAAY,SAAY,uBAAA,CAAwB,KAAA,CAAM,MAAM,YAAY,CAAA;AACjG,IAAA,MAAM,aAAA,GACJ,MAAM,aAAA,KAAkB,MAAA,GAAY,SAAY,mCAAA,CAAoC,KAAA,CAAM,MAAM,aAAa,CAAA;AAC/G,IAAA,MAAM,kBAAA,GACJ,MAAM,kBAAA,KAAuB,MAAA,GACzB,SACA,iCAAA,CAAkC,KAAA,CAAM,MAAM,kBAAkB,CAAA;AACtE,IAAA,IAAI,aAAA,KAAkB,MAAA,IAAa,KAAA,CAAM,mBAAA,KAAwB,MAAA,EAAW;AAC1E,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AACA,IAAA,MAAM,sBACJ,aAAA,KAAkB,MAAA,GAAY,SAAY,+BAAA,CAAgC,KAAA,CAAM,MAAM,mBAAmB,CAAA;AAC3G,IAAA,MAAM,iBAAA,GACJ,MAAM,iBAAA,KAAsB,MAAA,GAAY,SAAY,uBAAA,CAAwB,KAAA,CAAM,MAAM,iBAAiB,CAAA;AAC3G,IAAA,MAAM,gBAAA,GACJ,MAAM,gBAAA,KAAqB,MAAA,GAAY,SAAY,sBAAA,CAAuB,KAAA,CAAM,MAAM,gBAAgB,CAAA;AAExG,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,KAAA,CAAM,QAAA,KAAa,MAAA,EAAW;AAC1D,MAAA,MAAM,IAAI,MAAM,6EAA6E,CAAA;AAAA,IAC/F;AACA,IAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,QAAA,KAAa,MAAA,EAAW;AACxD,MAAA,MAAM,IAAI,MAAM,2FAA2F,CAAA;AAAA,IAC7G;AACA,IAAA,IAAI,aAAA,KAAkB,MAAA,IAAa,YAAA,KAAiB,MAAA,EAAW;AAC7D,MAAA,MAAM,IAAI,MAAM,iEAAiE,CAAA;AAAA,IACnF;AAEA,IAAA,MAAM,WACJ,KAAA,CAAM,QAAA,IACN,wBAAA,CAAyB,MAAM,8BAA6B,EAAG;AAAA,MAC7D,GAAI,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAiB;AAAA,MAC7D,sBAAsB,QAAA,KAAa;AAAA,KACpC,CAAA;AAGH,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,MAAM,sFAAsF,CAAA;AAAA,IACxG;AACA,IAAA,MAAM,iBAAiB,QAAQ,CAAA;AAM/B,IAAA,MAAMC,aAAAA,GAAe,MAAM,kBAAA,CAAmB,QAAQ,CAAA;AACtD,IAAA,IAAI,sBAAsB,MAAA,IAAa,EAAEA,eAAc,QAAA,CAAS,oBAAoB,KAAK,KAAA,CAAA,EAAQ;AAC/F,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,UAAU,QAAQ,CAAA,gGAAA;AAAA,OACpB;AAAA,IACF;AACA,IAAA,IAAI,qBAAqB,MAAA,EAAW;AAClC,MAAA,IAAI,EAAEA,aAAAA,EAAc,QAAA,CAAS,mBAAmB,KAAK,KAAA,CAAA,EAAQ;AAC3D,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,UAAU,QAAQ,CAAA,wGAAA;AAAA,SACpB;AAAA,MACF;AACA,MAAA,MAAM,kBAAA,GAAqB,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA,EAAG,kBAAA;AACtD,MAAA,IAAI,uBAAuB,MAAA,EAAW;AACpC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,UAAU,QAAQ,CAAA,8FAAA;AAAA,SACpB;AAAA,MACF;AACA,MAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,kBAAkB,CAAA;AAC7C,MAAA,MAAM,OAAA,GAAU,iBAAiB,MAAA,CAAO,CAAC,cAAc,CAAC,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACjF,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,MAAM,CAAA,OAAA,EAAU,QAAQ,wCAAwC,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAChG;AAAA,IACF;AACA,IAAA,IACE,iBAAA,KAAsB,UACtB,KAAA,CAAM,OAAA,KAAY,UAClB,KAAA,CAAM,OAAA,KAAY,kBAAkB,SAAA,EACpC;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,iBAAA,EAAoB,KAAA,CAAM,OAAO,CAAA,4CAAA,EAA+C,kBAAkB,SAAS,CAAA;AAAA,OAC7G;AAAA,IACF;AACA,IAAA,IAAI,aAAa,MAAA,IAAaA,aAAAA,EAAc,QAAA,CAASC,4BAA4B,MAAM,IAAA,EAAM;AAC3F,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,UAAU,QAAQ,CAAA,6EAAA;AAAA,OACpB;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAA2B,KAAA,CAAM,MAAA,IAAU,EAAE,MAAM,SAAA,EAAU;AACnE,IAAA,MAAM,OAAA,GAAU,iBAAA,EAAmB,SAAA,IAAa,KAAA,CAAM,OAAA;AACtD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb,GAAI,MAAM,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU;AAAA,MACtE,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,MAAA;AAAA,MACA,GAAI,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAQ;AAAA,MAC3C,GAAI,iBAAA,KAAsB,MAAA,GAAY,EAAC,GAAI,EAAE,iBAAA;AAAkB,KACjE;AAKA,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,IAAU,UAAA,CAAW,OAAO,UAAA,EAAW;AAC5D,IAAA,KAAA,CAAM,UAAU,MAAM,CAAA;AACtB,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,OAAO,YAAY;AAC5B,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,IAAa,YAAA,KAAiB,KAAA,CAAA,IAAa,gBAAA,EAAkB;AAC5E,UAAA,OAAO,KAAA,CAAM,4BAAA,CAA6B,MAAA,EAAQ,QAAA,EAAU;AAAA,YAC1D,MAAA;AAAA,YACA,OAAA,EAAS;AAAA,cACP,GAAG,MAAA;AAAA,cACH,QAAA;AAAA,cACA,YAAA;AAAA,cACA,GAAI,kBAAA,KAAuB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,kBAAA,EAAmB;AAAA,cACjE,GAAI,aAAA,KAAkB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAc;AAAA,cACvD,GAAI,gBAAA,KAAqB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,gBAAA;AAAiB,aAC/D;AAAA,YACA,GAAI,mBAAA,KAAwB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,mBAAA;AAAoB,WACpE,CAAA;AAAA,QACH;AACA,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,IAAa,YAAA,KAAiB,KAAA,CAAA,EAAW;AACxD,UAAA,IAAI,eAAe,KAAA,CAAA,EAAW;AAC5B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AACA,UAAA,OAAO,KAAA,CAAM,uBAAA,CAAwB,MAAA,EAAQ,QAAA,EAAU;AAAA,YACrD,MAAA;AAAA,YACA,OAAA,EAAS;AAAA,cACP,GAAG,MAAA;AAAA,cACH,UAAA;AAAA,cACA,QAAA;AAAA,cACA,YAAA;AAAA,cACA,GAAI,kBAAA,KAAuB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,kBAAA,EAAmB;AAAA,cACjE,GAAI,aAAA,KAAkB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAc;AAAA,cACvD,GAAI,gBAAA,KAAqB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,gBAAA;AAAiB,aAC/D;AAAA,YACA,GAAI,mBAAA,KAAwB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,mBAAA;AAAoB,WACpE,CAAA;AAAA,QACH;AACA,QAAA,IAAI,aAAa,KAAA,CAAA,EAAW;AAC1B,UAAA,OAAO,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ,QAAA,EAAU;AAAA,YAC/C,MAAA;AAAA,YACA,OAAA,EAAS;AAAA,cACP,GAAG,MAAA;AAAA,cACH,QAAA;AAAA,cACA,GAAI,UAAA,KAAe,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAW;AAAA,cACjD,GAAI,kBAAA,KAAuB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,kBAAA,EAAmB;AAAA,cACjE,GAAI,gBAAA,KAAqB,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,gBAAA;AAAiB;AAC/D,WACD,CAAA;AAAA,QACH;AACA,QAAA,IAAI,qBAAqB,KAAA,CAAA,EAAW;AAClC,UAAA,OAAO,KAAA,CAAM,mBAAA,CAAoB,MAAA,EAAQ,QAAA,EAAU;AAAA,YACjD,MAAA;AAAA,YACA,OAAA,EAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,UAAA,KAAe,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAW,EAAI,gBAAA;AAAiB,WAC7F,CAAA;AAAA,QACH;AACA,QAAA,OAAO,KAAA,CAAM,YAAA,CAAa,MAAA,EAAQ,QAAA,EAAU;AAAA,UAC1C,MAAA;AAAA,UACA,OAAA,EAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,UAAA,KAAe,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAW;AAAG,SAC3E,CAAA;AAAA,MACH,CAAA,GAAG;AAAA,IACL,SAAS,KAAA,EAAO;AACd,MAAA,KAAA,CAAM,MAAM,MAAM,CAAA;AAClB,MAAA,MAAM,KAAA;AAAA,IACR;AAIA,IAAA,MAAM,SAAA,GAAY,SAAS,QAAA,CAAS,EAAA;AACpC,IAAA,UAAA,CAAW,GAAA,CAAI,SAAS,MAAA,EAAQ;AAAA,MAC9B,SAAA;AAAA,MACA,GAAI,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA;AAAW,KAClD,CAAA;AACD,IAAA,KAAA,CAAM,cAAA,CAAe,QAAA,CAAS,MAAA,EAAQ,SAAS,CAAA;AAC/C,IAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAAA,EAClC;AAEA,EAAA,SAAS,UAAU,MAAA,EAA4B;AAC7C,IAAA,OAAO,iBAAiB,MAAA,EAAQ;AAAA,MAC9B,MAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW,aAAA;AAAA,MACX,YAAY,OAAO,EAAA,KAAO,aAAa,MAAM,YAAA,CAAa,EAAE,CAAC;AAAA,KAC9D,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IAEA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMP,MAAM,kBAAkB,KAAA,EAAyD;AAC/E,QAAA,IAAI,KAAA,CAAM,SAAA,KAAc,IAAA,CAAK,SAAA,EAAW;AACtC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,KAAA,CAAM,SAAS,CAAA,sCAAA,EAAyC,KAAK,SAAS,CAAA;AAAA,WAChG;AAAA,QACF;AACA,QAAA,OAAO,KAAA,CAAM,kBAAkB,MAAA,EAAQ;AAAA,UACrC,WAAW,KAAA,CAAM,SAAA;AAAA,UACjB,GAAI,MAAM,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA;AAAM,SAC3D,CAAA;AAAA,MACH;AAAA,KACF;AAAA,IAEA,SAAS,KAAA,EAA2C;AAClD,MAAA,OAAO,oBAAA,CAAqB,OAAO,KAAK,CAAA;AAAA,IAC1C,CAAA;AAAA,IAEA,yBAAyB,KAAA,EAA2D;AAClF,MAAA,IAAI,OAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAK,KAAA,EAAO,YAAY,CAAA,EAAG;AAC7D,QAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,MACzE;AACA,MAAA,IAAI,OAAO,KAAA,CAAM,QAAA,KAAa,YAAY,KAAA,CAAM,QAAA,CAAS,WAAW,CAAA,EAAG;AACrE,QAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,MAC7E;AACA,MAAA,IAAI,KAAA,CAAM,QAAA,KAAa,MAAA,IAAa,KAAA,CAAM,iBAAiB,MAAA,EAAW;AACpE,QAAA,MAAM,IAAI,MAAM,uEAAuE,CAAA;AAAA,MACzF;AACA,MAAA,OAAO,oBAAA,CAAqB,OAAO,IAAI,CAAA;AAAA,IACzC,CAAA;AAAA,IAEA,MAAM,wBAAwB,KAAA,EAA+C;AAC3E,MAAA,MAAM,OAAA,GAAU,6BAAA,CAA8B,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA;AACjE,MAAA,MAAM,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACrC,MAAA,MAAM,MAAM,uBAAA,CAAwB,MAAA,EAAQ,MAAM,QAAA,EAAU,EAAE,SAAS,CAAA;AAAA,IACzE,CAAA;AAAA,IAEA,MAAM,2BACJ,KAAA,EAC4C;AAC5C,MAAA,MAAM,OAAA,GAAU,gCAAA,CAAiC,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA;AACpE,MAAA,MAAM,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACrC,MAAA,OAAA,CAAQ,MAAM,KAAA,CAAM,0BAAA,CAA2B,QAAQ,KAAA,CAAM,QAAA,EAAU,OAAO,CAAA,EAAG,MAAA;AAAA,IACnF,CAAA;AAAA,IAEA,MAAM,uBAAA,CACJ,QAAA,EACA,QAAA,EACA,SAAA,EACwD;AAGxD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,KAAA,CAAM,QAAA,CAAS,GAAA;AAAA,QAC9C,MAAA;AAAA,QACA,6BAAA,CAA8B,QAAA,EAAU,QAAA,EAAU,SAAS;AAAA,OAC7D;AACA,MAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,MAAA,IAAI,OAAA;AACJ,MAAA,IAAI;AACF,QAAA,OAAA,GAAU,iCAAiC,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,MAC1E,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,OAAO,KAAA,CAAM,4BAAA,CAA6B,MAAA,EAAQ,QAAA,EAAU;AAAA,QAC1D,WAAW,OAAA,CAAQ,SAAA;AAAA,QACnB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,KAAA,EAAO;AAAA,MACL,MAAM,MAAA,EAAQ;AAAE,QAAA,OAAO,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAAA,MAAG,CAAA;AAAA,MAC5D,MAAM,MAAA,CAAO,MAAA,EAAQ,MAAA,EAAQ;AAC3B,QAAA,MAAM,UAAU,MAAM,KAAA,CAAM,UAAA,CAAW,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAC7D,QAAA,IAAI,OAAA,CAAQ,iBAAiB,MAAA,EAAW;AACtC,UAAA,KAAA,CAAM,kBAAA,CAAmB,MAAA,EAAQ,WAAA,EAAa,OAAA,CAAQ,aAAa,WAAW,CAAA;AAAA,QAChF;AAAA,MACF,CAAA;AAAA,MACA,MAAM,IAAI,MAAA,EAAmD;AAC3D,QAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,eAAA,CAAgB,QAAQ,MAAM,CAAA;AAC1D,QAAA,OAAO,OAAA,KAAY,MAAA,GAAY,MAAA,GAAY,WAAA,CAAY,OAAO,CAAA;AAAA,MAChE,CAAA;AAAA,MACA,MAAM,IAAA,CAAK,KAAA,GAAuB,EAAC,EAAsB;AACvD,QAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,gBAAA,CAAiB,MAAA,EAAQ;AAAA,UAChD,KAAA,EAAO,MAAM,KAAA,IAAS,uBAAA;AAAA,UACtB,GAAI,MAAM,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA;AAAO,SAC9D,CAAA;AACD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,MAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,KAAY,WAAA,CAAY,OAAO,CAAC,CAAC,CAAA;AAAA,UAC7E,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA;AAAW,SACzE;AAAA,MACF;AAAA,KACF;AAAA,IAEA,KAAA,EAAO;AAAA,MACL,eAAe,MAAA,EAA6C;AAC1D,QAAA,OAAO,WAAA,CAAY,KAAA,CAAM,KAAA,CAAM,cAAA,CAAe,QAAQ,MAAM,CAAA;AAAA,MAC9D;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,MAAM,GAAA,CAAI,QAAA,EAAkB,QAAA,EAAoB,OAAA,EAA0D;AACxG,QAAA,MAAM,SAAS,MAAM,KAAA,CAAM,gBAAgB,MAAA,EAAQ,QAAA,EAAU,UAAU,OAAO,CAAA;AAC9E,QAAA,OAAO,MAAA,KAAW,SACd,MAAA,GACA;AAAA,UACE,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,SAAS,MAAA,CAAO,OAAA;AAAA,UAChB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,YAAY,MAAA,CAAO;AAAA,SACrB;AAAA,MACN;AAAA,KACF;AAAA,IAEA,QAAA,EAAU;AAAA,MACR,MAAM,IAAA,GAA+B;AACnC,QAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,WAAA,CAAY,MAAM,CAAA;AAC9C,QAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAA,KAAW,aAAA,CAAc,MAAA,EAAQ,WAAA,CAAY,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAC,CAAC,CAAA;AAAA,MACxF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,SAAA,EAAW,MAAM,KAAA,CAAM,YAAA;AAAa,KACtC;AAAA,IAEA,OAAA,EAAS;AAAA,MACP,MAAM,OAAO,QAAA,EAAiC;AAI5C,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AACzC,QAAA,WAAA,CAAY,OAAO,QAAQ,CAAA;AAAA,MAC7B;AAAA,KACF;AAAA,IAEA,OAAA,EAAS;AAAA,MACP,eAAe,KAAA,EAA+D;AAC5E,QAAA,OAAO,WAAA,CAAY,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,QAAQ,KAAK,CAAA;AAAA,MAC9D;AAAA,KACF;AAAA,IAEA,IAAA,GAAa;AACX,MAAA,KAAA,CAAM,IAAA,EAAK;AACX,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,KAAK,YAAY,KAAA,EAAM;AAAA,IACzB,CAAA;AAAA,IAEA,MAAM,KAAA,GAAuB;AAC3B,MAAA,KAAA,CAAM,IAAA,EAAK;AACX,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,MAAM,YAAY,KAAA,EAAM;AAAA,IAC1B,CAAA;AAAA,IAEA,MAAM,KAAA,GAA2B;AAC/B,MAAA,MAAM,iBAAA,GAAoB,MAAA,CAAO,WAAA,CAAY,WAAA,CAAY,GAAA,CAAI,CAAC,KAAA,KAAU,CAAC,KAAA,EAAO,CAAC,CAAC,CAAC,CAAA;AAInF,MAAA,IAAI,MAAA;AACJ,MAAA,GAAG;AACD,QAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,gBAAA,CAAiB,MAAA,EAAQ;AAAA,UAChD,KAAA,EAAO,uBAAA;AAAA,UACP,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,SAC1C,CAAA;AACD,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACnC,UAAA,iBAAA,CAAkB,eAAA,CAAgB,SAAS,MAAM,WAAA,CAAY,QAAQ,MAAM,CAAC,CAAC,CAAA,IAAK,CAAA;AAAA,QACpF;AACA,QAAA,MAAA,GAAS,IAAA,CAAK,UAAA;AAAA,MAChB,SAAS,MAAA,KAAW,MAAA;AAEpB,MAAA,OAAO;AAAA,QACL,oBAAA,EAAsB,YAAY,cAAA,EAAe;AAAA,QACjD,iBAAA;AAAA,QACA,WAAA,EAAa,YAAY,QAAA,CAAS,WAAA;AAAA,QAClC,UAAA,EAAY,YAAY,QAAA,CAAS,UAAA;AAAA,QACjC,eAAA,EAAiB,YAAY,QAAA,CAAS,eAAA;AAAA,QACtC,QAAA,EAAU,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB;AAAA,IACF;AAAA,GACF;AACF;AAGA,SAAS,eAAA,CAAgB,SAAsB,OAAA,EAAiD;AAC9F,EAAA,OAAO,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,MAAA,EAAW,MAAS,CAAA,CAAE,KAAA;AAChE;AAOA,SAAS,iBAAiB,MAAA,EAAwB;AAChD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,wBAAwB,CAAA;AAC5D,EAAA,OAAO,KAAK,GAAA,CAAI,yBAAA,EAA2B,KAAK,GAAA,CAAI,yBAAA,EAA2B,OAAO,CAAC,CAAA;AACzF","file":"index.js","sourcesContent":["import type { RuntimeInfo, ToolsetId } from '@byok-sdk/protocol';\n\n/**\n * What this process has OBSERVED about a device's live connection.\n *\n * This is not a second authority over anything durable. The device row\n * (`DeviceRecord`, `@byok-sdk/cloud`) owns identity and the capability list\n * every admission gate reads; the mailbox owns delivery. What lives here is the\n * part of `conn.hello` the kernel deliberately does not persist — the runtime\n * DISCOVERY block and the client's self-reported version/toolset inventory —\n * plus \"when did we last hear from this device at all\".\n *\n * Why the kernel does not persist it: `conn.hello.runtimes` describes what a\n * device build could run, changes on every daemon restart, and authorizes\n * nothing (the steer gate reads the CLAIM snapshot, never this). Storing it\n * durably would create a stale second description of a device that outlives the\n * process that saw it. Keeping it as an in-process observation is honest about\n * its lifetime: restart the server and it is gone, exactly like the connection\n * it describes.\n *\n * `connected` is therefore \"observed alive and not since forgotten\", not \"a\n * socket is open\" — there are no sockets any more. Two observations set it: the\n * device's own `conn.hello` over `POST /byok/messages`, and a `GET /byok/events`\n * poll (a device that is polling is present even if it never announced). One\n * clears it: revocation, which deletes the device row and everything scoped to\n * it.\n */\nexport interface DeviceConnection {\n connected: boolean;\n /** ISO-8601 instant of the most recent observation. */\n lastSeen: string;\n clientVersion?: string;\n runtimes?: RuntimeInfo[];\n configuredToolsets?: ToolsetId[];\n}\n\n/** `conn.hello`'s discovery half, as observed on one accepted announcement. */\nexport interface DeviceAnnouncement {\n readonly clientVersion?: string;\n readonly runtimes?: readonly RuntimeInfo[];\n readonly configuredToolsets?: readonly ToolsetId[];\n}\n\n/**\n * In-process device observations, in first-observation order.\n *\n * Insertion order is load-bearing for ambient dispatch selection\n * (`device-selection.ts`): \"the first connected device\" must be stable and\n * explainable, and a `Map` gives that for free without a second index.\n */\nexport class DeviceConnections {\n readonly #devices = new Map<string, DeviceConnection>();\n\n /**\n * Record an accepted `conn.hello`. Discovery fields are REPLACED wholesale,\n * never merged: a daemon that restarted with a runtime removed must not keep\n * advertising it because an older hello mentioned it.\n */\n announce(deviceId: string, announcement: DeviceAnnouncement, at: string): void {\n this.#devices.set(deviceId, {\n connected: true,\n lastSeen: at,\n ...(announcement.clientVersion === undefined ? {} : { clientVersion: announcement.clientVersion }),\n ...(announcement.runtimes === undefined ? {} : { runtimes: [...announcement.runtimes] }),\n ...(announcement.configuredToolsets === undefined\n ? {}\n : { configuredToolsets: [...announcement.configuredToolsets] }),\n });\n }\n\n /**\n * Record any other sign of life (an inbound envelope, a long-poll read).\n * Deliberately additive: it refreshes `lastSeen` and marks the device present\n * without touching the discovery block, because none of those signals carry\n * one and clearing it would lose what the last hello said.\n */\n touch(deviceId: string, at: string): void {\n const existing = this.#devices.get(deviceId);\n if (existing === undefined) {\n this.#devices.set(deviceId, { connected: true, lastSeen: at });\n return;\n }\n existing.connected = true;\n existing.lastSeen = at;\n }\n\n get(deviceId: string): DeviceConnection | undefined {\n return this.#devices.get(deviceId);\n }\n\n isConnected(deviceId: string): boolean {\n return this.#devices.get(deviceId)?.connected === true;\n }\n\n connectedCount(): number {\n let count = 0;\n for (const connection of this.#devices.values()) if (connection.connected) count += 1;\n return count;\n }\n\n /** Device ids in first-observation order — the order ambient selection walks. */\n ids(): readonly string[] {\n return [...this.#devices.keys()];\n }\n\n /** Drop everything scoped to a device. Called when its registration is deleted (§6.3). */\n forget(deviceId: string): void {\n this.#devices.delete(deviceId);\n }\n\n clear(): void {\n this.#devices.clear();\n }\n}\n","import { STRICT_AGENT_ONLY_CAPABILITY, type ToolsetId } from '@byok-sdk/protocol';\n\n/**\n * Ambient device selection for a `dispatch()` that named no `deviceId`.\n *\n * `DispatchInput.deviceId` stays optional (ADR-034), so this rule survives the\n * fold. It is a SCHEDULING convenience and nothing more: every admission gate\n * that actually protects something — Agent capability, strict-agent-only,\n * egress, toolset selection — runs afterwards against the durable device row\n * inside the kernel, on the device this picked exactly as on one the caller\n * named. Picking wrong therefore costs a refusal, never a wrongly-authorized\n * dispatch.\n *\n * \"First connected\" means first OBSERVED (`connections.ts` preserves\n * first-observation order), which is stable and explainable, unlike any\n * load-shaped ordering this package has no information to compute.\n */\nexport interface DeviceCandidate {\n readonly deviceId: string;\n /** The durable capability list from the device's last accepted `conn.hello`. */\n readonly capabilities: readonly string[] | undefined;\n /** The logical toolset inventory the same announcement reported, if any. */\n readonly configuredToolsets: readonly ToolsetId[] | undefined;\n}\n\nexport interface AmbientSelectionQuery {\n /** Every toolset must be present; an unknown inventory is never guessed at. */\n readonly requiredToolsets?: readonly ToolsetId[];\n /** Agent-bound dispatch is the only caller allowed to land on a strict-agent-only device. */\n readonly allowStrictAgentOnly?: boolean;\n}\n\nexport function pickFirstConnectedDevice(\n candidates: readonly DeviceCandidate[],\n query: AmbientSelectionQuery = {},\n): string | undefined {\n for (const candidate of candidates) {\n if (query.allowStrictAgentOnly !== true && candidate.capabilities?.includes(STRICT_AGENT_ONLY_CAPABILITY)) {\n continue;\n }\n if (query.requiredToolsets === undefined) return candidate.deviceId;\n // A device that never advertised toolset selection, or never reported an\n // inventory at all, is skipped rather than assumed adequate: \"unknown\" is\n // not \"has them\", and guessing here would send a task to a device that\n // fails it locally.\n if (!candidate.capabilities?.includes('toolset-selection')) continue;\n if (candidate.configuredToolsets === undefined) continue;\n const configured = new Set(candidate.configuredToolsets);\n if (query.requiredToolsets.every((toolsetId) => configured.has(toolsetId))) return candidate.deviceId;\n }\n return undefined;\n}\n","/**\n * A tiny append-only, multi-reader async queue. `push` never blocks; `close`\n * marks the queue done. `subscribe()` returns a fresh async iterator that\n * always replays from the beginning of the retained buffer, so a consumer that\n * calls `events()` at any point still sees everything still retained for that\n * task's lifetime.\n *\n * Bounded, deliberately (WP3B §3): this queue is a NOTIFICATION relay, not a\n * record of what happened — the durable facts live in the cloud stores a\n * `ByokServer` reads back (`tasks.get`, `TaskHandle.result()`). A consumer that\n * stops iterating must therefore cost bounded memory, not unbounded growth. On\n * overflow the OLDEST entries are dropped and, exactly once per queue, a\n * caller-supplied `truncationMarker` is appended so a reader can tell a\n * complete feed from a clipped one instead of silently seeing a gap.\n *\n * Framework-agnostic on purpose (no Node/WS/Hono types here) so it can be\n * unit-tested and reused regardless of transport.\n */\nexport interface AsyncEventQueueOptions<T> {\n /**\n * Maximum entries retained before drop-oldest engages. Omitted means\n * unbounded — only appropriate for a queue whose producer is itself bounded.\n */\n readonly maxBuffered?: number;\n /**\n * Appended once, after the first drop, so the truncation is observable.\n * Omitted means a bounded queue that drops silently.\n */\n readonly truncationMarker?: T;\n}\n\nexport class AsyncEventQueue<T> {\n private readonly buffer: Array<{ readonly sequence: number; readonly value: T }> = [];\n private nextSequence = 0;\n private closed = false;\n private waiters: Array<() => void> = [];\n private readonly maxBuffered: number | undefined;\n private readonly truncationMarker: T | undefined;\n private truncationNoted = false;\n\n constructor(options: AsyncEventQueueOptions<T> = {}) {\n if (options.maxBuffered !