@ixo/editor 6.33.0 → 6.34.0

package/dist/chunk-IIIZZ4E4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/lib/actionRegistry/digest.ts","../src/core/lib/actionRegistry/topicSemanticRecords.ts","../src/core/lib/actionRegistry/canMapping.ts","../src/core/lib/actionRegistry/presentation.ts","../src/core/lib/actionRegistry/types.ts","../src/core/lib/actionRegistry/topicPolicy.ts","../src/core/lib/actionRegistry/registry.ts","../src/core/lib/flowEngine/dmNotificationState.ts","../src/core/lib/flowEngine/runs.ts"],"sourcesContent":["/**\n * Code-unit ordering, never `localeCompare`. `localeCompare` resolves against the\n * runtime's ICU data and ambient locale, so the same input can order differently\n * in a browser than in Node, or in Node built with small-icu than with full-icu.\n * Any digest built on that ordering stops being reproducible across the very\n * boundary it is meant to prove things across.\n */\nexport function compareCodeUnits(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\n/** Deterministic JSON used for portable Action contract and manifest digests. */\nexport function canonicalActionJson(value: unknown): string {\n  if (value === null) return 'null';\n  if (typeof value === 'string' || typeof value === 'boolean') return JSON.stringify(value);\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new Error('Action manifest cannot contain non-finite numbers');\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map((item) => (item === undefined ? 'null' : canonicalActionJson(item))).join(',')}]`;\n  if (typeof value === 'object') {\n    const fields = Object.entries(value as Record<string, unknown>)\n      .filter(([, item]) => item !== undefined)\n      .sort(([a], [b]) => compareCodeUnits(a, b));\n    return `{${fields.map(([key, item]) => `${JSON.stringify(key)}:${canonicalActionJson(item)}`).join(',')}}`;\n  }\n  throw new Error(`Action manifest cannot contain ${typeof value}`);\n}\n\nconst SHA256_K = new Uint32Array([\n  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe,\n  0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,\n  0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,\n  0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,\n]);\n\nfunction rotateRight(value: number, bits: number): number {\n  return (value >>> bits) | (value << (32 - bits));\n}\n\n/** Small dependency-free synchronous SHA-256 for browser-safe manifest generation. */\nexport function sha256Hex(text: string): string {\n  const input = new TextEncoder().encode(text);\n  const bitLength = input.length * 8;\n  const paddedLength = Math.ceil((input.length + 9) / 64) * 64;\n  const bytes = new Uint8Array(paddedLength);\n  bytes.set(input);\n  bytes[input.length] = 0x80;\n  const view = new DataView(bytes.buffer);\n  view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x100000000), false);\n  view.setUint32(paddedLength - 4, bitLength >>> 0, false);\n\n  const state = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);\n  const words = new Uint32Array(64);\n\n  for (let offset = 0; offset < bytes.length; offset += 64) {\n    for (let index = 0; index < 16; index += 1) words[index] = view.getUint32(offset + index * 4, false);\n    for (let index = 16; index < 64; index += 1) {\n      const s0 = rotateRight(words[index - 15], 7) ^ rotateRight(words[index - 15], 18) ^ (words[index - 15] >>> 3);\n      const s1 = rotateRight(words[index - 2], 17) ^ rotateRight(words[index - 2], 19) ^ (words[index - 2] >>> 10);\n      words[index] = (words[index - 16] + s0 + words[index - 7] + s1) >>> 0;\n    }\n\n    let a = state[0];\n    let b = state[1];\n    let c = state[2];\n    let d = state[3];\n    let e = state[4];\n    let f = state[5];\n    let g = state[6];\n    let h = state[7];\n    for (let index = 0; index < 64; index += 1) {\n      const sum1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);\n      const choice = (e & f) ^ (~e & g);\n      const temp1 = (h + sum1 + choice + SHA256_K[index] + words[index]) >>> 0;\n      const sum0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);\n      const majority = (a & b) ^ (a & c) ^ (b & c);\n      const temp2 = (sum0 + majority) >>> 0;\n      h = g;\n      g = f;\n      f = e;\n      e = (d + temp1) >>> 0;\n      d = c;\n      c = b;\n      b = a;\n      a = (temp1 + temp2) >>> 0;\n    }\n    state[0] = (state[0] + a) >>> 0;\n    state[1] = (state[1] + b) >>> 0;\n    state[2] = (state[2] + c) >>> 0;\n    state[3] = (state[3] + d) >>> 0;\n    state[4] = (state[4] + e) >>> 0;\n    state[5] = (state[5] + f) >>> 0;\n    state[6] = (state[6] + g) >>> 0;\n    state[7] = (state[7] + h) >>> 0;\n  }\n\n  return Array.from(state, (word) => word.toString(16).padStart(8, '0')).join('');\n}\n\nexport function sha256Digest(value: unknown): `sha256:${string}` {\n  return `sha256:${sha256Hex(canonicalActionJson(value))}`;\n}\n","import Ajv2020, { type ErrorObject, type ValidateFunction } from 'ajv/dist/2020.js';\n\nimport { canonicalActionJson, sha256Digest } from './digest';\nimport type { TopicActionMetadata, TopicActionRecord, TopicSemanticRecordDefinition } from './types';\n\nconst stringArray = { type: 'array', items: { type: 'string' } } as const;\nconst digest = { type: 'string', pattern: '^sha256:[a-f0-9]{64}$' } as const;\nconst dateTime = {\n  type: 'string',\n  pattern: '^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}:\\\\d{2}:\\\\d{2}(?:\\\\.\\\\d+)?(?:Z|[+-]\\\\d{2}:\\\\d{2})$',\n} as const;\n\n/** Keep the complete record batch comfortably below Matrix's event-size ceiling. */\nexport const MAX_TOPIC_SEMANTIC_RECORDS_PER_RECEIPT = 25;\nexport const MAX_TOPIC_SEMANTIC_RECORD_BATCH_BYTES = 32 * 1024;\n\nfunction closed(required: string[], properties: Record<string, object>): object {\n  return { type: 'object', required, additionalProperties: false, properties };\n}\n\nexport const TOPIC_SEMANTIC_RECORD_DEFINITIONS: readonly TopicSemanticRecordDefinition[] = [\n  {\n    type: 'org.ixo.topic.claim-submission',\n    version: 1,\n    displayName: 'Claim submitted',\n    description: 'Records that a claim was submitted to a collection.',\n    valueSchema: closed(['claimId', 'collectionId', 'deedDid', 'submittedByDid', 'submittedAt', 'transactionHash', 'submissionDigest'], {\n      claimId: { type: 'string' },\n      collectionId: { type: 'string' },\n      deedDid: { type: 'string' },\n      submittedByDid: { type: 'string' },\n      submittedAt: dateTime,\n      transactionHash: { type: 'string' },\n      submissionDigest: digest,\n    }),\n  },\n  {\n    type: 'org.ixo.topic.claim-evaluation',\n    version: 1,\n    displayName: 'Claim evaluated',\n    description: 'Records the governed evaluation outcome for a claim.',\n    valueSchema: closed(['claimId', 'collectionId', 'deedDid', 'decision', 'evaluatedByDid', 'evaluatedAt', 'transactionHash', 'evidenceDigest'], {\n      claimId: { type: 'string' },\n      collectionId: { type: 'string' },\n      deedDid: { type: 'string' },\n      decision: { type: 'string' },\n      evaluatedByDid: { type: 'string' },\n      evaluatedAt: dateTime,\n      verificationProof: { type: 'string' },\n      transactionHash: { type: 'string' },\n      evidenceDigest: digest,\n    }),\n  },\n  {\n    type: 'org.ixo.topic.proposal-receipt',\n    version: 1,\n    displayName: 'Governance proposal update',\n    description: 'Records the creation of, or a vote on, a governance proposal.',\n    valueSchema: closed(['event', 'proposalId', 'proposalContractAddress'], {\n      event: { type: 'string', enum: ['created', 'vote-cast'] },\n      actionType: { type: 'string' },\n      proposalId: { type: 'string' },\n      proposalContractAddress: { type: 'string' },\n      coreAddress: { type: 'string' },\n      title: { type: 'string' },\n      proposalTitle: { type: 'string' },\n      descriptionDigest: digest,\n      proposalDescriptionDigest: digest,\n      status: { type: 'string' },\n      vote: { type: 'string' },\n      rationaleDigest: digest,\n      actorDid: { type: 'string' },\n      votedAt: dateTime,\n      createdAt: dateTime,\n    }),\n  },\n  {\n    type: 'org.ixo.topic.work-event',\n    version: 1,\n    displayName: 'Work update',\n    description: 'Records an assignment, dispatch, checkpoint, submission, or acceptance of work.',\n    valueSchema: closed(['workId', 'resourceType', 'phase', 'assigneeDid', 'note', 'artifactReferences', 'evidenceReferences', 'actorDid', 'occurredAt'], {\n      workId: { type: 'string' },\n      resourceType: { type: 'string' },\n      phase: { type: 'string', enum: ['requested', 'dispatched', 'in_progress', 'ready_for_review', 'completed'] },\n      assigneeDid: { type: 'string' },\n      note: { type: 'string' },\n      artifactReferences: stringArray,\n      evidenceReferences: stringArray,\n      actorDid: { type: 'string' },\n      occurredAt: dateTime,\n    }),\n  },\n  {\n    type: 'org.ixo.topic.agent-result',\n    version: 1,\n    displayName: 'Agent result',\n    description: 'Records a delegated agent result and its evidence references without exposing invocation inputs.',\n    valueSchema: closed(['sessionId', 'result', 'resultDigest', 'evidenceReferences', 'evidenceDigest', 'providerReceiptReference'], {\n      sessionId: { type: 'string' },\n      result: { description: 'Provider-owned result extension point.' },\n      resultDigest: digest,\n      evidenceReferences: stringArray,\n      evidenceDigest: digest,\n      providerReceiptReference: { type: 'string' },\n    }),\n  },\n  {\n    type: 'org.ixo.topic.agent-cancellation',\n    version: 1,\n    displayName: 'Agent cancelled',\n    description: 'Records cancellation of a delegated agent session.',\n    valueSchema: closed(['sessionId', 'status', 'providerReceiptReference'], {\n      sessionId: { type: 'string' },\n      status: { const: 'cancelled' },\n      providerReceiptReference: { type: 'string' },\n    }),\n  },\n  {\n    type: 'org.ixo.topic.evidence',\n    version: 1,\n    displayName: 'Evidence collected',\n    description: 'Records collected evidence, provenance, and stable evidence references.',\n    valueSchema: closed(['question', 'evidence', 'provenance', 'evidenceReferences', 'evidenceDigest'], {\n      question: { type: 'string' },\n      evidence: { description: 'Provider-owned evidence extension point.' },\n      provenance: { description: 'Provider-owned provenance extension point.' },\n      evidenceReferences: stringArray,\n      evidenceDigest: digest,\n    }),\n  },\n  ...(['proposed', 'accepted'] as const).map(\n    (status): TopicSemanticRecordDefinition => ({\n      type: `org.ixo.topic.${status}-answer`,\n      version: 1,\n      displayName: status === 'accepted' ? 'Answer accepted' : 'Answer proposed',\n      description: status === 'accepted' ? 'Records an answer accepted by the stated authority.' : 'Records an answer proposed for review.',\n      valueSchema: closed(['answer', 'status', 'proposedAnswerRecordId', 'authorityDid', 'evidenceReferences', 'limitations', 'occurredAt'], {\n        answer: { type: 'string' },\n        status: { const: status },\n        proposedAnswerRecordId: { type: 'string' },\n        authorityDid: { type: 'string' },\n        evidenceReferences: stringArray,\n        limitations: { type: 'string' },\n        occurredAt: dateTime,\n      }),\n    })\n  ),\n  ...(['assertion', 'review'] as const).map(\n    (kind): TopicSemanticRecordDefinition => ({\n      type: `org.ixo.topic.evaluation-${kind}`,\n      version: 1,\n      displayName: kind === 'review' ? 'Evaluation reviewed' : 'Evaluation assertion',\n      description: kind === 'review' ? 'Records a signed human review of an evaluation assertion.' : 'Records a signed evaluation assertion.',\n      valueSchema: closed(\n        [kind === 'review' ? 'reviewId' : 'assertionId', 'providerResult', 'methodologyRevision', 'rubricRevision', 'evaluatorDid', 'evidenceReferences', 'signature'],\n        {\n          assertionId: { type: 'string' },\n          reviewId: { type: 'string' },\n          providerResult: { type: 'object', description: 'Provider-owned evaluation result extension point.', additionalProperties: true },\n          methodologyRevision: { type: 'string' },\n          rubricRevision: { type: 'string' },\n          evaluatorDid: { type: 'string' },\n          evidenceReferences: stringArray,\n          signature: { type: 'string' },\n        }\n      ),\n    })\n  ),\n  {\n    type: 'org.ixo.topic.settlement-record',\n    version: 1,\n    displayName: 'Settlement update',\n    description: 'Records the provider reference and terminal status of an approved settlement execution.',\n    valueSchema: closed(['settlementId', 'transactionReference', 'providerReceiptReference', 'status'], {\n      settlementId: { type: 'string' },\n      transactionReference: { type: 'string' },\n      providerReceiptReference: { type: 'string' },\n      status: { type: 'string', enum: ['submitted', 'confirmed', 'needs_verification'] },\n    }),\n  },\n  {\n    type: 'org.ixo.topic.incident-escalation',\n    version: 1,\n    displayName: 'Incident escalated',\n    description: 'Records that an incident was escalated to the stated recipients.',\n    valueSchema: closed(['severity', 'affectedResources', 'recipients', 'evidenceReferences', 'summary', 'escalationId', 'notifiedAt', 'providerReceiptReferences'], {\n      severity: { type: 'string', enum: ['low', 'medium', 'high', 'critical'] },\n      affectedResources: stringArray,\n      recipients: stringArray,\n      evidenceReferences: stringArray,\n      summary: { type: 'string' },\n      escalationId: { type: 'string' },\n      notifiedAt: dateTime,\n      providerReceiptReferences: stringArray,\n    }),\n  },\n  {\n    type: 'org.ixo.topic.incident-mitigation',\n    version: 1,\n    displayName: 'Incident mitigation recorded',\n    description: 'Records mitigation work for an incident without changing the incident lifecycle.',\n    valueSchema: closed(['mitigation', 'affectedResources', 'evidenceReferences', 'recordedBy', 'occurredAt'], {\n      mitigation: { type: 'string' },\n      affectedResources: stringArray,\n      evidenceReferences: stringArray,\n      recordedBy: { type: 'string' },\n      occurredAt: dateTime,\n    }),\n  },\n] as const;\n\nconst definitionsByType = new Map(TOPIC_SEMANTIC_RECORD_DEFINITIONS.map((definition) => [definition.type, definition]));\nconst ajv = new Ajv2020({ allErrors: true, strict: false });\nconst validators = new Map<string, ValidateFunction>();\n\nexport function getTopicSemanticRecordDefinition(type: string): TopicSemanticRecordDefinition | undefined {\n  return definitionsByType.get(type);\n}\n\nexport function getTopicSemanticRecordDefinitions(types: readonly string[]): TopicSemanticRecordDefinition[] {\n  return types.map((type) => definitionsByType.get(type)).filter((definition): definition is TopicSemanticRecordDefinition => !!definition);\n}\n\nexport type TopicSemanticRecordValidationResult = { valid: true; definition: TopicSemanticRecordDefinition } | { valid: false; code: string; errors?: ErrorObject[] };\nexport type TopicSemanticRecordBatchValidationResult = { valid: true } | { valid: false; code: string; errors?: ErrorObject[] };\n\n/** Validate the complete safe envelope and its declared value contract. */\nexport function validateTopicSemanticRecord(record: unknown, topic: TopicActionMetadata): TopicSemanticRecordValidationResult {\n  if (!record || typeof record !== 'object' || Array.isArray(record)) return { valid: false, code: 'INVALID_RECORD_ENVELOPE' };\n  const candidate = record as Partial<TopicActionRecord>;\n  const envelopeKeys = new Set(['type', 'id', 'version', 'value', 'evidenceReferences']);\n  if (\n    Object.keys(candidate).some((key) => !envelopeKeys.has(key)) ||\n    typeof candidate.type !== 'string' ||\n    typeof candidate.id !== 'string' ||\n    !candidate.id ||\n    !Number.isInteger(candidate.version) ||\n    Number(candidate.version) < 1 ||\n    !candidate.value ||\n    typeof candidate.value !== 'object' ||\n    Array.isArray(candidate.value)\n  ) {\n    return { valid: false, code: 'INVALID_RECORD_ENVELOPE' };\n  }\n  if (candidate.evidenceReferences !== undefined && (!Array.isArray(candidate.evidenceReferences) || candidate.evidenceReferences.some((item) => typeof item !== 'string'))) {\n    return { valid: false, code: 'INVALID_RECORD_ENVELOPE' };\n  }\n  const definition = topic.semanticRecordTypes.find((item) => item.type === candidate.type);\n  if (!definition) return { valid: false, code: 'UNKNOWN_RECORD_TYPE' };\n  if (candidate.version !== definition.version) return { valid: false, code: 'UNSUPPORTED_RECORD_VERSION' };\n  const validatorKey = `${definition.type}@${definition.version}:${sha256Digest(definition.valueSchema)}`;\n  let validate = validators.get(validatorKey);\n  if (!validate) {\n    validate = ajv.compile(definition.valueSchema);\n    validators.set(validatorKey, validate);\n  }\n  if (!validate(candidate.value)) return { valid: false, code: 'INVALID_RECORD_VALUE', errors: validate.errors || undefined };\n  return { valid: true, definition };\n}\n\n/** Validate every record and the bounded, JSON-portable batch written to Matrix. */\nexport function validateTopicSemanticRecordBatch(records: readonly unknown[], topic: TopicActionMetadata): TopicSemanticRecordBatchValidationResult {\n  if (records.length > MAX_TOPIC_SEMANTIC_RECORDS_PER_RECEIPT) return { valid: false, code: 'TOO_MANY_RECORDS' };\n  for (const record of records) {\n    const validation = validateTopicSemanticRecord(record, topic);\n    if (!validation.valid) return validation;\n  }\n  try {\n    const byteLength = new TextEncoder().encode(canonicalActionJson(records)).byteLength;\n    if (byteLength > MAX_TOPIC_SEMANTIC_RECORD_BATCH_BYTES) return { valid: false, code: 'RECORD_BATCH_TOO_LARGE' };\n  } catch {\n    return { valid: false, code: 'INVALID_RECORD_BATCH' };\n  }\n  return { valid: true };\n}\n","/**\n * Bidirectional mapping between UCAN `can` vocabulary and registry `type` strings.\n * Derived mechanically: strip \"qi/\", replace \".\" with \"/\".\n */\n\nconst CAN_TO_TYPE: Record<string, string> = {\n  'flow/run.start': 'qi/flow.run.start',\n  'flow/run.close': 'qi/flow.run.close',\n  'bid/submit': 'qi/bid.submit',\n  'bid/evaluate': 'qi/bid.evaluate',\n  'claim/submit': 'qi/claim.submit',\n  'claim/evaluate': 'qi/claim.evaluate',\n  'collection/lifecycle': 'qi/collection.lifecycle',\n  'collection/users': 'qi/collection.users',\n  'email/send': 'qi/email.send',\n  'notification/push': 'qi/notification.push',\n  'matrix/dm': 'qi/matrix.dm',\n  'proposal/create': 'qi/proposal.create',\n  'proposal/vote': 'qi/proposal.vote',\n  'governance/member-proposal': 'qi/governance.member-proposal',\n  'governance/settings-proposal': 'qi/governance.settings-proposal',\n  'governance.transaction/send-funds': 'qi/governance.transaction.send-funds',\n  'domain/card-preview': 'qi/domain.card-preview',\n  'domain/sign': 'qi/domain.sign',\n  'credential/store': 'qi/credential.store',\n  'funding/verify': 'qi/funding.verify',\n  'credential/issue': 'qi/credential.issue',\n  'yoma/opportunity': 'qi/yoma.opportunity',\n  'yoid/link': 'qi/yoid.link',\n  'outcome/certificate': 'qi/outcome.certificate',\n  'http/request': 'qi/http.request',\n  'protocol/select': 'qi/protocol.select',\n  'human/checkbox': 'qi/human.checkbox.set',\n  'human/form': 'qi/human.form.submit',\n  'oracle/query': 'oracle',\n  'pod/domain-indexer-lookup': 'qi/pod.domain-indexer-lookup',\n  'pod/domain-single-selection': 'qi/pod.domain-single-selection',\n  'pod/entity-single-selection': 'qi/pod.entity-single-selection',\n  'pod/governance-config': 'qi/pod.governance-config',\n  'pod/member-multi-select': 'qi/pod.member-multi-select',\n  'pod/list-domain-flows': 'qi/pod.list-domain-flows',\n  'blueprint/workspace-start': 'qi/blueprint.workspace-start',\n  'blueprint/journey-resume': 'qi/blueprint.journey-resume',\n  'blueprint/guided-authoring': 'qi/blueprint.guided-authoring',\n  'blueprint/artifact-preview': 'qi/blueprint.artifact-preview',\n  'blueprint/artifact-save': 'qi/blueprint.artifact-save',\n  'blueprint/checklist-update': 'qi/blueprint.checklist-update',\n  'blueprint/phase-commit': 'qi/blueprint.phase-commit',\n  'blueprint/phase-confirm': 'qi/blueprint.phase-confirm',\n  'blueprint/reviewer-assign': 'qi/blueprint.reviewer-assign',\n  'blueprint/review-submit': 'qi/blueprint.review-submit',\n  'blueprint/review-respond': 'qi/blueprint.review-respond',\n  'blueprint/release-compile': 'qi/blueprint.release-compile',\n  'blueprint/yoma-readiness': 'qi/blueprint.yoma-readiness',\n  'blueprint/publish': 'qi/blueprint.publish',\n  // Delegated integrations (author connects once, runners execute on their behalf)\n  'gmail.email/send': 'qi/gmail.email.send',\n  'outlook.email/send': 'qi/outlook.email.send',\n  'slack.message/send': 'qi/slack.message.send',\n  'googlecalendar.event/create': 'qi/googlecalendar.event.create',\n  // Google Calendar, self-connected (renamed from qi/calendar.* — IXO-4420 §5).\n  // The cans keep their historical values so existing UCAN grants still match.\n  'calendar.event/create': 'qi/googlecalendar.event.create-self',\n  'calendar.event/update': 'qi/googlecalendar.event.update-self',\n  'calendar.event/list': 'qi/googlecalendar.event.list-self',\n  // Xero integration\n  'xero.contact/create': 'qi/xero.contact.create',\n  'xero.invoice/create': 'qi/xero.invoice.create',\n  'xero.invoice/list': 'qi/xero.invoice.list',\n  'xero.payment/create': 'qi/xero.payment.create',\n  // Oracle / wallet / matrix lifecycle\n  'wallet/generate': 'qi/wallet.generate',\n  'wallet/fund': 'qi/wallet.fund',\n  'iid/create': 'qi/iid.create',\n  'matrix/register': 'qi/matrix.register',\n  'entity/createOracle': 'qi/entity.createOracle',\n  'sandbox/provision': 'qi/sandbox.provision',\n  'oracle/contract': 'qi/oracle.contract',\n  'oracle/storeSecrets': 'qi/oracle.storeSecrets',\n  'oracle/storeConfig': 'qi/oracle.storeConfig',\n  'oracle/configureOracle': 'qi/oracle.configureOracle',\n};\n\nconst TYPE_TO_CAN: Record<string, string> = Object.fromEntries(Object.entries(CAN_TO_TYPE).map(([can, type]) => [type, can]));\n\n/** Resolve a `can` ability string to the registry `type` string. */\nexport function canToType(can: string): string | undefined {\n  return CAN_TO_TYPE[can];\n}\n\n/** Resolve a registry `type` string to the `can` ability string. */\nexport function typeToCan(type: string): string | undefined {\n  return TYPE_TO_CAN[type];\n}\n\n/** Get all registered can↔type mappings. */\nexport function getAllCanMappings(): ReadonlyArray<{ can: string; type: string }> {\n  return Object.entries(CAN_TO_TYPE).map(([can, type]) => ({ can, type }));\n}\n","export interface ActionPresentation {\n  displayName: string;\n  description: string;\n}\n\n/** Presentation copy migrated from Portal UI registrations into the core registry. */\nconst PRESENTATION: Readonly<Record<string, ActionPresentation>> = {\n  oracle: { displayName: 'Ask your Agent', description: 'Send a prompt to the Personal Agent' },\n  'oracle.prompt': { displayName: 'Oracle Prompt', description: 'Send a prompt to the Personal Agent' },\n  'qi/bid.evaluate': { displayName: 'Evaluate Bid', description: 'Approve or reject a bid' },\n  'qi/bid.submit': { displayName: 'Bid', description: 'Submit a bid application' },\n  'qi/agent.cancel': { displayName: 'Cancel Agent', description: 'Cancel a delegated agent session' },\n  'qi/agent.invoke': { displayName: 'Invoke Agent', description: 'Delegate a task to an authorised agent runtime' },\n  'qi/answer.accept': { displayName: 'Accept Answer', description: 'Accept a proposed answer using the stated authority' },\n  'qi/answer.propose': { displayName: 'Propose Answer', description: 'Propose an answer for review in the Topic' },\n  'qi/blueprint.artifact-preview': { displayName: 'Preview Blueprint Artifact', description: 'Preview an authored Blueprint artifact before saving it' },\n  'qi/blueprint.artifact-save': { displayName: 'Save Blueprint Artifact', description: 'Save an authored artifact to the Blueprint workspace' },\n  'qi/blueprint.checklist-update': { displayName: 'Update Blueprint Checklist', description: 'Record progress against the Blueprint authoring checklist' },\n  'qi/blueprint.guided-authoring': { displayName: 'Guide Blueprint Authoring', description: 'Generate guided authoring input for the current Blueprint phase' },\n  'qi/blueprint.journey-resume': { displayName: 'Resume Blueprint Journey', description: 'Resume an existing Blueprint authoring journey' },\n  'qi/blueprint.phase-commit': { displayName: 'Commit Blueprint Phase', description: 'Commit the agreed answers for this phase of the design' },\n  'qi/blueprint.phase-confirm': { displayName: 'Confirm Blueprint Phase', description: 'Confirm completion of the current Blueprint authoring phase' },\n  'qi/blueprint.publish': { displayName: 'Publish Blueprint', description: 'Publish an approved Blueprint release' },\n  'qi/blueprint.release-compile': { displayName: 'Compile Blueprint Release', description: 'Compile Blueprint artifacts into a release candidate' },\n  'qi/blueprint.review-respond': { displayName: 'Respond to Blueprint Review', description: 'Respond to review feedback on a Blueprint release' },\n  'qi/blueprint.review-submit': { displayName: 'Submit Blueprint Review', description: 'Submit a Blueprint release for review' },\n  'qi/blueprint.reviewer-assign': { displayName: 'Assign Blueprint Reviewer', description: 'Assign a reviewer to a Blueprint release' },\n  'qi/blueprint.protocol-mint': { displayName: 'Mint Protocol', description: 'Create the protocol from the published design so working domains can be set up from it' },\n  'qi/blueprint.workspace-start': { displayName: 'Start Blueprint Workspace', description: 'Create a workspace for a new Blueprint authoring journey' },\n  'qi/blueprint.yoma-readiness': { displayName: 'Check Blueprint Readiness', description: 'Report how far the design has progressed towards publication' },\n  'qi/calendar.event.create': { displayName: 'Create Calendar event', description: 'Create an event on a connected Calendar' },\n  'qi/calendar.event.list': { displayName: 'List Calendar events', description: 'Fetch events from a connected Calendar' },\n  'qi/calendar.event.update': { displayName: 'Update Calendar event', description: 'Replace an existing Calendar event' },\n  'qi/carbon.harvest': { displayName: 'Harvest Carbon', description: 'Claim carbon credits into your wallet' },\n  'qi/carbon.loadBatches': { displayName: 'Load Carbon Batches', description: 'Reconcile harvestable and retireable CARBON credits' },\n  'qi/carbon.retire': { displayName: 'Retire Carbon', description: 'Permanently retire carbon credits to offset impact' },\n  'qi/claim.evaluate': { displayName: 'Evaluate Claim', description: 'Approve or reject a claim' },\n  'qi/claim.submit': { displayName: 'Claim', description: 'Submit a claim' },\n  'qi/collection.lifecycle': { displayName: 'Claim Collection', description: 'Create and manage a claim collection lifecycle' },\n  'qi/collection.create': { displayName: 'Create Claim Collection', description: 'Pin a protocol release and create its exact on-chain collection record' },\n  'qi/collection.users': { displayName: 'Collection Users', description: 'Add, list and revoke claim collection contributors & evaluators' },\n  'qi/credential.issue': { displayName: 'Issue Credential', description: 'Issue a verifiable credential to a participant' },\n  'qi/credential.store': { displayName: 'Store Credential', description: 'Store a verifiable credential in Matrix room state' },\n  'qi/funding.verify': { displayName: 'Verify Funding', description: 'Confirm the payout source holds enough funds before claims are evaluated' },\n  'qi/domain.card-preview': { displayName: 'Preview Domain Card', description: 'Review an oracle-enriched domain card and approve it before signing' },\n  'qi/domain.sign': { displayName: 'Sign Domain', description: 'Sign the domain card credential and create the entity on-chain' },\n  'qi/email.send': { displayName: 'Email', description: 'Send an email to a user' },\n  'qi/eval.connect': { displayName: 'Connect Evaluation Service', description: 'Authorize one evaluation service for one existing claim collection' },\n  'qi/eval.engine': { displayName: 'Evaluation Engine', description: 'Enroll a collection and publish its claim-approval rules in one step' },\n  'qi/evaluation.review': { displayName: 'Review Evaluation', description: 'Review and sign an evaluation assertion' },\n  'qi/evaluation.run': { displayName: 'Run Evaluation', description: 'Run an evaluation against the selected methodology and rubric' },\n  'qi/evidence.collect': { displayName: 'Collect Evidence', description: 'Collect evidence and provenance from approved sources' },\n  'qi/flow.run.close': { displayName: 'Close Flow Run', description: 'Close the current Flow run with a terminal outcome' },\n  'qi/flow.run.start': { displayName: 'Start Flow Run', description: 'Start a new governed Flow run' },\n  'qi/entity.createOracle': { displayName: 'Create Oracle Entity', description: 'Create the oracle entity on-chain' },\n  'qi/entity.transfer': { displayName: 'Transfer Entity', description: 'Transfer ownership of an entity to a new owner' },\n  'qi/form.submit': { displayName: 'Form Submit', description: 'Submit a form response' },\n  'qi/gmail.email.send': { displayName: 'Send Gmail email', description: \"Send an email from the template author's Gmail account\" },\n  'qi/googlecalendar.event.create': { displayName: 'Create Calendar event (delegated)', description: \"Create an event on the template author's Google Calendar\" },\n  'qi/googlecalendar.event.create-self': { displayName: 'Create Calendar event', description: 'Create an event on a connected Calendar' },\n  'qi/googlecalendar.event.list-self': { displayName: 'List Calendar events', description: 'Fetch events from a connected Calendar' },\n  'qi/googlecalendar.event.update-self': { displayName: 'Update Calendar event', description: 'Replace an existing Calendar event' },\n  'qi/governance.authz.exec': { displayName: 'Execute Authorized Action', description: 'Propose executing a message the POD was authorized to run' },\n  'qi/governance.authz.grant': { displayName: 'Grant Authorization', description: 'Propose granting an address authorization to act for the POD' },\n  'qi/governance.authz.revoke': { displayName: 'Revoke Authorization', description: 'Propose revoking a previously granted authorization' },\n  'qi/governance.chain-governance-vote': { displayName: 'Chain Governance Vote', description: \"Propose casting the POD's vote on a chain governance proposal\" },\n  'qi/governance.contract.execute': { displayName: 'Execute Contract', description: 'Propose executing a message on a smart contract as the DAO' },\n  'qi/governance.contract.instantiate': { displayName: 'Instantiate Contract', description: 'Propose instantiating a new smart contract from a code id' },\n  'qi/governance.contract.manage-cw20': { displayName: 'Manage Token List', description: 'Propose tracking or untracking a cw20 token in the DAO treasury' },\n  'qi/governance.contract.migrate': { displayName: 'Migrate Contract', description: 'Propose migrating a smart contract the DAO administers to a new code id' },\n  'qi/governance.contract.update-admin': { displayName: 'Update Contract Admin', description: 'Propose transferring admin rights over a smart contract to a new address' },\n  'qi/governance.custom-message': { displayName: 'Custom Message', description: 'Propose executing a raw JSON cosmos message (advanced)' },\n  'qi/governance.dao.accept-to-marketplace': { displayName: 'Accept to Marketplace', description: 'Propose marking an entity as verified on the marketplace' },\n  'qi/governance.dao.admin-exec': { displayName: 'DAO Admin Execute', description: 'Propose executing admin messages on a SubDAO this POD administers' },\n  'qi/governance.dao.create-entity': { displayName: 'Create Entity', description: 'Propose broadcasting a raw entity-creation message' },\n  'qi/governance.dao.join': { displayName: 'Join Entity', description: 'Propose linking this POD as a member of another entity' },\n  'qi/governance.dao.manage-storage': { displayName: 'Manage Storage Items', description: \"Propose setting or removing an item in the DAO's on-chain storage\" },\n  'qi/governance.dao.manage-subdaos': { displayName: 'Manage SubDAOs', description: 'Propose recognising or removing SubDAOs of this DAO' },\n  'qi/governance.dao.update-info': { displayName: 'Update DAO Info', description: \"Propose replacing the DAO's name, description and image\" },\n  'qi/governance.member-proposal': { displayName: 'Membership Proposal', description: 'Propose adding/removing members or changing voting power' },\n  'qi/governance.nft.burn': { displayName: 'Burn NFT', description: 'Propose permanently burning an NFT held by the treasury' },\n  'qi/governance.nft.manage-collections': { displayName: 'Manage NFT Collections', description: 'Propose tracking or untracking an NFT collection in the treasury' },\n  'qi/governance.nft.transfer': { displayName: 'Transfer NFT', description: 'Propose transferring an NFT from the treasury' },\n  'qi/governance.settings-proposal': { displayName: 'Governance Settings Proposal', description: 'Propose new voting rules (period, quorum, thresholds)' },\n  'qi/governance.staking.stake': { displayName: 'Stake Treasury Tokens', description: 'Propose staking treasury IXO with a validator — stake, unstake, restake or claim rewards' },\n  'qi/governance.staking.stake-to-group': { displayName: 'Stake to POD', description: \"Propose staking treasury cw20 tokens into a POD's staking contract\" },\n  'qi/governance.submission-config-proposal': { displayName: 'Proposal Submission Rules', description: 'Propose changing who may submit proposals and the required deposit' },\n  'qi/governance.transaction.mint': { displayName: 'Mint Governance Tokens', description: 'Propose minting new governance tokens to an address' },\n  'qi/governance.transaction.perform-token-swap': { displayName: 'Fund Token Swap', description: 'Propose funding the POD’s side of a token swap contract' },\n  'qi/governance.transaction.send-funds': { displayName: 'Send Funds', description: 'Propose sending funds from the POD treasury' },\n  'qi/governance.transaction.send-group-token': { displayName: 'Send POD Tokens', description: 'Propose transferring cw20 POD tokens from the treasury' },\n  'qi/governance.transaction.withdraw-token-swap': { displayName: 'Withdraw Token Swap', description: 'Propose withdrawing the POD’s funds from a token swap contract' },\n  