@cat-factory/orchestration 0.123.4 → 0.123.6

package/dist/modules/execution/RunAdmission.js

@@ -0,0 +1,571 @@
+import { ConflictError, isAllowedByFamilyPolicy, isModelUsable, isModelUsableInline, resolveModelRef, subscriptionOptionFor, } from '@cat-factory/kernel';
+import { frameAllowsVisualPipeline, frameProfile, isLocalRunner, pipelineHasVisualStep, } from '@cat-factory/contracts';
+import { BINARY_STORAGE_TRAIT, hasTrait, isInlineModelStep } from '@cat-factory/agents';
+import { validatePipelineShape } from '../pipelines/pipelineShape.js';
+import { assertInitiativeShapeAllowed } from '../initiative/initiative.logic.js';
+import { isTesterKind } from './ci.logic.js';
+import { decideTesterInfra, ENV_CONSUMER_KINDS, needsDeployerBeforeConsumer, TESTER_INFRA_MESSAGES, } from './tester-infra.logic.js';
+import { decideDeployerConfig, deployerServiceConfigIssues, hasEnabledDeployerStep, } from './deployer.logic.js';
+import { hasLiveServiceBinding, hasServiceBinding } from './frontend-infra.logic.js';
+import { dependenciesMet, unmetDependencies } from '../board/board.logic.js';
+/**
+ * The run ADMISSION preflights — every config/resource precondition a run must satisfy
+ * before it is allowed to START, RETRY or RESTART, extracted out of `ExecutionService`
+ * so the engine's public lifecycle methods stay readable while the guard family grows.
+ * All checks are read-only and run BEFORE any side effects, each throwing an actionable
+ * {@link ConflictError}. The shared entry point is {@link assertRunnable}; the start-only
+ * concurrency/dependency gates ({@link assertWithinTaskLimit}, {@link assertDependenciesMet})
+ * are separate because a retry/restart deliberately skips them.
+ */
+export class RunAdmission {
+    workspaceRepository;
+    blockRepository;
+    executionRepository;
+    contextBuilder;
+    agentKindRegistry;
+    spend;
+    environmentProvisioning;
+    workspaceSettingsService;
+    resolveBinaryArtifactStore;
+    resolveProviderCapabilities;
+    inlineHarnessRef;
+    resolveWorkspaceModelDefault;
+    assertAgentBackendConfigured;
+    constructor(deps) {
+        this.workspaceRepository = deps.workspaceRepository;
+        this.blockRepository = deps.blockRepository;
+        this.executionRepository = deps.executionRepository;
+        this.contextBuilder = deps.contextBuilder;
+        this.agentKindRegistry = deps.agentKindRegistry;
+        this.spend = deps.spend;
+        this.environmentProvisioning = deps.environmentProvisioning;
+        this.workspaceSettingsService = deps.workspaceSettingsService;
+        this.resolveBinaryArtifactStore = deps.resolveBinaryArtifactStore;
+        this.resolveProviderCapabilities = deps.resolveProviderCapabilities;
+        this.inlineHarnessRef = deps.inlineHarnessRef;
+        this.resolveWorkspaceModelDefault = deps.resolveWorkspaceModelDefault;
+        this.assertAgentBackendConfigured = deps.assertAgentBackendConfigured;
+    }
+    /**
+     * The config/resource preconditions a run must satisfy to START, RETRY **or** RESTART:
+     * everything that depends on the workspace environment + the steps being run, and NOT on
+     * whether this is a fresh run or a replacement. All three entry points call this so they
+     * can't drift — a guard added to one but silently missing from the other is exactly how a
+     * subscription-only preset slipped past retry and failed mid-run against the routing default.
+     * All checks are read-only and run BEFORE any side effects, each throwing an actionable
+     * {@link ConflictError}.
+     *
+     * The `shape` is the effective chain that will run, NOT the current pipeline definition: a
+     * fresh start passes the pipeline, while a retry/restart passes the STORED steps (via
+     * {@link runnableShapeOf}) so the guard validates exactly what re-executes — a pipeline
+     * edited out of band since the run started can't falsely refuse (or silently skip a check
+     * for) a step that isn't actually being re-driven.
+     *
+     * The concurrency (task-limit) and dependency gates are deliberately NOT here — they are
+     * start-only (a retry replaces the failed run rather than adding a new concurrent one, and a
+     * re-drive of an already-started task isn't re-gated on its dependencies).
+     */
+    async assertRunnable(workspaceId, block, shape, initiatedBy) {
+        // Reject a structurally-invalid chain (a misplaced companion or estimate-gating without a
+        // preceding task-estimator). The builder also rejects these at save, but a pipeline can
+        // become invalid out of band.
+        validatePipelineShape(shape);
+        // The Initiative Planning kinds run ONLY on an `initiative`-level block, and an
+        // initiative block accepts ONLY such a chain — bidirectional, and here in the shared
+        // guard so start/retry/restart can't drift on it.
+        assertInitiativeShapeAllowed(block, shape.agentKinds);
+        // A chain with visual steps (`tester-ui` / `visual-confirmation`) needs a UI to exercise:
+        // it can only run on a `frontend` frame or a frame a frontend links to — else a `tester-ui`
+        // step has no app to drive.
+        await this.assertPipelineFrameTypeAllowed(workspaceId, block, shape.agentKinds);
+        // A chain with a Tester needs the service's declared provisioning to be runnable
+        // (`infraless`/none = no infra; `docker-compose`/`kubernetes`/`custom` = a workspace handler).
+        if (shape.agentKinds.some(isTesterKind)) {
+            await this.assertTesterInfraConfigured(workspaceId, block, initiatedBy);
+        }
+        // A `docker-compose`/`kubernetes`/`custom` service whose enabled chain reaches an env-consumer
+        // (tester / human-test / playwright) with NO enabled `deployer` before it would dead-end inside
+        // the consumer — nothing provisions the environment it reads. Fail fast with an actionable error.
+        await this.assertDeployerBeforeConsumer(workspaceId, block, shape.agentKinds, shape.enabled);
+        // A chain that INCLUDES an enabled Deployer needs the service's provisioning config (the
+        // "what/where") AND the workspace's infra handler (the "how") complete + correct — and, best
+        // effort, the deployment integration's live connection working — so a misconfigured environment
+        // fails loudly here with a fix-it pointer instead of an async failed env (or a silent no-op).
