@ljwei-stak/dsh-model-route-bot 0.65.0 → 0.66.0

package/remote-computer-agent/dist/cli.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/cli.ts", "../src/agent.ts", "../src/protocol.ts", "../src/store.ts", "../src/scope.ts", "../src/browser.ts", "../src/desktop.ts", "../src/desktop-session.ts", "../src/container-command.ts", "../src/container-supervisor.mjs", "../src/workspace-identity.ts", "../src/workspace-admission.ts", "../src/workspace-generation.ts", "../src/pinned-write.ts", "../src/cli-task.ts", "../../packages/cli-runtime/src/agent-codex-runtime.mjs", "../../packages/cli-runtime/src/codex-session-core.mjs", "../../packages/cli-runtime/src/native-process.mjs", "../../packages/capability-broker/src/cli-bootstrap.mjs", "../../packages/capability-broker/src/authority.mjs", "../../packages/cli-runtime/src/contracts.mjs", "../../packages/cli-runtime/src/profile-policy.mjs", "../src/transport.ts", "../src/auth-throttle.ts"],
-  "sourcesContent": ["#!/usr/bin/env node\nimport { readFile, writeFile, mkdir } from 'node:fs/promises'\nimport { resolve, dirname, join } from 'node:path'\nimport { Agent } from './agent.js'\nimport { Store } from './store.js'\nimport { serve } from './transport.js'\nimport { fail } from './protocol.js'\nconst [command,configPath,...args]=process.argv.slice(2)\ntry{\n  if(!configPath)fail('USAGE: dsh-remote-agent init|serve|pair|rotate|revoke <config.json> [clientId ceiling.json]')\n  const file=resolve(configPath)\n  if(command==='init'){\n    const root=resolve(args[0]??'.');const config={dataDir:join(dirname(file),'data'),roots:{project:root},isolation:'application',network:{mode:'loopback',host:'127.0.0.1',port:9701},executables:{node:process.execPath},browserOrigins:[]}\n    await mkdir(dirname(file),{recursive:true,mode:0o700});await writeFile(file,JSON.stringify(config,null,2)+'\\n',{flag:'wx',mode:0o600});console.log(JSON.stringify({configured:file,next:'Run pair with an explicit Bot/tool/root ceiling, then serve.'}))\n  }else{\n    const config=JSON.parse(await readFile(file,'utf8'))\n    if(command==='serve'){\n      const agent=new Agent(config);let handle:any;try{handle=await serve(agent,config.network)}catch(e){await agent.close();throw e}\n      console.log(JSON.stringify({machineId:agent.store.machineId,listening:handle.address,protocols:handle.supportedMcpVersions}));let stopping=false\n      const stop=async()=>{if(stopping)return;stopping=true;await handle.close();await agent.close()};process.once('SIGINT',()=>void stop());process.once('SIGTERM',()=>void stop())\n    }else{\n      const store=new Store(config.dataDir,undefined,{admin:true});try{let result:any;if(command==='pair'){const ceiling=JSON.parse(await readFile(resolve(args[1]),'utf8'));for(const root of ceiling.roots??[])if(!config.roots[root])fail('UNKNOWN_ROOT');result=store.pair(args[0],ceiling)}else if(command==='rotate')result=store.rotate(args[0]);else if(command==='revoke'){store.revoke(args[0]);result={revoked:true}}else fail('UNKNOWN_COMMAND');console.log(JSON.stringify(result))}finally{store.close()}\n    }\n  }\n}catch(e:any){console.error(e.code??'AGENT_START_FAILED');process.exitCode=1}\n", "import { readFile, writeFile, mkdir, rename, unlink, lstat, stat, realpath } from 'node:fs/promises'\nimport { join, dirname, resolve } from 'node:path'\nimport { randomUUID } from 'node:crypto'\nimport { spawn, execFile } from 'node:child_process'\nimport { promisify } from 'node:util'\nimport { AGENT_VERSION, AGENT_API_MAJOR, AgentError, canonical, fail, integer, isMutating, sha, TOOL_NAMES, type Context } from './protocol.js'\nimport { Store } from './store.js'\nimport { Roots } from './scope.js'\nimport { BrowserTools } from './browser.js'\nimport { DesktopTools } from './desktop.js'\nimport { DesktopSessions } from './desktop-session.js'\nimport {ContainerCommands,type ContainerCommandConfig} from './container-command.js'\nimport {WorkspacePin} from './workspace-identity.js'\nimport {WorkspaceAdmissions} from './workspace-admission.js'\nimport {reconcileRootsGeneration,rootsGeneration} from './workspace-generation.js'\nimport {pinnedCreateNewFile,pinnedWriteSupported} from './pinned-write.js'\nimport {CliTasks,validateCliProfiles,type CliProfileConfig} from './cli-task.js'\nconst execFileAsync=promisify(execFile)\nconst ARTIFACT_QUOTA_BYTES=256*1024*1024\nexport type AgentConfig={dataDir:string;roots:Record<string,string>;executables?:Record<string,string>;shell?:string;windowsJobRunner?:string;browserOrigins?:string[];browserExecutablePath?:string;browserProfiles?:Record<string,string>;isolation?:'os-account'|'container'|'application';container?:ContainerCommandConfig;desktop?:{pipeName:string;secretFile:string};cliProfiles?:CliProfileConfig[]}\nexport class Agent {\n  store:Store;roots:Roots;browser:BrowserTools;desktop:DesktopTools;desktopSessions:DesktopSessions;workspaces:WorkspaceAdmissions;container?:ContainerCommands;cliTasks:CliTasks;rootsGeneration:string;private processes=new Map<string,any>();private jobs=new Map<string,Promise<any>>();private desktopJobs=new Map<string,{context:Context;cancel:(why:string)=>Promise<void>}>();private cancelRequested=new Set<string>();private writes=new Set<string>();private authTimer:any\n  constructor(public config:AgentConfig,Database?:any){const cliProfiles=validateCliProfiles(config.cliProfiles,config.dataDir,config.roots);this.store=new Store(resolve(config.dataDir),Database);this.roots=new Roots(config.roots,{protectedPaths:[resolve(config.dataDir),...(config.desktop?[resolve(config.desktop.secretFile)]:[])]});this.cliTasks=new CliTasks(cliProfiles,this.store,this.roots);this.browser=new BrowserTools(config.browserOrigins??[],config.browserExecutablePath,undefined,config.browserProfiles);this.desktop=new DesktopTools(config.desktop,{validate:c=>this.store.validate(c)})\n    try{\n     // Which roots configuration produced the persisted workspace state. A\n     // changed mapping between runs fences unsettled admissions instead of\n     // letting them be interpreted against roots they were not admitted under.\n     this.rootsGeneration=rootsGeneration(config.roots)\n     this.workspaces=new WorkspaceAdmissions(this.store,this.rootsGeneration)\n     this.store.db.exec('CREATE TABLE IF NOT EXISTS agent_stop_receipts(operation_id TEXT PRIMARY KEY REFERENCES operations(id),proof TEXT NOT NULL)')\n     // Older journals have no physical-root receipt. Keep an explicit recovery\n     // fence instead of assuming those unknown writers had no effects.\n     this.store.db.exec(`CREATE TABLE IF NOT EXISTS workspace_legacy_fences(operation_id TEXT PRIMARY KEY);\n       INSERT OR IGNORE INTO workspace_legacy_fences SELECT id FROM operations WHERE tool IN ('fs_write','shell_exec','worktree_create','worktree_integrate') AND status IN ('admitted','running','cancel_pending','unknown') AND NOT EXISTS(SELECT 1 FROM workspace_admissions WHERE operation_id=operations.id);`)\n     const generationChange=reconcileRootsGeneration(this.store.db,this.rootsGeneration)\n     if(generationChange.changed)this.store.audit('WORKSPACE_ROOTS_GENERATION_CHANGED')\n     if(config.container){if(config.isolation!=='container'||Object.keys(config.executables??{}).length||config.shell||config.windowsJobRunner)fail('CONTAINER_CONFIG_INVALID');this.container=new ContainerCommands(this.store,config.container)}else if(config.isolation==='container')fail('CONTAINER_CONFIG_INVALID')\n    }catch(e){this.store.close();throw e}\n    this.desktopSessions=new DesktopSessions(config.desktop,{validate:c=>this.store.validate(c),audit:(code,actor,operation)=>this.store.audit(code,actor,operation)})\n    this.authTimer=setInterval(()=>{for(const p of [...this.processes.values(),...this.desktopJobs.values()]){try{this.store.validate(p.context)}catch{void p.cancel('GRANT_REVOKED')}};void this.container?.sweep((data,c)=>this.artifact(data,c,'text/plain')).catch(()=>{})},100);this.authTimer.unref()}\n  async call(name:string,args:any,c:Context,operationId?:string) {\n    this.store.validate(c);if(!TOOL_NAMES.includes(name)||!c.tools.includes(name))fail('SCOPE_DENIED',403)\n    if(args?.rootId&&!c.roots.includes(args.rootId))fail('SCOPE_DENIED',403)\n    if(name==='cli_probe_v1')return this.cliTasks.probe(args,c,operationId)\n    if(name==='machine_ping')return {schemaVersion:1,machineId:this.store.machineId,agentVersion:AGENT_VERSION,agentApiMajor:AGENT_API_MAJOR,rootsGeneration:this.rootsGeneration,os:{platform:process.platform,arch:process.arch},node:process.version,isolation:this.config.isolation??'application',isolationStatus:this.container?'command-container':'configuration-only',container:this.container?await this.container.probe():null,capabilities:TOOL_NAMES.filter(n=>(!n.startsWith('desktop_')||!!this.config.desktop)&&(!this.container||!n.startsWith('worktree_'))),browser:await this.browser.probe(),shell:{configured:!!this.container||!!Object.keys(this.config.executables??{}).length||!!this.config.shell,processIsolation:this.container?'container':process.platform==='win32'?(this.config.windowsJobRunner?'job-object-configured':'unavailable'):'process-group'},desktop:{configured:!!this.config.desktop,status:this.config.desktop?'unverified':'unavailable'}}\n    if(name==='operation_status'){if(this.container){await this.container.observe(args.operationId,c,(data,context)=>this.artifact(data,context,'text/plain'));this.store.validate(c)}return this.operationStatus(args.operationId,c)}\n    if(name==='operation_cancel'){\n      this.store.status(args.operationId,c)\n      const p=this.processes.get(args.operationId),desktop=this.desktopJobs.get(args.operationId),pending=this.jobs.has(args.operationId)\n      let requested=!!p||!!desktop||pending\n      if(p)await p.cancel('CANCELLED');else if(desktop)await desktop.cancel('CANCELLED');else if(pending)this.cancelRequested.add(args.operationId);else if(this.container)requested=await this.container.cancel(args.operationId,c)\n      if(this.container){await this.container.observe(args.operationId,c,(data,context)=>this.artifact(data,context,'text/plain'));this.store.validate(c)}\n      const operation=this.operationStatus(args.operationId,c)\n      const terminal=['succeeded','failed','cancelled'].includes(operation.status)\n      // A terminal journal row alone does not prove an external process or\n      // helper has stopped. Trust only the original strict boolean evidence.\n      // Successful file writes await all in-process I/O and cleanup. A failed\n      // write without explicit evidence is not enough to infer that it stopped.\n      // A file write confirms stopping only through its own completed\n      // in-process chain, and only when no tracked job or controller for it\n      // remains. A raw stopConfirmed on a failed or cancelled write, or the\n      // mere absence of tracked processes, is not proof that the write\n      // stopped or that it never ran.\n      const inProcessWrite=operation.tool==='fs_write'&&!!operation.stopProof\n      const evidence=operation.tool!=='fs_write'&&(operation.result?.stopConfirmed===true||operation.result?.notStarted===true)\n      const writeSettled=operation.tool!=='fs_write'||(!this.jobs.has(args.operationId)&&!this.processes.has(args.operationId))\n      const stopConfirmed=terminal&&writeSettled&&(inProcessWrite||evidence)\n      return {cancelRequested:requested,stopConfirmed,...(stopConfirmed&&operation.stopProof?{stopProof:operation.stopProof}:{}),operation}\n    }\n    if(!isMutating(name))return this.execute(name,args,c)\n    if(!operationId)fail('OPERATION_ID_REQUIRED');const admitted=this.store.admit(operationId,c,name,args);if(!admitted.fresh)return name==='fs_write'?this.operationStatus(operationId,c):admitted.operation\n    this.store.running(operationId)\n    if(name==='cli_task_v1'){\n      const job=(async()=>{\n        let settled\n        try{settled=await this.cliTasks.run(args,c,operationId,{setProcess:record=>this.processes.set(operationId,record),clearProcess:()=>this.processes.delete(operationId)})}\n        catch(e:any){settled={status:'unknown',result:{kind:'remote-cli',schemaVersion:1,receipt:null,stopConfirmed:false,stopEvidence:{treeStopped:false,status:'unconfirmed'}},error:'OUTCOME_UNKNOWN'}}\n        this.jobs.delete(operationId);this.processes.delete(operationId);this.cancelRequested.delete(operationId)\n        this.store.finish(operationId,settled.status,settled.result,settled.error)\n        return this.operationStatus(operationId,c)\n      })().finally(()=>{this.jobs.delete(operationId);this.processes.delete(operationId);this.cancelRequested.delete(operationId)})\n      this.jobs.set(operationId,job);return this.store.status(operationId,c)\n    }\n    if(name==='shell_exec'||name==='container_command_v1'){\n      // The versioned command backend is container-only by construction: a\n      // non-container Agent settles the operation as never-started instead of\n      // throwing (a thrown refusal would leave an unsettled admitted\n      // operation and an unknown Task forever), argv is the only input shape,\n      // and the native shell path below stays unreachable for it.\n      const commandOnly=name==='container_command_v1'\n      const job=(async()=>{\n        if(commandOnly){\n          if(!this.container)fail('CONTAINER_COMMAND_UNAVAILABLE',503)\n          if(args?.script!==undefined||!args?.workspaceRef?.rootId)fail('INVALID_ARGUMENT')\n        }\n        return this.container?this.withWorkspace(args.workspaceRef?.rootId,c,operationId,()=>this.shell(args,c,operationId)):this.shell(args,c,operationId)\n      })().catch(e=>{\n        const notStarted=commandOnly&&!this.container||(this.container&&!this.store.db.prepare('SELECT 1 FROM container_workers WHERE operation_id=?').get(operationId))\n        this.store.finish(operationId,'failed',notStarted?{notStarted:true,stopConfirmed:true,possiblyApplied:false}:null,e instanceof AgentError?e.code:'EXECUTION_FAILED')\n      }).finally(()=>{this.jobs.delete(operationId);this.cancelRequested.delete(operationId)});this.jobs.set(operationId,job);return this.store.status(operationId,c)}\n    if(name==='fs_write'){\n      const controller=new AbortController()\n      this.processes.set(operationId,{context:c,cancel:async(why:string)=>{controller.abort(new AgentError(why))}})\n      const job=(async()=>{\n       try{\n        const result=await this.withWorkspace(args.rootId,c,operationId,pin=>this.execute(name,args,c,controller.signal,pin))\n        this.store.finish(operationId,controller.signal.aborted?'cancelled':'succeeded',controller.signal.aborted?{...result,stopConfirmed:true,possiblyApplied:true}:{...result,stopConfirmed:true},controller.signal.aborted?'CANCELLED':null)\n       }catch(e:any){\n        const cancelled=e?.code==='WRITE_CANCELLED',published=e?.published===true,unknown=!cancelled&&(published||e?.code==='OUTCOME_UNKNOWN')\n        // This catch runs only after the in-process write and awaited cleanup\n        // have settled. Post-publication cancellation can retain a shape-checked\n        // digest; every other post-publication error remains unknown and locked.\n        const digest=cancelled&&published&&e?.result&&/^[a-f0-9]{64}$/.test(e.result.sha256)&&Number.isSafeInteger(e.result.size)&&e.result.size>=0&&e.result.size<=1048576?{sha256:e.result.sha256,size:e.result.size}:{}\n        this.store.finish(operationId,cancelled?'cancelled':unknown?'unknown':'failed',unknown?null:{stopConfirmed:true,possiblyApplied:cancelled&&e?.possiblyApplied===false?false:true,...digest},cancelled&&published?'CANCELLED':unknown?'OUTCOME_UNKNOWN':e instanceof AgentError?e.code:'EXECUTION_FAILED')\n       }\n       finally{this.jobs.delete(operationId);this.processes.delete(operationId);this.cancelRequested.delete(operationId)}\n       // This independent receipt is written only by the settled in-process\n       // chain, never reconstructed from raw stopConfirmed/notStarted flags.\n       const operation=this.store.status(operationId,c)\n       if(['succeeded','failed','cancelled'].includes(operation.status)){\n        const proof={schemaVersion:1,kind:'agent-stop-receipt',source:'in-process-write',machineId:this.store.machineId,taskId:c.taskId,attemptId:c.attemptId,operationId,tool:'fs_write',status:operation.status,receiptHash:sha(canonical(operation))}\n        this.store.db.prepare('INSERT OR REPLACE INTO agent_stop_receipts VALUES(?,?)').run(operationId,canonical(proof))\n       }\n       return this.operationStatus(operationId,c)\n      })()\n      this.jobs.set(operationId,job);return job\n    }\n    if(name.startsWith('desktop_')){\n      const controller=new AbortController();let job:Promise<any>\n      const cancel=async(why:string)=>{controller.abort(new AgentError(why));await this.desktop.cancel(c);await job}\n      job=(async()=>{\n        try{const result=await this.execute(name,args,c,controller.signal);this.store.validate(c);if(controller.signal.aborted){const stop=await this.desktop.cancel(c);throw Object.assign(new AgentError(stop.stopConfirmed?'DESKTOP_CANCELLED':'OUTCOME_UNKNOWN'),{stopConfirmed:stop.stopConfirmed,possiblyApplied:name!=='desktop_screenshot'})}this.store.finish(operationId,'succeeded',result)}\n        catch(e:any){\n          if(e.code==='GRANT_REVOKED'){controller.abort(e);const stop=await this.desktop.cancel(c);e=Object.assign(new AgentError(stop.stopConfirmed?'DESKTOP_CANCELLED':'OUTCOME_UNKNOWN'),{stopConfirmed:stop.stopConfirmed,possiblyApplied:name!=='desktop_screenshot'})}\n          const code=e instanceof AgentError?e.code:'EXECUTION_FAILED',stopped=e.stopConfirmed===true,possiblyApplied=e.possiblyApplied===true\n          const state=code==='DESKTOP_CANCELLED'&&stopped?'cancelled':code==='OUTCOME_UNKNOWN'||possiblyApplied?'unknown':'failed'\n          this.store.finish(operationId,state,{stopConfirmed:stopped,possiblyApplied,cancelReason:controller.signal.aborted?(controller.signal.reason?.code??'CANCELLED'):null},code)\n        }finally{this.desktopJobs.delete(operationId);this.jobs.delete(operationId)}\n        return this.store.status(operationId,c)\n      })()\n      this.jobs.set(operationId,job);this.desktopJobs.set(operationId,{context:c,cancel});return job\n    }\n    try{const result=await this.execute(name,args,c);this.store.finish(operationId,'succeeded',result)}catch(e){this.store.finish(operationId,e instanceof AgentError&&e.code==='OUTCOME_UNKNOWN'?'unknown':'failed',null,e instanceof AgentError?e.code:'EXECUTION_FAILED')}\n    return this.store.status(operationId,c)\n  }\n  private operationStatus(id:string,c:Context){\n    const operation=this.store.status(id,c),saved=this.store.db.prepare('SELECT proof FROM agent_stop_receipts WHERE operation_id=?').get(id)\n    if(!saved||this.jobs.has(id)||this.processes.has(id))return operation\n    const proof=JSON.parse(saved.proof)\n    if(proof.schemaVersion!==1||proof.kind!=='agent-stop-receipt'||proof.source!=='in-process-write'||proof.machineId!==operation.machineId||proof.taskId!==c.taskId||proof.attemptId!==c.attemptId||proof.operationId!==id||proof.tool!==operation.tool||proof.status!==operation.status||proof.receiptHash!==sha(canonical(operation)))return operation\n    return {...operation,stopProof:proof}\n  }\n  async artifact(data:Buffer,c:Context,media='application/octet-stream'){\n    if(data.length>8*1024*1024)fail('ARTIFACT_LIMIT',413)\n    // Artifacts are delivery objects (one screenshot, one stream tail), not history. Without a\n    // sweep the quota is a one-way stop: every later screenshot and command would fail\n    // ARTIFACT_QUOTA with nothing able to free space. The oldest rows go first, and only when\n    // the new artifact would not fit.\n    const usage=await this.evictArtifacts(data.length)\n    if(usage+data.length>ARTIFACT_QUOTA_BYTES)fail('ARTIFACT_QUOTA',507)\n    const id=`artifact-${randomUUID()}`;await mkdir(join(this.config.dataDir,'artifacts'),{recursive:true,mode:0o700});await writeFile(join(this.config.dataDir,'artifacts',id),data,{flag:'wx',mode:0o600})\n    this.store.db.prepare('INSERT INTO artifacts VALUES (?,?,?,?,?)').run(id,canonical(c),sha(data),data.length,media);return {artifactId:id,sha256:sha(data),size:data.length,mediaType:media}\n  }\n  private async evictArtifacts(needed:number){\n    let usage:number=this.store.db.prepare('SELECT coalesce(sum(size),0) AS size FROM artifacts').get().size\n    if(usage+needed<=ARTIFACT_QUOTA_BYTES)return usage\n    const rows:any[]=this.store.db.prepare('SELECT id,size FROM artifacts ORDER BY rowid ASC').all()\n    for(const row of rows){\n      if(usage+needed<=ARTIFACT_QUOTA_BYTES)break\n      this.store.db.prepare('DELETE FROM artifacts WHERE id=?').run(row.id)\n      usage-=row.size\n      await unlink(join(this.config.dataDir,'artifacts',row.id)).catch(()=>{})\n    }\n    return usage\n  }\n  async execute(name:string,a:any,c:Context,signal?:AbortSignal,pin?:WorkspacePin):Promise<any>{\n    if(name==='fs_list'){const all=await this.roots.list(a.rootId,a.relativePath??'');all.sort((x,y)=>x.name.localeCompare(y.name));const offset=integer(a.cursor?Number(a.cursor):0,0,1e9),limit=integer(a.limit,1,1000,100);return {entries:all.slice(offset,offset+limit).map(x=>({name:x.name,type:x.isSymbolicLink()?'link':x.isDirectory()?'directory':'file'})),cursor:offset+limit<all.length?String(offset+limit):null}}\n    if(name==='fs_read'){const offset=integer(a.offset,0,Number.MAX_SAFE_INTEGER,0),length=integer(a.length,1,1048576,65536);const {data,size}=await this.roots.read(a.rootId,a.relativePath,offset,length);return {encoding:'base64',content:data.toString('base64'),sha256:sha(data),offset,size,eof:offset+data.length>=size}}\n    if(name==='fs_write')return this.write(a,c,signal,pin)\n    if(name.startsWith('artifact_')){const row=this.store.db.prepare('SELECT * FROM artifacts WHERE id=?').get(a.artifactId);if(!row)fail('ARTIFACT_NOT_FOUND',404);this.store.own(row.context,c);if(name==='artifact_stat')return {artifactId:row.id,sha256:row.hash,size:row.size,mediaType:row.media};const offset=integer(a.offset,0,Number.MAX_SAFE_INTEGER,0),length=integer(a.length,1,1048576,65536),data=await readFile(join(this.config.dataDir,'artifacts',row.id));if(sha(data)!==row.hash)fail('ARTIFACT_CORRUPT');return {encoding:'base64',content:data.subarray(offset,offset+length).toString('base64'),eof:offset+length>=row.size}}\n    if(name.startsWith('browser_'))return this.browser.run(name,a,c)\n    if(name.startsWith('desktop_')){const result=await this.desktop.run(name,a,c,signal);this.store.validate(c);if(result.pngBase64){const artifact=await this.artifact(Buffer.from(result.pngBase64,'base64'),c,'image/png');delete result.pngBase64;return {...result,...artifact}}return result}\n    if(name.startsWith('worktree_'))return this.worktree(name,a,c)\n    fail('TOOL_NOT_READY',503)\n  }\n  private async withWorkspace(rootId:string,c:Context,id:string,run:(pin:WorkspacePin)=>Promise<any>){\n    if(typeof rootId!=='string'||!c.roots.includes(rootId))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    const pin=await WorkspacePin.capture(await this.roots.resolve(rootId,''))\n    try{\n     const legacy=this.store.db.prepare(`SELECT o.id FROM workspace_legacy_fences f JOIN operations o ON o.id=f.operation_id WHERE o.status IN ('admitted','running','cancel_pending','unknown') OR (o.tool='shell_exec' AND NOT (o.status IN ('succeeded','failed','cancelled') AND (coalesce(json_type(o.result,'$.stopConfirmed'),'null')='true' OR coalesce(json_type(o.result,'$.notStarted'),'null')='true'))) LIMIT 1`).get()\n     if(legacy)fail('WORKSPACE_RECOVERY_REQUIRED',409)\n     // Same fail-closed contract for admissions that predate the current\n     // roots configuration: until the fenced operation settles with stop\n     // evidence, no mutating workspace operation interprets persisted state.\n     const generationFenced=this.store.db.prepare(`SELECT o.id FROM workspace_generation_fences f JOIN operations o ON o.id=f.operation_id WHERE o.status IN ('admitted','running','cancel_pending','unknown') OR (o.tool='shell_exec' AND NOT (o.status IN ('succeeded','failed','cancelled') AND (coalesce(json_type(o.result,'$.stopConfirmed'),'null')='true' OR coalesce(json_type(o.result,'$.notStarted'),'null')='true'))) LIMIT 1`).get()\n     if(generationFenced)fail('WORKSPACE_RECOVERY_REQUIRED',409)\n     this.workspaces.admit(id,c,pin.identity);await pin.verify();return await run(pin)\n    }finally{await pin.close()}\n  }\n  async write(a:any,c:Context,signal?:AbortSignal,pin?:WorkspacePin){\n    if(signal?.aborted)throw Object.assign(new AgentError('WRITE_CANCELLED',409),{possiblyApplied:false})\n    if(!Object.hasOwn(a,'expectedHash')||(a.expectedHash!==null&&!/^[a-f0-9]{64}$/.test(a.expectedHash)))fail('EXPECTED_HASH_REQUIRED')\n    if(typeof a.content!=='string'||Buffer.byteLength(a.content)>1048576||!['utf8','base64',undefined].includes(a.encoding))fail('INVALID_ARGUMENT')\n    const target=await this.roots.resolve(a.rootId,a.relativePath,true);if(this.writes.has(target))fail('FILE_CHANGED',409);this.writes.add(target)\n    try{\n      if(pinnedWriteSupported())return await this.pinnedWrite(a,c,signal,target,pin)\n      return await this.legacyWrite(a,c,signal,target)\n    }finally{this.writes.delete(target)}\n  }\n  /**\n   * Descriptor-pinned publication for Linux: only brand-new files. Every\n   * existing target answers the public FILE_CHANGED contract, an explicit\n   * hash-overwrite request is refused outright instead of falling back to the\n   * rename path, and a missing target keeps the old mismatch answer.\n   */\n  private async pinnedWrite(a:any,c:Context,signal:AbortSignal|undefined,target:string,pin?:WorkspacePin){\n    if(a.expectedHash!==null){\n      // Only a matching hash is an actual overwrite attempt (refused); a\n      // mismatched expectation and a missing target keep the public CAS\n      // refusal contract instead of reading as \"unsupported\".\n      try{const data=(await this.roots.read(a.rootId,a.relativePath,0,1048577)).data;if(data.length>1048576)fail('FILE_TOO_LARGE');fail(sha(data)===a.expectedHash?'OVERWRITE_UNSUPPORTED':'FILE_CHANGED',sha(data)===a.expectedHash?501:409)}\n      catch(e:any){if(e.code!=='ENOENT')throw e;fail('FILE_CHANGED',409)}\n    }\n    try{\n      const result=await pinnedCreateNewFile({\n        rootPath:pin?pin.identity.path:await realpath(await this.roots.resolve(a.rootId,'')),\n        relativePath:a.relativePath,content:a.content,encoding:a.encoding,signal,\n        check:report=>this.pinnedWritePolicy(a,c,pin,report)})\n      return {sha256:result.sha256,size:result.size}\n    }catch(e:any){\n      if(e instanceof AgentError&&e.code==='TARGET_EXISTS')fail('FILE_CHANGED',409)\n      throw e\n    }\n  }\n  /** Grant, protected-path and root-identity rechecks at every pinned-write phase. */\n  protected async pinnedWritePolicy(a:any,c:Context,pin:WorkspacePin|undefined,report:{phase:string;targetPath:string}){\n    this.store.validate(c)\n    await this.roots.assertPublicTree(report.targetPath)\n    if(pin)await pin.verify()\n  }\n  private async legacyWrite(a:any,c:Context,signal:AbortSignal|undefined,target:string){\n    const temp=join(dirname(target),`.dsh-write-${randomUUID()}`)\n    try{const parent=await stat(dirname(target));let previous:Buffer|null=null;try{previous=(await this.roots.read(a.rootId,a.relativePath,0,1048577)).data;if(previous.length>1048576)fail('FILE_TOO_LARGE')}catch(e:any){if(e.code!=='ENOENT')throw e}\n      if((previous===null?null:sha(previous))!==a.expectedHash)fail('FILE_CHANGED',409)\n      const data=Buffer.from(a.content,a.encoding??'utf8');await writeFile(temp,data,{flag:'wx',mode:0o600})\n      if(signal?.aborted)throw Object.assign(new AgentError('WRITE_CANCELLED',409),{possiblyApplied:false})\n      this.store.validate(c);await this.roots.resolve(a.rootId,a.relativePath,true);const now=await stat(dirname(target));if(now.ino!==parent.ino||now.dev!==parent.dev)fail('FILE_CHANGED',409)\n      let current:Buffer|null=null;try{current=(await this.roots.read(a.rootId,a.relativePath,0,1048577)).data}catch(e:any){if(e.code!=='ENOENT')throw e}\n      if((current===null?null:sha(current))!==a.expectedHash)fail('FILE_CHANGED',409)\n      if(signal?.aborted)throw Object.assign(new AgentError('WRITE_CANCELLED',409),{possiblyApplied:false})\n      await rename(temp,target);return {sha256:sha(data),size:data.length}\n    }finally{await unlink(temp).catch(()=>{})}\n  }\n  async shell(a:any,c:Context,id:string){\n    if(!a.workspaceRef||a.workspaceRef.kind!=='remote'||a.workspaceRef.machineId!==this.store.machineId||!c.roots.includes(a.workspaceRef.rootId))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    const cwd=await this.roots.resolve(a.workspaceRef.rootId,a.workspaceRef.relativePath??'');if(!(await stat(cwd)).isDirectory())fail('WORKSPACE_OUTSIDE_SCOPE')\n    const timeout=integer(a.timeoutMs,1,1800000,60000);let executable:string,argv:string[]\n    if(this.container){\n      if(a.argv){if(!Array.isArray(a.argv)||a.argv.length<1||a.argv.length>256||a.argv.some((x:any)=>typeof x!=='string'||x.includes('\\0')))fail('INVALID_ARGUMENT');executable=this.config.container!.executables[a.argv[0]];if(!executable)fail('EXECUTABLE_NOT_ALLOWED',403);argv=a.argv.slice(1)}\n      else{if(this.config.container!.shell!==true||typeof a.script!=='string'||a.script.length>1048576)fail('SCRIPT_NOT_ALLOWED',403);executable='/bin/sh';argv=['-c',a.script]}\n      const pin=await WorkspacePin.capture(cwd)\n      try{\n       await this.roots.assertContainerTree(pin.scanPath)\n       this.processes.set(id,{context:c,cancel:(why:string)=>this.container!.cancel(id,c,why)})\n       await this.container.run({id,c,rootId:a.workspaceRef.rootId,workspace:pin.identity.path,workspaceIdentity:pin.mountIdentity,executable,argv,timeout,validate:()=>this.store.validate(c),validateWorkspace:()=>pin.verify(),shouldCancel:()=>this.cancelRequested.has(id),artifact:(data,context)=>this.artifact(data,context,'text/plain')})\n      }finally{this.processes.delete(id);await pin.close()}\n      return\n    }\n    if(a.argv){if(!Array.isArray(a.argv)||a.argv.length<1||a.argv.length>256||a.argv.some((x:any)=>typeof x!=='string'||x.includes('\\0')))fail('INVALID_ARGUMENT');executable=this.config.executables?.[a.argv[0]];if(!executable)fail('EXECUTABLE_NOT_ALLOWED',403);argv=a.argv.slice(1)}\n    else {if(!this.config.shell||typeof a.script!=='string'||a.script.length>1048576)fail('SCRIPT_NOT_ALLOWED',403);executable=this.config.shell;argv=process.platform==='win32'?['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',Buffer.from(a.script,'utf16le').toString('base64')]:['-c',a.script]}\n    this.store.validate(c);if(this.cancelRequested.has(id)){this.store.finish(id,'cancelled',null,'CANCELLED');return}\n    if(process.platform==='win32'&&!this.config.windowsJobRunner)fail('PROCESS_ISOLATION_UNAVAILABLE',503)\n    const child=spawn(process.platform==='win32'?this.config.windowsJobRunner!:executable,process.platform==='win32'?[]:argv,{cwd,windowsHide:true,detached:process.platform!=='win32',env:{PATH:process.env.PATH??'',SystemRoot:process.env.SystemRoot??'',TEMP:process.env.TEMP??'',TMP:process.env.TMP??'',LANG:'C.UTF-8'},stdio:['pipe','pipe','pipe']})\n    if(process.platform==='win32')child.stdin.end(JSON.stringify({executable,args:argv,cwd})+'\\n');else child.stdin.end()\n    child.stdin.on('error',()=>{})\n    let stdout:Buffer[]=[],stderr:Buffer[]=[],bytes=0,truncated=false,reason:string|null=null,cancelPromise:Promise<void>|null=null\n    const capture=(target:Buffer[]) => (chunk:Buffer)=>{const remaining=8*1024*1024-bytes;if(remaining>0){target.push(chunk.subarray(0,remaining));bytes+=Math.min(remaining,chunk.length)}if(chunk.length>remaining)truncated=true}\n    child.stdout.on('data',capture(stdout));child.stderr.on('data',capture(stderr))\n    const cancel=(why:string)=>{if(cancelPromise)return cancelPromise;reason=why;cancelPromise=(async()=>{if(child.exitCode!==null||child.signalCode!==null)return\n      if(process.platform==='win32'){if(!child.kill('SIGKILL')&&child.exitCode===null&&child.signalCode===null)this.store.db.prepare(\"UPDATE operations SET status='cancel_pending',error='CANCEL_PENDING' WHERE id=?\").run(id)}\n      else {try{process.kill(-child.pid!,'SIGTERM')}catch{}await new Promise(r=>setTimeout(r,200));try{process.kill(-child.pid!,'SIGKILL')}catch{}}\n    })();return cancelPromise}\n    this.processes.set(id,{child,context:c,cancel});const timer=setTimeout(()=>void cancel('PROCESS_TIMEOUT'),timeout)\n    try{const exit=await new Promise<any>((resolve,reject)=>{child.once('error',reject);child.once('close',(code,signal)=>resolve({exitCode:code,signal}))});await cancelPromise\n      const out=await this.artifact(Buffer.concat(stdout),c,'text/plain'),err=await this.artifact(Buffer.concat(stderr),c,'text/plain')\n      this.store.finish(id,reason==='CANCELLED'?'cancelled':reason?'failed':exit.exitCode===0?'succeeded':'failed',{...exit,stdoutArtifactId:out.artifactId,stderrArtifactId:err.artifactId,truncated},reason??(exit.exitCode===0?null:'PROCESS_EXIT_NONZERO'))\n    }finally{clearTimeout(timer);this.processes.delete(id)}\n  }\n  async git(cwd:string,args:string[]){return (await execFileAsync('git',['-c','core.hooksPath=/dev/null',...args],{cwd,timeout:60000,maxBuffer:8*1024*1024,windowsHide:true,env:{...process.env,GIT_CONFIG_GLOBAL:process.platform==='win32'?'NUL':'/dev/null',GIT_CONFIG_NOSYSTEM:'1',GIT_TERMINAL_PROMPT:'0'}})).stdout.trim()}\n  async worktree(name:string,a:any,c:Context){\n    // Git can execute repository-configured helpers. Container mode must never\n    // cross back into the Agent's native account through a worktree tool.\n    if(this.container)fail('CONTAINER_TOOL_UNAVAILABLE',503)\n    if(name==='worktree_create'){\n      const source=await this.roots.resolve(a.rootId,a.relativePath??'');await this.roots.assertPublicTree(source);if(await this.git(source,['status','--porcelain']))fail('WORKSPACE_DIRTY',409)\n      const head=await this.git(source,['rev-parse','HEAD']);const id=`worktree-${randomUUID()}`,relative=a.worktreeRelativePath\n      if(typeof relative!=='string')fail('INVALID_ARGUMENT');const target=await this.roots.resolve(a.rootId,relative,true);if(target===source||this.roots.inside(source,target))fail('INVALID_WORKTREE_PATH')\n      this.store.validate(c);await this.git(source,['worktree','add','--detach',target,head]);this.store.db.prepare('INSERT INTO worktrees VALUES (?,?,?,?,?,?)').run(id,canonical(c),a.rootId,target,head,source);return {worktreeId:id,rootId:a.rootId,relativePath:relative,sourceHead:head}\n    }\n    const row=this.store.db.prepare('SELECT * FROM worktrees WHERE id=?').get(a.worktreeId);if(!row)fail('WORKTREE_NOT_FOUND',404);this.store.own(row.context,c);if(!c.roots.includes(row.root))fail('SCOPE_DENIED',403)\n    const base=await realpath(this.config.roots[row.root]);for(const p of [row.path,row.source]){if(!this.roots.inside(base,await realpath(p)))fail('WORKSPACE_OUTSIDE_SCOPE',403);await this.roots.assertPublicTree(p)}\n    const patch=await this.git(row.path,['diff','--binary',row.head]);if(name==='worktree_diff')return {sourceHead:row.head,...await this.artifact(Buffer.from(patch+'\\n'),c,'text/x-diff')}\n    if(await this.git(row.path,['rev-parse','HEAD'])!==row.head||await this.git(row.source,['rev-parse','HEAD'])!==row.head||await this.git(row.source,['status','--porcelain']))return {status:'integration-pending',reason:'SOURCE_CHANGED',worktreeId:a.worktreeId}\n    const patchFile=join(this.config.dataDir,`patch-${randomUUID()}`);await writeFile(patchFile,patch+'\\n',{mode:0o600})\n    try{if(!patch)return {status:'no-changes'};await this.git(row.source,['apply','--check',patchFile]);this.store.validate(c);await this.git(row.source,['apply',patchFile]);return {status:'integrated',sourceHead:row.head,patchSha256:sha(patch)}}catch(e){if(e instanceof AgentError)throw e;return {status:'integration-pending',reason:'PATCH_CONFLICT',worktreeId:a.worktreeId}}finally{await unlink(patchFile)}\n  }\n  async close(){clearInterval(this.authTimer);const sessions=await this.desktopSessions.close();for(const id of this.jobs.keys())this.cancelRequested.add(id);await Promise.all([...this.processes.values(),...this.desktopJobs.values()].map(p=>p.cancel('CANCELLED')));await this.container?.close();const desktop=await this.desktop.close();await Promise.all([...this.jobs.values()]);await this.browser.close();this.store.close();return {desktopStopConfirmed:desktop.stopConfirmed&&sessions.stopConfirmed}}\n}\n", "import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'\nexport const AGENT_VERSION = '0.1.1'\nexport const AGENT_API_MAJOR = 1\nexport class AgentError extends Error { constructor(public code:string, public status=400) { super(code) } }\nexport const fail = (code:string,status=400):never => { throw new AgentError(code,status) }\nexport const secret = () => randomBytes(32).toString('base64url')\nexport const sha = (value:string|Buffer) => createHash('sha256').update(value).digest('hex')\nexport const matches = (value:string, digest:string) => { const a=Buffer.from(sha(value),'hex'),b=Buffer.from(digest,'hex'); return a.length===b.length && timingSafeEqual(a,b) }\nexport function canonical(v:any):string { if(v===null||typeof v!=='object')return JSON.stringify(v);if(Array.isArray(v))return `[${v.map(canonical).join(',')}]`;return `{${Object.keys(v).sort().map(k=>`${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}` }\nexport function identifier(v:any):string { if(typeof v!=='string'||!/^[-a-zA-Z0-9_.]{1,128}$/.test(v))fail('INVALID_ID');return v }\nexport function integer(v:any,min:number,max:number,defaultValue?:number) { const n=v??defaultValue;if(!Number.isSafeInteger(n)||n<min||n>max)fail('INVALID_ARGUMENT');return n }\nexport type Context = {clientId:string;botId:string;taskId:string;attemptId:string;roots:string[];tools:string[];expiresAt:number;revision:number;grantId:string}\nexport const CATALOG = Object.freeze([\n  ['machine_ping',false],['fs_list',false],['fs_read',false],['fs_write',true],['shell_exec',true],\n  // Versioned container-command Task backend. A distinct name means an older\n  // Agent answers before any work instead of silently running a native shell.\n  ['container_command_v1',true],\n  ['cli_probe_v1',false],['cli_task_v1',true],\n  ['operation_status',false],['operation_cancel',true],['artifact_stat',false],['artifact_read',false],\n  ['worktree_create',true],['worktree_diff',false],['worktree_integrate',true],\n  ['browser_open',true],['browser_snapshot',false],['browser_click',true],['browser_type',true],['browser_script',true],['browser_upload',true],['browser_download',true],['browser_close',true],\n  ['desktop_screenshot',true],['desktop_click',true],['desktop_type',true],['desktop_key',true],['desktop_scroll',true],\n].map(([name,mutating])=>({name:String(name),mutating:Boolean(mutating),inputSchema:{type:'object',additionalProperties:true}})))\nexport const TOOL_NAMES = CATALOG.map(x=>x.name)\nexport const isMutating = (name:string) => CATALOG.find(x=>x.name===name)?.mutating??false\n", "import { mkdirSync, openSync, readFileSync, writeFileSync, closeSync, unlinkSync, chmodSync, fstatSync, lstatSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { createRequire } from 'node:module'\nimport { randomUUID } from 'node:crypto'\nimport { canonical, fail, identifier, matches, secret, sha, TOOL_NAMES, type Context } from './protocol.js'\nexport class Store {\n  db:any;machineId:string;private lockFd:number|undefined;private lockPath:string;private controllerGuard:any;private closed=false;private admin=false\n  constructor(public dataDir:string,Database?:any,options:{admin?:boolean}={}) {\n    this.admin=options.admin===true\n    mkdirSync(dataDir,{recursive:true,mode:0o700});chmodSync(dataDir,0o700)\n    this.lockPath=join(dataDir,'agent.lock')\n    try {\n    const Driver=Database??createRequire(import.meta.url)('better-sqlite3')\n    if(!options.admin){\n      // A lifetime transaction in a separate private file is a kernel-held\n      // semaphore. Stale PID readers cannot unlink each other's new ownership.\n      const guardPath=join(dataDir,'agent-instance.sqlite')\n      try{const s=lstatSync(guardPath);if(!s.isFile()||s.isSymbolicLink()||s.nlink!==1)fail('AGENT_LOCKED')}catch(e:any){if(e.code!=='ENOENT')throw e}\n      this.controllerGuard=new Driver(guardPath)\n      this.controllerGuard.pragma('busy_timeout = 0')\n      try{this.controllerGuard.exec('BEGIN IMMEDIATE')}catch(e:any){if(e.code?.startsWith('SQLITE_BUSY')||e.code?.startsWith('SQLITE_LOCKED'))fail('AGENT_LOCKED');throw e}\n      try {this.lockFd=openSync(this.lockPath,'wx',0o600)} catch {\n      let old:any;try{old=JSON.parse(readFileSync(this.lockPath,'utf8'))}catch{fail('AGENT_LOCKED')}\n      if(!Number.isSafeInteger(old?.pid)||old.pid<=0||typeof old.instanceId!=='string'||!old.instanceId)fail('AGENT_LOCKED')\n      try{process.kill(old.pid,0);fail('AGENT_LOCKED')}catch(e:any){if(e.code!=='ESRCH')throw e}\n      unlinkSync(this.lockPath);this.lockFd=openSync(this.lockPath,'wx',0o600)\n    }\n    writeFileSync(this.lockFd!,JSON.stringify({pid:process.pid,instanceId:randomUUID()}))}\n      this.db=new Driver(join(dataDir,'agent.sqlite'))\n      this.db.pragma('journal_mode = WAL');this.db.pragma('synchronous = FULL');this.db.pragma('busy_timeout = 5000')\n      this.db.exec(`CREATE TABLE IF NOT EXISTS meta(key TEXT PRIMARY KEY,value TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS clients(id TEXT PRIMARY KEY,digest TEXT NOT NULL,revision INTEGER NOT NULL,revoked INTEGER NOT NULL,ceiling TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS grants(digest TEXT PRIMARY KEY,context TEXT NOT NULL);\n        CREATE UNIQUE INDEX IF NOT EXISTS grants_identity ON grants(json_extract(context,'$.grantId'));\n        CREATE TABLE IF NOT EXISTS operations(id TEXT PRIMARY KEY,digest TEXT NOT NULL,context TEXT NOT NULL,tool TEXT NOT NULL,status TEXT NOT NULL,started INTEGER NOT NULL,finished INTEGER,result TEXT,error TEXT);\n        CREATE TABLE IF NOT EXISTS artifacts(id TEXT PRIMARY KEY,context TEXT NOT NULL,hash TEXT NOT NULL,size INTEGER NOT NULL,media TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS worktrees(id TEXT PRIMARY KEY,context TEXT NOT NULL,root TEXT NOT NULL,path TEXT NOT NULL,head TEXT NOT NULL,source TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS audit(id INTEGER PRIMARY KEY,time INTEGER NOT NULL,code TEXT NOT NULL,actor TEXT,operation TEXT);`)\n      this.db.prepare('INSERT OR IGNORE INTO meta VALUES (?,?)').run('machineId',`machine-${randomUUID()}`)\n      this.machineId=this.db.prepare('SELECT value FROM meta WHERE key=?').get('machineId').value\n      if(!options.admin)this.db.prepare(\"UPDATE operations SET status='unknown',error='OUTCOME_UNKNOWN' WHERE status IN ('admitted','running','cancel_pending')\").run()\n      // Tickets are process-lifetime credentials; a restart requires explicit reissuance.\n      if(!options.admin)this.db.prepare('DELETE FROM grants').run()\n    } catch(e) {try{this.db?.close()}catch{};this.releaseController();throw e}\n  }\n  private releaseController(){\n    try{\n      if(this.lockFd!==undefined){\n        let same=false;try{const fd=fstatSync(this.lockFd),named=lstatSync(this.lockPath);same=fd.dev===named.dev&&fd.ino===named.ino&&!named.isSymbolicLink()}catch{}\n        closeSync(this.lockFd);this.lockFd=undefined\n        if(same)try{unlinkSync(this.lockPath)}catch(e:any){if(e.code!=='ENOENT')throw e}\n      }\n    }finally{if(this.controllerGuard){try{this.controllerGuard.exec('ROLLBACK')}catch{};this.controllerGuard.close();this.controllerGuard=undefined}}\n  }\n  pair(id:string,ceiling:{botIds?:string[];hostManagedBots?:boolean;roots:string[];tools:string[]}) {\n    identifier(id)\n    if(!ceiling||ceiling.hostManagedBots!==undefined&&typeof ceiling.hostManagedBots!=='boolean'||!Array.isArray(ceiling.botIds??[])||!Array.isArray(ceiling.roots)||!ceiling.roots.length||!Array.isArray(ceiling.tools)||!ceiling.tools.length||ceiling.tools.some(x=>!TOOL_NAMES.includes(x)))fail('INVALID_CEILING')\n    const managed=ceiling.hostManagedBots===true,botIds=ceiling.botIds??[]\n    if(managed&&!this.admin)fail('ADMIN_REQUIRED',403)\n    if(!managed&&!botIds.length)fail('INVALID_CEILING')\n    botIds.forEach(identifier);ceiling.roots.forEach(identifier)\n    const saved={botIds,roots:ceiling.roots,tools:ceiling.tools,...(managed?{hostManagedBots:true}:{})}\n    const token=secret();this.db.prepare('INSERT INTO clients VALUES (?,?,1,0,?)').run(id,sha(token),canonical(saved));return {clientId:id,token,machineId:this.machineId,secretRef:`remote-agent/${this.machineId}/${id}`,hostManagedBots:managed}\n  }\n  client(token:string) {if(typeof token!=='string'||token.length>256)fail('AUTH_INVALID',401);const row=this.db.prepare('SELECT * FROM clients WHERE digest=?').get(sha(token));const verified=matches(token,row?.digest??'0'.repeat(64));if(!verified||!row||row.revoked)fail('AUTH_INVALID',401);return row}\n  rotate(id:string) {const token=secret();if(!this.db.prepare('UPDATE clients SET digest=?,revision=revision+1,revoked=0 WHERE id=?').run(sha(token),identifier(id)).changes)fail('AUTH_INVALID',401);return {clientId:id,token}}\n  revoke(id:string) {this.db.prepare('UPDATE clients SET revoked=1,revision=revision+1 WHERE id=?').run(identifier(id))}\n  private currentClient(client:any){const row=this.db.prepare('SELECT * FROM clients WHERE id=?').get(client?.id);if(!row||row.revoked||row.revision!==client.revision||row.digest!==client.digest)fail('AUTH_INVALID',401);return row}\n  issue(client:any,request:any) {\n    client=this.currentClient(client)\n    const ceiling=JSON.parse(client.ceiling);for(const key of ['botId','taskId','attemptId'])identifier(request[key])\n    if(ceiling.hostManagedBots!==true&&!ceiling.botIds.includes(request.botId)||!Array.isArray(request.roots)||!Array.isArray(request.tools)||request.roots.some((x:string)=>!ceiling.roots.includes(x))||request.tools.some((x:string)=>!ceiling.tools.includes(x)))fail('SCOPE_DENIED',403)\n    const ttl=request.ttlMs??300000;if(!Number.isSafeInteger(ttl)||ttl<1000||ttl>300000)fail('INVALID_ARGUMENT')\n    this.db.prepare(\"DELETE FROM grants WHERE json_extract(context,'$.expiresAt')<=?\").run(Date.now())\n    if(this.db.prepare('SELECT count(*) AS count FROM grants').get().count>=4096)fail('GRANT_LIMIT',429)\n    const context={clientId:client.id,botId:request.botId,taskId:request.taskId,attemptId:request.attemptId,roots:request.roots,tools:request.tools,expiresAt:Date.now()+ttl,revision:client.revision,grantId:randomUUID()}\n    const token=secret();this.db.prepare('INSERT INTO grants VALUES (?,?)').run(sha(token),canonical(context));return {grantToken:token,machineId:this.machineId,agentApiMajor:1,...context}\n  }\n  grant(token:string):Context {if(typeof token!=='string'||token.length>256)fail('AUTH_INVALID',401);const row=this.db.prepare('SELECT digest,context FROM grants WHERE digest=?').get(sha(token));const verified=matches(token,row?.digest??'0'.repeat(64));if(!verified||!row)fail('AUTH_INVALID',401);const context=JSON.parse(row.context);this.validate(context);return context}\n  validate(c:Context) {const row=this.db.prepare('SELECT revision,revoked FROM clients WHERE id=?').get(c.clientId);if(!row||row.revoked||row.revision!==c.revision||c.expiresAt<=Date.now()||!c.grantId||!this.db.prepare(\"SELECT 1 FROM grants WHERE json_extract(context,'$.grantId')=?\").get(c.grantId))fail('GRANT_REVOKED',403)}\n  revokeGrants(client:any,request:any) {\n    client=this.currentClient(client)\n    identifier(request.botId)\n    const ceiling=JSON.parse(client.ceiling);if(ceiling.hostManagedBots!==true&&!ceiling.botIds.includes(request.botId))fail('SCOPE_DENIED',403)\n    // An authenticated Host may revoke its own tickets, never another client's.\n    const result=this.db.prepare(\"DELETE FROM grants WHERE json_extract(context,'$.clientId')=? AND json_extract(context,'$.botId')=?\").run(client.id,request.botId)\n    return {machineId:this.machineId,agentApiMajor:1,revoked:result.changes,botId:request.botId}\n  }\n  admit(id:string,context:Context,tool:string,args:any) {\n    identifier(id);const digest=sha(canonical({clientId:context.clientId,botId:context.botId,taskId:context.taskId,attemptId:context.attemptId,tool,args}))\n    return this.db.transaction(()=>{const row=this.db.prepare('SELECT * FROM operations WHERE id=?').get(id);if(row){if(row.digest!==digest)fail('OPERATION_CONFLICT',409);return {fresh:false,operation:this.decode(row)}}\n      this.db.prepare(\"INSERT INTO operations(id,digest,context,tool,status,started) VALUES (?,?,?,?,'admitted',?)\").run(id,digest,canonical(context),tool,Date.now());return {fresh:true,operation:this.status(id,context)}})()\n  }\n  own(saved:string,c:Context) {const v=JSON.parse(saved);if(v.clientId!==c.clientId||v.botId!==c.botId||v.taskId!==c.taskId||v.attemptId!==c.attemptId)fail('SCOPE_DENIED',403)}\n  status(id:string,c:Context) {const row=this.db.prepare('SELECT * FROM operations WHERE id=?').get(identifier(id));if(!row)fail('OPERATION_NOT_FOUND',404);this.own(row.context,c);return this.decode(row)}\n  decode(row:any) {return {schemaVersion:1,machineId:this.machineId,operationId:row.id,tool:row.tool,status:row.status,startedAt:new Date(row.started).toISOString(),finishedAt:row.finished?new Date(row.finished).toISOString():null,result:row.result?JSON.parse(row.result):null,error:row.error?{code:row.error}:null}}\n  finish(id:string,status:string,result:any=null,error:string|null=null) {this.db.prepare('UPDATE operations SET status=?,result=?,error=?,finished=? WHERE id=?').run(status,result===null?null:canonical(result),error,Date.now(),id)}\n  running(id:string) {this.db.prepare(\"UPDATE operations SET status='running' WHERE id=? AND status='admitted'\").run(id)}\n  audit(code:string,actor:string|null=null,operation:string|null=null){this.db.prepare('INSERT INTO audit(time,code,actor,operation) VALUES (?,?,?,?)').run(Date.now(),code,actor,operation);this.db.prepare('DELETE FROM audit WHERE id < (SELECT max(id)-10000 FROM audit)').run()}\n  close(){if(this.closed)return;this.closed=true;try{this.db.close()}finally{this.releaseController()}}\n}\n", "import { constants, type Stats } from 'node:fs'\nimport { lstat, realpath, open, stat, readdir } from 'node:fs/promises'\nimport path from 'node:path'\nimport { fail } from './protocol.js'\nexport type RootProtection = { protectedPaths?: string[]; identityScanLimit?: number }\nexport class Roots {\n  private protectedPaths: string[]\n  private identityScanLimit: number\n  constructor(public roots:Record<string,string>,options:RootProtection={}){\n    this.protectedPaths=(options.protectedPaths??[]).map(p=>path.resolve(p))\n    this.identityScanLimit=options.identityScanLimit??8192\n    if(!Number.isSafeInteger(this.identityScanLimit)||this.identityScanLimit<1||this.identityScanLimit>65536)throw new Error('Invalid identity scan limit')\n  }\n  inside(base:string,target:string){const rel=path.relative(base,target);return rel===''||(!rel.startsWith(`..${path.sep}`)&&rel!=='..'&&!path.isAbsolute(rel))}\n  private async actual(p:string):Promise<string>{\n    try{return await realpath(p)}catch(e:any){\n      if(e.code!=='ENOENT'&&e.code!=='ENOTDIR')throw e\n      const parent=path.dirname(p);if(parent===p)throw e\n      return path.join(await this.actual(parent),path.basename(p))\n    }\n  }\n  private async reserved(){\n    const entries=new Set<string>(this.protectedPaths)\n    for(const p of this.protectedPaths)entries.add(await this.actual(p))\n    return [...entries]\n  }\n  private identity(s:Stats){return `${s.dev}:${s.ino}`}\n  private async privateIdentity(s:Stats){\n    if(!s.isFile()||s.nlink<2||!this.protectedPaths.length)return false\n    const wanted=this.identity(s),seen=new Set<string>(),stack=[...this.protectedPaths];let count=0\n    while(stack.length){\n      if(++count>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n      const p=stack.pop()!;let item:Stats\n      try{item=await stat(p)}catch(e:any){if(e.code==='ENOENT'||e.code==='ENOTDIR')continue;fail('PRIVATE_PATH_UNVERIFIED',403)}\n      const id=this.identity(item);if(id===wanted)return true\n      if(seen.has(id))continue;seen.add(id)\n      if(item.isDirectory()){\n        let names:string[];try{names=await readdir(p)}catch{fail('PRIVATE_PATH_UNVERIFIED',403)}\n        if(names!.length+count+stack.length>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n        for(const name of names!)stack.push(path.join(p,name))\n      }\n    }\n    return false\n  }\n  private async allowed(target:string,create=false,descriptor?:Stats){\n    const actual=await this.actual(target),reserved=await this.reserved()\n    if(reserved.some(p=>this.inside(p,target)||this.inside(p,actual)||(create&&(this.inside(target,p)||this.inside(actual,p)))))fail('WORKSPACE_PRIVATE_PATH',403)\n    let s=descriptor\n    if(!s)try{s=await stat(target)}catch(e:any){if(e.code!=='ENOENT'&&e.code!=='ENOTDIR')throw e}\n    if(s&&await this.privateIdentity(s))fail('WORKSPACE_PRIVATE_PATH',403)\n  }\n  async assertPublicTree(target:string){await this.allowed(target,true)}\n  async assertContainerTree(target:string){\n    const stack=[target];let count=0\n    while(stack.length){\n      if(++count>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n      const current=stack.pop()!,before=await lstat(current)\n      if(before.isSymbolicLink())fail('WORKSPACE_OUTSIDE_SCOPE',403)\n      await this.allowed(current,true,before)\n      if(before.isDirectory()){\n        const names=await readdir(current)\n        if(names.length+count+stack.length>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n        for(const name of names)stack.push(path.join(current,name))\n      }else if(!before.isFile())fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    }\n  }\n  async resolve(rootId:string,relativePath='',create=false) {\n    const configured=Object.hasOwn(this.roots,rootId)?this.roots[rootId]:undefined\n    if(!configured||typeof relativePath!=='string'||relativePath.includes('\\0')||path.isAbsolute(relativePath)||/^[a-zA-Z]:|^[/\\\\]{2}|[:]/.test(relativePath))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    const base=await realpath(configured!);const parts=relativePath.split(/[\\\\/]/).filter(Boolean);if(parts.some(x=>x==='..'||x==='.'||/[. ]$/.test(x)))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    let target=base\n    for(let i=0;i<parts.length;i++){target=path.join(target,parts[i]);try{const s=await lstat(target);if(s.isSymbolicLink())fail('WORKSPACE_OUTSIDE_SCOPE',403);const actual=await realpath(target);if(!this.inside(base,actual))fail('WORKSPACE_OUTSIDE_SCOPE',403)}catch(e:any){if(e.code==='ENOENT'&&create&&i===parts.length-1)break;throw e}}\n    if(!this.inside(base,target))fail('WORKSPACE_OUTSIDE_SCOPE',403);await this.allowed(target,create);return target\n  }\n  async read(root:string,relative:string,offset:number,length:number) {\n    const target=await this.resolve(root,relative);const handle=await open(target,constants.O_RDONLY|(constants.O_NOFOLLOW??0))\n    try{const before=await handle.stat();if(!before.isFile())fail('NOT_A_FILE');const resolved=await this.resolve(root,relative),after=await stat(resolved);if(before.ino!==after.ino||before.dev!==after.dev)fail('FILE_CHANGED',409)\n      await this.allowed(resolved,false,before)\n      if(process.platform==='linux'){const actual=await realpath(`/proc/self/fd/${handle.fd}`),base=await realpath(this.roots[root]);if(!this.inside(base,actual))fail('WORKSPACE_OUTSIDE_SCOPE',403);await this.allowed(actual,false,before)}\n      const data=Buffer.alloc(Math.min(length,Math.max(0,before.size-offset)));const {bytesRead}=await handle.read(data,0,data.length,offset);return {data:data.subarray(0,bytesRead),size:before.size}\n    }finally{await handle.close()}\n  }\n  async list(root:string,relative:string){\n    const target=await this.resolve(root,relative),entries=await readdir(target,{withFileTypes:true}),visible=[]\n    for(const entry of entries){\n      try{await this.allowed(path.join(target,entry.name));visible.push(entry)}catch(e:any){\n        if(!['WORKSPACE_PRIVATE_PATH','PRIVATE_PATH_UNVERIFIED'].includes(e.code))throw e\n      }\n    }\n    return visible\n  }\n}\n", "import { randomUUID, createHash } from 'node:crypto'\nimport { access, mkdir, readFile, stat, unlink } from 'node:fs/promises'\nimport { join } from 'node:path'\nimport { fail, sha, type Context } from './protocol.js'\nexport class BrowserTools {\n  private browser:any;private sessions=new Map<string,any>();private profiles=new Map<string,any>()\n  constructor(private origins:string[],private executablePath?:string,private loader=()=>import('playwright'),private profileRoots:Record<string,string>={}){}\n  async probe(){try{await this.loader();if(this.executablePath)await access(this.executablePath);return {status:this.browser?.isConnected()?'ready':'dependency-ready',launchStatus:this.browser?.isConnected()?'verified':'unverified',engine:'chromium',isolation:'browser-context',allowedOrigins:this.origins,persistentProfiles:Object.keys(this.profileRoots).sort()}}catch{return {status:'unavailable',code:'TOOL_NOT_READY'}}}\n  allowed(url:string) {let u:URL;try{u=new URL(url)}catch{fail('URL_OUTSIDE_SCOPE',403)}if(!['http:','https:'].includes(u.protocol)||u.username||u.password||!this.origins.includes(u.origin))fail('URL_OUTSIDE_SCOPE',403)}\n  async run(name:string,a:any,c:Context) {\n    if(name==='browser_open'){\n      this.allowed(a.url);if(this.sessions.size>=16)fail('BROWSER_LIMIT',429)\n      let pw:any;try{pw=await this.loader()}catch{fail('TOOL_NOT_READY',503)}\n      let context,persistent=false,profileId=null\n      if(a.profileId!==undefined){\n        const root=this.profileRoots[a.profileId];if(!root)fail('BROWSER_PROFILE_DENIED',403)\n        const owner=JSON.stringify([c.clientId,c.botId,a.profileId]),key=createHash('sha256').update(owner).digest('hex')\n        try{context=this.profiles.get(key);if(!context){const dataDir=join(root,key);await mkdir(dataDir,{recursive:true,mode:0o700});context=await pw.chromium.launchPersistentContext(dataDir,{headless:true,executablePath:this.executablePath,acceptDownloads:true,serviceWorkers:'block'});this.profiles.set(key,context)}persistent=true;profileId=a.profileId\n        }catch{fail('BROWSER_PROFILE_UNAVAILABLE',503)}\n      }else{\n        try{this.browser??=await pw.chromium.launch({headless:true,executablePath:this.executablePath});context=await this.browser.newContext({acceptDownloads:true,serviceWorkers:'block'})}catch{fail('TOOL_NOT_READY',503)}\n      }\n      await context.route('**/*',async(route:any)=>{try{this.allowed(route.request().url());await route.continue()}catch{await route.abort('blockedbyclient')}})\n      const page=await context.newPage();page.on('popup',(p:any)=>void p.close());const id=`browser-${randomUUID()}`,downloads=new Map()\n      page.on('download',(download:any)=>{const downloadId=`download-${randomUUID()}`;downloads.set(downloadId,{download,path:download.path(),suggestedFilename:download.suggestedFilename()})})\n      this.sessions.set(id,{context,page,owner:JSON.stringify([c.clientId,c.botId,c.taskId,c.attemptId]),revision:null,persistent,profileId,downloads})\n      try{await page.goto(a.url,{waitUntil:'domcontentloaded',timeout:30000});return {browserSessionId:id,url:page.url(),browserVersion:this.browser?.version()??'chromium',persistent,profileId}}catch{this.sessions.delete(id);persistent?await page.close():await context.close();fail('BROWSER_NAVIGATION_FAILED')}\n    }\n    const session=this.sessions.get(a.browserSessionId);if(!session)fail('BROWSER_SESSION_NOT_FOUND',404)\n    if(session.owner!==JSON.stringify([c.clientId,c.botId,c.taskId,c.attemptId]))fail('SCOPE_DENIED',403)\n    if(name==='browser_close'){session.persistent?await session.page.close():await session.context.close();this.sessions.delete(a.browserSessionId);return {closed:true,persistent:session.persistent}}\n    if(name==='browser_download'){\n      const item=session.downloads.get(a.downloadId);if(!item)fail('BROWSER_DOWNLOAD_NOT_FOUND',404)\n      const path=await item.path,info=await stat(path);if(info.size>1048576)fail('BROWSER_DOWNLOAD_TOO_LARGE',413)\n      const data=await readFile(path);await unlink(path);session.downloads.delete(a.downloadId)\n      return {downloadId:a.downloadId,filename:item.suggestedFilename,encoding:'base64',content:data.toString('base64'),sha256:sha(data),size:data.length}\n    }\n    if(name==='browser_script'){\n      if(typeof a.script!=='string'||!a.script.trim()||a.script.length>16384||a.script.includes('\\0'))fail('INVALID_ARGUMENT')\n      let value;try{value=await session.page.evaluate(a.script)}catch{fail('BROWSER_SCRIPT_FAILED',400)}\n      let text;try{text=JSON.stringify(value??null)}catch{fail('BROWSER_SCRIPT_RESULT_LIMIT',413)}\n      if(text.length>100000)fail('BROWSER_SCRIPT_RESULT_LIMIT',413)\n      return {completed:true,url:session.page.url(),result:value??null}\n    }\n    if(name==='browser_snapshot'){\n      session.revision=`snapshot-${randomUUID()}`\n      const nodes=await session.page.locator('a,button,input,textarea,select,[role=\"button\"]').evaluateAll((elements:any[])=>elements.slice(0,300).map((el:any,i:number)=>{el.setAttribute('data-dsh-agent-ref',String(i));return {ref:String(i),tag:el.tagName.toLowerCase(),text:(el.innerText||el.getAttribute('aria-label')||'').slice(0,300)}}))\n      return {browserSessionId:a.browserSessionId,snapshotId:session.revision,url:session.page.url(),text:(await session.page.locator('body').innerText()).slice(0,100000),nodes}\n    }\n    if(a.snapshotId!==session.revision||!/^\\d{1,3}$/.test(a.ref))fail('TARGET_STALE',409)\n    const node=session.page.locator(`[data-dsh-agent-ref=\"${a.ref}\"]`);if(await node.count()!==1)fail('TARGET_STALE',409)\n    session.revision=null\n    if(name==='browser_type'&&(typeof a.text!=='string'||a.text.length>65536))fail('INVALID_ARGUMENT')\n    let upload\n    if(name==='browser_upload'){\n      if(typeof a.filename!=='string'||!a.filename||a.filename.length>128||/[\\0/\\\\]/.test(a.filename)||typeof a.contentBase64!=='string')fail('INVALID_ARGUMENT')\n      const data=Buffer.from(a.contentBase64,'base64');if(data.toString('base64')!==a.contentBase64||data.length>1048576)fail('BROWSER_UPLOAD_LIMIT',413)\n      if(a.mimeType!==undefined&&(typeof a.mimeType!=='string'||!/^[-\\w.+]+\\/[-\\w.+]+$/.test(a.mimeType)))fail('INVALID_ARGUMENT')\n      upload={name:a.filename,mimeType:a.mimeType??'text/plain',buffer:data}\n    }\n    const pendingDownload=name==='browser_click'?session.page.waitForEvent('download',{timeout:1000}).catch(()=>null):null\n    try{if(name==='browser_click')await node.click({timeout:10000})\n      else if(name==='browser_type')await node.fill(a.text,{timeout:10000})\n      else if(name==='browser_upload')await node.setInputFiles(upload,{timeout:10000})\n      else fail('TOOL_NOT_READY',503)\n    }catch{fail('OUTCOME_UNKNOWN',409)}\n    const download=await pendingDownload,downloadId=download?[...session.downloads.entries()].find(([,item])=>item.download===download)?.[0]:undefined\n    return {completed:true,url:session.page.url(),...(downloadId?{downloadId}:{})}\n  }\n  async close(){for(const s of this.sessions.values())s.persistent?await s.page.close():await s.context.close();this.sessions.clear();for(const context of this.profiles.values())await context.close();this.profiles.clear();await this.browser?.close()}\n}\n", "import net from 'node:net'\nimport {readFile} from 'node:fs/promises'\nimport {randomUUID} from 'node:crypto'\nimport {AgentError,fail,sha,canonical,type Context} from './protocol.js'\n\ntype Owner={tag:string;expiresAt:number;helper?:string;token?:string;blocked:boolean;active:number;idleAt:number;uncertain:number;stopAttempts:number;stop?:Promise<boolean>}\ntype Options={connect?:typeof net.createConnection;validate?:(context:Context)=>void;timeoutMs?:number}\nconst error=(code:string,possiblyApplied=false,stopConfirmed=false)=>Object.assign(new AgentError(code,409),{possiblyApplied,stopConfirmed})\n\n/** The native helper is the global arbiter. This client never substitutes a local lock. */\nexport class DesktopTools {\n  private nonce=randomUUID();private owners=new Map<string,Owner>();private closing=new AbortController();private active=new Set<Promise<any>>()\n  constructor(private config?:{pipeName:string;secretFile:string},private options:Options={}){}\n  private tag(c:Context){return sha(canonical({agent:this.nonce,client:c.clientId,bot:c.botId,task:c.taskId,attempt:c.attemptId,revision:c.revision}))}\n  private owner(c:Context){\n    const now=Date.now();for(const [tag,row] of this.owners)if(!row.active&&!row.uncertain&&row.expiresAt+10000<now)this.owners.delete(tag)\n    const tag=this.tag(c);let row=this.owners.get(tag)\n    if(!row){if(this.owners.size>=4096)fail('DESKTOP_LEASE_LIMIT',429);row={tag,expiresAt:c.expiresAt,blocked:false,active:0,idleAt:0,uncertain:0,stopAttempts:0};this.owners.set(tag,row)}\n    row.expiresAt=Math.max(row.expiresAt,c.expiresAt);return row\n  }\n  private async rpc(control:boolean,packet:any,beforeWrite:()=>void=()=>{}){\n    const name=this.config!.pipeName+(control?'-control':'')\n    return new Promise<any>((resolve,reject)=>{\n      const socket=(this.options.connect??net.createConnection)(`\\\\\\\\.\\\\pipe\\\\${name}`),chunks:Buffer[]=[]\n      let bytes=0,sent=false,settled=false\n      const finish=(value:any,e?:any)=>{if(settled)return;settled=true;clearTimeout(timer);socket.destroy();if(e)reject(e);else resolve(value)}\n      const timer=setTimeout(()=>finish(null,error(sent?