@deksden-com/cpa-kit 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# @deksden-com/cpa-kit
+
+## 0.1.5
+
+No changes in this release.
+
+## 0.1.4
+
+### Patch Changes
+
+- ede8760: Include generated package changelogs in npm distributions. Release versions and the exact core peer dependency are maintained together through Changesets.
+- Skip irrelevant archive entries without decompressing them, allow larger uploads, and show clear import progress and limit errors.

package/dist/contracts/index.d.ts

@@ -360,10 +360,10 @@ declare const acceptSchema: z.ZodObject<{
     apiVersion: z.ZodLiteral<1>;
     operationId: z.ZodString;
     state: z.ZodEnum<{
-        running: "running";
-        failed: "failed";
         queued: "queued";
+        running: "running";
         succeeded: "succeeded";
+        failed: "failed";
         cancelled: "cancelled";
         partially_applied: "partially_applied";
         recovery_required: "recovery_required";
@@ -390,10 +390,10 @@ declare const operationSchema: z.ZodObject<{
     }>;
     actorId: z.ZodString;
     state: z.ZodEnum<{
-        running: "running";
-        failed: "failed";
         queued: "queued";
+        running: "running";
         succeeded: "succeeded";
+        failed: "failed";
         cancelled: "cancelled";
         partially_applied: "partially_applied";
         recovery_required: "recovery_required";
@@ -504,8 +504,8 @@ declare const statusSchema: z.ZodObject<{
         }>;
         version: z.ZodNullable<z.ZodString>;
         state: z.ZodEnum<{
-            unknown: "unknown";
             running: "running";
+            unknown: "unknown";
             stopped: "stopped";
         }>;
     }, z.core.$strict>;
@@ -525,9 +525,9 @@ declare const statusSchema: z.ZodObject<{
             stale: "stale";
         }>;
         probeState: z.ZodEnum<{
+            failed: "failed";
             unknown: "unknown";
             passed: "passed";
-            failed: "failed";
         }>;
         checkedAt: z.ZodNullable<z.ZodISODateTime>;
     }, z.core.$strict>;

package/dist/server/index.js

@@ -320,7 +320,7 @@ import {
 import { join as join2 } from "path";
 import * as yauzl from "yauzl";
 var defaultLimits = {
-  uploadBytes: 10 * 1024 * 1024,
+  uploadBytes: 64 * 1024 * 1024,
   entries: 1e3,
   jsonBytes: 1024 * 1024,
   acceptedBytes: 50 * 1024 * 1024,
@@ -470,8 +470,8 @@ async function importFiles(files, limits = defaultLimits, duplicatePolicy = "col
                     "ARCHIVE_UNSAFE",
                     "Links, devices and encrypted entries are forbidden"
                   );
-                declared += entry.uncompressedSize;
-                if (declared > limits.expandedBytes || entry.uncompressedSize > Math.max(1, entry.compressedSize) * limits.ratio)
+                if (selected(path)) declared += entry.uncompressedSize;
+                if (declared > limits.expandedBytes || selected(path) && entry.uncompressedSize > Math.max(1, entry.compressedSize) * limits.ratio)
                   throw new CpaError(
                     "UPLOAD_LIMIT",
                     "Archive expansion exceeds limit"
@@ -480,6 +480,12 @@ async function importFiles(files, limits = defaultLimits, duplicatePolicy = "col
                   zip.readEntry();
                   return;
                 }
+                if (!selected(path)) {
+                  skipped++;
+                  reasons.ignored = (reasons.ignored ?? 0) + 1;
+                  zip.readEntry();
+                  return;
+                }
                 zip.openReadStream(entry, (err, stream) => {
                   if (err || !stream) {
                     fail(err);

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/common.ts","../../src/server/store.ts","../../src/server/importer.ts","../../src/server/backend.ts","../../src/server/manager.ts","../../src/server/lifecycle.ts"],"sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { mkdir, lstat, chmod, open, rename, unlink } from \"node:fs/promises\";\nimport { dirname, resolve } from \"node:path\";\nimport { spawn } from \"node:child_process\";\nimport type { ErrorCode, ErrorDto } from \"../contracts/index.js\";\nexport class CpaError extends Error {\n  constructor(\n    public code: ErrorCode,\n    message: string,\n    public retryable = false,\n    public retryAt: string | null = null,\n  ) {\n    super(message.slice(0, 512));\n  }\n}\nexport function safeError(\n  error: unknown,\n  operationId: string | null = null,\n): ErrorDto {\n  return error instanceof CpaError\n    ? {\n        code: error.code,\n        message: redactText(error.message),\n        retryable: error.retryable,\n        retryAt: error.retryAt,\n        operationId,\n      }\n    : {\n        code: \"INTERNAL\",\n        message: \"CPA administration operation failed\",\n        retryable: false,\n        retryAt: null,\n        operationId,\n      };\n}\nexport function redactText(text: string) {\n  return text\n    .replace(/\\b(?:Bearer\\s+|sk-)[^\\s,;]+/gi, \"[redacted]\")\n    .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}/gi, \"[redacted]\")\n    .replace(\n      /(?:access_token|refresh_token|api[_-]?key|password|secret)\\s*[:=]\\s*[^\\s,;]+/gi,\n      \"[redacted]\",\n    )\n    .slice(0, 512);\n}\nexport function safeResult(\n  value: Record<string, unknown>,\n): Record<string, unknown> {\n  const visit = (v: unknown): unknown => {\n    if (typeof v === \"string\") return redactText(v);\n    if (Array.isArray(v)) return v.slice(0, 1000).map(visit);\n    if (v && typeof v === \"object\")\n      return Object.fromEntries(\n        Object.entries(v)\n          .filter(\n            ([k]) =>\n              !/token|secret|password|authorization|raw|email|filename|prompt|body/i.test(\n                k,\n              ),\n          )\n          .slice(0, 1000)\n          .map(([k, v]) => [k, visit(v)]),\n      );\n    return v;\n  };\n  return visit(value) as Record<string, unknown>;\n}\nexport function canonical(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(canonical).join(\",\")}]`;\n  if (value && typeof value === \"object\")\n    return `{${Object.entries(value)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`)\n      .join(\",\")}}`;\n  return JSON.stringify(value) ?? \"null\";\n}\nexport const hash = (value: unknown) =>\n  createHash(\"sha256\")\n    .update(typeof value === \"string\" ? value : canonical(value))\n    .digest(\"hex\");\nexport const newId = () => randomUUID();\nexport function confined(root: string, name: string) {\n  if (!/^[A-Za-z0-9_.-]+$/.test(name) || name === \".\" || name === \"..\")\n    throw new CpaError(\"INVALID_INPUT\", \"Invalid protected object ID\");\n  const path = resolve(root, name);\n  if (dirname(path) !== resolve(root))\n    throw new CpaError(\"INVALID_INPUT\", \"Path outside protected root\");\n  return path;\n}\nexport async function protectedDir(path: string) {\n  await mkdir(path, { recursive: true, mode: 0o700 });\n  const stat = await lstat(path);\n  if (stat.isSymbolicLink() || !stat.isDirectory())\n    throw new CpaError(\n      \"INVALID_INPUT\",\n      \"Protected storage must be a real directory\",\n    );\n  await chmod(path, 0o700);\n}\nexport async function atomicJson(path: string, value: unknown) {\n  const temp = `${path}.${newId()}.tmp`;\n  const handle = await open(temp, \"wx\", 0o600);\n  try {\n    await handle.writeFile(JSON.stringify(value));\n    await handle.sync();\n  } finally {\n    await handle.close();\n  }\n  try {\n    await rename(temp, path);\n    const dir = await open(dirname(path), \"r\");\n    try {\n      await dir.sync();\n    } finally {\n      await dir.close();\n    }\n  } catch (error) {\n    await unlink(temp).catch(() => {});\n    throw error;\n  }\n}\n/** POSIX advisory lock: held by a child until stdin closes, survives lease expiry but not process death. */\nexport async function osLock(\n  path: string,\n  timeoutMs = 30_000,\n  options: { mode?: 0o600 | 0o660 } = {},\n): Promise<() => Promise<void>> {\n  const mode = options.mode ?? 0o600;\n  if (mode !== 0o600 && mode !== 0o660)\n    throw new CpaError(\"INTERNAL\", \"Invalid lock permissions\");\n  const child = spawn(\n    \"/usr/bin/python3\",\n    [\n      \"-c\",\n      'import fcntl,sys,os,stat\\nmode=int(sys.argv[2])\\nfd=os.open(sys.argv[1],os.O_CREAT|os.O_RDWR|os.O_NOFOLLOW,mode)\\ns=os.fstat(fd)\\nassert stat.S_ISREG(s.st_mode)\\nif s.st_uid==os.geteuid(): os.fchmod(fd,mode)\\nelse: assert stat.S_IMODE(s.st_mode)==mode\\nf=os.fdopen(fd,\"a+\")\\nfcntl.flock(f,fcntl.LOCK_EX)\\nprint(\"locked\",flush=True)\\nsys.stdin.buffer.read()\\n',\n      path,\n      String(mode),\n    ],\n    {\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      env: {\n        PATH: \"/usr/bin:/bin\",\n        PYTHONNOUSERSITE: \"1\",\n        PYTHONSAFEPATH: \"1\",\n      },\n    },\n  );\n  await new Promise<void>((done, reject) => {\n    const timer = setTimeout(() => {\n      child.kill(\"SIGKILL\");\n      reject(new CpaError(\"INSTANCE_BUSY\", \"Instance writer is busy\", true));\n    }, timeoutMs);\n    child.stdout.once(\"data\", () => {\n      clearTimeout(timer);\n      done();\n    });\n    child.once(\"error\", () => {\n      clearTimeout(timer);\n      reject(new CpaError(\"INTERNAL\", \"POSIX lock helper unavailable\"));\n    });\n    child.once(\"exit\", (code) => {\n      clearTimeout(timer);\n      if (code !== 0)\n        reject(new CpaError(\"INTERNAL\", \"POSIX lock helper failed\"));\n    });\n  });\n  return async () => {\n    await new Promise<void>((done) => {\n      if (child.exitCode !== null) {\n        done();\n        return;\n      }\n      child.once(\"exit\", () => done());\n      child.stdin.end();\n    });\n  };\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { Actor, Command, OperationDto } from \"../contracts/index.js\";\nimport {\n  CpaError,\n  atomicJson,\n  hash,\n  newId,\n  osLock,\n  protectedDir,\n} from \"./common.js\";\nexport interface StoredOperation {\n  dto: OperationDto;\n  command: Command;\n  actor: Actor;\n  payloadHash: string;\n  fence: number;\n  leaseUntil: string | null;\n  owner: string | null;\n  privateState: Record<string, unknown>;\n}\nexport interface OperationStore {\n  accept(\n    command: Command,\n    actor: Actor,\n  ): Promise<{ operation: StoredOperation; reused: boolean }>;\n  get(id: string): Promise<StoredOperation | null>;\n  list(): Promise<StoredOperation[]>;\n  update(\n    id: string,\n    revision: number,\n    fn: (value: StoredOperation) => void,\n  ): Promise<StoredOperation>;\n  writer<T>(action: () => Promise<T>): Promise<T>;\n  reap(now?: number): Promise<void>;\n}\ninterface Journal {\n  version: 1;\n  fence: number;\n  operations: Record<string, StoredOperation>;\n  keys: Record<\n    string,\n    { id: string; hash: string; createdAt: number; expired: boolean }\n  >;\n}\nexport function createFsOperationStore(options: {\n  root: string;\n  clock?: () => number;\n  lockTimeoutMs?: number;\n}): OperationStore {\n  const now = options.clock ?? Date.now;\n  const path = join(options.root, \"journal.json\");\n  const transaction = async <T>(\n    fn: (j: Journal) => T | Promise<T>,\n    write = true,\n  ): Promise<T> => {\n    await protectedDir(options.root);\n    const release = await osLock(\n      join(options.root, \"journal.lock\"),\n      options.lockTimeoutMs,\n    );\n    try {\n      let j: Journal;\n      try {\n        j = JSON.parse(await readFile(path, \"utf8\"));\n        if (\n          j.version !== 1 ||\n          !Number.isSafeInteger(j.fence) ||\n          !j.operations ||\n          !j.keys\n        )\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Operation journal version or shape invalid\",\n          );\n      } catch (e) {\n        if ((e as NodeJS.ErrnoException).code !== \"ENOENT\")\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Operation journal is unreadable\",\n          );\n        j = { version: 1, fence: 0, operations: {}, keys: {} };\n      }\n      const result = await fn(j);\n      if (write) await atomicJson(path, j);\n      return result;\n    } finally {\n      await release();\n    }\n  };\n  return {\n    accept: (command, actor) =>\n      transaction((j) => {\n        const key = hash([\n          command.instanceId,\n          actor.id,\n          command.kind,\n          command.idempotencyKey,\n        ]);\n        const payloadHash = hash(command);\n        const existing = j.keys[key];\n        if (existing) {\n          if (existing.expired)\n            throw new CpaError(\n              \"KEY_EXPIRED\",\n              \"Idempotency key expired; create a new key\",\n            );\n          if (existing.hash !== payloadHash)\n            throw new CpaError(\n              \"IDEMPOTENCY_CONFLICT\",\n              \"Key was used for a different command\",\n            );\n          const op = j.operations[existing.id];\n          if (!op)\n            throw new CpaError(\"RECOVERY_REQUIRED\", \"Operation record missing\");\n          return { operation: op, reused: true };\n        }\n        const time = new Date(now()).toISOString();\n        const id = newId();\n        const operation: StoredOperation = {\n          dto: {\n            apiVersion: 1,\n            instanceId: command.instanceId,\n            id,\n            kind: command.kind,\n            actorId: actor.id,\n            state: \"queued\",\n            phase: \"validate\",\n            progress: { completed: 0, total: null },\n            createdAt: time,\n            startedAt: null,\n            updatedAt: time,\n            finishedAt: null,\n            revision: 0,\n            error: null,\n            result: null,\n            recoveryDisposition: null,\n            cancelRequested: false,\n          },\n          command,\n          actor,\n          payloadHash,\n          fence: ++j.fence,\n          leaseUntil: null,\n          owner: null,\n          privateState: {},\n        };\n        j.operations[id] = operation;\n        j.keys[key] = {\n          id,\n          hash: payloadHash,\n          createdAt: now(),\n          expired: false,\n        };\n        return { operation, reused: false };\n      }),\n    get: (id) =>\n      transaction(\n        (j) => (Object.hasOwn(j.operations, id) ? j.operations[id] : null),\n        false,\n      ),\n    list: () => transaction((j) => Object.values(j.operations), false),\n    update: (id, revision, fn) =>\n      transaction((j) => {\n        const operation = j.operations[id];\n        if (!operation)\n          throw new CpaError(\"INVALID_INPUT\", \"Operation does not exist\");\n        if (operation.dto.revision !== revision)\n          throw new CpaError(\n            \"REVISION_CONFLICT\",\n            \"Operation revision changed\",\n            true,\n          );\n        const before = operation.dto.state;\n        fn(operation);\n        if (before === \"queued\" && operation.dto.state === \"running\")\n          operation.fence = ++j.fence;\n        operation.dto.revision++;\n        operation.dto.updatedAt = new Date(now()).toISOString();\n        return operation;\n      }),\n    writer: async (action) => {\n      await protectedDir(options.root);\n      const release = await osLock(\n        join(options.root, \"writer.lock\"),\n        options.lockTimeoutMs,\n      );\n      try {\n        return await action();\n      } finally {\n        await release();\n      }\n    },\n    reap: (at = now()) =>\n      transaction((j) => {\n        for (const [key, entry] of Object.entries(j.keys)) {\n          if (entry.expired && at - entry.createdAt > 60 * 86400_000) {\n            delete j.keys[key];\n            continue;\n          }\n          const op = j.operations[entry.id];\n          if (\n            at -\n              (op?.dto.finishedAt\n                ? Date.parse(op.dto.finishedAt)\n                : entry.createdAt) >\n              30 * 86400_000 &&\n            op &&\n            [\"succeeded\", \"failed\", \"cancelled\", \"partially_applied\"].includes(\n              op.dto.state,\n            )\n          ) {\n            delete j.operations[entry.id];\n            entry.expired = true;\n            entry.createdAt = at - 30 * 86400_000;\n          }\n        }\n      }),\n  };\n}\n","import { Readable } from \"node:stream\";\nimport {\n  readFile,\n  writeFile,\n  readdir,\n  lstat,\n  unlink,\n  rm,\n  chmod,\n} from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport * as yauzl from \"yauzl\";\nimport {\n  CpaError,\n  atomicJson,\n  canonical,\n  confined,\n  hash,\n  newId,\n  protectedDir,\n} from \"./common.js\";\nexport interface Credential {\n  id: string;\n  provider: string;\n  body: Record<string, unknown>;\n  digest: string;\n}\nexport interface Candidate {\n  id: string;\n  actorId: string;\n  instanceId: string;\n  createdAt: number;\n  expiresAt: number;\n  credentials: Credential[];\n  skipped: number;\n  reasons: Record<string, number>;\n  preview?: {\n    revision: string;\n    expiresAt: number;\n    mode: \"merge\" | \"replace\";\n    overwriteIds: string[];\n  };\n}\nexport interface UploadFile {\n  name: string;\n  data: Uint8Array;\n}\nexport const defaultLimits = {\n  uploadBytes: 10 * 1024 * 1024,\n  entries: 1000,\n  jsonBytes: 1024 * 1024,\n  acceptedBytes: 50 * 1024 * 1024,\n  expandedBytes: 100 * 1024 * 1024,\n  ratio: 100,\n  parseMs: 60_000,\n};\nexport type ImportLimits = typeof defaultLimits;\nconst providers = new Set([\n  \"codex\",\n  \"claude\",\n  \"gemini\",\n  \"qwen\",\n  \"antigravity\",\n  \"iflow\",\n  \"kimi\",\n]);\nexport function parseCredential(\n  data: Uint8Array,\n  limits = defaultLimits,\n): Credential | null {\n  if (data.byteLength > limits.jsonBytes)\n    throw new CpaError(\"UPLOAD_LIMIT\", \"Credential JSON exceeds limit\");\n  let body: unknown;\n  try {\n    let text = new TextDecoder(\"utf-8\", { fatal: true }).decode(data);\n    if (text.charCodeAt(0) === 0xfeff) text = text.slice(1);\n    body = JSON.parse(text);\n  } catch {\n    return null;\n  }\n  if (!body || typeof body !== \"object\" || Array.isArray(body)) return null;\n  const row = body as Record<string, unknown>;\n  const provider =\n    typeof row.type === \"string\" ? row.type.trim().toLowerCase() : \"\";\n  if (\n    !providers.has(provider) ||\n    typeof row.access_token !== \"string\" ||\n    !row.access_token ||\n    typeof row.refresh_token !== \"string\" ||\n    !row.refresh_token\n  )\n    return null;\n  const account =\n    typeof row.account_id === \"string\"\n      ? row.account_id.trim()\n      : typeof row.email === \"string\"\n        ? row.email.trim().toLowerCase()\n        : \"\";\n  if (!account) return null;\n  return {\n    id: hash(`${provider}:${account}`),\n    provider,\n    body: row,\n    digest: hash(row),\n  };\n}\nfunction safeArchivePath(path: string) {\n  if (\n    path.includes(\"\\\\\") ||\n    path.includes(\"\\0\") ||\n    path.startsWith(\"/\") ||\n    /^[A-Za-z]:/.test(path) ||\n    path.split(\"/\").some((part) => part === \"..\" || part === \".\")\n  )\n    throw new CpaError(\"ARCHIVE_UNSAFE\", \"Unsafe archive path\");\n  return path.replace(/\\/$/, \"\");\n}\nfunction selected(path: string) {\n  const parts = path.split(\"/\");\n  if (parts.includes(\"__MACOSX\") || parts.at(-1) === \".DS_Store\") return false;\n  return (\n    path.toLowerCase().endsWith(\".json\") &&\n    (parts.length === 1 ||\n      parts.length === 2 ||\n      (parts.length === 3 && parts[1] === \".auths\"))\n  );\n}\nexport async function importFiles(\n  files: UploadFile[],\n  limits: ImportLimits = defaultLimits,\n  duplicatePolicy: \"collapse\" | \"reject\" = \"collapse\",\n): Promise<{\n  credentials: Credential[];\n  skipped: number;\n  reasons: Record<string, number>;\n}> {\n  if (\n    files.length > limits.entries ||\n    files.reduce((n, f) => n + f.data.byteLength, 0) > limits.uploadBytes\n  )\n    throw new CpaError(\"UPLOAD_LIMIT\", \"Upload exceeds limit\");\n  const credentials = new Map<string, Credential>();\n  let skipped = 0,\n    accepted = 0,\n    expanded = 0,\n    entries = 0;\n  const deadline = Date.now() + limits.parseMs;\n  const paths = new Set<string>();\n  const wrappers = new Set<string>();\n  const reasons: Record<string, number> = {};\n  const consume = (name: string, data: Uint8Array) => {\n    if (Date.now() > deadline)\n      throw new CpaError(\"UPLOAD_LIMIT\", \"Import parsing deadline exceeded\");\n    if (!selected(name)) {\n      skipped++;\n      reasons.ignored = (reasons.ignored ?? 0) + 1;\n      return;\n    }\n    const parts = name.split(\"/\");\n    if (parts.length > 1) wrappers.add(parts[0]);\n    if (wrappers.size > 1)\n      throw new CpaError(\n        \"ARCHIVE_UNSAFE\",\n        \"Only one enclosing credential folder is allowed\",\n      );\n    const credential = parseCredential(data, limits);\n    if (!credential) {\n      skipped++;\n      reasons.invalidCredential = (reasons.invalidCredential ?? 0) + 1;\n      return;\n    }\n    const existing = credentials.get(credential.id);\n    if (existing && existing.digest !== credential.digest)\n      throw new CpaError(\n        \"CREDENTIAL_INVALID\",\n        \"Conflicting duplicate credential identity\",\n      );\n    if (existing) {\n      if (duplicatePolicy === \"reject\")\n        throw new CpaError(\n          \"CREDENTIAL_INVALID\",\n          \"Duplicate credential identity\",\n        );\n      skipped++;\n      reasons.duplicate = (reasons.duplicate ?? 0) + 1;\n      return;\n    }\n    accepted += data.byteLength;\n    if (accepted > limits.acceptedBytes)\n      throw new CpaError(\"UPLOAD_LIMIT\", \"Accepted credentials exceed limit\");\n    credentials.set(credential.id, credential);\n  };\n  for (const file of files) {\n    if (file.data[0] === 0x50 && file.data[1] === 0x4b) {\n      await new Promise<void>((resolve, reject) => {\n        yauzl.fromBuffer(\n          Buffer.from(file.data),\n          {\n            lazyEntries: true,\n            validateEntrySizes: true,\n            strictFileNames: true,\n          },\n          (error, zip) => {\n            if (error || !zip) {\n              reject(new CpaError(\"ARCHIVE_UNSAFE\", \"Corrupt ZIP archive\"));\n              return;\n            }\n            let declared = 0;\n            const fail = (e: unknown) => {\n              zip.close();\n              reject(\n                e instanceof CpaError\n                  ? e\n                  : new CpaError(\n                      \"ARCHIVE_UNSAFE\",\n                      \"Archive decompression failed\",\n                    ),\n              );\n            };\n            zip.on(\"error\", fail);\n            zip.on(\"end\", resolve);\n            zip.on(\"entry\", (entry: yauzl.Entry) => {\n              try {\n                if (++entries > limits.entries)\n                  throw new CpaError(\n                    \"UPLOAD_LIMIT\",\n                    \"Too many archive entries\",\n                  );\n                const path = safeArchivePath(entry.fileName);\n                if (paths.has(path))\n                  throw new CpaError(\n                    \"ARCHIVE_UNSAFE\",\n                    \"Duplicate archive path\",\n                  );\n                paths.add(path);\n                const mode = (entry.externalFileAttributes >>> 16) & 0xf000;\n                if (\n                  [0xa000, 0x2000, 0x6000, 0x1000, 0xc000].includes(mode) ||\n                  entry.generalPurposeBitFlag & 1\n                )\n                  throw new CpaError(\n                    \"ARCHIVE_UNSAFE\",\n                    \"Links, devices and encrypted entries are forbidden\",\n                  );\n                declared += entry.uncompressedSize;\n                if (\n                  declared > limits.expandedBytes ||\n                  entry.uncompressedSize >\n                    Math.max(1, entry.compressedSize) * limits.ratio\n                )\n                  throw new CpaError(\n                    \"UPLOAD_LIMIT\",\n                    \"Archive expansion exceeds limit\",\n                  );\n                if (entry.fileName.endsWith(\"/\")) {\n                  zip.readEntry();\n                  return;\n                }\n                zip.openReadStream(entry, (err, stream) => {\n                  if (err || !stream) {\n                    fail(err);\n                    return;\n                  }\n                  const chunks: Buffer[] = [];\n                  let size = 0;\n                  let crc = 0xffffffff;\n                  stream.on(\"data\", (chunk: Buffer) => {\n                    for (const byte of chunk) {\n                      crc ^= byte;\n                      for (let n = 0; n < 8; n++)\n                        crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);\n                    }\n                    size += chunk.length;\n                    expanded += chunk.length;\n                    if (\n                      expanded > limits.expandedBytes ||\n                      Date.now() > deadline ||\n                      (selected(path) && size > limits.jsonBytes)\n                    ) {\n                      stream.destroy(\n                        new CpaError(\n                          \"UPLOAD_LIMIT\",\n                          \"Decompressed data exceeds limit\",\n                        ),\n                      );\n                      return;\n                    }\n                    if (selected(path)) chunks.push(chunk);\n                  });\n                  stream.on(\"error\", fail);\n                  stream.on(\"end\", () => {\n                    try {\n                      if ((crc ^ 0xffffffff) >>> 0 !== entry.crc32)\n                        throw new CpaError(\n                          \"ARCHIVE_UNSAFE\",\n                          \"Archive CRC mismatch\",\n                        );\n                      consume(path, Buffer.concat(chunks));\n                      zip.readEntry();\n                    } catch (e) {\n                      fail(e);\n                    }\n                  });\n                });\n              } catch (e) {\n                fail(e);\n              }\n            });\n            zip.readEntry();\n          },\n        );\n      });\n    } else {\n      entries++;\n      const path = safeArchivePath(file.name);\n      if (paths.has(path))\n        throw new CpaError(\"ARCHIVE_UNSAFE\", \"Duplicate file path\");\n      paths.add(path);\n      expanded += file.data.byteLength;\n      consume(path.includes(\"/\") ? path : `${path}.json`, file.data);\n    }\n  }\n  if (!credentials.size)\n    throw new CpaError(\"CREDENTIAL_INVALID\", \"No supported credentials found\");\n  return { credentials: [...credentials.values()], skipped, reasons };\n}\nexport interface StagingStore {\n  upload(\n    files: UploadFile[],\n    actorId: string,\n    instanceId: string,\n  ): Promise<string>;\n  stage(\n    uploadId: string,\n    actorId: string,\n    instanceId: string,\n  ): Promise<Candidate>;\n  get(\n    id: string,\n    actorId: string,\n    instanceId: string,\n    admin?: boolean,\n  ): Promise<Candidate>;\n  save(candidate: Candidate): Promise<void>;\n  remove(id: string): Promise<void>;\n  reap(protectedIds: Set<string>): Promise<void>;\n}\nexport function createFsStagingStore(options: {\n  root: string;\n  limits?: ImportLimits;\n  clock?: () => number;\n  duplicatePolicy?: \"collapse\" | \"reject\";\n}): StagingStore {\n  const now = options.clock ?? Date.now,\n    limits = options.limits ?? defaultLimits;\n  const candidatePath = (id: string) =>\n    confined(options.root, `${id}.candidate.json`);\n  return {\n    upload: async (files, actorId, instanceId) => {\n      await protectedDir(options.root);\n      if (\n        files.reduce((n, f) => n + f.data.byteLength, 0) > limits.uploadBytes ||\n        files.length > limits.entries\n      )\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Upload exceeds limit\");\n      const id = newId();\n      await atomicJson(confined(options.root, `${id}.upload.json`), {\n        actorId,\n        instanceId,\n        expiresAt: now() + 3600_000,\n        files: files.map((f) => ({\n          name: f.name,\n          data: Buffer.from(f.data).toString(\"base64\"),\n        })),\n      });\n      return id;\n    },\n    stage: async (id, actorId, instanceId) => {\n      const path = confined(options.root, `${id}.upload.json`);\n      let upload: {\n        actorId: string;\n        instanceId: string;\n        expiresAt: number;\n        files: { name: string; data: string }[];\n      };\n      try {\n        upload = JSON.parse(await readFile(path, \"utf8\"));\n      } catch {\n        throw new CpaError(\"INVALID_INPUT\", \"Upload unavailable\");\n      }\n      if (upload.actorId !== actorId || upload.instanceId !== instanceId)\n        throw new CpaError(\"NOT_AUTHORIZED\", \"Upload belongs to another actor\");\n      try {\n        if (upload.expiresAt < now())\n          throw new CpaError(\"KEY_EXPIRED\", \"Upload expired\");\n        const imported = await importFiles(\n          upload.files.map((f) => ({\n            name: f.name,\n            data: Buffer.from(f.data, \"base64\"),\n          })),\n          limits,\n          options.duplicatePolicy ?? \"collapse\",\n        );\n        const candidate: Candidate = {\n          ...imported,\n          id: newId(),\n          actorId,\n          instanceId,\n          createdAt: now(),\n          expiresAt: now() + 3600_000,\n        };\n        await atomicJson(candidatePath(candidate.id), candidate);\n        return candidate;\n      } finally {\n        await unlink(path).catch(() => {});\n      }\n    },\n    get: async (id, actorId, instanceId, admin) => {\n      let c: Candidate;\n      try {\n        c = JSON.parse(await readFile(candidatePath(id), \"utf8\"));\n      } catch {\n        throw new CpaError(\"INVALID_INPUT\", \"Candidate unavailable\");\n      }\n      if (c.instanceId !== instanceId || (c.actorId !== actorId && !admin))\n        throw new CpaError(\n          \"NOT_AUTHORIZED\",\n          \"Candidate belongs to another actor\",\n        );\n      if (c.expiresAt < now())\n        throw new CpaError(\"KEY_EXPIRED\", \"Candidate expired\");\n      return c;\n    },\n    save: (c) => atomicJson(candidatePath(c.id), c),\n    remove: async (id) => {\n      await unlink(candidatePath(id)).catch((e) => {\n        if (e.code !== \"ENOENT\") throw e;\n      });\n    },\n    reap: async (protectedIds) => {\n      await protectedDir(options.root);\n      for (const name of await readdir(options.root)) {\n        if (!/\\.candidate\\.json$|\\.upload\\.json$/.test(name)) continue;\n        const id = name.split(\".\")[0];\n        if (protectedIds.has(id)) continue;\n        const path = confined(options.root, name);\n        try {\n          const value = JSON.parse(await readFile(path, \"utf8\"));\n          if (value.expiresAt < now()) await unlink(path);\n        } catch {}\n      }\n    },\n  };\n}\n/** Trusted CLI only: never expose directory paths as HTTP inputs. */\nexport async function readCredentialDirectory(\n  root: string,\n  limits = defaultLimits,\n): Promise<UploadFile[]> {\n  const result: UploadFile[] = [];\n  let count = 0,\n    total = 0;\n  const visit = async (path: string, prefix: string, depth: number) => {\n    for (const name of await readdir(path)) {\n      if (++count > limits.entries)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Directory entry limit exceeded\");\n      const full = join(path, name),\n        stat = await lstat(full);\n      if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile()))\n        throw new CpaError(\n          \"ARCHIVE_UNSAFE\",\n          \"Directory contains a link or device\",\n        );\n      if (stat.isDirectory()) {\n        if (depth < 2 && name !== \"__MACOSX\")\n          await visit(full, `${prefix}${name}/`, depth + 1);\n        continue;\n      }\n      if (!selected(`${prefix}${name}`)) continue;\n      if (stat.size > limits.jsonBytes)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Credential file exceeds limit\");\n      total += stat.size;\n      if (total > limits.uploadBytes)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Directory upload exceeds limit\");\n      result.push({ name: `${prefix}${name}`, data: await readFile(full) });\n    }\n  };\n  const rootStat = await lstat(root);\n  if (rootStat.isSymbolicLink() || !rootStat.isDirectory())\n    throw new CpaError(\"ARCHIVE_UNSAFE\", \"Directory root must not be a link\");\n  await visit(root, \"\", 0);\n  return result;\n}\n","import {\n  readFile,\n  readdir,\n  lstat,\n  mkdir,\n  writeFile,\n  symlink,\n  readlink,\n  rename,\n  unlink,\n  rm,\n  open,\n} from \"node:fs/promises\";\nimport { join, resolve, dirname } from \"node:path\";\nimport type { Capabilities, CredentialDto } from \"../contracts/index.js\";\nimport { CpaError, atomicJson, hash, newId, protectedDir } from \"./common.js\";\nimport { parseCredential, type Credential } from \"./importer.js\";\nexport interface Snapshot {\n  revision: string;\n  credentials: CredentialDto[];\n}\nexport interface ApplyInput {\n  credentials: Credential[];\n  mode: \"merge\" | \"replace\";\n  overwriteIds: string[];\n  confirmedRemovals: string[];\n  expectedRevision: string;\n}\nexport interface BackendContext {\n  phase(\n    phase: \"prepare\" | \"switch\" | \"verify\" | \"commit\",\n    state?: Record<string, unknown>,\n  ): Promise<void>;\n  check(): Promise<void>;\n}\nexport interface Backend {\n  capabilities: Capabilities;\n  managementAvailability: \"available\" | \"unavailable\" | \"unknown\";\n  snapshot(): Promise<Snapshot>;\n  apply(\n    input: ApplyInput,\n    ctx: BackendContext,\n  ): Promise<Record<string, unknown>>;\n  delete(\n    id: string,\n    expectedRevision: string,\n    ctx: BackendContext,\n  ): Promise<Record<string, unknown>>;\n  recover(\n    state: Record<string, unknown>,\n  ): Promise<\"verified\" | \"rolled_back\" | \"unknown\">;\n}\nexport interface RuntimeLifecycle {\n  stop(): Promise<void>;\n  start(): Promise<void>;\n  inspect(): Promise<{\n    version: string | null;\n    state: \"running\" | \"stopped\" | \"unknown\";\n  }>;\n}\nexport function createReadOnlyBackend(): Backend {\n  const unavailable = async (): Promise<never> => {\n    throw new CpaError(\n      \"UNSUPPORTED_CAPABILITY\",\n      \"Credential management is unavailable for this endpoint\",\n    );\n  };\n  return {\n    capabilities: Object.fromEntries(\n      [\n        \"import.stage\",\n        \"import.apply\",\n        \"import.cancel\",\n        \"credential.delete\",\n        \"credentials.list\",\n      ].map((name) => [\n        name,\n        { enabled: false, reasonCode: \"NO_VERIFIED_MANAGEMENT\" },\n      ]),\n    ),\n    managementAvailability: \"unknown\",\n    snapshot: async () => ({ revision: hash(\"read-only\"), credentials: [] }),\n    apply: unavailable,\n    delete: unavailable,\n    recover: async () => \"unknown\",\n  };\n}\nexport function createInferenceCatalog(options: {\n  baseUrl: string;\n  secret: () => Promise<string>;\n  fetch?: typeof fetch;\n  timeoutMs?: number;\n}) {\n  const url = new URL(options.baseUrl);\n  if (\n    ![\"http:\", \"https:\"].includes(url.protocol) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash\n  )\n    throw new CpaError(\"INVALID_INPUT\", \"Invalid trusted inference URL\");\n  return async () => {\n    let response: Response;\n    try {\n      response = await (options.fetch ?? fetch)(\n        `${options.baseUrl.replace(/\\/$/, \"\")}/models`,\n        {\n          headers: { Authorization: `Bearer ${await options.secret()}` },\n          redirect: \"error\",\n          signal: AbortSignal.timeout(options.timeoutMs ?? 30_000),\n        },\n      );\n    } catch {\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Model catalog request unavailable\",\n        true,\n      );\n    }\n    if (!response.ok)\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Model catalog request rejected\",\n        response.status >= 500,\n      );\n    let bytes = 0;\n    const chunks: Uint8Array[] = [];\n    if (!response.body)\n      throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Model catalog unavailable\");\n    for await (const chunk of response.body as unknown as AsyncIterable<Uint8Array>) {\n      bytes += chunk.length;\n      if (bytes > 1024 * 1024)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Model catalog exceeds limit\");\n      chunks.push(chunk);\n    }\n    let body: { data?: { id?: unknown }[] };\n    try {\n      body = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n    } catch {\n      throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Invalid model catalog\");\n    }\n    if (!Array.isArray(body.data) || body.data.length > 1000)\n      throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Invalid model catalog\");\n    return body.data.map((m) => {\n      if (typeof m.id !== \"string\" || !m.id || m.id.length > 256)\n        throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Invalid model ID\");\n      return { id: m.id, capabilities: [] as string[] };\n    });\n  };\n}\nconst dto = (c: Credential): CredentialDto => ({\n  id: c.id,\n  provider: c.provider,\n  fingerprint: `${c.id.slice(0, 6)}…${c.id.slice(-4)}`,\n  usability: c.body.disabled === true ? \"disabled\" : \"usable\",\n  updatedAt:\n    typeof c.body.last_refresh === \"string\" &&\n    Number.isFinite(Date.parse(c.body.last_refresh))\n      ? new Date(c.body.last_refresh).toISOString()\n      : null,\n});\nexport function createManagedFileBackend(options: {\n  root: string;\n  activePath: string;\n  lifecycle: RuntimeLifecycle;\n  verify: () => Promise<void>;\n  allowUnknownDeletion?: boolean;\n}): Backend {\n  const root = resolve(options.root),\n    active = resolve(options.activePath);\n  if (!active.startsWith(`${root}/`))\n    throw new CpaError(\n      \"INVALID_INPUT\",\n      \"Active pool must be confined to managed root\",\n    );\n  const current = async () => {\n    let path: string;\n    try {\n      const stat = await lstat(active);\n      if (stat.isSymbolicLink()) {\n        path = resolve(dirname(active), await readlink(active));\n        if (!path.startsWith(`${root}/`))\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Active pool points outside managed root\",\n          );\n      } else if (stat.isDirectory()) path = active;\n      else throw new Error();\n    } catch (e) {\n      if (e instanceof CpaError) throw e;\n      throw new CpaError(\"RECOVERY_REQUIRED\", \"Active pool unavailable\");\n    }\n    return path;\n  };\n  const read = async () => {\n    const path = await current(),\n      items: Credential[] = [];\n    const raw: Record<string, string> = {};\n    const opaque: { id: string; name: string; bytes: Buffer }[] = [];\n    for (const name of (await readdir(path)).sort()) {\n      if (!name.endsWith(\".json\")) continue;\n      const stat = await lstat(join(path, name));\n      if (!stat.isFile() || stat.isSymbolicLink())\n        throw new CpaError(\n          \"RECOVERY_REQUIRED\",\n          \"Unsafe active credential file\",\n        );\n      const bytes = await readFile(join(path, name));\n      raw[name] = hash(bytes.toString(\"base64\"));\n      const c = parseCredential(bytes);\n      if (c) {\n        if (items.some((item) => item.id === c.id))\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Duplicate active credential identity\",\n          );\n        items.push(c);\n      } else opaque.push({ id: hash(`file:${name}`), name, bytes });\n    }\n    return { path, items, opaque, revision: hash(raw) };\n  };\n  const snapshot = async () => {\n    const s = await read();\n    return {\n      revision: s.revision,\n      credentials: [\n        ...s.items.map(dto),\n        ...s.opaque.map((o) => ({\n          id: o.id,\n          provider: \"unknown\",\n          fingerprint: `${o.id.slice(0, 6)}…${o.id.slice(-4)}`,\n          usability: \"unknown\" as const,\n          updatedAt: null,\n        })),\n      ],\n    };\n  };\n  const mutate = async (\n    expected: string,\n    build: (fresh: Awaited<ReturnType<typeof read>>) => Credential[],\n    ctx: BackendContext,\n    preserveOpaque = true,\n  ) => {\n    await ctx.check();\n    await options.lifecycle.stop();\n    let switched = false;\n    let previous = \"\";\n    let next = \"\";\n    try {\n      const fresh = await read();\n      previous = fresh.path;\n      if (fresh.revision !