+        await this.assertDeployerConfigured(workspaceId, block, shape.agentKinds, shape.enabled, initiatedBy);
+        // A chain carrying an agent that relies on binary-artifact storage (the UI Tester uploads
+        // screenshots) needs the account to have storage configured.
+        await this.assertBinaryStorageConfigured(workspaceId, shape.agentKinds);
+        // A workspace that delegates container agents to a runner pool needs that pool registered
+        // (local mode opt-in). No-op on Cloudflare/Node (fixed backend) and when delegation is off.
+        await this.assertAgentBackendConfigured?.(workspaceId);
+        // Every step's canonical model must have a usable provider — a container step needs any
+        // usable flavour, an INLINE step needs an inline-usable one (a subscription-only model can't
+        // run inline without an inline harness). This is the gate a retry used to skip.
+        await this.assertProvidersConfiguredForPipeline(workspaceId, block, shape.agentKinds, initiatedBy);
+        // Refuse a metered run once the spend budget is reached (a clear error rather than a silent
+        // mid-run pause). A local/subscription-only pipeline is exempt.
+        await this.assertBudgetAllowsPipeline(workspaceId, block, shape.agentKinds, initiatedBy);
+    }
+    /**
+     * The {@link PipelineShape} a retry/restart re-drives: the stored run's steps ARE the enabled,
+     * ordered chain that will run again, so {@link assertRunnable} validates exactly what
+     * re-executes rather than the current pipeline definition (which may have been edited out of
+     * band since the run started). Disabled steps were already filtered out at start, so every
+     * stored step is enabled.
+     */
+    runnableShapeOf(steps) {
+        return {
+            agentKinds: steps.map((s) => s.agentKind),
+            gating: steps.map((s) => s.gating ?? null),
+            // The QC companion's live step-state carries the same `gating` config the pipeline set, so
+            // the tester-QC gating validation re-runs on a retry against exactly what re-executes.
+            testerQuality: steps.map((s) => s.testerQuality ?? null),
+            // The per-step options bag (carrying a `skill` step's `skillId`) is copied onto the run
+            // step at start, so the skill-step validation re-runs on retry against what re-executes.
+            stepOptions: steps.map((s) => s.stepOptions ?? null),
+        };
+    }
+    /**
+     * Refuse a task start while any of its dependencies is unfinished. A task may only run
+     * once every block it `dependsOn` has reached `done` (its PR merged). No-ops for
+     * non-task blocks and for tasks with no dependencies. Throws a {@link ConflictError}
+     * (→ 409, shown as a toast) naming the unfinished blockers so the human knows why.
+     */
+    async assertDependenciesMet(workspaceId, block) {
+        if (block.level !== 'task' || block.dependsOn.length === 0)
+            return;
+        const blocks = await this.augmentWithCrossWorkspaceDeps(await this.blockRepository.listByWorkspace(workspaceId), block.dependsOn);
+        if (dependenciesMet(blocks, block.id))
+            return;
+        const blockers = unmetDependencies(blocks, block.id);
+        const names = blockers.map((b) => `"${b.title}"`).join(', ');
+        throw new ConflictError(`This task is blocked by ${blockers.length} unfinished dependenc${blockers.length === 1 ? 'y' : 'ies'}${names ? ` (${names})` : ''}. Finish them before starting this task.`, 'dependencies_unmet', { count: blockers.length, blockers: blockers.map((b) => b.title) });
+    }
+    /**
+     * Augment a workspace's block list (in place) with any dependency blocks referenced by
+     * `depIds` that aren't already present — a `dependsOn` edge can point at a task homed in a
+     * DIFFERENT workspace (a shared/mounted service). Resolved via the cross-workspace
+     * {@link BlockRepository.findByIds} (one batched query, not a point-read per id), so a
+     * shared-service blocker is evaluated by its real status instead of being silently treated
+     * as satisfied (missing ⇒ done). Returns the same (now-augmented) array for chaining.
+     */
+    async augmentWithCrossWorkspaceDeps(blocks, depIds) {
+        const have = new Set(blocks.map((b) => b.id));
+        const missing = [...new Set(depIds)].filter((id) => !have.has(id));
+        if (missing.length === 0)
+            return blocks;
+        for (const found of await this.blockRepository.findByIds(missing)) {
+            blocks.push(found.block);
+        }
+        return blocks;
+    }
+    /**
+     * Enforce the workspace's per-service running-task limit before a task run starts.
+     * No-ops unless the settings module is wired, the block is a task, and a limit mode
+     * is active. Counts the tasks under the same service frame that already have a live
+     * run (running / blocked / paused) — bucketed by task type when the mode is
+     * `per_type`, else shared across all types — and throws a {@link ConflictError} (→ 409,
+     * shown as a toast) when the cap is reached. The starting block is excluded from the
+     * count (its prior run is about to be replaced).
+     */
+    async assertWithinTaskLimit(workspaceId, block) {
+        const settingsService = this.workspaceSettingsService;
+        if (!settingsService || block.level !== 'task')
+            return;
+        const settings = await settingsService.get(workspaceId);
+        if (settings.taskLimitMode === 'off')
+            return;
+        const all = await this.blockRepository.listByWorkspace(workspaceId);
+        const byId = new Map(all.map((b) => [b.id, b]));
+        // Walk up to the owning service frame.
+        let frame = block;
+        let guard = 0;
+        while (frame && frame.level !== 'frame' && guard++ < 1000) {
+            frame = frame.parentId ? byId.get(frame.parentId) : undefined;
+        }
+        if (!frame || frame.level !== 'frame')
+            return; // orphan task — nothing to scope a service limit to
+        const frameId = frame.id;
+        const underFrame = (b) => {
+            let cur = b;
+            let hops = 0;
+            while (cur && hops++ < 1000) {
+                if (cur.id === frameId)
+                    return true;
+                cur = cur.parentId ? byId.get(cur.parentId) : undefined;
+            }
+            return false;
+        };
+        // Lean projection of the workspace's live runs (block + status only) — avoids loading and
+        // JSON-decoding every historical run's `detail` just to read the handful of live block ids.