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',!control&&sent)),this.options.timeoutMs??10000)\n      socket.once('connect',()=>{try{beforeWrite();sent=true;socket.write(JSON.stringify({...packet,protocolVersion:2})+'\\n')}catch(e){finish(null,e)}})\n      socket.on('data',chunk=>{\n        const data=Buffer.isBuffer(chunk)?chunk:Buffer.from(chunk);bytes+=data.length\n        if(bytes>24000000){finish(null,error('OUTCOME_UNKNOWN',!control&&sent));return}\n        chunks.push(data)\n        if(data.includes(10))try{const all=Buffer.concat(chunks),end=all.indexOf(10);if(all.subarray(end+1).toString('utf8').trim())throw Error();finish(JSON.parse(all.subarray(0,end).toString('utf8')))}catch{finish(null,error('OUTCOME_UNKNOWN',!control&&sent))}\n      })\n      socket.once('error',()=>finish(null,error(sent?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',!control&&sent)))\n      socket.once('close',()=>finish(null,error(sent?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',!control&&sent)))\n    })\n  }\n  private checkResponse(result:any,possiblyApplied=false){if(result?.protocolVersion!==2)throw error('DESKTOP_PROTOCOL_UNSUPPORTED',possiblyApplied);return result}\n  private async stop(row:Owner,retry=false):Promise<boolean>{\n    row.blocked=true\n    if(!row.helper||!row.token)return !row.uncertain\n    if(row.stop&&retry){const previous=row.stop,stopped=await previous;if(stopped||row.stopAttempts>=2)return stopped;if(row.stop===previous)row.stop=undefined}\n    if(!row.stop){row.stopAttempts++;row.stop=(async()=>{\n      try{\n        const result=this.checkResponse(await this.rpc(true,{token:row.token,name:'cancel',owner:row.tag,helperInstanceId:row.helper}))\n        const stopped=result.ok===true&&result.result?.helperInstanceId===row.helper&&result.result?.stopConfirmed===true\n        if(stopped){row.uncertain=0;row.idleAt=0}return stopped\n      }catch{return false}\n    })()}\n    return row.stop\n  }\n  async cancel(c:Context){const row=this.owners.get(this.tag(c));return {stopConfirmed:row?await this.stop(row,true):true}}\n  async run(name:string,args:any,c:Context,external?:AbortSignal){\n    if(process.platform!=='win32'&&!this.options.connect||!this.config)fail('DESKTOP_UNAVAILABLE',503)\n    if(!/^dsh-desktop-[-a-zA-Z0-9]{1,64}$/.test(this.config.pipeName))fail('DESKTOP_UNAVAILABLE',503)\n    const row=this.owner(c),signal=AbortSignal.any([this.closing.signal,...(external?[external]:[])])\n    // A stop request fences the owner, but a fresh capture has no side effect and proves the\n    // desktop is reachable under the current grant again. Without this, one cancelled action\n    // would refuse every later desktop call of that Bot chat.\n    if(name==='desktop_screenshot'&&row.blocked&&!this.closing.signal.aborted){row.blocked=false;row.stop=undefined;row.stopAttempts=0}\n    const check=()=>{if(signal.aborted||row.blocked)throw error('DESKTOP_CANCELLED',false,true);if(!Number.isSafeInteger(c.expiresAt)||c.expiresAt<=Date.now())throw error('GRANT_REVOKED');this.options.validate?.(c)}\n    const work=(async()=>{\n      let sent=false,notApplied=false\n      const abort=()=>{void this.stop(row)};signal.addEventListener('abort',abort,{once:true});row.active++\n      try{\n        check();const token=(await readFile(this.config!.secretFile,'utf8')).trim();check()\n        const probe=this.checkResponse(await this.rpc(true,{token,name:'probe'}))\n        if(!probe.ok)throw error(probe.code??'DESKTOP_UNAVAILABLE')\n        if(probe.result?.protocolVersion!==2||!/^[a-f0-9]{32}$/.test(probe.result?.helperInstanceId??''))throw error('DESKTOP_PROTOCOL_UNSUPPORTED')\n        check();row.helper=probe.result.helperInstanceId;row.token=token\n        const response=this.checkResponse(await this.rpc(false,{token,name,args,owner:row.tag,expiresAt:c.expiresAt,helperInstanceId:row.helper},()=>{check();sent=true;row.uncertain++}),true)\n        // Only this acknowledged packet retires its own uncertainty. A failed\n        // later connect must not erase another packet's missing receipt.\n        row.uncertain=Math.max(0,row.uncertain-1)\n        row.idleAt=Date.now()\n        notApplied=response.effect==='not-applied'\n        if(signal.aborted||row.blocked)throw error('DESKTOP_CANCELLED',sent&&!notApplied)\n        this.options.validate?.(c)\n        if(!response.ok)throw error(response.code??'DESKTOP_UNAVAILABLE',response.effect==='possibly-applied',response.stopConfirmed===true)\n        row.idleAt=Date.now();return response.result\n      }catch(e:any){\n        if(e.code==='GRANT_REVOKED')row.blocked=true\n        if(signal.aborted||row.blocked){const stopped=await this.stop(row,true);throw error(stopped?'DESKTOP_CANCELLED':'OUTCOME_UNKNOWN',sent&&!notApplied,stopped)}\n        if(!sent)e.stopConfirmed=true\n        throw e\n      }finally{row.active--;signal.removeEventListener('abort',abort)}\n    })()\n    this.active.add(work)\n    try{return await work}finally{this.active.delete(work)}\n  }\n  async close(){\n    this.closing.abort(error('DESKTOP_HOST_STOPPED'))\n    const relevant=[...this.owners.values()].filter(row=>row.active||row.uncertain||row.idleAt+15000>Date.now())\n    const stopped=await Promise.all(relevant.map(row=>this.stop(row,true)))\n    await Promise.allSettled([...this.active]);return {stopConfirmed:stopped.every(Boolean)}\n  }\n}\n", "import net from 'node:net'\nimport {readFile} from 'node:fs/promises'\nimport {EventEmitter} from 'node:events'\nimport {randomUUID} from 'node:crypto'\nimport type {WebSocket} from 'ws'\nimport {AgentError,canonical,fail,integer,matches,secret,sha,type Context} from './protocol.js'\n\ntype Config={pipeName:string;secretFile:string}\ntype Ack={ok:boolean;code?:string;possiblyApplied?:boolean;stopConfirmed?:boolean;mode?:'watch'|'control';expiresAt?:number}\nexport interface NativeDesktopSession extends EventEmitter {\n  metadata:any\n  request(message:any):Promise<Ack>\n  frame(keyframe?:boolean):void\n  close():Promise<{stopConfirmed:boolean}>\n}\ntype Authority={validate:(context:Context)=>void;audit?:(code:string,actor?:string|null,operation?:string|null)=>void}\nexport type DesktopSessionOptions={nativeFactory?:(config:Config,request:any)=>Promise<NativeDesktopSession>;authTimeoutMs?:number;maxBufferedAmount?:number;sweepMs?:number}\nconst inputTools=['desktop_click','desktop_type','desktop_key','desktop_scroll']\nconst unknown=()=>Object.assign(new AgentError('OUTCOME_UNKNOWN',409),{possiblyApplied:true,stopConfirmed:false})\n// Native Harness has a standard Electron origin that Node's URL serializes as\n// \"null\". Permit this exact origin only when bound to an authenticated ticket;\n// it is not added to the Agent's global HTTP Origin allowlist.\nconst safeOrigin=(value:any)=>{if(value==='dsh-app://app')return value;if(typeof value!=='string')fail('INVALID_ORIGIN');try{const url=new URL(value);if(!['http:','https:'].includes(url.protocol)||url.origin!==value)fail('INVALID_ORIGIN');return value}catch{fail('INVALID_ORIGIN')}}\nconst ownerIdentity=(c:Context)=>canonical({client:c.clientId,bot:c.botId,task:c.taskId,attempt:c.attemptId,revision:c.revision,roots:[...c.roots].sort()})\n\n/** Private native pipe; no helper token or Host grant is sent to the renderer. */\nexport class NativeDesktopPipe extends EventEmitter implements NativeDesktopSession {\n  metadata:any;private frameMetadata:any;private socket:net.Socket;private buffer=Buffer.alloc(0);private nextId=0;private ended=false;private stopConfirmed=false\n  private pending=new Map<number,{resolve:(v:Ack)=>void;reject:(e:any)=>void;timer:ReturnType<typeof setTimeout>}>()\n  private opening=Promise.withResolvers<any>();private openTimer:ReturnType<typeof setTimeout>;private stopping?:Promise<{stopConfirmed:boolean}>\n  private constructor(config:Config,request:any,token:string){\n    super();this.socket=net.createConnection(`\\\\\\\\.\\\\pipe\\\\${config.pipeName}-stream`)\n    this.openTimer=setTimeout(()=>this.finish(new AgentError('DESKTOP_UNAVAILABLE',503)),5000)\n    this.socket.once('connect',()=>this.write({...request,streamVersion:1,token}))\n    this.socket.on('data',chunk=>{try{this.receive(chunk)}catch{this.finish(unknown())}})\n    this.socket.once('error',()=>this.finish(new AgentError(this.metadata?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',503)))\n    this.socket.once('close',()=>this.finish(unknown()))\n  }\n  static async open(config:Config,request:any){\n    if(process.platform!=='win32'||!/^dsh-desktop-[-a-zA-Z0-9]{1,64}$/.test(config.pipeName))fail('DESKTOP_UNAVAILABLE',503)\n    const token=(await readFile(config.secretFile,'utf8')).trim(),pipe=new NativeDesktopPipe(config,request,token)\n    await pipe.opening.promise;return pipe\n  }\n  private write(value:any){if(this.ended)throw unknown();const body=Buffer.from(JSON.stringify(value));if(body.length>65535)fail('INPUT_LIMIT');const packet=Buffer.allocUnsafe(body.length+5);packet.writeUInt32LE(body.length+1);packet[4]=74;body.copy(packet,5);this.socket.write(packet)}\n  private receive(chunk:Buffer){\n    this.buffer=Buffer.concat([this.buffer,chunk]);if(this.buffer.length>8388613+65536)throw unknown()\n    while(this.buffer.length>=4){\n      const length=this.buffer.readUInt32LE(0);if(length<1||length>8388609)throw unknown();if(this.buffer.length<length+4)return\n      const tag=this.buffer[4],body=this.buffer.subarray(5,length+4);this.buffer=this.buffer.subarray(length+4)\n      if(tag===70){if(!this.metadata)throw unknown();this.emit('frame',body,this.frameMetadata);continue}\n      if(tag!==74||body.length>65536)throw unknown();const value=JSON.parse(body.toString('utf8'))\n      if(value.t==='opened'){\n        if(this.metadata)throw unknown();if(value.ok!==true){this.finish(new AgentError(value.code??'DESKTOP_UNAVAILABLE',503));return}\n        if(value.streamVersion!==1||!Number.isSafeInteger(value.width)||value.width<1||!Number.isSafeInteger(value.height)||value.height<1||!Array.isArray(value.displays)||typeof value.displayId!=='string')throw unknown()\n        this.metadata=value;clearTimeout(this.openTimer);this.opening.resolve(value)\n      }else if(value.t==='frame-meta'){this.frameMetadata=value}\n      else if(value.t==='ack'){\n        const pending=this.pending.get(value.id);if(!pending)continue;clearTimeout(pending.timer);this.pending.delete(value.id);pending.resolve(value)\n      }else if(value.t==='ended'){this.stopConfirmed=value.stopConfirmed===true;this.emit('ended',{code:value.code??'DESKTOP_STOPPED',stopConfirmed:this.stopConfirmed})}\n      else throw unknown()\n    }\n  }\n  private finish(error:any){\n    if(this.ended)return;this.ended=true;clearTimeout(this.openTimer);this.socket.destroy();this.buffer=Buffer.alloc(0);this.opening.reject(error)\n    for(const row of this.pending.values()){clearTimeout(row.timer);row.reject(unknown())}this.pending.clear();this.emit('ended',{code:error?.code??'DESKTOP_DISCONNECTED',stopConfirmed:this.stopConfirmed})\n  }\n  request(message:any):Promise<Ack>{\n    if(this.ended)return Promise.reject(unknown());if(this.pending.size>=64)return Promise.reject(new AgentError('DESKTOP_INPUT_LIMIT',429))\n    const id=++this.nextId\n    return new Promise((resolve,reject)=>{const timer=setTimeout(()=>{this.pending.delete(id);reject(unknown());this.finish(unknown())},6500);this.pending.set(id,{resolve,reject,timer});try{this.write({...message,id})}catch(e){clearTimeout(timer);this.pending.delete(id);reject(e)}})\n  }\n  frame(keyframe=false){try{this.write({t:'frame',...(keyframe?{keyframe:true}:{})})}catch{this.finish(unknown())}}\n  close(){\n    if(!this.stopping)this.stopping=(async()=>{if(this.ended)return {stopConfirmed:this.stopConfirmed};try{const ack=await this.request({t:'close'});this.stopConfirmed=ack.ok===true&&ack.stopConfirmed===true;return {stopConfirmed:this.stopConfirmed}}catch{return {stopConfirmed:this.stopConfirmed}}finally{this.finish(unknown())}})()\n    return this.stopping\n  }\n}\n\ntype Session={id:string;token:string;digest:string;context:Context;origin?:string;native:NativeDesktopSession;mode:'watch'|'control';requestedControl:boolean;controlAllowed:boolean;socket?:WebSocket;used:boolean;closed:boolean;stopped:boolean;closedAt?:number;stop?:Promise<{stopConfirmed:boolean}>;queue:Promise<any>;queued:number;renewing:boolean;frameTimer?:ReturnType<typeof setTimeout>;ackTimer?:ReturnType<typeof setTimeout>;sending:boolean;lastInputId:number;events:any[];fps:number;profile:number;appliedProfile:number;fastFrames:number;baselineRtt:number;pingTag?:string;pingStarted:number;frameSequence:number;frameRequested:boolean;pendingFrame?:{jpeg:Buffer;metadata:any}}\nconst videoProfiles=[{scalePercent:100,quality:70},{scalePercent:75,quality:60},{scalePercent:60,quality:50},{scalePercent:50,quality:45},{scalePercent:40,quality:35},{scalePercent:35,quality:30}]\n\n/** Process-lifetime, grant-bound capabilities. This object has no model tool route. */\nexport class DesktopSessions {\n  private forceKeyframes=new Set<Session>()\n  private flights=new WeakMap<Session,Map<string,{started:number;keyframe:boolean}>>()\n  private sessions=new Map<string,Session>();private nonce=randomUUID();private closing=false;private timer:ReturnType<typeof setInterval>;private sockets=new Set<WebSocket>();private opening=0\n  constructor(private config:Config|undefined,private authority:Authority,private options:DesktopSessionOptions={}){this.timer=setInterval(()=>void this.sweep(),options.sweepMs??100);this.timer.unref()}\n  private check(c:Context){if(this.closing)fail('DESKTOP_HOST_STOPPED',503);this.authority.validate(c);if(!c.tools.includes('desktop_screenshot'))fail('SCOPE_DENIED',403);if(!Number.isSafeInteger(c.expiresAt)||c.expiresAt<=Date.now())fail('GRANT_REVOKED',403)}\n  private audit(row:Session,kind:string,extra:any={}){row.events.push({at:Date.now(),kind,sessionId:row.id,taskId:row.context.taskId,attemptId:row.context.attemptId,...extra});if(row.events.length>128)row.events.shift();if(!['input','frame-drop'].includes(kind))this.authority.audit?.(`DESKTOP_SESSION_${kind.toUpperCase().replaceAll('-','_')}`,row.context.botId,`${row.context.taskId}/${row.context.attemptId}/${row.id}`)}\n  private ticket(row:Session){return {sessionId:row.id,token:row.token,expiresAt:row.context.expiresAt,path:'/desktop/v1/socket',displayId:row.native.metadata.displayId,displays:row.native.metadata.displays,width:row.native.metadata.width,height:row.native.metadata.height,mode:row.mode,controlAllowed:row.controlAllowed}}\n  private own(c:Context,id:any){this.check(c);const row=this.sessions.get(id);if(!row)fail('DESKTOP_SESSION_NOT_FOUND',404);if(ownerIdentity(c)!==ownerIdentity(row.context))fail('SCOPE_DENIED',403);return row}\n  async open(c:Context,request:any){\n    this.check(c);if(!this.config)fail('DESKTOP_UNAVAILABLE',503)\n    if(!request||typeof request!=='object'||Array.isArray(request)||Object.keys(request).some(k=>!['mode','fps','displayId','origin'].includes(k)))fail('INVALID_ARGUMENT')\n    const mode=request.mode??'watch';if(!['watch','control'].includes(mode))fail('INVALID_ARGUMENT');const fps=integer(request.fps,1,30,15)\n    if(request.displayId!==undefined&&(typeof request.displayId!=='string'||request.displayId.length>128))fail('INVALID_ARGUMENT')\n    const origin=request.origin===undefined?undefined:safeOrigin(request.origin),controlAllowed=inputTools.every(tool=>c.tools.includes(tool))\n    if(mode==='control'&&!controlAllowed)fail('SCOPE_DENIED',403)\n    await this.sweep();if(this.opening+[...this.sessions.values()].filter(s=>!s.closed).length>=4||this.sessions.size>=256)fail('DESKTOP_SESSION_LIMIT',429)\n    const id=`desktop-${randomUUID()}`,token=secret()\n    this.opening++;let native:NativeDesktopSession\n    try{native=await (this.options.nativeFactory??NativeDesktopPipe.open)(this.config,{owner:sha(canonical({agent:this.nonce,session:id,identity:ownerIdentity(c)})),expiresAt:c.expiresAt,fps,controlAllowed,...(request.displayId?{displayId:request.displayId}:{})})}finally{this.opening--}\n    try{this.check(c)}catch(e){await native.close();throw e}\n    const row:Session={id,token,digest:sha(token),context:structuredClone(c),origin,native,mode:'watch',requestedControl:mode==='control',controlAllowed,used:false,closed:false,stopped:false,queue:Promise.resolve(),queued:0,renewing:false,sending:false,lastInputId:0,events:[],fps,profile:0,appliedProfile:0,fastFrames:0,baselineRtt:0,pingStarted:0,frameSequence:0,frameRequested:false}\n    this.sessions.set(id,row);native.on('frame',(jpeg,metadata)=>{row.frameRequested=false;this.frame(row,jpeg,metadata)});native.on('ended',value=>{row.stopped=value.stopConfirmed===true;if(!row.closed){row.closed=true;row.closedAt=Date.now();clearTimeout(row.frameTimer);clearTimeout(row.ackTimer);row.pendingFrame=undefined;this.send(row,{type:'status',status:'disconnected',mode:'watch',code:value.code,stopConfirmed:row.stopped});row.socket?.close(1000,'Desktop session ended');this.audit(row,'ended',{code:value.code,stopConfirmed:row.stopped})}})\n    this.audit(row,'opened');return this.ticket(row)\n  }\n  async renew(c:Context,request:any){\n    const row=this.own(c,request?.sessionId);if(row.closed)fail('DESKTOP_SESSION_CLOSED',409)\n    if(request.origin!==undefined&&safeOrigin(request.origin)!==row.origin)fail('ORIGIN_DENIED',403)\n    if(!row.context.tools.every(tool=>c.tools.includes(tool)))fail('SCOPE_DENIED',403)\n    if(row.renewing)fail('DESKTOP_RENEW_PENDING',409);row.renewing=true\n    try{this.check(c);const ack=await row.native.request({t:'renew',expiresAt:c.expiresAt});if(ack.ok!==true)fail(ack.code??'DESKTOP_RENEW_FAILED',409);this.check(c);if(row.closed)fail('DESKTOP_SESSION_CLOSED',409);row.context=structuredClone(c);this.audit(row,'renewed');return this.ticket(row)}catch(e){await this.stop(row,'DESKTOP_RENEW_FAILED');throw e}finally{row.renewing=false}\n  }\n  async closeSession(c:Context,request:any){const row=this.own(c,request?.sessionId);return this.stop(row,'SESSION_CLOSED')}\n  hasOrigin(origin:string){return [...this.sessions.values()].some(row=>!row.closed&&row.origin===origin&&row.context.expiresAt>Date.now())}\n  private send(row:Session,message:any){if(row.socket?.readyState===1)row.socket.send(JSON.stringify(message))}\n  private nextFrame(row:Session,delay=0){if(row.closed||row.frameRequested||row.pendingFrame||!row.socket||row.socket.readyState!==1)return;clearTimeout(row.frameTimer);row.frameRequested=true;row.frameTimer=setTimeout(()=>void (async()=>{if(row.closed)return;this.check(row.context);if(row.profile!==row.appliedProfile){const ack=await row.native.request({t:'video',...videoProfiles[row.profile]});if(!ack.ok)throw new AgentError(ack.code??'DESKTOP_VIDEO_FAILED');row.appliedProfile=row.profile}if(!row.closed)row.native.frame(this.forceKeyframes.delete(row))})().catch(()=>this.stop(row,'DESKTOP_VIDEO_FAILED')),delay);row.frameTimer.unref()}\n  private framePing(row:Session,baseline=false,sequence=row.frameSequence){\n    if(row.closed||row.socket?.readyState!==1)return\n    const tag=baseline?'baseline':`frame:${sequence}`\n    if(baseline){row.pingTag=tag;row.pingStarted=performance.now()}\n    clearTimeout(row.ackTimer);row.ackTimer=setTimeout(()=>void this.stop(row,'DESKTOP_FRAME_ACK_TIMEOUT'),15000);row.ackTimer.unref()\n    row.socket.ping(tag,undefined,error=>{if(error)void this.stop(row,'DESKTOP_DISCONNECTED')})\n  }\n  private frame(row:Session,jpeg:Buffer,metadata?:any){\n    if(row.closed||!row.socket||row.socket.readyState!==1)return\n    try{this.check(row.context)}catch{void this.stop(row,'GRANT_REVOKED');return}\n    const socket=row.socket\n    if(!Buffer.isBuffer(jpeg)||jpeg.length>8388608){void this.stop(row,'CAPTURE_LIMIT');return}\n    const flights=this.flights.get(row)??new Map();this.flights.set(row,flights)\n    // Two small patches can cover a link RTT while a full image stays one-at-a-time.\n    // The pong is beyond that JPEG on the wire; write callbacks alone are not receipt proof.\n    const small=metadata?.region&&metadata.region.width*metadata.region.height<=row.native.metadata.width*row.native.metadata.height*.15&&jpeg.length<=65536\n    if(flights.size>=(small?2:1)){if(row.pendingFrame){this.audit(row,'frame-drop');this.forceKeyframes.add(row)}row.pendingFrame={jpeg,metadata};return}\n    if(socket.bufferedAmount>(this.options.maxBufferedAmount??524288)){this.audit(row,'frame-drop');this.forceKeyframes.add(row);this.nextFrame(row,100);return}\n    row.sending=true;row.pingStarted=performance.now();row.frameSequence++\n    flights.set(`frame:${row.frameSequence}`,{started:row.pingStarted,keyframe:metadata?.keyframe===true})\n    this.send(row,{type:'frame',width:row.native.metadata.width,height:row.native.metadata.height,frameWidth:metadata?.frameWidth??row.native.metadata.width,frameHeight:metadata?.frameHeight??row.native.metadata.height,...(metadata?.region?{region:metadata.region,keyframe:metadata.keyframe===true}:{}),quality:metadata?.quality??70,scalePercent:metadata?.scalePercent??100,sequence:row.frameSequence,captureMs:metadata?.captureMs,encodeMs:metadata?.encodeMs})\n    const sequence=row.frameSequence\n    socket.send(jpeg,{binary:true},error=>{if(error)void this.stop(row,'DESKTOP_DISCONNECTED');else{this.framePing(row,false,sequence);this.nextFrame(row)}})\n  }\n  private enqueue(row:Session,work:()=>Promise<void>){\n    if(row.queued>=64){this.send(row,{type:'error',code:'DESKTOP_INPUT_LIMIT'});return}row.queued++\n    row.queue=row.queue.then(async()=>{if(row.closed)return;try{this.check(row.context);await work()}catch(e:any){this.send(row,{type:'error',code:e?.code??'DESKTOP_SESSION_FAILED'});await this.stop(row,e?.code??'DESKTOP_SESSION_FAILED')}}).finally(()=>row.queued--)\n  }\n  private input(event:any,row:Session){\n    if(!event||typeof event!=='object'||Array.isArray(event))fail('INVALID_ARGUMENT')\n    if(event.type==='pointer'){\n      if(!['move','down','up'].includes(event.action)||!['left','middle','right'].includes(event.button??'left'))fail('INVALID_ARGUMENT')\n      return {kind:'pointer',action:event.action,button:event.button??'left',x:integer(event.x,0,row.native.metadata.width-1),y:integer(event.y,0,row.native.metadata.height-1)}\n    }\n    if(event.type==='key'){if(!['down','up'].includes(event.action)||typeof event.code!=='string'||!event.code||event.code.length>64||typeof event.key!=='string'||event.key.length>64)fail('INVALID_ARGUMENT');return {kind:'key',action:event.action,code:event.code,key:event.key}}\n    if(event.type==='wheel')return {kind:'wheel',deltaX:integer(event.deltaX,-4800,4800),deltaY:integer(event.deltaY,-4800,4800)}\n    if(event.type==='text'){if(typeof event.text!=='string'||event.text.length>8192||/[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f]/.test(event.text))fail('INPUT_LIMIT');return {kind:'text',text:event.text}}\n    fail('INVALID_ARGUMENT')\n  }\n  /** Called only after the HTTP server validates Host/network/TLS on upgrade. */\n  accept(socket:WebSocket,origin?:string,allowedOrigins:string[]=[]){\n    this.sockets.add(socket);let row:Session|undefined,authenticating=false,alive=true\n    const authTimer=setTimeout(()=>socket.close(1008,'Desktop authentication required'),this.options.authTimeoutMs??5000);authTimer.unref()\n    const heartbeat=setInterval(()=>{if(!alive){socket.terminate();return}alive=false;socket.ping()},15000);heartbeat.unref();socket.on('pong',data=>{\n      alive=true;if(!row)return\n      const tag=data.toString(),baseline=tag==='baseline'&&row.pingTag==='baseline'\n      const flights=this.flights.get(row),flight=flights?.get(tag)\n      if(!baseline&&!flight)return\n      clearTimeout(row.ackTimer);const elapsed=performance.now()-(baseline?row.pingStarted:flight!.started)\n      if(baseline){row.pingTag=undefined;row.baselineRtt=elapsed;this.nextFrame(row);return}\n      flights!.delete(tag)\n      row.sending=false;const target=1000/row.fps,transfer=Math.max(1,elapsed-row.baselineRtt)\n      if(!flight!.keyframe&&transfer>target*1.35&&row.profile<videoProfiles.length-1){row.profile=Math.min(videoProfiles.length-1,row.profile+(transfer>target*4?2:1));row.fastFrames=0}\n      else if(transfer<target*.55&&row.profile>0&&++row.fastFrames>=20){row.profile--;row.fastFrames=0}\n      else if(transfer>=target*.55)row.fastFrames=0\n      if(row.pendingFrame){const pending=row.pendingFrame;row.pendingFrame=undefined;this.frame(row,pending.jpeg,pending.metadata)}else this.nextFrame(row)\n    })\n    const reject=(code:string)=>{if(socket.readyState===1)socket.send(JSON.stringify({type:'error',code}));socket.close(1008,code)}\n    socket.on('message',(data,isBinary)=>{\n      let message:any;try{if(isBinary||data.length>65536)fail('INVALID_ARGUMENT');message=JSON.parse(data.toString());if(!message||typeof message!=='object'||Array.isArray(message))fail('INVALID_ARGUMENT')}catch{reject('INVALID_ARGUMENT');return}\n      if(!row){\n        if(authenticating){reject('AUTH_INVALID');return}\n        try{\n          const candidate=this.sessions.get(message.sessionId)\n          if(message.type!=='auth'||typeof message.token!=='string'||!/^[A-Za-z0-9_-]{43}$/.test(message.token)||!candidate||!matches(message.token,candidate.digest))fail('AUTH_INVALID',401)\n          if(candidate.closed||candidate.used)fail('DESKTOP_SESSION_CLOSED',409)\n          this.check(candidate.context)\n          if(origin!==undefined&&(candidate.origin?origin!==candidate.origin:!allowedOrigins.includes(origin)))fail('ORIGIN_DENIED',403)\n          if(candidate.origin&&origin===undefined){/* Trusted Node clients may omit Origin. */}\n          row=candidate;row.used=true;row.socket=socket;authenticating=true;clearTimeout(authTimer)\n          this.enqueue(row,async()=>{\n            if(row!.requestedControl){const ack=await row!.native.request({t:'control',action:'acquire'});if(!ack.ok)fail(ack.code??'CONTROL_NOT_GRANTED',409);row!.mode='control'}\n            const {t,ok,sessionId:physicalSessionId,...metadata}=row!.native.metadata\n            this.send(row!,{...metadata,type:'ready',sessionId:row!.id,nativeSessionId:physicalSessionId,mode:row!.mode,expiresAt:row!.context.expiresAt,controlAllowed:row!.controlAllowed});this.audit(row!,'authenticated');this.framePing(row!,true)\n          })\n        }catch(e:any){reject(e.code??'AUTH_INVALID')}\n        return\n      }\n      const current=row\n      if(message.type==='close'){void this.stop(current,'SESSION_CLOSED');return}\n      this.enqueue(current,async()=>{\n        if(message.type==='control'){\n          if(!['acquire','release'].includes(message.action))fail('INVALID_ARGUMENT')\n          if(message.action==='acquire'&&!current.controlAllowed){this.send(current,{type:'control',mode:'watch',ok:false,code:'SCOPE_DENIED',...(message.id!==undefined?{id:message.id}:{})});return}\n          let ack:Ack\n          try{ack=await current.native.request({t:'control',action:message.action})}catch(e:any){this.send(current,{type:'control',mode:'watch',ok:false,code:e.code??'OUTCOME_UNKNOWN',possiblyApplied:true,...(message.id!==undefined?{id:message.id}:{})});await this.stop(current,'OUTCOME_UNKNOWN');return}\n          if(ack.ok!==true){this.send(current,{type:'control',mode:current.mode,ok:false,code:ack.code??'CONTROL_NOT_GRANTED',...(message.id!==undefined?{id:message.id}:{})});if(message.action==='release')await this.stop(current,'INPUT_RELEASE_UNCONFIRMED');return}\n          current.mode=ack.mode==='control'?'control':'watch';this.send(current,{type:'control',mode:current.mode,ok:true,...(message.id!==undefined?{id:message.id}:{})});this.audit(current,'control',{mode:current.mode})\n        }else if(message.type==='input'){\n          let event:any\n          try{integer(message.id,1,Number.MAX_SAFE_INTEGER);if(message.id<=current.lastInputId)fail('DESKTOP_INPUT_REPLAY',409);current.lastInputId=message.id;if(current.mode!=='control')fail('CONTROL_NOT_GRANTED',403);event=this.input(message.event,current)}catch(e:any){this.send(current,{type:'input',id:message.id,ok:false,code:e.code??'INVALID_ARGUMENT',possiblyApplied:false});return}\n          let ack:Ack;try{ack=await current.native.request({t:'input',...event})}catch(e:any){this.send(current,{type:'input',id:message.id,ok:false,code:e.code??'OUTCOME_UNKNOWN',possiblyApplied:true});await this.stop(current,'OUTCOME_UNKNOWN');return}\n          this.send(current,{type:'input',id:message.id,ok:ack.ok===true,...(ack.ok?{}:{code:ack.code??'INPUT_REJECTED',possiblyApplied:ack.possiblyApplied===true})});this.audit(current,'input',{id:message.id,event:event.kind,ok:ack.ok===true})\n        }else if(message.type==='release-input'){\n          let ack:Ack\n          try{ack=await current.native.request({t:'release-input'})}catch(e:any){this.send(current,{type:'release-input',...(message.id!==undefined?{id:message.id}:{}),ok:false,code:e.code??'OUTCOME_UNKNOWN',possiblyApplied:true});await this.stop(current,'OUTCOME_UNKNOWN');return}\n          this.send(current,{type:'release-input',...(message.id!==undefined?{id:message.id}:{}),ok:ack.ok===true,...(ack.ok?{}:{code:ack.code??'INPUT_RELEASE_UNCONFIRMED',possiblyApplied:true})});this.audit(current,'release-input');if(!ack.ok)await this.stop(current,'INPUT_RELEASE_UNCONFIRMED')\n        }else fail('INVALID_ARGUMENT')\n      })\n    })\n    socket.on('error',()=>{if(row)void this.stop(row,'DESKTOP_DISCONNECTED')})\n    socket.once('close',()=>{clearTimeout(authTimer);clearInterval(heartbeat);this.sockets.delete(socket);if(row)void this.stop(row,'DESKTOP_DISCONNECTED')})\n  }\n  private stop(row:Session,reason:string):Promise<{stopConfirmed:boolean}>{\n    this.forceKeyframes.delete(row)\n    if(row.stop)return row.stop\n    row.closed=true;row.closedAt=Date.now();clearTimeout(row.frameTimer);clearTimeout(row.ackTimer);row.pendingFrame=undefined\n    row.stop=(async()=>{const result=await row.native.close().catch(()=>({stopConfirmed:false}));row.stopped=result.stopConfirmed===true;row.mode='watch';this.send(row,{type:'status',status:'disconnected',mode:'watch',code:reason,stopConfirmed:row.stopped});row.socket?.close(1000,'Desktop session closed');this.audit(row,'closed',{reason,stopConfirmed:row.stopped});return {stopConfirmed:row.stopped}})()\n    return row.stop\n  }\n  async sweep(){\n    const pending:Promise<any>[]=[]\n    for(const [id,row] of this.sessions){\n      if(row.closed){if(row.closedAt!+30000<Date.now())this.sessions.delete(id);continue}\n      if(row.renewing)continue\n      try{this.check(row.context)}catch{pending.push(this.stop(row,'GRANT_REVOKED'))}\n    }\n    await Promise.all(pending)\n  }\n  sessionAudit(c:Context,id:string){return structuredClone(this.own(c,id).events)}\n  async close(){this.closing=true;clearInterval(this.timer);const result=await Promise.all([...this.sessions.values()].map(row=>this.stop(row,'DESKTOP_HOST_STOPPED')));for(const socket of this.sockets)socket.terminate();this.sockets.clear();return {stopConfirmed:result.every(r=>r.stopConfirmed)}}\n}\n", "import {execFile,spawn} from 'node:child_process'\nimport {promisify} from 'node:util'\nimport {mkdir,open,readFile,lstat} from 'node:fs/promises'\nimport {isAbsolute,join} from 'node:path'\nimport {randomUUID} from 'node:crypto'\nimport {AgentError,canonical,fail,sha,type Context} from './protocol.js'\nimport type {Store} from './store.js'\nimport {CONTAINER_SUPERVISOR_SOURCE as supervisorSource} from './container-supervisor.mjs'\nconst control=promisify(execFile)\nexport const CONTAINER_IMAGE='node@sha256:4f77a690f2f8946ab16fe1e791a3ac0667ae1c3575c3e4d0d4589e9ed5bfaf3d'\nexport type ContainerCommandConfig={dockerExecutable:string;image:string;executables:Record<string,string>;shell?:boolean}\nconst object=(x:any)=>x!==null&&typeof x==='object'&&!Array.isArray(x)\nconst terminal=new Set(['succeeded','failed','cancelled'])\nconst env=(directory:string)=>({PATH:'/usr/sbin:/usr/bin:/sbin:/bin',LANG:'C.UTF-8',HOME:'/nonexistent',DOCKER_CONFIG:directory})\nexport function validateContainerCommandConfig(value:ContainerCommandConfig){\n if(process.platform!=='linux')fail('CONTAINER_PLATFORM_UNAVAILABLE',503)\n if(!object(value)||Object.keys(value).some(k=>!['dockerExecutable','image','executables','shell'].includes(k))||typeof value.dockerExecutable!=='string'||!isAbsolute(value.dockerExecutable)||value.dockerExecutable.includes('\\0')||value.image!==CONTAINER_IMAGE||!object(value.executables)||!Object.keys(value.executables).length||Object.entries(value.executables).some(([name,path])=>!/^[-a-z0-9]{1,32}$/.test(name)||typeof path!=='string'||!/^\\/(?:usr\\/local\\/bin|usr\\/bin|bin)\\/[-a-zA-Z0-9_.]+$/.test(path))||value.shell!==undefined&&typeof value.shell!=='boolean')fail('CONTAINER_CONFIG_INVALID')\n return value\n}\nexport function containerArguments({name,nonce,machineId,workspace,workspaceIdentity,config,executable,argv,deadlineAt=Date.now()+60000,supervisorFile='/fixture-supervisor.mjs'}:{name:string;nonce:string;machineId:string;workspace:string;workspaceIdentity:string;config:ContainerCommandConfig;executable:string;argv:string[];deadlineAt?:number;supervisorFile?:string}){\n // Arguments after the immutable image are container argv, never Docker options.\n if(!/^dsh-worker-[a-f0-9]{40}$/.test(name)||!/^[-a-f0-9]{36}$/.test(nonce)||![workspace,supervisorFile].every(p=>typeof p==='string'&&isAbsolute(p)&&!/[\\0,\\r\\n]/.test(p))||typeof workspaceIdentity!=='string'||workspaceIdentity.length>256||!Number.isSafeInteger(deadlineAt)||deadlineAt<=0||argv.some(x=>typeof x!=='string'||x.includes('\\0')))fail('CONTAINER_ARGUMENT_INVALID')\n let identity:any;try{identity=JSON.parse(workspaceIdentity)}catch{fail('CONTAINER_ARGUMENT_INVALID')}\n if(!object(identity)||Object.keys(identity).sort().join(',')!=='birth,dev,ino'||!['dev','ino','birth'].every(k=>typeof identity[k]==='string'&&/^(0|[1-9][0-9]{0,39})$/.test(identity[k]))||identity.ino==='0'||identity.birth==='0')fail('CONTAINER_ARGUMENT_INVALID')\n return ['container','create','--pull=never','--platform','linux/amd64','--name',name,'--label',`dsh.worker.nonce=${nonce}`,'--label',`dsh.worker.machine=${machineId}`,'--network=none','--read-only','--cap-drop=ALL','--cap-add=SETUID','--cap-add=SETGID','--security-opt=no-new-privileges','--user','0:0','--pids-limit=64','--memory=128m','--cpus=0.5','--log-driver=json-file','--log-opt=max-size=8m','--log-opt=max-file=1','--tmpfs','/tmp:rw,noexec,nosuid,size=16m','--mount',`type=bind,src=${workspace},dst=/workspace`,'--mount',`type=bind,src=${supervisorFile},dst=/opt/dsh-supervisor.mjs,readonly`,'--workdir','/workspace','--entrypoint','/usr/local/bin/node',config.image,'/opt/dsh-supervisor.mjs',String(deadlineAt),workspaceIdentity,executable,...argv]\n}\n\n/** Durable original-container controller; status observation never creates work. */\nexport class ContainerCommands {\n private dockerEnv:Record<string,string>;private sessions=new Map<string,{cancel:(why:string)=>Promise<void>}>();private controls=new Map<string,Promise<any>>();private sweeping=false;private closing=false;private sweepCursor=''\n constructor(private store:Store,private config:ContainerCommandConfig){\n  validateContainerCommandConfig(config);this.dockerEnv=env(join(store.dataDir,'docker-client'))\n  store.db.exec(`CREATE TABLE IF NOT EXISTS container_workers(operation_id TEXT PRIMARY KEY,name TEXT NOT NULL UNIQUE,nonce TEXT NOT NULL,context TEXT NOT NULL,root_id TEXT NOT NULL,workspace TEXT NOT NULL,input_digest TEXT NOT NULL,phase TEXT NOT NULL,cid TEXT,reason TEXT)`)\n  if(!store.db.prepare('PRAGMA table_info(container_workers)').all().some((row:any)=>row.name==='workspace_identity'))store.db.exec('ALTER TABLE container_workers ADD COLUMN workspace_identity TEXT')\n }\n private serialized(id:string,fn:()=>Promise<any>){const pending=(this.controls.get(id)??Promise.resolve()).catch(()=>{}).then(fn);this.controls.set(id,pending);return pending.finally(()=>{if(this.controls.get(id)===pending)this.controls.delete(id)})}\n private async supervisor(){\n  const path=join(this.store.dataDir,'container-supervisor-'+sha(supervisorSource)+'.mjs')\n  try{const fd=await open(path,'wx',0o444);try{await fd.writeFile(supervisorSource);await fd.sync()}finally{await fd.close()}}catch(e:any){if(e.code!=='EEXIST')throw e}\n  const info=await lstat(path);if(!info.isFile()||info.isSymbolicLink()||info.nlink!==1||sha(await readFile(path))!==sha(supervisorSource))fail('CONTAINER_SUPERVISOR_CHANGED',503)\n  return path\n }\n private async cli(args:string[],timeout=15000){\n  await mkdir(this.dockerEnv.DOCKER_CONFIG,{recursive:true,mode:0o700})\n  try{return (await control(this.config.dockerExecutable,args,{env:this.dockerEnv,encoding:'utf8',timeout,maxBuffer:10*1024*1024,windowsHide:true})).stdout.trim()}catch{fail('CONTAINER_CONTROL_UNAVAILABLE',503)}\n }\n private row(id:string,c:Context){const row=this.store.db.prepare('SELECT * FROM container_workers WHERE operation_id=?').get(id);if(!row)return null;this.store.own(row.context,c);if(!c.roots.includes(row.root_id))fail('SCOPE_DENIED',403);return row}\n private async inspect(row:any){\n  const ids=(await this.cli(['container','ls','-a','--no-trunc','--filter',`name=^/${row.name}$`,'--format','{{.ID}}'])).split('\\n').filter(Boolean)\n  if(!ids.length)return null\n  if(ids.length!==1||!/^[a-f0-9]{64}$/.test(ids[0])||row.cid&&row.cid!==ids[0])fail('CONTAINER_IDENTITY_MISMATCH',503)\n  let value:any;try{value=JSON.parse(await this.cli(['container','inspect',ids[0]]))[0]}catch{fail('CONTAINER_CONTROL_UNAVAILABLE',503)}\n  if(value?.Id!==ids[0]||value.Name!=='/'+row.name||value.Config?.Labels?.['dsh.worker.nonce']!==row.nonce||value.Config?.Labels?.['dsh.worker.machine']!==this.store.machineId)fail('CONTAINER_IDENTITY_MISMATCH',503)\n  const host=value.HostConfig,binds=(value.Mounts??[]).filter((m:any)=>m.Type==='bind')\n  const workspace=binds.find((m:any)=>m.Destination==='/workspace'),supervisor=binds.find((m:any)=>m.Destination==='/opt/dsh-supervisor.mjs')\n  const caps=host?.CapAdd?.map((name:string)=>name.replace(/^CAP_/,''))\n  if(typeof row.workspace_identity!=='string'||value.Config?.Cmd?.[0]!=='/opt/dsh-supervisor.mjs'||value.Config.Cmd[2]!==row.workspace_identity||value.Config?.Entrypoint?.length!==1||value.Config.Entrypoint[0]!=='/usr/local/bin/node')fail('CONTAINER_POLICY_MISMATCH',503)\n  if(value.Config?.Image!==this.config.image||value.Config?.User!=='0:0'||host?.NetworkMode!=='none'||host?.ReadonlyRootfs!==true||host?.Privileged!==false||!host.CapDrop?.includes('ALL')||caps?.length!==2||!caps.includes('SETUID')||!caps.includes('SETGID')||!host.SecurityOpt?.includes('no-new-privileges')||binds.length!==2||workspace?.Source!==row.workspace||supervisor?.Source!==await this.supervisor()||supervisor?.RW!==false)fail('CONTAINER_POLICY_MISMATCH',503)\n  return value\n }\n async probe(){\n  try{const info=JSON.parse(await this.cli(['image','inspect',this.config.image]))[0];if(info?.Architecture!=='amd64'||!info.RepoDigests?.includes(this.config.image))fail('CONTAINER_IMAGE_MISMATCH');return {mode:'container',status:'dependency-ready',image:this.config.image,network:'none',filesystem:'workspace-only',user:'65532:65532',measurement:'requires-operation-check'}}catch{return {mode:'container',status:'unavailable',code:'CONTAINER_DEPENDENCY_UNAVAILABLE'}}\n }\n private unknown(id:string,code='OUTCOME_UNKNOWN'){\n  this.store.finish(id,'unknown',{kind:'container-command',stopConfirmed:false,possiblyApplied:true},code)\n }\n private async logs(id:string){\n  const child=spawn(this.config.dockerExecutable,['container','logs',id],{env:this.dockerEnv,stdio:['ignore','pipe','pipe'],windowsHide:true})\n  const stdout:Buffer[]=[],stderr:Buffer[]=[];let bytes=0,failed=false\n  const take=(list:Buffer[])=>(chunk:Buffer)=>{const n=Math.min(chunk.length,Math.max(0,8*1024*1024-bytes));if(n)list.push(chunk.subarray(0,n));bytes+=n}\n  child.stdout.on('data',take(stdout));child.stderr.on('data',take(stderr));const timer=setTimeout(()=>{failed=true;child.kill('SIGKILL')},15000)\n  try{const code=await new Promise<number|null>((resolve,reject)=>{child.once('error',reject);child.once('close',resolve)});if(failed||code!==0)fail('CONTAINER_OUTPUT_UNAVAILABLE',503);return {stdout:Buffer.concat(stdout),stderr:Buffer.concat(stderr)}}finally{clearTimeout(timer)}\n }\n private async settle(id:string,c:Context,observed:any,artifact:(data:Buffer,c:Context)=>Promise<any>,reason:string|null){\n  if(!observed||!['exited','dead'].includes(observed.State?.Status)||observed.State?.Running!==false){this.unknown(id);return}\n  // Bounded tail logs survive a controller crash; rotation can omit old output.\n  let logs:any\n  try{logs=await this.logs(observed.Id)}catch{this.unknown(id,'CONTAINER_OUTPUT_UNAVAILABLE');return}\n  const out=await artifact(logs.stdout,c),err=await artifact(logs.stderr,c),exitCode=observed.State.ExitCode\n  const state=reason==='CANCELLED'||reason==='GRANT_REVOKED'?'cancelled':reason?'failed':exitCode===0?'succeeded':'failed'\n  const result={kind:'container-command',containerId:observed.Id,exitCode,stdoutArtifactId:out.artifactId,stderrArtifactId:err.artifactId,truncated:true,outputPolicy:'bounded-tail',stopConfirmed:true,possiblyApplied:true,isolation:{mode:'container',image:this.config.image,network:'none',user:'65532:65532'}}\n  this.store.db.transaction(()=>{this.store.finish(id,state,result,reason??(state==='failed'?'PROCESS_EXIT_NONZERO':null));this.store.db.prepare(\"UPDATE container_workers SET phase='settled',reason=? WHERE operation_id=?\").run(reason,id)})()\n  await this.cleanup(id,c).catch(()=>{})\n }\n async cleanup(id:string,c:Context){\n  const row=this.row(id,c);if(!row||row.phase!=='settled'||!terminal.has(this.store.status(id,c).status))return\n  const value=await this.inspect(row);if(!value){this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id);return}\n  if(value.State?.Running!==false)fail('CONTAINER_STOP_UNCONFIRMED',503)\n  await this.cli(['container','rm',value.Id]);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)\n }\n async observe(id:string,c:Context,artifact:(data:Buffer,c:Context)=>Promise<any>){return this.serialized(id,()=>this.observeOriginal(id,c,artifact))}\n private async observeOriginal(id:string,c:Context,artifact:(data:Buffer,c:Context)=>Promise<any>){\n  const row=this.row(id,c);if(!row)return false\n  if(terminal.has(this.store.status(id,c).status)){await this.cleanup(id,c).catch(()=>{});return true}\n  if(this.sessions.has(id))return true\n  try{\n   const value=await this.inspect(row)\n   if(['prepared','created'].includes(row.phase)){\n    if(value?.State?.Running||value&&value.State?.Status!=='created'){this.unknown(id);return true}\n    // The persisted start intent is absent, and this exact old controller died.\n    // Remove the never-started owned object before publishing no-effects proof.\n    if(value)await this.cli(['container','rm',value.Id])\n    this.store.db.transaction(()=>{this.store.finish(id,'cancelled',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},'HOST_INTERRUPTED_BEFORE_START');this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})()\n   }else if(value)await this.settle(id,c,value,artifact,row.reason)\n   else this.unknown(id)\n  }catch{this.unknown(id)}\n  return true\n }\n async cancel(id:string,c:Context,why='CANCELLED'){\n  const running=this.sessions.get(id);if(running){await running.cancel(why);return true}\n  return this.serialized(id,()=>this.cancelOriginal(id,c,why))\n }\n private async cancelOriginal(id:string,c:Context,why:string){\n  const row=this.row(id,c);if(!row||terminal.has(this.store.status(id,c).status))return !!row\n  const value=await this.inspect(row)\n  if(value?.State?.Running){this.store.db.prepare('UPDATE container_workers SET reason=? WHERE operation_id=?').run(why,id);await this.cli(['container','kill','--signal=KILL',value.Id],5000)}\n  else if(value?.State?.Status==='created'){\n   await this.cli(['container','rm',value.Id])\n   this.store.db.transaction(()=>{this.store.finish(id,'cancelled',{kind:'container-command',stopConfirmed:true,possiblyApplied:row.phase==='starting',notStarted:row.phase!=='starting'},why);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})()\n  }\n  return true\n }\n async sweep(artifact:(data:Buffer,c:Context)=>Promise<any>){\n  if(this.sweeping||this.closing)return;this.sweeping=true\n  try{const rows=this.store.db.prepare(\"SELECT operation_id,context FROM container_workers WHERE phase!='removed' AND operation_id>? ORDER BY operation_id LIMIT 4\").all(this.sweepCursor);if(!rows.length)this.sweepCursor='';for(const row of rows){\n   if(this.closing)break;this.sweepCursor=row.operation_id\n   if(this.sessions.has(row.operation_id))continue\n   const c=JSON.parse(row.context);let valid=true;try{this.store.validate(c)}catch{valid=false}\n   if(!valid)try{await this.cancel(row.operation_id,c,'GRANT_REVOKED')}catch{}\n   if(this.closing)break;try{await this.observe(row.operation_id,c,artifact)}catch{}\n  }}finally{this.sweeping=false}\n }\n async run({id,c,rootId,workspace,workspaceIdentity,executable,argv,timeout,validate,validateWorkspace,shouldCancel,artifact}:{id:string;c:Context;rootId:string;workspace:string;workspaceIdentity:string;executable:string;argv:string[];timeout:number;validate:()=>void;validateWorkspace:()=>Promise<void>;shouldCancel:()=>boolean;artifact:(data:Buffer,c:Context)=>Promise<any>}){\n  const name='dsh-worker-'+sha(canonical({machine:this.store.machineId,id})).slice(0,40),nonce=randomUUID(),digest=sha(canonical({rootId,workspace,workspaceIdentity,executable,argv,image:this.config.image}))\n  const deadlineAt=Math.min(c.expiresAt,Date.now()+timeout),supervisorFile=await this.supervisor()\n  const args=containerArguments({name,nonce,machineId:this.store.machineId,workspace,workspaceIdentity,config:this.config,executable,argv,deadlineAt,supervisorFile})\n  this.store.db.prepare(\"INSERT INTO container_workers(operation_id,name,nonce,context,root_id,workspace,input_digest,phase,cid,reason,workspace_identity) VALUES (?,?,?,?,?,?,?,'prepared',NULL,NULL,?)\").run(id,name,nonce,canonical(c),rootId,workspace,digest,workspaceIdentity)\n  let reason:string|null=null,child:any,controlLost=false,cancelling:Promise<void>|undefined,closed=false\n  const cancel=(why:string)=>{reason??=why;this.store.db.prepare('UPDATE container_workers SET reason=? WHERE operation_id=?').run(reason,id);return cancelling??=(async()=>{try{const row=this.row(id,c),value=await this.inspect(row);if(value?.State?.Running)await this.cli(['container','kill','--signal=KILL',value.Id],5000)}catch{controlLost=true}finally{if(child&&!closed){const timer=setTimeout(()=>{if(!closed){controlLost=true;try{process.kill(-child.pid,'SIGKILL')}catch{}}},3000);timer.unref()}}})()}\n  this.sessions.set(id,{cancel});const timer=setTimeout(()=>void cancel('PROCESS_TIMEOUT'),timeout)\n  try{\n   validate();if(shouldCancel())reason='CANCELLED'\n   if(reason){this.store.finish(id,'cancelled',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},reason);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id);return}\n   const ready=await this.probe();if(ready.status!=='dependency-ready')fail('CONTAINER_DEPENDENCY_UNAVAILABLE',503)\n   await validateWorkspace();validate()\n   const cid=await this.cli(args);if(!/^[a-f0-9]{64}$/.test(cid))fail('CONTAINER_CONTROL_UNAVAILABLE',503)\n   this.store.db.prepare(\"UPDATE container_workers SET cid=?,phase='created' WHERE operation_id=?\").run(cid,id)\n   await validateWorkspace();validate();if(shouldCancel())reason??='CANCELLED'\n   if(reason){const row=this.row(id,c),value=await this.inspect(row);if(value?.State?.Status!=='created')fail('OUTCOME_UNKNOWN');await this.cli(['container','rm',cid]);this.store.db.transaction(()=>{this.store.finish(id,'cancelled',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},reason);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})();return}\n   this.store.db.prepare(\"UPDATE container_workers SET phase='starting' WHERE operation_id=?\").run(id)\n   child=spawn(this.config.dockerExecutable,['container','start','-a',cid],{env:this.dockerEnv,detached:true,stdio:['ignore','ignore','ignore'],windowsHide:true})\n   await new Promise<void>((resolve,reject)=>{child.once('error',reject);child.once('close',()=>{closed=true;resolve()})});await cancelling\n   if(controlLost){this.unknown(id);return}\n   await this.settle(id,c,await this.inspect(this.row(id,c)),artifact,reason)\n  }catch(e:any){\n   const row=this.row(id,c)\n   if(row?.phase==='starting'){this.unknown(id)}\n   else{\n    // Even a failed create request may have reached the daemon. Observe this\n    // owned name before deciding no process could have run.\n    try{const value=await this.inspect(row);if(value?.State?.Status!=='created'&&value!==null)throw Error();if(value)await this.cli(['container','rm',value.Id]);this.store.db.transaction(()=>{this.store.finish(id,reason?'cancelled':'failed',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},reason??(e instanceof AgentError?e.code:'EXECUTION_FAILED'));this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})()}catch{this.unknown(id)}\n   }\n  }finally{clearTimeout(timer);this.sessions.delete(id)}\n }\n async close(){this.closing=true;await Promise.all([...this.sessions.values()].map(s=>s.cancel('CANCELLED')));await Promise.allSettled([...this.controls.values()]);while(this.sweeping)await new Promise(r=>setTimeout(r,10))}\n}\n", "// Fixed trusted PID 1, mounted read-only. Caller argv is data for an unprivileged\n// child, never JavaScript source. A child cannot signal/ptrace this root process.\nexport async function runContainerSupervisor(){\nconst {spawn}=await import('node:child_process')\nconst {stat}=await import('node:fs/promises')\nconst [deadlineText,identityText,executable,...argv]=process.argv.slice(2),deadline=Number(deadlineText)\nif(!Number.isSafeInteger(deadline)||deadline<=Date.now()||!executable)process.exit(124)\n// Docker/runc resolves the bind source after the Agent's final path check.\n// Verify the actual mounted directory before any untrusted program can run.\nlet expected\ntry{expected=JSON.parse(identityText)}catch{process.exit(125)}\nif(!expected||Object.keys(expected).sort().join(',')!=='birth,dev,ino'||!['birth','dev','ino'].every(k=>typeof expected[k]==='string'&&/^(0|[1-9][0-9]{0,39})$/.test(expected[k]))||expected.ino==='0'||expected.birth==='0')process.exit(125)\nfor(const path of ['/workspace','.']){\n const s=await stat(path,{bigint:true})\n if(!s.isDirectory()||String(s.dev)!==expected.dev||String(s.ino)!==expected.ino||String(s.birthtimeNs)!==expected.birth)process.exit(125)\n}\nprocess.setgroups([])\nlet child\n// Exiting namespace PID1 tears down its descendants. This needs no CAP_KILL;\n// the supervisor intentionally has only SETUID/SETGID for the initial spawn.\nconst stop=code=>process.exit(code)\nconst timer=setTimeout(()=>stop(124),Math.max(1,deadline-Date.now()))\nprocess.once('SIGTERM',()=>stop(143));process.once('SIGINT',()=>stop(130))\ntry{\n child=spawn(executable,argv,{uid:65532,gid:65532,env:{PATH:'/usr/local/bin:/usr/bin:/bin',LANG:'C.UTF-8',HOME:'/tmp'},stdio:['ignore','inherit','inherit']})\n child.once('error',()=>stop(126))\n child.once('close',(code,signal)=>{clearTimeout(timer);stop(code??(signal?128:1))})\n}catch{stop(126)}\n}\n// Self-contained function text avoids an eval CLI and keeps direct source builds\n// and the normal Agent bundler on the same canonical supervisor implementation.\nexport const CONTAINER_SUPERVISOR_SOURCE=`(${runContainerSupervisor.toString()})().catch(()=>process.exit(126))\\n`\n", "import {constants,type BigIntStats} from 'node:fs'\nimport {lstat,mkdir,open,readFile,realpath,stat,unlink,writeFile,type FileHandle} from 'node:fs/promises'\nimport path from 'node:path'\nimport {canonical,fail,sha} from './protocol.js'\n\nexport type WorkspaceIdentity={key:string;ancestors:string[];path:string;platform:'linux'|'win32'}\ntype PhysicalIdentity={dev:string;ino:string;birth:string}\nfunction physical(s:BigIntStats):PhysicalIdentity{\n if(!s.isDirectory()||s.ino<=0n||s.dev<0n||s.birthtimeNs<=0n)fail('WORKSPACE_IDENTITY_UNAVAILABLE',503)\n return {dev:String(s.dev),ino:String(s.ino),birth:String(s.birthtimeNs)}\n}\nconst key=(s:BigIntStats)=>sha(canonical(physical(s)))\n\n/**\n * Cross-dataDir physical-root exclusion (Linux).\n *\n * The per-dataDir journal cannot see a second Agent instance on the same host\n * with its own database. The held directory inode therefore also owns an\n * exclusive claim file under a stable system path keyed by dev:ino, so two\n * processes pinning the same physical root (aliases included \u2014 the inode is\n * the identity) cannot both hold it. The claim carries the owner PID; a\n * verifiably dead owner's claim is reclaimed with the same\n * fstat-vs-lstat identity discipline as the controller lock. Nested captures\n * inside one process share the outer claim, which is what lets the container\n * shell re-pin a cwd that withWorkspace already pinned. An unavailable lock\n * directory (for example a different service user owns it) degrades to the\n * previous single-database semantics with an audit-visible marker instead of\n * breaking a previously working workspace.\n */\nconst ROOT_LOCK_DIRECTORY='/tmp/dsh-agent-root-locks'\ntype RootLock={count:number;path:string;handle:FileHandle}\nconst rootLocks=new Map<string,RootLock|Promise<RootLock>>()\nexport const rootLockDegrades:{lastUnavailableAt:number|null}={lastUnavailableAt:null}\nconst alive=(pid:number)=>{try{process.kill(pid,0);return true}catch(e:any){return e?.code==='EPERM'}}\n\nasync function createRootClaim(lockPath:string):Promise<RootLock>{\n  await mkdir(ROOT_LOCK_DIRECTORY,{recursive:true,mode:0o700}).catch(()=>{})\n  for(let attempt=0;attempt<2;attempt++){\n    let handle:FileHandle|undefined\n    try{\n      handle=await open(lockPath,'wx',0o600)\n      await writeFile(handle,JSON.stringify({pid:process.pid}))\n      return {count:1,path:lockPath,handle}\n    }catch(e:any){\n      await handle?.close().catch(()=>{})\n      const code=(e as {code?:string})?.code\n      if(code==='EACCES'||code==='EPERM'){rootLockDegrades.lastUnavailableAt=Date.now();return {count:1,path:'',handle:undefined as unknown as FileHandle}}\n      if(code!=='EEXIST')throw e\n    }\n    // Another process holds the claim. Steal it only when its owner is\n    // verifiably dead and the file on the name is still the one we read.\n    let stolen=false\n    try{\n      const held=await open(lockPath,'r'),self=await held.stat(),named=await lstat(lockPath)\n      try{\n        const owner=JSON.parse(await readFile(held,{encoding:'utf8'}))\n        if(!alive(Number(owner?.pid))&&named.dev===self.dev&&named.ino===self.ino&&!named.isSymbolicLink()){\n          await unlink(lockPath).catch(()=>{});stolen=true\n        }\n      }finally{await held.close()}\n    }catch{}\n    if(!stolen)fail('WORKSPACE_BUSY',409)\n  }\n  fail('WORKSPACE_BUSY',409)\n}\n\nasync function acquireRootLock(stat:{dev:bigint;ino:bigint}):Promise<RootLock>{\n  const lockKey=`${stat.dev}:${stat.ino}`\n  const existing=rootLocks.get(lockKey)\n  if(existing){const lock=await existing;lock.count++;return lock}\n  const pending=createRootClaim(`${ROOT_LOCK_DIRECTORY}/${lockKey}`).then(lock=>{rootLocks.set(lockKey,lock);return lock})\n  rootLocks.set(lockKey,pending)\n  try{return await pending}catch(e){rootLocks.delete(lockKey);throw e}\n}\n\nasync function releaseRootLock(lockKey:string,lock:RootLock):Promise<void>{\n  if(--lock.count>0)return\n  if(rootLocks.get(lockKey)===lock)rootLocks.delete(lockKey)\n  if(!lock.handle)return\n  try{\n    const self=await lock.handle.stat(),named=await lstat(lock.path)\n    if(named.dev===self.dev&&named.ino===self.ino&&!named.isSymbolicLink())await unlink(lock.path).catch(()=>{})\n  }catch{}\n  await lock.handle.close().catch(()=>{})\n}\nasync function snapshot(target:string):Promise<{identity:WorkspaceIdentity;physical:PhysicalIdentity}>{\n if(!['linux','win32'].includes(process.platform)||typeof target!=='string'||!path.isAbsolute(target)||target.length>4096||target.includes('\\0'))fail('WORKSPACE_IDENTITY_UNAVAILABLE',503)\n const actual=await realpath(target),first=await stat(actual,{bigint:true}),ancestors:string[]=[]\n let current=actual\n for(let depth=0;;depth++){\n  if(depth>=128)fail('WORKSPACE_IDENTITY_UNAVAILABLE',503)\n  ancestors.push(key(depth===0?first:await stat(current,{bigint:true})))\n  const parent=path.dirname(current);if(parent===current)break;current=parent\n }\n if(key(await stat(actual,{bigint:true}))!==ancestors[0]||await realpath(target)!==actual)fail('WORKSPACE_CHANGED',409)\n return {identity:{key:ancestors[0],ancestors:[...new Set(ancestors)],path:actual,platform:process.platform as 'linux'|'win32'},physical:physical(first)}\n}\n\n/** Trusted filesystem observation, never a model-supplied identity or a lease. */\nexport class WorkspacePin{\n private closed=false\n private constructor(public readonly identity:WorkspaceIdentity,public readonly mountIdentity:string,private handle?:FileHandle,private rootLock?:{key:string;lock:RootLock}){}\n static async capture(target:string){\n  const value=await snapshot(target);let handle:FileHandle|undefined,rootLock:{key:string;lock:RootLock}|undefined\n  try{\n   if(process.platform==='linux'){\n    handle=await open(value.identity.path,constants.O_RDONLY|constants.O_DIRECTORY|constants.O_NOFOLLOW)\n    const held=await handle.stat({bigint:true})\n    if(key(held)!==value.identity.key)fail('WORKSPACE_CHANGED',409)\n    // One physical inode, one cross-process claim, nested captures refcounted.\n    const stat={dev:held.dev,ino:held.ino}\n    rootLock={key:`${stat.dev}:${stat.ino}`,lock:await acquireRootLock(stat)}\n   }\n   const pin=new WorkspacePin(Object.freeze({...value.identity,ancestors:Object.freeze(value.identity.ancestors)}) as WorkspaceIdentity,canonical(value.physical),handle,rootLock)\n   await pin.verify();return pin\n  }catch(e){await handle?.close();if(rootLock)await releaseRootLock(rootLock.key,rootLock.lock).catch(()=>{});throw e}\n }\n get scanPath(){if(this.closed)fail('WORKSPACE_PIN_CLOSED');return this.handle?`/proc/${process.pid}/fd/${this.handle.fd}/.`:this.identity.path}\n async verify(){\n  if(this.closed)fail('WORKSPACE_PIN_CLOSED')\n  const current=await snapshot(this.identity.path)\n  if(canonical(current.identity)!==canonical(this.identity)||current.physical&&canonical(current.physical)!==this.mountIdentity)fail('WORKSPACE_CHANGED',409)\n  if(this.handle&&(key(await this.handle.stat({bigint:true}))!==this.identity.key||await realpath(`/proc/${process.pid}/fd/${this.handle.fd}`)!==this.identity.path))fail('WORKSPACE_CHANGED',409)\n }\n async close(){if(this.closed)return;this.closed=true;if(this.rootLock)await releaseRootLock(this.rootLock.key,this.rootLock.lock).catch(()=>{});await this.handle?.close()}\n}\n", "import { isAbsolute } from 'node:path'\nimport { AgentError, canonical, fail, identifier, type Context } from './protocol.js'\nimport type { Store } from './store.js'\nimport type { WorkspaceIdentity } from './workspace-identity.js'\n\nexport type { WorkspaceIdentity }\nexport type WorkspacePlatform = WorkspaceIdentity['platform']\nexport type WorkspaceAdmission = {\n  operationId: string\n  tool: string\n  rootKey: string\n  path: string\n  platform: WorkspacePlatform\n  ancestors: string[]\n  clientId: string\n  botId: string\n  taskId: string\n  attemptId: string\n  acquiredAt: number\n}\nexport type WorkspaceRelease = {\n  operationId: string\n  status: string | null\n  released: boolean\n  reason: string | null\n}\n\nconst IDENTITY_KEYS = ['key', 'ancestors', 'path', 'platform']\nconst HEX64 = /^[a-f0-9]{64}$/\nconst MAX_ANCESTORS = 128\nconst MAX_PATH = 4096\nconst PLATFORMS = new Set<string>(['linux', 'win32'])\n/** Tools whose original operation mutates one physical root and therefore needs exclusion. */\nexport const ROOT_WRITING_TOOLS: readonly string[] = ['fs_write', 'shell_exec', 'container_command_v1']\n/** Tools whose stop evidence is only proven by a supervisor receipt. */\nconst STOP_EVIDENCE_TOOLS = new Set<string>(['shell_exec'])\n/** Upper bound on simultaneously active admissions; nothing is ever evicted to stay under it. */\nconst MAX_ACTIVE_ADMISSIONS = 4096\nconst TERMINAL = new Set<string>(['succeeded', 'failed', 'cancelled'])\nconst LIVE = new Set<string>(['admitted', 'running'])\n\n/**\n * Durable mutual exclusion over actual physical workspace roots.\n *\n * The lock lives in the Store database, so it survives controller restarts, is\n * visible to every connection, and is released only by a persisted terminal\n * receipt for the original operation. It never expires by itself.\n */\nexport class WorkspaceAdmissions {\n  /** Maximum number of simultaneously active admissions; explicit and closed. */\n  readonly MAX_ACTIVE_ADMISSIONS = MAX_ACTIVE_ADMISSIONS\n  constructor(private store: Store, private generation: string = '') {\n    this.store.db.exec(`CREATE TABLE IF NOT EXISTS workspace_admissions(\n        operation_id TEXT PRIMARY KEY REFERENCES operations(id),\n        tool TEXT NOT NULL,\n        root_key TEXT NOT NULL,\n        path TEXT NOT NULL,\n        platform TEXT NOT NULL,\n        ancestors TEXT NOT NULL,\n        ancestor_count INTEGER NOT NULL,\n        context TEXT NOT NULL,\n        acquired_at INTEGER NOT NULL);\n      CREATE INDEX IF NOT EXISTS workspace_admissions_root ON workspace_admissions(root_key);\n      DROP TRIGGER IF EXISTS workspace_admissions_receipt;\n      CREATE TRIGGER workspace_admissions_receipt\n        AFTER UPDATE OF status ON operations\n        FOR EACH ROW\n        WHEN NEW.status IN ('succeeded','failed','cancelled')\n        BEGIN\n          DELETE FROM workspace_admissions WHERE operation_id = NEW.id AND (\n            NEW.tool <> 'shell_exec'\n            OR (json_valid(NEW.result) AND json_type(NEW.result,'$.stopConfirmed') = 'true')\n            OR (json_valid(NEW.result) AND json_type(NEW.result,'$.notStarted') = 'true'));\n        END;`)\n    // Admissions predating roots-generation binding keep '' as an explicit\n    // unknown generation; replay never depends on this column.\n    if(!this.store.db.pragma('table_info(workspace_admissions)').some((column: any) => column.name==='roots_generation'))\n      this.store.db.exec(\"ALTER TABLE workspace_admissions ADD COLUMN roots_generation TEXT NOT NULL DEFAULT ''\")\n  }\n  /** Acquire the physical root for a live original operation; replay is idempotent. */\n  admit(operationId: string, context: Context, identity: any) {\n    identifier(operationId)\n    const root = this.verify(identity)\n    return this.immediate(() => {\n      this.store.validate(context)\n      const operation = this.store.db.prepare('SELECT * FROM operations WHERE id=?').get(operationId)\n      if (!operation) fail('OPERATION_NOT_FOUND', 404)\n      this.store.own(operation.context, context)\n      if (!ROOT_WRITING_TOOLS.includes(operation.tool)) fail('WORKSPACE_TOOL_NOT_SUPPORTED')\n      if (!LIVE.has(operation.status)) fail('OPERATION_CONFLICT', 409)\n      const saved = this.store.db.prepare('SELECT * FROM workspace_admissions WHERE operation_id=?').get(operationId)\n      if (saved) {\n        this.store.own(saved.context, context)\n        if (saved.root_key !== root.key || saved.path !== root.path || saved.platform !== root.platform || saved.ancestors !== canonical(root.ancestors)) fail('WORKSPACE_CONFLICT', 409)\n        return { fresh: false, admission: this.decode(saved) }\n      }\n      const holder = this.holder(root, operationId)\n      if (holder) fail('WORKSPACE_BUSY', 409)\n      const active = this.store.db.prepare('SELECT count(*) AS count FROM workspace_admissions').get()\n      if (active.count >= MAX_ACTIVE_ADMISSIONS) fail('WORKSPACE_ADMISSION_LIMIT', 429)\n      this.store.db.prepare('INSERT INTO workspace_admissions(operation_id,tool,root_key,path,platform,ancestors,ancestor_count,context,acquired_at,roots_generation) VALUES (?,?,?,?,?,?,?,?,?,?)')\n        .run(operationId, operation.tool, root.key, root.path, root.platform, canonical(root.ancestors), root.ancestors.length, canonical(context), Date.now(), this.generation)\n      return { fresh: true, admission: this.decode(this.store.db.prepare('SELECT * FROM workspace_admissions WHERE operation_id=?').get(operationId)) }\n    })\n  }\n  /** Read-side check: no other admitted operation may overlap this physical root. */\n  assertAvailable(identity: any, exceptOperationId?: string) {\n    const root = this.verify(identity)\n    if (exceptOperationId !== undefined) identifier(exceptOperationId)\n    this.immediate(() => { if (this.holder(root, exceptOperationId ?? '')) fail('WORKSPACE_BUSY', 409) })\n  }\n  /** Release only on a persisted terminal receipt; the receipt commit and the release share one transaction. */\n  releaseIfTerminal(operationId: string, context: Context): WorkspaceRelease {\n    identifier(operationId)\n    return this.immediate(() => {\n      this.store.validate(context)\n      const admission = this.store.db.prepare('SELECT * FROM workspace_admissions WHERE operation_id=?').get(operationId)\n      const operation = this.store.db.prepare('SELECT * FROM operations WHERE id=?').get(operationId)\n      // Whether or not the lock is still held, the original operation must belong to the caller.\n      if (admission) this.store.own(admission.context, context)\n      if (operation) this.store.own(operation.context, context)\n      if (!operation) return { operationId, status: null, released: false, reason: 'OPERATION_NOT_FOUND' }\n      if (!admission) return { operationId, status: operation.status, released: TERMINAL.has(operation.status) && this.stopped(operation), reason: TERMINAL.has(operation.status) && this.stopped(operation) ? 'ALREADY_RELEASED' : 'NOT_ADMITTED' }\n      if (!TERMINAL.has(operation.status)) return { operationId, status: operation.status, released: false, reason: 'NON_TERMINAL' }\n      if (!this.stopped(operation)) return { operationId, status: operation.status, released: false, reason: 'STOP_UNCONFIRMED' }\n      return { operationId, status: operation.status, released: this.store.db.prepare('DELETE FROM workspace_admissions WHERE operation_id=?').run(operationId).changes > 0, reason: null }\n    })\n  }\n  /** Active admissions, optionally narrowed to one grant subject. */\n  list(context?: Context) {\n    return this.immediate(() => {\n      if (context !