== undefined) {\n if (!Number.isSafeInteger(options.maxBuffered) || options.maxBuffered <= 0) {\n throw new TypeError(\n `AsyncEventQueue: maxBuffered must be a positive safe integer, got ${String(options.maxBuffered)}`,\n );\n }\n this.maxBuffered = options.maxBuffered;\n }\n this.truncationMarker = options.truncationMarker;\n }\n\n /** True once this queue has dropped at least one entry. */\n get truncated(): boolean {\n return this.truncationNoted;\n }\n\n push(value: T): void {\n if (this.closed) return;\n this.buffer.push({ sequence: this.nextSequence++, value });\n this.enforceBound();\n this.wake();\n }\n\n close(): void {\n if (this.closed) return;\n this.closed = true;\n this.wake();\n }\n\n /**\n * Drop the oldest entries back down to the bound. The marker is queue\n * metadata, not a buffered entry: every subscriber observes it at most once\n * after the first drop, while all retained capacity remains available to\n * real events.\n */\n private enforceBound(): void {\n const limit = this.maxBuffered;\n if (limit === undefined || this.buffer.length <= limit) return;\n this.buffer.splice(0, this.buffer.length - limit);\n this.truncationNoted = true;\n }\n\n private wake(): void {\n const waiters = this.waiters;\n this.waiters = [];\n for (const resolve of waiters) resolve();\n }\n\n private waitForMore(): Promise<void> {\n return new Promise((resolve) => this.waiters.push(resolve));\n }\n\n /** Async-iterate the buffer from index 0, waiting for new pushes until closed. */\n subscribe(): AsyncIterable<T> {\n const queue = this;\n return {\n [Symbol.asyncIterator](): AsyncIterator<T> {\n let sequence = queue.buffer[0]?.sequence ?? queue.nextSequence;\n let truncationDelivered = false;\n return {\n async next(): Promise<IteratorResult<T>> {\n for (;;) {\n if (queue.truncationNoted && !truncationDelivered && queue.truncationMarker !== undefined) {\n truncationDelivered = true;\n return { value: queue.truncationMarker, done: false };\n }\n\n const oldest = queue.buffer[0]?.sequence;\n if (oldest !== undefined && sequence < oldest) sequence = oldest;\n if (oldest !== undefined) {\n const offset = sequence - oldest;\n const entry = queue.buffer[offset];\n if (entry !== undefined) {\n sequence = entry.sequence + 1;\n return { value: entry.value, done: false };\n }\n }\n if (queue.closed) {\n return { value: undefined, done: true };\n }\n await queue.waitForMore();\n }\n },\n };\n },\n };\n }\n}\n","import type { InboundCommitted, ByokCloudObserver } from '@byok-sdk/cloud';\nimport type { RuntimeId, TaskState } from '@byok-sdk/protocol';\nimport { AsyncEventQueue } from './event-queue';\nimport type { DeviceConnections } from './connections';\nimport type { ByokServerEvent, ServerTaskEvent } from './types';\n\n/** Per-task {@link ServerTaskEvent} retention before drop-oldest engages. */\nexport const DEFAULT_TASK_EVENT_BUFFER_LIMIT = 1000;\n/** How long a terminal task's relay state is retained before reclamation, ms. */\nexport const DEFAULT_TASK_EVENT_RETENTION_MS = 5 * 60_000;\n\n/**\n * The relay's own truncation marker. A single `error` entry, appended once, is\n * the whole contract: it says \"entries were dropped from this feed\", not what\n * they were — a reader that needs the facts reads them back\n * (`ByokServer.tasks.get`, `TaskHandle.result()`).\n */\nconst TRUNCATION_MARKER: ServerTaskEvent = { kind: 'error', reason: 'events_truncated' };\n\ninterface TaskRelayState {\n readonly queue: AsyncEventQueue<ServerTaskEvent>;\n readonly terminal: Promise<void>;\n settleTerminal: () => void;\n terminalSettled: boolean;\n provisional: boolean;\n readonly early: Array<{ readonly envelope: InboundCommitted['envelope']; readonly at: string }>;\n latestApprovalRequestSourceEnvelopeId?: string;\n claimedRuntime?: RuntimeId;\n claimedHarnessId?: string;\n reclaimTimer?: ReturnType<typeof setTimeout>;\n}\n\nexport interface TaskEventRelayOptions {\n readonly connections: DeviceConnections;\n readonly taskEventBufferLimit?: number;\n readonly taskEventRetentionMs?: number;\n}\n\n/**\n * Post-commit fan-out: cloud kernel envelopes -> `ServerTaskEvent` /\n * `ByokServerEvent`.\n *\n * The invariant this file exists to keep (WP3B §3): **the relay holds\n * notifications, never state**. It never answers \"what is this task\", \"what did\n * it produce\" or \"who owns it\" — every one of those is read back from the\n * kernel's durable stores on demand. What it owns is per-task delivery\n * plumbing: a bounded replayable queue, and one promise that settles when the\n * task reaches a terminal so `TaskHandle.result()` has something to await\n * before it reads the answer back.\n *\n * The two small facts it does carry are delivery bookkeeping, not a read model:\n * `terminalSettled` (so the FIRST terminal is the one that settles the promise,\n * matching the store's own first-terminal-wins rule, and a later stale terminal\n * is not announced as a second one) and `claimedRuntime` (echoed onto the\n * `task.state` event stream because the pre-fold feed carried it there; the\n * authoritative copy is `TaskAttempt.claimedRuntime`).\n *\n * Dispatch first {@link provision}s a known task id, then activates it with\n * {@link noteDispatched} after the kernel has accepted its offer. Envelopes\n * that arrive in that narrow interval are buffered, not dropped. An envelope\n * naming a task this server never dispatched is folded for nobody and allocates nothing —\n * otherwise a device could grow this map without bound by guessing task ids,\n * and the kernel's gate deliberately treats such an envelope as a harmless\n * store no-op rather than a rejection.\n *\n * `onInboundCommitted` runs inline on the kernel's request path and must stay\n * synchronous and cheap; anything needing a store read goes through\n * {@link onTaskActivity}, which the composition sets and which owns its own\n * failure handling.\n */\nexport class TaskEventRelay implements ByokCloudObserver {\n readonly #tasks = new Map<string, TaskRelayState>();\n readonly #serverEvents: AsyncEventQueue<ByokServerEvent>;\n readonly #connections: DeviceConnections;\n readonly #bufferLimit: number;\n readonly #retentionMs: number;\n #stopped = false;\n\n /**\n * Called once per committed task-progress observation for a dispatched task.\n * The composition uses it to run the implicit-approval-resume check, which\n * needs a store read and therefore cannot happen inline here.\n */\n onTaskActivity: ((\n taskId: string,\n pendingRequestSourceEnvelopeId: string | undefined,\n activitySourceEnvelopeId: string,\n activityAt: string,\n ) => void) | undefined;\n\n constructor(options: TaskEventRelayOptions) {\n this.#connections = options.connections;\n this.#bufferLimit = positiveLimit(options.taskEventBufferLimit ?? DEFAULT_TASK_EVENT_BUFFER_LIMIT, 'taskEventBufferLimit');\n this.#retentionMs = positiveLimit(options.taskEventRetentionMs ?? DEFAULT_TASK_EVENT_RETENTION_MS, 'taskEventRetentionMs');\n // The cross-task feed is long-lived and never closed, so it is bounded on\n // the same budget. It drops silently: `ByokServerEvent` has no member that\n // could carry a truncation notice, and inventing one would be a wire-shaped\n // event no server action produced.\n this.#serverEvents = new AsyncEventQueue<ByokServerEvent>({ maxBuffered: this.#bufferLimit });\n }\n\n /** The cross-task embedder feed backing `ByokServer.events.subscribe()`. */\n serverEvents(): AsyncIterable<ByokServerEvent> {\n return this.#serverEvents.subscribe();\n }\n\n /** Publish one cross-task event (rate-limit episodes, host-side transitions). */\n emitServerEvent(event: ByokServerEvent): void {\n if (this.#stopped) return;\n this.#serverEvents.push(event);\n }\n\n /** Pre-register a task id before its offer enqueue can become observable. */\n provision(taskId: string): void {\n this.#open(taskId, true);\n }\n\n /** Forget an enqueue that failed before it produced an offer. */\n abort(taskId: string): void {\n const state = this.#tasks.get(taskId);\n if (state === undefined || !state.provisional) return;\n if (state.reclaimTimer !== undefined) clearTimeout(state.reclaimTimer);\n state.settleTerminal();\n state.queue.close();\n this.#tasks.delete(taskId);\n }\n\n /**\n * Open the relay for a task this server just dispatched, and publish its\n * `Offered` origin on both feeds. `at` is the offer envelope's own timestamp,\n * so the feed and the snapshot agree on when the task began.\n */\n noteDispatched(taskId: string, at: string): void {\n const existing = this.#tasks.get(taskId);\n const state = existing ?? this.#open(taskId);\n if (existing !== undefined && !state.provisional) return;\n state.provisional = false;\n state.queue.push({ kind: 'state', state: 'Offered', at });\n this.emitServerEvent({ kind: 'task.created', taskId, at });\n const early = state.early.splice(0);\n for (const input of early) this.#handleTaskEnvelope(state, taskId, input.envelope, input.at);\n }\n\n /** The per-task feed backing `TaskHandle.events()`, replayed from the start of what is retained. */\n events(taskId: string): AsyncIterable<ServerTaskEvent> {\n return this.#open(taskId).queue.subscribe();\n }\n\n /** Settles when this task first reaches a terminal — the barrier `TaskHandle.result()` awaits. */\n terminal(taskId: string): Promise<void> {\n return this.#open(taskId).terminal;\n }\n\n /**\n * Host-side transitions the wire never carries: an accepted cancellation, and\n * an approval the operator resolved through `TaskHandle.approve`/`reject`.\n * Published here so the two feeds report the same task history whichever side\n * moved it, and (for a terminal) so `result()` is not left waiting on a device\n * message that a cancelled task will never send.\n */\n noteHostTransition(taskId: string, state: TaskState, at: string): void {\n const existing = this.#tasks.get(taskId);\n if (existing === undefined) return;\n this.#transition(existing, taskId, state, at);\n }\n\n onInboundCommitted(input: InboundCommitted): void {\n if (this.#stopped) return;\n const { deviceId, envelope } = input;\n const at = new Date().toISOString();\n\n if (envelope.type === 'conn.hello') {\n this.#connections.announce(\n deviceId,\n {\n ...(envelope.payload.clientVersion === undefined ? {} : { clientVersion: envelope.payload.clientVersion }),\n ...(envelope.payload.runtimes === undefined ? {} : { runtimes: envelope.payload.runtimes }),\n ...(envelope.payload.configuredToolsets === undefined\n ? {}\n : { configuredToolsets: envelope.payload.configuredToolsets }),\n },\n at,\n );\n return;\n }\n // Any committed envelope is a sign of life from an authenticated device.\n this.#connections.touch(deviceId, at);\n\n const taskId = envelope.task_id;\n if (taskId === undefined) return;\n const state = this.#tasks.get(taskId);\n if (state === undefined) return;\n\n if (state.provisional) {\n state.early.push({ envelope, at });\n return;\n }\n this.#handleTaskEnvelope(state, taskId, envelope, at);\n }\n\n #handleTaskEnvelope(\n state: TaskRelayState,\n taskId: string,\n envelope: InboundCommitted['envelope'],\n at: string,\n ): void {\n switch (envelope.type) {\n case 'task.claim':\n if (envelope.payload.runtime !== undefined) state.claimedRuntime = envelope.payload.runtime;\n if (envelope.payload.harnessId !== undefined) state.claimedHarnessId = envelope.payload.harnessId;\n this.#transition(state, taskId, 'Claimed', at);\n return;\n case 'task.started':\n this.#transition(state, taskId, 'Running', at);\n return;\n case 'task.progress':\n for (const event of envelope.payload.events) state.queue.push({ kind: 'agent', event });\n this.onTaskActivity?.(\n taskId,\n state.latestApprovalRequestSourceEnvelopeId,\n envelope.id,\n envelope.ts,\n );\n return;\n case 'task.artifact':\n state.queue.push({ kind: 'artifact', artifact: envelope.payload });\n this.onTaskActivity?.(\n taskId,\n state.latestApprovalRequestSourceEnvelopeId,\n envelope.id,\n envelope.ts,\n );\n return;\n case 'task.await_approval':\n state.latestApprovalRequestSourceEnvelopeId = envelope.id;\n state.queue.push({ kind: 'await_approval', summary: envelope.payload.summary });\n this.#transition(state, taskId, 'AwaitApproval', at);\n return;\n case 'task.approval_resolved':\n this.emitServerEvent({\n kind: 'task.approval_resolved',\n taskId,\n at,\n approvalId: envelope.payload.approvalId,\n decision: envelope.payload.decision,\n resolvedBy: envelope.payload.resolvedBy,\n // Whether the reporting daemon advertised `approval-targeting` was a\n // property of its live WS registration, which no longer exists. The\n // durable capability list is a device-build fact rather than a\n // per-report one, so this reports the honest answer for the transport\n // that remains: not targeted.\n targeted: false,\n });\n this.#transition(state, taskId, 'Running', at);\n return;\n case 'task.decline':\n this.#transition(state, taskId, 'Failed', at);\n return;\n case 'task.complete':\n this.#transition(state, taskId, 'Complete', at);\n return;\n case 'task.fail':\n this.#transition(state, taskId, 'Failed', at);\n return;\n case 'task.cancelled':\n this.#transition(state, taskId, 'Cancelled', at);\n return;\n default:\n return;\n }\n }\n\n /** Publish an implicit resolution the composition inferred from later task traffic. */\n emitImplicitApprovalResolved(taskId: string, at: string): void {\n this.emitServerEvent({ kind: 'task.approval_resolved_implicit', taskId, at });\n this.noteHostTransition(taskId, 'Running', at);\n }\n\n /** Close every feed and drop every timer. Safe to call more than once. */\n stop(): void {\n if (this.#stopped) return;\n this.#stopped = true;\n for (const state of this.#tasks.values()) {\n if (state.reclaimTimer !== undefined) clearTimeout(state.reclaimTimer);\n state.settleTerminal();\n state.queue.close();\n }\n this.#tasks.clear();\n this.#serverEvents.close();\n this.#connections.clear();\n }\n\n #transition(state: TaskRelayState, taskId: string, next: TaskState, at: string): void {\n // First terminal wins here for the same reason it wins in the receipt\n // store: a later stale terminal changed no durable fact, so announcing it\n // would make the feed disagree with the read model.\n if (state.terminalSettled) return;\n state.queue.push({ kind: 'state', state: next, at });\n this.emitServerEvent({\n kind: 'task.state',\n taskId,\n state: next,\n at,\n ...(state.claimedHarnessId === undefined ? {} : { claimedHarnessId: state.claimedHarnessId }),\n ...(state.claimedRuntime === undefined ? {} : { claimedRuntime: state.claimedRuntime }),\n });\n if (next !== 'Complete' && next !== 'Failed' && next !== 'Cancelled') return;\n state.terminalSettled = true;\n state.settleTerminal();\n // The feed ENDS at the terminal, right after the terminal event is pushed —\n // that transition is the last thing that will ever happen to this task, so\n // a `for await` over `events()` completes there instead of hanging. Closing\n // does not empty the buffer (`event-queue.ts`), so a reader that subscribes\n // later still replays the whole history from the start and then ends;\n // `taskEventRetentionMs` below only decides when the buffer is RECLAIMED,\n // and must never be what terminates an iterator.\n state.queue.close();\n this.#scheduleReclaim(taskId, state);\n }\n\n /**\n * Drop a terminal task's plumbing after the retention window. The queue was\n * already closed at the terminal; this only stops retaining what it buffered,\n * after which the durable read model (`tasks.get`, `result()`) is the only\n * answer — which is where the facts lived all along.\n */\n #scheduleReclaim(taskId: string, state: TaskRelayState): void {\n if (state.reclaimTimer !== undefined) return;\n const timer = setTimeout(() => {\n this.#tasks.delete(taskId);\n }, this.#retentionMs);\n timer.unref?.();\n state.reclaimTimer = timer;\n }\n\n #open(taskId: string, provisional = false): TaskRelayState {\n const existing = this.#tasks.get(taskId);\n if (existing !== undefined) return existing;\n let settleTerminal!: () => void;\n const terminal = new Promise<void>((resolve) => {\n settleTerminal = resolve;\n });\n const created: TaskRelayState = {\n queue: new AsyncEventQueue<ServerTaskEvent>({\n maxBuffered: this.#bufferLimit,\n truncationMarker: TRUNCATION_MARKER,\n }),\n terminal,\n settleTerminal,\n terminalSettled: false,\n provisional,\n early: [],\n };\n this.#tasks.set(taskId, created);\n return created;\n }\n}\n\nfunction positiveLimit(value: number, name: string): number {\n if (!Number.isSafeInteger(value) || value <= 0) {\n throw new TypeError(`${name} must be a positive safe integer`);\n }\n return value;\n}\n","import type { DeviceRecord, PendingApproval, TaskAttempt, TerminalResult } from '@byok-sdk/cloud';\nimport type { TaskState } from '@byok-sdk/protocol';\nimport type { DeviceConnection } from './connections';\nimport type { MachineInfo, TaskResult, TaskSnapshot } from './types';\n\n/**\n * Projections from the cloud kernel's read model onto this package's public\n * shapes. Pure functions, deliberately: every input is a value the caller has\n * already read from a store, so there is exactly one place the mapping lives\n * and no way for a second copy of it to drift.\n */\n\n/**\n * What this server calls a task the kernel calls a `TaskAttempt`.\n *\n * The order of the gates is the whole contract, and it mirrors the kernel's own\n * (`ByokCloud.readTaskResult`):\n *\n * 1. an accepted host cancellation OUTRANKS everything a runtime reports later.\n * `cancel()` is authoritative the moment the kernel records it, so the task\n * reads `Cancelled` immediately and a late `task.complete` — which the wire\n * still answers as a success — cannot move it;\n * 2. a terminal attempt is its own terminal;\n * 3. an unresolved approval on the task's timeline is `AwaitApproval`. The\n * kernel has no such attempt STATUS on purpose (ADR-028: no execution state\n * in the cloud) — the pause is derived from the durable approval timeline,\n * which is the same single authority `approveTask`'s staleness gate reads;\n * 4. otherwise the attempt's own coarse status.\n */\nexport function toTaskState(attempt: TaskAttempt, pending: PendingApproval | undefined): TaskState {\n if (attempt.cancellation !== undefined) return 'Cancelled';\n switch (attempt.status) {\n case 'complete':\n return 'Complete';\n case 'failed':\n return 'Failed';\n case 'cancelled':\n case 'cancel_requested':\n return 'Cancelled';\n case 'offered':\n return pending === undefined ? 'Offered' : 'AwaitApproval';\n case 'claimed':\n return pending === undefined ? 'Claimed' : 'AwaitApproval';\n case 'running':\n return pending === undefined ? 'Running' : 'AwaitApproval';\n }\n}\n\n/**\n * The kernel's typed terminal read model, narrowed to this package's\n * {@link TaskResult}.\n *\n * Deliberately LOSSY in one direction: `taskId`, `recordedAt`, `agentRef`,\n * `usage` and `terminalCause` exist on `TerminalResult` and have no place here.\n * They are all reachable through the kernel (`readTaskResult`), and copying\n * them into a second shape would make this projection something a caller has to\n * keep in sync rather than a narrowing of one authority.\n */\nexport function toTaskResult(terminal: TerminalResult | undefined): TaskResult | undefined {\n if (terminal === undefined) return undefined;\n return {\n state: terminal.state === 'complete' ? 'Complete' : terminal.state === 'failed' ? 'Failed' : 'Cancelled',\n summary: terminal.summary,\n sessionRef: terminal.sessionRef,\n artifactRefs: terminal.artifactRefs === undefined ? undefined : [...terminal.artifactRefs],\n ...(terminal.document === undefined ? {} : { document: terminal.document }),\n ...(terminal.reason === undefined ? {} : { reason: terminal.reason }),\n ...(terminal.retryable === undefined ? {} : { retryable: terminal.retryable }),\n };\n}\n\n/**\n * The dispatch-time facts the kernel does not persist.\n *\n * `TaskAttempt` records ownership and disposition, not the request that opened\n * it — it carries no `createdAt` and no `sessionRef`. Both are needed by the\n * public snapshot, and both are known exactly once, at dispatch, so this\n * process keeps them keyed by task id rather than inventing a durable column or\n * quietly reporting the attempt's last-mutation time as its creation time.\n * Deliberately not TTL-reclaimed: it is the exact peer of the in-memory attempt\n * store this composition is built on, and it must not forget a task that store\n * still answers for.\n */\nexport interface DispatchFacts {\n readonly createdAt: string;\n readonly sessionRef?: string;\n}\n\nexport function toTaskSnapshot(\n attempt: TaskAttempt,\n pending: PendingApproval | undefined,\n terminal: TerminalResult | undefined,\n dispatched: DispatchFacts | undefined,\n): TaskSnapshot {\n const result = toTaskResult(terminal);\n // The terminal's own `sessionRef` wins: a runtime that resumed or minted a\n // session is reporting the one the work actually ran under, which is a\n // stronger fact than whatever the offer asked for.\n const sessionRef = result?.sessionRef ?? dispatched?.sessionRef;\n return {\n taskId: attempt.taskId,\n state: toTaskState(attempt, pending),\n deviceId: attempt.deviceId,\n sessionRef,\n ...(attempt.agentRef === undefined ? {} : { agentRef: attempt.agentRef }),\n createdAt: dispatched?.createdAt ?? attempt.updatedAt,\n updatedAt: attempt.updatedAt,\n ...(result === undefined ? {} : { result }),\n ...(pending?.approvalId === undefined ? {} : { pendingApprovalId: pending.approvalId }),\n ...(attempt.claimedHarnessId === undefined ? {} : { claimedHarnessId: attempt.claimedHarnessId }),\n ...(attempt.claimedRuntime === undefined ? {} : { claimedRuntime: attempt.claimedRuntime }),\n ...(attempt.claimedRuntimeCapabilities === undefined\n ? {}\n : { claimedRuntimeCapabilities: attempt.claimedRuntimeCapabilities }),\n };\n}\n\n/**\n * A device row joined with what this process observed of its connection.\n *\n * The identity half is durable and tenant-owned; the connection half is an\n * in-process observation that dies with the server — see `connections.ts` for\n * why `conn.hello`'s runtime discovery block is deliberately not persisted.