+        const live = await this.executionRepository.listLive(workspaceId);
+        const liveBlockIds = new Set(live.map((e) => e.blockId));
+        const siblingTasks = all.filter((b) => b.level === 'task' && b.id !== block.id && underFrame(b));
+        if (settings.taskLimitMode === 'shared') {
+            const limit = settings.taskLimitShared ?? 0;
+            const running = siblingTasks.filter((b) => liveBlockIds.has(b.id)).length;
+            if (running >= limit) {
+                throw new ConflictError(`"${frame.title}" is already running ${running} of ${limit} allowed task(s). ` +
+                    `Wait for one to finish before starting another.`, 'task_limit_reached', { frame: frame.title, limit, running });
+            }
+            return;
+        }
+        // per_type: only the configured types are capped; an unconfigured type is unbounded.
+        const type = block.taskType ?? 'feature';
+        const perType = (settings.taskLimitPerType ?? {});
+        const limit = perType[type];
+        if (limit == null)
+            return;
+        const running = siblingTasks.filter((b) => liveBlockIds.has(b.id) && (b.taskType ?? 'feature') === type).length;
+        if (running >= limit) {
+            throw new ConflictError(`"${frame.title}" is already running ${running} of ${limit} allowed ${type} task(s). ` +
+                `Wait for one to finish before starting another ${type} task.`, 'task_limit_reached', { frame: frame.title, limit, running, taskType: type });
+        }
+    }
+    /**
+     * Whether a model id will incur metered monetary cost for THIS workspace. Non-metered:
+     * a subscription model whose vendor is connected ("subscriptions always win"), or a
+     * local-runner model (keyless, on the user's own endpoint). Everything else — including
+     * env-default routing (an absent id) and Cloudflare Workers AI — is treated as metered.
+     * Shared with {@link RunDispatcher.currentStepIsNonMetered} so the up-front budget gate
+     * and the mid-run spend gate can't classify a model differently.
+     */
+    modelIdIsMetered(id, caps) {
+        const sub = subscriptionOptionFor(id);
+        if (sub && caps.subscriptionVendors.has(sub.vendor))
+            return false;
+        const ref = resolveModelRef(id, caps);
+        if (!ref)
+            return true;
+        if (ref.harness === 'claude-code' || ref.harness === 'codex')
+            return false;
+        return !isLocalRunner(ref.provider);
+    }
+    /**
+     * Guard a run start when the pipeline carries a VISUAL step (`tester-ui` /
+     * `visual-confirmation`): such a step exercises a rendered UI, so it only makes sense where
+     * there is a UI to drive — a `type: 'frontend'` frame (it owns the app under test) or a frame
+     * a `frontend` frame links to (the linked frontend is the UI a change to that service is
+     * validated through). On any other frame (a service with no linked frontend, a `library` /
+     * `document` repo) a `tester-ui` step would have nothing to drive, so refuse the start with an
+     * actionable {@link ConflictError} (`visual_pipeline_no_frontend`). The frontend surfaces the
+     * SAME rule (via the shared `frameAllowsVisualPipeline`) so it only offers these pipelines
+     * where they can run; this is the server-side guarantee. A non-visual pipeline passes through.
+     * The workspace block list is read ONCE (for the frontend→service links), never per-frame.
+     */
+    async assertPipelineFrameTypeAllowed(workspaceId, block, agentKinds) {
+        if (!pipelineHasVisualStep({ agentKinds: [...agentKinds] }))
+            return;
+        const frame = await this.contextBuilder.resolveServiceFrame(workspaceId, block.id);
+        // A `frontend` frame is always allowed without listing the workspace; only a non-frontend
+        // frame needs the link scan, so defer the (single) block-list read until then.
+        if (frame?.type === 'frontend')
+            return;
+        const blocks = await this.blockRepository.listByWorkspace(workspaceId);
+        if (frameAllowsVisualPipeline(frame, blocks))
+            return;
+        throw new ConflictError('This pipeline includes a UI-testing step, so it can only run on a frontend service (or a ' +
+            'backend service that has a frontend linked to it). Move the task under a frontend, link ' +
+            'a frontend to this service, or pick a pipeline without UI-testing steps.', 'visual_pipeline_no_frontend', { frameType: frame?.type ?? null });
+    }
+    /**
+     * Guard a Tester pipeline's start on the service frame's declared provisioning being runnable.
+     * The Tester needs SOME way to stand its system up: `infraless` (or none declared) runs with no
+     * infra; `docker-compose`/`kubernetes`/`custom` are all provisioned by the single Deployer step
+     * through a workspace handler, so one must resolve for the service's type. A `frontend` frame is
+     * gated instead on having a live service under test. Throws an actionable {@link ConflictError}
+     * (`tester_infra_unsupported` for the frontend case, `provision_type_unhandled` for a missing
+     * handler); passes through when the provisioning seam is unwired (tests / no environment
+     * integration), like the other optional start guards. `initiatedBy` is threaded into
+     * `canProvision` so the run initiator's local per-user handler OVERRIDES resolve exactly as they
+     * do at provision time (and as the Deployer-config gate does) — else a valid override-only local
+     * setup would be falsely refused here while the deployer would actually provision it.
+     */
+    async assertTesterInfraConfigured(workspaceId, block, initiatedBy) {
+        // A `frontend` frame (the self-contained UI-test flow) is gated on having a live service
+        // under test, NOT on a provision type — resolved first and short-circuiting the backend
+        // branch. Only enforce it when the environment seam is wired (else, like the other optional
+        // start guards, pass through so tests / no-env deployments run unchanged).
+        const frontend = await this.contextBuilder.resolveFrontendConfig(workspaceId, block);
+        if (frontend) {
+            if (!this.environmentProvisioning)
+                return;
+            const decision = decideTesterInfra({
+                frontend: {
+                    hasServiceBindings: hasServiceBinding(frontend.config),
+                    hasLiveService: hasLiveServiceBinding(frontend.bindings),
+                },
+                provisionType: undefined,
+                handlerResolves: true,
+            });
+            if (decision.ok)
+                return;
+            throw new ConflictError(TESTER_INFRA_MESSAGES[decision.reason], 'tester_infra_unsupported', {
+                infraReason: decision.reason,
+            });
+        }
+        const service = await this.contextBuilder.resolveServiceConfig(workspaceId, block);
+        // A `library` frame (not `liveTestable`) runs its unit/integration suite IN-CONTAINER — any
+        // repo-local docker-compose is test infra stood up on localhost, never a Deployer-provisioned
+        // env — so the tester never needs a workspace handler. Pass through regardless of provisioning.