== undefined) this.store.validate(context)\n      return this.store.db.prepare('SELECT * FROM workspace_admissions ORDER BY acquired_at,operation_id').all().map((row: any) => this.decode(row))\n        .filter((a: WorkspaceAdmission) => context === undefined || (a.clientId === context.clientId && a.botId === context.botId && a.taskId === context.taskId && a.attemptId === context.attemptId))\n    })\n  }\n  private verify(value: any): WorkspaceIdentity {\n    if (value === null || typeof value !== 'object' || Array.isArray(value)) fail('INVALID_WORKSPACE_IDENTITY')\n    const keys = Object.keys(value)\n    if (keys.length !== IDENTITY_KEYS.length || !keys.every(k => IDENTITY_KEYS.includes(k))) fail('INVALID_WORKSPACE_IDENTITY')\n    const { key, ancestors, path, platform } = value\n    if (typeof key !== 'string' || !HEX64.test(key)) fail('INVALID_WORKSPACE_IDENTITY')\n    if (!Array.isArray(ancestors) || !ancestors.length || ancestors.length > MAX_ANCESTORS || ancestors.some((x: any) => typeof x !== 'string' || !HEX64.test(x))) fail('INVALID_WORKSPACE_IDENTITY')\n    const chain = [...new Set(ancestors as string[])]\n    if (!chain.includes(key)) fail('INVALID_WORKSPACE_IDENTITY')\n    if (typeof path !== 'string' || !path.length || path.length > MAX_PATH || path.includes('\\0') || !isAbsolute(path)) fail('INVALID_WORKSPACE_IDENTITY')\n    if (typeof platform !== 'string' || !PLATFORMS.has(platform)) fail('INVALID_WORKSPACE_IDENTITY')\n    return { key, ancestors: chain, path, platform: platform as WorkspacePlatform }\n  }\n  /** Same physical root (alias) or an overlapping parent/child branch conflicts. */\n  private holder(root: WorkspaceIdentity, exceptOperationId: string) {\n    return this.store.db.prepare(`SELECT operation_id,path,root_key FROM workspace_admissions\n      WHERE operation_id <> @except AND (root_key = @key\n        OR EXISTS (SELECT 1 FROM json_each(ancestors) WHERE value = @key)\n        OR EXISTS (SELECT 1 FROM json_each(@ancestors) WHERE value = root_key))\n      ORDER BY acquired_at,operation_id LIMIT 1`).get({ except: exceptOperationId, key: root.key, ancestors: canonical(root.ancestors) }) ?? null\n  }\n  private decode(row: any): WorkspaceAdmission {\n    const context = JSON.parse(row.context)\n    return { operationId: row.operation_id, tool: row.tool, rootKey: row.root_key, path: row.path, platform: row.platform, ancestors: JSON.parse(row.ancestors), clientId: context.clientId, botId: context.botId, taskId: context.taskId, attemptId: context.attemptId, acquiredAt: row.acquired_at }\n  }\n  /** A supervisor receipt must prove the stop before a shell lock is dropped. */\n  private stopped(operation: any) {\n    if (!TERMINAL.has(operation.status)) return false\n    if (!STOP_EVIDENCE_TOOLS.has(operation.tool)) return true\n    let result: any = null\n    try { result = operation.result ? JSON.parse(operation.result) : null } catch { return false }\n    return result?.stopConfirmed === true || result?.notStarted === true\n  }\n  private immediate<T>(fn: () => T): T {\n    const db = this.store.db\n    if (db.inTransaction) return fn()\n    try { db.exec('BEGIN IMMEDIATE') } catch (e: any) { throw this.busy(e) }\n    try { const value = fn(); db.exec('COMMIT'); return value } catch (e) { try { db.exec('ROLLBACK') } catch {}; throw this.busy(e) }\n  }\n  private busy(e: any) {\n    if (e instanceof AgentError) return e\n    if (typeof e?.code === 'string' && (e.code.startsWith('SQLITE_BUSY') || e.code === 'SQLITE_LOCKED')) return new AgentError('DATABASE_BUSY', 503)\n    return e\n  }\n}\n", "import { resolve } from 'node:path'\nimport { canonical, sha } from './protocol.js'\n\nexport const ROOTS_GENERATION_META_KEY = 'workspaceRootsGeneration'\n\n/**\n * Deterministic digest of the configured roots map: which physical trees the\n * rootIds denote. Only the mapping participates \u2014 a different dataDir is a\n * different database, and executables/shell settings do not change what the\n * roots point at. Sorted by rootId so key insertion order never matters;\n * `resolve()` normalizes without touching the filesystem.\n */\nexport function rootsGeneration(roots: Record<string, string> = {}): string {\n  const entries = Object.entries(roots).map(([id, value]) => [id, resolve(value)] as const)\n  entries.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))\n  return sha(canonical(entries))\n}\n\n/**\n * Record the current roots generation and fence surviving admissions when the\n * configuration changed since the previous run.\n *\n * The fence deliberately reuses the legacy-fence liveness predicate: an\n * operation counts as unsettled when its status is\n * admitted/running/cancel_pending/unknown, or it is a shell operation whose\n * stop evidence has not settled. Fenced operations never auto-roll-back;\n * reconciliation happens through the existing terminal-with-evidence paths,\n * after which the fence goes inert.\n *\n * A first run on a database that predates generations only records the\n * digest: without an observed change there is nothing to invalidate, and\n * fencing on every upgrade would turn a routine update into a global write\n * outage. Returns the generation now in effect and whether it changed.\n */\nexport function reconcileRootsGeneration(db: any, generation: string): { changed: boolean } {\n  db.exec('CREATE TABLE IF NOT EXISTS workspace_generation_fences(operation_id TEXT PRIMARY KEY)')\n  const saved = db.prepare('SELECT value FROM meta WHERE key=?').get(ROOTS_GENERATION_META_KEY)?.value\n  if (saved === generation) return { changed: false }\n  if (saved === undefined) {\n    db.prepare('INSERT INTO meta VALUES (?,?)').run(ROOTS_GENERATION_META_KEY, generation)\n    return { changed: false }\n  }\n  const fenced = db.prepare(`INSERT OR IGNORE INTO workspace_generation_fences\n    SELECT a.operation_id FROM workspace_admissions a JOIN operations o ON o.id=a.operation_id\n    WHERE o.status IN ('admitted','running','cancel_pending','unknown')\n       OR (o.tool='shell_exec' AND NOT (o.status IN ('succeeded','failed','cancelled')\n           AND (coalesce(json_type(o.result,'$.stopConfirmed'),'null')='true'\n             OR coalesce(json_type(o.result,'$.notStarted'),'null')='true')))`).run().changes\n  db.prepare('UPDATE meta SET value=? WHERE key=?').run(generation, ROOTS_GENERATION_META_KEY)\n  return { changed: true, fenced }\n}\n", "/**\n * Directory-descriptor-pinned creation of a brand-new file (Linux only).\n *\n * Why this exists: the product `fs_write` path in `agent.ts` validates a resolved\n * path and then re-checks the parent directory identity before a plain\n * `rename()`. That re-check is a *path based* observation, so it cannot prove\n * that an external directory replacement (rename, rmdir + mkdir, bind mount) or\n * an external writer did not swap the object between the check and the rename.\n *\n * What this component provides instead:\n *  - the parent directory is opened component-by-component with\n *    `O_DIRECTORY | O_NOFOLLOW` from a held descriptor, so the final access is\n *    bound to one directory inode instead of to a name;\n *  - every host-path observation is re-verified against the held descriptor\n *    (`/proc/<pid>/fd/<n>` realpath and `dev:ino`) immediately before publish and\n *    again after publish;\n *  - publication is `link()` inside the pinned directory, which is an atomic\n *    no-clobber name creation: an existing target (file, directory, symlink,\n *    fifo, device, hard link to a protected file) makes the whole write fail.\n *\n * What this component deliberately does NOT claim:\n *  - fd pinning binds us to an inode, not to a path, a mount or a security\n *    label. A concurrent process with enough privilege can still move the held\n *    directory (or place a mount over the host path) into or onto a protected\n *    location. The component cannot prevent that; it can only detect the\n *    resulting divergence and refuse, or report an unverified outcome.\n *  - the `check` callback is host policy, not a kernel guarantee. A callback\n *    that returns normally means the host approved what it could observe at\n *    that instant, nothing more.\n *  - strict hash CAS against an existing target is NOT solved. An existing\n *    target is always refused (fail closed); this component never overwrites.\n *  - `link()` is addressed through a path string, so the publish step keeps a\n *    small path-resolution window that fd pinning alone cannot close with\n *    Node's `fs` API (no `linkat(dirfd, ...)` is exposed). The window is bounded\n *    by the immediately preceding verification and observed afterwards.\n *  - `nlink` in the result is a single observation of the published name taken\n *    after the private temp name is retired. It is evidence, not an atomic\n *    compare-and-swap against external writers: a link created after that\n *    observation is not something the component can see or prevent.\n *  - durability is best effort: the temp file is fsynced before linking, the\n *    directory is fsynced after linking and again after the private name is\n *    retired, but a crash can still lose any of those steps, and a crash between\n *    `link()` and the temp unlink leaves one private temp name behind in the\n *    target directory. Nothing else is ever published by such a crash, and the\n *    component never removes names it does not own.\n *  - the reported `sha256` is the digest of the payload the component read back\n *    through its own descriptor and compared byte for byte with the request\n *    before returning. It is evidence about the bytes on disk at that moment, not\n *    a guarantee about any later write.\n *\n * The component creates files only. `Agent` uses it solely for Linux new-file\n * writes whose expectedHash is null; existing-target overwrite stays disabled.\n */\nimport { constants, type BigIntStats, type FileHandle } from 'node:fs'\nimport { open, lstat, stat, realpath, link, unlink } from 'node:fs/promises'\nimport path from 'node:path'\nimport { randomBytes } from 'node:crypto'\nimport { AgentError, sha } from './protocol.js'\n\n/** Default and hard limits, mirroring the product `fs_write` content bound. */\nexport const PINNED_WRITE_MAX_BYTES = 1048576\nexport const PINNED_WRITE_MAX_LIMIT_BYTES = 16 * 1024 * 1024\nexport const PINNED_WRITE_MAX_PATH_BYTES = 4096\nexport const PINNED_WRITE_MAX_COMPONENTS = 64\nexport const PINNED_WRITE_MAX_COMPONENT_BYTES = 255\nconst PINNED_WRITE_TEMP_PREFIX = '.dsh-pinned-write-'\nconst DIRECTORY_FLAGS = constants.O_RDONLY | constants.O_DIRECTORY | (constants.O_NOFOLLOW ?? 0)\n/**\n * The private temp file is opened read-write, not write-only, so the published\n * payload can be read back through this very descriptor and compared with what\n * was requested. It stays mode 0600 and is never exposed under a second name.\n */\nconst TEMP_FLAGS = constants.O_RDWR | constants.O_CREAT | constants.O_EXCL\nconst BIG = { bigint: true } as const\n\nconst failWrite = (code: string, status = 409, extra: Record<string, unknown> = {}): never => { throw Object.assign(new AgentError(code, status), extra) }\n/**\n * Refusal raised once the target name exists. Such a failure must never read as\n * \"nothing was written\": the caller has to be able to tell that a file landed\n * and that the component could not certify the rest of the outcome.\n */\nconst failAfterPublish = (code: string, status = 409, extra: Record<string, unknown> = {}): never => { throw Object.assign(new AgentError(code, status), { published: true, possiblyApplied: true, ...extra }) }\n/** Give an already-thrown refusal the same post-publication receipt. */\nconst annotatePublished = (e: unknown): unknown => e instanceof AgentError ? Object.assign(e, { published: true, possiblyApplied: true }) : e\n/**\n * Retire our private temp name and report whether it is gone afterwards.\n *\n * A name that another writer already removed counts as gone, because the\n * directory is clean either way. A name that is still present does not: the\n * published target then keeps a second link and the directory keeps a private\n * entry this component failed to clean up, so the caller must not be told the\n * write finished cleanly.\n */\nconst retireTempName = async (pinned: PinnedDirectory, tempName: string): Promise<{ retired: boolean; fsCode: string }> => {\n  let code = 'OK'\n  try { await unlink(pinned.childPath(tempName)) } catch (e) { code = fsCode(e) }\n  try { if ((await pinned.lstatChild(tempName)) === null) return { retired: true, fsCode: 'OK' } } catch (e) { code = fsCode(e) }\n  return { retired: false, fsCode: code }\n}\n/** Turn an unexpected filesystem failure into a documented, fail-closed code. */\nconst guard = async <T>(work: () => Promise<T>, reason: string): Promise<T> => {\n  try { return await work() } catch (e) { if (e instanceof AgentError) throw e; throw Object.assign(new AgentError('PINNED_WRITE_FAILED', 500), { reason, fsCode: fsCode(e), cause: e }) }\n}\n/** Same, for an observation taken after publication: the receipt is part of the answer. */\nconst publishedGuard = async <T>(work: () => Promise<T>, reason: string): Promise<T> => guard(work, reason).catch(e => { throw annotatePublished(e) })\nconst fsCode = (e: unknown): string => (e && typeof e === 'object' && typeof (e as { code?: unknown }).code === 'string' ? (e as { code: string }).code : 'UNKNOWN')\nconst identityOf = (s: { dev: bigint; ino: bigint }): PinnedIdentity => ({ dev: String(s.dev), ino: String(s.ino) })\n\n/** True when this host can honour the descriptor-pinning contract. */\nexport function pinnedWriteSupported(platform: string = process.platform): boolean { return platform === 'linux' }\n\nexport type PinnedIdentity = { dev: string; ino: string }\n\n/**\n * A held descriptor for one directory inode.\n *\n * All child access goes through `/proc/<pid>/fd/<n>/<name>`, so once the\n * descriptor is held the object we operate on is the inode we verified, not\n * whatever the host path happens to name later.\n */\nexport class PinnedDirectory {\n  private constructor(private readonly handle: FileHandle, readonly hostPath: string) { }\n  /**\n   * Open `resolvedRoot` plus every `components` entry one at a time with\n   * `O_DIRECTORY|O_NOFOLLOW`, so no intermediate component of the target path\n   * can be a symlink or a non-directory. `resolvedRoot` must already be free of\n   * symlinks (the caller resolves it once with `realpath`); resolving the whole\n   * path here would silently follow a symlinked component instead of refusing.\n   */\n  static async pin(resolvedRoot: string, components: readonly string[] = []): Promise<PinnedDirectory> {\n    if (!pinnedWriteSupported()) failWrite('PINNED_WRITE_UNSUPPORTED', 503, { platform: process.platform })\n    if (typeof resolvedRoot !== 'string' || !resolvedRoot || resolvedRoot.includes('\\0') || !path.posix.isAbsolute(resolvedRoot) || Buffer.byteLength(resolvedRoot) > PINNED_WRITE_MAX_PATH_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'pin-root' })\n    for (const part of components) if (typeof part !== 'string' || !part || part.includes('\\0') || part.includes('/') || part === '.' || part === '..' || Buffer.byteLength(part) > PINNED_WRITE_MAX_COMPONENT_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'pin-component' })\n    const parts = [...resolvedRoot.split('/').filter(Boolean), ...components]\n    let handle: FileHandle\n    try { handle = await open('/', DIRECTORY_FLAGS) } catch (e) { throw await mapDirectoryError(e, '/', 'root') }\n    for (const part of parts) {\n      const child = `${descriptorPath(handle)}/${part}`\n      let next: FileHandle\n      try { next = await open(child, DIRECTORY_FLAGS) } catch (e) {\n        // Classify while this descriptor is still open: the diagnostic reads the\n        // refused entry through `/proc/<pid>/fd/<n>`, and a closed descriptor\n        // number can already have been reused by an unrelated open file.\n        let mapped: AgentError\n        try { mapped = await mapDirectoryError(e, child, 'component') } finally { await handle.close().catch(() => { }) }\n        throw mapped\n      }\n      await handle.close().catch(() => { })\n      handle = next\n    }\n    return new PinnedDirectory(handle, path.posix.join(resolvedRoot, ...components))\n  }\n  get fd(): number { return this.handle.fd }\n  /** Descriptor path of the held directory. */\n  get fdPath(): string { return descriptorPath(this.handle) }\n  /** Scan form of the descriptor path, mirroring `WorkspacePin.scanPath`. */\n  get scanPath(): string { return `${this.fdPath}/` }\n  /** Path of a child entry addressed through the held descriptor. */\n  childPath(name: string): string { return `${this.fdPath}/${name}` }\n  async identity(): Promise<PinnedIdentity> { return identityOf(await this.handle.stat(BIG)) }\n  /** lstat a child through the descriptor; `null` when the name does not exist. */\n  async lstatChild(name: string): Promise<BigIntStats | null> {\n    try { return await lstat(this.childPath(name), BIG) } catch (e) { if (fsCode(e) === 'ENOENT') return null; throw await mapDirectoryError(e, this.childPath(name), 'child') }\n  }\n  /**\n   * Re-observe the host path and require that it still denotes the held inode.\n   * Detects rename, replacement, deletion and mount swaps of the directory.\n   */\n  async verifyHostPath(expectedHostPath: string): Promise<void> {\n    const actual = await realpath(this.fdPath).catch(() => null)\n    if (actual !== expectedHostPath) failWrite('DIRECTORY_CHANGED', 409, { reason: 'descriptor-path', expected: expectedHostPath, actual })\n    const current = await stat(expectedHostPath, BIG).catch(() => null)\n    if (!current) failWrite('DIRECTORY_CHANGED', 409, { reason: 'host-path-unreadable', expected: expectedHostPath })\n    const pinned = await guard(() => this.identity(), 'descriptor-stat')\n    if (pinned.dev !== String(current.dev) || pinned.ino !== String(current.ino)) failWrite('DIRECTORY_CHANGED', 409, { reason: 'descriptor-identity', expected: identityOf(current), actual: pinned })  }\n  /** Best-effort durability of names created in this directory. */\n  async sync(): Promise<void> { await this.handle.sync().catch(() => { }) }\n  async close(): Promise<void> { await this.handle.close().catch(() => { }) }\n}\n\nconst descriptorPath = (handle: FileHandle): string => `/proc/${process.pid}/fd/${handle.fd}`\n\nasync function mapDirectoryError(e: unknown, at: string, phase: string): Promise<AgentError> {\n  const code = fsCode(e)\n  if (code === 'ELOOP') return Object.assign(new AgentError('WORKSPACE_OUTSIDE_SCOPE', 403), { reason: 'symlink-component', at, phase })\n  if (code === 'ENOTDIR') {\n    // Linux answers `O_DIRECTORY|O_NOFOLLOW` on a symlink with ENOTDIR rather\n    // than with ELOOP, and reports the same errno for a component that is\n    // genuinely not a directory, so the open flags alone cannot separate an\n    // escape attempt from a wrong-type component. Look at the entry the walk\n    // refused; the refusal itself never depended on this observation, so a race\n    // can only change the reported reason, never the outcome.\n    const entry = await lstat(at, BIG).catch(() => null)\n    if (entry?.isSymbolicLink()) return Object.assign(new AgentError('WORKSPACE_OUTSIDE_SCOPE', 403), { reason: 'symlink-component', at, phase, fsCode: code })\n    return Object.assign(new AgentError('TARGET_PARENT_INVALID', 400), { reason: entry ? 'non-directory-component' : 'component-vanished', at, phase, fsCode: code })\n  }\n  if (code === 'ENOENT' || code === 'ENOTEMPTY') return Object.assign(new AgentError('TARGET_PARENT_INVALID', 400), { reason: 'missing-component', at, phase })\n  if (code === 'EACCES' || code === 'EPERM') return Object.assign(new AgentError('PINNED_WRITE_FAILED', 500), { reason: 'permission', at, phase, fsCode: code })\n  return Object.assign(new AgentError('PINNED_WRITE_FAILED', 500), { reason: 'directory-open', at, phase, fsCode: code })\n}\n\n/** Resolve the configured root once; the descriptor walk then sees no symlinks. */\nasync function resolveRoot(rootPath: unknown): Promise<string> {\n  if (typeof rootPath !== 'string' || !rootPath || rootPath.includes('\\0') || !path.posix.isAbsolute(rootPath) || Buffer.byteLength(rootPath) > PINNED_WRITE_MAX_PATH_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'root-path' })\n  try { return await realpath(rootPath) } catch (e) {\n    const code = fsCode(e)\n    if (code === 'ENOENT' || code === 'ENOTDIR') failWrite('TARGET_PARENT_INVALID', 400, { reason: 'root-missing', fsCode: code })\n    if (code === 'ELOOP') failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'root-symlink', fsCode: code })\n    failWrite('PINNED_WRITE_FAILED', 500, { reason: 'root-unreadable', fsCode: code })\n  }\n}\n\n/** Split and bound a root-relative target path; the last component is the name. */\nfunction splitComponents(relativePath: unknown): string[] {\n  if (typeof relativePath !== 'string' || relativePath.includes('\\0') || Buffer.byteLength(relativePath) > PINNED_WRITE_MAX_PATH_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'relative-path' })\n  if (path.posix.isAbsolute(relativePath)) failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'absolute-relative-path' })\n  const parts = relativePath.split(/[\\\\/]/).filter(Boolean)\n  if (!parts.length || parts.length > PINNED_WRITE_MAX_COMPONENTS) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-count', count: parts.length })\n  for (const part of parts) {\n    if (part === '.' || part === '..') failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'dot-component', component: part })\n    if (Buffer.byteLength(part) > PINNED_WRITE_MAX_COMPONENT_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-too-long' })\n    if (/[. ]$/.test(part)) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-suffix' })\n    if (/[\\u0000-\\u001f\\u007f]/.test(part)) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-control' })\n  }\n  return parts\n}\n\nfunction toBuffer(content: unknown, encoding: unknown): Buffer {\n  if (encoding !== undefined && encoding !== 'utf8' && encoding !== 'base64') failWrite('INVALID_ARGUMENT', 400, { reason: 'encoding' })\n  if (typeof content === 'string') {\n    if (encoding === 'base64') {\n      const compact = content.replace(/\\s+/g, '')\n      if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact) || compact.length % 4 !== 0) failWrite('INVALID_ARGUMENT', 400, { reason: 'base64' })\n      return Buffer.from(compact, 'base64')\n    }\n    return Buffer.from(content, 'utf8')\n  }\n  if (content instanceof Uint8Array) {\n    try { return Buffer.from(content.buffer, content.byteOffset, content.byteLength) } catch { failWrite('INVALID_ARGUMENT', 400, { reason: 'content-buffer' }) }\n  }\n  failWrite('INVALID_ARGUMENT', 400, { reason: 'content-type' })\n}\n\nasync function writeAll(handle: FileHandle, data: Buffer, signal?: AbortSignal): Promise<void> {\n  let offset = 0\n  while (offset < data.byteLength) {\n    if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'during-write', possiblyApplied: false })\n    const written = await guard(() => handle.write(data, offset, data.byteLength - offset), 'temp-write')\n    if (!written.bytesWritten) failWrite('PINNED_WRITE_FAILED', 500, { reason: 'short-write', offset })\n    offset += written.bytesWritten\n  }\n}\n\nexport type PinnedWritePhase = 'before-pin' | 'before-publish' | 'after-publish'\nexport type PinnedWriteCheckReport = {\n  /** Which decision point this report belongs to. */\n  phase: PinnedWritePhase\n  /** Real root directory the target must stay inside. */\n  rootPath: string\n  /** Real parent directory of the target. */\n  directoryPath: string\n  /**\n   * Identity of the parent directory: observed on the host path at admission,\n   * and taken from the held descriptor from `before-publish` onwards, so a\n   * replacement between admission and the pin is visible to the caller.\n   */\n  directory: PinnedIdentity\n  /** Intended target path (may not exist yet). */\n  targetPath: string\n  targetName: string\n  size: number\n  sha256: string\n  /** Present at `before-publish` only: our own private temp file, retired before the write returns. */\n  temp?: { name: string; identity: PinnedIdentity; mode: number; size: number }\n}\n/**\n * Host policy hook. Throwing aborts the write; the thrown error is propagated\n * unchanged (except after publication, see `pinnedCreateNewFile`). It is a\n * policy decision about what the host could observe, never a kernel guarantee.\n */\nexport type PinnedWriteCheck = (report: PinnedWriteCheckReport) => void | Promise<void>\n\nexport type PinnedWriteRequest = {\n  /** Configured root directory; resolved with `realpath` before pinning. */\n  rootPath: string\n  /** Root-relative path of the file to create; it must not exist yet. */\n  relativePath: string\n  content: string | Uint8Array\n  encoding?: 'utf8' | 'base64'\n  maxBytes?: number\n  signal?: AbortSignal\n  check?: PinnedWriteCheck\n}\n\nexport type PinnedWriteResult = {\n  path: string\n  directoryPath: string\n  /** Identity of the directory the write was published through, from the held descriptor. */\n  directory: PinnedIdentity\n  dev: string\n  ino: string\n  /** Links on the published name, observed after the private temp name was retired. */\n  nlink: number\n  size: number\n  sha256: string\n}\n\n/**\n * Create `relativePath` inside `rootPath` as a brand-new regular file.\n *\n * Refuses (fail closed, nothing published) when the target already exists, when\n * the directory identity diverges from the host path, when the caller cancels\n * before publication, or when the host `check` vetoes any phase.\n *\n * A refusal discovered after the target name exists carries\n * `published: true` and `possiblyApplied: true`, because by then the file is on\n * disk and the caller must not read the error as \"nothing was written\".\n */\nexport async function pinnedCreateNewFile(request: PinnedWriteRequest): Promise<PinnedWriteResult> {\n  if (!request || typeof request !== 'object') failWrite('INVALID_ARGUMENT', 400, { reason: 'request' })\n  const { rootPath, relativePath, content, encoding, maxBytes = PINNED_WRITE_MAX_BYTES, signal, check } = request\n  if (!pinnedWriteSupported()) failWrite('PINNED_WRITE_UNSUPPORTED', 503, { platform: process.platform })\n  if (check !== undefined && typeof check !== 'function') failWrite('INVALID_ARGUMENT', 400, { reason: 'check' })\n  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0 || maxBytes > PINNED_WRITE_MAX_LIMIT_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'max-bytes' })\n  const data = toBuffer(content, encoding)\n  if (data.byteLength > maxBytes) failWrite('INVALID_ARGUMENT', 400, { reason: 'content-too-large', limit: maxBytes })\n  const digest = sha(data)\n  const components = splitComponents(relativePath)\n  const root = await resolveRoot(rootPath)\n  const targetName = components[components.length - 1]!\n  const directoryPath = path.posix.join(root, ...components.slice(0, -1))\n  const targetPath = path.posix.join(directoryPath, targetName)\n  // lstat, not stat: a symlinked parent has to be refused as an escape attempt\n  // instead of being followed into whatever it points at, so the admission\n  // report never claims an identity for a directory we did not verify. The\n  // descriptor walk below re-checks every component with `O_NOFOLLOW`; this only\n  // keeps the reported reason and the `check` report honest.\n  const observed = await lstat(directoryPath, BIG).catch(e => {\n    const code = fsCode(e)\n    if (code === 'ENOENT' || code === 'ENOTDIR') failWrite('TARGET_PARENT_INVALID', 400, { reason: 'parent-missing', at: directoryPath })\n    if (code === 'ELOOP') failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'parent-symlink', at: directoryPath })\n    failWrite('PINNED_WRITE_FAILED', 500, { reason: 'parent-unreadable', at: directoryPath, fsCode: code })\n  })\n  if (observed.isSymbolicLink()) failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'parent-symlink', at: directoryPath })\n  if (!observed.isDirectory()) failWrite('TARGET_PARENT_INVALID', 400, { reason: 'parent-not-directory', at: directoryPath })\n  const report = (phase: PinnedWritePhase, temp?: PinnedWriteCheckReport['temp']): PinnedWriteCheckReport => ({ phase, rootPath: root, directoryPath, directory: identityOf(observed), targetPath, targetName, size: data.byteLength, sha256: digest, ...(temp ? { temp } : {}) })\n  if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'before-pin', possiblyApplied: false })\n  if (check) await check(report('before-pin'))\n  // Pin the real parent directory: the root plus every intermediate component of\n  // the relative path, so no symlink or non-directory can hide in between.\n  const pinned = await PinnedDirectory.pin(root, components.slice(0, -1))\n  let tempName = ''\n  let held: FileHandle | undefined\n  let tempRetired = false\n  try {\n    await pinned.verifyHostPath(directoryPath)\n    if (await pinned.lstatChild(targetName)) failWrite('TARGET_EXISTS', 409, { target: targetPath })\n    tempName = `${PINNED_WRITE_TEMP_PREFIX}${randomBytes(16).toString('hex')}`\n    const temp = await open(pinned.childPath(tempName), TEMP_FLAGS, 0o600).catch(e => {\n      const code = fsCode(e)\n      if (code === 'EEXIST') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-name-collision' })\n      if (code === 'EACCES' || code === 'EPERM') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-permission', fsCode: code })\n      failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-create', fsCode: code })\n    })\n    held = temp\n    // The umask may strip owner bits, so make the private mode deterministic.\n    await temp.chmod(0o600).catch(e => failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-chmod', fsCode: fsCode(e) }))\n    let created: BigIntStats\n    await writeAll(temp, data, signal)\n    await temp.sync().catch(() => { })\n    // Our own temp file must stay a private, unlinked, exact-size regular file.\n    const verifyTemp = async (label: string): Promise<BigIntStats> => {\n      const current = await guard(() => temp.stat(BIG), 'temp-stat')\n      if (!current.isFile()) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-not-regular', label })\n      if (current.size !== BigInt(data.byteLength)) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-size', label, size: String(current.size) })\n      if ((Number(current.mode) & 0o777) !== 0o600) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-mode', label, mode: Number(current.mode) & 0o777 })\n      if (current.nlink !== 1n) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-linked', label, nlink: Number(current.nlink) })\n      return current\n    }\n    created = await verifyTemp('written')\n    if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'before-publish', possiblyApplied: false })\n    if (check) await check(report('before-publish', { name: tempName, identity: identityOf(created), mode: Number(created.mode) & 0o777, size: Number(created.size) }))\n    created = await verifyTemp('pre-publish')\n    // The host may have been unable to observe anything between the previous\n    // line and the link below, so re-verify both halves of the pin here.\n    await pinned.verifyHostPath(directoryPath)\n    if (await pinned.lstatChild(targetName)) failWrite('TARGET_EXISTS', 409, { target: targetPath })\n    if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'before-link', possiblyApplied: false })\n    await link(pinned.childPath(tempName), pinned.childPath(targetName)).catch(e => {\n      const code = fsCode(e)\n      if (code === 'EEXIST') failWrite('TARGET_EXISTS', 409, { target: targetPath })\n      if (code === 'EXDEV') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'cross-device', fsCode: code })\n      if (code === 'EACCES' || code === 'EPERM') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'publish-permission', fsCode: code })\n      failWrite('PINNED_WRITE_FAILED', 500, { reason: 'publish', fsCode: code })\n    })\n    const published = await publishedGuard(() => pinned.lstatChild(targetName), 'published-initial-stat')\n    if (!published || !published.isFile() || String(published.dev) !== String(created.dev) || String(published.ino) !== String(created.ino)) failAfterPublish('PINNED_WRITE_TAMPERED', 409, { reason: 'published-mismatch' })\n    if (signal?.aborted) failAfterPublish('WRITE_CANCELLED', 409, { reason: 'after-publish', result: { path: targetPath, size: data.byteLength, sha256: digest } })\n    await pinned.sync()\n    // `link()` leaves the payload under two names for a moment. The result has\n    // to describe the directory as it is once this call is finished, so retire\n    // the private name first, make that retirement durable, and observe the\n    // published name again instead of reporting the intermediate link count.\n    const retired = await retireTempName(pinned, tempName)\n    if (!retired.retired) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'temp-cleanup-failed', temp: tempName, fsCode: retired.fsCode })\n    tempRetired = true\n    await pinned.sync()\n    /**\n     * The published name must still be the private regular file we linked: one\n     * link, the exact size, the exact mode, and the inode we wrote.\n     */\n    const verifyPublished = async (label: string, expected: { dev: string; ino: string }): Promise<BigIntStats> => {\n      const current = await publishedGuard(() => pinned.lstatChild(targetName), 'published-stat')\n      if (!current || !current.isFile() || String(current.dev) !== expected.dev || String(current.ino) !== expected.ino) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-replaced', label, target: targetPath })\n      if (current.size !== BigInt(data.byteLength)) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-size', label, target: targetPath })\n      if ((Number(current.mode) & 0o777) !== 0o600) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-mode', label, target: targetPath })\n      // A second link means a foreign writer reached our private payload, so the\n      // published file no longer has the one-link shape this component promises.\n      if (current.nlink !== 1n) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-extra-links', label, target: targetPath, nlink: Number(current.nlink) })\n      return current\n    }\n    const final = await verifyPublished('after-cleanup', { dev: String(published.dev), ino: String(published.ino) })\n    // The reported digest is evidence about the bytes on disk, not a claim about\n    // the buffer we were handed, so read the published payload back through the\n    // descriptor we wrote it with and compare it with what was requested. The\n    // descriptor still denotes the published inode: retiring the private name\n    // removed a link, not the object.\n    let offset = 0\n    while (offset < data.byteLength) {\n      const want = Math.min(65536, data.byteLength - offset)\n      const chunk = Buffer.allocUnsafe(want)\n      const read = await publishedGuard(() => temp.read(chunk, 0, want, offset), 'published-read')\n      if (read.bytesRead !== want) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-short-read', offset, expected: want, read: read.bytesRead })\n      if (chunk.compare(data.subarray(offset, offset + want)) !== 0) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-content', offset })\n      offset += want\n    }\n    if (signal?.aborted) failAfterPublish('WRITE_CANCELLED', 409, { reason: 'after-publish', result: { path: targetPath, size: data.byteLength, sha256: digest } })\n    const settled = await verifyPublished('after-read-back', { dev: String(final.dev), ino: String(final.ino) })\n    // The directory identity comes from the descriptor we wrote through, never\n    // from the admission observation: a replacement between admission and the\n    // pin would otherwise be reported as the directory that is not on disk.\n    const directory = await publishedGuard(() => pinned.identity(), 'published-directory')\n    const result: PinnedWriteResult = { path: targetPath, directoryPath, directory, dev: String(settled.dev), ino: String(settled.ino), nlink: Number(settled.nlink), size: Number(settled.size), sha256: digest }\n    // A divergence here means the name we created is no longer the name the\n    // host asked for; the caller must treat the outcome as unknown.\n    try { await pinned.verifyHostPath(directoryPath) } catch (e) { throw annotatePublished(e) }\n    if (check) {\n      const afterPublish = { ...report('after-publish'), directory }\n      try { await check(afterPublish) } catch (e) {\n        throw Object.assign(new AgentError('PINNED_WRITE_UNVERIFIED', 409), { possiblyApplied: true, published: true, cause: e })\n      }\n    }\n    return result\n  } finally {\n    // Every path that did not already retire the private name gets one more\n    // best-effort attempt: a leftover name is a workspace leak, but it must never\n    // mask the real reason this write failed.\n    if (tempName && !tempRetired) await unlink(pinned.childPath(tempName)).catch(() => { })\n    await held?.close().catch(() => { })\n    await pinned.close()\n  }\n}\n", "import { readFile, stat, writeFile } from 'node:fs/promises'\nimport { isAbsolute, join, relative, resolve } from 'node:path'\nimport { canonical, fail, sha, type Context } from './protocol.js'\nimport { Store } from './store.js'\nimport { Roots } from './scope.js'\nimport { WorkspacePin } from './workspace-identity.js'\nimport { createAgentCodexSession } from '../../packages/cli-runtime/src/agent-codex-runtime.mjs'\n\nexport type CliProfileConfig={profileId:string;rootId:string;profileRevision:number;executable:string;runtimeRoot:string;entry:{sha256:string;version:string};bots:Record<string,{credentialRef:string}>}\nconst ref=(value:any)=>typeof value==='string'&&/^[-A-Za-z0-9_.]{1,128}$/.test(value)\nconst plain=(value:any)=>value&&typeof value==='object'&&!Array.isArray(value)&&Object.getPrototypeOf(value)===Object.prototype\nconst closed=(value:any,keys:string[])=>{if(!plain(value)||Object.keys(value).some(key=>!keys.includes(key)))fail('INVALID_CLI_ARGUMENT');return value}\nconst inside=(parent:string,child:string)=>{const part=relative(parent,child);return part!==''&&!part.startsWith('..')&&!isAbsolute(part)}\n\nexport function validateCliProfiles(value:any,dataDir:string,roots:Record<string,string>):CliProfileConfig[]{\n if(value===undefined)return []\n if(!Array.isArray(value)||value.length>64||!['win32','linux'].includes(process.platform))fail('CLI_PROFILE_CONFIG_INVALID')\n const seen=new Set<string>(),runtimeRoots=new Set<string>()\n return value.map(raw=>{\n  closed(raw,['profileId','rootId','profileRevision','executable','runtimeRoot','entry','bots'])\n  if(!ref(raw.profileId)||!ref(raw.rootId)||!Object.hasOwn(roots,raw.rootId)||!Number.isSafeInteger(raw.profileRevision)||raw.profileRevision<1\n   ||!isAbsolute(raw.executable)||!isAbsolute(raw.runtimeRoot)||!inside(resolve(dataDir),resolve(raw.runtimeRoot)))fail('CLI_PROFILE_CONFIG_INVALID')\n  closed(raw.entry,['sha256','version'])\n  if(!/^[a-f0-9]{64}$/.test(raw.entry.sha256)||!/^\\d+\\.\\d+\\.\\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(raw.entry.version))fail('CLI_PROFILE_CONFIG_INVALID')\n  if(!plain(raw.bots)||!Object.keys(raw.bots).length)fail('CLI_PROFILE_CONFIG_INVALID')\n  for(const [botId,bot] of Object.entries<any>(raw.bots)){\n   if(!ref(botId))fail('CLI_PROFILE_CONFIG_INVALID');closed(bot,['credentialRef'])\n   if(!isAbsolute(bot.credentialRef)||bot.credentialRef.length>4096||bot.credentialRef.includes('\\0'))fail('CLI_PROFILE_CONFIG_INVALID')\n  }\n  const key=`${raw.rootId}/${raw.profileId}`,runtime=resolve(raw.runtimeRoot)\n  if(seen.has(key)||runtimeRoots.has(runtime))fail('CLI_PROFILE_CONFIG_INVALID');seen.add(key);runtimeRoots.add(runtime)\n  return {profileId:raw.profileId,rootId:raw.rootId,profileRevision:raw.profileRevision,executable:resolve(raw.executable),runtimeRoot:runtime,entry:{sha256:raw.entry.sha256,version:raw.entry.version},bots:structuredClone(raw.bots)}\n })\n}\n\ntype Identity={args:any;profile:CliProfileConfig;workspaceId:string;pin:WorkspacePin}\ntype Settlement={status:'succeeded'|'failed'|'cancelled'|'unknown';result:any;error:string|null}\n\nexport class CliTasks{\n private profiles:Map<string,CliProfileConfig>\n constructor(cliProfiles:CliProfileConfig[],private store:Store,private roots:Roots){\n  this.profiles=new Map(cliProfiles.map(profile=>[`${profile.rootId}/${profile.profileId}`,profile]))\n }\n private async identity(a:any,c:Context,probe:boolean):Promise<Identity>{\n  const base=['rootId','workspaceRef','profileId','profileRevision','entry','requestedModel','catalogProvider','catalogModel','billing','deadlineMs']\n  closed(a,[...base,...(probe?[]:['task'])]);closed(a.workspaceRef,['kind','machineId','rootId','relativePath','workspaceId']);closed(a.entry,['sha256','version'])\n  if(!ref(a.rootId)||!c.roots.includes(a.rootId)||!ref(a.profileId)||!Number.isSafeInteger(a.profileRevision)||a.profileRevision<1\n   ||a.workspaceRef.kind!=='remote'||a.workspaceRef.machineId!==this.store.machineId||a.workspaceRef.rootId!==a.rootId\n   ||typeof a.workspaceRef.relativePath!=='string'||a.workspaceRef.relativePath.length>2048||typeof a.workspaceRef.workspaceId!=='string'\n   ||!/^[a-f0-9]{64}$/.test(a.entry.sha256)||!/^\\d+\\.\\d+\\.\\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(a.entry.version)\n   ||!/^gpt-[A-Za-z0-9_.-]{1,100}$/.test(a.requestedModel)||typeof a.catalogProvider!=='string'||!a.catalogProvider||typeof a.catalogModel!=='string'||!a.catalogModel\n   ||!['api','subscription'].includes(a.billing)||!Number.isSafeInteger(a.deadlineMs)||a.deadlineMs<1000||a.deadlineMs>7200000)fail('INVALID_CLI_ARGUMENT')\n  if(!probe&&(typeof a.task!=='string'||!a.task.trim()||a.task.includes('\\0')||Buffer.byteLength(a.task)>16000))fail('INVALID_CLI_ARGUMENT')\n  const profile=this.profiles.get(`${a.rootId}/${a.profileId}`)\n  if(!profile||profile.profileRevision!==a.profileRevision||profile.entry.sha256!==a.entry.sha256||profile.entry.version!==a.entry.version||!Object.hasOwn(profile.bots,c.botId))fail('CLI_PROFILE_DENIED',403)\n  const workspaceId='remote_'+sha(canonical({rootId:a.rootId,workspaceRelativePath:a.workspaceRef.relativePath,profileId:a.profileId,profileRevision:a.profileRevision,entrySha256:a.entry.sha256,entryVersion:a.entry.version}))\n  if(a.workspaceRef.workspaceId!==workspaceId)fail('CLI_WORKSPACE_IDENTITY_MISMATCH',403)\n  const cwd=await this.roots.resolve(a.rootId,a.workspaceRef.relativePath)\n  if(!(await stat(cwd)).isDirectory())fail('CLI_WORKSPACE_OUTSIDE_SCOPE',403)\n  const pin=await WorkspacePin.capture(cwd);await pin.verify()\n  return {args:a,profile,workspaceId,pin}\n }\n private async provision(profile:CliProfileConfig,c:Context,home:string){\n  const reference=profile.bots[c.botId].credentialRef\n  const bytes=await readFile(reference)\n  if(bytes.length>65536)fail('CLI_CREDENTIAL_PROVISION_FAILED')\n  await writeFile(join(home,'auth.json'),bytes,{flag:'wx',mode:0o600})\n }\n private async session(identity:Identity,c:Context,operationId:string,signal:AbortSignal){\n  const {args,profile,workspaceId,pin}=identity\n  return createAgentCodexSession({context:c,validate:()=>this.store.validate(c),binding:{taskId:c.taskId,attemptId:c.attemptId,machineId:this.store.machineId,workspaceId,location:'remote'},operationId,\n   runtimeRoot:profile.runtimeRoot,workspace:pin.identity.path,entry:{executable:profile.executable,...profile.entry},requestedModel:args.requestedModel,catalogProvider:args.catalogProvider,catalogModel:args.catalogModel,\n   billing:args.billing,deadlineMs:args.deadlineMs,tools:[],handlers:[],signal,provisionCredentials:(home:string)=>this.provision(profile,c,home)})\n }\n private remoteReceipt(identity:Identity,snapshot:any){\n  const {args,pin}=identity\n  return {...snapshot,remote:{rootId:args.rootId,workspaceRelativePath:args.workspaceRef.relativePath,profileId:args.profileId,profileRevision:args.profileRevision,workspaceIdentity:pin.identity}}\n }\n async probe(a:any,c:Context,operationId?:string){\n  if(!operationId)fail('OPERATION_ID_REQUIRED')\n  const identity=await this.identity(a,c,true),controller=new AbortController();let session:any\n  try{\n   session=await this.session(identity,c,operationId,controller.signal)\n   const readiness=await session.listCapabilities(),stop=await session.close(),snapshot=this.remoteReceipt(identity,session.snapshot())\n   if(stop?.treeStopped!==true)fail('CLI_STOP_UNCONFIRMED',409)\n   return {schemaVersion:1,kind:'remote-cli-probe',status:'available',location:'remote',machineId:this.store.machineId,rootId:a.rootId,workspaceId:identity.workspaceId,\n    workspaceRelativePath:a.workspaceRef.relativePath,workspaceIdentity:identity.pin.identity,profileId:a.profileId,profileRevision:a.profileRevision,\n    entry:{sha256:a.entry.sha256,version:a.entry.version,path:session.entry.path},requestedModel:a.requestedModel,loginStatus:'unknown',versionStatus:'available',dependencyStatus:'available',\n    nativeStatus:'available',profileStatus:'available',readinessStatus:'available',readiness,home:session.home,cwd:identity.pin.identity.path,stopConfirmed:true,stopEvidence:stop,\n    capabilityProbe:snapshot.capabilityProbe,profile:snapshot.profile}\n  }finally{await session?.close().catch(()=>{});controller.abort();await identity.pin.close()}\n }\n async run(a:any,c:Context,operationId:string,hooks:{setProcess:(record:any)=>void;clearProcess:()=>void}):Promise<Settlement>{\n  let identity:Identity|undefined,session:any,stop:any=null,error:any=null\n  const controller=new AbortController()\n  hooks.setProcess({context:c,cancel:async()=>{controller.abort(new Error('CANCELLED'));await session?.close()}})\n  try{\n   identity=await this.identity(a,c,false)\n   session=await this.session(identity,c,operationId,controller.signal)\n   await identity.pin.verify();await session.run(a.task);await identity.pin.verify()\n  }catch(e){error=e}\n  finally{\n   try{stop=await session?.close()}catch(e){error??=e}\n   if(identity)await identity.pin.close();hooks.clearProcess()\n  }\n  const base=session?.snapshot(),receipt=identity&&base?this.remoteReceipt(identity,base):null,stopConfirmed=stop?.treeStopped===true\n  if(receipt&&stopConfirmed&&controller.signal.aborted&&!['completed','failed'].includes(receipt.terminal))receipt.terminal='interrupted'\n  const terminal=receipt?.terminal==='completed'?'succeeded':receipt?.terminal==='failed'?'failed':receipt?.terminal==='interrupted'?'cancelled':'unknown'\n  const status=!stopConfirmed?'unknown':error&&terminal==='succeeded'?'unknown':terminal\n  const code=status==='unknown'?'OUTCOME_UNKNOWN':status==='cancelled'?'CANCELLED':status==='failed'?(error?.code??'CLI_TASK_FAILED'):null\n  const result={kind:'remote-cli',schemaVersion:1,receipt,stopConfirmed,stopEvidence:stop??{treeStopped:false,status:'unconfirmed'},exitCode:Number.isSafeInteger(stop?.exitCode)?stop.exitCode:null,\n   ...(receipt?.cliTurnRequestsDispatched===0?{notStarted:true,possiblyApplied:false}:{})}\n  return {status,result,error:code}\n }\n}\n", "import { randomBytes } from 'node:crypto'\nimport { createCodexSessionCore, pinCodexExecutable } from './codex-session-core.mjs'\n\nexport { pinCodexExecutable }\n\nfunction agentAuthority(context, validate, requestedModel, catalogProvider, catalogModel) {\n  const leases = new Map()\n  const subject = Object.freeze({})\n  const bindingKey = value => JSON.stringify(value)\n  const current = (token, binding) => {\n    validate(context)\n    const lease = leases.get(token)\n    if (!lease || lease.binding !== bindingKey(binding) || lease.expiresAt <= Date.now()) {\n      leases.delete(token)\n      throw new Error('AGENT_CLI_LEASE_DENIED')\n    }\n    return lease\n  }\n  const authority = {\n    describe() { validate(context); return { botId: context.botId, revision: context.revision } },\n    assertModel(_subject, provider, model) {\n      validate(context)\n      if (provider !== catalogProvider || model !== catalogModel || requestedModel !== catalogModel) throw new Error('AGENT_CLI_MODEL_DENIED')\n    },\n    issue(_subject, { binding, tools, ttlMs }) {\n      validate(context)\n      if (binding?.location !== 'remote' || !Array.isArray(tools) || tools.length || !Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > 300000) throw new Error('AGENT_CLI_LEASE_DENIED')\n      const token = randomBytes(32).toString('base64url')\n      leases.set(token, { binding: bindingKey(binding), tools: new Set(tools), expiresAt: Math.min(Date.now() + ttlMs, context.expiresAt) })\n      return { token }\n    },\n    list(token, binding) { return [...current(token, binding).tools].sort() },\n    renew(token, binding, { ttlMs }) {\n      const lease = current(token, binding)\n      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > 300000) throw new Error('AGENT_CLI_LEASE_DENIED')\n      lease.expiresAt = Math.min(Date.now() + ttlMs, context.expiresAt)\n      return { ttlMs }\n    },\n    async run(token, binding, tool, execute, { signal } = {}) {\n      const lease = current(token, binding)\n      if (!lease.tools.has(tool)) throw new Error('AGENT_CLI_TOOL_DENIED')\n      validate(context)\n      return execute({ signal: signal ?? new AbortController().signal })\n    },\n    release(token) { leases.delete(token) },\n  }\n  return { authority, subject, close: () => leases.clear() }\n}\n\n/** Agent-process-only entry. The binding remains remote; no Host-local fallback exists here. */\nexport async function createAgentCodexSession(options) {\n  const { context, validate, requestedModel, catalogProvider = 'openai', catalogModel = requestedModel } = options ?? {}\n  if (options?.binding?.location !== 'remote' || !context || typeof validate !== 'function') throw new Error('AGENT_CLI_REMOTE_BINDING_REQUIRED')\n  if (!Array.isArray(options.tools) || options.tools.length || !Array.isArray(options.handlers) || options.handlers.length) throw new Error('AGENT_CLI_CAPABILITIES_FIXED')\n  const local = agentAuthority(context, validate, requestedModel, catalogProvider, catalogModel)\n  try {\n    const session = await createCodexSessionCore({ ...options, authority: local.authority, subject: local.subject })\n    const close = session.close\n    return Object.freeze({ ...session, async close() { try { return await close() } finally { local.close() } }, async cancel() { try { return await session.cancel() } finally { local.close() } } })\n  } catch (error) {\n    local.close()\n    throw error\n  }\n}\n", "import { createHash } from 'node:crypto'\nimport { readFile, realpath, stat, mkdir, writeFile } from 'node:fs/promises'\nimport { spawn } from 'node:child_process'\nimport { isAbsolute, join } from 'node:path'\nimport { capabilityProbe, nativeProcess, privateEnvironment, protectProfile } from './native-process.mjs'\nimport { createCliBootstrap } from '../../capability-broker/src/cli-bootstrap.mjs'\nimport { createCodexEvidence } from './contracts.mjs'\nimport { providerSettings, assertEffectiveProfile } from './profile-policy.mjs'\n\nconst digest = value => createHash('sha256').update(value).digest('hex')\nconst id = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value)\nconst validText = value => typeof value === 'string' && value.trim() && !value.includes('\\0') && Buffer.byteLength(value) <= 64_000\n\n/** Caller supplies an installation-attested absolute native entry and immutable expected digest. */\nexport async function pinCodexExecutable({ executable, sha256, version }, home) {\n  if (!isAbsolute(executable) || !/^[a-f0-9]{64}$/.test(sha256) || !/^\\d+\\.\\d+\\.\\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(version)) throw new TypeError('PINNED_NATIVE_ENTRY_REQUIRED')\n  const path = await realpath(executable)\n  if (!(await stat(path)).isFile() || process.platform === 'win32' && !path.toLowerCase().endsWith('.exe')) throw new Error('NATIVE_ENTRY_REQUIRED')\n  if (digest(await readFile(path)) !== sha256) throw new Error('CLI_ENTRY_CHANGED')\n  const reported = await new Promise((resolve, reject) => {\n    const child = spawn(path, ['--version'], { cwd: home, env: privateEnvironment(home), windowsHide: true, shell: false, stdio: ['ignore', 'pipe', 'pipe'] })\n    let output = '', error = ''\n    const timer = setTimeout(() => { child.kill(); reject(new Error('CLI_VERSION_TIMEOUT')) }, 10_000)\n    child.stdout.on('data', chunk => { output += chunk.toString('utf8'); if (output.length > 1024) child.kill() })\n    child.stderr.on('data', chunk => { error = (error + chunk.toString('utf8')).slice(-1024) })\n    child.once('error', reject)\n    child.once('close', code => { clearTimeout(timer); if (code === 0) resolve(output.trim()); else reject(new Error(`CLI_VERSION_FAILED: ${error.slice(0, 128)}`)) })\n  })\n  if (reported !== `codex-cli ${version}`) throw new Error('CLI_VERSION_MISMATCH')\n  return Object.freeze({ path, sha256, version })\n}\n\n/** Internal session mechanics. Public local and Agent wrappers own their disjoint binding guards. */\nexport async function createCodexSessionCore({ authority, subject, binding, operationId, tools = [], handlers = [],\n  runtimeRoot, workspace, entry: suppliedEntry, requestedModel, catalogProvider = 'openai', catalogModel = requestedModel,\n  deadlineMs = 60_000, provisionCredentials, billing = 'subscription', python, onUsage, onBeforeRequest, onProgress, signal,\n  providerConfig = {}, roleInstructions }) {\n  if (!id(operationId) || !isAbsolute(runtimeRoot) || !isAbsolute(workspace) || !/^gpt-[A-Za-z0-9_.-]{1,100}$/.test(requestedModel)) throw new TypeError('INVALID_CLI_TASK')\n  if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 1000 || deadlineMs > 7_200_000) throw new TypeError('INVALID_CLI_DEADLINE')\n  authority.assertModel(subject, catalogProvider, catalogModel)\n  const { botId, revision } = authority.describe(subject)\n  signal?.throwIfAborted()\n  const settings = providerSettings(providerConfig)\n  if (roleInstructions !== undefined && !validText(roleInstructions)) throw new TypeError('INVALID_CLI_ROLE')\n  const cwd = await realpath(workspace)\n  if (!(await stat(cwd)).isDirectory()) throw new Error('INVALID_WORKSPACE')\n  await mkdir(runtimeRoot, { recursive: true, mode: 0o700 })\n  const root = await realpath(runtimeRoot)\n  const home = join(root, `h-${operationId}`)\n  await mkdir(home, { mode: 0o700 })\n  for (const folder of ['tmp', 'cache', 'config', 'data', 'appdata', 'local', 'b']) await mkdir(join(home, folder), { mode: 0o700 })\n  const probe = await capabilityProbe({ home, python })\n  if (!probe.available) throw new Error(`NATIVE_PEER_UNAVAILABLE: ${probe.reason}`)\n  await protectProfile(probe.helper, home)\n  const entry = await pinCodexExecutable(suppliedEntry, home)\n  const bridge = await createCliBootstrap({ authority, subject, binding, tools, handlers, home: join(home, 'b'), ttlMs: deadlineMs, helper: probe.helper })\n  const config = [\n    `model = ${JSON.stringify(requestedModel)}`, 'model_provider = \"openai\"', 'approval_policy = \"never\"', 'sandbox_mode = \"read-only\"',\n    'web_search = \"disabled\"', 'cli_auth_credentials_store = \"file\"', 'suppress_unstable_features_warning = true',\n    'model_reasoning_effort = \"low\"',\n    ...settings.lines,\n    '[features]', 'shell_tool = false', 'multi_agent = false', 'memories = false',\n    '[analytics]', 'enabled = false', '[mcp_servers.dsh_task]', `command = ${JSON.stringify(bridge.command)}`,\n    `args = ${JSON.stringify(bridge.args)}`, `cwd = ${JSON.stringify(join(home, 'b'))}`, 'enabled = true', 'required = true',\n    `enabled_tools = ${JSON.stringify(tools)}`, 'env_vars = []', 'startup_timeout_sec = 20',\n    '[mcp_servers.dsh_task.env]', `HOME = ${JSON.stringify(home)}`, `USERPROFILE = ${JSON.stringify(home)}`,\n    `TEMP = ${JSON.stringify(join(home, 'tmp'))}`, `TMP = ${JSON.stringify(join(home, 'tmp'))}`,\n  ].join('\\n') + '\\n'\n  await writeFile(join(home, 'config.toml'), config, { flag: 'wx', mode: 0o600 })\n  if (provisionCredentials) await provisionCredentials(home)\n  if (digest(await readFile(join(home, 'config.toml'))) !== digest(Buffer.from(config))) { await bridge.close(); throw new Error('CLI_PROFILE_CHANGED_DURING_PROVISIONING') }\n  if (digest(await readFile(entry.path)) !== entry.sha256) { await bridge.close(); throw new Error('CLI_ENTRY_CHANGED') }\n  const evidence = createCodexEvidence({ binding, operationId, botId, requestedModel, catalogProvider, catalogModel, entry, billing })\n  const env = privateEnvironment(home)\n  const supervisor = nativeProcess(probe.helper, 'supervise', { executable: entry.path, args: ['app-server', '--listen', 'stdio://'], cwd, ttlMs: deadlineMs }, { home, env })\n  const pending = new Map(), notifications = new Set()\n  let sequence = 0, closed = false, rootProcess, stopEvidence = null, threadId = null, requestCount = 0, stopPromise, activeTurn = false, fatal = null, profileEvidence\n  let usageWrites = Promise.resolve()\n  const failPending = error => { for (const value of pending.values()) value.reject(error); pending.clear() }\n  const rpc = (method, params, timeoutMs = 30_000) => new Promise((resolve, reject) => {\n    if (closed || fatal) { reject(fatal ?? new Error('CLI_CLOSED')); return }\n    const id = ++sequence\n    const timer = setTimeout(() => { pending.delete(id); reject(new Error(`CLI_RPC_TIMEOUT:${method}`)) }, Math.min(timeoutMs, deadlineMs))\n    const settle = fn => value => { clearTimeout(timer); fn(value) }\n    pending.set(id, { resolve: settle(resolve), reject: settle(reject) })\n    void supervisor.send({ id, method, params }).catch(error => { const value = pending.get(id); pending.delete(id); value?.reject(error) })\n  })\n  const stop = () => {\n    if (stopPromise) return stopPromise\n    closed = true; failPending(new Error('CLI_STOPPING'))\n    clearInterval(grantGuard); signal?.removeEventListener('abort', onAbort)\n    stopPromise = (async () => {\n      await bridge.close()\n      // A completed turn can be immediately followed by the CLI's natural\n      // exit. Do not replace that native exit code with our cancellation code.\n      // Never grant this grace to an active, revoked, failed-protocol or aborted\n      // session, and do not treat elapsed grace as proof that anything stopped.\n      if (!fatal && !signal?.aborted && ['completed', 'failed'].includes(evidence.snapshot().terminal) && !stopEvidence?.treeStopped) {\n        await new Promise(resolve => {\n          const finish = () => { clearTimeout(grace); signal?.removeEventListener('abort', finish); resolve() }\n          const grace = setTimeout(finish, 1000)\n          supervisor.exit.then(finish); signal?.addEventListener('abort', finish, { once: true })\n          if (signal?.aborted) finish()\n        })\n      }\n      supervisor.end()\n      const result = await Promise.race([supervisor.exit, new Promise(resolve => { const t = setTimeout(() => resolve(null), 8000); t.unref() })])\n      if (!result) {\n        if (process.platform === 'linux' && rootProcess) { try { process.kill(-rootProcess.pid, 'SIGKILL') } catch {} }\n        supervisor.child.kill()\n        await supervisor.exit\n      }\n      if (!stopEvidence?.treeStopped) stopEvidence = { ...stopEvidence, treeStopped: false, status: 'unconfirmed', forcedSupervisorStop: !result }\n      return stopEvidence\n    })()\n    return stopPromise\n  }\n  supervisor.events.on('control', value => {\n    if (value.control === 'spawned') rootProcess = value\n    if (value.control === 'stopped') stopEvidence = value\n  })\n  supervisor.events.on('message', message => {\n    if (message.id !== undefined && !message.method) {\n      const value = pending.get(message.id); pending.delete(message.id)\n      if (message.error) value?.reject(Object.assign(new Error(`CLI_RPC_REFUSED:${message.error.message}`), { code: message.error.code }))\n      else value?.resolve(message.result)\n      return\n    }\n    if (message.id !== undefined) {\n      void supervisor.send({ id: message.id, error: { code: -32601, message: 'Host callback is not authorized' } }).catch(() => {})\n      return\n    }\n    const update = evidence.event(message)\n    if (onProgress && typeof message.method === 'string') onProgress({ method: message.method, errorCode: typeof message.params?.error?.codexErrorInfo === 'string' ? message.params.error.codexErrorInfo : null })\n    if (update.usageChanged && onUsage) {\n      const snapshot = evidence.snapshot()\n      usageWrites = usageWrites.then(() => onUsage(snapshot))\n      void usageWrites.catch(error => { fatal = error; void stop() })\n    }\n    if (update.mismatch) { fatal = new Error('CLI_MODEL_IDENTITY_MISMATCH'); void stop() }\n    for (const listener of notifications) listener(message, update)\n  })\n  supervisor.events.on('failure', error => { fatal = error; failPending(error); void stop() })\n  supervisor.events.once('closed', () => { closed = true; failPending(new Error('CLI_EXITED')); void bridge.close() })\n  const onAbort = () => { fatal = new Error('CLI_CANCELLED'); void stop() }\n  signal?.addEventListener('abort', onAbort, { once: true })\n  const grantGuard = setInterval(() => {\n    try { if (bridge.closed) throw new Error('CLI_BRIDGE_CLOSED'); if (authority.describe(subject).revision !== revision) throw new Error('CLI_GRANT_CHANGED'); authority.assertModel(subject, catalogProvider, catalogModel) }\n    catch { fatal = new Error('CLI_GRANT_REVOKED'); void stop() }\n  }, 100); grantGuard.unref()\n  if (signal?.aborted) onAbort()\n  const timer = setTimeout(() => { fatal = new Error('CLI_DEADLINE'); void stop() }, deadlineMs); timer.unref()\n  try {\n    const spawned = await supervisor.waitControl('spawned')\n    await bridge.bind(spawned)\n    await rpc('initialize', { clientInfo: { name: 'dsh_task_executor', title: 'DSH Task Executor', version: '0.0.0' }, capabilities: { experimentalApi: true } })\n    await supervisor.send({ method: 'initialized', params: {} })\n    profileEvidence = assertEffectiveProfile(await rpc('config/read', { cwd, includeLayers: false }), { requestedModel, bridge, home: join(home, 'b'), tools, settings })\n    const result = await rpc('thread/start', { model: requestedModel, modelProvider: 'openai', allowProviderModelFallback: false, cwd, approvalPolicy: 'never', sandbox: 'read-only', ephemeral: true,\n      ...(roleInstructions ? { developerInstructions: roleInstructions } : {}) })\n    evidence.bindThread(result); threadId = result.thread.id\n  } catch (error) { clearTimeout(timer); await stop(); error.bridgeEvidence = bridge.evidence; error.nativeError = supervisor.stderr.slice(-1024); throw error }\n  return Object.freeze({\n    home, entry, binding: Object.freeze({ ...binding }), operationId,\n    async listModels() { return rpc('model/list', { includeHidden: false, limit: 100 }) },\n    async listCapabilities() { return rpc('mcpServerStatus/list', { threadId, serverName: 'dsh_task', detail: 'toolsAndAuthOnly', limit: 100 }) },\n    async callCapability(name, args = {}) {\n      if (!tools.includes(name)) throw new Error('TOOL_DENIED')\n      return rpc('mcpServer/tool/call', { threadId, server: 'dsh_task', tool: name, arguments: args })\n    },\n    async run(prompt) {\n      if (!validText(prompt) || activeTurn || requestCount) throw new Error('INVALID_OR_REPEATED_CLI_TURN')\n      authority.assertModel(subject, catalogProvider, catalogModel)\n      authority.describe(subject)\n      if (onBeforeRequest) await onBeforeRequest({ botId, ...binding, operationId, source: 'cli', toolId: 'codex', requestedModel, entry })\n      if (closed || fatal) throw fatal ?? new Error('CLI_CLOSED')\n      if (authority.describe(subject).revision !== revision) throw new Error('CLI_GRANT_CHANGED')\n      authority.assertModel(subject, catalogProvider, catalogModel)\n      activeTurn = true; requestCount++\n      try {\n        const completion = new Promise((resolve, reject) => {\n          const listener = (_message, update) => { if (update.completed) { notifications.delete(listener); resolve(evidence.snapshot()) } }\n          notifications.add(listener)\n          supervisor.exit.then(() => { notifications.delete(listener); reject(fatal ?? new Error('CLI_EXITED_DURING_TURN')) })\n        })\n        completion.catch(() => {})\n        await rpc('turn/start', { threadId, input: [{ type: 'text', text: prompt, text_elements: [] }], model: requestedModel })\n        const result = await completion\n        await usageWrites\n        if (fatal) throw fatal\n        return { ...result, status: result.terminal === 'completed' ? 'succeeded' : 'failed' }\n      } finally { activeTurn = false }\n    },\n    async cancel() { clearTimeout(timer); return stop() },\n    async close() { clearTimeout(timer); return stop() },\n    snapshot() { return { ...evidence.snapshot(), cliTurnRequestsDispatched: requestCount,\n      actualProviderRequestCount: requestCount ? null : 0, actualProviderRequestCountStatus: requestCount ? 'not-reported-by-cli' : 'no-turn-dispatched',\n      process: rootProcess, stopEvidence, bridge: bridge.evidence, profile: profileEvidence,\n      enforcement: 'application-scope-with-cli-read-only', capabilityProbe: { peer: probe.peer, supervisor: probe.supervisor, limitations: probe.limitations } } },\n    get closed() { return closed },\n  })\n}\n", "import { spawn } from 'node:child_process'\nimport { EventEmitter } from 'node:events'\nimport { StringDecoder } from 'node:string_decoder'\nimport { access, realpath } from 'node:fs/promises'\nimport { isAbsolute, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nconst HERE = fileURLToPath(new URL('.', import.meta.url))\nconst MAX_FRAME = 262_144\n\n/** Deliberately small environment: profiles, credentials and proxy secrets are never inherited. */\nexport function privateEnvironment(home, source = process.env) {\n  const env = { HOME: home, USERPROFILE: home, APPDATA: join(home, 'appdata'), LOCALAPPDATA: join(home, 'local'),\n    CODEX_HOME: home, XDG_CACHE_HOME: join(home, 'cache'), XDG_CONFIG_HOME: join(home, 'config'),\n    XDG_DATA_HOME: join(home, 'data'), TEMP: join(home, 'tmp'), TMP: join(home, 'tmp'), TMPDIR: join(home, 'tmp'),\n    NO_COLOR: '1', PYTHONIOENCODING: 'utf-8', PYTHONUTF8: '1' }\n  for (const key of ['SystemRoot', 'windir', 'ComSpec', 'LANG', 'LC_ALL']) if (source[key]) env[key] = source[key]\n  // Fixed executable paths remove PATH lookup from both supervisor and bridge.