'qi/governance.validator.actions': { displayName: 'Validator Actions', description: \"Propose a validator operation with the POD's validator account\" },\n  'qi/http.request': { displayName: 'HTTP Request', description: 'Make an HTTP API request' },\n  'qi/http.fetch': { displayName: 'Fetch HTTP Resource', description: 'Read data from an HTTP endpoint' },\n  'qi/incident.escalate': { displayName: 'Escalate Incident', description: 'Notify the stated recipients about an incident escalation' },\n  'qi/incident.mitigation.record': { displayName: 'Record Incident Mitigation', description: 'Record mitigation work and evidence for an incident' },\n  'qi/human.checkbox.set': { displayName: 'Checkbox Set', description: 'Record a checkbox response' },\n  'qi/human.form.submit': { displayName: 'Human Form Submit', description: 'Submit a human-completed form' },\n  'qi/identity.create': { displayName: 'Create Identity', description: 'Create an IID document and Matrix account for a user' },\n  'qi/iid.create': { displayName: 'Create IID', description: 'Create an IID document on-chain' },\n  'qi/kyc.verify': { displayName: 'Identity Verification (KYC)', description: 'Verify your identity and save the issued credential to your Vault' },\n  'qi/matrix.dm': { displayName: 'Matrix DM', description: 'Send a direct message via Matrix' },\n  'qi/matrix.register': { displayName: 'Register Matrix Account', description: 'Create a Matrix account and access token' },\n  'qi/notification.push': { displayName: 'Push Notification', description: 'Send a push notification' },\n  'qi/oracle.configureOracle': { displayName: 'Configure Oracle', description: 'Store oracle secrets and configuration in one step' },\n  'qi/oracle.contract': { displayName: 'Create Oracle Contract', description: 'Establish the user-oracle Matrix DM room' },\n  'qi/oracle.deploy': { displayName: 'Deploy Oracle', description: 'Build, deploy, and start the oracle' },\n  'qi/oracle.deploySetup': { displayName: 'Set Up Oracle Deployment', description: 'Build and prepare the oracle for deployment' },\n  'qi/oracle.deployStart': { displayName: 'Start Oracle Deployment', description: 'Start the oracle deployment process' },\n  'qi/oracle.invoke': { displayName: 'Ask your Agent', description: 'Send a prompt to the Personal Agent' },\n  'qi/oracle.storeConfig': { displayName: 'Store Oracle Config', description: 'Store the oracle configuration in Matrix room state' },\n  'qi/oracle.storeSecrets': { displayName: 'Store Oracle Secrets', description: 'Store oracle secrets in Matrix room state' },\n  'qi/oracle.storeSecretsAndConfig': { displayName: 'Store Oracle Secrets & Config', description: 'Store oracle secrets and configuration in Matrix room state' },\n  'qi/outlook.email.send': { displayName: 'Send Outlook email', description: \"Send an email from the template author's Outlook account\" },\n  'qi/pod.domain-indexer-lookup': { displayName: 'Define Purpose', description: 'Capture intent and find matching Blueprint candidates' },\n  'qi/pod.domain-single-selection': { displayName: 'Select Blueprint', description: 'Choose a Blueprint protocol for the POD' },\n  'qi/pod.entity-single-selection': { displayName: 'Select Parent Organisation', description: 'Pick a parent entity where you hold a role' },\n  'qi/pod.governance-config': { displayName: 'Configure Governance', description: 'Set the governance group type and decision policy' },\n  'qi/pod.list-domain-flows': { displayName: 'Select Flow Templates', description: 'Choose protocol flow templates to import' },\n  'qi/pod.member-multi-select': { displayName: 'Configure Membership', description: 'Define POD members, roles, and voting power' },\n  'qi/proposal.create': { displayName: 'Create Proposal', description: 'Create an on-chain governance proposal' },\n  'qi/proposal.vote': { displayName: 'Vote on Proposal', description: 'Cast a vote on a governance proposal' },\n  'qi/protocol.select': { displayName: 'Select Protocol', description: 'Select a protocol from a configured list' },\n  'qi/sandbox.provision': { displayName: 'Provision Sandbox', description: 'Provision a sandbox environment for the oracle' },\n  'qi/settlement.execute': { displayName: 'Execute Settlement', description: 'Execute an approved settlement using the configured provider' },\n  'qi/slack.message.send': { displayName: 'Post Slack message', description: \"Post a message to a channel from the template author's Slack account\" },\n  'qi/topic.action.cancel': { displayName: 'Cancel Topic Action', description: 'Cancel an outstanding governed Action request' },\n  'qi/topic.action.receipt.record': { displayName: 'Record Action Receipt', description: 'Record a signed Action receipt against its Topic request' },\n  'qi/topic.action.request': { displayName: 'Request Topic Action', description: 'Request an Action against the current Topic revision' },\n  'qi/topic.context.link': { displayName: 'Link Topic Context', description: 'Link a referenced resource or service to the Topic' },\n  'qi/topic.contract.confirm-setup': { displayName: 'Confirm Topic Setup', description: 'Confirm the exact proposed Topic setup revision' },\n  'qi/topic.decision.record': { displayName: 'Record Topic Decision', description: 'Record an authorised decision and its rationale' },\n  'qi/topic.file.attach-reference': { displayName: 'Attach File Reference', description: 'Attach a pinned VFS file reference to the Topic' },\n  'qi/topic.flow.bind': { displayName: 'Bind Flow to Topic', description: 'Bind a governed Flow revision to the Topic' },\n  'qi/topic.flow.unbind': { displayName: 'Unbind Flow from Topic', description: 'Remove an existing Flow binding from the Topic' },\n  'qi/outcome.certificate': { displayName: 'Issue Outcome Certificate', description: 'Certify that a promised outcome was achieved and evidenced' },\n  'qi/topic.outcome.confirm': { displayName: 'Confirm Topic Outcome', description: 'Confirm a proposed outcome using the stated authority' },\n  'qi/topic.outcome.propose': { displayName: 'Propose Topic Outcome', description: 'Propose an evidence-backed outcome for review' },\n  'qi/topic.status.transition': { displayName: 'Change Topic Status', description: 'Move the Topic between permitted lifecycle statuses' },\n  'qi/yoid.link': { displayName: 'Link YoID', description: 'Link a participant to their Yoma identity' },\n  'qi/yoma.opportunity': { displayName: 'Publish Yoma Opportunity', description: 'Publish an opportunity young people can take part in' },\n  'qi/wallet.fund': { displayName: 'Fund Wallet', description: 'Fund a wallet with an on-chain transfer' },\n  'qi/wallet.generate': { displayName: 'Generate Wallet', description: 'Generate an IXO wallet and DID' },\n  'qi/wallet.generateAndFund': { displayName: 'Generate & Fund Wallet', description: 'Generate an IXO wallet and fund it on-chain' },\n  'qi/work.accept': { displayName: 'Accept Work', description: 'Accept submitted work using the stated authority' },\n  'qi/work.assign': { displayName: 'Assign Work', description: 'Assign a referenced unit of work' },\n  'qi/work.checkpoint': { displayName: 'Record Work Checkpoint', description: 'Record progress and evidence for work in progress' },\n  'qi/work.dispatch': { displayName: 'Dispatch Work', description: 'Dispatch assigned work to its assignee' },\n  'qi/work.submit': { displayName: 'Submit Work', description: 'Submit completed work for review' },\n  'qi/xero.contact.create': { displayName: 'Create Xero contact', description: 'Add a customer or supplier in Xero' },\n  'qi/xero.invoice.create': { displayName: 'Create Xero invoice', description: 'Draft a new Xero invoice' },\n  'qi/xero.invoice.list': { displayName: 'List Xero invoices', description: 'Fetch invoices from Xero' },\n  'qi/xero.payment.create': { displayName: 'Record Xero payment', description: 'Settle a Xero bill — typically wired to capture an on-chain tx hash as the reference' },\n};\n\nfunction humanizeActionType(type: string): string {\n  const withoutNamespace = type.replace(/^qi\\//, '').replace(/^oracle\\.?/, 'oracle ');\n  const words = withoutNamespace\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .split(/[./_-]+/)\n    .filter(Boolean);\n  return words.map((word) => (/^(iid|kyc|dao|nft|http|dm|pod|cw20)$/i.test(word) ? word.toUpperCase() : word.charAt(0).toUpperCase() + word.slice(1))).join(' ');\n}\n\n/** Core-owned default used by built-ins and by legacy registrations during migration. */\nexport function getActionPresentation(type: string): ActionPresentation {\n  const registered = PRESENTATION[type];\n  if (registered) return registered;\n  const displayName = humanizeActionType(type) || 'Action';\n  return { displayName, description: `Perform ${displayName.toLowerCase()} as part of this flow.` };\n}\n","import type { Doc as YDoc } from 'yjs';\n\nimport type { FlowNode, FlowNodeRuntimeState } from '../../types/authorization';\nimport type { IxoEditorType } from '../../types/editor';\nimport type { FlowRuntimeStateManager } from '../flowEngine/runtime';\nimport type { PendingInvocation } from '../flowEngine/triggers';\nimport type { RunEventAppender, RunTerminalAuthorizationProof } from '../flowEngine/runLifecycle';\nimport type { CompiledDesignPodReleaseV1, DesignPodInvocationVerifier } from '../designPod/compiler';\nimport type { DesignPodArtifactReceiptV1, DesignPodControlId, DesignPodControlRevisionV1, DesignPodRuntimeAuthorityV1 } from '../designPod/contracts';\n\n/** Topic base kinds understood by the portable Action manifest. */\nexport const TOPIC_ACTION_BASE_KINDS = ['task', 'agent_task', 'proposal', 'evaluation', 'claims', 'question', 'discussion', 'incident'] as const;\nexport type TopicActionBaseKind = (typeof TOPIC_ACTION_BASE_KINDS)[number];\n\nexport type TopicActionRuntimeProvider = 'qi-flow' | 'qiforge' | 'mcp';\nexport type TopicActionWriteBackPolicy = 'none' | 'receipt-only' | 'semantic-record';\nexport type TopicActionRelevance = 'recommended' | 'contextual' | 'restricted';\nexport type ActionRiskTier = 'low' | 'medium' | 'high' | 'critical';\n\n/**\n * Optional, revision-bound Topic context carried by every execution provider.\n * It grants no authority by itself: Flow execution and Topic write-back are\n * verified independently against their respective capability references.\n */\nexport interface TopicExecutionContext {\n  topicId: string;\n  topicRevision: string;\n  kind: { source: 'standard'; kind: TopicActionBaseKind } | { source: 'custom'; profileId: string; profileVersion: string; baseKind: TopicActionBaseKind };\n  contract: { revision: string; digest: string };\n  capsule?: { reference: string; digest: string };\n  requestId: string;\n  /** Stable across every receipt phase for the governed Action request. */\n  idempotencyKey: string;\n  bindingId?: string;\n  executorProvider: TopicActionRuntimeProvider;\n  writeBackPolicy: TopicActionWriteBackPolicy;\n  /** Reference to a delegation authorising Topic operations, never the token itself. */\n  topicCapabilityReference: string;\n  confirmationReference?: string;\n}\n\n/** Safe semantic record returned to the bridge for protocol validation. */\nexport interface TopicActionRecord {\n  type: string;\n  id: string;\n  version: number;\n  value: Record<string, unknown>;\n  evidenceReferences?: string[];\n}\n\n/** Portable, human-readable contract for one Topic semantic record payload. */\nexport interface TopicSemanticRecordDefinition {\n  type: string;\n  version: number;\n  displayName: string;\n  description: string;\n  valueSchema: object;\n}\n\nexport interface TopicActionMetadata {\n  supportedBaseKinds: TopicActionBaseKind[];\n  relevance: TopicActionRelevance;\n  writeBackMode: Exclude<TopicActionWriteBackPolicy, 'none'>;\n  /** Canonical semantic contracts. `permittedTopicRecordTypes` is derived from these. */\n  semanticRecordTypes: TopicSemanticRecordDefinition[];\n  /** @deprecated Read `semanticRecordTypes[].type`; retained for manifest v2 consumers. */\n  permittedTopicRecordTypes: string[];\n  /** Actions do not mutate Topic, contract, outcome, claim, or settlement state implicitly. */\n  lifecycleEffect: 'none';\n  requiredTopicAbilities: string[];\n  redactionPolicy: {\n    mode: 'paths';\n    sensitiveInputPaths: string[];\n    sensitiveOutputPaths: string[];\n  };\n}\n\n/** Common portable invocation envelope used by Qi Flow, QiForge, and MCP. */\nexport interface TopicActionInvocationV1 {\n  version: 1;\n  requestId: string;\n  idempotencyKey: string;\n  actionType: string;\n  actionContractDigest: string;\n  topicId: string;\n  topicRevision: string;\n  contractRevision: string;\n  contractDigest: string;\n  actorDid: string;\n  executorDid: string;\n  executorProvider: TopicActionRuntimeProvider;\n  flowCapabilityReference?: string;\n  topicCapabilityReference: string;\n  input: { digest: string; reference?: string; safeSummary?: Record<string, unknown> };\n  bindingId?: string;\n  flowId?: string;\n  flowRevision?: string;\n  sessionId?: string;\n  nodeId?: string;\n  confirmationReference?: string;\n}\n\nexport interface TopicOperationAppendResult {\n  operationId: string;\n  topicRevision: string;\n  proofReference: string;\n}\n\n/**\n * Capability-checked Topic service. Hosts expose it only to Topic-native\n * actions; ordinary actions receive TopicExecutionContext but cannot mutate\n * Matrix Topic state directly.\n */\nexport interface TopicService {\n  appendOperation(params: {\n    context: TopicExecutionContext;\n    actorDid: string;\n    operationType: string;\n    payload: Record<string, unknown>;\n    idempotencyKey: string;\n  }): Promise<TopicOperationAppendResult>;\n  readProjection?(params: { topicId: string; topicRevision?: string; requestId?: string }): Promise<Record<string, unknown>>;\n  /**\n   * Deliver a Topic reminder: a message into the Topic thread plus its audit\n   * notice. Optional because it is the one Topic capability a host can lack —\n   * the Portal delivers nothing itself, and only a scheduling host (flow-manager)\n   * implements it. Absent means `qi/topic.remind` refuses rather than no-ops.\n   */\n  deliverReminder?(params: {\n    context: TopicExecutionContext;\n    recipients: string[];\n    message: string;\n    idempotencyKey: string;\n  }): Promise<{ deliveredAt: string; recipients: string[] }>;\n}\n\nexport interface AgentRuntimeService {\n  invoke(params: {\n    agentDid: string;\n    capsuleReference: string;\n    toolPolicy: Record<string, unknown>;\n    budget?: Record<string, unknown>;\n    deadline?: string;\n    executorPreference?: TopicActionRuntimeProvider;\n    prompt?: string;\n  }): Promise<{ sessionId: string; result: unknown; evidenceReferences?: string[]; providerReceiptReference: string }>;\n  cancel(params: { sessionId: string; reason?: string }): Promise<{ sessionId: string; status: 'cancelled'; providerReceiptReference: string }>;\n}\n\nexport interface EvidenceService {\n  collect(params: {\n    question: string;\n    sourceReferences: string[];\n    constraints?: Record<string, unknown>;\n  }): Promise<{ evidence: unknown; provenance: unknown; evidenceReferences: string[] }>;\n}\n\nexport interface EvaluationRuntimeService {\n  run(params: Record<string, unknown>): Promise<{ assertionId: string; assertion: Record<string, unknown>; evidenceReferences: string[]; signature: string }>;\n  review(params: Record<string, unknown>): Promise<{ reviewId: string; review: Record<string, unknown>; evidenceReferences: string[]; signature: string }>;\n}\n\nexport interface SettlementService {\n  execute(params: {\n    approvedClaimReference: string;\n    amount: string;\n    asset: string;\n    recipient: string;\n    policyReference: string;\n    confirmationReference: string;\n  }): Promise<{ settlementId: string; transactionReference: string; providerReceiptReference: string; status: 'submitted' | 'confirmed' | 'needs_verification' }>;\n}\n\nexport interface IncidentService {\n  escalate(params: { severity: string; affectedResources: string[]; recipients: string[]; evidenceReferences?: string[]; summary: string }): Promise<{\n    escalationId: string;\n    notifiedAt: string;\n    providerReceiptReferences: string[];\n  }>;\n}\n\n/**\n * The raw consumer handler bag (mantine `BlocknoteHandlers`), as visible to\n * action `run()` implementations via `ctx.handlers`. The real interface lives\n * in the mantine layer and cannot be imported here without a core→mantine\n * cycle, so this declares only the members actions actually call — loosely\n * typed, since the parameter shapes are owned by the consumer contract.\n *\n * There is deliberately NO index signature: calling an undeclared handler is a\n * compile error, so a renamed consumer handler surfaces here instead of\n * failing at runtime. Add the member when an action starts using a new\n * handler. Prefer `ctx.services.*` (the typed, adapted contract) over\n * `ctx.handlers` for new actions — this escape hatch exists for actions that\n * predate `buildServicesFromHandlers`.\n */\nexport interface ActionHandlers {\n  askCompanion?: (prompt: string) => Promise<any>;\n  vote?: (...args: any[]) => any;\n  getPreProposalContractAddress?: (...args: any[]) => any;\n  getGroupContractAddress?: (...args: any[]) => any;\n  getProposalContractAddress?: (...args: any[]) => any;\n  createProposal?: (...args: any[]) => any;\n  getUserRoles?: (...args: any[]) => any;\n  getClaimData?: (...args: any[]) => any;\n  /** Blocksync read of every claim submitted to a collection. Used by `qi/claim.evaluate`'s pending-work snapshot. */\n  getClaimsPerCollectionId?: (params: { collectionId: string }) => Promise<any[]>;\n  /** Blocksync read of an entity's claim collections (state, dates, admin). */\n  getClaimCollections?: (deedDid: string) => Promise<any>;\n  getOnlyClaimCollections?: (deedDid: string) => Promise<any[]>;\n  getDeedSurveyTemplate?: (...args: any[]) => any;\n  getDeedRubric?: (...args: any[]) => any;\n  requestPin?: (...args: any[]) => any;\n  signCredential?: (...args: any[]) => any;\n  publicFileUpload?: (...args: any[]) => any;\n  createDomain?: (...args: any[]) => any;\n  createAddLinkedResourceMessage?: (...args: any[]) => any;\n  createDeleteLinkedResourceMessage?: (...args: any[]) => any;\n  executeTransaction?: (...args: any[]) => any;\n  getTransactionStatus?: (transactionHash: string) => Promise<{\n    status: 'not_found' | 'pending' | 'succeeded' | 'failed';\n    observedAt: string;\n    transactionHash?: string;\n    code?: number;\n    height?: string;\n  }>;\n  createGovernanceGroup?: (...args: any[]) => any;\n  getEntityDid?: (...args: any[]) => any;\n  getCurrentUser?: (...args: any[]) => any;\n  getBalances?: (...args: any[]) => any;\n  createAddLinkedEntityMessage?: (...args: any[]) => any;\n  sourceDomainSpaces?: (...args: any[]) => any;\n  importProtocolTemplatesToSpace?: (...args: any[]) => any;\n  integrations?: {\n    executeTool?: (...args: any[]) => any;\n    fetchCurrentState?: (...args: any[]) => any;\n    getEntityDid?: (...args: any[]) => any;\n  };\n}\n\nexport interface ActionContext {\n  actorDid: string;\n  flowId: string;\n  /** Explicit session run; distinct from an individual action execution id. */\n  sessionRunId?: string;\n  /** Portal-owned project/room authority, supplied outside mutable Flow CRDT state. */\n  designPodAuthority?: DesignPodRuntimeAuthorityV1;\n  nodeId: string;\n  services: ActionServices;\n  flowNode?: FlowNode;\n  runtime?: FlowRuntimeStateManager;\n  /** Matrix-backed run history used for globally ordered governed claims. */\n  runEventLog?: RunEventAppender;\n  flowUri?: string;\n  /** Pinned content revision/digest used for Topic flow bindings and receipts. */\n  flowRevision?: string;\n  handlers?: ActionHandlers;\n  editor?: IxoEditorType;\n  /**\n   * The flow document. Present on both execution paths — `editor` is undefined\n   * headless, so an action that needs flow-level configuration (the connection\n   * bindings, say) has to read it from here rather than from the editor.\n   */\n  yDoc?: YDoc;\n  pendingInvocation?: PendingInvocation;\n  /** Optional governed Topic binding. Presence is context, not mutation authority. */\n  topic?: TopicExecutionContext;\n  /** Signed Flow invocation that authorized this exact action input. */\n  executionProof?: {\n    invocationCid: string;\n    /** Signed UCAN CAR retained for pre-effect authority arbitration. */\n    invocation?: string;\n    capabilityId?: string;\n    proofCids: string[];\n    capability: { can: string; with: string };\n    facts: Record<string, unknown>;\n    inputDigest: string;\n  };\n}\n\n/**\n * Lifecycle state of an IXO claims-module collection.\n *\n * Mirrors `ixo.claims.v1beta1.CollectionState` (the on-chain enum). Carried as\n * a numeric enum at this boundary so the consumer-side handler can map it\n * directly onto the SDK enum without a string lookup.\n *\n * - `OPEN`    (0) — accepting claims/bids.\n * - `PAUSED`  (1) — temporarily not accepting submissions.\n * - `CLOSED`  (2) — permanently closed.\n */\nexport enum CollectionStateEnum {\n  OPEN = 0,\n  PAUSED = 1,\n  CLOSED = 2,\n}\n\n/**\n * A single coin amount. Mirrors `cosmos.base.v1beta1.Coin`. `amount` is the\n * integer base-denom amount carried as a string (no `Long`/`bigint` at this\n * boundary).\n */\nexport interface CollectionCoin {\n  denom: string;\n  amount: string;\n}\n\n/**\n * A CW20 token payment leg. Mirrors `ixo.claims.v1beta1.CW20Payment`.\n */\nexport interface CollectionCW20Payment {\n  address: string;\n  /** Integer amount carried as a string. */\n  amount: string;\n}\n\n/**\n * A CW1155 contract payment leg. Mirrors `ixo.claims.v1beta1.Contract1155Payment`.\n */\nexport interface CollectionContract1155Payment {\n  address: string;\n  tokenId: string;\n  /** Integer amount carried as a string. */\n  amount: string;\n}\n\n/**\n * One payment leg of a collection (submission / evaluation / approval /\n * rejection). Mirrors `ixo.claims.v1beta1.Payment`.\n *\n * Optional/empty legs are represented by an empty `amount` array. The consumer\n * handler fills `account` with the collection admin address when creating.\n */\nexport interface CollectionPayment {\n  /** Destination/charging account address. */\n  account: string;\n  /** Native-coin amounts. Empty when this leg charges nothing in native coin. */\n  amount: CollectionCoin[];\n  /** Optional CW20 payment legs. */\n  cw20Payment?: CollectionCW20Payment[];\n  /** Optional CW1155 contract payment. */\n  contract_1155Payment?: CollectionContract1155Payment;\n  /** Optional payment timeout in nanoseconds, carried as a string. */\n  timeoutNs?: string;\n  /** Whether this leg is paid by the oracle rather than the claimant. */\n  isOraclePayment?: boolean;\n}\n\n/**\n * The four payment legs of a collection. Mirrors `ixo.claims.v1beta1.Payments`.\n */\nexport interface Payments {\n  submission?: CollectionPayment;\n  evaluation?: CollectionPayment;\n  approval?: CollectionPayment;\n  rejection?: CollectionPayment;\n}\n\n/**\n * Per-intent configuration for a collection. Mirrors the\n * `ixo.claims.v1beta1.CollectionIntentOptions` shape — controls whether/how\n * claimants can declare an intent before submitting.\n */\nexport interface CollectionIntentOptions {\n  /** Whether intents are enabled on this collection. */\n  allowed?: boolean;\n  /** Optional intent timeout in nanoseconds, carried as a string. */\n  timeoutNs?: string;\n  /** Optional per-intent payment override. */\n  payment?: CollectionPayment;\n}\n\n/**\n * Parameters for creating a collection (`MsgCreateCollection`).\n *\n * `entity` and `protocol` are template configuration; the consumer resolves the\n * `signer`/admin from its own wallet context, so it is not part of this\n * boundary. `quota` is carried as a string (`0` = unlimited).\n */\nexport interface CollectionCreateParams {\n  /** Entity (deed) DID the collection belongs to. */\n  entity: string;\n  /** Protocol DID/id the collection follows. */\n  protocol: string;\n  /** Initial lifecycle state. Defaults to OPEN if omitted by the consumer. */\n  state?: CollectionStateEnum;\n  /** ISO-8601 start date. */\n  startDate?: string;\n  /** ISO-8601 end date. */\n  endDate?: string;\n  /** Max number of claims; `0` = unlimited. Carried as a string. */\n  quota?: string;\n  /** Payment configuration for the four claim legs. */\n  payments?: Payments;\n  /** Intent configuration. */\n  intents?: CollectionIntentOptions;\n}\n\n/**\n * The full, canonical on-chain state of a collection, returned by every\n * `collection.*` operation (read or write) and stored verbatim as\n * `runtime.output`. It is never a delta — see IXO-2573: `output` always holds\n * the latest full on-chain collection state.\n *\n * Field names mirror `ixo.claims.v1beta1.Collection`. Numeric chain types\n * (`Long`/uint64) are carried as strings; `state` is the numeric enum.\n */\nexport interface CollectionState {\n  /** Collection identifier (the chain-assigned id). */\n  collectionId: string;\n  /** Entity (deed) DID the collection belongs to. */\n  entity: string;\n  /** Protocol DID/id the collection follows. */\n  protocol: string;\n  /** Admin address authorised to mutate the collection. */\n  admin?: string;\n  /** Current lifecycle state. */\n  state: CollectionStateEnum;\n  /** ISO-8601 start date, if set. */\n  startDate?: string;\n  /** ISO-8601 end date, if set. */\n  endDate?: string;\n  /** Max number of claims; `0` = unlimited. Carried as a string. */\n  quota: string;\n  /** Number of claims submitted so far. Carried as a string. */\n  count: string;\n  /** Number of claims evaluated so far. Carried as a string. */\n  evaluated?: string;\n  /** Number of approved claims. Carried as a string. */\n  approved?: string;\n  /** Number of rejected claims. Carried as a string. */\n  rejected?: string;\n  /** Number of disputed claims. Carried as a string. */\n  disputed?: string;\n  /** Payment configuration for the four claim legs. */\n  payments?: Payments;\n  /** Intent configuration. */\n  intents?: CollectionIntentOptions;\n}\n\n/**\n * Role a grantee holds on a claim collection. Drives which custom claims-module\n * authorization is granted: `submit` → `SubmitClaimAuthorization`,\n * `evaluate` → `EvaluateClaimAuthorization` (each carries `[]constraints`, one\n * per collection). See IXO-2586.\n */\nexport type CollectionUserRole = 'submit' | 'evaluate';\n\n/**\n * How a grantee address is treated when adding it to a collection:\n * - `user`          — a plain account; one grant.\n * - `group-account` — a DAO-core group account; one grant to the group itself.\n *   Only offered when the group can exercise the grant (dao-core can MsgExec).\n * - `group-members` — fan out: enumerate the group's members and grant each\n *   one individually.\n * - `address-list`  — a list of accounts pasted in bulk (from a spreadsheet);\n *   every account gets the same role/quota/limits (IXO-4396).\n */\nexport type CollectionGranteeKind = 'user' | 'group-account' | 'group-members' | 'address-list';\n\n/**\n * One per-collection authorization constraint held by a grantee for a role.\n * Carries the LIVE (decremented) limits as read back from chain — the revoke\n * read-modify-write must preserve these verbatim (IXO-2590), so re-granting\n * from a template would wrongly reset spent quota.\n */\nexport interface CollectionGrantee {\n  /** Grantee bech32 address. */\n  address: string;\n  /** Optional resolved DID (display / audit). */\n  did?: string;\n  /** Role this grant confers. */\n  role: CollectionUserRole;\n  /** Remaining agent quota; `0` = unlimited. Carried as a string. */\n  agentQuota?: string;\n  /** Per-claim max amount cap (evaluate role). */\n  maxAmount?: CollectionCoin[];\n  /** Intent duration in nanoseconds, carried as a string. */\n  intentDurationNs?: string;\n}\n\n/**\n * A member enumerated from a group account, used for grant fan-out. Mirrors the\n * `PODMember` shape produced by the `pod/memberMultiSelect` enumeration\n * (abstracts cw4 members / token-staking stakers / nft-staking / multisig\n * signers).\n */\nexport interface CollectionMember {\n  address: string;\n  did?: string;\n  role?: string;\n  votingPower?: number;\n}\n\n/**\n * DAO DAO classification of an address. On IXO both user accounts and CosmWasm\n * contracts share the `ixo1…` prefix, so classification is layered: bech32\n * byte-length heuristic → Wasm `ContractInfo` query → cw2 `{ \"info\": {} }`\n * smart query (IXO-2592).\n */\nexport interface AddressClassification {\n  /** `user` = plain account; `contract` = CosmWasm contract / module account. */\n  kind: 'user' | 'contract';\n  /** Present when `kind === 'contract'` and cw2 info resolved a DAO DAO group type. */\n  daodao?: {\n    /** cw2 contract name family, e.g. `dao-dao-core`, `cw4-group`, `dao-voting-cw4`. */\n    type: string;\n    /** Whether the contract can itself exercise a granted authz (only dao-core can MsgExec). */\n    canExerciseGrant: boolean;\n  };\n}\n\n/**\n * Provenance/identity of a carbon batch (= a CARBON token group; the batch id\n * is the on-chain token id). `entityDid` + `adminAddress` identify the entity\n * admin account the batch was minted from — both are REQUIRED to construct a\n * harvest (the authz grant + exec transfer target that account). The host\n * `loadBatches` handler performs provenance recovery for transferred batches so\n * these are populated before the editor ever sees them. See the carbon-credit\n * technical doc §4–§5 (IXO-2675).\n */\nexport interface CarbonBatchRef {\n  /** Token/batch id. */\n  id: string;\n  /** Minter entity DID. */\n  entityDid: string;\n  /** Entity admin account address (the FROM account for a harvest transfer). */\n  adminAddress: string;\n  /** Human-readable entity name, for display. */\n  alsoKnownAs?: string;\n}\n\n/**\n * A harvestable batch: held on an entity admin account the user owns but not\n * yet pulled into their wallet. `claimable` = the admin-held amount that\n * becomes the user's on harvest.\n */\nexport interface CarbonHarvestableBatch extends CarbonBatchRef {\n  /** Harvestable amount (admin-held; becomes user `amount` after harvest). */\n  claimable: number;\n}\n\n/**\n * A retireable batch: credits the user already holds in their wallet and can\n * burn/offset. `entityDid` is best-effort (display/provenance) and not required\n * to retire — retirement is a single owner-signed message.\n */\nexport interface CarbonRetireableBatch {\n  /** Token/batch id. */\n  id: string;\n  /** Amount available in the user's wallet to retire. */\n  amount: number;\n  /** Minter entity DID, when known. */\n  entityDid?: string;\n  /** Human-readable entity name, for display. */\n  alsoKnownAs?: string;\n}\n\nexport interface HttpService {\n  request: (params: {\n    url: string;\n    method: string;\n    headers?: Record<string, string>;\n    body?: any;\n    security: { denyPrivateNetworks: true; maxRedirects: number; stripSensitiveHeadersOnRedirect: true };\n  }) => Promise<{ status: number; headers: Record<string, string>; data: any; requestId?: string; responseDigest?: string; traceReference?: string }>;\n}\n\nexport interface EmailService {\n  send: (params: {\n    to: string;\n    subject: string;\n    template: string;\n    templateVersion?: string;\n    variables?: Record<string, any>;\n    cc?: string;\n    bcc?: string;\n    replyTo?: string;\n  }) => Promise<{ messageId: string; sentAt: string }>;\n}\n\nexport interface NotifyService {\n  send: (params: {\n    channel: string;\n    to: string[];\n    cc?: string[];\n    bcc?: string[];\n    subject?: string;\n    body?: string;\n    bodyType?: 'text' | 'html';\n    from?: string;\n    replyTo?: string;\n  }) => Promise<{ messageId: string; sentAt: string }>;\n}\n\nexport interface BidService {\n  submitBid: (params: { collectionId: string; role: string; surveyAnswers: Record<string, any>; entityDid?: string; onBehalfOfAddress?: string }) => Promise<any>;\n  approveBid: (params: { bidId: string; collectionId: string; did: string; entityDid?: string }) => Promise<any>;\n  rejectBid: (params: { bidId: string; collectionId: string; did: string; reason: string; entityDid?: string }) => Promise<any>;\n  approveServiceAgentApplication: (params: { adminAddress: string; collectionId: string; agentQuota: number; deedDid: string; currentUserAddress: string }) => Promise<void>;\n  approveEvaluatorApplication: (params: {\n    adminAddress: string;\n    collectionId: string;\n    deedDid: string;\n    evaluatorAddress: string;\n    agentQuota?: number;\n    claimIds?: string[];\n    maxAmounts?: Array<{ denom: string; amount: string }>;\n  }) => Promise<void>;\n}\n\nexport interface ClaimService {\n  requestPin: (config?: { title?: string; description?: string; submitText?: string }) => Promise<string>;\n  submitClaim: (params: { surveyData: any; deedDid: string; collectionId: string; adminAddress: string; pin: string; entityDid?: string }) => Promise<{\n    transactionHash: string;\n    claimId: string;\n  }>;\n  evaluateClaim: (\n    granteeAddress: string,\n    did: string,\n    payload: {\n      claimId: string;\n      collectionId: string;\n      adminAddress: string;\n      status?: number;\n      verificationProof: string;\n      amount?: { denom: string; amount: string };\n    }\n  ) => Promise<{\n    code: number;\n    transactionHash: string;\n    rawLog?: string;\n    height?: number;\n    txIndex?: number;\n    gasWanted?: bigint;\n    gasUsed?: bigint;\n  }>;\n  disputeClaim?: (\n    granteeAddress: string,\n    did: string,\n    payload: {\n      subjectId: string;\n      disputeType: number;\n      reason: string;\n    }\n  ) => Promise<any>;\n  getCurrentUser: () => { address: string; did?: string };\n  createUdid?: (params: any) => Promise<any>;\n}\n\n/**\n * Claims-module collection lifecycle service. The editor declares the\n * contract only; the consumer app implements each method (broadcast on chain,\n * resolve admin from its wallet context, map string<->Long).\n *\n * Per IXO-2573, each write op should broadcast then the dispatcher re-fetches\n * via `get(...)` so `runtime.output` always holds the latest full\n * `CollectionState`. `get` is the read-only `refresh` primitive.