== expected)\n        throw new CpaError(\n          \"REVISION_CONFLICT\",\n          \"Pool refreshed since preview; confirm again\",\n        );\n      const credentials = build(fresh);\n      if (\n        !credentials.length ||\n        !credentials.some((c) => c.body.disabled !== true)\n      )\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Cannot remove the last usable credential\",\n        );\n      await ctx.check();\n      next = join(root, \"generations\", `cpa_${newId()}`);\n      await protectedDir(dirname(next));\n      await protectedDir(next);\n      for (const c of credentials) {\n        const handle = await open(join(next, `${c.id}.json`), \"wx\", 0o600);\n        try {\n          await handle.writeFile(JSON.stringify(c.body));\n          await handle.sync();\n        } finally {\n          await handle.close();\n        }\n      }\n      if (preserveOpaque)\n        for (const o of fresh.opaque) {\n          const handle = await open(join(next, `${o.id}.json`), \"wx\", 0o600);\n          try {\n            await handle.writeFile(o.bytes);\n            await handle.sync();\n          } finally {\n            await handle.close();\n          }\n        }\n      const nextDir = await open(next, \"r\");\n      try {\n        await nextDir.sync();\n      } finally {\n        await nextDir.close();\n      }\n      await ctx.phase(\"prepare\", { previousPool: previous, nextPool: next });\n      const tmp = join(dirname(active), `.auths-${newId()}`);\n      await symlink(next, tmp);\n      await ctx.check();\n      await ctx.phase(\"switch\", { previousPool: previous, nextPool: next });\n      await rename(tmp, active);\n      switched = true;\n      await options.lifecycle.start();\n      await ctx.phase(\"verify\", { previousPool: previous, nextPool: next });\n      await options.verify();\n      await atomicJson(join(root, \"last-good.json\"), {\n        previousPool: previous,\n        activePool: next,\n      });\n      await ctx.phase(\"commit\");\n      return {\n        revision: (await snapshot()).revision,\n        count: credentials.length,\n      };\n    } catch (error) {\n      if (\n        switched &&\n        error instanceof CpaError &&\n        error.code === \"PROBE_QUOTA_LIMITED\"\n      ) {\n        await atomicJson(join(root, \"last-good.json\"), {\n          previousPool: previous,\n          activePool: next,\n        });\n        const current = await snapshot();\n        return {\n          revision: current.revision,\n          count: current.credentials.length,\n          verification: \"quota_limited\",\n        };\n      }\n      if (switched) {\n        try {\n          const tmp = join(dirname(active), `.auths-${newId()}`);\n          await options.lifecycle.stop();\n          await symlink(previous, tmp);\n          await rename(tmp, active);\n          await options.lifecycle.start();\n          await options.verify();\n        } catch {\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Pool rollback could not be verified\",\n          );\n        }\n      } else await options.lifecycle.start();\n      throw error;\n    }\n  };\n  return {\n    capabilities: {\n      \"import.stage\": { enabled: true, reasonCode: null },\n      \"import.apply\": {\n        enabled: true,\n        reasonCode: null,\n        modes: [\"merge\", \"replace\"],\n        overwrite: true,\n      },\n      \"import.cancel\": { enabled: true, reasonCode: null },\n      \"credential.delete\": { enabled: true, reasonCode: null },\n      \"credentials.list\": { enabled: true, reasonCode: null },\n    },\n    managementAvailability: \"unavailable\",\n    snapshot,\n    apply: (input, ctx) =>\n      mutate(\n        input.expectedRevision,\n        (fresh) => {\n          const existing = new Map(fresh.items.map((c) => [c.id, c]));\n          const next =\n            input.mode === \"merge\"\n              ? new Map(existing)\n              : new Map<string, Credential>();\n          for (const c of input.credentials)\n            next.set(\n              c.id,\n              existing.has(c.id) && !input.overwriteIds.includes(c.id)\n                ? existing.get(c.id)!\n                : c,\n            );\n          if (input.mode === \"replace\") {\n            const removals = [...existing.keys()].filter((id) => !next.has(id));\n            removals.push(...fresh.opaque.map((o) => o.id));\n            if (removals.some((id) => !input.confirmedRemovals.includes(id)))\n              throw new CpaError(\n                \"INVALID_INPUT\",\n                \"Pool removals require explicit confirmation\",\n              );\n          }\n          return [...next.values()];\n        },\n        ctx,\n        input.mode === \"merge\",\n      ),\n    delete: (id, revision, ctx) =>\n      mutate(\n        revision,\n        (fresh) => {\n          if (\n            !fresh.items.some((c) => c.id === id) &&\n            !fresh.opaque.some((o) => o.id === id)\n          )\n            throw new CpaError(\n              \"REVISION_CONFLICT\",\n              \"Credential no longer exists\",\n            );\n          fresh.opaque = fresh.opaque.filter((o) => o.id !== id);\n          return fresh.items.filter((c) => c.id !== id);\n        },\n        ctx,\n      ),\n    recover: async (state) => {\n      const next = typeof state.nextPool === \"string\" ? state.nextPool : null,\n        previous =\n          typeof state.previousPool === \"string\" ? state.previousPool : null;\n      if (\n        !next ||\n        !previous ||\n        !next.startsWith(`${root}/`) ||\n        !previous.startsWith(`${root}/`)\n      )\n        return \"unknown\";\n      try {\n        const path = await current();\n        if (path === next) {\n          await options.lifecycle.start();\n          await options.verify();\n          return \"verified\";\n        }\n        if (path === previous) {\n          await options.lifecycle.start();\n          await options.verify();\n          return \"rolled_back\";\n        }\n        return \"unknown\";\n      } catch {\n        return \"unknown\";\n      }\n    },\n  };\n}\nexport interface ManagementTransport {\n  request(path: string, init?: RequestInit): Promise<unknown>;\n}\nexport function createManagementTransport(options: {\n  baseUrl: string;\n  secret: () => Promise<string>;\n  fetch?: typeof fetch;\n  timeoutMs?: number;\n}): ManagementTransport {\n  const url = new URL(options.baseUrl);\n  if (\n    ![\"http:\", \"https:\"].includes(url.protocol) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash\n  )\n    throw new CpaError(\"INVALID_INPUT\", \"Invalid trusted management endpoint\");\n  const base = options.baseUrl.replace(/\\/$/, \"\");\n  return {\n    request: async (path, init = {}) => {\n      if (!/^\\/[a-z0-9/-]+(?:\\?[^\\r\\n]*)?$/.test(path))\n        throw new CpaError(\"INVALID_INPUT\", \"Invalid management route\");\n      const headers = new Headers(init.headers);\n      headers.set(\"Authorization\", `Bearer ${await options.secret()}`);\n      const signal = AbortSignal.any([\n        AbortSignal.timeout(options.timeoutMs ?? 30_000),\n        ...(init.signal ? [init.signal] : []),\n      ]);\n      let response: Response;\n      try {\n        response = await (options.fetch ?? fetch)(\n          `${base}/v8/management${path}`,\n          { ...init, headers, signal, redirect: \"error\" },\n        );\n      } catch {\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Management request unavailable\",\n          true,\n        );\n      }\n      if (!response.ok)\n        throw new CpaError(\n          response.status === 429\n            ? \"PROBE_QUOTA_LIMITED\"\n            : \"MANAGEMENT_UNAVAILABLE\",\n          \"Management request rejected\",\n          response.status >= 500,\n        );\n      if (response.status === 204) return {};\n      try {\n        if (!response.body) throw new Error();\n        const reader = response.body.getReader(),\n          chunks: Uint8Array[] = [];\n        let size = 0;\n        for (;;) {\n          const chunk = await reader.read();\n          if (chunk.done) break;\n          size += chunk.value.length;\n          if (size > 2 * 1024 * 1024) {\n            await reader.cancel();\n            throw new Error();\n          }\n          chunks.push(chunk.value);\n        }\n        return JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n      } catch {\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Management response invalid\",\n        );\n      }\n    },\n  };\n}\nexport function createPostgresManagementBackend(options: {\n  transport: ManagementTransport;\n  singleController: boolean;\n  verifiedProtocol: boolean;\n  allowUnknownDeletion?: boolean;\n}): Backend {\n  const enabled = options.singleController && options.verifiedProtocol;\n  const capabilities: Capabilities = Object.fromEntries(\n    [\n      \"import.stage\",\n      \"import.apply\",\n      \"import.cancel\",\n      \"credential.delete\",\n      \"credentials.list\",\n    ].map((name) => [\n      name,\n      { enabled, reasonCode: enabled ? null : \"UNVERIFIED_BACKEND\" },\n    ]),\n  );\n  capabilities[\"import.apply\"] = {\n    enabled,\n    reasonCode: enabled ? null : \"UNVERIFIED_BACKEND\",\n    modes: [\"merge\"],\n    overwrite: false,\n  };\n  const names = new Map<string, string>();\n  const snapshot = async () => {\n    if (!options.verifiedProtocol)\n      throw new CpaError(\n        \"UNSUPPORTED_CAPABILITY\",\n        \"Management backend is unverified\",\n      );\n    const body = (await options.transport.request(\"/credentials\")) as {\n      files?: Record<string, unknown>[];\n    };\n    if (!Array.isArray(body.files) || body.files.length > 1000)\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Credential listing invalid\",\n      );\n    names.clear();\n    const raw: (Record<string, unknown> & { id: string; digest: string })[] =\n      [];\n    for (const row of body.files) {\n      const name = typeof row.name === \"string\" ? row.name : \"\";\n      if (!name || name.includes(\"/\") || name.includes(\"\\\\\"))\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Credential identifier invalid\",\n        );\n      const downloaded =\n        row.runtime_only === true\n          ? null\n          : await options.transport.request(\n              `/credentials/download?name=${encodeURIComponent(name)}`,\n            );\n      const credential = downloaded\n        ? parseCredential(Buffer.from(JSON.stringify(downloaded)))\n        : null;\n      const id = credential?.id ?? hash(name);\n      names.set(id, name);\n      raw.push({ ...row, id, digest: hash(downloaded ?? row) });\n    }\n    const credentials: CredentialDto[] = raw.map((row) => ({\n      id: row.id as string,\n      provider:\n        typeof row.type === \"string\"\n          ? row.type\n          : typeof row.provider === \"string\"\n            ? row.provider\n            : \"unknown\",\n      fingerprint: `${String(row.id).slice(0, 6)}…${String(row.id).slice(-4)}`,\n      usability:\n        row.disabled === true\n          ? \"disabled\"\n          : row.status === \"ready\"\n            ? \"usable\"\n            : \"unknown\",\n      updatedAt: typeof row.updated_at === \"string\" ? row.updated_at : null,\n    }));\n    return { revision: hash(raw), credentials };\n  };\n  return {\n    capabilities,\n    managementAvailability: options.verifiedProtocol ? \"available\" : \"unknown\",\n    snapshot,\n    apply: async (input, ctx) => {\n      if (!enabled || input.mode === \"replace\" || input.overwriteIds.length)\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"PG supports new identities only\",\n        );\n      const initial = await snapshot();\n      if (initial.revision !== input.expectedRevision)\n        throw new CpaError(\"REVISION_CONFLICT\", \"Credential pool changed\");\n      const outcomes: { id: string; state: string }[] = [];\n      for (const credential of input.credentials) {\n        await ctx.check();\n        const latest = await snapshot();\n        const known = latest.credentials.some((c) => c.id === credential.id);\n        if (known) {\n          outcomes.push({ id: credential.id, state: \"preserved\" });\n          continue;\n        }\n        await ctx.phase(\"switch\", { outcomes });\n        try {\n          await options.transport.request(\n            `/credentials?name=${encodeURIComponent(`${credential.id}.json`)}`,\n            {\n              method: \"POST\",\n              headers: { \"Content-Type\": \"application/json\" },\n              body: JSON.stringify(credential.body),\n            },\n          );\n          outcomes.push({ id: credential.id, state: \"applied\" });\n        } catch {\n          outcomes.push({ id: credential.id, state: \"unknown\" });\n          await ctx.phase(\"verify\", { outcomes });\n          throw new CpaError(\n            outcomes.some((o) => o.state === \"applied\")\n              ? \"APPLY_PARTIAL\"\n              : \"OUTCOME_UNKNOWN\",\n            \"Import requires reconciliation; do not repeat automatically\",\n          );\n        }\n      }\n      await ctx.phase(\"verify\", { outcomes });\n      await snapshot();\n      return { outcomes };\n    },\n    delete: async (id, expected, ctx) => {\n      if (!enabled)\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"Credential deletion disabled\",\n        );\n      const s = await snapshot();\n      if (s.revision !== expected)\n        throw new CpaError(\"REVISION_CONFLICT\", \"Credential pool changed\");\n      const name = names.get(id);\n      if (!name)\n        throw new CpaError(\"REVISION_CONFLICT\", \"Credential no longer exists\");\n      if (\n        s.credentials.length <= 1 ||\n        (!options.allowUnknownDeletion &&\n          !s.credentials\n            .filter((c) => c.id !== id)\n            .some((c) => c.usability === \"usable\"))\n      )\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Last usable account deletion prohibited\",\n        );\n      await ctx.phase(\"switch\", { credentialId: id });\n      try {\n        await options.transport.request(\n          `/credentials?name=${encodeURIComponent(name)}`,\n          { method: \"DELETE\" },\n        );\n      } catch {\n        throw new CpaError(\n          \"OUTCOME_UNKNOWN\",\n          \"Deletion outcome unknown; reconcile before retry\",\n        );\n      }\n      await ctx.phase(\"verify\");\n      const after = await snapshot();\n      if (after.credentials.some((c) => c.id === id))\n        throw new CpaError(\"OUTCOME_UNKNOWN\", \"Deletion not confirmed\");\n      return { revision: after.revision, deletedId: id };\n    },\n    recover: async () => \"unknown\",\n  };\n}\n","import { hostname } from \"node:os\";\nimport type {\n  AcceptResult,\n  Actor,\n  Command,\n  ImportPreviewDto,\n  ListDto,\n  ModelsDto,\n  OperationDto,\n  Phase,\n  ReleaseDto,\n  StatusDto,\n} from \"../contracts/index.js\";\nimport { commandSchema, isTerminal, idSchema } from \"../contracts/index.js\";\nimport type { Backend, BackendContext, RuntimeLifecycle } from \"./backend.js\";\nimport type { StagingStore } from \"./importer.js\";\nimport type { OperationStore, StoredOperation } from \"./store.js\";\nimport { CpaError, hash, safeError, safeResult } from \"./common.js\";\nexport interface Authorization {\n  check(actor: Actor, instanceId: string, action: string): Promise<boolean>;\n}\nexport interface Maintenance {\n  enter(operationId: string, timeoutMs: number): Promise<void>;\n  leave(operationId: string): Promise<void>;\n}\nexport interface ReleaseAdapter {\n  list(): Promise<ReleaseDto[]>;\n  discover(): Promise<Record<string, unknown>>;\n  install(id: string, ctx: BackendContext): Promise<Record<string, unknown>>;\n  activate(id: string, ctx: BackendContext): Promise<Record<string, unknown>>;\n  delete(id: string): Promise<Record<string, unknown>>;\n  rollback(id: string, ctx: BackendContext): Promise<Record<string, unknown>>;\n  recover(\n    state: Record<string, unknown>,\n  ): Promise<\"verified\" | \"rolled_back\" | \"unknown\">;\n}\nexport interface ManagerConfig {\n  instanceId: string;\n  connection: {\n    baseUrl: string;\n    secretReference: string;\n    wireCapabilities: string[];\n  };\n  modelTtlMs?: number;\n  drainTimeoutMs?: number;\n}\nexport interface ManagerAdapters {\n  store: OperationStore;\n  staging: StagingStore;\n  backend: Backend;\n  authorization: Authorization;\n  lifecycle?: RuntimeLifecycle;\n  catalog?: () => Promise<{ id: string; capabilities: string[] }[]>;\n  probe?: (\n    input: {\n      modelId: string;\n      protocol: string;\n      reasoningProfile: string | null;\n    },\n    signal: AbortSignal,\n  ) => Promise<Record<string, unknown>>;\n  maintenance?: Maintenance;\n  releases?: ReleaseAdapter;\n  clock?: () => number;\n  onAudit?: (event: {\n    operationId: string;\n    kind: string;\n    state: string;\n  }) => Promise<void>;\n  modelCache?: {\n    get(): Promise<ModelsDto | null>;\n    put(value: ModelsDto): Promise<void>;\n  };\n}\nexport function createCpaManager(\n  config: ManagerConfig,\n  adapters: ManagerAdapters,\n) {\n  idSchema.parse(config.instanceId);\n  const now = adapters.clock ?? Date.now;\n  let catalog: ModelsDto = {\n    apiVersion: 1,\n    instanceId: config.instanceId,\n    models: [],\n    fetchedAt: null,\n    expiresAt: null,\n    stale: true,\n    revision: hash([]),\n  };\n  let probeState: \"passed\" | \"failed\" | \"unknown\" = \"unknown\";\n  let cacheWriteWarning = false;\n  const loadCatalog = async () => {\n    const cached = await adapters.modelCache?.get();\n    if (cached && cached.instanceId === config.instanceId) catalog = cached;\n  };\n  const saveCatalog = async () => {\n    try {\n      await adapters.modelCache?.put(catalog);\n    } catch {\n      cacheWriteWarning = true;\n    }\n  };\n  const authorize = async (actor: Actor, action: string) => {\n    idSchema.parse(actor.id);\n    if (!(await adapters.authorization.check(actor, config.instanceId, action)))\n      throw new CpaError(\"NOT_AUTHORIZED\", \"Administration access denied\");\n  };\n  const capabilities = () => ({\n    ...adapters.backend.capabilities,\n    ...(!adapters.maintenance\n      ? Object.fromEntries(\n          [\n            \"import.apply\",\n            \"credential.delete\",\n            \"release.activate\",\n            \"release.rollback\",\n          ].map((name) => [\n            name,\n            { enabled: false, reasonCode: \"NO_DRAIN_GUARD\" },\n          ]),\n        )\n      : {}),\n    \"catalog.refresh\": {\n      enabled: !!adapters.catalog,\n      reasonCode: adapters.catalog ? null : \"NO_CATALOG_ADAPTER\",\n    },\n    \"model.probe\": {\n      enabled: !!adapters.probe,\n      reasonCode: adapters.probe ? null : \"NO_PROBE_ADAPTER\",\n    },\n    ...Object.fromEntries(\n      [\n        \"release.discover\",\n        \"release.install\",\n        \"release.activate\",\n        \"release.delete\",\n        \"release.rollback\",\n      ].map((name) => [\n        name,\n        {\n          enabled:\n            !!adapters.releases &&\n            ([\"release.discover\", \"release.install\", \"release.delete\"].includes(\n              name,\n            ) ||\n              !!adapters.maintenance),\n          reasonCode: adapters.releases\n            ? adapters.maintenance\n              ? null\n              : \"NO_DRAIN_GUARD\"\n            : \"REMOTE_MODE\",\n        },\n      ]),\n    ),\n    \"operation.cancel\": { enabled: true, reasonCode: null },\n  });\n  const update = async (id: string, fn: (op: StoredOperation) => void) => {\n    for (let n = 0; n < 10; n++) {\n      const op = await adapters.store.get(id);\n      if (!op) throw new CpaError(\"INVALID_INPUT\", \"Operation missing\");\n      try {\n        return await adapters.store.update(id, op.dto.revision, fn);\n      } catch (e) {\n        if (!(e instanceof CpaError) || e.code !== \"REVISION_CONFLICT\") throw e;\n      }\n    }\n    throw new CpaError(\"INSTANCE_BUSY\", \"Concurrent operation updates\", true);\n  };\n  const own = async (id: string, actor: Actor) => {\n    await authorize(actor, \"operations.get\");\n    const op = await adapters.store.get(id);\n    if (!op || op.dto.instanceId !== config.instanceId)\n      throw new CpaError(\"INVALID_INPUT\", \"Operation missing\");\n    if (op.actor.id !== actor.id && !actor.admin)\n      throw new CpaError(\n        \"NOT_AUTHORIZED\",\n        \"Operation belongs to another actor\",\n      );\n    return op;\n  };\n  const preview = async (\n    candidateId: string,\n    actor: Actor,\n    options: { mode?: \"merge\" | \"replace\"; overwriteIds?: string[] } = {},\n  ): Promise<ImportPreviewDto> => {\n    await authorize(actor, \"imports.preview\");\n    const c = await adapters.staging.get(\n      candidateId,\n      actor.id,\n      config.instanceId,\n      actor.admin,\n    );\n    const s = await adapters.backend.snapshot();\n    const existing = new Set(s.credentials.map((item) => item.id)),\n      incoming = new Set(c.credentials.map((item) => item.id));\n    const overwriteIds = options.overwriteIds ?? [];\n    const mode = options.mode ?? \"merge\";\n    c.preview = {\n      revision: s.revision,\n      expiresAt: now() + 900_000,\n      mode,\n      overwriteIds,\n    };\n    await adapters.staging.save(c);\n    return {\n      apiVersion: 1,\n      instanceId: config.instanceId,\n      candidateId: c.id,\n      revision: s.revision,\n      expiresAt: new Date(c.expiresAt).toISOString(),\n      previewExpiresAt: new Date(c.preview.expiresAt).toISOString(),\n      accepted: c.credentials.length,\n      skipped: c.skipped,\n      additions: [...incoming].filter((id) => !existing.has(id)),\n      preserved: [...existing].filter((id) =>\n        mode === \"merge\"\n          ? !overwriteIds.includes(id)\n          : incoming.has(id) && !overwriteIds.includes(id),\n      ),\n      replacements: [...incoming].filter(\n        (id) => existing.has(id) && overwriteIds.includes(id),\n      ),\n      removals:\n        mode === \"replace\"\n          ? [...existing].filter((id) => !incoming.has(id))\n          : [],\n      reasons: c.reasons,\n    };\n  };\n  const manager = {\n    connectionDescriptor: () => ({\n      ...config.connection,\n      wireCapabilities: [...config.connection.wireCapabilities],\n    }),\n    accept: async (input: unknown, actor: Actor): Promise<AcceptResult> => {\n      const parsed = commandSchema.safeParse(input);\n      if (!parsed.success)\n        throw new CpaError(\"INVALID_INPUT\", \"Invalid administration command\");\n      const command = parsed.data;\n      if (command.instanceId !== config.instanceId)\n        throw new CpaError(\"INVALID_INPUT\", \"Unknown instance\");\n      await authorize(actor, command.kind);\n      const cap =\n        capabilities()[command.kind as keyof ReturnType<typeof capabilities>];\n      if (!cap?.enabled)\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"Administration capability unavailable\",\n        );\n      if (command.kind === \"import.apply\") {\n        const policy = adapters.backend.capabilities[\"import.apply\"];\n        if (\n          (policy?.modes && !policy.modes.includes(command.payload.mode)) ||\n          (policy?.overwrite === false && command.payload.overwriteIds.length)\n        )\n          throw new CpaError(\n            \"UNSUPPORTED_CAPABILITY\",\n            \"Import mode is not supported by this backend\",\n          );\n      }\n      if (\n        [\n          \"import.apply\",\n          \"credential.delete\",\n          \"release.activate\",\n          \"release.rollback\",\n        ].includes(command.kind) &&\n        !adapters.maintenance\n      )\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"Safe maintenance guard required\",\n        );\n      const result = await adapters.store.accept(command, actor);\n      if (\n        command.kind === \"operation.cancel\" &&\n        result.operation.dto.state === \"queued\"\n      ) {\n        const target = await own(command.payload.operationId, actor);\n        await update(target.dto.id, (op) => {\n          op.dto.cancelRequested = true;\n          if (op.dto.state === \"queued\") {\n            op.dto.state = \"cancelled\";\n            op.dto.finishedAt = new Date(now()).toISOString();\n          }\n        });\n        await update(result.operation.dto.id, (op) => {\n          op.dto.state = \"succeeded\";\n          op.dto.result = { operationId: target.dto.id };\n          op.dto.finishedAt = new Date(now()).toISOString();\n        });\n      }\n      return {\n        apiVersion: 1,\n        operationId: result.operation.dto.id,\n        state: (await adapters.store.get(result.operation.dto.id))!.dto.state,\n        reused: result.reused,\n      };\n    },\n    status: async (actor: Actor): Promise<StatusDto> => {\n      await authorize(actor, \"status.get\");\n      await loadCatalog();\n      const s = await adapters.backend\n        .snapshot()\n        .catch(() => ({ revision: hash(\"unavailable\"), credentials: [] }));\n      const runtime = await adapters.lifecycle\n        ?.inspect()\n        .catch(() => ({ version: null, state: \"unknown\" as const }));\n      const operations = await adapters.store.list();\n      const lastProbe = operations\n        .filter(\n          (o) =>\n            o.dto.instanceId === config.instanceId &&\n            o.dto.kind === \"model.probe\" &&\n            isTerminal(o.dto.state),\n        )\n        .sort((a, b) => b.dto.updatedAt.localeCompare(a.dto.updatedAt))[0];\n      const busy = operations.find(\n        (o) =>\n          o.dto.instanceId === config.instanceId &&\n          [\"running\", \"recovery_required\"].includes(o.dto.state),\n      );\n      return {\n        apiVersion: 1,\n        instanceId: config.instanceId,\n        revision: hash({ pool: s.revision, core: runtime?.version ?? null }),\n        runtime: {\n          mode: adapters.lifecycle ? \"managed\" : \"remote\",\n          version: runtime?.version ?? null,\n          state: runtime?.state ?? \"unknown\",\n        },\n        management: {\n          protocol:\n            adapters.backend.managementAvailability === \"available\"\n              ? \"v8\"\n              : null,\n          availability: adapters.backend.managementAvailability,\n        },\n        inference: {\n          reachable:\n            runtime?.state === \"stopped\"\n              ? false\n              : catalog.expiresAt && Date.parse(catalog.expiresAt) > now()\n                ? true\n                : null,\n          catalogState: catalog.fetchedAt\n            ? now() < Date.parse(catalog.expiresAt!)\n              ? \"fresh\"\n              : \"stale\"\n            : \"unknown\",\n          probeState: lastProbe\n            ? lastProbe.dto.state === \"succeeded\"\n              ? \"passed\"\n              : \"failed\"\n            : probeState,\n          checkedAt: lastProbe?.dto.finishedAt ?? catalog.fetchedAt,\n        },\n        capabilities: capabilities(),\n        busyOperationId: busy?.dto.id ?? null,\n      };\n    },\n    credentials: async (actor: Actor) => {\n      await authorize(actor, \"credentials.list\");\n      return {\n        apiVersion: 1 as const,\n        instanceId: config.instanceId,\n        items: (await adapters.backend.snapshot()).credentials,\n        nextCursor: null,\n      };\n    },\n    models: async (actor: Actor) => {\n      await authorize(actor, \"models.get\");\n      await loadCatalog();\n      return {\n        ...catalog,\n        stale: !catalog.expiresAt || Date.parse(catalog.expiresAt) < now(),\n      };\n    },\n    releases: async (actor: Actor): Promise<ListDto<ReleaseDto>> => {\n      await authorize(actor, \"releases.list\");\n      return {\n        apiVersion: 1,\n        instanceId: config.instanceId,\n        items: (await adapters.releases?.list()) ?? [],\n        nextCursor: null,\n      };\n    },\n    operations: async (\n      actor: Actor,\n      options: { limit?: number; cursor?: string } = {},\n    ): Promise<ListDto<OperationDto>> => {\n      await authorize(actor, \"operations.list\");\n      const limit = options.limit ?? 50;\n      if (!Number.isInteger(limit) || limit < 1 || limit > 100)\n        throw new CpaError(\"INVALID_INPUT\", \"Invalid page limit\");\n      let after = \"\";\n      let ceiling = new Date(now()).toISOString();\n      if (options.cursor) {\n        try {\n          const cursor = JSON.parse(\n            Buffer.from(options.cursor, \"base64url\").toString(),\n          );\n          if (\n            cursor.actor !== actor.id ||\n            cursor.instance !== config.instanceId\n          )\n            throw new Error();\n          after = cursor.after;\n          ceiling = cursor.ceiling;\n        } catch {\n          throw new CpaError(\"INVALID_INPUT\", \"Invalid page cursor\");\n        }\n      }\n      const items = (await adapters.store.list())\n        .filter(\n          (o) =>\n            o.dto.instanceId === config.instanceId &&\n            (actor.admin || o.actor.id === actor.id) &&\n            o.dto.createdAt <= ceiling,\n        )\n        .map((o) => o.dto)\n        .sort((a, b) =>\n          `${b.createdAt}:${b.id}`.localeCompare(`${a.createdAt}:${a.id}`),\n        )\n        .filter((o) => !after || `${o.createdAt}:${o.id}` < after);\n      const page = items.slice(0, limit);\n      return {\n        apiVersion: 1,\n        instanceId: config.instanceId,\n        items: page,\n        nextCursor:\n          items.length > limit\n            ? Buffer.from(\n                JSON.stringify({\n                  actor: actor.id,\n                  instance: config.instanceId,\n                  ceiling,\n                  after: `${page.at(-1)!.createdAt}:${page.at(-1)!.id}`,\n                }),\n              ).toString(\"base64url\")\n            : null,\n      };\n    },\n    operation: async (id: string, actor: Actor) => (await own(id, actor)).dto,\n    preview,\n    upload: async (\n      files: import(\"./importer.js\").UploadFile[],\n      actor: Actor,\n    ) => {\n      await authorize(actor, \"import.stage\");\n      return {\n        apiVersion: 1 as const,\n        uploadId: await adapters.staging.upload(\n          files,\n          actor.id,\n          config.instanceId,\n        ),\n      };\n    },\n    executeOperation: async (id: string):Promise<OperationDto|undefined> => {\n      const pending=await adapters.store.get(id);\n      if(pending?.dto.state==='queued'&&pending.command.kind==='operation.cancel'){\n        try{await authorize(pending.actor,'operation.cancel');const target=await own(pending.command.payload.operationId,pending.actor);await update(target.dto.id,o=>{o.dto.cancelRequested=true;if(o.dto.state==='queued'){o.dto.state='cancelled';o.dto.finishedAt=new Date(now()).toISOString();}});await update(id,o=>{o.dto.state='succeeded';o.dto.result={operationId:target.dto.id};o.dto.finishedAt=new Date(now()).toISOString();});}catch(e){await update(id,o=>{o.dto.state='failed';o.dto.error=safeError(e,id);o.dto.finishedAt=new Date(now()).toISOString();});}return(await adapters.store.get(id))!.dto;\n      }\n      return adapters.store.writer(async () => {\n        let op = await adapters.store.get(id);\n        if (\n          !op ||\n          op.dto.instanceId !== config.instanceId ||\n          op.dto.state !== \"queued\"\n        )\n          return;\n        const blocked = (await adapters.store.list()).find(\n          (o) =>\n            o.dto.instanceId === config.instanceId &&\n            o.dto.state === \"recovery_required\",\n        );\n        if (blocked)\n          throw new CpaError(\"RECOVERY_REQUIRED\", \"Instance recovery required\");\n        try {\n          await authorize(op.actor, op.command.kind);\n        } catch (e) {\n          await update(id, (o) => {\n            o.dto.state = \"failed\";\n            o.dto.error = safeError(e, id);\n            o.dto.finishedAt = new Date(now()).toISOString();\n          });\n          return (await adapters.store.get(id))!.dto;\n        }\n        const controller = new AbortController();\n        let heartbeatError = false;\n        op = await update(id, (o) => {\n          o.dto.state = \"running\";\n          o.dto.startedAt = new Date(now()).toISOString();\n          o.owner = `${hostname()}:${process.pid}`;\n          o.leaseUntil = new Date(now() + 30_000).toISOString();\n        });\n        const heartbeat = setInterval(() => {\n          void update(id, (o) => {\n            o.leaseUntil = new Date(now() + 30_000).toISOString();\n            if (o.dto.cancelRequested && !switched) controller.abort();\n          }).catch(() => {\n            heartbeatError = true;\n            controller.abort();\n          });\n        }, 10_000);\n        let entered = false,\n          switched = false;\n        const phase = async (p: Phase, state?: Record<string, unknown>) => {\n          if (p === \"switch\") switched = true;\n          await update(id, (o) => {\n            o.dto.phase = p;\n            if (state) o.privateState = { ...o.privateState, ...state };\n          });\n        };\n        const check = async () => {\n          if (heartbeatError)\n            throw new CpaError(\"RECOVERY_REQUIRED\", \"Operation lease lost\");\n          const current = await adapters.store.get(id);\n          if (current?.dto.cancelRequested && !switched)\n            throw new CpaError(\"CANCELLED\", \"Operation cancelled\");\n          await authorize(op!.actor, op!.command.kind);\n        };\n        const ctx: BackendContext = { phase, check };\n        let candidateId: string | null = null;\n        try {\n          cacheWriteWarning = false;\n          await check();\n          const command = op.command;\n          const disruptive = [\n            \"import.apply\",\n            \"credential.delete\",\n            \"release.activate\",\n            \"release.rollback\",\n          ].includes(command.kind);\n          if (disruptive) {\n            await phase(\"drain\");\n            await adapters.maintenance!.enter(\n              id,\n              config.drainTimeoutMs ?? 180_000,\n            );\n            entered = true;\n            await check();\n          }\n          if (\n            [\"release.activate\", \"release.delete\", \"release.rollback\"].includes(\n              op.command.kind,\n            )\n          ) {\n            const pool = await adapters.backend.snapshot();\n            const runtime = await adapters.lifecycle?.inspect();\n            if (\n              hash({ pool: pool.revision, core: runtime?.version ?? null }) !==\n              op.command.expectedRevision\n            )\n              throw new CpaError(\n                \"REVISION_CONFLICT\",\n                \"Runtime or pool changed since confirmation\",\n              );\n          }\n          let result: Record<string, unknown> = {};\n          switch (command.kind) {\n            case \"import.stage\": {\n              const candidate = await adapters.staging.stage(\n                command.payload.uploadId,\n                op.actor.id,\n                config.instanceId,\n              );\n              await phase(\"preview\");\n              await update(id, (o) => {\n                o.dto.progress = {\n                  completed: candidate.credentials.length + candidate.skipped,\n                  total: candidate.credentials.length + candidate.skipped,\n                };\n              });\n              result = {\n                candidateId: candidate.id,\n                accepted: candidate.credentials.length,\n                skipped: candidate.skipped,\n              };\n              break;\n            }\n            case \"import.apply\": {\n              candidateId = command.payload.candidateId;\n              const c = await adapters.staging.get(\n                candidateId,\n                op.actor.id,\n                config.instanceId,\n                op.actor.admin,\n              );\n              await update(id, (o) => {\n                o.dto.progress.total = c.credentials.length;\n              });\n              if (\n                !c.preview ||\n                c.preview.expiresAt < now() ||\n                c.preview.revision !== command.payload.previewRevision ||\n                command.expectedRevision !== c.preview.revision ||\n                c.preview.mode !== command.payload.mode ||\n                hash(c.preview.overwriteIds) !==\n                  hash(command.payload.overwriteIds)\n              )\n                throw new CpaError(\n                  \"REVISION_CONFLICT\",\n                  \"Import preview expired or changed\",\n                );\n              result = await adapters.backend.apply(\n                {\n                  credentials: c.credentials,\n                  ...command.payload,\n                  expectedRevision: command.expectedRevision!,\n                },\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            }\n            case \"import.cancel\":\n              candidateId = command.payload.candidateId;\n              await adapters.staging.get(\n                candidateId,\n                op.actor.id,\n                config.instanceId,\n                op.actor.admin,\n              );\n              result = { cancelled: true };\n              break;\n            case \"credential.delete\":\n              const deletePool = await adapters.backend.snapshot();\n              const deleteRuntime = await adapters.lifecycle?.inspect();\n              if (\n                hash({\n                  pool: deletePool.revision,\n                  core: deleteRuntime?.version ?? null,\n                }) !== command.expectedRevision\n              )\n                throw new CpaError(\n                  \"REVISION_CONFLICT\",\n                  \"Runtime or pool changed since confirmation\",\n                );\n              result = await adapters.backend.delete(\n                command.payload.credentialId,\n                deletePool.revision,\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            case \"catalog.refresh\": {\n              const models = await adapters.catalog!