\n */\nexport function toMachineInfo(device: DeviceRecord, connection: DeviceConnection | undefined): MachineInfo {\n return {\n deviceId: device.deviceId,\n deviceName: device.deviceName,\n connected: connection?.connected ?? false,\n lastSeen: connection?.lastSeen,\n ...(connection?.clientVersion === undefined ? {} : { clientVersion: connection.clientVersion }),\n harnesses: device.harnesses,\n runtimes: connection?.runtimes === undefined ? undefined : [...connection.runtimes],\n configuredToolsets:\n connection?.configuredToolsets === undefined ? undefined : [...connection.configuredToolsets],\n };\n}\n","/**\n * M4 Phase 4 (part A): per-key token bucket, used by `ConnectionHub`\n * (`hub.ts`) to rate-limit inbound daemon->server envelopes per device.\n * Framework-agnostic on purpose (no hub/transport types here) so it stays\n * unit-testable in isolation, mirroring `event-queue.ts`'s own\n * transport-agnostic split.\n *\n * Token bucket, not a fixed window: `burst` tokens are available immediately\n * (accommodating a legitimate short spike — e.g. a reconnect's redelivery\n * catch-up), refilling continuously at `messagesPerSecond` tokens/sec up to\n * that same `burst` ceiling. A bucket is created lazily per key on first use\n * and persists for as long as it stays active — deliberately NOT reset when\n * a device disconnects/reconnects (see `ConnectionHub`'s own use of this\n * class): resetting on reconnect would let a device that just got\n * disconnected for exceeding its budget immediately burst again on\n * reconnect, defeating the limit entirely. It IS dropped once idle long\n * enough that keeping it around would be pointless — see\n * `evictIdleBucketsIfDue`.\n *\n * Construction validates `messagesPerSecond`/`burst` fail-fast (throws\n * `TypeError` on anything non-finite or <= 0) rather than silently building\n * a limiter that either divides into `NaN` token math or (an `Infinity`\n * burst/rate) never actually limits anything.\n *\n * Finding R5 (cross-model re-review — F10 residual): `burst` specifically\n * must be `>= 1`, not merely `> 0`. A `0 < burst < 1` value used to pass\n * the old `<= 0` check cleanly, but `consume()`'s own debit logic\n * (`if (bucket.tokens < 1) return false;`) can NEVER succeed once the\n * bucket's own CEILING (`burst`) is itself below 1 — `Math.min(this.burst,\n * ...)` caps refill there, so `tokens` can never reach 1 no matter how\n * long the bucket sits idle. The old validation let this construct\n * silently — a limiter that rejects every single message, forever, for\n * every key, is not a rate LIMIT, it's a permanent, total block; that\n * should be a construction-time error, not a runtime surprise discovered\n * once real traffic starts getting rejected.\n */\n\nexport interface RateLimiterOptions {\n /** Sustained refill rate, tokens (i.e. messages) per second. Must be a finite number > 0. Default 50. */\n messagesPerSecond?: number;\n /** Bucket capacity — how many messages may arrive back-to-back before the limit engages. Must be a finite number >= 1 (finding R5 — see the module doc comment for why `< 1` can never let a single message through, ever). Default 100. */\n burst?: number;\n /** Hard cap on how many distinct keys (finding R5) this limiter tracks at once — see {@link DEFAULT_MAX_TRACKED_DEVICES}'s own doc comment. Must be a finite number >= 1. Default 10,000. */\n maxTrackedDevices?: number;\n}\n\nconst DEFAULT_MESSAGES_PER_SECOND = 50;\nconst DEFAULT_BURST = 100;\n/**\n * Finding R5 (cross-model re-review — F10 residual): hard cap on\n * `RateLimiter.buckets`' size — see {@link RateLimiter.evictOldestIfAtCapacity}\n * for the eviction policy this backs. Without a HARD cap, the existing idle\n * sweep (`evictIdleBucketsIfDue`) only ever reclaims a bucket once it's\n * been quiet for `idleEvictionThresholdMs` — a flood of many THOUSANDS of\n * genuinely-distinct, ACTIVELY-used keys arriving faster than they ever go\n * idle (a legitimately huge fleet, or a same-shape Sybil-style attack\n * registering many fake device ids) would otherwise grow `buckets` without\n * bound regardless of the idle sweep, exactly the unbounded-growth shape\n * this codebase caps everywhere else (`MAX_PENDING_APPROVALS`,\n * `MAX_TRACKED_TASKS`, `MAX_LIVE_TASK_ANCHORS`, ...). 10,000 is generously\n * sized for any plausible real deployment while still being a genuine,\n * enforced ceiling — not a real-world limit this is expected to ever\n * approach in ordinary operation.\n */\nconst DEFAULT_MAX_TRACKED_DEVICES = 10_000;\n\n/**\n * Sweep cadence for idle-bucket eviction (`evictIdleBucketsIfDue`), in\n * number of `consume()` calls across ALL keys — not a wall-clock timer, so\n * this class stays fully synchronous and framework-agnostic (per this\n * file's own top doc comment): no timer handle to create, `unref`, or clean\n * up on shutdown, and no lifecycle wiring needed in `ConnectionHub`.\n */\nconst EVICTION_SWEEP_EVERY_N_CALLS = 1000;\n\ninterface Bucket {\n tokens: number;\n lastRefillMs: number;\n}\n\nexport class RateLimiter {\n private readonly messagesPerSecond: number;\n private readonly burst: number;\n private readonly buckets = new Map<string, Bucket>();\n /**\n * Wall-clock idle duration (ms) after which a bucket is GUARANTEED to\n * already be refilled to `burst`, regardless of its actual token count at\n * last touch — i.e. the time to go from 0 tokens to `burst` at this\n * instance's configured rate. `evictIdleBucketsIfDue` uses this as the\n * eviction threshold: dropping an entry idle at least this long and\n * recreating it fresh (tokens = burst) on the next `consume()` is\n * therefore behaviorally IDENTICAL to refilling it in place would have\n * been — both cap at `burst` — so eviction is semantically invisible to\n * the caller.\n */\n private readonly idleEvictionThresholdMs: number;\n /** Finding R5: hard cap on `buckets.size` — see {@link DEFAULT_MAX_TRACKED_DEVICES}'s own doc comment. */\n private readonly maxTrackedDevices: number;\n /** Calls to `consume()` since the last sweep — see `EVICTION_SWEEP_EVERY_N_CALLS`. */\n private callsSinceSweep = 0;\n\n constructor(opts: RateLimiterOptions = {}) {\n const messagesPerSecond = opts.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND;\n const burst = opts.burst ?? DEFAULT_BURST;\n const maxTrackedDevices = opts.maxTrackedDevices ?? DEFAULT_MAX_TRACKED_DEVICES;\n if (!Number.isFinite(messagesPerSecond) || messagesPerSecond <= 0) {\n throw new TypeError(`RateLimiter: messagesPerSecond must be a finite number > 0, got ${messagesPerSecond}`);\n }\n // Finding R5: `< 1`, not `<= 0` — see the module doc comment for why a\n // burst between 0 and 1 (exclusive) constructs a limiter that can never\n // let a single message through, ever, for any key.\n if (!Number.isFinite(burst) || burst < 1) {\n throw new TypeError(`RateLimiter: burst must be a finite number >= 1, got ${burst}`);\n }\n if (!Number.isFinite(maxTrackedDevices) || maxTrackedDevices < 1) {\n throw new TypeError(`RateLimiter: maxTrackedDevices must be a finite number >= 1, got ${maxTrackedDevices}`);\n }\n this.messagesPerSecond = messagesPerSecond;\n this.burst = burst;\n this.maxTrackedDevices = maxTrackedDevices;\n this.idleEvictionThresholdMs = (burst / messagesPerSecond) * 1000;\n }\n\n /**\n * Debit one token from `key`'s bucket, refilling first for however much\n * wall-clock time has elapsed since its last refill. Returns `false`\n * (and debits nothing) when the bucket is currently empty — the caller is\n * over budget right now.\n */\n consume(key: string): boolean {\n const now = Date.now();\n this.evictIdleBucketsIfDue(now);\n\n let bucket = this.buckets.get(key);\n if (!bucket) {\n // Finding R5: enforce the hard cap right before growing the map with\n // a genuinely NEW key — see `evictOldestIfAtCapacity`'s own doc\n // comment for the eviction policy and its equivalence/best-effort\n // split.\n this.evictOldestIfAtCapacity();\n bucket = { tokens: this.burst, lastRefillMs: now };\n this.buckets.set(key, bucket);\n } else {\n const elapsedMs = now - bucket.lastRefillMs;\n if (elapsedMs > 0) {\n bucket.tokens = Math.min(this.burst, bucket.tokens + (elapsedMs / 1000) * this.messagesPerSecond);\n bucket.lastRefillMs = now;\n }\n }\n\n if (bucket.tokens < 1) return false;\n bucket.tokens -= 1;\n return true;\n }\n\n /**\n * Every `EVICTION_SWEEP_EVERY_N_CALLS` calls to `consume()`, drops every\n * bucket idle for at least `idleEvictionThresholdMs` (see that field's doc\n * comment for why this is safe). Without this, `buckets` would hold one\n * permanent entry per historical key forever — every device that ever\n * connected, even long after it disconnected for good — growing without\n * bound over a long-lived server's lifetime.\n */\n private evictIdleBucketsIfDue(now: number): void {\n this.callsSinceSweep++;\n if (this.callsSinceSweep < EVICTION_SWEEP_EVERY_N_CALLS) return;\n this.callsSinceSweep = 0;\n for (const [key, bucket] of this.buckets) {\n if (now - bucket.lastRefillMs >= this.idleEvictionThresholdMs) {\n this.buckets.delete(key);\n }\n }\n }\n\n /**\n * Finding R5 (cross-model re-review — F10 residual): called right before\n * inserting a bucket for a genuinely NEW key, evicting the single\n * LEAST-RECENTLY-refilled entry if `buckets` is already at\n * `maxTrackedDevices` — an O(n) scan, but one that only ever runs once\n * the map is already at its hard ceiling (a rare/bounded event under\n * ordinary operation, not a per-call cost), mirroring this codebase's own\n * established \"acceptable O(n) for a rare/bounded case\" precedent (e.g.\n * `audit-log.ts`'s `compactPreservingLiveTasks` during rotation).\n *\n * Equivalence split (stated explicitly, not left implied):\n * - For any evicted bucket that was ALREADY idle for at least\n * `idleEvictionThresholdMs` (i.e. `evictIdleBucketsIfDue` would have\n * reclaimed it anyway, just not yet — sweeps only run every\n * `EVICTION_SWEEP_EVERY_N_CALLS` calls, not continuously), eviction is\n * PROVABLY equivalent to an in-place refill: both cap at `burst`, so a\n * caller can never observe the difference (see `idleEvictionThresholdMs`'s\n * own doc comment for the identical reasoning `evictIdleBucketsIfDue`\n * already relies on).\n * - For a bucket evicted EARLY — still within its idle threshold, forced\n * out only because `buckets` is at capacity (many thousands of\n * genuinely-distinct, actively-used keys, not a quiet one) — this is\n * BEST-EFFORT, not equivalence-preserving: whatever partial token debt\n * that key had is discarded, and its very next `consume()` call starts\n * completely fresh (`tokens: this.burst`), a strictly MORE permissive\n * outcome than if it had kept its place. This is an accepted,\n * deliberately bounded trade-off — it only ever engages under\n * cardinality far beyond any plausible real deployment — favoring\n * bounded memory over perfect per-key continuity in that one extreme\n * case.\n */\n private evictOldestIfAtCapacity(): void {\n if (this.buckets.size < this.maxTrackedDevices) return;\n let oldestKey: string | undefined;\n let oldestLastRefillMs = Infinity;\n for (const [key, bucket] of this.buckets) {\n if (bucket.lastRefillMs < oldestLastRefillMs) {\n oldestLastRefillMs = bucket.lastRefillMs;\n oldestKey = key;\n }\n }\n if (oldestKey !== undefined) this.buckets.delete(oldestKey);\n }\n}\n\n/**\n * The counting `InboundRateLimiter` (`@byok-sdk/cloud`'s store port) this\n * package composes the kernel with.\n *\n * Position matters and is not this adapter's choice: the kernel debits one\n * token at step 0 of its inbound gate, BEFORE the type-allow check, for every\n * envelope that reaches it. That is exactly the choke point the old\n * `ConnectionHub.handleInbound` occupied, which is why both `envelopesIn` (one\n * per envelope, every outcome) and `rateLimitEvents` (one per REJECTED\n * envelope, never coalesced) are counted here and nowhere else.\n *\n * The `device.rate_limited` embedder event is the one thing that IS coalesced,\n * matching the pre-fold rule: an episode fires exactly one event, and only a\n * subsequent SUCCESSFUL consume by that device re-arms it. So a flood produces\n * one event and N counter increments, and a device that recovers and floods\n * again produces a second, distinct event.\n */\nexport interface InboundRateLimiterCounters {\n /** Every envelope handed to the kernel's inbound gate, whatever the gate then decides. */\n envelopesIn: number;\n /** Envelopes the bucket refused. Per envelope — see the episode rule above. */\n rateLimitEvents: number;\n}\n\nexport interface CountingInboundRateLimiter {\n /** The port `CloudStores.rateLimiter` is composed with. */\n readonly limiter: { consume(tenant: string, deviceId: string): Promise<boolean> };\n readonly counters: InboundRateLimiterCounters;\n}\n\n/**\n * Adapt a {@link RateLimiter} to the kernel's `(tenant, deviceId)` port.\n *\n * The bucket key is `${tenant}:${deviceId}` rather than the bare device id: a\n * device id is only unique within its tenant, and a shared key space would let\n * one tenant's flood spend another's budget for a colliding id.\n */\nexport function createCountingInboundRateLimiter(\n limiter: RateLimiter,\n onRateLimited: (deviceId: string, at: string) => void,\n): CountingInboundRateLimiter {\n const counters: InboundRateLimiterCounters = { envelopesIn: 0, rateLimitEvents: 0 };\n /** Devices currently inside a rate-limit episode — see the coalescing rule above. */\n const episodes = new Set<string>();\n\n return {\n counters,\n limiter: {\n async consume(tenant: string, deviceId: string): Promise<boolean> {\n counters.envelopesIn += 1;\n const key = `${tenant}:${deviceId}`;\n if (limiter.consume(key)) {\n episodes.delete(key);\n return true;\n }\n counters.rateLimitEvents += 1;\n if (!episodes.has(key)) {\n episodes.add(key);\n onRateLimited(deviceId, new Date().toISOString());\n }\n return false;\n },\n },\n };\n}\n","import { chmodSync, existsSync, mkdirSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { dirname } from 'node:path';\nimport type { DatabaseSync, DatabaseSyncOptions } from 'node:sqlite';\n\nexport type SqliteOpenStep = 'after-open' | 'after-wal';\n\n/** Test-only seam for proving that post-open initialization failures release the native handle. */\nexport interface SqliteOpenFaultSeam {\n onStep?(step: SqliteOpenStep): void;\n close?(db: DatabaseSync): void;\n}\n\n/**\n * Preserve the initialization error after deterministically releasing an\n * already-open SQLite handle. If cleanup itself fails, surface both failures\n * instead of losing the reason construction failed or pretending ownership\n * was returned.\n */\nexport function closeSqliteDatabaseAfterInitializationFailure(\n db: DatabaseSync,\n initializationError: unknown,\n message: string,\n close: (db: DatabaseSync) => void = (database) => database.close(),\n): never {\n try {\n close(db);\n } catch (closeError) {\n throw new AggregateError([initializationError, closeError], message);\n }\n throw initializationError;\n}\n\n/**\n * Thrown when `node:sqlite` isn't available in the running Node.js binary.\n * `node:sqlite` shipped in Node.js 22.5.0 (https://nodejs.org/api/sqlite.html)\n * and remains marked experimental there (an `ExperimentalWarning` on stderr\n * is expected and harmless — not an error). The SQLite-backed embedded store\n * composition deliberately\n * depend on nothing else — no `better-sqlite3` or other native module —\n * because staying at zero native dependencies is required to keep\n * `@byok-sdk/server` trivially packageable across platforms. The tradeoff is\n * that this composition simply doesn't work below Node 22.5; this error says so\n * clearly and up front, instead of letting a cryptic `Cannot find module\n * 'node:sqlite'` surface from deep inside a query.\n */\nexport class SqliteUnavailableError extends Error {\n constructor(cause: unknown) {\n super(\n 'node:sqlite is unavailable in this Node.js runtime. The SQLite-backed reference ' +\n 'store composition requires Node.js 22.5+ with the built-in ' +\n '`node:sqlite` module (no native dependency is used or allowed here). Upgrade Node.js, ' +\n 'or select the default in-memory server storage instead.',\n );\n this.name = 'SqliteUnavailableError';\n this.cause = cause;\n }\n}\n\n/** `node:sqlite`'s minimum Node.js version (https://nodejs.org/api/sqlite.html). */\nconst MIN_NODE_MAJOR = 22;\nconst MIN_NODE_MINOR = 5;\n\n/**\n * Whether `nodeVersion` (a `major.minor.patch` string shaped like\n * `process.versions.node`) is new enough to have `node:sqlite` at all.\n * Exported only for this package's own tests to exercise the guard\n * deterministically (this dev/CI machine is already on a qualifying Node,\n * so the real \"unavailable\" path can't be triggered end-to-end here) — not\n * re-exported from `index.ts`, so not part of the public package API.\n * Unparsable input returns `true` (don't false-negative on a version string\n * shape this hasn't seen before): `loadSqliteModule`'s own `require` call is\n * the real, authoritative gate; this check only exists to turn the common\n * case (a too-old Node) into a clear message instead of a cryptic one.\n *\n * Not a sufficient capability check on its own: `node:sqlite` shipped in\n * Node 22.5.0 behind the `--experimental-sqlite` flag and only became usable\n * unflagged in a later 22.x release (https://nodejs.org/api/sqlite.html), so\n * a runtime that satisfies this version check can still fail to actually\n * load the module. Use {@link isSqliteAvailable} when the question is \"can I\n * use `node:sqlite` right now\", not \"is the Node version new enough for it\n * to exist at all\".\n */\nexport function isSqliteCapableNodeVersion(nodeVersion: string): boolean {\n const [majorStr, minorStr] = nodeVersion.split('.');\n const major = Number(majorStr);\n const minor = Number(minorStr);\n if (!Number.isFinite(major) || !Number.isFinite(minor)) return true;\n return major > MIN_NODE_MAJOR || (major === MIN_NODE_MAJOR && minor >= MIN_NODE_MINOR);\n}\n\nlet sqliteModule: typeof import('node:sqlite') | undefined;\n\n/**\n * Synchronously load `node:sqlite` via `createRequire` rather than a dynamic\n * `import()`. Every reference store in this package (`InMemoryTaskStore`,\n * `LocalDiskBlobStore`) constructs synchronously via `new`, and\n * `node:sqlite`'s own API (`DatabaseSync`) is itself fully synchronous — an\n * async factory here would be the odd one out and would leak into every\n * caller (`createByokServer`, the example, tests). `node:sqlite` is a\n * built-in, so `require('node:sqlite')` resolves it even from this\n * `\"type\": \"module\"` package. Throws {@link SqliteUnavailableError} (not a\n * raw `MODULE_NOT_FOUND`/version-mismatch trace) when it can't be loaded —\n * checking the Node version first (see {@link isSqliteCapableNodeVersion})\n * gives the common \"Node too old\" case a specific, actionable message\n * before even attempting the `require`.\n */\nfunction loadSqliteModule(): typeof import('node:sqlite') {\n if (sqliteModule) return sqliteModule;\n if (!isSqliteCapableNodeVersion(process.versions.node)) {\n throw new SqliteUnavailableError(\n new Error(\n `node:sqlite requires Node.js ${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}+; detected ${process.versions.node}`,\n ),\n );\n }\n try {\n const require = createRequire(import.meta.url);\n sqliteModule = require('node:sqlite') as typeof import('node:sqlite');\n return sqliteModule;\n } catch (err) {\n throw new SqliteUnavailableError(err);\n }\n}\n\n/**\n * Whether `node:sqlite` can ACTUALLY be loaded right now — the authoritative\n * capability check, in contrast to {@link isSqliteCapableNodeVersion}'s\n * version-string heuristic. This is what this package's own test suite uses\n * to decide whether to skip the SQLite-backed reference-store tests (rather\n * than fail them), and what anything else should call before assuming a\n * `SqliteTaskStore`/`SqliteBlobStore` can be constructed: it attempts the\n * real `require('node:sqlite')` (via {@link loadSqliteModule}, memoized) and\n * reports whether that succeeded, so it agrees with reality regardless of\n * whether the current runtime is old, too-new-but-flagged, or fully capable.\n */\nexport function isSqliteAvailable(): boolean {\n try {\n loadSqliteModule();\n return true;\n } catch {\n return false;\n }\n}\n\n/** Busy-timeout (ms) shared by both SQLite stores: long enough that two same-process `DatabaseSync` connections opened against the same file back-to-back (e.g. a test proving restart-safety by opening a \"second instance\" against the same path) don't spuriously throw `SQLITE_BUSY` under momentary write-lock contention. */\nconst DEFAULT_BUSY_TIMEOUT_MS = 5_000;\n\n/** POSIX mode both SQLite reference-store db files (and their WAL/SHM siblings) are secured to — owner read/write only, no group/other access. Matches the convention the client-side device credential store already uses (`packages/client/src/daemon/store.ts`). */\nconst SECURE_FILE_MODE = 0o600;\n/** POSIX mode applied to a freshly-created directory holding a SQLite reference-store db file — owner read/write/execute only. Same rationale as {@link SECURE_FILE_MODE}. */\nconst SECURE_DIR_MODE = 0o700;\n\n/**\n * Open (or create) a `node:sqlite` `DatabaseSync` at `path`, applying the\n * pragmas both reference SQLite stores share: WAL journaling for a\n * file-backed database (allows a reader and a writer to proceed without\n * blocking each other, and is what makes \"close instance A, open instance B\n * on the same file\" — the restart-safety story — reliable) and a busy\n * timeout (see {@link DEFAULT_BUSY_TIMEOUT_MS}). WAL is skipped for\n * `:memory:`, where it's meaningless. For a file-backed path whose parent\n * directory doesn't exist yet, creates it (recursively) at\n * {@link SECURE_DIR_MODE} — mirroring the client-side device store's\n * convention of never leaving a credential directory at a permissive\n * default mode. Throws {@link SqliteUnavailableError} if `node:sqlite`\n * itself can't be loaded (Node <22.5, or a flagged intermediate 22.x — see\n * {@link isSqliteAvailable}) — callers don't need their own guard for that;\n * this is the single choke point.