\n  env.PATH = process.platform === 'win32' ? join(source.SystemRoot ?? 'C:\\\\Windows', 'System32') : '/usr/bin:/bin'\n  return env\n}\n\nexport async function resolveNativeHelper({ python = '/usr/bin/python3' } = {}) {\n  if (process.platform === 'win32') {\n    const executable = join(process.env.SystemRoot ?? 'C:\\\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe')\n    await access(executable)\n    return Object.freeze({ executable: await realpath(executable), prefix: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', join(HERE, 'native-peer.ps1')], platform: 'win32' })\n  }\n  if (process.platform !== 'linux' || !isAbsolute(python)) throw new Error('NATIVE_PEER_UNAVAILABLE')\n  await access(python)\n  return Object.freeze({ executable: await realpath(python), prefix: ['-u', join(HERE, 'native-peer.py')], platform: 'linux' })\n}\n\n/** Spawn a packaged native helper. It accepts one bounded JSON configuration on stdin. */\nexport function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home) } = {}) {\n  const events = new EventEmitter()\n  const args = helper.platform === 'win32' ? [...helper.prefix, '-Mode', mode] : [...helper.prefix, mode]\n  const child = spawn(helper.executable, args, { cwd: home, env, windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] })\n  let tail = '', buffer = '', bytes = 0, closed = false\n  const decoder = new StringDecoder('utf8'), cliDecoder = new StringDecoder('utf8')\n  let cliBuffer = ''\n  const frame = value => {\n    if (mode === 'supervise' && value.type === 'cli-output') {\n      if (typeof value.data !== 'string' || value.data.length > MAX_FRAME * 2) throw new Error('INVALID_CLI_FRAME')\n      cliBuffer += cliDecoder.write(Buffer.from(value.data, 'base64'))\n      if (Buffer.byteLength(cliBuffer) > MAX_FRAME) throw new Error('CLI_FRAME_LIMIT')\n      let end\n      while ((end = cliBuffer.indexOf('\\n')) >= 0) {\n        const line = cliBuffer.slice(0, end); cliBuffer = cliBuffer.slice(end + 1)\n        if (line.trim()) events.emit('message', JSON.parse(line))\n      }\n    } else events.emit(value.control ? 'control' : 'message', value)\n  }\n  const exit = new Promise(resolve => child.once('close', (code, signal) => { closed = true; events.emit('closed', { code, signal }); resolve({ code, signal }) }))\n  child.on('error', error => events.emit('failure', error))\n  child.stdin.on('error', () => {})\n  child.stderr.on('data', data => { tail = (tail + data.toString('utf8')).slice(-4096) })\n  child.stdout.on('data', chunk => {\n    bytes += chunk.length\n    buffer += decoder.write(chunk)\n    if (bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) { events.emit('failure', new Error('OUTPUT_LIMIT')); child.stdin.end(); return }\n    let end\n    while ((end = buffer.indexOf('\\n')) >= 0) {\n      const line = buffer.slice(0, end); buffer = buffer.slice(end + 1)\n      if (!line.trim()) continue\n      try { frame(JSON.parse(line)) }\n      catch { events.emit('failure', new Error('INVALID_NATIVE_FRAME')); child.stdin.end() }\n    }\n  })\n  const send = value => new Promise((resolve, reject) => {\n    const wire = JSON.stringify(value) + '\\n'\n    if (closed || Buffer.byteLength(wire) > MAX_FRAME) { reject(new Error(closed ? 'NATIVE_CLOSED' : 'INPUT_LIMIT')); return }\n    child.stdin.write(wire, error => error ? reject(error) : resolve())\n  })\n  if (spec) void send(spec).catch(error => events.emit('failure', error))\n  function waitControl(name, timeoutMs = 15_000) {\n    return new Promise((resolve, reject) => {\n      const clean = () => { clearTimeout(timer); events.off('control', control); events.off('closed', ended); events.off('failure', failed) }\n      const control = value => { if (value.control === name) { clean(); resolve(value) } }\n      const ended = () => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_FAILED: ${tail.slice(-256)}`)) }\n      const failed = error => { clean(); reject(error) }\n      const timer = setTimeout(() => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_TIMEOUT`)) }, timeoutMs)\n      events.on('control', control); events.once('closed', ended); events.once('failure', failed)\n      if (closed) ended()\n    })\n  }\n  return Object.freeze({ child, events, exit, send, waitControl, end: () => child.stdin.end(), get stderr() { return tail }, get closed() { return closed } })\n}\n\nexport async function capabilityProbe({ home, python } = {}) {\n  let proc\n  try {\n    const helper = await resolveNativeHelper({ python })\n    proc = nativeProcess(helper, 'probe', null, { home })\n    const value = await new Promise((resolve, reject) => {\n      proc.events.once('message', resolve)\n      proc.events.once('failure', reject)\n      proc.events.once('closed', () => reject(new Error('NATIVE_PROBE_FAILED')))\n    })\n    await proc.exit\n    return { ...value, helper, limitations: helper.platform === 'linux' ? ['Process groups are not an OS sandbox; adversarial unobserved daemon escape requires a cgroup/container boundary'] : [] }\n  } catch (error) { return { available: false, code: 'NATIVE_PEER_UNAVAILABLE', reason: error.message } }\n  finally { if (proc && !proc.closed) proc.end() }\n}\n\nexport async function protectProfile(helper, home) {\n  if (helper.platform !== 'win32') return\n  const proc = nativeProcess(helper, 'protect', { path: home }, { home })\n  const protectedValue = await new Promise((resolve, reject) => {\n    proc.events.once('message', resolve)\n    proc.events.once('failure', reject)\n    proc.events.once('closed', () => reject(new Error('PROFILE_ACL_FAILED')))\n  })\n  proc.end()\n  const exit = await proc.exit\n  if (!protectedValue.protected || exit.code !== 0) throw new Error('PROFILE_ACL_FAILED')\n}\n", "import { generateKeyPairSync, sign, randomBytes } from 'node:crypto'\nimport { mkdir, writeFile, mkdtemp, chmod, lstat, realpath, rmdir } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { isAbsolute, join } from 'node:path'\nimport { performance } from 'node:perf_hooks'\nimport { fileURLToPath } from 'node:url'\nimport { PolicyError } from './authority.mjs'\nimport { nativeProcess, resolveNativeHelper } from '../../cli-runtime/src/native-process.mjs'\n\nconst BRIDGE = fileURLToPath(new URL('./cli-stdio-bridge.mjs', import.meta.url))\nconst MAX_BYTES = 262_144\n\n/** CLI-grandchild handoff: public signed locator, OS peer identity, host-only capability lease. */\nexport async function createCliBootstrap({ authority, subject, binding, tools, handlers, home, ttlMs = 30_000, helper }) {\n  if (!isAbsolute(home)) throw new TypeError('An isolated absolute home is required')\n  const ownedBinding = Object.freeze({ ...binding })\n  const registry = new Map(handlers.map(handler => [handler.definition.name, handler]))\n  if (registry.size !== handlers.length || tools.some(name => !registry.has(name))) throw new TypeError('Unknown or duplicate bridge handler')\n  if (!Number.isSafeInteger(ttlMs) || ttlMs < 1000 || ttlMs > 7_200_000 || typeof authority.renew !== 'function') throw new TypeError('BOUNDED_RENEWABLE_LEASE_REQUIRED')\n  const leaseTtlMs = Math.min(30_000, ttlMs)\n  const startedAt = performance.now()\n  const native = helper ?? await resolveNativeHelper()\n  const { privateKey, publicKey } = generateKeyPairSync('ed25519')\n  const publicSpki = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url')\n  await mkdir(home, { recursive: true, mode: 0o700 })\n  await mkdir(join(home, 'tmp'), { recursive: true, mode: 0o700 })\n  const descriptorPath = join(home, `bridge-${randomBytes(12).toString('hex')}.json`)\n  // Locator has no authority. Its random name only prevents accidental collisions.\n  let socketDirectory\n  let endpoint = process.platform === 'win32' ? `dsh-cli-${randomBytes(18).toString('hex')}` : join(home, `p-${randomBytes(6).toString('hex')}.sock`)\n  if (process.platform === 'linux' && Buffer.byteLength(endpoint) > 103) {\n    // AF_UNIX limits the address length even when the private profile path is valid.\n    // Keep the signed descriptor/keys in the profile; only the socket uses an\n    // atomic, owner-only short directory. Peer PID/start-time/UID checks remain mandatory.\n    let parent=await realpath(tmpdir())\n    if(Buffer.byteLength(join(parent,'dsh-cli-XXXXXX','p.sock'))>103)parent=await realpath('/tmp')\n    socketDirectory=await mkdtemp(join(parent,'dsh-cli-'))\n    await chmod(socketDirectory,0o700)\n    const stat=await lstat(socketDirectory)\n    if(!stat.isDirectory()||stat.isSymbolicLink()||stat.uid!==process.getuid()||(stat.mode&0o077)!==0){await rmdir(socketDirectory);throw new Error('PRIVATE_SOCKET_DIRECTORY_REQUIRED')}\n    endpoint=join(socketDirectory,'p.sock')\n    if(Buffer.byteLength(endpoint)>103){await rmdir(socketDirectory);throw new Error('PRIVATE_SOCKET_PATH_TOO_LONG')}\n  }\n  let lease\n  try{lease=authority.issue(subject,{binding:ownedBinding,tools,ttlMs:leaseTtlMs})}\n  catch(error){if(socketDirectory)await rmdir(socketDirectory);throw error}\n  let relay, closed = false, bound = false, connected = false, closing\n  let accepted, rejected = 0, requests = 0, replies = 0\n  const active = new Map()\n  const release = () => { authority.release(lease.token); for (const controller of active.values()) controller.abort(new Error('BRIDGE_CLOSED')) }\n  const reply = (id, value) => {\n    if (!relay || relay.closed) return\n    replies++\n    const wire = { type: 'response', id, ...value }\n    void relay.send(Buffer.byteLength(JSON.stringify(wire)) > MAX_BYTES ? { type: 'response', id, ok: false, code: 'OUTPUT_LIMIT' } : wire).catch(() => {})\n  }\n  async function request(message) {\n    requests++\n    if (!message || !Number.isSafeInteger(message.id) || message.id < 1) return\n    if (message.type === 'cancel') { active.get(message.id)?.abort(new Error('REQUEST_CANCELLED')); return }\n    if (message.type !== 'request') return\n    const id = message.id\n    try {\n      if (closed) throw new PolicyError('BRIDGE_CLOSED')\n      if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES || Object.keys(message).some(key => !['type', 'id', 'op', 'name', 'args'].includes(key))) throw new PolicyError('INVALID_REQUEST')\n      if (active.has(id) || active.size >= 16) throw new PolicyError('BUSY')\n      if (message.op === 'list') { reply(id, { ok: true, value: authority.list(lease.token, ownedBinding).map(name => registry.get(name).definition) }); return }\n      if (message.op !== 'call') throw new PolicyError('INVALID_REQUEST')\n      const controller = new AbortController(); active.set(id, controller)\n      try {\n        const value = await authority.run(lease.token, ownedBinding, message.name, ({ signal }) => {\n          const handler = registry.get(message.name)\n          return handler.execute(handler.parse(message.args), { signal, binding: ownedBinding })\n        }, { signal: controller.signal })\n        reply(id, { ok: true, value })\n      } finally { active.delete(id) }\n    } catch (error) { reply(id, { ok: false, code: error instanceof PolicyError ? error.code : 'HANDLER_REFUSED' }) }\n  }\n  const close = () => {\n    if (closing) return closing\n    closed = true; release(); clearTimeout(expiry); clearInterval(renewal)\n    closing = (async () => {\n      if(relay){\n        relay.end()\n        const stopped = await Promise.race([relay.exit.then(() => true), new Promise(resolve => { const t = setTimeout(() => resolve(false), 3000); t.unref() })])\n        if (!stopped) { relay.child.kill(); await relay.exit }\n      }\n      // Nonrecursive cleanup only; an unexpected file is preserved for diagnosis.\n      if(socketDirectory)await rmdir(socketDirectory).catch(()=>{})\n    })()\n    return closing\n  }\n  const expiry = setTimeout(() => { void close() }, ttlMs); expiry.unref()\n  const renewal = setInterval(() => {\n    try { if (!closed) authority.renew(lease.token, ownedBinding, { ttlMs: Math.min(leaseTtlMs, Math.max(1, Math.floor(ttlMs - (performance.now() - startedAt)))) }) }\n    catch { void close() }\n  }, Math.max(100, Math.floor(leaseTtlMs / 3))); renewal.unref()\n  const bind = async ({ pid, start }) => {\n    if (closed || bound || !Number.isSafeInteger(pid) || pid < 1 || typeof start !== 'string') throw new Error('INVALID_CLI_BINDING')\n    authority.list(lease.token, ownedBinding)\n    bound = true\n    const remaining = Math.floor(ttlMs - (performance.now() - startedAt))\n    if (remaining < 1) { await close(); throw new Error('BOOTSTRAP_EXPIRED') }\n    relay = nativeProcess(native, 'server', { endpoint, rootPid: pid, rootStart: start, ttlMs: remaining }, { home })\n    relay.events.on('message', message => { void request(message) })\n    relay.events.on('control', value => {\n      if (value.control === 'accepted') { accepted = value; connected = true }\n      if (value.control === 'rejected') rejected++\n    })\n    relay.events.once('closed', () => { closed = true; release(); clearTimeout(expiry); clearInterval(renewal) })\n    relay.events.once('failure', () => { void close() })\n    const server = await relay.waitControl('listening')\n    const payload = JSON.stringify({ version: 1, endpoint, serverPid: server.pid, serverStart: server.start,\n      rootPid: pid, rootStart: start, expiresAt: Date.now() + Math.min(15_000, remaining), sessionExpiresAt: Date.now() + remaining, ttlMs: remaining,\n      helper: native, hostPid: process.pid, binding: ownedBinding })\n    const descriptor = JSON.stringify({ payload, signature: sign(null, Buffer.from(payload), privateKey).toString('base64url') })\n    await writeFile(descriptorPath, descriptor, { flag: 'wx', mode: 0o600 })\n  }\n  return Object.freeze({ command: process.execPath, args: [BRIDGE, descriptorPath, publicSpki], descriptorPath,\n    bind, close, get closed() { return closed }, get connected() { return connected },\n    get evidence() { return { binding: ownedBinding, connected, peer: accepted ?? null, rejectedPeers: rejected, requests, replies, nativeError: relay?.stderr ?? '', bearerInArgvOrEnv: false, closed } } })\n}\n", "import { createHash, randomBytes } from 'node:crypto'\nimport { performance } from 'node:perf_hooks'\n\nexport class PolicyError extends Error {\n  constructor(code) { super(`Capability refused: ${code}`); this.name = 'PolicyError'; this.code = code }\n}\n\nconst refuse = code => { throw new PolicyError(code) }\nconst identifier = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value)\nconst names = values => {\n  if (!Array.isArray(values) || values.some(value => typeof value !== 'string' || !value || value.length > 256)) refuse('INVALID_GRANT')\n  return new Set(values)\n}\nconst digest = value => createHash('sha256').update(value).digest('hex')\nconst routeKey = (provider, model) => JSON.stringify([provider, model])\nconst routes = values => {\n  if (!Array.isArray(values)) refuse('INVALID_GRANT')\n  return new Set(values.map(value => {\n    if (!value || Object.keys(value).some(key => !['provider', 'model'].includes(key)) ||\n        typeof value.provider !== 'string' || !value.provider || value.provider.length > 256 ||\n        typeof value.model !== 'string' || !value.model || value.model.length > 256) refuse('INVALID_GRANT')\n    return routeKey(value.provider, value.model)\n  }))\n}\n\nfunction bindingOf(input) {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) refuse('INVALID_BINDING')\n  if (Object.keys(input).some(key => !['taskId', 'attemptId', 'machineId', 'workspaceId', 'location'].includes(key))) refuse('INVALID_BINDING')\n  for (const key of ['taskId', 'attemptId', 'machineId', 'workspaceId']) if (!identifier(input[key])) refuse('INVALID_BINDING')\n  if (!['local', 'remote'].includes(input.location)) refuse('INVALID_BINDING')\n  return JSON.stringify([input.taskId, input.attemptId, input.machineId, input.workspaceId, input.location])\n}\n\n/** Experimental in-memory authority. Host-owned object identities never come from JSON. */\nexport function createAuthority({ now = () => performance.now(), maxTtlMs = 300_000, maxLeases = 256 } = {}) {\n  if (!Number.isSafeInteger(maxTtlMs) || maxTtlMs < 1 || maxTtlMs > 300_000) refuse('INVALID_TTL')\n  if (!Number.isSafeInteger(maxLeases) || maxLeases < 1 || maxLeases > 4096) refuse('INVALID_LIMIT')\n  const subjects = new WeakMap()\n  const botIds = new Set()\n  const leases = new Map()\n  let disposed = false\n\n  const subjectOf = subject => {\n    if (disposed) refuse('AUTHORITY_CLOSED')\n    const value = subject && typeof subject === 'object' ? subjects.get(subject) : undefined\n    if (!value) refuse('UNKNOWN_SUBJECT')\n    if (value.revoked) refuse('SUBJECT_REVOKED')\n    return value\n  }\n  const cancel = (lease, code) => {\n    for (const controller of lease.active) controller.abort(new PolicyError(code))\n    leases.delete(lease.key)\n  }\n  const validLease = (token, binding) => {\n    if (disposed) refuse('AUTHORITY_CLOSED')\n    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) refuse('UNKNOWN_LEASE')\n    const lease = leases.get(digest(token))\n    if (!lease) refuse('UNKNOWN_LEASE')\n    if (now() >= lease.expiresAt) { cancel(lease, 'LEASE_EXPIRED'); refuse('LEASE_EXPIRED') }\n    const principal = subjectOf(lease.subject)\n    if (principal.revision !== lease.revision) { cancel(lease, 'GRANT_CHANGED'); refuse('GRANT_CHANGED') }\n    if (bindingOf(binding) !== lease.binding) refuse('BINDING_MISMATCH')\n    return lease\n  }\n  const invalidateSubject = (subject, code) => {\n    for (const lease of [...leases.values()]) if (lease.subject === subject) cancel(lease, code)\n  }\n\n  return Object.freeze({\n    register(subject, { botId, tools = [], modelRoutes = [] }) {\n      if (disposed) refuse('AUTHORITY_CLOSED')\n      if (!subject || typeof subject !== 'object' || !identifier(botId)) refuse('INVALID_SUBJECT')\n      if (subjects.has(subject) || botIds.has(botId)) refuse('DUPLICATE_SUBJECT')\n      const state = { botId, tools: names(tools), models: routes(modelRoutes), revision: 1, revoked: false }\n      subjects.set(subject, state)\n      botIds.add(botId)\n    },\n    assertTool(subject, name) {\n      if (!subjectOf(subject).tools.has(name)) refuse('TOOL_DENIED')\n    },\n    describe(subject) {\n      const value = subjectOf(subject)\n      return Object.freeze({ botId: value.botId, revision: value.revision })\n    },\n    assertModel(subject, provider, model) {\n      if (typeof provider !== 'string' || typeof model !== 'string' || !subjectOf(subject).models.has(routeKey(provider, model))) refuse('MODEL_DENIED')\n    },\n    replaceGrant(subject, { tools = [], modelRoutes = [] }) {\n      const state = subjectOf(subject)\n      const nextTools = names(tools)\n      const nextModels = routes(modelRoutes)\n      state.tools = nextTools\n      state.models = nextModels\n      state.revision++\n      invalidateSubject(subject, 'GRANT_CHANGED')\n    },\n    revoke(subject) {\n      const state = subjectOf(subject)\n      state.revoked = true\n      state.revision++\n      invalidateSubject(subject, 'SUBJECT_REVOKED')\n    },\n    issue(subject, { binding, tools, ttlMs = 30_000 }) {\n      const principal = subjectOf(subject)\n      const encoded = bindingOf(binding)\n      const selected = names(tools)\n      if ([...selected].some(name => !principal.tools.has(name))) refuse('TOOL_DENIED')\n      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > maxTtlMs) refuse('INVALID_TTL')\n      for (const lease of [...leases.values()]) if (now() >= lease.expiresAt) cancel(lease, 'LEASE_EXPIRED')\n      if (leases.size >= maxLeases) refuse('LEASE_LIMIT')\n      const token = randomBytes(32).toString('base64url')\n      const key = digest(token)\n      leases.set(key, { key, subject, revision: principal.revision, binding: encoded,\n        tools: selected, expiresAt: now() + ttlMs, active: new Set() })\n      return Object.freeze({ token, ttlMs })\n    },\n    list(token, binding) { return [...validLease(token, binding).tools].sort() },\n    renew(token, binding, { ttlMs = 30_000 } = {}) {\n      // Host-only in-memory token. Expired leases and old revisions never revive.\n      const lease = validLease(token, binding)\n      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > maxTtlMs) refuse('INVALID_TTL')\n      lease.expiresAt = now() + ttlMs\n      return Object.freeze({ ttlMs })\n    },\n    async run(token, binding, toolName, execute, { signal } = {}) {\n      const lease = validLease(token, binding)\n      if (!lease.tools.has(toolName)) refuse('TOOL_DENIED')\n      if (typeof execute !== 'function') refuse('INVALID_HANDLER')\n      const controller = new AbortController()\n      lease.active.add(controller)\n      let timer\n      const checkExpiry = () => {\n        if (!leases.has(lease.key)) return\n        if (now() < lease.expiresAt) { timer = setTimeout(checkExpiry, Math.max(1, Math.ceil(lease.expiresAt - now()))); return }\n        cancel(lease, 'LEASE_EXPIRED')\n        controller.abort(new PolicyError('LEASE_EXPIRED'))\n      }\n      timer = setTimeout(checkExpiry, Math.max(1, Math.ceil(lease.expiresAt - now())))\n      const combined = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal\n      try {\n        combined.throwIfAborted()\n        const value = await execute({ signal: combined })\n        combined.throwIfAborted()\n        validLease(token, binding)\n        return value\n      } finally {\n        clearTimeout(timer)\n        lease.active.delete(controller)\n      }\n    },\n    release(token) {\n      if (typeof token !== 'string') return\n      const lease = leases.get(digest(token))\n      if (lease) cancel(lease, 'LEASE_RELEASED')\n    },\n    dispose() {\n      if (disposed) return\n      disposed = true\n      for (const lease of [...leases.values()]) cancel(lease, 'AUTHORITY_CLOSED')\n    },\n  })\n}\n", "const count = value => Number.isSafeInteger(value) && value >= 0 ? value : null\n\n/** Unknown stays null. Cached/reasoning counts are components, never added twice. */\nexport function usageBreakdown(value) {\n  return Object.freeze({ inputTokens: count(value?.inputTokens), outputTokens: count(value?.outputTokens),\n    cachedInputTokens: count(value?.cachedInputTokens), cacheWriteInputTokens: count(value?.cacheWriteInputTokens),\n    reasoningOutputTokens: count(value?.reasoningOutputTokens), totalTokens: count(value?.totalTokens) })\n}\n\nexport function createCodexEvidence({ binding, operationId, botId, requestedModel, catalogModel = requestedModel, catalogProvider = 'openai', entry, billing = 'subscription' }) {\n  if (!['subscription', 'api', 'unknown'].includes(billing)) throw new TypeError('INVALID_CLI_BILLING')\n  let threadId = null, turnId = null, reportedModel = null, reportedProvider = null\n  let usage = usageBreakdown(), seenUsage = false, mismatch = false, finished = null, finalText = '', failure = null\n  const reroutes = []\n  return Object.freeze({\n    bindThread(result) {\n      threadId = result?.thread?.id ?? null\n      reportedModel = typeof result?.model === 'string' ? result.model : null\n      reportedProvider = typeof result?.modelProvider === 'string' ? result.modelProvider : null\n      mismatch = reportedModel !== requestedModel || reportedProvider !== 'openai'\n      if (!threadId || mismatch) throw new Error('CLI_MODEL_IDENTITY_MISMATCH')\n    },\n    event(message) {\n      const params = message?.params\n      if (!params || params.threadId !== threadId) return { accepted: false }\n      if (turnId && params.turnId && params.turnId !== turnId) return { accepted: false }\n      if (message.method === 'turn/started') turnId = params.turn?.id ?? turnId\n      if (message.method === 'thread/tokenUsage/updated') {\n        turnId ??= params.turnId\n        // Each notification is cumulative for a thread. Repeated snapshots do not create extra receipts.\n        usage = usageBreakdown(params.tokenUsage?.total); seenUsage = true\n        return { accepted: true, usageChanged: true }\n      }\n      if (message.method === 'model/rerouted') {\n        reroutes.push({ fromModel: params.fromModel ?? null, toModel: params.toModel ?? null, reason: params.reason ?? null })\n        if (params.toModel !== requestedModel) mismatch = true\n      }\n      if (message.method === 'item/completed' && params.item?.type === 'agentMessage' && typeof params.item.text === 'string') finalText = params.item.text\n      if (message.method === 'turn/completed') {\n        turnId ??= params.turn?.id\n        finished = params.turn?.status ?? 'unknown'\n        failure = params.turn?.error ? { code: params.turn.error.codexErrorInfo ?? null, message: String(params.turn.error.message ?? '').slice(0, 512) } : null\n      }\n      return { accepted: true, mismatch, completed: message.method === 'turn/completed' }\n    },\n    snapshot() {\n      return { schemaVersion: 1, source: 'cli', toolId: 'codex', botId, ...binding, operationId,\n        receiptId: threadId && turnId ? `codex:${operationId}:${threadId}:${turnId}` : null,\n        threadId, turnId, entry: { path: entry.path, sha256: entry.sha256, version: entry.version },\n        identity: { catalogProvider, catalogModel, requestedCliModel: requestedModel, reportedCliModel: reportedModel,\n          reportedProvider, actualResponseModel: null, verification: mismatch ? 'mismatch' : reportedModel ? 'cli-configured-model' : 'unreported',\n          actualResponseModelVerified: false, reroutes: [...reroutes] },\n        usage: { ...usage, reported: seenUsage, status: seenUsage && Object.values(usage).every(value => value !== null) ? 'complete' : seenUsage ? 'partial' : 'unknown' },\n        billing: { kind: billing, amountUsd: null, amountStatus: billing === 'subscription' ? 'not-applicable' : 'unknown' },\n        terminal: mismatch ? 'identity-mismatch' : finished, finalText, failure,\n        limitations: ['Codex thread/start reports the configured model; this protocol does not prove the response backend model', 'An independent profile and MCP scope do not provide OS file isolation'] }\n    },\n  })\n}\n", "/** Host configuration only. Endpoints are kept in the private profile, never argv, receipts or diagnostics. */\nexport function providerSettings(input = {}) {\n  if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(key => !['openaiBaseUrl', 'chatgptBaseUrl'].includes(key))) throw new TypeError('INVALID_PROVIDER_SETTINGS')\n  const entries = []\n  for (const [source, target] of [['openaiBaseUrl', 'openai_base_url'], ['chatgptBaseUrl', 'chatgpt_base_url']]) {\n    if (input[source] === undefined) continue\n    let url\n    try { url = new URL(input[source]) } catch { throw new TypeError('INVALID_PROVIDER_ENDPOINT') }\n    if (typeof input[source] !== 'string' || input[source].length > 2048 || url.username || url.password || url.search || url.hash ||\n      !(url.protocol === 'https:' || url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) throw new TypeError('INVALID_PROVIDER_ENDPOINT')\n    entries.push([target, input[source]])\n  }\n  return Object.freeze({ lines: entries.map(([key, value]) => `${key} = ${JSON.stringify(value)}`),\n    configuredKeys: entries.map(([key]) => key), values: Object.fromEntries(entries) })\n}\n\n/** An inherited system/project config cannot add a second MCP or change our native bridge. */\nexport function assertEffectiveProfile(result, { requestedModel, bridge, home, tools, settings }) {\n  const config = result?.config\n  if (!config || config.model !== requestedModel || config.model_provider !== 'openai' || config.approval_policy !== 'never' || config.sandbox_mode !== 'read-only') throw new Error('CLI_EFFECTIVE_PROFILE_MISMATCH')\n  const servers = config.mcp_servers\n  if (!servers || Object.keys(servers).length !== 1 || !servers.dsh_task) throw new Error('CLI_EXTRA_OR_MISSING_MCP')\n  const server = servers.dsh_task\n  if (server.command !== bridge.command || JSON.stringify(server.args) !== JSON.stringify(bridge.args) ||\n    server.cwd !== home || server.required !== true || JSON.stringify(server.enabled_tools) !== JSON.stringify(tools)) throw new Error('CLI_EFFECTIVE_BRIDGE_MISMATCH')\n  for (const [key, value] of Object.entries(settings.values)) if (config[key] !== value) throw new Error('CLI_PROVIDER_SETTINGS_MISMATCH')\n  return { isolatedMcpServers: ['dsh_task'], explicitProviderSettingKeys: [...settings.configuredKeys] }\n}\n", "import http from 'node:http'\nimport https from 'node:https'\nimport { readFileSync } from 'node:fs'\nimport { networkInterfaces } from 'node:os'\nimport {isIP} from 'node:net'\nimport { Server, WebStandardStreamableHTTPServerTransport, SUPPORTED_PROTOCOL_VERSIONS } from '@modelcontextprotocol/server'\nimport { AgentError, AGENT_VERSION, CATALOG, fail } from './protocol.js'\nimport type { Agent } from './agent.js'\nimport {AuthThrottle,validateAuthLimits,type AuthLimits} from './auth-throttle.js'\nimport {WebSocketServer} from 'ws'\nexport type NetworkConfig={mode?:'loopback'|'wireguard'|'tailscale'|'cloudflare-tunnel'|'public-tls';host?:string;port?:number;protectedTunnel?:boolean;allowedHosts?:string[];allowedOrigins?:string[];trustedProxies?:string[];authLimits?:AuthLimits;tls?:{keyFile:string;certFile:string;caFile?:string;requireClientCertificate?:boolean}}\nconst loopback=(host:string)=>['127.0.0.1','::1','::ffff:127.0.0.1'].includes(host)\nexport function validateNetwork(c:NetworkConfig){const host=c.host??'127.0.0.1',mode=c.mode??'loopback';if(['0.0.0.0','::','localhost'].includes(host))fail('BIND_ADDRESS_REQUIRED')\n  if(!isIP(host)||c.port!==undefined&&(!Number.isSafeInteger(c.port)||c.port<0||c.port>65535))fail('INVALID_NETWORK_CONFIG')\n  for(const key of ['allowedHosts','allowedOrigins','trustedProxies'] as const)if(c[key]!==undefined&&(!Array.isArray(c[key])||c[key]!.length>128||c[key]!.some(value=>typeof value!=='string'||!value||value.length>512||/[\\s\\u0000-\\u001f\\u007f]/.test(value))))fail('INVALID_NETWORK_CONFIG')\n  if(c.trustedProxies?.some(value=>!isIP(value)))fail('INVALID_NETWORK_CONFIG')\n  if(c.allowedOrigins?.some(value=>{try{const url=new URL(value);return !['http:','https:'].includes(url.protocol)||url.origin!==value}catch{return true}}))fail('INVALID_NETWORK_CONFIG')\n  if(c.allowedHosts?.some(value=>{try{const url=new URL(`http://${value}`);return url.host!==value.toLowerCase()||url.pathname!=='/'||!!url.username||!!url.password||!!url.search||!!url.hash}catch{return true}}))fail('INVALID_NETWORK_CONFIG')\n  validateAuthLimits(c.authLimits)\n  if(c.tls?.requireClientCertificate&&!c.tls.caFile)fail('MTLS_CA_REQUIRED')\n  if(mode==='loopback'&&!loopback(host))fail('TLS_REQUIRED')\n  if(['wireguard','tailscale'].includes(mode)){if(!Object.values(networkInterfaces()).flat().some(x=>x?.address===host))fail('BIND_INTERFACE_NOT_FOUND');if(!c.tls&&!c.protectedTunnel)fail('TUNNEL_ATTESTATION_REQUIRED')}\n  if(mode==='cloudflare-tunnel'&&(!loopback(host)||!c.protectedTunnel))fail('TUNNEL_BACKEND_MUST_BE_LOOPBACK')\n  if(mode==='public-tls'&&!c.tls&&(!loopback(host)||!c.trustedProxies?.length))fail('TLS_REQUIRED')\n  if(!c.tls&&!loopback(host)&&!c.protectedTunnel)fail('TLS_REQUIRED')\n  if(!['loopback','wireguard','tailscale','cloudflare-tunnel','public-tls'].includes(mode))fail('INVALID_NETWORK_MODE')\n}\nexport async function serve(agent:Agent,c:NetworkConfig={}){\n  c=structuredClone(c);validateNetwork(c);const throttle=new AuthThrottle(c.authLimits),host=c.host??'127.0.0.1'\n  const requestBoundary=(req:http.IncomingMessage,upgrade=false)=>{\n    const address=server.address() as any,defaultHost=`${host.includes(':')?`[${host}]`:host}:${address.port}`\n    if(!(c.allowedHosts??[defaultHost]).includes(req.headers.host??''))fail('HOST_DENIED',403)\n    const origin=req.headers.origin\n    if(origin!==undefined&&!(c.allowedOrigins??[]).includes(origin)&&!(upgrade&&agent.desktopSessions.hasOrigin(origin)))fail('ORIGIN_DENIED',403)\n    if(c.mode==='public-tls'&&!c.tls&&(!(c.trustedProxies??[]).includes(req.socket.remoteAddress??'unknown')||req.headers['x-forwarded-proto']!=='https'))fail('TLS_REQUIRED',403)\n    return defaultHost\n  }\n  const handler=async(req:http.IncomingMessage,res:http.ServerResponse)=>{\n    let context:any;const source=req.socket.remoteAddress??'unknown';const json=(status:number,value:any)=>{res.writeHead(status,{'content-type':'application/json','cache-control':'no-store','x-content-type-options':'nosniff'});res.end(JSON.stringify(value))}\n    try{\n      const defaultHost=requestBoundary(req)\n      const reject=(decision:ReturnType<AuthThrottle['failure']>)=>{\n        if(decision.audit)agent.store.audit(decision.code)\n        if(decision.retryAfterMs)res.setHeader('retry-after',String(Math.max(1,Math.ceil(decision.retryAfterMs/1000))))\n        fail(decision.code,decision.status)\n      }\n      const auth=req.headers.authorization??'';if(!/^Bearer [A-Za-z0-9_-]{43}$/.test(auth)){reject(throttle.failure(source))}\n      const url=new URL(req.url??'/',`http://${defaultHost}`);let client:any\n      const authenticate=()=>{try{if(url.pathname.startsWith('/control/v1/'))client=agent.store.client(auth.slice(7));else context=agent.store.grant(auth.slice(7))}catch{reject(throttle.failure(source))}}\n      authenticate()\n      // Valid credentials bypass anonymous source cooldown, including shared proxies.\n      const limited=throttle.authenticated(client?.id??context.clientId,client?.revision??context.revision)\n      if(limited)reject(limited)\n      if(req.method!=='POST'){json(405,{error:{code:'METHOD_NOT_ALLOWED'}});return}\n      let body=Buffer.alloc(0);for await(const chunk of req){body=Buffer.concat([body,chunk]);if(body.length>2097152)fail('REQUEST_TOO_LARGE',413)}\n      let parsed:any;try{parsed=JSON.parse(body.toString('utf8'))}catch{fail('INVALID_JSON')}\n      // Rotation/revocation can happen while the authenticated body is arriving.\n      // A cached pre-body identity cannot authorize a later management action.\n      authenticate()\n      if(url.pathname==='/control/v1/grants'){json(200,agent.store.issue(client,parsed));return}\n      if(url.pathname==='/control/v1/grants/revoke'){const result=agent.store.revokeGrants(client,parsed);await agent.desktopSessions.sweep();json(200,result);return}\n      if(url.pathname==='/desktop/v1/session'){json(200,await agent.desktopSessions.open(context,parsed));return}\n      if(url.pathname==='/desktop/v1/session/renew'){json(200,await agent.desktopSessions.renew(context,parsed));return}\n      if(url.pathname==='/desktop/v1/session/close'){json(200,await agent.desktopSessions.closeSession(context,parsed));return}\n      if(url.pathname!=='/mcp')fail('NOT_FOUND',404)\n      const mcp=new Server({name:'dsh-remote-computer-agent',version:AGENT_VERSION},{capabilities:{tools:{}},supportedProtocolVersions:SUPPORTED_PROTOCOL_VERSIONS})\n      const transport=new WebStandardStreamableHTTPServerTransport({enableJsonResponse:true,sessionIdGenerator:undefined,maxRequestBodySize:2097152})\n      mcp.setRequestHandler('tools/list',async()=>{agent.store.validate(context);return {tools:CATALOG.filter(x=>context.tools.includes(x.name)).map(x=>({name:x.name,description:`Remote ${x.name}`,inputSchema:x.inputSchema,annotations:{readOnlyHint:!x.mutating,destructiveHint:x.mutating}}))}})\n      mcp.setRequestHandler('tools/call',async(request:any)=>{try{const meta=request.params._meta??{},args=request.params.arguments??{};if(Object.hasOwn(args,'operationId')&&request.params.name!=='operation_status'&&request.params.name!=='operation_cancel')fail('CONTEXT_MUST_BE_HOST_METADATA')\n          const result=await agent.call(request.params.name,args,context,meta['dsh/operationId']);agent.store.audit('TOOL_RESULT',context.botId,meta['dsh/operationId']??null);return {content:[{type:'text',text:JSON.stringify(result)}],structuredContent:result}\n        }catch(e){const code=e instanceof AgentError?e.code:'EXECUTION_FAILED';agent.store.audit(code,context.botId);return {isError:true,content:[{type:'text',text:code}]}}})\n      await mcp.connect(transport)\n      try{const response=await transport.handleRequest(new Request(`http://${defaultHost}/mcp`,{method:'POST',headers:req.headers as any,body:body.toString('utf8')}),{parsedBody:parsed});res.writeHead(response.status,Object.fromEntries(response.headers));res.end(Buffer.from(await response.arrayBuffer()))}finally{await mcp.close()}\n    }catch(e){json(e instanceof AgentError?e.status:500,{error:{code:e instanceof AgentError?e.code:'AGENT_INTERNAL'}})}\n  }\n  const tls=c.tls?{key:readFileSync(c.tls.keyFile),cert:readFileSync(c.tls.certFile),ca:c.tls.caFile?readFileSync(c.tls.caFile):undefined,requestCert:!!c.tls.requireClientCertificate,rejectUnauthorized:!!c.tls.requireClientCertificate}:null\n  const server=tls?https.createServer(tls,handler):http.createServer(handler);server.requestTimeout=30000;server.headersTimeout=10000;server.maxConnections=128\n  const websocket=new WebSocketServer({noServer:true,clientTracking:true,maxPayload:65536,perMessageDeflate:false})\n  server.on('upgrade',(req,socket,head)=>{\n    try{\n      const defaultHost=requestBoundary(req,true),url=new URL(req.url??'/',`http://${defaultHost}`)\n      if(url.pathname!=='/desktop/v1/socket'||url.search)fail('NOT_FOUND',404)\n      if(websocket.clients.size>=16)fail('DESKTOP_CONNECTION_LIMIT',429)\n      websocket.handleUpgrade(req,socket,head,ws=>{websocket.emit('connection',ws,req);agent.desktopSessions.accept(ws,req.headers.origin,c.allowedOrigins??[])})\n    }catch(e){const status=e instanceof AgentError?e.status:500;socket.end(`HTTP/1.1 ${status} Rejected\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\n\\r\\n`)}\n  })\n  await new Promise<void>((resolve,reject)=>{server.once('error',reject);server.listen(c.port??9701,host,()=>resolve())})\n  return {server,address:server.address(),supportedMcpVersions:SUPPORTED_PROTOCOL_VERSIONS,close:async()=>{await agent.desktopSessions.close();for(const client of websocket.clients)client.terminate();await new Promise<void>(resolve=>websocket.close(()=>resolve()));await new Promise<void>((resolve,reject)=>server.close(e=>e?reject(e):resolve()))}}\n}\n", "import {fail} from './protocol.js'\n\nexport type AuthLimits={windowMs?:number;failureThreshold?:number;baseBackoffMs?:number;maxBackoffMs?:number;maxSources?:number;maxClients?:number;globalFailureLimit?:number;clientRequestLimit?:number}\ntype Decision={status:401|429;code:'AUTH_INVALID'|'AUTH_RATE_LIMIT';retryAfterMs:number;audit:boolean}\ntype Source={start:number;failures:number;until:number}\ntype Client={start:number;requests:number;revision:number;limited:boolean}\nconst defaults={windowMs:60000,failureThreshold:5,baseBackoffMs:1000,maxBackoffMs:30000,maxSources:1024,maxClients:1024,globalFailureLimit:128,clientRequestLimit:120}\nexport function validateAuthLimits(input:AuthLimits={}){\n  const limits={...defaults,...input}\n  if(!input||typeof input!=='object'||Array.isArray(input)||Object.keys(input).some(key=>!Object.hasOwn(defaults,key)))fail('INVALID_AUTH_LIMITS')\n  const bounds={windowMs:[100,3600000],failureThreshold:[1,100],baseBackoffMs:[10,30000],maxBackoffMs:[10,30000],maxSources:[1,4096],maxClients:[1,4096],globalFailureLimit:[1,10000],clientRequestLimit:[1,10000]}\n  for(const key of Object.keys(bounds) as (keyof typeof defaults)[]){const [min,max]=bounds[key];if(!Number.isSafeInteger(limits[key])||limits[key]<min||limits[key]>max)fail('INVALID_AUTH_LIMITS')}\n  if(limits.baseBackoffMs>limits.maxBackoffMs||limits.maxBackoffMs>limits.windowMs)fail('INVALID_AUTH_LIMITS')\n  return Object.freeze(limits)\n}\n\n/** Anonymous inputs never establish a client identity or consume its allowance. */\nexport class AuthThrottle {\n  private sources=new Map<string,Source>();private clients=new Map<string,Client>()\n  private global={start:0,failures:0,limited:false}\n  readonly limits:ReturnType<typeof validateAuthLimits>\n  constructor(options:AuthLimits={},private now=Date.now){this.limits=validateAuthLimits(options)}\n  private save<T>(map:Map<string,T>,key:string,value:T,max:number){map.delete(key);map.set(key,value);while(map.size>max)map.delete(map.keys().next().value!)}\n  failure(source:string):Decision{\n    const now=this.now(),p=this.limits\n    if(now-this.global.start>=p.windowMs||now<this.global.start)this.global={start:now,failures:0,limited:false}\n    if(this.global.failures>=p.globalFailureLimit){const audit=!this.global.limited;this.global.limited=true;return {status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:this.global.start+p.windowMs-now,audit}}\n    let row=this.sources.get(source)\n    if(row&&now<row.start)row=undefined\n    if(row&&row.until>now)return {status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:row.until-now,audit:false}\n    if(!row||now-row.start>=p.windowMs||now<row.start)row={start:now,failures:0,until:0}\n    this.global.failures++;row.failures++\n    if(row.failures>=p.failureThreshold)row.until=now+Math.min(p.maxBackoffMs,p.baseBackoffMs*2**Math.min(16,row.failures-p.failureThreshold))\n    this.save(this.sources,source,row,p.maxSources)\n    return row.until>now?{status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:row.until-now,audit:true}:{status:401,code:'AUTH_INVALID',retryAfterMs:0,audit:true}\n  }\n  // clientId and revision come only from Store.client/grant's checked rows.\n  authenticated(clientId:string,revision:number):Decision|null{\n    const now=this.now(),p=this.limits;let row=this.clients.get(clientId)\n    if(!row||row.revision!==revision||now-row.start>=p.windowMs||now<row.start)row={start:now,requests:0,revision,limited:false}\n    if(row.requests>=p.clientRequestLimit){const audit=!row.limited;row.limited=true;return {status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:row.start+p.windowMs-now,audit}}\n    row.requests++;this.save(this.clients,clientId,row,p.maxClients);return null\n  }\n  stats(){return {sources:this.sources.size,clients:this.clients.size,globalFailures:this.global.failures}}\n}\n"],
-  "mappings": ";;;AACA,SAAS,YAAAA,WAAU,aAAAC,YAAW,SAAAC,cAAa;AAC3C,SAAS,WAAAC,UAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACFvC,SAAS,YAAAC,WAAU,aAAAC,YAAW,SAAAC,QAAO,QAAQ,UAAAC,SAAe,QAAAC,OAAM,YAAAC,iBAAgB;AAClF,SAAS,QAAAC,OAAM,SAAS,WAAAC,gBAAe;AACvC,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,SAAAC,QAAO,YAAAC,iBAAgB;AAChC,SAAS,aAAAC,kBAAiB;;;ACJ1B,SAAS,YAAY,aAAa,uBAAuB;AAClD,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,aAAN,cAAyB,MAAM;AAAA,EAAE,YAAmB,MAAoB,SAAO,KAAK;AAAE,UAAM,IAAI;AAA5C;AAAoB;AAAA,EAA0B;AAAA,EAA9C;AAAA,EAAoB;AAA4B;AACpG,IAAM,OAAO,CAAC,MAAY,SAAO,QAAc;AAAE,QAAM,IAAI,WAAW,MAAK,MAAM;AAAE;AACnF,IAAM,SAAS,MAAM,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,IAAM,MAAM,CAAC,UAAwB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACpF,IAAM,UAAU,CAAC,OAAcC,YAAkB;AAAE,QAAM,IAAE,OAAO,KAAK,IAAI,KAAK,GAAE,KAAK,GAAE,IAAE,OAAO,KAAKA,SAAO,KAAK;AAAG,SAAO,EAAE,WAAS,EAAE,UAAU,gBAAgB,GAAE,CAAC;AAAE;AACzK,SAAS,UAAU,GAAc;AAAE,MAAG,MAAI,QAAM,OAAO,MAAI,SAAS,QAAO,KAAK,UAAU,CAAC;AAAE,MAAG,MAAM,QAAQ,CAAC,EAAE,QAAO,IAAI,EAAE,IAAI,SAAS,EAAE,KAAK,GAAG,CAAC;AAAI,SAAO,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,OAAG,GAAG,KAAK,UAAU,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAI;AAC1P,SAAS,WAAW,GAAc;AAAE,MAAG,OAAO,MAAI,YAAU,CAAC,0BAA0B,KAAK,CAAC,EAAE,MAAK,YAAY;AAAE,SAAO;AAAE;AAC3H,SAAS,QAAQ,GAAM,KAAW,KAAW,cAAsB;AAAE,QAAM,IAAE,KAAG;AAAa,MAAG,CAAC,OAAO,cAAc,CAAC,KAAG,IAAE,OAAK,IAAE,IAAI,MAAK,kBAAkB;AAAE,SAAO;AAAE;AAEzK,IAAM,UAAU,OAAO,OAAO;AAAA,EACnC,CAAC,gBAAe,KAAK;AAAA,EAAE,CAAC,WAAU,KAAK;AAAA,EAAE,CAAC,WAAU,KAAK;AAAA,EAAE,CAAC,YAAW,IAAI;AAAA,EAAE,CAAC,cAAa,IAAI;AAAA;AAAA;AAAA,EAG/F,CAAC,wBAAuB,IAAI;AAAA,EAC5B,CAAC,gBAAe,KAAK;AAAA,EAAE,CAAC,eAAc,IAAI;AAAA,EAC1C,CAAC,oBAAmB,KAAK;AAAA,EAAE,CAAC,oBAAmB,IAAI;AAAA,EAAE,CAAC,iBAAgB,KAAK;AAAA,EAAE,CAAC,iBAAgB,KAAK;AAAA,EACnG,CAAC,mBAAkB,IAAI;AAAA,EAAE,CAAC,iBAAgB,KAAK;AAAA,EAAE,CAAC,sBAAqB,IAAI;AAAA,EAC3E,CAAC,gBAAe,IAAI;AAAA,EAAE,CAAC,oBAAmB,KAAK;AAAA,EAAE,CAAC,iBAAgB,IAAI;AAAA,EAAE,CAAC,gBAAe,IAAI;AAAA,EAAE,CAAC,kBAAiB,IAAI;AAAA,EAAE,CAAC,kBAAiB,IAAI;AAAA,EAAE,CAAC,oBAAmB,IAAI;AAAA,EAAE,CAAC,iBAAgB,IAAI;AAAA,EAC7L,CAAC,sBAAqB,IAAI;AAAA,EAAE,CAAC,iBAAgB,IAAI;AAAA,EAAE,CAAC,gBAAe,IAAI;AAAA,EAAE,CAAC,eAAc,IAAI;AAAA,EAAE,CAAC,kBAAiB,IAAI;AACtH,EAAE,IAAI,CAAC,CAAC,MAAK,QAAQ,OAAK,EAAC,MAAK,OAAO,IAAI,GAAE,UAAS,QAAQ,QAAQ,GAAE,aAAY,EAAC,MAAK,UAAS,sBAAqB,KAAI,EAAC,EAAE,CAAC;AACzH,IAAM,aAAa,QAAQ,IAAI,OAAG,EAAE,IAAI;AACxC,IAAM,aAAa,CAAC,SAAgB,QAAQ,KAAK,OAAG,EAAE,SAAO,IAAI,GAAG,YAAU;;;ACxBrF,SAAS,WAAW,UAAU,cAAc,eAAe,WAAW,YAAY,WAAW,WAAW,iBAAiB;AACzH,SAAS,YAAY;AACrB,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAEpB,IAAM,QAAN,MAAY;AAAA,EAEjB,YAAmB,SAAe,UAAc,UAAyB,CAAC,GAAG;AAA1D;AACjB,SAAK,QAAM,QAAQ,UAAQ;AAC3B,cAAU,SAAQ,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,cAAU,SAAQ,GAAK;AACtE,SAAK,WAAS,KAAK,SAAQ,YAAY;AACvC,QAAI;AACJ,YAAM,SAAO,YAAU,cAAc,YAAY,GAAG,EAAE,gBAAgB;AACtE,UAAG,CAAC,QAAQ,OAAM;AAGhB,cAAM,YAAU,KAAK,SAAQ,uBAAuB;AACpD,YAAG;AAAC,gBAAM,IAAE,UAAU,SAAS;AAAE,cAAG,CAAC,EAAE,OAAO,KAAG,EAAE,eAAe,KAAG,EAAE,UAAQ,EAAE,MAAK,cAAc;AAAA,QAAC,SAAO,GAAM;AAAC,cAAG,EAAE,SAAO,SAAS,OAAM;AAAA,QAAC;AAC/I,aAAK,kBAAgB,IAAI,OAAO,SAAS;AACzC,aAAK,gBAAgB,OAAO,kBAAkB;AAC9C,YAAG;AAAC,eAAK,gBAAgB,KAAK,iBAAiB;AAAA,QAAC,SAAO,GAAM;AAAC,cAAG,EAAE,MAAM,WAAW,aAAa,KAAG,EAAE,MAAM,WAAW,eAAe,EAAE,MAAK,cAAc;AAAE,gBAAM;AAAA,QAAC;AACpK,YAAI;AAAC,eAAK,SAAO,SAAS,KAAK,UAAS,MAAK,GAAK;AAAA,QAAC,QAAQ;AAC3D,cAAI;AAAQ,cAAG;AAAC,kBAAI,KAAK,MAAM,aAAa,KAAK,UAAS,MAAM,CAAC;AAAA,UAAC,QAAM;AAAC,iBAAK,cAAc;AAAA,UAAC;AAC7F,cAAG,CAAC,OAAO,cAAc,KAAK,GAAG,KAAG,IAAI,OAAK,KAAG,OAAO,IAAI,eAAa,YAAU,CAAC,IAAI,WAAW,MAAK,cAAc;AACrH,cAAG;AAAC,oBAAQ,KAAK,IAAI,KAAI,CAAC;AAAE,iBAAK,cAAc;AAAA,UAAC,SAAO,GAAM;AAAC,gBAAG,EAAE,SAAO,QAAQ,OAAM;AAAA,UAAC;AACzF,qBAAW,KAAK,QAAQ;AAAE,eAAK,SAAO,SAAS,KAAK,UAAS,MAAK,GAAK;AAAA,QACzE;AACA,sBAAc,KAAK,QAAQ,KAAK,UAAU,EAAC,KAAI,QAAQ,KAAI,YAAW,WAAW,EAAC,CAAC,CAAC;AAAA,MAAC;AACnF,WAAK,KAAG,IAAI,OAAO,KAAK,SAAQ,cAAc,CAAC;AAC/C,WAAK,GAAG,OAAO,oBAAoB;AAAE,WAAK,GAAG,OAAO,oBAAoB;AAAE,WAAK,GAAG,OAAO,qBAAqB;AAC9G,WAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qIAOkH;AAC/H,WAAK,GAAG,QAAQ,yCAAyC,EAAE,IAAI,aAAY,WAAW,WAAW,CAAC,EAAE;AACpG,WAAK,YAAU,KAAK,GAAG,QAAQ,oCAAoC,EAAE,IAAI,WAAW,EAAE;AACtF,UAAG,CAAC,QAAQ,MAAM,MAAK,GAAG,QAAQ,wHAAwH,EAAE,IAAI;AAEhK,UAAG,CAAC,QAAQ,MAAM,MAAK,GAAG,QAAQ,oBAAoB,EAAE,IAAI;AAAA,IAC9D,SAAQ,GAAG;AAAC,UAAG;AAAC,aAAK,IAAI,MAAM;AAAA,MAAC,QAAM;AAAA,MAAC;AAAC;AAAC,WAAK,kBAAkB;AAAE,YAAM;AAAA,IAAC;AAAA,EAC3E;AAAA,EArCmB;AAAA,EADnB;AAAA,EAAO;AAAA,EAAyB;AAAA,EAAgC;AAAA,EAAwB;AAAA,EAA4B,SAAO;AAAA,EAAc,QAAM;AAAA,EAuCvI,oBAAmB;AACzB,QAAG;AACD,UAAG,KAAK,WAAS,QAAU;AACzB,YAAI,OAAK;AAAM,YAAG;AAAC,gBAAM,KAAG,UAAU,KAAK,MAAM,GAAE,QAAM,UAAU,KAAK,QAAQ;AAAE,iBAAK,GAAG,QAAM,MAAM,OAAK,GAAG,QAAM,MAAM,OAAK,CAAC,MAAM,eAAe;AAAA,QAAC,QAAM;AAAA,QAAC;AAC7J,kBAAU,KAAK,MAAM;AAAE,aAAK,SAAO;AACnC,YAAG,KAAK,KAAG;AAAC,qBAAW,KAAK,QAAQ;AAAA,QAAC,SAAO,GAAM;AAAC,cAAG,EAAE,SAAO,SAAS,OAAM;AAAA,QAAC;AAAA,MACjF;AAAA,IACF,UAAC;AAAQ,UAAG,KAAK,iBAAgB;AAAC,YAAG;AAAC,eAAK,gBAAgB,KAAK,UAAU;AAAA,QAAC,QAAM;AAAA,QAAC;AAAC;AAAC,aAAK,gBAAgB,MAAM;AAAE,aAAK,kBAAgB;AAAA,MAAS;AAAA,IAAC;AAAA,EAClJ;AAAA,EACA,KAAKC,KAAU,SAAmF;AAChG,eAAWA,GAAE;AACb,QAAG,CAAC,WAAS,QAAQ,oBAAkB,UAAW,OAAO,QAAQ,oBAAkB,aAAW,CAAC,MAAM,QAAQ,QAAQ,UAAQ,CAAC,CAAC,KAAG,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,CAAC,QAAQ,MAAM,UAAQ,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,CAAC,QAAQ,MAAM,UAAQ,QAAQ,MAAM,KAAK,OAAG,CAAC,WAAW,SAAS,CAAC,CAAC,EAAE,MAAK,iBAAiB;AACnT,UAAM,UAAQ,QAAQ,oBAAkB,MAAK,SAAO,QAAQ,UAAQ,CAAC;AACrE,QAAG,WAAS,CAAC,KAAK,MAAM,MAAK,kBAAiB,GAAG;AACjD,QAAG,CAAC,WAAS,CAAC,OAAO,OAAO,MAAK,iBAAiB;AAClD,WAAO,QAAQ,UAAU;AAAE,YAAQ,MAAM,QAAQ,UAAU;AAC3D,UAAM,QAAM,EAAC,QAAO,OAAM,QAAQ,OAAM,OAAM,QAAQ,OAAM,GAAI,UAAQ,EAAC,iBAAgB,KAAI,IAAE,CAAC,EAAE;AAClG,UAAM,QAAM,OAAO;AAAE,SAAK,GAAG,QAAQ,wCAAwC,EAAE,IAAIA,KAAG,IAAI,KAAK,GAAE,UAAU,KAAK,CAAC;AAAE,WAAO,EAAC,UAASA,KAAG,OAAM,WAAU,KAAK,WAAU,WAAU,gBAAgB,KAAK,SAAS,IAAIA,GAAE,IAAG,iBAAgB,QAAO;AAAA,EAChP;AAAA,EACA,OAAO,OAAc;AAAC,QAAG,OAAO,UAAQ,YAAU,MAAM,SAAO,IAAI,MAAK,gBAAe,GAAG;AAAE,UAAM,MAAI,KAAK,GAAG,QAAQ,sCAAsC,EAAE,IAAI,IAAI,KAAK,CAAC;AAAE,UAAM,WAAS,QAAQ,OAAM,KAAK,UAAQ,IAAI,OAAO,EAAE,CAAC;AAAE,QAAG,CAAC,YAAU,CAAC,OAAK,IAAI,QAAQ,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EAC3S,OAAOA,KAAW;AAAC,UAAM,QAAM,OAAO;AAAE,QAAG,CAAC,KAAK,GAAG,QAAQ,sEAAsE,EAAE,IAAI,IAAI,KAAK,GAAE,WAAWA,GAAE,CAAC,EAAE,QAAQ,MAAK,gBAAe,GAAG;AAAE,WAAO,EAAC,UAASA,KAAG,MAAK;AAAA,EAAC;AAAA,EAC9N,OAAOA,KAAW;AAAC,SAAK,GAAG,QAAQ,6DAA6D,EAAE,IAAI,WAAWA,GAAE,CAAC;AAAA,EAAC;AAAA,EAC7G,cAAc,QAAW;AAAC,UAAM,MAAI,KAAK,GAAG,QAAQ,kCAAkC,EAAE,IAAI,QAAQ,EAAE;AAAE,QAAG,CAAC,OAAK,IAAI,WAAS,IAAI,aAAW,OAAO,YAAU,IAAI,WAAS,OAAO,OAAO,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EACpO,MAAM,QAAW,SAAa;AAC5B,aAAO,KAAK,cAAc,MAAM;AAChC,UAAM,UAAQ,KAAK,MAAM,OAAO,OAAO;AAAE,eAAUC,QAAO,CAAC,SAAQ,UAAS,WAAW,EAAE,YAAW,QAAQA,IAAG,CAAC;AAChH,QAAG,QAAQ,oBAAkB,QAAM,CAAC,QAAQ,OAAO,SAAS,QAAQ,KAAK,KAAG,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,QAAQ,MAAM,KAAK,CAAC,MAAW,CAAC,QAAQ,MAAM,SAAS,CAAC,CAAC,KAAG,QAAQ,MAAM,KAAK,CAAC,MAAW,CAAC,QAAQ,MAAM,SAAS,CAAC,CAAC,EAAE,MAAK,gBAAe,GAAG;AACxR,UAAM,MAAI,QAAQ,SAAO;AAAO,QAAG,CAAC,OAAO,cAAc,GAAG,KAAG,MAAI,OAAM,MAAI,IAAO,MAAK,kBAAkB;AAC3G,SAAK,GAAG,QAAQ,iEAAiE,EAAE,IAAI,KAAK,IAAI,CAAC;AACjG,QAAG,KAAK,GAAG,QAAQ,sCAAsC,EAAE,IAAI,EAAE,SAAO,KAAK,MAAK,eAAc,GAAG;AACnG,UAAM,UAAQ,EAAC,UAAS,OAAO,IAAG,OAAM,QAAQ,OAAM,QAAO,QAAQ,QAAO,WAAU,QAAQ,WAAU,OAAM,QAAQ,OAAM,OAAM,QAAQ,OAAM,WAAU,KAAK,IAAI,IAAE,KAAI,UAAS,OAAO,UAAS,SAAQ,WAAW,EAAC;AACtN,UAAM,QAAM,OAAO;AAAE,SAAK,GAAG,QAAQ,iCAAiC,EAAE,IAAI,IAAI,KAAK,GAAE,UAAU,OAAO,CAAC;AAAE,WAAO,EAAC,YAAW,OAAM,WAAU,KAAK,WAAU,eAAc,GAAE,GAAG,QAAO;AAAA,EACzL;AAAA,EACA,MAAM,OAAsB;AAAC,QAAG,OAAO,UAAQ,YAAU,MAAM,SAAO,IAAI,MAAK,gBAAe,GAAG;AAAE,UAAM,MAAI,KAAK,GAAG,QAAQ,kDAAkD,EAAE,IAAI,IAAI,KAAK,CAAC;AAAE,UAAM,WAAS,QAAQ,OAAM,KAAK,UAAQ,IAAI,OAAO,EAAE,CAAC;AAAE,QAAG,CAAC,YAAU,CAAC,IAAI,MAAK,gBAAe,GAAG;AAAE,UAAM,UAAQ,KAAK,MAAM,IAAI,OAAO;AAAE,SAAK,SAAS,OAAO;AAAE,WAAO;AAAA,EAAO;AAAA,EAClX,SAAS,GAAW;AAAC,UAAM,MAAI,KAAK,GAAG,QAAQ,iDAAiD,EAAE,IAAI,EAAE,QAAQ;AAAE,QAAG,CAAC,OAAK,IAAI,WAAS,IAAI,aAAW,EAAE,YAAU,EAAE,aAAW,KAAK,IAAI,KAAG,CAAC,EAAE,WAAS,CAAC,KAAK,GAAG,QAAQ,gEAAgE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAK,iBAAgB,GAAG;AAAA,EAAC;AAAA,EACnU,aAAa,QAAW,SAAa;AACnC,aAAO,KAAK,cAAc,MAAM;AAChC,eAAW,QAAQ,KAAK;AACxB,UAAM,UAAQ,KAAK,MAAM,OAAO,OAAO;AAAE,QAAG,QAAQ,oBAAkB,QAAM,CAAC,QAAQ,OAAO,SAAS,QAAQ,KAAK,EAAE,MAAK,gBAAe,GAAG;AAE3I,UAAM,SAAO,KAAK,GAAG,QAAQ,qGAAqG,EAAE,IAAI,OAAO,IAAG,QAAQ,KAAK;AAC/J,WAAO,EAAC,WAAU,KAAK,WAAU,eAAc,GAAE,SAAQ,OAAO,SAAQ,OAAM,QAAQ,MAAK;AAAA,EAC7F;AAAA,EACA,MAAMD,KAAU,SAAgB,MAAYE,OAAU;AACpD,eAAWF,GAAE;AAAE,UAAMG,UAAO,IAAI,UAAU,EAAC,UAAS,QAAQ,UAAS,OAAM,QAAQ,OAAM,QAAO,QAAQ,QAAO,WAAU,QAAQ,WAAU,MAAK,MAAAD,MAAI,CAAC,CAAC;AACtJ,WAAO,KAAK,GAAG,YAAY,MAAI;AAAC,YAAM,MAAI,KAAK,GAAG,QAAQ,qCAAqC,EAAE,IAAIF,GAAE;AAAE,UAAG,KAAI;AAAC,YAAG,IAAI,WAASG,QAAO,MAAK,sBAAqB,GAAG;AAAE,eAAO,EAAC,OAAM,OAAM,WAAU,KAAK,OAAO,GAAG,EAAC;AAAA,MAAC;AACpN,WAAK,GAAG,QAAQ,6FAA6F,EAAE,IAAIH,KAAGG,SAAO,UAAU,OAAO,GAAE,MAAK,KAAK,IAAI,CAAC;AAAE,aAAO,EAAC,OAAM,MAAK,WAAU,KAAK,OAAOH,KAAG,OAAO,EAAC;AAAA,IAAC,CAAC,EAAE;AAAA,EAC7N;AAAA,EACA,IAAI,OAAa,GAAW;AAAC,UAAM,IAAE,KAAK,MAAM,KAAK;AAAE,QAAG,EAAE,aAAW,EAAE,YAAU,EAAE,UAAQ,EAAE,SAAO,EAAE,WAAS,EAAE,UAAQ,EAAE,cAAY,EAAE,UAAU,MAAK,gBAAe,GAAG;AAAA,EAAC;AAAA,EAC7K,OAAOA,KAAU,GAAW;AAAC,UAAM,MAAI,KAAK,GAAG,QAAQ,qCAAqC,EAAE,IAAI,WAAWA,GAAE,CAAC;AAAE,QAAG,CAAC,IAAI,MAAK,uBAAsB,GAAG;AAAE,SAAK,IAAI,IAAI,SAAQ,CAAC;AAAE,WAAO,KAAK,OAAO,GAAG;AAAA,EAAC;AAAA,EACzM,OAAO,KAAS;AAAC,WAAO,EAAC,eAAc,GAAE,WAAU,KAAK,WAAU,aAAY,IAAI,IAAG,MAAK,IAAI,MAAK,QAAO,IAAI,QAAO,WAAU,IAAI,KAAK,IAAI,OAAO,EAAE,YAAY,GAAE,YAAW,IAAI,WAAS,IAAI,KAAK,IAAI,QAAQ,EAAE,YAAY,IAAE,MAAK,QAAO,IAAI,SAAO,KAAK,MAAM,IAAI,MAAM,IAAE,MAAK,OAAM,IAAI,QAAM,EAAC,MAAK,IAAI,MAAK,IAAE,KAAI;AAAA,EAAC;AAAA,EACzT,OAAOA,KAAU,QAAc,SAAW,MAAKI,SAAkB,MAAM;AAAC,SAAK,GAAG,QAAQ,uEAAuE,EAAE,IAAI,QAAO,WAAS,OAAK,OAAK,UAAU,MAAM,GAAEA,QAAM,KAAK,IAAI,GAAEJ,GAAE;AAAA,EAAC;AAAA,EACrO,QAAQA,KAAW;AAAC,SAAK,GAAG,QAAQ,yEAAyE,EAAE,IAAIA,GAAE;AAAA,EAAC;AAAA,EACtH,MAAM,MAAY,QAAkB,MAAK,YAAsB,MAAK;AAAC,SAAK,GAAG,QAAQ,+DAA+D,EAAE,IAAI,KAAK,IAAI,GAAE,MAAK,OAAM,SAAS;AAAE,SAAK,GAAG,QAAQ,gEAAgE,EAAE,IAAI;AAAA,EAAC;AAAA,EAClR,QAAO;AAAC,QAAG,KAAK,OAAO;AAAO,SAAK,SAAO;AAAK,QAAG;AAAC,WAAK,GAAG,MAAM;AAAA,IAAC,UAAC;AAAQ,WAAK,kBAAkB;AAAA,IAAC;AAAA,EAAC;AACtG;;;ACpGA,SAAS,iBAA6B;AACtC,SAAS,OAAO,UAAU,MAAM,MAAM,eAAe;AACrD,OAAO,UAAU;AAGV,IAAM,QAAN,MAAY;AAAA,EAGjB,YAAmB,OAA4B,UAAuB,CAAC,GAAE;AAAtD;AACjB,SAAK,kBAAgB,QAAQ,kBAAgB,CAAC,GAAG,IAAI,OAAG,KAAK,QAAQ,CAAC,CAAC;AACvE,SAAK,oBAAkB,QAAQ,qBAAmB;AAClD,QAAG,CAAC,OAAO,cAAc,KAAK,iBAAiB,KAAG,KAAK,oBAAkB,KAAG,KAAK,oBAAkB,MAAM,OAAM,IAAI,MAAM,6BAA6B;AAAA,EACxJ;AAAA,EAJmB;AAAA,EAFX;AAAA,EACA;AAAA,EAMR,OAAO,MAAY,QAAc;AAAC,UAAM,MAAI,KAAK,SAAS,MAAK,MAAM;AAAE,WAAO,QAAM,MAAK,CAAC,IAAI,WAAW,KAAK,KAAK,GAAG,EAAE,KAAG,QAAM,QAAM,CAAC,KAAK,WAAW,GAAG;AAAA,EAAE;AAAA,EAC7J,MAAc,OAAO,GAAyB;AAC5C,QAAG;AAAC,aAAO,MAAM,SAAS,CAAC;AAAA,IAAC,SAAO,GAAM;AACvC,UAAG,EAAE,SAAO,YAAU,EAAE,SAAO,UAAU,OAAM;AAC/C,YAAM,SAAO,KAAK,QAAQ,CAAC;AAAE,UAAG,WAAS,EAAE,OAAM;AACjD,aAAO,KAAK,KAAK,MAAM,KAAK,OAAO,MAAM,GAAE,KAAK,SAAS,CAAC,CAAC;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAc,WAAU;AACtB,UAAM,UAAQ,IAAI,IAAY,KAAK,cAAc;AACjD,eAAU,KAAK,KAAK,eAAe,SAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;AACnE,WAAO,CAAC,GAAG,OAAO;AAAA,EACpB;AAAA,EACQ,SAAS,GAAQ;AAAC,WAAO,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG;AAAA,EAAE;AAAA,EACpD,MAAc,gBAAgB,GAAQ;AACpC,QAAG,CAAC,EAAE,OAAO,KAAG,EAAE,QAAM,KAAG,CAAC,KAAK,eAAe,OAAO,QAAO;AAC9D,UAAM,SAAO,KAAK,SAAS,CAAC,GAAE,OAAK,oBAAI,IAAY,GAAE,QAAM,CAAC,GAAG,KAAK,cAAc;AAAE,QAAIK,SAAM;AAC9F,WAAM,MAAM,QAAO;AACjB,UAAG,EAAEA,SAAM,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AACpE,YAAM,IAAE,MAAM,IAAI;AAAG,UAAI;AACzB,UAAG;AAAC,eAAK,MAAM,KAAK,CAAC;AAAA,MAAC,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,YAAU,EAAE,SAAO,UAAU;AAAS,aAAK,2BAA0B,GAAG;AAAA,MAAC;AACzH,YAAMC,MAAG,KAAK,SAAS,IAAI;AAAE,UAAGA,QAAK,OAAO,QAAO;AACnD,UAAG,KAAK,IAAIA,GAAE,EAAE;AAAS,WAAK,IAAIA,GAAE;AACpC,UAAG,KAAK,YAAY,GAAE;AACpB,YAAI;AAAe,YAAG;AAAC,kBAAM,MAAM,QAAQ,CAAC;AAAA,QAAC,QAAM;AAAC,eAAK,2BAA0B,GAAG;AAAA,QAAC;AACvF,YAAG,MAAO,SAAOD,SAAM,MAAM,SAAO,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AAC7F,mBAAU,QAAQ,MAAO,OAAM,KAAK,KAAK,KAAK,GAAE,IAAI,CAAC;AAAA,MACvD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAc,QAAQ,QAAc,SAAO,OAAM,YAAkB;AACjE,UAAM,SAAO,MAAM,KAAK,OAAO,MAAM,GAAE,WAAS,MAAM,KAAK,SAAS;AACpE,QAAG,SAAS,KAAK,OAAG,KAAK,OAAO,GAAE,MAAM,KAAG,KAAK,OAAO,GAAE,MAAM,KAAI,WAAS,KAAK,OAAO,QAAO,CAAC,KAAG,KAAK,OAAO,QAAO,CAAC,EAAG,EAAE,MAAK,0BAAyB,GAAG;AAC7J,QAAI,IAAE;AACN,QAAG,CAAC,EAAE,KAAG;AAAC,UAAE,MAAM,KAAK,MAAM;AAAA,IAAC,SAAO,GAAM;AAAC,UAAG,EAAE,SAAO,YAAU,EAAE,SAAO,UAAU,OAAM;AAAA,IAAC;AAC5F,QAAG,KAAG,MAAM,KAAK,gBAAgB,CAAC,EAAE,MAAK,0BAAyB,GAAG;AAAA,EACvE;AAAA,EACA,MAAM,iBAAiB,QAAc;AAAC,UAAM,KAAK,QAAQ,QAAO,IAAI;AAAA,EAAC;AAAA,EACrE,MAAM,oBAAoB,QAAc;AACtC,UAAM,QAAM,CAAC,MAAM;AAAE,QAAIA,SAAM;AAC/B,WAAM,MAAM,QAAO;AACjB,UAAG,EAAEA,SAAM,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AACpE,YAAM,UAAQ,MAAM,IAAI,GAAG,SAAO,MAAM,MAAM,OAAO;AACrD,UAAG,OAAO,eAAe,EAAE,MAAK,2BAA0B,GAAG;AAC7D,YAAM,KAAK,QAAQ,SAAQ,MAAK,MAAM;AACtC,UAAG,OAAO,YAAY,GAAE;AACtB,cAAM,QAAM,MAAM,QAAQ,OAAO;AACjC,YAAG,MAAM,SAAOA,SAAM,MAAM,SAAO,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AAC5F,mBAAU,QAAQ,MAAM,OAAM,KAAK,KAAK,KAAK,SAAQ,IAAI,CAAC;AAAA,MAC5D,WAAS,CAAC,OAAO,OAAO,EAAE,MAAK,2BAA0B,GAAG;AAAA,IAC9D;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAc,eAAa,IAAG,SAAO,OAAO;AACxD,UAAM,aAAW,OAAO,OAAO,KAAK,OAAM,MAAM,IAAE,KAAK,MAAM,MAAM,IAAE;AACrE,QAAG,CAAC,cAAY,OAAO,iBAAe,YAAU,aAAa,SAAS,IAAI,KAAG,KAAK,WAAW,YAAY,KAAG,2BAA2B,KAAK,YAAY,EAAE,MAAK,2BAA0B,GAAG;AAC5L,UAAM,OAAK,MAAM,SAAS,UAAW;AAAE,UAAM,QAAM,aAAa,MAAM,OAAO,EAAE,OAAO,OAAO;AAAE,QAAG,MAAM,KAAK,OAAG,MAAI,QAAM,MAAI,OAAK,QAAQ,KAAK,CAAC,CAAC,EAAE,MAAK,2BAA0B,GAAG;AACtL,QAAI,SAAO;AACX,aAAQ,IAAE,GAAE,IAAE,MAAM,QAAO,KAAI;AAAC,eAAO,KAAK,KAAK,QAAO,MAAM,CAAC,CAAC;AAAE,UAAG;AAAC,cAAM,IAAE,MAAM,MAAM,MAAM;AAAE,YAAG,EAAE,eAAe,EAAE,MAAK,2BAA0B,GAAG;AAAE,cAAM,SAAO,MAAM,SAAS,MAAM;AAAE,YAAG,CAAC,KAAK,OAAO,MAAK,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAAA,MAAC,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,YAAU,UAAQ,MAAI,MAAM,SAAO,EAAE;AAAM,cAAM;AAAA,MAAC;AAAA,IAAC;AAC7U,QAAG,CAAC,KAAK,OAAO,MAAK,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAAE,UAAM,KAAK,QAAQ,QAAO,MAAM;AAAE,WAAO;AAAA,EAC5G;AAAA,EACA,MAAM,KAAK,MAAYE,WAAgB,QAAc,QAAe;AAClE,UAAM,SAAO,MAAM,KAAK,QAAQ,MAAKA,SAAQ;AAAE,UAAM,SAAO,MAAM,KAAK,QAAO,UAAU,YAAU,UAAU,cAAY,EAAE;AAC1H,QAAG;AAAC,YAAM,SAAO,MAAM,OAAO,KAAK;AAAE,UAAG,CAAC,OAAO,OAAO,EAAE,MAAK,YAAY;AAAE,YAAM,WAAS,MAAM,KAAK,QAAQ,MAAKA,SAAQ,GAAE,QAAM,MAAM,KAAK,QAAQ;AAAE,UAAG,OAAO,QAAM,MAAM,OAAK,OAAO,QAAM,MAAM,IAAI,MAAK,gBAAe,GAAG;AAC/N,YAAM,KAAK,QAAQ,UAAS,OAAM,MAAM;AACxC,UAAG,QAAQ,aAAW,SAAQ;AAAC,cAAM,SAAO,MAAM,SAAS,iBAAiB,OAAO,EAAE,EAAE,GAAE,OAAK,MAAM,SAAS,KAAK,MAAM,IAAI,CAAC;AAAE,YAAG,CAAC,KAAK,OAAO,MAAK,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAAE,cAAM,KAAK,QAAQ,QAAO,OAAM,MAAM;AAAA,MAAC;AACvO,YAAM,OAAK,OAAO,MAAM,KAAK,IAAI,QAAO,KAAK,IAAI,GAAE,OAAO,OAAK,MAAM,CAAC,CAAC;AAAE,YAAM,EAAC,UAAS,IAAE,MAAM,OAAO,KAAK,MAAK,GAAE,KAAK,QAAO,MAAM;AAAE,aAAO,EAAC,MAAK,KAAK,SAAS,GAAE,SAAS,GAAE,MAAK,OAAO,KAAI;AAAA,IAClM,UAAC;AAAQ,YAAM,OAAO,MAAM;AAAA,IAAC;AAAA,EAC/B;AAAA,EACA,MAAM,KAAK,MAAYA,WAAgB;AACrC,UAAM,SAAO,MAAM,KAAK,QAAQ,MAAKA,SAAQ,GAAE,UAAQ,MAAM,QAAQ,QAAO,EAAC,eAAc,KAAI,CAAC,GAAE,UAAQ,CAAC;AAC3G,eAAU,SAAS,SAAQ;AACzB,UAAG;AAAC,cAAM,KAAK,QAAQ,KAAK,KAAK,QAAO,MAAM,IAAI,CAAC;AAAE,gBAAQ,KAAK,KAAK;AAAA,MAAC,SAAO,GAAM;AACnF,YAAG,CAAC,CAAC,0BAAyB,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAM;AAAA,MAClF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AC3FA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,QAAQ,OAAO,UAAU,QAAAC,OAAM,cAAc;AACtD,SAAS,QAAAC,aAAY;AAEd,IAAM,eAAN,MAAmB;AAAA,EAExB,YAAoB,SAAyB,gBAA+B,SAAO,MAAI,OAAO,YAAY,GAAU,eAAmC,CAAC,GAAE;AAAtI;AAAyB;AAA+B;AAAwC;AAAA,EAAuC;AAAA,EAAvI;AAAA,EAAyB;AAAA,EAA+B;AAAA,EAAwC;AAAA,EAD5G;AAAA,EAAoB,WAAS,oBAAI,IAAgB;AAAA,EAAU,WAAS,oBAAI,IAAgB;AAAA,EAEhG,MAAM,QAAO;AAAC,QAAG;AAAC,YAAM,KAAK,OAAO;AAAE,UAAG,KAAK,eAAe,OAAM,OAAO,KAAK,cAAc;AAAE,aAAO,EAAC,QAAO,KAAK,SAAS,YAAY,IAAE,UAAQ,oBAAmB,cAAa,KAAK,SAAS,YAAY,IAAE,aAAW,cAAa,QAAO,YAAW,WAAU,mBAAkB,gBAAe,KAAK,SAAQ,oBAAmB,OAAO,KAAK,KAAK,YAAY,EAAE,KAAK,EAAC;AAAA,IAAC,QAAM;AAAC,aAAO,EAAC,QAAO,eAAc,MAAK,iBAAgB;AAAA,IAAC;AAAA,EAAC;AAAA,EACpa,QAAQ,KAAY;AAAC,QAAI;AAAM,QAAG;AAAC,UAAE,IAAI,IAAI,GAAG;AAAA,IAAC,QAAM;AAAC,WAAK,qBAAoB,GAAG;AAAA,IAAC;AAAC,QAAG,CAAC,CAAC,SAAQ,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAG,EAAE,YAAU,EAAE,YAAU,CAAC,KAAK,QAAQ,SAAS,EAAE,MAAM,EAAE,MAAK,qBAAoB,GAAG;AAAA,EAAC;AAAA,EACzN,MAAM,IAAI,MAAY,GAAM,GAAW;AACrC,QAAG,SAAO,gBAAe;AACvB,WAAK,QAAQ,EAAE,GAAG;AAAE,UAAG,KAAK,SAAS,QAAM,GAAG,MAAK,iBAAgB,GAAG;AACtE,UAAI;AAAO,UAAG;AAAC,aAAG,MAAM,KAAK,OAAO;AAAA,MAAC,QAAM;AAAC,aAAK,kBAAiB,GAAG;AAAA,MAAC;AACtE,UAAI,SAAQ,aAAW,OAAM,YAAU;AACvC,UAAG,EAAE,cAAY,QAAU;AACzB,cAAM,OAAK,KAAK,aAAa,EAAE,SAAS;AAAE,YAAG,CAAC,KAAK,MAAK,0BAAyB,GAAG;AACpF,cAAM,QAAM,KAAK,UAAU,CAAC,EAAE,UAAS,EAAE,OAAM,EAAE,SAAS,CAAC,GAAEC,OAAIC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAChH,YAAG;AAAC,oBAAQ,KAAK,SAAS,IAAID,IAAG;AAAE,cAAG,CAAC,SAAQ;AAAC,kBAAM,UAAQE,MAAK,MAAKF,IAAG;AAAE,kBAAM,MAAM,SAAQ,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,sBAAQ,MAAM,GAAG,SAAS,wBAAwB,SAAQ,EAAC,UAAS,MAAK,gBAAe,KAAK,gBAAe,iBAAgB,MAAK,gBAAe,QAAO,CAAC;AAAE,iBAAK,SAAS,IAAIA,MAAI,OAAO;AAAA,UAAC;AAAC,uBAAW;AAAK,sBAAU,EAAE;AAAA,QACnV,QAAM;AAAC,eAAK,+BAA8B,GAAG;AAAA,QAAC;AAAA,MAChD,OAAK;AACH,YAAG;AAAC,eAAK,YAAU,MAAM,GAAG,SAAS,OAAO,EAAC,UAAS,MAAK,gBAAe,KAAK,eAAc,CAAC;AAAE,oBAAQ,MAAM,KAAK,QAAQ,WAAW,EAAC,iBAAgB,MAAK,gBAAe,QAAO,CAAC;AAAA,QAAC,QAAM;AAAC,eAAK,kBAAiB,GAAG;AAAA,QAAC;AAAA,MACvN;AACA,YAAM,QAAQ,MAAM,QAAO,OAAM,UAAY;AAAC,YAAG;AAAC,eAAK,QAAQ,MAAM,QAAQ,EAAE,IAAI,CAAC;AAAE,gBAAM,MAAM,SAAS;AAAA,QAAC,QAAM;AAAC,gBAAM,MAAM,MAAM,iBAAiB;AAAA,QAAC;AAAA,MAAC,CAAC;AACzJ,YAAM,OAAK,MAAM,QAAQ,QAAQ;AAAE,WAAK,GAAG,SAAQ,CAAC,MAAQ,KAAK,EAAE,MAAM,CAAC;AAAE,YAAMG,MAAG,WAAWC,YAAW,CAAC,IAAG,YAAU,oBAAI,IAAI;AACjI,WAAK,GAAG,YAAW,CAACC,cAAe;AAAC,cAAMC,cAAW,YAAYF,YAAW,CAAC;AAAG,kBAAU,IAAIE,aAAW,EAAC,UAAAD,WAAS,MAAKA,UAAS,KAAK,GAAE,mBAAkBA,UAAS,kBAAkB,EAAC,CAAC;AAAA,MAAC,CAAC;AACzL,WAAK,SAAS,IAAIF,KAAG,EAAC,SAAQ,MAAK,OAAM,KAAK,UAAU,CAAC,EAAE,UAAS,EAAE,OAAM,EAAE,QAAO,EAAE,SAAS,CAAC,GAAE,UAAS,MAAK,YAAW,WAAU,UAAS,CAAC;AAChJ,UAAG;AAAC,cAAM,KAAK,KAAK,EAAE,KAAI,EAAC,WAAU,oBAAmB,SAAQ,IAAK,CAAC;AAAE,eAAO,EAAC,kBAAiBA,KAAG,KAAI,KAAK,IAAI,GAAE,gBAAe,KAAK,SAAS,QAAQ,KAAG,YAAW,YAAW,UAAS;AAAA,MAAC,QAAM;AAAC,aAAK,SAAS,OAAOA,GAAE;AAAE,qBAAW,MAAM,KAAK,MAAM,IAAE,MAAM,QAAQ,MAAM;AAAE,aAAK,2BAA2B;AAAA,MAAC;AAAA,IAClT;AACA,UAAM,UAAQ,KAAK,SAAS,IAAI,EAAE,gBAAgB;AAAE,QAAG,CAAC,QAAQ,MAAK,6BAA4B,GAAG;AACpG,QAAG,QAAQ,UAAQ,KAAK,UAAU,CAAC,EAAE,UAAS,EAAE,OAAM,EAAE,QAAO,EAAE,SAAS,CAAC,EAAE,MAAK,gBAAe,GAAG;AACpG,QAAG,SAAO,iBAAgB;AAAC,cAAQ,aAAW,MAAM,QAAQ,KAAK,MAAM,IAAE,MAAM,QAAQ,QAAQ,MAAM;AAAE,WAAK,SAAS,OAAO,EAAE,gBAAgB;AAAE,aAAO,EAAC,QAAO,MAAK,YAAW,QAAQ,WAAU;AAAA,IAAC;AAClM,QAAG,SAAO,oBAAmB;AAC3B,YAAM,OAAK,QAAQ,UAAU,IAAI,EAAE,UAAU;AAAE,UAAG,CAAC,KAAK,MAAK,8BAA6B,GAAG;AAC7F,YAAMI,QAAK,MAAM,KAAK,MAAK,OAAK,MAAMC,MAAKD,KAAI;AAAE,UAAG,KAAK,OAAK,QAAQ,MAAK,8BAA6B,GAAG;AAC3G,YAAM,OAAK,MAAM,SAASA,KAAI;AAAE,YAAM,OAAOA,KAAI;AAAE,cAAQ,UAAU,OAAO,EAAE,UAAU;AACxF,aAAO,EAAC,YAAW,EAAE,YAAW,UAAS,KAAK,mBAAkB,UAAS,UAAS,SAAQ,KAAK,SAAS,QAAQ,GAAE,QAAO,IAAI,IAAI,GAAE,MAAK,KAAK,OAAM;AAAA,IACrJ;AACA,QAAG,SAAO,kBAAiB;AACzB,UAAG,OAAO,EAAE,WAAS,YAAU,CAAC,EAAE,OAAO,KAAK,KAAG,EAAE,OAAO,SAAO,SAAO,EAAE,OAAO,SAAS,IAAI,EAAE,MAAK,kBAAkB;AACvH,UAAI;AAAM,UAAG;AAAC,gBAAM,MAAM,QAAQ,KAAK,SAAS,EAAE,MAAM;AAAA,MAAC,QAAM;AAAC,aAAK,yBAAwB,GAAG;AAAA,MAAC;AACjG,UAAI;AAAK,UAAG;AAAC,eAAK,KAAK,UAAU,SAAO,IAAI;AAAA,MAAC,QAAM;AAAC,aAAK,+BAA8B,GAAG;AAAA,MAAC;AAC3F,UAAG,KAAK,SAAO,IAAO,MAAK,+BAA8B,GAAG;AAC5D,aAAO,EAAC,WAAU,MAAK,KAAI,QAAQ,KAAK,IAAI,GAAE,QAAO,SAAO,KAAI;AAAA,IAClE;AACA,QAAG,SAAO,oBAAmB;AAC3B,cAAQ,WAAS,YAAYH,YAAW,CAAC;AACzC,YAAM,QAAM,MAAM,QAAQ,KAAK,QAAQ,gDAAgD,EAAE,YAAY,CAAC,aAAiB,SAAS,MAAM,GAAE,GAAG,EAAE,IAAI,CAAC,IAAO,MAAW;AAAC,WAAG,aAAa,sBAAqB,OAAO,CAAC,CAAC;AAAE,eAAO,EAAC,KAAI,OAAO,CAAC,GAAE,KAAI,GAAG,QAAQ,YAAY,GAAE,OAAM,GAAG,aAAW,GAAG,aAAa,YAAY,KAAG,IAAI,MAAM,GAAE,GAAG,EAAC;AAAA,MAAC,CAAC,CAAC;AAC9U,aAAO,EAAC,kBAAiB,EAAE,kBAAiB,YAAW,QAAQ,UAAS,KAAI,QAAQ,KAAK,IAAI,GAAE,OAAM,MAAM,QAAQ,KAAK,QAAQ,MAAM,EAAE,UAAU,GAAG,MAAM,GAAE,GAAM,GAAE,MAAK;AAAA,IAC5K;AACA,QAAG,EAAE,eAAa,QAAQ,YAAU,CAAC,YAAY,KAAK,EAAE,GAAG,EAAE,MAAK,gBAAe,GAAG;AACpF,UAAM,OAAK,QAAQ,KAAK,QAAQ,wBAAwB,EAAE,GAAG,IAAI;AAAE,QAAG,MAAM,KAAK,MAAM,MAAI,EAAE,MAAK,gBAAe,GAAG;AACpH,YAAQ,WAAS;AACjB,QAAG,SAAO,mBAAiB,OAAO,EAAE,SAAO,YAAU,EAAE,KAAK,SAAO,OAAO,MAAK,kBAAkB;AACjG,QAAI;AACJ,QAAG,SAAO,kBAAiB;AACzB,UAAG,OAAO,EAAE,aAAW,YAAU,CAAC,EAAE,YAAU,EAAE,SAAS,SAAO,OAAK,UAAU,KAAK,EAAE,QAAQ,KAAG,OAAO,EAAE,kBAAgB,SAAS,MAAK,kBAAkB;AAC1J,YAAM,OAAK,OAAO,KAAK,EAAE,eAAc,QAAQ;AAAE,UAAG,KAAK,SAAS,QAAQ,MAAI,EAAE,iBAAe,KAAK,SAAO,QAAQ,MAAK,wBAAuB,GAAG;AAClJ,UAAG,EAAE,aAAW,WAAY,OAAO,EAAE,aAAW,YAAU,CAAC,uBAAuB,KAAK,EAAE,QAAQ,GAAG,MAAK,kBAAkB;AAC3H,eAAO,EAAC,MAAK,EAAE,UAAS,UAAS,EAAE,YAAU,cAAa,QAAO,KAAI;AAAA,IACvE;AACA,UAAM,kBAAgB,SAAO,kBAAgB,QAAQ,KAAK,aAAa,YAAW,EAAC,SAAQ,IAAI,CAAC,EAAE,MAAM,MAAI,IAAI,IAAE;AAClH,QAAG;AAAC,UAAG,SAAO,gBAAgB,OAAM,KAAK,MAAM,EAAC,SAAQ,IAAK,CAAC;AAAA,eACpD,SAAO,eAAe,OAAM,KAAK,KAAK,EAAE,MAAK,EAAC,SAAQ,IAAK,CAAC;AAAA,eAC5D,SAAO,iBAAiB,OAAM,KAAK,cAAc,QAAO,EAAC,SAAQ,IAAK,CAAC;AAAA,UAC1E,MAAK,kBAAiB,GAAG;AAAA,IAChC,QAAM;AAAC,WAAK,mBAAkB,GAAG;AAAA,IAAC;AAClC,UAAM,WAAS,MAAM,iBAAgB,aAAW,WAAS,CAAC,GAAG,QAAQ,UAAU,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,EAAC,IAAI,MAAI,KAAK,aAAW,QAAQ,IAAI,CAAC,IAAE;AACzI,WAAO,EAAC,WAAU,MAAK,KAAI,QAAQ,KAAK,IAAI,GAAE,GAAI,aAAW,EAAC,WAAU,IAAE,CAAC,EAAE;AAAA,EAC/E;AAAA,EACA,MAAM,QAAO;AAAC,eAAU,KAAK,KAAK,SAAS,OAAO,EAAE,GAAE,aAAW,MAAM,EAAE,KAAK,MAAM,IAAE,MAAM,EAAE,QAAQ,MAAM;AAAE,SAAK,SAAS,MAAM;AAAE,eAAU,WAAW,KAAK,SAAS,OAAO,EAAE,OAAM,QAAQ,MAAM;AAAE,SAAK,SAAS,MAAM;AAAE,UAAM,KAAK,SAAS,MAAM;AAAA,EAAC;AACzP;;;ACtEA,OAAO,SAAS;AAChB,SAAQ,YAAAK,iBAAe;AACvB,SAAQ,cAAAC,mBAAiB;AAKzB,IAAM,QAAM,CAAC,MAAY,kBAAgB,OAAM,gBAAc,UAAQ,OAAO,OAAO,IAAI,WAAW,MAAK,GAAG,GAAE,EAAC,iBAAgB,cAAa,CAAC;AAGpI,IAAM,eAAN,MAAmB;AAAA,EAExB,YAAoB,QAAoD,UAAgB,CAAC,GAAE;AAAvE;AAAoD;AAAA,EAAoB;AAAA,EAAxE;AAAA,EAAoD;AAAA,EADhE,QAAMC,YAAW;AAAA,EAAU,SAAO,oBAAI,IAAkB;AAAA,EAAU,UAAQ,IAAI,gBAAgB;AAAA,EAAU,SAAO,oBAAI,IAAkB;AAAA,EAErI,IAAI,GAAU;AAAC,WAAO,IAAI,UAAU,EAAC,OAAM,KAAK,OAAM,QAAO,EAAE,UAAS,KAAI,EAAE,OAAM,MAAK,EAAE,QAAO,SAAQ,EAAE,WAAU,UAAS,EAAE,SAAQ,CAAC,CAAC;AAAA,EAAC;AAAA,EAC5I,MAAM,GAAU;AACtB,UAAM,MAAI,KAAK,IAAI;AAAE,eAAU,CAACC,MAAIC,IAAG,KAAK,KAAK,OAAO,KAAG,CAACA,KAAI,UAAQ,CAACA,KAAI,aAAWA,KAAI,YAAU,MAAM,IAAI,MAAK,OAAO,OAAOD,IAAG;AACtI,UAAM,MAAI,KAAK,IAAI,CAAC;AAAE,QAAI,MAAI,KAAK,OAAO,IAAI,GAAG;AACjD,QAAG,CAAC,KAAI;AAAC,UAAG,KAAK,OAAO,QAAM,KAAK,MAAK,uBAAsB,GAAG;AAAE,YAAI,EAAC,KAAI,WAAU,EAAE,WAAU,SAAQ,OAAM,QAAO,GAAE,QAAO,GAAE,WAAU,GAAE,cAAa,EAAC;AAAE,WAAK,OAAO,IAAI,KAAI,GAAG;AAAA,IAAC;AACtL,QAAI,YAAU,KAAK,IAAI,IAAI,WAAU,EAAE,SAAS;AAAE,WAAO;AAAA,EAC3D;AAAA,EACA,MAAc,IAAIE,UAAgB,QAAW,cAAqB,MAAI;AAAA,EAAC,GAAE;AACvE,UAAM,OAAK,KAAK,OAAQ,YAAUA,WAAQ,aAAW;AACrD,WAAO,IAAI,QAAa,CAACC,UAAQ,WAAS;AACxC,YAAM,UAAQ,KAAK,QAAQ,WAAS,IAAI,kBAAkB,gBAAgB,IAAI,EAAE,GAAE,SAAgB,CAAC;AACnG,UAAI,QAAM,GAAE,OAAK,OAAM,UAAQ;AAC/B,YAAM,SAAO,CAAC,OAAU,MAAS;AAAC,YAAG,QAAQ;AAAO,kBAAQ;AAAK,qBAAa,KAAK;AAAE,eAAO,QAAQ;AAAE,YAAG,EAAE,QAAO,CAAC;AAAA,YAAO,CAAAA,SAAQ,KAAK;AAAA,MAAC;AACxI,YAAM,QAAM,WAAW,MAAI,OAAO,MAAK,MAAM,OAAK,oBAAkB,uBAAsB,CAACD,YAAS,IAAI,CAAC,GAAE,KAAK,QAAQ,aAAW,GAAK;AACxI,aAAO,KAAK,WAAU,MAAI;AAAC,YAAG;AAAC,sBAAY;AAAE,iBAAK;AAAK,iBAAO,MAAM,KAAK,UAAU,EAAC,GAAG,QAAO,iBAAgB,EAAC,CAAC,IAAE,IAAI;AAAA,QAAC,SAAO,GAAE;AAAC,iBAAO,MAAK,CAAC;AAAA,QAAC;AAAA,MAAC,CAAC;AACjJ,aAAO,GAAG,QAAO,WAAO;AACtB,cAAM,OAAK,OAAO,SAAS,KAAK,IAAE,QAAM,OAAO,KAAK,KAAK;AAAE,iBAAO,KAAK;AACvE,YAAG,QAAM,MAAS;AAAC,iBAAO,MAAK,MAAM,mBAAkB,CAACA,YAAS,IAAI,CAAC;AAAE;AAAA,QAAM;AAC9E,eAAO,KAAK,IAAI;AAChB,YAAG,KAAK,SAAS,EAAE,EAAE,KAAG;AAAC,gBAAM,MAAI,OAAO,OAAO,MAAM,GAAE,MAAI,IAAI,QAAQ,EAAE;AAAE,cAAG