\n */\nexport interface CollectionService {\n  /** Read the full current on-chain state of a collection. */\n  get: (params: { collectionId: string }) => Promise<CollectionState>;\n  /** Broadcast `MsgCreateCollection`. Returns the new collectionId + tx hash. */\n  create: (params: CollectionCreateParams) => Promise<{ transactionHash: string; collectionId: string }>;\n  /** Broadcast `MsgUpdateCollectionState`. */\n  updateState: (params: { collectionId: string; state: CollectionStateEnum; adminAddress: string }) => Promise<{ transactionHash: string }>;\n  /** Broadcast `MsgUpdateCollectionDates`. */\n  updateDates: (params: { collectionId: string; startDate?: string; endDate?: string; adminAddress: string }) => Promise<{ transactionHash: string }>;\n  /** Broadcast `MsgUpdateCollectionQuota`. `quota` carried as a string; `0` = unlimited. */\n  updateQuota: (params: { collectionId: string; quota: string; adminAddress: string }) => Promise<{ transactionHash: string }>;\n  /** Broadcast `MsgUpdateCollectionPayments`. */\n  updatePayments: (params: { collectionId: string; payments: Payments; adminAddress: string }) => Promise<{ transactionHash: string }>;\n  /** Broadcast `MsgUpdateCollectionIntents`. */\n  updateIntents: (params: { collectionId: string; intents: CollectionIntentOptions; adminAddress: string }) => Promise<{ transactionHash: string }>;\n}\n\n/**\n * Claim-collection user-management service (IXO-2586). The editor declares the\n * contract only; the consumer app implements each method (build/broadcast the\n * claims-module authz messages, query authz grants, classify addresses,\n * enumerate group members). Extends → replaces the reactive `bid` service.\n */\nexport interface CollectionUsersService {\n  /**\n   * Grant submit/evaluate authz for ONE collection to a grantee. The handler\n   * reads the grantee's existing authz for the role's msgTypeUrl and APPENDS a\n   * per-collection constraint (preserving other collections' live values),\n   * then broadcasts `MsgCreateClaimAuthorization` routed via\n   * `MsgGrantEntityAccountAuthz` (entity admin = granter). See IXO-2589.\n   */\n  grant: (params: {\n    granterAdminAddress: string;\n    granteeAddress: string;\n    collectionId: string;\n    role: CollectionUserRole;\n    agentQuota?: string;\n    maxAmount?: CollectionCoin[];\n    intentDurationNs?: string;\n    deedDid?: string;\n  }) => Promise<{ transactionHash: string }>;\n  /**\n   * Grant the SAME collection/role/limits to MANY grantees in ONE transaction\n   * (IXO-4396). Every grantee gets its own authorization message (each still\n   * appending to that grantee's own existing constraints), but all of them are\n   * broadcast together so the user signs once.\n   *\n   * The dispatcher caps a call at `COLLECTION_USERS_MAX_GRANTS_PER_TX`\n   * grantees and issues consecutive calls beyond that, so an implementation\n   * never has to chunk for gas itself.\n   *\n   * OPTIONAL: hosts that predate the bulk grant don't implement it, and the\n   * dispatcher falls back to one `grant` (= one signature) per grantee.\n   */\n  grantMany?: (params: {\n    granterAdminAddress: string;\n    granteeAddresses: string[];\n    collectionId: string;\n    role: CollectionUserRole;\n    agentQuota?: string;\n    maxAmount?: CollectionCoin[];\n    intentDurationNs?: string;\n    deedDid?: string;\n  }) => Promise<{ transactionHash: string }>;\n  /**\n   * Per-collection read-modify-write revoke (IXO-2590). Reads the grantee's\n   * live authz, drops the target collection's constraint, and — when other\n   * constraints remain — broadcasts a single atomic tx ordered\n   * `[MsgRevokeEntityAccountAuthz, then one MsgCreateClaimAuthorization per\n   * remaining constraint]`, preserving each remaining constraint's live\n   * (decremented) quota/limits. Short-circuits to a plain revoke when the\n   * target was the only constraint.\n   */\n  revoke: (params: { granterAdminAddress: string; granteeAddress: string; collectionId: string; role: CollectionUserRole }) => Promise<{ transactionHash: string }>;\n  /**\n   * List the grantees holding a submit/evaluate constraint for a collection.\n   * Queries authz grants against the entity admin account, decodes the\n   * authorizations, and filters constraints by `collectionId` (IXO-2591).\n   */\n  list: (params: { granterAdminAddress: string; collectionId: string }) => Promise<{ grantees: CollectionGrantee[] }>;\n  /** Classify an address as a plain user vs a DAO DAO contract (IXO-2592). */\n  classifyAddress: (params: { address: string }) => Promise<AddressClassification>;\n  /** Enumerate the members of a group account for grant fan-out (IXO-2592). */\n  enumerateMembers: (params: { groupAddress: string }) => Promise<{ members: CollectionMember[] }>;\n}\n\nexport interface MatrixCredentialService {\n  storeCredential: (params: { roomId: string; credentialKey: string; credential: Record<string, any>; cid: string }) => Promise<{ storedAt: string; duplicate: boolean }>;\n}\n\nexport interface FundingVerificationService {\n  verify: (params: {\n    deploymentNetwork: 'testnet' | 'mainnet';\n    fundingAuthorityDid: string;\n    sourceAccountRef: string;\n    sourceAccountType: 'provider_wallet' | 'outcome_buyer_treasury' | 'deed_entity_account' | 'external_treasury';\n    payout: { denom: string; amount: string };\n    minimumAvailable: { denom: string; amount: string };\n    claimantAddressResolution: {\n      method: 'claim_subject_address' | 'verified_wallet_link' | 'provider_registry';\n      resolverServiceRef: string;\n      proofRequired: true;\n    };\n  }) => Promise<{\n    sourceAccountRef: string;\n    deploymentNetwork: 'testnet' | 'mainnet';\n    availableBalance: { denom: string; amount: string };\n    supportedDenominations: string[];\n    claimantAddressResolutionVerified: true;\n    requestDigest: string;\n    balanceDigest: string;\n    receiptRef: string;\n    observedAt: string;\n  }>;\n}\n\nexport interface CredentialIssuanceService {\n  issueAndDeliver: (params: {\n    credentialType: string;\n    issuerDid: string;\n    subjectDid: string;\n    yoId: string;\n    claims: Record<string, unknown>;\n    evidenceRefs: string[];\n    deliveryChannel: 'yoid_wallet' | 'ixo_portal' | 'both';\n  }) => Promise<{\n    credentialId: string;\n    credential: Record<string, unknown>;\n    requestDigest: string;\n    issuanceReceiptRef: string;\n    deliveryReceiptRef: string;\n    verificationReceiptRef: string;\n    verificationStatus: 'verified';\n  }>;\n}\n\nexport interface YomaOpportunityService {\n  execute: (params: {\n    operation: 'publish' | 'update' | 'pause' | 'withdraw';\n    providerOrganisationId: string;\n    opportunityId?: string;\n    deedDid: string;\n    opportunity: Record<string, unknown>;\n  }) => Promise<{\n    opportunityId: string;\n    status: 'published' | 'paused' | 'withdrawn';\n    requestDigest: string;\n    receiptRef: string;\n    observedAt: string;\n  }>;\n}\n\nexport interface YoIdLinkService {\n  execute: (params: { operation: 'link' | 'verify' | 'unlink'; participantDid: string; yoId: string; opportunityId: string; consentReceiptRef: string }) => Promise<{\n    bindingId: string;\n    status: 'linked' | 'verified' | 'unlinked';\n    requestDigest: string;\n    receiptRef: string;\n    observedAt: string;\n  }>;\n}\n\nexport interface OutcomeCertificateService {\n  issueAndVerify: (params: {\n    collectionId: string;\n    methodologyRef: string;\n    issuerDid: string;\n    claimIds: string[];\n    evidenceDigest: string;\n    period: { start: string; end: string };\n    outcomeBuyer?: {\n      buyerDid: string;\n      commitmentRef: string;\n      purchaseTrigger: 'certificate_issued' | 'certificate_verified' | 'manual_acceptance';\n    };\n    tokenisation?: {\n      enabled: boolean;\n      network?: 'testnet' | 'mainnet';\n      assetClass?: string;\n      transferPolicyRef?: string;\n      marketServiceRef?: string;\n    };\n  }) => Promise<{\n    certificateId: string;\n    credential: Record<string, unknown>;\n    requestDigest: string;\n    aggregateDigest: string;\n    issuanceReceiptRef: string;\n    verificationReceiptRef: string;\n    verificationStatus: 'verified';\n    tokenisationReceiptRef?: string;\n    buyerSettlementReceiptRef?: string;\n    settlementStatus?: 'settled';\n  }>;\n}\n\n/** Result of any integration tool execution (direct or via a binding). */\nexport interface IntegrationExecuteOutcome {\n  successful: boolean;\n  data?: Record<string, unknown>;\n  error?: string;\n  code?: 'OK' | 'VALIDATION' | 'AUTH_EXPIRED' | 'UPSTREAM_4XX' | 'UPSTREAM_5XX' | 'RATE_LIMIT' | 'UNKNOWN';\n  /** Signed, non-secret invocation receipt returned by the integration host. */\n  providerInvocationReceipt?: {\n    id: string;\n    provider: string;\n    issuedAt: string;\n    issuer: string;\n    invocationDigest: string;\n    resultDigest: string;\n    signature: string;\n  };\n}\n\n/**\n * The author-authorised connection a delegated block stores in its template\n * config. Holds only opaque references — never a credential. Clones verbatim\n * from template to flow; runners execute against it without connecting\n * anything. The binding lives on the worker keyed by `bindingId`; expiry (if\n * the underlying OAuth dies) surfaces at execute time, not as a stored field.\n */\nexport interface BoundConnection {\n  /** Opaque, template-scoped reference to the author's stored credential. */\n  bindingId: string;\n  /** The underlying platform account id (for display / ownership only). */\n  connectedAccountId: string;\n  /** Toolkit slug, e.g. 'gmail'. Kept as a plain string for core portability. */\n  toolkit: string;\n  /** Human label captured at bind time, e.g. \"you@ixo.world\". */\n  label: string | null;\n}\n\nexport interface IntegrationsService {\n  executeTool: (args: { toolSlug: string; connectedAccountId: string; arguments: Record<string, unknown> }) => Promise<IntegrationExecuteOutcome>;\n  fetchCurrentState?: (args: { toolSlug: string; connectedAccountId: string; arguments: Record<string, unknown> }) => Promise<Record<string, unknown>>;\n  getEntityDid?: () => string | undefined;\n  /**\n   * Execute a tool on the template author's behalf via an opaque, server-side\n   * binding (delegated blocks). The runner never holds the author's\n   * credential — `bindingId` selects it on the worker. Returns the same\n   * outcome shape as `executeTool`.\n   */\n  executeBinding?: (args: { bindingId: string; toolSlug: string; arguments: Record<string, unknown> }) => Promise<IntegrationExecuteOutcome>;\n}\n\nexport interface OracleService {\n  // Note: oracle handlers are single-network. The consumer-side handler\n  // resolves the chain network and matrix homeserver from its own\n  // DefaultChainNetwork — the editor never passes them in.\n  generateWallet: () => Promise<{\n    address: string;\n    did: string;\n    pubKey: string;\n    mnemonic: string;\n  }>;\n  /**\n   * Transfer tokens to `address`.\n   *\n   * - `amount` is in the denom's BASE units (uixo, not IXO) — the editor never\n   *   guesses an exponent, so a 0-decimal token like CARBON works unchanged.\n   * - `denom` is the on-chain base denom. Omitted means `uixo`, which is what\n   *   every flow saved before multi-token support relied on.\n   * - `fromAddress` is the wallet the tokens leave. Omitted means the\n   *   signed-in user's own wallet (a direct MsgSend). Any other address must\n   *   be one the signed-in user can act on — the host wraps the send in an\n   *   authz `MsgExec` with the user as grantee.\n   */\n  fundWallet: (params: { address: string; amount: number; denom?: string; fromAddress?: string }) => Promise<{ transactionHash: string }>;\n  createIidDocument: (params: { mnemonic: string; did: string; address: string; pubKey: string }) => Promise<{ did: string; transactionHash: string }>;\n  registerMatrixAccount: (params: { mnemonic: string; address: string; did: string; pin: string; oracleName: string; avatarUrl?: string }) => Promise<{\n    matrixUserId: string;\n    matrixAccessToken: string;\n    matrixRoomId: string;\n    matrixDeviceId: string;\n    matrixMnemonic: string;\n    matrixPassword: string;\n    matrixRecoveryPhrase: string;\n    matrixHomeServerUrl: string;\n  }>;\n  createOracleEntity: (params: {\n    mnemonic: string;\n    address: string;\n    did: string;\n    pubKey: string;\n    pin: string;\n    matrixAccessToken: string;\n    matrixRoomId: string;\n    oracleName: string;\n    orgName: string;\n    description: string;\n    location: string;\n    logoUrl: string;\n    coverImageUrl: string;\n    apiUrl: string;\n    price: number;\n    llmModel: string;\n    opening?: string;\n    communicationStyle?: string;\n    capabilities?: string;\n    mcpConfig?: any;\n    parentProtocol?: string;\n  }) => Promise<{\n    entityDid: string;\n    transactionHash: string;\n    /** Multibase-encoded P-256 public key registered as a keyAgreement vm on the oracle entity DID. */\n    encryptionPublicKeyMultibase: string;\n    /** DID verification method id of the P-256 keyAgreement key. */\n    encryptionVerificationMethodId: string;\n  }>;\n  /**\n   * Contract the oracle: ensure the user↔oracle Matrix DM room exists and\n   * the user has joined it. Pure Matrix work — no chain calls, no key setup.\n   * Returns the user↔oracle room id which downstream steps (storeSecrets,\n   * storeConfig) write into.\n   */\n  contract: (params: { oracleEntityDid: string }) => Promise<{\n    userOracleRoomId: string;\n    userOracleRoomAlias: string;\n  }>;\n  provisionSandbox: (params: { entityDid: string; matrixRoomId: string }) => Promise<{ sandboxUrl: string; status: string }>;\n  storeSecrets: (params: {\n    matrixRoomId: string;\n    publicKeyMultibase: string;\n    verificationMethodId: string;\n    // For fresh mxLogin → fresh MATRIX_ORACLE_ADMIN_ACCESS_TOKEN value\n    matrixHomeServerUrl: string;\n    matrixUsername: string;\n    matrixPassword: string;\n    // Plaintext secrets — handler JWE-encrypts to oracle pubkey before sending\n    secrets: Record<string, string>;\n    // Already JWE-encrypted secrets — handler writes them to the room as-is\n    preEncryptedSecrets?: Record<string, string>;\n  }) => Promise<{ storedSecrets: string[]; roomId: string; freshAccessToken?: string }>;\n  /** JWE-encrypts a single plaintext value to the oracle's P-256 public key (multibase).\n   *  Used by storeSecrets FlowDetail to encrypt user-typed OpenRouter key at-rest. */\n  encryptForOracle: (params: { plaintext: string; publicKeyMultibase: string }) => Promise<{ jwe: string }>;\n  /** Reads `ixo.room.secret.index` state events from the matrix room and returns the\n   *  list of secret names already stored. Used for idempotency checks. */\n  readStoredSecrets: (params: { matrixRoomId: string }) => Promise<{ secretNames: string[] }>;\n  /** Returns the network-derived .env constants (RPC URL, matrix homeserver, etc.)\n   *  for the consumer's currently configured network. Used by the storeSecrets\n   *  FlowDetail's \"Additional Configuration\" display section, and merged into the\n   *  storeConfig state event by the consumer handler. Must be deterministic per network. */\n  getNetworkConstants: (params: { oracleName: string }) => Promise<{\n    constants: Record<string, string>;\n  }>;\n  validateMcpServer: (params: { url: string; authType?: 'bearer' | 'api-key' | 'none'; authToken?: string }) => Promise<{\n    success: boolean;\n    tools?: Array<{ name: string; description?: string }>;\n    error?: string;\n  }>;\n  storeConfig: (params: {\n    matrixRoomId: string;\n    config: {\n      oracleName: string;\n      orgName: string;\n      description: string;\n      location: string;\n      price: number;\n      apiUrl: string;\n      entityDid: string;\n      logoUrl: string;\n      llmModel: string;\n      opening?: string;\n      communicationStyle?: string;\n      capabilities?: string;\n      skills?: string[];\n      mcpServers?: Array<{ name: string; url: string; description?: string; authEnvVar?: string }>;\n      matrixUserId?: string;\n      matrixAccountRoomId?: string;\n      oracleAddress?: string;\n      oracleDid?: string;\n    };\n  }) => Promise<{ configStored: boolean; roomId: string }>;\n  deploySetup: (params: {\n    name: string;\n    config: Record<string, any>;\n    roomId: string;\n    secrets?: Record<string, string>;\n  }) => Promise<{ setupComplete: boolean; stdout?: string; stderr?: string }>;\n  deployStart: (params: { name: string; entityDid: string; roomId: string; secrets?: Record<string, string> }) => Promise<{ processId: string; status: string; url?: string }>;\n  updateOracleDomain: (params: { entityDid: string; newApiUrl: string }) => Promise<{ transactionHash: string }>;\n}\n\n/**\n * Carbon credit batch service (IXO-2675). The editor declares the contract\n * only; the consumer app implements each method (run the owner/admin\n * reconciliation read, build + broadcast the harvest grant/exec pair and the\n * retire message, sign via its own wallet/SignX). Both writes are USER-signed\n * — the editor never signs on the user's behalf.\n */\nexport interface CarbonService {\n  /**\n   * Reconcile the user's owner-side and entity-admin-side batches into the\n   * unified view. Pure read (no signing). Performs provenance recovery for\n   * transferred batches so every `harvestableBatch` carries `entityDid` +\n   * `adminAddress`. See technical doc §3–§4.\n   */\n  loadBatches: (params: { ownerAddress: string }) => Promise<{\n    harvestableBatches: CarbonHarvestableBatch[];\n    retireableBatches: CarbonRetireableBatch[];\n    totalClaimable: number;\n    totalAvailable: number;\n    totalRetired: number;\n  }>;\n  /**\n   * Harvest (claim) the given batches: per entity, grant the owner authz to\n   * transfer out of the entity admin account, then exec that transfer into\n   * the owner's wallet (ordered pairs, 30-min grant). User-signed. See §5.2.\n   */\n  harvest: (params: {\n    ownerAddress: string;\n    tokens: Array<{ id: string; entityDid: string; adminAddress: string; claimable: number }>;\n  }) => Promise<{ transactionHash: string; harvestedBatchIds: string[]; harvestedAmount: number }>;\n  /**\n   * Retire (burn/offset) the given amounts from the owner's wallet. Single\n   * owner-signed `MsgRetireToken`. Irreversible. `jurisdiction` arrives\n   * pre-composed as a string (default \"Global\"); `reason` defaults to\n   * \"offset\". See §5.1.\n   */\n  retire: (params: {\n    owner: string;\n    reason?: string;\n    jurisdiction?: string;\n    tokens: Array<{ id: string; amount: number }>;\n  }) => Promise<{ transactionHash: string; retiredBatchIds: string[]; retiredAmount: number }>;\n}\n\n/**\n * Entity (domain) ownership service (IXO-2696). The editor declares the\n * contract only; the consumer app implements `transfer` — resolve a group\n * recipient to its DAO controller, ensure the recipient has an IID document,\n * build + broadcast `MsgTransferEntity`, and sign via its own wallet/SignX.\n * USER-signed and IRREVERSIBLE — the editor never signs on the user's behalf.\n */\nexport interface EntityService {\n  /**\n   * Transfer ownership of `entityDid` to `recipientDid`. The consumer resolves\n   * a `did:ixo:entity:` group recipient to its `did:ixo:wasm:` controller\n   * (reported back as `recipientResolved` when changed) and creates the\n   * recipient's IID document first if it is missing (`createdRecipientIid`).\n   * `ownerDid`/`ownerAddress` default to the connected user inside the host.\n   * Proof of a real transfer is the returned `transactionHash`.\n   */\n  transfer: (params: {\n    entityDid: string;\n    recipientDid: string;\n    ownerDid?: string;\n    ownerAddress?: string;\n  }) => Promise<{ transactionHash: string; recipientResolved?: string; createdRecipientIid?: boolean }>;\n}\n\n/**\n * KYC verification service (qi/kyc.verify). The editor declares the contract\n * only; the consumer app implements each method against its KYC server\n * (create/read the ComplyCube evaluation, mint the hosted verification URL,\n * persist the SD-JWT credential to the user's Matrix vault). The server's\n * status is the single source of truth for the lifecycle\n * (`verify → review → clear → issuing → issued → complete`, failure states\n * `rejected|attention|error`, plus `unknown`) — the editor only polls it.\n *\n * PII boundary: survey answers flow INTO `initiate` but never back out —\n * action outputs carry only `credentialCid`, `credentialType`, `protocolId`,\n * and `status`.\n */\nexport interface KycService {\n  /**\n   * Load the KYC protocol's details form + the user's current server-side\n   * state. `credentialType` is the vault index key of the credential this\n   * protocol issues (e.g. 'kycamllevel1' | 'kycamllevel2'); hosts default it\n   * to level 1 when omitted — `hasExistingCredential` refers to THAT type\n   * only, so a level-2 flow is never satisfied by a level-1 credential.\n   */\n  loadForm(params: { protocolDid: string; credentialType?: string }): Promise<{\n    protocolId: string;\n    claimCollectionId?: string;\n    deedOfferId?: string;\n    surveyJson: Record<string, unknown>;\n    hasExistingCredential: boolean;\n    /** Non-PII metadata of matching Vault credentials, oldest first. */\n    existingCredentials?: Array<{ cid: string; credentialType: string; storedAt?: string; issuerDid?: string }>;\n    status: string;\n  }>;\n  /** Submit the details form; the server creates the ComplyCube evaluation. */\n  initiate(params: { protocolId: string; claimCollectionId?: string; deedOfferId?: string; data: Record<string, unknown> }): Promise<{ status: string }>;\n  /** Mint the hosted-webview verification URL for the user's evaluation. */\n  getVerificationUrl(params: { protocolId: string }): Promise<{ url: string }>;\n  /** Read the current server-side lifecycle status. */\n  getStatus(params: { protocolId: string }): Promise<{ status: string }>;\n  /**\n   * Save the issued SD-JWT credential to the user's Matrix vault room and\n   * move the server status to `complete`. Idempotent — re-saving an\n   * already-saved credential of the same `credentialType` returns the\n   * existing CID (defaults to level 1 when omitted).\n   */\n  saveCredential(params: { protocolId: string; credentialType?: string; credentialCid?: string }): Promise<{ credentialCid: string; credentialType: string }>;\n}\n\nexport interface DesignPodLinkedResourceV1 {\n  id: string;\n  type: string;\n  description: string;\n  serviceEndpoint: string;\n  proof: string;\n  mediaType: string;\n  encrypted: string;\n  right: string;\n}\n\nexport interface DesignPodTransactionStatusV1 {\n  status: 'not_found' | 'pending' | 'succeeded' | 'failed';\n  observedAt: string;\n  transactionHash?: string;\n  code?: number;\n  height?: string;\n}\n\nexport interface DesignPodService {\n  /** Persist one approved revision through a fresh entity-VFS UCAN and verify its bytes/CID. */\n  persistArtifact(params: {\n    designProjectEntityDid: string;\n    controlId: DesignPodControlId;\n    revision: number;\n    digest: string;\n    content: Record<string, unknown>;\n  }): Promise<Omit<DesignPodArtifactReceiptV1, 'schemaVersion' | 'controlId' | 'digest'>>;\n  /** Re-read VFS metadata, CID bytes, and canonical content before trusting a cached receipt. */\n  verifyArtifactReceipt(params: {\n    designProjectEntityDid: string;\n    revision: DesignPodControlRevisionV1;\n    receipt: DesignPodArtifactReceiptV1;\n  }): Promise<Omit<DesignPodArtifactReceiptV1, 'schemaVersion' | 'controlId' | 'digest'>>;\n  /** Cryptographically verify the exact signed Flow invocation and its authority chain. */\n  verifyInvocation: DesignPodInvocationVerifier;\n  /** Persist a deterministic release package, in file order, with domain.md last. */\n  persistRelease(params: { designProjectEntityDid: string; release: CompiledDesignPodReleaseV1 }): Promise<{\n    packageRoot: string;\n    files: Array<{ id: string; path: string; version: number; contentHash: string; cid: string; verifiedAt: string }>;\n    domainCid: string;\n    domainServiceEndpoint: string;\n  }>;\n  /** Read the deterministic IXO linked resource from the authoritative chain index. */\n  verifyPublicationReceipt(params: { designProjectEntityDid: string; releaseDigest: string; linkedResource: DesignPodLinkedResourceV1 }): Promise<{\n    status: 'published' | 'not_found';\n    verifiedAt: string;\n    linkedResource?: DesignPodLinkedResourceV1;\n  }>;\n  /** Build and submit the existing Portal SignX linked-resource transaction. */\n  broadcastPublication(params: {\n    designProjectEntityDid: string;\n    linkedResource: DesignPodLinkedResourceV1;\n    memo: string;\n    onBroadcast: (transactionHash: string) => void;\n  }): Promise<{ transactionHash: string }>;\n  /** Read transaction status from the Portal's authoritative IXO RPC adapter. */\n  getTransactionStatus(transactionHash: string): Promise<DesignPodTransactionStatusV1>;\n  /**\n   * Mint the customer's own protocol entity from the published release and unpack\n   * the package into it: operational Flow templates published to its navigation,\n   * package files attached as linked resources. The host picks the entity type\n   * from the release's method — the design project's own protocol is NOT used as\n   * a class, so the mint inherits none of the design machinery.\n   */\n  mintProtocol(params: {\n    designProjectEntityDid: string;\n    release: CompiledDesignPodReleaseV1;\n    title: string;\n    /** Resume an interrupted mint: unpack into this protocol instead of creating another. */\n    resumeEntityDid?: string;\n    /** Fires the moment the entity is on chain, before unpacking, so the caller can record a resumable reference. */\n    onEntityCreated?: (protocol: { entityDid: string; entityType: string; transactionHash?: string }) => void;\n  }): Promise<{\n    entityDid: string;\n    entityType: string;\n    templates: Array<{ id: string; roomId: string }>;\n    resources: Array<{ id: string; serviceEndpoint: string }>;\n    failures: string[];\n    transactionHash?: string;\n    mintedAt: string;\n  }>;\n}\n\nexport interface DomainVfsService {\n  /** Persist the signed private domain credential and domain.md, in that order. */\n  persistDomainPackage(params: { entityDid: string; name: string; signedCredential: Record<string, unknown>; domainMarkdown: string }): Promise<{\n    credentialCid: string;\n    credentialServiceEndpoint: string;\n    domainCid: string;\n    domainServiceEndpoint: string;\n    receipts: Array<{ id: string; path: string; version: number; contentHash: string; cid: string; verifiedAt: string }>;\n  }>;\n}\n\nexport interface FlowRunLifecycleService {\n  start(params: { actorDid: string; flowId: string; flowUri?: string; label?: string }): Promise<{ runId: string; eventId?: string; startedAt?: number }>;\n  close(params: {\n    actorDid: string;\n    flowId: string;\n    flowUri?: string;\n    runId: string;\n    allowIncomplete?: boolean;\n    authorization?: RunTerminalAuthorizationProof;\n  }): Promise<{ status: 'closed'; eventId?: string; closedAt?: number }>;\n  cancel(params: {\n    actorDid: string;\n    flowId: string;\n    flowUri?: string;\n    runId: string;\n    reason?: string;\n    authorization?: RunTerminalAuthorizationProof;\n  }): Promise<{ status: 'cancelled'; eventId?: string; cancelledAt?: number }>;\n}\n\nexport interface FlowInvocationService {\n  /** Verify a signed Flow invocation retained in Matrix without domain coupling. */\n  verifyInvocation: DesignPodInvocationVerifier;\n}\n\n/**\n * Evaluation-Engine enrollment service (qi/eval.register — pull-claim-spec §6).\n * The editor declares the contract only; the consumer app implements each\n * method. All three signing/HTTP steps live host-side (the portal owns the\n * oracle-DID default, the delegation's capability list, the UCAN mints, and the\n * HTTP). The editor only orchestrates the calls. See the\n * module comment in `actions/evalRegister/evalRegister.ts` for the one-signed-step\n * flow. All-or-nothing group (see adapters.ts).\n */\nexport interface EvalRegisterService {\n  /**\n   * Prompt the user for their verification PIN — the user-authorization gate for\n   * the host-signed enrollment (primes the host signer session the delegation\n   * mint uses). Same primitive as `ClaimService.requestPin`; declared here so\n   * the composite action depends on this one service group.\n   */\n  requestPin: (config?: { title?: string; description?: string; submitText?: string }) => Promise<string>;\n  /**\n   * Mint the `owner → oracle` enrolment delegation host-side and return its\n   * serialized base64-CAR `token` (deposited into the UCAN Store). The host owns\n   * the oracle-DID default, the `issuerType:'user'` signing, and revocability —\n   * so the block passes nothing, or only the optional overrides\n   * (`oracleDid`, `ttlDays`).\n   *\n   * The host MUST grant BOTH capabilities — one delegation, two things the\n   * engine does on the owner's behalf:\n   *   - `{ can: '*',                 with: 'ixo:matrix-claims-bot' }`\n   *       read the collection's claim bodies out of Matrix.\n   *   - `{ can: 'subscriptions/read', with: 'ixo:subscriptions'    }`\n   *       ask subscriptions-api for the owner's ORACLE CLAIM COLLECTION, which\n   *       is the only account a per-claim fee can be billed to. subscriptions-api\n   *       resolves the acting user as the delegation ROOT, so an engine-signed\n   *       invocation proved by this delegation returns the OWNER's subscription.\n   *       Omit it and enrolment succeeds but the collection can never be billed —\n   *       the engine 403s the register with a \"re-register\" message rather than\n   *       recording that silently.\n   *\n   * Hosts SHOULD echo back the resolved `oracleDid` (the delegation audience) —\n   * the standard submit-authz grant derives the engine's grantee address from it\n   * when the block carries no explicit `oracleDid`/`oracleAddress` override.\n   */\n  mintBotDelegation: (params: { ttlDays?: number; oracleDid?: string; pin?: string; evalEngineUrl?: string }) => Promise<{ token: string; oracleDid?: string }>;\n  /**\n   * Deposit a delegation CAR into the UCAN Store\n   * (`POST {ucanStoreUrl}/api/delegations { token }`), authorized by a\n   * self-signed `store/add` invocation the host mints. `ucanStoreUrl` is\n   * optional — the host resolves it from its configured network when omitted.\n   */\n  depositDelegation: (params: { token: string; note?: string; ucanStoreUrl?: string }) => Promise<{ cid: string }>;\n  /**\n   * Register the collection with the Evaluation Engine\n   * (`POST {evalEngineUrl}/v1/collections/register\n   * { collectionId, deedDid, ownerDid, rubricId?, settings? }`), authorized\n   * host-side by a UCAN invocation on `ixo:eval-engine`. `evalEngineUrl` is\n   * optional — the host resolves it from its configured network when omitted.\n   * Idempotent upsert on `collectionId` (re-registering updates `settings` —\n   * that is the v1 \"change my mind\" path); returns the engine's registration\n   * `id`. `settings` gates the engine's paid check lanes per collection\n   * (eval-dashboard spec §B.1); the host forwards it verbatim.\n   */\n  registerCollection: (params: {\n    collectionId: string;\n    deedDid: string;\n    ownerDid: string;\n    rubricId?: string;\n    evalEngineUrl?: string;\n    /**\n     * Owner-typed collection name — the engine renders its billing notices as\n     * `Name (collection 913)` when set. Forwarded verbatim; the engine trims\n     * and caps it (120).\n     */\n    displayName?: string;\n    /**\n     * Owner-written description of what this collection collects — the context the engine's\n     * duplicate-claim judge is missing when it compares two submissions. Composed by the block\n     * from three plain questions (`evalRegister/description.ts`); the engine stores it as ONE\n     * opaque string (max 1000, never parsed). Same \"no opinion\" semantics as `displayName`:\n     * OMITTED leaves any stored description alone, an explicit `''` erases it — so hosts must\n     * forward the key only when it is actually present.\n     */\n    description?: string;\n    /**\n     * The address the engine sends this collection's billing notices to.\n     * Client-supplied on purpose — the owner naming their own notification\n     * address, not an authorization input. The action REQUIRES it before\n     * signing (owner, 2026-07-30), so hosts always receive one; the param\n     * stays optional only so older callers keep compiling.\n     */\n    notifyEmail?: string;\n    settings?: {\n      allowAiChecks: boolean;\n      allowImageChecks: boolean;\n      allowChainEvaluation: boolean;\n      /**\n       * Approve on chain even when the approval moves no money (attestation-only collections).\n       * Opt-IN, unlike the three above — see `EvalRegisterConfig.allowZeroPayoutApprovals`. Hosts\n       * must forward this key: the engine reads an absent `settings` as \"no opinion\" but a PRESENT\n       * settings object field-by-field, so a host that copies only the keys it knows silently\n       * turns this back off on every re-register.\n       */\n      allowZeroPayoutApprovals: boolean;\n    };\n  }) => Promise<{ id: string; collectionId?: string }>;\n}\n\n/**\n * Rubric publishing service (qi/eval.rubric — rubric-spec §C.1). The editor\n * declares the contract only; the consumer app implements it. `uploadRubric`\n * uploads the serialized JSON-LD document to Matrix media (the portal's\n * `publicUploadToMatrix`: public HTTP media URL + sha256 content proof — NOT\n * the generic `publicFileUpload`, which returns an empty proof). `pinRubric`\n * is the optional best-effort engine notification: the host forwards the new\n * `rubricId` to the evaluation engine's register upsert; the engine re-resolves\n * from chain regardless, so failures never fail a run.\n */\n/**\n * The result of a live §A.14 external-source test — the host makes the real\n * HTTP call (UCAN-signed to the source's `audience`) with the author's sample\n * values and reports back what happened, so the builder can show ✅/❌ without\n * ever judging a claim itself. `reachable`/`httpStatus` describe the transport,\n * `contractOk`/`value`/`reason` the answer, `error` any failure in the author's\n * words, and `sent` the exact payload that went on the wire.\n */\nexport interface SourcePreviewResult {\n  ok: boolean;\n  reachable: boolean;\n  httpStatus: number | null;\n  contractOk: boolean;\n  expect: 'boolean' | 'score';\n  value: boolean | number | null;\n  reason: string | null;\n  error: string | null;\n  sent: Record<string, unknown>;\n  audience: string;\n  elapsedMs: number;\n}\n\n/**\n * The engine's verdict on a rubric BEFORE it is anchored (§C.7). `problems` carries schema\n * violations, binder issues against the LIVE claim form, and the one thing the editor cannot\n * check for itself — whether the collection's engine settings actually permit these rules.