+        if (service?.type && !frameProfile(service.type).liveTestable)
+            return;
+        const provisioning = service?.provisioning;
+        // `docker-compose`/`kubernetes`/`custom` are all provisioned by the Deployer via a workspace
+        // handler, so resolve it lazily — and only when the provisioning seam is wired (else pass
+        // through, treating it as resolvable). `infraless`/none needs no handler.
+        const needsHandler = provisioning?.type === 'docker-compose' ||
+            provisioning?.type === 'kubernetes' ||
+            provisioning?.type === 'custom';
+        const handlerResolves = needsHandler && this.environmentProvisioning
+            ? (await this.environmentProvisioning.canProvision(workspaceId, provisioning, initiatedBy))
+                .ok
+            : true;
+        const decision = decideTesterInfra({ provisionType: provisioning?.type, handlerResolves });
+        if (decision.ok)
+            return;
+        // The only backend-branch refusal is a provision type with no resolvable handler.
+        throw new ConflictError(TESTER_INFRA_MESSAGES[decision.reason], 'provision_type_unhandled', {
+            provisionType: provisioning.type,
+        });
+    }
+    /**
+     * Fail fast when a `docker-compose`/`kubernetes`/`custom` service's chain would dead-end at an
+     * env-consumer (tester / human-test / playwright) because no enabled `deployer` provisions the
+     * environment before it — the exact silent dead-end this initiative fixes (the tester picks
+     * ephemeral mode from the provision type but finds no coordinates). The pure ordering check lives
+     * in {@link needsDeployerBeforeConsumer}; here we resolve the service's provision type (only when a
+     * consumer is present, so consumer-less chains skip the read) and translate a positive verdict
+     * into an actionable {@link ConflictError}. Pass-through for infraless/frontend services and for
+     * chains with a deployer before the first consumer.
+     */
+    async assertDeployerBeforeConsumer(workspaceId, block, agentKinds, enabled) {
+        const hasConsumer = agentKinds.some((kind, i) => enabled?.[i] !== false && ENV_CONSUMER_KINDS.includes(kind));
+        if (!hasConsumer)
+            return;
+        const service = await this.contextBuilder.resolveServiceConfig(workspaceId, block);
+        // A `library` frame stands nothing up via the Deployer (its tester runs the suite in-container),
+        // so a missing Deployer before the tester is never a dead-end — pass through like `infraless`.
+        if (service?.type && !frameProfile(service.type).deployable)
+            return;
+        if (!needsDeployerBeforeConsumer(agentKinds, enabled, service?.provisioning?.type))
+            return;
+        throw new ConflictError(`This service provisions a '${service.provisioning.type}' environment, but this pipeline ` +
+            'has no Deployer step before its first Tester / human-test step, so the environment would ' +
+            'never be stood up. Reseed this pipeline to the latest built-in (which includes a Deployer) ' +
+            'and start a new run, or set the service to docker-compose / infraless.', 'deployer_required_before_tester', { provisionType: service.provisioning.type });
+    }
+    /**
+     * Guard a pipeline that INCLUDES an enabled `deployer` step on its ephemeral-environment config
+     * being FULL + CORRECT on BOTH sides of the "what/where ÷ how" split, so a misconfigured
+     * environment fails LOUDLY at start with a fixable pointer instead of mid-run: a `kubernetes` /
+     * `custom` service silently failing its async provision, or a `docker-compose` one whose deployer
+     * NO-OPS because no handler resolves (the exact silent dead-ends this initiative closes). It
+     * checks, in order of the fix a human would make:
+     *   1. the SERVICE's provisioning config is complete for its declared type (manifest source /
+     *      compose path / custom-manifest id) — else `deployer_service_provisioning_incomplete`;
+     *   2. a WORKSPACE handler resolves for the type — else `provision_type_unhandled` (the same
+     *      reason the Tester gate raises; a MISSING/ambiguous handler, not a broken one);
+     *   3. (bonus, best-effort) the resolved deployment integration's live connection PROBES green —
+     *      else `deployer_connection_test_failed`, carrying the provider's failure detail.
+     * Each `ConflictError` carries a machine-readable reason + details the SPA deep-links off to the
+     * exact fix surface. Pass-through for `infraless`/undeclared services (the deployer stands nothing
+     * up) and when the environment seam is unwired (tests / no-env deployments), like the other
+     * optional start guards.
+     */
+    async assertDeployerConfigured(workspaceId, block, agentKinds, enabled, initiatedBy) {
+        if (!this.environmentProvisioning)
+            return;
+        if (!hasEnabledDeployerStep(agentKinds, enabled))
+            return;
+        const service = await this.contextBuilder.resolveServiceConfig(workspaceId, block);
+        // A Deployer on a `library` frame (not `deployable`) is a safe no-op regardless of any declared
+        // provisioning — the runtime deploy loop records a library skip — so there is nothing to
+        // validate. Checked BEFORE the provisioning branch, since a library may declare a compose path
+        // as repo-local TEST infra (not a deployable env).
+        if (service?.type && !frameProfile(service.type).deployable)
+            return;
+        const provisioning = service?.provisioning;
+        // A Deployer on an `infraless`/undeclared service is a safe no-op (nothing to provision), so
+        // there is nothing to validate — matching the deployer's own skip in advanceDeployerFrames.
+        if (!provisioning || provisioning.type === 'infraless')
+            return;
+        const type = provisioning.type;
+        const serviceIssues = deployerServiceConfigIssues(provisioning);
+        // `canProvision` is a single batched handler read (no decrypt / no N+1); safe to run eagerly.
+        // Pass the initiator so a local per-user handler override resolves exactly as provisioning does
+        // (else a valid override-only local setup would be falsely reported as unhandled).