,IAAI,SAAS,MAAI,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,EAAE,OAAM,MAAM;AAAE,iBAAO,KAAK,MAAM,IAAI,SAAS,GAAE,GAAG,EAAE,SAAS,MAAM,CAAC,CAAC;AAAA,QAAC,QAAM;AAAC,iBAAO,MAAK,MAAM,mBAAkB,CAACA,YAAS,IAAI,CAAC;AAAA,QAAC;AAAA,MAC/P,CAAC;AACD,aAAO,KAAK,SAAQ,MAAI,OAAO,MAAK,MAAM,OAAK,oBAAkB,uBAAsB,CAACA,YAAS,IAAI,CAAC,CAAC;AACvG,aAAO,KAAK,SAAQ,MAAI,OAAO,MAAK,MAAM,OAAK,oBAAkB,uBAAsB,CAACA,YAAS,IAAI,CAAC,CAAC;AAAA,IACzG,CAAC;AAAA,EACH;AAAA,EACQ,cAAc,QAAW,kBAAgB,OAAM;AAAC,QAAG,QAAQ,oBAAkB,EAAE,OAAM,MAAM,gCAA+B,eAAe;AAAE,WAAO;AAAA,EAAM;AAAA,EAChK,MAAc,KAAK,KAAU,QAAM,OAAuB;AACxD,QAAI,UAAQ;AACZ,QAAG,CAAC,IAAI,UAAQ,CAAC,IAAI,MAAM,QAAO,CAAC,IAAI;AACvC,QAAG,IAAI,QAAM,OAAM;AAAC,YAAM,WAAS,IAAI,MAAK,UAAQ,MAAM;AAAS,UAAG,WAAS,IAAI,gBAAc,EAAE,QAAO;AAAQ,UAAG,IAAI,SAAO,SAAS,KAAI,OAAK;AAAA,IAAS;AAC3J,QAAG,CAAC,IAAI,MAAK;AAAC,UAAI;AAAe,UAAI,QAAM,YAAS;AAClD,YAAG;AACD,gBAAM,SAAO,KAAK,cAAc,MAAM,KAAK,IAAI,MAAK,EAAC,OAAM,IAAI,OAAM,MAAK,UAAS,OAAM,IAAI,KAAI,kBAAiB,IAAI,OAAM,CAAC,CAAC;AAC9H,gBAAM,UAAQ,OAAO,OAAK,QAAM,OAAO,QAAQ,qBAAmB,IAAI,UAAQ,OAAO,QAAQ,kBAAgB;AAC7G,cAAG,SAAQ;AAAC,gBAAI,YAAU;AAAE,gBAAI,SAAO;AAAA,UAAC;AAAC,iBAAO;AAAA,QAClD,QAAM;AAAC,iBAAO;AAAA,QAAK;AAAA,MACrB,GAAG;AAAA,IAAC;AACJ,WAAO,IAAI;AAAA,EACb;AAAA,EACA,MAAM,OAAO,GAAU;AAAC,UAAM,MAAI,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC;AAAE,WAAO,EAAC,eAAc,MAAI,MAAM,KAAK,KAAK,KAAI,IAAI,IAAE,KAAI;AAAA,EAAC;AAAA,EACxH,MAAM,IAAI,MAAYE,OAAS,GAAU,UAAsB;AAC7D,QAAG,QAAQ,aAAW,WAAS,CAAC,KAAK,QAAQ,WAAS,CAAC,KAAK,OAAO,MAAK,uBAAsB,GAAG;AACjG,QAAG,CAAC,mCAAmC,KAAK,KAAK,OAAO,QAAQ,EAAE,MAAK,uBAAsB,GAAG;AAChG,UAAM,MAAI,KAAK,MAAM,CAAC,GAAE,SAAO,YAAY,IAAI,CAAC,KAAK,QAAQ,QAAO,GAAI,WAAS,CAAC,QAAQ,IAAE,CAAC,CAAE,CAAC;AAIhG,QAAG,SAAO,wBAAsB,IAAI,WAAS,CAAC,KAAK,QAAQ,OAAO,SAAQ;AAAC,UAAI,UAAQ;AAAM,UAAI,OAAK;AAAU,UAAI,eAAa;AAAA,IAAC;AAClI,UAAM,QAAM,MAAI;AAAC,UAAG,OAAO,WAAS,IAAI,QAAQ,OAAM,MAAM,qBAAoB,OAAM,IAAI;AAAE,UAAG,CAAC,OAAO,cAAc,EAAE,SAAS,KAAG,EAAE,aAAW,KAAK,IAAI,EAAE,OAAM,MAAM,eAAe;AAAE,WAAK,QAAQ,WAAW,CAAC;AAAA,IAAC;AAClN,UAAM,QAAM,YAAS;AACnB,UAAI,OAAK,OAAM,aAAW;AAC1B,YAAM,QAAM,MAAI;AAAC,aAAK,KAAK,KAAK,GAAG;AAAA,MAAC;AAAE,aAAO,iBAAiB,SAAQ,OAAM,EAAC,MAAK,KAAI,CAAC;AAAE,UAAI;AAC7F,UAAG;AACD,cAAM;AAAE,cAAM,SAAO,MAAMC,UAAS,KAAK,OAAQ,YAAW,MAAM,GAAG,KAAK;AAAE,cAAM;AAClF,cAAM,QAAM,KAAK,cAAc,MAAM,KAAK,IAAI,MAAK,EAAC,OAAM,MAAK,QAAO,CAAC,CAAC;AACxE,YAAG,CAAC,MAAM,GAAG,OAAM,MAAM,MAAM,QAAM,qBAAqB;AAC1D,YAAG,MAAM,QAAQ,oBAAkB,KAAG,CAAC,iBAAiB,KAAK,MAAM,QAAQ,oBAAkB,EAAE,EAAE,OAAM,MAAM,8BAA8B;AAC3I,cAAM;AAAE,YAAI,SAAO,MAAM,OAAO;AAAiB,YAAI,QAAM;AAC3D,cAAM,WAAS,KAAK,cAAc,MAAM,KAAK,IAAI,OAAM,EAAC,OAAM,MAAK,MAAAD,OAAK,OAAM,IAAI,KAAI,WAAU,EAAE,WAAU,kBAAiB,IAAI,OAAM,GAAE,MAAI;AAAC,gBAAM;AAAE,iBAAK;AAAK,cAAI;AAAA,QAAW,CAAC,GAAE,IAAI;AAGtL,YAAI,YAAU,KAAK,IAAI,GAAE,IAAI,YAAU,CAAC;AACxC,YAAI,SAAO,KAAK,IAAI;AACpB,qBAAW,SAAS,WAAS;AAC7B,YAAG,OAAO,WAAS,IAAI,QAAQ,OAAM,MAAM,qBAAoB,QAAM,CAAC,UAAU;AAChF,aAAK,QAAQ,WAAW,CAAC;AACzB,YAAG,CAAC,SAAS,GAAG,OAAM,MAAM,SAAS,QAAM,uBAAsB,SAAS,WAAS,oBAAmB,SAAS,kBAAgB,IAAI;AACnI,YAAI,SAAO,KAAK,IAAI;AAAE,eAAO,SAAS;AAAA,MACxC,SAAO,GAAM;AACX,YAAG,EAAE,SAAO,gBAAgB,KAAI,UAAQ;AACxC,YAAG,OAAO,WAAS,IAAI,SAAQ;AAAC,gBAAM,UAAQ,MAAM,KAAK,KAAK,KAAI,IAAI;AAAE,gBAAM,MAAM,UAAQ,sBAAoB,mBAAkB,QAAM,CAAC,YAAW,OAAO;AAAA,QAAC;AAC5J,YAAG,CAAC,KAAK,GAAE,gBAAc;AACzB,cAAM;AAAA,MACR,UAAC;AAAQ,YAAI;AAAS,eAAO,oBAAoB,SAAQ,KAAK;AAAA,MAAC;AAAA,IACjE,GAAG;AACH,SAAK,OAAO,IAAI,IAAI;AACpB,QAAG;AAAC,aAAO,MAAM;AAAA,IAAI,UAAC;AAAQ,WAAK,OAAO,OAAO,IAAI;AAAA,IAAC;AAAA,EACxD;AAAA,EACA,MAAM,QAAO;AACX,SAAK,QAAQ,MAAM,MAAM,sBAAsB,CAAC;AAChD,UAAM,WAAS,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,OAAO,SAAK,IAAI,UAAQ,IAAI,aAAW,IAAI,SAAO,OAAM,KAAK,IAAI,CAAC;AAC3G,UAAM,UAAQ,MAAM,QAAQ,IAAI,SAAS,IAAI,SAAK,KAAK,KAAK,KAAI,IAAI,CAAC,CAAC;AACtE,UAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,MAAM,CAAC;AAAE,WAAO,EAAC,eAAc,QAAQ,MAAM,OAAO,EAAC;AAAA,EACzF;AACF;;;ACjGA,OAAOE,UAAS;AAChB,SAAQ,YAAAC,iBAAe;AACvB,SAAQ,oBAAmB;AAC3B,SAAQ,cAAAC,mBAAiB;AAczB,IAAM,aAAW,CAAC,iBAAgB,gBAAe,eAAc,gBAAgB;AAC/E,IAAM,UAAQ,MAAI,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,eAAc,MAAK,CAAC;AAIhH,IAAM,aAAW,CAAC,UAAY;AAAC,MAAG,UAAQ,gBAAgB,QAAO;AAAM,MAAG,OAAO,UAAQ,SAAS,MAAK,gBAAgB;AAAE,MAAG;AAAC,UAAM,MAAI,IAAI,IAAI,KAAK;AAAE,QAAG,CAAC,CAAC,SAAQ,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAG,IAAI,WAAS,MAAM,MAAK,gBAAgB;AAAE,WAAO;AAAA,EAAK,QAAM;AAAC,SAAK,gBAAgB;AAAA,EAAC;AAAC;AACzR,IAAM,gBAAc,CAAC,MAAY,UAAU,EAAC,QAAO,EAAE,UAAS,KAAI,EAAE,OAAM,MAAK,EAAE,QAAO,SAAQ,EAAE,WAAU,UAAS,EAAE,UAAS,OAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAC,CAAC;AAGnJ,IAAM,oBAAN,MAAM,2BAA0B,aAA6C;AAAA,EAClF;AAAA,EAAqB;AAAA,EAA0B;AAAA,EAA0B,SAAO,OAAO,MAAM,CAAC;AAAA,EAAU,SAAO;AAAA,EAAU,QAAM;AAAA,EAAc,gBAAc;AAAA,EACnJ,UAAQ,oBAAI,IAA6F;AAAA,EACzG,UAAQ,QAAQ,cAAmB;AAAA,EAAU;AAAA,EAAgD;AAAA,EAC7F,YAAY,QAAc,SAAY,OAAa;AACzD,UAAM;AAAE,SAAK,SAAOC,KAAI,iBAAiB,gBAAgB,OAAO,QAAQ,SAAS;AACjF,SAAK,YAAU,WAAW,MAAI,KAAK,OAAO,IAAI,WAAW,uBAAsB,GAAG,CAAC,GAAE,GAAI;AACzF,SAAK,OAAO,KAAK,WAAU,MAAI,KAAK,MAAM,EAAC,GAAG,SAAQ,eAAc,GAAE,MAAK,CAAC,CAAC;AAC7E,SAAK,OAAO,GAAG,QAAO,WAAO;AAAC,UAAG;AAAC,aAAK,QAAQ,KAAK;AAAA,MAAC,QAAM;AAAC,aAAK,OAAO,QAAQ,CAAC;AAAA,MAAC;AAAA,IAAC,CAAC;AACpF,SAAK,OAAO,KAAK,SAAQ,MAAI,KAAK,OAAO,IAAI,WAAW,KAAK,WAAS,oBAAkB,uBAAsB,GAAG,CAAC,CAAC;AACnH,SAAK,OAAO,KAAK,SAAQ,MAAI,KAAK,OAAO,QAAQ,CAAC,CAAC;AAAA,EACrD;AAAA,EACA,aAAa,KAAK,QAAc,SAAY;AAC1C,QAAG,QAAQ,aAAW,WAAS,CAAC,mCAAmC,KAAK,OAAO,QAAQ,EAAE,MAAK,uBAAsB,GAAG;AACvH,UAAM,SAAO,MAAMC,UAAS,OAAO,YAAW,MAAM,GAAG,KAAK,GAAE,OAAK,IAAI,mBAAkB,QAAO,SAAQ,KAAK;AAC7G,UAAM,KAAK,QAAQ;AAAQ,WAAO;AAAA,EACpC;AAAA,EACQ,MAAM,OAAU;AAAC,QAAG,KAAK,MAAM,OAAM,QAAQ;AAAE,UAAM,OAAK,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC;AAAE,QAAG,KAAK,SAAO,MAAM,MAAK,aAAa;AAAE,UAAM,SAAO,OAAO,YAAY,KAAK,SAAO,CAAC;AAAE,WAAO,cAAc,KAAK,SAAO,CAAC;AAAE,WAAO,CAAC,IAAE;AAAG,SAAK,KAAK,QAAO,CAAC;AAAE,SAAK,OAAO,MAAM,MAAM;AAAA,EAAC;AAAA,EACnR,QAAQ,OAAa;AAC3B,SAAK,SAAO,OAAO,OAAO,CAAC,KAAK,QAAO,KAAK,CAAC;AAAE,QAAG,KAAK,OAAO,SAAO,UAAQ,MAAM,OAAM,QAAQ;AACjG,WAAM,KAAK,OAAO,UAAQ,GAAE;AAC1B,YAAM,SAAO,KAAK,OAAO,aAAa,CAAC;AAAE,UAAG,SAAO,KAAG,SAAO,QAAQ,OAAM,QAAQ;AAAE,UAAG,KAAK,OAAO,SAAO,SAAO,EAAE;AACpH,YAAM,MAAI,KAAK,OAAO,CAAC,GAAE,OAAK,KAAK,OAAO,SAAS,GAAE,SAAO,CAAC;AAAE,WAAK,SAAO,KAAK,OAAO,SAAS,SAAO,CAAC;AACxG,UAAG,QAAM,IAAG;AAAC,YAAG,CAAC,KAAK,SAAS,OAAM,QAAQ;AAAE,aAAK,KAAK,SAAQ,MAAK,KAAK,aAAa;AAAE;AAAA,MAAQ;AAClG,UAAG,QAAM,MAAI,KAAK,SAAO,MAAM,OAAM,QAAQ;AAAE,YAAM,QAAM,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC;AAC3F,UAAG,MAAM,MAAI,UAAS;AACpB,YAAG,KAAK,SAAS,OAAM,QAAQ;AAAE,YAAG,MAAM,OAAK,MAAK;AAAC,eAAK,OAAO,IAAI,WAAW,MAAM,QAAM,uBAAsB,GAAG,CAAC;AAAE;AAAA,QAAM;AAC9H,YAAG,MAAM,kBAAgB,KAAG,CAAC,OAAO,cAAc,MAAM,KAAK,KAAG,MAAM,QAAM,KAAG,CAAC,OAAO,cAAc,MAAM,MAAM,KAAG,MAAM,SAAO,KAAG,CAAC,MAAM,QAAQ,MAAM,QAAQ,KAAG,OAAO,MAAM,cAAY,SAAS,OAAM,QAAQ;AACpN,aAAK,WAAS;AAAM,qBAAa,KAAK,SAAS;AAAE,aAAK,QAAQ,QAAQ,KAAK;AAAA,MAC7E,WAAS,MAAM,MAAI,cAAa;AAAC,aAAK,gBAAc;AAAA,MAAK,WACjD,MAAM,MAAI,OAAM;AACtB,cAAM,UAAQ,KAAK,QAAQ,IAAI,MAAM,EAAE;AAAE,YAAG,CAAC,QAAQ;AAAS,qBAAa,QAAQ,KAAK;AAAE,aAAK,QAAQ,OAAO,MAAM,EAAE;AAAE,gBAAQ,QAAQ,KAAK;AAAA,MAC/I,WAAS,MAAM,MAAI,SAAQ;AAAC,aAAK,gBAAc,MAAM,kBAAgB;AAAK,aAAK,KAAK,SAAQ,EAAC,MAAK,MAAM,QAAM,mBAAkB,eAAc,KAAK,cAAa,CAAC;AAAA,MAAC,MAC7J,OAAM,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA,EACQ,OAAOC,QAAU;AACvB,QAAG,KAAK,MAAM;AAAO,SAAK,QAAM;AAAK,iBAAa,KAAK,SAAS;AAAE,SAAK,OAAO,QAAQ;AAAE,SAAK,SAAO,OAAO,MAAM,CAAC;AAAE,SAAK,QAAQ,OAAOA,MAAK;AAC7I,eAAU,OAAO,KAAK,QAAQ,OAAO,GAAE;AAAC,mBAAa,IAAI,KAAK;AAAE,UAAI,OAAO,QAAQ,CAAC;AAAA,IAAC;AAAC,SAAK,QAAQ,MAAM;AAAE,SAAK,KAAK,SAAQ,EAAC,MAAKA,QAAO,QAAM,wBAAuB,eAAc,KAAK,cAAa,CAAC;AAAA,EAC1M;AAAA,EACA,QAAQ,SAAyB;AAC/B,QAAG,KAAK,MAAM,QAAO,QAAQ,OAAO,QAAQ,CAAC;AAAE,QAAG,KAAK,QAAQ,QAAM,GAAG,QAAO,QAAQ,OAAO,IAAI,WAAW,uBAAsB,GAAG,CAAC;AACvI,UAAMC,MAAG,EAAE,KAAK;AAChB,WAAO,IAAI,QAAQ,CAACC,UAAQ,WAAS;AAAC,YAAM,QAAM,WAAW,MAAI;AAAC,aAAK,QAAQ,OAAOD,GAAE;AAAE,eAAO,QAAQ,CAAC;AAAE,aAAK,OAAO,QAAQ,CAAC;AAAA,MAAC,GAAE,IAAI;AAAE,WAAK,QAAQ,IAAIA,KAAG,EAAC,SAAAC,UAAQ,QAAO,MAAK,CAAC;AAAE,UAAG;AAAC,aAAK,MAAM,EAAC,GAAG,SAAQ,IAAAD,IAAE,CAAC;AAAA,MAAC,SAAO,GAAE;AAAC,qBAAa,KAAK;AAAE,aAAK,QAAQ,OAAOA,GAAE;AAAE,eAAO,CAAC;AAAA,MAAC;AAAA,IAAC,CAAC;AAAA,EACxR;AAAA,EACA,MAAM,WAAS,OAAM;AAAC,QAAG;AAAC,WAAK,MAAM,EAAC,GAAE,SAAQ,GAAI,WAAS,EAAC,UAAS,KAAI,IAAE,CAAC,EAAE,CAAC;AAAA,IAAC,QAAM;AAAC,WAAK,OAAO,QAAQ,CAAC;AAAA,IAAC;AAAA,EAAC;AAAA,EAChH,QAAO;AACL,QAAG,CAAC,KAAK,SAAS,MAAK,YAAU,YAAS;AAAC,UAAG,KAAK,MAAM,QAAO,EAAC,eAAc,KAAK,cAAa;AAAE,UAAG;AAAC,cAAM,MAAI,MAAM,KAAK,QAAQ,EAAC,GAAE,QAAO,CAAC;AAAE,aAAK,gBAAc,IAAI,OAAK,QAAM,IAAI,kBAAgB;AAAK,eAAO,EAAC,eAAc,KAAK,cAAa;AAAA,MAAC,QAAM;AAAC,eAAO,EAAC,eAAc,KAAK,cAAa;AAAA,MAAC,UAAC;AAAQ,aAAK,OAAO,QAAQ,CAAC;AAAA,MAAC;AAAA,IAAC,GAAG;AACxU,WAAO,KAAK;AAAA,EACd;AACF;AAGA,IAAM,gBAAc,CAAC,EAAC,cAAa,KAAI,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,CAAC;AAG5L,IAAM,kBAAN,MAAsB;AAAA,EAI3B,YAAoB,QAAgC,WAA4B,UAA8B,CAAC,GAAE;AAA7F;AAAgC;AAA4B;AAAkC,SAAK,QAAM,YAAY,MAAI,KAAK,KAAK,MAAM,GAAE,QAAQ,WAAS,GAAG;AAAE,SAAK,MAAM,MAAM;AAAA,EAAC;AAAA,EAAnL;AAAA,EAAgC;AAAA,EAA4B;AAAA,EAHxE,iBAAe,oBAAI,IAAa;AAAA,EAChC,UAAQ,oBAAI,QAA+D;AAAA,EAC3E,WAAS,oBAAI,IAAoB;AAAA,EAAU,QAAME,YAAW;AAAA,EAAU,UAAQ;AAAA,EAAc;AAAA,EAA6C,UAAQ,oBAAI,IAAe;AAAA,EAAU,UAAQ;AAAA,EAEtL,MAAM,GAAU;AAAC,QAAG,KAAK,QAAQ,MAAK,wBAAuB,GAAG;AAAE,SAAK,UAAU,SAAS,CAAC;AAAE,QAAG,CAAC,EAAE,MAAM,SAAS,oBAAoB,EAAE,MAAK,gBAAe,GAAG;AAAE,QAAG,CAAC,OAAO,cAAc,EAAE,SAAS,KAAG,EAAE,aAAW,KAAK,IAAI,EAAE,MAAK,iBAAgB,GAAG;AAAA,EAAC;AAAA,EACzP,MAAM,KAAY,MAAY,QAAU,CAAC,GAAE;AAAC,QAAI,OAAO,KAAK,EAAC,IAAG,KAAK,IAAI,GAAE,MAAK,WAAU,IAAI,IAAG,QAAO,IAAI,QAAQ,QAAO,WAAU,IAAI,QAAQ,WAAU,GAAG,MAAK,CAAC;AAAE,QAAG,IAAI,OAAO,SAAO,IAAI,KAAI,OAAO,MAAM;AAAE,QAAG,CAAC,CAAC,SAAQ,YAAY,EAAE,SAAS,IAAI,EAAE,MAAK,UAAU,QAAQ,mBAAmB,KAAK,YAAY,EAAE,WAAW,KAAI,GAAG,CAAC,IAAG,IAAI,QAAQ,OAAM,GAAG,IAAI,QAAQ,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,IAAI,EAAE,EAAE;AAAA,EAAC;AAAA,EAC5Z,OAAO,KAAY;AAAC,WAAO,EAAC,WAAU,IAAI,IAAG,OAAM,IAAI,OAAM,WAAU,IAAI,QAAQ,WAAU,MAAK,sBAAqB,WAAU,IAAI,OAAO,SAAS,WAAU,UAAS,IAAI,OAAO,SAAS,UAAS,OAAM,IAAI,OAAO,SAAS,OAAM,QAAO,IAAI,OAAO,SAAS,QAAO,MAAK,IAAI,MAAK,gBAAe,IAAI,eAAc;AAAA,EAAC;AAAA,EACvT,IAAI,GAAUF,KAAO;AAAC,SAAK,MAAM,CAAC;AAAE,UAAM,MAAI,KAAK,SAAS,IAAIA,GAAE;AAAE,QAAG,CAAC,IAAI,MAAK,6BAA4B,GAAG;AAAE,QAAG,cAAc,CAAC,MAAI,cAAc,IAAI,OAAO,EAAE,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EAC9M,MAAM,KAAK,GAAU,SAAY;AAC/B,SAAK,MAAM,CAAC;AAAE,QAAG,CAAC,KAAK,OAAO,MAAK,uBAAsB,GAAG;AAC5D,QAAG,CAAC,WAAS,OAAO,YAAU,YAAU,MAAM,QAAQ,OAAO,KAAG,OAAO,KAAK,OAAO,EAAE,KAAK,OAAG,CAAC,CAAC,QAAO,OAAM,aAAY,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,MAAK,kBAAkB;AACtK,UAAM,OAAK,QAAQ,QAAM;AAAQ,QAAG,CAAC,CAAC,SAAQ,SAAS,EAAE,SAAS,IAAI,EAAE,MAAK,kBAAkB;AAAE,UAAM,MAAI,QAAQ,QAAQ,KAAI,GAAE,IAAG,EAAE;AACtI,QAAG,QAAQ,cAAY,WAAY,OAAO,QAAQ,cAAY,YAAU,QAAQ,UAAU,SAAO,KAAK,MAAK,kBAAkB;AAC7H,UAAM,SAAO,QAAQ,WAAS,SAAU,SAAU,WAAW,QAAQ,MAAM,GAAE,iBAAe,WAAW,MAAM,UAAM,EAAE,MAAM,SAAS,IAAI,CAAC;AACzI,QAAG,SAAO,aAAW,CAAC,eAAe,MAAK,gBAAe,GAAG;AAC5D,UAAM,KAAK,MAAM;AAAE,QAAG,KAAK,UAAQ,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,OAAO,OAAG,CAAC,EAAE,MAAM,EAAE,UAAQ,KAAG,KAAK,SAAS,QAAM,IAAI,MAAK,yBAAwB,GAAG;AACvJ,UAAMA,MAAG,WAAWE,YAAW,CAAC,IAAG,QAAM,OAAO;AAChD,SAAK;AAAU,QAAI;AACnB,QAAG;AAAC,eAAO,OAAO,KAAK,QAAQ,iBAAe,kBAAkB,MAAM,KAAK,QAAO,EAAC,OAAM,IAAI,UAAU,EAAC,OAAM,KAAK,OAAM,SAAQF,KAAG,UAAS,cAAc,CAAC,EAAC,CAAC,CAAC,GAAE,WAAU,EAAE,WAAU,KAAI,gBAAe,GAAI,QAAQ,YAAU,EAAC,WAAU,QAAQ,UAAS,IAAE,CAAC,EAAE,CAAC;AAAA,IAAC,UAAC;AAAQ,WAAK;AAAA,IAAS;AAC1R,QAAG;AAAC,WAAK,MAAM,CAAC;AAAA,IAAC,SAAO,GAAE;AAAC,YAAM,OAAO,MAAM;AAAE,YAAM;AAAA,IAAC;AACvD,UAAM,MAAY,EAAC,IAAAA,KAAG,OAAM,QAAO,IAAI,KAAK,GAAE,SAAQ,gBAAgB,CAAC,GAAE,QAAO,QAAO,MAAK,SAAQ,kBAAiB,SAAO,WAAU,gBAAe,MAAK,OAAM,QAAO,OAAM,SAAQ,OAAM,OAAM,QAAQ,QAAQ,GAAE,QAAO,GAAE,UAAS,OAAM,SAAQ,OAAM,aAAY,GAAE,QAAO,CAAC,GAAE,KAAI,SAAQ,GAAE,gBAAe,GAAE,YAAW,GAAE,aAAY,GAAE,aAAY,GAAE,eAAc,GAAE,gBAAe,MAAK;AAC7X,SAAK,SAAS,IAAIA,KAAG,GAAG;AAAE,WAAO,GAAG,SAAQ,CAAC,MAAK,aAAW;AAAC,UAAI,iBAAe;AAAM,WAAK,MAAM,KAAI,MAAK,QAAQ;AAAA,IAAC,CAAC;AAAE,WAAO,GAAG,SAAQ,WAAO;AAAC,UAAI,UAAQ,MAAM,kBAAgB;AAAK,UAAG,CAAC,IAAI,QAAO;AAAC,YAAI,SAAO;AAAK,YAAI,WAAS,KAAK,IAAI;AAAE,qBAAa,IAAI,UAAU;AAAE,qBAAa,IAAI,QAAQ;AAAE,YAAI,eAAa;AAAU,aAAK,KAAK,KAAI,EAAC,MAAK,UAAS,QAAO,gBAAe,MAAK,SAAQ,MAAK,MAAM,MAAK,eAAc,IAAI,QAAO,CAAC;AAAE,YAAI,QAAQ,MAAM,KAAK,uBAAuB;AAAE,aAAK,MAAM,KAAI,SAAQ,EAAC,MAAK,MAAM,MAAK,eAAc,IAAI,QAAO,CAAC;AAAA,MAAC;AAAA,IAAC,CAAC;AACpiB,SAAK,MAAM,KAAI,QAAQ;AAAE,WAAO,KAAK,OAAO,GAAG;AAAA,EACjD;AAAA,EACA,MAAM,MAAM,GAAU,SAAY;AAChC,UAAM,MAAI,KAAK,IAAI,GAAE,SAAS,SAAS;AAAE,QAAG,IAAI,OAAO,MAAK,0BAAyB,GAAG;AACxF,QAAG,QAAQ,WAAS,UAAW,WAAW,QAAQ,MAAM,MAAI,IAAI,OAAO,MAAK,iBAAgB,GAAG;AAC/F,QAAG,CAAC,IAAI,QAAQ,MAAM,MAAM,UAAM,EAAE,MAAM,SAAS,IAAI,CAAC,EAAE,MAAK,gBAAe,GAAG;AACjF,QAAG,IAAI,SAAS,MAAK,yBAAwB,GAAG;AAAE,QAAI,WAAS;AAC/D,QAAG;AAAC,WAAK,MAAM,CAAC;AAAE,YAAM,MAAI,MAAM,IAAI,OAAO,QAAQ,EAAC,GAAE,SAAQ,WAAU,EAAE,UAAS,CAAC;AAAE,UAAG,IAAI,OAAK,KAAK,MAAK,IAAI,QAAM,wBAAuB,GAAG;AAAE,WAAK,MAAM,CAAC;AAAE,UAAG,IAAI,OAAO,MAAK,0BAAyB,GAAG;AAAE,UAAI,UAAQ,gBAAgB,CAAC;AAAE,WAAK,MAAM,KAAI,SAAS;AAAE,aAAO,KAAK,OAAO,GAAG;AAAA,IAAC,SAAO,GAAE;AAAC,YAAM,KAAK,KAAK,KAAI,sBAAsB;AAAE,YAAM;AAAA,IAAC,UAAC;AAAQ,UAAI,WAAS;AAAA,IAAK;AAAA,EAC7X;AAAA,EACA,MAAM,aAAa,GAAU,SAAY;AAAC,UAAM,MAAI,KAAK,IAAI,GAAE,SAAS,SAAS;AAAE,WAAO,KAAK,KAAK,KAAI,gBAAgB;AAAA,EAAC;AAAA,EACzH,UAAU,QAAc;AAAC,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,KAAK,SAAK,CAAC,IAAI,UAAQ,IAAI,WAAS,UAAQ,IAAI,QAAQ,YAAU,KAAK,IAAI,CAAC;AAAA,EAAC;AAAA,EACjI,KAAK,KAAY,SAAY;AAAC,QAAG,IAAI,QAAQ,eAAa,EAAE,KAAI,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC;AAAA,EAAC;AAAA,EACpG,UAAU,KAAY,QAAM,GAAE;AAAC,QAAG,IAAI,UAAQ,IAAI,kBAAgB,IAAI,gBAAc,CAAC,IAAI,UAAQ,IAAI,OAAO,eAAa,EAAE;AAAO,iBAAa,IAAI,UAAU;AAAE,QAAI,iBAAe;AAAK,QAAI,aAAW,WAAW,MAAI,MAAM,YAAS;AAAC,UAAG,IAAI,OAAO;AAAO,WAAK,MAAM,IAAI,OAAO;AAAE,UAAG,IAAI,YAAU,IAAI,gBAAe;AAAC,cAAM,MAAI,MAAM,IAAI,OAAO,QAAQ,EAAC,GAAE,SAAQ,GAAG,cAAc,IAAI,OAAO,EAAC,CAAC;AAAE,YAAG,CAAC,IAAI,GAAG,OAAM,IAAI,WAAW,IAAI,QAAM,sBAAsB;AAAE,YAAI,iBAAe,IAAI;AAAA,MAAO;AAAC,UAAG,CAAC,IAAI,OAAO,KAAI,OAAO,MAAM,KAAK,eAAe,OAAO,GAAG,CAAC;AAAA,IAAC,GAAG,EAAE,MAAM,MAAI,KAAK,KAAK,KAAI,sBAAsB,CAAC,GAAE,KAAK;AAAE,QAAI,WAAW,MAAM;AAAA,EAAC;AAAA,EACznB,UAAU,KAAY,WAAS,OAAM,WAAS,IAAI,eAAc;AACtE,QAAG,IAAI,UAAQ,IAAI,QAAQ,eAAa,EAAE;AAC1C,UAAM,MAAI,WAAS,aAAW,SAAS,QAAQ;AAC/C,QAAG,UAAS;AAAC,UAAI,UAAQ;AAAI,UAAI,cAAY,YAAY,IAAI;AAAA,IAAC;AAC9D,iBAAa,IAAI,QAAQ;AAAE,QAAI,WAAS,WAAW,MAAI,KAAK,KAAK,KAAK,KAAI,2BAA2B,GAAE,IAAK;AAAE,QAAI,SAAS,MAAM;AACjI,QAAI,OAAO,KAAK,KAAI,QAAU,CAAAD,WAAO;AAAC,UAAGA,OAAM,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,IAAC,CAAC;AAAA,EAC5F;AAAA,EACQ,MAAM,KAAY,MAAY,UAAc;AAClD,QAAG,IAAI,UAAQ,CAAC,IAAI,UAAQ,IAAI,OAAO,eAAa,EAAE;AACtD,QAAG;AAAC,WAAK,MAAM,IAAI,OAAO;AAAA,IAAC,QAAM;AAAC,WAAK,KAAK,KAAK,KAAI,eAAe;AAAE;AAAA,IAAM;AAC5E,UAAM,SAAO,IAAI;AACjB,QAAG,CAAC,OAAO,SAAS,IAAI,KAAG,KAAK,SAAO,SAAQ;AAAC,WAAK,KAAK,KAAK,KAAI,eAAe;AAAE;AAAA,IAAM;AAC1F,UAAM,UAAQ,KAAK,QAAQ,IAAI,GAAG,KAAG,oBAAI,IAAI;AAAE,SAAK,QAAQ,IAAI,KAAI,OAAO;AAG3E,UAAM,QAAM,UAAU,UAAQ,SAAS,OAAO,QAAM,SAAS,OAAO,UAAQ,IAAI,OAAO,SAAS,QAAM,IAAI,OAAO,SAAS,SAAO,QAAK,KAAK,UAAQ;AACnJ,QAAG,QAAQ,SAAO,QAAM,IAAE,IAAG;AAAC,UAAG,IAAI,cAAa;AAAC,aAAK,MAAM,KAAI,YAAY;AAAE,aAAK,eAAe,IAAI,GAAG;AAAA,MAAC;AAAC,UAAI,eAAa,EAAC,MAAK,SAAQ;AAAE;AAAA,IAAM;AACpJ,QAAG,OAAO,kBAAgB,KAAK,QAAQ,qBAAmB,SAAQ;AAAC,WAAK,MAAM,KAAI,YAAY;AAAE,WAAK,eAAe,IAAI,GAAG;AAAE,WAAK,UAAU,KAAI,GAAG;AAAE;AAAA,IAAM;AAC3J,QAAI,UAAQ;AAAK,QAAI,cAAY,YAAY,IAAI;AAAE,QAAI;AACvD,YAAQ,IAAI,SAAS,IAAI,aAAa,IAAG,EAAC,SAAQ,IAAI,aAAY,UAAS,UAAU,aAAW,KAAI,CAAC;AACrG,SAAK,KAAK,KAAI,EAAC,MAAK,SAAQ,OAAM,IAAI,OAAO,SAAS,OAAM,QAAO,IAAI,OAAO,SAAS,QAAO,YAAW,UAAU,cAAY,IAAI,OAAO,SAAS,OAAM,aAAY,UAAU,eAAa,IAAI,OAAO,SAAS,QAAO,GAAI,UAAU,SAAO,EAAC,QAAO,SAAS,QAAO,UAAS,SAAS,aAAW,KAAI,IAAE,CAAC,GAAG,SAAQ,UAAU,WAAS,IAAG,cAAa,UAAU,gBAAc,KAAI,UAAS,IAAI,eAAc,WAAU,UAAU,WAAU,UAAS,UAAU,SAAQ,CAAC;AACvc,UAAM,WAAS,IAAI;AACnB,WAAO,KAAK,MAAK,EAAC,QAAO,KAAI,GAAE,CAAAA,WAAO;AAAC,UAAGA,OAAM,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,WAAM;AAAC,aAAK,UAAU,KAAI,OAAM,QAAQ;AAAE,aAAK,UAAU,GAAG;AAAA,MAAC;AAAA,IAAC,CAAC;AAAA,EAC1J;AAAA,EACQ,QAAQ,KAAY,MAAuB;AACjD,QAAG,IAAI,UAAQ,IAAG;AAAC,WAAK,KAAK,KAAI,EAAC,MAAK,SAAQ,MAAK,sBAAqB,CAAC;AAAE;AAAA,IAAM;AAAC,QAAI;AACvF,QAAI,QAAM,IAAI,MAAM,KAAK,YAAS;AAAC,UAAG,IAAI,OAAO;AAAO,UAAG;AAAC,aAAK,MAAM,IAAI,OAAO;AAAE,cAAM,KAAK;AAAA,MAAC,SAAO,GAAM;AAAC,aAAK,KAAK,KAAI,EAAC,MAAK,SAAQ,MAAK,GAAG,QAAM,yBAAwB,CAAC;AAAE,cAAM,KAAK,KAAK,KAAI,GAAG,QAAM,wBAAwB;AAAA,MAAC;AAAA,IAAC,CAAC,EAAE,QAAQ,MAAI,IAAI,QAAQ;AAAA,EACvQ;AAAA,EACQ,MAAM,OAAU,KAAY;AAClC,QAAG,CAAC,SAAO,OAAO,UAAQ,YAAU,MAAM,QAAQ,KAAK,EAAE,MAAK,kBAAkB;AAChF,QAAG,MAAM,SAAO,WAAU;AACxB,UAAG,CAAC,CAAC,QAAO,QAAO,IAAI,EAAE,SAAS,MAAM,MAAM,KAAG,CAAC,CAAC,QAAO,UAAS,OAAO,EAAE,SAAS,MAAM,UAAQ,MAAM,EAAE,MAAK,kBAAkB;AAClI,aAAO,EAAC,MAAK,WAAU,QAAO,MAAM,QAAO,QAAO,MAAM,UAAQ,QAAO,GAAE,QAAQ,MAAM,GAAE,GAAE,IAAI,OAAO,SAAS,QAAM,CAAC,GAAE,GAAE,QAAQ,MAAM,GAAE,GAAE,IAAI,OAAO,SAAS,SAAO,CAAC,EAAC;AAAA,IAC3K;AACA,QAAG,MAAM,SAAO,OAAM;AAAC,UAAG,CAAC,CAAC,QAAO,IAAI,EAAE,SAAS,MAAM,MAAM,KAAG,OAAO,MAAM,SAAO,YAAU,CAAC,MAAM,QAAM,MAAM,KAAK,SAAO,MAAI,OAAO,MAAM,QAAM,YAAU,MAAM,IAAI,SAAO,GAAG,MAAK,kBAAkB;AAAE,aAAO,EAAC,MAAK,OAAM,QAAO,MAAM,QAAO,MAAK,MAAM,MAAK,KAAI,MAAM,IAAG;AAAA,IAAC;AACjR,QAAG,MAAM,SAAO,QAAQ,QAAO,EAAC,MAAK,SAAQ,QAAO,QAAQ,MAAM,QAAO,OAAM,IAAI,GAAE,QAAO,QAAQ,MAAM,QAAO,OAAM,IAAI,EAAC;AAC5H,QAAG,MAAM,SAAO,QAAO;AAAC,UAAG,OAAO,MAAM,SAAO,YAAU,MAAM,KAAK,SAAO,QAAM,2CAA2C,KAAK,MAAM,IAAI,EAAE,MAAK,aAAa;AAAE,aAAO,EAAC,MAAK,QAAO,MAAK,MAAM,KAAI;AAAA,IAAC;AACrM,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA,EAEA,OAAO,QAAiB,QAAe,iBAAwB,CAAC,GAAE;AAChE,SAAK,QAAQ,IAAI,MAAM;AAAE,QAAI,KAAsB,iBAAe,OAAMI,SAAM;AAC9E,UAAM,YAAU,WAAW,MAAI,OAAO,MAAM,MAAK,iCAAiC,GAAE,KAAK,QAAQ,iBAAe,GAAI;AAAE,cAAU,MAAM;AACtI,UAAM,YAAU,YAAY,MAAI;AAAC,UAAG,CAACA,QAAM;AAAC,eAAO,UAAU;AAAE;AAAA,MAAM;AAAC,MAAAA,SAAM;AAAM,aAAO,KAAK;AAAA,IAAC,GAAE,IAAK;AAAE,cAAU,MAAM;AAAE,WAAO,GAAG,QAAO,UAAM;AAC/I,MAAAA,SAAM;AAAK,UAAG,CAAC,IAAI;AACnB,YAAM,MAAI,KAAK,SAAS,GAAE,WAAS,QAAM,cAAY,IAAI,YAAU;AACnE,YAAM,UAAQ,KAAK,QAAQ,IAAI,GAAG,GAAE,SAAO,SAAS,IAAI,GAAG;AAC3D,UAAG,CAAC,YAAU,CAAC,OAAO;AACtB,mBAAa,IAAI,QAAQ;AAAE,YAAM,UAAQ,YAAY,IAAI,KAAG,WAAS,IAAI,cAAY,OAAQ;AAC7F,UAAG,UAAS;AAAC,YAAI,UAAQ;AAAU,YAAI,cAAY;AAAQ,aAAK,UAAU,GAAG;AAAE;AAAA,MAAM;AACrF,cAAS,OAAO,GAAG;AACnB,UAAI,UAAQ;AAAM,YAAM,SAAO,MAAK,IAAI,KAAI,WAAS,KAAK,IAAI,GAAE,UAAQ,IAAI,WAAW;AACvF,UAAG,CAAC,OAAQ,YAAU,WAAS,SAAO,QAAM,IAAI,UAAQ,cAAc,SAAO,GAAE;AAAC,YAAI,UAAQ,KAAK,IAAI,cAAc,SAAO,GAAE,IAAI,WAAS,WAAS,SAAO,IAAE,IAAE,EAAE;AAAE,YAAI,aAAW;AAAA,MAAC,WACzK,WAAS,SAAO,QAAK,IAAI,UAAQ,KAAG,EAAE,IAAI,cAAY,IAAG;AAAC,YAAI;AAAU,YAAI,aAAW;AAAA,MAAC,WACxF,YAAU,SAAO,KAAI,KAAI,aAAW;AAC5C,UAAG,IAAI,cAAa;AAAC,cAAM,UAAQ,IAAI;AAAa,YAAI,eAAa;AAAU,aAAK,MAAM,KAAI,QAAQ,MAAK,QAAQ,QAAQ;AAAA,MAAC,MAAM,MAAK,UAAU,GAAG;AAAA,IACtJ,CAAC;AACD,UAAM,SAAO,CAAC,SAAc;AAAC,UAAG,OAAO,eAAa,EAAE,QAAO,KAAK,KAAK,UAAU,EAAC,MAAK,SAAQ,KAAI,CAAC,CAAC;AAAE,aAAO,MAAM,MAAK,IAAI;AAAA,IAAC;AAC9H,WAAO,GAAG,WAAU,CAAC,MAAK,aAAW;AACnC,UAAI;AAAY,UAAG;AAAC,YAAG,YAAU,KAAK,SAAO,MAAM,MAAK,kBAAkB;AAAE,kBAAQ,KAAK,MAAM,KAAK,SAAS,CAAC;AAAE,YAAG,CAAC,WAAS,OAAO,YAAU,YAAU,MAAM,QAAQ,OAAO,EAAE,MAAK,kBAAkB;AAAA,MAAC,QAAM;AAAC,eAAO,kBAAkB;AAAE;AAAA,MAAM;AAC/O,UAAG,CAAC,KAAI;AACN,YAAG,gBAAe;AAAC,iBAAO,cAAc;AAAE;AAAA,QAAM;AAChD,YAAG;AACD,gBAAM,YAAU,KAAK,SAAS,IAAI,QAAQ,SAAS;AACnD,cAAG,QAAQ,SAAO,UAAQ,OAAO,QAAQ,UAAQ,YAAU,CAAC,sBAAsB,KAAK,QAAQ,KAAK,KAAG,CAAC,aAAW,CAAC,QAAQ,QAAQ,OAAM,UAAU,MAAM,EAAE,MAAK,gBAAe,GAAG;AACnL,cAAG,UAAU,UAAQ,UAAU,KAAK,MAAK,0BAAyB,GAAG;AACrE,eAAK,MAAM,UAAU,OAAO;AAC5B,cAAG,WAAS,WAAY,UAAU,SAAO,WAAS,UAAU,SAAO,CAAC,eAAe,SAAS,MAAM,GAAG,MAAK,iBAAgB,GAAG;AAC7H,cAAG,UAAU,UAAQ,WAAS,QAAU;AAAA,UAA4C;AACpF,gBAAI;AAAU,cAAI,OAAK;AAAK,cAAI,SAAO;AAAO,2BAAe;AAAK,uBAAa,SAAS;AACxF,eAAK,QAAQ,KAAI,YAAS;AACxB,gBAAG,IAAK,kBAAiB;AAAC,oBAAM,MAAI,MAAM,IAAK,OAAO,QAAQ,EAAC,GAAE,WAAU,QAAO,UAAS,CAAC;AAAE,kBAAG,CAAC,IAAI,GAAG,MAAK,IAAI,QAAM,uBAAsB,GAAG;AAAE,kBAAK,OAAK;AAAA,YAAS;AACtK,kBAAM,EAAC,GAAE,IAAG,WAAU,mBAAkB,GAAG,SAAQ,IAAE,IAAK,OAAO;AACjE,iBAAK,KAAK,KAAK,EAAC,GAAG,UAAS,MAAK,SAAQ,WAAU,IAAK,IAAG,iBAAgB,mBAAkB,MAAK,IAAK,MAAK,WAAU,IAAK,QAAQ,WAAU,gBAAe,IAAK,eAAc,CAAC;AAAE,iBAAK,MAAM,KAAK,eAAe;AAAE,iBAAK,UAAU,KAAK,IAAI;AAAA,UAC7O,CAAC;AAAA,QACH,SAAO,GAAM;AAAC,iBAAO,EAAE,QAAM,cAAc;AAAA,QAAC;AAC5C;AAAA,MACF;AACA,YAAM,UAAQ;AACd,UAAG,QAAQ,SAAO,SAAQ;AAAC,aAAK,KAAK,KAAK,SAAQ,gBAAgB;AAAE;AAAA,MAAM;AAC1E,WAAK,QAAQ,SAAQ,YAAS;AAC5B,YAAG,QAAQ,SAAO,WAAU;AAC1B,cAAG,CAAC,CAAC,WAAU,SAAS,EAAE,SAAS,QAAQ,MAAM,EAAE,MAAK,kBAAkB;AAC1E,cAAG,QAAQ,WAAS,aAAW,CAAC,QAAQ,gBAAe;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,SAAQ,IAAG,OAAM,MAAK,gBAAe,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE;AAAA,UAAM;AAC3L,cAAI;AACJ,cAAG;AAAC,kBAAI,MAAM,QAAQ,OAAO,QAAQ,EAAC,GAAE,WAAU,QAAO,QAAQ,OAAM,CAAC;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,SAAQ,IAAG,OAAM,MAAK,EAAE,QAAM,mBAAkB,iBAAgB,MAAK,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE,kBAAM,KAAK,KAAK,SAAQ,iBAAiB;AAAE;AAAA,UAAM;AACrS,cAAG,IAAI,OAAK,MAAK;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,QAAQ,MAAK,IAAG,OAAM,MAAK,IAAI,QAAM,uBAAsB,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE,gBAAG,QAAQ,WAAS,UAAU,OAAM,KAAK,KAAK,SAAQ,2BAA2B;AAAE;AAAA,UAAM;AAC9P,kBAAQ,OAAK,IAAI,SAAO,YAAU,YAAU;AAAQ,eAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,QAAQ,MAAK,IAAG,MAAK,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE,eAAK,MAAM,SAAQ,WAAU,EAAC,MAAK,QAAQ,KAAI,CAAC;AAAA,QACnN,WAAS,QAAQ,SAAO,SAAQ;AAC9B,cAAI;AACJ,cAAG;AAAC,oBAAQ,QAAQ,IAAG,GAAE,OAAO,gBAAgB;AAAE,gBAAG,QAAQ,MAAI,QAAQ,YAAY,MAAK,wBAAuB,GAAG;AAAE,oBAAQ,cAAY,QAAQ;AAAG,gBAAG,QAAQ,SAAO,UAAU,MAAK,uBAAsB,GAAG;AAAE,oBAAM,KAAK,MAAM,QAAQ,OAAM,OAAO;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,SAAQ,IAAG,QAAQ,IAAG,IAAG,OAAM,MAAK,EAAE,QAAM,oBAAmB,iBAAgB,MAAK,CAAC;AAAE;AAAA,UAAM;AAC3X,cAAI;AAAQ,cAAG;AAAC,kBAAI,MAAM,QAAQ,OAAO,QAAQ,EAAC,GAAE,SAAQ,GAAG,MAAK,CAAC;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,SAAQ,IAAG,QAAQ,IAAG,IAAG,OAAM,MAAK,EAAE,QAAM,mBAAkB,iBAAgB,KAAI,CAAC;AAAE,kBAAM,KAAK,KAAK,SAAQ,iBAAiB;AAAE;AAAA,UAAM;AAClP,eAAK,KAAK,SAAQ,EAAC,MAAK,SAAQ,IAAG,QAAQ,IAAG,IAAG,IAAI,OAAK,MAAK,GAAI,IAAI,KAAG,CAAC,IAAE,EAAC,MAAK,IAAI,QAAM,kBAAiB,iBAAgB,IAAI,oBAAkB,KAAI,EAAE,CAAC;AAAE,eAAK,MAAM,SAAQ,SAAQ,EAAC,IAAG,QAAQ,IAAG,OAAM,MAAM,MAAK,IAAG,IAAI,OAAK,KAAI,CAAC;AAAA,QAC3O,WAAS,QAAQ,SAAO,iBAAgB;AACtC,cAAI;AACJ,cAAG;AAAC,kBAAI,MAAM,QAAQ,OAAO,QAAQ,EAAC,GAAE,gBAAe,CAAC;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,iBAAgB,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,GAAG,IAAG,OAAM,MAAK,EAAE,QAAM,mBAAkB,iBAAgB,KAAI,CAAC;AAAE,kBAAM,KAAK,KAAK,SAAQ,iBAAiB;AAAE;AAAA,UAAM;AAC9Q,eAAK,KAAK,SAAQ,EAAC,MAAK,iBAAgB,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,GAAG,IAAG,IAAI,OAAK,MAAK,GAAI,IAAI,KAAG,CAAC,IAAE,EAAC,MAAK,IAAI,QAAM,6BAA4B,iBAAgB,KAAI,EAAE,CAAC;AAAE,eAAK,MAAM,SAAQ,eAAe;AAAE,cAAG,CAAC,IAAI,GAAG,OAAM,KAAK,KAAK,SAAQ,2BAA2B;AAAA,QAC/R,MAAM,MAAK,kBAAkB;AAAA,MAC/B,CAAC;AAAA,IACH,CAAC;AACD,WAAO,GAAG,SAAQ,MAAI;AAAC,UAAG,IAAI,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,IAAC,CAAC;AACzE,WAAO,KAAK,SAAQ,MAAI;AAAC,mBAAa,SAAS;AAAE,oBAAc,SAAS;AAAE,WAAK,QAAQ,OAAO,MAAM;AAAE,UAAG,IAAI,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,IAAC,CAAC;AAAA,EAC1J;AAAA,EACQ,KAAK,KAAY,QAA+C;AACtE,SAAK,eAAe,OAAO,GAAG;AAC9B,QAAG,IAAI,KAAK,QAAO,IAAI;AACvB,QAAI,SAAO;AAAK,QAAI,WAAS,KAAK,IAAI;AAAE,iBAAa,IAAI,UAAU;AAAE,iBAAa,IAAI,QAAQ;AAAE,QAAI,eAAa;AACjH,QAAI,QAAM,YAAS;AAAC,YAAM,SAAO,MAAM,IAAI,OAAO,MAAM,EAAE,MAAM,OAAK,EAAC,eAAc,MAAK,EAAE;AAAE,UAAI,UAAQ,OAAO,kBAAgB;AAAK,UAAI,OAAK;AAAQ,WAAK,KAAK,KAAI,EAAC,MAAK,UAAS,QAAO,gBAAe,MAAK,SAAQ,MAAK,QAAO,eAAc,IAAI,QAAO,CAAC;AAAE,UAAI,QAAQ,MAAM,KAAK,wBAAwB;AAAE,WAAK,MAAM,KAAI,UAAS,EAAC,QAAO,eAAc,IAAI,QAAO,CAAC;AAAE,aAAO,EAAC,eAAc,IAAI,QAAO;AAAA,IAAC,GAAG;AAChZ,WAAO,IAAI;AAAA,EACb;AAAA,EACA,MAAM,QAAO;AACX,UAAM,UAAuB,CAAC;AAC9B,eAAU,CAACH,KAAG,GAAG,KAAK,KAAK,UAAS;AAClC,UAAG,IAAI,QAAO;AAAC,YAAG,IAAI,WAAU,MAAM,KAAK,IAAI,EAAE,MAAK,SAAS,OAAOA,GAAE;AAAE;AAAA,MAAQ;AAClF,UAAG,IAAI,SAAS;AAChB,UAAG;AAAC,aAAK,MAAM,IAAI,OAAO;AAAA,MAAC,QAAM;AAAC,gBAAQ,KAAK,KAAK,KAAK,KAAI,eAAe,CAAC;AAAA,MAAC;AAAA,IAChF;AACA,UAAM,QAAQ,IAAI,OAAO;AAAA,EAC3B;AAAA,EACA,aAAa,GAAUA,KAAU;AAAC,WAAO,gBAAgB,KAAK,IAAI,GAAEA,GAAE,EAAE,MAAM;AAAA,EAAC;AAAA,EAC/E,MAAM,QAAO;AAAC,SAAK,UAAQ;AAAK,kBAAc,KAAK,KAAK;AAAE,UAAM,SAAO,MAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,SAAK,KAAK,KAAK,KAAI,sBAAsB,CAAC,CAAC;AAAE,eAAU,UAAU,KAAK,QAAQ,QAAO,UAAU;AAAE,SAAK,QAAQ,MAAM;AAAE,WAAO,EAAC,eAAc,OAAO,MAAM,OAAG,EAAE,aAAa,EAAC;AAAA,EAAC;AACxS;;;AC/OA,SAAQ,UAAS,aAAY;AAC7B,SAAQ,iBAAgB;AACxB,SAAQ,SAAAI,QAAM,QAAAC,OAAK,YAAAC,WAAS,SAAAC,cAAY;AACxC,SAAQ,YAAW,QAAAC,aAAW;AAC9B,SAAQ,cAAAC,mBAAiB;;;ACFzB,eAAsB,yBAAwB;AAC9C,QAAM,EAAC,OAAAC,OAAK,IAAE,MAAM,OAAO,oBAAoB;AAC/C,QAAM,EAAC,MAAAC,MAAI,IAAE,MAAM,OAAO,kBAAkB;AAC5C,QAAM,CAAC,cAAa,cAAa,YAAW,GAAG,IAAI,IAAE,QAAQ,KAAK,MAAM,CAAC,GAAE,WAAS,OAAO,YAAY;AACvG,MAAG,CAAC,OAAO,cAAc,QAAQ,KAAG,YAAU,KAAK,IAAI,KAAG,CAAC,WAAW,SAAQ,KAAK,GAAG;AAGtF,MAAI;AACJ,MAAG;AAAC,eAAS,KAAK,MAAM,YAAY;AAAA,EAAC,QAAM;AAAC,YAAQ,KAAK,GAAG;AAAA,EAAC;AAC7D,MAAG,CAAC,YAAU,OAAO,KAAK,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,MAAI,mBAAiB,CAAC,CAAC,SAAQ,OAAM,KAAK,EAAE,MAAM,OAAG,OAAO,SAAS,CAAC,MAAI,YAAU,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAG,SAAS,QAAM,OAAK,SAAS,UAAQ,IAAI,SAAQ,KAAK,GAAG;AAC7O,aAAUC,SAAQ,CAAC,cAAa,GAAG,GAAE;AACpC,UAAM,IAAE,MAAMD,MAAKC,OAAK,EAAC,QAAO,KAAI,CAAC;AACrC,QAAG,CAAC,EAAE,YAAY,KAAG,OAAO,EAAE,GAAG,MAAI,SAAS,OAAK,OAAO,EAAE,GAAG,MAAI,SAAS,OAAK,OAAO,EAAE,WAAW,MAAI,SAAS,MAAM,SAAQ,KAAK,GAAG;AAAA,EACzI;AACA,UAAQ,UAAU,CAAC,CAAC;AACpB,MAAI;AAGJ,QAAM,OAAK,UAAM,QAAQ,KAAK,IAAI;AAClC,QAAM,QAAM,WAAW,MAAI,KAAK,GAAG,GAAE,KAAK,IAAI,GAAE,WAAS,KAAK,IAAI,CAAC,CAAC;AACpE,UAAQ,KAAK,WAAU,MAAI,KAAK,GAAG,CAAC;AAAE,UAAQ,KAAK,UAAS,MAAI,KAAK,GAAG,CAAC;AACzE,MAAG;AACF,YAAMF,OAAM,YAAW,MAAK,EAAC,KAAI,OAAM,KAAI,OAAM,KAAI,EAAC,MAAK,gCAA+B,MAAK,WAAU,MAAK,OAAM,GAAE,OAAM,CAAC,UAAS,WAAU,SAAS,EAAC,CAAC;AAC3J,UAAM,KAAK,SAAQ,MAAI,KAAK,GAAG,CAAC;AAChC,UAAM,KAAK,SAAQ,CAAC,MAAK,WAAS;AAAC,mBAAa,KAAK;AAAE,WAAK,SAAO,SAAO,MAAI,EAAE;AAAA,IAAC,CAAC;AAAA,EACnF,QAAM;AAAC,SAAK,GAAG;AAAA,EAAC;AAChB;AAGO,IAAM,8BAA4B,IAAI,uBAAuB,SAAS,CAAC;AAAA;;;ADvB9E,IAAM,UAAQ,UAAU,QAAQ;AACzB,IAAM,kBAAgB;AAE7B,IAAM,SAAO,CAAC,MAAQ,MAAI,QAAM,OAAO,MAAI,YAAU,CAAC,MAAM,QAAQ,CAAC;AACrE,IAAM,WAAS,oBAAI,IAAI,CAAC,aAAY,UAAS,WAAW,CAAC;AACzD,IAAM,MAAI,CAAC,eAAoB,EAAC,MAAK,iCAAgC,MAAK,WAAU,MAAK,gBAAe,eAAc,UAAS;AACxH,SAAS,+BAA+B,OAA6B;AAC3E,MAAG,QAAQ,aAAW,QAAQ,MAAK,kCAAiC,GAAG;AACvE,MAAG,CAAC,OAAO,KAAK,KAAG,OAAO,KAAK,KAAK,EAAE,KAAK,OAAG,CAAC,CAAC,oBAAmB,SAAQ,eAAc,OAAO,EAAE,SAAS,CAAC,CAAC,KAAG,OAAO,MAAM,qBAAmB,YAAU,CAAC,WAAW,MAAM,gBAAgB,KAAG,MAAM,iBAAiB,SAAS,IAAI,KAAG,MAAM,UAAQ,mBAAiB,CAAC,OAAO,MAAM,WAAW,KAAG,CAAC,OAAO,KAAK,MAAM,WAAW,EAAE,UAAQ,OAAO,QAAQ,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC,MAAKG,KAAI,MAAI,CAAC,oBAAoB,KAAK,IAAI,KAAG,OAAOA,UAAO,YAAU,CAAC,wDAAwD,KAAKA,KAAI,CAAC,KAAG,MAAM,UAAQ,UAAW,OAAO,MAAM,UAAQ,UAAU,MAAK,0BAA0B;AACrlB,SAAO;AACR;AACO,SAAS,mBAAmB,EAAC,MAAK,OAAM,WAAU,WAAU,mBAAkB,QAAO,YAAW,MAAK,aAAW,KAAK,IAAI,IAAE,KAAM,iBAAe,0BAAyB,GAAgM;AAE/W,MAAG,CAAC,4BAA4B,KAAK,IAAI,KAAG,CAAC,kBAAkB,KAAK,KAAK,KAAG,CAAC,CAAC,WAAU,cAAc,EAAE,MAAM,OAAG,OAAO,MAAI,YAAU,WAAW,CAAC,KAAG,CAAC,YAAY,KAAK,CAAC,CAAC,KAAG,OAAO,sBAAoB,YAAU,kBAAkB,SAAO,OAAK,CAAC,OAAO,cAAc,UAAU,KAAG,cAAY,KAAG,KAAK,KAAK,OAAG,OAAO,MAAI,YAAU,EAAE,SAAS,IAAI,CAAC,EAAE,MAAK,4BAA4B;AACtX,MAAI;AAAa,MAAG;AAAC,eAAS,KAAK,MAAM,iBAAiB;AAAA,EAAC,QAAM;AAAC,SAAK,4BAA4B;AAAA,EAAC;AACpG,MAAG,CAAC,OAAO,QAAQ,KAAG,OAAO,KAAK,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,MAAI,mBAAiB,CAAC,CAAC,OAAM,OAAM,OAAO,EAAE,MAAM,OAAG,OAAO,SAAS,CAAC,MAAI,YAAU,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAG,SAAS,QAAM,OAAK,SAAS,UAAQ,IAAI,MAAK,4BAA4B;AACtQ,SAAO,CAAC,aAAY,UAAS,gBAAe,cAAa,eAAc,UAAS,MAAK,WAAU,oBAAoB,KAAK,IAAG,WAAU,sBAAsB,SAAS,IAAG,kBAAiB,eAAc,kBAAiB,oBAAmB,oBAAmB,oCAAmC,UAAS,OAAM,mBAAkB,iBAAgB,cAAa,0BAAyB,yBAAwB,wBAAuB,WAAU,kCAAiC,WAAU,iBAAiB,SAAS,mBAAkB,WAAU,iBAAiB,cAAc,yCAAwC,aAAY,cAAa,gBAAe,uBAAsB,OAAO,OAAM,2BAA0B,OAAO,UAAU,GAAE,mBAAkB,YAAW,GAAG,IAAI;AACrvB;AAGO,IAAM,oBAAN,MAAwB;AAAA,EAE9B,YAAoB,OAAoB,QAA8B;AAAlD;AAAoB;AACvC,mCAA+B,MAAM;AAAE,SAAK,YAAU,IAAIC,MAAK,MAAM,SAAQ,eAAe,CAAC;AAC7F,UAAM,GAAG,KAAK,mQAAmQ;AACjR,QAAG,CAAC,MAAM,GAAG,QAAQ,sCAAsC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAU,IAAI,SAAO,oBAAoB,EAAE,OAAM,GAAG,KAAK,kEAAkE;AAAA,EACrM;AAAA,EAJoB;AAAA,EAAoB;AAAA,EADhC;AAAA,EAAwC,WAAS,oBAAI,IAAiD;AAAA,EAAU,WAAS,oBAAI,IAAyB;AAAA,EAAU,WAAS;AAAA,EAAc,UAAQ;AAAA,EAAc,cAAY;AAAA,EAMzN,WAAWC,KAAU,IAAoB;AAAC,UAAM,WAAS,KAAK,SAAS,IAAIA,GAAE,KAAG,QAAQ,QAAQ,GAAG,MAAM,MAAI;AAAA,IAAC,CAAC,EAAE,KAAK,EAAE;AAAE,SAAK,SAAS,IAAIA,KAAG,OAAO;AAAE,WAAO,QAAQ,QAAQ,MAAI;AAAC,UAAG,KAAK,SAAS,IAAIA,GAAE,MAAI,QAAQ,MAAK,SAAS,OAAOA,GAAE;AAAA,IAAC,CAAC;AAAA,EAAC;AAAA,EACzP,MAAc,aAAY;AACzB,UAAMF,QAAKC,MAAK,KAAK,MAAM,SAAQ,0BAAwB,IAAI,2BAAgB,IAAE,MAAM;AACvF,QAAG;AAAC,YAAM,KAAG,MAAME,MAAKH,OAAK,MAAK,GAAK;AAAE,UAAG;AAAC,cAAM,GAAG,UAAU,2BAAgB;AAAE,cAAM,GAAG,KAAK;AAAA,MAAC,UAAC;AAAQ,cAAM,GAAG,MAAM;AAAA,MAAC;AAAA,IAAC,SAAO,GAAM;AAAC,UAAG,EAAE,SAAO,SAAS,OAAM;AAAA,IAAC;AACrK,UAAM,OAAK,MAAMI,OAAMJ,KAAI;AAAE,QAAG,CAAC,KAAK,OAAO,KAAG,KAAK,eAAe,KAAG,KAAK,UAAQ,KAAG,IAAI,MAAMK,UAASL,KAAI,CAAC,MAAI,IAAI,2BAAgB,EAAE,MAAK,gCAA+B,GAAG;AAChL,WAAOA;AAAA,EACR;AAAA,EACA,MAAc,IAAIM,OAAc,UAAQ,MAAM;AAC7C,UAAMC,OAAM,KAAK,UAAU,eAAc,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AACpE,QAAG;AAAC,cAAQ,MAAM,QAAQ,KAAK,OAAO,kBAAiBD,OAAK,EAAC,KAAI,KAAK,WAAU,UAAS,QAAO,SAAQ,WAAU,KAAG,OAAK,MAAK,aAAY,KAAI,CAAC,GAAG,OAAO,KAAK;AAAA,IAAC,QAAM;AAAC,WAAK,iCAAgC,GAAG;AAAA,IAAC;AAAA,EACjN;AAAA,EACQ,IAAIJ,KAAU,GAAU;AAAC,UAAM,MAAI,KAAK,MAAM,GAAG,QAAQ,sDAAsD,EAAE,IAAIA,GAAE;AAAE,QAAG,CAAC,IAAI,QAAO;AAAK,SAAK,MAAM,IAAI,IAAI,SAAQ,CAAC;AAAE,QAAG,CAAC,EAAE,MAAM,SAAS,IAAI,OAAO,EAAE,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EACxP,MAAc,QAAQ,KAAQ;AAC7B,UAAM,OAAK,MAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAK,cAAa,YAAW,UAAU,IAAI,IAAI,KAAI,YAAW,SAAS,CAAC,GAAG,MAAM,IAAI,EAAE,OAAO,OAAO;AACjJ,QAAG,CAAC,IAAI,OAAO,QAAO;AACtB,QAAG,IAAI,WAAS,KAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,KAAG,IAAI,OAAK,IAAI,QAAM,IAAI,CAAC,EAAE,MAAK,+BAA8B,GAAG;AACnH,QAAI;AAAU,QAAG;AAAC,cAAM,KAAK,MAAM,MAAM,KAAK,IAAI,CAAC,aAAY,WAAU,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,IAAC,QAAM;AAAC,WAAK,iCAAgC,GAAG;AAAA,IAAC;AACrI,QAAG,OAAO,OAAK,IAAI,CAAC,KAAG,MAAM,SAAO,MAAI,IAAI,QAAM,MAAM,QAAQ,SAAS,kBAAkB,MAAI,IAAI,SAAO,MAAM,QAAQ,SAAS,oBAAoB,MAAI,KAAK,MAAM,UAAU,MAAK,+BAA8B,GAAG;AACpN,UAAM,OAAK,MAAM,YAAW,SAAO,MAAM,UAAQ,CAAC,GAAG,OAAO,CAAC,MAAQ,EAAE,SAAO,MAAM;AACpF,UAAM,YAAU,MAAM,KAAK,CAAC,MAAQ,EAAE,gBAAc,YAAY,GAAE,aAAW,MAAM,KAAK,CAAC,MAAQ,EAAE,gBAAc,yBAAyB;AAC1I,UAAM,OAAK,MAAM,QAAQ,IAAI,CAAC,SAAc,KAAK,QAAQ,SAAQ,EAAE,CAAC;AACpE,QAAG,OAAO,IAAI,uBAAqB,YAAU,MAAM,QAAQ,MAAM,CAAC,MAAI,6BAA2B,MAAM,OAAO,IAAI,CAAC,MAAI,IAAI,sBAAoB,MAAM,QAAQ,YAAY,WAAS,KAAG,MAAM,OAAO,WAAW,CAAC,MAAI,sBAAsB,MAAK,6BAA4B,GAAG;AAC5Q,QAAG,MAAM,QAAQ,UAAQ,KAAK,OAAO,SAAO,MAAM,QAAQ,SAAO,SAAO,MAAM,gBAAc,UAAQ,MAAM,mBAAiB,QAAM,MAAM,eAAa,SAAO,CAAC,KAAK,SAAS,SAAS,KAAK,KAAG,MAAM,WAAS,KAAG,CAAC,KAAK,SAAS,QAAQ,KAAG,CAAC,KAAK,SAAS,QAAQ,KAAG,CAAC,KAAK,aAAa,SAAS,mBAAmB,KAAG,MAAM,WAAS,KAAG,WAAW,WAAS,IAAI,aAAW,YAAY,WAAS,MAAM,KAAK,WAAW,KAAG,YAAY,OAAK,MAAM,MAAK,6BAA4B,GAAG;AACjd,WAAO;AAAA,EACR;AAAA,EACA,MAAM,QAAO;AACZ,QAAG;AAAC,YAAM,OAAK,KAAK,MAAM,MAAM,KAAK,IAAI,CAAC,SAAQ,WAAU,KAAK,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;AAAE,UAAG,MAAM,iBAAe,WAAS,CAAC,KAAK,aAAa,SAAS,KAAK,OAAO,KAAK,EAAE,MAAK,0BAA0B;AAAE,aAAO,EAAC,MAAK,aAAY,QAAO,oBAAmB,OAAM,KAAK,OAAO,OAAM,SAAQ,QAAO,YAAW,kBAAiB,MAAK,eAAc,aAAY,2BAA0B;AAAA,IAAC,QAAM;AAAC,aAAO,EAAC,MAAK,aAAY,QAAO,eAAc,MAAK,mCAAkC;AAAA,IAAC;AAAA,EACnd;AAAA,EACQ,QAAQA,KAAU,OAAK,mBAAkB;AAChD,SAAK,MAAM,OAAOA,KAAG,WAAU,EAAC,MAAK,qBAAoB,eAAc,OAAM,iBAAgB,KAAI,GAAE,IAAI;AAAA,EACxG;AAAA,EACA,MAAc,KAAKA,KAAU;AAC5B,UAAM,QAAM,MAAM,KAAK,OAAO,kBAAiB,CAAC,aAAY,QAAOA,GAAE,GAAE,EAAC,KAAI,KAAK,WAAU,OAAM,CAAC,UAAS,QAAO,MAAM,GAAE,aAAY,KAAI,CAAC;AAC3I,UAAM,SAAgB,CAAC,GAAE,SAAgB,CAAC;AAAE,QAAI,QAAM,GAAE,SAAO;AAC/D,UAAM,OAAK,CAAC,SAAgB,CAAC,UAAe;AAAC,YAAM,IAAE,KAAK,IAAI,MAAM,QAAO,KAAK,IAAI,GAAE,IAAE,OAAK,OAAK,KAAK,CAAC;AAAE,UAAG,EAAE,MAAK,KAAK,MAAM,SAAS,GAAE,CAAC,CAAC;AAAE,eAAO;AAAA,IAAC;AACtJ,UAAM,OAAO,GAAG,QAAO,KAAK,MAAM,CAAC;AAAE,UAAM,OAAO,GAAG,QAAO,KAAK,MAAM,CAAC;AAAE,UAAM,QAAM,WAAW,MAAI;AAAC,eAAO;AAAK,YAAM,KAAK,SAAS;AAAA,IAAC,GAAE,IAAK;AAC9I,QAAG;AAAC,YAAM,OAAK,MAAM,IAAI,QAAqB,CAACM,UAAQ,WAAS;AAAC,cAAM,KAAK,SAAQ,MAAM;AAAE,cAAM,KAAK,SAAQA,QAAO;AAAA,MAAC,CAAC;AAAE,UAAG,UAAQ,SAAO,EAAE,MAAK,gCAA+B,GAAG;AAAE,aAAO,EAAC,QAAO,OAAO,OAAO,MAAM,GAAE,QAAO,OAAO,OAAO,MAAM,EAAC;AAAA,IAAC,UAAC;AAAQ,mBAAa,KAAK;AAAA,IAAC;AAAA,EACtR;AAAA,EACA,MAAc,OAAON,KAAU,GAAU,UAAa,UAA+C,QAAmB;AACvH,QAAG,CAAC,YAAU,CAAC,CAAC,UAAS,MAAM,EAAE,SAAS,SAAS,OAAO,MAAM,KAAG,SAAS,OAAO,YAAU,OAAM;AAAC,WAAK,QAAQA,GAAE;AAAE;AAAA,IAAM;AAE3H,QAAI;AACJ,QAAG;AAAC,aAAK,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAAC,QAAM;AAAC,WAAK,QAAQA,KAAG,8BAA8B;AAAE;AAAA,IAAM;AAClG,UAAM,MAAI,MAAM,SAAS,KAAK,QAAO,CAAC,GAAE,MAAI,MAAM,SAAS,KAAK,QAAO,CAAC,GAAE,WAAS,SAAS,MAAM;AAClG,UAAM,QAAM,WAAS,eAAa,WAAS,kBAAgB,cAAY,SAAO,WAAS,aAAW,IAAE,cAAY;AAChH,UAAM,SAAO,EAAC,MAAK,qBAAoB,aAAY,SAAS,IAAG,UAAS,kBAAiB,IAAI,YAAW,kBAAiB,IAAI,YAAW,WAAU,MAAK,cAAa,gBAAe,eAAc,MAAK,iBAAgB,MAAK,WAAU,EAAC,MAAK,aAAY,OAAM,KAAK,OAAO,OAAM,SAAQ,QAAO,MAAK,cAAa,EAAC;AACjT,SAAK,MAAM,GAAG,YAAY,MAAI;AAAC,WAAK,MAAM,OAAOA,KAAG,OAAM,QAAO,WAAS,UAAQ,WAAS,yBAAuB,KAAK;AAAE,WAAK,MAAM,GAAG,QAAQ,4EAA4E,EAAE,IAAI,QAAOA,GAAE;AAAA,IAAC,CAAC,EAAE;AAC9O,UAAM,KAAK,QAAQA,KAAG,CAAC,EAAE,MAAM,MAAI;AAAA,IAAC,CAAC;AAAA,EACtC;AAAA,EACA,MAAM,QAAQA,KAAU,GAAU;AACjC,UAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AAAE,QAAG,CAAC,OAAK,IAAI,UAAQ,aAAW,CAAC,SAAS,IAAI,KAAK,MAAM,OAAOA,KAAG,CAAC,EAAE,MAAM,EAAE;AACvG,UAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,QAAG,CAAC,OAAM;AAAC,WAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAE;AAAA,IAAM;AACxJ,QAAG,MAAM,OAAO,YAAU,MAAM,MAAK,8BAA6B,GAAG;AACrE,UAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AAAE,SAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,EAC9I;AAAA,EACA,MAAM,QAAQA,KAAU,GAAU,UAA+C;AAAC,WAAO,KAAK,WAAWA,KAAG,MAAI,KAAK,gBAAgBA,KAAG,GAAE,QAAQ,CAAC;AAAA,EAAC;AAAA,EACpJ,MAAc,gBAAgBA,KAAU,GAAU,UAA+C;AAChG,UAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AAAE,QAAG,CAAC,IAAI,QAAO;AACxC,QAAG,SAAS,IAAI,KAAK,MAAM,OAAOA,KAAG,CAAC,EAAE,MAAM,GAAE;AAAC,YAAM,KAAK,QAAQA,KAAG,CAAC,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAE,aAAO;AAAA,IAAI;AACnG,QAAG,KAAK,SAAS,IAAIA,GAAE,EAAE,QAAO;AAChC,QAAG;AACF,YAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,UAAG,CAAC,YAAW,SAAS,EAAE,SAAS,IAAI,KAAK,GAAE;AAC7C,YAAG,OAAO,OAAO,WAAS,SAAO,MAAM,OAAO,WAAS,WAAU;AAAC,eAAK,QAAQA,GAAE;AAAE,iBAAO;AAAA,QAAI;AAG9F,YAAG,MAAM,OAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AACnD,aAAK,MAAM,GAAG,YAAY,MAAI;AAAC,eAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,+BAA+B;AAAE,eAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,QAAC,CAAC,EAAE;AAAA,MAC3R,WAAS,MAAM,OAAM,KAAK,OAAOA,KAAG,GAAE,OAAM,UAAS,IAAI,MAAM;AAAA,UAC1D,MAAK,QAAQA,GAAE;AAAA,IACrB,QAAM;AAAC,WAAK,QAAQA,GAAE;AAAA,IAAC;AACvB,WAAO;AAAA,EACR;AAAA,EACA,MAAM,OAAOA,KAAU,GAAU,MAAI,aAAY;AAChD,UAAM,UAAQ,KAAK,SAAS,IAAIA,GAAE;AAAE,QAAG,SAAQ;AAAC,YAAM,QAAQ,OAAO,GAAG;AAAE,aAAO;AAAA,IAAI;AACrF,WAAO,KAAK,WAAWA,KAAG,MAAI,KAAK,eAAeA,KAAG,GAAE,GAAG,CAAC;AAAA,EAC5D;AAAA,EACA,MAAc,eAAeA,KAAU,GAAU,KAAW;AAC3D,UAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AAAE,QAAG,CAAC,OAAK,SAAS,IAAI,KAAK,MAAM,OAAOA,KAAG,CAAC,EAAE,MAAM,EAAE,QAAO,CAAC,CAAC;AACxF,UAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,QAAG,OAAO,OAAO,SAAQ;AAAC,WAAK,MAAM,GAAG,QAAQ,4DAA4D,EAAE,IAAI,KAAIA,GAAE;AAAE,YAAM,KAAK,IAAI,CAAC,aAAY,QAAO,iBAAgB,MAAM,EAAE,GAAE,GAAI;AAAA,IAAC,WACpL,OAAO,OAAO,WAAS,WAAU;AACxC,YAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AAC1C,WAAK,MAAM,GAAG,YAAY,MAAI;AAAC,aAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,eAAc,MAAK,iBAAgB,IAAI,UAAQ,YAAW,YAAW,IAAI,UAAQ,WAAU,GAAE,GAAG;AAAE,aAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,MAAC,CAAC,EAAE;AAAA,IAClS;AACA,WAAO;AAAA,EACR;AAAA,EACA,MAAM,MAAM,UAA+C;AAC1D,QAAG,KAAK,YAAU,KAAK,QAAQ;AAAO,SAAK,WAAS;AACpD,QAAG;AAAC,YAAM,OAAK,KAAK,MAAM,GAAG,QAAQ,4HAA4H,EAAE,IAAI,KAAK,WAAW;AAAE,UAAG,CAAC,KAAK,OAAO,MAAK,cAAY;AAAG,iBAAU,OAAO,MAAK;AAClP,YAAG,KAAK,QAAQ;AAAM,aAAK,cAAY,IAAI;AAC3C,YAAG,KAAK,SAAS,IAAI,IAAI,YAAY,EAAE;AACvC,cAAM,IAAE,KAAK,MAAM,IAAI,OAAO;AAAE,YAAI,QAAM;AAAK,YAAG;AAAC,eAAK,MAAM,SAAS,CAAC;AAAA,QAAC,QAAM;AAAC,kBAAM;AAAA,QAAK;AAC3F,YAAG,CAAC,MAAM,KAAG;AAAC,gBAAM,KAAK,OAAO,IAAI,cAAa,GAAE,eAAe;AAAA,QAAC,QAAM;AAAA,QAAC;AAC1E,YAAG,KAAK,QAAQ;AAAM,YAAG;AAAC,gBAAM,KAAK,QAAQ,IAAI,cAAa,GAAE,QAAQ;AAAA,QAAC,QAAM;AAAA,QAAC;AAAA,MACjF;AAAA,IAAC,UAAC;AAAQ,WAAK,WAAS;AAAA,IAAK;AAAA,EAC9B;AAAA,EACA,MAAM,IAAI,EAAC,IAAAA,KAAG,GAAE,QAAO,WAAU,mBAAkB,YAAW,MAAK,SAAQ,UAAS,mBAAkB,cAAa,SAAQ,GAA6P;AACvX,UAAM,OAAK,gBAAc,IAAI,UAAU,EAAC,SAAQ,KAAK,MAAM,WAAU,IAAAA,IAAE,CAAC,CAAC,EAAE,MAAM,GAAE,EAAE,GAAE,QAAMO,YAAW,GAAEC,UAAO,IAAI,UAAU,EAAC,QAAO,WAAU,mBAAkB,YAAW,MAAK,OAAM,KAAK,OAAO,MAAK,CAAC,CAAC;AAC5M,UAAM,aAAW,KAAK,IAAI,EAAE,WAAU,KAAK,IAAI,IAAE,OAAO,GAAE,iBAAe,MAAM,KAAK,WAAW;AAC/F,UAAMJ,QAAK,mBAAmB,EAAC,MAAK,OAAM,WAAU,KAAK,MAAM,WAAU,WAAU,mBAAkB,QAAO,KAAK,QAAO,YAAW,MAAK,YAAW,eAAc,CAAC;AAClK,SAAK,MAAM,GAAG,QAAQ,iLAAiL,EAAE,IAAIJ,KAAG,MAAK,OAAM,UAAU,CAAC,GAAE,QAAO,WAAUQ,SAAO,iBAAiB;AACjR,QAAI,SAAmB,MAAK,OAAU,cAAY,OAAM,YAAmCC,UAAO;AAClG,UAAM,SAAO,CAAC,QAAa;AAAC,iBAAS;AAAI,WAAK,MAAM,GAAG,QAAQ,4DAA4D,EAAE,IAAI,QAAOT,GAAE;AAAE,aAAO,gBAAc,YAAS;AAAC,YAAG;AAAC,gBAAM,MAAI,KAAK,IAAIA,KAAG,CAAC,GAAE,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,cAAG,OAAO,OAAO,QAAQ,OAAM,KAAK,IAAI,CAAC,aAAY,QAAO,iBAAgB,MAAM,EAAE,GAAE,GAAI;AAAA,QAAC,QAAM;AAAC,wBAAY;AAAA,QAAI,UAAC;AAAQ,cAAG,SAAO,CAACS,SAAO;AAAC,kBAAMC,SAAM,WAAW,MAAI;AAAC,kBAAG,CAACD,SAAO;AAAC,8BAAY;AAAK,oBAAG;AAAC,0BAAQ,KAAK,CAAC,MAAM,KAAI,SAAS;AAAA,gBAAC,QAAM;AAAA,gBAAC;AAAA,cAAC;AAAA,YAAC,GAAE,GAAI;AAAE,YAAAC,OAAM,MAAM;AAAA,UAAC;AAAA,QAAC;AAAA,MAAC,GAAG;AAAA,IAAC;AACvf,SAAK,SAAS,IAAIV,KAAG,EAAC,OAAM,CAAC;AAAE,UAAM,QAAM,WAAW,MAAI,KAAK,OAAO,iBAAiB,GAAE,OAAO;AAChG,QAAG;AACF,eAAS;AAAE,UAAG,aAAa,EAAE,UAAO;AACpC,UAAG,QAAO;AAAC,aAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,MAAM;AAAE,aAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAE;AAAA,MAAM;AACjP,YAAM,QAAM,MAAM,KAAK,MAAM;AAAE,UAAG,MAAM,WAAS,mBAAmB,MAAK,oCAAmC,GAAG;AAC/G,YAAM,kBAAkB;AAAE,eAAS;AACnC,YAAM,MAAI,MAAM,KAAK,IAAII,KAAI;AAAE,UAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,MAAK,iCAAgC,GAAG;AACtG,WAAK,MAAM,GAAG,QAAQ,yEAAyE,EAAE,IAAI,KAAIJ,GAAE;AAC3G,YAAM,kBAAkB;AAAE,eAAS;AAAE,UAAG,aAAa,EAAE,YAAS;AAChE,UAAG,QAAO;AAAC,cAAM,MAAI,KAAK,IAAIA,KAAG,CAAC,GAAE,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,YAAG,OAAO,OAAO,WAAS,UAAU,MAAK,iBAAiB;AAAE,cAAM,KAAK,IAAI,CAAC,aAAY,MAAK,GAAG,CAAC;AAAE,aAAK,MAAM,GAAG,YAAY,MAAI;AAAC,eAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,MAAM;AAAE,eAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,QAAC,CAAC,EAAE;AAAE;AAAA,MAAM;AAC9a,WAAK,MAAM,GAAG,QAAQ,oEAAoE,EAAE,IAAIA,GAAE;AAClG,cAAM,MAAM,KAAK,OAAO,kBAAiB,CAAC,aAAY,SAAQ,MAAK,GAAG,GAAE,EAAC,KAAI,KAAK,WAAU,UAAS,MAAK,OAAM,CAAC,UAAS,UAAS,QAAQ,GAAE,aAAY,KAAI,CAAC;AAC9J,YAAM,IAAI,QAAc,CAACM,UAAQ,WAAS;AAAC,cAAM,KAAK,SAAQ,MAAM;AAAE,cAAM,KAAK,SAAQ,MAAI;AAAC,UAAAG,UAAO;AAAK,UAAAH,SAAQ;AAAA,QAAC,CAAC;AAAA,MAAC,CAAC;AAAE,YAAM;AAC9H,UAAG,aAAY;AAAC,aAAK,QAAQN,GAAE;AAAE;AAAA,MAAM;AACvC,YAAM,KAAK,OAAOA,KAAG,GAAE,MAAM,KAAK,QAAQ,KAAK,IAAIA,KAAG,CAAC,CAAC,GAAE,UAAS,MAAM;AAAA,IAC1E,SAAO,GAAM;AACZ,YAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AACvB,UAAG,KAAK,UAAQ,YAAW;AAAC,aAAK,QAAQA,GAAE;AAAA,MAAC,OACxC;AAGH,YAAG;AAAC,gBAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,cAAG,OAAO,OAAO,WAAS,aAAW,UAAQ,KAAK,OAAM,MAAM;AAAE,cAAG,MAAM,OAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AAAE,eAAK,MAAM,GAAG,YAAY,MAAI;AAAC,iBAAK,MAAM,OAAOA,KAAG,SAAO,cAAY,UAAS,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,WAAS,aAAa,aAAW,EAAE,OAAK,mBAAmB;AAAE,iBAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,UAAC,CAAC,EAAE;AAAA,QAAC,QAAM;AAAC,eAAK,QAAQA,GAAE;AAAA,QAAC;AAAA,MAC5f;AAAA,IACD,UAAC;AAAQ,mBAAa,KAAK;AAAE,WAAK,SAAS,OAAOA,GAAE;AAAA,IAAC;AAAA,EACtD;AAAA,EACA,MAAM,QAAO;AAAC,SAAK,UAAQ;AAAK,UAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,OAAG,EAAE,OAAO,WAAW,CAAC,CAAC;AAAE,UAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,CAAC;AAAE,WAAM,KAAK,SAAS,OAAM,IAAI,QAAQ,OAAG,WAAW,GAAE,EAAE,CAAC;AAAA,EAAC;AAC9N;;;AErKA,SAAQ,aAAAW,kBAAiC;AACzC,SAAQ,SAAAC,QAAM,SAAAC,QAAM,QAAAC,OAAK,YAAAC,WAAS,YAAAC,WAAS,QAAAC,OAAK,UAAAC,SAAO,iBAAgC;AACvF,OAAOC,WAAU;AAKjB,SAAS,SAAS,GAA+B;AAChD,MAAG,CAAC,EAAE,YAAY,KAAG,EAAE,OAAK,MAAI,EAAE,MAAI,MAAI,EAAE,eAAa,GAAG,MAAK,kCAAiC,GAAG;AACrG,SAAO,EAAC,KAAI,OAAO,EAAE,GAAG,GAAE,KAAI,OAAO,EAAE,GAAG,GAAE,OAAM,OAAO,EAAE,WAAW,EAAC;AACxE;AACA,IAAM,MAAI,CAAC,MAAgB,IAAI,UAAU,SAAS,CAAC,CAAC,CAAC;AAkBrD,IAAM,sBAAoB;AAE1B,IAAM,YAAU,oBAAI,IAAuC;AACpD,IAAM,mBAAiD,EAAC,mBAAkB,KAAI;AACrF,IAAM,QAAM,CAAC,QAAa;AAAC,MAAG;AAAC,YAAQ,KAAK,KAAI,CAAC;AAAE,WAAO;AAAA,EAAI,SAAO,GAAM;AAAC,WAAO,GAAG,SAAO;AAAA,EAAO;AAAC;AAErG,eAAe,gBAAgB,UAAkC;AAC/D,QAAMC,OAAM,qBAAoB,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC,EAAE,MAAM,MAAI;AAAA,EAAC,CAAC;AACzE,WAAQ,UAAQ,GAAE,UAAQ,GAAE,WAAU;AACpC,QAAI;AACJ,QAAG;AACD,eAAO,MAAMC,MAAK,UAAS,MAAK,GAAK;AACrC,YAAM,UAAU,QAAO,KAAK,UAAU,EAAC,KAAI,QAAQ,IAAG,CAAC,CAAC;AACxD,aAAO,EAAC,OAAM,GAAE,MAAK,UAAS,OAAM;AAAA,IACtC,SAAO,GAAM;AACX,YAAM,QAAQ,MAAM,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAClC,YAAM,OAAM,GAAsB;AAClC,UAAG,SAAO,YAAU,SAAO,SAAQ;AAAC,yBAAiB,oBAAkB,KAAK,IAAI;AAAE,eAAO,EAAC,OAAM,GAAE,MAAK,IAAG,QAAO,OAAkC;AAAA,MAAC;AACpJ,UAAG,SAAO,SAAS,OAAM;AAAA,IAC3B;AAGA,QAAI,SAAO;AACX,QAAG;AACD,YAAM,OAAK,MAAMA,MAAK,UAAS,GAAG,GAAE,OAAK,MAAM,KAAK,KAAK,GAAE,QAAM,MAAMC,OAAM,QAAQ;AACrF,UAAG;AACD,cAAM,QAAM,KAAK,MAAM,MAAMC,UAAS,MAAK,EAAC,UAAS,OAAM,CAAC,CAAC;AAC7D,YAAG,CAAC,MAAM,OAAO,OAAO,GAAG,CAAC,KAAG,MAAM,QAAM,KAAK,OAAK,MAAM,QAAM,KAAK,OAAK,CAAC,MAAM,eAAe,GAAE;AACjG,gBAAMC,QAAO,QAAQ,EAAE,MAAM,MAAI;AAAA,UAAC,CAAC;AAAE,mBAAO;AAAA,QAC9C;AAAA,MACF,UAAC;AAAQ,cAAM,KAAK,MAAM;AAAA,MAAC;AAAA,IAC7B,QAAM;AAAA,IAAC;AACP,QAAG,CAAC,OAAO,MAAK,kBAAiB,GAAG;AAAA,EACtC;AACA,OAAK,kBAAiB,GAAG;AAC3B;AAEA,eAAe,gBAAgBC,OAA+C;AAC5E,QAAM,UAAQ,GAAGA,MAAK,GAAG,IAAIA,MAAK,GAAG;AACrC,QAAM,WAAS,UAAU,IAAI,OAAO;AACpC,MAAG,UAAS;AAAC,UAAM,OAAK,MAAM;AAAS,SAAK;AAAQ,WAAO;AAAA,EAAI;AAC/D,QAAM,UAAQ,gBAAgB,GAAG,mBAAmB,IAAI,OAAO,EAAE,EAAE,KAAK,UAAM;AAAC,cAAU,IAAI,SAAQ,IAAI;AAAE,WAAO;AAAA,EAAI,CAAC;AACvH,YAAU,IAAI,SAAQ,OAAO;AAC7B,MAAG;AAAC,WAAO,MAAM;AAAA,EAAO,SAAO,GAAE;AAAC,cAAU,OAAO,OAAO;AAAE,UAAM;AAAA,EAAC;AACrE;AAEA,eAAe,gBAAgB,SAAe,MAA4B;AACxE,MAAG,EAAE,KAAK,QAAM,EAAE;AAClB,MAAG,UAAU,IAAI,OAAO,MAAI,KAAK,WAAU,OAAO,OAAO;AACzD,MAAG,CAAC,KAAK,OAAO;AAChB,MAAG;AACD,UAAM,OAAK,MAAM,KAAK,OAAO,KAAK,GAAE,QAAM,MAAMH,OAAM,KAAK,IAAI;AAC/D,QAAG,MAAM,QAAM,KAAK,OAAK,MAAM,QAAM,KAAK,OAAK,CAAC,MAAM,eAAe,EAAE,OAAME,QAAO,KAAK,IAAI,EAAE,MAAM,MAAI;AAAA,IAAC,CAAC;AAAA,EAC7G,QAAM;AAAA,EAAC;AACP,QAAM,KAAK,OAAO,MAAM,EAAE,MAAM,MAAI;AAAA,EAAC,CAAC;AACxC;AACA,eAAe,SAAS,QAA8E;AACrG,MAAG,CAAC,CAAC,SAAQ,OAAO,EAAE,SAAS,QAAQ,QAAQ,KAAG,OAAO,WAAS,YAAU,CAACE,MAAK,WAAW,MAAM,KAAG,OAAO,SAAO,QAAM,OAAO,SAAS,IAAI,EAAE,MAAK,kCAAiC,GAAG;AACzL,QAAM,SAAO,MAAMC,UAAS,MAAM,GAAE,QAAM,MAAMF,MAAK,QAAO,EAAC,QAAO,KAAI,CAAC,GAAE,YAAmB,CAAC;AAC/F,MAAI,UAAQ;AACZ,WAAQ,QAAM,KAAG,SAAQ;AACxB,QAAG,SAAO,IAAI,MAAK,kCAAiC,GAAG;AACvD,cAAU,KAAK,IAAI,UAAQ,IAAE,QAAM,MAAMA,MAAK,SAAQ,EAAC,QAAO,KAAI,CAAC,CAAC,CAAC;AACrE,UAAM,SAAOC,MAAK,QAAQ,OAAO;AAAE,QAAG,WAAS,QAAQ;AAAM,cAAQ;AAAA,EACtE;AACA,MAAG,IAAI,MAAMD,MAAK,QAAO,EAAC,QAAO,KAAI,CAAC,CAAC,MAAI,UAAU,CAAC,KAAG,MAAME,UAAS,MAAM,MAAI,OAAO,MAAK,qBAAoB,GAAG;AACrH,SAAO,EAAC,UAAS,EAAC,KAAI,UAAU,CAAC,GAAE,WAAU,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,GAAE,MAAK,QAAO,UAAS,QAAQ,SAA2B,GAAE,UAAS,SAAS,KAAK,EAAC;AACxJ;AAGO,IAAM,eAAN,MAAM,cAAY;AAAA,EAEhB,YAA4B,UAA2C,eAA6B,QAA2B,UAAqC;AAAxI;AAA2C;AAA6B;AAA2B;AAAA,EAAsC;AAAA,EAAzI;AAAA,EAA2C;AAAA,EAA6B;AAAA,EAA2B;AAAA,EAD/H,SAAO;AAAA,EAEf,aAAa,QAAQ,QAAc;AAClC,UAAM,QAAM,MAAM,SAAS,MAAM;AAAE,QAAI,QAA4B;AACnE,QAAG;AACF,UAAG,QAAQ,aAAW,SAAQ;AAC7B,iBAAO,MAAMN,MAAK,MAAM,SAAS,MAAKO,WAAU,WAASA,WAAU,cAAYA,WAAU,UAAU;AACnG,cAAM,OAAK,MAAM,OAAO,KAAK,EAAC,QAAO,KAAI,CAAC;AAC1C,YAAG,IAAI,IAAI,MAAI,MAAM,SAAS,IAAI,MAAK,qBAAoB,GAAG;AAE9D,cAAMH,QAAK,EAAC,KAAI,KAAK,KAAI,KAAI,KAAK,IAAG;AACrC,mBAAS,EAAC,KAAI,GAAGA,MAAK,GAAG,IAAIA,MAAK,GAAG,IAAG,MAAK,MAAM,gBAAgBA,KAAI,EAAC;AAAA,MACzE;AACA,YAAM,MAAI,IAAI,cAAa,OAAO,OAAO,EAAC,GAAG,MAAM,UAAS,WAAU,OAAO,OAAO,MAAM,SAAS,SAAS,EAAC,CAAC,GAAuB,UAAU,MAAM,QAAQ,GAAE,QAAO,QAAQ;AAC9K,YAAM,IAAI,OAAO;AAAE,aAAO;AAAA,IAC3B,SAAO,GAAE;AAAC,YAAM,QAAQ,MAAM;AAAE,UAAG,SAAS,OAAM,gBAAgB,SAAS,KAAI,SAAS,IAAI,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAE,YAAM;AAAA,IAAC;AAAA,EACpH;AAAA,EACA,IAAI,WAAU;AAAC,QAAG,KAAK,OAAO,MAAK,sBAAsB;AAAE,WAAO,KAAK,SAAO,SAAS,QAAQ,GAAG,OAAO,KAAK,OAAO,EAAE,OAAK,KAAK,SAAS;AAAA,EAAI;AAAA,EAC9I,MAAM,SAAQ;AACb,QAAG,KAAK,OAAO,MAAK,sBAAsB;AAC1C,UAAM,UAAQ,MAAM,SAAS,KAAK,SAAS,IAAI;AAC/C,QAAG,UAAU,QAAQ,QAAQ,MAAI,UAAU,KAAK,QAAQ,KAAG,QAAQ,YAAU,UAAU,QAAQ,QAAQ,MAAI,KAAK,cAAc,MAAK,qBAAoB,GAAG;AAC1J,QAAG,KAAK,WAAS,IAAI,MAAM,KAAK,OAAO,KAAK,EAAC,QAAO,KAAI,CAAC,CAAC,MAAI,KAAK,SAAS,OAAK,MAAME,UAAS,SAAS,QAAQ,GAAG,OAAO,KAAK,OAAO,EAAE,EAAE,MAAI,KAAK,SAAS,MAAM,MAAK,qBAAoB,GAAG;AAAA,EAChM;AAAA,EACA,MAAM,QAAO;AAAC,QAAG,KAAK,OAAO;AAAO,SAAK,SAAO;AAAK,QAAG,KAAK,SAAS,OAAM,gBAAgB,KAAK,SAAS,KAAI,KAAK,SAAS,IAAI,EAAE,MAAM,MAAI;AAAA,IAAC,CAAC;AAAE,UAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAC3K;;;AC7HA,SAAS,cAAAE,mBAAkB;AA2B3B,IAAM,gBAAgB,CAAC,OAAO,aAAa,QAAQ,UAAU;AAC7D,IAAM,QAAQ;AACd,IAAM,gBAAgB;AACtB,IAAM,WAAW;AACjB,IAAM,YAAY,oBAAI,IAAY,CAAC,SAAS,OAAO,CAAC;AAE7C,IAAM,qBAAwC,CAAC,YAAY,cAAc,sBAAsB;AAEtG,IAAM,sBAAsB,oBAAI,IAAY,CAAC,YAAY,CAAC;AAE1D,IAAM,wBAAwB;AAC9B,IAAM,WAAW,oBAAI,IAAY,CAAC,aAAa,UAAU,WAAW,CAAC;AACrE,IAAM,OAAO,oBAAI,IAAY,CAAC,YAAY,SAAS,CAAC;AAS7C,IAAM,sBAAN,MAA0B;AAAA,EAG/B,YAAoB,OAAsB,aAAqB,IAAI;AAA/C;AAAsB;AACxC,SAAK,MAAM,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAqBV;AAGT,QAAG,CAAC,KAAK,MAAM,GAAG,OAAO,kCAAkC,EAAE,KAAK,CAAC,WAAgB,OAAO,SAAO,kBAAkB;AACjH,WAAK,MAAM,GAAG,KAAK,uFAAuF;AAAA,EAC9G;AAAA,EA3BoB;AAAA,EAAsB;AAAA;AAAA,EADjC,wBAAwB;AAAA;AAAA,EA8BjC,MAAM,aAAqB,SAAkB,UAAe;AAC1D,eAAW,WAAW;AACtB,UAAM,OAAO,KAAK,OAAO,QAAQ;AACjC,WAAO,KAAK,UAAU,MAAM;AAC1B,WAAK,MAAM,SAAS,OAAO;AAC3B,YAAM,YAAY,KAAK,MAAM,GAAG,QAAQ,qCAAqC,EAAE,IAAI,WAAW;AAC9F,UAAI,CAAC,UAAW,MAAK,uBAAuB,GAAG;AAC/C,WAAK,MAAM,IAAI,UAAU,SAAS,OAAO;AACzC,UAAI,CAAC,mBAAmB,SAAS,UAAU,IAAI,EAAG,MAAK,8BAA8B;AACrF,UAAI,CAAC,KAAK,IAAI,UAAU,MAAM,EAAG,MAAK,sBAAsB,GAAG;AAC/D,YAAM,QAAQ,KAAK,MAAM,GAAG,QAAQ,yDAAyD,EAAE,IAAI,WAAW;AAC9G,UAAI,OAAO;AACT,aAAK,MAAM,IAAI,MAAM,SAAS,OAAO;AACrC,YAAI,MAAM,aAAa,KAAK,OAAO,MAAM,SAAS,KAAK,QAAQ,MAAM,aAAa,KAAK,YAAY,MAAM,cAAc,UAAU,KAAK,SAAS,EAAG,MAAK,sBAAsB,GAAG;AAChL,eAAO,EAAE,OAAO,OAAO,WAAW,KAAK,OAAO,KAAK,EAAE;AAAA,MACvD;AACA,YAAM,SAAS,KAAK,OAAO,MAAM,WAAW;AAC5C,UAAI,OAAQ,MAAK,kBAAkB,GAAG;AACtC,YAAM,SAAS,KAAK,MAAM,GAAG,QAAQ,oDAAoD,EAAE,IAAI;AAC/F,UAAI,OAAO,SAAS,sBAAuB,MAAK,6BAA6B,GAAG;AAChF,WAAK,MAAM,GAAG,QAAQ,uKAAuK,EAC1L,IAAI,aAAa,UAAU,MAAM,KAAK,KAAK,KAAK,MAAM,KAAK,UAAU,UAAU,KAAK,SAAS,GAAG,KAAK,UAAU,QAAQ,UAAU,OAAO,GAAG,KAAK,IAAI,GAAG,KAAK,UAAU;AACzK,aAAO,EAAE,OAAO,MAAM,WAAW,KAAK,OAAO,KAAK,MAAM,GAAG,QAAQ,yDAAyD,EAAE,IAAI,WAAW,CAAC,EAAE;AAAA,IAClJ,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,gBAAgB,UAAe,mBAA4B;AACzD,UAAM,OAAO,KAAK,OAAO,QAAQ;AACjC,QAAI,sBAAsB,OAAW,YAAW,iBAAiB;AACjE,SAAK,UAAU,MAAM;AAAE,UAAI,KAAK,OAAO,MAAM,qBAAqB,EAAE,EAAG,MAAK,kBAAkB,GAAG;AAAA,IAAE,CAAC;AAAA,EACtG;AAAA;AAAA,EAEA,kBAAkB,aAAqB,SAAoC;AACzE,eAAW,WAAW;AACtB,WAAO,KAAK,UAAU,MAAM;AAC1B,WAAK,MAAM,SAAS,OAAO;AAC3B,YAAM,YAAY,KAAK,MAAM,GAAG,QAAQ,yDAAyD,EAAE,IAAI,WAAW;AAClH,YAAM,YAAY,KAAK,MAAM,GAAG,QAAQ,qCAAqC,EAAE,IAAI,WAAW;AAE9F,UAAI,UAAW,MAAK,MAAM,IAAI,UAAU,SAAS,OAAO;AACxD,UAAI,UAAW,MAAK,MAAM,IAAI,UAAU,SAAS,OAAO;AACxD,UAAI,CAAC,UAAW,QAAO,EAAE,aAAa,QAAQ,MAAM,UAAU,OAAO,QAAQ,sBAAsB;AACnG,UAAI,CAAC,UAAW,QAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,SAAS,IAAI,UAAU,MAAM,KAAK,KAAK,QAAQ,SAAS,GAAG,QAAQ,SAAS,IAAI,UAAU,MAAM,KAAK,KAAK,QAAQ,SAAS,IAAI,qBAAqB,eAAe;AAC7O,UAAI,CAAC,SAAS,IAAI,UAAU,MAAM,EAAG,QAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,OAAO,QAAQ,eAAe;AAC7H,UAAI,CAAC,KAAK,QAAQ,SAAS,EAAG,QAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,OAAO,QAAQ,mBAAmB;AAC1H,aAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,KAAK,MAAM,GAAG,QAAQ,uDAAuD,EAAE,IAAI,WAAW,EAAE,UAAU,GAAG,QAAQ,KAAK;AAAA,IACtL,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,KAAK,SAAmB;AACtB,WAAO,KAAK,UAAU,MAAM;AAC1B,UAAI,YAAY,OAAW,MAAK,MAAM,SAAS,OAAO;AACtD,aAAO,KAAK,MAAM,GAAG,QAAQ,sEAAsE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAa,KAAK,OAAO,GAAG,CAAC,EAC1I,OAAO,CAAC,MAA0B,YAAY,UAAc,EAAE,aAAa,QAAQ,YAAY,EAAE,UAAU,QAAQ,SAAS,EAAE,WAAW,QAAQ,UAAU,EAAE,cAAc,QAAQ,SAAU;AAAA,IAClM,CAAC;AAAA,EACH;AAAA,EACQ,OAAO,OAA+B;AAC5C,QAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,MAAK,4BAA4B;AAC1G,UAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,QAAI,KAAK,WAAW,cAAc,UAAU,CAAC,KAAK,MAAM,OAAK,cAAc,SAAS,CAAC,CAAC,EAAG,MAAK,4BAA4B;AAC1H,UAAM,EAAE,KAAAC,MAAK,WAAW,MAAAC,OAAM,SAAS,IAAI;AAC3C,QAAI,OAAOD,SAAQ,YAAY,CAAC,MAAM,KAAKA,IAAG,EAAG,MAAK,4BAA4B;AAClF,QAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,CAAC,UAAU,UAAU,UAAU,SAAS,iBAAiB,UAAU,KAAK,CAAC,MAAW,OAAO,MAAM,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAAG,MAAK,4BAA4B;AAChM,UAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,SAAqB,CAAC;AAChD,QAAI,CAAC,MAAM,SAASA,IAAG,EAAG,MAAK,4BAA4B;AAC3D,QAAI,OAAOC,UAAS,YAAY,CAACA,MAAK,UAAUA,MAAK,SAAS,YAAYA,MAAK,SAAS,IAAI,KAAK,CAACC,YAAWD,KAAI,EAAG,MAAK,4BAA4B;AACrJ,QAAI,OAAO,aAAa,YAAY,CAAC,UAAU,IAAI,QAAQ,EAAG,MAAK,4BAA4B;AAC/F,WAAO,EAAE,KAAAD,MAAK,WAAW,OAAO,MAAAC,OAAM,SAAwC;AAAA,EAChF;AAAA;AAAA,EAEQ,OAAO,MAAyB,mBAA2B;AACjE,WAAO,KAAK,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA,gDAIe,EAAE,IAAI,EAAE,QAAQ,mBAAmB,KAAK,KAAK,KAAK,WAAW,UAAU,KAAK,SAAS,EAAE,CAAC,KAAK;AAAA,EAC3I;AAAA,EACQ,OAAO,KAA8B;AAC3C,UAAM,UAAU,KAAK,MAAM,IAAI,OAAO;AACtC,WAAO,EAAE,aAAa,IAAI,cAAc,MAAM,IAAI,MAAM,SAAS,IAAI,UAAU,MAAM,IAAI,MAAM,UAAU,IAAI,UAAU,WAAW,KAAK,MAAM,IAAI,SAAS,GAAG,UAAU,QAAQ,UAAU,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,WAAW,YAAY,IAAI,YAAY;AAAA,EACnS;AAAA;AAAA,EAEQ,QAAQ,WAAgB;AAC9B,QAAI,CAAC,SAAS,IAAI,UAAU,MAAM,EAAG,QAAO;AAC5C,QAAI,CAAC,oBAAoB,IAAI,UAAU,IAAI,EAAG,QAAO;AACrD,QAAI,SAAc;AAClB,QAAI;AAAE,eAAS,UAAU,SAAS,KAAK,MAAM,UAAU,MAAM,IAAI;AAAA,IAAK,QAAQ;AAAE,aAAO;AAAA,IAAM;AAC7F,WAAO,QAAQ,kBAAkB,QAAQ,QAAQ,eAAe;AAAA,EAClE;AAAA,EACQ,UAAa,IAAgB;AACnC,UAAM,KAAK,KAAK,MAAM;AACtB,QAAI,GAAG,cAAe,QAAO,GAAG;AAChC,QAAI;AAAE,SAAG,KAAK,iBAAiB;AAAA,IAAE,SAAS,GAAQ;AAAE,YAAM,KAAK,KAAK,CAAC;AAAA,IAAE;AACvE,QAAI;AAAE,YAAM,QAAQ,GAAG;AAAG,SAAG,KAAK,QAAQ;AAAG,aAAO;AAAA,IAAM,SAAS,GAAG;AAAE,UAAI;AAAE,WAAG,KAAK,UAAU;AAAA,MAAE,QAAQ;AAAA,MAAC;AAAC;AAAE,YAAM,KAAK,KAAK,CAAC;AAAA,IAAE;AAAA,EACnI;AAAA,EACQ,KAAK,GAAQ;AACnB,QAAI,aAAa,WAAY,QAAO;AACpC,QAAI,OAAO,GAAG,SAAS,aAAa,EAAE,KAAK,WAAW,aAAa,KAAK,EAAE,SAAS,iBAAkB,QAAO,IAAI,WAAW,iBAAiB,GAAG;AAC/I,WAAO;AAAA,EACT;AACF;;;ACpLA,SAAS,eAAe;AAGjB,IAAM,4BAA4B;AASlC,SAAS,gBAAgB,QAAgC,CAAC,GAAW;AAC1E,QAAM,UAAU,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAACE,KAAI,KAAK,MAAM,CAACA,KAAI,QAAQ,KAAK,CAAC,CAAU;AACxF,UAAQ,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAE;AAC/D,SAAO,IAAI,UAAU,OAAO,CAAC;AAC/B;AAkBO,SAAS,yBAAyB,IAAS,YAA0C;AAC1F,KAAG,KAAK,uFAAuF;AAC/F,QAAM,QAAQ,GAAG,QAAQ,oCAAoC,EAAE,IAAI,yBAAyB,GAAG;AAC/F,MAAI,UAAU,WAAY,QAAO,EAAE,SAAS,MAAM;AAClD,MAAI,UAAU,QAAW;AACvB,OAAG,QAAQ,+BAA+B,EAAE,IAAI,2BAA2B,UAAU;AACrF,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,QAAM,SAAS,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,8EAKkD,EAAE,IAAI,EAAE;AACpF,KAAG,QAAQ,qCAAqC,EAAE,IAAI,YAAY,yBAAyB;AAC3F,SAAO,EAAE,SAAS,MAAM,OAAO;AACjC;;;ACGA,SAAS,aAAAC,kBAAoD;AAC7D,SAAS,QAAAC,OAAM,SAAAC,QAAO,QAAAC,OAAM,YAAAC,WAAU,MAAM,UAAAC,eAAc;AAC1D,OAAOC,WAAU;AACjB,SAAS,eAAAC,oBAAmB;AAIrB,IAAM,yBAAyB;AAC/B,IAAM,+BAA+B,KAAK,OAAO;AACjD,IAAM,8BAA8B;AACpC,IAAM,8BAA8B;AACpC,IAAM,mCAAmC;AAChD,IAAM,2BAA2B;AACjC,IAAM,kBAAkBC,WAAU,WAAWA,WAAU,eAAeA,WAAU,cAAc;AAM9F,IAAM,aAAaA,WAAU,SAASA,WAAU,UAAUA,WAAU;AACpE,IAAM,MAAM,EAAE,QAAQ,KAAK;AAE3B,IAAM,YAAY,CAAC,MAAc,SAAS,KAAK,QAAiC,CAAC,MAAa;AAAE,QAAM,OAAO,OAAO,IAAI,WAAW,MAAM,MAAM,GAAG,KAAK;AAAE;AAMzJ,IAAM,mBAAmB,CAAC,MAAc,SAAS,KAAK,QAAiC,CAAC,MAAa;AAAE,QAAM,OAAO,OAAO,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE,WAAW,MAAM,iBAAiB,MAAM,GAAG,MAAM,CAAC;AAAE;AAE/M,IAAM,oBAAoB,CAAC,MAAwB,aAAa,aAAa,OAAO,OAAO,GAAG,EAAE,WAAW,MAAM,iBAAiB,KAAK,CAAC,IAAI;AAU5I,IAAM,iBAAiB,OAAO,QAAyB,aAAoE;AACzH,MAAI,OAAO;AACX,MAAI;AAAE,UAAMC,QAAO,OAAO,UAAU,QAAQ,CAAC;AAAA,EAAE,SAAS,GAAG;AAAE,WAAO,OAAO,CAAC;AAAA,EAAE;AAC9E,MAAI;AAAE,QAAK,MAAM,OAAO,WAAW,QAAQ,MAAO,KAAM,QAAO,EAAE,SAAS,MAAM,QAAQ,KAAK;AAAA,EAAE,SAAS,GAAG;AAAE,WAAO,OAAO,CAAC;AAAA,EAAE;AAC9H,SAAO,EAAE,SAAS,OAAO,QAAQ,KAAK;AACxC;AAEA,IAAM,QAAQ,OAAU,MAAwB,WAA+B;AAC7E,MAAI;AAAE,WAAO,MAAM,KAAK;AAAA,EAAE,SAAS,GAAG;AAAE,QAAI,aAAa,WAAY,OAAM;AAAG,UAAM,OAAO,OAAO,IAAI,WAAW,uBAAuB,GAAG,GAAG,EAAE,QAAQ,QAAQ,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAAA,EAAE;AACzL;AAEA,IAAM,iBAAiB,OAAU,MAAwB,WAA+B,MAAM,MAAM,MAAM,EAAE,MAAM,OAAK;AAAE,QAAM,kBAAkB,CAAC;AAAE,CAAC;AACrJ,IAAM,SAAS,CAAC,MAAwB,KAAK,OAAO,MAAM,YAAY,OAAQ,EAAyB,SAAS,WAAY,EAAuB,OAAO;AAC1J,IAAM,aAAa,CAAC,OAAqD,EAAE,KAAK,OAAO,EAAE,GAAG,GAAG,KAAK,OAAO,EAAE,GAAG,EAAE;AAG3G,SAAS,qBAAqB,WAAmB,QAAQ,UAAmB;AAAE,SAAO,aAAa;AAAQ;AAW1G,IAAM,kBAAN,MAAM,iBAAgB;AAAA,EACnB,YAA6B,QAA6B,UAAkB;AAA/C;AAA6B;AAAA,EAAoB;AAAA,EAAjD;AAAA,EAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlE,aAAa,IAAI,cAAsB,aAAgC,CAAC,GAA6B;AACnG,QAAI,CAAC,qBAAqB,EAAG,WAAU,4BAA4B,KAAK,EAAE,UAAU,QAAQ,SAAS,CAAC;AACtG,QAAI,OAAO,iBAAiB,YAAY,CAAC,gBAAgB,aAAa,SAAS,IAAI,KAAK,CAACC,MAAK,MAAM,WAAW,YAAY,KAAK,OAAO,WAAW,YAAY,IAAI,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,WAAW,CAAC;AACxP,eAAW,QAAQ,WAAY,KAAI,OAAO,SAAS,YAAY,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,GAAG,KAAK,SAAS,OAAO,SAAS,QAAQ,OAAO,WAAW,IAAI,IAAI,iCAAkC,WAAU,oBAAoB,KAAK,EAAE,QAAQ,gBAAgB,CAAC;AAChR,UAAM,QAAQ,CAAC,GAAG,aAAa,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG,GAAG,UAAU;AACxE,QAAI;AACJ,QAAI;AAAE,eAAS,MAAMC,MAAK,KAAK,eAAe;AAAA,IAAE,SAAS,GAAG;AAAE,YAAM,MAAM,kBAAkB,GAAG,KAAK,MAAM;AAAA,IAAE;AAC5G,eAAW,QAAQ,OAAO;AACxB,YAAM,QAAQ,GAAG,eAAe,MAAM,CAAC,IAAI,IAAI;AAC/C,UAAI;AACJ,UAAI;AAAE,eAAO,MAAMA,MAAK,OAAO,eAAe;AAAA,MAAE,SAAS,GAAG;AAI1D,YAAI;AACJ,YAAI;AAAE,mBAAS,MAAM,kBAAkB,GAAG,OAAO,WAAW;AAAA,QAAE,UAAE;AAAU,gBAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,UAAE,CAAC;AAAA,QAAE;AAChH,cAAM;AAAA,MACR;AACA,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAAE,CAAC;AACpC,eAAS;AAAA,IACX;AACA,WAAO,IAAI,iBAAgB,QAAQD,MAAK,MAAM,KAAK,cAAc,GAAG,UAAU,CAAC;AAAA,EACjF;AAAA,EACA,IAAI,KAAa;AAAE,WAAO,KAAK,OAAO;AAAA,EAAG;AAAA;AAAA,EAEzC,IAAI,SAAiB;AAAE,WAAO,eAAe,KAAK,MAAM;AAAA,EAAE;AAAA;AAAA,EAE1D,IAAI,WAAmB;AAAE,WAAO,GAAG,KAAK,MAAM;AAAA,EAAI;AAAA;AAAA,EAElD,UAAU,MAAsB;AAAE,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAAG;AAAA,EAClE,MAAM,WAAoC;AAAE,WAAO,WAAW,MAAM,KAAK,OAAO,KAAK,GAAG,CAAC;AAAA,EAAE;AAAA;AAAA,EAE3F,MAAM,WAAW,MAA2C;AAC1D,QAAI;AAAE,aAAO,MAAME,OAAM,KAAK,UAAU,IAAI,GAAG,GAAG;AAAA,IAAE,SAAS,GAAG;AAAE,UAAI,OAAO,CAAC,MAAM,SAAU,QAAO;AAAM,YAAM,MAAM,kBAAkB,GAAG,KAAK,UAAU,IAAI,GAAG,OAAO;AAAA,IAAE;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,kBAAyC;AAC5D,UAAM,SAAS,MAAMC,UAAS,KAAK,MAAM,EAAE,MAAM,MAAM,IAAI;AAC3D,QAAI,WAAW,iBAAkB,WAAU,qBAAqB,KAAK,EAAE,QAAQ,mBAAmB,UAAU,kBAAkB,OAAO,CAAC;AACtI,UAAM,UAAU,MAAMC,MAAK,kBAAkB,GAAG,EAAE,MAAM,MAAM,IAAI;AAClE,QAAI,CAAC,QAAS,WAAU,qBAAqB,KAAK,EAAE,QAAQ,wBAAwB,UAAU,iBAAiB,CAAC;AAChH,UAAM,SAAS,MAAM,MAAM,MAAM,KAAK,SAAS,GAAG,iBAAiB;AACnE,QAAI,OAAO,QAAQ,OAAO,QAAQ,GAAG,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG,EAAG,WAAU,qBAAqB,KAAK,EAAE,QAAQ,uBAAuB,UAAU,WAAW,OAAO,GAAG,QAAQ,OAAO,CAAC;AAAA,EAAG;AAAA;AAAA,EAEvM,MAAM,OAAsB;AAAE,UAAM,KAAK,OAAO,KAAK,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AAAA,EAAE;AAAA,EACxE,MAAM,QAAuB;AAAE,UAAM,KAAK,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AAAA,EAAE;AAC5E;AAEA,IAAM,iBAAiB,CAAC,WAA+B,SAAS,QAAQ,GAAG,OAAO,OAAO,EAAE;AAE3F,eAAe,kBAAkB,GAAY,IAAY,OAAoC;AAC3F,QAAM,OAAO,OAAO,CAAC;AACrB,MAAI,SAAS,QAAS,QAAO,OAAO,OAAO,IAAI,WAAW,2BAA2B,GAAG,GAAG,EAAE,QAAQ,qBAAqB,IAAI,MAAM,CAAC;AACrI,MAAI,SAAS,WAAW;AAOtB,UAAM,QAAQ,MAAMF,OAAM,IAAI,GAAG,EAAE,MAAM,MAAM,IAAI;AACnD,QAAI,OAAO,eAAe,EAAG,QAAO,OAAO,OAAO,IAAI,WAAW,2BAA2B,GAAG,GAAG,EAAE,QAAQ,qBAAqB,IAAI,OAAO,QAAQ,KAAK,CAAC;AAC1J,WAAO,OAAO,OAAO,IAAI,WAAW,yBAAyB,GAAG,GAAG,EAAE,QAAQ,QAAQ,4BAA4B,sBAAsB,IAAI,OAAO,QAAQ,KAAK,CAAC;AAAA,EAClK;AACA,MAAI,SAAS,YAAY,SAAS,YAAa,QAAO,OAAO,OAAO,IAAI,WAAW,yBAAyB,GAAG,GAAG,EAAE,QAAQ,qBAAqB,IAAI,MAAM,CAAC;AAC5J,MAAI,SAAS,YAAY,SAAS,QAAS,QAAO,OAAO,OAAO,IAAI,WAAW,uBAAuB,GAAG,GAAG,EAAE,QAAQ,cAAc,IAAI,OAAO,QAAQ,KAAK,CAAC;AAC7J,SAAO,OAAO,OAAO,IAAI,WAAW,uBAAuB,GAAG,GAAG,EAAE,QAAQ,kBAAkB,IAAI,OAAO,QAAQ,KAAK,CAAC;AACxH;AAGA,eAAe,YAAY,UAAoC;AAC7D,MAAI,OAAO,aAAa,YAAY,CAAC,YAAY,SAAS,SAAS,IAAI,KAAK,CAACF,MAAK,MAAM,WAAW,QAAQ,KAAK,OAAO,WAAW,QAAQ,IAAI,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,YAAY,CAAC;AACrO,MAAI;AAAE,WAAO,MAAMG,UAAS,QAAQ;AAAA,EAAE,SAAS,GAAG;AAChD,UAAM,OAAO,OAAO,CAAC;AACrB,QAAI,SAAS,YAAY,SAAS,UAAW,WAAU,yBAAyB,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,KAAK,CAAC;AAC7H,QAAI,SAAS,QAAS,WAAU,2BAA2B,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,KAAK,CAAC;AACxG,cAAU,uBAAuB,KAAK,EAAE,QAAQ,mBAAmB,QAAQ,KAAK,CAAC;AAAA,EACnF;AACF;AAGA,SAAS,gBAAgB,cAAiC;AACxD,MAAI,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,KAAK,OAAO,WAAW,YAAY,IAAI,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,gBAAgB,CAAC;AACpM,MAAIH,MAAK,MAAM,WAAW,YAAY,EAAG,WAAU,2BAA2B,KAAK,EAAE,QAAQ,yBAAyB,CAAC;AACvH,QAAM,QAAQ,aAAa,MAAM,OAAO,EAAE,OAAO,OAAO;AACxD,MAAI,CAAC,MAAM,UAAU,MAAM,SAAS,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,mBAAmB,OAAO,MAAM,OAAO,CAAC;AACtJ,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,OAAO,SAAS,KAAM,WAAU,2BAA2B,KAAK,EAAE,QAAQ,iBAAiB,WAAW,KAAK,CAAC;AACzH,QAAI,OAAO,WAAW,IAAI,IAAI,iCAAkC,WAAU,oBAAoB,KAAK,EAAE,QAAQ,qBAAqB,CAAC;AACnI,QAAI,QAAQ,KAAK,IAAI,EAAG,WAAU,oBAAoB,KAAK,EAAE,QAAQ,mBAAmB,CAAC;AACzF,QAAI,wBAAwB,KAAK,IAAI,EAAG,WAAU,oBAAoB,KAAK,EAAE,QAAQ,oBAAoB,CAAC;AAAA,EAC5G;AACA,SAAO;AACT;AAEA,SAAS,SAAS,SAAkB,UAA2B;AAC7D,MAAI,aAAa,UAAa,aAAa,UAAU,aAAa,SAAU,WAAU,oBAAoB,KAAK,EAAE,QAAQ,WAAW,CAAC;AACrI,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI,aAAa,UAAU;AACzB,YAAM,UAAU,QAAQ,QAAQ,QAAQ,EAAE;AAC1C,UAAI,CAAC,yBAAyB,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAM,EAAG,WAAU,oBAAoB,KAAK,EAAE,QAAQ,SAAS,CAAC;AAChI,aAAO,OAAO,KAAK,SAAS,QAAQ;AAAA,IACtC;AACA,WAAO,OAAO,KAAK,SAAS,MAAM;AAAA,EACpC;AACA,MAAI,mBAAmB,YAAY;AACjC,QAAI;AAAE,aAAO,OAAO,KAAK,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU;AAAA,IAAE,QAAQ;AAAE,gBAAU,oBAAoB,KAAK,EAAE,QAAQ,iBAAiB,CAAC;AAAA,IAAE;AAAA,EAC9J;AACA,YAAU,oBAAoB,KAAK,EAAE,QAAQ,eAAe,CAAC;AAC/D;AAEA,eAAe,SAAS,QAAoB,MAAc,QAAqC;AAC7F,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,YAAY;AAC/B,QAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,gBAAgB,iBAAiB,MAAM,CAAC;AACzG,UAAM,UAAU,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,QAAQ,KAAK,aAAa,MAAM,GAAG,YAAY;AACpG,QAAI,CAAC,QAAQ,aAAc,WAAU,uBAAuB,KAAK,EAAE,QAAQ,eAAe,OAAO,CAAC;AAClG,cAAU,QAAQ;AAAA,EACpB;AACF;AAmEA,eAAsB,oBAAoB,SAAyD;AACjG,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,WAAU,oBAAoB,KAAK,EAAE,QAAQ,UAAU,CAAC;AACrG,QAAM,EAAE,UAAU,cAAc,SAAS,UAAU,WAAW,wBAAwB,QAAQ,MAAM,IAAI;AACxG,MAAI,CAAC,qBAAqB,EAAG,WAAU,4BAA4B,KAAK,EAAE,UAAU,QAAQ,SAAS,CAAC;AACtG,MAAI,UAAU,UAAa,OAAO,UAAU,WAAY,WAAU,oBAAoB,KAAK,EAAE,QAAQ,QAAQ,CAAC;AAC9G,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,KAAK,WAAW,6BAA8B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,YAAY,CAAC;AAC1J,QAAM,OAAO,SAAS,SAAS,QAAQ;AACvC,MAAI,KAAK,aAAa,SAAU,WAAU,oBAAoB,KAAK,EAAE,QAAQ,qBAAqB,OAAO,SAAS,CAAC;AACnH,QAAMK,UAAS,IAAI,IAAI;AACvB,QAAM,aAAa,gBAAgB,YAAY;AAC/C,QAAM,OAAO,MAAM,YAAY,QAAQ;AACvC,QAAM,aAAa,WAAW,WAAW,SAAS,CAAC;AACnD,QAAM,gBAAgBL,MAAK,MAAM,KAAK,MAAM,GAAG,WAAW,MAAM,GAAG,EAAE,CAAC;AACtE,QAAM,aAAaA,MAAK,MAAM,KAAK,eAAe,UAAU;AAM5D,QAAM,WAAW,MAAME,OAAM,eAAe,GAAG,EAAE,MAAM,OAAK;AAC1D,UAAM,OAAO,OAAO,CAAC;AACrB,QAAI,SAAS,YAAY,SAAS,UAAW,WAAU,yBAAyB,KAAK,EAAE,QAAQ,kBAAkB,IAAI,cAAc,CAAC;AACpI,QAAI,SAAS,QAAS,WAAU,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,IAAI,cAAc,CAAC;AAC/G,cAAU,uBAAuB,KAAK,EAAE,QAAQ,qBAAqB,IAAI,eAAe,QAAQ,KAAK,CAAC;AAAA,EACxG,CAAC;AACD,MAAI,SAAS,eAAe,EAAG,WAAU,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,IAAI,cAAc,CAAC;AACxH,MAAI,CAAC,SAAS,YAAY,EAAG,WAAU,yBAAyB,KAAK,EAAE,QAAQ,wBAAwB,IAAI,cAAc,CAAC;AAC1H,QAAM,SAAS,CAAC,OAAyB,UAAmE,EAAE,OAAO,UAAU,MAAM,eAAe,WAAW,WAAW,QAAQ,GAAG,YAAY,YAAY,MAAM,KAAK,YAAY,QAAQG,SAAQ,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG;AAC9Q,MAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,cAAc,iBAAiB,MAAM,CAAC;AACvG,MAAI,MAAO,OAAM,MAAM,OAAO,YAAY,CAAC;AAG3C,QAAM,SAAS,MAAM,gBAAgB,IAAI,MAAM,WAAW,MAAM,GAAG,EAAE,CAAC;AACtE,MAAI,WAAW;AACf,MAAI;AACJ,MAAI,cAAc;AAClB,MAAI;AACF,UAAM,OAAO,eAAe,aAAa;AACzC,QAAI,MAAM,OAAO,WAAW,UAAU,EAAG,WAAU,iBAAiB,KAAK,EAAE,QAAQ,WAAW,CAAC;AAC/F,eAAW,GAAG,wBAAwB,GAAGC,aAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AACxE,UAAM,OAAO,MAAML,MAAK,OAAO,UAAU,QAAQ,GAAG,YAAY,GAAK,EAAE,MAAM,OAAK;AAChF,YAAM,OAAO,OAAO,CAAC;AACrB,UAAI,SAAS,SAAU,WAAU,uBAAuB,KAAK,EAAE,QAAQ,sBAAsB,CAAC;AAC9F,UAAI,SAAS,YAAY,SAAS,QAAS,WAAU,uBAAuB,KAAK,EAAE,QAAQ,mBAAmB,QAAQ,KAAK,CAAC;AAC5H,gBAAU,uBAAuB,KAAK,EAAE,QAAQ,eAAe,QAAQ,KAAK,CAAC;AAAA,IAC/E,CAAC;AACD,WAAO;AAEP,UAAM,KAAK,MAAM,GAAK,EAAE,MAAM,OAAK,UAAU,uBAAuB,KAAK,EAAE,QAAQ,cAAc,QAAQ,OAAO,CAAC,EAAE,CAAC,CAAC;AACrH,QAAI;AACJ,UAAM,SAAS,MAAM,MAAM,MAAM;AACjC,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AAEjC,UAAM,aAAa,OAAO,UAAwC;AAChE,YAAM,UAAU,MAAM,MAAM,MAAM,KAAK,KAAK,GAAG,GAAG,WAAW;AAC7D,UAAI,CAAC,QAAQ,OAAO,EAAG,WAAU,yBAAyB,KAAK,EAAE,QAAQ,oBAAoB,MAAM,CAAC;AACpG,UAAI,QAAQ,SAAS,OAAO,KAAK,UAAU,EAAG,WAAU,yBAAyB,KAAK,EAAE,QAAQ,aAAa,OAAO,MAAM,OAAO,QAAQ,IAAI,EAAE,CAAC;AAChJ,WAAK,OAAO,QAAQ,IAAI,IAAI,SAAW,IAAO,WAAU,yBAAyB,KAAK,EAAE,QAAQ,aAAa,OAAO,MAAM,OAAO,QAAQ,IAAI,IAAI,IAAM,CAAC;AACxJ,UAAI,QAAQ,UAAU,GAAI,WAAU,yBAAyB,KAAK,EAAE,QAAQ,eAAe,OAAO,OAAO,OAAO,QAAQ,KAAK,EAAE,CAAC;AAChI,aAAO;AAAA,IACT;AACA,cAAU,MAAM,WAAW,SAAS;AACpC,QAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,kBAAkB,iBAAiB,MAAM,CAAC;AAC3G,QAAI,MAAO,OAAM,MAAM,OAAO,kBAAkB,EAAE,MAAM,UAAU,UAAU,WAAW,OAAO,GAAG,MAAM,OAAO,QAAQ,IAAI,IAAI,KAAO,MAAM,OAAO,QAAQ,IAAI,EAAE,CAAC,CAAC;AAClK,cAAU,MAAM,WAAW,aAAa;AAGxC,UAAM,OAAO,eAAe,aAAa;AACzC,QAAI,MAAM,OAAO,WAAW,UAAU,EAAG,WAAU,iBAAiB,KAAK,EAAE,QAAQ,WAAW,CAAC;AAC/F,QAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,eAAe,iBAAiB,MAAM,CAAC;AACxG,UAAM,KAAK,OAAO,UAAU,QAAQ,GAAG,OAAO,UAAU,UAAU,CAAC,EAAE,MAAM,OAAK;AAC9E,YAAM,OAAO,OAAO,CAAC;AACrB,UAAI,SAAS,SAAU,WAAU,iBAAiB,KAAK,EAAE,QAAQ,WAAW,CAAC;AAC7E,UAAI,SAAS,QAAS,WAAU,uBAAuB,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,KAAK,CAAC;AACpG,UAAI,SAAS,YAAY,SAAS,QAAS,WAAU,uBAAuB,KAAK,EAAE,QAAQ,sBAAsB,QAAQ,KAAK,CAAC;AAC/H,gBAAU,uBAAuB,KAAK,EAAE,QAAQ,WAAW,QAAQ,KAAK,CAAC;AAAA,IAC3E,CAAC;AACD,UAAM,YAAY,MAAM,eAAe,MAAM,OAAO,WAAW,UAAU,GAAG,wBAAwB;AACpG,QAAI,CAAC,aAAa,CAAC,UAAU,OAAO,KAAK,OAAO,UAAU,GAAG,MAAM,OAAO,QAAQ,GAAG,KAAK,OAAO,UAAU,GAAG,MAAM,OAAO,QAAQ,GAAG,EAAG,kBAAiB,yBAAyB,KAAK,EAAE,QAAQ,qBAAqB,CAAC;AACxN,QAAI,QAAQ,QAAS,kBAAiB,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQI,QAAO,EAAE,CAAC;AAC9J,UAAM,OAAO,KAAK;AAKlB,UAAM,UAAU,MAAM,eAAe,QAAQ,QAAQ;AACrD,QAAI,CAAC,QAAQ,QAAS,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,uBAAuB,MAAM,UAAU,QAAQ,QAAQ,OAAO,CAAC;AAChJ,kBAAc;AACd,UAAM,OAAO,KAAK;AAKlB,UAAM,kBAAkB,OAAO,OAAe,aAAiE;AAC7G,YAAM,UAAU,MAAM,eAAe,MAAM,OAAO,WAAW,UAAU,GAAG,gBAAgB;AAC1F,UAAI,CAAC,WAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,GAAG,MAAM,SAAS,OAAO,OAAO,QAAQ,GAAG,MAAM,SAAS,IAAK,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,sBAAsB,OAAO,QAAQ,WAAW,CAAC;AAC/N,UAAI,QAAQ,SAAS,OAAO,KAAK,UAAU,EAAG,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,OAAO,QAAQ,WAAW,CAAC;AACtJ,WAAK,OAAO,QAAQ,IAAI,IAAI,SAAW,IAAO,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,OAAO,QAAQ,WAAW,CAAC;AAGtJ,UAAI,QAAQ,UAAU,GAAI,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,yBAAyB,OAAO,QAAQ,YAAY,OAAO,OAAO,QAAQ,KAAK,EAAE,CAAC;AACvK,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM,gBAAgB,iBAAiB,EAAE,KAAK,OAAO,UAAU,GAAG,GAAG,KAAK,OAAO,UAAU,GAAG,EAAE,CAAC;AAM/G,QAAI,SAAS;AACb,WAAO,SAAS,KAAK,YAAY;AAC/B,YAAM,OAAO,KAAK,IAAI,OAAO,KAAK,aAAa,MAAM;AACrD,YAAM,QAAQ,OAAO,YAAY,IAAI;AACrC,YAAM,OAAO,MAAM,eAAe,MAAM,KAAK,KAAK,OAAO,GAAG,MAAM,MAAM,GAAG,gBAAgB;AAC3F,UAAI,KAAK,cAAc,KAAM,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,wBAAwB,QAAQ,UAAU,MAAM,MAAM,KAAK,UAAU,CAAC;AAC9J,UAAI,MAAM,QAAQ,KAAK,SAAS,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAG,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AACvJ,gBAAU;AAAA,IACZ;AACA,QAAI,QAAQ,QAAS,kBAAiB,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQA,QAAO,EAAE,CAAC;AAC9J,UAAM,UAAU,MAAM,gBAAgB,mBAAmB,EAAE,KAAK,OAAO,MAAM,GAAG,GAAG,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC;AAI3G,UAAM,YAAY,MAAM,eAAe,MAAM,OAAO,SAAS,GAAG,qBAAqB;AACrF,UAAM,SAA4B,EAAE,MAAM,YAAY,eAAe,WAAW,KAAK,OAAO,QAAQ,GAAG,GAAG,KAAK,OAAO,QAAQ,GAAG,GAAG,OAAO,OAAO,QAAQ,KAAK,GAAG,MAAM,OAAO,QAAQ,IAAI,GAAG,QAAQA,QAAO;AAG7M,QAAI;AAAE,YAAM,OAAO,eAAe,aAAa;AAAA,IAAE,SAAS,GAAG;AAAE,YAAM,kBAAkB,CAAC;AAAA,IAAE;AAC1F,QAAI,OAAO;AACT,YAAM,eAAe,EAAE,GAAG,OAAO,eAAe,GAAG,UAAU;AAC7D,UAAI;AAAE,cAAM,MAAM,YAAY;AAAA,MAAE,SAAS,GAAG;AAC1C,cAAM,OAAO,OAAO,IAAI,WAAW,2BAA2B,GAAG,GAAG,EAAE,iBAAiB,MAAM,WAAW,MAAM,OAAO,EAAE,CAAC;AAAA,MAC1H;AAAA,IACF;AACA,WAAO;AAAA,EACT,UAAE;AAIA,QAAI,YAAY,CAAC,YAAa,OAAMN,QAAO,OAAO,UAAU,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AACtF,UAAM,MAAM,MAAM,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AACnC,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;;;AC7cA,SAAS,YAAAQ,WAAU,QAAAC,OAAM,aAAAC,kBAAiB;AAC1C,SAAS,cAAAC,aAAY,QAAAC,OAAM,UAAU,WAAAC,gBAAe;;;ACDpD,SAAS,eAAAC,oBAAmB;;;ACA5B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,YAAAC,WAAU,YAAAC,WAAU,QAAAC,OAAM,SAAAC,QAAO,aAAAC,kBAAiB;AAC3D,SAAS,SAAAC,cAAa;AACtB,SAAS,cAAAC,aAAY,QAAAC,aAAY;;;ACHjC,SAAS,SAAAC,cAAa;AACtB,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,UAAAC,SAAQ,YAAAC,iBAAgB;AACjC,SAAS,cAAAC,aAAY,QAAAC,aAAY;AACjC,SAAS,qBAAqB;AAE9B,IAAM,OAAO,cAAc,IAAI,IAAI,KAAK,YAAY,GAAG,CAAC;AACxD,IAAM,YAAY;AAGX,SAAS,mBAAmB,MAAM,SAAS,QAAQ,KAAK;AAC7D,QAAMC,OAAM;AAAA,IAAE,MAAM;AAAA,IAAM,aAAa;AAAA,IAAM,SAASD,MAAK,MAAM,SAAS;AAAA,IAAG,cAAcA,MAAK,MAAM,OAAO;AAAA,IAC3G,YAAY;AAAA,IAAM,gBAAgBA,MAAK,MAAM,OAAO;AAAA,IAAG,iBAAiBA,MAAK,MAAM,QAAQ;AAAA,IAC3F,eAAeA,MAAK,MAAM,MAAM;AAAA,IAAG,MAAMA,MAAK,MAAM,KAAK;AAAA,IAAG,KAAKA,MAAK,MAAM,KAAK;AAAA,IAAG,QAAQA,MAAK,MAAM,KAAK;AAAA,IAC5G,UAAU;AAAA,IAAK,kBAAkB;AAAA,IAAS,YAAY;AAAA,EAAI;AAC5D,aAAWE,QAAO,CAAC,cAAc,UAAU,WAAW,QAAQ,QAAQ,EAAG,KAAI,OAAOA,IAAG,EAAG,CAAAD,KAAIC,IAAG,IAAI,OAAOA,IAAG;AAE/G,EAAAD,KAAI,OAAO,QAAQ,aAAa,UAAUD,MAAK,OAAO,cAAc,eAAe,UAAU,IAAI;AACjG,SAAOC;AACT;AAEA,eAAsB,oBAAoB,EAAE,SAAS,mBAAmB,IAAI,CAAC,GAAG;AAC9E,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,aAAaD,MAAK,QAAQ,IAAI,cAAc,eAAe,gDAAgD;AACjH,UAAMH,QAAO,UAAU;AACvB,WAAO,OAAO,OAAO,EAAE,YAAY,MAAMC,UAAS,UAAU,GAAG,QAAQ,CAAC,WAAW,cAAc,mBAAmB,oBAAoB,UAAU,SAASE,MAAK,MAAM,iBAAiB,CAAC,GAAG,UAAU,QAAQ,CAAC;AAAA,EAChN;AACA,MAAI,QAAQ,aAAa,WAAW,CAACD,YAAW,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAClG,QAAMF,QAAO,MAAM;AACnB,SAAO,OAAO,OAAO,EAAE,YAAY,MAAMC,UAAS,MAAM,GAAG,QAAQ,CAAC,MAAME,MAAK,MAAM,gBAAgB,CAAC,GAAG,UAAU,QAAQ,CAAC;AAC9H;AAGO,SAAS,cAAc,QAAQ,MAAM,MAAM,EAAE,MAAM,KAAAC,OAAM,mBAAmB,IAAI,EAAE,IAAI,CAAC,GAAG;AAC/F,QAAM,SAAS,IAAIL,cAAa;AAChC,QAAMO,QAAO,OAAO,aAAa,UAAU,CAAC,GAAG,OAAO,QAAQ,SAAS,IAAI,IAAI,CAAC,GAAG,OAAO,QAAQ,IAAI;AACtG,QAAM,QAAQR,OAAM,OAAO,YAAYQ,OAAM,EAAE,KAAK,MAAM,KAAAF,MAAK,aAAa,MAAM,OAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AACjI,MAAI,OAAO,IAAI,SAAS,IAAI,QAAQ,GAAGG,UAAS;AAChD,QAAM,UAAU,IAAI,cAAc,MAAM,GAAG,aAAa,IAAI,cAAc,MAAM;AAChF,MAAI,YAAY;AAChB,QAAM,QAAQ,WAAS;AACrB,QAAI,SAAS,eAAe,MAAM,SAAS,cAAc;AACvD,UAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAC5G,mBAAa,WAAW,MAAM,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAC/D,UAAI,OAAO,WAAW,SAAS,IAAI,UAAW,OAAM,IAAI,MAAM,iBAAiB;AAC/E,UAAI;AACJ,cAAQ,MAAM,UAAU,QAAQ,IAAI,MAAM,GAAG;AAC3C,cAAM,OAAO,UAAU,MAAM,GAAG,GAAG;AAAG,oBAAY,UAAU,MAAM,MAAM,CAAC;AACzE,YAAI,KAAK,KAAK,EAAG,QAAO,KAAK,WAAW,KAAK,MAAM,IAAI,CAAC;AAAA,MAC1D;AAAA,IACF,MAAO,QAAO,KAAK,MAAM,UAAU,YAAY,WAAW,KAAK;AAAA,EACjE;AACA,QAAM,OAAO,IAAI,QAAQ,CAAAC,aAAW,MAAM,KAAK,SAAS,CAAC,MAAM,WAAW;AAAE,IAAAD,UAAS;AAAM,WAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAAG,IAAAC,SAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,EAAE,CAAC,CAAC;AAChK,QAAM,GAAG,SAAS,CAAAC,WAAS,OAAO,KAAK,WAAWA,MAAK,CAAC;AACxD,QAAM,MAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAChC,QAAM,OAAO,GAAG,QAAQ,UAAQ;AAAE,YAAQ,OAAO,KAAK,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,EAAE,CAAC;AACtF,QAAM,OAAO,GAAG,QAAQ,WAAS;AAC/B,aAAS,MAAM;AACf,cAAU,QAAQ,MAAM,KAAK;AAC7B,QAAI,QAAQ,IAAI,OAAO,QAAQ,OAAO,WAAW,MAAM,IAAI,WAAW;AAAE,aAAO,KAAK,WAAW,IAAI,MAAM,cAAc,CAAC;AAAG,YAAM,MAAM,IAAI;AAAG;AAAA,IAAO;AACrJ,QAAI;AACJ,YAAQ,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG;AACxC,YAAM,OAAO,OAAO,MAAM,GAAG,GAAG;AAAG,eAAS,OAAO,MAAM,MAAM,CAAC;AAChE,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AAAE,cAAM,KAAK,MAAM,IAAI,CAAC;AAAA,MAAE,QACxB;AAAE,eAAO,KAAK,WAAW,IAAI,MAAM,sBAAsB,CAAC;AAAG,cAAM,MAAM,IAAI;AAAA,MAAE;AAAA,IACvF;AAAA,EACF,CAAC;AACD,QAAM,OAAO,WAAS,IAAI,QAAQ,CAACD,UAAS,WAAW;AACrD,UAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAID,WAAU,OAAO,WAAW,IAAI,IAAI,WAAW;AAAE,aAAO,IAAI,MAAMA,UAAS,kBAAkB,aAAa,CAAC;AAAG;AAAA,IAAO;AACzH,UAAM,MAAM,MAAM,MAAM,CAAAE,WAASA,SAAQ,OAAOA,MAAK,IAAID,SAAQ,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,KAAM,MAAK,KAAK,IAAI,EAAE,MAAM,CAAAC,WAAS,OAAO,KAAK,WAAWA,MAAK,CAAC;AACtE,WAAS,YAAY,MAAM,YAAY,MAAQ;AAC7C,WAAO,IAAI,QAAQ,CAACD,UAAS,WAAW;AACtC,YAAM,QAAQ,MAAM;AAAE,qBAAa,KAAK;AAAG,eAAO,IAAI,WAAWE,QAAO;AAAG,eAAO,IAAI,UAAU,KAAK;AAAG,eAAO,IAAI,WAAW,MAAM;AAAA,MAAE;AACtI,YAAMA,WAAU,WAAS;AAAE,YAAI,MAAM,YAAY,MAAM;AAAE,gBAAM;AAAG,UAAAF,SAAQ,KAAK;AAAA,QAAE;AAAA,MAAE;AACnF,YAAM,QAAQ,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC;AAAA,MAAE;AAC7G,YAAM,SAAS,CAAAC,WAAS;AAAE,cAAM;AAAG,eAAOA,MAAK;AAAA,MAAE;AACjD,YAAM,QAAQ,WAAW,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,UAAU,CAAC;AAAA,MAAE,GAAG,SAAS;AAChH,aAAO,GAAG,WAAWC,QAAO;AAAG,aAAO,KAAK,UAAU,KAAK;AAAG,aAAO,KAAK,WAAW,MAAM;AAC1F,UAAIH,QAAQ,OAAM;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,QAAQ,MAAM,MAAM,aAAa,KAAK,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,SAAS;AAAE,WAAO;AAAA,EAAK,GAAG,IAAI,SAAS;AAAE,WAAOA;AAAA,EAAO,EAAE,CAAC;AAC7J;AAEA,eAAsB,gBAAgB,EAAE,MAAM,OAAO,IAAI,CAAC,GAAG;AAC3D,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,oBAAoB,EAAE,OAAO,CAAC;AACnD,WAAO,cAAc,QAAQ,SAAS,MAAM,EAAE,KAAK,CAAC;AACpD,UAAM,QAAQ,MAAM,IAAI,QAAQ,CAACC,UAAS,WAAW;AACnD,WAAK,OAAO,KAAK,WAAWA,QAAO;AACnC,WAAK,OAAO,KAAK,WAAW,MAAM;AAClC,WAAK,OAAO,KAAK,UAAU,MAAM,OAAO,IAAI,MAAM,qBAAqB,CAAC,CAAC;AAAA,IAC3E,CAAC;AACD,UAAM,KAAK;AACX,WAAO,EAAE,GAAG,OAAO,QAAQ,aAAa,OAAO,aAAa,UAAU,CAAC,iHAAiH,IAAI,CAAC,EAAE;AAAA,EACjM,SAASC,QAAO;AAAE,WAAO,EAAE,WAAW,OAAO,MAAM,2BAA2B,QAAQA,OAAM,QAAQ;AAAA,EAAE,UACtG;AAAU,QAAI,QAAQ,CAAC,KAAK,OAAQ,MAAK,IAAI;AAAA,EAAE;AACjD;AAEA,eAAsB,eAAe,QAAQ,MAAM;AACjD,MAAI,OAAO,aAAa,QAAS;AACjC,QAAM,OAAO,cAAc,QAAQ,WAAW,EAAE,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC;AACtE,QAAM,iBAAiB,MAAM,IAAI,QAAQ,CAACD,UAAS,WAAW;AAC5D,SAAK,OAAO,KAAK,WAAWA,QAAO;AACnC,SAAK,OAAO,KAAK,WAAW,MAAM;AAClC,SAAK,OAAO,KAAK,UAAU,MAAM,OAAO,IAAI,MAAM,oBAAoB,CAAC,CAAC;AAAA,EAC1E,CAAC;AACD,OAAK,IAAI;AACT,QAAM,OAAO,MAAM,KAAK;AACxB,MAAI,CAAC,eAAe,aAAa,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACxF;;;ACpHA,SAAS,qBAAqB,MAAM,eAAAG,oBAAmB;AACvD,SAAS,SAAAC,QAAO,aAAAC,YAAW,SAAS,OAAO,SAAAC,QAAO,YAAAC,WAAU,aAAa;AACzE,SAAS,cAAc;AACvB,SAAS,cAAAC,aAAY,QAAAC,aAAY;AACjC,SAAS,eAAAC,oBAAmB;AAC5B,SAAS,iBAAAC,sBAAqB;;;ACFvB,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YAAY,MAAM;AAAE,UAAM,uBAAuB,IAAI,EAAE;AAAG,SAAK,OAAO;AAAe,SAAK,OAAO;AAAA,EAAK;AACxG;;;ADIA,IAAM,SAASC,eAAc,IAAI,IAAI,0BAA0B,YAAY,GAAG,CAAC;AAC/E,IAAM,YAAY;AAGlB,eAAsB,mBAAmB,EAAE,WAAW,SAAS,SAAS,OAAO,UAAU,MAAM,QAAQ,KAAQ,OAAO,GAAG;AACvH,MAAI,CAACC,YAAW,IAAI,EAAG,OAAM,IAAI,UAAU,uCAAuC;AAClF,QAAM,eAAe,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;AACjD,QAAM,WAAW,IAAI,IAAI,SAAS,IAAI,aAAW,CAAC,QAAQ,WAAW,MAAM,OAAO,CAAC,CAAC;AACpF,MAAI,SAAS,SAAS,SAAS,UAAU,MAAM,KAAK,UAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,EAAG,OAAM,IAAI,UAAU,qCAAqC;AAC3I,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,OAAQ,QAAQ,QAAa,OAAO,UAAU,UAAU,WAAY,OAAM,IAAI,UAAU,kCAAkC;AACtK,QAAM,aAAa,KAAK,IAAI,KAAQ,KAAK;AACzC,QAAM,YAAYC,aAAY,IAAI;AAClC,QAAM,SAAS,UAAU,MAAM,oBAAoB;AACnD,QAAM,EAAE,YAAY,UAAU,IAAI,oBAAoB,SAAS;AAC/D,QAAM,aAAa,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,CAAC,EAAE,SAAS,WAAW;AACzF,QAAMC,OAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAMA,OAAMC,MAAK,MAAM,KAAK,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC/D,QAAMC,kBAAiBD,MAAK,MAAM,UAAUE,aAAY,EAAE,EAAE,SAAS,KAAK,CAAC,OAAO;AAElF,MAAI;AACJ,MAAI,WAAW,QAAQ,aAAa,UAAU,WAAWA,aAAY,EAAE,EAAE,SAAS,KAAK,CAAC,KAAKF,MAAK,MAAM,KAAKE,aAAY,CAAC,EAAE,SAAS,KAAK,CAAC,OAAO;AAClJ,MAAI,QAAQ,aAAa,WAAW,OAAO,WAAW,QAAQ,IAAI,KAAK;AAIrE,QAAI,SAAO,MAAMC,UAAS,OAAO,CAAC;AAClC,QAAG,OAAO,WAAWH,MAAK,QAAO,kBAAiB,QAAQ,CAAC,IAAE,IAAI,UAAO,MAAMG,UAAS,MAAM;AAC7F,sBAAgB,MAAM,QAAQH,MAAK,QAAO,UAAU,CAAC;AACrD,UAAM,MAAM,iBAAgB,GAAK;AACjC,UAAMI,QAAK,MAAMC,OAAM,eAAe;AACtC,QAAG,CAACD,MAAK,YAAY,KAAGA,MAAK,eAAe,KAAGA,MAAK,QAAM,QAAQ,OAAO,MAAIA,MAAK,OAAK,QAAS,GAAE;AAAC,YAAM,MAAM,eAAe;AAAE,YAAM,IAAI,MAAM,mCAAmC;AAAA,IAAC;AACpL,eAASJ,MAAK,iBAAgB,QAAQ;AACtC,QAAG,OAAO,WAAW,QAAQ,IAAE,KAAI;AAAC,YAAM,MAAM,eAAe;AAAE,YAAM,IAAI,MAAM,8BAA8B;AAAA,IAAC;AAAA,EAClH;AACA,MAAI;AACJ,MAAG;AAAC,YAAM,UAAU,MAAM,SAAQ,EAAC,SAAQ,cAAa,OAAM,OAAM,WAAU,CAAC;AAAA,EAAC,SAC1EM,QAAM;AAAC,QAAG,gBAAgB,OAAM,MAAM,eAAe;AAAE,UAAMA;AAAA,EAAK;AACxE,MAAI,OAAOC,UAAS,OAAO,QAAQ,OAAO,YAAY,OAAO;AAC7D,MAAI,UAAU,WAAW,GAAG,WAAW,GAAG,UAAU;AACpD,QAAM,SAAS,oBAAI,IAAI;AACvB,QAAM,UAAU,MAAM;AAAE,cAAU,QAAQ,MAAM,KAAK;AAAG,eAAW,cAAc,OAAO,OAAO,EAAG,YAAW,MAAM,IAAI,MAAM,eAAe,CAAC;AAAA,EAAE;AAC/I,QAAM,QAAQ,CAACC,KAAI,UAAU;AAC3B,QAAI,CAAC,SAAS,MAAM,OAAQ;AAC5B;AACA,UAAM,OAAO,EAAE,MAAM,YAAY,IAAAA,KAAI,GAAG,MAAM;AAC9C,SAAK,MAAM,KAAK,OAAO,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,YAAY,EAAE,MAAM,YAAY,IAAAA,KAAI,IAAI,OAAO,MAAM,eAAe,IAAI,IAAI,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACxJ;AACA,iBAAe,QAAQ,SAAS;AAC9B;AACA,QAAI,CAAC,WAAW,CAAC,OAAO,cAAc,QAAQ,EAAE,KAAK,QAAQ,KAAK,EAAG;AACrE,QAAI,QAAQ,SAAS,UAAU;AAAE,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,IAAI,MAAM,mBAAmB,CAAC;AAAG;AAAA,IAAO;AACvG,QAAI,QAAQ,SAAS,UAAW;AAChC,UAAMA,MAAK,QAAQ;AACnB,QAAI;AACF,UAAID,QAAQ,OAAM,IAAI,YAAY,eAAe;AACjD,UAAI,OAAO,WAAW,KAAK,UAAU,OAAO,CAAC,IAAI,aAAa,OAAO,KAAK,OAAO,EAAE,KAAK,CAAAE,SAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,QAAQ,MAAM,EAAE,SAASA,IAAG,CAAC,EAAG,OAAM,IAAI,YAAY,iBAAiB;AAC5L,UAAI,OAAO,IAAID,GAAE,KAAK,OAAO,QAAQ,GAAI,OAAM,IAAI,YAAY,MAAM;AACrE,UAAI,QAAQ,OAAO,QAAQ;AAAE,cAAMA,KAAI,EAAE,IAAI,MAAM,OAAO,UAAU,KAAK,MAAM,OAAO,YAAY,EAAE,IAAI,UAAQ,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;AAAG;AAAA,MAAO;AAC1J,UAAI,QAAQ,OAAO,OAAQ,OAAM,IAAI,YAAY,iBAAiB;AAClE,YAAM,aAAa,IAAI,gBAAgB;AAAG,aAAO,IAAIA,KAAI,UAAU;AACnE,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,IAAI,MAAM,OAAO,cAAc,QAAQ,MAAM,CAAC,EAAE,OAAO,MAAM;AACzF,gBAAM,UAAU,SAAS,IAAI,QAAQ,IAAI;AACzC,iBAAO,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,IAAI,GAAG,EAAE,QAAQ,SAAS,aAAa,CAAC;AAAA,QACvF,GAAG,EAAE,QAAQ,WAAW,OAAO,CAAC;AAChC,cAAMA,KAAI,EAAE,IAAI,MAAM,MAAM,CAAC;AAAA,MAC/B,UAAE;AAAU,eAAO,OAAOA,GAAE;AAAA,MAAE;AAAA,IAChC,SAASF,QAAO;AAAE,YAAME,KAAI,EAAE,IAAI,OAAO,MAAMF,kBAAiB,cAAcA,OAAM,OAAO,kBAAkB,CAAC;AAAA,IAAE;AAAA,EAClH;AACA,QAAM,QAAQ,MAAM;AAClB,QAAI,QAAS,QAAO;AACpB,IAAAC,UAAS;AAAM,YAAQ;AAAG,iBAAa,MAAM;AAAG,kBAAc,OAAO;AACrE,eAAW,YAAY;AACrB,UAAG,OAAM;AACP,cAAM,IAAI;AACV,cAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,KAAK,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAAG,aAAW;AAAE,gBAAM,IAAI,WAAW,MAAMA,SAAQ,KAAK,GAAG,GAAI;AAAG,YAAE,MAAM;AAAA,QAAE,CAAC,CAAC,CAAC;AACzJ,YAAI,CAAC,SAAS;AAAE,gBAAM,MAAM,KAAK;AAAG,gBAAM,MAAM;AAAA,QAAK;AAAA,MACvD;AAEA,UAAG,gBAAgB,OAAM,MAAM,eAAe,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IAC9D,GAAG;AACH,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,MAAM;AAAE,SAAK,MAAM;AAAA,EAAE,GAAG,KAAK;AAAG,SAAO,MAAM;AACvE,QAAM,UAAU,YAAY,MAAM;AAChC,QAAI;AAAE,UAAI,CAACH,QAAQ,WAAU,MAAM,MAAM,OAAO,cAAc,EAAE,OAAO,KAAK,IAAI,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,SAAST,aAAY,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC;AAAA,IAAE,QAC3J;AAAE,WAAK,MAAM;AAAA,IAAE;AAAA,EACvB,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC;AAAG,UAAQ,MAAM;AAC7D,QAAM,OAAO,OAAO,EAAE,KAAK,MAAM,MAAM;AACrC,QAAIS,WAAU,SAAS,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,KAAK,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,qBAAqB;AAChI,cAAU,KAAK,MAAM,OAAO,YAAY;AACxC,YAAQ;AACR,UAAM,YAAY,KAAK,MAAM,SAAST,aAAY,IAAI,IAAI,UAAU;AACpE,QAAI,YAAY,GAAG;AAAE,YAAM,MAAM;AAAG,YAAM,IAAI,MAAM,mBAAmB;AAAA,IAAE;AACzE,YAAQ,cAAc,QAAQ,UAAU,EAAE,UAAU,SAAS,KAAK,WAAW,OAAO,OAAO,UAAU,GAAG,EAAE,KAAK,CAAC;AAChH,UAAM,OAAO,GAAG,WAAW,aAAW;AAAE,WAAK,QAAQ,OAAO;AAAA,IAAE,CAAC;AAC/D,UAAM,OAAO,GAAG,WAAW,WAAS;AAClC,UAAI,MAAM,YAAY,YAAY;AAAE,mBAAW;AAAO,oBAAY;AAAA,MAAK;AACvE,UAAI,MAAM,YAAY,WAAY;AAAA,IACpC,CAAC;AACD,UAAM,OAAO,KAAK,UAAU,MAAM;AAAE,MAAAS,UAAS;AAAM,cAAQ;AAAG,mBAAa,MAAM;AAAG,oBAAc,OAAO;AAAA,IAAE,CAAC;AAC5G,UAAM,OAAO,KAAK,WAAW,MAAM;AAAE,WAAK,MAAM;AAAA,IAAE,CAAC;AACnD,UAAM,SAAS,MAAM,MAAM,YAAY,WAAW;AAClD,UAAM,UAAU,KAAK,UAAU;AAAA,MAAE,SAAS;AAAA,MAAG;AAAA,MAAU,WAAW,OAAO;AAAA,MAAK,aAAa,OAAO;AAAA,MAChG,SAAS;AAAA,MAAK,WAAW;AAAA,MAAO,WAAW,KAAK,IAAI,IAAI,KAAK,IAAI,MAAQ,SAAS;AAAA,MAAG,kBAAkB,KAAK,IAAI,IAAI;AAAA,MAAW,OAAO;AAAA,MACtI,QAAQ;AAAA,MAAQ,SAAS,QAAQ;AAAA,MAAK,SAAS;AAAA,IAAa,CAAC;AAC/D,UAAM,aAAa,KAAK,UAAU,EAAE,SAAS,WAAW,KAAK,MAAM,OAAO,KAAK,OAAO,GAAG,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;AAC5H,UAAMI,WAAUV,iBAAgB,YAAY,EAAE,MAAM,MAAM,MAAM,IAAM,CAAC;AAAA,EACzE;AACA,SAAO,OAAO,OAAO;AAAA,IAAE,SAAS,QAAQ;AAAA,IAAU,MAAM,CAAC,QAAQA,iBAAgB,UAAU;AAAA,IAAG,gBAAAA;AAAA,IAC5F;AAAA,IAAM;AAAA,IAAO,IAAI,SAAS;AAAE,aAAOM;AAAA,IAAO;AAAA,IAAG,IAAI,YAAY;AAAE,aAAO;AAAA,IAAU;AAAA,IAChF,IAAI,WAAW;AAAE,aAAO,EAAE,SAAS,cAAc,WAAW,MAAM,YAAY,MAAM,eAAe,UAAU,UAAU,SAAS,aAAa,OAAO,UAAU,IAAI,mBAAmB,OAAO,QAAAA,QAAO;AAAA,IAAE;AAAA,EAAE,CAAC;AAC5M;;;AEzHA,IAAM,QAAQ,WAAS,OAAO,cAAc,KAAK,KAAK,SAAS,IAAI,QAAQ;AAGpE,SAAS,eAAe,OAAO;AACpC,SAAO,OAAO,OAAO;AAAA,IAAE,aAAa,MAAM,OAAO,WAAW;AAAA,IAAG,cAAc,MAAM,OAAO,YAAY;AAAA,IACpG,mBAAmB,MAAM,OAAO,iBAAiB;AAAA,IAAG,uBAAuB,MAAM,OAAO,qBAAqB;AAAA,IAC7G,uBAAuB,MAAM,OAAO,qBAAqB;AAAA,IAAG,aAAa,MAAM,OAAO,WAAW;AAAA,EAAE,CAAC;AACxG;AAEO,SAAS,oBAAoB,EAAE,SAAS,aAAa,OAAO,gBAAgB,eAAe,gBAAgB,kBAAkB,UAAU,OAAO,UAAU,eAAe,GAAG;AAC/K,MAAI,CAAC,CAAC,gBAAgB,OAAO,SAAS,EAAE,SAAS,OAAO,EAAG,OAAM,IAAI,UAAU,qBAAqB;AACpG,MAAI,WAAW,MAAM,SAAS,MAAM,gBAAgB,MAAM,mBAAmB;AAC7E,MAAI,QAAQ,eAAe,GAAG,YAAY,OAAO,WAAW,OAAO,WAAW,MAAM,YAAY,IAAI,UAAU;AAC9G,QAAM,WAAW,CAAC;AAClB,SAAO,OAAO,OAAO;AAAA,IACnB,WAAW,QAAQ;AACjB,iBAAW,QAAQ,QAAQ,MAAM;AACjC,sBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACnE,yBAAmB,OAAO,QAAQ,kBAAkB,WAAW,OAAO,gBAAgB;AACtF,iBAAW,kBAAkB,kBAAkB,qBAAqB;AACpE,UAAI,CAAC,YAAY,SAAU,OAAM,IAAI,MAAM,6BAA6B;AAAA,IAC1E;AAAA,IACA,MAAM,SAAS;AACb,YAAM,SAAS,SAAS;AACxB,UAAI,CAAC,UAAU,OAAO,aAAa,SAAU,QAAO,EAAE,UAAU,MAAM;AACtE,UAAI,UAAU,OAAO,UAAU,OAAO,WAAW,OAAQ,QAAO,EAAE,UAAU,MAAM;AAClF,UAAI,QAAQ,WAAW,eAAgB,UAAS,OAAO,MAAM,MAAM;AACnE,UAAI,QAAQ,WAAW,6BAA6B;AAClD,mBAAW,OAAO;AAElB,gBAAQ,eAAe,OAAO,YAAY,KAAK;AAAG,oBAAY;AAC9D,eAAO,EAAE,UAAU,MAAM,cAAc,KAAK;AAAA,MAC9C;AACA,UAAI,QAAQ,WAAW,kBAAkB;AACvC,iBAAS,KAAK,EAAE,WAAW,OAAO,aAAa,MAAM,SAAS,OAAO,WAAW,MAAM,QAAQ,OAAO,UAAU,KAAK,CAAC;AACrH,YAAI,OAAO,YAAY,eAAgB,YAAW;AAAA,MACpD;AACA,UAAI,QAAQ,WAAW,oBAAoB,OAAO,MAAM,SAAS,kBAAkB,OAAO,OAAO,KAAK,SAAS,SAAU,aAAY,OAAO,KAAK;AACjJ,UAAI,QAAQ,WAAW,kBAAkB;AACvC,mBAAW,OAAO,MAAM;AACxB,mBAAW,OAAO,MAAM,UAAU;AAClC,kBAAU,OAAO,MAAM,QAAQ,EAAE,MAAM,OAAO,KAAK,MAAM,kBAAkB,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,EAAE,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI;AAAA,MACtJ;AACA,aAAO,EAAE,UAAU,MAAM,UAAU,WAAW,QAAQ,WAAW,iBAAiB;AAAA,IACpF;AAAA,IACA,WAAW;AACT,aAAO;AAAA,QAAE,eAAe;AAAA,QAAG,QAAQ;AAAA,QAAO,QAAQ;AAAA,QAAS;AAAA,QAAO,GAAG;AAAA,QAAS;AAAA,QAC5E,WAAW,YAAY,SAAS,SAAS,WAAW,IAAI,QAAQ,IAAI,MAAM,KAAK;AAAA,QAC/E;AAAA,QAAU;AAAA,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM,QAAQ;AAAA,QAC1F,UAAU;AAAA,UAAE;AAAA,UAAiB;AAAA,UAAc,mBAAmB;AAAA,UAAgB,kBAAkB;AAAA,UAC9F;AAAA,UAAkB,qBAAqB;AAAA,UAAM,cAAc,WAAW,aAAa,gBAAgB,yBAAyB;AAAA,UAC5H,6BAA6B;AAAA,UAAO,UAAU,CAAC,GAAG,QAAQ;AAAA,QAAE;AAAA,QAC9D,OAAO,EAAE,GAAG,OAAO,UAAU,WAAW,QAAQ,aAAa,OAAO,OAAO,KAAK,EAAE,MAAM,WAAS,UAAU,IAAI,IAAI,aAAa,YAAY,YAAY,UAAU;AAAA,QAClK,SAAS,EAAE,MAAM,SAAS,WAAW,MAAM,cAAc,YAAY,iBAAiB,mBAAmB,UAAU;AAAA,QACnH,UAAU,WAAW,sBAAsB;AAAA,QAAU;AAAA,QAAW;AAAA,QAChE,aAAa,CAAC,4GAA4G,uEAAuE;AAAA,MAAE;AAAA,IACvM;AAAA,EACF,CAAC;AACH;;;ACzDO,SAAS,iBAAiB,QAAQ,CAAC,GAAG;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,CAAAK,SAAO,CAAC,CAAC,iBAAiB,gBAAgB,EAAE,SAASA,IAAG,CAAC,EAAG,OAAM,IAAI,UAAU,2BAA2B;AACtM,QAAM,UAAU,CAAC;AACjB,aAAW,CAAC,QAAQ,MAAM,KAAK,CAAC,CAAC,iBAAiB,iBAAiB,GAAG,CAAC,kBAAkB,kBAAkB,CAAC,GAAG;AAC7G,QAAI,MAAM,MAAM,MAAM,OAAW;AACjC,QAAI;AACJ,QAAI;AAAE,YAAM,IAAI,IAAI,MAAM,MAAM,CAAC;AAAA,IAAE,QAAQ;AAAE,YAAM,IAAI,UAAU,2BAA2B;AAAA,IAAE;AAC9F,QAAI,OAAO,MAAM,MAAM,MAAM,YAAY,MAAM,MAAM,EAAE,SAAS,QAAQ,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,QACxH,EAAE,IAAI,aAAa,YAAY,IAAI,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ,GAAI,OAAM,IAAI,UAAU,2BAA2B;AACzK,YAAQ,KAAK,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,EACtC;AACA,SAAO,OAAO,OAAO;AAAA,IAAE,OAAO,QAAQ,IAAI,CAAC,CAACA,MAAK,KAAK,MAAM,GAAGA,IAAG,MAAM,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC7F,gBAAgB,QAAQ,IAAI,CAAC,CAACA,IAAG,MAAMA,IAAG;AAAA,IAAG,QAAQ,OAAO,YAAY,OAAO;AAAA,EAAE,CAAC;AACtF;AAGO,SAAS,uBAAuB,QAAQ,EAAE,gBAAgB,QAAQ,MAAM,OAAO,SAAS,GAAG;AAChG,QAAM,SAAS,QAAQ;AACvB,MAAI,CAAC,UAAU,OAAO,UAAU,kBAAkB,OAAO,mBAAmB,YAAY,OAAO,oBAAoB,WAAW,OAAO,iBAAiB,YAAa,OAAM,IAAI,MAAM,gCAAgC;AACnN,QAAM,UAAU,OAAO;AACvB,MAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,KAAK,CAAC,QAAQ,SAAU,OAAM,IAAI,MAAM,0BAA0B;AAClH,QAAM,SAAS,QAAQ;AACvB,MAAI,OAAO,YAAY,OAAO,WAAW,KAAK,UAAU,OAAO,IAAI,MAAM,KAAK,UAAU,OAAO,IAAI,KACjG,OAAO,QAAQ,QAAQ,OAAO,aAAa,QAAQ,KAAK,UAAU,OAAO,aAAa,MAAM,KAAK,UAAU,KAAK,EAAG,OAAM,IAAI,MAAM,+BAA+B;AACpK,aAAW,CAACA,MAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,EAAG,KAAI,OAAOA,IAAG,MAAM,MAAO,OAAM,IAAI,MAAM,gCAAgC;AACvI,SAAO,EAAE,oBAAoB,CAAC,UAAU,GAAG,6BAA6B,CAAC,GAAG,SAAS,cAAc,EAAE;AACvG;;;ALlBA,IAAM,SAAS,WAASC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACvE,IAAM,KAAK,WAAS,OAAO,UAAU,YAAY,yBAAyB,KAAK,KAAK;AACpF,IAAM,YAAY,WAAS,OAAO,UAAU,YAAY,MAAM,KAAK,KAAK,CAAC,MAAM,SAAS,IAAI,KAAK,OAAO,WAAW,KAAK,KAAK;AAG7H,eAAsB,mBAAmB,EAAE,YAAY,QAAQ,QAAQ,GAAG,MAAM;AAC9E,MAAI,CAACC,YAAW,UAAU,KAAK,CAAC,iBAAiB,KAAK,MAAM,KAAK,CAAC,yCAAyC,KAAK,OAAO,EAAG,OAAM,IAAI,UAAU,8BAA8B;AAC5K,QAAMC,QAAO,MAAMC,UAAS,UAAU;AACtC,MAAI,EAAE,MAAMC,MAAKF,KAAI,GAAG,OAAO,KAAK,QAAQ,aAAa,WAAW,CAACA,MAAK,YAAY,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACjJ,MAAI,OAAO,MAAMG,UAASH,KAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,mBAAmB;AAChF,QAAM,WAAW,MAAM,IAAI,QAAQ,CAACI,UAAS,WAAW;AACtD,UAAM,QAAQC,OAAML,OAAM,CAAC,WAAW,GAAG,EAAE,KAAK,MAAM,KAAK,mBAAmB,IAAI,GAAG,aAAa,MAAM,OAAO,OAAO,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACzJ,QAAI,SAAS,IAAIM,SAAQ;AACzB,UAAM,QAAQ,WAAW,MAAM;AAAE,YAAM,KAAK;AAAG,aAAO,IAAI,MAAM,qBAAqB,CAAC;AAAA,IAAE,GAAG,GAAM;AACjG,UAAM,OAAO,GAAG,QAAQ,WAAS;AAAE,gBAAU,MAAM,SAAS,MAAM;AAAG,UAAI,OAAO,SAAS,KAAM,OAAM,KAAK;AAAA,IAAE,CAAC;AAC7G,UAAM,OAAO,GAAG,QAAQ,WAAS;AAAE,MAAAA,UAASA,SAAQ,MAAM,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,IAAE,CAAC;AAC1F,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,SAAS,UAAQ;AAAE,mBAAa,KAAK;AAAG,UAAI,SAAS,EAAG,CAAAF,SAAQ,OAAO,KAAK,CAAC;AAAA,UAAQ,QAAO,IAAI,MAAM,uBAAuBE,OAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;AAAA,IAAE,CAAC;AAAA,EACnK,CAAC;AACD,MAAI,aAAa,aAAa,OAAO,GAAI,OAAM,IAAI,MAAM,sBAAsB;AAC/E,SAAO,OAAO,OAAO,EAAE,MAAAN,OAAM,QAAQ,QAAQ,CAAC;AAChD;AAGA,eAAsB,uBAAuB;AAAA,EAAE;AAAA,EAAW;AAAA,EAAS;AAAA,EAAS;AAAA,EAAa,QAAQ,CAAC;AAAA,EAAG,WAAW,CAAC;AAAA,EAC/G;AAAA,EAAa;AAAA,EAAW,OAAO;AAAA,EAAe;AAAA,EAAgB,kBAAkB;AAAA,EAAU,eAAe;AAAA,EACzG,aAAa;AAAA,EAAQ;AAAA,EAAsB,UAAU;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAiB;AAAA,EAAY;AAAA,EACnH,iBAAiB,CAAC;AAAA,EAAG;AAAiB,GAAG;AACzC,MAAI,CAAC,GAAG,WAAW,KAAK,CAACD,YAAW,WAAW,KAAK,CAACA,YAAW,SAAS,KAAK,CAAC,8BAA8B,KAAK,cAAc,EAAG,OAAM,IAAI,UAAU,kBAAkB;AACzK,MAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,OAAQ,aAAa,KAAW,OAAM,IAAI,UAAU,sBAAsB;AAChI,YAAU,YAAY,SAAS,iBAAiB,YAAY;AAC5D,QAAM,EAAE,OAAO,SAAS,IAAI,UAAU,SAAS,OAAO;AACtD,UAAQ,eAAe;AACvB,QAAM,WAAW,iBAAiB,cAAc;AAChD,MAAI,qBAAqB,UAAa,CAAC,UAAU,gBAAgB,EAAG,OAAM,IAAI,UAAU,kBAAkB;AAC1G,QAAM,MAAM,MAAME,UAAS,SAAS;AACpC,MAAI,EAAE,MAAMC,MAAK,GAAG,GAAG,YAAY,EAAG,OAAM,IAAI,MAAM,mBAAmB;AACzE,QAAMK,OAAM,aAAa,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,QAAM,OAAO,MAAMN,UAAS,WAAW;AACvC,QAAM,OAAOO,MAAK,MAAM,KAAK,WAAW,EAAE;AAC1C,QAAMD,OAAM,MAAM,EAAE,MAAM,IAAM,CAAC;AACjC,aAAW,UAAU,CAAC,OAAO,SAAS,UAAU,QAAQ,WAAW,SAAS,GAAG,EAAG,OAAMA,OAAMC,MAAK,MAAM,MAAM,GAAG,EAAE,MAAM,IAAM,CAAC;AACjI,QAAM,QAAQ,MAAM,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACpD,MAAI,CAAC,MAAM,UAAW,OAAM,IAAI,MAAM,4BAA4B,MAAM,MAAM,EAAE;AAChF,QAAM,eAAe,MAAM,QAAQ,IAAI;AACvC,QAAM,QAAQ,MAAM,mBAAmB,eAAe,IAAI;AAC1D,QAAM,SAAS,MAAM,mBAAmB,EAAE,WAAW,SAAS,SAAS,OAAO,UAAU,MAAMA,MAAK,MAAM,GAAG,GAAG,OAAO,YAAY,QAAQ,MAAM,OAAO,CAAC;AACxJ,QAAM,SAAS;AAAA,IACb,WAAW,KAAK,UAAU,cAAc,CAAC;AAAA,IAAI;AAAA,IAA6B;AAAA,IAA6B;AAAA,IACvG;AAAA,IAA2B;AAAA,IAAuC;AAAA,IAClE;AAAA,IACA,GAAG,SAAS;AAAA,IACZ;AAAA,IAAc;AAAA,IAAsB;AAAA,IAAuB;AAAA,IAC3D;AAAA,IAAe;AAAA,IAAmB;AAAA,IAA0B,aAAa,KAAK,UAAU,OAAO,OAAO,CAAC;AAAA,IACvG,UAAU,KAAK,UAAU,OAAO,IAAI,CAAC;AAAA,IAAI,SAAS,KAAK,UAAUA,MAAK,MAAM,GAAG,CAAC,CAAC;AAAA,IAAI;AAAA,IAAkB;AAAA,IACvG,mBAAmB,KAAK,UAAU,KAAK,CAAC;AAAA,IAAI;AAAA,IAAiB;AAAA,IAC7D;AAAA,IAA8B,UAAU,KAAK,UAAU,IAAI,CAAC;AAAA,IAAI,iBAAiB,KAAK,UAAU,IAAI,CAAC;AAAA,IACrG,UAAU,KAAK,UAAUA,MAAK,MAAM,KAAK,CAAC,CAAC;AAAA,IAAI,SAAS,KAAK,UAAUA,MAAK,MAAM,KAAK,CAAC,CAAC;AAAA,EAC3F,EAAE,KAAK,IAAI,IAAI;AACf,QAAMC,WAAUD,MAAK,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,MAAM,MAAM,IAAM,CAAC;AAC9E,MAAI,qBAAsB,OAAM,qBAAqB,IAAI;AACzD,MAAI,OAAO,MAAML,UAASK,MAAK,MAAM,aAAa,CAAC,CAAC,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,GAAG;AAAE,UAAM,OAAO,MAAM;AAAG,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAAE;AAC1K,MAAI,OAAO,MAAML,UAAS,MAAM,IAAI,CAAC,MAAM,MAAM,QAAQ;AAAE,UAAM,OAAO,MAAM;AAAG,UAAM,IAAI,MAAM,mBAAmB;AAAA,EAAE;AACtH,QAAM,WAAW,oBAAoB,EAAE,SAAS,aAAa,OAAO,gBAAgB,iBAAiB,cAAc,OAAO,QAAQ,CAAC;AACnI,QAAMO,OAAM,mBAAmB,IAAI;AACnC,QAAM,aAAa,cAAc,MAAM,QAAQ,aAAa,EAAE,YAAY,MAAM,MAAM,MAAM,CAAC,cAAc,YAAY,UAAU,GAAG,KAAK,OAAO,WAAW,GAAG,EAAE,MAAM,KAAAA,KAAI,CAAC;AAC3K,QAAM,UAAU,oBAAI,IAAI,GAAG,gBAAgB,oBAAI,IAAI;AACnD,MAAI,WAAW,GAAGC,UAAS,OAAO,aAAa,eAAe,MAAM,WAAW,MAAM,eAAe,GAAG,aAAa,aAAa,OAAO,QAAQ,MAAM;AACtJ,MAAI,cAAc,QAAQ,QAAQ;AAClC,QAAM,cAAc,CAAAL,WAAS;AAAE,eAAW,SAAS,QAAQ,OAAO,EAAG,OAAM,OAAOA,MAAK;AAAG,YAAQ,MAAM;AAAA,EAAE;AAC1G,QAAM,MAAM,CAAC,QAAQ,QAAQ,YAAY,QAAW,IAAI,QAAQ,CAACF,UAAS,WAAW;AACnF,QAAIO,WAAU,OAAO;AAAE,aAAO,SAAS,IAAI,MAAM,YAAY,CAAC;AAAG;AAAA,IAAO;AACxE,UAAMC,MAAK,EAAE;AACb,UAAMC,SAAQ,WAAW,MAAM;AAAE,cAAQ,OAAOD,GAAE;AAAG,aAAO,IAAI,MAAM,mBAAmB,MAAM,EAAE,CAAC;AAAA,IAAE,GAAG,KAAK,IAAI,WAAW,UAAU,CAAC;AACtI,UAAM,SAAS,QAAM,WAAS;AAAE,mBAAaC,MAAK;AAAG,SAAG,KAAK;AAAA,IAAE;AAC/D,YAAQ,IAAID,KAAI,EAAE,SAAS,OAAOR,QAAO,GAAG,QAAQ,OAAO,MAAM,EAAE,CAAC;AACpE,SAAK,WAAW,KAAK,EAAE,IAAAQ,KAAI,QAAQ,OAAO,CAAC,EAAE,MAAM,CAAAN,WAAS;AAAE,YAAM,QAAQ,QAAQ,IAAIM,GAAE;AAAG,cAAQ,OAAOA,GAAE;AAAG,aAAO,OAAON,MAAK;AAAA,IAAE,CAAC;AAAA,EACzI,CAAC;AACD,QAAM,OAAO,MAAM;AACjB,QAAI,YAAa,QAAO;AACxB,IAAAK,UAAS;AAAM,gBAAY,IAAI,MAAM,cAAc,CAAC;AACpD,kBAAc,UAAU;AAAG,YAAQ,oBAAoB,SAAS,OAAO;AACvE,mBAAe,YAAY;AACzB,YAAM,OAAO,MAAM;AAKnB,UAAI,CAAC,SAAS,CAAC,QAAQ,WAAW,CAAC,aAAa,QAAQ,EAAE,SAAS,SAAS,SAAS,EAAE,QAAQ,KAAK,CAAC,cAAc,aAAa;AAC9H,cAAM,IAAI,QAAQ,CAAAP,aAAW;AAC3B,gBAAM,SAAS,MAAM;AAAE,yBAAa,KAAK;AAAG,oBAAQ,oBAAoB,SAAS,MAAM;AAAG,YAAAA,SAAQ;AAAA,UAAE;AACpG,gBAAM,QAAQ,WAAW,QAAQ,GAAI;AACrC,qBAAW,KAAK,KAAK,MAAM;AAAG,kBAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACtF,cAAI,QAAQ,QAAS,QAAO;AAAA,QAC9B,CAAC;AAAA,MACH;AACA,iBAAW,IAAI;AACf,YAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,WAAW,MAAM,IAAI,QAAQ,CAAAA,aAAW;AAAE,cAAM,IAAI,WAAW,MAAMA,SAAQ,IAAI,GAAG,GAAI;AAAG,UAAE,MAAM;AAAA,MAAE,CAAC,CAAC,CAAC;AAC3I,UAAI,CAAC,QAAQ;AACX,YAAI,QAAQ,aAAa,WAAW,aAAa;AAAE,cAAI;AAAE,oBAAQ,KAAK,CAAC,YAAY,KAAK,SAAS;AAAA,UAAE,QAAQ;AAAA,UAAC;AAAA,QAAE;AAC9G,mBAAW,MAAM,KAAK;AACtB,cAAM,WAAW;AAAA,MACnB;AACA,UAAI,CAAC,cAAc,YAAa,gBAAe,EAAE,GAAG,cAAc,aAAa,OAAO,QAAQ,eAAe,sBAAsB,CAAC,OAAO;AAC3I,aAAO;AAAA,IACT,GAAG;AACH,WAAO;AAAA,EACT;AACA,aAAW,OAAO,GAAG,WAAW,WAAS;AACvC,QAAI,MAAM,YAAY,UAAW,eAAc;AAC/C,QAAI,MAAM,YAAY,UAAW,gBAAe;AAAA,EAClD,CAAC;AACD,aAAW,OAAO,GAAG,WAAW,aAAW;AACzC,QAAI,QAAQ,OAAO,UAAa,CAAC,QAAQ,QAAQ;AAC/C,YAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;AAAG,cAAQ,OAAO,QAAQ,EAAE;AAChE,UAAI,QAAQ,MAAO,QAAO,OAAO,OAAO,OAAO,IAAI,MAAM,mBAAmB,QAAQ,MAAM,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,UAC9H,QAAO,QAAQ,QAAQ,MAAM;AAClC;AAAA,IACF;AACA,QAAI,QAAQ,OAAO,QAAW;AAC5B,WAAK,WAAW,KAAK,EAAE,IAAI,QAAQ,IAAI,OAAO,EAAE,MAAM,QAAQ,SAAS,kCAAkC,EAAE,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAC5H;AAAA,IACF;AACA,UAAM,SAAS,SAAS,MAAM,OAAO;AACrC,QAAI,cAAc,OAAO,QAAQ,WAAW,SAAU,YAAW,EAAE,QAAQ,QAAQ,QAAQ,WAAW,OAAO,QAAQ,QAAQ,OAAO,mBAAmB,WAAW,QAAQ,OAAO,MAAM,iBAAiB,KAAK,CAAC;AAC9M,QAAI,OAAO,gBAAgB,SAAS;AAClC,YAAMU,YAAW,SAAS,SAAS;AACnC,oBAAc,YAAY,KAAK,MAAM,QAAQA,SAAQ,CAAC;AACtD,WAAK,YAAY,MAAM,CAAAR,WAAS;AAAE,gBAAQA;AAAO,aAAK,KAAK;AAAA,MAAE,CAAC;AAAA,IAChE;AACA,QAAI,OAAO,UAAU;AAAE,cAAQ,IAAI,MAAM,6BAA6B;AAAG,WAAK,KAAK;AAAA,IAAE;AACrF,eAAW,YAAY,cAAe,UAAS,SAAS,MAAM;AAAA,EAChE,CAAC;AACD,aAAW,OAAO,GAAG,WAAW,CAAAA,WAAS;AAAE,YAAQA;AAAO,gBAAYA,MAAK;AAAG,SAAK,KAAK;AAAA,EAAE,CAAC;AAC3F,aAAW,OAAO,KAAK,UAAU,MAAM;AAAE,IAAAK,UAAS;AAAM,gBAAY,IAAI,MAAM,YAAY,CAAC;AAAG,SAAK,OAAO,MAAM;AAAA,EAAE,CAAC;AACnH,QAAM,UAAU,MAAM;AAAE,YAAQ,IAAI,MAAM,eAAe;AAAG,SAAK,KAAK;AAAA,EAAE;AACxE,UAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACzD,QAAM,aAAa,YAAY,MAAM;AACnC,QAAI;AAAE,UAAI,OAAO,OAAQ,OAAM,IAAI,MAAM,mBAAmB;AAAG,UAAI,UAAU,SAAS,OAAO,EAAE,aAAa,SAAU,OAAM,IAAI,MAAM,mBAAmB;AAAG,gBAAU,YAAY,SAAS,iBAAiB,YAAY;AAAA,IAAE,QACpN;AAAE,cAAQ,IAAI,MAAM,mBAAmB;AAAG,WAAK,KAAK;AAAA,IAAE;AAAA,EAC9D,GAAG,GAAG;AAAG,aAAW,MAAM;AAC1B,MAAI,QAAQ,QAAS,SAAQ;AAC7B,QAAM,QAAQ,WAAW,MAAM;AAAE,YAAQ,IAAI,MAAM,cAAc;AAAG,SAAK,KAAK;AAAA,EAAE,GAAG,UAAU;AAAG,QAAM,MAAM;AAC5G,MAAI;AACF,UAAM,UAAU,MAAM,WAAW,YAAY,SAAS;AACtD,UAAM,OAAO,KAAK,OAAO;AACzB,UAAM,IAAI,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,OAAO,qBAAqB,SAAS,QAAQ,GAAG,cAAc,EAAE,iBAAiB,KAAK,EAAE,CAAC;AAC5J,UAAM,WAAW,KAAK,EAAE,QAAQ,eAAe,QAAQ,CAAC,EAAE,CAAC;AAC3D,sBAAkB,uBAAuB,MAAM,IAAI,eAAe,EAAE,KAAK,eAAe,MAAM,CAAC,GAAG,EAAE,gBAAgB,QAAQ,MAAMH,MAAK,MAAM,GAAG,GAAG,OAAO,SAAS,CAAC;AACpK,UAAM,SAAS,MAAM,IAAI,gBAAgB;AAAA,MAAE,OAAO;AAAA,MAAgB,eAAe;AAAA,MAAU,4BAA4B;AAAA,MAAO;AAAA,MAAK,gBAAgB;AAAA,MAAS,SAAS;AAAA,MAAa,WAAW;AAAA,MAC3L,GAAI,mBAAmB,EAAE,uBAAuB,iBAAiB,IAAI,CAAC;AAAA,IAAG,CAAC;AAC5E,aAAS,WAAW,MAAM;AAAG,eAAW,OAAO,OAAO;AAAA,EACxD,SAASF,QAAO;AAAE,iBAAa,KAAK;AAAG,UAAM,KAAK;AAAG,IAAAA,OAAM,iBAAiB,OAAO;AAAU,IAAAA,OAAM,cAAc,WAAW,OAAO,MAAM,KAAK;AAAG,UAAMA;AAAA,EAAM;AAC7J,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IAAM;AAAA,IAAO,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;AAAA,IAAG;AAAA,IACrD,MAAM,aAAa;AAAE,aAAO,IAAI,cAAc,EAAE,eAAe,OAAO,OAAO,IAAI,CAAC;AAAA,IAAE;AAAA,IACpF,MAAM,mBAAmB;AAAE,aAAO,IAAI,wBAAwB,EAAE,UAAU,YAAY,YAAY,QAAQ,oBAAoB,OAAO,IAAI,CAAC;AAAA,IAAE;AAAA,IAC5I,MAAM,eAAe,MAAMS,QAAO,CAAC,GAAG;AACpC,UAAI,CAAC,MAAM,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,aAAa;AACxD,aAAO,IAAI,uBAAuB,EAAE,UAAU,QAAQ,YAAY,MAAM,MAAM,WAAWA,MAAK,CAAC;AAAA,IACjG;AAAA,IACA,MAAM,IAAI,QAAQ;AAChB,UAAI,CAAC,UAAU,MAAM,KAAK,cAAc,aAAc,OAAM,IAAI,MAAM,8BAA8B;AACpG,gBAAU,YAAY,SAAS,iBAAiB,YAAY;AAC5D,gBAAU,SAAS,OAAO;AAC1B,UAAI,gBAAiB,OAAM,gBAAgB,EAAE,OAAO,GAAG,SAAS,aAAa,QAAQ,OAAO,QAAQ,SAAS,gBAAgB,MAAM,CAAC;AACpI,UAAIJ,WAAU,MAAO,OAAM,SAAS,IAAI,MAAM,YAAY;AAC1D,UAAI,UAAU,SAAS,OAAO,EAAE,aAAa,SAAU,OAAM,IAAI,MAAM,mBAAmB;AAC1F,gBAAU,YAAY,SAAS,iBAAiB,YAAY;AAC5D,mBAAa;AAAM;AACnB,UAAI;AACF,cAAM,aAAa,IAAI,QAAQ,CAACP,UAAS,WAAW;AAClD,gBAAM,WAAW,CAAC,UAAU,WAAW;AAAE,gBAAI,OAAO,WAAW;AAAE,4BAAc,OAAO,QAAQ;AAAG,cAAAA,SAAQ,SAAS,SAAS,CAAC;AAAA,YAAE;AAAA,UAAE;AAChI,wBAAc,IAAI,QAAQ;AAC1B,qBAAW,KAAK,KAAK,MAAM;AAAE,0BAAc,OAAO,QAAQ;AAAG,mBAAO,SAAS,IAAI,MAAM,wBAAwB,CAAC;AAAA,UAAE,CAAC;AAAA,QACrH,CAAC;AACD,mBAAW,MAAM,MAAM;AAAA,QAAC,CAAC;AACzB,cAAM,IAAI,cAAc,EAAE,UAAU,OAAO,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,eAAe,CAAC,EAAE,CAAC,GAAG,OAAO,eAAe,CAAC;AACvH,cAAM,SAAS,MAAM;AACrB,cAAM;AACN,YAAI,MAAO,OAAM;AACjB,eAAO,EAAE,GAAG,QAAQ,QAAQ,OAAO,aAAa,cAAc,cAAc,SAAS;AAAA,MACvF,UAAE;AAAU,qBAAa;AAAA,MAAM;AAAA,IACjC;AAAA,IACA,MAAM,SAAS;AAAE,mBAAa,KAAK;AAAG,aAAO,KAAK;AAAA,IAAE;AAAA,IACpD,MAAM,QAAQ;AAAE,mBAAa,KAAK;AAAG,aAAO,KAAK;AAAA,IAAE;AAAA,IACnD,WAAW;AAAE,aAAO;AAAA,QAAE,GAAG,SAAS,SAAS;AAAA,QAAG,2BAA2B;AAAA,QACvE,4BAA4B,eAAe,OAAO;AAAA,QAAG,kCAAkC,eAAe,wBAAwB;AAAA,QAC9H,SAAS;AAAA,QAAa;AAAA,QAAc,QAAQ,OAAO;AAAA,QAAU,SAAS;AAAA,QACtE,aAAa;AAAA,QAAwC,iBAAiB,EAAE,MAAM,MAAM,MAAM,YAAY,MAAM,YAAY,aAAa,MAAM,YAAY;AAAA,MAAE;AAAA,IAAE;AAAA,IAC7J,IAAI,SAAS;AAAE,aAAOO;AAAA,IAAO;AAAA,EAC/B,CAAC;AACH;;;ADpMA,SAAS,eAAe,SAAS,UAAU,gBAAgB,iBAAiB,cAAc;AACxF,QAAM,SAAS,oBAAI,IAAI;AACvB,QAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAChC,QAAM,aAAa,WAAS,KAAK,UAAU,KAAK;AAChD,QAAM,UAAU,CAAC,OAAO,YAAY;AAClC,aAAS,OAAO;AAChB,UAAM,QAAQ,OAAO,IAAI,KAAK;AAC9B,QAAI,CAAC,SAAS,MAAM,YAAY,WAAW,OAAO,KAAK,MAAM,aAAa,KAAK,IAAI,GAAG;AACpF,aAAO,OAAO,KAAK;AACnB,YAAM,IAAI,MAAM,wBAAwB;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY;AAAA,IAChB,WAAW;AAAE,eAAS,OAAO;AAAG,aAAO,EAAE,OAAO,QAAQ,OAAO,UAAU,QAAQ,SAAS;AAAA,IAAE;AAAA,IAC5F,YAAY,UAAU,UAAU,OAAO;AACrC,eAAS,OAAO;AAChB,UAAI,aAAa,mBAAmB,UAAU,gBAAgB,mBAAmB,aAAc,OAAM,IAAI,MAAM,wBAAwB;AAAA,IACzI;AAAA,IACA,MAAM,UAAU,EAAE,SAAS,OAAO,MAAM,GAAG;AACzC,eAAS,OAAO;AAChB,UAAI,SAAS,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAQ,OAAM,IAAI,MAAM,wBAAwB;AACpL,YAAM,QAAQK,aAAY,EAAE,EAAE,SAAS,WAAW;AAClD,aAAO,IAAI,OAAO,EAAE,SAAS,WAAW,OAAO,GAAG,OAAO,IAAI,IAAI,KAAK,GAAG,WAAW,KAAK,IAAI,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAS,EAAE,CAAC;AACrI,aAAO,EAAE,MAAM;AAAA,IACjB;AAAA,IACA,KAAK,OAAO,SAAS;AAAE,aAAO,CAAC,GAAG,QAAQ,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK;AAAA,IAAE;AAAA,IACxE,MAAM,OAAO,SAAS,EAAE,MAAM,GAAG;AAC/B,YAAM,QAAQ,QAAQ,OAAO,OAAO;AACpC,UAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAQ,OAAM,IAAI,MAAM,wBAAwB;AACzG,YAAM,YAAY,KAAK,IAAI,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAS;AAChE,aAAO,EAAE,MAAM;AAAA,IACjB;AAAA,IACA,MAAM,IAAI,OAAO,SAAS,MAAM,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG;AACxD,YAAM,QAAQ,QAAQ,OAAO,OAAO;AACpC,UAAI,CAAC,MAAM,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACnE,eAAS,OAAO;AAChB,aAAO,QAAQ,EAAE,QAAQ,UAAU,IAAI,gBAAgB,EAAE,OAAO,CAAC;AAAA,IACnE;AAAA,IACA,QAAQ,OAAO;AAAE,aAAO,OAAO,KAAK;AAAA,IAAE;AAAA,EACxC;AACA,SAAO,EAAE,WAAW,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE;AAC3D;AAGA,eAAsB,wBAAwB,SAAS;AACrD,QAAM,EAAE,SAAS,UAAU,gBAAgB,kBAAkB,UAAU,eAAe,eAAe,IAAI,WAAW,CAAC;AACrH,MAAI,SAAS,SAAS,aAAa,YAAY,CAAC,WAAW,OAAO,aAAa,WAAY,OAAM,IAAI,MAAM,mCAAmC;AAC9I,MAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,MAAM,UAAU,CAAC,MAAM,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,SAAS,OAAQ,OAAM,IAAI,MAAM,8BAA8B;AACxK,QAAM,QAAQ,eAAe,SAAS,UAAU,gBAAgB,iBAAiB,YAAY;AAC7F,MAAI;AACF,UAAM,UAAU,MAAM,uBAAuB,EAAE,GAAG,SAAS,WAAW,MAAM,WAAW,SAAS,MAAM,QAAQ,CAAC;AAC/G,UAAM,QAAQ,QAAQ;AACtB,WAAO,OAAO,OAAO,EAAE,GAAG,SAAS,MAAM,QAAQ;AAAE,UAAI;AAAE,eAAO,MAAM,MAAM;AAAA,MAAE,UAAE;AAAU,cAAM,MAAM;AAAA,MAAE;AAAA,IAAE,GAAG,MAAM,SAAS;AAAE,UAAI;AAAE,eAAO,MAAM,QAAQ,OAAO;AAAA,MAAE,UAAE;AAAU,cAAM,MAAM;AAAA,MAAE;AAAA,IAAE,EAAE,CAAC;AAAA,EACnM,SAASC,QAAO;AACd,UAAM,MAAM;AACZ,UAAMA;AAAA,EACR;AACF;;;ADtDA,IAAM,MAAI,CAAC,UAAY,OAAO,UAAQ,YAAU,0BAA0B,KAAK,KAAK;AACpF,IAAM,QAAM,CAAC,UAAY,SAAO,OAAO,UAAQ,YAAU,CAAC,MAAM,QAAQ,KAAK,KAAG,OAAO,eAAe,KAAK,MAAI,OAAO;AACtH,IAAM,SAAO,CAAC,OAAU,SAAgB;AAAC,MAAG,CAAC,MAAM,KAAK,KAAG,OAAO,KAAK,KAAK,EAAE,KAAK,CAAAC,SAAK,CAAC,KAAK,SAASA,IAAG,CAAC,EAAE,MAAK,sBAAsB;AAAE,SAAO;AAAK;AACtJ,IAAM,SAAO,CAAC,QAAc,UAAe;AAAC,QAAM,OAAK,SAAS,QAAO,KAAK;AAAE,SAAO,SAAO,MAAI,CAAC,KAAK,WAAW,IAAI,KAAG,CAACC,YAAW,IAAI;AAAC;AAElI,SAAS,oBAAoB,OAAU,SAAe,OAA+C;AAC3G,MAAG,UAAQ,OAAU,QAAO,CAAC;AAC7B,MAAG,CAAC,MAAM,QAAQ,KAAK,KAAG,MAAM,SAAO,MAAI,CAAC,CAAC,SAAQ,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAAE,MAAK,4BAA4B;AAC1H,QAAM,OAAK,oBAAI,IAAY,GAAE,eAAa,oBAAI,IAAY;AAC1D,SAAO,MAAM,IAAI,SAAK;AACrB,WAAO,KAAI,CAAC,aAAY,UAAS,mBAAkB,cAAa,eAAc,SAAQ,MAAM,CAAC;AAC7F,QAAG,CAAC,IAAI,IAAI,SAAS,KAAG,CAAC,IAAI,IAAI,MAAM,KAAG,CAAC,OAAO,OAAO,OAAM,IAAI,MAAM,KAAG,CAAC,OAAO,cAAc,IAAI,eAAe,KAAG,IAAI,kBAAgB,KACzI,CAACA,YAAW,IAAI,UAAU,KAAG,CAACA,YAAW,IAAI,WAAW,KAAG,CAAC,OAAOC,SAAQ,OAAO,GAAEA,SAAQ,IAAI,WAAW,CAAC,EAAE,MAAK,4BAA4B;AAClJ,WAAO,IAAI,OAAM,CAAC,UAAS,SAAS,CAAC;AACrC,QAAG,CAAC,iBAAiB,KAAK,IAAI,MAAM,MAAM,KAAG,CAAC,yCAAyC,KAAK,IAAI,MAAM,OAAO,EAAE,MAAK,4BAA4B;AAChJ,QAAG,CAAC,MAAM,IAAI,IAAI,KAAG,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,OAAO,MAAK,4BAA4B;AACpF,eAAU,CAAC,OAAM,GAAG,KAAK,OAAO,QAAa,IAAI,IAAI,GAAE;AACtD,UAAG,CAAC,IAAI,KAAK,EAAE,MAAK,4BAA4B;AAAE,aAAO,KAAI,CAAC,eAAe,CAAC;AAC9E,UAAG,CAACD,YAAW,IAAI,aAAa,KAAG,IAAI,cAAc,SAAO,QAAM,IAAI,cAAc,SAAS,IAAI,EAAE,MAAK,4BAA4B;AAAA,IACrI;AACA,UAAMD,OAAI,GAAG,IAAI,MAAM,IAAI,IAAI,SAAS,IAAG,UAAQE,SAAQ,IAAI,WAAW;AAC1E,QAAG,KAAK,IAAIF,IAAG,KAAG,aAAa,IAAI,OAAO,EAAE,MAAK,4BAA4B;AAAE,SAAK,IAAIA,IAAG;AAAE,iBAAa,IAAI,OAAO;AACrH,WAAO,EAAC,WAAU,IAAI,WAAU,QAAO,IAAI,QAAO,iBAAgB,IAAI,iBAAgB,YAAWE,SAAQ,IAAI,UAAU,GAAE,aAAY,SAAQ,OAAM,EAAC,QAAO,IAAI,MAAM,QAAO,SAAQ,IAAI,MAAM,QAAO,GAAE,MAAK,gBAAgB,IAAI,IAAI,EAAC;AAAA,EACtO,CAAC;AACF;AAKO,IAAM,WAAN,MAAc;AAAA,EAEpB,YAAY,aAAuC,OAAoB,OAAY;AAAhC;AAAoB;AACtE,SAAK,WAAS,IAAI,IAAI,YAAY,IAAI,aAAS,CAAC,GAAG,QAAQ,MAAM,IAAI,QAAQ,SAAS,IAAG,OAAO,CAAC,CAAC;AAAA,EACnG;AAAA,EAFmD;AAAA,EAAoB;AAAA,EAD/D;AAAA,EAIR,MAAc,SAAS,GAAM,GAAU,OAAgC;AACtE,UAAM,OAAK,CAAC,UAAS,gBAAe,aAAY,mBAAkB,SAAQ,kBAAiB,mBAAkB,gBAAe,WAAU,YAAY;AAClJ,WAAO,GAAE,CAAC,GAAG,MAAK,GAAI,QAAM,CAAC,IAAE,CAAC,MAAM,CAAE,CAAC;AAAE,WAAO,EAAE,cAAa,CAAC,QAAO,aAAY,UAAS,gBAAe,aAAa,CAAC;AAAE,WAAO,EAAE,OAAM,CAAC,UAAS,SAAS,CAAC;AAChK,QAAG,CAAC,IAAI,EAAE,MAAM,KAAG,CAAC,EAAE,MAAM,SAAS,EAAE,MAAM,KAAG,CAAC,IAAI,EAAE,SAAS,KAAG,CAAC,OAAO,cAAc,EAAE,eAAe,KAAG,EAAE,kBAAgB,KAC5H,EAAE,aAAa,SAAO,YAAU,EAAE,aAAa,cAAY,KAAK,MAAM,aAAW,EAAE,aAAa,WAAS,EAAE,UAC3G,OAAO,EAAE,aAAa,iBAAe,YAAU,EAAE,aAAa,aAAa,SAAO,QAAM,OAAO,EAAE,aAAa,gBAAc,YAC5H,CAAC,iBAAiB,KAAK,EAAE,MAAM,MAAM,KAAG,CAAC,yCAAyC,KAAK,EAAE,MAAM,OAAO,KACtG,CAAC,8BAA8B,KAAK,EAAE,cAAc,KAAG,OAAO,EAAE,oBAAkB,YAAU,CAAC,EAAE,mBAAiB,OAAO,EAAE,iBAAe,YAAU,CAAC,EAAE,gBACrJ,CAAC,CAAC,OAAM,cAAc,EAAE,SAAS,EAAE,OAAO,KAAG,CAAC,OAAO,cAAc,EAAE,UAAU,KAAG,EAAE,aAAW,OAAM,EAAE,aAAW,KAAQ,MAAK,sBAAsB;AACxJ,QAAG,CAAC,UAAQ,OAAO,EAAE,SAAO,YAAU,CAAC,EAAE,KAAK,KAAK,KAAG,EAAE,KAAK,SAAS,IAAI,KAAG,OAAO,WAAW,EAAE,IAAI,IAAE,MAAO,MAAK,sBAAsB;AACzI,UAAM,UAAQ,KAAK,SAAS,IAAI,GAAG,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE;AAC5D,QAAG,CAAC,WAAS,QAAQ,oBAAkB,EAAE,mBAAiB,QAAQ,MAAM,WAAS,EAAE,MAAM,UAAQ,QAAQ,MAAM,YAAU,EAAE,MAAM,WAAS,CAAC,OAAO,OAAO,QAAQ,MAAK,EAAE,KAAK,EAAE,MAAK,sBAAqB,GAAG;AAC5M,UAAM,cAAY,YAAU,IAAI,UAAU,EAAC,QAAO,EAAE,QAAO,uBAAsB,EAAE,aAAa,cAAa,WAAU,EAAE,WAAU,iBAAgB,EAAE,iBAAgB,aAAY,EAAE,MAAM,QAAO,cAAa,EAAE,MAAM,QAAO,CAAC,CAAC;AAC9N,QAAG,EAAE,aAAa,gBAAc,YAAY,MAAK,mCAAkC,GAAG;AACtF,UAAM,MAAI,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,aAAa,YAAY;AACvE,QAAG,EAAE,MAAMC,MAAK,GAAG,GAAG,YAAY,EAAE,MAAK,+BAA8B,GAAG;AAC1E,UAAM,MAAI,MAAM,aAAa,QAAQ,GAAG;AAAE,UAAM,IAAI,OAAO;AAC3D,WAAO,EAAC,MAAK,GAAE,SAAQ,aAAY,IAAG;AAAA,EACvC;AAAA,EACA,MAAc,UAAU,SAAyB,GAAU,MAAY;AACtE,UAAM,YAAU,QAAQ,KAAK,EAAE,KAAK,EAAE;AACtC,UAAM,QAAM,MAAMC,UAAS,SAAS;AACpC,QAAG,MAAM,SAAO,MAAM,MAAK,iCAAiC;AAC5D,UAAMC,WAAUC,MAAK,MAAK,WAAW,GAAE,OAAM,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AAAA,EACpE;AAAA,EACA,MAAc,QAAQ,UAAkB,GAAU,aAAmB,QAAmB;AACvF,UAAM,EAAC,MAAAC,OAAK,SAAQ,aAAY,IAAG,IAAE;AACrC,WAAO,wBAAwB;AAAA,MAAC,SAAQ;AAAA,MAAE,UAAS,MAAI,KAAK,MAAM,SAAS,CAAC;AAAA,MAAE,SAAQ,EAAC,QAAO,EAAE,QAAO,WAAU,EAAE,WAAU,WAAU,KAAK,MAAM,WAAU,aAAY,UAAS,SAAQ;AAAA,MAAE;AAAA,MAC1L,aAAY,QAAQ;AAAA,MAAY,WAAU,IAAI,SAAS;AAAA,MAAK,OAAM,EAAC,YAAW,QAAQ,YAAW,GAAG,QAAQ,MAAK;AAAA,MAAE,gBAAeA,MAAK;AAAA,MAAe,iBAAgBA,MAAK;AAAA,MAAgB,cAAaA,MAAK;AAAA,MAC7M,SAAQA,MAAK;AAAA,MAAQ,YAAWA,MAAK;AAAA,MAAW,OAAM,CAAC;AAAA,MAAE,UAAS,CAAC;AAAA,MAAE;AAAA,MAAO,sBAAqB,CAAC,SAAc,KAAK,UAAU,SAAQ,GAAE,IAAI;AAAA,IAAC,CAAC;AAAA,EACjJ;AAAA,EACQ,cAAc,UAAkBC,WAAa;AACpD,UAAM,EAAC,MAAAD,OAAK,IAAG,IAAE;AACjB,WAAO,EAAC,GAAGC,WAAS,QAAO,EAAC,QAAOD,MAAK,QAAO,uBAAsBA,MAAK,aAAa,cAAa,WAAUA,MAAK,WAAU,iBAAgBA,MAAK,iBAAgB,mBAAkB,IAAI,SAAQ,EAAC;AAAA,EAClM;AAAA,EACA,MAAM,MAAM,GAAM,GAAU,aAAoB;AAC/C,QAAG,CAAC,YAAY,MAAK,uBAAuB;AAC5C,UAAM,WAAS,MAAM,KAAK,SAAS,GAAE,GAAE,IAAI,GAAE,aAAW,IAAI,gBAAgB;AAAE,QAAI;AAClF,QAAG;AACF,gBAAQ,MAAM,KAAK,QAAQ,UAAS,GAAE,aAAY,WAAW,MAAM;AACnE,YAAM,YAAU,MAAM,QAAQ,iBAAiB,GAAE,OAAK,MAAM,QAAQ,MAAM,GAAEC,YAAS,KAAK,cAAc,UAAS,QAAQ,SAAS,CAAC;AACnI,UAAG,MAAM,gBAAc,KAAK,MAAK,wBAAuB,GAAG;AAC3D,aAAO;AAAA,QAAC,eAAc;AAAA,QAAE,MAAK;AAAA,QAAmB,QAAO;AAAA,QAAY,UAAS;AAAA,QAAS,WAAU,KAAK,MAAM;AAAA,QAAU,QAAO,EAAE;AAAA,QAAO,aAAY,SAAS;AAAA,QACxJ,uBAAsB,EAAE,aAAa;AAAA,QAAa,mBAAkB,SAAS,IAAI;AAAA,QAAS,WAAU,EAAE;AAAA,QAAU,iBAAgB,EAAE;AAAA,QAClI,OAAM,EAAC,QAAO,EAAE,MAAM,QAAO,SAAQ,EAAE,MAAM,SAAQ,MAAK,QAAQ,MAAM,KAAI;AAAA,QAAE,gBAAe,EAAE;AAAA,QAAe,aAAY;AAAA,QAAU,eAAc;AAAA,QAAY,kBAAiB;AAAA,QAC/K,cAAa;AAAA,QAAY,eAAc;AAAA,QAAY,iBAAgB;AAAA,QAAY;AAAA,QAAU,MAAK,QAAQ;AAAA,QAAK,KAAI,SAAS,IAAI,SAAS;AAAA,QAAK,eAAc;AAAA,QAAK,cAAa;AAAA,QAC1K,iBAAgBA,UAAS;AAAA,QAAgB,SAAQA,UAAS;AAAA,MAAO;AAAA,IACnE,UAAC;AAAQ,YAAM,SAAS,MAAM,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAE,iBAAW,MAAM;AAAE,YAAM,SAAS,IAAI,MAAM;AAAA,IAAC;AAAA,EAC5F;AAAA,EACA,MAAM,IAAI,GAAM,GAAU,aAAmB,OAAgF;AAC5H,QAAI,UAA4B,SAAY,OAAS,MAAKC,SAAU;AACpE,UAAM,aAAW,IAAI,gBAAgB;AACrC,UAAM,WAAW,EAAC,SAAQ,GAAE,QAAO,YAAS;AAAC,iBAAW,MAAM,IAAI,MAAM,WAAW,CAAC;AAAE,YAAM,SAAS,MAAM;AAAA,IAAC,EAAC,CAAC;AAC9G,QAAG;AACF,iBAAS,MAAM,KAAK,SAAS,GAAE,GAAE,KAAK;AACtC,gBAAQ,MAAM,KAAK,QAAQ,UAAS,GAAE,aAAY,WAAW,MAAM;AACnE,YAAM,SAAS,IAAI,OAAO;AAAE,YAAM,QAAQ,IAAI,EAAE,IAAI;AAAE,YAAM,SAAS,IAAI,OAAO;AAAA,IACjF,SAAO,GAAE;AAAC,MAAAA,SAAM;AAAA,IAAC,UACjB;AACC,UAAG;AAAC,eAAK,MAAM,SAAS,MAAM;AAAA,MAAC,SAAO,GAAE;AAAC,QAAAA,WAAQ;AAAA,MAAC;AAClD,UAAG,SAAS,OAAM,SAAS,IAAI,MAAM;AAAE,YAAM,aAAa;AAAA,IAC3D;AACA,UAAM,OAAK,SAAS,SAAS,GAAE,UAAQ,YAAU,OAAK,KAAK,cAAc,UAAS,IAAI,IAAE,MAAK,gBAAc,MAAM,gBAAc;AAC/H,QAAG,WAAS,iBAAe,WAAW,OAAO,WAAS,CAAC,CAAC,aAAY,QAAQ,EAAE,SAAS,QAAQ,QAAQ,EAAE,SAAQ,WAAS;AAC1H,UAAMC,YAAS,SAAS,aAAW,cAAY,cAAY,SAAS,aAAW,WAAS,WAAS,SAAS,aAAW,gBAAc,cAAY;AAC/I,UAAM,SAAO,CAAC,gBAAc,YAAUD,UAAOC,cAAW,cAAY,YAAUA;AAC9E,UAAM,OAAK,WAAS,YAAU,oBAAkB,WAAS,cAAY,cAAY,WAAS,WAAUD,QAAO,QAAM,oBAAmB;AACpI,UAAM,SAAO;AAAA,MAAC,MAAK;AAAA,MAAa,eAAc;AAAA,MAAE;AAAA,MAAQ;AAAA,MAAc,cAAa,QAAM,EAAC,aAAY,OAAM,QAAO,cAAa;AAAA,MAAE,UAAS,OAAO,cAAc,MAAM,QAAQ,IAAE,KAAK,WAAS;AAAA,MAC7L,GAAI,SAAS,8BAA4B,IAAE,EAAC,YAAW,MAAK,iBAAgB,MAAK,IAAE,CAAC;AAAA,IAAE;AACvF,WAAO,EAAC,QAAO,QAAO,OAAM,KAAI;AAAA,EACjC;AACD;;;AbjGA,IAAM,gBAAcE,WAAUC,SAAQ;AACtC,IAAM,uBAAqB,MAAI,OAAK;AAE7B,IAAM,QAAN,MAAY;AAAA,EAEjB,YAAmB,QAAmB,UAAc;AAAjC;AAAkC,UAAM,cAAY,oBAAoB,OAAO,aAAY,OAAO,SAAQ,OAAO,KAAK;AAAE,SAAK,QAAM,IAAI,MAAMC,SAAQ,OAAO,OAAO,GAAE,QAAQ;AAAE,SAAK,QAAM,IAAI,MAAM,OAAO,OAAM,EAAC,gBAAe,CAACA,SAAQ,OAAO,OAAO,GAAE,GAAI,OAAO,UAAQ,CAACA,SAAQ,OAAO,QAAQ,UAAU,CAAC,IAAE,CAAC,CAAE,EAAC,CAAC;AAAE,SAAK,WAAS,IAAI,SAAS,aAAY,KAAK,OAAM,KAAK,KAAK;AAAE,SAAK,UAAQ,IAAI,aAAa,OAAO,kBAAgB,CAAC,GAAE,OAAO,uBAAsB,QAAU,OAAO,eAAe;AAAE,SAAK,UAAQ,IAAI,aAAa,OAAO,SAAQ,EAAC,UAAS,OAAG,KAAK,MAAM,SAAS,CAAC,EAAC,CAAC;AAChlB,QAAG;AAIF,WAAK,kBAAgB,gBAAgB,OAAO,KAAK;AACjD,WAAK,aAAW,IAAI,oBAAoB,KAAK,OAAM,KAAK,eAAe;AACvE,WAAK,MAAM,GAAG,KAAK,6HAA6H;AAGhJ,WAAK,MAAM,GAAG,KAAK;AAAA,mTAC2R;AAC9S,YAAM,mBAAiB,yBAAyB,KAAK,MAAM,IAAG,KAAK,eAAe;AAClF,UAAG,iBAAiB,QAAQ,MAAK,MAAM,MAAM,oCAAoC;AACjF,UAAG,OAAO,WAAU;AAAC,YAAG,OAAO,cAAY,eAAa,OAAO,KAAK,OAAO,eAAa,CAAC,CAAC,EAAE,UAAQ,OAAO,SAAO,OAAO,iBAAiB,MAAK,0BAA0B;AAAE,aAAK,YAAU,IAAI,kBAAkB,KAAK,OAAM,OAAO,SAAS;AAAA,MAAC,WAAS,OAAO,cAAY,YAAY,MAAK,0BAA0B;AAAA,IACpT,SAAO,GAAE;AAAC,WAAK,MAAM,MAAM;AAAE,YAAM;AAAA,IAAC;AACpC,SAAK,kBAAgB,IAAI,gBAAgB,OAAO,SAAQ,EAAC,UAAS,OAAG,KAAK,MAAM,SAAS,CAAC,GAAE,OAAM,CAAC,MAAK,OAAM,cAAY,KAAK,MAAM,MAAM,MAAK,OAAM,SAAS,EAAC,CAAC;AACjK,SAAK,YAAU,YAAY,MAAI;AAAC,iBAAU,KAAK,CAAC,GAAG,KAAK,UAAU,OAAO,GAAE,GAAG,KAAK,YAAY,OAAO,CAAC,GAAE;AAAC,YAAG;AAAC,eAAK,MAAM,SAAS,EAAE,OAAO;AAAA,QAAC,QAAM;AAAC,eAAK,EAAE,OAAO,eAAe;AAAA,QAAC;AAAA,MAAC;AAAC;AAAC,WAAK,KAAK,WAAW,MAAM,CAAC,MAAK,MAAI,KAAK,SAAS,MAAK,GAAE,YAAY,CAAC,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IAAC,GAAE,GAAG;AAAE,SAAK,UAAU,MAAM;AAAA,EAAC;AAAA,EAjBtR;AAAA,EADnB;AAAA,EAAY;AAAA,EAAY;AAAA,EAAqB;AAAA,EAAqB;AAAA,EAAgC;AAAA,EAA+B;AAAA,EAA6B;AAAA,EAAkB;AAAA,EAA+B,YAAU,oBAAI,IAAgB;AAAA,EAAU,OAAK,oBAAI,IAAyB;AAAA,EAAU,cAAY,oBAAI,IAAiE;AAAA,EAAU,kBAAgB,oBAAI,IAAY;AAAA,EAAU,SAAO,oBAAI,IAAY;AAAA,EAAU;AAAA,EAmBzc,MAAM,KAAK,MAAYC,OAAS,GAAU,aAAqB;AAC7D,SAAK,MAAM,SAAS,CAAC;AAAE,QAAG,CAAC,WAAW,SAAS,IAAI,KAAG,CAAC,EAAE,MAAM,SAAS,IAAI,EAAE,MAAK,gBAAe,GAAG;AACrG,QAAGA,OAAM,UAAQ,CAAC,EAAE,MAAM,SAASA,MAAK,MAAM,EAAE,MAAK,gBAAe,GAAG;AACvE,QAAG,SAAO,eAAe,QAAO,KAAK,SAAS,MAAMA,OAAK,GAAE,WAAW;AACtE,QAAG,SAAO,eAAe,QAAO,EAAC,eAAc,GAAE,WAAU,KAAK,MAAM,WAAU,cAAa,eAAc,eAAc,iBAAgB,iBAAgB,KAAK,iBAAgB,IAAG,EAAC,UAAS,QAAQ,UAAS,MAAK,QAAQ,KAAI,GAAE,MAAK,QAAQ,SAAQ,WAAU,KAAK,OAAO,aAAW,eAAc,iBAAgB,KAAK,YAAU,sBAAoB,sBAAqB,WAAU,KAAK,YAAU,MAAM,KAAK,UAAU,MAAM,IAAE,MAAK,cAAa,WAAW,OAAO,QAAI,CAAC,EAAE,WAAW,UAAU,KAAG,CAAC,CAAC,KAAK,OAAO,aAAW,CAAC,KAAK,aAAW,CAAC,EAAE,WAAW,WAAW,EAAE,GAAE,SAAQ,MAAM,KAAK,QAAQ,MAAM,GAAE,OAAM,EAAC,YAAW,CAAC,CAAC,KAAK,aAAW,CAAC,CAAC,OAAO,KAAK,KAAK,OAAO,eAAa,CAAC,CAAC,EAAE,UAAQ,CAAC,CAAC,KAAK,OAAO,OAAM,kBAAiB,KAAK,YAAU,cAAY,QAAQ,aAAW,UAAS,KAAK,OAAO,mBAAiB,0BAAwB,gBAAe,gBAAe,GAAE,SAAQ,EAAC,YAAW,CAAC,CAAC,KAAK,OAAO,SAAQ,QAAO,KAAK,OAAO,UAAQ,eAAa,cAAa,EAAC;AACt7B,QAAG,SAAO,oBAAmB;AAAC,UAAG,KAAK,WAAU;AAAC,cAAM,KAAK,UAAU,QAAQA,MAAK,aAAY,GAAE,CAAC,MAAK,YAAU,KAAK,SAAS,MAAK,SAAQ,YAAY,CAAC;AAAE,aAAK,MAAM,SAAS,CAAC;AAAA,MAAC;AAAC,aAAO,KAAK,gBAAgBA,MAAK,aAAY,CAAC;AAAA,IAAC;AACjO,QAAG,SAAO,oBAAmB;AAC3B,WAAK,MAAM,OAAOA,MAAK,aAAY,CAAC;AACpC,YAAM,IAAE,KAAK,UAAU,IAAIA,MAAK,WAAW,GAAE,UAAQ,KAAK,YAAY,IAAIA,MAAK,WAAW,GAAE,UAAQ,KAAK,KAAK,IAAIA,MAAK,WAAW;AAClI,UAAI,YAAU,CAAC,CAAC,KAAG,CAAC,CAAC,WAAS;AAC9B,UAAG,EAAE,OAAM,EAAE,OAAO,WAAW;AAAA,eAAU,QAAQ,OAAM,QAAQ,OAAO,WAAW;AAAA,eAAU,QAAQ,MAAK,gBAAgB,IAAIA,MAAK,WAAW;AAAA,eAAU,KAAK,UAAU,aAAU,MAAM,KAAK,UAAU,OAAOA,MAAK,aAAY,CAAC;AAC7N,UAAG,KAAK,WAAU;AAAC,cAAM,KAAK,UAAU,QAAQA,MAAK,aAAY,GAAE,CAAC,MAAK,YAAU,KAAK,SAAS,MAAK,SAAQ,YAAY,CAAC;AAAE,aAAK,MAAM,SAAS,CAAC;AAAA,MAAC;AACnJ,YAAM,YAAU,KAAK,gBAAgBA,MAAK,aAAY,CAAC;AACvD,YAAMC,YAAS,CAAC,aAAY,UAAS,WAAW,EAAE,SAAS,UAAU,MAAM;AAU3E,YAAM,iBAAe,UAAU,SAAO,cAAY,CAAC,CAAC,UAAU;AAC9D,YAAM,WAAS,UAAU,SAAO,eAAa,UAAU,QAAQ,kBAAgB,QAAM,UAAU,QAAQ,eAAa;AACpH,YAAM,eAAa,UAAU,SAAO,cAAa,CAAC,KAAK,KAAK,IAAID,MAAK,WAAW,KAAG,CAAC,KAAK,UAAU,IAAIA,MAAK,WAAW;AACvH,YAAM,gBAAcC,aAAU,iBAAe,kBAAgB;AAC7D,aAAO,EAAC,iBAAgB,WAAU,eAAc,GAAI,iBAAe,UAAU,YAAU,EAAC,WAAU,UAAU,UAAS,IAAE,CAAC,GAAG,UAAS;AAAA,IACtI;AACA,QAAG,CAAC,WAAW,IAAI,EAAE,QAAO,KAAK,QAAQ,MAAKD,OAAK,CAAC;AACpD,QAAG,CAAC,YAAY,MAAK,uBAAuB;AAAE,UAAM,WAAS,KAAK,MAAM,MAAM,aAAY,GAAE,MAAKA,KAAI;AAAE,QAAG,CAAC,SAAS,MAAM,QAAO,SAAO,aAAW,KAAK,gBAAgB,aAAY,CAAC,IAAE,SAAS;AAChM,SAAK,MAAM,QAAQ,WAAW;AAC9B,QAAG,SAAO,eAAc;AACtB,YAAM,OAAK,YAAS;AAClB,YAAI;AACJ,YAAG;AAAC,oBAAQ,MAAM,KAAK,SAAS,IAAIA,OAAK,GAAE,aAAY,EAAC,YAAW,YAAQ,KAAK,UAAU,IAAI,aAAY,MAAM,GAAE,cAAa,MAAI,KAAK,UAAU,OAAO,WAAW,EAAC,CAAC;AAAA,QAAC,SACjK,GAAM;AAAC,oBAAQ,EAAC,QAAO,WAAU,QAAO,EAAC,MAAK,cAAa,eAAc,GAAE,SAAQ,MAAK,eAAc,OAAM,cAAa,EAAC,aAAY,OAAM,QAAO,cAAa,EAAC,GAAE,OAAM,kBAAiB;AAAA,QAAC;AACjM,aAAK,KAAK,OAAO,WAAW;AAAE,aAAK,UAAU,OAAO,WAAW;AAAE,aAAK,gBAAgB,OAAO,WAAW;AACxG,aAAK,MAAM,OAAO,aAAY,QAAQ,QAAO,QAAQ,QAAO,QAAQ,KAAK;AACzE,eAAO,KAAK,gBAAgB,aAAY,CAAC;AAAA,MAC3C,GAAG,EAAE,QAAQ,MAAI;AAAC,aAAK,KAAK,OAAO,WAAW;AAAE,aAAK,UAAU,OAAO,WAAW;AAAE,aAAK,gBAAgB,OAAO,WAAW;AAAA,MAAC,CAAC;AAC5H,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,aAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,IACvE;AACA,QAAG,SAAO,gBAAc,SAAO,wBAAuB;AAMpD,YAAM,cAAY,SAAO;AACzB,YAAM,OAAK,YAAS;AAClB,YAAG,aAAY;AACb,cAAG,CAAC,KAAK,UAAU,MAAK,iCAAgC,GAAG;AAC3D,cAAGA,OAAM,WAAS,UAAW,CAACA,OAAM,cAAc,OAAO,MAAK,kBAAkB;AAAA,QAClF;AACA,eAAO,KAAK,YAAU,KAAK,cAAcA,MAAK,cAAc,QAAO,GAAE,aAAY,MAAI,KAAK,MAAMA,OAAK,GAAE,WAAW,CAAC,IAAE,KAAK,MAAMA,OAAK,GAAE,WAAW;AAAA,MACpJ,GAAG,EAAE,MAAM,OAAG;AACZ,cAAM,aAAW,eAAa,CAAC,KAAK,aAAY,KAAK,aAAW,CAAC,KAAK,MAAM,GAAG,QAAQ,sDAAsD,EAAE,IAAI,WAAW;AAC9J,aAAK,MAAM,OAAO,aAAY,UAAS,aAAW,EAAC,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,IAAE,MAAK,aAAa,aAAW,EAAE,OAAK,kBAAkB;AAAA,MACrK,CAAC,EAAE,QAAQ,MAAI;AAAC,aAAK,KAAK,OAAO,WAAW;AAAE,aAAK,gBAAgB,OAAO,WAAW;AAAA,MAAC,CAAC;AAAE,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,aAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,IAAC;AACjK,QAAG,SAAO,YAAW;AACnB,YAAM,aAAW,IAAI,gBAAgB;AACrC,WAAK,UAAU,IAAI,aAAY,EAAC,SAAQ,GAAE,QAAO,OAAM,QAAa;AAAC,mBAAW,MAAM,IAAI,WAAW,GAAG,CAAC;AAAA,MAAC,EAAC,CAAC;AAC5G,YAAM,OAAK,YAAS;AACnB,YAAG;AACF,gBAAM,SAAO,MAAM,KAAK,cAAcA,MAAK,QAAO,GAAE,aAAY,SAAK,KAAK,QAAQ,MAAKA,OAAK,GAAE,WAAW,QAAO,GAAG,CAAC;AACpH,eAAK,MAAM,OAAO,aAAY,WAAW,OAAO,UAAQ,cAAY,aAAY,WAAW,OAAO,UAAQ,EAAC,GAAG,QAAO,eAAc,MAAK,iBAAgB,KAAI,IAAE,EAAC,GAAG,QAAO,eAAc,KAAI,GAAE,WAAW,OAAO,UAAQ,cAAY,IAAI;AAAA,QACxO,SAAO,GAAM;AACZ,gBAAM,YAAU,GAAG,SAAO,mBAAkB,YAAU,GAAG,cAAY,MAAKE,WAAQ,CAAC,cAAY,aAAW,GAAG,SAAO;AAIpH,gBAAMC,UAAO,aAAW,aAAW,GAAG,UAAQ,iBAAiB,KAAK,EAAE,OAAO,MAAM,KAAG,OAAO,cAAc,EAAE,OAAO,IAAI,KAAG,EAAE,OAAO,QAAM,KAAG,EAAE,OAAO,QAAM,UAAQ,EAAC,QAAO,EAAE,OAAO,QAAO,MAAK,EAAE,OAAO,KAAI,IAAE,CAAC;AACjN,eAAK,MAAM,OAAO,aAAY,YAAU,cAAYD,WAAQ,YAAU,UAASA,WAAQ,OAAK,EAAC,eAAc,MAAK,iBAAgB,aAAW,GAAG,oBAAkB,QAAM,QAAM,MAAK,GAAGC,QAAM,GAAE,aAAW,YAAU,cAAYD,WAAQ,oBAAkB,aAAa,aAAW,EAAE,OAAK,kBAAkB;AAAA,QACzS,UACA;AAAQ,eAAK,KAAK,OAAO,WAAW;AAAE,eAAK,UAAU,OAAO,WAAW;AAAE,eAAK,gBAAgB,OAAO,WAAW;AAAA,QAAC;AAGjH,cAAM,YAAU,KAAK,MAAM,OAAO,aAAY,CAAC;AAC/C,YAAG,CAAC,aAAY,UAAS,WAAW,EAAE,SAAS,UAAU,MAAM,GAAE;AAChE,gBAAM,QAAM,EAAC,eAAc,GAAE,MAAK,sBAAqB,QAAO,oBAAmB,WAAU,KAAK,MAAM,WAAU,QAAO,EAAE,QAAO,WAAU,EAAE,WAAU,aAAY,MAAK,YAAW,QAAO,UAAU,QAAO,aAAY,IAAI,UAAU,SAAS,CAAC,EAAC;AAC/O,eAAK,MAAM,GAAG,QAAQ,wDAAwD,EAAE,IAAI,aAAY,UAAU,KAAK,CAAC;AAAA,QACjH;AACA,eAAO,KAAK,gBAAgB,aAAY,CAAC;AAAA,MAC1C,GAAG;AACH,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,aAAO;AAAA,IACxC;AACA,QAAG,KAAK,WAAW,UAAU,GAAE;AAC7B,YAAM,aAAW,IAAI,gBAAgB;AAAE,UAAI;AAC3C,YAAM,SAAO,OAAM,QAAa;AAAC,mBAAW,MAAM,IAAI,WAAW,GAAG,CAAC;AAAE,cAAM,KAAK,QAAQ,OAAO,CAAC;AAAE,cAAM;AAAA,MAAG;AAC7G,aAAK,YAAS;AACZ,YAAG;AAAC,gBAAM,SAAO,MAAM,KAAK,QAAQ,MAAKF,OAAK,GAAE,WAAW,MAAM;AAAE,eAAK,MAAM,SAAS,CAAC;AAAE,cAAG,WAAW,OAAO,SAAQ;AAAC,kBAAM,OAAK,MAAM,KAAK,QAAQ,OAAO,CAAC;AAAE,kBAAM,OAAO,OAAO,IAAI,WAAW,KAAK,gBAAc,sBAAoB,iBAAiB,GAAE,EAAC,eAAc,KAAK,eAAc,iBAAgB,SAAO,qBAAoB,CAAC;AAAA,UAAC;AAAC,eAAK,MAAM,OAAO,aAAY,aAAY,MAAM;AAAA,QAAC,SACxX,GAAM;AACV,cAAG,EAAE,SAAO,iBAAgB;AAAC,uBAAW,MAAM,CAAC;AAAE,kBAAM,OAAK,MAAM,KAAK,QAAQ,OAAO,CAAC;AAAE,gBAAE,OAAO,OAAO,IAAI,WAAW,KAAK,gBAAc,sBAAoB,iBAAiB,GAAE,EAAC,eAAc,KAAK,eAAc,iBAAgB,SAAO,qBAAoB,CAAC;AAAA,UAAC;AACjQ,gBAAM,OAAK,aAAa,aAAW,EAAE,OAAK,oBAAmB,UAAQ,EAAE,kBAAgB,MAAK,kBAAgB,EAAE,oBAAkB;AAChI,gBAAM,QAAM,SAAO,uBAAqB,UAAQ,cAAY,SAAO,qBAAmB,kBAAgB,YAAU;AAChH,eAAK,MAAM,OAAO,aAAY,OAAM,EAAC,eAAc,SAAQ,iBAAgB,cAAa,WAAW,OAAO,UAAS,WAAW,OAAO,QAAQ,QAAM,cAAa,KAAI,GAAE,IAAI;AAAA,QAC5K,UAAC;AAAQ,eAAK,YAAY,OAAO,WAAW;AAAE,eAAK,KAAK,OAAO,WAAW;AAAA,QAAC;AAC3E,eAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,MACxC,GAAG;AACH,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,WAAK,YAAY,IAAI,aAAY,EAAC,SAAQ,GAAE,OAAM,CAAC;AAAE,aAAO;AAAA,IAC7F;AACA,QAAG;AAAC,YAAM,SAAO,MAAM,KAAK,QAAQ,MAAKA,OAAK,CAAC;AAAE,WAAK,MAAM,OAAO,aAAY,aAAY,MAAM;AAAA,IAAC,SAAO,GAAE;AAAC,WAAK,MAAM,OAAO,aAAY,aAAa,cAAY,EAAE,SAAO,oBAAkB,YAAU,UAAS,MAAK,aAAa,aAAW,EAAE,OAAK,kBAAkB;AAAA,IAAC;AACxQ,WAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,EACxC;AAAA,EACQ,gBAAgBI,KAAU,GAAU;AAC1C,UAAM,YAAU,KAAK,MAAM,OAAOA,KAAG,CAAC,GAAE,QAAM,KAAK,MAAM,GAAG,QAAQ,4DAA4D,EAAE,IAAIA,GAAE;AACxI,QAAG,CAAC,SAAO,KAAK,KAAK,IAAIA,GAAE,KAAG,KAAK,UAAU,IAAIA,GAAE,EAAE,QAAO;AAC5D,UAAM,QAAM,KAAK,MAAM,MAAM,KAAK;AAClC,QAAG,MAAM,kBAAgB,KAAG,MAAM,SAAO,wBAAsB,MAAM,WAAS,sBAAoB,MAAM,cAAY,UAAU,aAAW,MAAM,WAAS,EAAE,UAAQ,MAAM,cAAY,EAAE,aAAW,MAAM,gBAAcA,OAAI,MAAM,SAAO,UAAU,QAAM,MAAM,WAAS,UAAU,UAAQ,MAAM,gBAAc,IAAI,UAAU,SAAS,CAAC,EAAE,QAAO;AAC5U,WAAO,EAAC,GAAG,WAAU,WAAU,MAAK;AAAA,EACtC;AAAA,EACA,MAAM,SAAS,MAAY,GAAU,QAAM,4BAA2B;AACpE,QAAG,KAAK,SAAO,IAAE,OAAK,KAAK,MAAK,kBAAiB,GAAG;AAKpD,UAAM,QAAM,MAAM,KAAK,eAAe,KAAK,MAAM;AACjD,QAAG,QAAM,KAAK,SAAO,qBAAqB,MAAK,kBAAiB,GAAG;AACnE,UAAMA,MAAG,YAAYC,YAAW,CAAC;AAAG,UAAMC,OAAMC,MAAK,KAAK,OAAO,SAAQ,WAAW,GAAE,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,UAAMC,WAAUD,MAAK,KAAK,OAAO,SAAQ,aAAYH,GAAE,GAAE,MAAK,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AACvM,SAAK,MAAM,GAAG,QAAQ,0CAA0C,EAAE,IAAIA,KAAG,UAAU,CAAC,GAAE,IAAI,IAAI,GAAE,KAAK,QAAO,KAAK;AAAE,WAAO,EAAC,YAAWA,KAAG,QAAO,IAAI,IAAI,GAAE,MAAK,KAAK,QAAO,WAAU,MAAK;AAAA,EAC5L;AAAA,EACA,MAAc,eAAe,QAAc;AACzC,QAAI,QAAa,KAAK,MAAM,GAAG,QAAQ,qDAAqD,EAAE,IAAI,EAAE;AACpG,QAAG,QAAM,UAAQ,qBAAqB,QAAO;AAC7C,UAAM,OAAW,KAAK,MAAM,GAAG,QAAQ,kDAAkD,EAAE,IAAI;AAC/F,eAAU,OAAO,MAAK;AACpB,UAAG,QAAM,UAAQ,qBAAqB;AACtC,WAAK,MAAM,GAAG,QAAQ,kCAAkC,EAAE,IAAI,IAAI,EAAE;AACpE,eAAO,IAAI;AACX,YAAMK,QAAOF,MAAK,KAAK,OAAO,SAAQ,aAAY,IAAI,EAAE,CAAC,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAM,QAAQ,MAAY,GAAM,GAAU,QAAoB,KAA+B;AAC3F,QAAG,SAAO,WAAU;AAAC,YAAM,MAAI,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,gBAAc,EAAE;AAAE,UAAI,KAAK,CAAC,GAAE,MAAI,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAE,YAAM,SAAO,QAAQ,EAAE,SAAO,OAAO,EAAE,MAAM,IAAE,GAAE,GAAE,GAAG,GAAE,QAAM,QAAQ,EAAE,OAAM,GAAE,KAAK,GAAG;AAAE,aAAO,EAAC,SAAQ,IAAI,MAAM,QAAO,SAAO,KAAK,EAAE,IAAI,QAAI,EAAC,MAAK,EAAE,MAAK,MAAK,EAAE,eAAe,IAAE,SAAO,EAAE,YAAY,IAAE,cAAY,OAAM,EAAE,GAAE,QAAO,SAAO,QAAM,IAAI,SAAO,OAAO,SAAO,KAAK,IAAE,KAAI;AAAA,IAAC;AAC5Z,QAAG,SAAO,WAAU;AAAC,YAAM,SAAO,QAAQ,EAAE,QAAO,GAAE,OAAO,kBAAiB,CAAC,GAAE,SAAO,QAAQ,EAAE,QAAO,GAAE,SAAQ,KAAK;AAAE,YAAM,EAAC,MAAK,KAAI,IAAE,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,QAAO,MAAM;AAAE,aAAO,EAAC,UAAS,UAAS,SAAQ,KAAK,SAAS,QAAQ,GAAE,QAAO,IAAI,IAAI,GAAE,QAAO,MAAK,KAAI,SAAO,KAAK,UAAQ,KAAI;AAAA,IAAC;AAC5T,QAAG,SAAO,WAAW,QAAO,KAAK,MAAM,GAAE,GAAE,QAAO,GAAG;AACrD,QAAG,KAAK,WAAW,WAAW,GAAE;AAAC,YAAM,MAAI,KAAK,MAAM,GAAG,QAAQ,oCAAoC,EAAE,IAAI,EAAE,UAAU;AAAE,UAAG,CAAC,IAAI,MAAK,sBAAqB,GAAG;AAAE,WAAK,MAAM,IAAI,IAAI,SAAQ,CAAC;AAAE,UAAG,SAAO,gBAAgB,QAAO,EAAC,YAAW,IAAI,IAAG,QAAO,IAAI,MAAK,MAAK,IAAI,MAAK,WAAU,IAAI,MAAK;AAAE,YAAM,SAAO,QAAQ,EAAE,QAAO,GAAE,OAAO,kBAAiB,CAAC,GAAE,SAAO,QAAQ,EAAE,QAAO,GAAE,SAAQ,KAAK,GAAE,OAAK,MAAMG,UAASH,MAAK,KAAK,OAAO,SAAQ,aAAY,IAAI,EAAE,CAAC;AAAE,UAAG,IAAI,IAAI,MAAI,IAAI,KAAK,MAAK,kBAAkB;AAAE,aAAO,EAAC,UAAS,UAAS,SAAQ,KAAK,SAAS,QAAO,SAAO,MAAM,EAAE,SAAS,QAAQ,GAAE,KAAI,SAAO,UAAQ,IAAI,KAAI;AAAA,IAAC;AACjnB,QAAG,KAAK,WAAW,UAAU,EAAE,QAAO,KAAK,QAAQ,IAAI,MAAK,GAAE,CAAC;AAC/D,QAAG,KAAK,WAAW,UAAU,GAAE;AAAC,YAAM,SAAO,MAAM,KAAK,QAAQ,IAAI,MAAK,GAAE,GAAE,MAAM;AAAE,WAAK,MAAM,SAAS,CAAC;AAAE,UAAG,OAAO,WAAU;AAAC,cAAM,WAAS,MAAM,KAAK,SAAS,OAAO,KAAK,OAAO,WAAU,QAAQ,GAAE,GAAE,WAAW;AAAE,eAAO,OAAO;AAAU,eAAO,EAAC,GAAG,QAAO,GAAG,SAAQ;AAAA,MAAC;AAAC,aAAO;AAAA,IAAM;AAC9R,QAAG,KAAK,WAAW,WAAW,EAAE,QAAO,KAAK,SAAS,MAAK,GAAE,CAAC;AAC7D,SAAK,kBAAiB,GAAG;AAAA,EAC3B;AAAA,EACA,MAAc,cAAc,QAAc,GAAUH,KAAU,KAAqC;AACjG,QAAG,OAAO,WAAS,YAAU,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,MAAK,2BAA0B,GAAG;AACzF,UAAM,MAAI,MAAM,aAAa,QAAQ,MAAM,KAAK,MAAM,QAAQ,QAAO,EAAE,CAAC;AACxE,QAAG;AACF,YAAM,SAAO,KAAK,MAAM,GAAG,QAAQ,qXAAqX,EAAE,IAAI;AAC9Z,UAAG,OAAO,MAAK,+BAA8B,GAAG;AAIhD,YAAM,mBAAiB,KAAK,MAAM,GAAG,QAAQ,yXAAyX,EAAE,IAAI;AAC5a,UAAG,iBAAiB,MAAK,+BAA8B,GAAG;AAC1D,WAAK,WAAW,MAAMA,KAAG,GAAE,IAAI,QAAQ;AAAE,YAAM,IAAI,OAAO;AAAE,aAAO,MAAM,IAAI,GAAG;AAAA,IACjF,UAAC;AAAQ,YAAM,IAAI,MAAM;AAAA,IAAC;AAAA,EAC5B;AAAA,EACA,MAAM,MAAM,GAAM,GAAU,QAAoB,KAAkB;AAChE,QAAG,QAAQ,QAAQ,OAAM,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,CAAC;AACpG,QAAG,CAAC,OAAO,OAAO,GAAE,cAAc,KAAI,EAAE,iBAAe,QAAM,CAAC,iBAAiB,KAAK,EAAE,YAAY,EAAG,MAAK,wBAAwB;AAClI,QAAG,OAAO,EAAE,YAAU,YAAU,OAAO,WAAW,EAAE,OAAO,IAAE,WAAS,CAAC,CAAC,QAAO,UAAS,MAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAK,kBAAkB;AAC/I,UAAM,SAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,cAAa,IAAI;AAAE,QAAG,KAAK,OAAO,IAAI,MAAM,EAAE,MAAK,gBAAe,GAAG;AAAE,SAAK,OAAO,IAAI,MAAM;AAC9I,QAAG;AACD,UAAG,qBAAqB,EAAE,QAAO,MAAM,KAAK,YAAY,GAAE,GAAE,QAAO,QAAO,GAAG;AAC7E,aAAO,MAAM,KAAK,YAAY,GAAE,GAAE,QAAO,MAAM;AAAA,IACjD,UAAC;AAAQ,WAAK,OAAO,OAAO,MAAM;AAAA,IAAC;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,YAAY,GAAM,GAAU,QAA6B,QAAc,KAAkB;AACrG,QAAG,EAAE,iBAAe,MAAK;AAIvB,UAAG;AAAC,cAAM,QAAM,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,GAAE,OAAO,GAAG;AAAK,YAAG,KAAK,SAAO,QAAQ,MAAK,gBAAgB;AAAE,aAAK,IAAI,IAAI,MAAI,EAAE,eAAa,0BAAwB,gBAAe,IAAI,IAAI,MAAI,EAAE,eAAa,MAAI,GAAG;AAAA,MAAC,SACjO,GAAM;AAAC,YAAG,EAAE,SAAO,SAAS,OAAM;AAAE,aAAK,gBAAe,GAAG;AAAA,MAAC;AAAA,IACpE;AACA,QAAG;AACD,YAAM,SAAO,MAAM,oBAAoB;AAAA,QACrC,UAAS,MAAI,IAAI,SAAS,OAAK,MAAMO,UAAS,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,CAAC;AAAA,QACnF,cAAa,EAAE;AAAA,QAAa,SAAQ,EAAE;AAAA,QAAQ,UAAS,EAAE;AAAA,QAAS;AAAA,QAClE,OAAM,YAAQ,KAAK,kBAAkB,GAAE,GAAE,KAAI,MAAM;AAAA,MAAC,CAAC;AACvD,aAAO,EAAC,QAAO,OAAO,QAAO,MAAK,OAAO,KAAI;AAAA,IAC/C,SAAO,GAAM;AACX,UAAG,aAAa,cAAY,EAAE,SAAO,gBAAgB,MAAK,gBAAe,GAAG;AAC5E,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAEA,MAAgB,kBAAkB,GAAM,GAAU,KAA2B,QAAwC;AACnH,SAAK,MAAM,SAAS,CAAC;AACrB,UAAM,KAAK,MAAM,iBAAiB,OAAO,UAAU;AACnD,QAAG,IAAI,OAAM,IAAI,OAAO;AAAA,EAC1B;AAAA,EACA,MAAc,YAAY,GAAM,GAAU,QAA6B,QAAc;AACnF,UAAM,OAAKJ,MAAK,QAAQ,MAAM,GAAE,cAAcF,YAAW,CAAC,EAAE;AAC5D,QAAG;AAAC,YAAM,SAAO,MAAMO,MAAK,QAAQ,MAAM,CAAC;AAAE,UAAI,WAAqB;AAAK,UAAG;AAAC,oBAAU,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,GAAE,OAAO,GAAG;AAAK,YAAG,SAAS,SAAO,QAAQ,MAAK,gBAAgB;AAAA,MAAC,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,SAAS,OAAM;AAAA,MAAC;AACjP,WAAI,aAAW,OAAK,OAAK,IAAI,QAAQ,OAAK,EAAE,aAAa,MAAK,gBAAe,GAAG;AAChF,YAAM,OAAK,OAAO,KAAK,EAAE,SAAQ,EAAE,YAAU,MAAM;AAAE,YAAMJ,WAAU,MAAK,MAAK,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AACrG,UAAG,QAAQ,QAAQ,OAAM,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,CAAC;AACpG,WAAK,MAAM,SAAS,CAAC;AAAE,YAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,cAAa,IAAI;AAAE,YAAM,MAAI,MAAMI,MAAK,QAAQ,MAAM,CAAC;AAAE,UAAG,IAAI,QAAM,OAAO,OAAK,IAAI,QAAM,OAAO,IAAI,MAAK,gBAAe,GAAG;AACzL,UAAI,UAAoB;AAAK,UAAG;AAAC,mBAAS,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,GAAE,OAAO,GAAG;AAAA,MAAI,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,SAAS,OAAM;AAAA,MAAC;AAClJ,WAAI,YAAU,OAAK,OAAK,IAAI,OAAO,OAAK,EAAE,aAAa,MAAK,gBAAe,GAAG;AAC9E,UAAG,QAAQ,QAAQ,OAAM,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,CAAC;AACpG,YAAM,OAAO,MAAK,MAAM;AAAE,aAAO,EAAC,QAAO,IAAI,IAAI,GAAE,MAAK,KAAK,OAAM;AAAA,IACrE,UAAC;AAAQ,YAAMH,QAAO,IAAI,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IAAC;AAAA,EAC3C;AAAA,EACA,MAAM,MAAM,GAAM,GAAUL,KAAU;AACpC,QAAG,CAAC,EAAE,gBAAc,EAAE,aAAa,SAAO,YAAU,EAAE,aAAa,cAAY,KAAK,MAAM,aAAW,CAAC,EAAE,MAAM,SAAS,EAAE,aAAa,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAChL,UAAM,MAAI,MAAM,KAAK,MAAM,QAAQ,EAAE,aAAa,QAAO,EAAE,aAAa,gBAAc,EAAE;AAAE,QAAG,EAAE,MAAMQ,MAAK,GAAG,GAAG,YAAY,EAAE,MAAK,yBAAyB;AAC5J,UAAM,UAAQ,QAAQ,EAAE,WAAU,GAAE,MAAQ,GAAK;AAAE,QAAI,YAAkB;AACzE,QAAG,KAAK,WAAU;AAChB,UAAG,EAAE,MAAK;AAAC,YAAG,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAG,EAAE,KAAK,SAAO,KAAG,EAAE,KAAK,SAAO,OAAK,EAAE,KAAK,KAAK,CAAC,MAAQ,OAAO,MAAI,YAAU,EAAE,SAAS,IAAI,CAAC,EAAE,MAAK,kBAAkB;AAAE,qBAAW,KAAK,OAAO,UAAW,YAAY,EAAE,KAAK,CAAC,CAAC;AAAE,YAAG,CAAC,WAAW,MAAK,0BAAyB,GAAG;AAAE,eAAK,EAAE,KAAK,MAAM,CAAC;AAAA,MAAC,OAC1R;AAAC,YAAG,KAAK,OAAO,UAAW,UAAQ,QAAM,OAAO,EAAE,WAAS,YAAU,EAAE,OAAO,SAAO,QAAQ,MAAK,sBAAqB,GAAG;AAAE,qBAAW;AAAU,eAAK,CAAC,MAAK,EAAE,MAAM;AAAA,MAAC;AACzK,YAAM,MAAI,MAAM,aAAa,QAAQ,GAAG;AACxC,UAAG;AACF,cAAM,KAAK,MAAM,oBAAoB,IAAI,QAAQ;AACjD,aAAK,UAAU,IAAIR,KAAG,EAAC,SAAQ,GAAE,QAAO,CAAC,QAAa,KAAK,UAAW,OAAOA,KAAG,GAAE,GAAG,EAAC,CAAC;AACvF,cAAM,KAAK,UAAU,IAAI,EAAC,IAAAA,KAAG,GAAE,QAAO,EAAE,aAAa,QAAO,WAAU,IAAI,SAAS,MAAK,mBAAkB,IAAI,eAAc,YAAW,MAAK,SAAQ,UAAS,MAAI,KAAK,MAAM,SAAS,CAAC,GAAE,mBAAkB,MAAI,IAAI,OAAO,GAAE,cAAa,MAAI,KAAK,gBAAgB,IAAIA,GAAE,GAAE,UAAS,CAAC,MAAK,YAAU,KAAK,SAAS,MAAK,SAAQ,YAAY,EAAC,CAAC;AAAA,MAC5U,UAAC;AAAQ,aAAK,UAAU,OAAOA,GAAE;AAAE,cAAM,IAAI,MAAM;AAAA,MAAC;AACpD;AAAA,IACF;AACA,QAAG,EAAE,MAAK;AAAC,UAAG,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAG,EAAE,KAAK,SAAO,KAAG,EAAE,KAAK,SAAO,OAAK,EAAE,KAAK,KAAK,CAAC,MAAQ,OAAO,MAAI,YAAU,EAAE,SAAS,IAAI,CAAC,EAAE,MAAK,kBAAkB;AAAE,mBAAW,KAAK,OAAO,cAAc,EAAE,KAAK,CAAC,CAAC;AAAE,UAAG,CAAC,WAAW,MAAK,0BAAyB,GAAG;AAAE,aAAK,EAAE,KAAK,MAAM,CAAC;AAAA,IAAC,OAChR;AAAC,UAAG,CAAC,KAAK,OAAO,SAAO,OAAO,EAAE,WAAS,YAAU,EAAE,OAAO,SAAO,QAAQ,MAAK,sBAAqB,GAAG;AAAE,mBAAW,KAAK,OAAO;AAAM,aAAK,QAAQ,aAAW,UAAQ,CAAC,WAAU,cAAa,mBAAkB,mBAAkB,OAAO,KAAK,EAAE,QAAO,SAAS,EAAE,SAAS,QAAQ,CAAC,IAAE,CAAC,MAAK,EAAE,MAAM;AAAA,IAAC;AAC5S,SAAK,MAAM,SAAS,CAAC;AAAE,QAAG,KAAK,gBAAgB,IAAIA,GAAE,GAAE;AAAC,WAAK,MAAM,OAAOA,KAAG,aAAY,MAAK,WAAW;AAAE;AAAA,IAAM;AACjH,QAAG,QAAQ,aAAW,WAAS,CAAC,KAAK,OAAO,iBAAiB,MAAK,iCAAgC,GAAG;AACrG,UAAM,QAAMS,OAAM,QAAQ,aAAW,UAAQ,KAAK,OAAO,mBAAkB,YAAW,QAAQ,aAAW,UAAQ,CAAC,IAAE,MAAK,EAAC,KAAI,aAAY,MAAK,UAAS,QAAQ,aAAW,SAAQ,KAAI,EAAC,MAAK,QAAQ,IAAI,QAAM,IAAG,YAAW,QAAQ,IAAI,cAAY,IAAG,MAAK,QAAQ,IAAI,QAAM,IAAG,KAAI,QAAQ,IAAI,OAAK,IAAG,MAAK,UAAS,GAAE,OAAM,CAAC,QAAO,QAAO,MAAM,EAAC,CAAC;AACvV,QAAG,QAAQ,aAAW,QAAQ,OAAM,MAAM,IAAI,KAAK,UAAU,EAAC,YAAW,MAAK,MAAK,IAAG,CAAC,IAAE,IAAI;AAAA,QAAO,OAAM,MAAM,IAAI;AACpH,UAAM,MAAM,GAAG,SAAQ,MAAI;AAAA,IAAC,CAAC;AAC7B,QAAI,SAAgB,CAAC,GAAE,SAAgB,CAAC,GAAE,QAAM,GAAE,YAAU,OAAM,SAAmB,MAAK,gBAAiC;AAC3H,UAAM,UAAQ,CAAC,WAAoB,CAAC,UAAe;AAAC,YAAM,YAAU,IAAE,OAAK,OAAK;AAAM,UAAG,YAAU,GAAE;AAAC,eAAO,KAAK,MAAM,SAAS,GAAE,SAAS,CAAC;AAAE,iBAAO,KAAK,IAAI,WAAU,MAAM,MAAM;AAAA,MAAC;AAAC,UAAG,MAAM,SAAO,UAAU,aAAU;AAAA,IAAI;AAC/N,UAAM,OAAO,GAAG,QAAO,QAAQ,MAAM,CAAC;AAAE,UAAM,OAAO,GAAG,QAAO,QAAQ,MAAM,CAAC;AAC9E,UAAM,SAAO,CAAC,QAAa;AAAC,UAAG,cAAc,QAAO;AAAc,eAAO;AAAI,uBAAe,YAAS;AAAC,YAAG,MAAM,aAAW,QAAM,MAAM,eAAa,KAAK;AACtJ,YAAG,QAAQ,aAAW,SAAQ;AAAC,cAAG,CAAC,MAAM,KAAK,SAAS,KAAG,MAAM,aAAW,QAAM,MAAM,eAAa,KAAK,MAAK,MAAM,GAAG,QAAQ,iFAAiF,EAAE,IAAIT,GAAE;AAAA,QAAC,OACpN;AAAC,cAAG;AAAC,oBAAQ,KAAK,CAAC,MAAM,KAAK,SAAS;AAAA,UAAC,QAAM;AAAA,UAAC;AAAC,gBAAM,IAAI,QAAQ,OAAG,WAAW,GAAE,GAAG,CAAC;AAAE,cAAG;AAAC,oBAAQ,KAAK,CAAC,MAAM,KAAK,SAAS;AAAA,UAAC,QAAM;AAAA,UAAC;AAAA,QAAC;AAAA,MAC9I,GAAG;AAAE,aAAO;AAAA,IAAa;AACzB,SAAK,UAAU,IAAIA,KAAG,EAAC,OAAM,SAAQ,GAAE,OAAM,CAAC;AAAE,UAAM,QAAM,WAAW,MAAI,KAAK,OAAO,iBAAiB,GAAE,OAAO;AACjH,QAAG;AAAC,YAAM,OAAK,MAAM,IAAI,QAAa,CAACL,UAAQ,WAAS;AAAC,cAAM,KAAK,SAAQ,MAAM;AAAE,cAAM,KAAK,SAAQ,CAAC,MAAK,WAASA,SAAQ,EAAC,UAAS,MAAK,OAAM,CAAC,CAAC;AAAA,MAAC,CAAC;AAAE,YAAM;AAC7J,YAAM,MAAI,MAAM,KAAK,SAAS,OAAO,OAAO,MAAM,GAAE,GAAE,YAAY,GAAE,MAAI,MAAM,KAAK,SAAS,OAAO,OAAO,MAAM,GAAE,GAAE,YAAY;AAChI,WAAK,MAAM,OAAOK,KAAG,WAAS,cAAY,cAAY,SAAO,WAAS,KAAK,aAAW,IAAE,cAAY,UAAS,EAAC,GAAG,MAAK,kBAAiB,IAAI,YAAW,kBAAiB,IAAI,YAAW,UAAS,GAAE,WAAS,KAAK,aAAW,IAAE,OAAK,uBAAuB;AAAA,IAC1P,UAAC;AAAQ,mBAAa,KAAK;AAAE,WAAK,UAAU,OAAOA,GAAE;AAAA,IAAC;AAAA,EACxD;AAAA,EACA,MAAM,IAAI,KAAWJ,OAAc;AAAC,YAAQ,MAAM,cAAc,OAAM,CAAC,MAAK,4BAA2B,GAAGA,KAAI,GAAE,EAAC,KAAI,SAAQ,KAAM,WAAU,IAAE,OAAK,MAAK,aAAY,MAAK,KAAI,EAAC,GAAG,QAAQ,KAAI,mBAAkB,QAAQ,aAAW,UAAQ,QAAM,aAAY,qBAAoB,KAAI,qBAAoB,IAAG,EAAC,CAAC,GAAG,OAAO,KAAK;AAAA,EAAC;AAAA,EAC9T,MAAM,SAAS,MAAY,GAAM,GAAU;AAGzC,QAAG,KAAK,UAAU,MAAK,8BAA6B,GAAG;AACvD,QAAG,SAAO,mBAAkB;AAC1B,YAAM,SAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,gBAAc,EAAE;AAAE,YAAM,KAAK,MAAM,iBAAiB,MAAM;AAAE,UAAG,MAAM,KAAK,IAAI,QAAO,CAAC,UAAS,aAAa,CAAC,EAAE,MAAK,mBAAkB,GAAG;AAC1L,YAAM,OAAK,MAAM,KAAK,IAAI,QAAO,CAAC,aAAY,MAAM,CAAC;AAAE,YAAMI,MAAG,YAAYC,YAAW,CAAC,IAAGS,YAAS,EAAE;AACtG,UAAG,OAAOA,cAAW,SAAS,MAAK,kBAAkB;AAAE,YAAM,SAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAOA,WAAS,IAAI;AAAE,UAAG,WAAS,UAAQ,KAAK,MAAM,OAAO,QAAO,MAAM,EAAE,MAAK,uBAAuB;AACtM,WAAK,MAAM,SAAS,CAAC;AAAE,YAAM,KAAK,IAAI,QAAO,CAAC,YAAW,OAAM,YAAW,QAAO,IAAI,CAAC;AAAE,WAAK,MAAM,GAAG,QAAQ,4CAA4C,EAAE,IAAIV,KAAG,UAAU,CAAC,GAAE,EAAE,QAAO,QAAO,MAAK,MAAM;AAAE,aAAO,EAAC,YAAWA,KAAG,QAAO,EAAE,QAAO,cAAaU,WAAS,YAAW,KAAI;AAAA,IAC1R;AACA,UAAM,MAAI,KAAK,MAAM,GAAG,QAAQ,oCAAoC,EAAE,IAAI,EAAE,UAAU;AAAE,QAAG,CAAC,IAAI,MAAK,sBAAqB,GAAG;AAAE,SAAK,MAAM,IAAI,IAAI,SAAQ,CAAC;AAAE,QAAG,CAAC,EAAE,MAAM,SAAS,IAAI,IAAI,EAAE,MAAK,gBAAe,GAAG;AACnN,UAAM,OAAK,MAAMH,UAAS,KAAK,OAAO,MAAM,IAAI,IAAI,CAAC;AAAE,eAAU,KAAK,CAAC,IAAI,MAAK,IAAI,MAAM,GAAE;AAAC,UAAG,CAAC,KAAK,MAAM,OAAO,MAAK,MAAMA,UAAS,CAAC,CAAC,EAAE,MAAK,2BAA0B,GAAG;AAAE,YAAM,KAAK,MAAM,iBAAiB,CAAC;AAAA,IAAC;AACnN,UAAM,QAAM,MAAM,KAAK,IAAI,IAAI,MAAK,CAAC,QAAO,YAAW,IAAI,IAAI,CAAC;AAAE,QAAG,SAAO,gBAAgB,QAAO,EAAC,YAAW,IAAI,MAAK,GAAG,MAAM,KAAK,SAAS,OAAO,KAAK,QAAM,IAAI,GAAE,GAAE,aAAa,EAAC;AACvL,QAAG,MAAM,KAAK,IAAI,IAAI,MAAK,CAAC,aAAY,MAAM,CAAC,MAAI,IAAI,QAAM,MAAM,KAAK,IAAI,IAAI,QAAO,CAAC,aAAY,MAAM,CAAC,MAAI,IAAI,QAAM,MAAM,KAAK,IAAI,IAAI,QAAO,CAAC,UAAS,aAAa,CAAC,EAAE,QAAO,EAAC,QAAO,uBAAsB,QAAO,kBAAiB,YAAW,EAAE,WAAU;AACjQ,UAAM,YAAUJ,MAAK,KAAK,OAAO,SAAQ,SAASF,YAAW,CAAC,EAAE;AAAE,UAAMG,WAAU,WAAU,QAAM,MAAK,EAAC,MAAK,IAAK,CAAC;AACnH,QAAG;AAAC,UAAG,CAAC,MAAM,QAAO,EAAC,QAAO,aAAY;AAAE,YAAM,KAAK,IAAI,IAAI,QAAO,CAAC,SAAQ,WAAU,SAAS,CAAC;AAAE,WAAK,MAAM,SAAS,CAAC;AAAE,YAAM,KAAK,IAAI,IAAI,QAAO,CAAC,SAAQ,SAAS,CAAC;AAAE,aAAO,EAAC,QAAO,cAAa,YAAW,IAAI,MAAK,aAAY,IAAI,KAAK,EAAC;AAAA,IAAC,SAAO,GAAE;AAAC,UAAG,aAAa,WAAW,OAAM;AAAE,aAAO,EAAC,QAAO,uBAAsB,QAAO,kBAAiB,YAAW,EAAE,WAAU;AAAA,IAAC,UAAC;AAAQ,YAAMC,QAAO,SAAS;AAAA,IAAC;AAAA,EACrZ;AAAA,EACA,MAAM,QAAO;AAAC,kBAAc,KAAK,SAAS;AAAE,UAAM,WAAS,MAAM,KAAK,gBAAgB,MAAM;AAAE,eAAUL,OAAM,KAAK,KAAK,KAAK,EAAE,MAAK,gBAAgB,IAAIA,GAAE;AAAE,UAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,GAAE,GAAG,KAAK,YAAY,OAAO,CAAC,EAAE,IAAI,OAAG,EAAE,OAAO,WAAW,CAAC,CAAC;AAAE,UAAM,KAAK,WAAW,MAAM;AAAE,UAAM,UAAQ,MAAM,KAAK,QAAQ,MAAM;AAAE,UAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC;AAAE,UAAM,KAAK,QAAQ,MAAM;AAAE,SAAK,MAAM,MAAM;AAAE,WAAO,EAAC,sBAAqB,QAAQ,iBAAe,SAAS,cAAa;AAAA,EAAC;AACpf;;;AqBnTA,OAAO,UAAU;AACjB,OAAO,WAAW;AAClB,SAAS,gBAAAW,qBAAoB;AAC7B,SAAS,yBAAyB;AAClC,SAAQ,YAAW;AACnB,SAAS,QAAQ,0CAA0C,mCAAmC;;;ACC9F,IAAM,WAAS,EAAC,UAAS,KAAM,kBAAiB,GAAE,eAAc,KAAK,cAAa,KAAM,YAAW,MAAK,YAAW,MAAK,oBAAmB,KAAI,oBAAmB,IAAG;AAC9J,SAAS,mBAAmB,QAAiB,CAAC,GAAE;AACrD,QAAM,SAAO,EAAC,GAAG,UAAS,GAAG,MAAK;AAClC,MAAG,CAAC,SAAO,OAAO,UAAQ,YAAU,MAAM,QAAQ,KAAK,KAAG,OAAO,KAAK,KAAK,EAAE,KAAK,CAAAC,SAAK,CAAC,OAAO,OAAO,UAASA,IAAG,CAAC,EAAE,MAAK,qBAAqB;AAC/I,QAAM,SAAO,EAAC,UAAS,CAAC,KAAI,IAAO,GAAE,kBAAiB,CAAC,GAAE,GAAG,GAAE,eAAc,CAAC,IAAG,GAAK,GAAE,cAAa,CAAC,IAAG,GAAK,GAAE,YAAW,CAAC,GAAE,IAAI,GAAE,YAAW,CAAC,GAAE,IAAI,GAAE,oBAAmB,CAAC,GAAE,GAAK,GAAE,oBAAmB,CAAC,GAAE,GAAK,EAAC;AAChN,aAAUA,QAAO,OAAO,KAAK,MAAM,GAA+B;AAAC,UAAM,CAAC,KAAI,GAAG,IAAE,OAAOA,IAAG;AAAE,QAAG,CAAC,OAAO,cAAc,OAAOA,IAAG,CAAC,KAAG,OAAOA,IAAG,IAAE,OAAK,OAAOA,IAAG,IAAE,IAAI,MAAK,qBAAqB;AAAA,EAAC;AAClM,MAAG,OAAO,gBAAc,OAAO,gBAAc,OAAO,eAAa,OAAO,SAAS,MAAK,qBAAqB;AAC3G,SAAO,OAAO,OAAO,MAAM;AAC7B;AAGO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAAY,UAAmB,CAAC,GAAU,MAAI,KAAK,KAAI;AAAb;AAAc,SAAK,SAAO,mBAAmB,OAAO;AAAA,EAAC;AAAA,EAArD;AAAA,EAHlC,UAAQ,oBAAI,IAAmB;AAAA,EAAU,UAAQ,oBAAI,IAAmB;AAAA,EACxE,SAAO,EAAC,OAAM,GAAE,UAAS,GAAE,SAAQ,MAAK;AAAA,EACvC;AAAA,EAED,KAAQ,KAAkBA,MAAW,OAAQ,KAAW;AAAC,QAAI,OAAOA,IAAG;AAAE,QAAI,IAAIA,MAAI,KAAK;AAAE,WAAM,IAAI,OAAK,IAAI,KAAI,OAAO,IAAI,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,EAAC;AAAA,EAC3J,QAAQ,QAAuB;AAC7B,UAAM,MAAI,KAAK,IAAI,GAAE,IAAE,KAAK;AAC5B,QAAG,MAAI,KAAK,OAAO,SAAO,EAAE,YAAU,MAAI,KAAK,OAAO,MAAM,MAAK,SAAO,EAAC,OAAM,KAAI,UAAS,GAAE,SAAQ,MAAK;AAC3G,QAAG,KAAK,OAAO,YAAU,EAAE,oBAAmB;AAAC,YAAM,QAAM,CAAC,KAAK,OAAO;AAAQ,WAAK,OAAO,UAAQ;AAAK,aAAO,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,KAAK,OAAO,QAAM,EAAE,WAAS,KAAI,MAAK;AAAA,IAAC;AACvM,QAAI,MAAI,KAAK,QAAQ,IAAI,MAAM;AAC/B,QAAG,OAAK,MAAI,IAAI,MAAM,OAAI;AAC1B,QAAG,OAAK,IAAI,QAAM,IAAI,QAAO,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,IAAI,QAAM,KAAI,OAAM,MAAK;AACtG,QAAG,CAAC,OAAK,MAAI,IAAI,SAAO,EAAE,YAAU,MAAI,IAAI,MAAM,OAAI,EAAC,OAAM,KAAI,UAAS,GAAE,OAAM,EAAC;AACnF,SAAK,OAAO;AAAW,QAAI;AAC3B,QAAG,IAAI,YAAU,EAAE,iBAAiB,KAAI,QAAM,MAAI,KAAK,IAAI,EAAE,cAAa,EAAE,gBAAc,KAAG,KAAK,IAAI,IAAG,IAAI,WAAS,EAAE,gBAAgB,CAAC;AACzI,SAAK,KAAK,KAAK,SAAQ,QAAO,KAAI,EAAE,UAAU;AAC9C,WAAO,IAAI,QAAM,MAAI,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,IAAI,QAAM,KAAI,OAAM,KAAI,IAAE,EAAC,QAAO,KAAI,MAAK,gBAAe,cAAa,GAAE,OAAM,KAAI;AAAA,EAC1J;AAAA;AAAA,EAEA,cAAc,UAAgB,UAA8B;AAC1D,UAAM,MAAI,KAAK,IAAI,GAAE,IAAE,KAAK;AAAO,QAAI,MAAI,KAAK,QAAQ,IAAI,QAAQ;AACpE,QAAG,CAAC,OAAK,IAAI,aAAW,YAAU,MAAI,IAAI,SAAO,EAAE,YAAU,MAAI,IAAI,MAAM,OAAI,EAAC,OAAM,KAAI,UAAS,GAAE,UAAS,SAAQ,MAAK;AAC3H,QAAG,IAAI,YAAU,EAAE,oBAAmB;AAAC,YAAM,QAAM,CAAC,IAAI;AAAQ,UAAI,UAAQ;AAAK,aAAO,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,IAAI,QAAM,EAAE,WAAS,KAAI,MAAK;AAAA,IAAC;AACvK,QAAI;AAAW,SAAK,KAAK,KAAK,SAAQ,UAAS,KAAI,EAAE,UAAU;AAAE,WAAO;AAAA,EAC1E;AAAA,EACA,QAAO;AAAC,WAAO,EAAC,SAAQ,KAAK,QAAQ,MAAK,SAAQ,KAAK,QAAQ,MAAK,gBAAe,KAAK,OAAO,SAAQ;AAAA,EAAC;AAC1G;;;ADnCA,SAAQ,uBAAsB;AAE9B,IAAM,WAAS,CAAC,SAAc,CAAC,aAAY,OAAM,kBAAkB,EAAE,SAAS,IAAI;AAC3E,SAAS,gBAAgB,GAAgB;AAAC,QAAM,OAAK,EAAE,QAAM,aAAY,OAAK,EAAE,QAAM;AAAW,MAAG,CAAC,WAAU,MAAK,WAAW,EAAE,SAAS,IAAI,EAAE,MAAK,uBAAuB;AACjL,MAAG,CAAC,KAAK,IAAI,KAAG,EAAE,SAAO,WAAY,CAAC,OAAO,cAAc,EAAE,IAAI,KAAG,EAAE,OAAK,KAAG,EAAE,OAAK,OAAO,MAAK,wBAAwB;AACzH,aAAUC,QAAO,CAAC,gBAAe,kBAAiB,gBAAgB,EAAW,KAAG,EAAEA,IAAG,MAAI,WAAY,CAAC,MAAM,QAAQ,EAAEA,IAAG,CAAC,KAAG,EAAEA,IAAG,EAAG,SAAO,OAAK,EAAEA,IAAG,EAAG,KAAK,WAAO,OAAO,UAAQ,YAAU,CAAC,SAAO,MAAM,SAAO,OAAK,0BAA0B,KAAK,KAAK,CAAC,GAAG,MAAK,wBAAwB;AAC7R,MAAG,EAAE,gBAAgB,KAAK,WAAO,CAAC,KAAK,KAAK,CAAC,EAAE,MAAK,wBAAwB;AAC5E,MAAG,EAAE,gBAAgB,KAAK,WAAO;AAAC,QAAG;AAAC,YAAM,MAAI,IAAI,IAAI,KAAK;AAAE,aAAO,CAAC,CAAC,SAAQ,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAG,IAAI,WAAS;AAAA,IAAK,QAAM;AAAC,aAAO;AAAA,IAAI;AAAA,EAAC,CAAC,EAAE,MAAK,wBAAwB;AACvL,MAAG,EAAE,cAAc,KAAK,WAAO;AAAC,QAAG;AAAC,YAAM,MAAI,IAAI,IAAI,UAAU,KAAK,EAAE;AAAE,aAAO,IAAI,SAAO,MAAM,YAAY,KAAG,IAAI,aAAW,OAAK,CAAC,CAAC,IAAI,YAAU,CAAC,CAAC,IAAI,YAAU,CAAC,CAAC,IAAI,UAAQ,CAAC,CAAC,IAAI;AAAA,IAAI,QAAM;AAAC,aAAO;AAAA,IAAI;AAAA,EAAC,CAAC,EAAE,MAAK,wBAAwB;AAC/O,qBAAmB,EAAE,UAAU;AAC/B,MAAG,EAAE,KAAK,4BAA0B,CAAC,EAAE,IAAI,OAAO,MAAK,kBAAkB;AACzE,MAAG,SAAO,cAAY,CAAC,SAAS,IAAI,EAAE,MAAK,cAAc;AACzD,MAAG,CAAC,aAAY,WAAW,EAAE,SAAS,IAAI,GAAE;AAAC,QAAG,CAAC,OAAO,OAAO,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,OAAG,GAAG,YAAU,IAAI,EAAE,MAAK,0BAA0B;AAAE,QAAG,CAAC,EAAE,OAAK,CAAC,EAAE,gBAAgB,MAAK,6BAA6B;AAAA,EAAC;AACxN,MAAG,SAAO,wBAAsB,CAAC,SAAS,IAAI,KAAG,CAAC,EAAE,iBAAiB,MAAK,iCAAiC;AAC3G,MAAG,SAAO,gBAAc,CAAC,EAAE,QAAM,CAAC,SAAS,IAAI,KAAG,CAAC,EAAE,gBAAgB,QAAQ,MAAK,cAAc;AAChG,MAAG,CAAC,EAAE,OAAK,CAAC,SAAS,IAAI,KAAG,CAAC,EAAE,gBAAgB,MAAK,cAAc;AAClE,MAAG,CAAC,CAAC,YAAW,aAAY,aAAY,qBAAoB,YAAY,EAAE,SAAS,IAAI,EAAE,MAAK,sBAAsB;AACtH;AACA,eAAsB,MAAM,OAAY,IAAgB,CAAC,GAAE;AACzD,MAAE,gBAAgB,CAAC;AAAE,kBAAgB,CAAC;AAAE,QAAM,WAAS,IAAI,aAAa,EAAE,UAAU,GAAE,OAAK,EAAE,QAAM;AACnG,QAAM,kBAAgB,CAAC,KAAyB,UAAQ,UAAQ;AAC9D,UAAM,UAAQ,OAAO,QAAQ,GAAS,cAAY,GAAG,KAAK,SAAS,GAAG,IAAE,IAAI,IAAI,MAAI,IAAI,IAAI,QAAQ,IAAI;AACxG,QAAG,EAAE,EAAE,gBAAc,CAAC,WAAW,GAAG,SAAS,IAAI,QAAQ,QAAM,EAAE,EAAE,MAAK,eAAc,GAAG;AACzF,UAAM,SAAO,IAAI,QAAQ;AACzB,QAAG,WAAS,UAAW,EAAE,EAAE,kBAAgB,CAAC,GAAG,SAAS,MAAM,KAAG,EAAE,WAAS,MAAM,gBAAgB,UAAU,MAAM,GAAG,MAAK,iBAAgB,GAAG;AAC7I,QAAG,EAAE,SAAO,gBAAc,CAAC,EAAE,QAAM,EAAE,EAAE,kBAAgB,CAAC,GAAG,SAAS,IAAI,OAAO,iBAAe,SAAS,KAAG,IAAI,QAAQ,mBAAmB,MAAI,SAAS,MAAK,gBAAe,GAAG;AAC7K,WAAO;AAAA,EACT;AACA,QAAM,UAAQ,OAAM,KAAyB,QAA0B;AACrE,QAAI;AAAY,UAAM,SAAO,IAAI,OAAO,iBAAe;AAAU,UAAM,OAAK,CAAC,QAAc,UAAY;AAAC,UAAI,UAAU,QAAO,EAAC,gBAAe,oBAAmB,iBAAgB,YAAW,0BAAyB,UAAS,CAAC;AAAE,UAAI,IAAI,KAAK,UAAU,KAAK,CAAC;AAAA,IAAC;AAC9P,QAAG;AACD,YAAM,cAAY,gBAAgB,GAAG;AACrC,YAAM,SAAO,CAAC,aAA+C;AAC3D,YAAG,SAAS,MAAM,OAAM,MAAM,MAAM,SAAS,IAAI;AACjD,YAAG,SAAS,aAAa,KAAI,UAAU,eAAc,OAAO,KAAK,IAAI,GAAE,KAAK,KAAK,SAAS,eAAa,GAAI,CAAC,CAAC,CAAC;AAC9G,aAAK,SAAS,MAAK,SAAS,MAAM;AAAA,MACpC;AACA,YAAM,OAAK,IAAI,QAAQ,iBAAe;AAAG,UAAG,CAAC,6BAA6B,KAAK,IAAI,GAAE;AAAC,eAAO,SAAS,QAAQ,MAAM,CAAC;AAAA,MAAC;AACtH,YAAM,MAAI,IAAI,IAAI,IAAI,OAAK,KAAI,UAAU,WAAW,EAAE;AAAE,UAAI;AAC5D,YAAM,eAAa,MAAI;AAAC,YAAG;AAAC,cAAG,IAAI,SAAS,WAAW,cAAc,EAAE,UAAO,MAAM,MAAM,OAAO,KAAK,MAAM,CAAC,CAAC;AAAA,cAAO,WAAQ,MAAM,MAAM,MAAM,KAAK,MAAM,CAAC,CAAC;AAAA,QAAC,QAAM;AAAC,iBAAO,SAAS,QAAQ,MAAM,CAAC;AAAA,QAAC;AAAA,MAAC;AACrM,mBAAa;AAEb,YAAM,UAAQ,SAAS,cAAc,QAAQ,MAAI,QAAQ,UAAS,QAAQ,YAAU,QAAQ,QAAQ;AACpG,UAAG,QAAQ,QAAO,OAAO;AACzB,UAAG,IAAI,WAAS,QAAO;AAAC,aAAK,KAAI,EAAC,OAAM,EAAC,MAAK,qBAAoB,EAAC,CAAC;AAAE;AAAA,MAAM;AAC5E,UAAI,OAAK,OAAO,MAAM,CAAC;AAAE,uBAAgB,SAAS,KAAI;AAAC,eAAK,OAAO,OAAO,CAAC,MAAK,KAAK,CAAC;AAAE,YAAG,KAAK,SAAO,QAAQ,MAAK,qBAAoB,GAAG;AAAA,MAAC;AAC5I,UAAI;AAAW,UAAG;AAAC,iBAAO,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC;AAAA,MAAC,QAAM;AAAC,aAAK,cAAc;AAAA,MAAC;AAGtF,mBAAa;AACb,UAAG,IAAI,aAAW,sBAAqB;AAAC,aAAK,KAAI,MAAM,MAAM,MAAM,QAAO,MAAM,CAAC;AAAE;AAAA,MAAM;AACzF,UAAG,IAAI,aAAW,6BAA4B;AAAC,cAAM,SAAO,MAAM,MAAM,aAAa,QAAO,MAAM;AAAE,cAAM,MAAM,gBAAgB,MAAM;AAAE,aAAK,KAAI,MAAM;AAAE;AAAA,MAAM;AAC/J,UAAG,IAAI,aAAW,uBAAsB;AAAC,aAAK,KAAI,MAAM,MAAM,gBAAgB,KAAK,SAAQ,MAAM,CAAC;AAAE;AAAA,MAAM;AAC1G,UAAG,IAAI,aAAW,6BAA4B;AAAC,aAAK,KAAI,MAAM,MAAM,gBAAgB,MAAM,SAAQ,MAAM,CAAC;AAAE;AAAA,MAAM;AACjH,UAAG,IAAI,aAAW,6BAA4B;AAAC,aAAK,KAAI,MAAM,MAAM,gBAAgB,aAAa,SAAQ,MAAM,CAAC;AAAE;AAAA,MAAM;AACxH,UAAG,IAAI,aAAW,OAAO,MAAK,aAAY,GAAG;AAC7C,YAAM,MAAI,IAAI,OAAO,EAAC,MAAK,6BAA4B,SAAQ,cAAa,GAAE,EAAC,cAAa,EAAC,OAAM,CAAC,EAAC,GAAE,2BAA0B,4BAA2B,CAAC;AAC7J,YAAM,YAAU,IAAI,yCAAyC,EAAC,oBAAmB,MAAK,oBAAmB,QAAU,oBAAmB,QAAO,CAAC;AAC9I,UAAI,kBAAkB,cAAa,YAAS;AAAC,cAAM,MAAM,SAAS,OAAO;AAAE,eAAO,EAAC,OAAM,QAAQ,OAAO,OAAG,QAAQ,MAAM,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,QAAI,EAAC,MAAK,EAAE,MAAK,aAAY,UAAU,EAAE,IAAI,IAAG,aAAY,EAAE,aAAY,aAAY,EAAC,cAAa,CAAC,EAAE,UAAS,iBAAgB,EAAE,SAAQ,EAAC,EAAE,EAAC;AAAA,MAAC,CAAC;AAC/R,UAAI,kBAAkB,cAAa,OAAM,YAAc;AAAC,YAAG;AAAC,gBAAM,OAAK,QAAQ,OAAO,SAAO,CAAC,GAAEC,QAAK,QAAQ,OAAO,aAAW,CAAC;AAAE,cAAG,OAAO,OAAOA,OAAK,aAAa,KAAG,QAAQ,OAAO,SAAO,sBAAoB,QAAQ,OAAO,SAAO,mBAAmB,MAAK,+BAA+B;AAC3R,gBAAM,SAAO,MAAM,MAAM,KAAK,QAAQ,OAAO,MAAKA,OAAK,SAAQ,KAAK,iBAAiB,CAAC;AAAE,gBAAM,MAAM,MAAM,eAAc,QAAQ,OAAM,KAAK,iBAAiB,KAAG,IAAI;AAAE,iBAAO,EAAC,SAAQ,CAAC,EAAC,MAAK,QAAO,MAAK,KAAK,UAAU,MAAM,EAAC,CAAC,GAAE,mBAAkB,OAAM;AAAA,QAC3P,SAAO,GAAE;AAAC,gBAAM,OAAK,aAAa,aAAW,EAAE,OAAK;AAAmB,gBAAM,MAAM,MAAM,MAAK,QAAQ,KAAK;AAAE,iBAAO,EAAC,SAAQ,MAAK,SAAQ,CAAC,EAAC,MAAK,QAAO,MAAK,KAAI,CAAC,EAAC;AAAA,QAAC;AAAA,MAAC,CAAC;AACxK,YAAM,IAAI,QAAQ,SAAS;AAC3B,UAAG;AAAC,cAAM,WAAS,MAAM,UAAU,cAAc,IAAI,QAAQ,UAAU,WAAW,QAAO,EAAC,QAAO,QAAO,SAAQ,IAAI,SAAe,MAAK,KAAK,SAAS,MAAM,EAAC,CAAC,GAAE,EAAC,YAAW,OAAM,CAAC;AAAE,YAAI,UAAU,SAAS,QAAO,OAAO,YAAY,SAAS,OAAO,CAAC;AAAE,YAAI,IAAI,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,MAAC,UAAC;AAAQ,cAAM,IAAI,MAAM;AAAA,MAAC;AAAA,IACvU,SAAO,GAAE;AAAC,WAAK,aAAa,aAAW,EAAE,SAAO,KAAI,EAAC,OAAM,EAAC,MAAK,aAAa,aAAW,EAAE,OAAK,iBAAgB,EAAC,CAAC;AAAA,IAAC;AAAA,EACrH;AACA,QAAM,MAAI,EAAE,MAAI,EAAC,KAAIC,cAAa,EAAE,IAAI,OAAO,GAAE,MAAKA,cAAa,EAAE,IAAI,QAAQ,GAAE,IAAG,EAAE,IAAI,SAAOA,cAAa,EAAE,IAAI,MAAM,IAAE,QAAU,aAAY,CAAC,CAAC,EAAE,IAAI,0BAAyB,oBAAmB,CAAC,CAAC,EAAE,IAAI,yBAAwB,IAAE;AAC1O,QAAM,SAAO,MAAI,MAAM,aAAa,KAAI,OAAO,IAAE,KAAK,aAAa,OAAO;AAAE,SAAO,iBAAe;AAAM,SAAO,iBAAe;AAAM,SAAO,iBAAe;AAC1J,QAAM,YAAU,IAAI,gBAAgB,EAAC,UAAS,MAAK,gBAAe,MAAK,YAAW,OAAM,mBAAkB,MAAK,CAAC;AAChH,SAAO,GAAG,WAAU,CAAC,KAAI,QAAO,SAAO;AACrC,QAAG;AACD,YAAM,cAAY,gBAAgB,KAAI,IAAI,GAAE,MAAI,IAAI,IAAI,IAAI,OAAK,KAAI,UAAU,WAAW,EAAE;AAC5F,UAAG,IAAI,aAAW,wBAAsB,IAAI,OAAO,MAAK,aAAY,GAAG;AACvE,UAAG,UAAU,QAAQ,QAAM,GAAG,MAAK,4BAA2B,GAAG;AACjE,gBAAU,cAAc,KAAI,QAAO,MAAK,QAAI;AAAC,kBAAU,KAAK,cAAa,IAAG,GAAG;AAAE,cAAM,gBAAgB,OAAO,IAAG,IAAI,QAAQ,QAAO,EAAE,kBAAgB,CAAC,CAAC;AAAA,MAAC,CAAC;AAAA,IAC5J,SAAO,GAAE;AAAC,YAAM,SAAO,aAAa,aAAW,EAAE,SAAO;AAAI,aAAO,IAAI,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA,CAA6D;AAAA,IAAC;AAAA,EACzJ,CAAC;AACD,QAAM,IAAI,QAAc,CAACC,UAAQ,WAAS;AAAC,WAAO,KAAK,SAAQ,MAAM;AAAE,WAAO,OAAO,EAAE,QAAM,MAAK,MAAK,MAAIA,SAAQ,CAAC;AAAA,EAAC,CAAC;AACtH,SAAO,EAAC,QAAO,SAAQ,OAAO,QAAQ,GAAE,sBAAqB,6BAA4B,OAAM,YAAS;AAAC,UAAM,MAAM,gBAAgB,MAAM;AAAE,eAAU,UAAU,UAAU,QAAQ,QAAO,UAAU;AAAE,UAAM,IAAI,QAAc,CAAAA,aAAS,UAAU,MAAM,MAAIA,SAAQ,CAAC,CAAC;AAAE,UAAM,IAAI,QAAc,CAACA,UAAQ,WAAS,OAAO,MAAM,OAAG,IAAE,OAAO,CAAC,IAAEA,SAAQ,CAAC,CAAC;AAAA,EAAC,EAAC;AAC3V;;;AtBjFA,IAAM,CAAC,SAAQ,YAAW,GAAG,IAAI,IAAE,QAAQ,KAAK,MAAM,CAAC;AACvD,IAAG;AACD,MAAG,CAAC,WAAW,MAAK,6FAA6F;AACjH,QAAM,OAAKC,SAAQ,UAAU;AAC7B,MAAG,YAAU,QAAO;AAClB,UAAM,OAAKA,SAAQ,KAAK,CAAC,KAAG,GAAG;AAAE,UAAM,SAAO,EAAC,SAAQC,MAAKC,SAAQ,IAAI,GAAE,MAAM,GAAE,OAAM,EAAC,SAAQ,KAAI,GAAE,WAAU,eAAc,SAAQ,EAAC,MAAK,YAAW,MAAK,aAAY,MAAK,KAAI,GAAE,aAAY,EAAC,MAAK,QAAQ,SAAQ,GAAE,gBAAe,CAAC,EAAC;AACzO,UAAMC,OAAMD,SAAQ,IAAI,GAAE,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,UAAME,WAAU,MAAK,KAAK,UAAU,QAAO,MAAK,CAAC,IAAE,MAAK,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AAAE,YAAQ,IAAI,KAAK,UAAU,EAAC,YAAW,MAAK,MAAK,+DAA8D,CAAC,CAAC;AAAA,EAC1P,OAAK;AACH,UAAM,SAAO,KAAK,MAAM,MAAMC,UAAS,MAAK,MAAM,CAAC;AACnD,QAAG,YAAU,SAAQ;AACnB,YAAM,QAAM,IAAI,MAAM,MAAM;AAAE,UAAI;AAAW,UAAG;AAAC,iBAAO,MAAM,MAAM,OAAM,OAAO,OAAO;AAAA,MAAC,SAAO,GAAE;AAAC,cAAM,MAAM,MAAM;AAAE,cAAM;AAAA,MAAC;AAC9H,cAAQ,IAAI,KAAK,UAAU,EAAC,WAAU,MAAM,MAAM,WAAU,WAAU,OAAO,SAAQ,WAAU,OAAO,qBAAoB,CAAC,CAAC;AAAE,UAAI,WAAS;AAC3I,YAAM,OAAK,YAAS;AAAC,YAAG,SAAS;AAAO,mBAAS;AAAK,cAAM,OAAO,MAAM;AAAE,cAAM,MAAM,MAAM;AAAA,MAAC;AAAE,cAAQ,KAAK,UAAS,MAAI,KAAK,KAAK,CAAC;AAAE,cAAQ,KAAK,WAAU,MAAI,KAAK,KAAK,CAAC;AAAA,IAC/K,OAAK;AACH,YAAM,QAAM,IAAI,MAAM,OAAO,SAAQ,QAAU,EAAC,OAAM,KAAI,CAAC;AAAE,UAAG;AAAC,YAAI;AAAW,YAAG,YAAU,QAAO;AAAC,gBAAM,UAAQ,KAAK,MAAM,MAAMA,UAASL,SAAQ,KAAK,CAAC,CAAC,GAAE,MAAM,CAAC;AAAE,qBAAU,QAAQ,QAAQ,SAAO,CAAC,EAAE,KAAG,CAAC,OAAO,MAAM,IAAI,EAAE,MAAK,cAAc;AAAE,mBAAO,MAAM,KAAK,KAAK,CAAC,GAAE,OAAO;AAAA,QAAC,WAAS,YAAU,SAAS,UAAO,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,iBAAU,YAAU,UAAS;AAAC,gBAAM,OAAO,KAAK,CAAC,CAAC;AAAE,mBAAO,EAAC,SAAQ,KAAI;AAAA,QAAC,MAAM,MAAK,iBAAiB;AAAE,gBAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAAA,MAAC,UAAC;AAAQ,cAAM,MAAM;AAAA,MAAC;AAAA,IAClf;AAAA,EACF;AACF,SAAO,GAAM;AAAC,UAAQ,MAAM,EAAE,QAAM,oBAAoB;AAAE,UAAQ,WAAS;AAAC;",