\n */\nexport function openSqliteDatabase(\n path: string,\n options?: DatabaseSyncOptions,\n faults?: SqliteOpenFaultSeam,\n): DatabaseSync {\n const { DatabaseSync } = loadSqliteModule();\n if (path !== ':memory:') {\n mkdirSync(dirname(path), { recursive: true, mode: SECURE_DIR_MODE });\n }\n const db = new DatabaseSync(path, { timeout: DEFAULT_BUSY_TIMEOUT_MS, ...options });\n try {\n faults?.onStep?.('after-open');\n if (path !== ':memory:') {\n db.exec('PRAGMA journal_mode = WAL;');\n faults?.onStep?.('after-wal');\n }\n return db;\n } catch (error) {\n closeSqliteDatabaseAfterInitializationFailure(\n db,\n error,\n 'SQLite open initialization failed and its native handle could not be closed',\n faults?.close,\n );\n }\n}\n\n/**\n * Restrict `dbPath` and its WAL/SHM sibling files (`<path>-wal`,\n * `<path>-shm` — created by SQLite itself once WAL mode is active and a\n * write has happened) to owner-only read/write ({@link SECURE_FILE_MODE}).\n * Both SQLite reference stores hold sensitive bytes on disk with no other\n * access-control layer of their own — `SqliteBlobStore` an HMAC signing\n * secret plus arbitrary uploaded blob content, `SqliteTaskStore` task\n * instructions and device/session refs — so a real (non-`:memory:`)\n * database file must not be left at whatever permissive mode the process'\n * umask would otherwise give it.\n *\n * Call this AFTER the schema has been created against `dbPath` (so the\n * WAL/SHM files, which SQLite creates lazily on first write, already exist)\n * — a sibling file that doesn't exist yet is silently skipped rather than\n * treated as an error. No-op for `:memory:`.\n */\nexport function secureSqliteFilePermissions(dbPath: string): void {\n if (dbPath === ':memory:') return;\n for (const candidate of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {\n if (existsSync(candidate)) {\n chmodSync(candidate, SECURE_FILE_MODE);\n }\n }\n}\n","import {\n PRESENCE_LEVELS,\n type PresenceStore,\n type TenantId,\n type TenantReadiness,\n type TenantReadinessDevice,\n} from '@byok-sdk/core';\nimport type { DeviceDirectory, DeviceRecord, DeviceRegistration } from '@byok-sdk/cloud';\nimport { HarnessInventorySchema, type HarnessInfo } from '@byok-sdk/protocol';\nimport type { DatabaseSync } from 'node:sqlite';\n\nexport const DEVICE_SCHEMA = `\nCREATE TABLE device_directory (\n tenant_id TEXT NOT NULL,\n device_id TEXT NOT NULL UNIQUE,\n product_id TEXT NOT NULL,\n machine_id TEXT,\n device_name TEXT NOT NULL,\n device_public_key TEXT NOT NULL,\n proof_key_id TEXT NOT NULL,\n proof_key_epoch INTEGER NOT NULL CHECK (proof_key_epoch >= 0),\n capabilities_json TEXT,\n harnesses_json TEXT,\n PRIMARY KEY (tenant_id, device_id)\n);\nCREATE UNIQUE INDEX device_directory_machine\n ON device_directory (tenant_id, product_id, machine_id) WHERE machine_id IS NOT NULL;\n`;\n\ninterface Coordinator {\n run<T>(operation: (db: DatabaseSync) => T | Promise<T>): Promise<T>;\n transaction<T>(operation: (db: DatabaseSync) => T | Promise<T>): Promise<T>;\n}\n\ntype Row = Record<string, unknown>;\nfunction requiredString(row: Row, field: string): string {\n const value = row[field];\n if (typeof value !== 'string' || value.length === 0) throw new Error(`Invalid SQLite device ${field}`);\n return value;\n}\nfunction capabilities(value: unknown): readonly string[] {\n if (!Array.isArray(value) || value.some(item => typeof item !== 'string')) {\n throw new Error('Invalid SQLite device capabilities');\n }\n return Object.freeze([...value]);\n}\nfunction fromRow(row: Row): DeviceRecord {\n const epoch = row.proof_key_epoch;\n if (typeof epoch !== 'number' || !Number.isSafeInteger(epoch) || epoch < 0) {\n throw new Error('Invalid SQLite device proof_key_epoch');\n }\n return {\n tenantId: requiredString(row, 'tenant_id') as TenantId,\n deviceId: requiredString(row, 'device_id'),\n productId: requiredString(row, 'product_id'),\n deviceName: requiredString(row, 'device_name'),\n devicePublicKey: requiredString(row, 'device_public_key'),\n proofKeyId: requiredString(row, 'proof_key_id'),\n proofKeyEpoch: epoch,\n revoked: false,\n ...(row.machine_id === null ? {} : { machineId: requiredString(row, 'machine_id') }),\n ...(row.capabilities_json === null ? {} : {\n capabilities: capabilities(JSON.parse(requiredString(row, 'capabilities_json'))),\n }),\n ...(row.harnesses_json === null ? {} : {\n harnesses: HarnessInventorySchema.parse(JSON.parse(requiredString(row, 'harnesses_json'))),\n }),\n };\n}\n\n/** Enrollment, capability admission and pre-tenant auth read the same durable row. */\nexport class SqliteDeviceDirectory implements DeviceDirectory {\n constructor(private readonly coordinator: Coordinator) {}\n\n register(tenant: TenantId, input: DeviceRegistration): Promise<DeviceRecord> {\n return this.coordinator.transaction(db => {\n // Global device IDs resolve a tenant before authentication. A collision must\n // fail rather than replacing another tenant's authentication authority.\n const owner = db.prepare('SELECT tenant_id FROM device_directory WHERE device_id = ?').get(input.deviceId);\n if (owner !== undefined && owner.tenant_id !== tenant) throw new Error('Device ID already belongs to another tenant');\n if (input.machineId !== undefined) {\n db.prepare('DELETE FROM device_directory WHERE tenant_id = ? AND product_id = ? AND machine_id = ? AND device_id <> ?')\n .run(tenant, input.productId, input.machineId, input.deviceId);\n }\n db.prepare(`INSERT INTO device_directory\n (tenant_id, device_id, product_id, machine_id, device_name, device_public_key, proof_key_id, proof_key_epoch)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT (tenant_id, device_id) DO UPDATE SET\n product_id = excluded.product_id, machine_id = excluded.machine_id,\n device_name = excluded.device_name, device_public_key = excluded.device_public_key,\n proof_key_id = excluded.proof_key_id, proof_key_epoch = excluded.proof_key_epoch,\n capabilities_json = NULL, harnesses_json = NULL`)\n .run(tenant, input.deviceId, input.productId, input.machineId ?? null,\n input.deviceName, input.devicePublicKey, input.proofKeyId, input.proofKeyEpoch);\n return fromRow(db.prepare('SELECT * FROM device_directory WHERE tenant_id = ? AND device_id = ?').get(tenant, input.deviceId)!);\n });\n }\n\n get(tenant: TenantId, deviceId: string): Promise<DeviceRecord | undefined> {\n return this.coordinator.run(db => {\n const row = db.prepare('SELECT * FROM device_directory WHERE tenant_id = ? AND device_id = ?').get(tenant, deviceId);\n return row === undefined ? undefined : fromRow(row);\n });\n }\n\n revoke(tenant: TenantId, deviceId: string): Promise<void> {\n return this.coordinator.run(db => {\n db.prepare('DELETE FROM device_directory WHERE tenant_id = ? AND device_id = ?').run(tenant, deviceId);\n });\n }\n\n list(tenant: TenantId): Promise<readonly DeviceRecord[]> {\n return this.coordinator.run(db => db.prepare('SELECT * FROM device_directory WHERE tenant_id = ? ORDER BY device_id')\n .all(tenant).map(fromRow));\n }\n\n resolveByDeviceId(deviceId: string): Promise<DeviceRecord | undefined> {\n return this.coordinator.run(db => {\n const row = db.prepare('SELECT * FROM device_directory WHERE device_id = ?').get(deviceId);\n return row === undefined ? undefined : fromRow(row);\n });\n }\n\n recordCapabilities(tenant: TenantId, input: {\n readonly deviceId: string; readonly capabilities: readonly string[]; readonly harnesses?: readonly HarnessInfo[];\n }): Promise<DeviceRecord | undefined> {\n return this.coordinator.transaction(db => {\n const row = db.prepare('SELECT * FROM device_directory WHERE tenant_id = ? AND device_id = ?').get(tenant, input.deviceId);\n if (row === undefined) return undefined;\n fromRow(row);\n const declaredCapabilities = capabilities(input.capabilities);\n const harnesses = HarnessInventorySchema.parse(input.harnesses ?? []);\n db.prepare('UPDATE device_directory SET capabilities_json = ?, harnesses_json = ? WHERE tenant_id = ? AND device_id = ?')\n .run(JSON.stringify(declaredCapabilities), JSON.stringify(harnesses), tenant, input.deviceId);\n return fromRow(db.prepare('SELECT * FROM device_directory WHERE tenant_id = ? AND device_id = ?').get(tenant, input.deviceId)!);\n });\n }\n\n async readiness(tenant: TenantId, presence: PresenceStore): Promise<TenantReadiness> {\n const devices = await this.list(tenant);\n const livePresence = await presence.list(tenant);\n const presenceByDevice = new Map(livePresence.map((hint) => [hint.deviceId, hint]));\n const activeDeviceIds = new Set(\n devices.filter((device) => !device.revoked).map((device) => device.deviceId),\n );\n const observedPresenceByLevel = Object.fromEntries(\n PRESENCE_LEVELS.map((level) => [level, 0]),\n ) as Record<(typeof PRESENCE_LEVELS)[number], number>;\n for (const hint of livePresence) {\n if (!activeDeviceIds.has(hint.deviceId)) continue;\n observedPresenceByLevel[hint.level] += 1;\n }\n return {\n tenantId: tenant,\n activePairedDeviceCount: devices.filter((device) => !device.revoked).length,\n revokedDeviceCount: devices.filter((device) => device.revoked).length,\n observedPresenceCount: Object.values(observedPresenceByLevel).reduce(\n (total, count) => total + count,\n 0,\n ),\n observedPresenceByLevel,\n devices: [...devices]\n .sort((left, right) => left.deviceId.localeCompare(right.deviceId))\n .map((device): TenantReadinessDevice => {\n const hint = device.revoked ? undefined : presenceByDevice.get(device.deviceId);\n return {\n deviceId: device.deviceId,\n productId: device.productId,\n deviceName: device.deviceName,\n revoked: device.revoked,\n ...(hint === undefined\n ? {}\n : {\n presence: {\n level: hint.level,\n ...(hint.detail === undefined ? {} : { detail: hint.detail }),\n ...(hint.configuredToolsets === undefined\n ? {}\n : { configuredToolsets: hint.configuredToolsets }),\n ...(hint.clientVersion === undefined ? {} : { clientVersion: hint.clientVersion }),\n ...(hint.protocolVersions === undefined\n ? {}\n : { protocolVersions: hint.protocolVersions }),\n ...(hint.runtimes === undefined ? {} : { runtimes: hint.runtimes }),\n observedAt: hint.observedAt,\n expiresAt: hint.expiresAt,\n },\n }),\n };\n }),\n };\n }\n\n}\n","import {\n ByokCoreError,\n CoreConflictError,\n InMemoryQuotaStore,\n assertCanonicalTimestamp,\n createInMemoryCoreStores,\n isLegalObjectTransition,\n type Clock,\n type ContentHash,\n type CoreStores,\n type MailboxAppendInput,\n type MailboxCursorState,\n type MailboxMessage,\n type MailboxPage,\n type MailboxReadQuery,\n type MailboxRecordDeliveryInput,\n type MailboxAdvanceCursorInput,\n type MailboxRetentionInput,\n type MailboxRetentionResult,\n type MailboxStore,\n type ObjectCommitInput,\n type ObjectListQuery,\n type ObjectManifestEntry,\n type ObjectManifestInput,\n type ObjectReferenceInput,\n type ObjectStore,\n type StorageReservation,\n type TenantId,\n} from '@byok-sdk/core';\nimport {\n InMemoryPairingCodeStore,\n assertTaskAttemptListLimit,\n createInMemoryCloudStores,\n type AgentMessageAdmission,\n type AgentRef,\n type BlobContentProxy,\n type CloudBlobStore,\n type BlobObservation,\n type BlobReadResult,\n type BlobWriteResult,\n type CloudCrypto,\n type CloudStores,\n type RequestReceipt,\n type RequestReceiptStore,\n type TaskAttempt,\n type TaskAttemptListQuery,\n type TaskAttemptPage,\n type TaskAttemptStatus,\n type TaskAttemptStore,\n type TaskCancellationMutation,\n type TaskCancellationRequest,\n type TaskCancellationStore,\n} from '@byok-sdk/cloud';\nimport { byokBlobContentPath, type RuntimeCapabilities, type RuntimeId } from '@byok-sdk/protocol';\nimport type { DatabaseSync } from 'node:sqlite';\nimport {\n closeSqliteDatabaseAfterInitializationFailure,\n openSqliteDatabase,\n secureSqliteFilePermissions,\n} from '../../sqlite-support';\n\nconst DEFAULT_MAILBOX_READ_LIMIT = 50;\nconst DEFAULT_OBJECT_LIST_LIMIT = 100;\nconst DEFAULT_BLOB_URL_TTL_MS = 15 * 60_000;\nconst SIGNING_SECRET_BYTES = 32;\nconst SQLITE_SCHEMA_VERSION = '3';\n\nimport { SqliteDeviceDirectory, DEVICE_SCHEMA } from './device-directory';\n\nconst RECEIPT_SCHEMA = `\nCREATE TABLE request_receipt (\n tenant_id TEXT NOT NULL,\n key TEXT NOT NULL,\n body TEXT NOT NULL,\n recorded_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, key)\n);\n`;\n\nconst SCHEMA = `\nCREATE TABLE IF NOT EXISTS byok_sqlite_meta (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS mailbox_cursor (\n tenant_id TEXT NOT NULL,\n device_id TEXT NOT NULL,\n next_seq INTEGER NOT NULL DEFAULT 1,\n delivered_seq INTEGER NOT NULL DEFAULT 0,\n acked_seq INTEGER NOT NULL DEFAULT 0,\n updated_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, device_id)\n);\nCREATE TABLE IF NOT EXISTS mailbox_message (\n tenant_id TEXT NOT NULL,\n device_id TEXT NOT NULL,\n seq INTEGER NOT NULL,\n message_id TEXT NOT NULL,\n body TEXT NOT NULL,\n body_hash TEXT NOT NULL,\n byte_size TEXT NOT NULL,\n state TEXT NOT NULL CHECK (state IN ('pending', 'acked', 'expired')),\n appended_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, device_id, seq),\n UNIQUE (tenant_id, device_id, message_id)\n);\nCREATE TABLE IF NOT EXISTS task_attempt (\n tenant_id TEXT NOT NULL,\n task_id TEXT NOT NULL,\n device_id TEXT NOT NULL,\n agent_ref_json TEXT,\n owner_device_id TEXT,\n claimed_runtime TEXT,\n claimed_runtime_capabilities_json TEXT,\n status TEXT NOT NULL,\n terminal_cause TEXT,\n cancellation_requested_at TEXT,\n cancellation_reason TEXT,\n cancellation_message_id TEXT,\n updated_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, task_id)\n);\nCREATE TABLE IF NOT EXISTS agent_message_admission (\n tenant_id TEXT NOT NULL,\n task_id TEXT NOT NULL,\n message_id TEXT NOT NULL,\n payload_body TEXT NOT NULL,\n terminal_body TEXT,\n PRIMARY KEY (tenant_id, task_id)\n);\nCREATE TABLE IF NOT EXISTS object_manifest (\n tenant_id TEXT NOT NULL,\n hash TEXT NOT NULL,\n byte_size TEXT NOT NULL,\n content_type TEXT NOT NULL,\n state TEXT NOT NULL CHECK (state IN ('pending', 'committed', 'delete_pending', 'deleted')),\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL,\n delete_pending_at TEXT,\n PRIMARY KEY (tenant_id, hash)\n);\nCREATE TABLE IF NOT EXISTS object_reference (\n tenant_id TEXT NOT NULL,\n hash TEXT NOT NULL,\n ref_kind TEXT NOT NULL,\n ref_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n PRIMARY KEY (tenant_id, hash, ref_kind, ref_id),\n FOREIGN KEY (tenant_id, hash) REFERENCES object_manifest(tenant_id, hash) ON DELETE CASCADE\n);\nCREATE TABLE IF NOT EXISTS blob (\n blob_id TEXT PRIMARY KEY,\n tenant_id TEXT NOT NULL,\n reservation_id TEXT NOT NULL,\n content_hash TEXT NOT NULL,\n byte_size TEXT NOT NULL,\n content_type TEXT NOT NULL,\n uploaded INTEGER NOT NULL DEFAULT 0,\n data BLOB,\n UNIQUE (tenant_id, reservation_id)\n);\n`;\n\nexport interface SqliteEmbeddedStoreOptions {\n readonly path: string;\n readonly urlTtlMs?: number;\n readonly migration?: 'v1-to-v3' | 'v2-to-v3';\n}\n\nexport interface SqliteEmbeddedStores {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n readonly blobContentProxy: BlobContentProxy;\n close(): Promise<void>;\n}\n\n/** One serialized owner for the synchronous SQLite handle and every transaction on it. */\nclass SqliteCoordinator {\n readonly db: DatabaseSync;\n #tail: Promise<void> = Promise.resolve();\n #closing = false;\n #closePromise: Promise<void> | undefined;\n\n constructor(path: string, migration?: 'v1-to-v3' | 'v2-to-v3') {\n this.db = openSqliteDatabase(path);\n try {\n // The host must stop every old writer before this open. A version fence\n // prevents later downgrade opens, not writes through an already-open handle.\n this.db.exec('BEGIN IMMEDIATE');\n try {\n const hasMetadata = this.db\n .prepare(\"SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'byok_sqlite_meta'\")\n .get();\n if (hasMetadata !== undefined) {\n const version = this.db.prepare(\"SELECT value FROM byok_sqlite_meta WHERE key = 'schema_version'\")\n .get() as { value: string } | undefined;\n if (version?.value !== SQLITE_SCHEMA_VERSION && !((version?.value === '1' && migration === 'v1-to-v3') || (version?.value === '2' && migration === 'v2-to-v3'))) {\n throw new Error(`Unsupported BYOK SQLite schema version ${JSON.stringify(version?.value)}; ` +\n `this build requires ${SQLITE_SCHEMA_VERSION}. Stop all writers, back up the database and explicitly select migration: 'v1-to-v3' or 'v2-to-v3' for a receipt-free legacy database without task history.`);\n }\n // Do not silently recreate missing durable authorities in an existing file.\n for (const projection of [\n 'tenant_id, device_id, next_seq, delivered_seq, acked_seq, updated_at FROM mailbox_cursor',\n 'tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at FROM mailbox_message',\n 'tenant_id, task_id, device_id, agent_ref_json, owner_device_id, claimed_runtime, claimed_runtime_capabilities_json, status, terminal_cause, cancellation_requested_at, cancellation_reason, cancellation_message_id, updated_at FROM task_attempt',\n 'tenant_id, task_id, message_id, payload_body, terminal_body FROM agent_message_admission',\n 'tenant_id, hash, byte_size, content_type, state, created_at, updated_at, delete_pending_at FROM object_manifest',\n 'tenant_id, hash, ref_kind, ref_id, created_at FROM object_reference',\n 'blob_id, tenant_id, reservation_id, content_hash, byte_size, content_type, uploaded, data FROM blob',\n ]) {\n this.db.prepare(`SELECT ${projection} LIMIT 0`);\n }\n if (version?.value !== SQLITE_SCHEMA_VERSION) {\n // Old compositions lost these facts on restart. Never synthesize\n // receipts from status, mailbox bodies or a caller's retry payload.\n for (const table of ['task_attempt', 'mailbox_message', 'agent_message_admission']) {\n if (this.db.prepare(`SELECT 1 FROM ${table} LIMIT 1`).get() !== undefined) {\n throw new Error('Cannot migrate BYOK SQLite database with task history: historical receipts are unavailable; preserve this database for reconciliation');\n }\n }\n if (this.db.prepare('SELECT 1 FROM mailbox_cursor WHERE next_seq <> 1 OR delivered_seq <> 0 OR acked_seq <> 0 LIMIT 1').get() !== undefined) {\n throw new Error('Cannot migrate BYOK SQLite database with delivery history: historical receipts are unavailable; preserve this database for reconciliation');\n }\n if (this.db.prepare(\"SELECT 1 FROM sqlite_master WHERE name = 'request_receipt'\").get() !== undefined) {\n throw new Error('Unexpected request receipt authority in legacy BYOK SQLite schema');\n }\n this.db.exec(RECEIPT_SCHEMA);\n }\n if (version?.value === '1') {\n const unexpected = this.db.prepare(\"SELECT 1 FROM sqlite_master WHERE name = 'device_directory'\").get();\n if (unexpected !== undefined) throw new Error('Unexpected device directory in BYOK SQLite schema v1');\n this.db.exec(DEVICE_SCHEMA);\n }\n if (version?.value !== SQLITE_SCHEMA_VERSION) {\n this.db.prepare(\"UPDATE byok_sqlite_meta SET value = ? WHERE key = 'schema_version'\").run(SQLITE_SCHEMA_VERSION);\n }\n } else {\n const existing = this.db.prepare(\"SELECT 1 FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'\").get();\n if (existing !== undefined) throw new Error('Existing SQLite database has no BYOK schema metadata');\n this.db.exec(SCHEMA);\n this.db.exec(RECEIPT_SCHEMA);\n this.db.exec(DEVICE_SCHEMA);\n this.db.prepare(\"INSERT INTO byok_sqlite_meta (key, value) VALUES ('schema_version', ?)\").run(SQLITE_SCHEMA_VERSION);\n }\n this.db.prepare('SELECT tenant_id, device_id, product_id, machine_id, device_name, device_public_key, proof_key_id, proof_key_epoch, capabilities_json, harnesses_json FROM device_directory LIMIT 0');\n const receiptColumns = this.db.prepare('PRAGMA table_info(request_receipt)').all() as unknown as\n { name: string; type: string; notnull: number; pk: number }[];\n const expectedColumns = ['tenant_id', 'key', 'body', 'recorded_at'];\n if (receiptColumns.length !== expectedColumns.length || receiptColumns.some((column, index) =>\n column.name !== expectedColumns[index] || column.type !== 'TEXT' || column.notnull !== 1 ||\n column.pk !== (index < 2 ? index + 1 : 0))) {\n throw new Error('Invalid BYOK SQLite request receipt schema');\n }\n this.db.exec('COMMIT');\n } catch (error) {\n this.db.exec('ROLLBACK');\n throw error;\n }\n secureSqliteFilePermissions(path);\n } catch (error) {\n closeSqliteDatabaseAfterInitializationFailure(\n this.db, error,\n 'SQLite embedded composition initialization failed and its native handle could not be closed',\n );\n }\n }\n\n run<T>(operation: (db: DatabaseSync) => T | Promise<T>): Promise<T> {\n if (this.#closing) return Promise.reject(new Error('SQLite embedded composition is closed'));\n const result = this.#tail.then(() => operation(this.db));\n this.#tail = result.then(() => undefined, () => undefined);\n return result;\n }\n\n transaction<T>(operation: (db: DatabaseSync) => T | Promise<T>): Promise<T> {\n return this.run(async (db) => {\n db.exec('BEGIN IMMEDIATE');\n try {\n const result = await operation(db);\n db.exec('COMMIT');\n return result;\n } catch (error) {\n try {\n db.exec('ROLLBACK');\n } catch {\n // The original failure remains authoritative.\n }\n throw error;\n }\n });\n }\n\n close(): Promise<void> {\n if (this.#closePromise !== undefined) return this.#closePromise;\n this.#closing = true;\n this.#closePromise = this.#tail.then(() => this.db.close());\n return this.#closePromise;\n }\n}\n\ninterface TaskRow extends Record<string, unknown> {\n tenant_id: string;\n task_id: string;\n device_id: string;\n agent_ref_json: string | null;\n owner_device_id: string | null;\n claimed_runtime: string | null;\n claimed_runtime_capabilities_json: string | null;\n status: string;\n terminal_cause: string | null;\n cancellation_requested_at: string | null;\n cancellation_reason: string | null;\n cancellation_message_id: string | null;\n updated_at: string;\n}\n\nfunction taskRow(row: TaskRow): TaskAttempt {\n return {\n tenantId: row.tenant_id as TenantId,\n taskId: row.task_id,\n deviceId: row.device_id,\n ...(row.agent_ref_json === null ? {} : { agentRef: JSON.parse(row.agent_ref_json) as AgentRef }),\n ...(row.owner_device_id === null ? {} : { ownerDeviceId: row.owner_device_id }),\n ...(row.claimed_runtime === null ? {} : { claimedRuntime: row.claimed_runtime as RuntimeId }),\n ...(row.claimed_runtime_capabilities_json === null\n ? {}\n : { claimedRuntimeCapabilities: JSON.parse(row.claimed_runtime_capabilities_json) as RuntimeCapabilities }),\n status: row.status as TaskAttemptStatus,\n ...(row.terminal_cause === null ? {} : { terminalCause: row.terminal_cause }),\n ...(row.cancellation_requested_at === null\n ? {}\n : {\n cancellation: {\n requestedAt: row.cancellation_requested_at,\n ...(row.cancellation_reason === null ? {} : { reason: row.cancellation_reason }),\n },\n }),\n updatedAt: row.updated_at,\n };\n}\n\nfunction readTask(db: DatabaseSync, tenant: TenantId, taskId: string): TaskAttempt | undefined {\n const row = db.prepare('SELECT * FROM task_attempt WHERE tenant_id = ? AND task_id = ?').get(tenant, taskId) as\n | TaskRow\n | undefined;\n return row === undefined ? undefined : taskRow(row);\n}\n\nfunction sameAgentRef(left: AgentRef | undefined, right: AgentRef | undefined): boolean {\n return left?.agentId === right?.agentId && left?.profileRevision === right?.profileRevision;\n}\n\n/** Receipts are lifetime facts: mailbox retirement must never delete them. */\nclass SqliteRequestReceiptStore implements RequestReceiptStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n record(tenant: TenantId, input: { key: string; body: string }): Promise<{ receipt: RequestReceipt; created: boolean }> {\n // The INSERT is atomic; rows are immutable and never deleted, so the\n // following read cannot observe a different winner. No async lock is held.\n return this.coordinator.run((db) => {\n const result = db.prepare(\n `INSERT INTO request_receipt (tenant_id, key, body, recorded_at) VALUES (?, ?, ?, ?)\n ON CONFLICT (tenant_id, key) DO NOTHING`,\n ).run(tenant, input.key, input.body, this.clock.now().toISOString());\n return { receipt: this.#read(db, tenant, input.key)!, created: Number(result.changes) === 1 };\n });\n }\n\n get(tenant: TenantId, key: string): Promise<RequestReceipt | undefined> {\n return this.coordinator.run((db) => this.#read(db, tenant, key));\n }\n\n #read(db: DatabaseSync, tenant: TenantId, key: string): RequestReceipt | undefined {\n const row = db.prepare('SELECT body, recorded_at FROM request_receipt WHERE tenant_id = ? AND key = ?')\n .get(tenant, key) as { body: string; recorded_at: string } | undefined;\n return row === undefined ? undefined : { tenantId: tenant, key, body: row.body, recordedAt: row.recorded_at };\n }\n}\n\nexport class SqliteTaskAttemptStore implements TaskAttemptStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n open(tenant: TenantId, input: { taskId: string; deviceId: string; agentRef?: AgentRef }): Promise<TaskAttempt> {\n return this.coordinator.run((db) => {\n db.prepare(\n `INSERT OR IGNORE INTO task_attempt\n (tenant_id, task_id, device_id, agent_ref_json, status, updated_at)\n VALUES (?, ?, ?, ?, 'offered', ?)`,\n ).run(tenant, input.taskId, input.deviceId, input.agentRef === undefined ? null : JSON.stringify(input.agentRef), this.#now());\n return readTask(db, tenant, input.taskId)!;\n });\n }\n\n reserveAgentOffer(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; agentRef: AgentRef },\n ): Promise<{ attempt: TaskAttempt; created: boolean }> {\n return this.coordinator.run((db) => {\n const result = db.prepare(\n `INSERT OR IGNORE INTO task_attempt\n (tenant_id, task_id, device_id, agent_ref_json, status, updated_at)\n VALUES (?, ?, ?, ?, 'offered', ?)`,\n ).run(tenant, input.taskId, input.deviceId, JSON.stringify(input.agentRef), this.#now());\n return { attempt: readTask(db, tenant, input.taskId)!, created: Number(result.changes) === 1 };\n });\n }\n\n reserveAgentMessage(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; messageId: string; payloadBody: string },\n ): Promise<'reserved' | 'pending' | 'rejected'> {\n return this.coordinator.run((db) => {\n const attempt = readTask(db, tenant, input.taskId);\n if (attempt === undefined || attempt.deviceId !== input.deviceId) return 'rejected';\n const existing = db.prepare(\n 'SELECT message_id, payload_body FROM agent_message_admission WHERE tenant_id = ? AND task_id = ?',\n ).get(tenant, input.taskId) as { message_id: string; payload_body: string } | undefined;\n if (existing !== undefined) {\n return existing.message_id === input.messageId && existing.payload_body === input.payloadBody\n ? 'pending'\n : 'rejected';\n }\n // The shared coordinator serializes cancellation and admission. An\n // existing exact message can reconcile its product outcome after the\n // task changes state; only a new reservation needs a live task.\n if (\n attempt.cancellation !== undefined ||\n !['offered', 'claimed', 'running'].includes(attempt.status)\n ) return 'rejected';\n db.prepare(\n `INSERT INTO agent_message_admission (tenant_id, task_id, message_id, payload_body)\n VALUES (?, ?, ?, ?)`,\n ).run(tenant, input.taskId, input.messageId, input.payloadBody);\n return 'reserved';\n });\n }\n\n readAgentMessage(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; messageId: string; payloadBody: string },\n ): Promise<AgentMessageAdmission | undefined> {\n return this.coordinator.run((db) => {\n const attempt = readTask(db, tenant, input.taskId);\n if (attempt?.deviceId !== input.deviceId) return undefined;\n const row = db.prepare(\n `SELECT message_id, payload_body, terminal_body FROM agent_message_admission\n WHERE tenant_id = ? AND task_id = ? AND message_id = ? AND payload_body = ?`,\n ).get(tenant, input.taskId, input.messageId, input.payloadBody) as\n | { message_id: string; payload_body: string; terminal_body: string | null }\n | undefined;\n return row === undefined\n ? undefined\n : {\n messageId: row.message_id,\n payloadBody: row.payload_body,\n ...(row.terminal_body === null ? {} : { terminalBody: row.terminal_body }),\n };\n });\n }\n\n finalizeAgentMessage(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; messageId: string; payloadBody: string; terminalBody: string },\n ): Promise<AgentMessageAdmission | undefined> {\n return this.coordinator.run((db) => {\n const attempt = readTask(db, tenant, input.taskId);\n if (attempt?.deviceId !== input.deviceId) return undefined;\n db.prepare(\n `UPDATE agent_message_admission SET terminal_body = ?\n WHERE tenant_id = ? AND task_id = ? AND message_id = ? AND payload_body = ? AND terminal_body IS NULL`,\n ).run(input.terminalBody, tenant, input.taskId, input.messageId, input.payloadBody);\n const row = db.prepare(\n `SELECT message_id, payload_body, terminal_body FROM agent_message_admission\n WHERE tenant_id = ? AND task_id = ? AND message_id = ? AND payload_body = ?`,\n ).get(tenant, input.taskId, input.messageId, input.payloadBody) as\n | { message_id: string; payload_body: string; terminal_body: string | null }\n | undefined;\n return row === undefined\n ? undefined\n : {\n messageId: row.message_id,\n payloadBody: row.payload_body,\n ...(row.terminal_body === null ? {} : { terminalBody: row.terminal_body }),\n };\n });\n }\n\n get(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined> {\n return this.coordinator.run((db) => readTask(db, tenant, taskId));\n }\n\n getMany(tenant: TenantId, taskIds: readonly string[]): Promise<readonly TaskAttempt[]> {\n return this.coordinator.run((db) => taskIds.flatMap((taskId) => {\n const attempt = readTask(db, tenant, taskId);\n return attempt === undefined ? [] : [attempt];\n }));\n }\n\n async list(tenant: TenantId, query: TaskAttemptListQuery): Promise<TaskAttemptPage> {\n assertTaskAttemptListLimit(query.limit);\n return this.coordinator.run((db) => {\n const rows = db.prepare(\n `SELECT * FROM task_attempt WHERE tenant_id = ? AND task_id > ?\n ORDER BY task_id COLLATE BINARY LIMIT ?`,\n ).all(tenant, query.cursor ?? '', query.limit + 1) as unknown as TaskRow[];\n const hasMore = rows.length > query.limit;\n const attempts = rows.slice(0, query.limit).map(taskRow);\n const last = attempts.at(-1);\n return { attempts, ...(hasMore && last !== undefined ? { nextCursor: last.taskId } : {}) };\n });\n }\n\n claim(\n tenant: TenantId,\n input: { taskId: string; deviceId: string; runtime?: RuntimeId; capabilities?: RuntimeCapabilities },\n ): Promise<TaskAttempt | undefined> {\n return this.coordinator.run((db) => {\n db.prepare(\n `UPDATE task_attempt SET owner_device_id = ?, claimed_runtime = ?, claimed_runtime_capabilities_json = ?,\n status = 'claimed', updated_at = ?\n WHERE tenant_id = ? AND task_id = ? AND device_id = ? AND owner_device_id IS NULL\n AND cancellation_requested_at IS NULL AND status = 'offered'`,\n ).run(\n input.deviceId,\n input.runtime ?? null,\n input.capabilities === undefined ? null : JSON.stringify(input.capabilities),\n this.#now(),\n tenant,\n input.taskId,\n input.deviceId,\n );\n return readTask(db, tenant, input.taskId);\n });\n }\n\n recordStatus(\n tenant: TenantId,\n input: { taskId: string; status: TaskAttemptStatus; agentRef?: AgentRef; terminalCause?: string },\n ): Promise<TaskAttempt | undefined> {\n return this.coordinator.run((db) => {\n const existing = readTask(db, tenant, input.taskId);\n if (existing === undefined) return undefined;\n if (!sameAgentRef(existing.agentRef, input.agentRef)) return existing;\n if (existing.cancellation !== undefined) {\n if (input.status !== 'cancelled' || existing.status === 'cancelled') return existing;\n } else if (['complete', 'failed', 'cancelled'].includes(existing.status)) {\n return existing;\n }\n db.prepare(\n `UPDATE task_attempt SET status = ?, terminal_cause = ?, updated_at = ?\n WHERE tenant_id = ? AND task_id = ?`,\n ).run(input.status, input.terminalCause ?? null, this.#now(), tenant, input.taskId);\n return readTask(db, tenant, input.taskId);\n });\n }\n\n #now(): string {\n return this.clock.now().toISOString();\n }\n}\n\ninterface MailboxRow extends Record<string, unknown> {\n tenant_id: string;\n device_id: string;\n seq: number;\n message_id: string;\n body: string;\n body_hash: string;\n byte_size: string;\n state: 'pending' | 'acked' | 'expired';\n appended_at: string;\n}\n\nfunction mailboxMessage(row: MailboxRow): MailboxMessage {\n return {\n tenantId: row.tenant_id as TenantId,\n deviceId: row.device_id,\n seq: Number(row.seq),\n messageId: row.message_id,\n body: row.body,\n bodyHash: row.body_hash as ContentHash,\n byteSize: BigInt(row.byte_size),\n state: row.state,\n appendedAt: row.appended_at,\n };\n}\n\nfunction ensureMailboxCursor(db: DatabaseSync, clock: Clock, tenant: TenantId, deviceId: string): void {\n if (deviceId.length === 0) {\n throw new ByokCoreError('mailbox_message_not_found', 'Device id must not be empty.');\n }\n db.prepare(\n `INSERT OR IGNORE INTO mailbox_cursor (tenant_id, device_id, updated_at) VALUES (?, ?, ?)`,\n ).run(tenant, deviceId, clock.now().toISOString());\n}\n\nfunction readCursor(db: DatabaseSync, clock: Clock, tenant: TenantId, deviceId: string): MailboxCursorState {\n const row = db.prepare(\n `SELECT delivered_seq, acked_seq, updated_at FROM mailbox_cursor WHERE tenant_id = ? AND device_id = ?`,\n ).get(tenant, deviceId) as { delivered_seq: number; acked_seq: number; updated_at: string } | undefined;\n return row === undefined\n ? { tenantId: tenant, deviceId, deliveredSeq: 0, ackedSeq: 0, updatedAt: clock.now().toISOString() }\n : {\n tenantId: tenant,\n deviceId,\n deliveredSeq: Number(row.delivered_seq),\n ackedSeq: Number(row.acked_seq),\n updatedAt: row.updated_at,\n };\n}\n\nasync function appendMailbox(\n db: DatabaseSync,\n clock: Clock,\n tenant: TenantId,\n input: MailboxAppendInput,\n): Promise<MailboxMessage> {\n ensureMailboxCursor(db, clock, tenant, input.deviceId);\n const existing = db.prepare(\n `SELECT * FROM mailbox_message WHERE tenant_id = ? AND device_id = ? AND message_id = ?`,\n ).get(tenant, input.deviceId, input.messageId) as MailboxRow | undefined;\n if (existing !== undefined) return mailboxMessage(existing);\n const cursor = db.prepare(\n `SELECT next_seq FROM mailbox_cursor WHERE tenant_id = ? AND device_id = ?`,\n ).get(tenant, input.deviceId) as { next_seq: number };\n const seq = Number(cursor.next_seq);\n const materialized = await input.materialize(seq);\n db.prepare(\n `INSERT INTO mailbox_message\n (tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?)`,\n ).run(\n tenant,\n input.deviceId,\n seq,\n input.messageId,\n materialized.body,\n materialized.bodyHash,\n String(materialized.byteSize),\n clock.now().toISOString(),\n );\n db.prepare(\n `UPDATE mailbox_cursor SET next_seq = ? WHERE tenant_id = ? AND device_id = ?`,\n ).run(seq + 1, tenant, input.deviceId);\n return mailboxMessage(db.prepare(\n `SELECT * FROM mailbox_message WHERE tenant_id = ? AND device_id = ? AND seq = ?`,\n ).get(tenant, input.deviceId, seq) as MailboxRow);\n}\n\nexport class SqliteMailboxStore implements MailboxStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n append(tenant: TenantId, input: MailboxAppendInput): Promise<MailboxMessage> {\n return this.coordinator.transaction((db) => appendMailbox(db, this.clock, tenant, input));\n }\n\n readAfter(tenant: TenantId, query: MailboxReadQuery): Promise<MailboxPage> {\n return this.coordinator.run((db) => {\n const limit = query.limit ?? DEFAULT_MAILBOX_READ_LIMIT;\n const rows = db.prepare(\n `SELECT * FROM mailbox_message\n WHERE tenant_id = ? AND device_id = ? AND state = 'pending' AND seq > ?\n ORDER BY seq LIMIT ?`,\n ).all(tenant, query.deviceId, query.afterSeq, limit + 1) as unknown as MailboxRow[];\n const page = rows.slice(0, limit).map(mailboxMessage);\n const last = page.at(-1);\n const lost = db.prepare(\n `SELECT MAX(seq) AS lost FROM mailbox_message\n WHERE tenant_id = ? AND device_id = ? AND state = 'expired'`,\n ).get(tenant, query.deviceId) as { lost: number | null };\n return {\n messages: page,\n nextSeq: last?.seq ?? query.afterSeq,\n hasMore: rows.length > limit,\n recoverableFrom: Number(lost.lost ?? 0) + 1,\n };\n });\n }\n\n recordDelivery(tenant: TenantId, input: MailboxRecordDeliveryInput): Promise<MailboxCursorState> {\n return this.coordinator.run((db) => {\n ensureMailboxCursor(db, this.clock, tenant, input.deviceId);\n db.prepare(\n `UPDATE mailbox_cursor SET delivered_seq = MAX(delivered_seq, ?)\n WHERE tenant_id = ? AND device_id = ?`,\n ).run(input.deliveredSeq, tenant, input.deviceId);\n return readCursor(db, this.clock, tenant, input.deviceId);\n });\n }\n\n advanceCursor(tenant: TenantId, input: MailboxAdvanceCursorInput): Promise<MailboxCursorState> {\n return this.coordinator.transaction((db) => {\n ensureMailboxCursor(db, this.clock, tenant, input.deviceId);\n const current = readCursor(db, this.clock, tenant, input.deviceId);\n const observedAt = this.clock.now().toISOString();\n if (input.ackedSeq < current.ackedSeq) {\n throw new CoreConflictError(\n 'mailbox_cursor_regression',\n `Cursor for device ${input.deviceId} is at ${current.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,\n current,\n observedAt,\n );\n }\n if (input.ackedSeq > current.deliveredSeq) {\n throw new CoreConflictError(\n 'mailbox_cursor_ahead_of_delivery',\n `Cursor for device ${input.deviceId} was delivered through ${current.deliveredSeq}; refusing to acknowledge future cursor ${input.ackedSeq}.`,\n current,\n observedAt,\n );\n }\n db.prepare(\n `UPDATE mailbox_cursor SET acked_seq = ?, updated_at = ? WHERE tenant_id = ? AND device_id = ?`,\n ).run(input.ackedSeq, observedAt, tenant, input.deviceId);\n db.prepare(\n `UPDATE mailbox_message SET state = 'acked'\n WHERE tenant_id = ? AND device_id = ? AND state = 'pending' AND seq <= ?`,\n ).run(tenant, input.deviceId, input.ackedSeq);\n return readCursor(db, this.clock, tenant, input.deviceId);\n });\n }\n\n readCursor(tenant: TenantId, deviceId: string): Promise<MailboxCursorState> {\n return this.coordinator.run((db) => readCursor(db, this.clock, tenant, deviceId));\n }\n\n async collectRetired(tenant: TenantId, input: MailboxRetentionInput): Promise<MailboxRetentionResult> {\n assertCanonicalTimestamp(input.ackedBefore, 'ackedBefore');\n assertCanonicalTimestamp(input.expireUnackedBefore, 'expireUnackedBefore');\n return this.coordinator.transaction((db) => {\n const deviceClause = input.deviceId === undefined ? '' : ' AND device_id = ?';\n const params = input.deviceId === undefined ? [tenant] : [tenant, input.deviceId];\n const acked = db.prepare(\n `SELECT byte_size FROM mailbox_message\n WHERE tenant_id = ?${deviceClause} AND state = 'acked' AND appended_at < ?`,\n ).all(...params, input.ackedBefore) as unknown as Array<{ byte_size: string }>;\n const deleted = db.prepare(\n `DELETE FROM mailbox_message\n WHERE tenant_id = ?${deviceClause} AND state = 'acked' AND appended_at < ?`,\n ).run(...params, input.ackedBefore);\n const expired = db.prepare(\n `UPDATE mailbox_message SET state = 'expired'\n WHERE tenant_id = ?${deviceClause} AND state = 'pending' AND appended_at < ?`,\n ).run(...params, input.expireUnackedBefore);\n return {\n deletedCount: Number(deleted.changes),\n expiredCount: Number(expired.changes),\n releasedBytes: acked.reduce((sum, row) => sum + BigInt(row.byte_size), 0n),\n };\n });\n }\n}\n\nexport class SqliteTaskCancellationStore implements TaskCancellationStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n request(tenant: TenantId, input: TaskCancellationRequest): Promise<TaskCancellationMutation | undefined> {\n return this.coordinator.transaction(async (db) => {\n const existing = readTask(db, tenant, input.taskId);\n if (existing === undefined) return undefined;\n if (\n existing.cancellation === undefined &&\n ['complete', 'failed', 'cancelled'].includes(existing.status)\n ) return { attempt: existing };\n\n const existingMessageId = (db.prepare(\n `SELECT cancellation_message_id FROM task_attempt WHERE tenant_id = ? AND task_id = ?`,\n ).get(tenant, input.taskId) as { cancellation_message_id: string | null }).cancellation_message_id;\n if (existingMessageId !== null) {\n const row = db.prepare(\n `SELECT * FROM mailbox_message WHERE tenant_id = ? AND device_id = ? AND message_id = ?`,\n ).get(tenant, existing.deviceId, existingMessageId) as MailboxRow | undefined;\n if (row === undefined) {\n if (existing.status === 'cancelled') return { attempt: existing };\n throw new Error(`Cancellation delivery ${existingMessageId} is missing for task ${input.taskId}`);\n }\n return { attempt: existing, message: mailboxMessage(row) };\n }\n\n const message = await appendMailbox(db, this.clock, tenant, {\n deviceId: existing.deviceId,\n messageId: input.proposedMessageId,\n materialize: (seq) => input.materialize(seq, input.proposedMessageId),\n });\n const requestedAt = this.clock.now().toISOString();\n db.prepare(\n `UPDATE task_attempt SET\n status = CASE WHEN owner_device_id IS NULL THEN 'cancelled' ELSE 'cancel_requested' END,\n cancellation_requested_at = ?, cancellation_reason = ?, cancellation_message_id = ?, updated_at = ?\n WHERE tenant_id = ? AND task_id = ?`,\n ).run(requestedAt, input.reason ?? null, input.proposedMessageId, requestedAt, tenant, input.taskId);\n return { attempt: readTask(db, tenant, input.taskId)!, message };\n });\n }\n}\n\ninterface ManifestRow extends Record<string, unknown> {\n tenant_id: string;\n hash: string;\n byte_size: string;\n content_type: string;\n state: ObjectManifestEntry['state'];\n created_at: string;\n updated_at: string;\n delete_pending_at: string | null;\n ref_count: number;\n}\n\nfunction manifestRow(row: ManifestRow): ObjectManifestEntry {\n return {\n tenantId: row.tenant_id as TenantId,\n hash: row.hash as ContentHash,\n byteSize: BigInt(row.byte_size),\n contentType: row.content_type,\n state: row.state,\n refCount: Number(row.ref_count),\n createdAt: row.created_at,\n updatedAt: row.updated_at,\n ...(row.delete_pending_at === null ? {} : { deletePendingAt: row.delete_pending_at }),\n };\n}\n\nconst MANIFEST_SELECT = `\nSELECT m.*, COUNT(r.ref_id) AS ref_count\nFROM object_manifest m\nLEFT JOIN object_reference r ON r.tenant_id = m.tenant_id AND r.hash = m.hash`;\n\nfunction readManifest(db: DatabaseSync, tenant: TenantId, hash: ContentHash): ObjectManifestEntry | undefined {\n const row = db.prepare(\n `${MANIFEST_SELECT} WHERE m.tenant_id = ? AND m.hash = ? GROUP BY m.tenant_id, m.hash`,\n ).get(tenant, hash) as ManifestRow | undefined;\n return row === undefined ? undefined : manifestRow(row);\n}\n\nfunction requireManifest(db: DatabaseSync, tenant: TenantId, hash: ContentHash): ObjectManifestEntry {\n const entry = readManifest(db, tenant, hash);\n if (entry === undefined) {\n throw new ByokCoreError('object_not_found', `Object ${hash} has no manifest row in this tenant.`);\n }\n return entry;\n}\n\nfunction putManifest(db: DatabaseSync, clock: Clock, tenant: TenantId, input: ObjectManifestInput): ObjectManifestEntry {\n const existing = readManifest(db, tenant, input.hash);\n if (existing !== undefined && existing.state !