\n */\nexport interface RubricPreviewResult {\n  ok: boolean;\n  problems: { code: string; severity: 'error' | 'warning'; path: string; message: string }[];\n  settings: { allowAiChecks: boolean; allowImageChecks: boolean; allowChainEvaluation: boolean };\n}\n\nexport interface RubricService {\n  /**\n   * Upload the exact rubric bytes; returns the public media URL and the sha256\n   * hex OF THOSE BYTES — which IS the rubric's id and its on-chain proof\n   * (§A.10). An implementation must hash exactly what it stores and pass the\n   * pre-serialized `json` string through untouched (no re-encoding, no\n   * re-serialization), or the id stops identifying the document.\n   */\n  uploadRubric(params: { json: string; fileName?: string }): Promise<{ url: string; sha256: string }>;\n  /** Best-effort: tell the engine about the newly anchored rubric. Optional; never proof-bearing. */\n  pinRubric?(params: { collectionId: string; rubricId: string; evalEngineUrl?: string }): Promise<void>;\n  /**\n   * Ask the engine to check a rubric it has not seen yet (§C.7). Read-only — writes nothing and\n   * anchors nothing. Optional: a host without it falls back to the local Ajv shape gate, which is\n   * strictly weaker (no form binding, no settings check).\n   */\n  previewRubric?(params: {\n    collectionId: string;\n    rubric: unknown;\n    evalEngineUrl?: string;\n    /**\n     * True only on a user gesture that is ALREADY collecting a PIN (the publish step). Otherwise\n     * the host mints silently and returns `null` rather than interrupting authoring with a modal.\n     */\n    interactive?: boolean;\n    /**\n     * The engine settings the author INTENDS to enrol with — lets the engine judge AI rules\n     * truthfully before the collection is enrolled (the stored row doesn't exist yet, or is stale\n     * against the block's unexecuted toggles). Absent = the engine falls back to its stored row.\n     */\n    settings?: { allowAiChecks: boolean; allowImageChecks: boolean; allowChainEvaluation: boolean };\n  }): Promise<RubricPreviewResult | null>;\n  /**\n   * Fetch the engine's canonical rubric JSON Schema — a public GET of\n   * `/v1/rubric-schema` (§A.12). `run()` compiles it once with Ajv and validates\n   * the built envelope's SHAPE against it (the defense that the editor can never\n   * publish a shape the engine rejects). `evalEngineUrl` is optional — the host\n   * resolves it from its configured network when omitted.\n   */\n  getRubricSchema?: (evalEngineUrl?: string) => Promise<object>;\n  /**\n   * Test a single §A.14 external source live (§B.5): the host makes the real\n   * UCAN-signed HTTP call to `source.audience` with the author's `sampleValues`\n   * (one per `send` key) and returns what happened. Optional — the builder\n   * disables the Test button and shows a hint when a host hasn't wired it.\n   */\n  testExternalSource?: (params: { source: object; sampleValues?: Record<string, string | number | boolean> }) => Promise<SourcePreviewResult>;\n  /**\n   * Resolve a §A.14 source's `did:web:` audience from its endpoint — a public\n   * host read (no signing, no PIN), so the builder can auto-fill `audience`\n   * instead of asking the author to paste a DID. `resolved:false` (or an absent\n   * handler) falls back to a manual `audience` box; `audience` stays REQUIRED.\n   */\n  resolveSourceDid?: (params: { endpoint: string }) => Promise<{ did: string | null; resolved: boolean; error: string | null }>;\n  /**\n   * The protocol entity's existing `#rub` LinkedResource — its on-chain `id`\n   * EXACTLY as stored (may be the literal template `{id}#rub`) and `proof` —\n   * or `null` when the entity carries none. Read by `run()` before anchoring:\n   * IID has no update, so republishing must DELETE the existing resource and\n   * add the new one in the SAME transaction (delete first), or the chain\n   * rejects the add as a duplicated resource id (x/iid). THROWS on a genuine\n   * query failure — the publish must stop rather than add-and-fail on chain.\n   */\n  getRubricResource?: (params: { protocolDid: string }) => Promise<{ id: string; proof: string } | null>;\n}\n\n/**\n * The full service contract an action execution context can carry. Composed\n * from the per-domain service interfaces above so consumers can implement and\n * type one domain at a time; the runtime shape is unchanged.\n */\nexport interface ActionServices {\n  designPod?: DesignPodService;\n  flowInvocation?: FlowInvocationService;\n  domainVfs?: DomainVfsService;\n  fundingVerification?: FundingVerificationService;\n  credentialIssuance?: CredentialIssuanceService;\n  yomaOpportunity?: YomaOpportunityService;\n  yoId?: YoIdLinkService;\n  outcomeCertificate?: OutcomeCertificateService;\n  /** Explicit session lifecycle capability supplied by browser/headless hosts. */\n  flowRuns?: FlowRunLifecycleService;\n  http?: HttpService;\n  email?: EmailService;\n  notify?: NotifyService;\n  bid?: BidService;\n  claim?: ClaimService;\n  collection?: CollectionService;\n  collectionUsers?: CollectionUsersService;\n  matrix?: MatrixCredentialService;\n  integrations?: IntegrationsService;\n  oracle?: OracleService;\n  carbon?: CarbonService;\n  entity?: EntityService;\n  kyc?: KycService;\n  evalRegister?: EvalRegisterService;\n  rubric?: RubricService;\n  /** Supplied only to Topic-native bridge/actions after a separate UCAN check. */\n  topic?: TopicService;\n  agents?: AgentRuntimeService;\n  evidence?: EvidenceService;\n  evaluations?: EvaluationRuntimeService;\n  settlement?: SettlementService;\n  incidents?: IncidentService;\n}\n\nexport interface OutputSchemaField {\n  path: string;\n  displayName: string;\n  type: 'string' | 'number' | 'boolean' | 'object' | 'array';\n  description?: string;\n  /**\n   * For `type === 'array'`: the shape of each element. Drives item-scoped\n   * reference pickers (e.g. the Xero invoice LineItems iterative mapper,\n   * where each cell refs into `{{item.<field>}}`).\n   */\n  itemSchema?: OutputSchemaField[];\n}\n\n/**\n * A typed event that an action can emit when it runs.\n *\n * Events drive the trigger/listener model: another block can declare a\n * `block.event` trigger on a (sourceBlockId, eventName) pair, and when this\n * action emits a matching event, a pending invocation is queued on the\n * listener block. See `docs/flow-engine/events-and-triggers-plan.md` for the full model.\n */\nexport interface ActionEventDefinition {\n  /** Stable identifier — used in trigger declarations and ref strings. */\n  name: string;\n  /** Human-readable label shown in the trigger picker UI. */\n  displayName: string;\n  /** Short description shown as inline hint in the trigger picker. */\n  description: string;\n  /** Schema of the event payload. Same shape as `outputSchema`. */\n  payloadSchema: OutputSchemaField[];\n  /**\n   * Field paths from `payloadSchema` (in order) shown inline in the\n   * pending-invocation list so the assignee can distinguish queued\n   * invocations at a glance. E.g. `['claimId', 'evaluatedAt']`.\n   */\n  pendingDisplayFields?: string[];\n}\n\n/**\n * Declares what counts as proof that this action's side effect actually\n * happened. Enforced centrally by `executeActionBlock`: a run that returns\n * success without satisfying its proof declaration is recorded as\n * `state: 'failed'` (code `PROOF_MISSING`), never as `completed`.\n *\n * - `{ fields }` — at least one of the listed output paths (dot notation\n *   allowed) must be truthy. Empty arrays and `false` do not count.\n * - `{ validate }` — custom predicate over the raw output.\n * - `'none'` — explicit opt-out for actions with no side effect to prove\n *   (pure selection/config actions). Must be stated, not omitted.\n */\nexport type ActionProofDeclaration = { fields: string[] } | { validate: (output: Record<string, unknown>) => boolean } | 'none';\n\nexport interface ActionRunContext {\n  runId: string;\n  flowId?: string;\n  flowUri?: string;\n  actorDid?: string;\n  nodeId?: string;\n  /** Read-only service capabilities available to `done.check`. */\n  services?: ActionServices;\n  /** Read-only consumer handlers available to `done.check` (Blocksync reads and the like). */\n  handlers?: ActionHandlers;\n  now: number;\n}\n\nexport interface CompletionCheck {\n  done: boolean | 'unknown';\n  source: string;\n  output?: Record<string, unknown>;\n  reason?: string;\n}\n\n/**\n * Canonical completion semantics for one run of an action. Every registered\n * action declares one — see {@link ActionDefinition.done}.\n */\nexport interface ActionDoneContract<TInputs extends Record<string, any> = Record<string, any>> {\n  /** Pure fold used by session summaries and the default close condition. */\n  isDone: (actionState: FlowNodeRuntimeState, runContext: ActionRunContext) => boolean;\n  /** Optional side-effect-free external read used by explicit reconciliation. */\n  check?: (params: { inputs: TInputs; actionState: FlowNodeRuntimeState; ctx: ActionRunContext }) => Promise<CompletionCheck>;\n  /**\n   * Done is a snapshot of outstanding work, not a latch. A negative `check`\n   * against a completed entry means new work arrived, so reconciliation merges\n   * the check output and keeps the entry completed instead of moving it to\n   * human verification. Only meaningful with `cardinality: 'many'`.\n   */\n  reopenable?: boolean;\n}\n\n/**\n * How an action behaves when fired by a schedule rather than a human\n * (Sovereign Scheduling, IXO-4433; vocabulary from @ixo/scheduling-contracts).\n * Serializable — it crosses the manifest JSON boundary unchanged.\n */\nexport interface ActionSchedulingContract {\n  /** R0 no external effect · R1 reversible/own-resources · R2 irreversible or third-party-visible · R3 money/on-chain (approval work only). */\n  riskTier: 'R0' | 'R1' | 'R2' | 'R3';\n  /** Misfire policies this action supports. There is deliberately no fire_all. */\n  misfirePolicies: Array<'run_once_immediately' | 'skip'>;\n  overlapPolicies: Array<'skip' | 'queue' | 'allow'>;\n  approvalRequirement: 'none' | 'single' | 'multi_party';\n  /** How a duplicate dispatch is made harmless. R1+ requires at least one. */\n  idempotencyStrategy: 'idempotency_key' | 'read_back' | 'both';\n  inputModes: Array<'snapshot_at_activation' | 'snapshot_at_event' | 'resolve_at_fire' | 'operator_at_approval'>;\n  /** Run scopes: fire into the open run, or start a new run per occurrence. */\n  runModes: Array<'per_flow_run' | 'new_run_per_occurrence'>;\n}\n\nexport interface ActionDefinition<TInputs extends Record<string, any> = Record<string, any>> {\n  type: string;\n\n  /**\n   * Semver identity of the portable execution contract. Pre-vNext\n   * registrations inherit the registry-wide v4 baseline; vNext manifests\n   * must still pin and sign each exact contract digest.\n   */\n  contractVersion: string;\n\n  /** Canonical, non-technical presentation used by every registry consumer. */\n  displayName: string;\n  /** Canonical plain-language explanation of what the Action does. */\n  description: string;\n\n  /** UCAN-style ability string used by the flow compiler, e.g., \"bid/submit\". */\n  can?: string;\n\n  // Policy\n  sideEffect: boolean;\n  defaultRequiresConfirmation: boolean;\n  requiredCapability?: string;\n\n  /**\n   * Require a persisted UCAN invocation even while the repository-wide\n   * temporary enforcement switch is disabled. Use this for governed state\n   * transitions whose durable records carry an invocation CID.\n   */\n  requiresSignedInvocation?: boolean;\n\n  /**\n   * Who performs the execution once inputs are complete.\n   *\n   * - 'agent' (the default) — a headless orchestrator may run `run()` itself\n   *   or delegate it to a capable oracle.\n   * - 'human' — only a human surface (Portal FlowDetail) may execute: the\n   *   side effect needs an authority the orchestrator does not hold, e.g. a\n   *   chain transaction signed as the entity admin. Orchestrators still\n   *   gather inputs and notify the human, but must never run or delegate\n   *   the action themselves.\n   */\n  executionOwner?: 'agent' | 'human';\n\n  /** Portable registry policy; normalized for every public manifest entry. */\n  riskTier?: ActionRiskTier;\n  /** Host capabilities/services required before this Action is offered. */\n  requiredServices?: string[];\n  /** Input/output paths that must never be copied into shared Topic state. */\n  sensitiveInputPaths?: string[];\n  sensitiveOutputPaths?: string[];\n  /** Topic compatibility contract owned by the canonical Action registry. */\n  topic?: TopicActionMetadata;\n\n  /**\n   * Hide this action from authoring surfaces (action-type pickers, step\n   * palettes) so no new blocks of this type can be added. The action stays\n   * registered: existing docs and templates keep rendering and executing.\n   * Use for deprecated actions superseded by a newer type.\n   */\n  hiddenFromAuthoring?: boolean;\n  /** Machine-readable lifecycle for external registry consumers. */\n  deprecated?: boolean;\n  /** Canonical replacement when deprecated. */\n  supersededBy?: string;\n\n  /** Proof-of-execution declaration. See {@link ActionProofDeclaration}. */\n  proof: ActionProofDeclaration;\n\n  /**\n   * How many times this action is meant to run within a single flow.\n   *\n   * - 'once' (the default) — a one-shot step that reaches a terminal\n   *   `completed` state and is then Done.\n   * - 'many' — a standing, repeatable capability that can fire any number of\n   *   times on a cadence the flow (not the action) decides — e.g. submitting a\n   *   claim every month. A repeatable block never latches to a terminal Done:\n   *   a `completed` runtime entry means \"has fired at least once\", and its real\n   *   progress is the count of successful runs in the audit trail, not this\n   *   single summary entry. Such blocks never withhold the flow.\n   */\n  cardinality?: 'once' | 'many';\n\n  /**\n   * Canonical completion semantics for a run. Required: every action states\n   * how one of its runs folds to Done, and `isActionDone` consults nothing\n   * else. Most actions are Done when the run reached `completed` and use the\n   * shared {@link doneWhenCompleted} contract; repeatable (`many`) actions use\n   * {@link neverDone}. Declare a bespoke contract when Done-ness depends on an\n   * output field, a quota, or an external system (see `qi/kyc.verify`).\n   */\n  done: ActionDoneContract<TInputs>;\n\n  /**\n   * How dynamic resolver results combine with the static `events` /\n   * `outputSchema` baselines. 'merge' (the default) dedupes by event name /\n   * field path with the dynamic entry winning; 'replace' hands the resolver\n   * full control of the vocabulary (needed e.g. to hide the baseline until\n   * configuration is complete).\n   */\n  dynamicResolutionMode?: 'merge' | 'replace';\n\n  // Validation (optional, wire JSON Schema later)\n  inputSchema?: object;\n\n  /**\n   * Machine-readable mirror of the required-input preamble in `run()`: given a\n   * fully-merged inputs object, returns the names of inputs still missing or\n   * blank (empty array = ready to execute). External orchestrators call this\n   * via `getMissingActionInputs` BEFORE queuing execution so a missing input\n   * becomes a prompt to a human rather than a failed run.\n   *\n   * Only define this when requiredness is conditional — it branches on other\n   * inputs (skip flags, group types, either-of-two-fields) and therefore\n   * cannot be derived from `inputSchema.required`, which is the default\n   * derivation. Keep it directly above `run()` and keep the two in lockstep:\n   * every presence throw in `run()` must be predicted here. Presence only —\n   * value validity (ranges, formats, duplicates) stays in `run()`.\n   */\n  getMissingInputs?: (inputs: TInputs) => string[];\n\n  /** Static output schema for action types with predictable output (e.g. email.send).\n   *  For action types with dynamic output (e.g. http.request), the schema is user-defined in inputs. */\n  outputSchema?: OutputSchemaField[];\n\n  /**\n   * Typed vocabulary of events this action can emit. Drives the trigger\n   * picker UI and compile-time validation of `block.event` triggers.\n   */\n  events?: ActionEventDefinition[];\n\n  /**\n   * Optional per-block event resolver. Called with the block's current\n   * template inputs; returns the event vocabulary that applies to this\n   * specific block.\n   *\n   * Use this when the event schema depends on configuration the designer\n   * picks at template time. For example, `qi/claim.submit` only knows the\n   * shape of `surveyAnswers` once a claim collection has been chosen —\n   * returning `[]` until then hides the block from the trigger picker.\n   *\n   * Consumers (trigger picker, flow compiler, event payload picker) prefer\n   * `getDynamicEvents(inputs)` when defined and fall back to static `events`\n   * otherwise. By default the result is MERGED with the static `events`\n   * baseline (deduped by name, dynamic wins). Set\n   * `dynamicResolutionMode: 'replace'` when the resolver must control the\n   * full vocabulary (e.g. returning [] to hide the baseline).\n   */\n  getDynamicEvents?: (inputs: TInputs) => ActionEventDefinition[];\n\n  /**\n   * Optional per-block output-schema resolver. Symmetric to `getDynamicEvents`\n   * but for `outputSchema` — drives the reference picker for `${block.field}`\n   * refs so survey-derived fields like `output.surveyAnswers.<question>` show\n   * up alongside the static baseline.\n   *\n   * By default the returned array is MERGED with the static `outputSchema`\n   * baseline (deduped by path, dynamic wins); `dynamicResolutionMode:\n   * 'replace'` gives the resolver full control.\n   */\n  getDynamicOutputSchema?: (inputs: TInputs) => OutputSchemaField[];\n\n  /**\n   * Whether this action can be wired to a `block.event` trigger.\n   * False (the default) for user-interaction-driven actions like forms,\n   * claims, and evaluations — they always run as `manual`. True for actions\n   * where it makes sense for an event to nudge a human assignee to invoke\n   * them (email, http, notify).\n   *\n   * The trigger picker UI is hidden for blocks whose action type has this\n   * set to false.\n   */\n  eligibleForEventTrigger?: boolean;\n\n  /**\n   * Whether this action can be the target of a time trigger (Sovereign\n   * Scheduling, IXO-4433). False (the default) keeps an action manual-only:\n   * a schedule that names an ineligible action fails at both compilation and\n   * activation. Distinct from `eligibleForEventTrigger` — an action can be\n   * event-nudgeable but not safe to fire unattended on a timer.\n   */\n  eligibleForTimeTrigger?: boolean;\n\n  /**\n   * Timed Action contract (IXO-4433, delivery plan §9.3). Required when\n   * `eligibleForTimeTrigger` is true — an action that may fire unattended\n   * must declare how late it may fire, what happens on overlap, its risk\n   * tier, whether a human approves, and how a duplicate dispatch is made\n   * harmless. R3 actions never complete from a timer; they create approval\n   * work only. Tenants may RAISE the tier, never lower it.\n   */\n  scheduling?: ActionSchedulingContract;\n\n  // Execution\n  run: (inputs: TInputs, ctx: ActionContext) => Promise<ActionResult>;\n}\n\n/**\n * Result returned by an action's `run()` function.\n *\n * The optional `events` array is the explicit emission surface — actions\n * declare which named events they're emitting on this particular run, with\n * the payload by value. The runtime persists these as part of the run record\n * and the reconciliation loop turns them into pending invocations on\n * subscribed listener blocks.\n */\nexport interface ActionResult {\n  output: Record<string, any>;\n  /** Optional semantic records; the bridge accepts only types declared by the Action. */\n  topicRecords?: TopicActionRecord[];\n  events?: Array<{ name: string; payload: Record<string, any> }>;\n  completion?: {\n    state?: 'completed' | 'awaiting_readback';\n    readBack?: Record<string, any>;\n  };\n}\n","import { TOPIC_ACTION_BASE_KINDS, type ActionDefinition, type ActionRiskTier, type TopicActionBaseKind, type TopicActionMetadata } from './types';\nimport { getTopicSemanticRecordDefinitions } from './topicSemanticRecords';\n\nexport interface NormalizedActionPolicy {\n  executionOwner: 'agent' | 'human';\n  riskTier: ActionRiskTier;\n  requiredServices: string[];\n  sensitiveInputPaths: string[];\n  sensitiveOutputPaths: string[];\n  topic: TopicActionMetadata;\n}\n\nconst ALL_KINDS = [...TOPIC_ACTION_BASE_KINDS];\n\nconst HUMAN_OWNED = [\n  /^qi\\/human\\./,\n  /^qi\\/governance\\./,\n  /^qi\\/proposal\\./,\n  /^qi\\/(claim|bid)\\.(submit|evaluate)$/,\n  /^qi\\/(domain\\.sign|entity\\.|iid\\.|identity\\.|kyc\\.)/,\n  /^qi\\/(carbon\\.(harvest|retire)|wallet\\.fund)/,\n  // qi/xero.invoice.create and qi/xero.payment.create are deliberately absent:\n  // they are agent-owned. A headless runner contracts them out to the Xero\n  // helper oracle through @ixo/flow-work, and that oracle acts on the user's\n  // own delegated Composio authority, so no human surface is needed at\n  // execution time. qi/xero.payment.create stays riskTier 'high' — risk and\n  // execution owner are separate decisions.\n  /^qi\\/settlement\\./,\n  /^qi\\/topic\\.(flow\\.(bind|unbind)|status\\.transition|contract\\.accept|outcome\\.confirm)$/,\n  /^qi\\/work\\.accept$/,\n  /^qi\\/answer\\.accept$/,\n];\n\nconst RESTRICTED = [/^qi\\/oracle\\.(configure|deploy|store)/i, /^qi\\/(matrix\\.register|sandbox\\.provision|entity\\.createOracle|wallet\\.generate)/];\n\nfunction any(patterns: RegExp[], value: string): boolean {\n  return patterns.some((pattern) => pattern.test(value));\n}\n\nfunction requiredServices(type: string): string[] {\n  if (type.startsWith('qi/http.')) return ['http'];\n  if (type === 'qi/email.send') return ['email'];\n  if (type === 'qi/notification.push') return ['notifications'];\n  if (/^qi\\/(gmail|outlook|slack|googlecalendar|calendar|xero)\\./.test(type)) return ['integrations'];\n  if (/^qi\\/flow\\.run\\./.test(type)) return ['flowRuns'];\n  if (/^qi\\/blueprint\\./.test(type)) return ['blueprint'];\n  if (/^qi\\/bid\\./.test(type)) return ['bid'];\n  if (/^qi\\/claim\\./.test(type)) return ['claim'];\n  if (type === 'qi/collection.lifecycle') return ['collection'];\n  if (type === 'qi/collection.users') return ['collectionUsers'];\n  if (/^qi\\/(matrix\\.dm|credential\\.store)/.test(type)) return ['matrix'];\n  if (/^qi\\/(oracle\\.|wallet\\.|iid\\.|matrix\\.register|identity\\.|entity\\.createOracle|sandbox\\.)/.test(type) || type === 'qi/oracle.invoke') return ['oracle'];\n  if (/^qi\\/carbon\\./.test(type)) return ['carbon'];\n  if (/^qi\\/entity\\.transfer/.test(type)) return ['entity'];\n  if (/^qi\\/kyc\\./.test(type)) return ['kyc'];\n  if (/^qi\\/eval\\./.test(type)) return ['evalRegister', 'rubric'];\n  if (/^qi\\/topic\\./.test(type)) return ['topic'];\n  if (/^qi\\/agent\\./.test(type)) return ['agents'];\n  if (/^qi\\/evidence\\./.test(type)) return ['evidence'];\n  if (/^qi\\/evaluation\\./.test(type)) return ['evaluations'];\n  if (/^qi\\/settlement\\./.test(type)) return ['settlement'];\n  if (/^qi\\/incident\\.escalate/.test(type)) return ['incidents'];\n  if (/^qi\\/(work|answer|incident\\.mitigation)\\./.test(type)) return ['topic'];\n  if (/^qi\\/(governance|proposal|domain\\.)\\./.test(type)) return ['portalHandlers'];\n  return [];\n}\n\nfunction riskTier(action: ActionDefinition): ActionRiskTier {\n  const type = action.type;\n  if (/^qi\\/(settlement\\.execute|carbon\\.retire)$/.test(type)) return 'critical';\n  if (/^qi\\/(governance\\.|claim\\.evaluate|entity\\.transfer|domain\\.sign|xero\\.payment\\.create|wallet\\.fund)/.test(type)) return 'high';\n  if (!action.sideEffect || /\\.(list|loadBatches|card-preview|fetch)$/.test(type)) return 'low';\n  return 'medium';\n}\n\nfunction sensitivePaths(type: string): Pick<NormalizedActionPolicy, 'sensitiveInputPaths' | 'sensitiveOutputPaths'> {\n  const input: string[] = [];\n  const output: string[] = [];\n  if (type.startsWith('qi/http.')) {\n    input.push('headers.authorization', 'headers.cookie', 'headers.x-api-key', 'body');\n    output.push('data', 'response');\n  }\n  if (/^qi\\/(email|gmail|outlook|slack|notification|matrix\\.dm)/.test(type)) {\n    input.push('to', 'cc', 'bcc', 'body', 'template', 'variables');\n    output.push('providerResponse');\n  }\n  if (/^qi\\/(gmail|outlook|slack|googlecalendar|calendar|xero)\\./.test(type)) input.push('connection', 'bindingId');\n  if (/^qi\\/(kyc|credential)\\./.test(type)) {\n    input.push('data', 'credential');\n    output.push('credential', 'surveyAnswers');\n  }\n  if (/^qi\\/(oracle\\.|wallet\\.|iid\\.|matrix\\.register|identity\\.|entity\\.createOracle|sandbox\\.)/.test(type)) {\n    input.push('mnemonic', 'pin', 'secrets', 'config');\n    output.push('mnemonic', 'privateKey', 'matrixAccessToken', 'matrixPassword', 'matrixRecoveryPhrase', 'secrets');\n  }\n  if (type === 'qi/oracle.invoke') {\n    input.push('prompt');\n    output.push('result');\n  }\n  if (/^qi\\/(form|human\\.form|claim|bid)\\./.test(type)) {\n    input.push('answers', 'surveyAnswers', 'surveyData');\n    output.push('answers', 'surveyAnswers', 'surveyData');\n  }\n  return { sensitiveInputPaths: [...new Set(input)].sort(), sensitiveOutputPaths: [...new Set(output)].sort() };\n}\n\nfunction topicKindsAndRelevance(type: string): { supportedBaseKinds: TopicActionBaseKind[]; relevance: TopicActionMetadata['relevance'] } {\n  if (any(RESTRICTED, type)) return { supportedBaseKinds: ['agent_task'], relevance: 'restricted' };\n  if (/^qi\\/flow\\.run\\./.test(type)) return { supportedBaseKinds: ALL_KINDS, relevance: 'recommended' };\n  if (/^qi\\/(oracle\\.invoke|agent\\.)/.test(type)) return { supportedBaseKinds: ['agent_task', 'question', 'task'], relevance: 'recommended' };\n  if (/^qi\\/(governance\\.|proposal\\.|topic\\.decision)/.test(type)) return { supportedBaseKinds: ['proposal', 'discussion', 'evaluation'], relevance: 'recommended' };\n  if (/^qi\\/(eval\\.|evaluation\\.)/.test(type)) return { supportedBaseKinds: ['evaluation', 'claims'], relevance: 'recommended' };\n  if (/^qi\\/(claim\\.|collection\\.|settlement\\.)/.test(type)) return { supportedBaseKinds: ['claims', 'evaluation'], relevance: 'recommended' };\n  if (/^qi\\/(work\\.)/.test(type)) return { supportedBaseKinds: ['task', 'discussion', 'incident'], relevance: 'recommended' };\n  if (/^qi\\/(evidence\\.|answer\\.)/.test(type)) return { supportedBaseKinds: ['question', 'evaluation'], relevance: 'recommended' };\n  if (/^qi\\/incident\\./.test(type)) return { supportedBaseKinds: ['incident'], relevance: 'recommended' };\n  if (/^qi\\/topic\\./.test(type)) return { supportedBaseKinds: ALL_KINDS, relevance: 'recommended' };\n  if (/^qi\\/(http\\.|domain\\.card-preview|calendar\\.|googlecalendar\\.)/.test(type))\n    return { supportedBaseKinds: ['question', 'evaluation', 'agent_task', 'task'], relevance: 'contextual' };\n  if (/^qi\\/(email\\.|gmail\\.|outlook\\.|slack\\.|matrix\\.dm|notification\\.)/.test(type)) {\n    return { supportedBaseKinds: ['task', 'question', 'discussion', 'incident'], relevance: 'contextual' };\n  }\n  return { supportedBaseKinds: ALL_KINDS, relevance: 'contextual' };\n}\n\nfunction topicSemanticRecords(type: string): string[] {\n  if (/^qi\\/(governance\\.|proposal\\.)/.test(type)) return ['org.ixo.topic.proposal-receipt'];\n  if (/^qi\\/claim\\.submit/.test(type)) return ['org.ixo.topic.claim-submission'];\n  if (/^qi\\/claim\\.evaluate/.test(type)) return ['org.ixo.topic.claim-evaluation'];\n  if (/^qi\\/evaluation\\./.test(type)) return ['org.ixo.topic.evaluation-assertion'];\n  return [];\n}\n\n/** Resolve complete registry metadata without changing an Action's authority. */\nexport function normalizeActionPolicy(action: ActionDefinition): NormalizedActionPolicy {\n  const sensitive = sensitivePaths(action.type);\n  const topicSelection = topicKindsAndRelevance(action.type);\n  const semanticRecords = topicSemanticRecords(action.type);\n  const declaredTopic = action.topic;\n  const sensitiveInputPaths = [...new Set([...(action.sensitiveInputPaths || []), ...sensitive.sensitiveInputPaths])].sort();\n  const sensitiveOutputPaths = [...new Set([...(action.sensitiveOutputPaths || []), ...sensitive.sensitiveOutputPaths])].sort();\n\n  return {\n    executionOwner: action.executionOwner || (any(HUMAN_OWNED, action.type) ? 'human' : 'agent'),\n    riskTier: action.riskTier || riskTier(action),\n    requiredServices: [...new Set(action.requiredServices || requiredServices(action.type))].sort(),\n    sensitiveInputPaths,\n    sensitiveOutputPaths,\n    topic: declaredTopic\n      ? {\n          ...declaredTopic,\n          semanticRecordTypes: declaredTopic.semanticRecordTypes || getTopicSemanticRecordDefinitions(declaredTopic.permittedTopicRecordTypes),\n          permittedTopicRecordTypes: (declaredTopic.semanticRecordTypes || getTopicSemanticRecordDefinitions(declaredTopic.permittedTopicRecordTypes)).map(\n            (definition) => definition.type\n          ),\n        }\n      : {\n          ...topicSelection,\n          writeBackMode: semanticRecords.length > 0 ? 'semantic-record' : 'receipt-only',\n          semanticRecordTypes: getTopicSemanticRecordDefinitions(semanticRecords),\n          permittedTopicRecordTypes: semanticRecords,\n          lifecycleEffect: 'none',\n          requiredTopicAbilities: ['topic/request-action', 'topic/record-action'],\n          redactionPolicy: { mode: 'paths', sensitiveInputPaths, sensitiveOutputPaths },\n        },\n  };\n}\n","import { canToType, typeToCan } from './canMapping';\nimport type { ActionDefinition, ActionDoneContract, ActionEventDefinition, OutputSchemaField } from './types';\nimport { warnOnce } from '../warnOnce';\nimport { normalizeActionPolicy } from './topicPolicy';\nimport { getActionPresentation } from './presentation';\n\nconst actions = new Map<string, ActionDefinition>();\n\n/** Initial version assigned to action registrations authored before per-action versions existed. */\nexport const LEGACY_ACTION_CONTRACT_VERSION = '4.0.0';\n\nlet registryRevision = 0;\n\n/**\n * Bumped by every {@link registerAction}. Derived artefacts that are expensive to\n * rebuild — the Action Manifest above all — cache against this instead of\n * recomputing per call, and stay correct when an Action module is imported late.\n */\nexport function getRegistryRevision(): number {\n  return registryRevision;\n}\n\n/** Stable name of the universal completion event every step emits. */\nexport const STEP_COMPLETED_EVENT_NAME = 'step.completed';\n\n/**\n * The universal completion event. Every step emits this when it completes, on\n * top of whatever domain events its action declares. It exists so that:\n *  - any step can be sequenced off a predecessor (\"run after X\") via a\n *    `(X, step.completed)` trigger, regardless of the source action's events;\n *  - every completion is auditable (a run record is always written).\n */\nexport const STEP_COMPLETED_EVENT: ActionEventDefinition = {\n  name: STEP_COMPLETED_EVENT_NAME,\n  displayName: 'Completed',\n  description: 'Fires when this step is completed.',\n  payloadSchema: [],\n};\n\n/**\n * The default Done contract: a one-shot step is Done once its run reached\n * `completed`.\n *\n * The fold reads only the run state because proof of execution is enforced\n * where the completion is *written* — `executeActionBlock` records a success\n * that lacks the action's declared proof as `failed` (`PROOF_MISSING`) — and\n * re-checked at the trust boundary by `verifyCompletion`, which is what\n * trigger reconciliation, flow-agent planning and the completion badge gate on.\n *\n * Actions whose Done-ness is not simply the run state — it depends on an\n * output field, a quota, or an external system — declare their own contract\n * instead (see `qi/kyc.verify`).\n */\nexport const doneWhenCompleted: ActionDoneContract = {\n  isDone: (state) => state.state === 'completed',\n};\n\n/**\n * Done contract for repeatable capabilities (`cardinality: 'many'`): a\n * standing block fires as often as the flow decides and never latches to a\n * terminal Done, so its fold is always false. Real progress for these blocks\n * is the count of successful runs in the audit trail, not the summary entry.\n */\nexport const neverDone: ActionDoneContract = {\n  isDone: () => false,\n};\n\n/** Maps legacy action type names to their canonical namespaced names. */\nconst ACTION_TYPE_ALIASES: Record<string, string> = {\n  oracle: 'qi/oracle.invoke',\n  bid: 'qi/bid.submit',\n  claim: 'qi/claim.submit',\n  evaluateBid: 'qi/bid.evaluate',\n  evaluateClaim: 'qi/claim.evaluate',\n  'email.send': 'qi/email.send',\n  'http.request': 'qi/http.request',\n  'form.submit': 'qi/form.submit',\n  'human.form.submit': 'qi/human.form.submit',\n  'human.checkbox.set': 'qi/human.checkbox.set',\n  'notification.push': 'qi/notification.push',\n  'proposal.create': 'qi/proposal.create',\n  'proposal.vote': 'qi/proposal.vote',\n  'protocol.select': 'qi/protocol.select',\n  'domain.sign': 'qi/domain.sign',\n  'domain.card-preview': 'qi/domain.card-preview',\n  'credential.store': 'qi/credential.store',\n  // POD setup flow — camelCase orchestrator labels → canonical action types\n  DomainIndexerLookup: 'qi/pod.domain-indexer-lookup',\n  DomainSingleSelection: 'qi/pod.domain-single-selection',\n  EntitySingleSelection: 'qi/pod.entity-single-selection',\n  MemberMultiSelect: 'qi/pod.member-multi-select',\n  governanceConfig: 'qi/pod.governance-config',\n  listDomainFlows: 'qi/pod.list-domain-flows',\n  'matrix.dm': 'qi/matrix.dm',\n  // The qi/calendar.* namespace is retired permanently (IXO-4420 §5): these\n  // blocks were always Google Calendar via Composio, misnamed as neutral.\n  // Aliases keep every existing document loading; because resolveActionType\n  // checks aliases before registered types, no new canonical action can ever\n  // be registered under these names — the IXO-native calendar (M4) takes\n  // qi/ixo.calendar.event.* instead.\n  'qi/calendar.event.create': 'qi/googlecalendar.event.create-self',\n  'qi/calendar.event.update': 'qi/googlecalendar.event.update-self',\n  'qi/calendar.event.list': 'qi/googlecalendar.event.list-self',\n  // Topic v3 called setup confirmation \"accept contract\". Persisted Flow\n  // documents keep that action key, so resolve it to the v4 confirmation\n  // contract while new documents use the canonical name.