();\n              if (models.some((m) => !m.id || m.id.length > 256))\n                throw new CpaError(\n                  \"MANAGEMENT_UNAVAILABLE\",\n                  \"Model catalog invalid\",\n                );\n              catalog = {\n                apiVersion: 1,\n                instanceId: config.instanceId,\n                models,\n                fetchedAt: new Date(now()).toISOString(),\n                expiresAt: new Date(\n                  now() + (config.modelTtlMs ?? 300_000),\n                ).toISOString(),\n                stale: false,\n                revision: hash(models),\n              };\n              result = { count: models.length };\n              await saveCatalog();\n              break;\n            }\n            case \"model.probe\":\n              await loadCatalog();\n              if (\n                !config.connection.wireCapabilities.includes(\n                  command.payload.protocol,\n                )\n              )\n                throw new CpaError(\n                  \"UNSUPPORTED_CAPABILITY\",\n                  \"Probe wire protocol is not approved\",\n                );\n              if (!catalog.models.some((m) => m.id === command.payload.modelId))\n                throw new CpaError(\"INVALID_INPUT\", \"Model is not in catalog\");\n              result = await adapters.probe!(\n                command.payload,\n                controller.signal,\n              );\n              probeState = \"passed\";\n              break;\n            case \"release.discover\":\n              result = await adapters.releases!.discover();\n              break;\n            case \"release.install\":\n              result = await adapters.releases!.install(\n                command.payload.releaseId,\n                ctx,\n              );\n              break;\n            case \"release.activate\":\n              result = await adapters.releases!.activate(\n                command.payload.installedReleaseId,\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            case \"release.delete\":\n              result = await adapters.releases!.delete(\n                command.payload.installedReleaseId,\n              );\n              break;\n            case \"release.rollback\":\n              result = await adapters.releases!.rollback(\n                command.payload.lastKnownGoodReleaseId,\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            case \"operation.cancel\":\n              break;\n          }\n          await phase(\"commit\");\n          await update(id, (o) => {\n            o.dto.state = \"succeeded\";\n            o.dto.result = safeResult({\n              ...result,\n              ...(cacheWriteWarning ? { cacheWriteWarning: true } : {}),\n            });\n            o.dto.finishedAt = new Date(now()).toISOString();\n          });\n        } catch (e) {\n          const error = safeError(e, id);\n          if (op.command.kind === \"model.probe\") probeState = \"failed\";\n          if (op.command.kind === \"catalog.refresh\") {\n            catalog = { ...catalog, stale: true, expiresAt: null };\n            await saveCatalog();\n          }\n          await update(id, (o) => {\n            o.dto.state =\n              error.code === \"RECOVERY_REQUIRED\" ||\n              error.code === \"OUTCOME_UNKNOWN\"\n                ? \"recovery_required\"\n                : error.code === \"APPLY_PARTIAL\"\n                  ? \"partially_applied\"\n                  : error.code === \"CANCELLED\"\n                    ? \"cancelled\"\n                    : \"failed\";\n            o.dto.error = error;\n            o.dto.finishedAt = new Date(now()).toISOString();\n            if (o.dto.state === \"recovery_required\")\n              o.dto.recoveryDisposition = \"reconcile\";\n          });\n        } finally {\n          clearInterval(heartbeat);\n          const final = (await adapters.store.get(id))!;\n          if (candidateId && final.dto.state !== \"recovery_required\") {\n            await adapters.staging.remove(candidateId).catch(async () => {\n              await update(id, (o) => {\n                o.dto.result = { ...o.dto.result, cleanupWarning: true };\n              });\n            });\n          }\n          if (entered && final.dto.state !== \"recovery_required\")\n            await adapters.maintenance!.leave(id);\n          await adapters\n            .onAudit?.({\n              operationId: id,\n              kind: op.command.kind,\n              state: final.dto.state,\n            })\n            .catch(() => {});\n        }\n        return (await adapters.store.get(id))!.dto;\n      });\n    },\n    recoverOperations: async () =>\n      adapters.store.writer(async () => {\n        for (const o of await adapters.store.list()) {\n          if (\n            o.dto.instanceId !== config.instanceId ||\n            ![\"running\", \"recovery_required\"].includes(o.dto.state)\n          )\n            continue;\n          const recovery = o.dto.kind.startsWith(\"release.\")\n            ? ((await adapters.releases?.recover(o.privateState)) ?? \"unknown\")\n            : await adapters.backend.recover(o.privateState);\n          const actual =\n            recovery === \"verified\" ? await adapters.backend.snapshot() : null;\n          await update(o.dto.id, (op) => {\n            op.dto.state =\n              recovery === \"verified\"\n                ? \"succeeded\"\n                : recovery === \"rolled_back\"\n                  ? \"failed\"\n                  : \"recovery_required\";\n            op.dto.recoveryDisposition = recovery;\n            op.dto.finishedAt = new Date(now()).toISOString();\n            if (recovery === \"verified\") {\n              op.dto.error = null;\n              op.dto.result = {\n                recovered: true,\n                revision: actual?.revision ?? null,\n              };\n            }\n            if (recovery !== \"verified\")\n              op.dto.error = safeError(\n                new CpaError(\n                  \"RECOVERY_REQUIRED\",\n                  \"Interrupted operation requires review\",\n                ),\n                o.dto.id,\n              );\n          });\n          if (recovery !== \"unknown\")\n            await adapters.maintenance?.leave(o.dto.id);\n          if (recovery !== \"unknown\" && \"candidateId\" in o.command.payload)\n            await adapters.staging\n              .remove(o.command.payload.candidateId)\n              .catch(() => {});\n          if (recovery === \"verified\") {\n            catalog = { ...catalog, stale: true, expiresAt: null };\n            await saveCatalog();\n          }\n        }\n      }),\n    reapStaging: async () => {\n      const protectedIds = new Set<string>();\n      for (const o of await adapters.store.list()) {\n        if (\n          [\"running\", \"recovery_required\"].includes(o.dto.state) &&\n          \"candidateId\" in o.command.payload\n        )\n          protectedIds.add(o.command.payload.candidateId);\n        if (\n          [\"running\", \"recovery_required\"].includes(o.dto.state) &&\n          \"uploadId\" in o.command.payload\n        )\n          protectedIds.add(o.command.payload.uploadId);\n      }\n      await adapters.staging.reap(protectedIds);\n      await adapters.store.reap(now());\n    },\n  };\n  return manager;\n}\nexport type CpaManager = ReturnType<typeof createCpaManager>;\nexport const executeOperation = (manager: CpaManager, id: string) =>\n  manager.executeOperation(id);\nexport const recoverOperations = (manager: CpaManager) =>\n  manager.recoverOperations();\nexport const reapStaging = (manager: CpaManager) => manager.reapStaging();\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport {\n  lstat,\n  readFile,\n  writeFile,\n  rename,\n  symlink,\n  readlink,\n  readdir,\n  rm,\n} from \"node:fs/promises\";\nimport { join, resolve, dirname } from \"node:path\";\nimport { createHash } from \"node:crypto\";\nimport { gunzipSync } from \"node:zlib\";\nimport {\n  CpaError,\n  atomicJson,\n  confined,\n  newId,\n  protectedDir,\n} from \"./common.js\";\nimport type { BackendContext, RuntimeLifecycle } from \"./backend.js\";\nimport type { ReleaseAdapter } from \"./manager.js\";\nimport type { ReleaseDto } from \"../contracts/index.js\";\nconst exec = promisify(execFile);\nexport function createLinuxRuntimeLifecycle(options: {\n  helperPath: string;\n  version: () => Promise<string | null>;\n  timeoutMs?: number;\n}): RuntimeLifecycle {\n  if (process.platform !== \"linux\")\n    throw new CpaError(\n      \"UNSUPPORTED_CAPABILITY\",\n      \"Linux runtime adapter unavailable\",\n    );\n  const invoke = async (action: \"stop\" | \"start\" | \"inspect\") => {\n    const stat = await lstat(options.helperPath);\n    if (\n      !stat.isFile() ||\n      stat.isSymbolicLink() ||\n      stat.uid !== 0 ||\n      stat.mode & 0o022\n    )\n      throw new CpaError(\n        \"INVALID_INPUT\",\n        \"Lifecycle helper must be root-owned and non-writable\",\n      );\n    for (\n      let path = dirname(resolve(options.helperPath));\n      ;\n      path = dirname(path)\n    ) {\n      const parent = await lstat(path);\n      if (\n        !parent.isDirectory() ||\n        parent.isSymbolicLink() ||\n        parent.uid !== 0 ||\n        parent.mode & 0o022\n      )\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Lifecycle helper ancestors must be root-owned and non-writable\",\n        );\n      if (path === \"/\") break;\n    }\n    try {\n      return (\n        await exec(\"/usr/bin/sudo\", [\"-n\", options.helperPath, action], {\n          timeout: options.timeoutMs ?? 30_000,\n          maxBuffer: 4096,\n          env: { PATH: \"/usr/sbin:/usr/bin:/sbin:/bin\" },\n        })\n      ).stdout.trim();\n    } catch {\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Trusted lifecycle helper failed\",\n      );\n    }\n  };\n  return {\n    stop: async () => {\n      await invoke(\"stop\");\n    },\n    start: async () => {\n      await invoke(\"start\");\n    },\n    inspect: async () => ({\n      version: await options.version(),\n      state: (await invoke(\"inspect\")) === \"active\" ? \"running\" : \"stopped\",\n    }),\n  };\n}\nexport interface ApprovedRelease {\n  id: string;\n  version: string;\n  url: string;\n  sha256: string;\n  asset: \"binary\" | \"tar.gz\";\n  binaryName?: string;\n}\nexport interface ApprovedReleaseSource {\n  discover(): Promise<ApprovedRelease[]>;\n  allowedHosts: string[];\n}\nconst versionPattern = /^v?\\d+\\.\\d+\\.\\d+(?:-[a-zA-Z0-9.-]+)?$/;\nfunction tarBinary(bytes: Buffer, name: string): Buffer {\n  const tar = gunzipSync(bytes, { maxOutputLength: 200 * 1024 * 1024 });\n  let at = 0,\n    result: Buffer | null = null,\n    count = 0;\n  while (at + 512 <= tar.length) {\n    const header = tar.subarray(at, at + 512);\n    if (header.every((b) => b === 0)) break;\n    if (++count > 1000)\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Release archive entry limit\");\n    const path = header.subarray(0, 100).toString().replace(/\\0.*$/, \"\");\n    const prefix = header.subarray(345, 500).toString().replace(/\\0.*$/, \"\");\n    const full = prefix ? `${prefix}/${path}` : path;\n    if (\n      full.includes(\"\\\\\") ||\n      full.startsWith(\"/\") ||\n      full.split(\"/\").includes(\"..\")\n    )\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Unsafe release archive path\");\n    const type = String.fromCharCode(header[156]);\n    if (![\"0\", \"\\0\", \"5\"].includes(type))\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Special archive entries forbidden\");\n    const size = parseInt(\n      header.subarray(124, 136).toString().replace(/\\0.*$/, \"\"),\n      8,\n    );\n    if (!Number.isFinite(size) || size < 0 || at + 512 + size > tar.length)\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Truncated archive\");\n    const expected = parseInt(\n      header.subarray(148, 156).toString().replace(/\\0.*$/, \"\"),\n      8,\n    );\n    let checksum = 0;\n    for (let i = 0; i < 512; i++)\n      checksum += i >= 148 && i < 156 ? 32 : header[i];\n    if (checksum !== expected)\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Archive checksum invalid\");\n    if (full === name || full === `./${name}`) {\n      if (result) throw new CpaError(\"ARCHIVE_UNSAFE\", \"Duplicate binary\");\n      result = Buffer.from(tar.subarray(at + 512, at + 512 + size));\n    }\n    at += 512 + Math.ceil(size / 512) * 512;\n  }\n  if (!result) throw new CpaError(\"ARCHIVE_UNSAFE\", \"Approved binary missing\");\n  return result;\n}\nexport function createManagedReleaseAdapter(options: {\n  root: string;\n  activePath: string;\n  source: ApprovedReleaseSource;\n  runtime: RuntimeLifecycle;\n  verify: () => Promise<void>;\n  fetch?: typeof fetch;\n  maxDownloadBytes?: number;\n}): ReleaseAdapter {\n  const root = resolve(options.root),\n    active = resolve(options.activePath);\n  if (!active.startsWith(`${root}/`))\n    throw new CpaError(\"INVALID_INPUT\", \"Runtime pointer outside managed root\");\n  let releases: ApprovedRelease[] = [];\n  const pointer = async () => {\n    const value = resolve(dirname(active), await readlink(active));\n    if (!value.startsWith(`${root}/`))\n      throw new CpaError(\"RECOVERY_REQUIRED\", \"Runtime pointer outside root\");\n    return value;\n  };\n  const versionDir = (id: string) => {\n    if (!versionPattern.test(id))\n      throw new CpaError(\"INVALID_INPUT\", \"Invalid release ID\");\n    return confined(root, id);\n  };\n  const lastGood = async (): Promise<string | null> => {\n    try {\n      return JSON.parse(\n        await readFile(join(root, \"last-good-release.json\"), \"utf8\"),\n      ).previous;\n    } catch {\n      return null;\n    }\n  };\n  const activate = async (id: string, ctx: BackendContext) => {\n    const next = versionDir(id);\n    const stat = await lstat(join(next, \"cli-proxy-api\"));\n    if (!stat.isFile() || stat.isSymbolicLink())\n      throw new CpaError(\"INVALID_INPUT\", \"Binary unavailable\");\n    const previous = await pointer();\n    await ctx.check();\n    await options.runtime.stop();\n    let switched = false;\n    try {\n      await ctx.phase(\"prepare\", {\n        previousRelease: previous,\n        nextRelease: next,\n      });\n      const tmp = join(dirname(active), `.runtime-${newId()}`);\n      await symlink(next, tmp);\n      await ctx.phase(\"switch\", {\n        previousRelease: previous,\n        nextRelease: next,\n      });\n      await rename(tmp, active);\n      switched = true;\n      await options.runtime.start();\n      await ctx.phase(\"verify\");\n      await options.verify();\n      await atomicJson(join(root, \"last-good-release.json\"), {\n        previous,\n        active: next,\n      });\n      return { activeReleaseId: id };\n    } catch (error) {\n      if (\n        switched &&\n        error instanceof CpaError &&\n        error.code === \"PROBE_QUOTA_LIMITED\"\n      ) {\n        await atomicJson(join(root, \"last-good-release.json\"), {\n          previous,\n          active: next,\n        });\n        return { activeReleaseId: id, verification: \"quota_limited\" };\n      }\n      if (switched) {\n        try {\n          await options.runtime.stop();\n          const tmp = join(dirname(active), `.runtime-${newId()}`);\n          await symlink(previous, tmp);\n          await rename(tmp, active);\n          await options.runtime.start();\n          await options.verify();\n        } catch {\n          throw new CpaError(\"RECOVERY_REQUIRED\", \"Runtime rollback failed\");\n        }\n      } else await options.runtime.start();\n      throw error;\n    }\n  };\n  return {\n    list: async () => {\n      await protectedDir(root);\n      const active = await pointer().catch(() => null),\n        last = await lastGood();\n      const items: ReleaseDto[] = [];\n      for (const id of await readdir(root)) {\n        if (!versionPattern.test(id)) continue;\n        const stat = await lstat(join(root, id));\n        if (!stat.isDirectory() || stat.isSymbolicLink()) continue;\n        items.push({\n          id,\n          version: id,\n          installed: true,\n          active: active === join(root, id),\n          lastKnownGood: last === join(root, id),\n          installedAt: stat.birthtime.toISOString(),\n        });\n      }\n      for (const r of releases)\n        if (!items.some((i) => i.id === r.id))\n          items.push({\n            id: r.id,\n            version: r.version,\n            installed: false,\n            active: false,\n            lastKnownGood: false,\n            installedAt: null,\n          });\n      return items;\n    },\n    discover: async () => {\n      const found = await options.source.discover();\n      for (const r of found) {\n        const url = new URL(r.url);\n        if (\n          !versionPattern.test(r.id) ||\n          !versionPattern.test(r.version) ||\n          !/^([a-f0-9]{64})$/i.test(r.sha256) ||\n          url.protocol !== \"https:\" ||\n          !options.source.allowedHosts.includes(url.hostname) ||\n          url.username ||\n          url.password\n        )\n          throw new CpaError(\"INVALID_INPUT\", \"Unapproved release metadata\");\n      }\n      releases = found;\n      return { count: releases.length };\n    },\n    install: async (id, ctx) => {\n      if (!releases.length) releases = await options.source.discover();\n      const r = releases.find((r) => r.id === id);\n      if (!r)\n        throw new CpaError(\"INVALID_INPUT\", \"Release not in approved catalog\");\n      const final = versionDir(id);\n      try {\n        await lstat(final);\n        return { installedReleaseId: id, reused: true };\n      } catch (e) {\n        if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n      }\n      await protectedDir(root);\n      await ctx.check();\n      await ctx.phase(\"prepare\", { installReleaseId: id });\n      let downloadUrl = r.url;\n      let response: Response | null = null;\n      const timeout = AbortSignal.timeout(60_000);\n      for (let redirects = 0; redirects <= 3; redirects++) {\n        const url = new URL(downloadUrl);\n        if (\n          url.protocol !== \"https:\" ||\n          !options.source.allowedHosts.includes(url.hostname) ||\n          url.username ||\n          url.password\n        )\n          throw new CpaError(\n            \"INVALID_INPUT\",\n            \"Release redirected outside approved hosts\",\n          );\n        response = await (options.fetch ?? fetch)(downloadUrl, {\n          redirect: \"manual\",\n          signal: timeout,\n        });\n        if (![301, 302, 303, 307, 308].includes(response.status)) break;\n        const location = response.headers.get(\"location\");\n        if (!location || redirects === 3)\n          throw new CpaError(\n            \"MANAGEMENT_UNAVAILABLE\",\n            \"Release redirect limit exceeded\",\n          );\n        downloadUrl = new URL(location, downloadUrl).toString();\n      }\n      if (!response)\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Release download unavailable\",\n        );\n      if (!response.ok || !response.body)\n        throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Release download failed\");\n      const reader = response.body.getReader(),\n        chunks: Buffer[] = [];\n      let size = 0;\n      for (;;) {\n        const chunk = await reader.read();\n        if (chunk.done) break;\n        size += chunk.value.length;\n        if (size > (options.maxDownloadBytes ?? 50 * 1024 * 1024)) {\n          await reader.cancel();\n          throw new CpaError(\"UPLOAD_LIMIT\", \"Release exceeds limit\");\n        }\n        chunks.push(Buffer.from(chunk.value));\n      }\n      const bytes = Buffer.concat(chunks);\n      if (\n        createHash(\"sha256\").update(bytes).digest(\"hex\") !==\n        r.sha256.toLowerCase()\n      )\n        throw new CpaError(\"INVALID_INPUT\", \"Release checksum mismatch\");\n      const binary =\n        r.asset === \"tar.gz\"\n          ? tarBinary(bytes, r.binaryName ?? \"cli-proxy-api\")\n          : bytes;\n      const candidate = join(root, `.candidate-${newId()}`);\n      await protectedDir(candidate);\n      try {\n        const binaryPath = join(candidate, \"cli-proxy-api\");\n        await writeFile(binaryPath, binary, { mode: 0o700, flag: \"wx\" });\n        let version: string;\n        try {\n          version = (\n            await exec(binaryPath, [\"-h\"], {\n              cwd: candidate,\n              timeout: 15_000,\n              maxBuffer: 8192,\n              env: { PATH: \"/usr/bin:/bin\", HOME: candidate },\n            })\n          ).stdout;\n        } catch {\n          throw new CpaError(\n            \"PROBE_FAILED\",\n            \"Candidate structural check failed\",\n          );\n        }\n        if (!version.includes(r.version.replace(/^v/, \"\")))\n          throw new CpaError(\"PROBE_FAILED\", \"Candidate version mismatch\");\n        await atomicJson(join(candidate, \"manifest.json\"), {\n          releaseId: id,\n          sha256: r.sha256,\n        });\n        await ctx.check();\n        await rename(candidate, final);\n        return { installedReleaseId: id };\n      } finally {\n        await rm(candidate, { recursive: true, force: true });\n      }\n    },\n    activate,\n    delete: async (id) => {\n      const target = versionDir(id);\n      if (target === (await pointer()) || target === (await lastGood()))\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Active or recovery release cannot be deleted\",\n        );\n      await rm(target, { recursive: true, force: true });\n      return { deletedReleaseId: id };\n    },\n    rollback: async (id, ctx) => {\n      if (versionDir(id) !== (await lastGood()))\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Rollback must use last-known-good release\",\n        );\n      return activate(id, ctx);\n    },\n    recover: async (state) => {\n      if (\n        typeof state.previousRelease !== \"string\" ||\n        typeof state.nextRelease !== \"string\"\n      )\n        return \"unknown\";\n      try {\n        const current = await pointer();\n        if (current !== state.previousRelease && current !== state.nextRelease)\n          return \"unknown\";\n        await options.runtime.start();\n        await options.verify();\n        return current === state.nextRelease ? \"verified\" : \"rolled_back\";\n      } catch {\n        return \"unknown\";\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;AAAA,SAAS,YAAY,kBAAkB;AACvC,SAAS,OAAO,OAAO,OAAO,MAAM,QAAQ,cAAc;AAC1D,SAAS,SAAS,eAAe;AACjC,SAAS,aAAa;AAEf,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YACS,MACP,SACO,YAAY,OACZ,UAAyB,MAChC;AACA,UAAM,QAAQ,MAAM,GAAG,GAAG,CAAC;AALpB;AAEA;AACA;AAAA,EAGT;AACF;AACO,SAAS,UACd,OACA,cAA6B,MACnB;AACV,SAAO,iBAAiB,WACpB;AAAA,IACE,MAAM,MAAM;AAAA,IACZ,SAAS,WAAW,MAAM,OAAO;AAAA,IACjC,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf;AAAA,EACF,IACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,SAAS;AAAA,IACT;AAAA,EACF;AACN;AACO,SAAS,WAAW,MAAc;AACvC,SAAO,KACJ,QAAQ,iCAAiC,YAAY,EACrD,QAAQ,2CAA2C,YAAY,EAC/D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,MAAM,GAAG,GAAG;AACjB;AACO,SAAS,WACd,OACyB;AACzB,QAAM,QAAQ,CAAC,MAAwB;AACrC,QAAI,OAAO,MAAM,SAAU,QAAO,WAAW,CAAC;AAC9C,QAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,MAAM,GAAG,GAAI,EAAE,IAAI,KAAK;AACvD,QAAI,KAAK,OAAO,MAAM;AACpB,aAAO,OAAO;AAAA,QACZ,OAAO,QAAQ,CAAC,EACb;AAAA,UACC,CAAC,CAAC,CAAC,MACD,CAAC,sEAAsE;AAAA,YACrE;AAAA,UACF;AAAA,QACJ,EACC,MAAM,GAAG,GAAI,EACb,IAAI,CAAC,CAAC,GAAGA,EAAC,MAAM,CAAC,GAAG,MAAMA,EAAC,CAAC,CAAC;AAAA,MAClC;AACF,WAAO;AAAA,EACT;AACA,SAAO,MAAM,KAAK;AACpB;AACO,SAAS,UAAU,OAAwB;AAChD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,SAAS,EAAE,KAAK,GAAG,CAAC;AACnE,MAAI,SAAS,OAAO,UAAU;AAC5B,WAAO,IAAI,OAAO,QAAQ,KAAK,EAC5B,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,EACtD,KAAK,GAAG,CAAC;AACd,SAAO,KAAK,UAAU,KAAK,KAAK;AAClC;AACO,IAAM,OAAO,CAAC,UACnB,WAAW,QAAQ,EAChB,OAAO,OAAO,UAAU,WAAW,QAAQ,UAAU,KAAK,CAAC,EAC3D,OAAO,KAAK;AACV,IAAM,QAAQ,MAAM,WAAW;AAC/B,SAAS,SAAS,MAAc,MAAc;AACnD,MAAI,CAAC,oBAAoB,KAAK,IAAI,KAAK,SAAS,OAAO,SAAS;AAC9D,UAAM,IAAI,SAAS,iBAAiB,6BAA6B;AACnE,QAAM,OAAO,QAAQ,MAAM,IAAI;AAC/B,MAAI,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAChC,UAAM,IAAI,SAAS,iBAAiB,6BAA6B;AACnE,SAAO;AACT;AACA,eAAsB,aAAa,MAAc;AAC/C,QAAM,MAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAM,OAAO,MAAM,MAAM,IAAI;AAC7B,MAAI,KAAK,eAAe,KAAK,CAAC,KAAK,YAAY;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACF,QAAM,MAAM,MAAM,GAAK;AACzB;AACA,eAAsB,WAAW,MAAc,OAAgB;AAC7D,QAAM,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC;AAC/B,QAAM,SAAS,MAAM,KAAK,MAAM,MAAM,GAAK;AAC3C,MAAI;AACF,UAAM,OAAO,UAAU,KAAK,UAAU,KAAK,CAAC;AAC5C,UAAM,OAAO,KAAK;AAAA,EACpB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI;AACvB,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAG;AACzC,QAAI;AACF,YAAM,IAAI,KAAK;AAAA,IACjB,UAAE;AACA,YAAM,IAAI,MAAM;AAAA,IAClB;AAAA,EACF,SAAS,OAAO;AACd,UAAM,OAAO,IAAI,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjC,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,OACpB,MACA,YAAY,KACZ,UAAoC,CAAC,GACP;AAC9B,QAAM,OAAO,QAAQ,QAAQ;AAC7B,MAAI,SAAS,OAAS,SAAS;AAC7B,UAAM,IAAI,SAAS,YAAY,0BAA0B;AAC3D,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,IAAI;AAAA,IACb;AAAA,IACA;AAAA,MACE,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAC9B,KAAK;AAAA,QACH,MAAM;AAAA,QACN,kBAAkB;AAAA,QAClB,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI,QAAc,CAAC,MAAM,WAAW;AACxC,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,KAAK,SAAS;AACpB,aAAO,IAAI,SAAS,iBAAiB,2BAA2B,IAAI,CAAC;AAAA,IACvE,GAAG,SAAS;AACZ,UAAM,OAAO,KAAK,QAAQ,MAAM;AAC9B,mBAAa,KAAK;AAClB,WAAK;AAAA,IACP,CAAC;AACD,UAAM,KAAK,SAAS,MAAM;AACxB,mBAAa,KAAK;AAClB,aAAO,IAAI,SAAS,YAAY,+BAA+B,CAAC;AAAA,IAClE,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,SAAS;AAC3B,mBAAa,KAAK;AAClB,UAAI,SAAS;AACX,eAAO,IAAI,SAAS,YAAY,0BAA0B,CAAC;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACD,SAAO,YAAY;AACjB,UAAM,IAAI,QAAc,CAAC,SAAS;AAChC,UAAI,MAAM,aAAa,MAAM;AAC3B,aAAK;AACL;AAAA,MACF;AACA,YAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;AAC/B,YAAM,MAAM,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;;;AChLA,SAAS,gBAAgB;AACzB,SAAS,YAAY;AA4Cd,SAAS,uBAAuB,SAIpB;AACjB,QAAM,MAAM,QAAQ,SAAS,KAAK;AAClC,QAAM,OAAO,KAAK,QAAQ,MAAM,cAAc;AAC9C,QAAM,cAAc,OAClB,IACA,QAAQ,SACO;AACf,UAAM,aAAa,QAAQ,IAAI;AAC/B,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK,QAAQ,MAAM,cAAc;AAAA,MACjC,QAAQ;AAAA,IACV;AACA,QAAI;AACF,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAC3C,YACE,EAAE,YAAY,KACd,CAAC,OAAO,cAAc,EAAE,KAAK,KAC7B,CAAC,EAAE,cACH,CAAC,EAAE;AAEH,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,MACJ,SAAS,GAAG;AACV,YAAK,EAA4B,SAAS;AACxC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,YAAI,EAAE,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC,EAAE;AAAA,MACvD;AACA,YAAM,SAAS,MAAM,GAAG,CAAC;AACzB,UAAI,MAAO,OAAM,WAAW,MAAM,CAAC;AACnC,aAAO;AAAA,IACT,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,CAAC,SAAS,UAChB,YAAY,CAAC,MAAM;AACjB,YAAM,MAAM,KAAK;AAAA,QACf,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,cAAc,KAAK,OAAO;AAChC,YAAM,WAAW,EAAE,KAAK,GAAG;AAC3B,UAAI,UAAU;AACZ,YAAI,SAAS;AACX,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,YAAI,SAAS,SAAS;AACpB,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,cAAM,KAAK,EAAE,WAAW,SAAS,EAAE;AACnC,YAAI,CAAC;AACH,gBAAM,IAAI,SAAS,qBAAqB,0BAA0B;AACpE,eAAO,EAAE,WAAW,IAAI,QAAQ,KAAK;AAAA,MACvC;AACA,YAAM,OAAO,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AACzC,YAAM,KAAK,MAAM;AACjB,YAAM,YAA6B;AAAA,QACjC,KAAK;AAAA,UACH,YAAY;AAAA,UACZ,YAAY,QAAQ;AAAA,UACpB;AAAA,UACA,MAAM,QAAQ;AAAA,UACd,SAAS,MAAM;AAAA,UACf,OAAO;AAAA,UACP,OAAO;AAAA,UACP,UAAU,EAAE,WAAW,GAAG,OAAO,KAAK;AAAA,UACtC,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,UACX,YAAY;AAAA,UACZ,UAAU;AAAA,UACV,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,qBAAqB;AAAA,UACrB,iBAAiB;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,EAAE,EAAE;AAAA,QACX,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,cAAc,CAAC;AAAA,MACjB;AACA,QAAE,WAAW,EAAE,IAAI;AACnB,QAAE,KAAK,GAAG,IAAI;AAAA,QACZ;AAAA,QACA,MAAM;AAAA,QACN,WAAW,IAAI;AAAA,QACf,SAAS;AAAA,MACX;AACA,aAAO,EAAE,WAAW,QAAQ,MAAM;AAAA,IACpC,CAAC;AAAA,IACH,KAAK,CAAC,OACJ;AAAA,MACE,CAAC,MAAO,OAAO,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;AAAA,MAC7D;AAAA,IACF;AAAA,IACF,MAAM,MAAM,YAAY,CAAC,MAAM,OAAO,OAAO,EAAE,UAAU,GAAG,KAAK;AAAA,IACjE,QAAQ,CAAC,IAAI,UAAU,OACrB,YAAY,CAAC,MAAM;AACjB,YAAM,YAAY,EAAE,WAAW,EAAE;AACjC,UAAI,CAAC;AACH,cAAM,IAAI,SAAS,iBAAiB,0BAA0B;AAChE,UAAI,UAAU,IAAI,aAAa;AAC7B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACF,YAAM,SAAS,UAAU,IAAI;AAC7B,SAAG,SAAS;AACZ,UAAI,WAAW,YAAY,UAAU,IAAI,UAAU;AACjD,kBAAU,QAAQ,EAAE,EAAE;AACxB,gBAAU,IAAI;AACd,gBAAU,IAAI,YAAY,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AACtD,aAAO;AAAA,IACT,CAAC;AAAA,IACH,QAAQ,OAAO,WAAW;AACxB,YAAM,aAAa,QAAQ,IAAI;AAC/B,YAAM,UAAU,MAAM;AAAA,QACpB,KAAK,QAAQ,MAAM,aAAa;AAAA,QAChC,QAAQ;AAAA,MACV;AACA,UAAI;AACF,eAAO,MAAM,OAAO;AAAA,MACtB,UAAE;AACA,cAAM,QAAQ;AAAA,MAChB;AAAA,IACF;AAAA,IACA,MAAM,CAAC,KAAK,IAAI,MACd,YAAY,CAAC,MAAM;AACjB,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,EAAE,IAAI,GAAG;AACjD,YAAI,MAAM,WAAW,KAAK,MAAM,YAAY,KAAK,OAAW;AAC1D,iBAAO,EAAE,KAAK,GAAG;AACjB;AAAA,QACF;AACA,cAAM,KAAK,EAAE,WAAW,MAAM,EAAE;AAChC,YACE,MACG,IAAI,IAAI,aACL,KAAK,MAAM,GAAG,IAAI,UAAU,IAC5B,MAAM,aACV,KAAK,SACP,MACA,CAAC,aAAa,UAAU,aAAa,mBAAmB,EAAE;AAAA,UACxD,GAAG,IAAI;AAAA,QACT,GACA;AACA,iBAAO,EAAE,WAAW,MAAM,EAAE;AAC5B,gBAAM,UAAU;AAChB,gBAAM,YAAY,KAAK,KAAK;AAAA,QAC9B;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACL;AACF;;;AC1NA;AAAA,EACE,YAAAC;AAAA,EAEA;AAAA,EACA,SAAAC;AAAA,EACA,UAAAC;AAAA,OAGK;AACP,SAAS,QAAAC,aAAY;AACrB,YAAY,WAAW;AAoChB,IAAM,gBAAgB;AAAA,EAC3B,aAAa,KAAK,OAAO;AAAA,EACzB,SAAS;AAAA,EACT,WAAW,OAAO;AAAA,EAClB,eAAe,KAAK,OAAO;AAAA,EAC3B,eAAe,MAAM,OAAO;AAAA,EAC5B,OAAO;AAAA,EACP,SAAS;AACX;AAEA,IAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACM,SAAS,gBACd,MACA,SAAS,eACU;AACnB,MAAI,KAAK,aAAa,OAAO;AAC3B,UAAM,IAAI,SAAS,gBAAgB,+BAA+B;AACpE,MAAI;AACJ,MAAI;AACF,QAAI,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI;AAChE,QAAI,KAAK,WAAW,CAAC,MAAM,MAAQ,QAAO,KAAK,MAAM,CAAC;AACtD,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,QAAM,MAAM;AACZ,QAAM,WACJ,OAAO,IAAI,SAAS,WAAW,IAAI,KAAK,KAAK,EAAE,YAAY,IAAI;AACjE,MACE,CAAC,UAAU,IAAI,QAAQ,KACvB,OAAO,IAAI,iBAAiB,YAC5B,CAAC,IAAI,gBACL,OAAO,IAAI,kBAAkB,YAC7B,CAAC,IAAI;AAEL,WAAO;AACT,QAAM,UACJ,OAAO,IAAI,eAAe,WACtB,IAAI,WAAW,KAAK,IACpB,OAAO,IAAI,UAAU,WACnB,IAAI,MAAM,KAAK,EAAE,YAAY,IAC7B;AACR,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO;AAAA,IACL,IAAI,KAAK,GAAG,QAAQ,IAAI,OAAO,EAAE;AAAA,IACjC;AAAA,IACA,MAAM;AAAA,IACN,QAAQ,KAAK,GAAG;AAAA,EAClB;AACF;AACA,SAAS,gBAAgB,MAAc;AACrC,MACE,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,KAAK,WAAW,GAAG,KACnB,aAAa,KAAK,IAAI,KACtB,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,SAAS,GAAG;AAE5D,UAAM,IAAI,SAAS,kBAAkB,qBAAqB;AAC5D,SAAO,KAAK,QAAQ,OAAO,EAAE;AAC/B;AACA,SAAS,SAAS,MAAc;AAC9B,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,MAAM,SAAS,UAAU,KAAK,MAAM,GAAG,EAAE,MAAM,YAAa,QAAO;AACvE,SACE,KAAK,YAAY,EAAE,SAAS,OAAO,MAClC,MAAM,WAAW,KAChB,MAAM,WAAW,KAChB,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAE1C;AACA,eAAsB,YACpB,OACA,SAAuB,eACvB,kBAAyC,YAKxC;AACD,MACE,MAAM,SAAS,OAAO,WACtB,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,OAAO;AAE1D,UAAM,IAAI,SAAS,gBAAgB,sBAAsB;AAC3D,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,UAAU,GACZ,WAAW,GACX,WAAW,GACX,UAAU;AACZ,QAAM,WAAW,KAAK,IAAI,IAAI,OAAO;AACrC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,UAAkC,CAAC;AACzC,QAAM,UAAU,CAAC,MAAc,SAAqB;AAClD,QAAI,KAAK,IAAI,IAAI;AACf,YAAM,IAAI,SAAS,gBAAgB,kCAAkC;AACvE,QAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AACA,cAAQ,WAAW,QAAQ,WAAW,KAAK;AAC3C;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,MAAM,SAAS,EAAG,UAAS,IAAI,MAAM,CAAC,CAAC;AAC3C,QAAI,SAAS,OAAO;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,UAAM,aAAa,gBAAgB,MAAM,MAAM;AAC/C,QAAI,CAAC,YAAY;AACf;AACA,cAAQ,qBAAqB,QAAQ,qBAAqB,KAAK;AAC/D;AAAA,IACF;AACA,UAAM,WAAW,YAAY,IAAI,WAAW,EAAE;AAC9C,QAAI,YAAY,SAAS,WAAW,WAAW;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,QAAI,UAAU;AACZ,UAAI,oBAAoB;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF;AACA,cAAQ,aAAa,QAAQ,aAAa,KAAK;AAC/C;AAAA,IACF;AACA,gBAAY,KAAK;AACjB,QAAI,WAAW,OAAO;AACpB,YAAM,IAAI,SAAS,gBAAgB,mCAAmC;AACxE,gBAAY,IAAI,WAAW,IAAI,UAAU;AAAA,EAC3C;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,KAAK,CAAC,MAAM,MAAQ,KAAK,KAAK,CAAC,MAAM,IAAM;AAClD,YAAM,IAAI,QAAc,CAACC,UAAS,WAAW;AAC3C,QAAM;AAAA,UACJ,OAAO,KAAK,KAAK,IAAI;AAAA,UACrB;AAAA,YACE,aAAa;AAAA,YACb,oBAAoB;AAAA,YACpB,iBAAiB;AAAA,UACnB;AAAA,UACA,CAAC,OAAO,QAAQ;AACd,gBAAI,SAAS,CAAC,KAAK;AACjB,qBAAO,IAAI,SAAS,kBAAkB,qBAAqB,CAAC;AAC5D;AAAA,YACF;AACA,gBAAI,WAAW;AACf,kBAAM,OAAO,CAAC,MAAe;AAC3B,kBAAI,MAAM;AACV;AAAA,gBACE,aAAa,WACT,IACA,IAAI;AAAA,kBACF;AAAA,kBACA;AAAA,gBACF;AAAA,cACN;AAAA,YACF;AACA,gBAAI,GAAG,SAAS,IAAI;AACpB,gBAAI,GAAG,OAAOA,QAAO;AACrB,gBAAI,GAAG,SAAS,CAAC,UAAuB;AACtC,kBAAI;AACF,oBAAI,EAAE,UAAU,OAAO;AACrB,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,sBAAM,OAAO,gBAAgB,MAAM,QAAQ;AAC3C,oBAAI,MAAM,IAAI,IAAI;AAChB,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,sBAAM,IAAI,IAAI;AACd,sBAAM,OAAQ,MAAM,2BAA2B,KAAM;AACrD,oBACE,CAAC,OAAQ,MAAQ,OAAQ,MAAQ,KAAM,EAAE,SAAS,IAAI,KACtD,MAAM,wBAAwB;AAE9B,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,4BAAY,MAAM;AAClB,oBACE,WAAW,OAAO,iBAClB,MAAM,mBACJ,KAAK,IAAI,GAAG,MAAM,cAAc,IAAI,OAAO;AAE7C,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,oBAAI,MAAM,SAAS,SAAS,GAAG,GAAG;AAChC,sBAAI,UAAU;AACd;AAAA,gBACF;AACA,oBAAI,eAAe,OAAO,CAAC,KAAK,WAAW;AACzC,sBAAI,OAAO,CAAC,QAAQ;AAClB,yBAAK,GAAG;AACR;AAAA,kBACF;AACA,wBAAM,SAAmB,CAAC;AAC1B,sBAAI,OAAO;AACX,sBAAI,MAAM;AACV,yBAAO,GAAG,QAAQ,CAAC,UAAkB;AACnC,+BAAW,QAAQ,OAAO;AACxB,6BAAO;AACP,+BAAS,IAAI,GAAG,IAAI,GAAG;AACrB,8BAAO,QAAQ,KAAM,MAAM,IAAI,aAAa;AAAA,oBAChD;AACA,4BAAQ,MAAM;AACd,gCAAY,MAAM;AAClB,wBACE,WAAW,OAAO,iBAClB,KAAK,IAAI,IAAI,YACZ,SAAS,IAAI,KAAK,OAAO,OAAO,WACjC;AACA,6BAAO;AAAA,wBACL,IAAI;AAAA,0BACF;AAAA,0BACA;AAAA,wBACF;AAAA,sBACF;AACA;AAAA,oBACF;AACA,wBAAI,SAAS,IAAI,EAAG,QAAO,KAAK,KAAK;AAAA,kBACvC,CAAC;AACD,yBAAO,GAAG,SAAS,IAAI;AACvB,yBAAO,GAAG,OAAO,MAAM;AACrB,wBAAI;AACF,2BAAK,MAAM,gBAAgB,MAAM,MAAM;AACrC,8BAAM,IAAI;AAAA,0BACR;AAAA,0BACA;AAAA,wBACF;AACF,8BAAQ,MAAM,OAAO,OAAO,MAAM,CAAC;AACnC,0BAAI,UAAU;AAAA,oBAChB,SAAS,GAAG;AACV,2BAAK,CAAC;AAAA,oBACR;AAAA,kBACF,CAAC;AAAA,gBACH,CAAC;AAAA,cACH,SAAS,GAAG;AACV,qBAAK,CAAC;AAAA,cACR;AAAA,YACF,CAAC;AACD,gBAAI,UAAU;AAAA,UAChB;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,OAAO;AACL;AACA,YAAM,OAAO,gBAAgB,KAAK,IAAI;AACtC,UAAI,MAAM,IAAI,IAAI;AAChB,cAAM,IAAI,SAAS,kBAAkB,qBAAqB;AAC5D,YAAM,IAAI,IAAI;AACd,kBAAY,KAAK,KAAK;AACtB,cAAQ,KAAK,SAAS,GAAG,IAAI,OAAO,GAAG,IAAI,SAAS,KAAK,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,SAAS,sBAAsB,gCAAgC;AAC3E,SAAO,EAAE,aAAa,CAAC,GAAG,YAAY,OAAO,CAAC,GAAG,SAAS,QAAQ;AACpE;AAsBO,SAAS,qBAAqB,SAKpB;AACf,QAAM,MAAM,QAAQ,SAAS,KAAK,KAChC,SAAS,QAAQ,UAAU;AAC7B,QAAM,gBAAgB,CAAC,OACrB,SAAS,QAAQ,MAAM,GAAG,EAAE,iBAAiB;AAC/C,SAAO;AAAA,IACL,QAAQ,OAAO,OAAO,SAAS,eAAe;AAC5C,YAAM,aAAa,QAAQ,IAAI;AAC/B,UACE,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,OAAO,eAC1D,MAAM,SAAS,OAAO;AAEtB,cAAM,IAAI,SAAS,gBAAgB,sBAAsB;AAC3D,YAAM,KAAK,MAAM;AACjB,YAAM,WAAW,SAAS,QAAQ,MAAM,GAAG,EAAE,cAAc,GAAG;AAAA,QAC5D;AAAA,QACA;AAAA,QACA,WAAW,IAAI,IAAI;AAAA,QACnB,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,UACvB,MAAM,EAAE;AAAA,UACR,MAAM,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,QAAQ;AAAA,QAC7C,EAAE;AAAA,MACJ,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,OAAO,OAAO,IAAI,SAAS,eAAe;AACxC,YAAM,OAAO,SAAS,QAAQ,MAAM,GAAG,EAAE,cAAc;AACvD,UAAI;AAMJ,UAAI;AACF,iBAAS,KAAK,MAAM,MAAMC,UAAS,MAAM,MAAM,CAAC;AAAA,MAClD,QAAQ;AACN,cAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAAA,MAC1D;AACA,UAAI,OAAO,YAAY,WAAW,OAAO,eAAe;AACtD,cAAM,IAAI,SAAS,kBAAkB,iCAAiC;AACxE,UAAI;AACF,YAAI,OAAO,YAAY,IAAI;AACzB,gBAAM,IAAI,SAAS,eAAe,gBAAgB;AACpD,cAAM,WAAW,MAAM;AAAA,UACrB,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,YACvB,MAAM,EAAE;AAAA,YACR,MAAM,OAAO,KAAK,EAAE,MAAM,QAAQ;AAAA,UACpC,EAAE;AAAA,UACF;AAAA,UACA,QAAQ,mBAAmB;AAAA,QAC7B;AACA,cAAM,YAAuB;AAAA,UAC3B,GAAG;AAAA,UACH,IAAI,MAAM;AAAA,UACV;AAAA,UACA;AAAA,UACA,WAAW,IAAI;AAAA,UACf,WAAW,IAAI,IAAI;AAAA,QACrB;AACA,cAAM,WAAW,cAAc,UAAU,EAAE,GAAG,SAAS;AACvD,eAAO;AAAA,MACT,UAAE;AACA,cAAMC,QAAO,IAAI,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,KAAK,OAAO,IAAI,SAAS,YAAY,UAAU;AAC7C,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,MAAM,MAAMD,UAAS,cAAc,EAAE,GAAG,MAAM,CAAC;AAAA,MAC1D,QAAQ;AACN,cAAM,IAAI,SAAS,iBAAiB,uBAAuB;AAAA,MAC7D;AACA,UAAI,EAAE,eAAe,cAAe,EAAE,YAAY,WAAW,CAAC;AAC5D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,EAAE,YAAY,IAAI;AACpB,cAAM,IAAI,SAAS,eAAe,mBAAmB;AACvD,aAAO;AAAA,IACT;AAAA,IACA,MAAM,CAAC,MAAM,WAAW,cAAc,EAAE,EAAE,GAAG,CAAC;AAAA,IAC9C,QAAQ,OAAO,OAAO;AACpB,YAAMC,QAAO,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM;AAC3C,YAAI,EAAE,SAAS,SAAU,OAAM;AAAA,MACjC,CAAC;AAAA,IACH;AAAA,IACA,MAAM,OAAO,iBAAiB;AAC5B,YAAM,aAAa,QAAQ,IAAI;AAC/B,iBAAW,QAAQ,MAAM,QAAQ,QAAQ,IAAI,GAAG;AAC9C,YAAI,CAAC,qCAAqC,KAAK,IAAI,EAAG;AACtD,cAAM,KAAK,KAAK,MAAM,GAAG,EAAE,CAAC;AAC5B,YAAI,aAAa,IAAI,EAAE,EAAG;AAC1B,cAAM,OAAO,SAAS,QAAQ,MAAM,IAAI;AACxC,YAAI;AACF,gBAAM,QAAQ,KAAK,MAAM,MAAMD,UAAS,MAAM,MAAM,CAAC;AACrD,cAAI,MAAM,YAAY,IAAI,EAAG,OAAMC,QAAO,IAAI;AAAA,QAChD,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,wBACpB,MACA,SAAS,eACc;AACvB,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ,GACV,QAAQ;AACV,QAAM,QAAQ,OAAO,MAAc,QAAgB,UAAkB;AACnE,eAAW,QAAQ,MAAM,QAAQ,IAAI,GAAG;AACtC,UAAI,EAAE,QAAQ,OAAO;AACnB,cAAM,IAAI,SAAS,gBAAgB,gCAAgC;AACrE,YAAM,OAAOC,MAAK,MAAM,IAAI,GAC1B,OAAO,MAAMC,OAAM,IAAI;AACzB,UAAI,KAAK,eAAe,KAAM,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,OAAO;AAChE,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,KAAK,YAAY,GAAG;AACtB,YAAI,QAAQ,KAAK,SAAS;AACxB,gBAAM,MAAM,MAAM,GAAG,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;AAClD;AAAA,MACF;AACA,UAAI,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,EAAE,EAAG;AACnC,UAAI,KAAK,OAAO,OAAO;AACrB,cAAM,IAAI,SAAS,gBAAgB,+BAA+B;AACpE,eAAS,KAAK;AACd,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAI,SAAS,gBAAgB,gCAAgC;AACrE,aAAO,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,IAAI,MAAM,MAAMH,UAAS,IAAI,EAAE,CAAC;AAAA,IACtE;AAAA,EACF;AACA,QAAM,WAAW,MAAMG,OAAM,IAAI;AACjC,MAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY;AACrD,UAAM,IAAI,SAAS,kBAAkB,mCAAmC;AAC1E,QAAM,MAAM,MAAM,IAAI,CAAC;AACvB,SAAO;AACT;;;AC5eA;AAAA,EACE,YAAAC;AAAA,EACA,WAAAC;AAAA,EACA,SAAAC;AAAA,EAGA;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EAGA,QAAAC;AAAA,OACK;AACP,SAAS,QAAAC,OAAM,WAAAC,UAAS,WAAAC,gBAAe;AA+ChC,SAAS,wBAAiC;AAC/C,QAAM,cAAc,YAA4B;AAC9C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,MACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,IAAI,CAAC,SAAS;AAAA,QACd;AAAA,QACA,EAAE,SAAS,OAAO,YAAY,yBAAyB;AAAA,MACzD,CAAC;AAAA,IACH;AAAA,IACA,wBAAwB;AAAA,IACxB,UAAU,aAAa,EAAE,UAAU,KAAK,WAAW,GAAG,aAAa,CAAC,EAAE;AAAA,IACtE,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,YAAY;AAAA,EACvB;AACF;AACO,SAAS,uBAAuB,SAKpC;AACD,QAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,MACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI;AAEJ,UAAM,IAAI,SAAS,iBAAiB,+BAA+B;AACrE,SAAO,YAAY;AACjB,QAAI;AACJ,QAAI;AACF,iBAAW,OAAO,QAAQ,SAAS;AAAA,QACjC,GAAG,QAAQ,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAAA,QACrC;AAAA,UACE,SAAS,EAAE,eAAe,UAAU,MAAM,QAAQ,OAAO,CAAC,GAAG;AAAA,UAC7D,UAAU;AAAA,UACV,QAAQ,YAAY,QAAQ,QAAQ,aAAa,GAAM;AAAA,QACzD;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,MACrB;AACF,QAAI,QAAQ;AACZ,UAAM,SAAuB,CAAC;AAC9B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,SAAS,0BAA0B,2BAA2B;AAC1E,qBAAiB,SAAS,SAAS,MAA8C;AAC/E,eAAS,MAAM;AACf,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAI,SAAS,gBAAgB,6BAA6B;AAClE,aAAO,KAAK,KAAK;AAAA,IACnB;AACA,QAAI;AACJ,QAAI;AACF,aAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAAA,IAC1D,QAAQ;AACN,YAAM,IAAI,SAAS,0BAA0B,uBAAuB;AAAA,IACtE;AACA,QAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,KAAK,KAAK,SAAS;AAClD,YAAM,IAAI,SAAS,0BAA0B,uBAAuB;AACtE,WAAO,KAAK,KAAK,IAAI,CAAC,MAAM;AAC1B,UAAI,OAAO,EAAE,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS;AACrD,cAAM,IAAI,SAAS,0BAA0B,kBAAkB;AACjE,aAAO,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,EAAc;AAAA,IAClD,CAAC;AAAA,EACH;AACF;AACA,IAAM,MAAM,CAAC,OAAkC;AAAA,EAC7C,IAAI,EAAE;AAAA,EACN,UAAU,EAAE;AAAA,EACZ,aAAa,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAI,EAAE,GAAG,MAAM,EAAE,CAAC;AAAA,EAClD,WAAW,EAAE,KAAK,aAAa,OAAO,aAAa;AAAA,EACnD,WACE,OAAO,EAAE,KAAK,iBAAiB,YAC/B,OAAO,SAAS,KAAK,MAAM,EAAE,KAAK,YAAY,CAAC,IAC3C,IAAI,KAAK,EAAE,KAAK,YAAY,EAAE,YAAY,IAC1C;AACR;AACO,SAAS,yBAAyB,SAM7B;AACV,QAAM,OAAOC,SAAQ,QAAQ,IAAI,GAC/B,SAASA,SAAQ,QAAQ,UAAU;AACrC,MAAI,CAAC,OAAO,WAAW,GAAG,IAAI,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACF,QAAM,UAAU,YAAY;AAC1B,QAAI;AACJ,QAAI;AACF,YAAM,OAAO,MAAMC,OAAM,MAAM;AAC/B,UAAI,KAAK,eAAe,GAAG;AACzB,eAAOD,SAAQE,SAAQ,MAAM,GAAG,MAAM,SAAS,MAAM,CAAC;AACtD,YAAI,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG;AAC7B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,MACJ,WAAW,KAAK,YAAY,EAAG,QAAO;AAAA,UACjC,OAAM,IAAI,MAAM;AAAA,IACvB,SAAS,GAAG;AACV,UAAI,aAAa,SAAU,OAAM;AACjC,YAAM,IAAI,SAAS,qBAAqB,yBAAyB;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,YAAY;AACvB,UAAM,OAAO,MAAM,QAAQ,GACzB,QAAsB,CAAC;AACzB,UAAM,MAA8B,CAAC;AACrC,UAAM,SAAwD,CAAC;AAC/D,eAAW,SAAS,MAAMC,SAAQ,IAAI,GAAG,KAAK,GAAG;AAC/C,UAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAC7B,YAAM,OAAO,MAAMF,OAAMG,MAAK,MAAM,IAAI,CAAC;AACzC,UAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe;AACxC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,QAAQ,MAAMC,UAASD,MAAK,MAAM,IAAI,CAAC;AAC7C,UAAI,IAAI,IAAI,KAAK,MAAM,SAAS,QAAQ,CAAC;AACzC,YAAM,IAAI,gBAAgB,KAAK;AAC/B,UAAI,GAAG;AACL,YAAI,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,EAAE;AACvC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,cAAM,KAAK,CAAC;AAAA,MACd,MAAO,QAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC;AAAA,IAC9D;AACA,WAAO,EAAE,MAAM,OAAO,QAAQ,UAAU,KAAK,GAAG,EAAE;AAAA,EACpD;AACA,QAAM,WAAW,YAAY;AAC3B,UAAM,IAAI,MAAM,KAAK;AACrB,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,MACZ,aAAa;AAAA,QACX,GAAG,EAAE,MAAM,IAAI,GAAG;AAAA,QAClB,GAAG,EAAE,OAAO,IAAI,CAAC,OAAO;AAAA,UACtB,IAAI,EAAE;AAAA,UACN,UAAU;AAAA,UACV,aAAa,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAI,EAAE,GAAG,MAAM,EAAE,CAAC;AAAA,UAClD,WAAW;AAAA,UACX,WAAW;AAAA,QACb,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OACb,UACA,OACA,KACA,iBAAiB,SACd;AACH,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,UAAU,KAAK;AAC7B,QAAI,WAAW;AACf,QAAI,WAAW;AACf,QAAI,OAAO;AACX,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK;AACzB,iBAAW,MAAM;AACjB,UAAI,MAAM,aAAa;AACrB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,cAAc,MAAM,KAAK;AAC/B,UACE,CAAC,YAAY,UACb,CAAC,YAAY,KAAK,CAAC,MAAM,EAAE,KAAK,aAAa,IAAI;AAEjD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,IAAI,MAAM;AAChB,aAAOA,MAAK,MAAM,eAAe,OAAO,MAAM,CAAC,EAAE;AACjD,YAAM,aAAaF,SAAQ,IAAI,CAAC;AAChC,YAAM,aAAa,IAAI;AACvB,iBAAW,KAAK,aAAa;AAC3B,cAAM,SAAS,MAAMI,MAAKF,MAAK,MAAM,GAAG,EAAE,EAAE,OAAO,GAAG,MAAM,GAAK;AACjE,YAAI;AACF,gBAAM,OAAO,UAAU,KAAK,UAAU,EAAE,IAAI,CAAC;AAC7C,gBAAM,OAAO,KAAK;AAAA,QACpB,UAAE;AACA,gBAAM,OAAO,MAAM;AAAA,QACrB;AAAA,MACF;AACA,UAAI;AACF,mBAAW,KAAK,MAAM,QAAQ;AAC5B,gBAAM,SAAS,MAAME,MAAKF,MAAK,MAAM,GAAG,EAAE,EAAE,OAAO,GAAG,MAAM,GAAK;AACjE,cAAI;AACF,kBAAM,OAAO,UAAU,EAAE,KAAK;AAC9B,kBAAM,OAAO,KAAK;AAAA,UACpB,UAAE;AACA,kBAAM,OAAO,MAAM;AAAA,UACrB;AAAA,QACF;AACF,YAAM,UAAU,MAAME,MAAK,MAAM,GAAG;AACpC,UAAI;AACF,cAAM,QAAQ,KAAK;AAAA,MACrB,UAAE;AACA,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,YAAM,IAAI,MAAM,WAAW,EAAE,cAAc,UAAU,UAAU,KAAK,CAAC;AACrE,YAAM,MAAMF,MAAKF,SAAQ,MAAM,GAAG,UAAU,MAAM,CAAC,EAAE;AACrD,YAAM,QAAQ,MAAM,GAAG;AACvB,YAAM,IAAI,MAAM;AAChB,YAAM,IAAI,MAAM,UAAU,EAAE,cAAc,UAAU,UAAU,KAAK,CAAC;AACpE,YAAMK,QAAO,KAAK,MAAM;AACxB,iBAAW;AACX,YAAM,QAAQ,UAAU,MAAM;AAC9B,YAAM,IAAI,MAAM,UAAU,EAAE,cAAc,UAAU,UAAU,KAAK,CAAC;AACpE,YAAM,QAAQ,OAAO;AACrB,YAAM,WAAWH,MAAK,MAAM,gBAAgB,GAAG;AAAA,QAC7C,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD,YAAM,IAAI,MAAM,QAAQ;AACxB,aAAO;AAAA,QACL,WAAW,MAAM,SAAS,GAAG;AAAA,QAC7B,OAAO,YAAY;AAAA,MACrB;AAAA,IACF,SAAS,OAAO;AACd,UACE,YACA,iBAAiB,YACjB,MAAM,SAAS,uBACf;AACA,cAAM,WAAWA,MAAK,MAAM,gBAAgB,GAAG;AAAA,UAC7C,cAAc;AAAA,UACd,YAAY;AAAA,QACd,CAAC;AACD,cAAMI,WAAU,MAAM,SAAS;AAC/B,eAAO;AAAA,UACL,UAAUA,SAAQ;AAAA,UAClB,OAAOA,SAAQ,YAAY;AAAA,UAC3B,cAAc;AAAA,QAChB;AAAA,MACF;AACA,UAAI,UAAU;AACZ,YAAI;AACF,gBAAM,MAAMJ,MAAKF,SAAQ,MAAM,GAAG,UAAU,MAAM,CAAC,EAAE;AACrD,gBAAM,QAAQ,UAAU,KAAK;AAC7B,gBAAM,QAAQ,UAAU,GAAG;AAC3B,gBAAMK,QAAO,KAAK,MAAM;AACxB,gBAAM,QAAQ,UAAU,MAAM;AAC9B,gBAAM,QAAQ,OAAO;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF,MAAO,OAAM,QAAQ,UAAU,MAAM;AACrC,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,MACZ,gBAAgB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,MAClD,gBAAgB;AAAA,QACd,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,OAAO,CAAC,SAAS,SAAS;AAAA,QAC1B,WAAW;AAAA,MACb;AAAA,MACA,iBAAiB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,MACnD,qBAAqB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,MACvD,oBAAoB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,IACxD;AAAA,IACA,wBAAwB;AAAA,IACxB;AAAA,IACA,OAAO,CAAC,OAAO,QACb;AAAA,MACE,MAAM;AAAA,MACN,CAAC,UAAU;AACT,cAAM,WAAW,IAAI,IAAI,MAAM,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,cAAM,OACJ,MAAM,SAAS,UACX,IAAI,IAAI,QAAQ,IAChB,oBAAI,IAAwB;AAClC,mBAAW,KAAK,MAAM;AACpB,eAAK;AAAA,YACH,EAAE;AAAA,YACF,SAAS,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,aAAa,SAAS,EAAE,EAAE,IACnD,SAAS,IAAI,EAAE,EAAE,IACjB;AAAA,UACN;AACF,YAAI,MAAM,SAAS,WAAW;AAC5B,gBAAM,WAAW,CAAC,GAAG,SAAS,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;AAClE,mBAAS,KAAK,GAAG,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAC9C,cAAI,SAAS,KAAK,CAAC,OAAO,CAAC,MAAM,kBAAkB,SAAS,EAAE,CAAC;AAC7D,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,QACJ;AACA,eAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,MAAM,SAAS;AAAA,IACjB;AAAA,IACF,QAAQ,CAAC,IAAI,UAAU,QACrB;AAAA,MACE;AAAA,MACA,CAAC,UAAU;AACT,YACE,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KACpC,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AAErC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,cAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AACrD,eAAO,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AAAA,MAC9C;AAAA,MACA;AAAA,IACF;AAAA,IACF,SAAS,OAAO,UAAU;AACxB,YAAM,OAAO,OAAO,MAAM,aAAa,WAAW,MAAM,WAAW,MACjE,WACE,OAAO,MAAM,iBAAiB,WAAW,MAAM,eAAe;AAClE,UACE,CAAC,QACD,CAAC,YACD,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,KAC3B,CAAC,SAAS,WAAW,GAAG,IAAI,GAAG;AAE/B,eAAO;AACT,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ;AAC3B,YAAI,SAAS,MAAM;AACjB,gBAAM,QAAQ,UAAU,MAAM;AAC9B,gBAAM,QAAQ,OAAO;AACrB,iBAAO;AAAA,QACT;AACA,YAAI,SAAS,UAAU;AACrB,gBAAM,QAAQ,UAAU,MAAM;AAC9B,gBAAM,QAAQ,OAAO;AACrB,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,0BAA0B,SAKlB;AACtB,QAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,MACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI;AAEJ,UAAM,IAAI,SAAS,iBAAiB,qCAAqC;AAC3E,QAAM,OAAO,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AAC9C,SAAO;AAAA,IACL,SAAS,OAAO,MAAM,OAAO,CAAC,MAAM;AAClC,UAAI,CAAC,iCAAiC,KAAK,IAAI;AAC7C,cAAM,IAAI,SAAS,iBAAiB,0BAA0B;AAChE,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,UAAU,MAAM,QAAQ,OAAO,CAAC,EAAE;AAC/D,YAAM,SAAS,YAAY,IAAI;AAAA,QAC7B,YAAY,QAAQ,QAAQ,aAAa,GAAM;AAAA,QAC/C,GAAI,KAAK,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC;AAAA,MACrC,CAAC;AACD,UAAI;AACJ,UAAI;AACF,mBAAW,OAAO,QAAQ,SAAS;AAAA,UACjC,GAAG,IAAI,iBAAiB,IAAI;AAAA,UAC5B,EAAE,GAAG,MAAM,SAAS,QAAQ,UAAU,QAAQ;AAAA,QAChD;AAAA,MACF,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI;AAAA,UACR,SAAS,WAAW,MAChB,wBACA;AAAA,UACJ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB;AACF,UAAI,SAAS,WAAW,IAAK,QAAO,CAAC;AACrC,UAAI;AACF,YAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM;AACpC,cAAM,SAAS,SAAS,KAAK,UAAU,GACrC,SAAuB,CAAC;AAC1B,YAAI,OAAO;AACX,mBAAS;AACP,gBAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,cAAI,MAAM,KAAM;AAChB,kBAAQ,MAAM,MAAM;AACpB,cAAI,OAAO,IAAI,OAAO,MAAM;AAC1B,kBAAM,OAAO,OAAO;AACpB,kBAAM,IAAI,MAAM;AAAA,UAClB;AACA,iBAAO,KAAK,MAAM,KAAK;AAAA,QACzB;AACA,eAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAAA,MAC1D,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AACO,SAAS,gCAAgC,SAKpC;AACV,QAAM,UAAU,QAAQ,oBAAoB,QAAQ;AACpD,QAAM,eAA6B,OAAO;AAAA,IACxC;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,IAAI,CAAC,SAAS;AAAA,MACd;AAAA,MACA,EAAE,SAAS,YAAY,UAAU,OAAO,qBAAqB;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,eAAa,cAAc,IAAI;AAAA,IAC7B;AAAA,IACA,YAAY,UAAU,OAAO;AAAA,IAC7B,OAAO,CAAC,OAAO;AAAA,IACf,WAAW;AAAA,EACb;AACA,QAAM,QAAQ,oBAAI,IAAoB;AACtC,QAAM,WAAW,YAAY;AAC3B,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,UAAM,OAAQ,MAAM,QAAQ,UAAU,QAAQ,cAAc;AAG5D,QAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,UAAM,MAAM;AACZ,UAAM,MACJ,CAAC;AACH,eAAW,OAAO,KAAK,OAAO;AAC5B,YAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AACvD,UAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI;AACnD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,aACJ,IAAI,iBAAiB,OACjB,OACA,MAAM,QAAQ,UAAU;AAAA,QACtB,8BAA8B,mBAAmB,IAAI,CAAC;AAAA,MACxD;AACN,YAAM,aAAa,aACf,gBAAgB,OAAO,KAAK,KAAK,UAAU,UAAU,CAAC,CAAC,IACvD;AACJ,YAAM,KAAK,YAAY,MAAM,KAAK,IAAI;AACtC,YAAM,IAAI,IAAI,IAAI;AAClB,UAAI,KAAK,EAAE,GAAG,KAAK,IAAI,QAAQ,KAAK,cAAc,GAAG,EAAE,CAAC;AAAA,IAC1D;AACA,UAAM,cAA+B,IAAI,IAAI,CAAC,SAAS;AAAA,MACrD,IAAI,IAAI;AAAA,MACR,UACE,OAAO,IAAI,SAAS,WAChB,IAAI,OACJ,OAAO,IAAI,aAAa,WACtB,IAAI,WACJ;AAAA,MACR,aAAa,GAAG,OAAO,IAAI,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,SAAI,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AAAA,MACtE,WACE,IAAI,aAAa,OACb,aACA,IAAI,WAAW,UACb,WACA;AAAA,MACR,WAAW,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;AAAA,IACnE,EAAE;AACF,WAAO,EAAE,UAAU,KAAK,GAAG,GAAG,YAAY;AAAA,EAC5C;AACA,SAAO;AAAA,IACL;AAAA,IACA,wBAAwB,QAAQ,mBAAmB,cAAc;AAAA,IACjE;AAAA,IACA,OAAO,OAAO,OAAO,QAAQ;AAC3B,UAAI,CAAC,WAAW,MAAM,SAAS,aAAa,MAAM,aAAa;AAC7D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,UAAU,MAAM,SAAS;AAC/B,UAAI,QAAQ,aAAa,MAAM;AAC7B,cAAM,IAAI,SAAS,qBAAqB,yBAAyB;AACnE,YAAM,WAA4C,CAAC;AACnD,iBAAW,cAAc,MAAM,aAAa;AAC1C,cAAM,IAAI,MAAM;AAChB,cAAM,SAAS,MAAM,SAAS;AAC9B,cAAM,QAAQ,OAAO,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE;AACnE,YAAI,OAAO;AACT,mBAAS,KAAK,EAAE,IAAI,WAAW,IAAI,OAAO,YAAY,CAAC;AACvD;AAAA,QACF;AACA,cAAM,IAAI,MAAM,UAAU,EAAE,SAAS,CAAC;AACtC,YAAI;AACF,gBAAM,QAAQ,UAAU;AAAA,YACtB,qBAAqB,mBAAmB,GAAG,WAAW,EAAE,OAAO,CAAC;AAAA,YAChE;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU,WAAW,IAAI;AAAA,YACtC;AAAA,UACF;AACA,mBAAS,KAAK,EAAE,IAAI,WAAW,IAAI,OAAO,UAAU,CAAC;AAAA,QACvD,QAAQ;AACN,mBAAS,KAAK,EAAE,IAAI,WAAW,IAAI,OAAO,UAAU,CAAC;AACrD,gBAAM,IAAI,MAAM,UAAU,EAAE,SAAS,CAAC;AACtC,gBAAM,IAAI;AAAA,YACR,SAAS,KAAK,CAAC,MAAM,EAAE,UAAU,SAAS,IACtC,kBACA;AAAA,YACJ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,MAAM,UAAU,EAAE,SAAS,CAAC;AACtC,YAAM,SAAS;AACf,aAAO,EAAE,SAAS;AAAA,IACpB;AAAA,IACA,QAAQ,OAAO,IAAI,UAAU,QAAQ;AACnC,UAAI,CAAC;AACH,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,IAAI,MAAM,SAAS;AACzB,UAAI,EAAE,aAAa;AACjB,cAAM,IAAI,SAAS,qBAAqB,yBAAyB;AACnE,YAAM,OAAO,MAAM,IAAI,EAAE;AACzB,UAAI,CAAC;AACH,cAAM,IAAI,SAAS,qBAAqB,6BAA6B;AACvE,UACE,EAAE,YAAY,UAAU,KACvB,CAAC,QAAQ,wBACR,CAAC,EAAE,YACA,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EACzB,KAAK,CAAC,MAAM,EAAE,cAAc,QAAQ;AAEzC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,IAAI,MAAM,UAAU,EAAE,cAAc,GAAG,CAAC;AAC9C,UAAI;AACF,cAAM,QAAQ,UAAU;AAAA,UACtB,qBAAqB,mBAAmB,IAAI,CAAC;AAAA,UAC7C,EAAE,QAAQ,SAAS;AAAA,QACrB;AAAA,MACF,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,MAAM,QAAQ;AACxB,YAAM,QAAQ,MAAM,SAAS;AAC7B,UAAI,MAAM,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AAC3C,cAAM,IAAI,SAAS,mBAAmB,wBAAwB;AAChE,aAAO,EAAE,UAAU,MAAM,UAAU,WAAW,GAAG;AAAA,IACnD;AAAA,IACA,SAAS,YAAY;AAAA,EACvB;AACF;;;AClrBA,SAAS,gBAAgB;AA0ElB,SAAS,iBACd,QACA,UACA;AACA,WAAS,MAAM,OAAO,UAAU;AAChC,QAAM,MAAM,SAAS,SAAS,KAAK;AACnC,MAAI,UAAqB;AAAA,IACvB,YAAY;AAAA,IACZ,YAAY,OAAO;AAAA,IACnB,QAAQ,CAAC;AAAA,IACT,WAAW;AAAA,IACX,WAAW;AAAA,IACX,OAAO;AAAA,IACP,UAAU,KAAK,CAAC,CAAC;AAAA,EACnB;AACA,MAAI,aAA8C;AAClD,MAAI,oBAAoB;AACxB,QAAM,cAAc,YAAY;AAC9B,UAAM,SAAS,MAAM,SAAS,YAAY,IAAI;AAC9C,QAAI,UAAU,OAAO,eAAe,OAAO,WAAY,WAAU;AAAA,EACnE;AACA,QAAM,cAAc,YAAY;AAC9B,QAAI;AACF,YAAM,SAAS,YAAY,IAAI,OAAO;AAAA,IACxC,QAAQ;AACN,0BAAoB;AAAA,IACtB;AAAA,EACF;AACA,QAAM,YAAY,OAAO,OAAc,WAAmB;AACxD,aAAS,MAAM,MAAM,EAAE;AACvB,QAAI,CAAE,MAAM,SAAS,cAAc,MAAM,OAAO,OAAO,YAAY,MAAM;AACvE,YAAM,IAAI,SAAS,kBAAkB,8BAA8B;AAAA,EACvE;AACA,QAAM,eAAe,OAAO;AAAA,IAC1B,GAAG,SAAS,QAAQ;AAAA,IACpB,GAAI,CAAC,SAAS,cACV,OAAO;AAAA,MACL;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,IAAI,CAAC,SAAS;AAAA,QACd;AAAA,QACA,EAAE,SAAS,OAAO,YAAY,iBAAiB;AAAA,MACjD,CAAC;AAAA,IACH,IACA,CAAC;AAAA,IACL,mBAAmB;AAAA,MACjB,SAAS,CAAC,CAAC,SAAS;AAAA,MACpB,YAAY,SAAS,UAAU,OAAO;AAAA,IACxC;AAAA,IACA,eAAe;AAAA,MACb,SAAS,CAAC,CAAC,SAAS;AAAA,MACpB,YAAY,SAAS,QAAQ,OAAO;AAAA,IACtC;AAAA,IACA,GAAG,OAAO;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,IAAI,CAAC,SAAS;AAAA,QACd;AAAA,QACA;AAAA,UACE,SACE,CAAC,CAAC,SAAS,aACV,CAAC,oBAAoB,mBAAmB,gBAAgB,EAAE;AAAA,YACzD;AAAA,UACF,KACE,CAAC,CAAC,SAAS;AAAA,UACf,YAAY,SAAS,WACjB,SAAS,cACP,OACA,mBACF;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,oBAAoB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,EACxD;AACA,QAAM,SAAS,OAAO,IAAY,OAAsC;AACtE,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,YAAM,KAAK,MAAM,SAAS,MAAM,IAAI,EAAE;AACtC,UAAI,CAAC,GAAI,OAAM,IAAI,SAAS,iBAAiB,mBAAmB;AAChE,UAAI;AACF,eAAO,MAAM,SAAS,MAAM,OAAO,IAAI,GAAG,IAAI,UAAU,EAAE;AAAA,MAC5D,SAAS,GAAG;AACV,YAAI,EAAE,aAAa,aAAa,EAAE,SAAS,oBAAqB,OAAM;AAAA,MACxE;AAAA,IACF;AACA,UAAM,IAAI,SAAS,iBAAiB,gCAAgC,IAAI;AAAA,EAC1E;AACA,QAAM,MAAM,OAAO,IAAY,UAAiB;AAC9C,UAAM,UAAU,OAAO,gBAAgB;AACvC,UAAM,KAAK,MAAM,SAAS,MAAM,IAAI,EAAE;AACtC,QAAI,CAAC,MAAM,GAAG,IAAI,eAAe,OAAO;AACtC,YAAM,IAAI,SAAS,iBAAiB,mBAAmB;AACzD,QAAI,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC,MAAM;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OACd,aACA,OACA,UAAmE,CAAC,MACtC;AAC9B,UAAM,UAAU,OAAO,iBAAiB;AACxC,UAAM,IAAI,MAAM,SAAS,QAAQ;AAAA,MAC/B;AAAA,MACA,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM;AAAA,IACR;AACA,UAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAC1C,UAAM,WAAW,IAAI,IAAI,EAAE,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,GAC3D,WAAW,IAAI,IAAI,EAAE,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AACzD,UAAM,eAAe,QAAQ,gBAAgB,CAAC;AAC9C,UAAM,OAAO,QAAQ,QAAQ;AAC7B,MAAE,UAAU;AAAA,MACV,UAAU,EAAE;AAAA,MACZ,WAAW,IAAI,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,KAAK,CAAC;AAC7B,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,YAAY,OAAO;AAAA,MACnB,aAAa,EAAE;AAAA,MACf,UAAU,EAAE;AAAA,MACZ,WAAW,IAAI,KAAK,EAAE,SAAS,EAAE,YAAY;AAAA,MAC7C,kBAAkB,IAAI,KAAK,EAAE,QAAQ,SAAS,EAAE,YAAY;AAAA,MAC5D,UAAU,EAAE,YAAY;AAAA,MACxB,SAAS,EAAE;AAAA,MACX,WAAW,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;AAAA,MACzD,WAAW,CAAC,GAAG,QAAQ,EAAE;AAAA,QAAO,CAAC,OAC/B,SAAS,UACL,CAAC,aAAa,SAAS,EAAE,IACzB,SAAS,IAAI,EAAE,KAAK,CAAC,aAAa,SAAS,EAAE;AAAA,MACnD;AAAA,MACA,cAAc,CAAC,GAAG,QAAQ,EAAE;AAAA,QAC1B,CAAC,OAAO,SAAS,IAAI,EAAE,KAAK,aAAa,SAAS,EAAE;AAAA,MACtD;AAAA,MACA,UACE,SAAS,YACL,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,IAC9C,CAAC;AAAA,MACP,SAAS,EAAE;AAAA,IACb;AAAA,EACF;AACA,QAAM,UAAU;AAAA,IACd,sBAAsB,OAAO;AAAA,MAC3B,GAAG,OAAO;AAAA,MACV,kBAAkB,CAAC,GAAG,OAAO,WAAW,gBAAgB;AAAA,IAC1D;AAAA,IACA,QAAQ,OAAO,OAAgB,UAAwC;AACrE,YAAM,SAAS,cAAc,UAAU,KAAK;AAC5C,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,SAAS,iBAAiB,gCAAgC;AACtE,YAAM,UAAU,OAAO;AACvB,UAAI,QAAQ,eAAe,OAAO;AAChC,cAAM,IAAI,SAAS,iBAAiB,kBAAkB;AACxD,YAAM,UAAU,OAAO,QAAQ,IAAI;AACnC,YAAM,MACJ,aAAa,EAAE,QAAQ,IAA6C;AACtE,UAAI,CAAC,KAAK;AACR,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,QAAQ,SAAS,gBAAgB;AACnC,cAAM,SAAS,SAAS,QAAQ,aAAa,cAAc;AAC3D,YACG,QAAQ,SAAS,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,IAAI,KAC5D,QAAQ,cAAc,SAAS,QAAQ,QAAQ,aAAa;AAE7D,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,MACJ;AACA,UACE;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,SAAS,QAAQ,IAAI,KACvB,CAAC,SAAS;AAEV,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,SAAS,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK;AACzD,UACE,QAAQ,SAAS,sBACjB,OAAO,UAAU,IAAI,UAAU,UAC/B;AACA,cAAM,SAAS,MAAM,IAAI,QAAQ,QAAQ,aAAa,KAAK;AAC3D,cAAM,OAAO,OAAO,IAAI,IAAI,CAAC,OAAO;AAClC,aAAG,IAAI,kBAAkB;AACzB,cAAI,GAAG,IAAI,UAAU,UAAU;AAC7B,eAAG,IAAI,QAAQ;AACf,eAAG,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UAClD;AAAA,QACF,CAAC;AACD,cAAM,OAAO,OAAO,UAAU,IAAI,IAAI,CAAC,OAAO;AAC5C,aAAG,IAAI,QAAQ;AACf,aAAG,IAAI,SAAS,EAAE,aAAa,OAAO,IAAI,GAAG;AAC7C,aAAG,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,QAClD,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,aAAa,OAAO,UAAU,IAAI;AAAA,QAClC,QAAQ,MAAM,SAAS,MAAM,IAAI,OAAO,UAAU,IAAI,EAAE,GAAI,IAAI;AAAA,QAChE,QAAQ,OAAO;AAAA,MACjB;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAqC;AAClD,YAAM,UAAU,OAAO,YAAY;AACnC,YAAM,YAAY;AAClB,YAAM,IAAI,MAAM,SAAS,QACtB,SAAS,EACT,MAAM,OAAO,EAAE,UAAU,KAAK,aAAa,GAAG,aAAa,CAAC,EAAE,EAAE;AACnE,YAAM,UAAU,MAAM,SAAS,WAC3B,QAAQ,EACT,MAAM,OAAO,EAAE,SAAS,MAAM,OAAO,UAAmB,EAAE;AAC7D,YAAM,aAAa,MAAM,SAAS,MAAM,KAAK;AAC7C,YAAM,YAAY,WACf;AAAA,QACC,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,cAC5B,EAAE,IAAI,SAAS,iBACf,WAAW,EAAE,IAAI,KAAK;AAAA,MAC1B,EACC,KAAK,CAAC,GAAG,MAAM,EAAE,IAAI,UAAU,cAAc,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC;AACnE,YAAM,OAAO,WAAW;AAAA,QACtB,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,cAC5B,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK;AAAA,MACzD;AACA,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,UAAU,KAAK,EAAE,MAAM,EAAE,UAAU,MAAM,SAAS,WAAW,KAAK,CAAC;AAAA,QACnE,SAAS;AAAA,UACP,MAAM,SAAS,YAAY,YAAY;AAAA,UACvC,SAAS,SAAS,WAAW;AAAA,UAC7B,OAAO,SAAS,SAAS;AAAA,QAC3B;AAAA,QACA,YAAY;AAAA,UACV,UACE,SAAS,QAAQ,2BAA2B,cACxC,OACA;AAAA,UACN,cAAc,SAAS,QAAQ;AAAA,QACjC;AAAA,QACA,WAAW;AAAA,UACT,WACE,SAAS,UAAU,YACf,QACA,QAAQ,aAAa,KAAK,MAAM,QAAQ,SAAS,IAAI,IAAI,IACvD,OACA;AAAA,UACR,cAAc,QAAQ,YAClB,IAAI,IAAI,KAAK,MAAM,QAAQ,SAAU,IACnC,UACA,UACF;AAAA,UACJ,YAAY,YACR,UAAU,IAAI,UAAU,cACtB,WACA,WACF;AAAA,UACJ,WAAW,WAAW,IAAI,cAAc,QAAQ;AAAA,QAClD;AAAA,QACA,cAAc,aAAa;AAAA,QAC3B,iBAAiB,MAAM,IAAI,MAAM;AAAA,MACnC;AAAA,IACF;AAAA,IACA,aAAa,OAAO,UAAiB;AACnC,YAAM,UAAU,OAAO,kBAAkB;AACzC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,QAAQ,MAAM,SAAS,QAAQ,SAAS,GAAG;AAAA,QAC3C,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAiB;AAC9B,YAAM,UAAU,OAAO,YAAY;AACnC,YAAM,YAAY;AAClB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,OAAO,CAAC,QAAQ,aAAa,KAAK,MAAM,QAAQ,SAAS,IAAI,IAAI;AAAA,MACnE;AAAA,IACF;AAAA,IACA,UAAU,OAAO,UAA+C;AAC9D,YAAM,UAAU,OAAO,eAAe;AACtC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,OAAQ,MAAM,SAAS,UAAU,KAAK,KAAM,CAAC;AAAA,QAC7C,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA,YAAY,OACV,OACA,UAA+C,CAAC,MACb;AACnC,YAAM,UAAU,OAAO,iBAAiB;AACxC,YAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ;AACnD,cAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAC1D,UAAI,QAAQ;AACZ,UAAI,UAAU,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAC1C,UAAI,QAAQ,QAAQ;AAClB,YAAI;AACF,gBAAM,SAAS,KAAK;AAAA,YAClB,OAAO,KAAK,QAAQ,QAAQ,WAAW,EAAE,SAAS;AAAA,UACpD;AACA,cACE,OAAO,UAAU,MAAM,MACvB,OAAO,aAAa,OAAO;AAE3B,kBAAM,IAAI,MAAM;AAClB,kBAAQ,OAAO;AACf,oBAAU,OAAO;AAAA,QACnB,QAAQ;AACN,gBAAM,IAAI,SAAS,iBAAiB,qBAAqB;AAAA,QAC3D;AAAA,MACF;AACA,YAAM,SAAS,MAAM,SAAS,MAAM,KAAK,GACtC;AAAA,QACC,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,eAC3B,MAAM,SAAS,EAAE,MAAM,OAAO,MAAM,OACrC,EAAE,IAAI,aAAa;AAAA,MACvB,EACC,IAAI,CAAC,MAAM,EAAE,GAAG,EAChB;AAAA,QAAK,CAAC,GAAG,MACR,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,GAAG,cAAc,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,EAAE;AAAA,MACjE,EACC,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,KAAK,KAAK;AAC3D,YAAM,OAAO,MAAM,MAAM,GAAG,KAAK;AACjC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,QACP,YACE,MAAM,SAAS,QACX,OAAO;AAAA,UACL,KAAK,UAAU;AAAA,YACb,OAAO,MAAM;AAAA,YACb,UAAU,OAAO;AAAA,YACjB;AAAA,YACA,OAAO,GAAG,KAAK,GAAG,EAAE,EAAG,SAAS,IAAI,KAAK,GAAG,EAAE,EAAG,EAAE;AAAA,UACrD,CAAC;AAAA,QACH,EAAE,SAAS,WAAW,IACtB;AAAA,MACR;AAAA,IACF;AAAA,IACA,WAAW,OAAO,IAAY,WAAkB,MAAM,IAAI,IAAI,KAAK,GAAG;AAAA,IACtE;AAAA,IACA,QAAQ,OACN,OACA,UACG;AACH,YAAM,UAAU,OAAO,cAAc;AACrC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,UAAU,MAAM,SAAS,QAAQ;AAAA,UAC/B;AAAA,UACA,MAAM;AAAA,UACN,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA,kBAAkB,OAAO,OAA+C;AACtE,YAAM,UAAQ,MAAM,SAAS,MAAM,IAAI,EAAE;AACzC,UAAG,SAAS,IAAI,UAAQ,YAAU,QAAQ,QAAQ,SAAO,oBAAmB;AAC1E,YAAG;AAAC,gBAAM,UAAU,QAAQ,OAAM,kBAAkB;AAAE,gBAAM,SAAO,MAAM,IAAI,QAAQ,QAAQ,QAAQ,aAAY,QAAQ,KAAK;AAAE,gBAAM,OAAO,OAAO,IAAI,IAAG,OAAG;AAAC,cAAE,IAAI,kBAAgB;AAAK,gBAAG,EAAE,IAAI,UAAQ,UAAS;AAAC,gBAAE,IAAI,QAAM;AAAY,gBAAE,IAAI,aAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,YAAE;AAAA,UAAC,CAAC;AAAE,gBAAM,OAAO,IAAG,OAAG;AAAC,cAAE,IAAI,QAAM;AAAY,cAAE,IAAI,SAAO,EAAC,aAAY,OAAO,IAAI,GAAE;AAAE,cAAE,IAAI,aAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UAAE,CAAC;AAAA,QAAE,SAAO,GAAE;AAAC,gBAAM,OAAO,IAAG,OAAG;AAAC,cAAE,IAAI,QAAM;AAAS,cAAE,IAAI,QAAM,UAAU,GAAE,EAAE;AAAE,cAAE,IAAI,aAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UAAE,CAAC;AAAA,QAAE;AAAC,gBAAO,MAAM,SAAS,MAAM,IAAI,EAAE,GAAI;AAAA,MACjlB;AACA,aAAO,SAAS,MAAM,OAAO,YAAY;AACvC,YAAI,KAAK,MAAM,SAAS,MAAM,IAAI,EAAE;AACpC,YACE,CAAC,MACD,GAAG,IAAI,eAAe,OAAO,cAC7B,GAAG,IAAI,UAAU;AAEjB;AACF,cAAM,WAAW,MAAM,SAAS,MAAM,KAAK,GAAG;AAAA,UAC5C,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,cAC5B,EAAE,IAAI,UAAU;AAAA,QACpB;AACA,YAAI;AACF,gBAAM,IAAI,SAAS,qBAAqB,4BAA4B;AACtE,YAAI;AACF,gBAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,IAAI;AAAA,QAC3C,SAAS,GAAG;AACV,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QAAQ;AACd,cAAE,IAAI,QAAQ,UAAU,GAAG,EAAE;AAC7B,cAAE,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UACjD,CAAC;AACD,kBAAQ,MAAM,SAAS,MAAM,IAAI,EAAE,GAAI;AAAA,QACzC;AACA,cAAM,aAAa,IAAI,gBAAgB;AACvC,YAAI,iBAAiB;AACrB,aAAK,MAAM,OAAO,IAAI,CAAC,MAAM;AAC3B,YAAE,IAAI,QAAQ;AACd,YAAE,IAAI,YAAY,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAC9C,YAAE,QAAQ,GAAG,SAAS,CAAC,IAAI,QAAQ,GAAG;AACtC,YAAE,aAAa,IAAI,KAAK,IAAI,IAAI,GAAM,EAAE,YAAY;AAAA,QACtD,CAAC;AACD,cAAM,YAAY,YAAY,MAAM;AAClC,eAAK,OAAO,IAAI,CAAC,MAAM;AACrB,cAAE,aAAa,IAAI,KAAK,IAAI,IAAI,GAAM,EAAE,YAAY;AACpD,gBAAI,EAAE,IAAI,mBAAmB,CAAC,SAAU,YAAW,MAAM;AAAA,UAC3D,CAAC,EAAE,MAAM,MAAM;AACb,6BAAiB;AACjB,uBAAW,MAAM;AAAA,UACnB,CAAC;AAAA,QACH,GAAG,GAAM;AACT,YAAI,UAAU,OACZ,WAAW;AACb,cAAM,QAAQ,OAAO,GAAU,UAAoC;AACjE,cAAI,MAAM,SAAU,YAAW;AAC/B,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QAAQ;AACd,gBAAI,MAAO,GAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM;AAAA,UAC5D,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,YAAY;AACxB,cAAI;AACF,kBAAM,IAAI,SAAS,qBAAqB,sBAAsB;AAChE,gBAAM,UAAU,MAAM,SAAS,MAAM,IAAI,EAAE;AAC3C,cAAI,SAAS,IAAI,mBAAmB,CAAC;AACnC,kBAAM,IAAI,SAAS,aAAa,qBAAqB;AACvD,gBAAM,UAAU,GAAI,OAAO,GAAI,QAAQ,IAAI;AAAA,QAC7C;AACA,cAAM,MAAsB,EAAE,OAAO,MAAM;AAC3C,YAAI,cAA6B;AACjC,YAAI;AACF,8BAAoB;AACpB,gBAAM,MAAM;AACZ,gBAAM,UAAU,GAAG;AACnB,gBAAM,aAAa;AAAA,YACjB;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,EAAE,SAAS,QAAQ,IAAI;AACvB,cAAI,YAAY;AACd,kBAAM,MAAM,OAAO;AACnB,kBAAM,SAAS,YAAa;AAAA,cAC1B;AAAA,cACA,OAAO,kBAAkB;AAAA,YAC3B;AACA,sBAAU;AACV,kBAAM,MAAM;AAAA,UACd;AACA,cACE,CAAC,oBAAoB,kBAAkB,kBAAkB,EAAE;AAAA,YACzD,GAAG,QAAQ;AAAA,UACb,GACA;AACA,kBAAM,OAAO,MAAM,SAAS,QAAQ,SAAS;AAC7C,kBAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;AAClD,gBACE,KAAK,EAAE,MAAM,KAAK,UAAU,MAAM,SAAS,WAAW,KAAK,CAAC,MAC5D,GAAG,QAAQ;AAEX,oBAAM,IAAI;AAAA,gBACR;AAAA,gBACA;AAAA,cACF;AAAA,UACJ;AACA,cAAI,SAAkC,CAAC;AACvC,kBAAQ,QAAQ,MAAM;AAAA,YACpB,KAAK,gBAAgB;AACnB,oBAAM,YAAY,MAAM,SAAS,QAAQ;AAAA,gBACvC,QAAQ,QAAQ;AAAA,gBAChB,GAAG,MAAM;AAAA,gBACT,OAAO;AAAA,cACT;AACA,oBAAM,MAAM,SAAS;AACrB,oBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,kBAAE,IAAI,WAAW;AAAA,kBACf,WAAW,UAAU,YAAY,SAAS,UAAU;AAAA,kBACpD,OAAO,UAAU,YAAY,SAAS,UAAU;AAAA,gBAClD;AAAA,cACF,CAAC;AACD,uBAAS;AAAA,gBACP,aAAa,UAAU;AAAA,gBACvB,UAAU,UAAU,YAAY;AAAA,gBAChC,SAAS,UAAU;AAAA,cACrB;AACA;AAAA,YACF;AAAA,YACA,KAAK,gBAAgB;AACnB,4BAAc,QAAQ,QAAQ;AAC9B,oBAAM,IAAI,MAAM,SAAS,QAAQ;AAAA,gBAC/B;AAAA,gBACA,GAAG,MAAM;AAAA,gBACT,OAAO;AAAA,gBACP,GAAG,MAAM;AAAA,cACX;AACA,oBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,kBAAE,IAAI,SAAS,QAAQ,EAAE,YAAY;AAAA,cACvC,CAAC;AACD,kBACE,CAAC,EAAE,WACH,EAAE,QAAQ,YAAY,IAAI,KAC1B,EAAE,QAAQ,aAAa,QAAQ,QAAQ,mBACvC,QAAQ,qBAAqB,EAAE,QAAQ,YACvC,EAAE,QAAQ,SAAS,QAAQ,QAAQ,QACnC,KAAK,EAAE,QAAQ,YAAY,MACzB,KAAK,QAAQ,QAAQ,YAAY;AAEnC,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,uBAAS,MAAM,SAAS,QAAQ;AAAA,gBAC9B;AAAA,kBACE,aAAa,EAAE;AAAA,kBACf,GAAG,QAAQ;AAAA,kBACX,kBAAkB,QAAQ;AAAA,gBAC5B;AAAA,gBACA;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF;AAAA,YACA,KAAK;AACH,4BAAc,QAAQ,QAAQ;AAC9B,oBAAM,SAAS,QAAQ;AAAA,gBACrB;AAAA,gBACA,GAAG,MAAM;AAAA,gBACT,OAAO;AAAA,gBACP,GAAG,MAAM;AAAA,cACX;AACA,uBAAS,EAAE,WAAW,KAAK;AAC3B;AAAA,YACF,KAAK;AACH,oBAAM,aAAa,MAAM,SAAS,QAAQ,SAAS;AACnD,oBAAM,gBAAgB,MAAM,SAAS,WAAW,QAAQ;AACxD,kBACE,KAAK;AAAA,gBACH,MAAM,WAAW;AAAA,gBACjB,MAAM,eAAe,WAAW;AAAA,cAClC,CAAC,MAAM,QAAQ;AAEf,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,uBAAS,MAAM,SAAS,QAAQ;AAAA,gBAC9B,QAAQ,QAAQ;AAAA,gBAChB,WAAW;AAAA,gBACX;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF,KAAK,mBAAmB;AACtB,oBAAM,SAAS,MAAM,SAAS,QAAS;AACvC,kBAAI,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG;AAC/C,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,wBAAU;AAAA,gBACR,YAAY;AAAA,gBACZ,YAAY,OAAO;AAAA,gBACnB;AAAA,gBACA,WAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,gBACvC,WAAW,IAAI;AAAA,kBACb,IAAI,KAAK,OAAO,cAAc;AAAA,gBAChC,EAAE,YAAY;AAAA,gBACd,OAAO;AAAA,gBACP,UAAU,KAAK,MAAM;AAAA,cACvB;AACA,uBAAS,EAAE,OAAO,OAAO,OAAO;AAChC,oBAAM,YAAY;AAClB;AAAA,YACF;AAAA,YACA,KAAK;AACH,oBAAM,YAAY;AAClB,kBACE,CAAC,OAAO,WAAW,iBAAiB;AAAA,gBAClC,QAAQ,QAAQ;AAAA,cAClB;AAEA,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,kBAAI,CAAC,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ,QAAQ,OAAO;AAC9D,sBAAM,IAAI,SAAS,iBAAiB,yBAAyB;AAC/D,uBAAS,MAAM,SAAS;AAAA,gBACtB,QAAQ;AAAA,gBACR,WAAW;AAAA,cACb;AACA,2BAAa;AACb;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU,SAAS;AAC3C;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,gBAChB;AAAA,cACF;AACA;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,gBAChB;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,cAClB;AACA;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,gBAChB;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF,KAAK;AACH;AAAA,UACJ;AACA,gBAAM,MAAM,QAAQ;AACpB,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QAAQ;AACd,cAAE,IAAI,SAAS,WAAW;AAAA,cACxB,GAAG;AAAA,cACH,GAAI,oBAAoB,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAAA,YACzD,CAAC;AACD,cAAE,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UACjD,CAAC;AAAA,QACH,SAAS,GAAG;AACV,gBAAM,QAAQ,UAAU,GAAG,EAAE;AAC7B,cAAI,GAAG,QAAQ,SAAS,cAAe,cAAa;AACpD,cAAI,GAAG,QAAQ,SAAS,mBAAmB;AACzC,sBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,kBAAM,YAAY;AAAA,UACpB;AACA,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QACJ,MAAM,SAAS,uBACf,MAAM,SAAS,oBACX,sBACA,MAAM,SAAS,kBACb,sBACA,MAAM,SAAS,cACb,cACA;AACV,cAAE,IAAI,QAAQ;AACd,cAAE,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAC/C,gBAAI,EAAE,IAAI,UAAU;AAClB,gBAAE,IAAI,sBAAsB;AAAA,UAChC,CAAC;AAAA,QACH,UAAE;AACA,wBAAc,SAAS;AACvB,gBAAM,QAAS,MAAM,SAAS,MAAM,IAAI,EAAE;AAC1C,cAAI,eAAe,MAAM,IAAI,UAAU,qBAAqB;AAC1D,kBAAM,SAAS,QAAQ,OAAO,WAAW,EAAE,MAAM,YAAY;AAC3D,oBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,kBAAE,IAAI,SAAS,EAAE,GAAG,EAAE,IAAI,QAAQ,gBAAgB,KAAK;AAAA,cACzD,CAAC;AAAA,YACH,CAAC;AAAA,UACH;AACA,cAAI,WAAW,MAAM,IAAI,UAAU;AACjC,kBAAM,SAAS,YAAa,MAAM,EAAE;AACtC,gBAAM,SACH,UAAU;AAAA,YACT,aAAa;AAAA,YACb,MAAM,GAAG,QAAQ;AAAA,YACjB,OAAO,MAAM,IAAI;AAAA,UACnB,CAAC,EACA,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QACnB;AACA,gBAAQ,MAAM,SAAS,MAAM,IAAI,EAAE,GAAI;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,YACjB,SAAS,MAAM,OAAO,YAAY;AAChC,iBAAW,KAAK,MAAM,SAAS,MAAM,KAAK,GAAG;AAC3C,YACE,EAAE,IAAI,eAAe,OAAO,cAC5B,CAAC,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK;AAEtD;AACF,cAAM,WAAW,EAAE,IAAI,KAAK,WAAW,UAAU,IAC3C,MAAM,SAAS,UAAU,QAAQ,EAAE,YAAY,KAAM,YACvD,MAAM,SAAS,QAAQ,QAAQ,EAAE,YAAY;AACjD,cAAM,SACJ,aAAa,aAAa,MAAM,SAAS,QAAQ,SAAS,IAAI;AAChE,cAAM,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO;AAC7B,aAAG,IAAI,QACL,aAAa,aACT,cACA,aAAa,gBACX,WACA;AACR,aAAG,IAAI,sBAAsB;AAC7B,aAAG,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAChD,cAAI,aAAa,YAAY;AAC3B,eAAG,IAAI,QAAQ;AACf,eAAG,IAAI,SAAS;AAAA,cACd,WAAW;AAAA,cACX,UAAU,QAAQ,YAAY;AAAA,YAChC;AAAA,UACF;AACA,cAAI,aAAa;AACf,eAAG,IAAI,QAAQ;AAAA,cACb,IAAI;AAAA,gBACF;AAAA,gBACA;AAAA,cACF;AAAA,cACA,EAAE,IAAI;AAAA,YACR;AAAA,QACJ,CAAC;AACD,YAAI,aAAa;AACf,gBAAM,SAAS,aAAa,MAAM,EAAE,IAAI,EAAE;AAC5C,YAAI,aAAa,aAAa,iBAAiB,EAAE,QAAQ;AACvD,gBAAM,SAAS,QACZ,OAAO,EAAE,QAAQ,QAAQ,WAAW,EACpC,MAAM,MAAM;AAAA,UAAC,CAAC;AACnB,YAAI,aAAa,YAAY;AAC3B,oBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,gBAAM,YAAY;AAAA,QACpB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACH,aAAa,YAAY;AACvB,YAAM,eAAe,oBAAI,IAAY;AACrC,iBAAW,KAAK,MAAM,SAAS,MAAM,KAAK,GAAG;AAC3C,YACE,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK,KACrD,iBAAiB,EAAE,QAAQ;AAE3B,uBAAa,IAAI,EAAE,QAAQ,QAAQ,WAAW;AAChD,YACE,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK,KACrD,cAAc,EAAE,QAAQ;AAExB,uBAAa,IAAI,EAAE,QAAQ,QAAQ,QAAQ;AAAA,MAC/C;AACA,YAAM,SAAS,QAAQ,KAAK,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,IAAI,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,mBAAmB,CAAC,SAAqB,OACpD,QAAQ,iBAAiB,EAAE;AACtB,IAAM,oBAAoB,CAAC,YAChC,QAAQ,kBAAkB;AACrB,IAAM,cAAc,CAAC,YAAwB,QAAQ,YAAY;;;ACp1BxE,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAC1B;AAAA,EACE,SAAAE;AAAA,EACA,YAAAC;AAAA,EACA,aAAAC;AAAA,EACA,UAAAC;AAAA,EACA,WAAAC;AAAA,EACA,YAAAC;AAAA,EACA,WAAAC;AAAA,EACA,MAAAC;AAAA,OACK;AACP,SAAS,QAAAC,OAAM,WAAAC,UAAS,WAAAC,gBAAe;AACvC,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,kBAAkB;AAW3B,IAAM,OAAO,UAAU,QAAQ;AACxB,SAAS,4BAA4B,SAIvB;AACnB,MAAI,QAAQ,aAAa;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACF,QAAM,SAAS,OAAO,WAAyC;AAC7D,UAAM,OAAO,MAAMC,OAAM,QAAQ,UAAU;AAC3C,QACE,CAAC,KAAK,OAAO,KACb,KAAK,eAAe,KACpB,KAAK,QAAQ,KACb,KAAK,OAAO;AAEZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,aACM,OAAOC,SAAQC,SAAQ,QAAQ,UAAU,CAAC,KAE9C,OAAOD,SAAQ,IAAI,GACnB;AACA,YAAM,SAAS,MAAMD,OAAM,IAAI;AAC/B,UACE,CAAC,OAAO,YAAY,KACpB,OAAO,eAAe,KACtB,OAAO,QAAQ,KACf,OAAO,OAAO;AAEd,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,SAAS,IAAK;AAAA,IACpB;AACA,QAAI;AACF,cACE,MAAM,KAAK,iBAAiB,CAAC,MAAM,QAAQ,YAAY,MAAM,GAAG;AAAA,QAC9D,SAAS,QAAQ,aAAa;AAAA,QAC9B,WAAW;AAAA,QACX,KAAK,EAAE,MAAM,gCAAgC;AAAA,MAC/C,CAAC,GACD,OAAO,KAAK;AAAA,IAChB,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,YAAY;AAChB,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,IACA,OAAO,YAAY;AACjB,YAAM,OAAO,OAAO;AAAA,IACtB;AAAA,IACA,SAAS,aAAa;AAAA,MACpB,SAAS,MAAM,QAAQ,QAAQ;AAAA,MAC/B,OAAQ,MAAM,OAAO,SAAS,MAAO,WAAW,YAAY;AAAA,IAC9D;AAAA,EACF;AACF;AAaA,IAAM,iBAAiB;AACvB,SAAS,UAAU,OAAe,MAAsB;AACtD,QAAM,MAAM,WAAW,OAAO,EAAE,iBAAiB,MAAM,OAAO,KAAK,CAAC;AACpE,MAAI,KAAK,GACP,SAAwB,MACxB,QAAQ;AACV,SAAO,KAAK,OAAO,IAAI,QAAQ;AAC7B,UAAM,SAAS,IAAI,SAAS,IAAI,KAAK,GAAG;AACxC,QAAI,OAAO,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG;AAClC,QAAI,EAAE,QAAQ;AACZ,YAAM,IAAI,SAAS,kBAAkB,6BAA6B;AACpE,UAAM,OAAO,OAAO,SAAS,GAAG,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AACnE,UAAM,SAAS,OAAO,SAAS,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AACvE,UAAM,OAAO,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK;AAC5C,QACE,KAAK,SAAS,IAAI,KAClB,KAAK,WAAW,GAAG,KACnB,KAAK,MAAM,GAAG,EAAE,SAAS,IAAI;AAE7B,YAAM,IAAI,SAAS,kBAAkB,6BAA6B;AACpE,UAAM,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC;AAC5C,QAAI,CAAC,CAAC,KAAK,MAAM,GAAG,EAAE,SAAS,IAAI;AACjC,YAAM,IAAI,SAAS,kBAAkB,mCAAmC;AAC1E,UAAM,OAAO;AAAA,MACX,OAAO,SAAS,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AAAA,MACxD;AAAA,IACF;AACA,QAAI,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,KAAK,MAAM,OAAO,IAAI;AAC9D,YAAM,IAAI,SAAS,kBAAkB,mBAAmB;AAC1D,UAAM,WAAW;AAAA,MACf,OAAO,SAAS,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AAAA,MACxD;AAAA,IACF;AACA,QAAI,WAAW;AACf,aAAS,IAAI,GAAG,IAAI,KAAK;AACvB,kBAAY,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC;AACjD,QAAI,aAAa;AACf,YAAM,IAAI,SAAS,kBAAkB,0BAA0B;AACjE,QAAI,SAAS,QAAQ,SAAS,KAAK,IAAI,IAAI;AACzC,UAAI,OAAQ,OAAM,IAAI,SAAS,kBAAkB,kBAAkB;AACnE,eAAS,OAAO,KAAK,IAAI,SAAS,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC;AAAA,IAC9D;AACA,UAAM,MAAM,KAAK,KAAK,OAAO,GAAG,IAAI;AAAA,EACtC;AACA,MAAI,CAAC,OAAQ,OAAM,IAAI,SAAS,kBAAkB,yBAAyB;AAC3E,SAAO;AACT;AACO,SAAS,4BAA4B,SAQzB;AACjB,QAAM,OAAOE,SAAQ,QAAQ,IAAI,GAC/B,SAASA,SAAQ,QAAQ,UAAU;AACrC,MAAI,CAAC,OAAO,WAAW,GAAG,IAAI,GAAG;AAC/B,UAAM,IAAI,SAAS,iBAAiB,sCAAsC;AAC5E,MAAI,WAA8B,CAAC;AACnC,QAAM,UAAU,YAAY;AAC1B,UAAM,QAAQA,SAAQD,SAAQ,MAAM,GAAG,MAAME,UAAS,MAAM,CAAC;AAC7D,QAAI,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG;AAC9B,YAAM,IAAI,SAAS,qBAAqB,8BAA8B;AACxE,WAAO;AAAA,EACT;AACA,QAAM,aAAa,CAAC,OAAe;AACjC,QAAI,CAAC,eAAe,KAAK,EAAE;AACzB,YAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAC1D,WAAO,SAAS,MAAM,EAAE;AAAA,EAC1B;AACA,QAAM,WAAW,YAAoC;AACnD,QAAI;AACF,aAAO,KAAK;AAAA,QACV,MAAMC,UAASC,MAAK,MAAM,wBAAwB,GAAG,MAAM;AAAA,MAC7D,EAAE;AAAA,IACJ,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,WAAW,OAAO,IAAY,QAAwB;AAC1D,UAAM,OAAO,WAAW,EAAE;AAC1B,UAAM,OAAO,MAAML,OAAMK,MAAK,MAAM,eAAe,CAAC;AACpD,QAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe;AACxC,YAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAC1D,UAAM,WAAW,MAAM,QAAQ;AAC/B,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,QAAQ,KAAK;AAC3B,QAAI,WAAW;AACf,QAAI;AACF,YAAM,IAAI,MAAM,WAAW;AAAA,QACzB,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf,CAAC;AACD,YAAM,MAAMA,MAAKJ,SAAQ,MAAM,GAAG,YAAY,MAAM,CAAC,EAAE;AACvD,YAAMK,SAAQ,MAAM,GAAG;AACvB,YAAM,IAAI,MAAM,UAAU;AAAA,QACxB,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf,CAAC;AACD,YAAMC,QAAO,KAAK,MAAM;AACxB,iBAAW;AACX,YAAM,QAAQ,QAAQ,MAAM;AAC5B,YAAM,IAAI,MAAM,QAAQ;AACxB,YAAM,QAAQ,OAAO;AACrB,YAAM,WAAWF,MAAK,MAAM,wBAAwB,GAAG;AAAA,QACrD;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,EAAE,iBAAiB,GAAG;AAAA,IAC/B,SAAS,OAAO;AACd,UACE,YACA,iBAAiB,YACjB,MAAM,SAAS,uBACf;AACA,cAAM,WAAWA,MAAK,MAAM,wBAAwB,GAAG;AAAA,UACrD;AAAA,UACA,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,EAAE,iBAAiB,IAAI,cAAc,gBAAgB;AAAA,MAC9D;AACA,UAAI,UAAU;AACZ,YAAI;AACF,gBAAM,QAAQ,QAAQ,KAAK;AAC3B,gBAAM,MAAMA,MAAKJ,SAAQ,MAAM,GAAG,YAAY,MAAM,CAAC,EAAE;AACvD,gBAAMK,SAAQ,UAAU,GAAG;AAC3B,gBAAMC,QAAO,KAAK,MAAM;AACxB,gBAAM,QAAQ,QAAQ,MAAM;AAC5B,gBAAM,QAAQ,OAAO;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI,SAAS,qBAAqB,yBAAyB;AAAA,QACnE;AAAA,MACF,MAAO,OAAM,QAAQ,QAAQ,MAAM;AACnC,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,YAAY;AAChB,YAAM,aAAa,IAAI;AACvB,YAAMC,UAAS,MAAM,QAAQ,EAAE,MAAM,MAAM,IAAI,GAC7C,OAAO,MAAM,SAAS;AACxB,YAAM,QAAsB,CAAC;AAC7B,iBAAW,MAAM,MAAMC,SAAQ,IAAI,GAAG;AACpC,YAAI,CAAC,eAAe,KAAK,EAAE,EAAG;AAC9B,cAAM,OAAO,MAAMT,OAAMK,MAAK,MAAM,EAAE,CAAC;AACvC,YAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,EAAG;AAClD,cAAM,KAAK;AAAA,UACT;AAAA,UACA,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQG,YAAWH,MAAK,MAAM,EAAE;AAAA,UAChC,eAAe,SAASA,MAAK,MAAM,EAAE;AAAA,UACrC,aAAa,KAAK,UAAU,YAAY;AAAA,QAC1C,CAAC;AAAA,MACH;AACA,iBAAW,KAAK;AACd,YAAI,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;AAClC,gBAAM,KAAK;AAAA,YACT,IAAI,EAAE;AAAA,YACN,SAAS,EAAE;AAAA,YACX,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,eAAe;AAAA,YACf,aAAa;AAAA,UACf,CAAC;AACL,aAAO;AAAA,IACT;AAAA,IACA,UAAU,YAAY;AACpB,YAAM,QAAQ,MAAM,QAAQ,OAAO,SAAS;AAC5C,iBAAW,KAAK,OAAO;AACrB,cAAM,MAAM,IAAI,IAAI,EAAE,GAAG;AACzB,YACE,CAAC,eAAe,KAAK,EAAE,EAAE,KACzB,CAAC,eAAe,KAAK,EAAE,OAAO,KAC9B,CAAC,oBAAoB,KAAK,EAAE,MAAM,KAClC,IAAI,aAAa,YACjB,CAAC,QAAQ,OAAO,aAAa,SAAS,IAAI,QAAQ,KAClD,IAAI,YACJ,IAAI;AAEJ,gBAAM,IAAI,SAAS,iBAAiB,6BAA6B;AAAA,MACrE;AACA,iBAAW;AACX,aAAO,EAAE,OAAO,SAAS,OAAO;AAAA,IAClC;AAAA,IACA,SAAS,OAAO,IAAI,QAAQ;AAC1B,UAAI,CAAC,SAAS,OAAQ,YAAW,MAAM,QAAQ,OAAO,SAAS;AAC/D,YAAM,IAAI,SAAS,KAAK,CAACK,OAAMA,GAAE,OAAO,EAAE;AAC1C,UAAI,CAAC;AACH,cAAM,IAAI,SAAS,iBAAiB,iCAAiC;AACvE,YAAM,QAAQ,WAAW,EAAE;AAC3B,UAAI;AACF,cAAMV,OAAM,KAAK;AACjB,eAAO,EAAE,oBAAoB,IAAI,QAAQ,KAAK;AAAA,MAChD,SAAS,GAAG;AACV,YAAK,EAA4B,SAAS,SAAU,OAAM;AAAA,MAC5D;AACA,YAAM,aAAa,IAAI;AACvB,YAAM,IAAI,MAAM;AAChB,YAAM,IAAI,MAAM,WAAW,EAAE,kBAAkB,GAAG,CAAC;AACnD,UAAI,cAAc,EAAE;AACpB,UAAI,WAA4B;AAChC,YAAM,UAAU,YAAY,QAAQ,GAAM;AAC1C,eAAS,YAAY,GAAG,aAAa,GAAG,aAAa;AACnD,cAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,YACE,IAAI,aAAa,YACjB,CAAC,QAAQ,OAAO,aAAa,SAAS,IAAI,QAAQ,KAClD,IAAI,YACJ,IAAI;AAEJ,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,mBAAW,OAAO,QAAQ,SAAS,OAAO,aAAa;AAAA,UACrD,UAAU;AAAA,UACV,QAAQ;AAAA,QACV,CAAC;AACD,YAAI,CAAC,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,EAAE,SAAS,SAAS,MAAM,EAAG;AAC1D,cAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,YAAI,CAAC,YAAY,cAAc;AAC7B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,sBAAc,IAAI,IAAI,UAAU,WAAW,EAAE,SAAS;AAAA,MACxD;AACA,UAAI,CAAC;AACH,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,CAAC,SAAS,MAAM,CAAC,SAAS;AAC5B,cAAM,IAAI,SAAS,0BAA0B,yBAAyB;AACxE,YAAM,SAAS,SAAS,KAAK,UAAU,GACrC,SAAmB,CAAC;AACtB,UAAI,OAAO;AACX,iBAAS;AACP,cAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,YAAI,MAAM,KAAM;AAChB,gBAAQ,MAAM,MAAM;AACpB,YAAI,QAAQ,QAAQ,oBAAoB,KAAK,OAAO,OAAO;AACzD,gBAAM,OAAO,OAAO;AACpB,gBAAM,IAAI,SAAS,gBAAgB,uBAAuB;AAAA,QAC5D;AACA,eAAO,KAAK,OAAO,KAAK,MAAM,KAAK,CAAC;AAAA,MACtC;AACA,YAAM,QAAQ,OAAO,OAAO,MAAM;AAClC,UACEW,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,MAC/C,EAAE,OAAO,YAAY;AAErB,cAAM,IAAI,SAAS,iBAAiB,2BAA2B;AACjE,YAAM,SACJ,EAAE,UAAU,WACR,UAAU,OAAO,EAAE,cAAc,eAAe,IAChD;AACN,YAAM,YAAYN,MAAK,MAAM,cAAc,MAAM,CAAC,EAAE;AACpD,YAAM,aAAa,SAAS;AAC5B,UAAI;AACF,cAAM,aAAaA,MAAK,WAAW,eAAe;AAClD,cAAMO,WAAU,YAAY,QAAQ,EAAE,MAAM,KAAO,MAAM,KAAK,CAAC;AAC/D,YAAI;AACJ,YAAI;AACF,qBACE,MAAM,KAAK,YAAY,CAAC,IAAI,GAAG;AAAA,YAC7B,KAAK;AAAA,YACL,SAAS;AAAA,YACT,WAAW;AAAA,YACX,KAAK,EAAE,MAAM,iBAAiB,MAAM,UAAU;AAAA,UAChD,CAAC,GACD;AAAA,QACJ,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,QAAQ,SAAS,EAAE,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAC/C,gBAAM,IAAI,SAAS,gBAAgB,4BAA4B;AACjE,cAAM,WAAWP,MAAK,WAAW,eAAe,GAAG;AAAA,UACjD,WAAW;AAAA,UACX,QAAQ,EAAE;AAAA,QACZ,CAAC;AACD,cAAM,IAAI,MAAM;AAChB,cAAME,QAAO,WAAW,KAAK;AAC7B,eAAO,EAAE,oBAAoB,GAAG;AAAA,MAClC,UAAE;AACA,cAAMM,IAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACtD;AAAA,IACF;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,OAAO;AACpB,YAAM,SAAS,WAAW,EAAE;AAC5B,UAAI,WAAY,MAAM,QAAQ,KAAM,WAAY,MAAM,SAAS;AAC7D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAMA,IAAG,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACjD,aAAO,EAAE,kBAAkB,GAAG;AAAA,IAChC;AAAA,IACA,UAAU,OAAO,IAAI,QAAQ;AAC3B,UAAI,WAAW,EAAE,MAAO,MAAM,SAAS;AACrC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,aAAO,SAAS,IAAI,GAAG;AAAA,IACzB;AAAA,IACA,SAAS,OAAO,UAAU;AACxB,UACE,OAAO,MAAM,oBAAoB,YACjC,OAAO,MAAM,gBAAgB;AAE7B,eAAO;AACT,UAAI;AACF,cAAM,UAAU,MAAM,QAAQ;AAC9B,YAAI,YAAY,MAAM,mBAAmB,YAAY,MAAM;AACzD,iBAAO;AACT,cAAM,QAAQ,QAAQ,MAAM;AAC5B,cAAM,QAAQ,OAAO;AACrB,eAAO,YAAY,MAAM,cAAc,aAAa;AAAA,MACtD,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;","names":["v","readFile","lstat","unlink","join","resolve","readFile","unlink","join","lstat","readFile","readdir","lstat","rename","open","join","resolve","dirname","resolve","lstat","dirname","readdir","join","readFile","open","rename","current","lstat","readFile","writeFile","rename","symlink","readlink","readdir","rm","join","resolve","dirname","createHash","lstat","dirname","resolve","readlink","readFile","join","symlink","rename","active","readdir","r","createHash","writeFile","rm"]}