== 'deleted') return existing;\n const now = clock.now().toISOString();\n db.prepare('DELETE FROM object_reference WHERE tenant_id = ? AND hash = ?').run(tenant, input.hash);\n db.prepare(\n `INSERT INTO object_manifest\n (tenant_id, hash, byte_size, content_type, state, created_at, updated_at, delete_pending_at)\n VALUES (?, ?, ?, ?, 'pending', ?, ?, NULL)\n ON CONFLICT (tenant_id, hash) DO UPDATE SET\n byte_size = excluded.byte_size, content_type = excluded.content_type, state = 'pending',\n created_at = excluded.created_at, updated_at = excluded.updated_at, delete_pending_at = NULL`,\n ).run(tenant, input.hash, String(input.byteSize), input.contentType, now, now);\n return readManifest(db, tenant, input.hash)!;\n}\n\nexport class SqliteObjectStore implements ObjectStore {\n constructor(private readonly coordinator: SqliteCoordinator, private readonly clock: Clock) {}\n\n putManifest(tenant: TenantId, input: ObjectManifestInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => putManifest(db, this.clock, tenant, input));\n }\n\n commit(tenant: TenantId, input: ObjectCommitInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n const current = requireManifest(db, tenant, input.hash);\n if (current.byteSize !== input.observedByteSize || current.contentType !== input.observedContentType) {\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n `Observed object ${input.hash} does not match the declared manifest.`,\n );\n }\n if (current.state === 'committed') return current;\n return this.#transition(db, tenant, current, 'committed');\n });\n }\n\n get(tenant: TenantId, hash: ContentHash): Promise<ObjectManifestEntry | undefined> {\n return this.coordinator.run((db) => readManifest(db, tenant, hash));\n }\n\n async list(tenant: TenantId, query: ObjectListQuery): Promise<readonly ObjectManifestEntry[]> {\n if (query.deletePendingBefore !== undefined) {\n assertCanonicalTimestamp(query.deletePendingBefore, 'deletePendingBefore');\n }\n return this.coordinator.run((db) => {\n const rows = db.prepare(\n `${MANIFEST_SELECT}\n WHERE m.tenant_id = ? AND (? IS NULL OR m.state = ?)\n AND (? IS NULL OR (m.delete_pending_at IS NOT NULL AND m.delete_pending_at < ?))\n GROUP BY m.tenant_id, m.hash ORDER BY m.hash COLLATE BINARY LIMIT ?`,\n ).all(\n tenant,\n query.state ?? null,\n query.state ?? null,\n query.deletePendingBefore ?? null,\n query.deletePendingBefore ?? null,\n query.limit ?? DEFAULT_OBJECT_LIST_LIMIT,\n ) as unknown as ManifestRow[];\n return rows.map(manifestRow);\n });\n }\n\n addReference(tenant: TenantId, input: ObjectReferenceInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n const current = requireManifest(db, tenant, input.hash);\n if (current.state !== 'committed') {\n throw new ByokCoreError('object_state_invalid', `Only committed objects can be referenced; ${input.hash} is ${current.state}.`);\n }\n db.prepare(\n `INSERT OR IGNORE INTO object_reference (tenant_id, hash, ref_kind, ref_id, created_at)\n VALUES (?, ?, ?, ?, ?)`,\n ).run(tenant, input.hash, input.refKind, input.refId, this.clock.now().toISOString());\n db.prepare('UPDATE object_manifest SET updated_at = ? WHERE tenant_id = ? AND hash = ?')\n .run(this.clock.now().toISOString(), tenant, input.hash);\n return requireManifest(db, tenant, input.hash);\n });\n }\n\n removeReference(tenant: TenantId, input: ObjectReferenceInput): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n requireManifest(db, tenant, input.hash);\n db.prepare(\n `DELETE FROM object_reference WHERE tenant_id = ? AND hash = ? AND ref_kind = ? AND ref_id = ?`,\n ).run(tenant, input.hash, input.refKind, input.refId);\n db.prepare('UPDATE object_manifest SET updated_at = ? WHERE tenant_id = ? AND hash = ?')\n .run(this.clock.now().toISOString(), tenant, input.hash);\n return requireManifest(db, tenant, input.hash);\n });\n }\n\n markDeletePending(tenant: TenantId, hash: ContentHash): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => {\n const current = requireManifest(db, tenant, hash);\n if (current.refCount !== 0) {\n throw new ByokCoreError('object_state_invalid', `Object ${hash} still has ${current.refCount} reference(s).`);\n }\n return this.#transition(db, tenant, current, 'delete_pending');\n });\n }\n\n markDeleted(tenant: TenantId, hash: ContentHash): Promise<ObjectManifestEntry> {\n return this.coordinator.transaction((db) => this.#transition(db, tenant, requireManifest(db, tenant, hash), 'deleted'));\n }\n\n #transition(\n db: DatabaseSync,\n tenant: TenantId,\n current: ObjectManifestEntry,\n next: ObjectManifestEntry['state'],\n ): ObjectManifestEntry {\n if (!isLegalObjectTransition(current.state, next)) {\n throw new ByokCoreError('object_state_invalid', `${current.state} to ${next} is not a legal object manifest transition.`);\n }\n const now = this.clock.now().toISOString();\n db.prepare(\n `UPDATE object_manifest SET state = ?, updated_at = ?, delete_pending_at = ?\n WHERE tenant_id = ? AND hash = ?`,\n ).run(next, now, next === 'delete_pending' ? now : current.deletePendingAt ?? null, tenant, current.hash);\n return requireManifest(db, tenant, current.hash);\n }\n}\n\ninterface BlobRow extends Record<string, unknown> {\n blob_id: string;\n tenant_id: string;\n reservation_id: string;\n content_hash: string;\n byte_size: string;\n content_type: string;\n uploaded: number;\n data: Uint8Array | null;\n}\n\nfunction assertReservedObject(tenant: TenantId, reservation: StorageReservation): void {\n if (\n reservation.tenantId === tenant &&\n reservation.kind === 'object' &&\n reservation.state === 'reserved' &&\n reservation.expectedBytes >= 0n\n ) return;\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n 'An upload grant requires a reserved object reservation owned by this tenant.',\n );\n}\n\nclass SqliteBlobRegistry {\n readonly secret: Uint8Array;\n readonly urlTtlMs: number;\n\n constructor(\n readonly coordinator: SqliteCoordinator,\n readonly clock: Clock,\n readonly crypto: CloudCrypto,\n urlTtlMs: number,\n ) {\n this.urlTtlMs = urlTtlMs;\n const row = coordinator.db.prepare(\"SELECT value FROM byok_sqlite_meta WHERE key = 'blob_signing_secret'\").get() as\n | { value: string }\n | undefined;\n if (row === undefined) {\n const bytes = globalThis.crypto.getRandomValues(new Uint8Array(SIGNING_SECRET_BYTES));\n coordinator.db.prepare(\n \"INSERT OR IGNORE INTO byok_sqlite_meta (key, value) VALUES ('blob_signing_secret', ?)\",\n ).run(Buffer.from(bytes).toString('base64url'));\n }\n const stored = coordinator.db.prepare(\"SELECT value FROM byok_sqlite_meta WHERE key = 'blob_signing_secret'\").get() as { value: string };\n this.secret = Buffer.from(stored.value, 'base64url');\n }\n\n async signUrl(blobId: string, action: 'put' | 'get'): Promise<string> {\n const exp = this.clock.now().getTime() + this.urlTtlMs;\n const sig = await this.crypto.hmacSha256(this.secret, `${blobId}:${action}:${exp}`);\n return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;\n }\n}\n\nexport class SqliteCloudBlobStore implements CloudBlobStore {\n constructor(private readonly registry: SqliteBlobRegistry) {}\n\n async createUpload(tenant: TenantId, reservation: StorageReservation): Promise<{ blobId: string; uploadUrl: string }> {\n assertReservedObject(tenant, reservation);\n const blobId = await this.registry.coordinator.transaction((db) => {\n const existing = db.prepare(\n 'SELECT * FROM blob WHERE tenant_id = ? AND reservation_id = ?',\n ).get(tenant, reservation.reservationId) as BlobRow | undefined;\n if (existing !== undefined) {\n const manifest = readManifest(db, tenant, reservation.contentHash);\n if (manifest?.state === 'committed') {\n throw new ByokCoreError('object_state_invalid', `Object ${reservation.contentHash} is already committed and immutable.`);\n }\n return existing.blob_id;\n }\n const entry = putManifest(db, this.registry.clock, tenant, {\n hash: reservation.contentHash,\n byteSize: reservation.expectedBytes,\n contentType: reservation.contentType,\n });\n if (entry.byteSize !== reservation.expectedBytes || entry.contentType !== reservation.contentType) {\n throw new ByokCoreError('storage_integrity_mismatch', `Object ${reservation.contentHash} already binds a different storage declaration.`);\n }\n if (entry.state === 'committed') {\n throw new ByokCoreError('object_state_invalid', `Object ${reservation.contentHash} is already committed and immutable.`);\n }\n const created = `blob_${this.registry.crypto.randomUuid()}`;\n db.prepare(\n `INSERT INTO blob\n (blob_id, tenant_id, reservation_id, content_hash, byte_size, content_type)\n VALUES (?, ?, ?, ?, ?, ?)`,\n ).run(created, tenant, reservation.reservationId, reservation.contentHash, String(reservation.expectedBytes), reservation.contentType);\n return created;\n });\n return { blobId, uploadUrl: await this.registry.signUrl(blobId, 'put') };\n }\n\n observeUpload(tenant: TenantId, blobId: string, reservation: StorageReservation): Promise<BlobObservation | undefined> {\n return this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (\n row === undefined || row.tenant_id !== tenant || reservation.tenantId !== tenant ||\n row.reservation_id !== reservation.reservationId || row.content_hash !== reservation.contentHash || !row.uploaded\n ) return undefined;\n return { observedByteSize: BigInt(row.data?.byteLength ?? 0), observedContentType: row.content_type };\n });\n }\n\n async getDownloadUrl(tenant: TenantId, blobId: string): Promise<string | undefined> {\n const found = await this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (row === undefined || row.tenant_id !== tenant || !row.uploaded) return false;\n return readManifest(db, tenant, row.content_hash as ContentHash)?.state === 'committed';\n });\n return found ? this.registry.signUrl(blobId, 'get') : undefined;\n }\n}\n\nexport class SqliteBlobContentProxy implements BlobContentProxy {\n constructor(private readonly registry: SqliteBlobRegistry) {}\n\n async verifySignedUrl(blobId: string, action: 'put' | 'get', sig: string, exp: number): Promise<boolean> {\n if (!Number.isFinite(exp) || this.registry.clock.now().getTime() > exp) return false;\n const expected = await this.registry.crypto.hmacSha256(this.registry.secret, `${blobId}:${action}:${exp}`);\n return this.registry.crypto.timingSafeEqual(expected, sig);\n }\n\n expectedUploadBytes(blobId: string): Promise<bigint | undefined> {\n return this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT byte_size FROM blob WHERE blob_id = ?').get(blobId) as { byte_size: string } | undefined;\n return row === undefined ? undefined : BigInt(row.byte_size);\n });\n }\n\n writeContent(blobId: string, data: Uint8Array): Promise<BlobWriteResult> {\n return this.registry.coordinator.run(async (db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (row === undefined) return { ok: false, reason: 'unknown blobId' };\n if (BigInt(data.length) !== BigInt(row.byte_size)) {\n return { ok: false, reason: `size mismatch: declared ${row.byte_size}, received ${data.length}` };\n }\n if (await this.registry.crypto.sha256(data) !== row.content_hash) {\n return { ok: false, reason: 'contentHash mismatch' };\n }\n db.prepare('UPDATE blob SET data = ?, uploaded = 1 WHERE blob_id = ?').run(data, blobId);\n return { ok: true };\n });\n }\n\n readContent(blobId: string): Promise<BlobReadResult | undefined> {\n return this.registry.coordinator.run((db) => {\n const row = db.prepare('SELECT * FROM blob WHERE blob_id = ?').get(blobId) as BlobRow | undefined;\n if (row === undefined || !row.uploaded || row.data === null) return undefined;\n const data = new Uint8Array(row.data.buffer, row.data.byteOffset, row.data.byteLength);\n return { ok: true, content: { data, contentType: row.content_type } };\n });\n }\n}\n\n/** Mixed embedded composition: eight durable interfaces, every other port unchanged in-memory. */\nexport function createSqliteEmbeddedStores(\n options: SqliteEmbeddedStoreOptions,\n dependencies: { readonly clock: Clock; readonly crypto: CloudCrypto },\n): SqliteEmbeddedStores {\n const coordinator = new SqliteCoordinator(options.path, options.migration);\n const objects = new SqliteObjectStore(coordinator, dependencies.clock);\n const mailbox = new SqliteMailboxStore(coordinator, dependencies.clock);\n const tasks = new SqliteTaskAttemptStore(coordinator, dependencies.clock);\n const cancellations = new SqliteTaskCancellationStore(coordinator, dependencies.clock);\n const registry = new SqliteBlobRegistry(\n coordinator,\n dependencies.clock,\n dependencies.crypto,\n options.urlTtlMs ?? DEFAULT_BLOB_URL_TTL_MS,\n );\n const blobs = new SqliteCloudBlobStore(registry);\n const blobContentProxy = new SqliteBlobContentProxy(registry);\n\n const inMemoryCore = createInMemoryCoreStores({ clock: dependencies.clock }).stores;\n const core: CoreStores = {\n ...inMemoryCore,\n mailbox,\n objects,\n quota: new InMemoryQuotaStore(dependencies.clock, objects),\n };\n const inMemoryCloud = createInMemoryCloudStores(\n dependencies.clock,\n dependencies.crypto,\n objects,\n mailbox,\n );\n const devices = new SqliteDeviceDirectory(coordinator);\n const pairing = new InMemoryPairingCodeStore(dependencies.clock, devices);\n const cloud: CloudStores = {\n ...inMemoryCloud.stores,\n devices,\n pairingCodes: { issue: pairing.issue.bind(pairing) },\n pairing: { redeemAndRegister: pairing.redeemAndRegister.bind(pairing) },\n tasks,\n receipts: new SqliteRequestReceiptStore(coordinator, dependencies.clock),\n cancellations,\n blobs,\n };\n return { core, cloud, blobContentProxy, close: () => coordinator.close() };\n}\n","import {\n createInMemoryCoreStores,\n tenantId,\n type Clock,\n type CoreStores,\n type MailboxStore,\n type TenantId,\n} from '@byok-sdk/core';\nimport {\n createInMemoryCloudStores,\n createWebCrypto,\n type BlobContentProxy,\n type CloudCrypto,\n type CloudStores,\n type InboundDedupStore,\n} from '@byok-sdk/cloud';\nimport { RateLimiter, createCountingInboundRateLimiter, type RateLimiterOptions } from './rate-limiter';\nimport type { DeviceConnections } from './connections';\nimport { createSqliteEmbeddedStores } from './stores/sqlite';\nimport type { ByokServerStorage } from './types';\n\n/**\n * The store composition this façade hands the cloud kernel.\n *\n * Same parts as `@byok-sdk/cloud`'s own in-memory composition, with three\n * decorators layered on ports the kernel already calls, and nothing else:\n *\n * - `rateLimiter` becomes this package's token bucket, which is also where\n * `envelopesIn` and `rateLimitEvents` are counted (the kernel debits it at\n * gate step 0, for every envelope, before any other decision — the exact\n * choke point `ConnectionHub.handleInbound` used to be);\n * - `dedup` counts the already-seen answers that back `dedupDrops`;\n * - `mailbox` reports each device-scoped read, which is how a device that only\n * ever long-polls still counts as present.\n *\n * Decorators rather than kernel changes, deliberately: each counter is a fact\n * about a call this composition already makes, so it is observable from the\n * outside, and the kernel keeps no observability surface it would then have to\n * keep honest for every other deployment.\n */\n\n/** Per-product blob size ceiling (§7): 100MB unless overridden. */\nexport const DEFAULT_MAX_BLOB_SIZE_BYTES = 100 * 1024 * 1024;\n\n/**\n * Real time, deliberately — the same choice `@byok-sdk/cloud`'s in-memory\n * composition makes and for the same reason: a daemon compares the `expiresAt`\n * it is handed against its own wall clock, so a frozen clock would make every\n * minted token look expired.\n */\nfunction systemClock(): Clock {\n return { now: () => new Date() };\n}\n\n/**\n * The one tenant an embedded server serves.\n *\n * An embedded `createByokServer` is a single product's coordinator, not a\n * multi-tenant control plane: there is no surface on it that could name a\n * second tenant and no request that could carry one. Deriving the id from\n * `productId` keeps that visible — one product, one tenant, and a device paired\n * into this instance can only ever land in it.\n */\nexport function serverTenantId(productId: string): TenantId {\n return tenantId(`product:${productId}`);\n}\n\n/** Live counter reads; every field is derived from a call the kernel already makes. */\nexport interface FacadeCounters {\n /** Every envelope the kernel's inbound gate was handed, whatever it decided. */\n readonly envelopesIn: number;\n /** Inbound envelopes recognized as an already-seen `(device, envelope id)` pair. */\n readonly dedupDrops: number;\n /** Inbound envelopes the bucket refused — one per envelope, never coalesced. */\n readonly rateLimitEvents: number;\n}\n\nexport interface FacadeStoreComposition {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n readonly blobContentProxy: BlobContentProxy;\n readonly clock: Clock;\n readonly crypto: CloudCrypto;\n readonly counters: FacadeCounters;\n close(): Promise<void>;\n}\n\nexport interface FacadeStoreOptions {\n readonly tenant: TenantId;\n readonly maxBlobSizeBytes: number;\n readonly storage?: ByokServerStorage;\n readonly rateLimit?: RateLimiterOptions;\n /** Where a device's own liveness observations are recorded. */\n readonly connections: DeviceConnections;\n /** Fired once per rate-limit EPISODE, not per refused envelope. */\n readonly onRateLimited: (deviceId: string, at: string) => void;\n}\n\nexport function composeFacadeStores(options: FacadeStoreOptions): FacadeStoreComposition {\n const clock = systemClock();\n const crypto = createWebCrypto();\n const sqlite =\n options.storage?.kind === 'sqlite'\n ? createSqliteEmbeddedStores(\n {\n path: options.storage.path,\n ...(options.storage.migration === undefined ? {} : { migration: options.storage.migration }),\n ...(options.storage.urlTtlMs === undefined ? {} : { urlTtlMs: options.storage.urlTtlMs }),\n },\n { clock, crypto },\n )\n : undefined;\n const inMemoryCore = sqlite === undefined ? createInMemoryCoreStores({ clock }).stores : undefined;\n const core = sqlite?.core ?? inMemoryCore!;\n const inMemoryCloud =\n sqlite === undefined ? createInMemoryCloudStores(clock, crypto, core.objects, core.mailbox) : undefined;\n const stores = sqlite?.cloud ?? inMemoryCloud!.stores;\n const blobContentProxy = sqlite?.blobContentProxy ?? inMemoryCloud!.blobContentProxy;\n\n const rateLimiter = createCountingInboundRateLimiter(\n new RateLimiter(options.rateLimit),\n options.onRateLimited,\n );\n const dedup = countingDedup(stores.dedup);\n\n const counters: FacadeCounters = {\n get envelopesIn(): number {\n return rateLimiter.counters.envelopesIn;\n },\n get dedupDrops(): number {\n return dedup.drops();\n },\n get rateLimitEvents(): number {\n return rateLimiter.counters.rateLimitEvents;\n },\n };\n\n // Blob uploads reserve against the tenant's storage entitlement (`quota`), so\n // a composition that never writes one has working coordination and 4xx blob\n // routes. The embedded server has exactly one tenant and one configured\n // ceiling, so the entitlement is that ceiling — there is no second party here\n // to negotiate one.\n void core.quota.writeEntitlement(options.tenant, {\n version: 1n,\n hardLimitBytes: BigInt(options.maxBlobSizeBytes) * 1024n,\n maxObjectBytes: BigInt(options.maxBlobSizeBytes),\n maxInlineBytes: BigInt(options.maxBlobSizeBytes),\n mailboxLimitBytes: BigInt(options.maxBlobSizeBytes) * 1024n,\n retentionPolicyId: 'byok-server-embedded',\n });\n\n return {\n core: { ...core, mailbox: observingMailbox(core.mailbox, options.connections) },\n cloud: { ...stores, rateLimiter: rateLimiter.limiter, dedup },\n blobContentProxy,\n clock,\n crypto,\n counters,\n close: () => sqlite?.close() ?? Promise.resolve(),\n };\n}\n\ninterface CountingDedupStore extends InboundDedupStore {\n drops(): number;\n}\n\n/**\n * Count the dedup hits the kernel resolves. A hit is a wire-level SUCCESS\n * (§8.2) that re-ran nothing, so it is invisible in the response and this\n * counter is the only place an embedder can see it happening at all.\n */\nfunction countingDedup(inner: InboundDedupStore): CountingDedupStore {\n let drops = 0;\n return {\n async checkAndRecord(tenant, deviceId, envelopeId): Promise<boolean> {\n const seen = await inner.checkAndRecord(tenant, deviceId, envelopeId);\n if (seen) drops += 1;\n return seen;\n },\n async checkAndRecordAgent(tenant, deviceId, agentRef, envelopeId): Promise<boolean> {\n const seen = await inner.checkAndRecordAgent(tenant, deviceId, agentRef, envelopeId);\n if (seen) drops += 1;\n return seen;\n },\n drops: () => drops,\n };\n}\n\n/**\n * Mark a device present when it reads its mailbox.\n *\n * `GET /byok/events` is the long-poll transport's whole receive half, and a\n * device sitting on it is as connected as a device gets now — a poll is the\n * only sign of life a daemon with nothing to say ever produces. `readCursor` is\n * the one call every poll makes exactly once, before any hold, which makes it\n * the honest place to observe it.\n */\nfunction observingMailbox(inner: MailboxStore, connections: DeviceConnections): MailboxStore {\n return {\n append: (tenant, input) => inner.append(tenant, input),\n readAfter: (tenant, query) => inner.readAfter(tenant, query),\n recordDelivery: (tenant, input) => inner.recordDelivery(tenant, input),\n advanceCursor: (tenant, input) => inner.advanceCursor(tenant, input),\n readCursor: (tenant, deviceId) => {\n connections.touch(deviceId, new Date().toISOString());\n return inner.readCursor(tenant, deviceId);\n },\n collectRetired: (tenant, input) => inner.collectRetired(tenant, input),\n };\n}\n","import {\n SteerRejectedError as KernelSteerRejectedError,\n type ByokCloud,\n type SteerRejectionCode,\n type TenantId,\n} from '@byok-sdk/cloud';\nimport type { RuntimeId, TaskState } from '@byok-sdk/protocol';\nimport type { TaskEventRelay } from './relay';\nimport type { ServerTaskEvent, TaskHandle, TaskResult } from './types';\n\nfunction steerRejectionMessage(\n taskId: string,\n code: SteerRejectionCode,\n state: TaskState,\n runtime: RuntimeId | undefined,\n): string {\n switch (code) {\n case 'task_terminal':\n return `cannot steer task ${taskId}: task is already terminal (state ${state})`;\n case 'task_not_running':\n return `cannot steer task ${taskId}: not running (state ${state})`;\n case 'steer_unsupported_runtime':\n return `cannot steer task ${taskId}: claimed runtime ${runtime ?? '(unknown)'} does not support steering`;\n }\n}\n\n/**\n * Thrown by {@link TaskHandle.steer} when the kernel refuses the steer.