\n  'qi/topic.contract.accept': 'qi/topic.contract.confirm-setup',\n};\n\nconst aliases = new Map<string, string>(Object.entries(ACTION_TYPE_ALIASES));\n\n/** Resolves a legacy action type name to its canonical namespaced name. */\nexport function resolveActionType(type: string): string {\n  return aliases.get(type) ?? type;\n}\n\n/** Normalize UCAN `can` abilities to the canonical slash vocabulary. */\nexport function normalizeCan(can: string): string {\n  const trimmed = can.trim();\n  const lastDot = trimmed.lastIndexOf('.');\n  if (!trimmed.includes('/') && lastDot > 0) {\n    return `${trimmed.slice(0, lastDot)}/${trimmed.slice(lastDot + 1)}`;\n  }\n  return trimmed;\n}\n\n/**\n * Normalize UCAN capability patterns while accepting dotted legacy aliases.\n * Patterns follow the same vocabulary as abilities, so this delegates to\n * {@link normalizeCan} (`claim.*` → `claim/*`, `xero.invoice.*` → `xero.invoice/*`).\n */\nexport function normalizeCapabilityPattern(pattern: string): string {\n  return normalizeCan(pattern);\n}\n\n/** Resolve a registry action type to its canonical UCAN `can` ability. */\nexport function actionTypeToCan(type: string): string | undefined {\n  const resolvedType = resolveActionType(type.trim());\n  const registered = actions.get(resolvedType);\n  if (registered?.can) return normalizeCan(registered.can);\n\n  const mapped = typeToCan(resolvedType);\n  if (mapped) return normalizeCan(mapped);\n\n  if (!resolvedType.startsWith('qi/')) return undefined;\n  // Verb-last: `qi/calendar.event.create` → `calendar.event/create`, matching\n  // both `canMapping` entries and `normalizeCan`'s last-dot rule.\n  return normalizeCan(resolvedType.slice('qi/'.length));\n}\n\n/** Resolve a UCAN `can` ability to its canonical namespaced registry action type. */\nexport function canToActionType(can: string): string | undefined {\n  const normalizedCan = normalizeCan(can);\n  for (const action of actions.values()) {\n    if (action.can && normalizeCan(action.can) === normalizedCan) return action.type;\n  }\n\n  const mapped = canToType(normalizedCan);\n  if (mapped) return resolveActionType(mapped);\n\n  // Only single-slash abilities have a well-formed action type. Multi-slash\n  // abilities (e.g. serviceCan's `claim/evaluate/report`) have no `qi/…` type,\n  // and a `claim/`-style ability has no verb — report both as unmapped rather\n  // than synthesising a malformed type.\n  const segments = normalizedCan.split('/');\n  if (segments.length !== 2) return undefined;\n  const [namespace, verb] = segments;\n  if (namespace.length === 0 || verb.length === 0) return undefined;\n  return `qi/${namespace}.${verb}`;\n}\n\nexport interface CapabilityPatternCoversCanOptions {\n  allowGlobalWildcard?: boolean;\n}\n\n/** Return true when a capability pattern grants the requested `can` ability. */\nexport function capabilityPatternCoversCan(pattern: string, can: string, options: CapabilityPatternCoversCanOptions = {}): boolean {\n  const normalizedPattern = normalizeCapabilityPattern(pattern);\n  const normalizedCan = normalizeCan(can);\n\n  if (normalizedPattern === '*') return options.allowGlobalWildcard === true;\n  if (normalizedPattern === normalizedCan) return true;\n  if (normalizedPattern.endsWith('/*')) {\n    const prefix = normalizedPattern.slice(0, -1);\n    return normalizedCan.startsWith(prefix);\n  }\n  return false;\n}\n\ntype ActionRegistrationDefinition<TInputs extends Record<string, any>> = Omit<ActionDefinition<TInputs>, 'displayName' | 'description' | 'contractVersion'> &\n  Partial<Pick<ActionDefinition<TInputs>, 'displayName' | 'description' | 'contractVersion'>>;\n\nexport function registerAction<TInputs extends Record<string, any> = Record<string, any>>(definition: ActionRegistrationDefinition<TInputs>): void {\n  // Preserve the registry's long-standing identity contract: callers that\n  // register a definition receive that same definition back from getAction().\n  // Manifest v4 metadata is therefore normalized onto the supplied object\n  // instead of replacing it with a clone.\n  const presentation = getActionPresentation(definition.type);\n  definition.displayName = definition.displayName?.trim() || presentation.displayName;\n  definition.description = definition.description?.trim() || presentation.description;\n  if (!definition.contractVersion?.trim()) {\n    definition.contractVersion = LEGACY_ACTION_CONTRACT_VERSION;\n  }\n  if (definition.can) definition.can = normalizeCan(definition.can);\n  Object.assign(definition, normalizeActionPolicy(definition as ActionDefinition));\n  // Every action states how one of its runs folds to Done; the registry\n  // guarantees the invariant so `isActionDone` can consult the contract\n  // unconditionally. The type requires it — this backfill only catches a\n  // plain-JS consumer registering an action written before the contract\n  // existed, which should warn rather than crash the completion fold.\n  if (!definition.done) {\n    warnOnce(`missing-done-contract:${definition.type}`, `[flow-config] action ${definition.type}: no done contract declared; defaulting to state === 'completed'`);\n    definition.done = doneWhenCompleted;\n  }\n  actions.set(definition.type, definition as ActionDefinition);\n  registryRevision += 1;\n}\n\nexport function getAction(type: string): ActionDefinition | undefined {\n  return actions.get(resolveActionType(type));\n}\n\nexport function getAllActions(): ActionDefinition[] {\n  return Array.from(actions.values());\n}\n\n/**\n * Whether an action type is a repeatable ('many') capability — a standing\n * block that can fire any number of times and never latches to a terminal\n * Done. Unknown types default to `false` (one-shot). See\n * {@link ActionDefinition.cardinality}.\n */\nexport function isRepeatableAction(type: string | undefined | null): boolean {\n  if (!type) return false;\n  return getAction(type)?.cardinality === 'many';\n}\n\n/** Whether an action is a standing capability that can never fold to Done. */\nexport function isNeverDoneAction(type: string | undefined | null): boolean {\n  if (!type) return false;\n  return getAction(type)?.done === neverDone;\n}\n\n/** All (alias → canonical type) pairs, for manifest generation and consistency checks. */\nexport function getAliasEntries(): Array<[string, string]> {\n  return Array.from(aliases.entries());\n}\n\nexport function hasAction(type: string): boolean {\n  return actions.has(resolveActionType(type));\n}\n\n/** Look up an action by its UCAN `can` ability string, e.g., \"bid/submit\". */\nexport function getActionByCan(can: string): ActionDefinition | undefined {\n  const normalizedCan = normalizeCan(can);\n  for (const action of actions.values()) {\n    if (action.can && normalizeCan(action.can) === normalizedCan) return action;\n  }\n  return undefined;\n}\n\n/**\n * Resolve the event vocabulary for a specific block given its template inputs.\n *\n * Prefers the action's `getDynamicEvents(inputs)` resolver (so actions can\n * derive event schemas from configured state — e.g. claim.submit deriving the\n * event payload from the picked collection's survey). Falls back to the static\n * `events` array when no resolver is defined.\n *\n * `inputs` may be a pre-parsed object, a JSON string, or missing entirely;\n * this helper absorbs parse failures so callers don't need to.\n */\nexport function getEventsForBlock(action: ActionDefinition | undefined, inputs: unknown): ActionEventDefinition[] {\n  if (!action) return [];\n\n  let events: ActionEventDefinition[];\n  if (action.getDynamicEvents) {\n    const parsed = normalizeInputs(inputs);\n    try {\n      const dynamic = action.getDynamicEvents(parsed) || [];\n      events = action.dynamicResolutionMode === 'replace' ? dynamic : mergeByKey(action.events || [], dynamic, (event) => event.name);\n    } catch (error) {\n      // A crashing resolver must not break the picker or compiler.\n      warnOnce(\n        `dynamic-events:${action.type}`,\n        `[flow-config] action ${action.type}: getDynamicEvents threw (${error instanceof Error ? error.message : String(error)}); no events resolved`\n      );\n      events = [];\n    }\n  } else {\n    events = action.events || [];\n  }\n\n  // Every step also emits the universal completion event, so any step can be a\n  // \"run after X\" trigger source. Skip if the action already declares one with\n  // that name (don't double-list).\n  if (events.some((event) => event.name === STEP_COMPLETED_EVENT_NAME)) {\n    return events;\n  }\n  return [...events, STEP_COMPLETED_EVENT];\n}\n\n/**\n * Resolve the output schema for a specific block. Symmetric to\n * `getEventsForBlock`: prefers `getDynamicOutputSchema(inputs)` when defined\n * so actions can derive their output shape from configured state (e.g.\n * `qi/claim.submit` exposing `output.surveyAnswers.<question>` once a\n * collection is picked). Falls back to the static `outputSchema`.\n */\nexport function getOutputSchemaForBlock(action: ActionDefinition | undefined, inputs: unknown): OutputSchemaField[] {\n  if (!action) return [];\n  if (action.getDynamicOutputSchema) {\n    const parsed = normalizeInputs(inputs);\n    try {\n      const dynamic = action.getDynamicOutputSchema(parsed) || [];\n      if (action.dynamicResolutionMode === 'replace') return dynamic;\n      return mergeByKey(action.outputSchema || [], dynamic, (field) => field.path);\n    } catch (error) {\n      warnOnce(\n        `dynamic-output-schema:${action.type}`,\n        `[flow-config] action ${action.type}: getDynamicOutputSchema threw (${error instanceof Error ? error.message : String(error)}); using static schema`\n      );\n      return action.outputSchema || [];\n    }\n  }\n  return action.outputSchema || [];\n}\n\n/**\n * Merge a static baseline with dynamic entries, deduping by key — the\n * dynamic entry wins on conflict, baseline order is preserved. Actions that\n * genuinely need to hide the baseline set `dynamicResolutionMode: 'replace'`.\n */\nfunction mergeByKey<T>(baseline: T[], dynamic: T[], keyOf: (item: T) => string): T[] {\n  const dynamicKeys = new Set(dynamic.map(keyOf));\n  return [...baseline.filter((item) => !dynamicKeys.has(keyOf(item))), ...dynamic];\n}\n\nfunction normalizeInputs(inputs: unknown): Record<string, any> {\n  if (!inputs) return {};\n  if (typeof inputs === 'object') return inputs as Record<string, any>;\n  if (typeof inputs === 'string') {\n    try {\n      const parsed = JSON.parse(inputs || '{}');\n      return parsed && typeof parsed === 'object' ? parsed : {};\n    } catch {\n      warnOnce(`inputs-normalize:${inputs}`, `[flow-config] block inputs are not valid JSON; treated as empty`);\n      return {};\n    }\n  }\n  return {};\n}\n","import type { Doc as YDoc, Map as YMap } from 'yjs';\n\n/**\n * Top-level Y.Doc map that owns all DM notification dedup state.\n *\n * Ignition Phase A prerequisite: these records used to squat as reserved\n * `__`-prefixed keys inside the flat `runtime` map. Run adoption iterates that\n * map and copies every entry into `runs[<runId>].actions`, so leaving them\n * there manufactures phantom \"actions\" that later get quantified over as if\n * they were blocks (close folds, `actions.forEach`, block counts).\n *\n * DM dedup state is flow-scoped, not run-scoped, so it gets its own map rather\n * than moving under a run.\n *\n * ## Why this module DUAL-WRITES rather than forking one-way\n *\n * The first cut of this move wrote only the new map and kept a **read-only**\n * fallback to the legacy keys. That forks dedup in one direction and reopens\n * the bug it was meant to close:\n *\n * - Before the move both generations shared one key, so dedup worked across\n *   them: whoever DM'd first, everyone saw it.\n * - After a one-way fork, an already-deployed client reads **only** the legacy\n *   key. Every block a new client notified is invisible to it, so it re-DMs the\n *   assignee — one duplicate per block, forever, for as long as an old tab is\n *   open.\n *\n * So writes go to **both** places, in one transaction, exactly as\n * `runs.ts#writeActionState` mirrors run state into the flat `runtime` map.\n * Both generations then converge on the same dedup facts.\n *\n * **This is safe only because the legacy keys are `__`-prefixed.**\n * `adoptLegacyRuntime` (`runs.ts`) skips every key starting with\n * `RESERVED_RUNTIME_KEY_PREFIX`, so writing them back into `runtime` cannot\n * leak a phantom \"action\" into `runs[<runId>].actions`. That coupling is\n * asserted in `dmNotificationState.test.ts` — if the prefix or these key names\n * ever change, that test fails rather than the leak shipping silently.\n *\n * ## The read rule: per-record freshness, NOT blanket precedence\n *\n * Both bags must be merged (an old client only ever writes the legacy one), but\n * a naive union with a fixed winner still misfires, because a dedup record is\n * **overwritten, not accumulated**: `shouldNotify` compares `assignedDid`, so a\n * reassignment rewrites the record for that block. Give either side blanket\n * precedence and the loser's *newer* record gets shadowed by the winner's\n * *older* one — `shouldNotify` sees the previous assignee, and the client\n * re-DMs someone who was already notified.\n *\n * The rule is therefore the same shape as `runs.ts#resolveActionState`: resolve\n * **per record**, newest `notifiedAt` wins, and on a tie the new map wins as a\n * deterministic tiebreak so every peer resolves an identical pair identically.\n * `notifiedAt` is stamped at DM time by whoever sent it, which makes it the\n * natural freshness key — the direct analogue of `executedAt`.\n */\nexport const DM_NOTIFICATIONS_MAP_KEY = 'dmNotificationState';\n\n/**\n * Sub-key inside {@link DM_NOTIFICATIONS_MAP_KEY} holding {@link DMNotificationState}.\n *\n * Also the legacy key inside the flat `runtime` map. The `__` prefix is\n * load-bearing: it is what makes run adoption skip it.\n */\nexport const DM_NOTIFICATIONS_KEY = '__dm_notifications';\n\n/**\n * Sub-key inside {@link DM_NOTIFICATIONS_MAP_KEY} holding {@link PendingDMNotificationState}.\n *\n * Also the legacy key inside the flat `runtime` map. See {@link DM_NOTIFICATIONS_KEY}.\n */\nexport const DM_NOTIFICATIONS_PENDING_KEY = '__dm_notifications_pending';\n\n/**\n * The flat map these records used to live in, and still do — as the Phase A\n * compat mirror that keeps already-deployed clients deduping against the same\n * facts new clients write.\n */\nconst LEGACY_RUNTIME_MAP_KEY = 'runtime';\n\nexport interface DMNotificationRecord {\n  /** DID of the assigned actor who was notified */\n  assignedDid: string;\n  /** Unix timestamp (ms) when the notification was sent */\n  notifiedAt: number;\n  /** Matrix user ID of whoever triggered the notification */\n  notifiedBy: string;\n}\n\nexport interface DMNotificationState {\n  [blockId: string]: DMNotificationRecord;\n}\n\n/**\n * Per-pending-invocation DM dedup state. Slice G of the events-and-triggers\n * feature. The original `DMNotificationState` is keyed by blockId only,\n * which is correct for activation-based notifications (one DM per block per\n * assignee change). Pending invocations need a finer key — each individual\n * queued invocation must produce exactly one DM, so the dedup key is\n * (blockId, pendingInvocationId).\n *\n * Stored under a separate sub-key so the existing `DMNotificationState`\n * surface stays unchanged for backward compat.\n */\nexport interface PendingDMNotificationState {\n  [blockId: string]: {\n    [pendingInvocationId: string]: DMNotificationRecord;\n  };\n}\n\nfunction getDMMap(yDoc: YDoc): YMap<any> {\n  return yDoc.getMap<any>(DM_NOTIFICATIONS_MAP_KEY);\n}\n\n/**\n * The legacy flat map.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: when nothing in this file references\n * `LEGACY_RUNTIME_MAP_KEY` (compat register item 7) — i.e. when no deployed\n * client reads or writes the `__dm_notifications*` keys any more.\n */\nfunction getLegacyMap(yDoc: YDoc): YMap<any> {\n  return yDoc.getMap<any>(LEGACY_RUNTIME_MAP_KEY);\n}\n\nfunction readRecordBag(map: YMap<any> | undefined, key: string): Record<string, any> {\n  return readNestedBag(map?.get(key));\n}\n\n/** `{}` unless the value is a usable plain-object bag. */\nfunction readNestedBag(value: unknown): Record<string, any> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};\n  return value as Record<string, any>;\n}\n\n/** `undefined` unless the value is a usable dedup record. */\nfunction asRecord(value: unknown): DMNotificationRecord | undefined {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;\n  return value as DMNotificationRecord;\n}\n\n/** A record with no usable timestamp sorts below every stamped one, above nothing. */\nfunction notifiedAtOf(record: DMNotificationRecord): number {\n  const at = record.notifiedAt;\n  return typeof at === 'number' && Number.isFinite(at) ? at : Number.NEGATIVE_INFINITY;\n}\n\n/**\n * Resolve one key's legacy-vs-current pair.\n *\n * Pure and deterministic: newer `notifiedAt` wins; on a tie (including two\n * records that both lack a usable timestamp) `current` wins. Every peer must\n * resolve a given pair identically or the two generations diverge again.\n */\nfunction resolveRecord(legacy: unknown, current: unknown): DMNotificationRecord | undefined {\n  const l = asRecord(legacy);\n  const c = asRecord(current);\n  if (!l) return c;\n  if (!c) return l;\n  return notifiedAtOf(l) > notifiedAtOf(c) ? l : c;\n}\n\nfunction unionKeys(a: Record<string, unknown>, b: Record<string, unknown>): string[] {\n  return Array.from(new Set([...Object.keys(a), ...Object.keys(b)]));\n}\n\n/**\n * Structural copy of a dedup bag.\n *\n * Yjs stores a plain-object value **by reference**, so handing the same object\n * to both maps would alias them: a later mutation through one silently rewrites\n * the other, and the doc records no change. Same discipline as\n * `runs.ts#writeActionState`, which builds three distinct objects for the same\n * reason.\n */\nfunction copyBag<T>(value: T): T {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return value;\n  const out: Record<string, unknown> = {};\n  for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {\n    out[key] = copyBag(nested);\n  }\n  return out as T;\n}\n\n/**\n * Write a dedup bag to the dedicated map **and** mirror it to the legacy key,\n * in one transaction so the two can never be observed half-updated.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: the legacy mirror goes when no deployed\n * client reads the `__dm_notifications*` keys out of the flat `runtime` map\n * (compat register item 7). Until then, dropping it makes an old tab re-DM\n * every assignee a new client already notified.\n */\nfunction writeDedupBag(yDoc: YDoc, key: string, next: Record<string, unknown>): void {\n  yDoc.transact(() => {\n    getDMMap(yDoc).set(key, copyBag(next));\n    // PHASE A COMPAT — REMOVAL TRIGGER: when no deployed client reads\n    // `runtime['__dm_notifications*']` (compat register item 7). Safe to write\n    // into `runtime` only because `adoptLegacyRuntime` skips `__`-prefixed keys.\n    getLegacyMap(yDoc).set(key, copyBag(next));\n  });\n}\n\n/**\n * Read the DM notification dedup state: the union of the dedicated map and the\n * legacy `runtime` key, resolved **per block** by {@link resolveRecord}.\n *\n * Union, because an already-deployed client only ever writes the legacy key, so\n * a whole-bag fallback would go blind to it the instant the new map became\n * non-empty. Per-record freshness rather than blanket precedence, because a\n * reassignment *overwrites* a block's record — see the module header.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: when the legacy side stops being written\n * (compat register item 7).\n */\nexport function getDMNotificationState(yDoc: YDoc): DMNotificationState {\n  const legacy = readRecordBag(getLegacyMap(yDoc), DM_NOTIFICATIONS_KEY);\n  const current = readRecordBag(getDMMap(yDoc), DM_NOTIFICATIONS_KEY);\n\n  const merged: DMNotificationState = {};\n  for (const blockId of unionKeys(legacy, current)) {\n    const winner = resolveRecord(legacy[blockId], current[blockId]);\n    if (winner) merged[blockId] = { ...winner };\n  }\n  return merged;\n}\n\n/**\n * Write a DM notification record for a block, merging with existing state.\n * Dual-writes the dedicated map and the legacy `runtime` key (one transaction),\n * so both client generations dedup against the same facts.\n */\nexport function setDMNotificationRecord(yDoc: YDoc, blockId: string, record: DMNotificationRecord): void {\n  const next: DMNotificationState = {\n    ...getDMNotificationState(yDoc),\n    [blockId]: { ...record },\n  };\n  writeDedupBag(yDoc, DM_NOTIFICATIONS_KEY, next);\n}\n\n/**\n * Check whether a DM notification should be sent for a given block.\n * Returns true if:\n * - No notification was ever sent for this block, OR\n * - The assigned DID has changed since the last notification\n */\nexport function shouldNotify(state: DMNotificationState, blockId: string, currentAssignedDid: string): boolean {\n  const existing = state[blockId];\n  if (!existing) return true;\n  return existing.assignedDid !== currentAssignedDid;\n}\n\n// ─── Pending invocation DM dedup (slice G) ──────────────────────────────────\n\n/**\n * Read the pending-invocation DM dedup state: the union of the dedicated map\n * and the legacy `runtime` key, resolved per (blockId, pendingInvocationId) by\n * {@link resolveRecord}. Same rule as {@link getDMNotificationState}, one level\n * deeper — `shouldNotifyPending` also compares `assignedDid`, so an individual\n * invocation's record can likewise be rewritten and must be resolved by\n * freshness rather than by which map it came from.\n */\nexport function getPendingDMNotificationState(yDoc: YDoc): PendingDMNotificationState {\n  const legacy = readRecordBag(getLegacyMap(yDoc), DM_NOTIFICATIONS_PENDING_KEY);\n  const current = readRecordBag(getDMMap(yDoc), DM_NOTIFICATIONS_PENDING_KEY);\n\n  const merged: PendingDMNotificationState = {};\n  for (const blockId of unionKeys(legacy, current)) {\n    const legacyBlock = readNestedBag(legacy[blockId]);\n    const currentBlock = readNestedBag(current[blockId]);\n    const block: Record<string, DMNotificationRecord> = {};\n    for (const invocationId of unionKeys(legacyBlock, currentBlock)) {\n      const winner = resolveRecord(legacyBlock[invocationId], currentBlock[invocationId]);\n      if (winner) block[invocationId] = { ...winner };\n    }\n    if (Object.keys(block).length > 0) merged[blockId] = block;\n  }\n  return merged;\n}\n\n/**\n * Record that a DM was sent for a specific (blockId, pendingInvocationId).\n * Dual-writes the dedicated map and the legacy `runtime` key (one transaction).\n */\nexport function setPendingDMNotificationRecord(yDoc: YDoc, blockId: string, pendingInvocationId: string, record: DMNotificationRecord): void {\n  const current = getPendingDMNotificationState(yDoc);\n  const blockState = current[blockId] || {};\n  const next: PendingDMNotificationState = {\n    ...current,\n    [blockId]: {\n      ...blockState,\n      [pendingInvocationId]: { ...record },\n    },\n  };\n  writeDedupBag(yDoc, DM_NOTIFICATIONS_PENDING_KEY, next);\n}\n\n/**\n * Check whether a DM should be sent for a specific pending invocation.\n * Returns true if no DM has yet been sent for this (blockId, pendingInvocationId, assigneeDid).\n *\n * Each pending invocation gets at most one DM, regardless of how many times\n * the scan runs. If the assignee on the pending invocation changes (which\n * shouldn't happen in normal flow but could via edits), a fresh DM fires.\n */\nexport function shouldNotifyPending(state: PendingDMNotificationState, blockId: string, pendingInvocationId: string, currentAssignedDid: string): boolean {\n  const blockState = state[blockId];\n  if (!blockState) return true;\n  const existing = blockState[pendingInvocationId];\n  if (!existing) return true;\n  return existing.assignedDid !== currentAssignedDid;\n}\n","import * as Y from 'yjs';\nimport type { FlowNodeRuntimeState, NodeState } from '../../types/authorization';\nimport { DM_NOTIFICATIONS_MAP_KEY } from './dmNotificationState';\nimport type { FlowRuntimeStateManager } from './runtime';\nimport { getExistingYMap, isYMapLike } from '../yjsTypes';\nimport { isNeverDoneAction } from '../actionRegistry/registry';\n\n/**\n * # `runs.ts` — the narrow waist for per-action execution state\n *\n * Ignition Phase A. This is the ONLY module in the codebase that knows the\n * runs layout, the dual-write rule, or the flat-map fallback rule. Every\n * runtime read and every runtime write goes through here. Converting some call\n * sites and not others reproduces the split-brain failure described below\n * *inside a single release*, with no old client involved.\n *\n * ## Shape\n *\n * ```\n * runs: Y.Map<runId, Y.Map>            ← nested container\n *   └─ meta:    plain object (RunMeta)\n *   └─ actions: Y.Map<blockId, FlowNodeRuntimeState>   ← PLAIN JS OBJECT values\n * runsTerminalPending: Y.Map<runId, RunTerminalReservation> ← plain objects, short-lived\n * runsTerminal: Y.Map<runId, RunTerminalRecord>        ← plain objects, write-once\n * ```\n *\n * **Containers are nested Y.Maps; leaves stay plain JS objects.** Today every\n * runtime value is a plain object written whole, which gives last-writer-wins\n * *per blockId*. Storing a leaf as a nested `Y.Map` would silently change that\n * to per-field LWW — a merge-semantics change masquerading as a relocation —\n * and would break every `{...stored}` spread and every `stored.output` read in\n * the repo by returning `undefined` rather than throwing. Phase A changes\n * *where* state lives and nothing about *how it merges*.\n *\n * ## Why the dual-write exists\n *\n * Already-deployed clients cannot be told to stand down: `getVersionPolicy`\n * falls back to the latest known policy for unrecognised doc versions, so an\n * old client meeting a doc from the future writes anyway. Old and new clients\n * therefore write the same doc concurrently, and CRDT merge preserves both\n * writes. If the two generations read different shapes, each concludes the\n * block never ran, and a side-effecting action fires twice — a double claim\n * submission, a double payment.\n *\n * Every write mirrors the full merged object into the flat `runtime` map, and\n * **every read resolves the run entry against the flat entry through one shared\n * freshness predicate** ({@link resolveActionState}). The two generations do\n * *not* automatically agree, and nothing here assumes they do: at any moment\n * either side may hold the more advanced value, and the predicate is what\n * decides. A mirror that could only fill a *hole* would be no safety net at all\n * — `initializeRuntime` seeds `{state:'idle'}` for every block, so after the\n * first adoption there are no holes left, and an absence-based rule would be\n * dead code. The mirror is a net precisely because a read can *correct* a stale\n * run entry, and because adoption *materialises* the corrected value back into\n * the run so the doc converges.\n *\n * ## Phase A compat register (this file's entries)\n *\n * | # | Scaffolding                          | Removal trigger                                                    |\n * | - | ------------------------------------ | ------------------------------------------------------------------ |\n * | 1 | flat-map mirror write (write/reset/delete/clear) | Phase B: dual-write and multi-run are mutually exclusive |\n * | 2 | flat-map read resolution             | Phase B, after (1), and only after adoption ran on every live room  |\n * | 3 | `adoptLegacyRuntime`                 | Phase B, after (1)                                                  |\n * | 4 | version 1 branch + `UNSESSIONED_RUN_ID` | when `flow-manager` stops ticking legacy, unmigrated flows      |\n *\n * Adoption itself is additionally **flag-gated and default OFF** until every\n * writer of flow runtime state — in this repo *and* in `flow-manager` and\n * `flow-agent` — routes through this file. See\n * {@link isLegacyRuntimeAdoptionEnabled} and §9.3 The adoption gate.\n */\n\n/** Top-level Y.Doc map owning every run. */\nexport const RUNS_MAP_KEY = 'runs';\n\n/** Top-level Y.Doc map owning the write-once terminal (closed/cancelled) latch per run. */\nexport const RUNS_TERMINAL_MAP_KEY = 'runsTerminal';\n\n/** Top-level Y.Doc map reserving a terminal transition before its Matrix event is appended. */\nexport const RUNS_TERMINAL_PENDING_MAP_KEY = 'runsTerminalPending';\n\n/**\n * The pre-runs flat map, keyed by blockId. Still a live write target for\n * already-deployed clients, which is why every write mirrors into it and every\n * read falls back to it.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: when `writeActionState` no longer mirrors\n * and `readActionState` no longer falls back (compat register items 1 and 2).\n */\nexport const LEGACY_RUNTIME_MAP_KEY = 'runtime';\n\n/**\n * The run id `resolveRunIdForExecution` hands back for a **legacy, unmigrated**\n * document — one that predates sessions and has no run container at all.\n *\n * It addresses nothing. Under version 1 with no container, reads resolve to the\n * flat map and writes go flat-only, so this value is never used as a key in the\n * doc. It exists because the execution boundary's signature returns a `string`\n * and `flow-manager`'s `resolveSessionRunId` calls it on every tick of every\n * legacy flow.\n *\n * **Deliberately not exported.** Its predecessor (`LEGACY_RUN_ID`) was a public\n * constant, and other repos built ownership semantics on it — `sessionRunId ??\n * LEGACY_RUN_ID` — which made a document-shaped question answerable by a\n * hard-coded string. Ownership now lives in the data: migration stamps a real\n * run id onto every previously-untagged record.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: when `flow-manager` stops ticking legacy\n * flows, the version 1 branch of `resolveRunIdForExecution` loses its last\n * caller and this goes with it (compat register item 4).\n */\nconst UNSESSIONED_RUN_ID = '__unsessioned__';\n\n/**\n * Whether a record written with `recordRunId` belongs to `sessionRunId`.\n *\n * Records written before sessions existed carry no `sessionRunId` at all. They\n * belong to the unsessioned document, so they match only while the flow is\n * still unmigrated — migration stamps the real run id onto every one of them,\n * after which this is a plain equality test and no record is ownerless.\n *\n * Every \"does this record belong to this session\" test goes through here, so\n * the answer cannot drift between the readers of commands, leases, ledger\n * entries and invocations.\n */\nexport function isRecordInRun(recordRunId: string | undefined, sessionRunId: string): boolean {\n  return (recordRunId ?? UNSESSIONED_RUN_ID) === sessionRunId;\n}\n\n/**\n * The run id to report for a record whose own `sessionRunId` may be absent.\n *\n * Readers hand back types that require the field, so an untagged record needs\n * *some* answer. When the caller asked for a specific session the record has\n * already matched it, so that is the honest owner; otherwise it is unsessioned.\n * Callers must not substitute a literal here — the sentinel stays private so it\n * cannot become load-bearing outside this file again.\n */\nexport function resolveRecordRunId(recordRunId: string | undefined, requestedRunId?: string): string {\n  return recordRunId ?? requestedRunId ?? UNSESSIONED_RUN_ID;\n}\n\n/**\n * The container id that pre-migration builds created on every connect.\n *\n * Never an addressing constant — the only code allowed to name it is\n * {@link collectPhantomLegacyRun}, which deletes it. A phantom's action states\n * are also in the flat map by the version 1 dual-write, so deleting the\n * container loses nothing.\n */\nconst PHANTOM_LEGACY_RUN_ID = 'r-0000-legacy';\n\n/**\n * Root metadata key describing which runtime layout is authoritative.\n *\n * Version 1 is the Phase A coexistence layout: one legacy run plus the flat\n * `runtime` mirror. Version 2 is the multi-run layout: every caller supplies a\n * run id and the flat map is neither read nor written.\n */\nexport const RUN_STORAGE_VERSION_KEY = 'runStorageVersion';\n\nexport type RunStorageVersion = 1 | 2;\n\n/**\n * The Phase A layout. Inferred for a document that carries pre-session history,\n * or declared by one that pins the key — never a fallback for a document whose\n * key is simply absent. Production writes only version 2 (migration and\n * `startRun`); the declared form exists so a caller that must pin the\n * coexistence layout, chiefly a test exercising the flat-map mirror, can say so\n * instead of relying on a default that no longer points that way.\n */\nexport const LEGACY_RUN_STORAGE_VERSION: RunStorageVersion = 1;\n\n/** The Phase B layout used by explicit, parallel runs. */\nexport const MULTI_RUN_STORAGE_VERSION: RunStorageVersion = 2;\n\n/**\n * Keys that live in the flat `runtime` map but are not blocks. Never adopted.\n *\n * DM notification dedup state used to squat here as `__dm_notifications` and\n * `__dm_notifications_pending`; it now has its own map, but already-deployed\n * clients still write the legacy keys. Adopting them would manufacture phantom\n * \"actions\" that later get quantified over as if they were blocks.\n */\nexport const RESERVED_RUNTIME_KEY_PREFIX = '__';\n\n// ─── The adoption gate ──────────────────────────────────────────────────────\n\n/**\n * **The one switch controlling whether adoption materialises. Default OFF.**\n *\n * ## The flip condition — it is CROSS-REPO, and that is not a detail\n *\n * > **Every writer of flow runtime state in `editor`, `flow-manager` AND\n * > `flow-agent` routes through this waist. Not most writers. Every one, in\n * > every repo.**\n *\n * A grep of `editor/src` is **not** that condition and never was. §9.6 of the\n * design doc names both orchestrators as live writers of flow runtime state.\n * `flow-agent` lives in this repo and is converted. `flow-manager` does not and\n * is not: it is pinned to a pre-runs editor version and still carries\n *\n * 1. a private duplicate of `createYDocRuntimeManager` over `doc.getMap('runtime')`,\n * 2. a raw `_yRuntime: doc.getMap('runtime')` synthetic editor, and\n * 3. a flat-only **downgrade** — `{ state: 'failed', … }` with no `executedAt`.\n *\n * (3) is the strand, end to end: a browser dual-writes `awaiting_readback` to\n * both sides, flow-manager writes flat-only `failed`, and\n * {@link resolveActionState} then abstains at rule (a) (both started), skips\n * rule (b) (no `executedAt` on the flat side), and rule (c) ranks\n * `awaiting_readback` **above** `failed` — so the run entry wins and a genuine\n * failure verdict is invisible forever. CRDT history is immutable: no\n * convergence path, no repair possible in code.