+{"version":3,"sources":["../../src/server/common.ts","../../src/server/store.ts","../../src/server/importer.ts","../../src/server/backend.ts","../../src/server/manager.ts","../../src/server/lifecycle.ts"],"sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { mkdir, lstat, chmod, open, rename, unlink } from \"node:fs/promises\";\nimport { dirname, resolve } from \"node:path\";\nimport { spawn } from \"node:child_process\";\nimport type { ErrorCode, ErrorDto } from \"../contracts/index.js\";\nexport class CpaError extends Error {\n  constructor(\n    public code: ErrorCode,\n    message: string,\n    public retryable = false,\n    public retryAt: string | null = null,\n  ) {\n    super(message.slice(0, 512));\n  }\n}\nexport function safeError(\n  error: unknown,\n  operationId: string | null = null,\n): ErrorDto {\n  return error instanceof CpaError\n    ? {\n        code: error.code,\n        message: redactText(error.message),\n        retryable: error.retryable,\n        retryAt: error.retryAt,\n        operationId,\n      }\n    : {\n        code: \"INTERNAL\",\n        message: \"CPA administration operation failed\",\n        retryable: false,\n        retryAt: null,\n        operationId,\n      };\n}\nexport function redactText(text: string) {\n  return text\n    .replace(/\\b(?:Bearer\\s+|sk-)[^\\s,;]+/gi, \"[redacted]\")\n    .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}/gi, \"[redacted]\")\n    .replace(\n      /(?:access_token|refresh_token|api[_-]?key|password|secret)\\s*[:=]\\s*[^\\s,;]+/gi,\n      \"[redacted]\",\n    )\n    .slice(0, 512);\n}\nexport function safeResult(\n  value: Record<string, unknown>,\n): Record<string, unknown> {\n  const visit = (v: unknown): unknown => {\n    if (typeof v === \"string\") return redactText(v);\n    if (Array.isArray(v)) return v.slice(0, 1000).map(visit);\n    if (v && typeof v === \"object\")\n      return Object.fromEntries(\n        Object.entries(v)\n          .filter(\n            ([k]) =>\n              !/token|secret|password|authorization|raw|email|filename|prompt|body/i.test(\n                k,\n              ),\n          )\n          .slice(0, 1000)\n          .map(([k, v]) => [k, visit(v)]),\n      );\n    return v;\n  };\n  return visit(value) as Record<string, unknown>;\n}\nexport function canonical(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(canonical).join(\",\")}]`;\n  if (value && typeof value === \"object\")\n    return `{${Object.entries(value)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`)\n      .join(\",\")}}`;\n  return JSON.stringify(value) ?? \"null\";\n}\nexport const hash = (value: unknown) =>\n  createHash(\"sha256\")\n    .update(typeof value === \"string\" ? value : canonical(value))\n    .digest(\"hex\");\nexport const newId = () => randomUUID();\nexport function confined(root: string, name: string) {\n  if (!/^[A-Za-z0-9_.-]+$/.test(name) || name === \".\" || name === \"..\")\n    throw new CpaError(\"INVALID_INPUT\", \"Invalid protected object ID\");\n  const path = resolve(root, name);\n  if (dirname(path) !== resolve(root))\n    throw new CpaError(\"INVALID_INPUT\", \"Path outside protected root\");\n  return path;\n}\nexport async function protectedDir(path: string) {\n  await mkdir(path, { recursive: true, mode: 0o700 });\n  const stat = await lstat(path);\n  if (stat.isSymbolicLink() || !stat.isDirectory())\n    throw new CpaError(\n      \"INVALID_INPUT\",\n      \"Protected storage must be a real directory\",\n    );\n  await chmod(path, 0o700);\n}\nexport async function atomicJson(path: string, value: unknown) {\n  const temp = `${path}.${newId()}.tmp`;\n  const handle = await open(temp, \"wx\", 0o600);\n  try {\n    await handle.writeFile(JSON.stringify(value));\n    await handle.sync();\n  } finally {\n    await handle.close();\n  }\n  try {\n    await rename(temp, path);\n    const dir = await open(dirname(path), \"r\");\n    try {\n      await dir.sync();\n    } finally {\n      await dir.close();\n    }\n  } catch (error) {\n    await unlink(temp).catch(() => {});\n    throw error;\n  }\n}\n/** POSIX advisory lock: held by a child until stdin closes, survives lease expiry but not process death. */\nexport async function osLock(\n  path: string,\n  timeoutMs = 30_000,\n  options: { mode?: 0o600 | 0o660 } = {},\n): Promise<() => Promise<void>> {\n  const mode = options.mode ?? 0o600;\n  if (mode !== 0o600 && mode !== 0o660)\n    throw new CpaError(\"INTERNAL\", \"Invalid lock permissions\");\n  const child = spawn(\n    \"/usr/bin/python3\",\n    [\n      \"-c\",\n      'import fcntl,sys,os,stat\\nmode=int(sys.argv[2])\\nfd=os.open(sys.argv[1],os.O_CREAT|os.O_RDWR|os.O_NOFOLLOW,mode)\\ns=os.fstat(fd)\\nassert stat.S_ISREG(s.st_mode)\\nif s.st_uid==os.geteuid(): os.fchmod(fd,mode)\\nelse: assert stat.S_IMODE(s.st_mode)==mode\\nf=os.fdopen(fd,\"a+\")\\nfcntl.flock(f,fcntl.LOCK_EX)\\nprint(\"locked\",flush=True)\\nsys.stdin.buffer.read()\\n',\n      path,\n      String(mode),\n    ],\n    {\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      env: {\n        PATH: \"/usr/bin:/bin\",\n        PYTHONNOUSERSITE: \"1\",\n        PYTHONSAFEPATH: \"1\",\n      },\n    },\n  );\n  await new Promise<void>((done, reject) => {\n    const timer = setTimeout(() => {\n      child.kill(\"SIGKILL\");\n      reject(new CpaError(\"INSTANCE_BUSY\", \"Instance writer is busy\", true));\n    }, timeoutMs);\n    child.stdout.once(\"data\", () => {\n      clearTimeout(timer);\n      done();\n    });\n    child.once(\"error\", () => {\n      clearTimeout(timer);\n      reject(new CpaError(\"INTERNAL\", \"POSIX lock helper unavailable\"));\n    });\n    child.once(\"exit\", (code) => {\n      clearTimeout(timer);\n      if (code !== 0)\n        reject(new CpaError(\"INTERNAL\", \"POSIX lock helper failed\"));\n    });\n  });\n  return async () => {\n    await new Promise<void>((done) => {\n      if (child.exitCode !== null) {\n        done();\n        return;\n      }\n      child.once(\"exit\", () => done());\n      child.stdin.end();\n    });\n  };\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { Actor, Command, OperationDto } from \"../contracts/index.js\";\nimport {\n  CpaError,\n  atomicJson,\n  hash,\n  newId,\n  osLock,\n  protectedDir,\n} from \"./common.js\";\nexport interface StoredOperation {\n  dto: OperationDto;\n  command: Command;\n  actor: Actor;\n  payloadHash: string;\n  fence: number;\n  leaseUntil: string | null;\n  owner: string | null;\n  privateState: Record<string, unknown>;\n}\nexport interface OperationStore {\n  accept(\n    command: Command,\n    actor: Actor,\n  ): Promise<{ operation: StoredOperation; reused: boolean }>;\n  get(id: string): Promise<StoredOperation | null>;\n  list(): Promise<StoredOperation[]>;\n  update(\n    id: string,\n    revision: number,\n    fn: (value: StoredOperation) => void,\n  ): Promise<StoredOperation>;\n  writer<T>(action: () => Promise<T>): Promise<T>;\n  reap(now?: number): Promise<void>;\n}\ninterface Journal {\n  version: 1;\n  fence: number;\n  operations: Record<string, StoredOperation>;\n  keys: Record<\n    string,\n    { id: string; hash: string; createdAt: number; expired: boolean }\n  >;\n}\nexport function createFsOperationStore(options: {\n  root: string;\n  clock?: () => number;\n  lockTimeoutMs?: number;\n}): OperationStore {\n  const now = options.clock ?? Date.now;\n  const path = join(options.root, \"journal.json\");\n  const transaction = async <T>(\n    fn: (j: Journal) => T | Promise<T>,\n    write = true,\n  ): Promise<T> => {\n    await protectedDir(options.root);\n    const release = await osLock(\n      join(options.root, \"journal.lock\"),\n      options.lockTimeoutMs,\n    );\n    try {\n      let j: Journal;\n      try {\n        j = JSON.parse(await readFile(path, \"utf8\"));\n        if (\n          j.version !== 1 ||\n          !Number.isSafeInteger(j.fence) ||\n          !j.operations ||\n          !j.keys\n        )\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Operation journal version or shape invalid\",\n          );\n      } catch (e) {\n        if ((e as NodeJS.ErrnoException).code !== \"ENOENT\")\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Operation journal is unreadable\",\n          );\n        j = { version: 1, fence: 0, operations: {}, keys: {} };\n      }\n      const result = await fn(j);\n      if (write) await atomicJson(path, j);\n      return result;\n    } finally {\n      await release();\n    }\n  };\n  return {\n    accept: (command, actor) =>\n      transaction((j) => {\n        const key = hash([\n          command.instanceId,\n          actor.id,\n          command.kind,\n          command.idempotencyKey,\n        ]);\n        const payloadHash = hash(command);\n        const existing = j.keys[key];\n        if (existing) {\n          if (existing.expired)\n            throw new CpaError(\n              \"KEY_EXPIRED\",\n              \"Idempotency key expired; create a new key\",\n            );\n          if (existing.hash !== payloadHash)\n            throw new CpaError(\n              \"IDEMPOTENCY_CONFLICT\",\n              \"Key was used for a different command\",\n            );\n          const op = j.operations[existing.id];\n          if (!op)\n            throw new CpaError(\"RECOVERY_REQUIRED\", \"Operation record missing\");\n          return { operation: op, reused: true };\n        }\n        const time = new Date(now()).toISOString();\n        const id = newId();\n        const operation: StoredOperation = {\n          dto: {\n            apiVersion: 1,\n            instanceId: command.instanceId,\n            id,\n            kind: command.kind,\n            actorId: actor.id,\n            state: \"queued\",\n            phase: \"validate\",\n            progress: { completed: 0, total: null },\n            createdAt: time,\n            startedAt: null,\n            updatedAt: time,\n            finishedAt: null,\n            revision: 0,\n            error: null,\n            result: null,\n            recoveryDisposition: null,\n            cancelRequested: false,\n          },\n          command,\n          actor,\n          payloadHash,\n          fence: ++j.fence,\n          leaseUntil: null,\n          owner: null,\n          privateState: {},\n        };\n        j.operations[id] = operation;\n        j.keys[key] = {\n          id,\n          hash: payloadHash,\n          createdAt: now(),\n          expired: false,\n        };\n        return { operation, reused: false };\n      }),\n    get: (id) =>\n      transaction(\n        (j) => (Object.hasOwn(j.operations, id) ? j.operations[id] : null),\n        false,\n      ),\n    list: () => transaction((j) => Object.values(j.operations), false),\n    update: (id, revision, fn) =>\n      transaction((j) => {\n        const operation = j.operations[id];\n        if (!operation)\n          throw new CpaError(\"INVALID_INPUT\", \"Operation does not exist\");\n        if (operation.dto.revision !== revision)\n          throw new CpaError(\n            \"REVISION_CONFLICT\",\n            \"Operation revision changed\",\n            true,\n          );\n        const before = operation.dto.state;\n        fn(operation);\n        if (before === \"queued\" && operation.dto.state === \"running\")\n          operation.fence = ++j.fence;\n        operation.dto.revision++;\n        operation.dto.updatedAt = new Date(now()).toISOString();\n        return operation;\n      }),\n    writer: async (action) => {\n      await protectedDir(options.root);\n      const release = await osLock(\n        join(options.root, \"writer.lock\"),\n        options.lockTimeoutMs,\n      );\n      try {\n        return await action();\n      } finally {\n        await release();\n      }\n    },\n    reap: (at = now()) =>\n      transaction((j) => {\n        for (const [key, entry] of Object.entries(j.keys)) {\n          if (entry.expired && at - entry.createdAt > 60 * 86400_000) {\n            delete j.keys[key];\n            continue;\n          }\n          const op = j.operations[entry.id];\n          if (\n            at -\n              (op?.dto.finishedAt\n                ? Date.parse(op.dto.finishedAt)\n                : entry.createdAt) >\n              30 * 86400_000 &&\n            op &&\n            [\"succeeded\", \"failed\", \"cancelled\", \"partially_applied\"].includes(\n              op.dto.state,\n            )\n          ) {\n            delete j.operations[entry.id];\n            entry.expired = true;\n            entry.createdAt = at - 30 * 86400_000;\n          }\n        }\n      }),\n  };\n}\n","import { Readable } from \"node:stream\";\nimport {\n  readFile,\n  writeFile,\n  readdir,\n  lstat,\n  unlink,\n  rm,\n  chmod,\n} from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport * as yauzl from \"yauzl\";\nimport {\n  CpaError,\n  atomicJson,\n  canonical,\n  confined,\n  hash,\n  newId,\n  protectedDir,\n} from \"./common.js\";\nexport interface Credential {\n  id: string;\n  provider: string;\n  body: Record<string, unknown>;\n  digest: string;\n}\nexport interface Candidate {\n  id: string;\n  actorId: string;\n  instanceId: string;\n  createdAt: number;\n  expiresAt: number;\n  credentials: Credential[];\n  skipped: number;\n  reasons: Record<string, number>;\n  preview?: {\n    revision: string;\n    expiresAt: number;\n    mode: \"merge\" | \"replace\";\n    overwriteIds: string[];\n  };\n}\nexport interface UploadFile {\n  name: string;\n  data: Uint8Array;\n}\nexport const defaultLimits = {\n  uploadBytes: 64 * 1024 * 1024,\n  entries: 1000,\n  jsonBytes: 1024 * 1024,\n  acceptedBytes: 50 * 1024 * 1024,\n  expandedBytes: 100 * 1024 * 1024,\n  ratio: 100,\n  parseMs: 60_000,\n};\nexport type ImportLimits = typeof defaultLimits;\nconst providers = new Set([\n  \"codex\",\n  \"claude\",\n  \"gemini\",\n  \"qwen\",\n  \"antigravity\",\n  \"iflow\",\n  \"kimi\",\n]);\nexport function parseCredential(\n  data: Uint8Array,\n  limits = defaultLimits,\n): Credential | null {\n  if (data.byteLength > limits.jsonBytes)\n    throw new CpaError(\"UPLOAD_LIMIT\", \"Credential JSON exceeds limit\");\n  let body: unknown;\n  try {\n    let text = new TextDecoder(\"utf-8\", { fatal: true }).decode(data);\n    if (text.charCodeAt(0) === 0xfeff) text = text.slice(1);\n    body = JSON.parse(text);\n  } catch {\n    return null;\n  }\n  if (!body || typeof body !== \"object\" || Array.isArray(body)) return null;\n  const row = body as Record<string, unknown>;\n  const provider =\n    typeof row.type === \"string\" ? row.type.trim().toLowerCase() : \"\";\n  if (\n    !providers.has(provider) ||\n    typeof row.access_token !== \"string\" ||\n    !row.access_token ||\n    typeof row.refresh_token !== \"string\" ||\n    !row.refresh_token\n  )\n    return null;\n  const account =\n    typeof row.account_id === \"string\"\n      ? row.account_id.trim()\n      : typeof row.email === \"string\"\n        ? row.email.trim().toLowerCase()\n        : \"\";\n  if (!account) return null;\n  return {\n    id: hash(`${provider}:${account}`),\n    provider,\n    body: row,\n    digest: hash(row),\n  };\n}\nfunction safeArchivePath(path: string) {\n  if (\n    path.includes(\"\\\\\") ||\n    path.includes(\"\\0\") ||\n    path.startsWith(\"/\") ||\n    /^[A-Za-z]:/.test(path) ||\n    path.split(\"/\").some((part) => part === \"..\" || part === \".\")\n  )\n    throw new CpaError(\"ARCHIVE_UNSAFE\", \"Unsafe archive path\");\n  return path.replace(/\\/$/, \"\");\n}\nfunction selected(path: string) {\n  const parts = path.split(\"/\");\n  if (parts.includes(\"__MACOSX\") || parts.at(-1) === \".DS_Store\") return false;\n  return (\n    path.toLowerCase().endsWith(\".json\") &&\n    (parts.length === 1 ||\n      parts.length === 2 ||\n      (parts.length === 3 && parts[1] === \".auths\"))\n  );\n}\nexport async function importFiles(\n  files: UploadFile[],\n  limits: ImportLimits = defaultLimits,\n  duplicatePolicy: \"collapse\" | \"reject\" = \"collapse\",\n): Promise<{\n  credentials: Credential[];\n  skipped: number;\n  reasons: Record<string, number>;\n}> {\n  if (\n    files.length > limits.entries ||\n    files.reduce((n, f) => n + f.data.byteLength, 0) > limits.uploadBytes\n  )\n    throw new CpaError(\"UPLOAD_LIMIT\", \"Upload exceeds limit\");\n  const credentials = new Map<string, Credential>();\n  let skipped = 0,\n    accepted = 0,\n    expanded = 0,\n    entries = 0;\n  const deadline = Date.now() + limits.parseMs;\n  const paths = new Set<string>();\n  const wrappers = new Set<string>();\n  const reasons: Record<string, number> = {};\n  const consume = (name: string, data: Uint8Array) => {\n    if (Date.now() > deadline)\n      throw new CpaError(\"UPLOAD_LIMIT\", \"Import parsing deadline exceeded\");\n    if (!selected(name)) {\n      skipped++;\n      reasons.ignored = (reasons.ignored ?? 0) + 1;\n      return;\n    }\n    const parts = name.split(\"/\");\n    if (parts.length > 1) wrappers.add(parts[0]);\n    if (wrappers.size > 1)\n      throw new CpaError(\n        \"ARCHIVE_UNSAFE\",\n        \"Only one enclosing credential folder is allowed\",\n      );\n    const credential = parseCredential(data, limits);\n    if (!credential) {\n      skipped++;\n      reasons.invalidCredential = (reasons.invalidCredential ?? 0) + 1;\n      return;\n    }\n    const existing = credentials.get(credential.id);\n    if (existing && existing.digest !== credential.digest)\n      throw new CpaError(\n        \"CREDENTIAL_INVALID\",\n        \"Conflicting duplicate credential identity\",\n      );\n    if (existing) {\n      if (duplicatePolicy === \"reject\")\n        throw new CpaError(\n          \"CREDENTIAL_INVALID\",\n          \"Duplicate credential identity\",\n        );\n      skipped++;\n      reasons.duplicate = (reasons.duplicate ?? 0) + 1;\n      return;\n    }\n    accepted += data.byteLength;\n    if (accepted > limits.acceptedBytes)\n      throw new CpaError(\"UPLOAD_LIMIT\", \"Accepted credentials exceed limit\");\n    credentials.set(credential.id, credential);\n  };\n  for (const file of files) {\n    if (file.data[0] === 0x50 && file.data[1] === 0x4b) {\n      await new Promise<void>((resolve, reject) => {\n        yauzl.fromBuffer(\n          Buffer.from(file.data),\n          {\n            lazyEntries: true,\n            validateEntrySizes: true,\n            strictFileNames: true,\n          },\n          (error, zip) => {\n            if (error || !zip) {\n              reject(new CpaError(\"ARCHIVE_UNSAFE\", \"Corrupt ZIP archive\"));\n              return;\n            }\n            let declared = 0;\n            const fail = (e: unknown) => {\n              zip.close();\n              reject(\n                e instanceof CpaError\n                  ? e\n                  : new CpaError(\n                      \"ARCHIVE_UNSAFE\",\n                      \"Archive decompression failed\",\n                    ),\n              );\n            };\n            zip.on(\"error\", fail);\n            zip.on(\"end\", resolve);\n            zip.on(\"entry\", (entry: yauzl.Entry) => {\n              try {\n                if (++entries > limits.entries)\n                  throw new CpaError(\n                    \"UPLOAD_LIMIT\",\n                    \"Too many archive entries\",\n                  );\n                const path = safeArchivePath(entry.fileName);\n                if (paths.has(path))\n                  throw new CpaError(\n                    \"ARCHIVE_UNSAFE\",\n                    \"Duplicate archive path\",\n                  );\n                paths.add(path);\n                const mode = (entry.externalFileAttributes >>> 16) & 0xf000;\n                if (\n                  [0xa000, 0x2000, 0x6000, 0x1000, 0xc000].includes(mode) ||\n                  entry.generalPurposeBitFlag & 1\n                )\n                  throw new CpaError(\n                    \"ARCHIVE_UNSAFE\",\n                    \"Links, devices and encrypted entries are forbidden\",\n                  );\n                if (selected(path)) declared += entry.uncompressedSize;\n                if (\n                  declared > limits.expandedBytes ||\n                  (selected(path) && entry.uncompressedSize >\n                    Math.max(1, entry.compressedSize) * limits.ratio)\n                )\n                  throw new CpaError(\n                    \"UPLOAD_LIMIT\",\n                    \"Archive expansion exceeds limit\",\n                  );\n                if (entry.fileName.endsWith(\"/\")) {\n                  zip.readEntry();\n                  return;\n                }\n                // Ignored files are never decompressed or held in memory.\n                if (!selected(path)) {\n                  skipped++;\n                  reasons.ignored = (reasons.ignored ?? 0) + 1;\n                  zip.readEntry();\n                  return;\n                }\n                zip.openReadStream(entry, (err, stream) => {\n                  if (err || !stream) {\n                    fail(err);\n                    return;\n                  }\n                  const chunks: Buffer[] = [];\n                  let size = 0;\n                  let crc = 0xffffffff;\n                  stream.on(\"data\", (chunk: Buffer) => {\n                    for (const byte of chunk) {\n                      crc ^= byte;\n                      for (let n = 0; n < 8; n++)\n                        crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);\n                    }\n                    size += chunk.length;\n                    expanded += chunk.length;\n                    if (\n                      expanded > limits.expandedBytes ||\n                      Date.now() > deadline ||\n                      (selected(path) && size > limits.jsonBytes)\n                    ) {\n                      stream.destroy(\n                        new CpaError(\n                          \"UPLOAD_LIMIT\",\n                          \"Decompressed data exceeds limit\",\n                        ),\n                      );\n                      return;\n                    }\n                    if (selected(path)) chunks.push(chunk);\n                  });\n                  stream.on(\"error\", fail);\n                  stream.on(\"end\", () => {\n                    try {\n                      if ((crc ^ 0xffffffff) >>> 0 !== entry.crc32)\n                        throw new CpaError(\n                          \"ARCHIVE_UNSAFE\",\n                          \"Archive CRC mismatch\",\n                        );\n                      consume(path, Buffer.concat(chunks));\n                      zip.readEntry();\n                    } catch (e) {\n                      fail(e);\n                    }\n                  });\n                });\n              } catch (e) {\n                fail(e);\n              }\n            });\n            zip.readEntry();\n          },\n        );\n      });\n    } else {\n      entries++;\n      const path = safeArchivePath(file.name);\n      if (paths.has(path))\n        throw new CpaError(\"ARCHIVE_UNSAFE\", \"Duplicate file path\");\n      paths.add(path);\n      expanded += file.data.byteLength;\n      consume(path.includes(\"/\") ? path : `${path}.json`, file.data);\n    }\n  }\n  if (!credentials.size)\n    throw new CpaError(\"CREDENTIAL_INVALID\", \"No supported credentials found\");\n  return { credentials: [...credentials.values()], skipped, reasons };\n}\nexport interface StagingStore {\n  upload(\n    files: UploadFile[],\n    actorId: string,\n    instanceId: string,\n  ): Promise<string>;\n  stage(\n    uploadId: string,\n    actorId: string,\n    instanceId: string,\n  ): Promise<Candidate>;\n  get(\n    id: string,\n    actorId: string,\n    instanceId: string,\n    admin?: boolean,\n  ): Promise<Candidate>;\n  save(candidate: Candidate): Promise<void>;\n  remove(id: string): Promise<void>;\n  reap(protectedIds: Set<string>): Promise<void>;\n}\nexport function createFsStagingStore(options: {\n  root: string;\n  limits?: ImportLimits;\n  clock?: () => number;\n  duplicatePolicy?: \"collapse\" | \"reject\";\n}): StagingStore {\n  const now = options.clock ?? Date.now,\n    limits = options.limits ?? defaultLimits;\n  const candidatePath = (id: string) =>\n    confined(options.root, `${id}.candidate.json`);\n  return {\n    upload: async (files, actorId, instanceId) => {\n      await protectedDir(options.root);\n      if (\n        files.reduce((n, f) => n + f.data.byteLength, 0) > limits.uploadBytes ||\n        files.length > limits.entries\n      )\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Upload exceeds limit\");\n      const id = newId();\n      await atomicJson(confined(options.root, `${id}.upload.json`), {\n        actorId,\n        instanceId,\n        expiresAt: now() + 3600_000,\n        files: files.map((f) => ({\n          name: f.name,\n          data: Buffer.from(f.data).toString(\"base64\"),\n        })),\n      });\n      return id;\n    },\n    stage: async (id, actorId, instanceId) => {\n      const path = confined(options.root, `${id}.upload.json`);\n      let upload: {\n        actorId: string;\n        instanceId: string;\n        expiresAt: number;\n        files: { name: string; data: string }[];\n      };\n      try {\n        upload = JSON.parse(await readFile(path, \"utf8\"));\n      } catch {\n        throw new CpaError(\"INVALID_INPUT\", \"Upload unavailable\");\n      }\n      if (upload.actorId !== actorId || upload.instanceId !== instanceId)\n        throw new CpaError(\"NOT_AUTHORIZED\", \"Upload belongs to another actor\");\n      try {\n        if (upload.expiresAt < now())\n          throw new CpaError(\"KEY_EXPIRED\", \"Upload expired\");\n        const imported = await importFiles(\n          upload.files.map((f) => ({\n            name: f.name,\n            data: Buffer.from(f.data, \"base64\"),\n          })),\n          limits,\n          options.duplicatePolicy ?? \"collapse\",\n        );\n        const candidate: Candidate = {\n          ...imported,\n          id: newId(),\n          actorId,\n          instanceId,\n          createdAt: now(),\n          expiresAt: now() + 3600_000,\n        };\n        await atomicJson(candidatePath(candidate.id), candidate);\n        return candidate;\n      } finally {\n        await unlink(path).catch(() => {});\n      }\n    },\n    get: async (id, actorId, instanceId, admin) => {\n      let c: Candidate;\n      try {\n        c = JSON.parse(await readFile(candidatePath(id), \"utf8\"));\n      } catch {\n        throw new CpaError(\"INVALID_INPUT\", \"Candidate unavailable\");\n      }\n      if (c.instanceId !== instanceId || (c.actorId !== actorId && !admin))\n        throw new CpaError(\n          \"NOT_AUTHORIZED\",\n          \"Candidate belongs to another actor\",\n        );\n      if (c.expiresAt < now())\n        throw new CpaError(\"KEY_EXPIRED\", \"Candidate expired\");\n      return c;\n    },\n    save: (c) => atomicJson(candidatePath(c.id), c),\n    remove: async (id) => {\n      await unlink(candidatePath(id)).catch((e) => {\n        if (e.code !== \"ENOENT\") throw e;\n      });\n    },\n    reap: async (protectedIds) => {\n      await protectedDir(options.root);\n      for (const name of await readdir(options.root)) {\n        if (!/\\.candidate\\.json$|\\.upload\\.json$/.test(name)) continue;\n        const id = name.split(\".\")[0];\n        if (protectedIds.has(id)) continue;\n        const path = confined(options.root, name);\n        try {\n          const value = JSON.parse(await readFile(path, \"utf8\"));\n          if (value.expiresAt < now()) await unlink(path);\n        } catch {}\n      }\n    },\n  };\n}\n/** Trusted CLI only: never expose directory paths as HTTP inputs. */\nexport async function readCredentialDirectory(\n  root: string,\n  limits = defaultLimits,\n): Promise<UploadFile[]> {\n  const result: UploadFile[] = [];\n  let count = 0,\n    total = 0;\n  const visit = async (path: string, prefix: string, depth: number) => {\n    for (const name of await readdir(path)) {\n      if (++count > limits.entries)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Directory entry limit exceeded\");\n      const full = join(path, name),\n        stat = await lstat(full);\n      if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile()))\n        throw new CpaError(\n          \"ARCHIVE_UNSAFE\",\n          \"Directory contains a link or device\",\n        );\n      if (stat.isDirectory()) {\n        if (depth < 2 && name !== \"__MACOSX\")\n          await visit(full, `${prefix}${name}/`, depth + 1);\n        continue;\n      }\n      if (!selected(`${prefix}${name}`)) continue;\n      if (stat.size > limits.jsonBytes)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Credential file exceeds limit\");\n      total += stat.size;\n      if (total > limits.uploadBytes)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Directory upload exceeds limit\");\n      result.push({ name: `${prefix}${name}`, data: await readFile(full) });\n    }\n  };\n  const rootStat = await lstat(root);\n  if (rootStat.isSymbolicLink() || !rootStat.isDirectory())\n    throw new CpaError(\"ARCHIVE_UNSAFE\", \"Directory root must not be a link\");\n  await visit(root, \"\", 0);\n  return result;\n}\n","import {\n  readFile,\n  readdir,\n  lstat,\n  mkdir,\n  writeFile,\n  symlink,\n  readlink,\n  rename,\n  unlink,\n  rm,\n  open,\n} from \"node:fs/promises\";\nimport { join, resolve, dirname } from \"node:path\";\nimport type { Capabilities, CredentialDto } from \"../contracts/index.js\";\nimport { CpaError, atomicJson, hash, newId, protectedDir } from \"./common.js\";\nimport { parseCredential, type Credential } from \"./importer.js\";\nexport interface Snapshot {\n  revision: string;\n  credentials: CredentialDto[];\n}\nexport interface ApplyInput {\n  credentials: Credential[];\n  mode: \"merge\" | \"replace\";\n  overwriteIds: string[];\n  confirmedRemovals: string[];\n  expectedRevision: string;\n}\nexport interface BackendContext {\n  phase(\n    phase: \"prepare\" | \"switch\" | \"verify\" | \"commit\",\n    state?: Record<string, unknown>,\n  ): Promise<void>;\n  check(): Promise<void>;\n}\nexport interface Backend {\n  capabilities: Capabilities;\n  managementAvailability: \"available\" | \"unavailable\" | \"unknown\";\n  snapshot(): Promise<Snapshot>;\n  apply(\n    input: ApplyInput,\n    ctx: BackendContext,\n  ): Promise<Record<string, unknown>>;\n  delete(\n    id: string,\n    expectedRevision: string,\n    ctx: BackendContext,\n  ): Promise<Record<string, unknown>>;\n  recover(\n    state: Record<string, unknown>,\n  ): Promise<\"verified\" | \"rolled_back\" | \"unknown\">;\n}\nexport interface RuntimeLifecycle {\n  stop(): Promise<void>;\n  start(): Promise<void>;\n  inspect(): Promise<{\n    version: string | null;\n    state: \"running\" | \"stopped\" | \"unknown\";\n  }>;\n}\nexport function createReadOnlyBackend(): Backend {\n  const unavailable = async (): Promise<never> => {\n    throw new CpaError(\n      \"UNSUPPORTED_CAPABILITY\",\n      \"Credential management is unavailable for this endpoint\",\n    );\n  };\n  return {\n    capabilities: Object.fromEntries(\n      [\n        \"import.stage\",\n        \"import.apply\",\n        \"import.cancel\",\n        \"credential.delete\",\n        \"credentials.list\",\n      ].map((name) => [\n        name,\n        { enabled: false, reasonCode: \"NO_VERIFIED_MANAGEMENT\" },\n      ]),\n    ),\n    managementAvailability: \"unknown\",\n    snapshot: async () => ({ revision: hash(\"read-only\"), credentials: [] }),\n    apply: unavailable,\n    delete: unavailable,\n    recover: async () => \"unknown\",\n  };\n}\nexport function createInferenceCatalog(options: {\n  baseUrl: string;\n  secret: () => Promise<string>;\n  fetch?: typeof fetch;\n  timeoutMs?: number;\n}) {\n  const url = new URL(options.baseUrl);\n  if (\n    ![\"http:\", \"https:\"].includes(url.protocol) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash\n  )\n    throw new CpaError(\"INVALID_INPUT\", \"Invalid trusted inference URL\");\n  return async () => {\n    let response: Response;\n    try {\n      response = await (options.fetch ?? fetch)(\n        `${options.baseUrl.replace(/\\/$/, \"\")}/models`,\n        {\n          headers: { Authorization: `Bearer ${await options.secret()}` },\n          redirect: \"error\",\n          signal: AbortSignal.timeout(options.timeoutMs ?? 30_000),\n        },\n      );\n    } catch {\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Model catalog request unavailable\",\n        true,\n      );\n    }\n    if (!response.ok)\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Model catalog request rejected\",\n        response.status >= 500,\n      );\n    let bytes = 0;\n    const chunks: Uint8Array[] = [];\n    if (!response.body)\n      throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Model catalog unavailable\");\n    for await (const chunk of response.body as unknown as AsyncIterable<Uint8Array>) {\n      bytes += chunk.length;\n      if (bytes > 1024 * 1024)\n        throw new CpaError(\"UPLOAD_LIMIT\", \"Model catalog exceeds limit\");\n      chunks.push(chunk);\n    }\n    let body: { data?: { id?: unknown }[] };\n    try {\n      body = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n    } catch {\n      throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Invalid model catalog\");\n    }\n    if (!Array.isArray(body.data) || body.data.length > 1000)\n      throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Invalid model catalog\");\n    return body.data.map((m) => {\n      if (typeof m.id !== \"string\" || !m.id || m.id.length > 256)\n        throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Invalid model ID\");\n      return { id: m.id, capabilities: [] as string[] };\n    });\n  };\n}\nconst dto = (c: Credential): CredentialDto => ({\n  id: c.id,\n  provider: c.provider,\n  fingerprint: `${c.id.slice(0, 6)}…${c.id.slice(-4)}`,\n  usability: c.body.disabled === true ? \"disabled\" : \"usable\",\n  updatedAt:\n    typeof c.body.last_refresh === \"string\" &&\n    Number.isFinite(Date.parse(c.body.last_refresh))\n      ? new Date(c.body.last_refresh).toISOString()\n      : null,\n});\nexport function createManagedFileBackend(options: {\n  root: string;\n  activePath: string;\n  lifecycle: RuntimeLifecycle;\n  verify: () => Promise<void>;\n  allowUnknownDeletion?: boolean;\n}): Backend {\n  const root = resolve(options.root),\n    active = resolve(options.activePath);\n  if (!active.startsWith(`${root}/`))\n    throw new CpaError(\n      \"INVALID_INPUT\",\n      \"Active pool must be confined to managed root\",\n    );\n  const current = async () => {\n    let path: string;\n    try {\n      const stat = await lstat(active);\n      if (stat.isSymbolicLink()) {\n        path = resolve(dirname(active), await readlink(active));\n        if (!path.startsWith(`${root}/`))\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Active pool points outside managed root\",\n          );\n      } else if (stat.isDirectory()) path = active;\n      else throw new Error();\n    } catch (e) {\n      if (e instanceof CpaError) throw e;\n      throw new CpaError(\"RECOVERY_REQUIRED\", \"Active pool unavailable\");\n    }\n    return path;\n  };\n  const read = async () => {\n    const path = await current(),\n      items: Credential[] = [];\n    const raw: Record<string, string> = {};\n    const opaque: { id: string; name: string; bytes: Buffer }[] = [];\n    for (const name of (await readdir(path)).sort()) {\n      if (!name.endsWith(\".json\")) continue;\n      const stat = await lstat(join(path, name));\n      if (!stat.isFile() || stat.isSymbolicLink())\n        throw new CpaError(\n          \"RECOVERY_REQUIRED\",\n          \"Unsafe active credential file\",\n        );\n      const bytes = await readFile(join(path, name));\n      raw[name] = hash(bytes.toString(\"base64\"));\n      const c = parseCredential(bytes);\n      if (c) {\n        if (items.some((item) => item.id === c.id))\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Duplicate active credential identity\",\n          );\n        items.push(c);\n      } else opaque.push({ id: hash(`file:${name}`), name, bytes });\n    }\n    return { path, items, opaque, revision: hash(raw) };\n  };\n  const snapshot = async () => {\n    const s = await read();\n    return {\n      revision: s.revision,\n      credentials: [\n        ...s.items.map(dto),\n        ...s.opaque.map((o) => ({\n          id: o.id,\n          provider: \"unknown\",\n          fingerprint: `${o.id.slice(0, 6)}…${o.id.slice(-4)}`,\n          usability: \"unknown\" as const,\n          updatedAt: null,\n        })),\n      ],\n    };\n  };\n  const mutate = async (\n    expected: string,\n    build: (fresh: Awaited<ReturnType<typeof read>>) => Credential[],\n    ctx: BackendContext,\n    preserveOpaque = true,\n  ) => {\n    await ctx.check();\n    await options.lifecycle.stop();\n    let switched = false;\n    let previous = \"\";\n    let next = \"\";\n    try {\n      const fresh = await read();\n      previous = fresh.path;\n      if (fresh.revision !== expected)\n        throw new CpaError(\n          \"REVISION_CONFLICT\",\n          \"Pool refreshed since preview; confirm again\",\n        );\n      const credentials = build(fresh);\n      if (\n        !credentials.length ||\n        !credentials.some((c) => c.body.disabled !