\n *\n * This package keeps its OWN class rather than re-exporting the kernel's, and\n * that is deliberate rather than a leftover. The two carry the same `taskId`,\n * `code` and `runtime`, and differ in exactly one field: the kernel reports\n * `status: TaskAttemptStatus` — its coarse, execution-free attempt disposition\n * (`running`, `offered`, …) — while this surface reports `state: TaskState`,\n * the WIRE vocabulary every other member of this package speaks\n * (`TaskSnapshot.state`, `ServerTaskEvent`, `HubStats.taskCountsByState`).\n * `AwaitApproval` is the reason they cannot be the same field: it is derived\n * from the durable approval timeline and has no attempt status at all\n * (ADR-028), so a `TaskAttemptStatus -> TaskState` mapping inside the kernel\n * would have to report `Running` for a task this façade calls `AwaitApproval`.\n *\n * So the state here is not translated from the kernel's field — it is READ,\n * through the very projection `byok.tasks.get(taskId)` answers with, at the\n * moment of the refusal. One authority, two readers, no second mapping.\n *\n * Deviation from design packet §1.2, which had this class move to\n * `@byok-sdk/cloud` with the server re-exporting it: the wire `TaskState`\n * vocabulary is host-facing and lives here, so the class that carries it does\n * too. `SteerRejectionCode` and `StaleApprovalError` are unaffected and stay\n * kernel re-exports.\n */\nexport class SteerRejectedError extends Error {\n readonly taskId: string;\n readonly code: SteerRejectionCode;\n /** The task's state at the moment the steer was refused. */\n readonly state: TaskState;\n /** `TaskSnapshot.claimedRuntime` — `undefined` when nothing was ever recorded, which is itself a reason `steer_unsupported_runtime` can fire. */\n readonly runtime: RuntimeId | undefined;\n\n constructor(\n taskId: string,\n code: SteerRejectionCode,\n state: TaskState,\n runtime: RuntimeId | undefined,\n ) {\n super(steerRejectionMessage(taskId, code, state, runtime));\n this.name = 'SteerRejectedError';\n this.taskId = taskId;\n this.code = code;\n this.state = state;\n this.runtime = runtime;\n }\n}\n\n/** The three states this surface calls terminal — the same set {@link TaskResult} is defined over. */\nconst TERMINAL_STATES: ReadonlySet<TaskState> = new Set<TaskState>(['Complete', 'Failed', 'Cancelled']);\n\n/**\n * The refusal code for a state THIS surface has already decided.\n *\n * Not a translation of the kernel's `status` — that field is never read here.\n * The kernel's own precedence is \"terminal first, so a terminal attempt reports\n * the more specific truth\" (`steer-control.ts`), and it applies that rule to its\n * attempt status; this applies the identical rule to the one `TaskState` the\n * façade answers `tasks.get()` with, which is the same value already being put\n * on the error. Without it the two halves of one error contradict each other:\n * an accepted host cancellation is terminal here immediately (`snapshot.ts`\n * gate 1) while the kernel still calls the attempt `cancel_requested` and\n * therefore live, producing `code: 'task_not_running'` on an error whose own\n * `state` says `Cancelled`.\n */\nfunction refusalCode(kernelCode: SteerRejectionCode, state: TaskState): SteerRejectionCode {\n return TERMINAL_STATES.has(state) ? 'task_terminal' : kernelCode;\n}\n\nexport interface TaskHandleDeps {\n readonly tenant: TenantId;\n readonly cloud: ByokCloud;\n readonly relay: TaskEventRelay;\n /**\n * The task's current `TaskSnapshot.state`, or `undefined` when the attempt is\n * gone. The snapshot projection itself — never a second derivation.\n */\n readonly readState: (taskId: string) => Promise<TaskState | undefined>;\n /** The read-back this handle's `result()` answers with. */\n readonly readResult: (taskId: string) => Promise<TaskResult | undefined>;\n}\n\n/**\n * One in-flight task's control surface.\n *\n * The §3 invariant it exists to keep: **the handle is not a second authority.**\n * Every mutation is a kernel call, and `result()` is a READ-BACK — it waits for\n * the relay's terminal barrier and then asks the store what the terminal was,\n * so `handle.result()` and `byok.tasks.get(taskId).result` are physically the\n * same fact rather than two copies that can disagree. Nothing about the task is\n * cached here.\n */\nexport function createTaskHandle(taskId: string, deps: TaskHandleDeps): TaskHandle {\n // Captured once, at construction. Looking the barrier up later would resurrect\n // relay state for a task whose terminal was already reclaimed, and then wait\n // on a promise nothing is left to settle.\n const terminal = deps.relay.terminal(taskId);\n\n return {\n taskId,\n\n events(): AsyncIterable<ServerTaskEvent> {\n return deps.relay.events(taskId);\n },\n\n async cancel(reason?: string): Promise<void> {\n const attempt = await deps.cloud.cancelTask(deps.tenant, taskId, reason);\n // An already-terminal task comes back untouched: there was nothing to\n // cancel, its terminal already settled the barrier, and announcing a\n // `Cancelled` transition would contradict the recorded result.\n if (attempt.cancellation === undefined) return;\n deps.relay.noteHostTransition(taskId, 'Cancelled', attempt.cancellation.requestedAt);\n },\n\n async approve(opts?: { approvalId?: string }): Promise<void> {\n await deps.cloud.approveTask(deps.tenant, taskId, opts);\n // Cloud atomically records the host decision in the one approval\n // timeline before this notification is enqueued. The relay remains a\n // notification projection, never a second writer for that authority.\n deps.relay.noteHostTransition(taskId, 'Running', new Date().toISOString());\n },\n\n async reject(reason?: string, opts?: { approvalId?: string }): Promise<void> {\n await deps.cloud.rejectTask(deps.tenant, taskId, {\n ...(opts?.approvalId === undefined ? {} : { approvalId: opts.approvalId }),\n ...(reason === undefined ? {} : { reason }),\n });\n deps.relay.noteHostTransition(taskId, 'Running', new Date().toISOString());\n },\n\n async steer(text: string): Promise<void> {\n try {\n await deps.cloud.steerTask(deps.tenant, taskId, { text });\n } catch (caught) {\n if (!(caught instanceof KernelSteerRejectedError)) throw caught;\n const state = await deps.readState(taskId);\n // A refused steer is a non-event, so nothing it did could have removed\n // the attempt between the gate and this read. If the attempt is gone\n // anyway, the store lost it: report the kernel's own refusal rather\n // than inventing a `TaskState` for a task that no longer has one.\n if (state === undefined) throw caught;\n throw new SteerRejectedError(taskId, refusalCode(caught.code, state), state, caught.runtime);\n }\n },\n\n async result(): Promise<TaskResult> {\n // Notification delivery is not terminal liveness authority. A terminal\n // can be durable before a TaskHandle is constructed (or after relay\n // reclamation), so always ask the durable projection before waiting.\n const alreadyRecorded = await deps.readResult(taskId);\n if (alreadyRecorded !== undefined) return alreadyRecorded;\n await terminal;\n const result = await deps.readResult(taskId);\n if (result === undefined) {\n // The barrier only settles on a fact the store wrote, so an absent\n // read-back means the store lost it. Fail loudly rather than inventing\n // a terminal the task never reached.\n throw new Error(`task ${taskId} reached a terminal with no recorded result`);\n }\n return result;\n },\n };\n}\n","import { Hono } from 'hono';\nimport {\n agentHomeProjectionRequestKey,\n createByokCloud,\n createHmacTokenSigner,\n fullCapabilityDeclaration,\n pendingApproval,\n type ByokCloud,\n type EnqueuedOffer,\n type PairingCodeInfo,\n type PendingApproval,\n type TaskAttempt,\n type TenantId,\n type TerminalResult,\n} from '@byok-sdk/cloud';\nimport {\n AgentContentReadPayloadSchema,\n AgentEgressPolicySchema,\n AgentHomeProjectionPayloadSchema,\n AgentMessageEgressRequirementSchema,\n AgentMessageServerContextSchema,\n AgentRefSchema,\n DispatchSelectionSchema,\n RequiredToolsetsSchema,\n STRICT_AGENT_ONLY_CAPABILITY,\n TASK_STATES,\n TerminalProjectionSelectionSchema,\n type AgentHomeProjectionPayload,\n type AgentRef,\n type PermissionPolicy,\n type TaskState,\n} from '@byok-sdk/protocol';\nimport type { MailboxRetentionInput, MailboxRetentionResult } from '@byok-sdk/core';\nimport { DeviceConnections } from './connections';\nimport { pickFirstConnectedDevice, type DeviceCandidate } from './device-selection';\nimport { TaskEventRelay } from './relay';\nimport { toMachineInfo, toTaskResult, toTaskSnapshot, type DispatchFacts } from './snapshot';\nimport { composeFacadeStores, serverTenantId, DEFAULT_MAX_BLOB_SIZE_BYTES } from './stores';\nimport { createTaskHandle } from './task-handle';\nimport type {\n ByokServerEvent,\n AgentContentReadRequest,\n AgentHomeProjectionRequest,\n AgentHomeProjectionStatusReadback,\n AgentEgressReceipt,\n ByokServerStorage,\n CreateByokServerOptions,\n DispatchInput,\n FreshAgentEgressDispatchInput,\n HubStats,\n MachineInfo,\n TaskHandle,\n TaskResult,\n TaskSnapshot,\n} from './types';\n\nexport type {\n ByokServerEvent,\n AgentContentReadRequest,\n AgentHomeProjectionRequest,\n AgentHomeProjectionStatusReadback,\n AgentEgressReceipt,\n ByokServerStorage,\n CreateByokServerOptions,\n DispatchInput,\n FreshAgentEgressDispatchInput,\n HubStats,\n MachineInfo,\n ServerTaskEvent,\n TaskHandle,\n TaskResult,\n TaskSnapshot,\n} from './types';\nexport type { TaskOfferReadback } from '@byok-sdk/cloud';\n/**\n * M5 (approval targeting, docs/protocol.md §5.3): `TaskHandle.approve`/`reject`'s\n * `opts.approvalId` targeting throws this when the id names an approval the\n * task has already superseded, so a caller needs it to `instanceof`-check and\n * inspect the two ids. Re-exported from `@byok-sdk/cloud`, which owns the gate\n * both the embedded and the hosted surface are decided by — one class, one\n * `instanceof` that works across both.\n */\nexport { StaleApprovalError } from '@byok-sdk/cloud';\n/**\n * S0 (GAP-002): `TaskHandle.steer` throws this when the runtime that claimed\n * the task cannot be steered, when the task isn't running, or when it's already\n * terminal. The GATE is the kernel's — it reads the claim-time capability\n * snapshot and nothing else — and so is the `code`. The CLASS is this\n * package's, because it carries `state: TaskState`, the wire vocabulary this\n * surface speaks and the kernel deliberately has no field for. See\n * `task-handle.ts` for the full reasoning and for why `SteerRejectionCode` and\n * {@link StaleApprovalError} stay kernel re-exports.\n */\nexport { SteerRejectedError } from './task-handle';\nexport type { SteerRejectionCode } from '@byok-sdk/cloud';\n/**\n * Auth v2 types an embedder needs to talk about devices and tokens. All owned\n * by `@byok-sdk/cloud` now — this package no longer has an auth plane of its\n * own to keep in agreement with one.\n */\nexport type { AccessTokenClaims, DeviceRecord, PairingCodeInfo, TenantId, TokenSigner } from '@byok-sdk/cloud';\nexport { createHmacTokenSigner } from '@byok-sdk/cloud';\n/** Cutoffs and result of {@link ByokServer.mailbox.collectRetired}, owned by `@byok-sdk/core`. */\nexport type { MailboxRetentionInput, MailboxRetentionResult } from '@byok-sdk/core';\nexport { SqliteUnavailableError } from './sqlite-support';\nexport type { RateLimiterOptions } from './rate-limiter';\nexport { DEFAULT_TASK_EVENT_BUFFER_LIMIT, DEFAULT_TASK_EVENT_RETENTION_MS } from './relay';\n\n/** `GET /byok/events` hold duration (§8): ~50s unless overridden (e.g. for tests). */\nconst DEFAULT_LONG_POLL_HOLD_MS = 50_000;\n/** Ceiling on how often a held poll re-reads the mailbox, ms. */\nconst MAX_LONG_POLL_INTERVAL_MS = 250;\n/** Floor on the same, so a short test hold still re-reads several times. */\nconst MIN_LONG_POLL_INTERVAL_MS = 5;\n/** Attempts a held poll makes across its window; sets the re-read interval with the hold. */\nconst LONG_POLL_READS_PER_HOLD = 8;\n/** Bytes of HMAC secret minted when an embedder supplies no {@link TokenSigner}. */\nconst TOKEN_SECRET_BYTES = 32;\n/** Page size `tasks.list()` uses when the caller names none. */\nexport const DEFAULT_TASK_PAGE_LIMIT = 100;\n\n/** Input to {@link ByokServer.pairing.createPairingCode}. */\nexport interface CreatePairingCodeInput {\n /**\n * The product the redeeming device pairs into. Must be this instance's own\n * `productId`: an embedded server serves exactly one product, and a code for\n * some other product would mint a device every bearer-authed route then\n * refuses (`instanceProductId`, `@byok-sdk/cloud`). Fail closed rather than\n * silently issuing an unusable code.\n *\n * The TENANT is not a parameter: it is derived from `productId` once, at\n * construction (`serverTenantId`, `stores.ts`), because this surface has no\n * second tenant to name.\n */\n readonly productId: string;\n /** Overrides the default single-use code lifetime. */\n readonly ttlMs?: number;\n}\n\n/** One bounded page of this server's tasks. */\nexport interface TaskPage {\n readonly tasks: readonly TaskSnapshot[];\n /**\n * Pass as the next call's `cursor`. ABSENT means the walk is over — a caller\n * stops on absence, not on an empty page, so a page that exactly fills\n * `limit` with nothing after it still terminates.\n */\n readonly nextCursor?: string;\n}\n\n/** Query for {@link ByokServer.tasks.list}. */\nexport interface TaskListQuery {\n /** Maximum snapshots in the page. Defaults to {@link DEFAULT_TASK_PAGE_LIMIT}. */\n readonly limit?: number;\n /** The `nextCursor` from the previous page; absent starts at the beginning. */\n readonly cursor?: string;\n}\n\n/** The object `createByokServer` returns — the SaaS-embedder-facing surface. */\nexport interface ByokServer {\n /** Hono app exposing every device route, plus the opt-in `/healthz`. Mount it, or use its `.fetch` with `@hono/node-server`. */\n hono: Hono;\n pairing: {\n /** Mint a single-use pairing code for this server's product and tenant (docs/protocol.md §6.1). */\n createPairingCode(input: CreatePairingCodeInput): Promise<PairingCodeInfo>;\n };\n dispatch(input: DispatchInput): Promise<TaskHandle>;\n /** Dispatch a fresh Agent execution whose runtime will mint its session after start. */\n dispatchFreshAgentEgress(input: FreshAgentEgressDispatchInput): Promise<TaskHandle>;\n /** Enqueue one capability-gated, exact-identity content-read request. */\n requestAgentContentRead(input: AgentContentReadRequest): Promise<void>;\n /** Enqueue one task-free, exact-device Agent-home projection. */\n enqueueAgentHomeProjection(input: AgentHomeProjectionRequest): Promise<AgentHomeProjectionStatusReadback>;\n /** Durable desired-state and terminal-outcome readback for one exact device-and-Agent request. */\n readAgentHomeProjection(\n deviceId: string,\n agentRef: AgentRef,\n requestId: string,\n ): Promise<AgentHomeProjectionStatusReadback | undefined>;\n tasks: {\n get(taskId: string): Promise<TaskSnapshot | undefined>;\n /** Immutable kernel offer readback for verifying a persisted host binding. No transport seq is inferred. */\n offer(taskId: string): Promise<import('@byok-sdk/cloud').TaskOfferReadback | undefined>;\n /** Request cancellation through the kernel without a process-owned TaskHandle. */\n cancel(taskId: string, reason?: string): Promise<void>;\n /**\n * One bounded page, keyset-paged by task id. Paged rather than \"all of\n * them\" because the underlying store is: an unbounded `list()` would have\n * to walk every page internally and hand back a snapshot that was never\n * consistent at any single instant.\n */\n list(query?: TaskListQuery): Promise<TaskPage>;\n };\n /** Trusted embedder access to committed blob download grants. */\n blobs: {\n getDownloadUrl(blobId: string): Promise<string | undefined>;\n };\n /** Reliable Agent egress receipt readback. */\n egress: {\n get(deviceId: string, agentRef: AgentRef, eventId: string): Promise<AgentEgressReceipt | undefined>;\n };\n machines: {\n list(): Promise<MachineInfo[]>;\n };\n events: {\n subscribe(): AsyncIterable<ByokServerEvent>;\n };\n /**\n * Device revocation (§6.3) — server-side only, no wire message. Revoking a\n * device DELETES its registration, so its next `/byok/challenge`,\n * `/byok/token`, or authed HTTP call gets a 401 — the same answer as for a\n * device id that was never registered — and its only recourse is to re-run\n * `/byok/pair`. The device-scoped state the row owned (outstanding challenge\n * nonces, presence, inbound dedup) is deleted with it; what the device DID\n * (tasks, receipts) is history and survives.\n *\n * DEVICE-ID ONLY. The hosted control plane's own revocation is tenant-first\n * (a tenant may only revoke a device it owns), but an embedded server owns\n * exactly ONE tenant and binds it here itself: `TenantId` is a branded type an\n * embedder cannot mint, and nothing on this surface — `ByokServer`,\n * `MachineInfo`, `PairingCodeInfo` — hands one back, so a tenant-first\n * parameter would make this method uncallable from outside the package rather\n * than safer. The scoping it provided is unchanged, just not the caller's to\n * state: a device id this server does not know resolves to nothing and is a\n * silent no-op.\n */\n devices: {\n revoke(deviceId: string): Promise<void>;\n };\n /**\n * Mailbox retention for this server's tenant — the host control-plane\n * operation core defines (`MailboxStore.collectRetired`), forwarded verbatim.\n *\n * A pass-through, deliberately, and NOT a retention policy: the caller names\n * both cutoffs, so this package invents no TTL, runs no timer, and holds no\n * second opinion about when a device's undelivered work is declared lost.\n * Nothing in `@byok-sdk/core`, `@byok-sdk/cloud` or this façade drives the\n * sweep on its own, which is exactly why an embedder needs a way to reach it:\n * without one, an embedded server retires nothing, ever, and the\n * `cursor_too_old` floor can never move.\n *\n * Acked rows appended before `ackedBefore` are DELETED; unacked rows appended\n * before `expireUnackedBefore` are dead-lettered as `expired` and stay\n * visible, which is what moves `recoverableFrom` and turns a device polling\n * from a lost cursor into a `409 cursor_too_old` resync instead of a silently\n * short page. Both cutoffs must be canonical ISO-8601 UTC.\n */\n mailbox: {\n collectRetired(input: MailboxRetentionInput): Promise<MailboxRetentionResult>;\n };\n /**\n * Release what this instance holds: the relay's per-task feeds and their\n * reclamation timers, and the connection observations. Call it on shutdown so\n * nothing keeps the process alive or leaks a handle in tests; safe to call\n * more than once. SQLite embedders that need to await handle release should\n * call {@link ByokServer.close} instead.\n */\n stop(): void;\n /** Drain pending store calls and release the selected storage authority. */\n close(): Promise<void>;\n /**\n * A plain, serializable snapshot of this server's current state. See\n * {@link HubStats} for the field-by-field contract.\n *\n * Async because `taskCountsByState` is COMPUTED from the durable task store\n * on every call rather than mirrored into a counter this package would then\n * have to keep in agreement with it — that mirror was the second task\n * authority the fold exists to remove. Deliberately in-process only: never\n * exposed over HTTP by this SDK itself (see\n * `CreateByokServerOptions.healthzRoute`); an embedder that wants any of it\n * surfaced remotely builds its own authenticated route around this method.\n */\n stats(): Promise<HubStats>;\n}\n\n/**\n * Embedded reference coordinator: a thin façade over `@byok-sdk/cloud`'s\n * kernel, composed against the explicitly selected embedded stores.\n *\n * What that means concretely — and it is the whole point of WP3B — is that this\n * package owns NO coordination semantics any more. Pairing, tokens, the inbound\n * gate, task ownership, first-terminal-wins, approvals, steering, cancellation,\n * long-poll redelivery and the `cursor_too_old` floor are all the kernel's, and\n * a device cannot tell this from a hosted deployment. What is left here is the\n * embedded shape: one product, one tenant, a `TaskHandle` for hosts that want\n * one, an in-process notification relay, and the observability an embedder used\n * to get from the hub.\n *\n * State is in-memory by default. Explicit SQLite mode persists request receipts, the device directory and six\n * coordination interfaces whose contracts cross a process restart; all other\n * ports remain process-local.\n */\nexport function createByokServer(opts: CreateByokServerOptions): ByokServer {\n const startedAtMs = Date.now();\n const tenant = serverTenantId(opts.productId);\n const maxBlobSizeBytes = opts.maxBlobSizeBytes ?? DEFAULT_MAX_BLOB_SIZE_BYTES;\n const longPollHoldMs = opts.longPollHoldMs ?? DEFAULT_LONG_POLL_HOLD_MS;\n\n const connections = new DeviceConnections();\n const relay = new TaskEventRelay({\n connections,\n ...(opts.taskEventBufferLimit === undefined ? {} : { taskEventBufferLimit: opts.taskEventBufferLimit }),\n ...