+  "sourcesContent": ["#!/usr/bin/env node\nimport { readFile, writeFile, mkdir } from 'node:fs/promises'\nimport { resolve, dirname, join } from 'node:path'\nimport { Agent } from './agent.js'\nimport { Store } from './store.js'\nimport { serve } from './transport.js'\nimport { fail } from './protocol.js'\nconst [command,configPath,...args]=process.argv.slice(2)\ntry{\n  if(!configPath)fail('USAGE: dsh-remote-agent init|serve|pair|rotate|revoke <config.json> [clientId ceiling.json]')\n  const file=resolve(configPath)\n  if(command==='init'){\n    const root=resolve(args[0]??'.');const config={dataDir:join(dirname(file),'data'),roots:{project:root},isolation:'application',network:{mode:'loopback',host:'127.0.0.1',port:9701},executables:{node:process.execPath},browserOrigins:[]}\n    await mkdir(dirname(file),{recursive:true,mode:0o700});await writeFile(file,JSON.stringify(config,null,2)+'\\n',{flag:'wx',mode:0o600});console.log(JSON.stringify({configured:file,next:'Run pair with an explicit Bot/tool/root ceiling, then serve.'}))\n  }else{\n    const config=JSON.parse(await readFile(file,'utf8'))\n    if(command==='serve'){\n      const agent=new Agent(config);let handle:any;try{handle=await serve(agent,config.network)}catch(e){await agent.close();throw e}\n      console.log(JSON.stringify({machineId:agent.store.machineId,listening:handle.address,protocols:handle.supportedMcpVersions}));let stopping=false\n      const stop=async()=>{if(stopping)return;stopping=true;await handle.close();await agent.close()};process.once('SIGINT',()=>void stop());process.once('SIGTERM',()=>void stop())\n    }else{\n      const store=new Store(config.dataDir,undefined,{admin:true});try{let result:any;if(command==='pair'){const ceiling=JSON.parse(await readFile(resolve(args[1]),'utf8'));for(const root of ceiling.roots??[])if(!config.roots[root])fail('UNKNOWN_ROOT');result=store.pair(args[0],ceiling)}else if(command==='rotate')result=store.rotate(args[0]);else if(command==='revoke'){store.revoke(args[0]);result={revoked:true}}else fail('UNKNOWN_COMMAND');console.log(JSON.stringify(result))}finally{store.close()}\n    }\n  }\n}catch(e:any){console.error(e.code??'AGENT_START_FAILED');process.exitCode=1}\n", "import { readFile, writeFile, mkdir, rename, unlink, lstat, stat, realpath } from 'node:fs/promises'\nimport { join, dirname, resolve } from 'node:path'\nimport { randomUUID } from 'node:crypto'\nimport { spawn, execFile } from 'node:child_process'\nimport { promisify } from 'node:util'\nimport { AGENT_VERSION, AGENT_API_MAJOR, AgentError, canonical, fail, integer, isMutating, sha, TOOL_NAMES, type Context } from './protocol.js'\nimport { Store } from './store.js'\nimport { Roots } from './scope.js'\nimport { BrowserTools } from './browser.js'\nimport { DesktopTools } from './desktop.js'\nimport { DesktopSessions } from './desktop-session.js'\nimport {ContainerCommands,type ContainerCommandConfig} from './container-command.js'\nimport {WorkspacePin} from './workspace-identity.js'\nimport {WorkspaceAdmissions} from './workspace-admission.js'\nimport {reconcileRootsGeneration,rootsGeneration} from './workspace-generation.js'\nimport {pinnedCreateNewFile,pinnedWriteSupported} from './pinned-write.js'\nimport {CliTasks,validateCliProfiles,type CliProfileConfig} from './cli-task.js'\nconst execFileAsync=promisify(execFile)\nconst ARTIFACT_QUOTA_BYTES=256*1024*1024\nexport type AgentConfig={dataDir:string;roots:Record<string,string>;executables?:Record<string,string>;shell?:string;windowsJobRunner?:string;browserOrigins?:string[];browserExecutablePath?:string;browserProfiles?:Record<string,string>;isolation?:'os-account'|'container'|'application';container?:ContainerCommandConfig;desktop?:{pipeName:string;secretFile:string};cliProfiles?:CliProfileConfig[]}\nexport class Agent {\n  store:Store;roots:Roots;browser:BrowserTools;desktop:DesktopTools;desktopSessions:DesktopSessions;workspaces:WorkspaceAdmissions;container?:ContainerCommands;cliTasks:CliTasks;rootsGeneration:string;private processes=new Map<string,any>();private jobs=new Map<string,Promise<any>>();private desktopJobs=new Map<string,{context:Context;cancel:(why:string)=>Promise<void>}>();private cancelRequested=new Set<string>();private writes=new Set<string>();private authTimer:any\n  constructor(public config:AgentConfig,Database?:any){const cliProfiles=validateCliProfiles(config.cliProfiles,config.dataDir,config.roots);this.store=new Store(resolve(config.dataDir),Database);this.roots=new Roots(config.roots,{protectedPaths:[resolve(config.dataDir),...(config.desktop?[resolve(config.desktop.secretFile)]:[])]});this.cliTasks=new CliTasks(cliProfiles,this.store,this.roots);this.browser=new BrowserTools(config.browserOrigins??[],config.browserExecutablePath,undefined,config.browserProfiles);this.desktop=new DesktopTools(config.desktop,{validate:c=>this.store.validate(c)})\n    try{\n     // Which roots configuration produced the persisted workspace state. A\n     // changed mapping between runs fences unsettled admissions instead of\n     // letting them be interpreted against roots they were not admitted under.\n     this.rootsGeneration=rootsGeneration(config.roots)\n     this.workspaces=new WorkspaceAdmissions(this.store,this.rootsGeneration)\n     this.store.db.exec('CREATE TABLE IF NOT EXISTS agent_stop_receipts(operation_id TEXT PRIMARY KEY REFERENCES operations(id),proof TEXT NOT NULL)')\n     // Older journals have no physical-root receipt. Keep an explicit recovery\n     // fence instead of assuming those unknown writers had no effects.\n     this.store.db.exec(`CREATE TABLE IF NOT EXISTS workspace_legacy_fences(operation_id TEXT PRIMARY KEY);\n       INSERT OR IGNORE INTO workspace_legacy_fences SELECT id FROM operations WHERE tool IN ('fs_write','shell_exec','worktree_create','worktree_integrate') AND status IN ('admitted','running','cancel_pending','unknown') AND NOT EXISTS(SELECT 1 FROM workspace_admissions WHERE operation_id=operations.id);`)\n     const generationChange=reconcileRootsGeneration(this.store.db,this.rootsGeneration)\n     if(generationChange.changed)this.store.audit('WORKSPACE_ROOTS_GENERATION_CHANGED')\n     if(config.container){if(config.isolation!=='container'||Object.keys(config.executables??{}).length||config.shell||config.windowsJobRunner)fail('CONTAINER_CONFIG_INVALID');this.container=new ContainerCommands(this.store,config.container)}else if(config.isolation==='container')fail('CONTAINER_CONFIG_INVALID')\n    }catch(e){this.store.close();throw e}\n    this.desktopSessions=new DesktopSessions(config.desktop,{validate:c=>this.store.validate(c),audit:(code,actor,operation)=>this.store.audit(code,actor,operation)})\n    this.authTimer=setInterval(()=>{for(const p of [...this.processes.values(),...this.desktopJobs.values()]){try{this.store.validate(p.context)}catch{void p.cancel('GRANT_REVOKED')}};void this.container?.sweep((data,c)=>this.artifact(data,c,'text/plain')).catch(()=>{})},100);this.authTimer.unref()}\n  async call(name:string,args:any,c:Context,operationId?:string) {\n    this.store.validate(c);if(!TOOL_NAMES.includes(name)||!c.tools.includes(name))fail('SCOPE_DENIED',403)\n    if(args?.rootId&&!c.roots.includes(args.rootId))fail('SCOPE_DENIED',403)\n    if(name==='cli_probe_v1')return this.cliTasks.probe(args,c,operationId)\n    if(name==='machine_ping')return {schemaVersion:1,machineId:this.store.machineId,agentVersion:AGENT_VERSION,agentApiMajor:AGENT_API_MAJOR,rootsGeneration:this.rootsGeneration,os:{platform:process.platform,arch:process.arch},node:process.version,isolation:this.config.isolation??'application',isolationStatus:this.container?'command-container':'configuration-only',container:this.container?await this.container.probe():null,capabilities:TOOL_NAMES.filter(n=>(!n.startsWith('desktop_')||!!this.config.desktop)&&(!this.container||!n.startsWith('worktree_'))),browser:await this.browser.probe(),shell:{configured:!!this.container||!!Object.keys(this.config.executables??{}).length||!!this.config.shell,processIsolation:this.container?'container':process.platform==='win32'?(this.config.windowsJobRunner?'job-object-configured':'unavailable'):'process-group'},desktop:{configured:!!this.config.desktop,status:this.config.desktop?'unverified':'unavailable'}}\n    if(name==='operation_status'){if(this.container){await this.container.observe(args.operationId,c,(data,context)=>this.artifact(data,context,'text/plain'));this.store.validate(c)}return this.operationStatus(args.operationId,c)}\n    if(name==='operation_cancel'){\n      this.store.status(args.operationId,c)\n      const p=this.processes.get(args.operationId),desktop=this.desktopJobs.get(args.operationId),pending=this.jobs.has(args.operationId)\n      let requested=!!p||!!desktop||pending\n      if(p)await p.cancel('CANCELLED');else if(desktop)await desktop.cancel('CANCELLED');else if(pending)this.cancelRequested.add(args.operationId);else if(this.container)requested=await this.container.cancel(args.operationId,c)\n      if(this.container){await this.container.observe(args.operationId,c,(data,context)=>this.artifact(data,context,'text/plain'));this.store.validate(c)}\n      const operation=this.operationStatus(args.operationId,c)\n      const terminal=['succeeded','failed','cancelled'].includes(operation.status)\n      // A terminal journal row alone does not prove an external process or\n      // helper has stopped. Trust only the original strict boolean evidence.\n      // Successful file writes await all in-process I/O and cleanup. A failed\n      // write without explicit evidence is not enough to infer that it stopped.\n      // A file write confirms stopping only through its own completed\n      // in-process chain, and only when no tracked job or controller for it\n      // remains. A raw stopConfirmed on a failed or cancelled write, or the\n      // mere absence of tracked processes, is not proof that the write\n      // stopped or that it never ran.\n      const inProcessWrite=operation.tool==='fs_write'&&!!operation.stopProof\n      const evidence=operation.tool!=='fs_write'&&(operation.result?.stopConfirmed===true||operation.result?.notStarted===true)\n      const writeSettled=operation.tool!=='fs_write'||(!this.jobs.has(args.operationId)&&!this.processes.has(args.operationId))\n      const stopConfirmed=terminal&&writeSettled&&(inProcessWrite||evidence)\n      return {cancelRequested:requested,stopConfirmed,...(stopConfirmed&&operation.stopProof?{stopProof:operation.stopProof}:{}),operation}\n    }\n    if(!isMutating(name))return this.execute(name,args,c)\n    if(!operationId)fail('OPERATION_ID_REQUIRED');const admitted=this.store.admit(operationId,c,name,args);if(!admitted.fresh)return name==='fs_write'?this.operationStatus(operationId,c):admitted.operation\n    this.store.running(operationId)\n    if(name==='cli_task_v1'){\n      const job=(async()=>{\n        let settled\n        try{settled=await this.cliTasks.run(args,c,operationId,{setProcess:record=>this.processes.set(operationId,record),clearProcess:()=>this.processes.delete(operationId)})}\n        catch(e:any){settled={status:'unknown',result:{kind:'remote-cli',schemaVersion:1,receipt:null,stopConfirmed:false,stopEvidence:{treeStopped:false,status:'unconfirmed'}},error:'OUTCOME_UNKNOWN'}}\n        this.jobs.delete(operationId);this.processes.delete(operationId);this.cancelRequested.delete(operationId)\n        this.store.finish(operationId,settled.status,settled.result,settled.error)\n        return this.operationStatus(operationId,c)\n      })().finally(()=>{this.jobs.delete(operationId);this.processes.delete(operationId);this.cancelRequested.delete(operationId)})\n      this.jobs.set(operationId,job);return this.store.status(operationId,c)\n    }\n    if(name==='shell_exec'||name==='container_command_v1'){\n      // The versioned command backend is container-only by construction: a\n      // non-container Agent settles the operation as never-started instead of\n      // throwing (a thrown refusal would leave an unsettled admitted\n      // operation and an unknown Task forever), argv is the only input shape,\n      // and the native shell path below stays unreachable for it.\n      const commandOnly=name==='container_command_v1'\n      const job=(async()=>{\n        if(commandOnly){\n          if(!this.container)fail('CONTAINER_COMMAND_UNAVAILABLE',503)\n          if(args?.script!==undefined||!args?.workspaceRef?.rootId)fail('INVALID_ARGUMENT')\n        }\n        return this.container?this.withWorkspace(args.workspaceRef?.rootId,c,operationId,()=>this.shell(args,c,operationId)):this.shell(args,c,operationId)\n      })().catch(e=>{\n        const notStarted=commandOnly&&!this.container||(this.container&&!this.store.db.prepare('SELECT 1 FROM container_workers WHERE operation_id=?').get(operationId))\n        this.store.finish(operationId,'failed',notStarted?{notStarted:true,stopConfirmed:true,possiblyApplied:false}:null,e instanceof AgentError?e.code:'EXECUTION_FAILED')\n      }).finally(()=>{this.jobs.delete(operationId);this.cancelRequested.delete(operationId)});this.jobs.set(operationId,job);return this.store.status(operationId,c)}\n    if(name==='fs_write'){\n      const controller=new AbortController()\n      this.processes.set(operationId,{context:c,cancel:async(why:string)=>{controller.abort(new AgentError(why))}})\n      const job=(async()=>{\n       try{\n        const result=await this.withWorkspace(args.rootId,c,operationId,pin=>this.execute(name,args,c,controller.signal,pin))\n        this.store.finish(operationId,controller.signal.aborted?'cancelled':'succeeded',controller.signal.aborted?{...result,stopConfirmed:true,possiblyApplied:true}:{...result,stopConfirmed:true},controller.signal.aborted?'CANCELLED':null)\n       }catch(e:any){\n        const cancelled=e?.code==='WRITE_CANCELLED',published=e?.published===true,unknown=!cancelled&&(published||e?.code==='OUTCOME_UNKNOWN')\n        // This catch runs only after the in-process write and awaited cleanup\n        // have settled. Post-publication cancellation can retain a shape-checked\n        // digest; every other post-publication error remains unknown and locked.\n        const digest=cancelled&&published&&e?.result&&/^[a-f0-9]{64}$/.test(e.result.sha256)&&Number.isSafeInteger(e.result.size)&&e.result.size>=0&&e.result.size<=1048576?{sha256:e.result.sha256,size:e.result.size}:{}\n        this.store.finish(operationId,cancelled?'cancelled':unknown?'unknown':'failed',unknown?null:{stopConfirmed:true,possiblyApplied:cancelled&&e?.possiblyApplied===false?false:true,...digest},cancelled&&published?'CANCELLED':unknown?'OUTCOME_UNKNOWN':e instanceof AgentError?e.code:'EXECUTION_FAILED')\n       }\n       finally{this.jobs.delete(operationId);this.processes.delete(operationId);this.cancelRequested.delete(operationId)}\n       // This independent receipt is written only by the settled in-process\n       // chain, never reconstructed from raw stopConfirmed/notStarted flags.\n       const operation=this.store.status(operationId,c)\n       if(['succeeded','failed','cancelled'].includes(operation.status)){\n        const proof={schemaVersion:1,kind:'agent-stop-receipt',source:'in-process-write',machineId:this.store.machineId,taskId:c.taskId,attemptId:c.attemptId,operationId,tool:'fs_write',status:operation.status,receiptHash:sha(canonical(operation))}\n        this.store.db.prepare('INSERT OR REPLACE INTO agent_stop_receipts VALUES(?,?)').run(operationId,canonical(proof))\n       }\n       return this.operationStatus(operationId,c)\n      })()\n      this.jobs.set(operationId,job);return job\n    }\n    if(name.startsWith('desktop_')){\n      const controller=new AbortController();let job:Promise<any>\n      const cancel=async(why:string)=>{controller.abort(new AgentError(why));await this.desktop.cancel(c);await job}\n      job=(async()=>{\n        try{const result=await this.execute(name,args,c,controller.signal);this.store.validate(c);if(controller.signal.aborted){const stop=await this.desktop.cancel(c);throw Object.assign(new AgentError(stop.stopConfirmed?'DESKTOP_CANCELLED':'OUTCOME_UNKNOWN'),{stopConfirmed:stop.stopConfirmed,possiblyApplied:name!=='desktop_screenshot'})}this.store.finish(operationId,'succeeded',result)}\n        catch(e:any){\n          if(e.code==='GRANT_REVOKED'){controller.abort(e);const stop=await this.desktop.cancel(c);e=Object.assign(new AgentError(stop.stopConfirmed?'DESKTOP_CANCELLED':'OUTCOME_UNKNOWN'),{stopConfirmed:stop.stopConfirmed,possiblyApplied:name!=='desktop_screenshot'})}\n          const code=e instanceof AgentError?e.code:'EXECUTION_FAILED',stopped=e.stopConfirmed===true,possiblyApplied=e.possiblyApplied===true\n          const state=code==='DESKTOP_CANCELLED'&&stopped?'cancelled':code==='OUTCOME_UNKNOWN'||possiblyApplied?'unknown':'failed'\n          this.store.finish(operationId,state,{stopConfirmed:stopped,possiblyApplied,cancelReason:controller.signal.aborted?(controller.signal.reason?.code??'CANCELLED'):null},code)\n        }finally{this.desktopJobs.delete(operationId);this.jobs.delete(operationId)}\n        return this.store.status(operationId,c)\n      })()\n      this.jobs.set(operationId,job);this.desktopJobs.set(operationId,{context:c,cancel});return job\n    }\n    try{const result=await this.execute(name,args,c);this.store.finish(operationId,'succeeded',result)}catch(e){this.store.finish(operationId,e instanceof AgentError&&e.code==='OUTCOME_UNKNOWN'?'unknown':'failed',null,e instanceof AgentError?e.code:'EXECUTION_FAILED')}\n    return this.store.status(operationId,c)\n  }\n  private operationStatus(id:string,c:Context){\n    const operation=this.store.status(id,c),saved=this.store.db.prepare('SELECT proof FROM agent_stop_receipts WHERE operation_id=?').get(id)\n    if(!saved||this.jobs.has(id)||this.processes.has(id))return operation\n    const proof=JSON.parse(saved.proof)\n    if(proof.schemaVersion!==1||proof.kind!=='agent-stop-receipt'||proof.source!=='in-process-write'||proof.machineId!==operation.machineId||proof.taskId!==c.taskId||proof.attemptId!==c.attemptId||proof.operationId!==id||proof.tool!==operation.tool||proof.status!==operation.status||proof.receiptHash!==sha(canonical(operation)))return operation\n    return {...operation,stopProof:proof}\n  }\n  async artifact(data:Buffer,c:Context,media='application/octet-stream'){\n    if(data.length>8*1024*1024)fail('ARTIFACT_LIMIT',413)\n    // Artifacts are delivery objects (one screenshot, one stream tail), not history. Without a\n    // sweep the quota is a one-way stop: every later screenshot and command would fail\n    // ARTIFACT_QUOTA with nothing able to free space. The oldest rows go first, and only when\n    // the new artifact would not fit.\n    const usage=await this.evictArtifacts(data.length)\n    if(usage+data.length>ARTIFACT_QUOTA_BYTES)fail('ARTIFACT_QUOTA',507)\n    const id=`artifact-${randomUUID()}`;await mkdir(join(this.config.dataDir,'artifacts'),{recursive:true,mode:0o700});await writeFile(join(this.config.dataDir,'artifacts',id),data,{flag:'wx',mode:0o600})\n    this.store.db.prepare('INSERT INTO artifacts VALUES (?,?,?,?,?)').run(id,canonical(c),sha(data),data.length,media);return {artifactId:id,sha256:sha(data),size:data.length,mediaType:media}\n  }\n  private async evictArtifacts(needed:number){\n    let usage:number=this.store.db.prepare('SELECT coalesce(sum(size),0) AS size FROM artifacts').get().size\n    if(usage+needed<=ARTIFACT_QUOTA_BYTES)return usage\n    const rows:any[]=this.store.db.prepare('SELECT id,size FROM artifacts ORDER BY rowid ASC').all()\n    for(const row of rows){\n      if(usage+needed<=ARTIFACT_QUOTA_BYTES)break\n      this.store.db.prepare('DELETE FROM artifacts WHERE id=?').run(row.id)\n      usage-=row.size\n      await unlink(join(this.config.dataDir,'artifacts',row.id)).catch(()=>{})\n    }\n    return usage\n  }\n  async execute(name:string,a:any,c:Context,signal?:AbortSignal,pin?:WorkspacePin):Promise<any>{\n    if(name==='fs_list'){const all=await this.roots.list(a.rootId,a.relativePath??'');all.sort((x,y)=>x.name.localeCompare(y.name));const offset=integer(a.cursor?Number(a.cursor):0,0,1e9),limit=integer(a.limit,1,1000,100);return {entries:all.slice(offset,offset+limit).map(x=>({name:x.name,type:x.isSymbolicLink()?'link':x.isDirectory()?'directory':'file'})),cursor:offset+limit<all.length?String(offset+limit):null}}\n    if(name==='fs_read'){const offset=integer(a.offset,0,Number.MAX_SAFE_INTEGER,0),length=integer(a.length,1,1048576,65536);const {data,size}=await this.roots.read(a.rootId,a.relativePath,offset,length);return {encoding:'base64',content:data.toString('base64'),sha256:sha(data),offset,size,eof:offset+data.length>=size}}\n    if(name==='fs_write')return this.write(a,c,signal,pin)\n    if(name.startsWith('artifact_')){const row=this.store.db.prepare('SELECT * FROM artifacts WHERE id=?').get(a.artifactId);if(!row)fail('ARTIFACT_NOT_FOUND',404);this.store.own(row.context,c);if(name==='artifact_stat')return {artifactId:row.id,sha256:row.hash,size:row.size,mediaType:row.media};const offset=integer(a.offset,0,Number.MAX_SAFE_INTEGER,0),length=integer(a.length,1,1048576,65536),data=await readFile(join(this.config.dataDir,'artifacts',row.id));if(sha(data)!==row.hash)fail('ARTIFACT_CORRUPT');return {encoding:'base64',content:data.subarray(offset,offset+length).toString('base64'),eof:offset+length>=row.size}}\n    if(name.startsWith('browser_'))return this.browser.run(name,a,c)\n    if(name.startsWith('desktop_')){const result=await this.desktop.run(name,a,c,signal);this.store.validate(c);if(result.pngBase64){const artifact=await this.artifact(Buffer.from(result.pngBase64,'base64'),c,'image/png');delete result.pngBase64;return {...result,...artifact}}return result}\n    if(name.startsWith('worktree_'))return this.worktree(name,a,c)\n    fail('TOOL_NOT_READY',503)\n  }\n  private async withWorkspace(rootId:string,c:Context,id:string,run:(pin:WorkspacePin)=>Promise<any>){\n    if(typeof rootId!=='string'||!c.roots.includes(rootId))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    const pin=await WorkspacePin.capture(await this.roots.resolve(rootId,''))\n    try{\n     const legacy=this.store.db.prepare(`SELECT o.id FROM workspace_legacy_fences f JOIN operations o ON o.id=f.operation_id WHERE o.status IN ('admitted','running','cancel_pending','unknown') OR (o.tool='shell_exec' AND NOT (o.status IN ('succeeded','failed','cancelled') AND (coalesce(json_type(o.result,'$.stopConfirmed'),'null')='true' OR coalesce(json_type(o.result,'$.notStarted'),'null')='true'))) LIMIT 1`).get()\n     if(legacy)fail('WORKSPACE_RECOVERY_REQUIRED',409)\n     // Same fail-closed contract for admissions that predate the current\n     // roots configuration: until the fenced operation settles with stop\n     // evidence, no mutating workspace operation interprets persisted state.\n     const generationFenced=this.store.db.prepare(`SELECT o.id FROM workspace_generation_fences f JOIN operations o ON o.id=f.operation_id WHERE o.status IN ('admitted','running','cancel_pending','unknown') OR (o.tool='shell_exec' AND NOT (o.status IN ('succeeded','failed','cancelled') AND (coalesce(json_type(o.result,'$.stopConfirmed'),'null')='true' OR coalesce(json_type(o.result,'$.notStarted'),'null')='true'))) LIMIT 1`).get()\n     if(generationFenced)fail('WORKSPACE_RECOVERY_REQUIRED',409)\n     this.workspaces.admit(id,c,pin.identity);await pin.verify();return await run(pin)\n    }finally{await pin.close()}\n  }\n  async write(a:any,c:Context,signal?:AbortSignal,pin?:WorkspacePin){\n    if(signal?.aborted)throw Object.assign(new AgentError('WRITE_CANCELLED',409),{possiblyApplied:false})\n    if(!Object.hasOwn(a,'expectedHash')||(a.expectedHash!==null&&!/^[a-f0-9]{64}$/.test(a.expectedHash)))fail('EXPECTED_HASH_REQUIRED')\n    if(typeof a.content!=='string'||Buffer.byteLength(a.content)>1048576||!['utf8','base64',undefined].includes(a.encoding))fail('INVALID_ARGUMENT')\n    const target=await this.roots.resolve(a.rootId,a.relativePath,true);if(this.writes.has(target))fail('FILE_CHANGED',409);this.writes.add(target)\n    try{\n      if(pinnedWriteSupported())return await this.pinnedWrite(a,c,signal,target,pin)\n      return await this.legacyWrite(a,c,signal,target)\n    }finally{this.writes.delete(target)}\n  }\n  /**\n   * Descriptor-pinned publication for Linux: only brand-new files. Every\n   * existing target answers the public FILE_CHANGED contract, an explicit\n   * hash-overwrite request is refused outright instead of falling back to the\n   * rename path, and a missing target keeps the old mismatch answer.\n   */\n  private async pinnedWrite(a:any,c:Context,signal:AbortSignal|undefined,target:string,pin?:WorkspacePin){\n    if(a.expectedHash!==null){\n      // Only a matching hash is an actual overwrite attempt (refused); a\n      // mismatched expectation and a missing target keep the public CAS\n      // refusal contract instead of reading as \"unsupported\".\n      try{const data=(await this.roots.read(a.rootId,a.relativePath,0,1048577)).data;if(data.length>1048576)fail('FILE_TOO_LARGE');fail(sha(data)===a.expectedHash?'OVERWRITE_UNSUPPORTED':'FILE_CHANGED',sha(data)===a.expectedHash?501:409)}\n      catch(e:any){if(e.code!=='ENOENT')throw e;fail('FILE_CHANGED',409)}\n    }\n    try{\n      const result=await pinnedCreateNewFile({\n        rootPath:pin?pin.identity.path:await realpath(await this.roots.resolve(a.rootId,'')),\n        relativePath:a.relativePath,content:a.content,encoding:a.encoding,signal,\n        check:report=>this.pinnedWritePolicy(a,c,pin,report)})\n      return {sha256:result.sha256,size:result.size}\n    }catch(e:any){\n      if(e instanceof AgentError&&e.code==='TARGET_EXISTS')fail('FILE_CHANGED',409)\n      throw e\n    }\n  }\n  /** Grant, protected-path and root-identity rechecks at every pinned-write phase. */\n  protected async pinnedWritePolicy(a:any,c:Context,pin:WorkspacePin|undefined,report:{phase:string;targetPath:string}){\n    this.store.validate(c)\n    await this.roots.assertPublicTree(report.targetPath)\n    if(pin)await pin.verify()\n  }\n  private async legacyWrite(a:any,c:Context,signal:AbortSignal|undefined,target:string){\n    const temp=join(dirname(target),`.dsh-write-${randomUUID()}`)\n    try{const parent=await stat(dirname(target));let previous:Buffer|null=null;try{previous=(await this.roots.read(a.rootId,a.relativePath,0,1048577)).data;if(previous.length>1048576)fail('FILE_TOO_LARGE')}catch(e:any){if(e.code!=='ENOENT')throw e}\n      if((previous===null?null:sha(previous))!==a.expectedHash)fail('FILE_CHANGED',409)\n      const data=Buffer.from(a.content,a.encoding??'utf8');await writeFile(temp,data,{flag:'wx',mode:0o600})\n      if(signal?.aborted)throw Object.assign(new AgentError('WRITE_CANCELLED',409),{possiblyApplied:false})\n      this.store.validate(c);await this.roots.resolve(a.rootId,a.relativePath,true);const now=await stat(dirname(target));if(now.ino!==parent.ino||now.dev!==parent.dev)fail('FILE_CHANGED',409)\n      let current:Buffer|null=null;try{current=(await this.roots.read(a.rootId,a.relativePath,0,1048577)).data}catch(e:any){if(e.code!=='ENOENT')throw e}\n      if((current===null?null:sha(current))!==a.expectedHash)fail('FILE_CHANGED',409)\n      if(signal?.aborted)throw Object.assign(new AgentError('WRITE_CANCELLED',409),{possiblyApplied:false})\n      await rename(temp,target);return {sha256:sha(data),size:data.length}\n    }finally{await unlink(temp).catch(()=>{})}\n  }\n  async shell(a:any,c:Context,id:string){\n    if(!a.workspaceRef||a.workspaceRef.kind!=='remote'||a.workspaceRef.machineId!==this.store.machineId||!c.roots.includes(a.workspaceRef.rootId))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    const cwd=await this.roots.resolve(a.workspaceRef.rootId,a.workspaceRef.relativePath??'');if(!(await stat(cwd)).isDirectory())fail('WORKSPACE_OUTSIDE_SCOPE')\n    const timeout=integer(a.timeoutMs,1,1800000,60000);let executable:string,argv:string[]\n    if(this.container){\n      if(a.argv){if(!Array.isArray(a.argv)||a.argv.length<1||a.argv.length>256||a.argv.some((x:any)=>typeof x!=='string'||x.includes('\\0')))fail('INVALID_ARGUMENT');executable=this.config.container!.executables[a.argv[0]];if(!executable)fail('EXECUTABLE_NOT_ALLOWED',403);argv=a.argv.slice(1)}\n      else{if(this.config.container!.shell!==true||typeof a.script!=='string'||a.script.length>1048576)fail('SCRIPT_NOT_ALLOWED',403);executable='/bin/sh';argv=['-c',a.script]}\n      const pin=await WorkspacePin.capture(cwd)\n      try{\n       await this.roots.assertContainerTree(pin.scanPath)\n       this.processes.set(id,{context:c,cancel:(why:string)=>this.container!.cancel(id,c,why)})\n       await this.container.run({id,c,rootId:a.workspaceRef.rootId,workspace:pin.identity.path,workspaceIdentity:pin.mountIdentity,executable,argv,timeout,validate:()=>this.store.validate(c),validateWorkspace:()=>pin.verify(),shouldCancel:()=>this.cancelRequested.has(id),artifact:(data,context)=>this.artifact(data,context,'text/plain')})\n      }finally{this.processes.delete(id);await pin.close()}\n      return\n    }\n    if(a.argv){if(!Array.isArray(a.argv)||a.argv.length<1||a.argv.length>256||a.argv.some((x:any)=>typeof x!=='string'||x.includes('\\0')))fail('INVALID_ARGUMENT');executable=this.config.executables?.[a.argv[0]];if(!executable)fail('EXECUTABLE_NOT_ALLOWED',403);argv=a.argv.slice(1)}\n    else {if(!this.config.shell||typeof a.script!=='string'||a.script.length>1048576)fail('SCRIPT_NOT_ALLOWED',403);executable=this.config.shell;argv=process.platform==='win32'?['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',Buffer.from(a.script,'utf16le').toString('base64')]:['-c',a.script]}\n    this.store.validate(c);if(this.cancelRequested.has(id)){this.store.finish(id,'cancelled',null,'CANCELLED');return}\n    if(process.platform==='win32'&&!this.config.windowsJobRunner)fail('PROCESS_ISOLATION_UNAVAILABLE',503)\n    const child=spawn(process.platform==='win32'?this.config.windowsJobRunner!:executable,process.platform==='win32'?[]:argv,{cwd,windowsHide:true,detached:process.platform!=='win32',env:{PATH:process.env.PATH??'',SystemRoot:process.env.SystemRoot??'',TEMP:process.env.TEMP??'',TMP:process.env.TMP??'',LANG:'C.UTF-8'},stdio:['pipe','pipe','pipe']})\n    if(process.platform==='win32')child.stdin.end(JSON.stringify({executable,args:argv,cwd})+'\\n');else child.stdin.end()\n    child.stdin.on('error',()=>{})\n    let stdout:Buffer[]=[],stderr:Buffer[]=[],bytes=0,truncated=false,reason:string|null=null,cancelPromise:Promise<void>|null=null\n    const capture=(target:Buffer[]) => (chunk:Buffer)=>{const remaining=8*1024*1024-bytes;if(remaining>0){target.push(chunk.subarray(0,remaining));bytes+=Math.min(remaining,chunk.length)}if(chunk.length>remaining)truncated=true}\n    child.stdout.on('data',capture(stdout));child.stderr.on('data',capture(stderr))\n    const cancel=(why:string)=>{if(cancelPromise)return cancelPromise;reason=why;cancelPromise=(async()=>{if(child.exitCode!==null||child.signalCode!==null)return\n      if(process.platform==='win32'){if(!child.kill('SIGKILL')&&child.exitCode===null&&child.signalCode===null)this.store.db.prepare(\"UPDATE operations SET status='cancel_pending',error='CANCEL_PENDING' WHERE id=?\").run(id)}\n      else {try{process.kill(-child.pid!,'SIGTERM')}catch{}await new Promise(r=>setTimeout(r,200));try{process.kill(-child.pid!,'SIGKILL')}catch{}}\n    })();return cancelPromise}\n    this.processes.set(id,{child,context:c,cancel});const timer=setTimeout(()=>void cancel('PROCESS_TIMEOUT'),timeout)\n    try{const exit=await new Promise<any>((resolve,reject)=>{child.once('error',reject);child.once('close',(code,signal)=>resolve({exitCode:code,signal}))});await cancelPromise\n      const out=await this.artifact(Buffer.concat(stdout),c,'text/plain'),err=await this.artifact(Buffer.concat(stderr),c,'text/plain')\n      this.store.finish(id,reason==='CANCELLED'?'cancelled':reason?'failed':exit.exitCode===0?'succeeded':'failed',{...exit,stdoutArtifactId:out.artifactId,stderrArtifactId:err.artifactId,truncated},reason??(exit.exitCode===0?null:'PROCESS_EXIT_NONZERO'))\n    }finally{clearTimeout(timer);this.processes.delete(id)}\n  }\n  async git(cwd:string,args:string[]){return (await execFileAsync('git',['-c','core.hooksPath=/dev/null',...args],{cwd,timeout:60000,maxBuffer:8*1024*1024,windowsHide:true,env:{...process.env,GIT_CONFIG_GLOBAL:process.platform==='win32'?'NUL':'/dev/null',GIT_CONFIG_NOSYSTEM:'1',GIT_TERMINAL_PROMPT:'0'}})).stdout.trim()}\n  async worktree(name:string,a:any,c:Context){\n    // Git can execute repository-configured helpers. Container mode must never\n    // cross back into the Agent's native account through a worktree tool.\n    if(this.container)fail('CONTAINER_TOOL_UNAVAILABLE',503)\n    if(name==='worktree_create'){\n      const source=await this.roots.resolve(a.rootId,a.relativePath??'');await this.roots.assertPublicTree(source);if(await this.git(source,['status','--porcelain']))fail('WORKSPACE_DIRTY',409)\n      const head=await this.git(source,['rev-parse','HEAD']);const id=`worktree-${randomUUID()}`,relative=a.worktreeRelativePath\n      if(typeof relative!=='string')fail('INVALID_ARGUMENT');const target=await this.roots.resolve(a.rootId,relative,true);if(target===source||this.roots.inside(source,target))fail('INVALID_WORKTREE_PATH')\n      this.store.validate(c);await this.git(source,['worktree','add','--detach',target,head]);this.store.db.prepare('INSERT INTO worktrees VALUES (?,?,?,?,?,?)').run(id,canonical(c),a.rootId,target,head,source);return {worktreeId:id,rootId:a.rootId,relativePath:relative,sourceHead:head}\n    }\n    const row=this.store.db.prepare('SELECT * FROM worktrees WHERE id=?').get(a.worktreeId);if(!row)fail('WORKTREE_NOT_FOUND',404);this.store.own(row.context,c);if(!c.roots.includes(row.root))fail('SCOPE_DENIED',403)\n    const base=await realpath(this.config.roots[row.root]);for(const p of [row.path,row.source]){if(!this.roots.inside(base,await realpath(p)))fail('WORKSPACE_OUTSIDE_SCOPE',403);await this.roots.assertPublicTree(p)}\n    const patch=await this.git(row.path,['diff','--binary',row.head]);if(name==='worktree_diff')return {sourceHead:row.head,...await this.artifact(Buffer.from(patch+'\\n'),c,'text/x-diff')}\n    if(await this.git(row.path,['rev-parse','HEAD'])!==row.head||await this.git(row.source,['rev-parse','HEAD'])!==row.head||await this.git(row.source,['status','--porcelain']))return {status:'integration-pending',reason:'SOURCE_CHANGED',worktreeId:a.worktreeId}\n    const patchFile=join(this.config.dataDir,`patch-${randomUUID()}`);await writeFile(patchFile,patch+'\\n',{mode:0o600})\n    try{if(!patch)return {status:'no-changes'};await this.git(row.source,['apply','--check',patchFile]);this.store.validate(c);await this.git(row.source,['apply',patchFile]);return {status:'integrated',sourceHead:row.head,patchSha256:sha(patch)}}catch(e){if(e instanceof AgentError)throw e;return {status:'integration-pending',reason:'PATCH_CONFLICT',worktreeId:a.worktreeId}}finally{await unlink(patchFile)}\n  }\n  async close(){clearInterval(this.authTimer);const sessions=await this.desktopSessions.close();for(const id of this.jobs.keys())this.cancelRequested.add(id);await Promise.all([...this.processes.values(),...this.desktopJobs.values()].map(p=>p.cancel('CANCELLED')));await this.container?.close();const desktop=await this.desktop.close();await Promise.all([...this.jobs.values()]);await this.browser.close();this.store.close();return {desktopStopConfirmed:desktop.stopConfirmed&&sessions.stopConfirmed}}\n}\n", "import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'\nexport const AGENT_VERSION = '0.1.1'\nexport const AGENT_API_MAJOR = 1\nexport class AgentError extends Error { constructor(public code:string, public status=400) { super(code) } }\nexport const fail = (code:string,status=400):never => { throw new AgentError(code,status) }\nexport const secret = () => randomBytes(32).toString('base64url')\nexport const sha = (value:string|Buffer) => createHash('sha256').update(value).digest('hex')\nexport const matches = (value:string, digest:string) => { const a=Buffer.from(sha(value),'hex'),b=Buffer.from(digest,'hex'); return a.length===b.length && timingSafeEqual(a,b) }\nexport function canonical(v:any):string { if(v===null||typeof v!=='object')return JSON.stringify(v);if(Array.isArray(v))return `[${v.map(canonical).join(',')}]`;return `{${Object.keys(v).sort().map(k=>`${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}` }\nexport function identifier(v:any):string { if(typeof v!=='string'||!/^[-a-zA-Z0-9_.]{1,128}$/.test(v))fail('INVALID_ID');return v }\nexport function integer(v:any,min:number,max:number,defaultValue?:number) { const n=v??defaultValue;if(!Number.isSafeInteger(n)||n<min||n>max)fail('INVALID_ARGUMENT');return n }\nexport type Context = {clientId:string;botId:string;taskId:string;attemptId:string;roots:string[];tools:string[];expiresAt:number;revision:number;grantId:string}\nexport const CATALOG = Object.freeze([\n  ['machine_ping',false],['fs_list',false],['fs_read',false],['fs_write',true],['shell_exec',true],\n  // Versioned container-command Task backend. A distinct name means an older\n  // Agent answers before any work instead of silently running a native shell.\n  ['container_command_v1',true],\n  ['cli_probe_v1',false],['cli_task_v1',true],\n  ['operation_status',false],['operation_cancel',true],['artifact_stat',false],['artifact_read',false],\n  ['worktree_create',true],['worktree_diff',false],['worktree_integrate',true],\n  ['browser_open',true],['browser_snapshot',false],['browser_click',true],['browser_type',true],['browser_script',true],['browser_upload',true],['browser_download',true],['browser_close',true],\n  ['desktop_screenshot',true],['desktop_click',true],['desktop_type',true],['desktop_key',true],['desktop_scroll',true],\n].map(([name,mutating])=>({name:String(name),mutating:Boolean(mutating),inputSchema:{type:'object',additionalProperties:true}})))\nexport const TOOL_NAMES = CATALOG.map(x=>x.name)\nexport const isMutating = (name:string) => CATALOG.find(x=>x.name===name)?.mutating??false\n", "import { mkdirSync, openSync, readFileSync, writeFileSync, closeSync, unlinkSync, chmodSync, fstatSync, lstatSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { createRequire } from 'node:module'\nimport { randomUUID } from 'node:crypto'\nimport { canonical, fail, identifier, matches, secret, sha, TOOL_NAMES, type Context } from './protocol.js'\nexport class Store {\n  db:any;machineId:string;private lockFd:number|undefined;private lockPath:string;private controllerGuard:any;private closed=false;private admin=false\n  constructor(public dataDir:string,Database?:any,options:{admin?:boolean}={}) {\n    this.admin=options.admin===true\n    mkdirSync(dataDir,{recursive:true,mode:0o700});chmodSync(dataDir,0o700)\n    this.lockPath=join(dataDir,'agent.lock')\n    try {\n    const Driver=Database??createRequire(import.meta.url)('better-sqlite3')\n    if(!options.admin){\n      // A lifetime transaction in a separate private file is a kernel-held\n      // semaphore. Stale PID readers cannot unlink each other's new ownership.\n      const guardPath=join(dataDir,'agent-instance.sqlite')\n      try{const s=lstatSync(guardPath);if(!s.isFile()||s.isSymbolicLink()||s.nlink!==1)fail('AGENT_LOCKED')}catch(e:any){if(e.code!=='ENOENT')throw e}\n      this.controllerGuard=new Driver(guardPath)\n      this.controllerGuard.pragma('busy_timeout = 0')\n      try{this.controllerGuard.exec('BEGIN IMMEDIATE')}catch(e:any){if(e.code?.startsWith('SQLITE_BUSY')||e.code?.startsWith('SQLITE_LOCKED'))fail('AGENT_LOCKED');throw e}\n      try {this.lockFd=openSync(this.lockPath,'wx',0o600)} catch {\n      let old:any;try{old=JSON.parse(readFileSync(this.lockPath,'utf8'))}catch{fail('AGENT_LOCKED')}\n      if(!Number.isSafeInteger(old?.pid)||old.pid<=0||typeof old.instanceId!=='string'||!old.instanceId)fail('AGENT_LOCKED')\n      try{process.kill(old.pid,0);fail('AGENT_LOCKED')}catch(e:any){if(e.code!=='ESRCH')throw e}\n      unlinkSync(this.lockPath);this.lockFd=openSync(this.lockPath,'wx',0o600)\n    }\n    writeFileSync(this.lockFd!,JSON.stringify({pid:process.pid,instanceId:randomUUID()}))}\n      this.db=new Driver(join(dataDir,'agent.sqlite'))\n      this.db.pragma('journal_mode = WAL');this.db.pragma('synchronous = FULL');this.db.pragma('busy_timeout = 5000')\n      this.db.exec(`CREATE TABLE IF NOT EXISTS meta(key TEXT PRIMARY KEY,value TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS clients(id TEXT PRIMARY KEY,digest TEXT NOT NULL,revision INTEGER NOT NULL,revoked INTEGER NOT NULL,ceiling TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS grants(digest TEXT PRIMARY KEY,context TEXT NOT NULL);\n        CREATE UNIQUE INDEX IF NOT EXISTS grants_identity ON grants(json_extract(context,'$.grantId'));\n        CREATE TABLE IF NOT EXISTS operations(id TEXT PRIMARY KEY,digest TEXT NOT NULL,context TEXT NOT NULL,tool TEXT NOT NULL,status TEXT NOT NULL,started INTEGER NOT NULL,finished INTEGER,result TEXT,error TEXT);\n        CREATE TABLE IF NOT EXISTS artifacts(id TEXT PRIMARY KEY,context TEXT NOT NULL,hash TEXT NOT NULL,size INTEGER NOT NULL,media TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS worktrees(id TEXT PRIMARY KEY,context TEXT NOT NULL,root TEXT NOT NULL,path TEXT NOT NULL,head TEXT NOT NULL,source TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS audit(id INTEGER PRIMARY KEY,time INTEGER NOT NULL,code TEXT NOT NULL,actor TEXT,operation TEXT);`)\n      this.db.prepare('INSERT OR IGNORE INTO meta VALUES (?,?)').run('machineId',`machine-${randomUUID()}`)\n      this.machineId=this.db.prepare('SELECT value FROM meta WHERE key=?').get('machineId').value\n      if(!options.admin)this.db.prepare(\"UPDATE operations SET status='unknown',error='OUTCOME_UNKNOWN' WHERE status IN ('admitted','running','cancel_pending')\").run()\n      // Tickets are process-lifetime credentials; a restart requires explicit reissuance.\n      if(!options.admin)this.db.prepare('DELETE FROM grants').run()\n    } catch(e) {try{this.db?.close()}catch{};this.releaseController();throw e}\n  }\n  private releaseController(){\n    try{\n      if(this.lockFd!==undefined){\n        let same=false;try{const fd=fstatSync(this.lockFd),named=lstatSync(this.lockPath);same=fd.dev===named.dev&&fd.ino===named.ino&&!named.isSymbolicLink()}catch{}\n        closeSync(this.lockFd);this.lockFd=undefined\n        if(same)try{unlinkSync(this.lockPath)}catch(e:any){if(e.code!=='ENOENT')throw e}\n      }\n    }finally{if(this.controllerGuard){try{this.controllerGuard.exec('ROLLBACK')}catch{};this.controllerGuard.close();this.controllerGuard=undefined}}\n  }\n  pair(id:string,ceiling:{botIds?:string[];hostManagedBots?:boolean;roots:string[];tools:string[]}) {\n    identifier(id)\n    if(!ceiling||ceiling.hostManagedBots!==undefined&&typeof ceiling.hostManagedBots!=='boolean'||!Array.isArray(ceiling.botIds??[])||!Array.isArray(ceiling.roots)||!ceiling.roots.length||!Array.isArray(ceiling.tools)||!ceiling.tools.length||ceiling.tools.some(x=>!TOOL_NAMES.includes(x)))fail('INVALID_CEILING')\n    const managed=ceiling.hostManagedBots===true,botIds=ceiling.botIds??[]\n    if(managed&&!this.admin)fail('ADMIN_REQUIRED',403)\n    if(!managed&&!botIds.length)fail('INVALID_CEILING')\n    botIds.forEach(identifier);ceiling.roots.forEach(identifier)\n    const saved={botIds,roots:ceiling.roots,tools:ceiling.tools,...(managed?{hostManagedBots:true}:{})}\n    const token=secret();this.db.prepare('INSERT INTO clients VALUES (?,?,1,0,?)').run(id,sha(token),canonical(saved));return {clientId:id,token,machineId:this.machineId,secretRef:`remote-agent/${this.machineId}/${id}`,hostManagedBots:managed}\n  }\n  client(token:string) {if(typeof token!=='string'||token.length>256)fail('AUTH_INVALID',401);const row=this.db.prepare('SELECT * FROM clients WHERE digest=?').get(sha(token));const verified=matches(token,row?.digest??'0'.repeat(64));if(!verified||!row||row.revoked)fail('AUTH_INVALID',401);return row}\n  rotate(id:string) {const token=secret();if(!this.db.prepare('UPDATE clients SET digest=?,revision=revision+1,revoked=0 WHERE id=?').run(sha(token),identifier(id)).changes)fail('AUTH_INVALID',401);return {clientId:id,token}}\n  revoke(id:string) {this.db.prepare('UPDATE clients SET revoked=1,revision=revision+1 WHERE id=?').run(identifier(id))}\n  private currentClient(client:any){const row=this.db.prepare('SELECT * FROM clients WHERE id=?').get(client?.id);if(!row||row.revoked||row.revision!==client.revision||row.digest!==client.digest)fail('AUTH_INVALID',401);return row}\n  issue(client:any,request:any) {\n    client=this.currentClient(client)\n    const ceiling=JSON.parse(client.ceiling);for(const key of ['botId','taskId','attemptId'])identifier(request[key])\n    if(ceiling.hostManagedBots!==true&&!ceiling.botIds.includes(request.botId)||!Array.isArray(request.roots)||!Array.isArray(request.tools)||request.roots.some((x:string)=>!ceiling.roots.includes(x))||request.tools.some((x:string)=>!ceiling.tools.includes(x)))fail('SCOPE_DENIED',403)\n    const ttl=request.ttlMs??300000;if(!Number.isSafeInteger(ttl)||ttl<1000||ttl>300000)fail('INVALID_ARGUMENT')\n    this.db.prepare(\"DELETE FROM grants WHERE json_extract(context,'$.expiresAt')<=?\").run(Date.now())\n    if(this.db.prepare('SELECT count(*) AS count FROM grants').get().count>=4096)fail('GRANT_LIMIT',429)\n    const context={clientId:client.id,botId:request.botId,taskId:request.taskId,attemptId:request.attemptId,roots:request.roots,tools:request.tools,expiresAt:Date.now()+ttl,revision:client.revision,grantId:randomUUID()}\n    const token=secret();this.db.prepare('INSERT INTO grants VALUES (?,?)').run(sha(token),canonical(context));return {grantToken:token,machineId:this.machineId,agentApiMajor:1,...context}\n  }\n  grant(token:string):Context {if(typeof token!=='string'||token.length>256)fail('AUTH_INVALID',401);const row=this.db.prepare('SELECT digest,context FROM grants WHERE digest=?').get(sha(token));const verified=matches(token,row?.digest??'0'.repeat(64));if(!verified||!row)fail('AUTH_INVALID',401);const context=JSON.parse(row.context);this.validate(context);return context}\n  validate(c:Context) {const row=this.db.prepare('SELECT revision,revoked FROM clients WHERE id=?').get(c.clientId);if(!row||row.revoked||row.revision!==c.revision||c.expiresAt<=Date.now()||!c.grantId||!this.db.prepare(\"SELECT 1 FROM grants WHERE json_extract(context,'$.grantId')=?\").get(c.grantId))fail('GRANT_REVOKED',403)}\n  revokeGrants(client:any,request:any) {\n    client=this.currentClient(client)\n    identifier(request.botId)\n    const ceiling=JSON.parse(client.ceiling);if(ceiling.hostManagedBots!==true&&!ceiling.botIds.includes(request.botId))fail('SCOPE_DENIED',403)\n    // An authenticated Host may revoke its own tickets, never another client's.\n    const result=this.db.prepare(\"DELETE FROM grants WHERE json_extract(context,'$.clientId')=? AND json_extract(context,'$.botId')=?\").run(client.id,request.botId)\n    return {machineId:this.machineId,agentApiMajor:1,revoked:result.changes,botId:request.botId}\n  }\n  admit(id:string,context:Context,tool:string,args:any) {\n    identifier(id);const digest=sha(canonical({clientId:context.clientId,botId:context.botId,taskId:context.taskId,attemptId:context.attemptId,tool,args}))\n    return this.db.transaction(()=>{const row=this.db.prepare('SELECT * FROM operations WHERE id=?').get(id);if(row){if(row.digest!==digest)fail('OPERATION_CONFLICT',409);return {fresh:false,operation:this.decode(row)}}\n      this.db.prepare(\"INSERT INTO operations(id,digest,context,tool,status,started) VALUES (?,?,?,?,'admitted',?)\").run(id,digest,canonical(context),tool,Date.now());return {fresh:true,operation:this.status(id,context)}})()\n  }\n  own(saved:string,c:Context) {const v=JSON.parse(saved);if(v.clientId!==c.clientId||v.botId!==c.botId||v.taskId!==c.taskId||v.attemptId!==c.attemptId)fail('SCOPE_DENIED',403)}\n  status(id:string,c:Context) {const row=this.db.prepare('SELECT * FROM operations WHERE id=?').get(identifier(id));if(!row)fail('OPERATION_NOT_FOUND',404);this.own(row.context,c);return this.decode(row)}\n  decode(row:any) {return {schemaVersion:1,machineId:this.machineId,operationId:row.id,tool:row.tool,status:row.status,startedAt:new Date(row.started).toISOString(),finishedAt:row.finished?new Date(row.finished).toISOString():null,result:row.result?JSON.parse(row.result):null,error:row.error?{code:row.error}:null}}\n  finish(id:string,status:string,result:any=null,error:string|null=null) {this.db.prepare('UPDATE operations SET status=?,result=?,error=?,finished=? WHERE id=?').run(status,result===null?null:canonical(result),error,Date.now(),id)}\n  running(id:string) {this.db.prepare(\"UPDATE operations SET status='running' WHERE id=? AND status='admitted'\").run(id)}\n  audit(code:string,actor:string|null=null,operation:string|null=null){this.db.prepare('INSERT INTO audit(time,code,actor,operation) VALUES (?,?,?,?)').run(Date.now(),code,actor,operation);this.db.prepare('DELETE FROM audit WHERE id < (SELECT max(id)-10000 FROM audit)').run()}\n  close(){if(this.closed)return;this.closed=true;try{this.db.close()}finally{this.releaseController()}}\n}\n", "import { constants, type Stats } from 'node:fs'\nimport { lstat, realpath, open, stat, readdir } from 'node:fs/promises'\nimport path from 'node:path'\nimport { fail } from './protocol.js'\nexport type RootProtection = { protectedPaths?: string[]; identityScanLimit?: number }\nexport class Roots {\n  private protectedPaths: string[]\n  private identityScanLimit: number\n  constructor(public roots:Record<string,string>,options:RootProtection={}){\n    this.protectedPaths=(options.protectedPaths??[]).map(p=>path.resolve(p))\n    this.identityScanLimit=options.identityScanLimit??8192\n    if(!Number.isSafeInteger(this.identityScanLimit)||this.identityScanLimit<1||this.identityScanLimit>65536)throw new Error('Invalid identity scan limit')\n  }\n  inside(base:string,target:string){const rel=path.relative(base,target);return rel===''||(!rel.startsWith(`..${path.sep}`)&&rel!=='..'&&!path.isAbsolute(rel))}\n  private async actual(p:string):Promise<string>{\n    try{return await realpath(p)}catch(e:any){\n      if(e.code!=='ENOENT'&&e.code!=='ENOTDIR')throw e\n      const parent=path.dirname(p);if(parent===p)throw e\n      return path.join(await this.actual(parent),path.basename(p))\n    }\n  }\n  private async reserved(){\n    const entries=new Set<string>(this.protectedPaths)\n    for(const p of this.protectedPaths)entries.add(await this.actual(p))\n    return [...entries]\n  }\n  private identity(s:Stats){return `${s.dev}:${s.ino}`}\n  private async privateIdentity(s:Stats){\n    if(!s.isFile()||s.nlink<2||!this.protectedPaths.length)return false\n    const wanted=this.identity(s),seen=new Set<string>(),stack=[...this.protectedPaths];let count=0\n    while(stack.length){\n      if(++count>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n      const p=stack.pop()!;let item:Stats\n      try{item=await stat(p)}catch(e:any){if(e.code==='ENOENT'||e.code==='ENOTDIR')continue;fail('PRIVATE_PATH_UNVERIFIED',403)}\n      const id=this.identity(item);if(id===wanted)return true\n      if(seen.has(id))continue;seen.add(id)\n      if(item.isDirectory()){\n        let names:string[];try{names=await readdir(p)}catch{fail('PRIVATE_PATH_UNVERIFIED',403)}\n        if(names!.length+count+stack.length>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n        for(const name of names!)stack.push(path.join(p,name))\n      }\n    }\n    return false\n  }\n  private async allowed(target:string,create=false,descriptor?:Stats){\n    const actual=await this.actual(target),reserved=await this.reserved()\n    if(reserved.some(p=>this.inside(p,target)||this.inside(p,actual)||(create&&(this.inside(target,p)||this.inside(actual,p)))))fail('WORKSPACE_PRIVATE_PATH',403)\n    let s=descriptor\n    if(!s)try{s=await stat(target)}catch(e:any){if(e.code!=='ENOENT'&&e.code!=='ENOTDIR')throw e}\n    if(s&&await this.privateIdentity(s))fail('WORKSPACE_PRIVATE_PATH',403)\n  }\n  async assertPublicTree(target:string){await this.allowed(target,true)}\n  async assertContainerTree(target:string){\n    const stack=[target];let count=0\n    while(stack.length){\n      if(++count>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n      const current=stack.pop()!,before=await lstat(current)\n      if(before.isSymbolicLink())fail('WORKSPACE_OUTSIDE_SCOPE',403)\n      await this.allowed(current,true,before)\n      if(before.isDirectory()){\n        const names=await readdir(current)\n        if(names.length+count+stack.length>this.identityScanLimit)fail('PRIVATE_PATH_UNVERIFIED',403)\n        for(const name of names)stack.push(path.join(current,name))\n      }else if(!before.isFile())fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    }\n  }\n  async resolve(rootId:string,relativePath='',create=false) {\n    const configured=Object.hasOwn(this.roots,rootId)?this.roots[rootId]:undefined\n    if(!configured||typeof relativePath!=='string'||relativePath.includes('\\0')||path.isAbsolute(relativePath)||/^[a-zA-Z]:|^[/\\\\]{2}|[:]/.test(relativePath))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    const base=await realpath(configured!);const parts=relativePath.split(/[\\\\/]/).filter(Boolean);if(parts.some(x=>x==='..'||x==='.'||/[. ]$/.test(x)))fail('WORKSPACE_OUTSIDE_SCOPE',403)\n    let target=base\n    for(let i=0;i<parts.length;i++){target=path.join(target,parts[i]);try{const s=await lstat(target);if(s.isSymbolicLink())fail('WORKSPACE_OUTSIDE_SCOPE',403);const actual=await realpath(target);if(!this.inside(base,actual))fail('WORKSPACE_OUTSIDE_SCOPE',403)}catch(e:any){if(e.code==='ENOENT'&&create&&i===parts.length-1)break;throw e}}\n    if(!this.inside(base,target))fail('WORKSPACE_OUTSIDE_SCOPE',403);await this.allowed(target,create);return target\n  }\n  async read(root:string,relative:string,offset:number,length:number) {\n    const target=await this.resolve(root,relative);const handle=await open(target,constants.O_RDONLY|(constants.O_NOFOLLOW??0))\n    try{const before=await handle.stat();if(!before.isFile())fail('NOT_A_FILE');const resolved=await this.resolve(root,relative),after=await stat(resolved);if(before.ino!==after.ino||before.dev!==after.dev)fail('FILE_CHANGED',409)\n      await this.allowed(resolved,false,before)\n      if(process.platform==='linux'){const actual=await realpath(`/proc/self/fd/${handle.fd}`),base=await realpath(this.roots[root]);if(!this.inside(base,actual))fail('WORKSPACE_OUTSIDE_SCOPE',403);await this.allowed(actual,false,before)}\n      const data=Buffer.alloc(Math.min(length,Math.max(0,before.size-offset)));const {bytesRead}=await handle.read(data,0,data.length,offset);return {data:data.subarray(0,bytesRead),size:before.size}\n    }finally{await handle.close()}\n  }\n  async list(root:string,relative:string){\n    const target=await this.resolve(root,relative),entries=await readdir(target,{withFileTypes:true}),visible=[]\n    for(const entry of entries){\n      try{await this.allowed(path.join(target,entry.name));visible.push(entry)}catch(e:any){\n        if(!['WORKSPACE_PRIVATE_PATH','PRIVATE_PATH_UNVERIFIED'].includes(e.code))throw e\n      }\n    }\n    return visible\n  }\n}\n", "import { randomUUID, createHash } from 'node:crypto'\nimport { access, mkdir, readFile, stat, unlink } from 'node:fs/promises'\nimport { join } from 'node:path'\nimport { fail, sha, type Context } from './protocol.js'\nexport class BrowserTools {\n  private browser:any;private sessions=new Map<string,any>();private profiles=new Map<string,any>()\n  constructor(private origins:string[],private executablePath?:string,private loader=()=>import('playwright'),private profileRoots:Record<string,string>={}){}\n  async probe(){try{await this.loader();if(this.executablePath)await access(this.executablePath);return {status:this.browser?.isConnected()?'ready':'dependency-ready',launchStatus:this.browser?.isConnected()?'verified':'unverified',engine:'chromium',isolation:'browser-context',allowedOrigins:this.origins,persistentProfiles:Object.keys(this.profileRoots).sort()}}catch{return {status:'unavailable',code:'TOOL_NOT_READY'}}}\n  allowed(url:string) {let u:URL;try{u=new URL(url)}catch{fail('URL_OUTSIDE_SCOPE',403)}if(!['http:','https:'].includes(u.protocol)||u.username||u.password||!this.origins.includes(u.origin))fail('URL_OUTSIDE_SCOPE',403)}\n  async run(name:string,a:any,c:Context) {\n    if(name==='browser_open'){\n      this.allowed(a.url);if(this.sessions.size>=16)fail('BROWSER_LIMIT',429)\n      let pw:any;try{pw=await this.loader()}catch{fail('TOOL_NOT_READY',503)}\n      let context,persistent=false,profileId=null\n      if(a.profileId!==undefined){\n        const root=this.profileRoots[a.profileId];if(!root)fail('BROWSER_PROFILE_DENIED',403)\n        const owner=JSON.stringify([c.clientId,c.botId,a.profileId]),key=createHash('sha256').update(owner).digest('hex')\n        try{context=this.profiles.get(key);if(!context){const dataDir=join(root,key);await mkdir(dataDir,{recursive:true,mode:0o700});context=await pw.chromium.launchPersistentContext(dataDir,{headless:true,executablePath:this.executablePath,acceptDownloads:true,serviceWorkers:'block'});this.profiles.set(key,context)}persistent=true;profileId=a.profileId\n        }catch{fail('BROWSER_PROFILE_UNAVAILABLE',503)}\n      }else{\n        try{this.browser??=await pw.chromium.launch({headless:true,executablePath:this.executablePath});context=await this.browser.newContext({acceptDownloads:true,serviceWorkers:'block'})}catch{fail('TOOL_NOT_READY',503)}\n      }\n      await context.route('**/*',async(route:any)=>{try{this.allowed(route.request().url());await route.continue()}catch{await route.abort('blockedbyclient')}})\n      const page=await context.newPage();page.on('popup',(p:any)=>void p.close());const id=`browser-${randomUUID()}`,downloads=new Map()\n      page.on('download',(download:any)=>{const downloadId=`download-${randomUUID()}`;downloads.set(downloadId,{download,path:download.path(),suggestedFilename:download.suggestedFilename()})})\n      this.sessions.set(id,{context,page,owner:JSON.stringify([c.clientId,c.botId,c.taskId,c.attemptId]),revision:null,persistent,profileId,downloads})\n      try{await page.goto(a.url,{waitUntil:'domcontentloaded',timeout:30000});return {browserSessionId:id,url:page.url(),browserVersion:this.browser?.version()??'chromium',persistent,profileId}}catch{this.sessions.delete(id);persistent?await page.close():await context.close();fail('BROWSER_NAVIGATION_FAILED')}\n    }\n    const session=this.sessions.get(a.browserSessionId);if(!session)fail('BROWSER_SESSION_NOT_FOUND',404)\n    if(session.owner!==JSON.stringify([c.clientId,c.botId,c.taskId,c.attemptId]))fail('SCOPE_DENIED',403)\n    if(name==='browser_close'){session.persistent?await session.page.close():await session.context.close();this.sessions.delete(a.browserSessionId);return {closed:true,persistent:session.persistent}}\n    if(name==='browser_download'){\n      const item=session.downloads.get(a.downloadId);if(!item)fail('BROWSER_DOWNLOAD_NOT_FOUND',404)\n      const path=await item.path,info=await stat(path);if(info.size>1048576)fail('BROWSER_DOWNLOAD_TOO_LARGE',413)\n      const data=await readFile(path);await unlink(path);session.downloads.delete(a.downloadId)\n      return {downloadId:a.downloadId,filename:item.suggestedFilename,encoding:'base64',content:data.toString('base64'),sha256:sha(data),size:data.length}\n    }\n    if(name==='browser_script'){\n      if(typeof a.script!=='string'||!a.script.trim()||a.script.length>16384||a.script.includes('\\0'))fail('INVALID_ARGUMENT')\n      let value;try{value=await session.page.evaluate(a.script)}catch{fail('BROWSER_SCRIPT_FAILED',400)}\n      let text;try{text=JSON.stringify(value??null)}catch{fail('BROWSER_SCRIPT_RESULT_LIMIT',413)}\n      if(text.length>100000)fail('BROWSER_SCRIPT_RESULT_LIMIT',413)\n      return {completed:true,url:session.page.url(),result:value??null}\n    }\n    if(name==='browser_snapshot'){\n      session.revision=`snapshot-${randomUUID()}`\n      const nodes=await session.page.locator('a,button,input,textarea,select,[role=\"button\"]').evaluateAll((elements:any[])=>elements.slice(0,300).map((el:any,i:number)=>{el.setAttribute('data-dsh-agent-ref',String(i));return {ref:String(i),tag:el.tagName.toLowerCase(),text:(el.innerText||el.getAttribute('aria-label')||'').slice(0,300)}}))\n      return {browserSessionId:a.browserSessionId,snapshotId:session.revision,url:session.page.url(),text:(await session.page.locator('body').innerText()).slice(0,100000),nodes}\n    }\n    if(a.snapshotId!