\n *\n * Converting flow-manager needs a published editor version whose exported\n * managers are run-scoped, so the sequence is **publish → bump → convert → then\n * flip**. Do not flip before the third arrow.\n *\n * ## Why a switch at all\n *\n * Adoption is a **writer**: it materialises the freshness predicate's winner\n * into `runs[…].actions`, in every live room, the moment it runs. The predicate\n * is deliberately **non-downgrading** — rule (a) of {@link resolveActionState},\n * \"a started side beats an unstarted side\" — which is what stops an old tab's\n * completed payment reading as `idle`.\n *\n * The corollary is the trap. A legitimate transition to a **lower** state — a\n * user pressing \"Reset\", a checkbox being unchecked, a read-back returning a\n * proof *failure* — that is written **flat-only** can never be materialised into\n * the run, because the predicate refuses the downgrade. The run entry then keeps\n * the stale higher state **forever**.\n *\n * That failure inverts the bug the predicate fixed. With a stale `completed`\n * run entry, a legitimate reset-then-re-run resolves `prev.state === 'completed'`,\n * so the completion guard `prev.state !== 'completed'` is false, `step.completed`\n * is never emitted, and downstream listeners never queue. Instead of\n * double-firing, the flow **stalls**. Same root cause, opposite symptom.\n *\n * ## Why BOTH a flag and a guard — do not delete this again\n *\n * This flag was once deleted on the argument that \"a tripwire satisfiable by\n * editing one constant is not a gate\". That argument is **correct about flags\n * and wrong about the conclusion.** A flag alone is weak, so it is not alone:\n *\n * - the **guard** (`no-runtime-writer-outside-waist.test.ts`) is what makes the\n *   condition *checkable* inside this repo, and it can only ever see this repo;\n * - the **flag** is what keeps adoption inert for the part of the condition no\n *   test in this repo can check — another repo's writers — and what makes the\n *   flip a single, reviewable, attributable line rather than a side effect of\n *   whichever PR happened to convert the last local call site.\n *\n * Deleting either one leaves the other covering a hole it structurally cannot\n * reach. Both stay until the cross-repo condition above is actually met.\n *\n * ## Where it is enforced\n *\n * Inside {@link adoptLegacyRuntime} itself, so no call site can forget it, and\n * a future third call site inherits the gate for free. The two known call sites\n * (the adopt effect in `useCollaborativeIxoEditor`, and the headless one in\n * `flowCompiler/setup.ts`) also check {@link isLegacyRuntimeAdoptionEnabled}\n * explicitly, so the gate is visible where the decision is read.\n *\n * `ensureRun` is deliberately **not** gated: creating an empty run container is\n * harmless and idempotent, and doing it now means the container already exists\n * when the flag flips. It is *materialising stale winners* that must wait.\n */\nconst LEGACY_RUNTIME_ADOPTION_DEFAULT = false;\n\nlet legacyRuntimeAdoptionEnabled = LEGACY_RUNTIME_ADOPTION_DEFAULT;\n\n/**\n * Whether {@link adoptLegacyRuntime} may materialise. Read it; never cache it.\n *\n * See {@link LEGACY_RUNTIME_ADOPTION_DEFAULT} for the flip condition.\n */\nexport function isLegacyRuntimeAdoptionEnabled(): boolean {\n  return legacyRuntimeAdoptionEnabled;\n}\n\n/**\n * **Test seam only.** Tests need adoption ON to test adoption at all; production\n * must never be able to reach that state by accident.\n *\n * Three things keep this honest:\n * 1. `runs.ts` is not re-exported from `src/index.ts` or `src/core/index.ts`, so\n *    this function is not reachable from the published package surface at all;\n * 2. the name says what it is;\n * 3. it throws outside a test runner, so a stray call in app code fails loudly\n *    at the call rather than silently switching a writer on in a live room.\n *\n * Always restore the previous value in an `afterEach` — module state is shared\n * across tests in a file.\n */\nexport function __setLegacyRuntimeAdoptionEnabledForTests(enabled: boolean): void {\n  if (!isTestRunner()) {\n    throw new Error('[runs] __setLegacyRuntimeAdoptionEnabledForTests is a test-only seam — see §9.3 The adoption gate');\n  }\n  legacyRuntimeAdoptionEnabled = enabled;\n}\n\n/**\n * True only under a test runner (vitest sets both of these). Read through\n * `globalThis` because this package is bundled for the browser, where `process`\n * may not exist at all.\n */\nfunction isTestRunner(): boolean {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env;\n  return !!env && (env.NODE_ENV === 'test' || !!env.VITEST);\n}\n\nexport interface RunMeta {\n  /** Monotonic per-flow sequence number, for humans and ordering. */\n  seq: number;\n  startedAt: number;\n  startedByDid?: string;\n  label?: string;\n  /**\n   * How this run came to exist. `'migrated'` marks the single session that\n   * absorbed a legacy document's pre-session history; it is an ordinary session\n   * in every other respect.\n   */\n  origin?: 'started' | 'migrated';\n  /**\n   * Frozen when the run is created: the sequenced action block ids in this run\n   * plus a hash of the compiled graph.\n   *\n   * **A run without one is not a session.** It is a phantom from a build that\n   * created containers on connect, and the lifecycle refuses to close it rather\n   * than computing a summary against the live document.\n   *\n   * `defHash` is absent on a run the flow manager opened. It hashes the\n   * compiled graph as the authoring surface assembles it — block order, node\n   * shapes, sorted edges — and the runner reads the same flow through a\n   * different projection, so any hash it produced would differ from the\n   * Portal's for an identical definition and report drift on every scheduled\n   * run forever. `blockIds` is what closing needs, and the runner knows those\n   * exactly; the hash is left off rather than guessed, and\n   * {@link detectRunDefinitionDrift} answers from the block ids instead.\n   */\n  manifest?: { blockIds: string[]; defHash?: string };\n}\n\nexport interface RunTerminalRecord {\n  status: 'closed' | 'cancelled';\n  at: number;\n  by?: string;\n  closeInvocationCid?: string;\n  /** Matrix event that won the terminal transition. */\n  terminalEventId?: string;\n  /** Per-block `isDone` snapshotted at close time. Phase B populates it. */\n  summary?: Record<string, boolean>;\n}\n\nexport interface RunTerminalReservation {\n  reservationId: string;\n  status: RunTerminalRecord['status'];\n  at: number;\n  by?: string;\n  closeInvocationCid?: string;\n  reason?: string;\n  summary: Record<string, boolean>;\n}\n\nconst META_KEY = 'meta';\nconst ACTIONS_KEY = 'actions';\nconst PENDING_INVOCATIONS_KEY = 'pendingInvocations';\nconst BARRIER_STATE_KEY = 'barrierState';\n\n// ─── The freshness predicate ────────────────────────────────────────────────\n//\n// Everything below returns a defensive copy, matching the flat map's historical\n// `{ ...stored }` contract. Callers mutate what they read (`runtime.output.x = …`\n// happens in FlowDetails), so nothing may ever hand out a reference into the doc.\n\n/**\n * Progress rank over the real {@link NodeState} union. Higher = more advanced.\n *\n * This is only ever consulted as a tiebreak *within* a started/unstarted class\n * (see {@link resolveActionState} rule (a)), so the exact ordering matters far\n * less than it being total and identical on every peer. Where the ordering is\n * genuinely arguable it is resolved by asking **which direction of downgrade is\n * dangerous**:\n *\n * - `cancelled` above `running` — a deliberate stop must not be reanimated into\n *   an in-flight execution.\n * - `awaiting_readback` and `needs_verification` above `failed` — both mean the\n *   side effect may already have happened. `failed` is retryable; downgrading\n *   into it re-arms the auto-execute gate and double-executes. Downgrading the\n *   other way merely leaves a block waiting, which is inert.\n * - `retry_scheduled` above `failed`, and `awaiting_human` above both: a\n *   headless writer already owns the next transition. Replacing either wait\n *   with a generic failure can queue duplicate work.\n * - `completed` highest — the resolved terminal state, including the\n *   `manuallyVerified` path out of `needs_verification`.\n */\nconst NODE_STATE_RANK: Record<NodeState, number> = {\n  idle: 0,\n  pending: 1,\n  running: 2,\n  cancelled: 3,\n  failed: 4,\n  retry_scheduled: 5,\n  awaiting_readback: 6,\n  awaiting_human: 7,\n  needs_verification: 8,\n  completed: 9,\n};\n\n/** Rank of a possibly-absent state. An absent state sorts below `idle`. */\nfunction rankOf(state: NodeState | undefined): number {\n  if (!state) return -1;\n  const rank = NODE_STATE_RANK[state];\n  return typeof rank === 'number' ? rank : -1;\n}\n\n/** Whether a string is a state this build understands. Keyed off the rank table\n *  so a new `NodeState` can never be known to one and unknown to the other. */\nfunction isKnownNodeState(state: string): state is NodeState {\n  return Object.prototype.hasOwnProperty.call(NODE_STATE_RANK, state);\n}\n\n/**\n * \"Unstarted\" = the block has not been acted on: no `state` at all, or the\n * `idle` that `initializeRuntime` seeds. Everything else means *something\n * happened* — including `failed` and `cancelled`.\n */\nfunction isStarted(entry: FlowNodeRuntimeState): boolean {\n  return !!entry.state && entry.state !== 'idle';\n}\n\n/**\n * Deep copy of an action-state value.\n *\n * A **shallow** `{ ...value }` is not enough, and the difference is a lost\n * payment proof rather than a style point. Yjs stores a plain object *by\n * reference*, so with a shallow copy the nested `output` / `error` / `readBack`\n * objects are shared between the run entry, the flat mirror and the value handed\n * back to the caller. Then:\n *\n * ```ts\n * const { next } = writeActionState(doc, runId, blockId, { output: { transactionHash: '0xA' } });\n * next.output.transactionHash = '0xB';\n * ```\n *\n * silently rewrites **both** stored values with **no Yjs transaction, no update\n * event and no observer** — so every remote peer stays on `0xA` forever and\n * nothing anywhere reports a problem. Deep-copying at the boundary makes the\n * stored state unreachable except through a real write.\n */\nfunction cloneState<T>(value: T): T {\n  if (value === null || typeof value !== 'object') return value;\n  try {\n    return structuredClone(value);\n  } catch {\n    // Non-cloneable payload (a function, a symbol, a live Y type). Fall back to\n    // a JSON round-trip, which is lossy in exactly the cases that must not be in\n    // action state anyway, and never returns a shared reference.\n    try {\n      return JSON.parse(JSON.stringify(value)) as T;\n    } catch {\n      return value;\n    }\n  }\n}\n\n/**\n * `undefined` unless the value is a usable action-state object.\n *\n * **Total by contract.** The parameter is `unknown`, so this is the only place\n * hostile input can be rejected, and {@link resolveActionState}'s determinism\n * depends on it: a value that is truthy but not a real state object would count\n * as \"started\" under rule (a) and win against a genuine entry, and a `NaN`\n * `executedAt` makes rule (b)'s comparison **asymmetric** — `NaN > x` and\n * `x > NaN` are both false — so two clients could resolve the same pair\n * differently and the generations would diverge again.\n */\nfunction asStateObject(value: unknown): FlowNodeRuntimeState | undefined {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;\n  // Only a plain object. A live Y.Map (or any class instance) that found its way\n  // in is not action state and must not be treated as one.\n  const proto = Object.getPrototypeOf(value);\n  if (proto !== Object.prototype && proto !== null) return undefined;\n\n  const entry = value as FlowNodeRuntimeState;\n  const state = entry.state;\n  const at = entry.executedAt;\n  const stateUsable = state === undefined || (typeof state === 'string' && isKnownNodeState(state));\n  const atUsable = at === undefined || (typeof at === 'number' && Number.isFinite(at));\n  if (stateUsable && atUsable) return entry;\n\n  // Normalise rather than discard: the rest of the entry (output, error) is\n  // still the only record of what happened. Drop only the unusable fields, so\n  // an unknown state reads as unstarted and a non-finite timestamp is absent.\n  const normalised: FlowNodeRuntimeState = { ...entry };\n  if (!stateUsable) delete normalised.state;\n  if (!atUsable) delete normalised.executedAt;\n  return normalised;\n}\n\n/** Which generation's entry won the resolution. `'neither'` = both absent. */\nexport type ActionStateWinner = 'run' | 'flat' | 'neither';\n\nexport interface ResolvedActionState {\n  /** Defensive copy of the winning entry; `{}` when both sides are absent. */\n  value: FlowNodeRuntimeState;\n  winner: ActionStateWinner;\n}\n\n/**\n * **The one freshness predicate.** Given a run entry and a flat `runtime` entry\n * — either or both may be absent — return the more advanced one.\n *\n * Pure, synchronous, deterministic, no I/O, no doc access. Every peer resolves\n * a given pair identically; if it did not, the two generations would diverge\n * again and the whole dual-write scheme would be pointless.\n *\n * The rule this replaces was **absence-based**: \"use the flat entry only when\n * the run has none.\" That is dead code in practice — `initializeRuntime` seeds\n * `{state:'idle'}` into the flat map for *every* block at flow setup, so the\n * first adoption creates a run entry for every block and there is never a hole\n * again. Every later flat write (an old tab completing a payment, a\n * not-yet-upgraded flow-manager finishing a claim, or the flat mirror of a\n * container that lost the concurrent-create race) would be invisible forever:\n * the block reads `idle`, the auto-execute gate re-arms, and the side effect\n * fires a **second time**.\n *\n * Resolution order:\n *\n * 1. **A started side beats an unstarted side.** This is the anti-double-\n *    execution rule and it dominates every other consideration — a stale `idle`\n *    must never win against evidence that something ran, no matter how new its\n *    timestamp or how it ranks.\n * 2. Else, if both carry an `executedAt` and they differ, the newer wins.\n * 3. Else, if the state ranks differ, the higher rank wins ({@link NODE_STATE_RANK}).\n * 4. Else the run entry wins — a deterministic tiebreak that preserves the\n *    local write and makes adoption idempotent (a materialised value resolves\n *    back to `'run'` on the next pass, so nothing is rewritten).\n *\n * ## The sharp edge in rule (d) — known, bounded, and deliberately not \"fixed\"\n *\n * Rules (b) and (c) can both abstain: (b) needs a numeric `executedAt` on BOTH\n * sides, (c) needs the ranks to differ. So two entries that are both started, at\n * the same rank, with no numeric `executedAt` on either side, fall through to\n * (d) — and the run entry wins **even though the two carry different payloads**.\n * A flat entry `{state:'completed', output:{txHash:'0xB'}}` written by an\n * already-deployed client is then shadowed by a run entry\n * `{state:'completed', output:{txHash:'0xA'}}`, permanently, and adoption\n * reports nothing to converge.\n *\n * Three things bound it:\n *\n * 1. Every writer in this repo goes through {@link writeActionState}, which\n *    dual-writes the *identical* object, so the run and flat entries of a\n *    same-generation write are never different-but-equal-rank.\n * 2. Divergence therefore needs an already-deployed client writing flat-only,\n *    AND both sides landing on the same rank, AND neither side carrying a\n *    numeric `executedAt`. The kernel's success path (`actionExecutor`) and the\n *    read-back completion path both stamp `executedAt`, which is what makes (b)\n *    fire for the realistic completion race.\n * 3. The residue is genuinely ambiguous — two peers claiming the same state with\n *    no ordering information between them. Any rule here is arbitrary; what is\n *    NOT optional is that the rule be **total and identical on every peer**, or\n *    the two generations diverge again. (d) buys that, and it is what makes\n *    adoption idempotent.\n *\n * ### The one reachable instance, found by probing (severity: payload, not state)\n *\n * The *failure* writes do not stamp `executedAt` — deliberately, since\n * `executedAt` means \"timestamp of last completion\":\n * `actionExecutor#updateRuntimeFailure` (`{state:'failed', error}`), its\n * `PROOF_MISSING` sibling (`{state:'needs_verification'|'failed', output,\n * error}`), and `readBackReconciler`'s failure branch. If an already-deployed\n * client independently fails the same block flat-only, both sides land on the\n * same rank with no numeric `executedAt` on the flat side, and (d) keeps the run\n * entry's `error`/`output`.\n *\n * What that costs is bounded and worth stating exactly: **the two sides always\n * agree on the state**, so neither the auto-execute gate nor the\n * `prev.state !== 'completed'` completion guard can behave differently — no\n * double execution, no stall. What can be shadowed is the `error.message`, the\n * retained `output`, and the `readBack` metadata. For `needs_verification` that\n * payload is the evidence a human verifier reads, so it is a real if minor\n * correctness cost.\n *\n * It is **not** patched here. Stamping `executedAt` on failure would redefine\n * the field (CLAUDE.md: \"timestamp of last completion\") for every consumer,\n * including TTL logic and both orchestrators — a behaviour change that must be\n * made deliberately, not smuggled in under a predicate fix.\n *\n * And do not \"improve\" (d) with a deep-equality or field-count comparison:\n * those are not total orders, they differ under key insertion order, and they\n * would cost adoption its idempotence. Where a payload genuinely matters, the\n * fix is to make **that writer** carry an ordering key, never to loosen the\n * predicate.\n */\nexport function resolveActionState(runEntry: unknown, flatEntry: unknown): ResolvedActionState {\n  const run = asStateObject(runEntry);\n  const flat = asStateObject(flatEntry);\n\n  if (!run && !flat) return { value: {}, winner: 'neither' };\n  if (!run) return { value: cloneState(flat as FlowNodeRuntimeState), winner: 'flat' };\n  if (!flat) return { value: cloneState(run), winner: 'run' };\n\n  const runWins = (): ResolvedActionState => ({ value: cloneState(run), winner: 'run' });\n  const flatWins = (): ResolvedActionState => ({ value: cloneState(flat), winner: 'flat' });\n\n  // (a) Started beats unstarted. Dominates everything below.\n  const runStarted = isStarted(run);\n  const flatStarted = isStarted(flat);\n  if (runStarted !== flatStarted) return runStarted ? runWins() : flatWins();\n\n  // (b) Newer execution wins, when both sides claim one.\n  const runAt = typeof run.executedAt === 'number' ? run.executedAt : undefined;\n  const flatAt = typeof flat.executedAt === 'number' ? flat.executedAt : undefined;\n  if (runAt !== undefined && flatAt !== undefined && runAt !== flatAt) {\n    return runAt > flatAt ? runWins() : flatWins();\n  }\n\n  // (c) More advanced state wins.\n  const runRank = rankOf(run.state);\n  const flatRank = rankOf(flat.state);\n  if (runRank !== flatRank) return runRank > flatRank ? runWins() : flatWins();\n\n  // (d) Otherwise prefer the better-evidenced side: when exactly one carries a\n  // usable `executedAt`, take it. Without this, the rule (e) tiebreak discards\n  // whichever side happens to be the flat one, so a genuine timestamp is lost\n  // to a bare duplicate of the same state — and the resolved VALUE depends on\n  // which map the entry sat in rather than on what it says. That asymmetry is\n  // invisible in production (callers always pass run first) which is precisely\n  // why it survived review; a symmetry test over hostile pairs caught it.\n  if (runAt !== undefined && flatAt === undefined) return runWins();\n  if (flatAt !== undefined && runAt === undefined) return flatWins();\n\n  // (e) Deterministic tiebreak: the run entry.\n  return runWins();\n}\n\n/** The runs container. Re-resolve on every call; never cache the result. */\nexport function getRunsMap(yDoc: Y.Doc): Y.Map<Y.Map<unknown>> {\n  return yDoc.getMap<Y.Map<unknown>>(RUNS_MAP_KEY);\n}\n\n/** Existing runs container, without materialising it on a read-only document. */\nexport function getExistingRunsMap(yDoc: Y.Doc): Y.Map<Y.Map<unknown>> | undefined {\n  return getExistingYMap<Y.Map<unknown>>(yDoc, RUNS_MAP_KEY);\n}\n\n/** The write-once terminal latch map. Re-resolve on every call. */\nexport function getRunsTerminalMap(yDoc: Y.Doc): Y.Map<RunTerminalRecord> {\n  return yDoc.getMap<RunTerminalRecord>(RUNS_TERMINAL_MAP_KEY);\n}\n\n/** Existing terminal container, without materialising it during inspection. */\nexport function getExistingRunsTerminalMap(yDoc: Y.Doc): Y.Map<RunTerminalRecord> | undefined {\n  return getExistingYMap<RunTerminalRecord>(yDoc, RUNS_TERMINAL_MAP_KEY);\n}\n\n/** The short-lived terminal reservation map. Re-resolve on every call. */\nexport function getRunsTerminalPendingMap(yDoc: Y.Doc): Y.Map<RunTerminalReservation> {\n  return yDoc.getMap<RunTerminalReservation>(RUNS_TERMINAL_PENDING_MAP_KEY);\n}\n\n/** Existing reservation container, without materialising it during inspection. */\nexport function getExistingRunsTerminalPendingMap(yDoc: Y.Doc): Y.Map<RunTerminalReservation> | undefined {\n  return getExistingYMap<RunTerminalReservation>(yDoc, RUNS_TERMINAL_PENDING_MAP_KEY);\n}\n\n/** Whether a run is terminal or has reserved its terminal Matrix transition. */\nexport function isRunTerminalOrPending(yDoc: Y.Doc, runId: string): boolean {\n  return Boolean(getExistingRunsTerminalMap(yDoc)?.has(runId) || getExistingRunsTerminalPendingMap(yDoc)?.has(runId));\n}\n\n/**\n * The legacy flat runtime map.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: when nothing in this file references\n * `LEGACY_RUNTIME_MAP_KEY` (compat register items 1, 2 and 3).\n */\nfunction getLegacyRuntimeMap(yDoc: Y.Doc): Y.Map<FlowNodeRuntimeState> {\n  return yDoc.getMap<FlowNodeRuntimeState>(LEGACY_RUNTIME_MAP_KEY);\n}\n\nfunction getExistingLegacyRuntimeMap(yDoc: Y.Doc): Y.Map<FlowNodeRuntimeState> | undefined {\n  return getExistingYMap<FlowNodeRuntimeState>(yDoc, LEGACY_RUNTIME_MAP_KEY);\n}\n\n/**\n * Read the document's runtime layout without mutating it.\n *\n * **Sessions are the default; the Phase A layout is not a fallback.** A missing\n * version key is not evidence of a legacy document — it is the state of every\n * document nobody has latched yet, including ones created moments ago by paths\n * that copy a doc rather than compile one (template instantiation, protocol\n * import). Treating the absent key as version 1 made those flows demand a\n * migration that would move nothing.\n *\n * So the discriminator is the *presence of pre-session history*, the same\n * predicate the compiler latches on. Version 1 is reported only for a document\n * that actually has flat-map history to migrate; everything else is version 2,\n * whether or not it carries the key. An explicit key always wins — that is what\n * `migrateFlowToSessions` writes to make the transition permanent, and it is\n * what keeps a migrated document on version 2 after its history is seeded into\n * the first session.\n */\nexport function getRunStorageVersion(yDoc: Y.Doc): RunStorageVersion {\n  assertDoc(yDoc, 'getRunStorageVersion');\n  const declared = getExistingYMap(yDoc, 'root')?.get(RUN_STORAGE_VERSION_KEY);\n  if (declared === MULTI_RUN_STORAGE_VERSION) return MULTI_RUN_STORAGE_VERSION;\n  if (declared === LEGACY_RUN_STORAGE_VERSION) return LEGACY_RUN_STORAGE_VERSION;\n  return hasLegacyRuntimeHistory(yDoc) ? LEGACY_RUN_STORAGE_VERSION : MULTI_RUN_STORAGE_VERSION;\n}\n\n/** Whether flat-map compatibility is still part of this document's interface. */\nexport function usesLegacyRuntimeCompatibility(yDoc: Y.Doc): boolean {\n  return getRunStorageVersion(yDoc) === LEGACY_RUN_STORAGE_VERSION;\n}\n\nexport class ExplicitRunRequiredError extends Error {\n  constructor(message = 'Multi-run execution requires an explicit session run id.') {\n    super(message);\n    this.name = 'ExplicitRunRequiredError';\n  }\n}\n\nexport class UnknownRunError extends Error {\n  constructor(public readonly runId: string) {\n    super(`Unknown session run \"${runId}\".`);\n    this.name = 'UnknownRunError';\n  }\n}\n\nexport class TerminalRunExecutionError extends Error {\n  constructor(\n    public readonly runId: string,\n    public readonly blockId: string\n  ) {\n    super(`Run \"${runId}\" is terminal; sequenced action \"${blockId}\" cannot execute.`);\n    this.name = 'TerminalRunExecutionError';\n  }\n}\n\n/** Definition flag shared by manifest construction, execution guards and UI. */\nexport function isBelowTheLineBlock(\n  block:\n    | {\n        props?: Record<string, unknown>;\n      }\n    | null\n    | undefined\n): boolean {\n  const props = block?.props || {};\n  return (\n    props.belowTheLine === true ||\n    props.sequenced === false ||\n    props.runScope === 'below-the-line' ||\n    props.executionLane === 'below-the-line' ||\n    isNeverDoneAction(typeof props.actionType === 'string' ? props.actionType : undefined)\n  );\n}\n\n/**\n * Resolve an execution target without turning the advisory active-run pointer\n * into authority. Version 2 requires a real, named run supplied by the caller.\n *\n * Version 1 is a legacy, unmigrated document. It has no run container and never\n * gains one from a write: the returned {@link UNSESSIONED_RUN_ID} addresses\n * nothing, reads resolve to the flat map, and writes go flat-only. That is the\n * pre-session behaviour, preserved exactly, until the flow is migrated.\n */\nexport function resolveRunIdForExecution(yDoc: Y.Doc, requestedRunId?: string): string {\n  assertDoc(yDoc, 'resolveRunIdForExecution');\n  if (usesLegacyRuntimeCompatibility(yDoc)) {\n    return requestedRunId || resolveActiveRunId(yDoc) || UNSESSIONED_RUN_ID;\n  }\n  if (!requestedRunId) throw new ExplicitRunRequiredError();\n  if (!getExistingRunsMap(yDoc)?.has(requestedRunId)) {\n    throw new UnknownRunError(requestedRunId);\n  }\n  return requestedRunId;\n}\n\n/**\n * Ordinary sequenced actions stop with the run. Explicit below-the-line\n * actions remain available for post-close work and continue appending history.\n */\nexport function assertRunActionExecutionAllowed(yDoc: Y.Doc, runId: string, block: { id?: string; props?: Record<string, unknown> }): void {\n  if (!getExistingRunsMap(yDoc)?.has(runId) && !usesLegacyRuntimeCompatibility(yDoc)) {\n    throw new UnknownRunError(runId);\n  }\n  if (isRunTerminalOrPending(yDoc, runId) && !isBelowTheLineBlock(block)) {\n    throw new TerminalRunExecutionError(runId, block.id || 'unknown');\n  }\n}\n\nfunction assertDoc(yDoc: Y.Doc | null | undefined, fn: string): asserts yDoc is Y.Doc {\n  if (!yDoc || typeof (yDoc as Y.Doc).getMap !== 'function') {\n    throw new Error(`[runs] ${fn} requires a Y.Doc — refusing to fall back to non-persistent state`);\n  }\n}\n\n/**\n * Create the run container if it is missing. Transactional, idempotent, and\n * safe against the concurrent-create race.\n *\n * **The race:** two clients concurrently doing `runs.get(id) ?? new Y.Map()`\n * produce two detached `Y.Map`s. The merge keeps one and *silently discards\n * everything ever written into the loser*, with no error. Phase A aggravates\n * this whenever two clients start or migrate the same flow at once.\n * The in-transaction re-check closes the local window; the flat mirror written\n * by {@link writeActionState} is the second net that makes the remote window\n * survivable.\n *\n * Returns the LIVE container. **Never cache it across a tick** — a losing merge\n * orphans the reference and subsequent writes vanish with no error.\n */\nexport function ensureRun(yDoc: Y.Doc, runId: string, meta?: Partial<RunMeta>): Y.Map<unknown> {\n  assertDoc(yDoc, 'ensureRun');\n  let run = getRunsMap(yDoc).get(runId);\n  if (!run) {\n    yDoc.transact(() => {\n      // Re-resolve and re-check INSIDE the transaction: another local writer may\n      // have created it between the read above and here.\n      const runs = getRunsMap(yDoc);\n      if (!runs.get(runId)) {\n        const created = new Y.Map<unknown>();\n        created.set(META_KEY, { seq: 0, startedAt: Date.now(), ...meta } satisfies RunMeta);\n        created.set(ACTIONS_KEY, new Y.Map<FlowNodeRuntimeState>());\n        runs.set(runId, created);\n      }\n    });\n    // Re-read from the doc rather than returning the local object: after a\n    // losing merge the object we constructed is not the one in the doc.\n    run = getRunsMap(yDoc).get(runId)!;\n  }\n  return run;\n}\n\n/**\n * The run's actions map, re-resolved from the doc on every call.\n * Returns `undefined` if the run does not exist — this is a pure read and must\n * never write (a read-only viewer calls it).\n */\nexport function getRunActionsMap(yDoc: Y.Doc, runId: string): Y.Map<FlowNodeRuntimeState> | undefined {\n  assertDoc(yDoc, 'getRunActionsMap');\n  const run = getExistingRunsMap(yDoc)?.get(runId);\n  if (!run) return undefined;\n  const actions = run.get(ACTIONS_KEY);\n  return isYMapLike<FlowNodeRuntimeState>(actions) ? actions : undefined;\n}\n\n/**\n * Read a named run-scoped CRDT container without creating it.\n *\n * Execution-adjacent state such as pending invocations and barrier progress\n * belongs beside `actions` in Phase B. Keeping the container lookup in this\n * waist prevents callers from learning or duplicating the nested runs layout.\n */\nexport function getRunScopedMap<T = unknown>(yDoc: Y.Doc, runId: string, key: string): Y.Map<T> | undefined {\n  assertDoc(yDoc, 'getRunScopedMap');\n  const value = getExistingRunsMap(yDoc)?.get(runId)?.get(key);\n  return isYMapLike<T>(value) ? value : undefined;\n}\n\n/** Resolve a named run-scoped CRDT container, creating it when absent. */\nexport function ensureRunScopedMap<T = unknown>(yDoc: Y.Doc, runId: string, key: string): Y.Map<T> {\n  assertDoc(yDoc, 'ensureRunScopedMap');\n  const run = ensureRun(yDoc, runId);\n  const existing = run.get(key);\n  if (isYMapLike<T>(existing)) return existing;\n  run.set(key, new Y.Map<T>());\n  return getRunScopedMap<T>(yDoc, runId, key)!;\n}\n\n/** Read a run's `meta`. Returns `undefined` when the run does not exist. */\nexport function getRunMeta(yDoc: Y.Doc, runId: string): RunMeta | undefined {\n  assertDoc(yDoc, 'getRunMeta');\n  const run = getExistingRunsMap(yDoc)?.get(runId);\n  const meta = run?.get(META_KEY);\n  if (!meta || typeof meta !== 'object') return undefined;\n  return { ...(meta as RunMeta) };\n}\n\n/**\n * Resolve the run's actions map, creating the run (and the `actions` container\n * on a run written by a client that did not create one) if needed.\n * Callers must already be inside — or be about to open — a transaction.\n */\n/**\n * The actions container a write should land in, or `undefined` when the write\n * belongs only in the flat map.\n *\n * **This is what keeps an unstarted flow sessionless.** Materialising a run\n * because someone wrote to it is how a document that never had a session grew\n * one on first execution — and a container created that way has no manifest, so\n * it can never be closed. A write therefore never creates a run:\n *\n * - version 1 (legacy, unmigrated): no container, so `undefined` → flat-only,\n *   which is exactly the pre-session behaviour;\n * - version 2: a run id that names nothing is a caller bug, so it throws.\n *\n * Runs are created in exactly two places, both deliberate and both carrying a\n * frozen manifest: `startRun` and `migrateFlowToSessions`.\n */\nfunction resolveActionsForWrite(yDoc: Y.Doc, runId: string): Y.Map<FlowNodeRuntimeState> | undefined {\n  if (!getExistingRunsMap(yDoc)?.has(runId)) {\n    if (usesLegacyRuntimeCompatibility(yDoc)) return undefined;\n    throw new UnknownRunError(runId);\n  }\n  return ensureRunActions(yDoc, runId);\n}\n\nfunction ensureRunActions(yDoc: Y.Doc, runId: string): Y.Map<FlowNodeRuntimeState> {\n  ensureRun(yDoc, runId);\n  const existing = getRunActionsMap(yDoc, runId);\n  if (existing) return existing;\n  // Defensive: a run container that lost the `actions` sub-map (a peer created\n  // the container differently, or a merge dropped it). Re-resolve after writing.\n  const run = getRunsMap(yDoc).get(runId)!;\n  run.set(ACTIONS_KEY, new Y.Map<FlowNodeRuntimeState>());\n  return getRunActionsMap(yDoc, runId)!;\n}\n\nexport interface MultiRunMigrationResult {\n  actionStates: number;\n  pendingInvocations: number;\n  barrierEntries: number;\n}\n\nfunction copyNestedMapIntoRun(yDoc: Y.Doc, runId: string, key: string): number {\n  const source = yDoc.getMap<Y.Map<unknown>>(key);\n  const target = ensureRunScopedMap<Y.Map<unknown>>(yDoc, runId, key);\n  let copied = 0;\n  source.forEach((sourceInner, outerKey) => {\n    if (!isYMapLike(sourceInner)) return;\n    let targetInner = target.get(outerKey);\n    if (!isYMapLike(targetInner)) {\n      targetInner = new Y.Map<unknown>();\n      target.set(outerKey, targetInner);\n    }\n    sourceInner.forEach((value, innerKey) => {\n      if (!targetInner!.has(innerKey)) {\n        targetInner!.set(innerKey, cloneState(value));\n        copied += 1;\n      }\n    });\n  });\n  return copied;\n}\n\n/**\n * Whether this document carries pre-session execution history.\n *\n * True means the flat `runtime` map holds at least one real action state, so\n * migrating produces a session with something in it. Reserved `__`-prefixed\n * keys (DM dedup) are not history: a flow that only ever sent a notification has\n * never executed anything.\n */\nexport function hasLegacyRuntimeHistory(yDoc: Y.Doc): boolean {\n  assertDoc(yDoc, 'hasLegacyRuntimeHistory');\n  const flat = getExistingLegacyRuntimeMap(yDoc);\n  if (!flat) return false;\n  let found = false;\n  flat.forEach((value, key) => {\n    if (found || key.startsWith(RESERVED_RUNTIME_KEY_PREFIX)) return;\n    if (asStateObject(value)) found = true;\n  });\n  return found;\n}\n\n/**\n * Delete the container that pre-migration builds created on every connect.\n *\n * Such a container is not a session — it has no frozen manifest, so the\n * lifecycle cannot close it, yet it is enumerated by every surface that lists\n * runs and therefore shows up as a phantom the user can neither finish nor\n * remove. Returns whether anything was deleted.\n *\n * Collected when deleting it provably loses nothing:\n *\n * - it holds no action states of its own — there is no copy to destroy; or\n * - the document is version 1, where the dual-write guarantees every state in\n *   the phantom is also in the flat map.