+        const handlerResolution = await this.environmentProvisioning.canProvision(workspaceId, provisioning, initiatedBy);
+        // Only probe the LIVE connection when the structural config is sound — a network probe is
+        // wasted (and its verdict misleading) while the service config is incomplete or no handler
+        // resolves. A probe FAULT (transient network / provider-build hiccup) is not a definitive
+        // "connection broken" verdict, so swallow it and let the async provision surface a real fault
+        // rather than blocking the start on a flake.
+        let connectionTest;
+        if (serviceIssues.length === 0 && handlerResolution.ok) {
+            try {
+                connectionTest =
+                    (await this.environmentProvisioning.testProvisioning(workspaceId, provisioning, initiatedBy)) ?? undefined;
+            }
+            catch {
+                connectionTest = undefined;
+            }
+        }
+        const decision = decideDeployerConfig({
+            provisionType: type,
+            serviceIssues,
+            handlerResolution,
+            ...(connectionTest ? { connectionTest } : {}),
+        });
+        if (decision.ok)
+            return;
+        if (decision.reason === 'service-config-incomplete') {
+            // Deep-link target: the service FRAME's environment config (the inspector / compose wizard).
+            const frameId = block.level === 'frame'
+                ? block.id
+                : ((await this.contextBuilder.resolveServiceFrameId(workspaceId, block.id)) ?? undefined);
+            throw new ConflictError(`This service provisions a '${type}' environment via the Deployer, but its environment ` +
+                `configuration is incomplete (missing: ${decision.missing.join(', ')}). Complete the ` +
+                "service's environment configuration before starting.", 'deployer_service_provisioning_incomplete', { provisionType: type, missing: [...decision.missing], ...(frameId ? { frameId } : {}) });
+        }
+        if (decision.reason === 'workspace-unhandled') {
+            throw new ConflictError(`This service provisions a '${type}' environment via the Deployer, but this workspace has ` +
+                (decision.handlerReason === 'type-mismatch'
+                    ? `more than one handler matching it — pin a manifest id to disambiguate, `
+                    : `no infrastructure handler configured for that type — `) +
+                'configure a handler (Infrastructure → Test environments), or set the service to ' +
+                'infraless, before starting.', 'provision_type_unhandled', { provisionType: type });
+        }
+        // decision.reason === 'connection-failed'
+        throw new ConflictError(`The '${type}' deployment integration for this service isn't working: ` +
+            `${decision.message ?? 'the connection test failed'}. Check the handler's endpoint and ` +
+            'credentials (Infrastructure → Test environments) and re-test the connection, then start ' +
+            'again.', 'deployer_connection_test_failed', { provisionType: type, ...(decision.message ? { detail: decision.message } : {}) });
+    }
+    /**
+     * Guard a pipeline's start when it carries an agent kind that RELIES on binary-artifact
+     * storage (the {@link BINARY_STORAGE_TRAIT}, e.g. the UI Tester, which uploads its
+     * screenshots there). Such a run would otherwise dispatch and then fail/degrade with no
+     * place to store its artifacts, so refuse it up-front with a clear, actionable
+     * `binary_storage_unconfigured` conflict the SPA turns into a "configure storage" prompt.
+     * The check is trait-driven so it stays universal: a future artifact-producing kind just
+     * carries the trait. Pass-through when no store resolver is wired (tests/conformance with
+     * no storage) — matching the other optional start guards.
+     */
+    async assertBinaryStorageConfigured(workspaceId, agentKinds) {
+        if (!agentKinds.some((kind) => hasTrait(kind, BINARY_STORAGE_TRAIT, this.agentKindRegistry)))
+            return;
+        const resolve = this.resolveBinaryArtifactStore;
+        if (!resolve)
+            return;
+        const store = await resolve(workspaceId);
+        if (store)
+            return;
+        throw new ConflictError('This pipeline includes an agent that needs binary storage (e.g. the UI Tester, which uploads its screenshots), but this account has no content storage configured. Configure content storage to run it.', 'binary_storage_unconfigured');
+    }
+    /**
+     * Guard a pipeline's start on having a usable provider for every step's canonical
+     * model. The model a step runs is resolved by the same precedence the dispatch path
+     * uses (block pin → workspace per-kind default); each canonical id must have a usable
+     * provider given what's configured — a direct API key for its provider, a connected
+     * subscription vendor, or the opt-in Cloudflare lib enabled. Env-routing defaults (the
+     * last fallback, with no catalog id) are operator-level and not gated, matching the
+     * personal-credential gate. A throw aborts the start cleanly before any side effects.
+     * Skipped when no capability resolver is wired (tests / unconfigured facades).
+     */
+    async assertProvidersConfiguredForPipeline(workspaceId, block, agentKinds, initiatedBy) {
+        if (!this.resolveProviderCapabilities)
+            return;
+        const caps = await this.resolveProviderCapabilities(workspaceId, initiatedBy);
+        const runsInline = this.inlineHarnessRef;
+        // Two failure buckets, so the error can steer the fix precisely:
+        //  - `unconfigured`: no usable provider AT ALL (container or inline) — add a key/sub/CF.
+        //  - `inlineUnsatisfiable`: usable for a container step but NOT for an INLINE step — a
+        //    subscription-only model an inline `generateText` call can't drive (and this
+        //    deployment can't run the harness inline). The remedy is different (pin an
+        //    inline-capable model, or a preset whose inline steps resolve to one), so a subscription
+        //    model that satisfies the container steps but strands the reviewer/brainstorm/estimator
+        //    is refused up front instead of failing mid-run against an ungated env default.
+        //  - `policyBlocked`: the account-wide model-family policy blocks the model on its
+        //    effective route — a distinct, more actionable reason than "unconfigured", so it is
+        //    checked FIRST and short-circuits the other buckets for that id.