== true)\n      )\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Cannot remove the last usable credential\",\n        );\n      await ctx.check();\n      next = join(root, \"generations\", `cpa_${newId()}`);\n      await protectedDir(dirname(next));\n      await protectedDir(next);\n      for (const c of credentials) {\n        const handle = await open(join(next, `${c.id}.json`), \"wx\", 0o600);\n        try {\n          await handle.writeFile(JSON.stringify(c.body));\n          await handle.sync();\n        } finally {\n          await handle.close();\n        }\n      }\n      if (preserveOpaque)\n        for (const o of fresh.opaque) {\n          const handle = await open(join(next, `${o.id}.json`), \"wx\", 0o600);\n          try {\n            await handle.writeFile(o.bytes);\n            await handle.sync();\n          } finally {\n            await handle.close();\n          }\n        }\n      const nextDir = await open(next, \"r\");\n      try {\n        await nextDir.sync();\n      } finally {\n        await nextDir.close();\n      }\n      await ctx.phase(\"prepare\", { previousPool: previous, nextPool: next });\n      const tmp = join(dirname(active), `.auths-${newId()}`);\n      await symlink(next, tmp);\n      await ctx.check();\n      await ctx.phase(\"switch\", { previousPool: previous, nextPool: next });\n      await rename(tmp, active);\n      switched = true;\n      await options.lifecycle.start();\n      await ctx.phase(\"verify\", { previousPool: previous, nextPool: next });\n      await options.verify();\n      await atomicJson(join(root, \"last-good.json\"), {\n        previousPool: previous,\n        activePool: next,\n      });\n      await ctx.phase(\"commit\");\n      return {\n        revision: (await snapshot()).revision,\n        count: credentials.length,\n      };\n    } catch (error) {\n      if (\n        switched &&\n        error instanceof CpaError &&\n        error.code === \"PROBE_QUOTA_LIMITED\"\n      ) {\n        await atomicJson(join(root, \"last-good.json\"), {\n          previousPool: previous,\n          activePool: next,\n        });\n        const current = await snapshot();\n        return {\n          revision: current.revision,\n          count: current.credentials.length,\n          verification: \"quota_limited\",\n        };\n      }\n      if (switched) {\n        try {\n          const tmp = join(dirname(active), `.auths-${newId()}`);\n          await options.lifecycle.stop();\n          await symlink(previous, tmp);\n          await rename(tmp, active);\n          await options.lifecycle.start();\n          await options.verify();\n        } catch {\n          throw new CpaError(\n            \"RECOVERY_REQUIRED\",\n            \"Pool rollback could not be verified\",\n          );\n        }\n      } else await options.lifecycle.start();\n      throw error;\n    }\n  };\n  return {\n    capabilities: {\n      \"import.stage\": { enabled: true, reasonCode: null },\n      \"import.apply\": {\n        enabled: true,\n        reasonCode: null,\n        modes: [\"merge\", \"replace\"],\n        overwrite: true,\n      },\n      \"import.cancel\": { enabled: true, reasonCode: null },\n      \"credential.delete\": { enabled: true, reasonCode: null },\n      \"credentials.list\": { enabled: true, reasonCode: null },\n    },\n    managementAvailability: \"unavailable\",\n    snapshot,\n    apply: (input, ctx) =>\n      mutate(\n        input.expectedRevision,\n        (fresh) => {\n          const existing = new Map(fresh.items.map((c) => [c.id, c]));\n          const next =\n            input.mode === \"merge\"\n              ? new Map(existing)\n              : new Map<string, Credential>();\n          for (const c of input.credentials)\n            next.set(\n              c.id,\n              existing.has(c.id) && !input.overwriteIds.includes(c.id)\n                ? existing.get(c.id)!\n                : c,\n            );\n          if (input.mode === \"replace\") {\n            const removals = [...existing.keys()].filter((id) => !next.has(id));\n            removals.push(...fresh.opaque.map((o) => o.id));\n            if (removals.some((id) => !input.confirmedRemovals.includes(id)))\n              throw new CpaError(\n                \"INVALID_INPUT\",\n                \"Pool removals require explicit confirmation\",\n              );\n          }\n          return [...next.values()];\n        },\n        ctx,\n        input.mode === \"merge\",\n      ),\n    delete: (id, revision, ctx) =>\n      mutate(\n        revision,\n        (fresh) => {\n          if (\n            !fresh.items.some((c) => c.id === id) &&\n            !fresh.opaque.some((o) => o.id === id)\n          )\n            throw new CpaError(\n              \"REVISION_CONFLICT\",\n              \"Credential no longer exists\",\n            );\n          fresh.opaque = fresh.opaque.filter((o) => o.id !== id);\n          return fresh.items.filter((c) => c.id !== id);\n        },\n        ctx,\n      ),\n    recover: async (state) => {\n      const next = typeof state.nextPool === \"string\" ? state.nextPool : null,\n        previous =\n          typeof state.previousPool === \"string\" ? state.previousPool : null;\n      if (\n        !next ||\n        !previous ||\n        !next.startsWith(`${root}/`) ||\n        !previous.startsWith(`${root}/`)\n      )\n        return \"unknown\";\n      try {\n        const path = await current();\n        if (path === next) {\n          await options.lifecycle.start();\n          await options.verify();\n          return \"verified\";\n        }\n        if (path === previous) {\n          await options.lifecycle.start();\n          await options.verify();\n          return \"rolled_back\";\n        }\n        return \"unknown\";\n      } catch {\n        return \"unknown\";\n      }\n    },\n  };\n}\nexport interface ManagementTransport {\n  request(path: string, init?: RequestInit): Promise<unknown>;\n}\nexport function createManagementTransport(options: {\n  baseUrl: string;\n  secret: () => Promise<string>;\n  fetch?: typeof fetch;\n  timeoutMs?: number;\n}): ManagementTransport {\n  const url = new URL(options.baseUrl);\n  if (\n    ![\"http:\", \"https:\"].includes(url.protocol) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash\n  )\n    throw new CpaError(\"INVALID_INPUT\", \"Invalid trusted management endpoint\");\n  const base = options.baseUrl.replace(/\\/$/, \"\");\n  return {\n    request: async (path, init = {}) => {\n      if (!/^\\/[a-z0-9/-]+(?:\\?[^\\r\\n]*)?$/.test(path))\n        throw new CpaError(\"INVALID_INPUT\", \"Invalid management route\");\n      const headers = new Headers(init.headers);\n      headers.set(\"Authorization\", `Bearer ${await options.secret()}`);\n      const signal = AbortSignal.any([\n        AbortSignal.timeout(options.timeoutMs ?? 30_000),\n        ...(init.signal ? [init.signal] : []),\n      ]);\n      let response: Response;\n      try {\n        response = await (options.fetch ?? fetch)(\n          `${base}/v8/management${path}`,\n          { ...init, headers, signal, redirect: \"error\" },\n        );\n      } catch {\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Management request unavailable\",\n          true,\n        );\n      }\n      if (!response.ok)\n        throw new CpaError(\n          response.status === 429\n            ? \"PROBE_QUOTA_LIMITED\"\n            : \"MANAGEMENT_UNAVAILABLE\",\n          \"Management request rejected\",\n          response.status >= 500,\n        );\n      if (response.status === 204) return {};\n      try {\n        if (!response.body) throw new Error();\n        const reader = response.body.getReader(),\n          chunks: Uint8Array[] = [];\n        let size = 0;\n        for (;;) {\n          const chunk = await reader.read();\n          if (chunk.done) break;\n          size += chunk.value.length;\n          if (size > 2 * 1024 * 1024) {\n            await reader.cancel();\n            throw new Error();\n          }\n          chunks.push(chunk.value);\n        }\n        return JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n      } catch {\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Management response invalid\",\n        );\n      }\n    },\n  };\n}\nexport function createPostgresManagementBackend(options: {\n  transport: ManagementTransport;\n  singleController: boolean;\n  verifiedProtocol: boolean;\n  allowUnknownDeletion?: boolean;\n}): Backend {\n  const enabled = options.singleController && options.verifiedProtocol;\n  const capabilities: Capabilities = Object.fromEntries(\n    [\n      \"import.stage\",\n      \"import.apply\",\n      \"import.cancel\",\n      \"credential.delete\",\n      \"credentials.list\",\n    ].map((name) => [\n      name,\n      { enabled, reasonCode: enabled ? null : \"UNVERIFIED_BACKEND\" },\n    ]),\n  );\n  capabilities[\"import.apply\"] = {\n    enabled,\n    reasonCode: enabled ? null : \"UNVERIFIED_BACKEND\",\n    modes: [\"merge\"],\n    overwrite: false,\n  };\n  const names = new Map<string, string>();\n  const snapshot = async () => {\n    if (!options.verifiedProtocol)\n      throw new CpaError(\n        \"UNSUPPORTED_CAPABILITY\",\n        \"Management backend is unverified\",\n      );\n    const body = (await options.transport.request(\"/credentials\")) as {\n      files?: Record<string, unknown>[];\n    };\n    if (!Array.isArray(body.files) || body.files.length > 1000)\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Credential listing invalid\",\n      );\n    names.clear();\n    const raw: (Record<string, unknown> & { id: string; digest: string })[] =\n      [];\n    for (const row of body.files) {\n      const name = typeof row.name === \"string\" ? row.name : \"\";\n      if (!name || name.includes(\"/\") || name.includes(\"\\\\\"))\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Credential identifier invalid\",\n        );\n      const downloaded =\n        row.runtime_only === true\n          ? null\n          : await options.transport.request(\n              `/credentials/download?name=${encodeURIComponent(name)}`,\n            );\n      const credential = downloaded\n        ? parseCredential(Buffer.from(JSON.stringify(downloaded)))\n        : null;\n      const id = credential?.id ?? hash(name);\n      names.set(id, name);\n      raw.push({ ...row, id, digest: hash(downloaded ?? row) });\n    }\n    const credentials: CredentialDto[] = raw.map((row) => ({\n      id: row.id as string,\n      provider:\n        typeof row.type === \"string\"\n          ? row.type\n          : typeof row.provider === \"string\"\n            ? row.provider\n            : \"unknown\",\n      fingerprint: `${String(row.id).slice(0, 6)}…${String(row.id).slice(-4)}`,\n      usability:\n        row.disabled === true\n          ? \"disabled\"\n          : row.status === \"ready\"\n            ? \"usable\"\n            : \"unknown\",\n      updatedAt: typeof row.updated_at === \"string\" ? row.updated_at : null,\n    }));\n    return { revision: hash(raw), credentials };\n  };\n  return {\n    capabilities,\n    managementAvailability: options.verifiedProtocol ? \"available\" : \"unknown\",\n    snapshot,\n    apply: async (input, ctx) => {\n      if (!enabled || input.mode === \"replace\" || input.overwriteIds.length)\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"PG supports new identities only\",\n        );\n      const initial = await snapshot();\n      if (initial.revision !== input.expectedRevision)\n        throw new CpaError(\"REVISION_CONFLICT\", \"Credential pool changed\");\n      const outcomes: { id: string; state: string }[] = [];\n      for (const credential of input.credentials) {\n        await ctx.check();\n        const latest = await snapshot();\n        const known = latest.credentials.some((c) => c.id === credential.id);\n        if (known) {\n          outcomes.push({ id: credential.id, state: \"preserved\" });\n          continue;\n        }\n        await ctx.phase(\"switch\", { outcomes });\n        try {\n          await options.transport.request(\n            `/credentials?name=${encodeURIComponent(`${credential.id}.json`)}`,\n            {\n              method: \"POST\",\n              headers: { \"Content-Type\": \"application/json\" },\n              body: JSON.stringify(credential.body),\n            },\n          );\n          outcomes.push({ id: credential.id, state: \"applied\" });\n        } catch {\n          outcomes.push({ id: credential.id, state: \"unknown\" });\n          await ctx.phase(\"verify\", { outcomes });\n          throw new CpaError(\n            outcomes.some((o) => o.state === \"applied\")\n              ? \"APPLY_PARTIAL\"\n              : \"OUTCOME_UNKNOWN\",\n            \"Import requires reconciliation; do not repeat automatically\",\n          );\n        }\n      }\n      await ctx.phase(\"verify\", { outcomes });\n      await snapshot();\n      return { outcomes };\n    },\n    delete: async (id, expected, ctx) => {\n      if (!enabled)\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"Credential deletion disabled\",\n        );\n      const s = await snapshot();\n      if (s.revision !== expected)\n        throw new CpaError(\"REVISION_CONFLICT\", \"Credential pool changed\");\n      const name = names.get(id);\n      if (!name)\n        throw new CpaError(\"REVISION_CONFLICT\", \"Credential no longer exists\");\n      if (\n        s.credentials.length <= 1 ||\n        (!options.allowUnknownDeletion &&\n          !s.credentials\n            .filter((c) => c.id !== id)\n            .some((c) => c.usability === \"usable\"))\n      )\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Last usable account deletion prohibited\",\n        );\n      await ctx.phase(\"switch\", { credentialId: id });\n      try {\n        await options.transport.request(\n          `/credentials?name=${encodeURIComponent(name)}`,\n          { method: \"DELETE\" },\n        );\n      } catch {\n        throw new CpaError(\n          \"OUTCOME_UNKNOWN\",\n          \"Deletion outcome unknown; reconcile before retry\",\n        );\n      }\n      await ctx.phase(\"verify\");\n      const after = await snapshot();\n      if (after.credentials.some((c) => c.id === id))\n        throw new CpaError(\"OUTCOME_UNKNOWN\", \"Deletion not confirmed\");\n      return { revision: after.revision, deletedId: id };\n    },\n    recover: async () => \"unknown\",\n  };\n}\n","import { hostname } from \"node:os\";\nimport type {\n  AcceptResult,\n  Actor,\n  Command,\n  ImportPreviewDto,\n  ListDto,\n  ModelsDto,\n  OperationDto,\n  Phase,\n  ReleaseDto,\n  StatusDto,\n} from \"../contracts/index.js\";\nimport { commandSchema, isTerminal, idSchema } from \"../contracts/index.js\";\nimport type { Backend, BackendContext, RuntimeLifecycle } from \"./backend.js\";\nimport type { StagingStore } from \"./importer.js\";\nimport type { OperationStore, StoredOperation } from \"./store.js\";\nimport { CpaError, hash, safeError, safeResult } from \"./common.js\";\nexport interface Authorization {\n  check(actor: Actor, instanceId: string, action: string): Promise<boolean>;\n}\nexport interface Maintenance {\n  enter(operationId: string, timeoutMs: number): Promise<void>;\n  leave(operationId: string): Promise<void>;\n}\nexport interface ReleaseAdapter {\n  list(): Promise<ReleaseDto[]>;\n  discover(): Promise<Record<string, unknown>>;\n  install(id: string, ctx: BackendContext): Promise<Record<string, unknown>>;\n  activate(id: string, ctx: BackendContext): Promise<Record<string, unknown>>;\n  delete(id: string): Promise<Record<string, unknown>>;\n  rollback(id: string, ctx: BackendContext): Promise<Record<string, unknown>>;\n  recover(\n    state: Record<string, unknown>,\n  ): Promise<\"verified\" | \"rolled_back\" | \"unknown\">;\n}\nexport interface ManagerConfig {\n  instanceId: string;\n  connection: {\n    baseUrl: string;\n    secretReference: string;\n    wireCapabilities: string[];\n  };\n  modelTtlMs?: number;\n  drainTimeoutMs?: number;\n}\nexport interface ManagerAdapters {\n  store: OperationStore;\n  staging: StagingStore;\n  backend: Backend;\n  authorization: Authorization;\n  lifecycle?: RuntimeLifecycle;\n  catalog?: () => Promise<{ id: string; capabilities: string[] }[]>;\n  probe?: (\n    input: {\n      modelId: string;\n      protocol: string;\n      reasoningProfile: string | null;\n    },\n    signal: AbortSignal,\n  ) => Promise<Record<string, unknown>>;\n  maintenance?: Maintenance;\n  releases?: ReleaseAdapter;\n  clock?: () => number;\n  onAudit?: (event: {\n    operationId: string;\n    kind: string;\n    state: string;\n  }) => Promise<void>;\n  modelCache?: {\n    get(): Promise<ModelsDto | null>;\n    put(value: ModelsDto): Promise<void>;\n  };\n}\nexport function createCpaManager(\n  config: ManagerConfig,\n  adapters: ManagerAdapters,\n) {\n  idSchema.parse(config.instanceId);\n  const now = adapters.clock ?? Date.now;\n  let catalog: ModelsDto = {\n    apiVersion: 1,\n    instanceId: config.instanceId,\n    models: [],\n    fetchedAt: null,\n    expiresAt: null,\n    stale: true,\n    revision: hash([]),\n  };\n  let probeState: \"passed\" | \"failed\" | \"unknown\" = \"unknown\";\n  let cacheWriteWarning = false;\n  const loadCatalog = async () => {\n    const cached = await adapters.modelCache?.get();\n    if (cached && cached.instanceId === config.instanceId) catalog = cached;\n  };\n  const saveCatalog = async () => {\n    try {\n      await adapters.modelCache?.put(catalog);\n    } catch {\n      cacheWriteWarning = true;\n    }\n  };\n  const authorize = async (actor: Actor, action: string) => {\n    idSchema.parse(actor.id);\n    if (!(await adapters.authorization.check(actor, config.instanceId, action)))\n      throw new CpaError(\"NOT_AUTHORIZED\", \"Administration access denied\");\n  };\n  const capabilities = () => ({\n    ...adapters.backend.capabilities,\n    ...(!adapters.maintenance\n      ? Object.fromEntries(\n          [\n            \"import.apply\",\n            \"credential.delete\",\n            \"release.activate\",\n            \"release.rollback\",\n          ].map((name) => [\n            name,\n            { enabled: false, reasonCode: \"NO_DRAIN_GUARD\" },\n          ]),\n        )\n      : {}),\n    \"catalog.refresh\": {\n      enabled: !!adapters.catalog,\n      reasonCode: adapters.catalog ? null : \"NO_CATALOG_ADAPTER\",\n    },\n    \"model.probe\": {\n      enabled: !!adapters.probe,\n      reasonCode: adapters.probe ? null : \"NO_PROBE_ADAPTER\",\n    },\n    ...Object.fromEntries(\n      [\n        \"release.discover\",\n        \"release.install\",\n        \"release.activate\",\n        \"release.delete\",\n        \"release.rollback\",\n      ].map((name) => [\n        name,\n        {\n          enabled:\n            !!adapters.releases &&\n            ([\"release.discover\", \"release.install\", \"release.delete\"].includes(\n              name,\n            ) ||\n              !!adapters.maintenance),\n          reasonCode: adapters.releases\n            ? adapters.maintenance\n              ? null\n              : \"NO_DRAIN_GUARD\"\n            : \"REMOTE_MODE\",\n        },\n      ]),\n    ),\n    \"operation.cancel\": { enabled: true, reasonCode: null },\n  });\n  const update = async (id: string, fn: (op: StoredOperation) => void) => {\n    for (let n = 0; n < 10; n++) {\n      const op = await adapters.store.get(id);\n      if (!op) throw new CpaError(\"INVALID_INPUT\", \"Operation missing\");\n      try {\n        return await adapters.store.update(id, op.dto.revision, fn);\n      } catch (e) {\n        if (!(e instanceof CpaError) || e.code !== \"REVISION_CONFLICT\") throw e;\n      }\n    }\n    throw new CpaError(\"INSTANCE_BUSY\", \"Concurrent operation updates\", true);\n  };\n  const own = async (id: string, actor: Actor) => {\n    await authorize(actor, \"operations.get\");\n    const op = await adapters.store.get(id);\n    if (!op || op.dto.instanceId !== config.instanceId)\n      throw new CpaError(\"INVALID_INPUT\", \"Operation missing\");\n    if (op.actor.id !== actor.id && !actor.admin)\n      throw new CpaError(\n        \"NOT_AUTHORIZED\",\n        \"Operation belongs to another actor\",\n      );\n    return op;\n  };\n  const preview = async (\n    candidateId: string,\n    actor: Actor,\n    options: { mode?: \"merge\" | \"replace\"; overwriteIds?: string[] } = {},\n  ): Promise<ImportPreviewDto> => {\n    await authorize(actor, \"imports.preview\");\n    const c = await adapters.staging.get(\n      candidateId,\n      actor.id,\n      config.instanceId,\n      actor.admin,\n    );\n    const s = await adapters.backend.snapshot();\n    const existing = new Set(s.credentials.map((item) => item.id)),\n      incoming = new Set(c.credentials.map((item) => item.id));\n    const overwriteIds = options.overwriteIds ?? [];\n    const mode = options.mode ?? \"merge\";\n    c.preview = {\n      revision: s.revision,\n      expiresAt: now() + 900_000,\n      mode,\n      overwriteIds,\n    };\n    await adapters.staging.save(c);\n    return {\n      apiVersion: 1,\n      instanceId: config.instanceId,\n      candidateId: c.id,\n      revision: s.revision,\n      expiresAt: new Date(c.expiresAt).toISOString(),\n      previewExpiresAt: new Date(c.preview.expiresAt).toISOString(),\n      accepted: c.credentials.length,\n      skipped: c.skipped,\n      additions: [...incoming].filter((id) => !existing.has(id)),\n      preserved: [...existing].filter((id) =>\n        mode === \"merge\"\n          ? !overwriteIds.includes(id)\n          : incoming.has(id) && !overwriteIds.includes(id),\n      ),\n      replacements: [...incoming].filter(\n        (id) => existing.has(id) && overwriteIds.includes(id),\n      ),\n      removals:\n        mode === \"replace\"\n          ? [...existing].filter((id) => !incoming.has(id))\n          : [],\n      reasons: c.reasons,\n    };\n  };\n  const manager = {\n    connectionDescriptor: () => ({\n      ...config.connection,\n      wireCapabilities: [...config.connection.wireCapabilities],\n    }),\n    accept: async (input: unknown, actor: Actor): Promise<AcceptResult> => {\n      const parsed = commandSchema.safeParse(input);\n      if (!parsed.success)\n        throw new CpaError(\"INVALID_INPUT\", \"Invalid administration command\");\n      const command = parsed.data;\n      if (command.instanceId !== config.instanceId)\n        throw new CpaError(\"INVALID_INPUT\", \"Unknown instance\");\n      await authorize(actor, command.kind);\n      const cap =\n        capabilities()[command.kind as keyof ReturnType<typeof capabilities>];\n      if (!cap?.enabled)\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"Administration capability unavailable\",\n        );\n      if (command.kind === \"import.apply\") {\n        const policy = adapters.backend.capabilities[\"import.apply\"];\n        if (\n          (policy?.modes && !policy.modes.includes(command.payload.mode)) ||\n          (policy?.overwrite === false && command.payload.overwriteIds.length)\n        )\n          throw new CpaError(\n            \"UNSUPPORTED_CAPABILITY\",\n            \"Import mode is not supported by this backend\",\n          );\n      }\n      if (\n        [\n          \"import.apply\",\n          \"credential.delete\",\n          \"release.activate\",\n          \"release.rollback\",\n        ].includes(command.kind) &&\n        !adapters.maintenance\n      )\n        throw new CpaError(\n          \"UNSUPPORTED_CAPABILITY\",\n          \"Safe maintenance guard required\",\n        );\n      const result = await adapters.store.accept(command, actor);\n      if (\n        command.kind === \"operation.cancel\" &&\n        result.operation.dto.state === \"queued\"\n      ) {\n        const target = await own(command.payload.operationId, actor);\n        await update(target.dto.id, (op) => {\n          op.dto.cancelRequested = true;\n          if (op.dto.state === \"queued\") {\n            op.dto.state = \"cancelled\";\n            op.dto.finishedAt = new Date(now()).toISOString();\n          }\n        });\n        await update(result.operation.dto.id, (op) => {\n          op.dto.state = \"succeeded\";\n          op.dto.result = { operationId: target.dto.id };\n          op.dto.finishedAt = new Date(now()).toISOString();\n        });\n      }\n      return {\n        apiVersion: 1,\n        operationId: result.operation.dto.id,\n        state: (await adapters.store.get(result.operation.dto.id))!.dto.state,\n        reused: result.reused,\n      };\n    },\n    status: async (actor: Actor): Promise<StatusDto> => {\n      await authorize(actor, \"status.get\");\n      await loadCatalog();\n      const s = await adapters.backend\n        .snapshot()\n        .catch(() => ({ revision: hash(\"unavailable\"), credentials: [] }));\n      const runtime = await adapters.lifecycle\n        ?.inspect()\n        .catch(() => ({ version: null, state: \"unknown\" as const }));\n      const operations = await adapters.store.list();\n      const lastProbe = operations\n        .filter(\n          (o) =>\n            o.dto.instanceId === config.instanceId &&\n            o.dto.kind === \"model.probe\" &&\n            isTerminal(o.dto.state),\n        )\n        .sort((a, b) => b.dto.updatedAt.localeCompare(a.dto.updatedAt))[0];\n      const busy = operations.find(\n        (o) =>\n          o.dto.instanceId === config.instanceId &&\n          [\"running\", \"recovery_required\"].includes(o.dto.state),\n      );\n      return {\n        apiVersion: 1,\n        instanceId: config.instanceId,\n        revision: hash({ pool: s.revision, core: runtime?.version ?? null }),\n        runtime: {\n          mode: adapters.lifecycle ? \"managed\" : \"remote\",\n          version: runtime?.version ?? null,\n          state: runtime?.state ?? \"unknown\",\n        },\n        management: {\n          protocol:\n            adapters.backend.managementAvailability === \"available\"\n              ? \"v8\"\n              : null,\n          availability: adapters.backend.managementAvailability,\n        },\n        inference: {\n          reachable:\n            runtime?.state === \"stopped\"\n              ? false\n              : catalog.expiresAt && Date.parse(catalog.expiresAt) > now()\n                ? true\n                : null,\n          catalogState: catalog.fetchedAt\n            ? now() < Date.parse(catalog.expiresAt!)\n              ? \"fresh\"\n              : \"stale\"\n            : \"unknown\",\n          probeState: lastProbe\n            ? lastProbe.dto.state === \"succeeded\"\n              ? \"passed\"\n              : \"failed\"\n            : probeState,\n          checkedAt: lastProbe?.dto.finishedAt ?? catalog.fetchedAt,\n        },\n        capabilities: capabilities(),\n        busyOperationId: busy?.dto.id ?? null,\n      };\n    },\n    credentials: async (actor: Actor) => {\n      await authorize(actor, \"credentials.list\");\n      return {\n        apiVersion: 1 as const,\n        instanceId: config.instanceId,\n        items: (await adapters.backend.snapshot()).credentials,\n        nextCursor: null,\n      };\n    },\n    models: async (actor: Actor) => {\n      await authorize(actor, \"models.get\");\n      await loadCatalog();\n      return {\n        ...catalog,\n        stale: !catalog.expiresAt || Date.parse(catalog.expiresAt) < now(),\n      };\n    },\n    releases: async (actor: Actor): Promise<ListDto<ReleaseDto>> => {\n      await authorize(actor, \"releases.list\");\n      return {\n        apiVersion: 1,\n        instanceId: config.instanceId,\n        items: (await adapters.releases?.list()) ?? [],\n        nextCursor: null,\n      };\n    },\n    operations: async (\n      actor: Actor,\n      options: { limit?: number; cursor?: string } = {},\n    ): Promise<ListDto<OperationDto>> => {\n      await authorize(actor, \"operations.list\");\n      const limit = options.limit ?? 50;\n      if (!Number.isInteger(limit) || limit < 1 || limit > 100)\n        throw new CpaError(\"INVALID_INPUT\", \"Invalid page limit\");\n      let after = \"\";\n      let ceiling = new Date(now()).toISOString();\n      if (options.cursor) {\n        try {\n          const cursor = JSON.parse(\n            Buffer.from(options.cursor, \"base64url\").toString(),\n          );\n          if (\n            cursor.actor !== actor.id ||\n            cursor.instance !== config.instanceId\n          )\n            throw new Error();\n          after = cursor.after;\n          ceiling = cursor.ceiling;\n        } catch {\n          throw new CpaError(\"INVALID_INPUT\", \"Invalid page cursor\");\n        }\n      }\n      const items = (await adapters.store.list())\n        .filter(\n          (o) =>\n            o.dto.instanceId === config.instanceId &&\n            (actor.admin || o.actor.id === actor.id) &&\n            o.dto.createdAt <= ceiling,\n        )\n        .map((o) => o.dto)\n        .sort((a, b) =>\n          `${b.createdAt}:${b.id}`.localeCompare(`${a.createdAt}:${a.id}`),\n        )\n        .filter((o) => !after || `${o.createdAt}:${o.id}` < after);\n      const page = items.slice(0, limit);\n      return {\n        apiVersion: 1,\n        instanceId: config.instanceId,\n        items: page,\n        nextCursor:\n          items.length > limit\n            ? Buffer.from(\n                JSON.stringify({\n                  actor: actor.id,\n                  instance: config.instanceId,\n                  ceiling,\n                  after: `${page.at(-1)!.createdAt}:${page.at(-1)!.id}`,\n                }),\n              ).toString(\"base64url\")\n            : null,\n      };\n    },\n    operation: async (id: string, actor: Actor) => (await own(id, actor)).dto,\n    preview,\n    upload: async (\n      files: import(\"./importer.js\").UploadFile[],\n      actor: Actor,\n    ) => {\n      await authorize(actor, \"import.stage\");\n      return {\n        apiVersion: 1 as const,\n        uploadId: await adapters.staging.upload(\n          files,\n          actor.id,\n          config.instanceId,\n        ),\n      };\n    },\n    executeOperation: async (id: string):Promise<OperationDto|undefined> => {\n      const pending=await adapters.store.get(id);\n      if(pending?.dto.state==='queued'&&pending.command.kind==='operation.cancel'){\n        try{await authorize(pending.actor,'operation.cancel');const target=await own(pending.command.payload.operationId,pending.actor);await update(target.dto.id,o=>{o.dto.cancelRequested=true;if(o.dto.state==='queued'){o.dto.state='cancelled';o.dto.finishedAt=new Date(now()).toISOString();}});await update(id,o=>{o.dto.state='succeeded';o.dto.result={operationId:target.dto.id};o.dto.finishedAt=new Date(now()).toISOString();});}catch(e){await update(id,o=>{o.dto.state='failed';o.dto.error=safeError(e,id);o.dto.finishedAt=new Date(now()).toISOString();});}return(await adapters.store.get(id))!.dto;\n      }\n      return adapters.store.writer(async () => {\n        let op = await adapters.store.get(id);\n        if (\n          !op ||\n          op.dto.instanceId !== config.instanceId ||\n          op.dto.state !== \"queued\"\n        )\n          return;\n        const blocked = (await adapters.store.list()).find(\n          (o) =>\n            o.dto.instanceId === config.instanceId &&\n            o.dto.state === \"recovery_required\",\n        );\n        if (blocked)\n          throw new CpaError(\"RECOVERY_REQUIRED\", \"Instance recovery required\");\n        try {\n          await authorize(op.actor, op.command.kind);\n        } catch (e) {\n          await update(id, (o) => {\n            o.dto.state = \"failed\";\n            o.dto.error = safeError(e, id);\n            o.dto.finishedAt = new Date(now()).toISOString();\n          });\n          return (await adapters.store.get(id))!.dto;\n        }\n        const controller = new AbortController();\n        let heartbeatError = false;\n        op = await update(id, (o) => {\n          o.dto.state = \"running\";\n          o.dto.startedAt = new Date(now()).toISOString();\n          o.owner = `${hostname()}:${process.pid}`;\n          o.leaseUntil = new Date(now() + 30_000).toISOString();\n        });\n        const heartbeat = setInterval(() => {\n          void update(id, (o) => {\n            o.leaseUntil = new Date(now() + 30_000).toISOString();\n            if (o.dto.cancelRequested && !switched) controller.abort();\n          }).catch(() => {\n            heartbeatError = true;\n            controller.abort();\n          });\n        }, 10_000);\n        let entered = false,\n          switched = false;\n        const phase = async (p: Phase, state?: Record<string, unknown>) => {\n          if (p === \"switch\") switched = true;\n          await update(id, (o) => {\n            o.dto.phase = p;\n            if (state) o.privateState = { ...o.privateState, ...state };\n          });\n        };\n        const check = async () => {\n          if (heartbeatError)\n            throw new CpaError(\"RECOVERY_REQUIRED\", \"Operation lease lost\");\n          const current = await adapters.store.get(id);\n          if (current?.dto.cancelRequested && !switched)\n            throw new CpaError(\"CANCELLED\", \"Operation cancelled\");\n          await authorize(op!.actor, op!.command.kind);\n        };\n        const ctx: BackendContext = { phase, check };\n        let candidateId: string | null = null;\n        try {\n          cacheWriteWarning = false;\n          await check();\n          const command = op.command;\n          const disruptive = [\n            \"import.apply\",\n            \"credential.delete\",\n            \"release.activate\",\n            \"release.rollback\",\n          ].includes(command.kind);\n          if (disruptive) {\n            await phase(\"drain\");\n            await adapters.maintenance!.enter(\n              id,\n              config.drainTimeoutMs ?? 180_000,\n            );\n            entered = true;\n            await check();\n          }\n          if (\n            [\"release.activate\", \"release.delete\", \"release.rollback\"].includes(\n              op.command.kind,\n            )\n          ) {\n            const pool = await adapters.backend.snapshot();\n            const runtime = await adapters.lifecycle?.inspect();\n            if (\n              hash({ pool: pool.revision, core: runtime?.version ?? null }) !==\n              op.command.expectedRevision\n            )\n              throw new CpaError(\n                \"REVISION_CONFLICT\",\n                \"Runtime or pool changed since confirmation\",\n              );\n          }\n          let result: Record<string, unknown> = {};\n          switch (command.kind) {\n            case \"import.stage\": {\n              const candidate = await adapters.staging.stage(\n                command.payload.uploadId,\n                op.actor.id,\n                config.instanceId,\n              );\n              await phase(\"preview\");\n              await update(id, (o) => {\n                o.dto.progress = {\n                  completed: candidate.credentials.length + candidate.skipped,\n                  total: candidate.credentials.length + candidate.skipped,\n                };\n              });\n              result = {\n                candidateId: candidate.id,\n                accepted: candidate.credentials.length,\n                skipped: candidate.skipped,\n              };\n              break;\n            }\n            case \"import.apply\": {\n              candidateId = command.payload.candidateId;\n              const c = await adapters.staging.get(\n                candidateId,\n                op.actor.id,\n                config.instanceId,\n                op.actor.admin,\n              );\n              await update(id, (o) => {\n                o.dto.progress.total = c.credentials.length;\n              });\n              if (\n                !c.preview ||\n                c.preview.expiresAt < now() ||\n                c.preview.revision !== command.payload.previewRevision ||\n                command.expectedRevision !== c.preview.revision ||\n                c.preview.mode !== command.payload.mode ||\n                hash(c.preview.overwriteIds) !==\n                  hash(command.payload.overwriteIds)\n              )\n                throw new CpaError(\n                  \"REVISION_CONFLICT\",\n                  \"Import preview expired or changed\",\n                );\n              result = await adapters.backend.apply(\n                {\n                  credentials: c.credentials,\n                  ...command.payload,\n                  expectedRevision: command.expectedRevision!,\n                },\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            }\n            case \"import.cancel\":\n              candidateId = command.payload.candidateId;\n              await adapters.staging.get(\n                candidateId,\n                op.actor.id,\n                config.instanceId,\n                op.actor.admin,\n              );\n              result = { cancelled: true };\n              break;\n            case \"credential.delete\":\n              const deletePool = await adapters.backend.snapshot();\n              const deleteRuntime = await adapters.lifecycle?.inspect();\n              if (\n                hash({\n                  pool: deletePool.revision,\n                  core: deleteRuntime?.version ?? null,\n                }) !== command.expectedRevision\n              )\n                throw new CpaError(\n                  \"REVISION_CONFLICT\",\n                  \"Runtime or pool changed since confirmation\",\n                );\n              result = await adapters.backend.delete(\n                command.payload.credentialId,\n                deletePool.revision,\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            case \"catalog.refresh\": {\n              const models = await adapters.catalog!();\n              if (models.some((m) => !m.id || m.id.length > 256))\n                throw new CpaError(\n                  \"MANAGEMENT_UNAVAILABLE\",\n                  \"Model catalog invalid\",\n                );\n              catalog = {\n                apiVersion: 1,\n                instanceId: config.instanceId,\n                models,\n                fetchedAt: new Date(now()).toISOString(),\n                expiresAt: new Date(\n                  now() + (config.modelTtlMs ?? 300_000),\n                ).toISOString(),\n                stale: false,\n                revision: hash(models),\n              };\n              result = { count: models.length };\n              await saveCatalog();\n              break;\n            }\n            case \"model.probe\":\n              await loadCatalog();\n              if (\n                !config.connection.wireCapabilities.includes(\n                  command.payload.protocol,\n                )\n              )\n                throw new CpaError(\n                  \"UNSUPPORTED_CAPABILITY\",\n                  \"Probe wire protocol is not approved\",\n                );\n              if (!catalog.models.some((m) => m.id === command.payload.modelId))\n                throw new CpaError(\"INVALID_INPUT\", \"Model is not in catalog\");\n              result = await adapters.probe!