\n *\n * Under version 2 a container that does hold states is the only copy of them,\n * so it is left alone regardless of how it got its name. A run bearing a\n * manifest is a real session and is never touched.\n *\n * The empty case is not hypothetical: a pre-session build created this\n * container on *every connect*, so a flow that was opened but never executed\n * has a phantom and no flat history — and with sessions as the default that\n * document is version 2, where the version gate alone would strand the phantom\n * as an unfinishable, unremovable session.\n */\nexport function collectPhantomLegacyRun(yDoc: Y.Doc): boolean {\n  assertDoc(yDoc, 'collectPhantomLegacyRun');\n  if (!getExistingRunsMap(yDoc)?.has(PHANTOM_LEGACY_RUN_ID)) return false;\n  if (getRunMeta(yDoc, PHANTOM_LEGACY_RUN_ID)?.manifest) return false;\n  const phantomActions = getRunActionsMap(yDoc, PHANTOM_LEGACY_RUN_ID);\n  if (phantomActions && phantomActions.size > 0 && !usesLegacyRuntimeCompatibility(yDoc)) return false;\n  yDoc.transact(() => {\n    getRunsMap(yDoc).delete(PHANTOM_LEGACY_RUN_ID);\n    getRunsTerminalMap(yDoc).delete(PHANTOM_LEGACY_RUN_ID);\n    const root = getExistingYMap(yDoc, 'root');\n    if (root?.get('activeRunId') === PHANTOM_LEGACY_RUN_ID) root.delete('activeRunId');\n  });\n  return true;\n}\n\n/**\n * Seed a newly created run with the document's pre-session history: the\n * freshness winner for every legacy action, plus pending invocations and\n * partial barriers.\n *\n * **Cannot downgrade anything.** The run is created by migration immediately\n * before this call, so every block resolves with no run entry — rule (a) of\n * {@link resolveActionState} makes the flat side the winner every time, and\n * there is nothing on the run side to lose. That is what lets a legacy document\n * be seeded while the global adoption gate remains closed.\n *\n * Does **not** write the version latch: the caller flips it at the end of the\n * same transaction, after every part of the migration has succeeded.\n */\nexport function seedRunFromLegacyRuntime(yDoc: Y.Doc, runId: string): MultiRunMigrationResult {\n  assertDoc(yDoc, 'seedRunFromLegacyRuntime');\n  const result: MultiRunMigrationResult = { actionStates: 0, pendingInvocations: 0, barrierEntries: 0 };\n\n  yDoc.transact(() => {\n    const actions = ensureRunActions(yDoc, runId);\n    const flat = getLegacyRuntimeMap(yDoc);\n    const keys = new Set<string>();\n    actions.forEach((_, key) => keys.add(key));\n    flat.forEach((_, key) => {\n      if (!key.startsWith(RESERVED_RUNTIME_KEY_PREFIX)) keys.add(key);\n    });\n    for (const key of keys) {\n      const resolved = resolveActionState(actions.get(key), flat.get(key)).value;\n      actions.set(key, cloneState(resolved));\n      result.actionStates += 1;\n    }\n\n    result.pendingInvocations = copyNestedMapIntoRun(yDoc, runId, PENDING_INVOCATIONS_KEY);\n    result.barrierEntries = copyNestedMapIntoRun(yDoc, runId, BARRIER_STATE_KEY);\n  });\n  return result;\n}\n\n/** Latch the document onto the multi-run layout. */\nexport function setMultiRunStorage(yDoc: Y.Doc): void {\n  assertDoc(yDoc, 'setMultiRunStorage');\n  yDoc.getMap('root').set(RUN_STORAGE_VERSION_KEY, MULTI_RUN_STORAGE_VERSION);\n}\n\n/**\n * Mark a document as multi-run without migrating anything.\n *\n * For newly created documents, which have no legacy history to carry over, and\n * for tests that build runs explicitly.\n */\nexport function enableMultiRunStorage(yDoc: Y.Doc): void {\n  setMultiRunStorage(yDoc);\n}\n\n/**\n * Read a block's action state for a run.\n *\n * **Resolves** the run entry against the flat `runtime[blockId]` through\n * {@link resolveActionState} — it does not merely fall back when the run entry\n * is missing. A run entry that exists but is *staler* than the flat mirror (an\n * old tab or a not-yet-upgraded orchestrator finished the block; or the run\n * entry is the `idle` seed left by `initializeRuntime`) must read as the\n * advanced value, or the auto-execute gate re-arms and the side effect fires\n * twice.\n *\n * Always returns a fresh copy, never a reference into the doc. Never writes —\n * safe on a read-only viewer and before the doc has connected. (Convergence is\n * `adoptLegacyRuntime`'s job, and it is a writer; reads only correct what they\n * hand back.)\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: the flat resolution goes when dual-write\n * goes (compat register item 2), and only after `adoptLegacyRuntime` has run\n * against every live room.\n */\nexport function readActionState(yDoc: Y.Doc, runId: string, blockId: string): FlowNodeRuntimeState {\n  assertDoc(yDoc, 'readActionState');\n  const runEntry = getRunActionsMap(yDoc, runId)?.get(blockId);\n  if (!usesLegacyRuntimeCompatibility(yDoc)) {\n    const state = asStateObject(runEntry);\n    return state ? cloneState(state) : {};\n  }\n  const flatEntry = getExistingLegacyRuntimeMap(yDoc)?.get(blockId);\n  return resolveActionState(runEntry, flatEntry).value;\n}\n\n/**\n * Enumerate one run through the same interface as {@link readActionState}.\n *\n * During Phase A this iterates the union of run and flat keys and resolves each\n * value through the freshness predicate. During Phase B it reads only the named\n * run. Consumers use this instead of touching either storage container.\n */\nexport function readActionStates(yDoc: Y.Doc, runId: string): Record<string, FlowNodeRuntimeState> {\n  assertDoc(yDoc, 'readActionStates');\n  const keys = new Set<string>();\n  getRunActionsMap(yDoc, runId)?.forEach((_, key) => keys.add(key));\n  if (usesLegacyRuntimeCompatibility(yDoc)) {\n    getExistingLegacyRuntimeMap(yDoc)?.forEach((_, key) => {\n      if (!key.startsWith(RESERVED_RUNTIME_KEY_PREFIX)) keys.add(key);\n    });\n  }\n  const states: Record<string, FlowNodeRuntimeState> = {};\n  for (const key of keys) {\n    states[key] = readActionState(yDoc, runId, key);\n  }\n  return states;\n}\n\n/**\n * Merge `updates` into a block's action state.\n *\n * **ONE transaction, ONE `prev` read.** The returned `prev` is the single\n * pre-write snapshot the caller must use for completion guards. Two separate\n * read-modify-write calls (one for the run, one for the mirror) would evaluate\n * `prev.state !== 'completed'` twice → two run records → two pending\n * invocations on every downstream listener → **double execution of a\n * side-effecting action**. That is the single most likely way this project\n * causes a real double payment, so the contract is enforced here rather than\n * left to call sites.\n *\n * `prev` is the **resolved** value ({@link resolveActionState}), not the raw\n * run entry. This is load-bearing for the same guard: if an old tab already\n * completed the block in the flat map while the run still holds the `idle`\n * seed, a raw `prev` would read `idle`, the guard would fire, and\n * `step.completed` would be emitted a second time — one pending invocation per\n * downstream listener, all over again.\n */\nexport function writeActionState(yDoc: Y.Doc, runId: string, blockId: string, updates: Partial<FlowNodeRuntimeState>): { prev: FlowNodeRuntimeState; next: FlowNodeRuntimeState } {\n  assertDoc(yDoc, 'writeActionState');\n  let prev: FlowNodeRuntimeState = {};\n  let next: FlowNodeRuntimeState = {};\n  yDoc.transact(() => {\n    const actions = resolveActionsForWrite(yDoc, runId);\n    const legacyCompatible = usesLegacyRuntimeCompatibility(yDoc);\n    const flat = legacyCompatible ? getLegacyRuntimeMap(yDoc) : undefined;\n    // PHASE A COMPAT — REMOVAL TRIGGER: same as the read resolution (compat\n    // register item 2). Resolve-on-read at the point of write, so a block an\n    // old client already advanced is merged into rather than overwritten — and\n    // so the returned `prev` cannot understate progress and re-fire a\n    // completion guard.\n    prev = legacyCompatible ? resolveActionState(actions?.get(blockId), flat?.get(blockId)).value : readActionState(yDoc, runId, blockId);\n    next = cloneState({ ...prev, ...updates });\n    // Three DEEPLY distinct objects: Yjs stores a plain-object value by\n    // reference, so sharing any part of one between the run entry, the mirror\n    // and the returned `next` lets a caller mutating the result silently\n    // rewrite the doc with no transaction, no update event and no observer —\n    // see {@link cloneState}. A shallow spread here shares every nested\n    // `output`/`error`, which is the payment-proof case.\n    actions?.set(blockId, cloneState(next));\n    // PHASE A DUAL-WRITE. Mirrors the FULL merged object so an old client's\n    // read-modify-write LWWs against complete state, exactly as it does today.\n    // REMOVAL TRIGGER: Phase B, when multi-run is enabled. Dual-write and\n    // multi-run are mutually exclusive by construction — with N runs the\n    // question \"which run does runtime[blockId] represent?\" has no answer.\n    flat?.set(blockId, cloneState(next));\n  });\n  return { prev, next };\n}\n\n/**\n * **Replace** a block's action state in the run AND the flat mirror, in one\n * transaction. The opposite of {@link writeActionState}: nothing is merged, the\n * previous value is discarded on both sides.\n *\n * This is the primitive every *reset* path must use — flow rebuild, per-node\n * re-initialisation, the user's \"Reset\" affordance. A reset that touches only\n * the flat map is the most dangerous write in Phase A: {@link resolveActionState}\n * rule (a) makes a surviving `completed` run entry beat the fresh `idle` flat\n * entry, so the block reads **pre-completed** — a rebuilt flow shows green ticks\n * for work nobody did in it, and a \"Reset\" button appears to do nothing. Because\n * CRDT history is immutable, that wrong state is permanent in a live room.\n *\n * Writing the *identical* object to both sides is what makes the pair converge:\n * the two entries are then indistinguishable, so the predicate falls through to\n * the deterministic tiebreak and {@link adoptLegacyRuntime} has nothing to\n * materialise.\n */\nexport function resetActionState(yDoc: Y.Doc, runId: string, blockId: string, value: FlowNodeRuntimeState = { state: 'idle' }): void {\n  assertDoc(yDoc, 'resetActionState');\n  yDoc.transact(() => {\n    const actions = resolveActionsForWrite(yDoc, runId);\n    // Deeply distinct objects, for the same aliasing reason as `writeActionState`.\n    actions?.set(blockId, cloneState(value));\n    // PHASE A DUAL-WRITE — REMOVAL TRIGGER: compat register item 1.\n    if (usesLegacyRuntimeCompatibility(yDoc)) {\n      getLegacyRuntimeMap(yDoc).set(blockId, cloneState(value));\n    }\n  });\n}\n\n/**\n * Delete a block's action state from the run AND the flat mirror, in one\n * transaction. Used when the block itself is removed from the flow.\n *\n * Deleting only the flat entry leaves the run holding the deleted block's last\n * state; a block re-added under the same id (block ids are deterministic —\n * `flow_block_<nodeId>`) then reads as already-executed.\n *\n * **Never creates the run container.** A delete on a doc that has no run yet is\n * a no-op on the run side, not a reason to materialise `runs` — a doc that has\n * never been adopted must not gain a container from a removal.\n *\n * Phase A has exactly one run, but this deletes from the *named* run only,\n * never every run: in Phase B removing a block must not rewrite the history of\n * runs that already executed it.\n */\nexport function deleteActionState(yDoc: Y.Doc, runId: string, blockId: string): void {\n  assertDoc(yDoc, 'deleteActionState');\n  yDoc.transact(() => {\n    getRunActionsMap(yDoc, runId)?.delete(blockId);\n    // PHASE A DUAL-WRITE — REMOVAL TRIGGER: compat register item 1.\n    if (usesLegacyRuntimeCompatibility(yDoc)) {\n      getLegacyRuntimeMap(yDoc).delete(blockId);\n    }\n  });\n}\n\n/**\n * Drop **all** per-action execution state: every run container, the write-once\n * terminal latch, and the flat `runtime` map. One transaction.\n *\n * This is the full-rebuild wipe. It deletes every run, not just the active one:\n * a rebuild replaces the definition wholesale, so no run's state is meaningful\n * against it any more.\n *\n * Deliberately narrower than `clearRuntimeForTemplateClone` — it does not touch\n * `auditTrail`, `invocations`, `pendingInvocations` or `barrierState`, matching\n * exactly what the rebuild path cleared before runs existed. Widening it further\n * is a separate behaviour change.\n *\n * ## Why the DM dedup map is in scope, and is NOT a widening\n *\n * Wiping the flat map wipes the `__dm_notifications` / `__dm_notifications_pending`\n * keys along with everything else, because those records used to *live* there.\n * Clearing the flat map and not the dedicated map does not preserve DM state —\n * it **forks** it, in the one direction that is loudest:\n *\n * - an already-deployed client reads only the legacy keys, sees an empty bag,\n *   and re-DMs the assignee of every block in the rebuilt flow;\n * - a new client reads the union, still sees the pre-rebuild records, and stays\n *   silent.\n *\n * So the two generations disagree about who has been notified, which is the\n * exact split `dmNotificationState`'s dual-write exists to prevent. Clearing\n * both restores the pre-runs behaviour byte for byte: a full rebuild resets DM\n * dedup, and both generations agree that it did. `clearRuntimeForTemplateClone`\n * already clears both for the same reason.\n */\nexport function clearAllActionState(yDoc: Y.Doc): void {\n  assertDoc(yDoc, 'clearAllActionState');\n  yDoc.transact(() => {\n    const runs = getRunsMap(yDoc);\n    runs.forEach((_, key) => runs.delete(key));\n    const terminal = getRunsTerminalMap(yDoc);\n    terminal.forEach((_, key) => terminal.delete(key));\n    // PHASE A DUAL-WRITE — REMOVAL TRIGGER: compat register item 1.\n    // This also drops the `__dm_notifications*` mirrors, which is why the\n    // dedicated map below must go with it or the two generations fork.\n    const flat = getLegacyRuntimeMap(yDoc);\n    flat.forEach((_, key) => flat.delete(key));\n    const dmState = yDoc.getMap<unknown>(DM_NOTIFICATIONS_MAP_KEY);\n    dmState.forEach((_, key) => dmState.delete(key));\n  });\n}\n\n/**\n * Resolve every flat `runtime` entry against its run entry and **materialise\n * the winner into the run**. Returns the number of entries actually written.\n *\n * This is the writer half of the freshness contract, and the reason the doc\n * *converges* rather than merely reading correctly on each peer. Adoption is\n * **not absent-only**: skipping any key the run already has would make it dead\n * code the moment `initializeRuntime` seeds `{state:'idle'}` for every block,\n * and would strand every later flat write — an old tab completing a payment, a\n * not-yet-upgraded flow-manager finishing a claim, or the mirror of a container\n * that lost the concurrent-create race — outside the run forever.\n *\n * It is still **never a downgrade**: {@link resolveActionState}'s rule (a) means\n * a staler flat entry (an old tab re-seeding `idle` after a new tab completed\n * the block) loses, so nothing here can resurrect a pre-execution state on top\n * of a completed one and re-arm the auto-execute gate.\n *\n * **Idempotent by construction.** A materialised value is a copy of the flat\n * entry, so the next pass resolves the pair via the deterministic tiebreak\n * (rule (d)) back to `'run'` — no write, and a reported count of zero.\n *\n * ## THE ADOPTION GATE (§9.3) — **NOT discharged**\n *\n * **Gated, default OFF** — see {@link isLegacyRuntimeAdoptionEnabled} for the\n * full, cross-repo flip condition. While the gate is closed this is a pure no-op\n * returning `0`: it does not read, does not open a transaction, and does not\n * create the `actions` container. The gate is enforced here rather than at the\n * call sites so that no call site — present or future — can forget it.\n *\n * It was once declared discharged on the strength of a grep over `editor/src`.\n * That is the wrong scope: `flow-manager` is a live writer of flow runtime state\n * (§9.6), is pinned to a pre-runs editor, and still writes a flat-only `failed`\n * with no `executedAt` — which this predicate can never materialise. The two\n * things that keep the gate honest, and why neither alone is enough, are written\n * out at {@link isLegacyRuntimeAdoptionEnabled}: the flag covers the repos no\n * test here can see, the guard covers this one.\n *\n * - `no-runtime-writer-outside-waist.test.ts` greps the whole of `src/` and\n *   fails on any runtime-map write outside this file's allowlist. Its allowlist\n *   is per-line where feasible, and it must never gain an entry without a §9.3\n *   argument.\n * - `adoption-live.repro.test.ts` pins the four originally-reproduced defects\n *   (checkbox uncheck, reset-after-failed, read-back proof failure, 50 idempotent\n *   passes) plus the stall — all with the gate explicitly **opened**, because\n *   that is the only configuration in which they are reachable.\n *\n * `ensureRun` was never gated: an empty run container is harmless and\n * idempotent. It is *materialising stale winners* that has to wait.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: Phase B, once `writeActionState` no longer\n * mirrors to the flat map (compat register item 3).\n */\nexport function adoptLegacyRuntime(yDoc: Y.Doc, runId: string): number {\n  assertDoc(yDoc, 'adoptLegacyRuntime');\n  // THE ADOPTION GATE (§9.3). Materialising a stale winner into the run is\n  // irreversible in a live room; nothing below may run until every runtime\n  // writer — in this repo, in flow-manager, and in flow-agent — routes through\n  // this waist.\n  if (!legacyRuntimeAdoptionEnabled) return 0;\n  let adopted = 0;\n  yDoc.transact(() => {\n    const actions = ensureRunActions(yDoc, runId);\n    const flat = getLegacyRuntimeMap(yDoc);\n    flat.forEach((value, key) => {\n      if (key.startsWith(RESERVED_RUNTIME_KEY_PREFIX)) return; // not a block\n      if (!asStateObject(value)) return; // not an action state\n      const resolved = resolveActionState(actions.get(key), value);\n      // 'run' (or 'neither') → the run already holds the more advanced value.\n      // Writing anyway would churn the doc and break idempotence.\n      if (resolved.winner !== 'flat') return;\n      actions.set(key, cloneState(resolved.value));\n      adopted += 1;\n    });\n  });\n  return adopted;\n}\n\n/**\n * Subscribe to every change that can alter what {@link readActionState} returns\n * for any block. Returns the unsubscribe function.\n *\n * **Two sources, not one — this is the \"block completed but UI still spinning\"\n * trap.** The flat map is a *flat* `Y.Map`, so a shallow `observe` on it sees\n * every per-block write. `runs` is a *nested* container, so a shallow `observe`\n * on it fires only when a whole run is added or replaced — a change to\n * `runs[runId].actions[blockId]` would never reach the handler at all. That\n * failure presents as a block that completed in the doc while its UI keeps\n * spinning, which reads as a Matrix sync problem rather than a code bug, so it\n * is subscribed here in the waist instead of at each call site.\n *\n * - `observeDeep` on `runs` covers per-block action writes **and** the container\n *   replacement that follows a losing concurrent-create merge.\n * - `observe` on the flat map covers an already-deployed client's write, so it\n *   is visible immediately rather than waiting for an adoption pass.\n *\n * Both fire for a dual-write, so handlers must be cheap and idempotent — the\n * `shallowEqual` gate in `useNodeRuntime` is what keeps the extra fanout free.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: the flat-map subscription goes with the\n * mirror write and the read resolution (compat register items 1 and 2).\n */\nexport function subscribeToActionState(yDoc: Y.Doc, handler: () => void): () => void {\n  assertDoc(yDoc, 'subscribeToActionState');\n  // Top-level maps have stable identity per doc, so the same handles are valid\n  // for `unobserve` later. Nested containers must never be captured this way.\n  const runs = getRunsMap(yDoc);\n  runs.observeDeep(handler);\n  const flat = usesLegacyRuntimeCompatibility(yDoc) ? getLegacyRuntimeMap(yDoc) : undefined;\n  flat?.observe(handler);\n  return () => {\n    runs.unobserveDeep(handler);\n    flat?.unobserve(handler);\n  };\n}\n\n/**\n * The session a surface should show, or `undefined` when the flow has none.\n *\n * `undefined` is a real answer, not a failure: a new flow has no session until\n * an actor starts one, and a legacy flow has none until it is migrated. Read\n * surfaces must render that state rather than substituting a run id — a\n * fabricated id is what made an unstarted flow display a phantom session.\n *\n * The pointer is advisory and is only honoured when it names a run that\n * actually exists, so a stale pointer (a cloned template, a deleted run) reads\n * as \"no session\" rather than as a missing container.\n */\nexport function resolveActiveRunId(yDoc?: Y.Doc): string | undefined {\n  if (yDoc && typeof yDoc.getMap === 'function') {\n    const advisory = getExistingYMap(yDoc, 'root')?.get('activeRunId');\n    if (typeof advisory === 'string' && advisory.length > 0 && getExistingRunsMap(yDoc)?.has(advisory)) {\n      return advisory;\n    }\n  }\n  return undefined;\n}\n\n/**\n * The run id a **read** should resolve against, or `undefined` when there is\n * nothing to read.\n *\n * The read-side counterpart to {@link resolveRunIdForExecution}, which throws\n * rather than returning nothing — right for a write, wrong for a status panel\n * or a reference resolver, where \"this flow has no session yet\" is an ordinary\n * thing to render.\n *\n * A legacy, unmigrated document still has state to show: it lives in the flat\n * map, and the unsessioned id reaches it.\n */\nexport function resolveRunIdForRead(yDoc: Y.Doc, requestedRunId?: string): string | undefined {\n  assertDoc(yDoc, 'resolveRunIdForRead');\n  if (requestedRunId) return requestedRunId;\n  return resolveActiveRunId(yDoc) ?? (usesLegacyRuntimeCompatibility(yDoc) ? UNSESSIONED_RUN_ID : undefined);\n}\n\n/**\n * `FlowRuntimeStateManager` over a run. Drop-in for `createYDocRuntimeManager`.\n *\n * **Throws rather than degrading.** `createRuntimeStateManager` silently\n * returns an in-memory `Map` when it cannot resolve a doc; under runs that\n * means the action executes, the side effect happens, and nothing persists — so\n * the next reader sees an un-run block and executes it again. A throw surfaces\n * as a failed block, which is recoverable; a silent memory manager is not.\n */\nexport function createRunScopedRuntimeManager(yDoc: Y.Doc, runId: string): FlowRuntimeStateManager {\n  assertDoc(yDoc, 'createRunScopedRuntimeManager');\n  if (!runId) {\n    throw new Error('[runs] createRunScopedRuntimeManager requires a runId');\n  }\n  return {\n    get: (nodeId: string) => readActionState(yDoc, runId, nodeId),\n    update: (nodeId: string, updates: Partial<FlowNodeRuntimeState>) => {\n      writeActionState(yDoc, runId, nodeId, updates);\n    },\n  };\n}\n\n/**\n * Duck-typed `{ get(blockId) }` shim for `referenceResolver`'s `options.yRuntime`,\n * which only ever calls `.get(blockId)`. Returns `undefined` for an unknown\n * block, exactly as the flat `Y.Map` it replaces does, so every existing\n * `stored?.output` read behaves identically.\n *\n * Resolves from the doc on every `get` — the reader object may safely be\n * memoised, but the container it reads must not be.\n *\n * Uses the same {@link resolveActionState} predicate as {@link readActionState}:\n * a reference like `{{block.output.txHash}}` must see the same value the block's\n * own UI does, or a downstream action signs against a run entry that a stale\n * `idle` seed is hiding.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: compat register item 2.\n */\nexport function createRunRuntimeReader(yDoc: Y.Doc, runId: string): { get(blockId: string): FlowNodeRuntimeState | undefined } {\n  assertDoc(yDoc, 'createRunRuntimeReader');\n  return {\n    get(blockId: string): FlowNodeRuntimeState | undefined {\n      const runEntry = getRunActionsMap(yDoc, runId)?.get(blockId);\n      if (!usesLegacyRuntimeCompatibility(yDoc)) {\n        const state = asStateObject(runEntry);\n        return state ? cloneState(state) : undefined;\n      }\n      const flatEntry = getLegacyRuntimeMap(yDoc).get(blockId);\n      const resolved = resolveActionState(runEntry, flatEntry);\n      // `undefined` for an unknown block, exactly as the flat `Y.Map` does.\n      return resolved.winner === 'neither' ? undefined : resolved.value;\n    },\n  };\n}\n\n/**\n * {@link createRunRuntimeReader} plus the `.doc` handle, for the `_yRuntime`\n * slot of a **synthetic editor** — the `{ _yDoc, _yRuntime, document }` object\n * `actionExecutor` and `readBackReconciler` fabricate when they are driven\n * headlessly from a Y.Doc.\n *\n * Two properties matter:\n *\n * 1. **Read-only.** There is no `set`. The headless write path goes through\n *    {@link writeActionState} directly, so there is exactly one duck-typed\n *    handle in the system and it cannot write. A synthetic `_yRuntime` that\n *    was the raw flat `Y.Map` (what these call sites used before Ignition) is a\n *    writer outside this waist by construction.\n * 2. **`.doc` is present**, because `editor._yRuntime?.doc` is an established\n *    way to reach the Y.Doc in this repo (`useEntities.ts`, `DebugButton.tsx`),\n *    and the shim must not be the thing that breaks it.\n *\n * PHASE A COMPAT — REMOVAL TRIGGER: compat register item 2, with the reader.\n */\nexport function createRunRuntimeReaderWithDoc(yDoc: Y.Doc, runId: string): { get(blockId: string): FlowNodeRuntimeState | undefined; doc: Y.Doc } {\n  return Object.assign(createRunRuntimeReader(yDoc, runId), { doc: yDoc });\n}\n"],"mappings":";;;;;;;;;AAOO,SAAS,iBAAiB,MAAc,OAAuB;AACpE,SAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AAGO,SAAS,oBAAoB,OAAwB;AAC1D,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,KAAK,UAAU,KAAK;AACxF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mDAAmD;AAChG,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,CAAC,SAAU,SAAS,SAAY,SAAS,oBAAoB,IAAI,CAAE,EAAE,KAAK,GAAG,CAAC;AAC7H,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,SAAS,OAAO,QAAQ,KAAgC,EAC3D,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,SAAS,MAAS,EACvC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5C,WAAO,IAAI,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,oBAAoB,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,EACzG;AACA,QAAM,IAAI,MAAM,kCAAkC,OAAO,KAAK,EAAE;AAClE;AAEA,IAAM,WAAW,IAAI,YAAY;AAAA,EAC/B;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAC5J;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAC5J;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAC5J;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAC5J;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACtF,CAAC;AAED,SAAS,YAAY,OAAe,MAAsB;AACxD,SAAQ,UAAU,OAAS,SAAU,KAAK;AAC5C;AAGO,SAAS,UAAU,MAAsB;AAC9C,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAC3C,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,KAAK,MAAM,MAAM,SAAS,KAAK,EAAE,IAAI;AAC1D,QAAM,QAAQ,IAAI,WAAW,YAAY;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,MAAM,MAAM,IAAI;AACtB,QAAM,OAAO,IAAI,SAAS,MAAM,MAAM;AACtC,OAAK,UAAU,eAAe,GAAG,KAAK,MAAM,YAAY,UAAW,GAAG,KAAK;AAC3E,OAAK,UAAU,eAAe,GAAG,cAAc,GAAG,KAAK;AAEvD,QAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,YAAY,YAAY,YAAY,YAAY,YAAY,WAAY,UAAU,CAAC;AAC9H,QAAM,QAAQ,IAAI,YAAY,EAAE;AAEhC,WAAS,SAAS,GAAG,SAAS,MAAM,QAAQ,UAAU,IAAI;AACxD,aAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,EAAG,OAAM,KAAK,IAAI,KAAK,UAAU,SAAS,QAAQ,GAAG,KAAK;AACnG,aAAS,QAAQ,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC3C,YAAM,KAAK,YAAY,MAAM,QAAQ,EAAE,GAAG,CAAC,IAAI,YAAY,MAAM,QAAQ,EAAE,GAAG,EAAE,IAAK,MAAM,QAAQ,EAAE,MAAM;AAC3G,YAAM,KAAK,YAAY,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,YAAY,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAK,MAAM,QAAQ,CAAC,MAAM;AACzG,YAAM,KAAK,IAAK,MAAM,QAAQ,EAAE,IAAI,KAAK,MAAM,QAAQ,CAAC,IAAI,OAAQ;AAAA,IACtE;AAEA,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,IAAI,MAAM,CAAC;AACf,aAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,GAAG;AAC1C,YAAM,OAAO,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,EAAE,IAAI,YAAY,GAAG,EAAE;AACvE,YAAM,SAAU,IAAI,IAAM,CAAC,IAAI;AAC/B,YAAM,QAAS,IAAI,OAAO,SAAS,SAAS,KAAK,IAAI,MAAM,KAAK,MAAO;AACvE,YAAM,OAAO,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,EAAE,IAAI,YAAY,GAAG,EAAE;AACvE,YAAM,WAAY,IAAI,IAAM,IAAI,IAAM,IAAI;AAC1C,YAAM,QAAS,OAAO,aAAc;AACpC,UAAI;AACJ,UAAI;AACJ,UAAI;AACJ,UAAK,IAAI,UAAW;AACpB,UAAI;AACJ,UAAI;AACJ,UAAI;AACJ,UAAK,QAAQ,UAAW;AAAA,IAC1B;AACA,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAC9B,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAC9B,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAC9B,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAC9B,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAC9B,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAC9B,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAC9B,UAAM,CAAC,IAAK,MAAM,CAAC,IAAI,MAAO;AAAA,EAChC;AAEA,SAAO,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAChF;AAEO,SAAS,aAAa,OAAoC;AAC/D,SAAO,UAAU,UAAU,oBAAoB,KAAK,CAAC,CAAC;AACxD;;;ACvGA,OAAO,aAA0D;AAKjE,IAAM,cAAc,EAAE,MAAM,SAAS,OAAO,EAAE,MAAM,SAAS,EAAE;AAC/D,IAAM,SAAS,EAAE,MAAM,UAAU,SAAS,wBAAwB;AAClE,IAAM,WAAW;AAAA,EACf,MAAM;AAAA,EACN,SAAS;AACX;AAGO,IAAM,yCAAyC;AAC/C,IAAM,wCAAwC,KAAK;AAE1D,SAAS,OAAO,UAAoB,YAA4C;AAC9E,SAAO,EAAE,MAAM,UAAU,UAAU,sBAAsB,OAAO,WAAW;AAC7E;AAEO,IAAM,oCAA8E;AAAA,EACzF;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,WAAW,gBAAgB,WAAW,kBAAkB,eAAe,mBAAmB,kBAAkB,GAAG;AAAA,MAClI,SAAS,EAAE,MAAM,SAAS;AAAA,MAC1B,cAAc,EAAE,MAAM,SAAS;AAAA,MAC/B,SAAS,EAAE,MAAM,SAAS;AAAA,MAC1B,gBAAgB,EAAE,MAAM,SAAS;AAAA,MACjC,aAAa;AAAA,MACb,iBAAiB,EAAE,MAAM,SAAS;AAAA,MAClC,kBAAkB;AAAA,IACpB,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,WAAW,gBAAgB,WAAW,YAAY,kBAAkB,eAAe,mBAAmB,gBAAgB,GAAG;AAAA,MAC5I,SAAS,EAAE,MAAM,SAAS;AAAA,MAC1B,cAAc,EAAE,MAAM,SAAS;AAAA,MAC/B,SAAS,EAAE,MAAM,SAAS;AAAA,MAC1B,UAAU,EAAE,MAAM,SAAS;AAAA,MAC3B,gBAAgB,EAAE,MAAM,SAAS;AAAA,MACjC,aAAa;AAAA,MACb,mBAAmB,EAAE,MAAM,SAAS;AAAA,MACpC,iBAAiB,EAAE,MAAM,SAAS;AAAA,MAClC,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,SAAS,cAAc,yBAAyB,GAAG;AAAA,MACtE,OAAO,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,WAAW,EAAE;AAAA,MACxD,YAAY,EAAE,MAAM,SAAS;AAAA,MAC7B,YAAY,EAAE,MAAM,SAAS;AAAA,MAC7B,yBAAyB,EAAE,MAAM,SAAS;AAAA,MAC1C,aAAa,EAAE,MAAM,SAAS;AAAA,MAC9B,OAAO,EAAE,MAAM,SAAS;AAAA,MACxB,eAAe,EAAE,MAAM,SAAS;AAAA,MAChC,mBAAmB;AAAA,MACnB,2BAA2B;AAAA,MAC3B,QAAQ,EAAE,MAAM,SAAS;AAAA,MACzB,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,iBAAiB;AAAA,MACjB,UAAU,EAAE,MAAM,SAAS;AAAA,MAC3B,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,UAAU,gBAAgB,SAAS,eAAe,QAAQ,sBAAsB,sBAAsB,YAAY,YAAY,GAAG;AAAA,MACpJ,QAAQ,EAAE,MAAM,SAAS;AAAA,MACzB,cAAc,EAAE,MAAM,SAAS;AAAA,MAC/B,OAAO,EAAE,MAAM,UAAU,MAAM,CAAC,aAAa,cAAc,eAAe,oBAAoB,WAAW,EAAE;AAAA,MAC3G,aAAa,EAAE,MAAM,SAAS;AAAA,MAC9B,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,oBAAoB;AAAA,MACpB,oBAAoB;AAAA,MACpB,UAAU,EAAE,MAAM,SAAS;AAAA,MAC3B,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,aAAa,UAAU,gBAAgB,sBAAsB,kBAAkB,0BAA0B,GAAG;AAAA,MAC/H,WAAW,EAAE,MAAM,SAAS;AAAA,MAC5B,QAAQ,EAAE,aAAa,yCAAyC;AAAA,MAChE,cAAc;AAAA,MACd,oBAAoB;AAAA,MACpB,gBAAgB;AAAA,MAChB,0BAA0B,EAAE,MAAM,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,aAAa,UAAU,0BAA0B,GAAG;AAAA,MACvE,WAAW,EAAE,MAAM,SAAS;AAAA,MAC5B,QAAQ,EAAE,OAAO,YAAY;AAAA,MAC7B,0BAA0B,EAAE,MAAM,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,YAAY,YAAY,cAAc,sBAAsB,gBAAgB,GAAG;AAAA,MAClG,UAAU,EAAE,MAAM,SAAS;AAAA,MAC3B,UAAU,EAAE,aAAa,2CAA2C;AAAA,MACpE,YAAY,EAAE,aAAa,6CAA6C;AAAA,MACxE,oBAAoB;AAAA,MACpB,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EACA,GAAI,CAAC,YAAY,UAAU,EAAY;AAAA,IACrC,CAAC,YAA2C;AAAA,MAC1C,MAAM,iBAAiB,MAAM;AAAA,MAC7B,SAAS;AAAA,MACT,aAAa,WAAW,aAAa,oBAAoB;AAAA,MACzD,aAAa,WAAW,aAAa,wDAAwD;AAAA,MAC7F,aAAa,OAAO,CAAC,UAAU,UAAU,0BAA0B,gBAAgB,sBAAsB,eAAe,YAAY,GAAG;AAAA,QACrI,QAAQ,EAAE,MAAM,SAAS;AAAA,QACzB,QAAQ,EAAE,OAAO,OAAO;AAAA,QACxB,wBAAwB,EAAE,MAAM,SAAS;AAAA,QACzC,cAAc,EAAE,MAAM,SAAS;AAAA,QAC/B,oBAAoB;AAAA,QACpB,aAAa,EAAE,MAAM,SAAS;AAAA,QAC9B,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,GAAI,CAAC,aAAa,QAAQ,EAAY;AAAA,IACpC,CAAC,UAAyC;AAAA,MACxC,MAAM,4BAA4B,IAAI;AAAA,MACtC,SAAS;AAAA,MACT,aAAa,SAAS,WAAW,wBAAwB;AAAA,MACzD,aAAa,SAAS,WAAW,8DAA8D;AAAA,MAC/F,aAAa;AAAA,QACX,CAAC,SAAS,WAAW,aAAa,eAAe,kBAAkB,uBAAuB,kBAAkB,gBAAgB,sBAAsB,WAAW;AAAA,QAC7J;AAAA,UACE,aAAa,EAAE,MAAM,SAAS;AAAA,UAC9B,UAAU,EAAE,MAAM,SAAS;AAAA,UAC3B,gBAAgB,EAAE,MAAM,UAAU,aAAa,qDAAqD,sBAAsB,KAAK;AAAA,UAC/H,qBAAqB,EAAE,MAAM,SAAS;AAAA,UACtC,gBAAgB,EAAE,MAAM,SAAS;AAAA,UACjC,cAAc,EAAE,MAAM,SAAS;AAAA,UAC/B,oBAAoB;AAAA,UACpB,WAAW,EAAE,MAAM,SAAS;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,gBAAgB,wBAAwB,4BAA4B,QAAQ,GAAG;AAAA,MAClG,cAAc,EAAE,MAAM,SAAS;AAAA,MAC/B,sBAAsB,EAAE,MAAM,SAAS;AAAA,MACvC,0BAA0B,EAAE,MAAM,SAAS;AAAA,MAC3C,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,aAAa,aAAa,oBAAoB,EAAE;AAAA,IACnF,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,YAAY,qBAAqB,cAAc,sBAAsB,WAAW,gBAAgB,cAAc,2BAA2B,GAAG;AAAA,MAC/J,UAAU,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,UAAU,QAAQ,UAAU,EAAE;AAAA,MACxE,mBAAmB;AAAA,MACnB,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,SAAS,EAAE,MAAM,SAAS;AAAA,MAC1B,cAAc,EAAE,MAAM,SAAS;AAAA,MAC/B,YAAY;AAAA,MACZ,2BAA2B;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa,OAAO,CAAC,cAAc,qBAAqB,sBAAsB,cAAc,YAAY,GAAG;AAAA,MACzG,YAAY,EAAE,MAAM,SAAS;AAAA,MAC7B,mBAAmB;AAAA,MACnB,oBAAoB;AAAA,MACpB,YAAY,EAAE,MAAM,SAAS;AAAA,MAC7B,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACF;AAEA,IAAM,oBAAoB,IAAI,IAAI,kCAAkC,IAAI,CAAC,eAAe,CAAC,WAAW,MAAM,UAAU,CAAC,CAAC;AACtH,IAAM,MAAM,IAAI,QAAQ,EAAE,WAAW,MAAM,QAAQ,MAAM,CAAC;AAC1D,IAAM,aAAa,oBAAI,IAA8B;AAM9C,SAAS,kCAAkC,OAA2D;AAC3G,SAAO,MAAM,IAAI,CAAC,SAAS,kBAAkB,IAAI,IAAI,CAAC,EAAE,OAAO,CAAC,eAA4D,CAAC,CAAC,UAAU;AAC1I;AAMO,SAAS,4BAA4B,QAAiB,OAAiE;AAC5H,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,EAAE,OAAO,OAAO,MAAM,0BAA0B;AAC3H,QAAM,YAAY;AAClB,QAAM,eAAe,oBAAI,IAAI,CAAC,QAAQ,MAAM,WAAW,SAAS,oBAAoB,CAAC;AACrF,MACE,OAAO,KAAK,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,IAAI,GAAG,CAAC,KAC3D,OAAO,UAAU,SAAS,YAC1B,OAAO,UAAU,OAAO,YACxB,CAAC,UAAU,MACX,CAAC,OAAO,UAAU,UAAU,OAAO,KACnC,OAAO,UAAU,OAAO,IAAI,KAC5B,CAAC,UAAU,SACX,OAAO,UAAU