+        const unconfigured = new Set();
+        const inlineUnsatisfiable = new Set();
+        const policyBlocked = new Set();
+        const check = (id, inline) => {
+            if (!id)
+                return;
+            if (caps.modelPolicy &&
+                !isAllowedByFamilyPolicy(id, resolveModelRef(id, caps)?.provider, caps.modelPolicy)) {
+                policyBlocked.add(id);
+                return;
+            }
+            if (!isModelUsable(id, caps))
+                unconfigured.add(id);
+            else if (inline && !isModelUsableInline(id, caps, runsInline))
+                inlineUnsatisfiable.add(id);
+        };
+        if (block.modelId) {
+            // A block-level pin applies to every step; it must satisfy an inline step too when the
+            // pipeline has one.
+            check(block.modelId, agentKinds.some((kind) => isInlineModelStep(kind, this.agentKindRegistry)));
+        }
+        else if (this.resolveWorkspaceModelDefault) {
+            // Independent per-kind resolutions on the start path — run them concurrently.
+            const ids = await Promise.all(agentKinds.map((kind) => this.resolveWorkspaceModelDefault(workspaceId, kind, block.modelPresetId)));
+            agentKinds.forEach((kind, i) => check(ids[i], isInlineModelStep(kind, this.agentKindRegistry)));
+        }
+        if (policyBlocked.size > 0) {
+            throw new ConflictError(`This pipeline uses models blocked by the account's model-family policy: ` +
+                `${[...policyBlocked].join(', ')}. Pick a model from an allowed family (or a ` +
+                'residency-guaranteed route), or ask an account admin to adjust the policy.', 'model_policy_blocked', { models: [...policyBlocked] });
+        }
+        if (unconfigured.size > 0) {
+            throw new ConflictError(`This pipeline uses models with no configured provider: ${[...unconfigured].join(', ')}. ` +
+                'Add an API key for the provider, connect a subscription, or enable Cloudflare AI ' +
+                'before starting.', 'providers_unconfigured', { models: [...unconfigured] });
+        }
+        if (inlineUnsatisfiable.size > 0) {
+            throw new ConflictError(`This pipeline has inline steps (e.g. the requirements reviewer) whose model ` +
+                `cannot run inline: ${[...inlineUnsatisfiable].join(', ')}. A subscription-only model ` +
+                '(Claude / GPT / GLM) runs only in the container agents, not the inline reviewers — ' +
+                'and this deployment has no inline harness. Pick a model preset whose inline steps ' +
+                'resolve to a provider-backed model (a direct API key, OpenRouter, or Cloudflare AI), ' +
+                'or run local mode with the ambient Claude Code / Codex CLI enabled.', 'preset_unsatisfiable', { models: [...inlineUnsatisfiable] });
+        }
+    }
+    /**
+     * Refuse to START / RETRY a run when the workspace has reached its spend budget AND the
+     * pipeline has at least one budget-METERED step. A `0` (or exhausted) budget is a
+     * deliberate "no paid spend" setting, but it must surface as a clear, up-front error here
+     * rather than a silent mid-run pause. Steps that incur no metered cost — a connected
+     * subscription model, or a keyless local-runner model — are exempt, so a workspace that
+     * runs ONLY local/subscription models starts normally even at a `0` budget. Best-effort:
+     * with no capability resolver wired (tests/unconfigured) it is skipped and the mid-run
+     * gate still guards. Before any side effects, matching the other start guards.
+     */
+    async assertBudgetAllowsPipeline(workspaceId, block, agentKinds, initiatedBy) {
+        const accountId = await this.workspaceRepository.accountOf(workspaceId);
+        if (!(await this.spend.isOverBudget(workspaceId, { accountId, userId: initiatedBy })))
+            return;
+        if (!this.resolveProviderCapabilities)
+            return;
+        const caps = await this.resolveProviderCapabilities(workspaceId, initiatedBy);
+        const ids = [];
+        if (block.modelId) {
+            ids.push(block.modelId);
+        }
+        else if (this.resolveWorkspaceModelDefault) {
+            ids.push(...(await Promise.all(agentKinds.map((kind) => this.resolveWorkspaceModelDefault(workspaceId, kind, block.modelPresetId)))));
+        }
+        else {
+            ids.push(undefined);
+        }
+        if (!ids.some((id) => this.modelIdIsMetered(id, caps)))
+            return;
+        throw new ConflictError('This run has reached a spend budget (workspace, account, or user). New runs on metered ' +
+            'models are paused until the budget is raised or the billing period resets. A task pinned ' +
+            'to a local model or a connected subscription still runs.');
+    }
+}
+//# sourceMappingURL=RunAdmission.js.map

package/dist/modules/execution/RunAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunAdmission.js","sourceRoot":"","sources":["../../../src/modules/execution/RunAdmission.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,aAAa,EAEb,uBAAuB,EACvB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,aAAa,EACb,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAIvF,OAAO,EAAE,qBAAqB,EAAsB,MAAM,+BAA+B,CAAA;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AACpF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AA8B5E;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACN,mBAAmB,CAAqB;IACxC,eAAe,CAAiB;IAChC,mBAAmB,CAAqB;IACxC,cAAc,CAAqB;IACnC,iBAAiB,CAAmB;IACpC,KAAK,CAAc;IACnB,uBAAuB,CAAiC;IACxD,wBAAwB,CAA2B;IACnD,0BAA0B,CAA6B;IACvD,2BAA2B,CAGV;IACjB,gBAAgB,CAA6B;IAC7C,4BAA4B,CAIb;IACf,4BAA4B,CAAyC;IAEtF,YAAY,IAAsB;QAChC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAA;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,uBAAuB,CAAA;QAC3D,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,wBAAwB,CAAA;QAC7D,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,CAAA;QACjE,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,CAAA;QACnE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,4BAA4B,GAAG,IAAI,CAAC,4BAA4B,CAAA;QACrE,IAAI,CAAC,4BAA4B,GAAG,IAAI,CAAC,4BAA4B,CAAA;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,