(\n                command.payload,\n                controller.signal,\n              );\n              probeState = \"passed\";\n              break;\n            case \"release.discover\":\n              result = await adapters.releases!.discover();\n              break;\n            case \"release.install\":\n              result = await adapters.releases!.install(\n                command.payload.releaseId,\n                ctx,\n              );\n              break;\n            case \"release.activate\":\n              result = await adapters.releases!.activate(\n                command.payload.installedReleaseId,\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            case \"release.delete\":\n              result = await adapters.releases!.delete(\n                command.payload.installedReleaseId,\n              );\n              break;\n            case \"release.rollback\":\n              result = await adapters.releases!.rollback(\n                command.payload.lastKnownGoodReleaseId,\n                ctx,\n              );\n              catalog = { ...catalog, stale: true, expiresAt: null };\n              await saveCatalog();\n              break;\n            case \"operation.cancel\":\n              break;\n          }\n          await phase(\"commit\");\n          await update(id, (o) => {\n            o.dto.state = \"succeeded\";\n            o.dto.result = safeResult({\n              ...result,\n              ...(cacheWriteWarning ? { cacheWriteWarning: true } : {}),\n            });\n            o.dto.finishedAt = new Date(now()).toISOString();\n          });\n        } catch (e) {\n          const error = safeError(e, id);\n          if (op.command.kind === \"model.probe\") probeState = \"failed\";\n          if (op.command.kind === \"catalog.refresh\") {\n            catalog = { ...catalog, stale: true, expiresAt: null };\n            await saveCatalog();\n          }\n          await update(id, (o) => {\n            o.dto.state =\n              error.code === \"RECOVERY_REQUIRED\" ||\n              error.code === \"OUTCOME_UNKNOWN\"\n                ? \"recovery_required\"\n                : error.code === \"APPLY_PARTIAL\"\n                  ? \"partially_applied\"\n                  : error.code === \"CANCELLED\"\n                    ? \"cancelled\"\n                    : \"failed\";\n            o.dto.error = error;\n            o.dto.finishedAt = new Date(now()).toISOString();\n            if (o.dto.state === \"recovery_required\")\n              o.dto.recoveryDisposition = \"reconcile\";\n          });\n        } finally {\n          clearInterval(heartbeat);\n          const final = (await adapters.store.get(id))!;\n          if (candidateId && final.dto.state !== \"recovery_required\") {\n            await adapters.staging.remove(candidateId).catch(async () => {\n              await update(id, (o) => {\n                o.dto.result = { ...o.dto.result, cleanupWarning: true };\n              });\n            });\n          }\n          if (entered && final.dto.state !== \"recovery_required\")\n            await adapters.maintenance!.leave(id);\n          await adapters\n            .onAudit?.({\n              operationId: id,\n              kind: op.command.kind,\n              state: final.dto.state,\n            })\n            .catch(() => {});\n        }\n        return (await adapters.store.get(id))!.dto;\n      });\n    },\n    recoverOperations: async () =>\n      adapters.store.writer(async () => {\n        for (const o of await adapters.store.list()) {\n          if (\n            o.dto.instanceId !== config.instanceId ||\n            ![\"running\", \"recovery_required\"].includes(o.dto.state)\n          )\n            continue;\n          const recovery = o.dto.kind.startsWith(\"release.\")\n            ? ((await adapters.releases?.recover(o.privateState)) ?? \"unknown\")\n            : await adapters.backend.recover(o.privateState);\n          const actual =\n            recovery === \"verified\" ? await adapters.backend.snapshot() : null;\n          await update(o.dto.id, (op) => {\n            op.dto.state =\n              recovery === \"verified\"\n                ? \"succeeded\"\n                : recovery === \"rolled_back\"\n                  ? \"failed\"\n                  : \"recovery_required\";\n            op.dto.recoveryDisposition = recovery;\n            op.dto.finishedAt = new Date(now()).toISOString();\n            if (recovery === \"verified\") {\n              op.dto.error = null;\n              op.dto.result = {\n                recovered: true,\n                revision: actual?.revision ?? null,\n              };\n            }\n            if (recovery !== \"verified\")\n              op.dto.error = safeError(\n                new CpaError(\n                  \"RECOVERY_REQUIRED\",\n                  \"Interrupted operation requires review\",\n                ),\n                o.dto.id,\n              );\n          });\n          if (recovery !== \"unknown\")\n            await adapters.maintenance?.leave(o.dto.id);\n          if (recovery !== \"unknown\" && \"candidateId\" in o.command.payload)\n            await adapters.staging\n              .remove(o.command.payload.candidateId)\n              .catch(() => {});\n          if (recovery === \"verified\") {\n            catalog = { ...catalog, stale: true, expiresAt: null };\n            await saveCatalog();\n          }\n        }\n      }),\n    reapStaging: async () => {\n      const protectedIds = new Set<string>();\n      for (const o of await adapters.store.list()) {\n        if (\n          [\"running\", \"recovery_required\"].includes(o.dto.state) &&\n          \"candidateId\" in o.command.payload\n        )\n          protectedIds.add(o.command.payload.candidateId);\n        if (\n          [\"running\", \"recovery_required\"].includes(o.dto.state) &&\n          \"uploadId\" in o.command.payload\n        )\n          protectedIds.add(o.command.payload.uploadId);\n      }\n      await adapters.staging.reap(protectedIds);\n      await adapters.store.reap(now());\n    },\n  };\n  return manager;\n}\nexport type CpaManager = ReturnType<typeof createCpaManager>;\nexport const executeOperation = (manager: CpaManager, id: string) =>\n  manager.executeOperation(id);\nexport const recoverOperations = (manager: CpaManager) =>\n  manager.recoverOperations();\nexport const reapStaging = (manager: CpaManager) => manager.reapStaging();\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport {\n  lstat,\n  readFile,\n  writeFile,\n  rename,\n  symlink,\n  readlink,\n  readdir,\n  rm,\n} from \"node:fs/promises\";\nimport { join, resolve, dirname } from \"node:path\";\nimport { createHash } from \"node:crypto\";\nimport { gunzipSync } from \"node:zlib\";\nimport {\n  CpaError,\n  atomicJson,\n  confined,\n  newId,\n  protectedDir,\n} from \"./common.js\";\nimport type { BackendContext, RuntimeLifecycle } from \"./backend.js\";\nimport type { ReleaseAdapter } from \"./manager.js\";\nimport type { ReleaseDto } from \"../contracts/index.js\";\nconst exec = promisify(execFile);\nexport function createLinuxRuntimeLifecycle(options: {\n  helperPath: string;\n  version: () => Promise<string | null>;\n  timeoutMs?: number;\n}): RuntimeLifecycle {\n  if (process.platform !== \"linux\")\n    throw new CpaError(\n      \"UNSUPPORTED_CAPABILITY\",\n      \"Linux runtime adapter unavailable\",\n    );\n  const invoke = async (action: \"stop\" | \"start\" | \"inspect\") => {\n    const stat = await lstat(options.helperPath);\n    if (\n      !stat.isFile() ||\n      stat.isSymbolicLink() ||\n      stat.uid !== 0 ||\n      stat.mode & 0o022\n    )\n      throw new CpaError(\n        \"INVALID_INPUT\",\n        \"Lifecycle helper must be root-owned and non-writable\",\n      );\n    for (\n      let path = dirname(resolve(options.helperPath));\n      ;\n      path = dirname(path)\n    ) {\n      const parent = await lstat(path);\n      if (\n        !parent.isDirectory() ||\n        parent.isSymbolicLink() ||\n        parent.uid !== 0 ||\n        parent.mode & 0o022\n      )\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Lifecycle helper ancestors must be root-owned and non-writable\",\n        );\n      if (path === \"/\") break;\n    }\n    try {\n      return (\n        await exec(\"/usr/bin/sudo\", [\"-n\", options.helperPath, action], {\n          timeout: options.timeoutMs ?? 30_000,\n          maxBuffer: 4096,\n          env: { PATH: \"/usr/sbin:/usr/bin:/sbin:/bin\" },\n        })\n      ).stdout.trim();\n    } catch {\n      throw new CpaError(\n        \"MANAGEMENT_UNAVAILABLE\",\n        \"Trusted lifecycle helper failed\",\n      );\n    }\n  };\n  return {\n    stop: async () => {\n      await invoke(\"stop\");\n    },\n    start: async () => {\n      await invoke(\"start\");\n    },\n    inspect: async () => ({\n      version: await options.version(),\n      state: (await invoke(\"inspect\")) === \"active\" ? \"running\" : \"stopped\",\n    }),\n  };\n}\nexport interface ApprovedRelease {\n  id: string;\n  version: string;\n  url: string;\n  sha256: string;\n  asset: \"binary\" | \"tar.gz\";\n  binaryName?: string;\n}\nexport interface ApprovedReleaseSource {\n  discover(): Promise<ApprovedRelease[]>;\n  allowedHosts: string[];\n}\nconst versionPattern = /^v?\\d+\\.\\d+\\.\\d+(?:-[a-zA-Z0-9.-]+)?$/;\nfunction tarBinary(bytes: Buffer, name: string): Buffer {\n  const tar = gunzipSync(bytes, { maxOutputLength: 200 * 1024 * 1024 });\n  let at = 0,\n    result: Buffer | null = null,\n    count = 0;\n  while (at + 512 <= tar.length) {\n    const header = tar.subarray(at, at + 512);\n    if (header.every((b) => b === 0)) break;\n    if (++count > 1000)\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Release archive entry limit\");\n    const path = header.subarray(0, 100).toString().replace(/\\0.*$/, \"\");\n    const prefix = header.subarray(345, 500).toString().replace(/\\0.*$/, \"\");\n    const full = prefix ? `${prefix}/${path}` : path;\n    if (\n      full.includes(\"\\\\\") ||\n      full.startsWith(\"/\") ||\n      full.split(\"/\").includes(\"..\")\n    )\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Unsafe release archive path\");\n    const type = String.fromCharCode(header[156]);\n    if (![\"0\", \"\\0\", \"5\"].includes(type))\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Special archive entries forbidden\");\n    const size = parseInt(\n      header.subarray(124, 136).toString().replace(/\\0.*$/, \"\"),\n      8,\n    );\n    if (!Number.isFinite(size) || size < 0 || at + 512 + size > tar.length)\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Truncated archive\");\n    const expected = parseInt(\n      header.subarray(148, 156).toString().replace(/\\0.*$/, \"\"),\n      8,\n    );\n    let checksum = 0;\n    for (let i = 0; i < 512; i++)\n      checksum += i >= 148 && i < 156 ? 32 : header[i];\n    if (checksum !== expected)\n      throw new CpaError(\"ARCHIVE_UNSAFE\", \"Archive checksum invalid\");\n    if (full === name || full === `./${name}`) {\n      if (result) throw new CpaError(\"ARCHIVE_UNSAFE\", \"Duplicate binary\");\n      result = Buffer.from(tar.subarray(at + 512, at + 512 + size));\n    }\n    at += 512 + Math.ceil(size / 512) * 512;\n  }\n  if (!result) throw new CpaError(\"ARCHIVE_UNSAFE\", \"Approved binary missing\");\n  return result;\n}\nexport function createManagedReleaseAdapter(options: {\n  root: string;\n  activePath: string;\n  source: ApprovedReleaseSource;\n  runtime: RuntimeLifecycle;\n  verify: () => Promise<void>;\n  fetch?: typeof fetch;\n  maxDownloadBytes?: number;\n}): ReleaseAdapter {\n  const root = resolve(options.root),\n    active = resolve(options.activePath);\n  if (!active.startsWith(`${root}/`))\n    throw new CpaError(\"INVALID_INPUT\", \"Runtime pointer outside managed root\");\n  let releases: ApprovedRelease[] = [];\n  const pointer = async () => {\n    const value = resolve(dirname(active), await readlink(active));\n    if (!value.startsWith(`${root}/`))\n      throw new CpaError(\"RECOVERY_REQUIRED\", \"Runtime pointer outside root\");\n    return value;\n  };\n  const versionDir = (id: string) => {\n    if (!versionPattern.test(id))\n      throw new CpaError(\"INVALID_INPUT\", \"Invalid release ID\");\n    return confined(root, id);\n  };\n  const lastGood = async (): Promise<string | null> => {\n    try {\n      return JSON.parse(\n        await readFile(join(root, \"last-good-release.json\"), \"utf8\"),\n      ).previous;\n    } catch {\n      return null;\n    }\n  };\n  const activate = async (id: string, ctx: BackendContext) => {\n    const next = versionDir(id);\n    const stat = await lstat(join(next, \"cli-proxy-api\"));\n    if (!stat.isFile() || stat.isSymbolicLink())\n      throw new CpaError(\"INVALID_INPUT\", \"Binary unavailable\");\n    const previous = await pointer();\n    await ctx.check();\n    await options.runtime.stop();\n    let switched = false;\n    try {\n      await ctx.phase(\"prepare\", {\n        previousRelease: previous,\n        nextRelease: next,\n      });\n      const tmp = join(dirname(active), `.runtime-${newId()}`);\n      await symlink(next, tmp);\n      await ctx.phase(\"switch\", {\n        previousRelease: previous,\n        nextRelease: next,\n      });\n      await rename(tmp, active);\n      switched = true;\n      await options.runtime.start();\n      await ctx.phase(\"verify\");\n      await options.verify();\n      await atomicJson(join(root, \"last-good-release.json\"), {\n        previous,\n        active: next,\n      });\n      return { activeReleaseId: id };\n    } catch (error) {\n      if (\n        switched &&\n        error instanceof CpaError &&\n        error.code === \"PROBE_QUOTA_LIMITED\"\n      ) {\n        await atomicJson(join(root, \"last-good-release.json\"), {\n          previous,\n          active: next,\n        });\n        return { activeReleaseId: id, verification: \"quota_limited\" };\n      }\n      if (switched) {\n        try {\n          await options.runtime.stop();\n          const tmp = join(dirname(active), `.runtime-${newId()}`);\n          await symlink(previous, tmp);\n          await rename(tmp, active);\n          await options.runtime.start();\n          await options.verify();\n        } catch {\n          throw new CpaError(\"RECOVERY_REQUIRED\", \"Runtime rollback failed\");\n        }\n      } else await options.runtime.start();\n      throw error;\n    }\n  };\n  return {\n    list: async () => {\n      await protectedDir(root);\n      const active = await pointer().catch(() => null),\n        last = await lastGood();\n      const items: ReleaseDto[] = [];\n      for (const id of await readdir(root)) {\n        if (!versionPattern.test(id)) continue;\n        const stat = await lstat(join(root, id));\n        if (!stat.isDirectory() || stat.isSymbolicLink()) continue;\n        items.push({\n          id,\n          version: id,\n          installed: true,\n          active: active === join(root, id),\n          lastKnownGood: last === join(root, id),\n          installedAt: stat.birthtime.toISOString(),\n        });\n      }\n      for (const r of releases)\n        if (!items.some((i) => i.id === r.id))\n          items.push({\n            id: r.id,\n            version: r.version,\n            installed: false,\n            active: false,\n            lastKnownGood: false,\n            installedAt: null,\n          });\n      return items;\n    },\n    discover: async () => {\n      const found = await options.source.discover();\n      for (const r of found) {\n        const url = new URL(r.url);\n        if (\n          !versionPattern.test(r.id) ||\n          !versionPattern.test(r.version) ||\n          !/^([a-f0-9]{64})$/i.test(r.sha256) ||\n          url.protocol !== \"https:\" ||\n          !options.source.allowedHosts.includes(url.hostname) ||\n          url.username ||\n          url.password\n        )\n          throw new CpaError(\"INVALID_INPUT\", \"Unapproved release metadata\");\n      }\n      releases = found;\n      return { count: releases.length };\n    },\n    install: async (id, ctx) => {\n      if (!releases.length) releases = await options.source.discover();\n      const r = releases.find((r) => r.id === id);\n      if (!r)\n        throw new CpaError(\"INVALID_INPUT\", \"Release not in approved catalog\");\n      const final = versionDir(id);\n      try {\n        await lstat(final);\n        return { installedReleaseId: id, reused: true };\n      } catch (e) {\n        if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n      }\n      await protectedDir(root);\n      await ctx.check();\n      await ctx.phase(\"prepare\", { installReleaseId: id });\n      let downloadUrl = r.url;\n      let response: Response | null = null;\n      const timeout = AbortSignal.timeout(60_000);\n      for (let redirects = 0; redirects <= 3; redirects++) {\n        const url = new URL(downloadUrl);\n        if (\n          url.protocol !== \"https:\" ||\n          !options.source.allowedHosts.includes(url.hostname) ||\n          url.username ||\n          url.password\n        )\n          throw new CpaError(\n            \"INVALID_INPUT\",\n            \"Release redirected outside approved hosts\",\n          );\n        response = await (options.fetch ?? fetch)(downloadUrl, {\n          redirect: \"manual\",\n          signal: timeout,\n        });\n        if (![301, 302, 303, 307, 308].includes(response.status)) break;\n        const location = response.headers.get(\"location\");\n        if (!location || redirects === 3)\n          throw new CpaError(\n            \"MANAGEMENT_UNAVAILABLE\",\n            \"Release redirect limit exceeded\",\n          );\n        downloadUrl = new URL(location, downloadUrl).toString();\n      }\n      if (!response)\n        throw new CpaError(\n          \"MANAGEMENT_UNAVAILABLE\",\n          \"Release download unavailable\",\n        );\n      if (!response.ok || !response.body)\n        throw new CpaError(\"MANAGEMENT_UNAVAILABLE\", \"Release download failed\");\n      const reader = response.body.getReader(),\n        chunks: Buffer[] = [];\n      let size = 0;\n      for (;;) {\n        const chunk = await reader.read();\n        if (chunk.done) break;\n        size += chunk.value.length;\n        if (size > (options.maxDownloadBytes ?? 50 * 1024 * 1024)) {\n          await reader.cancel();\n          throw new CpaError(\"UPLOAD_LIMIT\", \"Release exceeds limit\");\n        }\n        chunks.push(Buffer.from(chunk.value));\n      }\n      const bytes = Buffer.concat(chunks);\n      if (\n        createHash(\"sha256\").update(bytes).digest(\"hex\") !==\n        r.sha256.toLowerCase()\n      )\n        throw new CpaError(\"INVALID_INPUT\", \"Release checksum mismatch\");\n      const binary =\n        r.asset === \"tar.gz\"\n          ? tarBinary(bytes, r.binaryName ?? \"cli-proxy-api\")\n          : bytes;\n      const candidate = join(root, `.candidate-${newId()}`);\n      await protectedDir(candidate);\n      try {\n        const binaryPath = join(candidate, \"cli-proxy-api\");\n        await writeFile(binaryPath, binary, { mode: 0o700, flag: \"wx\" });\n        let version: string;\n        try {\n          version = (\n            await exec(binaryPath, [\"-h\"], {\n              cwd: candidate,\n              timeout: 15_000,\n              maxBuffer: 8192,\n              env: { PATH: \"/usr/bin:/bin\", HOME: candidate },\n            })\n          ).stdout;\n        } catch {\n          throw new CpaError(\n            \"PROBE_FAILED\",\n            \"Candidate structural check failed\",\n          );\n        }\n        if (!version.includes(r.version.replace(/^v/, \"\")))\n          throw new CpaError(\"PROBE_FAILED\", \"Candidate version mismatch\");\n        await atomicJson(join(candidate, \"manifest.json\"), {\n          releaseId: id,\n          sha256: r.sha256,\n        });\n        await ctx.check();\n        await rename(candidate, final);\n        return { installedReleaseId: id };\n      } finally {\n        await rm(candidate, { recursive: true, force: true });\n      }\n    },\n    activate,\n    delete: async (id) => {\n      const target = versionDir(id);\n      if (target === (await pointer()) || target === (await lastGood()))\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Active or recovery release cannot be deleted\",\n        );\n      await rm(target, { recursive: true, force: true });\n      return { deletedReleaseId: id };\n    },\n    rollback: async (id, ctx) => {\n      if (versionDir(id) !== (await lastGood()))\n        throw new CpaError(\n          \"INVALID_INPUT\",\n          \"Rollback must use last-known-good release\",\n        );\n      return activate(id, ctx);\n    },\n    recover: async (state) => {\n      if (\n        typeof state.previousRelease !== \"string\" ||\n        typeof state.nextRelease !== \"string\"\n      )\n        return \"unknown\";\n      try {\n        const current = await pointer();\n        if (current !== state.previousRelease && current !== state.nextRelease)\n          return \"unknown\";\n        await options.runtime.start();\n        await options.verify();\n        return current === state.nextRelease ? \"verified\" : \"rolled_back\";\n      } catch {\n        return \"unknown\";\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;AAAA,SAAS,YAAY,kBAAkB;AACvC,SAAS,OAAO,OAAO,OAAO,MAAM,QAAQ,cAAc;AAC1D,SAAS,SAAS,eAAe;AACjC,SAAS,aAAa;AAEf,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YACS,MACP,SACO,YAAY,OACZ,UAAyB,MAChC;AACA,UAAM,QAAQ,MAAM,GAAG,GAAG,CAAC;AALpB;AAEA;AACA;AAAA,EAGT;AACF;AACO,SAAS,UACd,OACA,cAA6B,MACnB;AACV,SAAO,iBAAiB,WACpB;AAAA,IACE,MAAM,MAAM;AAAA,IACZ,SAAS,WAAW,MAAM,OAAO;AAAA,IACjC,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf;AAAA,EACF,IACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,SAAS;AAAA,IACT;AAAA,EACF;AACN;AACO,SAAS,WAAW,MAAc;AACvC,SAAO,KACJ,QAAQ,iCAAiC,YAAY,EACrD,QAAQ,2CAA2C,YAAY,EAC/D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,MAAM,GAAG,GAAG;AACjB;AACO,SAAS,WACd,OACyB;AACzB,QAAM,QAAQ,CAAC,MAAwB;AACrC,QAAI,OAAO,MAAM,SAAU,QAAO,WAAW,CAAC;AAC9C,QAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,MAAM,GAAG,GAAI,EAAE,IAAI,KAAK;AACvD,QAAI,KAAK,OAAO,MAAM;AACpB,aAAO,OAAO;AAAA,QACZ,OAAO,QAAQ,CAAC,EACb;AAAA,UACC,CAAC,CAAC,CAAC,MACD,CAAC,sEAAsE;AAAA,YACrE;AAAA,UACF;AAAA,QACJ,EACC,MAAM,GAAG,GAAI,EACb,IAAI,CAAC,CAAC,GAAGA,EAAC,MAAM,CAAC,GAAG,MAAMA,EAAC,CAAC,CAAC;AAAA,MAClC;AACF,WAAO;AAAA,EACT;AACA,SAAO,MAAM,KAAK;AACpB;AACO,SAAS,UAAU,OAAwB;AAChD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,SAAS,EAAE,KAAK,GAAG,CAAC;AACnE,MAAI,SAAS,OAAO,UAAU;AAC5B,WAAO,IAAI,OAAO,QAAQ,KAAK,EAC5B,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,EACtD,KAAK,GAAG,CAAC;AACd,SAAO,KAAK,UAAU,KAAK,KAAK;AAClC;AACO,IAAM,OAAO,CAAC,UACnB,WAAW,QAAQ,EAChB,OAAO,OAAO,UAAU,WAAW,QAAQ,UAAU,KAAK,CAAC,EAC3D,OAAO,KAAK;AACV,IAAM,QAAQ,MAAM,WAAW;AAC/B,SAAS,SAAS,MAAc,MAAc;AACnD,MAAI,CAAC,oBAAoB,KAAK,IAAI,KAAK,SAAS,OAAO,SAAS;AAC9D,UAAM,IAAI,SAAS,iBAAiB,6BAA6B;AACnE,QAAM,OAAO,QAAQ,MAAM,IAAI;AAC/B,MAAI,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAChC,UAAM,IAAI,SAAS,iBAAiB,6BAA6B;AACnE,SAAO;AACT;AACA,eAAsB,aAAa,MAAc;AAC/C,QAAM,MAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAM,OAAO,MAAM,MAAM,IAAI;AAC7B,MAAI,KAAK,eAAe,KAAK,CAAC,KAAK,YAAY;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACF,QAAM,MAAM,MAAM,GAAK;AACzB;AACA,eAAsB,WAAW,MAAc,OAAgB;AAC7D,QAAM,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC;AAC/B,QAAM,SAAS,MAAM,KAAK,MAAM,MAAM,GAAK;AAC3C,MAAI;AACF,UAAM,OAAO,UAAU,KAAK,UAAU,KAAK,CAAC;AAC5C,UAAM,OAAO,KAAK;AAAA,EACpB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI;AACvB,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAG;AACzC,QAAI;AACF,YAAM,IAAI,KAAK;AAAA,IACjB,UAAE;AACA,YAAM,IAAI,MAAM;AAAA,IAClB;AAAA,EACF,SAAS,OAAO;AACd,UAAM,OAAO,IAAI,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjC,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,OACpB,MACA,YAAY,KACZ,UAAoC,CAAC,GACP;AAC9B,QAAM,OAAO,QAAQ,QAAQ;AAC7B,MAAI,SAAS,OAAS,SAAS;AAC7B,UAAM,IAAI,SAAS,YAAY,0BAA0B;AAC3D,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,IAAI;AAAA,IACb;AAAA,IACA;AAAA,MACE,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAC9B,KAAK;AAAA,QACH,MAAM;AAAA,QACN,kBAAkB;AAAA,QAClB,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI,QAAc,CAAC,MAAM,WAAW;AACxC,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,KAAK,SAAS;AACpB,aAAO,IAAI,SAAS,iBAAiB,2BAA2B,IAAI,CAAC;AAAA,IACvE,GAAG,SAAS;AACZ,UAAM,OAAO,KAAK,QAAQ,MAAM;AAC9B,mBAAa,KAAK;AAClB,WAAK;AAAA,IACP,CAAC;AACD,UAAM,KAAK,SAAS,MAAM;AACxB,mBAAa,KAAK;AAClB,aAAO,IAAI,SAAS,YAAY,+BAA+B,CAAC;AAAA,IAClE,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,SAAS;AAC3B,mBAAa,KAAK;AAClB,UAAI,SAAS;AACX,eAAO,IAAI,SAAS,YAAY,0BAA0B,CAAC;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACD,SAAO,YAAY;AACjB,UAAM,IAAI,QAAc,CAAC,SAAS;AAChC,UAAI,MAAM,aAAa,MAAM;AAC3B,aAAK;AACL;AAAA,MACF;AACA,YAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;AAC/B,YAAM,MAAM,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;;;AChLA,SAAS,gBAAgB;AACzB,SAAS,YAAY;AA4Cd,SAAS,uBAAuB,SAIpB;AACjB,QAAM,MAAM,QAAQ,SAAS,KAAK;AAClC,QAAM,OAAO,KAAK,QAAQ,MAAM,cAAc;AAC9C,QAAM,cAAc,OAClB,IACA,QAAQ,SACO;AACf,UAAM,aAAa,QAAQ,IAAI;AAC/B,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK,QAAQ,MAAM,cAAc;AAAA,MACjC,QAAQ;AAAA,IACV;AACA,QAAI;AACF,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAC3C,YACE,EAAE,YAAY,KACd,CAAC,OAAO,cAAc,EAAE,KAAK,KAC7B,CAAC,EAAE,cACH,CAAC,EAAE;AAEH,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,MACJ,SAAS,GAAG;AACV,YAAK,EAA4B,SAAS;AACxC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,YAAI,EAAE,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC,EAAE;AAAA,MACvD;AACA,YAAM,SAAS,MAAM,GAAG,CAAC;AACzB,UAAI,MAAO,OAAM,WAAW,MAAM,CAAC;AACnC,aAAO;AAAA,IACT,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,CAAC,SAAS,UAChB,YAAY,CAAC,MAAM;AACjB,YAAM,MAAM,KAAK;AAAA,QACf,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,cAAc,KAAK,OAAO;AAChC,YAAM,WAAW,EAAE,KAAK,GAAG;AAC3B,UAAI,UAAU;AACZ,YAAI,SAAS;AACX,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,YAAI,SAAS,SAAS;AACpB,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,cAAM,KAAK,EAAE,WAAW,SAAS,EAAE;AACnC,YAAI,CAAC;AACH,gBAAM,IAAI,SAAS,qBAAqB,0BAA0B;AACpE,eAAO,EAAE,WAAW,IAAI,QAAQ,KAAK;AAAA,MACvC;AACA,YAAM,OAAO,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AACzC,YAAM,KAAK,MAAM;AACjB,YAAM,YAA6B;AAAA,QACjC,KAAK;AAAA,UACH,YAAY;AAAA,UACZ,YAAY,QAAQ;AAAA,UACpB;AAAA,UACA,MAAM,QAAQ;AAAA,UACd,SAAS,MAAM;AAAA,UACf,OAAO;AAAA,UACP,OAAO;AAAA,UACP,UAAU,EAAE,WAAW,GAAG,OAAO,KAAK;AAAA,UACtC,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,UACX,YAAY;AAAA,UACZ,UAAU;AAAA,UACV,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,qBAAqB;AAAA,UACrB,iBAAiB;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,EAAE,EAAE;AAAA,QACX,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,cAAc,CAAC;AAAA,MACjB;AACA,QAAE,WAAW,EAAE,IAAI;AACnB,QAAE,KAAK,GAAG,IAAI;AAAA,QACZ;AAAA,QACA,MAAM;AAAA,QACN,WAAW,IAAI;AAAA,QACf,SAAS;AAAA,MACX;AACA,aAAO,EAAE,WAAW,QAAQ,MAAM;AAAA,IACpC,CAAC;AAAA,IACH,KAAK,CAAC,OACJ;AAAA,MACE,CAAC,MAAO,OAAO,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;AAAA,MAC7D;AAAA,IACF;AAAA,IACF,MAAM,MAAM,YAAY,CAAC,MAAM,OAAO,OAAO,EAAE,UAAU,GAAG,KAAK;AAAA,IACjE,QAAQ,CAAC,IAAI,UAAU,OACrB,YAAY,CAAC,MAAM;AACjB,YAAM,YAAY,EAAE,WAAW,EAAE;AACjC,UAAI,CAAC;AACH,cAAM,IAAI,SAAS,iBAAiB,0BAA0B;AAChE,UAAI,UAAU,IAAI,aAAa;AAC7B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACF,YAAM,SAAS,UAAU,IAAI;AAC7B,SAAG,SAAS;AACZ,UAAI,WAAW,YAAY,UAAU,IAAI,UAAU;AACjD,kBAAU,QAAQ,EAAE,EAAE;AACxB,gBAAU,IAAI;AACd,gBAAU,IAAI,YAAY,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AACtD,aAAO;AAAA,IACT,CAAC;AAAA,IACH,QAAQ,OAAO,WAAW;AACxB,YAAM,aAAa,QAAQ,IAAI;AAC/B,YAAM,UAAU,MAAM;AAAA,QACpB,KAAK,QAAQ,MAAM,aAAa;AAAA,QAChC,QAAQ;AAAA,MACV;AACA,UAAI;AACF,eAAO,MAAM,OAAO;AAAA,MACtB,UAAE;AACA,cAAM,QAAQ;AAAA,MAChB;AAAA,IACF;AAAA,IACA,MAAM,CAAC,KAAK,IAAI,MACd,YAAY,CAAC,MAAM;AACjB,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,EAAE,IAAI,GAAG;AACjD,YAAI,MAAM,WAAW,KAAK,MAAM,YAAY,KAAK,OAAW;AAC1D,iBAAO,EAAE,KAAK,GAAG;AACjB;AAAA,QACF;AACA,cAAM,KAAK,EAAE,WAAW,MAAM,EAAE;AAChC,YACE,MACG,IAAI,IAAI,aACL,KAAK,MAAM,GAAG,IAAI,UAAU,IAC5B,MAAM,aACV,KAAK,SACP,MACA,CAAC,aAAa,UAAU,aAAa,mBAAmB,EAAE;AAAA,UACxD,GAAG,IAAI;AAAA,QACT,GACA;AACA,iBAAO,EAAE,WAAW,MAAM,EAAE;AAC5B,gBAAM,UAAU;AAChB,gBAAM,YAAY,KAAK,KAAK;AAAA,QAC9B;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACL;AACF;;;AC1NA;AAAA,EACE,YAAAC;AAAA,EAEA;AAAA,EACA,SAAAC;AAAA,EACA,UAAAC;AAAA,OAGK;AACP,SAAS,QAAAC,aAAY;AACrB,YAAY,WAAW;AAoChB,IAAM,gBAAgB;AAAA,EAC3B,aAAa,KAAK,OAAO;AAAA,EACzB,SAAS;AAAA,EACT,WAAW,OAAO;AAAA,EAClB,eAAe,KAAK,OAAO;AAAA,EAC3B,eAAe,MAAM,OAAO;AAAA,EAC5B,OAAO;AAAA,EACP,SAAS;AACX;AAEA,IAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACM,SAAS,gBACd,MACA,SAAS,eACU;AACnB,MAAI,KAAK,aAAa,OAAO;AAC3B,UAAM,IAAI,SAAS,gBAAgB,+BAA+B;AACpE,MAAI;AACJ,MAAI;AACF,QAAI,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI;AAChE,QAAI,KAAK,WAAW,CAAC,MAAM,MAAQ,QAAO,KAAK,MAAM,CAAC;AACtD,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,QAAM,MAAM;AACZ,QAAM,WACJ,OAAO,IAAI,SAAS,WAAW,IAAI,KAAK,KAAK,EAAE,YAAY,IAAI;AACjE,MACE,CAAC,UAAU,IAAI,QAAQ,KACvB,OAAO,IAAI,iBAAiB,YAC5B,CAAC,IAAI,gBACL,OAAO,IAAI,kBAAkB,YAC7B,CAAC,IAAI;AAEL,WAAO;AACT,QAAM,UACJ,OAAO,IAAI,eAAe,WACtB,IAAI,WAAW,KAAK,IACpB,OAAO,IAAI,UAAU,WACnB,IAAI,MAAM,KAAK,EAAE,YAAY,IAC7B;AACR,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO;AAAA,IACL,IAAI,KAAK,GAAG,QAAQ,IAAI,OAAO,EAAE;AAAA,IACjC;AAAA,IACA,MAAM;AAAA,IACN,QAAQ,KAAK,GAAG;AAAA,EAClB;AACF;AACA,SAAS,gBAAgB,MAAc;AACrC,MACE,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,KAAK,WAAW,GAAG,KACnB,aAAa,KAAK,IAAI,KACtB,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,SAAS,GAAG;AAE5D,UAAM,IAAI,SAAS,kBAAkB,qBAAqB;AAC5D,SAAO,KAAK,QAAQ,OAAO,EAAE;AAC/B;AACA,SAAS,SAAS,MAAc;AAC9B,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,MAAM,SAAS,UAAU,KAAK,MAAM,GAAG,EAAE,MAAM,YAAa,QAAO;AACvE,SACE,KAAK,YAAY,EAAE,SAAS,OAAO,MAClC,MAAM,WAAW,KAChB,MAAM,WAAW,KAChB,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAE1C;AACA,eAAsB,YACpB,OACA,SAAuB,eACvB,kBAAyC,YAKxC;AACD,MACE,MAAM,SAAS,OAAO,WACtB,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,OAAO;AAE1D,UAAM,IAAI,SAAS,gBAAgB,sBAAsB;AAC3D,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,UAAU,GACZ,WAAW,GACX,WAAW,GACX,UAAU;AACZ,QAAM,WAAW,KAAK,IAAI,IAAI,OAAO;AACrC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,UAAkC,CAAC;AACzC,QAAM,UAAU,CAAC,MAAc,SAAqB;AAClD,QAAI,KAAK,IAAI,IAAI;AACf,YAAM,IAAI,SAAS,gBAAgB,kCAAkC;AACvE,QAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AACA,cAAQ,WAAW,QAAQ,WAAW,KAAK;AAC3C;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,MAAM,SAAS,EAAG,UAAS,IAAI,MAAM,CAAC,CAAC;AAC3C,QAAI,SAAS,OAAO;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,UAAM,aAAa,gBAAgB,MAAM,MAAM;AAC/C,QAAI,CAAC,YAAY;AACf;AACA,cAAQ,qBAAqB,QAAQ,qBAAqB,KAAK;AAC/D;AAAA,IACF;AACA,UAAM,WAAW,YAAY,IAAI,WAAW,EAAE;AAC9C,QAAI,YAAY,SAAS,WAAW,WAAW;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,QAAI,UAAU;AACZ,UAAI,oBAAoB;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF;AACA,cAAQ,aAAa,QAAQ,aAAa,KAAK;AAC/C;AAAA,IACF;AACA,gBAAY,KAAK;AACjB,QAAI,WAAW,OAAO;AACpB,YAAM,IAAI,SAAS,gBAAgB,mCAAmC;AACxE,gBAAY,IAAI,WAAW,IAAI,UAAU;AAAA,EAC3C;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,KAAK,CAAC,MAAM,MAAQ,KAAK,KAAK,CAAC,MAAM,IAAM;AAClD,YAAM,IAAI,QAAc,CAACC,UAAS,WAAW;AAC3C,QAAM;AAAA,UACJ,OAAO,KAAK,KAAK,IAAI;AAAA,UACrB;AAAA,YACE,aAAa;AAAA,YACb,oBAAoB;AAAA,YACpB,iBAAiB;AAAA,UACnB;AAAA,UACA,CAAC,OAAO,QAAQ;AACd,gBAAI,SAAS,CAAC,KAAK;AACjB,qBAAO,IAAI,SAAS,kBAAkB,qBAAqB,CAAC;AAC5D;AAAA,YACF;AACA,gBAAI,WAAW;AACf,kBAAM,OAAO,CAAC,MAAe;AAC3B,kBAAI,MAAM;AACV;AAAA,gBACE,aAAa,WACT,IACA,IAAI;AAAA,kBACF;AAAA,kBACA;AAAA,gBACF;AAAA,cACN;AAAA,YACF;AACA,gBAAI,GAAG,SAAS,IAAI;AACpB,gBAAI,GAAG,OAAOA,QAAO;AACrB,gBAAI,GAAG,SAAS,CAAC,UAAuB;AACtC,kBAAI;AACF,oBAAI,EAAE,UAAU,OAAO;AACrB,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,sBAAM,OAAO,gBAAgB,MAAM,QAAQ;AAC3C,oBAAI,MAAM,IAAI,IAAI;AAChB,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,sBAAM,IAAI,IAAI;AACd,sBAAM,OAAQ,MAAM,2BAA2B,KAAM;AACrD,oBACE,CAAC,OAAQ,MAAQ,OAAQ,MAAQ,KAAM,EAAE,SAAS,IAAI,KACtD,MAAM,wBAAwB;AAE9B,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,oBAAI,SAAS,IAAI,EAAG,aAAY,MAAM;AACtC,oBACE,WAAW,OAAO,iBACjB,SAAS,IAAI,KAAK,MAAM,mBACvB,KAAK,IAAI,GAAG,MAAM,cAAc,IAAI,OAAO;AAE7C,wBAAM,IAAI;AAAA,oBACR;AAAA,oBACA;AAAA,kBACF;AACF,oBAAI,MAAM,SAAS,SAAS,GAAG,GAAG;AAChC,sBAAI,UAAU;AACd;AAAA,gBACF;AAEA,oBAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AACA,0BAAQ,WAAW,QAAQ,WAAW,KAAK;AAC3C,sBAAI,UAAU;AACd;AAAA,gBACF;AACA,oBAAI,eAAe,OAAO,CAAC,KAAK,WAAW;AACzC,sBAAI,OAAO,CAAC,QAAQ;AAClB,yBAAK,GAAG;AACR;AAAA,kBACF;AACA,wBAAM,SAAmB,CAAC;AAC1B,sBAAI,OAAO;AACX,sBAAI,MAAM;AACV,yBAAO,GAAG,QAAQ,CAAC,UAAkB;AACnC,+BAAW,QAAQ,OAAO;AACxB,6BAAO;AACP,+BAAS,IAAI,GAAG,IAAI,GAAG;AACrB,8BAAO,QAAQ,KAAM,MAAM,IAAI,aAAa;AAAA,oBAChD;AACA,4BAAQ,MAAM;AACd,gCAAY,MAAM;AAClB,wBACE,WAAW,OAAO,iBAClB,KAAK,IAAI,IAAI,YACZ,SAAS,IAAI,KAAK,OAAO,OAAO,WACjC;AACA,6BAAO;AAAA,wBACL,IAAI;AAAA,0BACF;AAAA,0BACA;AAAA,wBACF;AAAA,sBACF;AACA;AAAA,oBACF;AACA,wBAAI,SAAS,IAAI,EAAG,QAAO,KAAK,KAAK;AAAA,kBACvC,CAAC;AACD,yBAAO,GAAG,SAAS,IAAI;AACvB,yBAAO,GAAG,OAAO,MAAM;AACrB,wBAAI;AACF,2BAAK,MAAM,gBAAgB,MAAM,MAAM;AACrC,8BAAM,IAAI;AAAA,0BACR;AAAA,0BACA;AAAA,wBACF;AACF,8BAAQ,MAAM,OAAO,OAAO,MAAM,CAAC;AACnC,0BAAI,UAAU;AAAA,oBAChB,SAAS,GAAG;AACV,2BAAK,CAAC;AAAA,oBACR;AAAA,kBACF,CAAC;AAAA,gBACH,CAAC;AAAA,cACH,SAAS,GAAG;AACV,qBAAK,CAAC;AAAA,cACR;AAAA,YACF,CAAC;AACD,gBAAI,UAAU;AAAA,UAChB;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,OAAO;AACL;AACA,YAAM,OAAO,gBAAgB,KAAK,IAAI;AACtC,UAAI,MAAM,IAAI,IAAI;AAChB,cAAM,IAAI,SAAS,kBAAkB,qBAAqB;AAC5D,YAAM,IAAI,IAAI;AACd,kBAAY,KAAK,KAAK;AACtB,cAAQ,KAAK,SAAS,GAAG,IAAI,OAAO,GAAG,IAAI,SAAS,KAAK,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,SAAS,sBAAsB,gCAAgC;AAC3E,SAAO,EAAE,aAAa,CAAC,GAAG,YAAY,OAAO,CAAC,GAAG,SAAS,QAAQ;AACpE;AAsBO,SAAS,qBAAqB,SAKpB;AACf,QAAM,MAAM,QAAQ,SAAS,KAAK,KAChC,SAAS,QAAQ,UAAU;AAC7B,QAAM,gBAAgB,CAAC,OACrB,SAAS,QAAQ,MAAM,GAAG,EAAE,iBAAiB;AAC/C,SAAO;AAAA,IACL,QAAQ,OAAO,OAAO,SAAS,eAAe;AAC5C,YAAM,aAAa,QAAQ,IAAI;AAC/B,UACE,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,OAAO,eAC1D,MAAM,SAAS,OAAO;AAEtB,cAAM,IAAI,SAAS,gBAAgB,sBAAsB;AAC3D,YAAM,KAAK,MAAM;AACjB,YAAM,WAAW,SAAS,QAAQ,MAAM,GAAG,EAAE,cAAc,GAAG;AAAA,QAC5D;AAAA,QACA;AAAA,QACA,WAAW,IAAI,IAAI;AAAA,QACnB,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,UACvB,MAAM,EAAE;AAAA,UACR,MAAM,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,QAAQ;AAAA,QAC7C,EAAE;AAAA,MACJ,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,OAAO,OAAO,IAAI,SAAS,eAAe;AACxC,YAAM,OAAO,SAAS,QAAQ,MAAM,GAAG,EAAE,cAAc;AACvD,UAAI;AAMJ,UAAI;AACF,iBAAS,KAAK,MAAM,MAAMC,UAAS,MAAM,MAAM,CAAC;AAAA,MAClD,QAAQ;AACN,cAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAAA,MAC1D;AACA,UAAI,OAAO,YAAY,WAAW,OAAO,eAAe;AACtD,cAAM,IAAI,SAAS,kBAAkB,iCAAiC;AACxE,UAAI;AACF,YAAI,OAAO,YAAY,IAAI;AACzB,gBAAM,IAAI,SAAS,eAAe,gBAAgB;AACpD,cAAM,WAAW,MAAM;AAAA,UACrB,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,YACvB,MAAM,EAAE;AAAA,YACR,MAAM,OAAO,KAAK,EAAE,MAAM,QAAQ;AAAA,UACpC,EAAE;AAAA,UACF;AAAA,UACA,QAAQ,mBAAmB;AAAA,QAC7B;AACA,cAAM,YAAuB;AAAA,UAC3B,GAAG;AAAA,UACH,IAAI,MAAM;AAAA,UACV;AAAA,UACA;AAAA,UACA,WAAW,IAAI;AAAA,UACf,WAAW,IAAI,IAAI;AAAA,QACrB;AACA,cAAM,WAAW,cAAc,UAAU,EAAE,GAAG,SAAS;AACvD,eAAO;AAAA,MACT,UAAE;AACA,cAAMC,QAAO,IAAI,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,KAAK,OAAO,IAAI,SAAS,YAAY,UAAU;AAC7C,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,MAAM,MAAMD,UAAS,cAAc,EAAE,GAAG,MAAM,CAAC;AAAA,MAC1D,QAAQ;AACN,cAAM,IAAI,SAAS,iBAAiB,uBAAuB;AAAA,MAC7D;AACA,UAAI,EAAE,eAAe,cAAe,EAAE,YAAY,WAAW,CAAC;AAC5D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,EAAE,YAAY,IAAI;AACpB,cAAM,IAAI,SAAS,eAAe,mBAAmB;AACvD,aAAO;AAAA,IACT;AAAA,IACA,MAAM,CAAC,MAAM,WAAW,cAAc,EAAE,EAAE,GAAG,CAAC;AAAA,IAC9C,QAAQ,OAAO,OAAO;AACpB,YAAMC,QAAO,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM;AAC3C,YAAI,EAAE,SAAS,SAAU,OAAM;AAAA,MACjC,CAAC;AAAA,IACH;AAAA,IACA,MAAM,OAAO,iBAAiB;AAC5B,YAAM,aAAa,QAAQ,IAAI;AAC/B,iBAAW,QAAQ,MAAM,QAAQ,QAAQ,IAAI,GAAG;AAC9C,YAAI,CAAC,qCAAqC,KAAK,IAAI,EAAG;AACtD,cAAM,KAAK,KAAK,MAAM,GAAG,EAAE,CAAC;AAC5B,YAAI,aAAa,IAAI,EAAE,EAAG;AAC1B,cAAM,OAAO,SAAS,QAAQ,MAAM,IAAI;AACxC,YAAI;AACF,gBAAM,QAAQ,KAAK,MAAM,MAAMD,UAAS,MAAM,MAAM,CAAC;AACrD,cAAI,MAAM,YAAY,IAAI,EAAG,OAAMC,QAAO,IAAI;AAAA,QAChD,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,wBACpB,MACA,SAAS,eACc;AACvB,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ,GACV,QAAQ;AACV,QAAM,QAAQ,OAAO,MAAc,QAAgB,UAAkB;AACnE,eAAW,QAAQ,MAAM,QAAQ,IAAI,GAAG;AACtC,UAAI,EAAE,QAAQ,OAAO;AACnB,cAAM,IAAI,SAAS,gBAAgB,gCAAgC;AACrE,YAAM,OAAOC,MAAK,MAAM,IAAI,GAC1B,OAAO,MAAMC,OAAM,IAAI;AACzB,UAAI,KAAK,eAAe,KAAM,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,OAAO;AAChE,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,KAAK,YAAY,GAAG;AACtB,YAAI,QAAQ,KAAK,SAAS;AACxB,gBAAM,MAAM,MAAM,GAAG,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;AAClD;AAAA,MACF;AACA,UAAI,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,EAAE,EAAG;AACnC,UAAI,KAAK,OAAO,OAAO;AACrB,cAAM,IAAI,SAAS,gBAAgB,+BAA+B;AACpE,eAAS,KAAK;AACd,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAI,SAAS,gBAAgB,gCAAgC;AACrE,aAAO,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,IAAI,MAAM,MAAMH,UAAS,IAAI,EAAE,CAAC;AAAA,IACtE;AAAA,EACF;AACA,QAAM,WAAW,MAAMG,OAAM,IAAI;AACjC,MAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY;AACrD,UAAM,IAAI,SAAS,kBAAkB,mCAAmC;AAC1E,QAAM,MAAM,MAAM,IAAI,CAAC;AACvB,SAAO;AACT;;;ACnfA;AAAA,EACE,YAAAC;AAAA,EACA,WAAAC;AAAA,EACA,SAAAC;AAAA,EAGA;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EAGA,QAAAC;AAAA,OACK;AACP,SAAS,QAAAC,OAAM,WAAAC,UAAS,WAAAC,gBAAe;AA+ChC,SAAS,wBAAiC;AAC/C,QAAM,cAAc,YAA4B;AAC9C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,MACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,IAAI,CAAC,SAAS;AAAA,QACd;AAAA,QACA,EAAE,SAAS,OAAO,YAAY,yBAAyB;AAAA,MACzD,CAAC;AAAA,IACH;AAAA,IACA,wBAAwB;AAAA,IACxB,UAAU,aAAa,EAAE,UAAU,KAAK,WAAW,GAAG,aAAa,CAAC,EAAE;AAAA,IACtE,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,YAAY;AAAA,EACvB;AACF;AACO,SAAS,uBAAuB,SAKpC;AACD,QAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,MACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI;AAEJ,UAAM,IAAI,SAAS,iBAAiB,+BAA+B;AACrE,SAAO,YAAY;AACjB,QAAI;AACJ,QAAI;AACF,iBAAW,OAAO,QAAQ,SAAS;AAAA,QACjC,GAAG,QAAQ,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAAA,QACrC;AAAA,UACE,SAAS,EAAE,eAAe,UAAU,MAAM,QAAQ,OAAO,CAAC,GAAG;AAAA,UAC7D,UAAU;AAAA,UACV,QAAQ,YAAY,QAAQ,QAAQ,aAAa,GAAM;AAAA,QACzD;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,MACrB;AACF,QAAI,QAAQ;AACZ,UAAM,SAAuB,CAAC;AAC9B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,SAAS,0BAA0B,2BAA2B;AAC1E,qBAAiB,SAAS,SAAS,MAA8C;AAC/E,eAAS,MAAM;AACf,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAI,SAAS,gBAAgB,6BAA6B;AAClE,aAAO,KAAK,KAAK;AAAA,IACnB;AACA,QAAI;AACJ,QAAI;AACF,aAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAAA,IAC1D,QAAQ;AACN,YAAM,IAAI,SAAS,0BAA0B,uBAAuB;AAAA,IACtE;AACA,QAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,KAAK,KAAK,SAAS;AAClD,YAAM,IAAI,SAAS,0BAA0B,uBAAuB;AACtE,WAAO,KAAK,KAAK,IAAI,CAAC,MAAM;AAC1B,UAAI,OAAO,EAAE,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS;AACrD,cAAM,IAAI,SAAS,0BAA0B,kBAAkB;AACjE,aAAO,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,EAAc;AAAA,IAClD,CAAC;AAAA,EACH;AACF;AACA,IAAM,MAAM,CAAC,OAAkC;AAAA,EAC7C,IAAI,EAAE;AAAA,EACN,UAAU,EAAE;AAAA,EACZ,aAAa,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAI,EAAE,GAAG,MAAM,EAAE,CAAC;AAAA,EAClD,WAAW,EAAE,KAAK,aAAa,OAAO,aAAa;AAAA,EACnD,WACE,OAAO,EAAE,KAAK,iBAAiB,YAC/B,OAAO,SAAS,KAAK,MAAM,EAAE,KAAK,YAAY,CAAC,IAC3C,IAAI,KAAK,EAAE,KAAK,YAAY,EAAE,YAAY,IAC1C;AACR;AACO,SAAS,yBAAyB,SAM7B;AACV,QAAM,OAAOC,SAAQ,QAAQ,IAAI,GAC/B,SAASA,SAAQ,QAAQ,UAAU;AACrC,MAAI,CAAC,OAAO,WAAW,GAAG,IAAI,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACF,QAAM,UAAU,YAAY;AAC1B,QAAI;AACJ,QAAI;AACF,YAAM,OAAO,MAAMC,OAAM,MAAM;AAC/B,UAAI,KAAK,eAAe,GAAG;AACzB,eAAOD,SAAQE,SAAQ,MAAM,GAAG,MAAM,SAAS,MAAM,CAAC;AACtD,YAAI,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG;AAC7B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,MACJ,WAAW,KAAK,YAAY,EAAG,QAAO;AAAA,UACjC,OAAM,IAAI,MAAM;AAAA,IACvB,SAAS,GAAG;AACV,UAAI,aAAa,SAAU,OAAM;AACjC,YAAM,IAAI,SAAS,qBAAqB,yBAAyB;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,YAAY;AACvB,UAAM,OAAO,MAAM,QAAQ,GACzB,QAAsB,CAAC;AACzB,UAAM,MAA8B,CAAC;AACrC,UAAM,SAAwD,CAAC;AAC/D,eAAW,SAAS,MAAMC,SAAQ,IAAI,GAAG,KAAK,GAAG;AAC/C,UAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAC7B,YAAM,OAAO,MAAMF,OAAMG,MAAK,MAAM,IAAI,CAAC;AACzC,UAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe;AACxC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,QAAQ,MAAMC,UAASD,MAAK,MAAM,IAAI,CAAC;AAC7C,UAAI,IAAI,IAAI,KAAK,MAAM,SAAS,QAAQ,CAAC;AACzC,YAAM,IAAI,gBAAgB,KAAK;AAC/B,UAAI,GAAG;AACL,YAAI,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,EAAE;AACvC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,cAAM,KAAK,CAAC;AAAA,MACd,MAAO,QAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC;AAAA,IAC9D;AACA,WAAO,EAAE,MAAM,OAAO,QAAQ,UAAU,KAAK,GAAG,EAAE;AAAA,EACpD;AACA,QAAM,WAAW,YAAY;AAC3B,UAAM,IAAI,MAAM,KAAK;AACrB,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,MACZ,aAAa;AAAA,QACX,GAAG,EAAE,MAAM,IAAI,GAAG;AAAA,QAClB,GAAG,EAAE,OAAO,IAAI,CAAC,OAAO;AAAA,UACtB,IAAI,EAAE;AAAA,UACN,UAAU;AAAA,UACV,aAAa,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAI,EAAE,GAAG,MAAM,EAAE,CAAC;AAAA,UAClD,WAAW;AAAA,UACX,WAAW;AAAA,QACb,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OACb,UACA,OACA,KACA,iBAAiB,SACd;AACH,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,UAAU,KAAK;AAC7B,QAAI,WAAW;AACf,QAAI,WAAW;AACf,QAAI,OAAO;AACX,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK;AACzB,iBAAW,MAAM;AACjB,UAAI,MAAM,aAAa;AACrB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,cAAc,MAAM,KAAK;AAC/B,UACE,CAAC,YAAY,UACb,CAAC,YAAY,KAAK,CAAC,MAAM,EAAE,KAAK,aAAa,IAAI;AAEjD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,IAAI,MAAM;AAChB,aAAOA,MAAK,MAAM,eAAe,OAAO,MAAM,CAAC,EAAE;AACjD,YAAM,aAAaF,SAAQ,IAAI,CAAC;AAChC,YAAM,aAAa,IAAI;AACvB,iBAAW,KAAK,aAAa;AAC3B,cAAM,SAAS,MAAMI,MAAKF,MAAK,MAAM,GAAG,EAAE,EAAE,OAAO,GAAG,MAAM,GAAK;AACjE,YAAI;AACF,gBAAM,OAAO,UAAU,KAAK,UAAU,EAAE,IAAI,CAAC;AAC7C,gBAAM,OAAO,KAAK;AAAA,QACpB,UAAE;AACA,gBAAM,OAAO,MAAM;AAAA,QACrB;AAAA,MACF;AACA,UAAI;AACF,mBAAW,KAAK,MAAM,QAAQ;AAC5B,gBAAM,SAAS,MAAME,MAAKF,MAAK,MAAM,GAAG,EAAE,EAAE,OAAO,GAAG,MAAM,GAAK;AACjE,cAAI;AACF,kBAAM,OAAO,UAAU,EAAE,KAAK;AAC9B,kBAAM,OAAO,KAAK;AAAA,UACpB,UAAE;AACA,kBAAM,OAAO,MAAM;AAAA,UACrB;AAAA,QACF;AACF,YAAM,UAAU,MAAME,MAAK,MAAM,GAAG;AACpC,UAAI;AACF,cAAM,QAAQ,KAAK;AAAA,MACrB,UAAE;AACA,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,YAAM,IAAI,MAAM,WAAW,EAAE,cAAc,UAAU,UAAU,KAAK,CAAC;AACrE,YAAM,MAAMF,MAAKF,SAAQ,MAAM,GAAG,UAAU,MAAM,CAAC,EAAE;AACrD,YAAM,QAAQ,MAAM,GAAG;AACvB,YAAM,IAAI,MAAM;AAChB,YAAM,IAAI,MAAM,UAAU,EAAE,cAAc,UAAU,UAAU,KAAK,CAAC;AACpE,YAAMK,QAAO,KAAK,MAAM;AACxB,iBAAW;AACX,YAAM,QAAQ,UAAU,MAAM;AAC9B,YAAM,IAAI,MAAM,UAAU,EAAE,cAAc,UAAU,UAAU,KAAK,CAAC;AACpE,YAAM,QAAQ,OAAO;AACrB,YAAM,WAAWH,MAAK,MAAM,gBAAgB,GAAG;AAAA,QAC7C,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD,YAAM,IAAI,MAAM,QAAQ;AACxB,aAAO;AAAA,QACL,WAAW,MAAM,SAAS,GAAG;AAAA,QAC7B,OAAO,YAAY;AAAA,MACrB;AAAA,IACF,SAAS,OAAO;AACd,UACE,YACA,iBAAiB,YACjB,MAAM,SAAS,uBACf;AACA,cAAM,WAAWA,MAAK,MAAM,gBAAgB,GAAG;AAAA,UAC7C,cAAc;AAAA,UACd,YAAY;AAAA,QACd,CAAC;AACD,cAAMI,WAAU,MAAM,SAAS;AAC/B,eAAO;AAAA,UACL,UAAUA,SAAQ;AAAA,UAClB,OAAOA,SAAQ,YAAY;AAAA,UAC3B,cAAc;AAAA,QAChB;AAAA,MACF;AACA,UAAI,UAAU;AACZ,YAAI;AACF,gBAAM,MAAMJ,MAAKF,SAAQ,MAAM,GAAG,UAAU,MAAM,CAAC,EAAE;AACrD,gBAAM,QAAQ,UAAU,KAAK;AAC7B,gBAAM,QAAQ,UAAU,GAAG;AAC3B,gBAAMK,QAAO,KAAK,MAAM;AACxB,gBAAM,QAAQ,UAAU,MAAM;AAC9B,gBAAM,QAAQ,OAAO;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF,MAAO,OAAM,QAAQ,UAAU,MAAM;AACrC,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,MACZ,gBAAgB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,MAClD,gBAAgB;AAAA,QACd,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,OAAO,CAAC,SAAS,SAAS;AAAA,QAC1B,WAAW;AAAA,MACb;AAAA,MACA,iBAAiB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,MACnD,qBAAqB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,MACvD,oBAAoB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,IACxD;AAAA,IACA,wBAAwB;AAAA,IACxB;AAAA,IACA,OAAO,CAAC,OAAO,QACb;AAAA,MACE,MAAM;AAAA,MACN,CAAC,UAAU;AACT,cAAM,WAAW,IAAI,IAAI,MAAM,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,cAAM,OACJ,MAAM,SAAS,UACX,IAAI,IAAI,QAAQ,IAChB,oBAAI,IAAwB;AAClC,mBAAW,KAAK,MAAM;AACpB,eAAK;AAAA,YACH,EAAE;AAAA,YACF,SAAS,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,aAAa,SAAS,EAAE,EAAE,IACnD,SAAS,IAAI,EAAE,EAAE,IACjB;AAAA,UACN;AACF,YAAI,MAAM,SAAS,WAAW;AAC5B,gBAAM,WAAW,CAAC,GAAG,SAAS,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;AAClE,mBAAS,KAAK,GAAG,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAC9C,cAAI,SAAS,KAAK,CAAC,OAAO,CAAC,MAAM,kBAAkB,SAAS,EAAE,CAAC;AAC7D,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,QACJ;AACA,eAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,MAAM,SAAS;AAAA,IACjB;AAAA,IACF,QAAQ,CAAC,IAAI,UAAU,QACrB;AAAA,MACE;AAAA,MACA,CAAC,UAAU;AACT,YACE,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KACpC,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AAErC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,cAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AACrD,eAAO,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AAAA,MAC9C;AAAA,MACA;AAAA,IACF;AAAA,IACF,SAAS,OAAO,UAAU;AACxB,YAAM,OAAO,OAAO,MAAM,aAAa,WAAW,MAAM,WAAW,MACjE,WACE,OAAO,MAAM,iBAAiB,WAAW,MAAM,eAAe;AAClE,UACE,CAAC,QACD,CAAC,YACD,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,KAC3B,CAAC,SAAS,WAAW,GAAG,IAAI,GAAG;AAE/B,eAAO;AACT,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ;AAC3B,YAAI,SAAS,MAAM;AACjB,gBAAM,QAAQ,UAAU,MAAM;AAC9B,gBAAM,QAAQ,OAAO;AACrB,iBAAO;AAAA,QACT;AACA,YAAI,SAAS,UAAU;AACrB,gBAAM,QAAQ,UAAU,MAAM;AAC9B,gBAAM,QAAQ,OAAO;AACrB,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,0BAA0B,SAKlB;AACtB,QAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,MACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI;AAEJ,UAAM,IAAI,SAAS,iBAAiB,qCAAqC;AAC3E,QAAM,OAAO,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AAC9C,SAAO;AAAA,IACL,SAAS,OAAO,MAAM,OAAO,CAAC,MAAM;AAClC,UAAI,CAAC,iCAAiC,KAAK,IAAI;AAC7C,cAAM,IAAI,SAAS,iBAAiB,0BAA0B;AAChE,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,UAAU,MAAM,QAAQ,OAAO,CAAC,EAAE;AAC/D,YAAM,SAAS,YAAY,IAAI;AAAA,QAC7B,YAAY,QAAQ,QAAQ,aAAa,GAAM;AAAA,QAC/C,GAAI,KAAK,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC;AAAA,MACrC,CAAC;AACD,UAAI;AACJ,UAAI;AACF,mBAAW,OAAO,QAAQ,SAAS;AAAA,UACjC,GAAG,IAAI,iBAAiB,IAAI;AAAA,UAC5B,EAAE,GAAG,MAAM,SAAS,QAAQ,UAAU,QAAQ;AAAA,QAChD;AAAA,MACF,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI;AAAA,UACR,SAAS,WAAW,MAChB,wBACA;AAAA,UACJ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB;AACF,UAAI,SAAS,WAAW,IAAK,QAAO,CAAC;AACrC,UAAI;AACF,YAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM;AACpC,cAAM,SAAS,SAAS,KAAK,UAAU,GACrC,SAAuB,CAAC;AAC1B,YAAI,OAAO;AACX,mBAAS;AACP,gBAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,cAAI,MAAM,KAAM;AAChB,kBAAQ,MAAM,MAAM;AACpB,cAAI,OAAO,IAAI,OAAO,MAAM;AAC1B,kBAAM,OAAO,OAAO;AACpB,kBAAM,IAAI,MAAM;AAAA,UAClB;AACA,iBAAO,KAAK,MAAM,KAAK;AAAA,QACzB;AACA,eAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAAA,MAC1D,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AACO,SAAS,gCAAgC,SAKpC;AACV,QAAM,UAAU,QAAQ,oBAAoB,QAAQ;AACpD,QAAM,eAA6B,OAAO;AAAA,IACxC;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,IAAI,CAAC,SAAS;AAAA,MACd;AAAA,MACA,EAAE,SAAS,YAAY,UAAU,OAAO,qBAAqB;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,eAAa,cAAc,IAAI;AAAA,IAC7B;AAAA,IACA,YAAY,UAAU,OAAO;AAAA,IAC7B,OAAO,CAAC,OAAO;AAAA,IACf,WAAW;AAAA,EACb;AACA,QAAM,QAAQ,oBAAI,IAAoB;AACtC,QAAM,WAAW,YAAY;AAC3B,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,UAAM,OAAQ,MAAM,QAAQ,UAAU,QAAQ,cAAc;AAG5D,QAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,UAAM,MAAM;AACZ,UAAM,MACJ,CAAC;AACH,eAAW,OAAO,KAAK,OAAO;AAC5B,YAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AACvD,UAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI;AACnD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,aACJ,IAAI,iBAAiB,OACjB,OACA,MAAM,QAAQ,UAAU;AAAA,QACtB,8BAA8B,mBAAmB,IAAI,CAAC;AAAA,MACxD;AACN,YAAM,aAAa,aACf,gBAAgB,OAAO,KAAK,KAAK,UAAU,UAAU,CAAC,CAAC,IACvD;AACJ,YAAM,KAAK,YAAY,MAAM,KAAK,IAAI;AACtC,YAAM,IAAI,IAAI,IAAI;AAClB,UAAI,KAAK,EAAE,GAAG,KAAK,IAAI,QAAQ,KAAK,cAAc,GAAG,EAAE,CAAC;AAAA,IAC1D;AACA,UAAM,cAA+B,IAAI,IAAI,CAAC,SAAS;AAAA,MACrD,IAAI,IAAI;AAAA,MACR,UACE,OAAO,IAAI,SAAS,WAChB,IAAI,OACJ,OAAO,IAAI,aAAa,WACtB,IAAI,WACJ;AAAA,MACR,aAAa,GAAG,OAAO,IAAI,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,SAAI,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AAAA,MACtE,WACE,IAAI,aAAa,OACb,aACA,IAAI,WAAW,UACb,WACA;AAAA,MACR,WAAW,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;AAAA,IACnE,EAAE;AACF,WAAO,EAAE,UAAU,KAAK,GAAG,GAAG,YAAY;AAAA,EAC5C;AACA,SAAO;AAAA,IACL;AAAA,IACA,wBAAwB,QAAQ,mBAAmB,cAAc;AAAA,IACjE;AAAA,IACA,OAAO,OAAO,OAAO,QAAQ;AAC3B,UAAI,CAAC,WAAW,MAAM,SAAS,aAAa,MAAM,aAAa;AAC7D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,UAAU,MAAM,SAAS;AAC/B,UAAI,QAAQ,aAAa,MAAM;AAC7B,cAAM,IAAI,SAAS,qBAAqB,yBAAyB;AACnE,YAAM,WAA4C,CAAC;AACnD,iBAAW,cAAc,MAAM,aAAa;AAC1C,cAAM,IAAI,MAAM;AAChB,cAAM,SAAS,MAAM,SAAS;AAC9B,cAAM,QAAQ,OAAO,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE;AACnE,YAAI,OAAO;AACT,mBAAS,KAAK,EAAE,IAAI,WAAW,IAAI,OAAO,YAAY,CAAC;AACvD;AAAA,QACF;AACA,cAAM,IAAI,MAAM,UAAU,EAAE,SAAS,CAAC;AACtC,YAAI;AACF,gBAAM,QAAQ,UAAU;AAAA,YACtB,qBAAqB,mBAAmB,GAAG,WAAW,EAAE,OAAO,CAAC;AAAA,YAChE;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU,WAAW,IAAI;AAAA,YACtC;AAAA,UACF;AACA,mBAAS,KAAK,EAAE,IAAI,WAAW,IAAI,OAAO,UAAU,CAAC;AAAA,QACvD,QAAQ;AACN,mBAAS,KAAK,EAAE,IAAI,WAAW,IAAI,OAAO,UAAU,CAAC;AACrD,gBAAM,IAAI,MAAM,UAAU,EAAE,SAAS,CAAC;AACtC,gBAAM,IAAI;AAAA,YACR,SAAS,KAAK,CAAC,MAAM,EAAE,UAAU,SAAS,IACtC,kBACA;AAAA,YACJ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,MAAM,UAAU,EAAE,SAAS,CAAC;AACtC,YAAM,SAAS;AACf,aAAO,EAAE,SAAS;AAAA,IACpB;AAAA,IACA,QAAQ,OAAO,IAAI,UAAU,QAAQ;AACnC,UAAI,CAAC;AACH,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,IAAI,MAAM,SAAS;AACzB,UAAI,EAAE,aAAa;AACjB,cAAM,IAAI,SAAS,qBAAqB,yBAAyB;AACnE,YAAM,OAAO,MAAM,IAAI,EAAE;AACzB,UAAI,CAAC;AACH,cAAM,IAAI,SAAS,qBAAqB,6BAA6B;AACvE,UACE,EAAE,YAAY,UAAU,KACvB,CAAC,QAAQ,wBACR,CAAC,EAAE,YACA,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EACzB,KAAK,CAAC,MAAM,EAAE,cAAc,QAAQ;AAEzC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,IAAI,MAAM,UAAU,EAAE,cAAc,GAAG,CAAC;AAC9C,UAAI;AACF,cAAM,QAAQ,UAAU;AAAA,UACtB,qBAAqB,mBAAmB,IAAI,CAAC;AAAA,UAC7C,EAAE,QAAQ,SAAS;AAAA,QACrB;AAAA,MACF,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,MAAM,QAAQ;AACxB,YAAM,QAAQ,MAAM,SAAS;AAC7B,UAAI,MAAM,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AAC3C,cAAM,IAAI,SAAS,mBAAmB,wBAAwB;AAChE,aAAO,EAAE,UAAU,MAAM,UAAU,WAAW,GAAG;AAAA,IACnD;AAAA,IACA,SAAS,YAAY;AAAA,EACvB;AACF;;;AClrBA,SAAS,gBAAgB;AA0ElB,SAAS,iBACd,QACA,UACA;AACA,WAAS,MAAM,OAAO,UAAU;AAChC,QAAM,MAAM,SAAS,SAAS,KAAK;AACnC,MAAI,UAAqB;AAAA,IACvB,YAAY;AAAA,IACZ,YAAY,OAAO;AAAA,IACnB,QAAQ,CAAC;AAAA,IACT,WAAW;AAAA,IACX,WAAW;AAAA,IACX,OAAO;AAAA,IACP,UAAU,KAAK,CAAC,CAAC;AAAA,EACnB;AACA,MAAI,aAA8C;AAClD,MAAI,oBAAoB;AACxB,QAAM,cAAc,YAAY;AAC9B,UAAM,SAAS,MAAM,SAAS,YAAY,IAAI;AAC9C,QAAI,UAAU,OAAO,eAAe,OAAO,WAAY,WAAU;AAAA,EACnE;AACA,QAAM,cAAc,YAAY;AAC9B,QAAI;AACF,YAAM,SAAS,YAAY,IAAI,OAAO;AAAA,IACxC,QAAQ;AACN,0BAAoB;AAAA,IACtB;AAAA,EACF;AACA,QAAM,YAAY,OAAO,OAAc,WAAmB;AACxD,aAAS,MAAM,MAAM,EAAE;AACvB,QAAI,CAAE,MAAM,SAAS,cAAc,MAAM,OAAO,OAAO,YAAY,MAAM;AACvE,YAAM,IAAI,SAAS,kBAAkB,8BAA8B;AAAA,EACvE;AACA,QAAM,eAAe,OAAO;AAAA,IAC1B,GAAG,SAAS,QAAQ;AAAA,IACpB,GAAI,CAAC,SAAS,cACV,OAAO;AAAA,MACL;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,IAAI,CAAC,SAAS;AAAA,QACd;AAAA,QACA,EAAE,SAAS,OAAO,YAAY,iBAAiB;AAAA,MACjD,CAAC;AAAA,IACH,IACA,CAAC;AAAA,IACL,mBAAmB;AAAA,MACjB,SAAS,CAAC,CAAC,SAAS;AAAA,MACpB,YAAY,SAAS,UAAU,OAAO;AAAA,IACxC;AAAA,IACA,eAAe;AAAA,MACb,SAAS,CAAC,CAAC,SAAS;AAAA,MACpB,YAAY,SAAS,QAAQ,OAAO;AAAA,IACtC;AAAA,IACA,GAAG,OAAO;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,IAAI,CAAC,SAAS;AAAA,QACd;AAAA,QACA;AAAA,UACE,SACE,CAAC,CAAC,SAAS,aACV,CAAC,oBAAoB,mBAAmB,gBAAgB,EAAE;AAAA,YACzD;AAAA,UACF,KACE,CAAC,CAAC,SAAS;AAAA,UACf,YAAY,SAAS,WACjB,SAAS,cACP,OACA,mBACF;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,oBAAoB,EAAE,SAAS,MAAM,YAAY,KAAK;AAAA,EACxD;AACA,QAAM,SAAS,OAAO,IAAY,OAAsC;AACtE,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,YAAM,KAAK,MAAM,SAAS,MAAM,IAAI,EAAE;AACtC,UAAI,CAAC,GAAI,OAAM,IAAI,SAAS,iBAAiB,mBAAmB;AAChE,UAAI;AACF,eAAO,MAAM,SAAS,MAAM,OAAO,IAAI,GAAG,IAAI,UAAU,EAAE;AAAA,MAC5D,SAAS,GAAG;AACV,YAAI,EAAE,aAAa,aAAa,EAAE,SAAS,oBAAqB,OAAM;AAAA,MACxE;AAAA,IACF;AACA,UAAM,IAAI,SAAS,iBAAiB,gCAAgC,IAAI;AAAA,EAC1E;AACA,QAAM,MAAM,OAAO,IAAY,UAAiB;AAC9C,UAAM,UAAU,OAAO,gBAAgB;AACvC,UAAM,KAAK,MAAM,SAAS,MAAM,IAAI,EAAE;AACtC,QAAI,CAAC,MAAM,GAAG,IAAI,eAAe,OAAO;AACtC,YAAM,IAAI,SAAS,iBAAiB,mBAAmB;AACzD,QAAI,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC,MAAM;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OACd,aACA,OACA,UAAmE,CAAC,MACtC;AAC9B,UAAM,UAAU,OAAO,iBAAiB;AACxC,UAAM,IAAI,MAAM,SAAS,QAAQ;AAAA,MAC/B;AAAA,MACA,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM;AAAA,IACR;AACA,UAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAC1C,UAAM,WAAW,IAAI,IAAI,EAAE,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,GAC3D,WAAW,IAAI,IAAI,EAAE,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AACzD,UAAM,eAAe,QAAQ,gBAAgB,CAAC;AAC9C,UAAM,OAAO,QAAQ,QAAQ;AAC7B,MAAE,UAAU;AAAA,MACV,UAAU,EAAE;AAAA,MACZ,WAAW,IAAI,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,KAAK,CAAC;AAC7B,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,YAAY,OAAO;AAAA,MACnB,aAAa,EAAE;AAAA,MACf,UAAU,EAAE;AAAA,MACZ,WAAW,IAAI,KAAK,EAAE,SAAS,EAAE,YAAY;AAAA,MAC7C,kBAAkB,IAAI,KAAK,EAAE,QAAQ,SAAS,EAAE,YAAY;AAAA,MAC5D,UAAU,EAAE,YAAY;AAAA,MACxB,SAAS,EAAE;AAAA,MACX,WAAW,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;AAAA,MACzD,WAAW,CAAC,GAAG,QAAQ,EAAE;AAAA,QAAO,CAAC,OAC/B,SAAS,UACL,CAAC,aAAa,SAAS,EAAE,IACzB,SAAS,IAAI,EAAE,KAAK,CAAC,aAAa,SAAS,EAAE;AAAA,MACnD;AAAA,MACA,cAAc,CAAC,GAAG,QAAQ,EAAE;AAAA,QAC1B,CAAC,OAAO,SAAS,IAAI,EAAE,KAAK,aAAa,SAAS,EAAE;AAAA,MACtD;AAAA,MACA,UACE,SAAS,YACL,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,IAC9C,CAAC;AAAA,MACP,SAAS,EAAE;AAAA,IACb;AAAA,EACF;AACA,QAAM,UAAU;AAAA,IACd,sBAAsB,OAAO;AAAA,MAC3B,GAAG,OAAO;AAAA,MACV,kBAAkB,CAAC,GAAG,OAAO,WAAW,gBAAgB;AAAA,IAC1D;AAAA,IACA,QAAQ,OAAO,OAAgB,UAAwC;AACrE,YAAM,SAAS,cAAc,UAAU,KAAK;AAC5C,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,SAAS,iBAAiB,gCAAgC;AACtE,YAAM,UAAU,OAAO;AACvB,UAAI,QAAQ,eAAe,OAAO;AAChC,cAAM,IAAI,SAAS,iBAAiB,kBAAkB;AACxD,YAAM,UAAU,OAAO,QAAQ,IAAI;AACnC,YAAM,MACJ,aAAa,EAAE,QAAQ,IAA6C;AACtE,UAAI,CAAC,KAAK;AACR,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,QAAQ,SAAS,gBAAgB;AACnC,cAAM,SAAS,SAAS,QAAQ,aAAa,cAAc;AAC3D,YACG,QAAQ,SAAS,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,IAAI,KAC5D,QAAQ,cAAc,SAAS,QAAQ,QAAQ,aAAa;AAE7D,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,MACJ;AACA,UACE;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,SAAS,QAAQ,IAAI,KACvB,CAAC,SAAS;AAEV,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAM,SAAS,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK;AACzD,UACE,QAAQ,SAAS,sBACjB,OAAO,UAAU,IAAI,UAAU,UAC/B;AACA,cAAM,SAAS,MAAM,IAAI,QAAQ,QAAQ,aAAa,KAAK;AAC3D,cAAM,OAAO,OAAO,IAAI,IAAI,CAAC,OAAO;AAClC,aAAG,IAAI,kBAAkB;AACzB,cAAI,GAAG,IAAI,UAAU,UAAU;AAC7B,eAAG,IAAI,QAAQ;AACf,eAAG,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UAClD;AAAA,QACF,CAAC;AACD,cAAM,OAAO,OAAO,UAAU,IAAI,IAAI,CAAC,OAAO;AAC5C,aAAG,IAAI,QAAQ;AACf,aAAG,IAAI,SAAS,EAAE,aAAa,OAAO,IAAI,GAAG;AAC7C,aAAG,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,QAClD,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,aAAa,OAAO,UAAU,IAAI;AAAA,QAClC,QAAQ,MAAM,SAAS,MAAM,IAAI,OAAO,UAAU,IAAI,EAAE,GAAI,IAAI;AAAA,QAChE,QAAQ,OAAO;AAAA,MACjB;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAqC;AAClD,YAAM,UAAU,OAAO,YAAY;AACnC,YAAM,YAAY;AAClB,YAAM,IAAI,MAAM,SAAS,QACtB,SAAS,EACT,MAAM,OAAO,EAAE,UAAU,KAAK,aAAa,GAAG,aAAa,CAAC,EAAE,EAAE;AACnE,YAAM,UAAU,MAAM,SAAS,WAC3B,QAAQ,EACT,MAAM,OAAO,EAAE,SAAS,MAAM,OAAO,UAAmB,EAAE;AAC7D,YAAM,aAAa,MAAM,SAAS,MAAM,KAAK;AAC7C,YAAM,YAAY,WACf;AAAA,QACC,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,cAC5B,EAAE,IAAI,SAAS,iBACf,WAAW,EAAE,IAAI,KAAK;AAAA,MAC1B,EACC,KAAK,CAAC,GAAG,MAAM,EAAE,IAAI,UAAU,cAAc,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC;AACnE,YAAM,OAAO,WAAW;AAAA,QACtB,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,cAC5B,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK;AAAA,MACzD;AACA,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,UAAU,KAAK,EAAE,MAAM,EAAE,UAAU,MAAM,SAAS,WAAW,KAAK,CAAC;AAAA,QACnE,SAAS;AAAA,UACP,MAAM,SAAS,YAAY,YAAY;AAAA,UACvC,SAAS,SAAS,WAAW;AAAA,UAC7B,OAAO,SAAS,SAAS;AAAA,QAC3B;AAAA,QACA,YAAY;AAAA,UACV,UACE,SAAS,QAAQ,2BAA2B,cACxC,OACA;AAAA,UACN,cAAc,SAAS,QAAQ;AAAA,QACjC;AAAA,QACA,WAAW;AAAA,UACT,WACE,SAAS,UAAU,YACf,QACA,QAAQ,aAAa,KAAK,MAAM,QAAQ,SAAS,IAAI,IAAI,IACvD,OACA;AAAA,UACR,cAAc,QAAQ,YAClB,IAAI,IAAI,KAAK,MAAM,QAAQ,SAAU,IACnC,UACA,UACF;AAAA,UACJ,YAAY,YACR,UAAU,IAAI,UAAU,cACtB,WACA,WACF;AAAA,UACJ,WAAW,WAAW,IAAI,cAAc,QAAQ;AAAA,QAClD;AAAA,QACA,cAAc,aAAa;AAAA,QAC3B,iBAAiB,MAAM,IAAI,MAAM;AAAA,MACnC;AAAA,IACF;AAAA,IACA,aAAa,OAAO,UAAiB;AACnC,YAAM,UAAU,OAAO,kBAAkB;AACzC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,QAAQ,MAAM,SAAS,QAAQ,SAAS,GAAG;AAAA,QAC3C,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAiB;AAC9B,YAAM,UAAU,OAAO,YAAY;AACnC,YAAM,YAAY;AAClB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,OAAO,CAAC,QAAQ,aAAa,KAAK,MAAM,QAAQ,SAAS,IAAI,IAAI;AAAA,MACnE;AAAA,IACF;AAAA,IACA,UAAU,OAAO,UAA+C;AAC9D,YAAM,UAAU,OAAO,eAAe;AACtC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,OAAQ,MAAM,SAAS,UAAU,KAAK,KAAM,CAAC;AAAA,QAC7C,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA,YAAY,OACV,OACA,UAA+C,CAAC,MACb;AACnC,YAAM,UAAU,OAAO,iBAAiB;AACxC,YAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ;AACnD,cAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAC1D,UAAI,QAAQ;AACZ,UAAI,UAAU,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAC1C,UAAI,QAAQ,QAAQ;AAClB,YAAI;AACF,gBAAM,SAAS,KAAK;AAAA,YAClB,OAAO,KAAK,QAAQ,QAAQ,WAAW,EAAE,SAAS;AAAA,UACpD;AACA,cACE,OAAO,UAAU,MAAM,MACvB,OAAO,aAAa,OAAO;AAE3B,kBAAM,IAAI,MAAM;AAClB,kBAAQ,OAAO;AACf,oBAAU,OAAO;AAAA,QACnB,QAAQ;AACN,gBAAM,IAAI,SAAS,iBAAiB,qBAAqB;AAAA,QAC3D;AAAA,MACF;AACA,YAAM,SAAS,MAAM,SAAS,MAAM,KAAK,GACtC;AAAA,QACC,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,eAC3B,MAAM,SAAS,EAAE,MAAM,OAAO,MAAM,OACrC,EAAE,IAAI,aAAa;AAAA,MACvB,EACC,IAAI,CAAC,MAAM,EAAE,GAAG,EAChB;AAAA,QAAK,CAAC,GAAG,MACR,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,GAAG,cAAc,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,EAAE;AAAA,MACjE,EACC,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,KAAK,KAAK;AAC3D,YAAM,OAAO,MAAM,MAAM,GAAG,KAAK;AACjC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,QACP,YACE,MAAM,SAAS,QACX,OAAO;AAAA,UACL,KAAK,UAAU;AAAA,YACb,OAAO,MAAM;AAAA,YACb,UAAU,OAAO;AAAA,YACjB;AAAA,YACA,OAAO,GAAG,KAAK,GAAG,EAAE,EAAG,SAAS,IAAI,KAAK,GAAG,EAAE,EAAG,EAAE;AAAA,UACrD,CAAC;AAAA,QACH,EAAE,SAAS,WAAW,IACtB;AAAA,MACR;AAAA,IACF;AAAA,IACA,WAAW,OAAO,IAAY,WAAkB,MAAM,IAAI,IAAI,KAAK,GAAG;AAAA,IACtE;AAAA,IACA,QAAQ,OACN,OACA,UACG;AACH,YAAM,UAAU,OAAO,cAAc;AACrC,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,UAAU,MAAM,SAAS,QAAQ;AAAA,UAC/B;AAAA,UACA,MAAM;AAAA,UACN,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA,kBAAkB,OAAO,OAA+C;AACtE,YAAM,UAAQ,MAAM,SAAS,MAAM,IAAI,EAAE;AACzC,UAAG,SAAS,IAAI,UAAQ,YAAU,QAAQ,QAAQ,SAAO,oBAAmB;AAC1E,YAAG;AAAC,gBAAM,UAAU,QAAQ,OAAM,kBAAkB;AAAE,gBAAM,SAAO,MAAM,IAAI,QAAQ,QAAQ,QAAQ,aAAY,QAAQ,KAAK;AAAE,gBAAM,OAAO,OAAO,IAAI,IAAG,OAAG;AAAC,cAAE,IAAI,kBAAgB;AAAK,gBAAG,EAAE,IAAI,UAAQ,UAAS;AAAC,gBAAE,IAAI,QAAM;AAAY,gBAAE,IAAI,aAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,YAAE;AAAA,UAAC,CAAC;AAAE,gBAAM,OAAO,IAAG,OAAG;AAAC,cAAE,IAAI,QAAM;AAAY,cAAE,IAAI,SAAO,EAAC,aAAY,OAAO,IAAI,GAAE;AAAE,cAAE,IAAI,aAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UAAE,CAAC;AAAA,QAAE,SAAO,GAAE;AAAC,gBAAM,OAAO,IAAG,OAAG;AAAC,cAAE,IAAI,QAAM;AAAS,cAAE,IAAI,QAAM,UAAU,GAAE,EAAE;AAAE,cAAE,IAAI,aAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UAAE,CAAC;AAAA,QAAE;AAAC,gBAAO,MAAM,SAAS,MAAM,IAAI,EAAE,GAAI;AAAA,MACjlB;AACA,aAAO,SAAS,MAAM,OAAO,YAAY;AACvC,YAAI,KAAK,MAAM,SAAS,MAAM,IAAI,EAAE;AACpC,YACE,CAAC,MACD,GAAG,IAAI,eAAe,OAAO,cAC7B,GAAG,IAAI,UAAU;AAEjB;AACF,cAAM,WAAW,MAAM,SAAS,MAAM,KAAK,GAAG;AAAA,UAC5C,CAAC,MACC,EAAE,IAAI,eAAe,OAAO,cAC5B,EAAE,IAAI,UAAU;AAAA,QACpB;AACA,YAAI;AACF,gBAAM,IAAI,SAAS,qBAAqB,4BAA4B;AACtE,YAAI;AACF,gBAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,IAAI;AAAA,QAC3C,SAAS,GAAG;AACV,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QAAQ;AACd,cAAE,IAAI,QAAQ,UAAU,GAAG,EAAE;AAC7B,cAAE,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UACjD,CAAC;AACD,kBAAQ,MAAM,SAAS,MAAM,IAAI,EAAE,GAAI;AAAA,QACzC;AACA,cAAM,aAAa,IAAI,gBAAgB;AACvC,YAAI,iBAAiB;AACrB,aAAK,MAAM,OAAO,IAAI,CAAC,MAAM;AAC3B,YAAE,IAAI,QAAQ;AACd,YAAE,IAAI,YAAY,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAC9C,YAAE,QAAQ,GAAG,SAAS,CAAC,IAAI,QAAQ,GAAG;AACtC,YAAE,aAAa,IAAI,KAAK,IAAI,IAAI,GAAM,EAAE,YAAY;AAAA,QACtD,CAAC;AACD,cAAM,YAAY,YAAY,MAAM;AAClC,eAAK,OAAO,IAAI,CAAC,MAAM;AACrB,cAAE,aAAa,IAAI,KAAK,IAAI,IAAI,GAAM,EAAE,YAAY;AACpD,gBAAI,EAAE,IAAI,mBAAmB,CAAC,SAAU,YAAW,MAAM;AAAA,UAC3D,CAAC,EAAE,MAAM,MAAM;AACb,6BAAiB;AACjB,uBAAW,MAAM;AAAA,UACnB,CAAC;AAAA,QACH,GAAG,GAAM;AACT,YAAI,UAAU,OACZ,WAAW;AACb,cAAM,QAAQ,OAAO,GAAU,UAAoC;AACjE,cAAI,MAAM,SAAU,YAAW;AAC/B,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QAAQ;AACd,gBAAI,MAAO,GAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM;AAAA,UAC5D,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,YAAY;AACxB,cAAI;AACF,kBAAM,IAAI,SAAS,qBAAqB,sBAAsB;AAChE,gBAAM,UAAU,MAAM,SAAS,MAAM,IAAI,EAAE;AAC3C,cAAI,SAAS,IAAI,mBAAmB,CAAC;AACnC,kBAAM,IAAI,SAAS,aAAa,qBAAqB;AACvD,gBAAM,UAAU,GAAI,OAAO,GAAI,QAAQ,IAAI;AAAA,QAC7C;AACA,cAAM,MAAsB,EAAE,OAAO,MAAM;AAC3C,YAAI,cAA6B;AACjC,YAAI;AACF,8BAAoB;AACpB,gBAAM,MAAM;AACZ,gBAAM,UAAU,GAAG;AACnB,gBAAM,aAAa;AAAA,YACjB;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,EAAE,SAAS,QAAQ,IAAI;AACvB,cAAI,YAAY;AACd,kBAAM,MAAM,OAAO;AACnB,kBAAM,SAAS,YAAa;AAAA,cAC1B;AAAA,cACA,OAAO,kBAAkB;AAAA,YAC3B;AACA,sBAAU;AACV,kBAAM,MAAM;AAAA,UACd;AACA,cACE,CAAC,oBAAoB,kBAAkB,kBAAkB,EAAE;AAAA,YACzD,GAAG,QAAQ;AAAA,UACb,GACA;AACA,kBAAM,OAAO,MAAM,SAAS,QAAQ,SAAS;AAC7C,kBAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;AAClD,gBACE,KAAK,EAAE,MAAM,KAAK,UAAU,MAAM,SAAS,WAAW,KAAK,CAAC,MAC5D,GAAG,QAAQ;AAEX,oBAAM,IAAI;AAAA,gBACR;AAAA,gBACA;AAAA,cACF;AAAA,UACJ;AACA,cAAI,SAAkC,CAAC;AACvC,kBAAQ,QAAQ,MAAM;AAAA,YACpB,KAAK,gBAAgB;AACnB,oBAAM,YAAY,MAAM,SAAS,QAAQ;AAAA,gBACvC,QAAQ,QAAQ;AAAA,gBAChB,GAAG,MAAM;AAAA,gBACT,OAAO;AAAA,cACT;AACA,oBAAM,MAAM,SAAS;AACrB,oBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,kBAAE,IAAI,WAAW;AAAA,kBACf,WAAW,UAAU,YAAY,SAAS,UAAU;AAAA,kBACpD,OAAO,UAAU,YAAY,SAAS,UAAU;AAAA,gBAClD;AAAA,cACF,CAAC;AACD,uBAAS;AAAA,gBACP,aAAa,UAAU;AAAA,gBACvB,UAAU,UAAU,YAAY;AAAA,gBAChC,SAAS,UAAU;AAAA,cACrB;AACA;AAAA,YACF;AAAA,YACA,KAAK,gBAAgB;AACnB,4BAAc,QAAQ,QAAQ;AAC9B,oBAAM,IAAI,MAAM,SAAS,QAAQ;AAAA,gBAC/B;AAAA,gBACA,GAAG,MAAM;AAAA,gBACT,OAAO;AAAA,gBACP,GAAG,MAAM;AAAA,cACX;AACA,oBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,kBAAE,IAAI,SAAS,QAAQ,EAAE,YAAY;AAAA,cACvC,CAAC;AACD,kBACE,CAAC,EAAE,WACH,EAAE,QAAQ,YAAY,IAAI,KAC1B,EAAE,QAAQ,aAAa,QAAQ,QAAQ,mBACvC,QAAQ,qBAAqB,EAAE,QAAQ,YACvC,EAAE,QAAQ,SAAS,QAAQ,QAAQ,QACnC,KAAK,EAAE,QAAQ,YAAY,MACzB,KAAK,QAAQ,QAAQ,YAAY;AAEnC,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,uBAAS,MAAM,SAAS,QAAQ;AAAA,gBAC9B;AAAA,kBACE,aAAa,EAAE;AAAA,kBACf,GAAG,QAAQ;AAAA,kBACX,kBAAkB,QAAQ;AAAA,gBAC5B;AAAA,gBACA;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF;AAAA,YACA,KAAK;AACH,4BAAc,QAAQ,QAAQ;AAC9B,oBAAM,SAAS,QAAQ;AAAA,gBACrB;AAAA,gBACA,GAAG,MAAM;AAAA,gBACT,OAAO;AAAA,gBACP,GAAG,MAAM;AAAA,cACX;AACA,uBAAS,EAAE,WAAW,KAAK;AAC3B;AAAA,YACF,KAAK;AACH,oBAAM,aAAa,MAAM,SAAS,QAAQ,SAAS;AACnD,oBAAM,gBAAgB,MAAM,SAAS,WAAW,QAAQ;AACxD,kBACE,KAAK;AAAA,gBACH,MAAM,WAAW;AAAA,gBACjB,MAAM,eAAe,WAAW;AAAA,cAClC,CAAC,MAAM,QAAQ;AAEf,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,uBAAS,MAAM,SAAS,QAAQ;AAAA,gBAC9B,QAAQ,QAAQ;AAAA,gBAChB,WAAW;AAAA,gBACX;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF,KAAK,mBAAmB;AACtB,oBAAM,SAAS,MAAM,SAAS,QAAS;AACvC,kBAAI,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG;AAC/C,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,wBAAU;AAAA,gBACR,YAAY;AAAA,gBACZ,YAAY,OAAO;AAAA,gBACnB;AAAA,gBACA,WAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,gBACvC,WAAW,IAAI;AAAA,kBACb,IAAI,KAAK,OAAO,cAAc;AAAA,gBAChC,EAAE,YAAY;AAAA,gBACd,OAAO;AAAA,gBACP,UAAU,KAAK,MAAM;AAAA,cACvB;AACA,uBAAS,EAAE,OAAO,OAAO,OAAO;AAChC,oBAAM,YAAY;AAClB;AAAA,YACF;AAAA,YACA,KAAK;AACH,oBAAM,YAAY;AAClB,kBACE,CAAC,OAAO,WAAW,iBAAiB;AAAA,gBAClC,QAAQ,QAAQ;AAAA,cAClB;AAEA,sBAAM,IAAI;AAAA,kBACR;AAAA,kBACA;AAAA,gBACF;AACF,kBAAI,CAAC,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ,QAAQ,OAAO;AAC9D,sBAAM,IAAI,SAAS,iBAAiB,yBAAyB;AAC/D,uBAAS,MAAM,SAAS;AAAA,gBACtB,QAAQ;AAAA,gBACR,WAAW;AAAA,cACb;AACA,2BAAa;AACb;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU,SAAS;AAC3C;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,gBAChB;AAAA,cACF;AACA;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,gBAChB;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,cAClB;AACA;AAAA,YACF,KAAK;AACH,uBAAS,MAAM,SAAS,SAAU;AAAA,gBAChC,QAAQ,QAAQ;AAAA,gBAChB;AAAA,cACF;AACA,wBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,oBAAM,YAAY;AAClB;AAAA,YACF,KAAK;AACH;AAAA,UACJ;AACA,gBAAM,MAAM,QAAQ;AACpB,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QAAQ;AACd,cAAE,IAAI,SAAS,WAAW;AAAA,cACxB,GAAG;AAAA,cACH,GAAI,oBAAoB,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAAA,YACzD,CAAC;AACD,cAAE,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,UACjD,CAAC;AAAA,QACH,SAAS,GAAG;AACV,gBAAM,QAAQ,UAAU,GAAG,EAAE;AAC7B,cAAI,GAAG,QAAQ,SAAS,cAAe,cAAa;AACpD,cAAI,GAAG,QAAQ,SAAS,mBAAmB;AACzC,sBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,kBAAM,YAAY;AAAA,UACpB;AACA,gBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,cAAE,IAAI,QACJ,MAAM,SAAS,uBACf,MAAM,SAAS,oBACX,sBACA,MAAM,SAAS,kBACb,sBACA,MAAM,SAAS,cACb,cACA;AACV,cAAE,IAAI,QAAQ;AACd,cAAE,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAC/C,gBAAI,EAAE,IAAI,UAAU;AAClB,gBAAE,IAAI,sBAAsB;AAAA,UAChC,CAAC;AAAA,QACH,UAAE;AACA,wBAAc,SAAS;AACvB,gBAAM,QAAS,MAAM,SAAS,MAAM,IAAI,EAAE;AAC1C,cAAI,eAAe,MAAM,IAAI,UAAU,qBAAqB;AAC1D,kBAAM,SAAS,QAAQ,OAAO,WAAW,EAAE,MAAM,YAAY;AAC3D,oBAAM,OAAO,IAAI,CAAC,MAAM;AACtB,kBAAE,IAAI,SAAS,EAAE,GAAG,EAAE,IAAI,QAAQ,gBAAgB,KAAK;AAAA,cACzD,CAAC;AAAA,YACH,CAAC;AAAA,UACH;AACA,cAAI,WAAW,MAAM,IAAI,UAAU;AACjC,kBAAM,SAAS,YAAa,MAAM,EAAE;AACtC,gBAAM,SACH,UAAU;AAAA,YACT,aAAa;AAAA,YACb,MAAM,GAAG,QAAQ;AAAA,YACjB,OAAO,MAAM,IAAI;AAAA,UACnB,CAAC,EACA,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QACnB;AACA,gBAAQ,MAAM,SAAS,MAAM,IAAI,EAAE,GAAI;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,YACjB,SAAS,MAAM,OAAO,YAAY;AAChC,iBAAW,KAAK,MAAM,SAAS,MAAM,KAAK,GAAG;AAC3C,YACE,EAAE,IAAI,eAAe,OAAO,cAC5B,CAAC,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK;AAEtD;AACF,cAAM,WAAW,EAAE,IAAI,KAAK,WAAW,UAAU,IAC3C,MAAM,SAAS,UAAU,QAAQ,EAAE,YAAY,KAAM,YACvD,MAAM,SAAS,QAAQ,QAAQ,EAAE,YAAY;AACjD,cAAM,SACJ,aAAa,aAAa,MAAM,SAAS,QAAQ,SAAS,IAAI;AAChE,cAAM,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO;AAC7B,aAAG,IAAI,QACL,aAAa,aACT,cACA,aAAa,gBACX,WACA;AACR,aAAG,IAAI,sBAAsB;AAC7B,aAAG,IAAI,aAAa,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAChD,cAAI,aAAa,YAAY;AAC3B,eAAG,IAAI,QAAQ;AACf,eAAG,IAAI,SAAS;AAAA,cACd,WAAW;AAAA,cACX,UAAU,QAAQ,YAAY;AAAA,YAChC;AAAA,UACF;AACA,cAAI,aAAa;AACf,eAAG,IAAI,QAAQ;AAAA,cACb,IAAI;AAAA,gBACF;AAAA,gBACA;AAAA,cACF;AAAA,cACA,EAAE,IAAI;AAAA,YACR;AAAA,QACJ,CAAC;AACD,YAAI,aAAa;AACf,gBAAM,SAAS,aAAa,MAAM,EAAE,IAAI,EAAE;AAC5C,YAAI,aAAa,aAAa,iBAAiB,EAAE,QAAQ;AACvD,gBAAM,SAAS,QACZ,OAAO,EAAE,QAAQ,QAAQ,WAAW,EACpC,MAAM,MAAM;AAAA,UAAC,CAAC;AACnB,YAAI,aAAa,YAAY;AAC3B,oBAAU,EAAE,GAAG,SAAS,OAAO,MAAM,WAAW,KAAK;AACrD,gBAAM,YAAY;AAAA,QACpB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACH,aAAa,YAAY;AACvB,YAAM,eAAe,oBAAI,IAAY;AACrC,iBAAW,KAAK,MAAM,SAAS,MAAM,KAAK,GAAG;AAC3C,YACE,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK,KACrD,iBAAiB,EAAE,QAAQ;AAE3B,uBAAa,IAAI,EAAE,QAAQ,QAAQ,WAAW;AAChD,YACE,CAAC,WAAW,mBAAmB,EAAE,SAAS,EAAE,IAAI,KAAK,KACrD,cAAc,EAAE,QAAQ;AAExB,uBAAa,IAAI,EAAE,QAAQ,QAAQ,QAAQ;AAAA,MAC/C;AACA,YAAM,SAAS,QAAQ,KAAK,YAAY;AACxC,YAAM,SAAS,MAAM,KAAK,IAAI,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,mBAAmB,CAAC,SAAqB,OACpD,QAAQ,iBAAiB,EAAE;AACtB,IAAM,oBAAoB,CAAC,YAChC,QAAQ,kBAAkB;AACrB,IAAM,cAAc,CAAC,YAAwB,QAAQ,YAAY;;;ACp1BxE,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAC1B;AAAA,EACE,SAAAE;AAAA,EACA,YAAAC;AAAA,EACA,aAAAC;AAAA,EACA,UAAAC;AAAA,EACA,WAAAC;AAAA,EACA,YAAAC;AAAA,EACA,WAAAC;AAAA,EACA,MAAAC;AAAA,OACK;AACP,SAAS,QAAAC,OAAM,WAAAC,UAAS,WAAAC,gBAAe;AACvC,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,kBAAkB;AAW3B,IAAM,OAAO,UAAU,QAAQ;AACxB,SAAS,4BAA4B,SAIvB;AACnB,MAAI,QAAQ,aAAa;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACF,QAAM,SAAS,OAAO,WAAyC;AAC7D,UAAM,OAAO,MAAMC,OAAM,QAAQ,UAAU;AAC3C,QACE,CAAC,KAAK,OAAO,KACb,KAAK,eAAe,KACpB,KAAK,QAAQ,KACb,KAAK,OAAO;AAEZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,aACM,OAAOC,SAAQC,SAAQ,QAAQ,UAAU,CAAC,KAE9C,OAAOD,SAAQ,IAAI,GACnB;AACA,YAAM,SAAS,MAAMD,OAAM,IAAI;AAC/B,UACE,CAAC,OAAO,YAAY,KACpB,OAAO,eAAe,KACtB,OAAO,QAAQ,KACf,OAAO,OAAO;AAEd,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,SAAS,IAAK;AAAA,IACpB;AACA,QAAI;AACF,cACE,MAAM,KAAK,iBAAiB,CAAC,MAAM,QAAQ,YAAY,MAAM,GAAG;AAAA,QAC9D,SAAS,QAAQ,aAAa;AAAA,QAC9B,WAAW;AAAA,QACX,KAAK,EAAE,MAAM,gCAAgC;AAAA,MAC/C,CAAC,GACD,OAAO,KAAK;AAAA,IAChB,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,YAAY;AAChB,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,IACA,OAAO,YAAY;AACjB,YAAM,OAAO,OAAO;AAAA,IACtB;AAAA,IACA,SAAS,aAAa;AAAA,MACpB,SAAS,MAAM,QAAQ,QAAQ;AAAA,MAC/B,OAAQ,MAAM,OAAO,SAAS,MAAO,WAAW,YAAY;AAAA,IAC9D;AAAA,EACF;AACF;AAaA,IAAM,iBAAiB;AACvB,SAAS,UAAU,OAAe,MAAsB;AACtD,QAAM,MAAM,WAAW,OAAO,EAAE,iBAAiB,MAAM,OAAO,KAAK,CAAC;AACpE,MAAI,KAAK,GACP,SAAwB,MACxB,QAAQ;AACV,SAAO,KAAK,OAAO,IAAI,QAAQ;AAC7B,UAAM,SAAS,IAAI,SAAS,IAAI,KAAK,GAAG;AACxC,QAAI,OAAO,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG;AAClC,QAAI,EAAE,QAAQ;AACZ,YAAM,IAAI,SAAS,kBAAkB,6BAA6B;AACpE,UAAM,OAAO,OAAO,SAAS,GAAG,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AACnE,UAAM,SAAS,OAAO,SAAS,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AACvE,UAAM,OAAO,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK;AAC5C,QACE,KAAK,SAAS,IAAI,KAClB,KAAK,WAAW,GAAG,KACnB,KAAK,MAAM,GAAG,EAAE,SAAS,IAAI;AAE7B,YAAM,IAAI,SAAS,kBAAkB,6BAA6B;AACpE,UAAM,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC;AAC5C,QAAI,CAAC,CAAC,KAAK,MAAM,GAAG,EAAE,SAAS,IAAI;AACjC,YAAM,IAAI,SAAS,kBAAkB,mCAAmC;AAC1E,UAAM,OAAO;AAAA,MACX,OAAO,SAAS,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AAAA,MACxD;AAAA,IACF;AACA,QAAI,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,KAAK,MAAM,OAAO,IAAI;AAC9D,YAAM,IAAI,SAAS,kBAAkB,mBAAmB;AAC1D,UAAM,WAAW;AAAA,MACf,OAAO,SAAS,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE;AAAA,MACxD;AAAA,IACF;AACA,QAAI,WAAW;AACf,aAAS,IAAI,GAAG,IAAI,KAAK;AACvB,kBAAY,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC;AACjD,QAAI,aAAa;AACf,YAAM,IAAI,SAAS,kBAAkB,0BAA0B;AACjE,QAAI,SAAS,QAAQ,SAAS,KAAK,IAAI,IAAI;AACzC,UAAI,OAAQ,OAAM,IAAI,SAAS,kBAAkB,kBAAkB;AACnE,eAAS,OAAO,KAAK,IAAI,SAAS,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC;AAAA,IAC9D;AACA,UAAM,MAAM,KAAK,KAAK,OAAO,GAAG,IAAI;AAAA,EACtC;AACA,MAAI,CAAC,OAAQ,OAAM,IAAI,SAAS,kBAAkB,yBAAyB;AAC3E,SAAO;AACT;AACO,SAAS,4BAA4B,SAQzB;AACjB,QAAM,OAAOE,SAAQ,QAAQ,IAAI,GAC/B,SAASA,SAAQ,QAAQ,UAAU;AACrC,MAAI,CAAC,OAAO,WAAW,GAAG,IAAI,GAAG;AAC/B,UAAM,IAAI,SAAS,iBAAiB,sCAAsC;AAC5E,MAAI,WAA8B,CAAC;AACnC,QAAM,UAAU,YAAY;AAC1B,UAAM,QAAQA,SAAQD,SAAQ,MAAM,GAAG,MAAME,UAAS,MAAM,CAAC;AAC7D,QAAI,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG;AAC9B,YAAM,IAAI,SAAS,qBAAqB,8BAA8B;AACxE,WAAO;AAAA,EACT;AACA,QAAM,aAAa,CAAC,OAAe;AACjC,QAAI,CAAC,eAAe,KAAK,EAAE;AACzB,YAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAC1D,WAAO,SAAS,MAAM,EAAE;AAAA,EAC1B;AACA,QAAM,WAAW,YAAoC;AACnD,QAAI;AACF,aAAO,KAAK;AAAA,QACV,MAAMC,UAASC,MAAK,MAAM,wBAAwB,GAAG,MAAM;AAAA,MAC7D,EAAE;AAAA,IACJ,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,WAAW,OAAO,IAAY,QAAwB;AAC1D,UAAM,OAAO,WAAW,EAAE;AAC1B,UAAM,OAAO,MAAML,OAAMK,MAAK,MAAM,eAAe,CAAC;AACpD,QAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe;AACxC,YAAM,IAAI,SAAS,iBAAiB,oBAAoB;AAC1D,UAAM,WAAW,MAAM,QAAQ;AAC/B,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,QAAQ,KAAK;AAC3B,QAAI,WAAW;AACf,QAAI;AACF,YAAM,IAAI,MAAM,WAAW;AAAA,QACzB,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf,CAAC;AACD,YAAM,MAAMA,MAAKJ,SAAQ,MAAM,GAAG,YAAY,MAAM,CAAC,EAAE;AACvD,YAAMK,SAAQ,MAAM,GAAG;AACvB,YAAM,IAAI,MAAM,UAAU;AAAA,QACxB,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf,CAAC;AACD,YAAMC,QAAO,KAAK,MAAM;AACxB,iBAAW;AACX,YAAM,QAAQ,QAAQ,MAAM;AAC5B,YAAM,IAAI,MAAM,QAAQ;AACxB,YAAM,QAAQ,OAAO;AACrB,YAAM,WAAWF,MAAK,MAAM,wBAAwB,GAAG;AAAA,QACrD;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,EAAE,iBAAiB,GAAG;AAAA,IAC/B,SAAS,OAAO;AACd,UACE,YACA,iBAAiB,YACjB,MAAM,SAAS,uBACf;AACA,cAAM,WAAWA,MAAK,MAAM,wBAAwB,GAAG;AAAA,UACrD;AAAA,UACA,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,EAAE,iBAAiB,IAAI,cAAc,gBAAgB;AAAA,MAC9D;AACA,UAAI,UAAU;AACZ,YAAI;AACF,gBAAM,QAAQ,QAAQ,KAAK;AAC3B,gBAAM,MAAMA,MAAKJ,SAAQ,MAAM,GAAG,YAAY,MAAM,CAAC,EAAE;AACvD,gBAAMK,SAAQ,UAAU,GAAG;AAC3B,gBAAMC,QAAO,KAAK,MAAM;AACxB,gBAAM,QAAQ,QAAQ,MAAM;AAC5B,gBAAM,QAAQ,OAAO;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI,SAAS,qBAAqB,yBAAyB;AAAA,QACnE;AAAA,MACF,MAAO,OAAM,QAAQ,QAAQ,MAAM;AACnC,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,YAAY;AAChB,YAAM,aAAa,IAAI;AACvB,YAAMC,UAAS,MAAM,QAAQ,EAAE,MAAM,MAAM,IAAI,GAC7C,OAAO,MAAM,SAAS;AACxB,YAAM,QAAsB,CAAC;AAC7B,iBAAW,MAAM,MAAMC,SAAQ,IAAI,GAAG;AACpC,YAAI,CAAC,eAAe,KAAK,EAAE,EAAG;AAC9B,cAAM,OAAO,MAAMT,OAAMK,MAAK,MAAM,EAAE,CAAC;AACvC,YAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,EAAG;AAClD,cAAM,KAAK;AAAA,UACT;AAAA,UACA,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQG,YAAWH,MAAK,MAAM,EAAE;AAAA,UAChC,eAAe,SAASA,MAAK,MAAM,EAAE;AAAA,UACrC,aAAa,KAAK,UAAU,YAAY;AAAA,QAC1C,CAAC;AAAA,MACH;AACA,iBAAW,KAAK;AACd,YAAI,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;AAClC,gBAAM,KAAK;AAAA,YACT,IAAI,EAAE;AAAA,YACN,SAAS,EAAE;AAAA,YACX,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,eAAe;AAAA,YACf,aAAa;AAAA,UACf,CAAC;AACL,aAAO;AAAA,IACT;AAAA,IACA,UAAU,YAAY;AACpB,YAAM,QAAQ,MAAM,QAAQ,OAAO,SAAS;AAC5C,iBAAW,KAAK,OAAO;AACrB,cAAM,MAAM,IAAI,IAAI,EAAE,GAAG;AACzB,YACE,CAAC,eAAe,KAAK,EAAE,EAAE,KACzB,CAAC,eAAe,KAAK,EAAE,OAAO,KAC9B,CAAC,oBAAoB,KAAK,EAAE,MAAM,KAClC,IAAI,aAAa,YACjB,CAAC,QAAQ,OAAO,aAAa,SAAS,IAAI,QAAQ,KAClD,IAAI,YACJ,IAAI;AAEJ,gBAAM,IAAI,SAAS,iBAAiB,6BAA6B;AAAA,MACrE;AACA,iBAAW;AACX,aAAO,EAAE,OAAO,SAAS,OAAO;AAAA,IAClC;AAAA,IACA,SAAS,OAAO,IAAI,QAAQ;AAC1B,UAAI,CAAC,SAAS,OAAQ,YAAW,MAAM,QAAQ,OAAO,SAAS;AAC/D,YAAM,IAAI,SAAS,KAAK,CAACK,OAAMA,GAAE,OAAO,EAAE;AAC1C,UAAI,CAAC;AACH,cAAM,IAAI,SAAS,iBAAiB,iCAAiC;AACvE,YAAM,QAAQ,WAAW,EAAE;AAC3B,UAAI;AACF,cAAMV,OAAM,KAAK;AACjB,eAAO,EAAE,oBAAoB,IAAI,QAAQ,KAAK;AAAA,MAChD,SAAS,GAAG;AACV,YAAK,EAA4B,SAAS,SAAU,OAAM;AAAA,MAC5D;AACA,YAAM,aAAa,IAAI;AACvB,YAAM,IAAI,MAAM;AAChB,YAAM,IAAI,MAAM,WAAW,EAAE,kBAAkB,GAAG,CAAC;AACnD,UAAI,cAAc,EAAE;AACpB,UAAI,WAA4B;AAChC,YAAM,UAAU,YAAY,QAAQ,GAAM;AAC1C,eAAS,YAAY,GAAG,aAAa,GAAG,aAAa;AACnD,cAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,YACE,IAAI,aAAa,YACjB,CAAC,QAAQ,OAAO,aAAa,SAAS,IAAI,QAAQ,KAClD,IAAI,YACJ,IAAI;AAEJ,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,mBAAW,OAAO,QAAQ,SAAS,OAAO,aAAa;AAAA,UACrD,UAAU;AAAA,UACV,QAAQ;AAAA,QACV,CAAC;AACD,YAAI,CAAC,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,EAAE,SAAS,SAAS,MAAM,EAAG;AAC1D,cAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,YAAI,CAAC,YAAY,cAAc;AAC7B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AACF,sBAAc,IAAI,IAAI,UAAU,WAAW,EAAE,SAAS;AAAA,MACxD;AACA,UAAI,CAAC;AACH,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,UAAI,CAAC,SAAS,MAAM,CAAC,SAAS;AAC5B,cAAM,IAAI,SAAS,0BAA0B,yBAAyB;AACxE,YAAM,SAAS,SAAS,KAAK,UAAU,GACrC,SAAmB,CAAC;AACtB,UAAI,OAAO;AACX,iBAAS;AACP,cAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,YAAI,MAAM,KAAM;AAChB,gBAAQ,MAAM,MAAM;AACpB,YAAI,QAAQ,QAAQ,oBAAoB,KAAK,OAAO,OAAO;AACzD,gBAAM,OAAO,OAAO;AACpB,gBAAM,IAAI,SAAS,gBAAgB,uBAAuB;AAAA,QAC5D;AACA,eAAO,KAAK,OAAO,KAAK,MAAM,KAAK,CAAC;AAAA,MACtC;AACA,YAAM,QAAQ,OAAO,OAAO,MAAM;AAClC,UACEW,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,MAC/C,EAAE,OAAO,YAAY;AAErB,cAAM,IAAI,SAAS,iBAAiB,2BAA2B;AACjE,YAAM,SACJ,EAAE,UAAU,WACR,UAAU,OAAO,EAAE,cAAc,eAAe,IAChD;AACN,YAAM,YAAYN,MAAK,MAAM,cAAc,MAAM,CAAC,EAAE;AACpD,YAAM,aAAa,SAAS;AAC5B,UAAI;AACF,cAAM,aAAaA,MAAK,WAAW,eAAe;AAClD,cAAMO,WAAU,YAAY,QAAQ,EAAE,MAAM,KAAO,MAAM,KAAK,CAAC;AAC/D,YAAI;AACJ,YAAI;AACF,qBACE,MAAM,KAAK,YAAY,CAAC,IAAI,GAAG;AAAA,YAC7B,KAAK;AAAA,YACL,SAAS;AAAA,YACT,WAAW;AAAA,YACX,KAAK,EAAE,MAAM,iBAAiB,MAAM,UAAU;AAAA,UAChD,CAAC,GACD;AAAA,QACJ,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,QAAQ,SAAS,EAAE,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAC/C,gBAAM,IAAI,SAAS,gBAAgB,4BAA4B;AACjE,cAAM,WAAWP,MAAK,WAAW,eAAe,GAAG;AAAA,UACjD,WAAW;AAAA,UACX,QAAQ,EAAE;AAAA,QACZ,CAAC;AACD,cAAM,IAAI,MAAM;AAChB,cAAME,QAAO,WAAW,KAAK;AAC7B,eAAO,EAAE,oBAAoB,GAAG;AAAA,MAClC,UAAE;AACA,cAAMM,IAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACtD;AAAA,IACF;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,OAAO;AACpB,YAAM,SAAS,WAAW,EAAE;AAC5B,UAAI,WAAY,MAAM,QAAQ,KAAM,WAAY,MAAM,SAAS;AAC7D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,YAAMA,IAAG,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACjD,aAAO,EAAE,kBAAkB,GAAG;AAAA,IAChC;AAAA,IACA,UAAU,OAAO,IAAI,QAAQ;AAC3B,UAAI,WAAW,EAAE,MAAO,MAAM,SAAS;AACrC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACF,aAAO,SAAS,IAAI,GAAG;AAAA,IACzB;AAAA,IACA,SAAS,OAAO,UAAU;AACxB,UACE,OAAO,MAAM,oBAAoB,YACjC,OAAO,MAAM,gBAAgB;AAE7B,eAAO;AACT,UAAI;AACF,cAAM,UAAU,MAAM,QAAQ;AAC9B,YAAI,YAAY,MAAM,mBAAmB,YAAY,MAAM;AACzD,iBAAO;AACT,cAAM,QAAQ,QAAQ,MAAM;AAC5B,cAAM,QAAQ,OAAO;AACrB,eAAO,YAAY,MAAM,cAAc,aAAa;AAAA,MACtD,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;","names":["v","readFile","lstat","unlink","join","resolve","readFile","unlink","join","lstat","readFile","readdir","lstat","rename","open","join","resolve","dirname","resolve","lstat","dirname","readdir","join","readFile","open","rename","current","lstat","readFile","writeFile","rename","symlink","readlink","readdir","rm","join","resolve","dirname","createHash","lstat","dirname","resolve","readlink","readFile","join","symlink","rename","active","readdir","r","createHash","writeFile","rm"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/cpa-kit",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Embeddable CPA administration mechanisms",
   "type": "module",
   "license": "UNLICENSED",
@@ -38,6 +38,7 @@
   "files": [
     "dist",
     "README.md",
+    "CHANGELOG.md",
     "NOTICE"
   ],
   "dependencies": {