,UAAU,YAC3B,MAAM,QAAQ,UAAU,KAAK,GAC7B;AACA,WAAO,EAAE,OAAO,OAAO,MAAM,0BAA0B;AAAA,EACzD;AACA,MAAI,UAAU,uBAAuB,WAAc,CAAC,MAAM,QAAQ,UAAU,kBAAkB,KAAK,UAAU,mBAAmB,KAAK,CAAC,SAAS,OAAO,SAAS,QAAQ,IAAI;AACzK,WAAO,EAAE,OAAO,OAAO,MAAM,0BAA0B;AAAA,EACzD;AACA,QAAM,aAAa,MAAM,oBAAoB,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU,IAAI;AACxF,MAAI,CAAC,WAAY,QAAO,EAAE,OAAO,OAAO,MAAM,sBAAsB;AACpE,MAAI,UAAU,YAAY,WAAW,QAAS,QAAO,EAAE,OAAO,OAAO,MAAM,6BAA6B;AACxG,QAAM,eAAe,GAAG,WAAW,IAAI,IAAI,WAAW,OAAO,IAAI,aAAa,WAAW,WAAW,CAAC;AACrG,MAAI,WAAW,WAAW,IAAI,YAAY;AAC1C,MAAI,CAAC,UAAU;AACb,eAAW,IAAI,QAAQ,WAAW,WAAW;AAC7C,eAAW,IAAI,cAAc,QAAQ;AAAA,EACvC;AACA,MAAI,CAAC,SAAS,UAAU,KAAK,EAAG,QAAO,EAAE,OAAO,OAAO,MAAM,wBAAwB,QAAQ,SAAS,UAAU,OAAU;AAC1H,SAAO,EAAE,OAAO,MAAM,WAAW;AACnC;AAGO,SAAS,iCAAiC,SAA6B,OAAsE;AAClJ,MAAI,QAAQ,SAAS,uCAAwC,QAAO,EAAE,OAAO,OAAO,MAAM,mBAAmB;AAC7G,aAAW,UAAU,SAAS;AAC5B,UAAM,aAAa,4BAA4B,QAAQ,KAAK;AAC5D,QAAI,CAAC,WAAW,MAAO,QAAO;AAAA,EAChC;AACA,MAAI;AACF,UAAM,aAAa,IAAI,YAAY,EAAE,OAAO,oBAAoB,OAAO,CAAC,EAAE;AAC1E,QAAI,aAAa,sCAAuC,QAAO,EAAE,OAAO,OAAO,MAAM,yBAAyB;AAAA,EAChH,QAAQ;AACN,WAAO,EAAE,OAAO,OAAO,MAAM,uBAAuB;AAAA,EACtD;AACA,SAAO,EAAE,OAAO,KAAK;AACvB;;;AC9QA,IAAM,cAAsC;AAAA,EAC1C,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,8BAA8B;AAAA,EAC9B,gCAAgC;AAAA,EAChC,qCAAqC;AAAA,EACrC,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,6BAA6B;AAAA,EAC7B,+BAA+B;AAAA,EAC/B,+BAA+B;AAAA,EAC/B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,yBAAyB;AAAA,EACzB,6BAA6B;AAAA,EAC7B,4BAA4B;AAAA,EAC5B,8BAA8B;AAAA,EAC9B,8BAA8B;AAAA,EAC9B,2BAA2B;AAAA,EAC3B,8BAA8B;AAAA,EAC9B,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,6BAA6B;AAAA,EAC7B,2BAA2B;AAAA,EAC3B,4BAA4B;AAAA,EAC5B,6BAA6B;AAAA,EAC7B,4BAA4B;AAAA,EAC5B,qBAAqB;AAAA;AAAA,EAErB,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,+BAA+B;AAAA;AAAA;AAAA,EAG/B,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,uBAAuB;AAAA;AAAA,EAEvB,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA;AAAA,EAEvB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,0BAA0B;AAC5B;AAEA,IAAM,cAAsC,OAAO,YAAY,OAAO,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAGrH,SAAS,UAAU,KAAiC;AACzD,SAAO,YAAY,GAAG;AACxB;AAGO,SAAS,UAAU,MAAkC;AAC1D,SAAO,YAAY,IAAI;AACzB;AAGO,SAAS,oBAAkE;AAChF,SAAO,OAAO,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,EAAE,KAAK,KAAK,EAAE;AACzE;;;AC5FA,IAAM,eAA6D;AAAA,EACjE,QAAQ,EAAE,aAAa,kBAAkB,aAAa,sCAAsC;AAAA,EAC5F,iBAAiB,EAAE,aAAa,iBAAiB,aAAa,sCAAsC;AAAA,EACpG,mBAAmB,EAAE,aAAa,gBAAgB,aAAa,0BAA0B;AAAA,EACzF,iBAAiB,EAAE,aAAa,OAAO,aAAa,2BAA2B;AAAA,EAC/E,mBAAmB,EAAE,aAAa,gBAAgB,aAAa,mCAAmC;AAAA,EAClG,mBAAmB,EAAE,aAAa,gBAAgB,aAAa,iDAAiD;AAAA,EAChH,oBAAoB,EAAE,aAAa,iBAAiB,aAAa,sDAAsD;AAAA,EACvH,qBAAqB,EAAE,aAAa,kBAAkB,aAAa,4CAA4C;AAAA,EAC/G,iCAAiC,EAAE,aAAa,8BAA8B,aAAa,0DAA0D;AAAA,EACrJ,8BAA8B,EAAE,aAAa,2BAA2B,aAAa,uDAAuD;AAAA,EAC5I,iCAAiC,EAAE,aAAa,8BAA8B,aAAa,4DAA4D;AAAA,EACvJ,iCAAiC,EAAE,aAAa,6BAA6B,aAAa,kEAAkE;AAAA,EAC5J,+BAA+B,EAAE,aAAa,4BAA4B,aAAa,iDAAiD;AAAA,EACxI,6BAA6B,EAAE,aAAa,0BAA0B,aAAa,yDAAyD;AAAA,EAC5I,8BAA8B,EAAE,aAAa,2BAA2B,aAAa,8DAA8D;AAAA,EACnJ,wBAAwB,EAAE,aAAa,qBAAqB,aAAa,wCAAwC;AAAA,EACjH,gCAAgC,EAAE,aAAa,6BAA6B,aAAa,uDAAuD;AAAA,EAChJ,+BAA+B,EAAE,aAAa,+BAA+B,aAAa,oDAAoD;AAAA,EAC9I,8BAA8B,EAAE,aAAa,2BAA2B,aAAa,wCAAwC;AAAA,EAC7H,gCAAgC,EAAE,aAAa,6BAA6B,aAAa,2CAA2C;AAAA,EACpI,8BAA8B,EAAE,aAAa,iBAAiB,aAAa,yFAAyF;AAAA,EACpK,gCAAgC,EAAE,aAAa,6BAA6B,aAAa,2DAA2D;AAAA,EACpJ,+BAA+B,EAAE,aAAa,6BAA6B,aAAa,+DAA+D;AAAA,EACvJ,4BAA4B,EAAE,aAAa,yBAAyB,aAAa,0CAA0C;AAAA,EAC3H,0BAA0B,EAAE,aAAa,wBAAwB,aAAa,yCAAyC;AAAA,EACvH,4BAA4B,EAAE,aAAa,yBAAyB,aAAa,qCAAqC;AAAA,EACtH,qBAAqB,EAAE,aAAa,kBAAkB,aAAa,wCAAwC;AAAA,EAC3G,yBAAyB,EAAE,aAAa,uBAAuB,aAAa,sDAAsD;AAAA,EAClI,oBAAoB,EAAE,aAAa,iBAAiB,aAAa,qDAAqD;AAAA,EACtH,qBAAqB,EAAE,aAAa,kBAAkB,aAAa,4BAA4B;AAAA,EAC/F,mBAAmB,EAAE,aAAa,SAAS,aAAa,iBAAiB;AAAA,EACzE,2BAA2B,EAAE,aAAa,oBAAoB,aAAa,iDAAiD;AAAA,EAC5H,wBAAwB,EAAE,aAAa,2BAA2B,aAAa,yEAAyE;AAAA,EACxJ,uBAAuB,EAAE,aAAa,oBAAoB,aAAa,kEAAkE;AAAA,EACzI,uBAAuB,EAAE,aAAa,oBAAoB,aAAa,iDAAiD;AAAA,EACxH,uBAAuB,EAAE,aAAa,oBAAoB,aAAa,qDAAqD;AAAA,EAC5H,qBAAqB,EAAE,aAAa,kBAAkB,aAAa,2EAA2E;AAAA,EAC9I,0BAA0B,EAAE,aAAa,uBAAuB,aAAa,sEAAsE;AAAA,EACnJ,kBAAkB,EAAE,aAAa,eAAe,aAAa,iEAAiE;AAAA,EAC9H,iBAAiB,EAAE,aAAa,SAAS,aAAa,0BAA0B;AAAA,EAChF,mBAAmB,EAAE,aAAa,8BAA8B,aAAa,qEAAqE;AAAA,EAClJ,kBAAkB,EAAE,aAAa,qBAAqB,aAAa,uEAAuE;AAAA,EAC1I,wBAAwB,EAAE,aAAa,qBAAqB,aAAa,0CAA0C;AAAA,EACnH,qBAAqB,EAAE,aAAa,kBAAkB,aAAa,gEAAgE;AAAA,EACnI,uBAAuB,EAAE,aAAa,oBAAoB,aAAa,wDAAwD;AAAA,EAC/H,qBAAqB,EAAE,aAAa,kBAAkB,aAAa,qDAAqD;AAAA,EACxH,qBAAqB,EAAE,aAAa,kBAAkB,aAAa,gCAAgC;AAAA,EACnG,0BAA0B,EAAE,aAAa,wBAAwB,aAAa,oCAAoC;AAAA,EAClH,sBAAsB,EAAE,aAAa,mBAAmB,aAAa,iDAAiD;AAAA,EACtH,kBAAkB,EAAE,aAAa,eAAe,aAAa,yBAAyB;AAAA,EACtF,uBAAuB,EAAE,aAAa,oBAAoB,aAAa,yDAAyD;AAAA,EAChI,kCAAkC,EAAE,aAAa,qCAAqC,aAAa,2DAA2D;AAAA,EAC9J,uCAAuC,EAAE,aAAa,yBAAyB,aAAa,0CAA0C;AAAA,EACtI,qCAAqC,EAAE,aAAa,wBAAwB,aAAa,yCAAyC;AAAA,EAClI,uCAAuC,EAAE,aAAa,yBAAyB,aAAa,qCAAqC;AAAA,EACjI,4BAA4B,EAAE,aAAa,6BAA6B,aAAa,4DAA4D;AAAA,EACjJ,6BAA6B,EAAE,aAAa,uBAAuB,aAAa,+DAA+D;AAAA,EAC/I,8BAA8B,EAAE,aAAa,wBAAwB,aAAa,sDAAsD;AAAA,EACxI,uCAAuC,EAAE,aAAa,yBAAyB,aAAa,gEAAgE;AAAA,EAC5J,kCAAkC,EAAE,aAAa,oBAAoB,aAAa,6DAA6D;AAAA,EAC/I,sCAAsC,EAAE,aAAa,wBAAwB,aAAa,4DAA4D;AAAA,EACtJ,sCAAsC,EAAE,aAAa,qBAAqB,aAAa,kEAAkE;AAAA,EACzJ,kCAAkC,EAAE,aAAa,oBAAoB,aAAa,0EAA0E;AAAA,EAC5J,uCAAuC,EAAE,aAAa,yBAAyB,aAAa,2EAA2E;AAAA,EACvK,gCAAgC,EAAE,aAAa,kBAAkB,aAAa,yDAAyD;AAAA,EACvI,2CAA2C,EAAE,aAAa,yBAAyB,aAAa,2DAA2D;AAAA,EAC3J,gCAAgC,EAAE,aAAa,qBAAqB,aAAa,oEAAoE;AAAA,EACrJ,mCAAmC,EAAE,aAAa,iBAAiB,aAAa,qDAAqD;AAAA,EACrI,0BAA0B,EAAE,aAAa,eAAe,aAAa,yDAAyD;AAAA,EAC9H,oCAAoC,EAAE,aAAa,wBAAwB,aAAa,oEAAoE;AAAA,EAC5J,oCAAoC,EAAE,aAAa,kBAAkB,aAAa,sDAAsD;AAAA,EACxI,iCAAiC,EAAE,aAAa,mBAAmB,aAAa,0DAA0D;AAAA,EAC1I,iCAAiC,EAAE,aAAa,uBAAuB,aAAa,2DAA2D;AAAA,EAC/I,0BAA0B,EAAE,aAAa,YAAY,aAAa,0DAA0D;AAAA,EAC5H,wCAAwC,EAAE,aAAa,0BAA0B,aAAa,mEAAmE;AAAA,EACjK,8BAA8B,EAAE,aAAa,gBAAgB,aAAa,gDAAgD;AAAA,EAC1H,mCAAmC,EAAE,aAAa,gCAAgC,aAAa,wDAAwD;AAAA,EACvJ,+BAA+B,EAAE,aAAa,yBAAyB,aAAa,gGAA2F;AAAA,EAC/K,wCAAwC,EAAE,aAAa,gBAAgB,aAAa,qEAAqE;AAAA,EACzJ,4CAA4C,EAAE,aAAa,6BAA6B,aAAa,qEAAqE;AAAA,EAC1K,kCAAkC,EAAE,aAAa,0BAA0B,aAAa,sDAAsD;AAAA,EAC9I,gDAAgD,EAAE,aAAa,mBAAmB,aAAa,+DAA0D;AAAA,EACzJ,wCAAwC,EAAE,aAAa,cAAc,aAAa,8CAA8C;AAAA,EAChI,8CAA8C,EAAE,aAAa,mBAAmB,aAAa,yDAAyD;AAAA,EACtJ,iDAAiD,EAAE,aAAa,uBAAuB,aAAa,sEAAiE;AAAA,EACrK,mCAAmC,EAAE,aAAa,qBAAqB,aAAa,iEAAiE;AAAA,EACrJ,mBAAmB,EAAE,aAAa,gBAAgB,aAAa,2BAA2B;AAAA,EAC1F,iBAAiB,EAAE,aAAa,uBAAuB,aAAa,kCAAkC;AAAA,EACtG,wBAAwB,EAAE,aAAa,qBAAqB,aAAa,4DAA4D;AAAA,EACrI,iCAAiC,EAAE,aAAa,8BAA8B,aAAa,sDAAsD;AAAA,EACjJ,yBAAyB,EAAE,aAAa,gBAAgB,aAAa,6BAA6B;AAAA,EAClG,wBAAwB,EAAE,aAAa,qBAAqB,aAAa,gCAAgC;AAAA,EACzG,sBAAsB,EAAE,aAAa,mBAAmB,aAAa,uDAAuD;AAAA,EAC5H,iBAAiB,EAAE,aAAa,cAAc,aAAa,kCAAkC;AAAA,EAC7F,iBAAiB,EAAE,aAAa,+BAA+B,aAAa,oEAAoE;AAAA,EAChJ,gBAAgB,EAAE,aAAa,aAAa,aAAa,mCAAmC;AAAA,EAC5F,sBAAsB,EAAE,aAAa,2BAA2B,aAAa,2CAA2C;AAAA,EACxH,wBAAwB,EAAE,aAAa,qBAAqB,aAAa,2BAA2B;AAAA,EACpG,6BAA6B,EAAE,aAAa,oBAAoB,aAAa,qDAAqD;AAAA,EAClI,sBAAsB,EAAE,aAAa,0BAA0B,aAAa,2CAA2C;AAAA,EACvH,oBAAoB,EAAE,aAAa,iBAAiB,aAAa,sCAAsC;AAAA,EACvG,yBAAyB,EAAE,aAAa,4BAA4B,aAAa,8CAA8C;AAAA,EAC/H,yBAAyB,EAAE,aAAa,2BAA2B,aAAa,sCAAsC;AAAA,EACtH,oBAAoB,EAAE,aAAa,kBAAkB,aAAa,sCAAsC;AAAA,EACxG,yBAAyB,EAAE,aAAa,uBAAuB,aAAa,sDAAsD;AAAA,EAClI,0BAA0B,EAAE,aAAa,wBAAwB,aAAa,4CAA4C;AAAA,EAC1H,mCAAmC,EAAE,aAAa,iCAAiC,aAAa,8DAA8D;AAAA,EAC9J,yBAAyB,EAAE,aAAa,sBAAsB,aAAa,2DAA2D;AAAA,EACtI,gCAAgC,EAAE,aAAa,kBAAkB,aAAa,wDAAwD;AAAA,EACtI,kCAAkC,EAAE,aAAa,oBAAoB,aAAa,0CAA0C;AAAA,EAC5H,kCAAkC,EAAE,aAAa,8BAA8B,aAAa,6CAA6C;AAAA,EACzI,4BAA4B,EAAE,aAAa,wBAAwB,aAAa,oDAAoD;AAAA,EACpI,4BAA4B,EAAE,aAAa,yBAAyB,aAAa,2CAA2C;AAAA,EAC5H,8BAA8B,EAAE,aAAa,wBAAwB,aAAa,8CAA8C;AAAA,EAChI,sBAAsB,EAAE,aAAa,mBAAmB,aAAa,yCAAyC;AAAA,EAC9G,oBAAoB,EAAE,aAAa,oBAAoB,aAAa,uCAAuC;AAAA,EAC3G,sBAAsB,EAAE,aAAa,mBAAmB,aAAa,2CAA2C;AAAA,EAChH,wBAAwB,EAAE,aAAa,qBAAqB,aAAa,iDAAiD;AAAA,EAC1H,yBAAyB,EAAE,aAAa,sBAAsB,aAAa,+DAA+D;AAAA,EAC1I,yBAAyB,EAAE,aAAa,sBAAsB,aAAa,uEAAuE;AAAA,EAClJ,0BAA0B,EAAE,aAAa,uBAAuB,aAAa,gDAAgD;AAAA,EAC7H,kCAAkC,EAAE,aAAa,yBAAyB,aAAa,2DAA2D;AAAA,EAClJ,2BAA2B,EAAE,aAAa,wBAAwB,aAAa,uDAAuD;AAAA,EACtI,yBAAyB,EAAE,aAAa,sBAAsB,aAAa,qDAAqD;AAAA,EAChI,mCAAmC,EAAE,aAAa,uBAAuB,aAAa,kDAAkD;AAAA,EACxI,4BAA4B,EAAE,aAAa,yBAAyB,aAAa,kDAAkD;AAAA,EACnI,kCAAkC,EAAE,aAAa,yBAAyB,aAAa,kDAAkD;AAAA,EACzI,sBAAsB,EAAE,aAAa,sBAAsB,aAAa,6CAA6C;AAAA,EACrH,wBAAwB,EAAE,aAAa,0BAA0B,aAAa,iDAAiD;AAAA,EAC/H,0BAA0B,EAAE,aAAa,6BAA6B,aAAa,6DAA6D;AAAA,EAChJ,4BAA4B,EAAE,aAAa,yBAAyB,aAAa,wDAAwD;AAAA,EACzI,4BAA4B,EAAE,aAAa,yBAAyB,aAAa,gDAAgD;AAAA,EACjI,8BAA8B,EAAE,aAAa,uBAAuB,aAAa,sDAAsD;AAAA,EACvI,gBAAgB,EAAE,aAAa,aAAa,aAAa,4CAA4C;AAAA,EACrG,uBAAuB,EAAE,aAAa,4BAA4B,aAAa,uDAAuD;AAAA,EACtI,kBAAkB,EAAE,aAAa,eAAe,aAAa,0CAA0C;AAAA,EACvG,sBAAsB,EAAE,aAAa,mBAAmB,aAAa,iCAAiC;AAAA,EACtG,6BAA6B,EAAE,aAAa,0BAA0B,aAAa,8CAA8C;AAAA,EACjI,kBAAkB,EAAE,aAAa,eAAe,aAAa,mDAAmD;AAAA,EAChH,kBAAkB,EAAE,aAAa,eAAe,aAAa,mCAAmC;AAAA,EAChG,sBAAsB,EAAE,aAAa,0BAA0B,aAAa,oDAAoD;AAAA,EAChI,oBAAoB,EAAE,aAAa,iBAAiB,aAAa,yCAAyC;AAAA,EAC1G,kBAAkB,EAAE,aAAa,eAAe,aAAa,mCAAmC;AAAA,EAChG,0BAA0B,EAAE,aAAa,uBAAuB,aAAa,qCAAqC;AAAA,EAClH,0BAA0B,EAAE,aAAa,uBAAuB,aAAa,2BAA2B;AAAA,EACxG,wBAAwB,EAAE,aAAa,sBAAsB,aAAa,2BAA2B;AAAA,EACrG,0BAA0B,EAAE,aAAa,uBAAuB,aAAa,4FAAuF;AACtK;AAEA,SAAS,mBAAmB,MAAsB;AAChD,QAAM,mBAAmB,KAAK,QAAQ,SAAS,EAAE,EAAE,QAAQ,cAAc,SAAS;AAClF,QAAM,QAAQ,iBACX,QAAQ,sBAAsB,OAAO,EACrC,MAAM,SAAS,EACf,OAAO,OAAO;AACjB,SAAO,MAAM,IAAI,CAAC,SAAU,wCAAwC,KAAK,IAAI,IAAI,KAAK,YAAY,IAAI,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,CAAE,EAAE,KAAK,GAAG;AAC/J;AAGO,SAAS,sBAAsB,MAAkC;AACtE,QAAM,aAAa,aAAa,IAAI;AACpC,MAAI,WAAY,QAAO;AACvB,QAAM,cAAc,mBAAmB,IAAI,KAAK;AAChD,SAAO,EAAE,aAAa,aAAa,WAAW,YAAY,YAAY,CAAC,yBAAyB;AAClG;;;AChKO,IAAM,0BAA0B,CAAC,QAAQ,cAAc,YAAY,cAAc,UAAU,YAAY,cAAc,UAAU;AAuR/H,IAAK,sBAAL,kBAAKA,yBAAL;AACL,EAAAA,0CAAA,UAAO,KAAP;AACA,EAAAA,0CAAA,YAAS,KAAT;AACA,EAAAA,0CAAA,YAAS,KAAT;AAHU,SAAAA;AAAA,GAAA;;;ACtRZ,IAAM,YAAY,CAAC,GAAG,uBAAuB;AAE7C,IAAM,cAAc;AAAA,EAClB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,aAAa,CAAC,0CAA0C,kFAAkF;AAEhJ,SAAS,IAAI,UAAoB,OAAwB;AACvD,SAAO,SAAS,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AACvD;AAEA,SAAS,iBAAiB,MAAwB;AAChD,MAAI,KAAK,WAAW,UAAU,EAAG,QAAO,CAAC,MAAM;AAC/C,MAAI,SAAS,gBAAiB,QAAO,CAAC,OAAO;AAC7C,MAAI,SAAS,uBAAwB,QAAO,CAAC,eAAe;AAC5D,MAAI,4DAA4D,KAAK,IAAI,EAAG,QAAO,CAAC,cAAc;AAClG,MAAI,mBAAmB,KAAK,IAAI,EAAG,QAAO,CAAC,UAAU;AACrD,MAAI,mBAAmB,KAAK,IAAI,EAAG,QAAO,CAAC,WAAW;AACtD,MAAI,aAAa,KAAK,IAAI,EAAG,QAAO,CAAC,KAAK;AAC1C,MAAI,eAAe,KAAK,IAAI,EAAG,QAAO,CAAC,OAAO;AAC9C,MAAI,SAAS,0BAA2B,QAAO,CAAC,YAAY;AAC5D,MAAI,SAAS,sBAAuB,QAAO,CAAC,iBAAiB;AAC7D,MAAI,sCAAsC,KAAK,IAAI,EAAG,QAAO,CAAC,QAAQ;AACtE,MAAI,4FAA4F,KAAK,IAAI,KAAK,SAAS,mBAAoB,QAAO,CAAC,QAAQ;AAC3J,MAAI,gBAAgB,KAAK,IAAI,EAAG,QAAO,CAAC,QAAQ;AAChD,MAAI,wBAAwB,KAAK,IAAI,EAAG,QAAO,CAAC,QAAQ;AACxD,MAAI,aAAa,KAAK,IAAI,EAAG,QAAO,CAAC,KAAK;AAC1C,MAAI,cAAc,KAAK,IAAI,EAAG,QAAO,CAAC,gBAAgB,QAAQ;AAC9D,MAAI,eAAe,KAAK,IAAI,EAAG,QAAO,CAAC,OAAO;AAC9C,MAAI,eAAe,KAAK,IAAI,EAAG,QAAO,CAAC,QAAQ;AAC/C,MAAI,kBAAkB,KAAK,IAAI,EAAG,QAAO,CAAC,UAAU;AACpD,MAAI,oBAAoB,KAAK,IAAI,EAAG,QAAO,CAAC,aAAa;AACzD,MAAI,oBAAoB,KAAK,IAAI,EAAG,QAAO,CAAC,YAAY;AACxD,MAAI,0BAA0B,KAAK,IAAI,EAAG,QAAO,CAAC,WAAW;AAC7D,MAAI,4CAA4C,KAAK,IAAI,EAAG,QAAO,CAAC,OAAO;AAC3E,MAAI,wCAAwC,KAAK,IAAI,EAAG,QAAO,CAAC,gBAAgB;AAChF,SAAO,CAAC;AACV;AAEA,SAAS,SAAS,QAA0C;AAC1D,QAAM,OAAO,OAAO;AACpB,MAAI,6CAA6C,KAAK,IAAI,EAAG,QAAO;AACpE,MAAI,uGAAuG,KAAK,IAAI,EAAG,QAAO;AAC9H,MAAI,CAAC,OAAO,cAAc,2CAA2C,KAAK,IAAI,EAAG,QAAO;AACxF,SAAO;AACT;AAEA,SAAS,eAAe,MAA4F;AAClH,QAAM,QAAkB,CAAC;AACzB,QAAM,SAAmB,CAAC;AAC1B,MAAI,KAAK,WAAW,UAAU,GAAG;AAC/B,UAAM,KAAK,yBAAyB,kBAAkB,qBAAqB,MAAM;AACjF,WAAO,KAAK,QAAQ,UAAU;AAAA,EAChC;AACA,MAAI,2DAA2D,KAAK,IAAI,GAAG;AACzE,UAAM,KAAK,MAAM,MAAM,OAAO,QAAQ,YAAY,WAAW;AAC7D,WAAO,KAAK,kBAAkB;AAAA,EAChC;AACA,MAAI,4DAA4D,KAAK,IAAI,EAAG,OAAM,KAAK,cAAc,WAAW;AAChH,MAAI,0BAA0B,KAAK,IAAI,GAAG;AACxC,UAAM,KAAK,QAAQ,YAAY;AAC/B,WAAO,KAAK,cAAc,eAAe;AAAA,EAC3C;AACA,MAAI,4FAA4F,KAAK,IAAI,GAAG;AAC1G,UAAM,KAAK,YAAY,OAAO,WAAW,QAAQ;AACjD,WAAO,KAAK,YAAY,cAAc,qBAAqB,kBAAkB,wBAAwB,SAAS;AAAA,EAChH;AACA,MAAI,SAAS,oBAAoB;AAC/B,UAAM,KAAK,QAAQ;AACnB,WAAO,KAAK,QAAQ;AAAA,EACtB;AACA,MAAI,sCAAsC,KAAK,IAAI,GAAG;AACpD,UAAM,KAAK,WAAW,iBAAiB,YAAY;AACnD,WAAO,KAAK,WAAW,iBAAiB,YAAY;AAAA,EACtD;AACA,SAAO,EAAE,qBAAqB,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,sBAAsB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE;AAC9G;AAEA,SAAS,uBAAuB,MAA0G;AACxI,MAAI,IAAI,YAAY,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,YAAY,GAAG,WAAW,aAAa;AAChG,MAAI,mBAAmB,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,WAAW,WAAW,cAAc;AACpG,MAAI,gCAAgC,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,cAAc,YAAY,MAAM,GAAG,WAAW,cAAc;AAC1I,MAAI,iDAAiD,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,YAAY,cAAc,YAAY,GAAG,WAAW,cAAc;AACjK,MAAI,6BAA6B,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,cAAc,QAAQ,GAAG,WAAW,cAAc;AAC7H,MAAI,2CAA2C,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,UAAU,YAAY,GAAG,WAAW,cAAc;AAC3I,MAAI,gBAAgB,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,QAAQ,cAAc,UAAU,GAAG,WAAW,cAAc;AAC1H,MAAI,6BAA6B,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,YAAY,YAAY,GAAG,WAAW,cAAc;AAC/H,MAAI,kBAAkB,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,CAAC,UAAU,GAAG,WAAW,cAAc;AACtG,MAAI,eAAe,KAAK,IAAI,EAAG,QAAO,EAAE,oBAAoB,WAAW,WAAW,cAAc;AAChG,MAAI,iEAAiE,KAAK,IAAI;AAC5E,WAAO,EAAE,oBAAoB,CAAC,YAAY,cAAc,cAAc,MAAM,GAAG,WAAW,aAAa;AACzG,MAAI,qEAAqE,KAAK,IAAI,GAAG;AACnF,WAAO,EAAE,oBAAoB,CAAC,QAAQ,YAAY,cAAc,UAAU,GAAG,WAAW,aAAa;AAAA,EACvG;AACA,SAAO,EAAE,oBAAoB,WAAW,WAAW,aAAa;AAClE;AAEA,SAAS,qBAAqB,MAAwB;AACpD,MAAI,iCAAiC,KAAK,IAAI,EAAG,QAAO,CAAC,gCAAgC;AACzF,MAAI,qBAAqB,KAAK,IAAI,EAAG,QAAO,CAAC,gCAAgC;AAC7E,MAAI,uBAAuB,KAAK,IAAI,EAAG,QAAO,CAAC,gCAAgC;AAC/E,MAAI,oBAAoB,KAAK,IAAI,EAAG,QAAO,CAAC,oCAAoC;AAChF,SAAO,CAAC;AACV;AAGO,SAAS,sBAAsB,QAAkD;AACtF,QAAM,YAAY,eAAe,OAAO,IAAI;AAC5C,QAAM,iBAAiB,uBAAuB,OAAO,IAAI;AACzD,QAAM,kBAAkB,qBAAqB,OAAO,IAAI;AACxD,QAAM,gBAAgB,OAAO;AAC7B,QAAM,sBAAsB,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAI,OAAO,uBAAuB,CAAC,GAAI,GAAG,UAAU,mBAAmB,CAAC,CAAC,EAAE,KAAK;AACzH,QAAM,uBAAuB,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAI,OAAO,wBAAwB,CAAC,GAAI,GAAG,UAAU,oBAAoB,CAAC,CAAC,EAAE,KAAK;AAE5H,SAAO;AAAA,IACL,gBAAgB,OAAO,mBAAmB,IAAI,aAAa,OAAO,IAAI,IAAI,UAAU;AAAA,IACpF,UAAU,OAAO,YAAY,SAAS,MAAM;AAAA,IAC5C,kBAAkB,CAAC,GAAG,IAAI,IAAI,OAAO,oBAAoB,iBAAiB,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK;AAAA,IAC9F;AAAA,IACA;AAAA,IACA,OAAO,gBACH;AAAA,MACE,GAAG;AAAA,MACH,qBAAqB,cAAc,uBAAuB,kCAAkC,cAAc,yBAAyB;AAAA,MACnI,4BAA4B,cAAc,uBAAuB,kCAAkC,cAAc,yBAAyB,GAAG;AAAA,QAC3I,CAAC,eAAe,WAAW;AAAA,MAC7B;AAAA,IACF,IACA;AAAA,MACE,GAAG;AAAA,MACH,eAAe,gBAAgB,SAAS,IAAI,oBAAoB;AAAA,MAChE,qBAAqB,kCAAkC,eAAe;AAAA,MACtE,2BAA2B;AAAA,MAC3B,iBAAiB;AAAA,MACjB,wBAAwB,CAAC,wBAAwB,qBAAqB;AAAA,MACtE,iBAAiB,EAAE,MAAM,SAAS,qBAAqB,qBAAqB;AAAA,IAC9E;AAAA,EACN;AACF;;;AChKA,IAAM,UAAU,oBAAI,IAA8B;AAG3C,IAAM,iCAAiC;AAE9C,IAAI,mBAAmB;AAOhB,SAAS,sBAA8B;AAC5C,SAAO;AACT;AAGO,IAAM,4BAA4B;AASlC,IAAM,uBAA8C;AAAA,EACzD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC;AAClB;AAgBO,IAAM,oBAAwC;AAAA,EACnD,QAAQ,CAAC,UAAU,MAAM,UAAU;AACrC;AAQO,IAAM,YAAgC;AAAA,EAC3C,QAAQ,MAAM;AAChB;AAGA,IAAM,sBAA8C;AAAA,EAClD,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,OAAO;AAAA,EACP,aAAa;AAAA,EACb,eAAe;AAAA,EACf,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,oBAAoB;AAAA;AAAA,EAEpB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOb,4BAA4B;AAAA,EAC5B,4BAA4B;AAAA,EAC5B,0BAA0B;AAAA;AAAA;AAAA;AAAA,EAI1B,4BAA4B;AAC9B;AAEA,IAAM,UAAU,IAAI,IAAoB,OAAO,QAAQ,mBAAmB,CAAC;AAGpE,SAAS,kBAAkB,MAAsB;AACtD,SAAO,QAAQ,IAAI,IAAI,KAAK;AAC9B;AAGO,SAAS,aAAa,KAAqB;AAChD,QAAM,UAAU,IAAI,KAAK;AACzB,QAAM,UAAU,QAAQ,YAAY,GAAG;AACvC,MAAI,CAAC,QAAQ,SAAS,GAAG,KAAK,UAAU,GAAG;AACzC,WAAO,GAAG,QAAQ,MAAM,GAAG,OAAO,CAAC,IAAI,QAAQ,MAAM,UAAU,CAAC,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAOO,SAAS,2BAA2B,SAAyB;AAClE,SAAO,aAAa,OAAO;AAC7B;AAGO,SAAS,gBAAgB,MAAkC;AAChE,QAAM,eAAe,kBAAkB,KAAK,KAAK,CAAC;AAClD,QAAM,aAAa,QAAQ,IAAI,YAAY;AAC3C,MAAI,YAAY,IAAK,QAAO,aAAa,WAAW,GAAG;AAEvD,QAAM,SAAS,UAAU,YAAY;AACrC,MAAI,OAAQ,QAAO,aAAa,MAAM;AAEtC,MAAI,CAAC,aAAa,WAAW,KAAK,EAAG,QAAO;AAG5C,SAAO,aAAa,aAAa,MAAM,MAAM,MAAM,CAAC;AACtD;AAGO,SAAS,gBAAgB,KAAiC;AAC/D,QAAM,gBAAgB,aAAa,GAAG;AACtC,aAAW,UAAU,QAAQ,OAAO,GAAG;AACrC,QAAI,OAAO,OAAO,aAAa,OAAO,GAAG,MAAM,cAAe,QAAO,OAAO;AAAA,EAC9E;AAEA,QAAM,SAAS,UAAU,aAAa;AACtC,MAAI,OAAQ,QAAO,kBAAkB,MAAM;AAM3C,QAAM,WAAW,cAAc,MAAM,GAAG;AACxC,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,CAAC,WAAW,IAAI,IAAI;AAC1B,MAAI,UAAU,WAAW,KAAK,KAAK,WAAW,EAAG,QAAO;AACxD,SAAO,MAAM,SAAS,IAAI,IAAI;AAChC;AAOO,SAAS,2BAA2B,SAAiB,KAAa,UAA6C,CAAC,GAAY;AACjI,QAAM,oBAAoB,2BAA2B,OAAO;AAC5D,QAAM,gBAAgB,aAAa,GAAG;AAEtC,MAAI,sBAAsB,IAAK,QAAO,QAAQ,wBAAwB;AACtE,MAAI,sBAAsB,cAAe,QAAO;AAChD,MAAI,kBAAkB,SAAS,IAAI,GAAG;AACpC,UAAM,SAAS,kBAAkB,MAAM,GAAG,EAAE;AAC5C,WAAO,cAAc,WAAW,MAAM;AAAA,EACxC;AACA,SAAO;AACT;AAKO,SAAS,eAA0E,YAAyD;AAKjJ,QAAM,eAAe,sBAAsB,WAAW,IAAI;AAC1D,aAAW,cAAc,WAAW,aAAa,KAAK,KAAK,aAAa;AACxE,aAAW,cAAc,WAAW,aAAa,KAAK,KAAK,aAAa;AACxE,MAAI,CAAC,WAAW,iBAAiB,KAAK,GAAG;AACvC,eAAW,kBAAkB;AAAA,EAC/B;AACA,MAAI,WAAW,IAAK,YAAW,MAAM,aAAa,WAAW,GAAG;AAChE,SAAO,OAAO,YAAY,sBAAsB,UAA8B,CAAC;AAM/E,MAAI,CAAC,WAAW,MAAM;AACpB,aAAS,yBAAyB,WAAW,IAAI,IAAI,wBAAwB,WAAW,IAAI,kEAAkE;AAC9J,eAAW,OAAO;AAAA,EACpB;AACA,UAAQ,IAAI,WAAW,MAAM,UAA8B;AAC3D,sBAAoB;AACtB;AAEO,SAAS,UAAU,MAA4C;AACpE,SAAO,QAAQ,IAAI,kBAAkB,IAAI,CAAC;AAC5C;AAEO,SAAS,gBAAoC;AAClD,SAAO,MAAM,KAAK,QAAQ,OAAO,CAAC;AACpC;AAQO,SAAS,mBAAmB,MAA0C;AAC3E,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,UAAU,IAAI,GAAG,gBAAgB;AAC1C;AAGO,SAAS,kBAAkB,MAA0C;AAC1E,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,UAAU,IAAI,GAAG,SAAS;AACnC;AAGO,SAAS,kBAA2C;AACzD,SAAO,MAAM,KAAK,QAAQ,QAAQ,CAAC;AACrC;AAEO,SAAS,UAAU,MAAuB;AAC/C,SAAO,QAAQ,IAAI,kBAAkB,IAAI,CAAC;AAC5C;AAGO,SAAS,eAAe,KAA2C;AACxE,QAAM,gBAAgB,aAAa,GAAG;AACtC,aAAW,UAAU,QAAQ,OAAO,GAAG;AACrC,QAAI,OAAO,OAAO,aAAa,OAAO,GAAG,MAAM,cAAe,QAAO;AAAA,EACvE;AACA,SAAO;AACT;AAaO,SAAS,kBAAkB,QAAsC,QAA0C;AAChH,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,MAAI;AACJ,MAAI,OAAO,kBAAkB;AAC3B,UAAM,SAAS,gBAAgB,MAAM;AACrC,QAAI;AACF,YAAM,UAAU,OAAO,iBAAiB,MAAM,KAAK,CAAC;AACpD,eAAS,OAAO,0BAA0B,YAAY,UAAU,WAAW,OAAO,UAAU,CAAC,GAAG,SAAS,CAAC,UAAU,MAAM,IAAI;AAAA,IAChI,SAAS,OAAO;AAEd;AAAA,QACE,kBAAkB,OAAO,IAAI;AAAA,QAC7B,wBAAwB,OAAO,IAAI,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACxH;AACA,eAAS,CAAC;AAAA,IACZ;AAAA,EACF,OAAO;AACL,aAAS,OAAO,UAAU,CAAC;AAAA,EAC7B;AAKA,MAAI,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,yBAAyB,GAAG;AACpE,WAAO;AAAA,EACT;AACA,SAAO,CAAC,GAAG,QAAQ,oBAAoB;AACzC;AASO,SAAS,wBAAwB,QAAsC,QAAsC;AAClH,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,MAAI,OAAO,wBAAwB;AACjC,UAAM,SAAS,gBAAgB,MAAM;AACrC,QAAI;AACF,YAAM,UAAU,OAAO,uBAAuB,MAAM,KAAK,CAAC;AAC1D,UAAI,OAAO,0BAA0B,UAAW,QAAO;AACvD,aAAO,WAAW,OAAO,gBAAgB,CAAC,GAAG,SAAS,CAAC,UAAU,MAAM,IAAI;AAAA,IAC7E,SAAS,OAAO;AACd;AAAA,QACE,yBAAyB,OAAO,IAAI;AAAA,QACpC,wBAAwB,OAAO,IAAI,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC9H;AACA,aAAO,OAAO,gBAAgB,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,OAAO,gBAAgB,CAAC;AACjC;AAOA,SAAS,WAAc,UAAe,SAAc,OAAiC;AACnF,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,KAAK,CAAC;AAC9C,SAAO,CAAC,GAAG,SAAS,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,MAAM,IAAI,CAAC,CAAC,GAAG,GAAG,OAAO;AACjF;AAEA,SAAS,gBAAgB,QAAsC;AAC7D,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,MAAI,OAAO,WAAW,UAAU;AAC9B,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,UAAU,IAAI;AACxC,aAAO,UAAU,OAAO,WAAW,WAAW,SAAS,CAAC;AAAA,IAC1D,QAAQ;AACN,eAAS,oBAAoB,MAAM,IAAI,iEAAiE;AACxG,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,SAAO,CAAC;AACV;;;ACzSO,IAAM,2BAA2B;AAQjC,IAAM,uBAAuB;AAO7B,IAAM,+BAA+B;AAO5C,IAAM,yBAAyB;AAgC/B,SAAS,SAAS,MAAuB;AACvC,SAAO,KAAK,OAAY,wBAAwB;AAClD;AASA,SAAS,aAAa,MAAuB;AAC3C,SAAO,KAAK,OAAY,sBAAsB;AAChD;AAEA,SAAS,cAAc,KAA4B,KAAkC;AACnF,SAAO,cAAc,KAAK,IAAI,GAAG,CAAC;AACpC;AAGA,SAAS,cAAc,OAAqC;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACzE,SAAO;AACT;AAGA,SAAS,SAAS,OAAkD;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,SAAO;AACT;AAGA,SAAS,aAAa,QAAsC;AAC1D,QAAM,KAAK,OAAO;AAClB,SAAO,OAAO,OAAO,YAAY,OAAO,SAAS,EAAE,IAAI,KAAK,OAAO;AACrE;AASA,SAAS,cAAc,QAAiB,SAAoD;AAC1F,QAAM,IAAI,SAAS,MAAM;AACzB,QAAM,IAAI,SAAS,OAAO;AAC1B,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,IAAI;AACjD;AAEA,SAAS,UAAU,GAA4B,GAAsC;AACnF,SAAO,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AACnE;AAWA,SAAS,QAAW,OAAa;AAC/B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC5E,QAAI,GAAG,IAAI,QAAQ,MAAM;AAAA,EAC3B;AACA,SAAO;AACT;AAWA,SAAS,cAAc,MAAY,KAAa,MAAqC;AACnF,OAAK,SAAS,MAAM;AAClB,aAAS,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC;AAIrC,iBAAa,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC;AACH;AAcO,SAAS,uBAAuB,MAAiC;AACtE,QAAM,SAAS,cAAc,aAAa,IAAI,GAAG,oBAAoB;AACrE,QAAM,UAAU,cAAc,SAAS,IAAI,GAAG,oBAAoB;AAElE,QAAM,SAA8B,CAAC;AACrC,aAAW,WAAW,UAAU,QAAQ,OAAO,GAAG;AAChD,UAAM,SAAS,cAAc,OAAO,OAAO,GAAG,QAAQ,OAAO,CAAC;AAC9D,QAAI,OAAQ,QAAO,OAAO,IAAI,EAAE,GAAG,OAAO;AAAA,EAC5C;AACA,SAAO;AACT;AAOO,SAAS,wBAAwB,MAAY,SAAiB,QAAoC;AACvG,QAAM,OAA4B;AAAA,IAChC,GAAG,uBAAuB,IAAI;AAAA,IAC9B,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO;AAAA,EACzB;AACA,gBAAc,MAAM,sBAAsB,IAAI;AAChD;AAQO,SAAS,aAAa,OAA4B,SAAiB,oBAAqC;AAC7G,QAAM,WAAW,MAAM,OAAO;AAC9B,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,gBAAgB;AAClC;AAYO,SAAS,8BAA8B,MAAwC;AACpF,QAAM,SAAS,cAAc,aAAa,IAAI,GAAG,4BAA4B;AAC7E,QAAM,UAAU,cAAc,SAAS,IAAI,GAAG,4BAA4B;AAE1E,QAAM,SAAqC,CAAC;AAC5C,aAAW,WAAW,UAAU,QAAQ,OAAO,GAAG;AAChD,UAAM,cAAc,cAAc,OAAO,OAAO,CAAC;AACjD,UAAM,eAAe,cAAc,QAAQ,OAAO,CAAC;AACnD,UAAM,QAA8C,CAAC;AACrD,eAAW,gBAAgB,UAAU,aAAa,YAAY,GAAG;AAC/D,YAAM,SAAS,cAAc,YAAY,YAAY,GAAG,aAAa,YAAY,CAAC;AAClF,UAAI,OAAQ,OAAM,YAAY,IAAI,EAAE,GAAG,OAAO;AAAA,IAChD;AACA,QAAI,OAAO,KAAK,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,IAAI;AAAA,EACvD;AACA,SAAO;AACT;AAMO,SAAS,+BAA+B,MAAY,SAAiB,qBAA6B,QAAoC;AAC3I,QAAM,UAAU,8BAA8B,IAAI;AAClD,QAAM,aAAa,QAAQ,OAAO,KAAK,CAAC;AACxC,QAAM,OAAmC;AAAA,IACvC,GAAG;AAAA,IACH,CAAC,OAAO,GAAG;AAAA,MACT,GAAG;AAAA,MACH,CAAC,mBAAmB,GAAG,EAAE,GAAG,OAAO;AAAA,IACrC;AAAA,EACF;AACA,gBAAc,MAAM,8BAA8B,IAAI;AACxD;AAUO,SAAS,oBAAoB,OAAmC,SAAiB,qBAA6B,oBAAqC;AACxJ,QAAM,aAAa,MAAM,OAAO;AAChC,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,WAAW,WAAW,mBAAmB;AAC/C,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,gBAAgB;AAClC;;;ACrTA,YAAY,OAAO;AAwEZ,IAAM,eAAe;AAGrB,IAAM,wBAAwB;AAG9B,IAAM,gCAAgC;AAUtC,IAAMC,0BAAyB;AAsBtC,IAAM,qBAAqB;AAcpB,SAAS,cAAc,aAAiC,cAA+B;AAC5F,UAAQ,eAAe,wBAAwB;AACjD;AAWO,SAAS,mBAAmB,aAAiC,gBAAiC;AACnG,SAAO,eAAe,kBAAkB;AAC1C;AAUA,IAAM,wBAAwB;AASvB,IAAM,0BAA0B;AAYhC,IAAM,6BAAgD;AAGtD,IAAM,4BAA+C;AAUrD,IAAM,8BAA8B;AAkF3C,IAAM,kCAAkC;AAExC,IAAI,+BAA+B;AAO5B,SAAS,iCAA0C;AACxD,SAAO;AACT;AAsFA,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AA6B1B,IAAM,kBAA6C;AAAA,EACjD,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,oBAAoB;AAAA,EACpB,WAAW;AACb;AAGA,SAAS,OAAO,OAAsC;AACpD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,gBAAgB,KAAK;AAClC,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAIA,SAAS,iBAAiB,OAAmC;AAC3D,SAAO,OAAO,UAAU,eAAe,KAAK,iBAAiB,KAAK;AACpE;AAOA,SAAS,UAAU,OAAsC;AACvD,SAAO,CAAC,CAAC,MAAM,SAAS,MAAM,UAAU;AAC1C;AAqBA,SAAS,WAAc,OAAa;AAClC,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI;AACF,WAAO,gBAAgB,KAAK;AAAA,EAC9B,QAAQ;AAIN,QAAI;AACF,aAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AAAA,IACzC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAaA,SAAS,cAAc,OAAkD;AACvE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAGxE,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,KAAM,QAAO;AAEzD,QAAM,QAAQ;AACd,QAAM,QAAQ,MAAM;AACpB,QAAM,KAAK,MAAM;AACjB,QAAM,cAAc,UAAU,UAAc,OAAO,UAAU,YAAY,iBAAiB,KAAK;AAC/F,QAAM,WAAW,OAAO,UAAc,OAAO,OAAO,YAAY,OAAO,SAAS,EAAE;AAClF,MAAI,eAAe,SAAU,QAAO;AAKpC,QAAM,aAAmC,EAAE,GAAG,MAAM;AACpD,MAAI,CAAC,YAAa,QAAO,WAAW;AACpC,MAAI,CAAC,SAAU,QAAO,WAAW;AACjC,SAAO;AACT;AAkGO,SAAS,mBAAmB,UAAmB,WAAyC;AAC7F,QAAM,MAAM,cAAc,QAAQ;AAClC,QAAM,OAAO,cAAc,SAAS;AAEpC,MAAI,CAAC,OAAO,CAAC,KAAM,QAAO,EAAE,OAAO,CAAC,GAAG,QAAQ,UAAU;AACzD,MAAI,CAAC,IAAK,QAAO,EAAE,OAAO,WAAW,IAA4B,GAAG,QAAQ,OAAO;AACnF,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,WAAW,GAAG,GAAG,QAAQ,MAAM;AAE1D,QAAM,UAAU,OAA4B,EAAE,OAAO,WAAW,GAAG,GAAG,QAAQ,MAAM;AACpF,QAAM,WAAW,OAA4B,EAAE,OAAO,WAAW,IAAI,GAAG,QAAQ,OAAO;AAGvF,QAAM,aAAa,UAAU,GAAG;AAChC,QAAM,cAAc,UAAU,IAAI;AAClC,MAAI,eAAe,YAAa,QAAO,aAAa,QAAQ,IAAI,SAAS;AAGzE,QAAM,QAAQ,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;AACpE,QAAM,SAAS,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AACvE,MAAI,UAAU,UAAa,WAAW,UAAa,UAAU,QAAQ;AACnE,WAAO,QAAQ,SAAS,QAAQ,IAAI,SAAS;AAAA,EAC/C;AAGA,QAAM,UAAU,OAAO,IAAI,KAAK;AAChC,QAAM,WAAW,OAAO,KAAK,KAAK;AAClC,MAAI,YAAY,SAAU,QAAO,UAAU,WAAW,QAAQ,IAAI,SAAS;AAS3E,MAAI,UAAU,UAAa,WAAW,OAAW,QAAO,QAAQ;AAChE,MAAI,WAAW,UAAa,UAAU,OAAW,QAAO,SAAS;AAGjE,SAAO,QAAQ;AACjB;AAGO,SAAS,WAAW,MAAoC;AAC7D,SAAO,KAAK,OAAuB,YAAY;AACjD;AAGO,SAAS,mBAAmB,MAAgD;AACjF,SAAO,gBAAgC,MAAM,YAAY;AAC3D;AAGO,SAAS,mBAAmB,MAAuC;AACxE,SAAO,KAAK,OAA0B,qBAAqB;AAC7D;AAGO,SAAS,2BAA2B,MAAmD;AAC5F,SAAO,gBAAmC,MAAM,qBAAqB;AACvE;AAGO,SAAS,0BAA0B,MAA4C;AACpF,SAAO,KAAK,OAA+B,6BAA6B;AAC1E;AAGO,SAAS,kCAAkC,MAAwD;AACxG,SAAO,gBAAwC,MAAM,6BAA6B;AACpF;AAGO,SAAS,uBAAuB,MAAa,OAAwB;AAC1E,SAAO,QAAQ,2BAA2B,IAAI,GAAG,IAAI,KAAK,KAAK,kCAAkC,IAAI,GAAG,IAAI,KAAK,CAAC;AACpH;AAQA,SAAS,oBAAoB,MAA0C;AACrE,SAAO,KAAK,OAA6BC,uBAAsB;AACjE;AAEA,SAAS,4BAA4B,MAAsD;AACzF,SAAO,gBAAsC,MAAMA,uBAAsB;AAC3E;AAoBO,SAAS,qBAAqB,MAAgC;AACnE,YAAU,MAAM,sBAAsB;AACtC,QAAM,WAAW,gBAAgB,MAAM,MAAM,GAAG,IAAI,uBAAuB;AAC3E,MAAI,aAAa,0BAA2B,QAAO;AACnD,MAAI,aAAa,2BAA4B,QAAO;AACpD,SAAO,wBAAwB,IAAI,IAAI,6BAA6B;AACtE;AAGO,SAAS,+BAA+B,MAAsB;AACnE,SAAO,qBAAqB,IAAI,MAAM;AACxC;AAEO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAU,4DAA4D;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YAA4B,OAAe;AACzC,UAAM,wBAAwB,KAAK,IAAI;AADb;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YACkB,OACA,SAChB;AACA,UAAM,QAAQ,KAAK,oCAAoC,OAAO,mBAAmB;AAHjE;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,oBACd,OAMS;AACT,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,SACE,MAAM,iBAAiB,QACvB,MAAM,cAAc,SACpB,MAAM,aAAa,oBACnB,MAAM,kBAAkB,oBACxB,kBAAkB,OAAO,MAAM,eAAe,WAAW,MAAM,aAAa,MAAS;AAEzF;AAWO,SAAS,yBAAyB,MAAa,gBAAiC;AACrF,YAAU,MAAM,0BAA0B;AAC1C,MAAI,+BAA+B,IAAI,GAAG;AACxC,WAAO,kBAAkB,mBAAmB,IAAI,KAAK;AAAA,EACvD;AACA,MAAI,CAAC,eAAgB,OAAM,IAAI,yBAAyB;AACxD,MAAI,CAAC,mBAAmB,IAAI,GAAG,IAAI,cAAc,GAAG;AAClD,UAAM,IAAI,gBAAgB,cAAc;AAAA,EAC1C;AACA,SAAO;AACT;AAMO,SAAS,gCAAgC,MAAa,OAAe,OAA+D;AACzI,MAAI,CAAC,mBAAmB,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC,+BAA+B,IAAI,GAAG;AAClF,UAAM,IAAI,gBAAgB,KAAK;AAAA,EACjC;AACA,MAAI,uBAAuB,MAAM,KAAK,KAAK,CAAC,oBAAoB,KAAK,GAAG;AACtE,UAAM,IAAI,0BAA0B,OAAO,MAAM,MAAM,SAAS;AAAA,EAClE;AACF;AAEA,SAAS,UAAU,MAAgC,IAAmC;AACpF,MAAI,CAAC,QAAQ,OAAQ,KAAe,WAAW,YAAY;AACzD,UAAM,IAAI,MAAM,UAAU,EAAE,wEAAmE;AAAA,EACjG;AACF;AAiBO,SAAS,UAAU,MAAa,OAAe,MAAyC;AAC7F,YAAU,MAAM,WAAW;AAC3B,MAAI,MAAM,WAAW,IAAI,EAAE,IAAI,KAAK;AACpC,MAAI,CAAC,KAAK;AACR,SAAK,SAAS,MAAM;AAGlB,YAAM,OAAO,WAAW,IAAI;AAC5B,UAAI,CAAC,KAAK,IAAI,KAAK,GAAG;AACpB,cAAM,UAAU,IAAM,MAAa;AACnC,gBAAQ,IAAI,UAAU,EAAE,KAAK,GAAG,WAAW,KAAK,IAAI,GAAG,GAAG,KAAK,CAAmB;AAClF,gBAAQ,IAAI,aAAa,IAAM,MAA0B,CAAC;AAC1D,aAAK,IAAI,OAAO,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAGD,UAAM,WAAW,IAAI,EAAE,IAAI,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAOO,SAAS,iBAAiB,MAAa,OAAwD;AACpG,YAAU,MAAM,kBAAkB;AAClC,QAAM,MAAM,mBAAmB,IAAI,GAAG,IAAI,KAAK;AAC/C,MAAI,CAAC,IAAK,QAAO;AACjB,QAAMC,WAAU,IAAI,IAAI,WAAW;AACnC,SAAO,WAAiCA,QAAO,IAAIA,WAAU;AAC/D;AASO,SAAS,gBAA6B,MAAa,OAAe,KAAmC;AAC1G,YAAU,MAAM,iBAAiB;AACjC,QAAM,QAAQ,mBAAmB,IAAI,GAAG,IAAI,KAAK,GAAG,IAAI,GAAG;AAC3D,SAAO,WAAc,KAAK,IAAI,QAAQ;AACxC;AAGO,SAAS,mBAAgC,MAAa,OAAe,KAAuB;AACjG,YAAU,MAAM,oBAAoB;AACpC,QAAM,MAAM,UAAU,MAAM,KAAK;AACjC,QAAM,WAAW,IAAI,IAAI,GAAG;AAC5B,MAAI,WAAc,QAAQ,EAAG,QAAO;AACpC,MAAI,IAAI,KAAK,IAAM,MAAO,CAAC;AAC3B,SAAO,gBAAmB,MAAM,OAAO,GAAG;AAC5C;AAGO,SAAS,WAAW,MAAa,OAAoC;AAC1E,YAAU,MAAM,YAAY;AAC5B,QAAM,MAAM,mBAAmB,IAAI,GAAG,IAAI,KAAK;AAC/C,QAAM,OAAO,KAAK,IAAI,QAAQ;AAC9B,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,SAAO,EAAE,GAAI,KAAiB;AAChC;AAuBA,SAAS,uBAAuB,MAAa,OAAwD;AACnG,MAAI,CAAC,mBAAmB,IAAI,GAAG,IAAI,KAAK,GAAG;AACzC,QAAI,+BAA+B,IAAI,EAAG,QAAO;AACjD,UAAM,IAAI,gBAAgB,KAAK;AAAA,EACjC;AACA,SAAO,iBAAiB,MAAM,KAAK;AACrC;AAEA,SAAS,iBAAiB,MAAa,OAA4C;AACjF,YAAU,MAAM,KAAK;AACrB,QAAM,WAAW,iBAAiB,MAAM,KAAK;AAC7C,MAAI,SAAU,QAAO;AAGrB,QAAM,MAAM,WAAW,IAAI,EAAE,IAAI,KAAK;AACtC,MAAI,IAAI,aAAa,IAAM,MAA0B,CAAC;AACtD,SAAO,iBAAiB,MAAM,KAAK;AACrC;AAQA,SAAS,qBAAqB,MAAa,OAAe,KAAqB;AAC7E,QAAM,SAAS,KAAK,OAAuB,GAAG;AAC9C,QAAM,SAAS,mBAAmC,MAAM,OAAO,GAAG;AAClE,MAAI,SAAS;AACb,SAAO,QAAQ,CAAC,aAAa,aAAa;AACxC,QAAI,CAAC,WAAW,WAAW,EAAG;AAC9B,QAAI,cAAc,OAAO,IAAI,QAAQ;AACrC,QAAI,CAAC,WAAW,WAAW,GAAG;AAC5B,oBAAc,IAAM,MAAa;AACjC,aAAO,IAAI,UAAU,WAAW;AAAA,IAClC;AACA,gBAAY,QAAQ,CAAC,OAAO,aAAa;AACvC,UAAI,CAAC,YAAa,IAAI,QAAQ,GAAG;AAC/B,oBAAa,IAAI,UAAU,WAAW,KAAK,CAAC;AAC5C,kBAAU;AAAA,MACZ;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUO,SAAS,wBAAwB,MAAsB;AAC5D,YAAU,MAAM,yBAAyB;AACzC,QAAM,OAAO,4BAA4B,IAAI;AAC7C,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,QAAQ;AACZ,OAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,QAAI,SAAS,IAAI,WAAW,2BAA2B,EAAG;AAC1D,QAAI,cAAc,KAAK,EAAG,SAAQ;AAAA,EACpC,CAAC;AACD,SAAO;AACT;AA0BO,SAAS,wBAAwB,MAAsB;AAC5D,YAAU,MAAM,yBAAyB;AACzC,MAAI,CAAC,mBAAmB,IAAI,GAAG,IAAI,qBAAqB,EAAG,QAAO;AAClE,MAAI,WAAW,MAAM,qBAAqB,GAAG,SAAU,QAAO;AAC9D,QAAM,iBAAiB,iBAAiB,MAAM,qBAAqB;AACnE,MAAI,kBAAkB,eAAe,OAAO,KAAK,CAAC,+BAA+B,IAAI,EAAG,QAAO;AAC/F,OAAK,SAAS,MAAM;AAClB,eAAW,IAAI,EAAE,OAAO,qBAAqB;AAC7C,uBAAmB,IAAI,EAAE,OAAO,qBAAqB;AACrD,UAAM,OAAO,gBAAgB,MAAM,MAAM;AACzC,QAAI,MAAM,IAAI,aAAa,MAAM,sBAAuB,MAAK,OAAO,aAAa;AAAA,EACnF,CAAC;AACD,SAAO;AACT;AAgBO,SAAS,yBAAyB,MAAa,OAAwC;AAC5F,YAAU,MAAM,0BAA0B;AAC1C,QAAM,SAAkC,EAAE,cAAc,GAAG,oBAAoB,GAAG,gBAAgB,EAAE;AAEpG,OAAK,SAAS,MAAM;AAClB,UAAMA,WAAU,iBAAiB,MAAM,KAAK;AAC5C,UAAM,OAAO,oBAAoB,IAAI;AACrC,UAAM,OAAO,oBAAI,IAAY;AAC7B,IAAAA,SAAQ,QAAQ,CAAC,GAAG,QAAQ,KAAK,IAAI,GAAG,CAAC;AACzC,SAAK,QAAQ,CAAC,GAAG,QAAQ;AACvB,UAAI,CAAC,IAAI,WAAW,2BAA2B,EAAG,MAAK,IAAI,GAAG;AAAA,IAChE,CAAC;AACD,eAAW,OAAO,MAAM;AACtB,YAAM,WAAW,mBAAmBA,SAAQ,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,CAAC,EAAE;AACrE,MAAAA,SAAQ,IAAI,KAAK,WAAW,QAAQ,CAAC;AACrC,aAAO,gBAAgB;AAAA,IACzB;AAEA,WAAO,qBAAqB,qBAAqB,MAAM,OAAO,uBAAuB;AACrF,WAAO,iBAAiB,qBAAqB,MAAM,OAAO,iBAAiB;AAAA,EAC7E,CAAC;AACD,SAAO;AACT;AAGO,SAAS,mBAAmB,MAAmB;AACpD,YAAU,MAAM,oBAAoB;AACpC,OAAK,OAAO,MAAM,EAAE,IAAI,yBAAyB,yBAAyB;AAC5E;AAQO,SAAS,sBAAsB,MAAmB;AACvD,qBAAmB,IAAI;AACzB;AAsBO,SAAS,gBAAgB,MAAa,OAAe,SAAuC;AACjG,YAAU,MAAM,iBAAiB;AACjC,QAAM,WAAW,iBAAiB,MAAM,KAAK,GAAG,IAAI,OAAO;AAC3D,MAAI,CAAC,+BAA+B,IAAI,GAAG;AACzC,UAAM,QAAQ,cAAc,QAAQ;AACpC,WAAO,QAAQ,WAAW,KAAK,IAAI,CAAC;AAAA,EACtC;AACA,QAAM,YAAY,4BAA4B,IAAI,GAAG,IAAI,OAAO;AAChE,SAAO,mBAAmB,UAAU,SAAS,EAAE;AACjD;AASO,SAAS,iBAAiB,MAAa,OAAqD;AACjG,YAAU,MAAM,kBAAkB;AAClC,QAAM,OAAO,oBAAI,IAAY;AAC7B,mBAAiB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,QAAQ,KAAK,IAAI,GAAG,CAAC;AAChE,MAAI,+BAA+B,IAAI,GAAG;AACxC,gCAA4B,IAAI,GAAG,QAAQ,CAAC,GAAG,QAAQ;AACrD,UAAI,CAAC,IAAI,WAAW,2BAA2B,EAAG,MAAK,IAAI,GAAG;AAAA,IAChE,CAAC;AAAA,EACH;AACA,QAAM,SAA+C,CAAC;AACtD,aAAW,OAAO,MAAM;AACtB,WAAO,GAAG,IAAI,gBAAgB,MAAM,OAAO,GAAG;AAAA,EAChD;AACA,SAAO;AACT;AAqBO,SAAS,iBAAiB,MAAa,OAAe,SAAiB,SAAoG;AAChL,YAAU,MAAM,kBAAkB;AAClC,MAAI,OAA6B,CAAC;AAClC,MAAI,OAA6B,CAAC;AAClC,OAAK,SAAS,MAAM;AAClB,UAAMA,WAAU,uBAAuB,MAAM,KAAK;AAClD,UAAM,mBAAmB,+BAA+B,IAAI;AAC5D,UAAM,OAAO,mBAAmB,oBAAoB,IAAI,IAAI;AAM5D,WAAO,mBAAmB,mBAAmBA,UAAS,IAAI,OAAO,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,QAAQ,gBAAgB,MAAM,OAAO,OAAO;AACpI,WAAO,WAAW,EAAE,GAAG,MAAM,GAAG,QAAQ,CAAC;AAOzC,IAAAA,UAAS,IAAI,SAAS,WAAW,IAAI,CAAC;AAMtC,UAAM,IAAI,SAAS,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACD,SAAO,EAAE,MAAM,KAAK;AACtB;AAoBO,SAAS,iBAAiB,MAAa,OAAe,SAAiB,QAA8B,EAAE,OAAO,OAAO,GAAS;AACnI,YAAU,MAAM,kBAAkB;AAClC,OAAK,SAAS,MAAM;AAClB,UAAMA,WAAU,uBAAuB,MAAM,KAAK;AAElD,IAAAA,UAAS,IAAI,SAAS,WAAW,KAAK,CAAC;AAEvC,QAAI,+BAA+B,IAAI,GAAG;AACxC,0BAAoB,IAAI,EAAE,IAAI,SAAS,WAAW,KAAK,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAkBO,SAAS,kBAAkB,MAAa,OAAe,SAAuB;AACnF,YAAU,MAAM,mBAAmB;AACnC,OAAK,SAAS,MAAM;AAClB,qBAAiB,MAAM,KAAK,GAAG,OAAO,OAAO;AAE7C,QAAI,+BAA+B,IAAI,GAAG;AACxC,0BAAoB,IAAI,EAAE,OAAO,OAAO;AAAA,IAC1C;AAAA,EACF,CAAC;AACH;AAiCO,SAAS,oBAAoB,MAAmB;AACrD,YAAU,MAAM,qBAAqB;AACrC,OAAK,SAAS,MAAM;AAClB,UAAM,OAAO,WAAW,IAAI;AAC5B,SAAK,QAAQ,CAAC,GAAG,QAAQ,KAAK,OAAO,GAAG,CAAC;AACzC,UAAM,WAAW,mBAAmB,IAAI;AACxC,aAAS,QAAQ,CAAC,GAAG,QAAQ,SAAS,OAAO,GAAG,CAAC;AAIjD,UAAM,OAAO,oBAAoB,IAAI;AACrC,SAAK,QAAQ,CAAC,GAAG,QAAQ,KAAK,OAAO,GAAG,CAAC;AACzC,UAAM,UAAU,KAAK,OAAgB,wBAAwB;AAC7D,YAAQ,QAAQ,CAAC,GAAG,QAAQ,QAAQ,OAAO,GAAG,CAAC;AAAA,EACjD,CAAC;AACH;AAsDO,SAAS,mBAAmB,MAAa,OAAuB;AACrE,YAAU,MAAM,oBAAoB;AAKpC,MAAI,CAAC,6BAA8B,QAAO;AAC1C,MAAI,UAAU;AACd,OAAK,SAAS,MAAM;AAClB,UAAMA,WAAU,iBAAiB,MAAM,KAAK;AAC5C,UAAM,OAAO,oBAAoB,IAAI;AACrC,SAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,UAAI,IAAI,WAAW,2BAA2B,EAAG;AACjD,UAAI,CAAC,cAAc,KAAK,EAAG;AAC3B,YAAM,WAAW,mBAAmBA,SAAQ,IAAI,GAAG,GAAG,KAAK;AAG3D,UAAI,SAAS,WAAW,OAAQ;AAChC,MAAAA,SAAQ,IAAI,KAAK,WAAW,SAAS,KAAK,CAAC;AAC3C,iBAAW;AAAA,IACb,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AA0BO,SAAS,uBAAuB,MAAa,SAAiC;AACnF,YAAU,MAAM,wBAAwB;AAGxC,QAAM,OAAO,WAAW,IAAI;AAC5B,OAAK,YAAY,OAAO;AACxB,QAAM,OAAO,+BAA+B,IAAI,IAAI,oBAAoB,IAAI,IAAI;AAChF,QAAM,QAAQ,OAAO;AACrB,SAAO,MAAM;AACX,SAAK,cAAc,OAAO;AAC1B,UAAM,UAAU,OAAO;AAAA,EACzB;AACF;AAcO,SAAS,mBAAmB,MAAkC;AACnE,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY;AAC7C,UAAM,WAAW,gBAAgB,MAAM,MAAM,GAAG,IAAI,aAAa;AACjE,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,KAAK,mBAAmB,IAAI,GAAG,IAAI,QAAQ,GAAG;AAClG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAcO,SAAS,oBAAoB,MAAa,gBAA6C;AAC5F,YAAU,MAAM,qBAAqB;AACrC,MAAI,eAAgB,QAAO;AAC3B,SAAO,mBAAmB,IAAI,MAAM,+BAA+B,IAAI,IAAI,qBAAqB;AAClG;AAWO,SAAS,8BAA8B,MAAa,OAAwC;AACjG,YAAU,MAAM,+BAA+B;AAC/C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO;AAAA,IACL,KAAK,CAAC,WAAmB,gBAAgB,MAAM,OAAO,MAAM;AAAA,IAC5D,QAAQ,CAAC,QAAgB,YAA2C;AAClE,uBAAiB,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACF;AAkBO,SAAS,uBAAuB,MAAa,OAA2E;AAC7H,YAAU,MAAM,wBAAwB;AACxC,SAAO;AAAA,IACL,IAAI,SAAmD;AACrD,YAAM,WAAW,iBAAiB,MAAM,KAAK,GAAG,IAAI,OAAO;AAC3D,UAAI,CAAC,+BAA+B,IAAI,GAAG;AACzC,cAAM,QAAQ,cAAc,QAAQ;AACpC,eAAO,QAAQ,WAAW,KAAK,IAAI;AAAA,MACrC;AACA,YAAM,YAAY,oBAAoB,IAAI,EAAE,IAAI,OAAO;AACvD,YAAM,WAAW,mBAAmB,UAAU,SAAS;AAEvD,aAAO,SAAS,WAAW,YAAY,SAAY,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAqBO,SAAS,8BAA8B,MAAa,OAAuF;AAChJ,SAAO,OAAO,OAAO,uBAAuB,MAAM,KAAK,GAAG,EAAE,KAAK,KAAK,CAAC;AACzE;","names":["CollectionStateEnum","LEGACY_RUNTIME_MAP_KEY","LEGACY_RUNTIME_MAP_KEY","actions"]}