KAAY,EACZ,KAAoB,EACpB,WAAsC;QAEtC,0FAA0F;QAC1F,wFAAwF;QACxF,8BAA8B;QAC9B,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAE5B,gFAAgF;QAChF,qFAAqF;QACrF,kDAAkD;QAClD,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;QAErD,0FAA0F;QAC1F,4FAA4F;QAC5F,4BAA4B;QAC5B,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;QAE/E,iFAAiF;QACjF,+FAA+F;QAC/F,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;QACzE,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAE5F,yFAAyF;QACzF,6FAA6F;QAC7F,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,IAAI,CAAC,wBAAwB,CACjC,WAAW,EACX,KAAK,EACL,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,OAAO,EACb,WAAW,CACZ,CAAA;QAED,0FAA0F;QAC1F,6DAA6D;QAC7D,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;QAEvE,0FAA0F;QAC1F,4FAA4F;QAC5F,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC,WAAW,CAAC,CAAA;QAEtD,wFAAwF;QACxF,6FAA6F;QAC7F,gFAAgF;QAChF,MAAM,IAAI,CAAC,oCAAoC,CAC7C,WAAW,EACX,KAAK,EACL,KAAK,CAAC,UAAU,EAChB,WAAW,CACZ,CAAA;QAED,4FAA4F;QAC5F,gEAAgE;QAChE,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC1F,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAA8B;QAC5C,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAC1C,2FAA2F;YAC3F,uFAAuF;YACvF,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;YACxD,wFAAwF;YACxF,yFAAyF;YACzF,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC;SACrD,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,KAAY;QAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CACrD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,WAAW,CAAC,EACvD,KAAK,CAAC,SAAS,CAChB,CAAA;QACD,IAAI,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAAE,OAAM;QAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5D,MAAM,IAAI,aAAa,CACrB,2BAA2B,QAAQ,CAAC,MAAM,wBACxC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAChC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,0CAA0C,EACvE,oBAAoB,EACpB,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CACnE,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAAe,EAAE,MAAgB;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1B,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,KAAY;QAC3D,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,CAAA;QACrD,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;YAAE,OAAM;QACtD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACvD,IAAI,QAAQ,CAAC,aAAa,KAAK,KAAK;YAAE,OAAM;QAE5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,uCAAuC;QACvC,IAAI,KAAK,GAAsB,KAAK,CAAA;QACpC,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;YAC1D,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;YAAE,OAAM,CAAC,oDAAoD;QAClG,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAA;QAExB,MAAM,UAAU,GAAG,CAAC,CAAQ,EAAW,EAAE;YACvC,IAAI,GAAG,GAAsB,CAAC,CAAA;YAC9B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,OAAO,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO;oBAAE,OAAO,IAAI,CAAA;gBACnC,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACzD,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QAED,0FAA0F;QAC1F,4FAA4F;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;QAEhG,IAAI,QAAQ,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAA;YAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;YACzE,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,aAAa,CACrB,IAAI,KAAK,CAAC,KAAK,wBAAwB,OAAO,OAAO,KAAK,oBAAoB;oBAC5E,iDAAiD,EACnD,oBAAoB,EACpB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CACvC,CAAA;YACH,CAAC;YACD,OAAM;QACR,CAAC;QAED,qFAAqF;QACrF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAA;QACxC,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAA2B,CAAA;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,KAAK,IAAI,IAAI;YAAE,OAAM;QACzB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,IAAI,CACpE,CAAC,MAAM,CAAA;QACR,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CACrB,IAAI,KAAK,CAAC,KAAK,wBAAwB,OAAO,OAAO,KAAK,YAAY,IAAI,YAAY;gBACpF,kDAAkD,IAAI,QAAQ,EAChE,oBAAoB,EACpB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CACvD,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAsB,EAAE,IAA0B;QACjE,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAA;QACrC,IAAI,GAAG,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QACjE,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,GAAG,CAAC,OAAO,KAAK,aAAa,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1E,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,8BAA8B,CAC1C,WAAmB,EACnB,KAAY,EACZ,UAA6B;QAE7B,IAAI,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;YAAE,OAAM;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QAClF,0FAA0F;QAC1F,+EAA+E;QAC/E,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU;YAAE,OAAM;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QACtE,IAAI,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAM;QACpD,MAAM,IAAI,aAAa,CACrB,2FAA2F;YACzF,0FAA0F;YAC1F,0EAA0E,EAC5E,6BAA6B,EAC7B,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,CACnC,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,2BAA2B,CACvC,WAAmB,EACnB,KAAY,EACZ,WAAsC;QAEtC,yFAAyF;QACzF,wFAAwF;QACxF,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACpF,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,uBAAuB;gBAAE,OAAM;YACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;gBACjC,QAAQ,EAAE;oBACR,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACtD,cAAc,EAAE,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBACzD;gBACD,aAAa,EAAE,SAAS;gBACxB,eAAe,EAAE,IAAI;aACtB,CAAC,CAAA;YACF,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAM;YACvB,MAAM,IAAI,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE;gBAC1F,WAAW,EAAE,QAAQ,CAAC,MAAM;aAC7B,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAClF,4FAA4F;QAC5F,8FAA8F;QAC9F,gGAAgG;QAChG,IAAI,OAAO,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY;YAAE,OAAM;QACrE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,CAAA;QAC1C,6FAA6F;QAC7F,0FAA0F;QAC1F,0EAA0E;QAC1E,MAAM,YAAY,GAChB,YAAY,EAAE,IAAI,KAAK,gBAAgB;YACvC,YAAY,EAAE,IAAI,KAAK,YAAY;YACnC,YAAY,EAAE,IAAI,KAAK,QAAQ,CAAA;QACjC,MAAM,eAAe,GACnB,YAAY,IAAI,IAAI,CAAC,uBAAuB;YAC1C,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;iBACtF,EAAE;YACP,CAAC,CAAC,IAAI,CAAA;QACV,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;QAC1F,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAM;QACvB,kFAAkF;QAClF,MAAM,IAAI,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE;YAC1F,aAAa,EAAE,YAAa,CAAC,IAAI;SAClC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,4BAA4B,CACxC,WAAmB,EACnB,KAAY,EACZ,UAA6B,EAC7B,OAAuC;QAEvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CACzE,CAAA;QACD,IAAI,CAAC,WAAW;YAAE,OAAM;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAClF,iGAAiG;QACjG,+FAA+F;QAC/F,IAAI,OAAO,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU;YAAE,OAAM;QACnE,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC;YAAE,OAAM;QAC1F,MAAM,IAAI,aAAa,CACrB,8BAA8B,OAAQ,CAAC,YAAa,CAAC,IAAI,mCAAmC;YAC1F,2FAA2F;YAC3F,6FAA6F;YAC7F,wEAAwE,EAC1E,iCAAiC,EACjC,EAAE,aAAa,EAAE,OAAQ,CAAC,YAAa,CAAC,IAAI,EAAE,CAC/C,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,wBAAwB,CACpC,WAAmB,EACnB,KAAY,EACZ,UAA6B,EAC7B,OAAuC,EACvC,WAAsC;QAEtC,IAAI,CAAC,IAAI,CAAC,uBAAuB;YAAE,OAAM;QACzC,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC;YAAE,OAAM;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAClF,gGAAgG;QAChG,yFAAyF;QACzF,+FAA+F;QAC/F,mDAAmD;QACnD,IAAI,OAAO,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU;YAAE,OAAM;QACnE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,CAAA;QAC1C,6FAA6F;QAC7F,4FAA4F;QAC5F,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,WAAW;YAAE,OAAM;QAC9D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAA;QAE9B,MAAM,aAAa,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAA;QAC/D,8FAA8F;QAC9F,gGAAgG;QAChG,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,CACvE,WAAW,EACX,YAAY,EACZ,WAAW,CACZ,CAAA;QACD,0FAA0F;QAC1F,2FAA2F;QAC3F,0FAA0F;QAC1F,8FAA8F;QAC9F,6CAA6C;QAC7C,IAAI,cAAgD,CAAA;QACpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,cAAc;oBACZ,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAClD,WAAW,EACX,YAAY,EACZ,WAAW,CACZ,CAAC,IAAI,SAAS,CAAA;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,SAAS,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,aAAa,EAAE,IAAI;YACnB,aAAa;YACb,iBAAiB;YACjB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAM;QAEvB,IAAI,QAAQ,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;YACpD,6FAA6F;YAC7F,MAAM,OAAO,GACX,KAAK,CAAC,KAAK,KAAK,OAAO;gBACrB,CAAC,CAAC,KAAK,CAAC,EAAE;gBACV,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,CAAA;YAC7F,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,sDAAsD;gBACtF,yCAAyC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBACtF,sDAAsD,EACxD,0CAA0C,EAC1C,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACzF,CAAA;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YAC9C,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,yDAAyD;gBACzF,CAAC,QAAQ,CAAC,aAAa,KAAK,eAAe;oBACzC,CAAC,CAAC,yEAAyE;oBAC3E,CAAC,CAAC,uDAAuD,CAAC;gBAC5D,kFAAkF;gBAClF,6BAA6B,EAC/B,0BAA0B,EAC1B,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CAAA;QACH,CAAC;QACD,0CAA0C;QAC1C,MAAM,IAAI,aAAa,CACrB,QAAQ,IAAI,2DAA2D;YACrE,GAAG,QAAQ,CAAC,OAAO,IAAI,4BAA4B,qCAAqC;YACxF,0FAA0F;YAC1F,QAAQ,EACV,iCAAiC,EACjC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACnF,CAAA;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,6BAA6B,CACzC,WAAmB,EACnB,UAA6B;QAE7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC1F,OAAM;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,0BAA0B,CAAA;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAA;QACxC,IAAI,KAAK;YAAE,OAAM;QACjB,MAAM,IAAI,aAAa,CACrB,yMAAyM,EACzM,6BAA6B,CAC9B,CAAA;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,oCAAoC,CAChD,WAAmB,EACnB,KAAY,EACZ,UAA6B,EAC7B,WAAsC;QAEtC,IAAI,CAAC,IAAI,CAAC,2BAA2B;YAAE,OAAM;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACxC,iEAAiE;QACjE,yFAAyF;QACzF,uFAAuF;QACvF,iFAAiF;QACjF,+EAA+E;QAC/E,6FAA6F;QAC7F,4FAA4F;QAC5F,oFAAoF;QACpF,mFAAmF;QACnF,wFAAwF;QACxF,qEAAqE;QACrE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;QACtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAA;QAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,MAAM,KAAK,GAAG,CAAC,EAAsB,EAAE,MAAe,EAAQ,EAAE;YAC9D,IAAI,CAAC,EAAE;gBAAE,OAAM;YACf,IACE,IAAI,CAAC,WAAW;gBAChB,CAAC,uBAAuB,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EACnF,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACrB,OAAM;YACR,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;iBAC7C,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC;gBAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5F,CAAC,CAAA;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,uFAAuF;YACvF,oBAAoB;YACpB,KAAK,CACH,KAAK,CAAC,OAAO,EACb,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAC3E,CAAA;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC7C,8EAA8E;YAC9E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,4BAA6B,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAC3E,CACF,CAAA;YACD,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAC7B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAC/D,CAAA;QACH,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,aAAa,CACrB,0EAA0E;gBACxE,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C;gBAC9E,4EAA4E,EAC9E,sBAAsB,EACtB,EAAE,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE,CAC/B,CAAA;QACH,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,aAAa,CACrB,0DAA0D,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACxF,mFAAmF;gBACnF,kBAAkB,EACpB,wBAAwB,EACxB,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAC9B,CAAA;QACH,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,aAAa,CACrB,8EAA8E;gBAC5E,sBAAsB,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;gBACvF,qFAAqF;gBACrF,oFAAoF;gBACpF,uFAAuF;gBACvF,qEAAqE,EACvE,sBAAsB,EACtB,EAAE,MAAM,EAAE,CAAC,GAAG,mBAAmB,CAAC,EAAE,CACrC,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,0BAA0B,CACtC,WAAmB,EACnB,KAAY,EACZ,UAA6B,EAC7B,WAAsC;QAEtC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAAE,OAAM;QAC7F,IAAI,CAAC,IAAI,CAAC,2BAA2B;YAAE,OAAM;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;QAC7E,MAAM,GAAG,GAA2B,EAAE,CAAA;QACtC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CACN,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACnB,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,4BAA6B,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAC3E,CACF,CAAC,CACH,CAAA;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAAE,OAAM;QAC9D,MAAM,IAAI,aAAa,CACrB,yFAAyF;YACvF,2FAA2F;YAC3F,0DAA0D,CAC7D,CAAA;IACH,CAAC;CACF"}