(opts.taskEventRetentionMs === undefined ? {} : { taskEventRetentionMs: opts.taskEventRetentionMs }),\n });\n\n const composition = composeFacadeStores({\n tenant,\n maxBlobSizeBytes,\n ...(opts.storage === undefined ? {} : { storage: opts.storage }),\n ...(opts.rateLimit === undefined ? {} : { rateLimit: opts.rateLimit }),\n connections,\n onRateLimited: (deviceId, at) => relay.emitServerEvent({ kind: 'device.rate_limited', deviceId, at }),\n });\n\n const tokenSigner =\n opts.tokenSigner ??\n createHmacTokenSigner(\n globalThis.crypto.getRandomValues(new Uint8Array(TOKEN_SECRET_BYTES)),\n composition.clock,\n );\n\n const cloud: ByokCloud = createByokCloud({\n core: composition.core,\n cloud: composition.cloud,\n blobContentProxy: composition.blobContentProxy,\n crypto: composition.crypto,\n tokenSigner,\n clock: composition.clock,\n capabilities: fullCapabilityDeclaration(),\n // S1: the product this instance serves is part of every bearer-authed\n // route's decision, not just of the pairing claims.\n instanceProductId: opts.productId,\n observer: relay,\n ...(opts.agentMessage === undefined ? {} : { agentMessage: opts.agentMessage }),\n maxBlobSizeBytes,\n longPollHoldMs,\n longPollIntervalMs: longPollInterval(longPollHoldMs),\n });\n\n /**\n * Dispatch input the kernel does not persist. See `DispatchFacts` for why\n * this exists and why it is not TTL-reclaimed.\n */\n const dispatched = new Map<string, DispatchFacts>();\n\n const hono = new Hono();\n if (opts.healthzRoute === true) {\n // Deliberately UNAUTHENTICATED and minimal: a liveness probe must not need\n // a device credential, and the body carries no device ids and no counts.\n // `stats()` is the richer surface and is never routed anywhere by this SDK.\n hono.get('/healthz', (c) => c.json({ ok: true, uptimeMs: Date.now() - startedAtMs }, 200));\n }\n // Everything else IS the kernel. Mounted as a fallthrough rather than\n // re-declared route by route so this package can never publish a route the\n // kernel does not serve, or shadow one it does.\n hono.all('*', (c) => cloud.fetch(c.req.raw));\n\n async function readPending(taskId: string): Promise<PendingApproval | undefined> {\n return pendingApproval(await cloud.readApprovalTimeline(tenant, taskId));\n }\n\n async function readTerminal(taskId: string): Promise<TerminalResult | undefined> {\n return cloud.readTaskResult(tenant, taskId);\n }\n\n async function projectTask(attempt: TaskAttempt): Promise<TaskSnapshot> {\n const [pending, terminal] = await Promise.all([readPending(attempt.taskId), readTerminal(attempt.taskId)]);\n return toTaskSnapshot(attempt, pending, terminal, dispatched.get(attempt.taskId));\n }\n\n /**\n * The state `byok.tasks.get(taskId)` would report right now.\n *\n * Deliberately routed through `projectTask` rather than re-deriving it: a\n * refused steer reports the same `TaskState` the snapshot does, because it is\n * literally the snapshot's, read at the moment of the refusal.\n */\n async function readTaskState(taskId: string): Promise<TaskState | undefined> {\n const attempt = await cloud.readTaskAttempt(tenant, taskId);\n return attempt === undefined ? undefined : (await projectTask(attempt)).state;\n }\n\n /**\n * M4 Phase 3 hardening: the daemon resolved a pending approval entirely\n * locally and never sent `task.approval_resolved`, but its next\n * progress/artifact message proves, after the fact, that it did. Recorded on\n * the same timeline as any other resolution so the read model resumes, and\n * announced as `task.approval_resolved_implicit` so an embedder can tell the\n * inferred path from the reported one.\n *\n * Runs off the relay's request path, not on it: it needs a store read, and\n * the kernel's observer contract is synchronous and inline. A failure here\n * changes nothing durable — the next message re-runs the same check.\n */\n relay.onTaskActivity = (\n taskId: string,\n pendingRequestSourceEnvelopeId: string | undefined,\n activitySourceEnvelopeId: string,\n activityAt: string,\n ): void => {\n void (async () => {\n // The relay captured this request identity when it observed the native\n // `task.await_approval`. An activity that committed before that request\n // is therefore never retroactively allowed to resolve it after an async\n // timeline read observes the newer pending slot.\n if (pendingRequestSourceEnvelopeId === undefined) return;\n const pending = await readPending(taskId);\n if (\n pending === undefined ||\n pending.sourceEnvelopeId !== pendingRequestSourceEnvelopeId\n ) {\n return;\n }\n const attempt = await cloud.readTaskAttempt(tenant, taskId);\n if (attempt === undefined) return;\n const sourceEnvelopeId = await composition.crypto.sha256(\n new TextEncoder().encode(\n JSON.stringify({\n domain: 'byok:implicit-approval',\n tenant,\n taskId,\n deviceId: attempt.deviceId,\n ownerDeviceId: attempt.ownerDeviceId,\n agentRef: attempt.agentRef,\n requestSourceEnvelopeId: pending.sourceEnvelopeId,\n requestRevision: pending.revision,\n activitySourceEnvelopeId,\n }),\n ),\n );\n const resolved = await composition.cloud.approvals.resolvePending(tenant, {\n taskId,\n sourceEnvelopeId,\n expectedSourceEnvelopeId: pending.sourceEnvelopeId,\n expectedRevision: pending.revision,\n event: {\n type: 'approval_resolved',\n ...(pending.approvalId === undefined ? {} : { approvalId: pending.approvalId }),\n decision: 'approve',\n resolvedBy: 'host',\n at: activityAt,\n },\n });\n if (resolved.status === 'applied' || resolved.status === 'replayed') {\n relay.emitImplicitApprovalResolved(taskId, activityAt);\n }\n })().catch(() => undefined);\n };\n\n async function candidatesInObservationOrder(): Promise<DeviceCandidate[]> {\n const candidates: DeviceCandidate[] = [];\n for (const deviceId of connections.ids()) {\n if (!connections.isConnected(deviceId)) continue;\n const device = await composition.cloud.devices.get(tenant, deviceId);\n if (device === undefined || device.revoked) continue;\n candidates.push({\n deviceId,\n capabilities: device.capabilities,\n configuredToolsets: connections.get(deviceId)?.configuredToolsets,\n });\n }\n return candidates;\n }\n\n async function deviceCapabilities(deviceId: string): Promise<readonly string[] | undefined> {\n return (await composition.cloud.devices.get(tenant, deviceId))?.capabilities;\n }\n\n async function requireConnected(deviceId: string): Promise<void> {\n if (!connections.isConnected(deviceId)) throw new Error(`device ${deviceId} is not connected`);\n }\n\n // An in-flight exclusion only; persisted task and receipt stores own identity.\n const dispatching = new Set<string>();\n async function dispatchWithIdentity(input: DispatchInput | FreshAgentEgressDispatchInput, fresh: boolean): Promise<TaskHandle> {\n const submission = { ...input };\n const taskId = submission.taskId;\n if (taskId === undefined) return dispatchInternal(submission, fresh);\n if (typeof taskId !== 'string' || taskId.length === 0) throw new Error('taskId must be a non-empty string');\n if (input.deviceId === undefined) throw new Error('caller taskId requires an explicit deviceId');\n if (dispatching.has(taskId)) throw new Error('dispatch for this taskId is already in progress; retain the original binding');\n dispatching.add(taskId);\n try { return await dispatchInternal(submission, fresh); }\n finally { dispatching.delete(taskId); }\n }\n\n async function dispatchInternal(\n input: DispatchInput | FreshAgentEgressDispatchInput,\n freshAgentEgress: boolean,\n ): Promise<TaskHandle> {\n const sessionRef = 'sessionRef' in input ? input.sessionRef : undefined;\n const agentRef = input.agentRef === undefined ? undefined : AgentRefSchema.parse(input.agentRef);\n const egressPolicy =\n input.egressPolicy === undefined ? undefined : AgentEgressPolicySchema.parse(input.egressPolicy);\n const messageEgress =\n input.messageEgress === undefined ? undefined : AgentMessageEgressRequirementSchema.parse(input.messageEgress);\n const terminalProjection =\n input.terminalProjection === undefined\n ? undefined\n : TerminalProjectionSelectionSchema.parse(input.terminalProjection);\n if (messageEgress === undefined && input.agentMessageContext !== undefined) {\n throw new Error('agentMessageContext requires messageEgress');\n }\n const agentMessageContext =\n messageEgress === undefined ? undefined : AgentMessageServerContextSchema.parse(input.agentMessageContext);\n const dispatchSelection =\n input.dispatchSelection === undefined ? undefined : DispatchSelectionSchema.parse(input.dispatchSelection);\n const requiredToolsets =\n input.requiredToolsets === undefined ? undefined : RequiredToolsetsSchema.parse(input.requiredToolsets);\n\n if (agentRef !== undefined && input.deviceId === undefined) {\n throw new Error('Agent-bound dispatch requires an explicit deviceId for capability admission');\n }\n if (egressPolicy !== undefined && agentRef === undefined) {\n throw new Error('Agent egress policy requires an explicit AgentRef; legacy task dispatch cannot consume it');\n }\n if (messageEgress !== undefined && egressPolicy === undefined) {\n throw new Error('Agent message egress requires the typed Agent egress offer path');\n }\n\n const deviceId =\n input.deviceId ??\n pickFirstConnectedDevice(await candidatesInObservationOrder(), {\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n allowStrictAgentOnly: agentRef !== undefined,\n });\n // No queue-until-connect: reject clearly instead of silently enqueuing a\n // task nothing will ever claim.\n if (deviceId === undefined) {\n throw new Error('no connected device to dispatch to (M0 does not queue tasks until a device connects)');\n }\n await requireConnected(deviceId);\n\n // The gates the kernel does not run, in the pre-fold order. Everything\n // below the kernel DOES run (strict-agent-only, agent-home-contract, the\n // egress/message/terminal-projection capabilities) is left to it rather\n // than duplicated here, so there is one place each admission is decided.\n const capabilities = await deviceCapabilities(deviceId);\n if (dispatchSelection !== undefined && !(capabilities?.includes('dispatch-selection') ?? false)) {\n throw new Error(\n `device ${deviceId} did not advertise dispatch-selection capability; refusing authoritative provider/model dispatch`,\n );\n }\n if (requiredToolsets !== undefined) {\n if (!(capabilities?.includes('toolset-selection') ?? false)) {\n throw new Error(\n `device ${deviceId} did not advertise toolset-selection capability; refusing a task whose semantics require local MCP tools`,\n );\n }\n const configuredToolsets = connections.get(deviceId)?.configuredToolsets;\n if (configuredToolsets === undefined) {\n throw new Error(\n `device ${deviceId} did not advertise its configured toolset inventory; refusing to guess from runtime capability`,\n );\n }\n const configured = new Set(configuredToolsets);\n const missing = requiredToolsets.filter((toolsetId) => !configured.has(toolsetId));\n if (missing.length > 0) {\n throw new Error(`device ${deviceId} is missing required MCP toolset(s): ${missing.join(', ')}`);\n }\n }\n if (\n dispatchSelection !== undefined &&\n input.runtime !== undefined &&\n input.runtime !== dispatchSelection.runtimeId\n ) {\n throw new Error(\n `dispatch runtime ${input.runtime} does not match dispatchSelection.runtimeId ${dispatchSelection.runtimeId}`,\n );\n }\n if (agentRef === undefined && capabilities?.includes(STRICT_AGENT_ONLY_CAPABILITY) === true) {\n throw new Error(\n `device ${deviceId} advertises strict-agent-only; legacy task dispatch is refused before enqueue`,\n );\n }\n\n const policy: PermissionPolicy = input.policy ?? { mode: 'confirm' };\n const runtime = dispatchSelection?.runtimeId ?? input.runtime;\n const common = {\n ...(input.harnessId === undefined ? {} : { harnessId: input.harnessId }),\n instruction: input.instruction,\n policy,\n ...(runtime === undefined ? {} : { runtime }),\n ...(dispatchSelection === undefined ? {} : { dispatchSelection }),\n };\n\n // A known id lets the relay exist before enqueue can make the offer\n // observable. Inbound claim/terminal traffic racing append is buffered by\n // that provisional relay state and reconciled once the offer succeeds.\n const taskId = input.taskId ?? globalThis.crypto.randomUUID();\n relay.provision(taskId);\n let enqueued: EnqueuedOffer;\n try {\n enqueued = await (async () => {\n if (agentRef !== undefined && egressPolicy !== undefined && freshAgentEgress) {\n return cloud.enqueueFreshAgentEgressOffer(tenant, deviceId, {\n taskId,\n payload: {\n ...common,\n agentRef,\n egressPolicy,\n ...(terminalProjection === undefined ? {} : { terminalProjection }),\n ...(messageEgress === undefined ? {} : { messageEgress }),\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n },\n ...(agentMessageContext === undefined ? {} : { agentMessageContext }),\n });\n }\n if (agentRef !== undefined && egressPolicy !== undefined) {\n if (sessionRef === undefined) {\n throw new Error(\n 'Agent egress resume dispatch requires an exact sessionRef; use dispatchFreshAgentEgress for fresh execution',\n );\n }\n return cloud.enqueueAgentEgressOffer(tenant, deviceId, {\n taskId,\n payload: {\n ...common,\n sessionRef,\n agentRef,\n egressPolicy,\n ...(terminalProjection === undefined ? {} : { terminalProjection }),\n ...(messageEgress === undefined ? {} : { messageEgress }),\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n },\n ...(agentMessageContext === undefined ? {} : { agentMessageContext }),\n });\n }\n if (agentRef !== undefined) {\n return cloud.enqueueAgentOffer(tenant, deviceId, {\n taskId,\n payload: {\n ...common,\n agentRef,\n ...(sessionRef === undefined ? {} : { sessionRef }),\n ...(terminalProjection === undefined ? {} : { terminalProjection }),\n ...(requiredToolsets === undefined ? {} : { requiredToolsets }),\n },\n });\n }\n if (requiredToolsets !== undefined) {\n return cloud.enqueueToolsetOffer(tenant, deviceId, {\n taskId,\n payload: { ...common, ...(sessionRef === undefined ? {} : { sessionRef }), requiredToolsets },\n });\n }\n return cloud.enqueueOffer(tenant, deviceId, {\n taskId,\n payload: { ...common, ...(sessionRef === undefined ? {} : { sessionRef }) },\n });\n })();\n } catch (error) {\n relay.abort(taskId);\n throw error;\n }\n\n // The offer envelope's own timestamp, so the feed and the snapshot agree on\n // when the task began rather than each stamping its own \"now\".\n const createdAt = enqueued.envelope.ts;\n dispatched.set(enqueued.taskId, {\n createdAt,\n ...(sessionRef === undefined ? {} : { sessionRef }),\n });\n relay.noteDispatched(enqueued.taskId, createdAt);\n return handleFor(enqueued.taskId);\n }\n\n function handleFor(taskId: string): TaskHandle {\n return createTaskHandle(taskId, {\n tenant,\n cloud,\n relay,\n readState: readTaskState,\n readResult: async (id) => toTaskResult(await readTerminal(id)),\n });\n }\n\n return {\n hono,\n\n pairing: {\n // `async`, not a plain function that throws: the declared contract is a\n // promise, and a guard that threw synchronously would refuse a\n // cross-product mint through a channel no `await`/`.catch()` caller of a\n // promise-returning method handles. Fail closed, on the same channel as\n // every other failure of this method.\n async createPairingCode(input: CreatePairingCodeInput): Promise<PairingCodeInfo> {\n if (input.productId !== opts.productId) {\n throw new Error(\n `pairing code product ${input.productId} does not match this server's product ${opts.productId}`,\n );\n }\n return cloud.createPairingCode(tenant, {\n productId: input.productId,\n ...(input.ttlMs === undefined ? {} : { ttlMs: input.ttlMs }),\n });\n },\n },\n\n dispatch(input: DispatchInput): Promise<TaskHandle> {\n return dispatchWithIdentity(input, false);\n },\n\n dispatchFreshAgentEgress(input: FreshAgentEgressDispatchInput): Promise<TaskHandle> {\n if (Object.prototype.hasOwnProperty.call(input, 'sessionRef')) {\n throw new Error('fresh Agent egress dispatch must not carry sessionRef');\n }\n if (typeof input.deviceId !== 'string' || input.deviceId.length === 0) {\n throw new Error('fresh Agent egress dispatch requires an explicit deviceId');\n }\n if (input.agentRef === undefined || input.egressPolicy === undefined) {\n throw new Error('fresh Agent egress dispatch requires exact AgentRef and egress policy');\n }\n return dispatchWithIdentity(input, true);\n },\n\n async requestAgentContentRead(input: AgentContentReadRequest): Promise<void> {\n const payload = AgentContentReadPayloadSchema.parse(input.payload);\n await requireConnected(input.deviceId);\n await cloud.enqueueAgentContentRead(tenant, input.deviceId, { payload });\n },\n\n async enqueueAgentHomeProjection(\n input: AgentHomeProjectionRequest,\n ): Promise<AgentHomeProjectionStatusReadback> {\n const payload = AgentHomeProjectionPayloadSchema.parse(input.payload);\n await requireConnected(input.deviceId);\n return (await cloud.enqueueAgentHomeProjection(tenant, input.deviceId, payload)).status;\n },\n\n async readAgentHomeProjection(\n deviceId: string,\n agentRef: AgentRef,\n requestId: string,\n ): Promise<AgentHomeProjectionStatusReadback | undefined> {\n // The durable request lookup is exact to the device and AgentRef. The\n // stored request remains the authority for the projection hash.\n const stored = await composition.cloud.receipts.get(\n tenant,\n agentHomeProjectionRequestKey(deviceId, agentRef, requestId),\n );\n if (stored === undefined) return undefined;\n let desired: AgentHomeProjectionPayload;\n try {\n desired = AgentHomeProjectionPayloadSchema.parse(JSON.parse(stored.body));\n } catch {\n return undefined;\n }\n return cloud.getAgentHomeProjectionStatus(tenant, deviceId, {\n requestId: desired.requestId,\n agentRef: desired.agentRef,\n projectionHash: desired.projectionHash,\n });\n },\n\n tasks: {\n offer(taskId) { return cloud.readTaskOffer(tenant, taskId); },\n async cancel(taskId, reason) {\n const attempt = await cloud.cancelTask(tenant, taskId, reason);\n if (attempt.cancellation !== undefined) {\n relay.noteHostTransition(taskId, 'Cancelled', attempt.cancellation.requestedAt);\n }\n },\n async get(taskId: string): Promise<TaskSnapshot | undefined> {\n const attempt = await cloud.readTaskAttempt(tenant, taskId);\n return attempt === undefined ? undefined : projectTask(attempt);\n },\n async list(query: TaskListQuery = {}): Promise<TaskPage> {\n const page = await cloud.listTaskAttempts(tenant, {\n limit: query.limit ?? DEFAULT_TASK_PAGE_LIMIT,\n ...(query.cursor === undefined ? {} : { cursor: query.cursor }),\n });\n return {\n tasks: await Promise.all(page.attempts.map((attempt) => projectTask(attempt))),\n ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }),\n };\n },\n },\n\n blobs: {\n getDownloadUrl(blobId: string): Promise<string | undefined> {\n return composition.cloud.blobs.getDownloadUrl(tenant, blobId);\n },\n },\n\n egress: {\n async get(deviceId: string, agentRef: AgentRef, eventId: string): Promise<AgentEgressReceipt | undefined> {\n const record = await cloud.readAgentEgress(tenant, deviceId, agentRef, eventId);\n return record === undefined\n ? undefined\n : {\n deviceId: record.deviceId,\n payload: record.payload,\n receiptId: record.receiptId,\n recordedAt: record.recordedAt,\n };\n },\n },\n\n machines: {\n async list(): Promise<MachineInfo[]> {\n const devices = await cloud.listDevices(tenant);\n return devices.map((device) => toMachineInfo(device, connections.get(device.deviceId)));\n },\n },\n\n events: {\n subscribe: () => relay.serverEvents(),\n },\n\n devices: {\n async revoke(deviceId: string): Promise<void> {\n // §6.3: a tenant can only revoke a device it owns. This server owns one\n // tenant and supplies it here, so a device id belonging to nobody\n // addresses nothing and touches nothing.\n await cloud.revokeDevice(tenant, deviceId);\n connections.forget(deviceId);\n },\n },\n\n mailbox: {\n collectRetired(input: MailboxRetentionInput): Promise<MailboxRetentionResult> {\n return composition.core.mailbox.collectRetired(tenant, input);\n },\n },\n\n stop(): void {\n relay.stop();\n dispatched.clear();\n void composition.close();\n },\n\n async close(): Promise<void> {\n relay.stop();\n dispatched.clear();\n await composition.close();\n },\n\n async stats(): Promise<HubStats> {\n const taskCountsByState = Object.fromEntries(TASK_STATES.map((state) => [state, 0])) as Record<\n TaskState,\n number\n >;\n let cursor: string | undefined;\n do {\n const page = await cloud.listTaskAttempts(tenant, {\n limit: DEFAULT_TASK_PAGE_LIMIT,\n ...(cursor === undefined ? {} : { cursor }),\n });\n for (const attempt of page.attempts) {\n taskCountsByState[toStateForCount(attempt, await readPending(attempt.taskId))] += 1;\n }\n cursor = page.nextCursor;\n } while (cursor !== undefined);\n\n return {\n connectedDeviceCount: connections.connectedCount(),\n taskCountsByState,\n envelopesIn: composition.counters.envelopesIn,\n dedupDrops: composition.counters.dedupDrops,\n rateLimitEvents: composition.counters.rateLimitEvents,\n uptimeMs: Date.now() - startedAtMs,\n };\n },\n };\n}\n\n/** Same projection `tasks.get` uses; named so the count and the snapshot can never disagree. */\nfunction toStateForCount(attempt: TaskAttempt, pending: PendingApproval | undefined): TaskState {\n return toTaskSnapshot(attempt, pending, undefined, undefined).state;\n}\n\n/**\n * A held poll re-reads the mailbox on a fraction of its own window, clamped so\n * a long production hold does not busy-loop and a short test hold still gets\n * several reads instead of exactly one.\n */\nfunction longPollInterval(holdMs: number): number {\n const derived = Math.floor(holdMs / LONG_POLL_READS_PER_HOLD);\n return Math.max(MIN_LONG_POLL_INTERVAL_MS, Math.min(MAX_LONG_POLL_INTERVAL_MS, derived));\n}\n"]}