==session.revision||!/^\\d{1,3}$/.test(a.ref))fail('TARGET_STALE',409)\n    const node=session.page.locator(`[data-dsh-agent-ref=\"${a.ref}\"]`);if(await node.count()!==1)fail('TARGET_STALE',409)\n    session.revision=null\n    if(name==='browser_type'&&(typeof a.text!=='string'||a.text.length>65536))fail('INVALID_ARGUMENT')\n    let upload\n    if(name==='browser_upload'){\n      if(typeof a.filename!=='string'||!a.filename||a.filename.length>128||/[\\0/\\\\]/.test(a.filename)||typeof a.contentBase64!=='string')fail('INVALID_ARGUMENT')\n      const data=Buffer.from(a.contentBase64,'base64');if(data.toString('base64')!==a.contentBase64||data.length>1048576)fail('BROWSER_UPLOAD_LIMIT',413)\n      if(a.mimeType!==undefined&&(typeof a.mimeType!=='string'||!/^[-\\w.+]+\\/[-\\w.+]+$/.test(a.mimeType)))fail('INVALID_ARGUMENT')\n      upload={name:a.filename,mimeType:a.mimeType??'text/plain',buffer:data}\n    }\n    const pendingDownload=name==='browser_click'?session.page.waitForEvent('download',{timeout:1000}).catch(()=>null):null\n    try{if(name==='browser_click')await node.click({timeout:10000})\n      else if(name==='browser_type')await node.fill(a.text,{timeout:10000})\n      else if(name==='browser_upload')await node.setInputFiles(upload,{timeout:10000})\n      else fail('TOOL_NOT_READY',503)\n    }catch{fail('OUTCOME_UNKNOWN',409)}\n    const download=await pendingDownload,downloadId=download?[...session.downloads.entries()].find(([,item])=>item.download===download)?.[0]:undefined\n    return {completed:true,url:session.page.url(),...(downloadId?{downloadId}:{})}\n  }\n  async close(){for(const s of this.sessions.values())s.persistent?await s.page.close():await s.context.close();this.sessions.clear();for(const context of this.profiles.values())await context.close();this.profiles.clear();await this.browser?.close()}\n}\n", "import net from 'node:net'\nimport {readFile} from 'node:fs/promises'\nimport {randomUUID} from 'node:crypto'\nimport {AgentError,fail,sha,canonical,type Context} from './protocol.js'\n\ntype Owner={tag:string;expiresAt:number;helper?:string;token?:string;blocked:boolean;active:number;idleAt:number;uncertain:number;stopAttempts:number;stop?:Promise<boolean>}\ntype Options={connect?:typeof net.createConnection;validate?:(context:Context)=>void;timeoutMs?:number}\nconst error=(code:string,possiblyApplied=false,stopConfirmed=false)=>Object.assign(new AgentError(code,409),{possiblyApplied,stopConfirmed})\n\n/** The native helper is the global arbiter. This client never substitutes a local lock. */\nexport class DesktopTools {\n  private nonce=randomUUID();private owners=new Map<string,Owner>();private closing=new AbortController();private active=new Set<Promise<any>>()\n  constructor(private config?:{pipeName:string;secretFile:string},private options:Options={}){}\n  private tag(c:Context){return sha(canonical({agent:this.nonce,client:c.clientId,bot:c.botId,task:c.taskId,attempt:c.attemptId,revision:c.revision}))}\n  private owner(c:Context){\n    const now=Date.now();for(const [tag,row] of this.owners)if(!row.active&&!row.uncertain&&row.expiresAt+10000<now)this.owners.delete(tag)\n    const tag=this.tag(c);let row=this.owners.get(tag)\n    if(!row){if(this.owners.size>=4096)fail('DESKTOP_LEASE_LIMIT',429);row={tag,expiresAt:c.expiresAt,blocked:false,active:0,idleAt:0,uncertain:0,stopAttempts:0};this.owners.set(tag,row)}\n    row.expiresAt=Math.max(row.expiresAt,c.expiresAt);return row\n  }\n  private async rpc(control:boolean,packet:any,beforeWrite:()=>void=()=>{}){\n    const name=this.config!.pipeName+(control?'-control':'')\n    return new Promise<any>((resolve,reject)=>{\n      const socket=(this.options.connect??net.createConnection)(`\\\\\\\\.\\\\pipe\\\\${name}`),chunks:Buffer[]=[]\n      let bytes=0,sent=false,settled=false\n      const finish=(value:any,e?:any)=>{if(settled)return;settled=true;clearTimeout(timer);socket.destroy();if(e)reject(e);else resolve(value)}\n      const timer=setTimeout(()=>finish(null,error(sent?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',!control&&sent)),this.options.timeoutMs??10000)\n      socket.once('connect',()=>{try{beforeWrite();sent=true;socket.write(JSON.stringify({...packet,protocolVersion:2})+'\\n')}catch(e){finish(null,e)}})\n      socket.on('data',chunk=>{\n        const data=Buffer.isBuffer(chunk)?chunk:Buffer.from(chunk);bytes+=data.length\n        if(bytes>24000000){finish(null,error('OUTCOME_UNKNOWN',!control&&sent));return}\n        chunks.push(data)\n        if(data.includes(10))try{const all=Buffer.concat(chunks),end=all.indexOf(10);if(all.subarray(end+1).toString('utf8').trim())throw Error();finish(JSON.parse(all.subarray(0,end).toString('utf8')))}catch{finish(null,error('OUTCOME_UNKNOWN',!control&&sent))}\n      })\n      socket.once('error',()=>finish(null,error(sent?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',!control&&sent)))\n      socket.once('close',()=>finish(null,error(sent?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',!control&&sent)))\n    })\n  }\n  private checkResponse(result:any,possiblyApplied=false){if(result?.protocolVersion!==2)throw error('DESKTOP_PROTOCOL_UNSUPPORTED',possiblyApplied);return result}\n  private async stop(row:Owner,retry=false):Promise<boolean>{\n    row.blocked=true\n    if(!row.helper||!row.token)return !row.uncertain\n    if(row.stop&&retry){const previous=row.stop,stopped=await previous;if(stopped||row.stopAttempts>=2)return stopped;if(row.stop===previous)row.stop=undefined}\n    if(!row.stop){row.stopAttempts++;row.stop=(async()=>{\n      try{\n        const result=this.checkResponse(await this.rpc(true,{token:row.token,name:'cancel',owner:row.tag,helperInstanceId:row.helper}))\n        const stopped=result.ok===true&&result.result?.helperInstanceId===row.helper&&result.result?.stopConfirmed===true\n        if(stopped){row.uncertain=0;row.idleAt=0}return stopped\n      }catch{return false}\n    })()}\n    return row.stop\n  }\n  async cancel(c:Context){const row=this.owners.get(this.tag(c));return {stopConfirmed:row?await this.stop(row,true):true}}\n  async run(name:string,args:any,c:Context,external?:AbortSignal){\n    if(process.platform!=='win32'&&!this.options.connect||!this.config)fail('DESKTOP_UNAVAILABLE',503)\n    if(!/^dsh-desktop-[-a-zA-Z0-9]{1,64}$/.test(this.config.pipeName))fail('DESKTOP_UNAVAILABLE',503)\n    const row=this.owner(c),signal=AbortSignal.any([this.closing.signal,...(external?[external]:[])])\n    // A stop request fences the owner, but a fresh capture has no side effect and proves the\n    // desktop is reachable under the current grant again. Without this, one cancelled action\n    // would refuse every later desktop call of that Bot chat.\n    if(name==='desktop_screenshot'&&row.blocked&&!this.closing.signal.aborted){row.blocked=false;row.stop=undefined;row.stopAttempts=0}\n    const check=()=>{if(signal.aborted||row.blocked)throw error('DESKTOP_CANCELLED',false,true);if(!Number.isSafeInteger(c.expiresAt)||c.expiresAt<=Date.now())throw error('GRANT_REVOKED');this.options.validate?.(c)}\n    const work=(async()=>{\n      let sent=false,notApplied=false\n      const abort=()=>{void this.stop(row)};signal.addEventListener('abort',abort,{once:true});row.active++\n      try{\n        check();const token=(await readFile(this.config!.secretFile,'utf8')).trim();check()\n        const probe=this.checkResponse(await this.rpc(true,{token,name:'probe'}))\n        if(!probe.ok)throw error(probe.code??'DESKTOP_UNAVAILABLE')\n        if(probe.result?.protocolVersion!==2||!/^[a-f0-9]{32}$/.test(probe.result?.helperInstanceId??''))throw error('DESKTOP_PROTOCOL_UNSUPPORTED')\n        check();row.helper=probe.result.helperInstanceId;row.token=token\n        const response=this.checkResponse(await this.rpc(false,{token,name,args,owner:row.tag,expiresAt:c.expiresAt,helperInstanceId:row.helper},()=>{check();sent=true;row.uncertain++}),true)\n        // Only this acknowledged packet retires its own uncertainty. A failed\n        // later connect must not erase another packet's missing receipt.\n        row.uncertain=Math.max(0,row.uncertain-1)\n        row.idleAt=Date.now()\n        notApplied=response.effect==='not-applied'\n        if(signal.aborted||row.blocked)throw error('DESKTOP_CANCELLED',sent&&!notApplied)\n        this.options.validate?.(c)\n        if(!response.ok)throw error(response.code??'DESKTOP_UNAVAILABLE',response.effect==='possibly-applied',response.stopConfirmed===true)\n        row.idleAt=Date.now();return response.result\n      }catch(e:any){\n        if(e.code==='GRANT_REVOKED')row.blocked=true\n        if(signal.aborted||row.blocked){const stopped=await this.stop(row,true);throw error(stopped?'DESKTOP_CANCELLED':'OUTCOME_UNKNOWN',sent&&!notApplied,stopped)}\n        if(!sent)e.stopConfirmed=true\n        throw e\n      }finally{row.active--;signal.removeEventListener('abort',abort)}\n    })()\n    this.active.add(work)\n    try{return await work}finally{this.active.delete(work)}\n  }\n  async close(){\n    this.closing.abort(error('DESKTOP_HOST_STOPPED'))\n    const relevant=[...this.owners.values()].filter(row=>row.active||row.uncertain||row.idleAt+15000>Date.now())\n    const stopped=await Promise.all(relevant.map(row=>this.stop(row,true)))\n    await Promise.allSettled([...this.active]);return {stopConfirmed:stopped.every(Boolean)}\n  }\n}\n", "import net from 'node:net'\nimport {readFile} from 'node:fs/promises'\nimport {EventEmitter} from 'node:events'\nimport {randomUUID} from 'node:crypto'\nimport type {WebSocket} from 'ws'\nimport {AgentError,canonical,fail,integer,matches,secret,sha,type Context} from './protocol.js'\n\ntype Config={pipeName:string;secretFile:string}\ntype Ack={ok:boolean;code?:string;possiblyApplied?:boolean;stopConfirmed?:boolean;mode?:'watch'|'control';expiresAt?:number}\nexport interface NativeDesktopSession extends EventEmitter {\n  metadata:any\n  request(message:any):Promise<Ack>\n  frame(keyframe?:boolean):void\n  close():Promise<{stopConfirmed:boolean}>\n}\ntype Authority={validate:(context:Context)=>void;audit?:(code:string,actor?:string|null,operation?:string|null)=>void}\nexport type DesktopSessionOptions={nativeFactory?:(config:Config,request:any)=>Promise<NativeDesktopSession>;authTimeoutMs?:number;maxBufferedAmount?:number;sweepMs?:number}\nconst inputTools=['desktop_click','desktop_type','desktop_key','desktop_scroll']\nconst unknown=()=>Object.assign(new AgentError('OUTCOME_UNKNOWN',409),{possiblyApplied:true,stopConfirmed:false})\n// Native Harness has a standard Electron origin that Node's URL serializes as\n// \"null\". Permit this exact origin only when bound to an authenticated ticket;\n// it is not added to the Agent's global HTTP Origin allowlist.\nconst safeOrigin=(value:any)=>{if(value==='dsh-app://app')return value;if(typeof value!=='string')fail('INVALID_ORIGIN');try{const url=new URL(value);if(!['http:','https:'].includes(url.protocol)||url.origin!==value)fail('INVALID_ORIGIN');return value}catch{fail('INVALID_ORIGIN')}}\nconst ownerIdentity=(c:Context)=>canonical({client:c.clientId,bot:c.botId,task:c.taskId,attempt:c.attemptId,revision:c.revision,roots:[...c.roots].sort()})\n\n/** Private native pipe; no helper token or Host grant is sent to the renderer. */\nexport class NativeDesktopPipe extends EventEmitter implements NativeDesktopSession {\n  metadata:any;private frameMetadata:any;private socket:net.Socket;private buffer=Buffer.alloc(0);private nextId=0;private ended=false;private stopConfirmed=false\n  private pending=new Map<number,{resolve:(v:Ack)=>void;reject:(e:any)=>void;timer:ReturnType<typeof setTimeout>}>()\n  private opening=Promise.withResolvers<any>();private openTimer:ReturnType<typeof setTimeout>;private stopping?:Promise<{stopConfirmed:boolean}>\n  private constructor(config:Config,request:any,token:string){\n    super();this.socket=net.createConnection(`\\\\\\\\.\\\\pipe\\\\${config.pipeName}-stream`)\n    this.openTimer=setTimeout(()=>this.finish(new AgentError('DESKTOP_UNAVAILABLE',503)),5000)\n    this.socket.once('connect',()=>this.write({...request,streamVersion:1,token}))\n    this.socket.on('data',chunk=>{try{this.receive(chunk)}catch{this.finish(unknown())}})\n    this.socket.once('error',()=>this.finish(new AgentError(this.metadata?'OUTCOME_UNKNOWN':'DESKTOP_UNAVAILABLE',503)))\n    this.socket.once('close',()=>this.finish(unknown()))\n  }\n  static async open(config:Config,request:any){\n    if(process.platform!=='win32'||!/^dsh-desktop-[-a-zA-Z0-9]{1,64}$/.test(config.pipeName))fail('DESKTOP_UNAVAILABLE',503)\n    const token=(await readFile(config.secretFile,'utf8')).trim(),pipe=new NativeDesktopPipe(config,request,token)\n    await pipe.opening.promise;return pipe\n  }\n  private write(value:any){if(this.ended)throw unknown();const body=Buffer.from(JSON.stringify(value));if(body.length>65535)fail('INPUT_LIMIT');const packet=Buffer.allocUnsafe(body.length+5);packet.writeUInt32LE(body.length+1);packet[4]=74;body.copy(packet,5);this.socket.write(packet)}\n  private receive(chunk:Buffer){\n    this.buffer=Buffer.concat([this.buffer,chunk]);if(this.buffer.length>8388613+65536)throw unknown()\n    while(this.buffer.length>=4){\n      const length=this.buffer.readUInt32LE(0);if(length<1||length>8388609)throw unknown();if(this.buffer.length<length+4)return\n      const tag=this.buffer[4],body=this.buffer.subarray(5,length+4);this.buffer=this.buffer.subarray(length+4)\n      if(tag===70){if(!this.metadata)throw unknown();this.emit('frame',body,this.frameMetadata);continue}\n      if(tag!==74||body.length>65536)throw unknown();const value=JSON.parse(body.toString('utf8'))\n      if(value.t==='opened'){\n        if(this.metadata)throw unknown();if(value.ok!==true){this.finish(new AgentError(value.code??'DESKTOP_UNAVAILABLE',503));return}\n        if(value.streamVersion!==1||!Number.isSafeInteger(value.width)||value.width<1||!Number.isSafeInteger(value.height)||value.height<1||!Array.isArray(value.displays)||typeof value.displayId!=='string')throw unknown()\n        this.metadata=value;clearTimeout(this.openTimer);this.opening.resolve(value)\n      }else if(value.t==='frame-meta'){this.frameMetadata=value}\n      else if(value.t==='ack'){\n        const pending=this.pending.get(value.id);if(!pending)continue;clearTimeout(pending.timer);this.pending.delete(value.id);pending.resolve(value)\n      }else if(value.t==='ended'){this.stopConfirmed=value.stopConfirmed===true;this.emit('ended',{code:value.code??'DESKTOP_STOPPED',stopConfirmed:this.stopConfirmed})}\n      else throw unknown()\n    }\n  }\n  private finish(error:any){\n    if(this.ended)return;this.ended=true;clearTimeout(this.openTimer);this.socket.destroy();this.buffer=Buffer.alloc(0);this.opening.reject(error)\n    for(const row of this.pending.values()){clearTimeout(row.timer);row.reject(unknown())}this.pending.clear();this.emit('ended',{code:error?.code??'DESKTOP_DISCONNECTED',stopConfirmed:this.stopConfirmed})\n  }\n  request(message:any):Promise<Ack>{\n    if(this.ended)return Promise.reject(unknown());if(this.pending.size>=64)return Promise.reject(new AgentError('DESKTOP_INPUT_LIMIT',429))\n    const id=++this.nextId\n    return new Promise((resolve,reject)=>{const timer=setTimeout(()=>{this.pending.delete(id);reject(unknown());this.finish(unknown())},6500);this.pending.set(id,{resolve,reject,timer});try{this.write({...message,id})}catch(e){clearTimeout(timer);this.pending.delete(id);reject(e)}})\n  }\n  frame(keyframe=false){try{this.write({t:'frame',...(keyframe?{keyframe:true}:{})})}catch{this.finish(unknown())}}\n  close(){\n    if(!this.stopping)this.stopping=(async()=>{if(this.ended)return {stopConfirmed:this.stopConfirmed};try{const ack=await this.request({t:'close'});this.stopConfirmed=ack.ok===true&&ack.stopConfirmed===true;return {stopConfirmed:this.stopConfirmed}}catch{return {stopConfirmed:this.stopConfirmed}}finally{this.finish(unknown())}})()\n    return this.stopping\n  }\n}\n\ntype Session={id:string;token:string;digest:string;context:Context;origin?:string;native:NativeDesktopSession;mode:'watch'|'control';requestedControl:boolean;controlAllowed:boolean;socket?:WebSocket;used:boolean;closed:boolean;stopped:boolean;closedAt?:number;stop?:Promise<{stopConfirmed:boolean}>;queue:Promise<any>;queued:number;renewing:boolean;frameTimer?:ReturnType<typeof setTimeout>;ackTimer?:ReturnType<typeof setTimeout>;sending:boolean;lastInputId:number;events:any[];fps:number;profile:number;appliedProfile:number;fastFrames:number;baselineRtt:number;pingTag?:string;pingStarted:number;frameSequence:number;frameRequested:boolean;pendingFrame?:{jpeg:Buffer;metadata:any}}\nconst videoProfiles=[{scalePercent:100,quality:70},{scalePercent:75,quality:60},{scalePercent:60,quality:50},{scalePercent:50,quality:45},{scalePercent:40,quality:35},{scalePercent:35,quality:30}]\n\n/** Process-lifetime, grant-bound capabilities. This object has no model tool route. */\nexport class DesktopSessions {\n  private forceKeyframes=new Set<Session>()\n  private flights=new WeakMap<Session,Map<string,{started:number;keyframe:boolean}>>()\n  private sessions=new Map<string,Session>();private nonce=randomUUID();private closing=false;private timer:ReturnType<typeof setInterval>;private sockets=new Set<WebSocket>();private opening=0\n  constructor(private config:Config|undefined,private authority:Authority,private options:DesktopSessionOptions={}){this.timer=setInterval(()=>void this.sweep(),options.sweepMs??100);this.timer.unref()}\n  private check(c:Context){if(this.closing)fail('DESKTOP_HOST_STOPPED',503);this.authority.validate(c);if(!c.tools.includes('desktop_screenshot'))fail('SCOPE_DENIED',403);if(!Number.isSafeInteger(c.expiresAt)||c.expiresAt<=Date.now())fail('GRANT_REVOKED',403)}\n  private audit(row:Session,kind:string,extra:any={}){row.events.push({at:Date.now(),kind,sessionId:row.id,taskId:row.context.taskId,attemptId:row.context.attemptId,...extra});if(row.events.length>128)row.events.shift();if(!['input','frame-drop'].includes(kind))this.authority.audit?.(`DESKTOP_SESSION_${kind.toUpperCase().replaceAll('-','_')}`,row.context.botId,`${row.context.taskId}/${row.context.attemptId}/${row.id}`)}\n  private ticket(row:Session){return {sessionId:row.id,token:row.token,expiresAt:row.context.expiresAt,path:'/desktop/v1/socket',displayId:row.native.metadata.displayId,displays:row.native.metadata.displays,width:row.native.metadata.width,height:row.native.metadata.height,mode:row.mode,controlAllowed:row.controlAllowed}}\n  private own(c:Context,id:any){this.check(c);const row=this.sessions.get(id);if(!row)fail('DESKTOP_SESSION_NOT_FOUND',404);if(ownerIdentity(c)!==ownerIdentity(row.context))fail('SCOPE_DENIED',403);return row}\n  async open(c:Context,request:any){\n    this.check(c);if(!this.config)fail('DESKTOP_UNAVAILABLE',503)\n    if(!request||typeof request!=='object'||Array.isArray(request)||Object.keys(request).some(k=>!['mode','fps','displayId','origin'].includes(k)))fail('INVALID_ARGUMENT')\n    const mode=request.mode??'watch';if(!['watch','control'].includes(mode))fail('INVALID_ARGUMENT');const fps=integer(request.fps,1,30,15)\n    if(request.displayId!==undefined&&(typeof request.displayId!=='string'||request.displayId.length>128))fail('INVALID_ARGUMENT')\n    const origin=request.origin===undefined?undefined:safeOrigin(request.origin),controlAllowed=inputTools.every(tool=>c.tools.includes(tool))\n    if(mode==='control'&&!controlAllowed)fail('SCOPE_DENIED',403)\n    await this.sweep();if(this.opening+[...this.sessions.values()].filter(s=>!s.closed).length>=4||this.sessions.size>=256)fail('DESKTOP_SESSION_LIMIT',429)\n    const id=`desktop-${randomUUID()}`,token=secret()\n    this.opening++;let native:NativeDesktopSession\n    try{native=await (this.options.nativeFactory??NativeDesktopPipe.open)(this.config,{owner:sha(canonical({agent:this.nonce,session:id,identity:ownerIdentity(c)})),expiresAt:c.expiresAt,fps,controlAllowed,...(request.displayId?{displayId:request.displayId}:{})})}finally{this.opening--}\n    try{this.check(c)}catch(e){await native.close();throw e}\n    const row:Session={id,token,digest:sha(token),context:structuredClone(c),origin,native,mode:'watch',requestedControl:mode==='control',controlAllowed,used:false,closed:false,stopped:false,queue:Promise.resolve(),queued:0,renewing:false,sending:false,lastInputId:0,events:[],fps,profile:0,appliedProfile:0,fastFrames:0,baselineRtt:0,pingStarted:0,frameSequence:0,frameRequested:false}\n    this.sessions.set(id,row);native.on('frame',(jpeg,metadata)=>{row.frameRequested=false;this.frame(row,jpeg,metadata)});native.on('ended',value=>{row.stopped=value.stopConfirmed===true;if(!row.closed){row.closed=true;row.closedAt=Date.now();clearTimeout(row.frameTimer);clearTimeout(row.ackTimer);row.pendingFrame=undefined;this.send(row,{type:'status',status:'disconnected',mode:'watch',code:value.code,stopConfirmed:row.stopped});row.socket?.close(1000,'Desktop session ended');this.audit(row,'ended',{code:value.code,stopConfirmed:row.stopped})}})\n    this.audit(row,'opened');return this.ticket(row)\n  }\n  async renew(c:Context,request:any){\n    const row=this.own(c,request?.sessionId);if(row.closed)fail('DESKTOP_SESSION_CLOSED',409)\n    if(request.origin!==undefined&&safeOrigin(request.origin)!==row.origin)fail('ORIGIN_DENIED',403)\n    if(!row.context.tools.every(tool=>c.tools.includes(tool)))fail('SCOPE_DENIED',403)\n    if(row.renewing)fail('DESKTOP_RENEW_PENDING',409);row.renewing=true\n    try{this.check(c);const ack=await row.native.request({t:'renew',expiresAt:c.expiresAt});if(ack.ok!==true)fail(ack.code??'DESKTOP_RENEW_FAILED',409);this.check(c);if(row.closed)fail('DESKTOP_SESSION_CLOSED',409);row.context=structuredClone(c);this.audit(row,'renewed');return this.ticket(row)}catch(e){await this.stop(row,'DESKTOP_RENEW_FAILED');throw e}finally{row.renewing=false}\n  }\n  async closeSession(c:Context,request:any){const row=this.own(c,request?.sessionId);return this.stop(row,'SESSION_CLOSED')}\n  hasOrigin(origin:string){return [...this.sessions.values()].some(row=>!row.closed&&row.origin===origin&&row.context.expiresAt>Date.now())}\n  private send(row:Session,message:any){if(row.socket?.readyState===1)row.socket.send(JSON.stringify(message))}\n  private nextFrame(row:Session,delay=0){if(row.closed||row.frameRequested||row.pendingFrame||!row.socket||row.socket.readyState!==1)return;clearTimeout(row.frameTimer);row.frameRequested=true;row.frameTimer=setTimeout(()=>void (async()=>{if(row.closed)return;this.check(row.context);if(row.profile!==row.appliedProfile){const ack=await row.native.request({t:'video',...videoProfiles[row.profile]});if(!ack.ok)throw new AgentError(ack.code??'DESKTOP_VIDEO_FAILED');row.appliedProfile=row.profile}if(!row.closed)row.native.frame(this.forceKeyframes.delete(row))})().catch(()=>this.stop(row,'DESKTOP_VIDEO_FAILED')),delay);row.frameTimer.unref()}\n  private framePing(row:Session,baseline=false,sequence=row.frameSequence){\n    if(row.closed||row.socket?.readyState!==1)return\n    const tag=baseline?'baseline':`frame:${sequence}`\n    if(baseline){row.pingTag=tag;row.pingStarted=performance.now()}\n    clearTimeout(row.ackTimer);row.ackTimer=setTimeout(()=>void this.stop(row,'DESKTOP_FRAME_ACK_TIMEOUT'),15000);row.ackTimer.unref()\n    row.socket.ping(tag,undefined,error=>{if(error)void this.stop(row,'DESKTOP_DISCONNECTED')})\n  }\n  private frame(row:Session,jpeg:Buffer,metadata?:any){\n    if(row.closed||!row.socket||row.socket.readyState!==1)return\n    try{this.check(row.context)}catch{void this.stop(row,'GRANT_REVOKED');return}\n    const socket=row.socket\n    if(!Buffer.isBuffer(jpeg)||jpeg.length>8388608){void this.stop(row,'CAPTURE_LIMIT');return}\n    const flights=this.flights.get(row)??new Map();this.flights.set(row,flights)\n    // Two small patches can cover a link RTT while a full image stays one-at-a-time.\n    // The pong is beyond that JPEG on the wire; write callbacks alone are not receipt proof.\n    const small=metadata?.region&&metadata.region.width*metadata.region.height<=row.native.metadata.width*row.native.metadata.height*.15&&jpeg.length<=65536\n    if(flights.size>=(small?2:1)){if(row.pendingFrame){this.audit(row,'frame-drop');this.forceKeyframes.add(row)}row.pendingFrame={jpeg,metadata};return}\n    if(socket.bufferedAmount>(this.options.maxBufferedAmount??524288)){this.audit(row,'frame-drop');this.forceKeyframes.add(row);this.nextFrame(row,100);return}\n    row.sending=true;row.pingStarted=performance.now();row.frameSequence++\n    flights.set(`frame:${row.frameSequence}`,{started:row.pingStarted,keyframe:metadata?.keyframe===true})\n    this.send(row,{type:'frame',width:row.native.metadata.width,height:row.native.metadata.height,frameWidth:metadata?.frameWidth??row.native.metadata.width,frameHeight:metadata?.frameHeight??row.native.metadata.height,...(metadata?.region?{region:metadata.region,keyframe:metadata.keyframe===true}:{}),quality:metadata?.quality??70,scalePercent:metadata?.scalePercent??100,sequence:row.frameSequence,captureMs:metadata?.captureMs,encodeMs:metadata?.encodeMs})\n    const sequence=row.frameSequence\n    socket.send(jpeg,{binary:true},error=>{if(error)void this.stop(row,'DESKTOP_DISCONNECTED');else{this.framePing(row,false,sequence);this.nextFrame(row)}})\n  }\n  private enqueue(row:Session,work:()=>Promise<void>){\n    if(row.queued>=64){this.send(row,{type:'error',code:'DESKTOP_INPUT_LIMIT'});return}row.queued++\n    row.queue=row.queue.then(async()=>{if(row.closed)return;try{this.check(row.context);await work()}catch(e:any){this.send(row,{type:'error',code:e?.code??'DESKTOP_SESSION_FAILED'});await this.stop(row,e?.code??'DESKTOP_SESSION_FAILED')}}).finally(()=>row.queued--)\n  }\n  private input(event:any,row:Session){\n    if(!event||typeof event!=='object'||Array.isArray(event))fail('INVALID_ARGUMENT')\n    if(event.type==='pointer'){\n      if(!['move','down','up'].includes(event.action)||!['left','middle','right'].includes(event.button??'left'))fail('INVALID_ARGUMENT')\n      return {kind:'pointer',action:event.action,button:event.button??'left',x:integer(event.x,0,row.native.metadata.width-1),y:integer(event.y,0,row.native.metadata.height-1)}\n    }\n    if(event.type==='key'){if(!['down','up'].includes(event.action)||typeof event.code!=='string'||!event.code||event.code.length>64||typeof event.key!=='string'||event.key.length>64)fail('INVALID_ARGUMENT');return {kind:'key',action:event.action,code:event.code,key:event.key}}\n    if(event.type==='wheel')return {kind:'wheel',deltaX:integer(event.deltaX,-4800,4800),deltaY:integer(event.deltaY,-4800,4800)}\n    if(event.type==='text'){if(typeof event.text!=='string'||event.text.length>8192||/[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f]/.test(event.text))fail('INPUT_LIMIT');return {kind:'text',text:event.text}}\n    fail('INVALID_ARGUMENT')\n  }\n  /** Called only after the HTTP server validates Host/network/TLS on upgrade. */\n  accept(socket:WebSocket,origin?:string,allowedOrigins:string[]=[]){\n    this.sockets.add(socket);let row:Session|undefined,authenticating=false,alive=true\n    const authTimer=setTimeout(()=>socket.close(1008,'Desktop authentication required'),this.options.authTimeoutMs??5000);authTimer.unref()\n    const heartbeat=setInterval(()=>{if(!alive){socket.terminate();return}alive=false;socket.ping()},15000);heartbeat.unref();socket.on('pong',data=>{\n      alive=true;if(!row)return\n      const tag=data.toString(),baseline=tag==='baseline'&&row.pingTag==='baseline'\n      const flights=this.flights.get(row),flight=flights?.get(tag)\n      if(!baseline&&!flight)return\n      clearTimeout(row.ackTimer);const elapsed=performance.now()-(baseline?row.pingStarted:flight!.started)\n      if(baseline){row.pingTag=undefined;row.baselineRtt=elapsed;this.nextFrame(row);return}\n      flights!.delete(tag)\n      row.sending=false;const target=1000/row.fps,transfer=Math.max(1,elapsed-row.baselineRtt)\n      if(!flight!.keyframe&&transfer>target*1.35&&row.profile<videoProfiles.length-1){row.profile=Math.min(videoProfiles.length-1,row.profile+(transfer>target*4?2:1));row.fastFrames=0}\n      else if(transfer<target*.55&&row.profile>0&&++row.fastFrames>=20){row.profile--;row.fastFrames=0}\n      else if(transfer>=target*.55)row.fastFrames=0\n      if(row.pendingFrame){const pending=row.pendingFrame;row.pendingFrame=undefined;this.frame(row,pending.jpeg,pending.metadata)}else this.nextFrame(row)\n    })\n    const reject=(code:string)=>{if(socket.readyState===1)socket.send(JSON.stringify({type:'error',code}));socket.close(1008,code)}\n    socket.on('message',(data,isBinary)=>{\n      let message:any;try{if(isBinary||data.length>65536)fail('INVALID_ARGUMENT');message=JSON.parse(data.toString());if(!message||typeof message!=='object'||Array.isArray(message))fail('INVALID_ARGUMENT')}catch{reject('INVALID_ARGUMENT');return}\n      if(!row){\n        if(authenticating){reject('AUTH_INVALID');return}\n        try{\n          const candidate=this.sessions.get(message.sessionId)\n          if(message.type!=='auth'||typeof message.token!=='string'||!/^[A-Za-z0-9_-]{43}$/.test(message.token)||!candidate||!matches(message.token,candidate.digest))fail('AUTH_INVALID',401)\n          if(candidate.closed||candidate.used)fail('DESKTOP_SESSION_CLOSED',409)\n          this.check(candidate.context)\n          if(origin!==undefined&&(candidate.origin?origin!==candidate.origin:!allowedOrigins.includes(origin)))fail('ORIGIN_DENIED',403)\n          if(candidate.origin&&origin===undefined){/* Trusted Node clients may omit Origin. */}\n          row=candidate;row.used=true;row.socket=socket;authenticating=true;clearTimeout(authTimer)\n          this.enqueue(row,async()=>{\n            if(row!.requestedControl){const ack=await row!.native.request({t:'control',action:'acquire'});if(!ack.ok)fail(ack.code??'CONTROL_NOT_GRANTED',409);row!.mode='control'}\n            const {t,ok,sessionId:physicalSessionId,...metadata}=row!.native.metadata\n            this.send(row!,{...metadata,type:'ready',sessionId:row!.id,nativeSessionId:physicalSessionId,mode:row!.mode,expiresAt:row!.context.expiresAt,controlAllowed:row!.controlAllowed});this.audit(row!,'authenticated');this.framePing(row!,true)\n          })\n        }catch(e:any){reject(e.code??'AUTH_INVALID')}\n        return\n      }\n      const current=row\n      if(message.type==='close'){void this.stop(current,'SESSION_CLOSED');return}\n      this.enqueue(current,async()=>{\n        if(message.type==='control'){\n          if(!['acquire','release'].includes(message.action))fail('INVALID_ARGUMENT')\n          if(message.action==='acquire'&&!current.controlAllowed){this.send(current,{type:'control',mode:'watch',ok:false,code:'SCOPE_DENIED',...(message.id!==undefined?{id:message.id}:{})});return}\n          let ack:Ack\n          try{ack=await current.native.request({t:'control',action:message.action})}catch(e:any){this.send(current,{type:'control',mode:'watch',ok:false,code:e.code??'OUTCOME_UNKNOWN',possiblyApplied:true,...(message.id!==undefined?{id:message.id}:{})});await this.stop(current,'OUTCOME_UNKNOWN');return}\n          if(ack.ok!==true){this.send(current,{type:'control',mode:current.mode,ok:false,code:ack.code??'CONTROL_NOT_GRANTED',...(message.id!==undefined?{id:message.id}:{})});if(message.action==='release')await this.stop(current,'INPUT_RELEASE_UNCONFIRMED');return}\n          current.mode=ack.mode==='control'?'control':'watch';this.send(current,{type:'control',mode:current.mode,ok:true,...(message.id!==undefined?{id:message.id}:{})});this.audit(current,'control',{mode:current.mode})\n        }else if(message.type==='input'){\n          let event:any\n          try{integer(message.id,1,Number.MAX_SAFE_INTEGER);if(message.id<=current.lastInputId)fail('DESKTOP_INPUT_REPLAY',409);current.lastInputId=message.id;if(current.mode!=='control')fail('CONTROL_NOT_GRANTED',403);event=this.input(message.event,current)}catch(e:any){this.send(current,{type:'input',id:message.id,ok:false,code:e.code??'INVALID_ARGUMENT',possiblyApplied:false});return}\n          let ack:Ack;try{ack=await current.native.request({t:'input',...event})}catch(e:any){this.send(current,{type:'input',id:message.id,ok:false,code:e.code??'OUTCOME_UNKNOWN',possiblyApplied:true});await this.stop(current,'OUTCOME_UNKNOWN');return}\n          this.send(current,{type:'input',id:message.id,ok:ack.ok===true,...(ack.ok?{}:{code:ack.code??'INPUT_REJECTED',possiblyApplied:ack.possiblyApplied===true})});this.audit(current,'input',{id:message.id,event:event.kind,ok:ack.ok===true})\n        }else if(message.type==='release-input'){\n          let ack:Ack\n          try{ack=await current.native.request({t:'release-input'})}catch(e:any){this.send(current,{type:'release-input',...(message.id!==undefined?{id:message.id}:{}),ok:false,code:e.code??'OUTCOME_UNKNOWN',possiblyApplied:true});await this.stop(current,'OUTCOME_UNKNOWN');return}\n          this.send(current,{type:'release-input',...(message.id!==undefined?{id:message.id}:{}),ok:ack.ok===true,...(ack.ok?{}:{code:ack.code??'INPUT_RELEASE_UNCONFIRMED',possiblyApplied:true})});this.audit(current,'release-input');if(!ack.ok)await this.stop(current,'INPUT_RELEASE_UNCONFIRMED')\n        }else fail('INVALID_ARGUMENT')\n      })\n    })\n    socket.on('error',()=>{if(row)void this.stop(row,'DESKTOP_DISCONNECTED')})\n    socket.once('close',()=>{clearTimeout(authTimer);clearInterval(heartbeat);this.sockets.delete(socket);if(row)void this.stop(row,'DESKTOP_DISCONNECTED')})\n  }\n  private stop(row:Session,reason:string):Promise<{stopConfirmed:boolean}>{\n    this.forceKeyframes.delete(row)\n    if(row.stop)return row.stop\n    row.closed=true;row.closedAt=Date.now();clearTimeout(row.frameTimer);clearTimeout(row.ackTimer);row.pendingFrame=undefined\n    row.stop=(async()=>{const result=await row.native.close().catch(()=>({stopConfirmed:false}));row.stopped=result.stopConfirmed===true;row.mode='watch';this.send(row,{type:'status',status:'disconnected',mode:'watch',code:reason,stopConfirmed:row.stopped});row.socket?.close(1000,'Desktop session closed');this.audit(row,'closed',{reason,stopConfirmed:row.stopped});return {stopConfirmed:row.stopped}})()\n    return row.stop\n  }\n  async sweep(){\n    const pending:Promise<any>[]=[]\n    for(const [id,row] of this.sessions){\n      if(row.closed){if(row.closedAt!+30000<Date.now())this.sessions.delete(id);continue}\n      if(row.renewing)continue\n      try{this.check(row.context)}catch{pending.push(this.stop(row,'GRANT_REVOKED'))}\n    }\n    await Promise.all(pending)\n  }\n  sessionAudit(c:Context,id:string){return structuredClone(this.own(c,id).events)}\n  async close(){this.closing=true;clearInterval(this.timer);const result=await Promise.all([...this.sessions.values()].map(row=>this.stop(row,'DESKTOP_HOST_STOPPED')));for(const socket of this.sockets)socket.terminate();this.sockets.clear();return {stopConfirmed:result.every(r=>r.stopConfirmed)}}\n}\n", "import {execFile,spawn} from 'node:child_process'\nimport {promisify} from 'node:util'\nimport {mkdir,open,readFile,lstat} from 'node:fs/promises'\nimport {isAbsolute,join} from 'node:path'\nimport {randomUUID} from 'node:crypto'\nimport {AgentError,canonical,fail,sha,type Context} from './protocol.js'\nimport type {Store} from './store.js'\nimport {CONTAINER_SUPERVISOR_SOURCE as supervisorSource} from './container-supervisor.mjs'\nconst control=promisify(execFile)\nexport const CONTAINER_IMAGE='node@sha256:4f77a690f2f8946ab16fe1e791a3ac0667ae1c3575c3e4d0d4589e9ed5bfaf3d'\nexport type ContainerCommandConfig={dockerExecutable:string;image:string;executables:Record<string,string>;shell?:boolean}\nconst object=(x:any)=>x!==null&&typeof x==='object'&&!Array.isArray(x)\nconst terminal=new Set(['succeeded','failed','cancelled'])\nconst env=(directory:string)=>({PATH:'/usr/sbin:/usr/bin:/sbin:/bin',LANG:'C.UTF-8',HOME:'/nonexistent',DOCKER_CONFIG:directory})\nexport function validateContainerCommandConfig(value:ContainerCommandConfig){\n if(process.platform!=='linux')fail('CONTAINER_PLATFORM_UNAVAILABLE',503)\n if(!object(value)||Object.keys(value).some(k=>!['dockerExecutable','image','executables','shell'].includes(k))||typeof value.dockerExecutable!=='string'||!isAbsolute(value.dockerExecutable)||value.dockerExecutable.includes('\\0')||value.image!==CONTAINER_IMAGE||!object(value.executables)||!Object.keys(value.executables).length||Object.entries(value.executables).some(([name,path])=>!/^[-a-z0-9]{1,32}$/.test(name)||typeof path!=='string'||!/^\\/(?:usr\\/local\\/bin|usr\\/bin|bin)\\/[-a-zA-Z0-9_.]+$/.test(path))||value.shell!==undefined&&typeof value.shell!=='boolean')fail('CONTAINER_CONFIG_INVALID')\n return value\n}\nexport function containerArguments({name,nonce,machineId,workspace,workspaceIdentity,config,executable,argv,deadlineAt=Date.now()+60000,supervisorFile='/fixture-supervisor.mjs'}:{name:string;nonce:string;machineId:string;workspace:string;workspaceIdentity:string;config:ContainerCommandConfig;executable:string;argv:string[];deadlineAt?:number;supervisorFile?:string}){\n // Arguments after the immutable image are container argv, never Docker options.\n if(!/^dsh-worker-[a-f0-9]{40}$/.test(name)||!/^[-a-f0-9]{36}$/.test(nonce)||![workspace,supervisorFile].every(p=>typeof p==='string'&&isAbsolute(p)&&!/[\\0,\\r\\n]/.test(p))||typeof workspaceIdentity!=='string'||workspaceIdentity.length>256||!Number.isSafeInteger(deadlineAt)||deadlineAt<=0||argv.some(x=>typeof x!=='string'||x.includes('\\0')))fail('CONTAINER_ARGUMENT_INVALID')\n let identity:any;try{identity=JSON.parse(workspaceIdentity)}catch{fail('CONTAINER_ARGUMENT_INVALID')}\n if(!object(identity)||Object.keys(identity).sort().join(',')!=='birth,dev,ino'||!['dev','ino','birth'].every(k=>typeof identity[k]==='string'&&/^(0|[1-9][0-9]{0,39})$/.test(identity[k]))||identity.ino==='0'||identity.birth==='0')fail('CONTAINER_ARGUMENT_INVALID')\n return ['container','create','--pull=never','--platform','linux/amd64','--name',name,'--label',`dsh.worker.nonce=${nonce}`,'--label',`dsh.worker.machine=${machineId}`,'--network=none','--read-only','--cap-drop=ALL','--cap-add=SETUID','--cap-add=SETGID','--security-opt=no-new-privileges','--user','0:0','--pids-limit=64','--memory=128m','--cpus=0.5','--log-driver=json-file','--log-opt=max-size=8m','--log-opt=max-file=1','--tmpfs','/tmp:rw,noexec,nosuid,size=16m','--mount',`type=bind,src=${workspace},dst=/workspace`,'--mount',`type=bind,src=${supervisorFile},dst=/opt/dsh-supervisor.mjs,readonly`,'--workdir','/workspace','--entrypoint','/usr/local/bin/node',config.image,'/opt/dsh-supervisor.mjs',String(deadlineAt),workspaceIdentity,executable,...argv]\n}\n\n/** Durable original-container controller; status observation never creates work. */\nexport class ContainerCommands {\n private dockerEnv:Record<string,string>;private sessions=new Map<string,{cancel:(why:string)=>Promise<void>}>();private controls=new Map<string,Promise<any>>();private sweeping=false;private closing=false;private sweepCursor=''\n constructor(private store:Store,private config:ContainerCommandConfig){\n  validateContainerCommandConfig(config);this.dockerEnv=env(join(store.dataDir,'docker-client'))\n  store.db.exec(`CREATE TABLE IF NOT EXISTS container_workers(operation_id TEXT PRIMARY KEY,name TEXT NOT NULL UNIQUE,nonce TEXT NOT NULL,context TEXT NOT NULL,root_id TEXT NOT NULL,workspace TEXT NOT NULL,input_digest TEXT NOT NULL,phase TEXT NOT NULL,cid TEXT,reason TEXT)`)\n  if(!store.db.prepare('PRAGMA table_info(container_workers)').all().some((row:any)=>row.name==='workspace_identity'))store.db.exec('ALTER TABLE container_workers ADD COLUMN workspace_identity TEXT')\n }\n private serialized(id:string,fn:()=>Promise<any>){const pending=(this.controls.get(id)??Promise.resolve()).catch(()=>{}).then(fn);this.controls.set(id,pending);return pending.finally(()=>{if(this.controls.get(id)===pending)this.controls.delete(id)})}\n private async supervisor(){\n  const path=join(this.store.dataDir,'container-supervisor-'+sha(supervisorSource)+'.mjs')\n  try{const fd=await open(path,'wx',0o444);try{await fd.writeFile(supervisorSource);await fd.sync()}finally{await fd.close()}}catch(e:any){if(e.code!=='EEXIST')throw e}\n  const info=await lstat(path);if(!info.isFile()||info.isSymbolicLink()||info.nlink!==1||sha(await readFile(path))!==sha(supervisorSource))fail('CONTAINER_SUPERVISOR_CHANGED',503)\n  return path\n }\n private async cli(args:string[],timeout=15000){\n  await mkdir(this.dockerEnv.DOCKER_CONFIG,{recursive:true,mode:0o700})\n  try{return (await control(this.config.dockerExecutable,args,{env:this.dockerEnv,encoding:'utf8',timeout,maxBuffer:10*1024*1024,windowsHide:true})).stdout.trim()}catch{fail('CONTAINER_CONTROL_UNAVAILABLE',503)}\n }\n private row(id:string,c:Context){const row=this.store.db.prepare('SELECT * FROM container_workers WHERE operation_id=?').get(id);if(!row)return null;this.store.own(row.context,c);if(!c.roots.includes(row.root_id))fail('SCOPE_DENIED',403);return row}\n private async inspect(row:any){\n  const ids=(await this.cli(['container','ls','-a','--no-trunc','--filter',`name=^/${row.name}$`,'--format','{{.ID}}'])).split('\\n').filter(Boolean)\n  if(!ids.length)return null\n  if(ids.length!==1||!/^[a-f0-9]{64}$/.test(ids[0])||row.cid&&row.cid!==ids[0])fail('CONTAINER_IDENTITY_MISMATCH',503)\n  let value:any;try{value=JSON.parse(await this.cli(['container','inspect',ids[0]]))[0]}catch{fail('CONTAINER_CONTROL_UNAVAILABLE',503)}\n  if(value?.Id!==ids[0]||value.Name!=='/'+row.name||value.Config?.Labels?.['dsh.worker.nonce']!==row.nonce||value.Config?.Labels?.['dsh.worker.machine']!==this.store.machineId)fail('CONTAINER_IDENTITY_MISMATCH',503)\n  const host=value.HostConfig,binds=(value.Mounts??[]).filter((m:any)=>m.Type==='bind')\n  const workspace=binds.find((m:any)=>m.Destination==='/workspace'),supervisor=binds.find((m:any)=>m.Destination==='/opt/dsh-supervisor.mjs')\n  const caps=host?.CapAdd?.map((name:string)=>name.replace(/^CAP_/,''))\n  if(typeof row.workspace_identity!=='string'||value.Config?.Cmd?.[0]!=='/opt/dsh-supervisor.mjs'||value.Config.Cmd[2]!==row.workspace_identity||value.Config?.Entrypoint?.length!==1||value.Config.Entrypoint[0]!=='/usr/local/bin/node')fail('CONTAINER_POLICY_MISMATCH',503)\n  if(value.Config?.Image!==this.config.image||value.Config?.User!=='0:0'||host?.NetworkMode!=='none'||host?.ReadonlyRootfs!==true||host?.Privileged!==false||!host.CapDrop?.includes('ALL')||caps?.length!==2||!caps.includes('SETUID')||!caps.includes('SETGID')||!host.SecurityOpt?.includes('no-new-privileges')||binds.length!==2||workspace?.Source!==row.workspace||supervisor?.Source!==await this.supervisor()||supervisor?.RW!==false)fail('CONTAINER_POLICY_MISMATCH',503)\n  return value\n }\n async probe(){\n  try{const info=JSON.parse(await this.cli(['image','inspect',this.config.image]))[0];if(info?.Architecture!=='amd64'||!info.RepoDigests?.includes(this.config.image))fail('CONTAINER_IMAGE_MISMATCH');return {mode:'container',status:'dependency-ready',image:this.config.image,network:'none',filesystem:'workspace-only',user:'65532:65532',measurement:'requires-operation-check'}}catch{return {mode:'container',status:'unavailable',code:'CONTAINER_DEPENDENCY_UNAVAILABLE'}}\n }\n private unknown(id:string,code='OUTCOME_UNKNOWN'){\n  this.store.finish(id,'unknown',{kind:'container-command',stopConfirmed:false,possiblyApplied:true},code)\n }\n private async logs(id:string){\n  const child=spawn(this.config.dockerExecutable,['container','logs',id],{env:this.dockerEnv,stdio:['ignore','pipe','pipe'],windowsHide:true})\n  const stdout:Buffer[]=[],stderr:Buffer[]=[];let bytes=0,failed=false\n  const take=(list:Buffer[])=>(chunk:Buffer)=>{const n=Math.min(chunk.length,Math.max(0,8*1024*1024-bytes));if(n)list.push(chunk.subarray(0,n));bytes+=n}\n  child.stdout.on('data',take(stdout));child.stderr.on('data',take(stderr));const timer=setTimeout(()=>{failed=true;child.kill('SIGKILL')},15000)\n  try{const code=await new Promise<number|null>((resolve,reject)=>{child.once('error',reject);child.once('close',resolve)});if(failed||code!==0)fail('CONTAINER_OUTPUT_UNAVAILABLE',503);return {stdout:Buffer.concat(stdout),stderr:Buffer.concat(stderr)}}finally{clearTimeout(timer)}\n }\n private async settle(id:string,c:Context,observed:any,artifact:(data:Buffer,c:Context)=>Promise<any>,reason:string|null){\n  if(!observed||!['exited','dead'].includes(observed.State?.Status)||observed.State?.Running!==false){this.unknown(id);return}\n  // Bounded tail logs survive a controller crash; rotation can omit old output.\n  let logs:any\n  try{logs=await this.logs(observed.Id)}catch{this.unknown(id,'CONTAINER_OUTPUT_UNAVAILABLE');return}\n  const out=await artifact(logs.stdout,c),err=await artifact(logs.stderr,c),exitCode=observed.State.ExitCode\n  const state=reason==='CANCELLED'||reason==='GRANT_REVOKED'?'cancelled':reason?'failed':exitCode===0?'succeeded':'failed'\n  const result={kind:'container-command',containerId:observed.Id,exitCode,stdoutArtifactId:out.artifactId,stderrArtifactId:err.artifactId,truncated:true,outputPolicy:'bounded-tail',stopConfirmed:true,possiblyApplied:true,isolation:{mode:'container',image:this.config.image,network:'none',user:'65532:65532'}}\n  this.store.db.transaction(()=>{this.store.finish(id,state,result,reason??(state==='failed'?'PROCESS_EXIT_NONZERO':null));this.store.db.prepare(\"UPDATE container_workers SET phase='settled',reason=? WHERE operation_id=?\").run(reason,id)})()\n  await this.cleanup(id,c).catch(()=>{})\n }\n async cleanup(id:string,c:Context){\n  const row=this.row(id,c);if(!row||row.phase!=='settled'||!terminal.has(this.store.status(id,c).status))return\n  const value=await this.inspect(row);if(!value){this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id);return}\n  if(value.State?.Running!==false)fail('CONTAINER_STOP_UNCONFIRMED',503)\n  await this.cli(['container','rm',value.Id]);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)\n }\n async observe(id:string,c:Context,artifact:(data:Buffer,c:Context)=>Promise<any>){return this.serialized(id,()=>this.observeOriginal(id,c,artifact))}\n private async observeOriginal(id:string,c:Context,artifact:(data:Buffer,c:Context)=>Promise<any>){\n  const row=this.row(id,c);if(!row)return false\n  if(terminal.has(this.store.status(id,c).status)){await this.cleanup(id,c).catch(()=>{});return true}\n  if(this.sessions.has(id))return true\n  try{\n   const value=await this.inspect(row)\n   if(['prepared','created'].includes(row.phase)){\n    if(value?.State?.Running||value&&value.State?.Status!=='created'){this.unknown(id);return true}\n    // The persisted start intent is absent, and this exact old controller died.\n    // Remove the never-started owned object before publishing no-effects proof.\n    if(value)await this.cli(['container','rm',value.Id])\n    this.store.db.transaction(()=>{this.store.finish(id,'cancelled',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},'HOST_INTERRUPTED_BEFORE_START');this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})()\n   }else if(value)await this.settle(id,c,value,artifact,row.reason)\n   else this.unknown(id)\n  }catch{this.unknown(id)}\n  return true\n }\n async cancel(id:string,c:Context,why='CANCELLED'){\n  const running=this.sessions.get(id);if(running){await running.cancel(why);return true}\n  return this.serialized(id,()=>this.cancelOriginal(id,c,why))\n }\n private async cancelOriginal(id:string,c:Context,why:string){\n  const row=this.row(id,c);if(!row||terminal.has(this.store.status(id,c).status))return !!row\n  const value=await this.inspect(row)\n  if(value?.State?.Running){this.store.db.prepare('UPDATE container_workers SET reason=? WHERE operation_id=?').run(why,id);await this.cli(['container','kill','--signal=KILL',value.Id],5000)}\n  else if(value?.State?.Status==='created'){\n   await this.cli(['container','rm',value.Id])\n   this.store.db.transaction(()=>{this.store.finish(id,'cancelled',{kind:'container-command',stopConfirmed:true,possiblyApplied:row.phase==='starting',notStarted:row.phase!=='starting'},why);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})()\n  }\n  return true\n }\n async sweep(artifact:(data:Buffer,c:Context)=>Promise<any>){\n  if(this.sweeping||this.closing)return;this.sweeping=true\n  try{const rows=this.store.db.prepare(\"SELECT operation_id,context FROM container_workers WHERE phase!='removed' AND operation_id>? ORDER BY operation_id LIMIT 4\").all(this.sweepCursor);if(!rows.length)this.sweepCursor='';for(const row of rows){\n   if(this.closing)break;this.sweepCursor=row.operation_id\n   if(this.sessions.has(row.operation_id))continue\n   const c=JSON.parse(row.context);let valid=true;try{this.store.validate(c)}catch{valid=false}\n   if(!valid)try{await this.cancel(row.operation_id,c,'GRANT_REVOKED')}catch{}\n   if(this.closing)break;try{await this.observe(row.operation_id,c,artifact)}catch{}\n  }}finally{this.sweeping=false}\n }\n async run({id,c,rootId,workspace,workspaceIdentity,executable,argv,timeout,validate,validateWorkspace,shouldCancel,artifact}:{id:string;c:Context;rootId:string;workspace:string;workspaceIdentity:string;executable:string;argv:string[];timeout:number;validate:()=>void;validateWorkspace:()=>Promise<void>;shouldCancel:()=>boolean;artifact:(data:Buffer,c:Context)=>Promise<any>}){\n  const name='dsh-worker-'+sha(canonical({machine:this.store.machineId,id})).slice(0,40),nonce=randomUUID(),digest=sha(canonical({rootId,workspace,workspaceIdentity,executable,argv,image:this.config.image}))\n  const deadlineAt=Math.min(c.expiresAt,Date.now()+timeout),supervisorFile=await this.supervisor()\n  const args=containerArguments({name,nonce,machineId:this.store.machineId,workspace,workspaceIdentity,config:this.config,executable,argv,deadlineAt,supervisorFile})\n  this.store.db.prepare(\"INSERT INTO container_workers(operation_id,name,nonce,context,root_id,workspace,input_digest,phase,cid,reason,workspace_identity) VALUES (?,?,?,?,?,?,?,'prepared',NULL,NULL,?)\").run(id,name,nonce,canonical(c),rootId,workspace,digest,workspaceIdentity)\n  let reason:string|null=null,child:any,controlLost=false,cancelling:Promise<void>|undefined,closed=false\n  const cancel=(why:string)=>{reason??=why;this.store.db.prepare('UPDATE container_workers SET reason=? WHERE operation_id=?').run(reason,id);return cancelling??=(async()=>{try{const row=this.row(id,c),value=await this.inspect(row);if(value?.State?.Running)await this.cli(['container','kill','--signal=KILL',value.Id],5000)}catch{controlLost=true}finally{if(child&&!closed){const timer=setTimeout(()=>{if(!closed){controlLost=true;try{process.kill(-child.pid,'SIGKILL')}catch{}}},3000);timer.unref()}}})()}\n  this.sessions.set(id,{cancel});const timer=setTimeout(()=>void cancel('PROCESS_TIMEOUT'),timeout)\n  try{\n   validate();if(shouldCancel())reason='CANCELLED'\n   if(reason){this.store.finish(id,'cancelled',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},reason);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id);return}\n   const ready=await this.probe();if(ready.status!=='dependency-ready')fail('CONTAINER_DEPENDENCY_UNAVAILABLE',503)\n   await validateWorkspace();validate()\n   const cid=await this.cli(args);if(!/^[a-f0-9]{64}$/.test(cid))fail('CONTAINER_CONTROL_UNAVAILABLE',503)\n   this.store.db.prepare(\"UPDATE container_workers SET cid=?,phase='created' WHERE operation_id=?\").run(cid,id)\n   await validateWorkspace();validate();if(shouldCancel())reason??='CANCELLED'\n   if(reason){const row=this.row(id,c),value=await this.inspect(row);if(value?.State?.Status!=='created')fail('OUTCOME_UNKNOWN');await this.cli(['container','rm',cid]);this.store.db.transaction(()=>{this.store.finish(id,'cancelled',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},reason);this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})();return}\n   this.store.db.prepare(\"UPDATE container_workers SET phase='starting' WHERE operation_id=?\").run(id)\n   child=spawn(this.config.dockerExecutable,['container','start','-a',cid],{env:this.dockerEnv,detached:true,stdio:['ignore','ignore','ignore'],windowsHide:true})\n   await new Promise<void>((resolve,reject)=>{child.once('error',reject);child.once('close',()=>{closed=true;resolve()})});await cancelling\n   if(controlLost){this.unknown(id);return}\n   await this.settle(id,c,await this.inspect(this.row(id,c)),artifact,reason)\n  }catch(e:any){\n   const row=this.row(id,c)\n   if(row?.phase==='starting'){this.unknown(id)}\n   else{\n    // Even a failed create request may have reached the daemon. Observe this\n    // owned name before deciding no process could have run.\n    try{const value=await this.inspect(row);if(value?.State?.Status!=='created'&&value!==null)throw Error();if(value)await this.cli(['container','rm',value.Id]);this.store.db.transaction(()=>{this.store.finish(id,reason?'cancelled':'failed',{kind:'container-command',notStarted:true,stopConfirmed:true,possiblyApplied:false},reason??(e instanceof AgentError?e.code:'EXECUTION_FAILED'));this.store.db.prepare(\"UPDATE container_workers SET phase='removed' WHERE operation_id=?\").run(id)})()}catch{this.unknown(id)}\n   }\n  }finally{clearTimeout(timer);this.sessions.delete(id)}\n }\n async close(){this.closing=true;await Promise.all([...this.sessions.values()].map(s=>s.cancel('CANCELLED')));await Promise.allSettled([...this.controls.values()]);while(this.sweeping)await new Promise(r=>setTimeout(r,10))}\n}\n", "// Fixed trusted PID 1, mounted read-only. Caller argv is data for an unprivileged\n// child, never JavaScript source. A child cannot signal/ptrace this root process.\nexport async function runContainerSupervisor(){\nconst {spawn}=await import('node:child_process')\nconst {stat}=await import('node:fs/promises')\nconst [deadlineText,identityText,executable,...argv]=process.argv.slice(2),deadline=Number(deadlineText)\nif(!Number.isSafeInteger(deadline)||deadline<=Date.now()||!executable)process.exit(124)\n// Docker/runc resolves the bind source after the Agent's final path check.\n// Verify the actual mounted directory before any untrusted program can run.\nlet expected\ntry{expected=JSON.parse(identityText)}catch{process.exit(125)}\nif(!expected||Object.keys(expected).sort().join(',')!=='birth,dev,ino'||!['birth','dev','ino'].every(k=>typeof expected[k]==='string'&&/^(0|[1-9][0-9]{0,39})$/.test(expected[k]))||expected.ino==='0'||expected.birth==='0')process.exit(125)\nfor(const path of ['/workspace','.']){\n const s=await stat(path,{bigint:true})\n if(!s.isDirectory()||String(s.dev)!==expected.dev||String(s.ino)!==expected.ino||String(s.birthtimeNs)!==expected.birth)process.exit(125)\n}\nprocess.setgroups([])\nlet child\n// Exiting namespace PID1 tears down its descendants. This needs no CAP_KILL;\n// the supervisor intentionally has only SETUID/SETGID for the initial spawn.\nconst stop=code=>process.exit(code)\nconst timer=setTimeout(()=>stop(124),Math.max(1,deadline-Date.now()))\nprocess.once('SIGTERM',()=>stop(143));process.once('SIGINT',()=>stop(130))\ntry{\n child=spawn(executable,argv,{uid:65532,gid:65532,env:{PATH:'/usr/local/bin:/usr/bin:/bin',LANG:'C.UTF-8',HOME:'/tmp'},stdio:['ignore','inherit','inherit']})\n child.once('error',()=>stop(126))\n child.once('close',(code,signal)=>{clearTimeout(timer);stop(code??(signal?128:1))})\n}catch{stop(126)}\n}\n// Self-contained function text avoids an eval CLI and keeps direct source builds\n// and the normal Agent bundler on the same canonical supervisor implementation.\nexport const CONTAINER_SUPERVISOR_SOURCE=`(${runContainerSupervisor.toString()})().catch(()=>process.exit(126))\\n`\n", "import {constants,type BigIntStats} from 'node:fs'\nimport {lstat,mkdir,open,readFile,realpath,stat,unlink,writeFile,type FileHandle} from 'node:fs/promises'\nimport path from 'node:path'\nimport {canonical,fail,sha} from './protocol.js'\n\nexport type WorkspaceIdentity={key:string;ancestors:string[];path:string;platform:'linux'|'win32'}\ntype PhysicalIdentity={dev:string;ino:string;birth:string}\nfunction physical(s:BigIntStats):PhysicalIdentity{\n if(!s.isDirectory()||s.ino<=0n||s.dev<0n||s.birthtimeNs<=0n)fail('WORKSPACE_IDENTITY_UNAVAILABLE',503)\n return {dev:String(s.dev),ino:String(s.ino),birth:String(s.birthtimeNs)}\n}\nconst key=(s:BigIntStats)=>sha(canonical(physical(s)))\n\n/**\n * Cross-dataDir physical-root exclusion (Linux).\n *\n * The per-dataDir journal cannot see a second Agent instance on the same host\n * with its own database. The held directory inode therefore also owns an\n * exclusive claim file under a stable system path keyed by dev:ino, so two\n * processes pinning the same physical root (aliases included \u2014 the inode is\n * the identity) cannot both hold it. The claim carries the owner PID; a\n * verifiably dead owner's claim is reclaimed with the same\n * fstat-vs-lstat identity discipline as the controller lock. Nested captures\n * inside one process share the outer claim, which is what lets the container\n * shell re-pin a cwd that withWorkspace already pinned. An unavailable lock\n * directory (for example a different service user owns it) degrades to the\n * previous single-database semantics with an audit-visible marker instead of\n * breaking a previously working workspace.\n */\nconst ROOT_LOCK_DIRECTORY='/tmp/dsh-agent-root-locks'\ntype RootLock={count:number;path:string;handle:FileHandle}\nconst rootLocks=new Map<string,RootLock|Promise<RootLock>>()\nexport const rootLockDegrades:{lastUnavailableAt:number|null}={lastUnavailableAt:null}\nconst alive=(pid:number)=>{try{process.kill(pid,0);return true}catch(e:any){return e?.code==='EPERM'}}\n\nasync function createRootClaim(lockPath:string):Promise<RootLock>{\n  await mkdir(ROOT_LOCK_DIRECTORY,{recursive:true,mode:0o700}).catch(()=>{})\n  for(let attempt=0;attempt<2;attempt++){\n    let handle:FileHandle|undefined\n    try{\n      handle=await open(lockPath,'wx',0o600)\n      await writeFile(handle,JSON.stringify({pid:process.pid}))\n      return {count:1,path:lockPath,handle}\n    }catch(e:any){\n      await handle?.close().catch(()=>{})\n      const code=(e as {code?:string})?.code\n      if(code==='EACCES'||code==='EPERM'){rootLockDegrades.lastUnavailableAt=Date.now();return {count:1,path:'',handle:undefined as unknown as FileHandle}}\n      if(code!=='EEXIST')throw e\n    }\n    // Another process holds the claim. Steal it only when its owner is\n    // verifiably dead and the file on the name is still the one we read.\n    let stolen=false\n    try{\n      const held=await open(lockPath,'r'),self=await held.stat(),named=await lstat(lockPath)\n      try{\n        const owner=JSON.parse(await readFile(held,{encoding:'utf8'}))\n        if(!alive(Number(owner?.pid))&&named.dev===self.dev&&named.ino===self.ino&&!named.isSymbolicLink()){\n          await unlink(lockPath).catch(()=>{});stolen=true\n        }\n      }finally{await held.close()}\n    }catch{}\n    if(!stolen)fail('WORKSPACE_BUSY',409)\n  }\n  fail('WORKSPACE_BUSY',409)\n}\n\nasync function acquireRootLock(stat:{dev:bigint;ino:bigint}):Promise<RootLock>{\n  const lockKey=`${stat.dev}:${stat.ino}`\n  const existing=rootLocks.get(lockKey)\n  if(existing){const lock=await existing;lock.count++;return lock}\n  const pending=createRootClaim(`${ROOT_LOCK_DIRECTORY}/${lockKey}`).then(lock=>{rootLocks.set(lockKey,lock);return lock})\n  rootLocks.set(lockKey,pending)\n  try{return await pending}catch(e){rootLocks.delete(lockKey);throw e}\n}\n\nasync function releaseRootLock(lockKey:string,lock:RootLock):Promise<void>{\n  if(--lock.count>0)return\n  if(rootLocks.get(lockKey)===lock)rootLocks.delete(lockKey)\n  if(!lock.handle)return\n  try{\n    const self=await lock.handle.stat(),named=await lstat(lock.path)\n    if(named.dev===self.dev&&named.ino===self.ino&&!named.isSymbolicLink())await unlink(lock.path).catch(()=>{})\n  }catch{}\n  await lock.handle.close().catch(()=>{})\n}\nasync function snapshot(target:string):Promise<{identity:WorkspaceIdentity;physical:PhysicalIdentity}>{\n if(!['linux','win32'].includes(process.platform)||typeof target!=='string'||!path.isAbsolute(target)||target.length>4096||target.includes('\\0'))fail('WORKSPACE_IDENTITY_UNAVAILABLE',503)\n const actual=await realpath(target),first=await stat(actual,{bigint:true}),ancestors:string[]=[]\n let current=actual\n for(let depth=0;;depth++){\n  if(depth>=128)fail('WORKSPACE_IDENTITY_UNAVAILABLE',503)\n  ancestors.push(key(depth===0?first:await stat(current,{bigint:true})))\n  const parent=path.dirname(current);if(parent===current)break;current=parent\n }\n if(key(await stat(actual,{bigint:true}))!==ancestors[0]||await realpath(target)!==actual)fail('WORKSPACE_CHANGED',409)\n return {identity:{key:ancestors[0],ancestors:[...new Set(ancestors)],path:actual,platform:process.platform as 'linux'|'win32'},physical:physical(first)}\n}\n\n/** Trusted filesystem observation, never a model-supplied identity or a lease. */\nexport class WorkspacePin{\n private closed=false\n private constructor(public readonly identity:WorkspaceIdentity,public readonly mountIdentity:string,private handle?:FileHandle,private rootLock?:{key:string;lock:RootLock}){}\n static async capture(target:string){\n  const value=await snapshot(target);let handle:FileHandle|undefined,rootLock:{key:string;lock:RootLock}|undefined\n  try{\n   if(process.platform==='linux'){\n    handle=await open(value.identity.path,constants.O_RDONLY|constants.O_DIRECTORY|constants.O_NOFOLLOW)\n    const held=await handle.stat({bigint:true})\n    if(key(held)!==value.identity.key)fail('WORKSPACE_CHANGED',409)\n    // One physical inode, one cross-process claim, nested captures refcounted.\n    const stat={dev:held.dev,ino:held.ino}\n    rootLock={key:`${stat.dev}:${stat.ino}`,lock:await acquireRootLock(stat)}\n   }\n   const pin=new WorkspacePin(Object.freeze({...value.identity,ancestors:Object.freeze(value.identity.ancestors)}) as WorkspaceIdentity,canonical(value.physical),handle,rootLock)\n   await pin.verify();return pin\n  }catch(e){await handle?.close();if(rootLock)await releaseRootLock(rootLock.key,rootLock.lock).catch(()=>{});throw e}\n }\n get scanPath(){if(this.closed)fail('WORKSPACE_PIN_CLOSED');return this.handle?`/proc/${process.pid}/fd/${this.handle.fd}/.`:this.identity.path}\n async verify(){\n  if(this.closed)fail('WORKSPACE_PIN_CLOSED')\n  const current=await snapshot(this.identity.path)\n  if(canonical(current.identity)!==canonical(this.identity)||current.physical&&canonical(current.physical)!==this.mountIdentity)fail('WORKSPACE_CHANGED',409)\n  if(this.handle&&(key(await this.handle.stat({bigint:true}))!==this.identity.key||await realpath(`/proc/${process.pid}/fd/${this.handle.fd}`)!==this.identity.path))fail('WORKSPACE_CHANGED',409)\n }\n async close(){if(this.closed)return;this.closed=true;if(this.rootLock)await releaseRootLock(this.rootLock.key,this.rootLock.lock).catch(()=>{});await this.handle?.close()}\n}\n", "import { isAbsolute } from 'node:path'\nimport { AgentError, canonical, fail, identifier, type Context } from './protocol.js'\nimport type { Store } from './store.js'\nimport type { WorkspaceIdentity } from './workspace-identity.js'\n\nexport type { WorkspaceIdentity }\nexport type WorkspacePlatform = WorkspaceIdentity['platform']\nexport type WorkspaceAdmission = {\n  operationId: string\n  tool: string\n  rootKey: string\n  path: string\n  platform: WorkspacePlatform\n  ancestors: string[]\n  clientId: string\n  botId: string\n  taskId: string\n  attemptId: string\n  acquiredAt: number\n}\nexport type WorkspaceRelease = {\n  operationId: string\n  status: string | null\n  released: boolean\n  reason: string | null\n}\n\nconst IDENTITY_KEYS = ['key', 'ancestors', 'path', 'platform']\nconst HEX64 = /^[a-f0-9]{64}$/\nconst MAX_ANCESTORS = 128\nconst MAX_PATH = 4096\nconst PLATFORMS = new Set<string>(['linux', 'win32'])\n/** Tools whose original operation mutates one physical root and therefore needs exclusion. */\nexport const ROOT_WRITING_TOOLS: readonly string[] = ['fs_write', 'shell_exec', 'container_command_v1']\n/** Tools whose stop evidence is only proven by a supervisor receipt. */\nconst STOP_EVIDENCE_TOOLS = new Set<string>(['shell_exec'])\n/** Upper bound on simultaneously active admissions; nothing is ever evicted to stay under it. */\nconst MAX_ACTIVE_ADMISSIONS = 4096\nconst TERMINAL = new Set<string>(['succeeded', 'failed', 'cancelled'])\nconst LIVE = new Set<string>(['admitted', 'running'])\n\n/**\n * Durable mutual exclusion over actual physical workspace roots.\n *\n * The lock lives in the Store database, so it survives controller restarts, is\n * visible to every connection, and is released only by a persisted terminal\n * receipt for the original operation. It never expires by itself.\n */\nexport class WorkspaceAdmissions {\n  /** Maximum number of simultaneously active admissions; explicit and closed. */\n  readonly MAX_ACTIVE_ADMISSIONS = MAX_ACTIVE_ADMISSIONS\n  constructor(private store: Store, private generation: string = '') {\n    this.store.db.exec(`CREATE TABLE IF NOT EXISTS workspace_admissions(\n        operation_id TEXT PRIMARY KEY REFERENCES operations(id),\n        tool TEXT NOT NULL,\n        root_key TEXT NOT NULL,\n        path TEXT NOT NULL,\n        platform TEXT NOT NULL,\n        ancestors TEXT NOT NULL,\n        ancestor_count INTEGER NOT NULL,\n        context TEXT NOT NULL,\n        acquired_at INTEGER NOT NULL);\n      CREATE INDEX IF NOT EXISTS workspace_admissions_root ON workspace_admissions(root_key);\n      DROP TRIGGER IF EXISTS workspace_admissions_receipt;\n      CREATE TRIGGER workspace_admissions_receipt\n        AFTER UPDATE OF status ON operations\n        FOR EACH ROW\n        WHEN NEW.status IN ('succeeded','failed','cancelled')\n        BEGIN\n          DELETE FROM workspace_admissions WHERE operation_id = NEW.id AND (\n            NEW.tool <> 'shell_exec'\n            OR (json_valid(NEW.result) AND json_type(NEW.result,'$.stopConfirmed') = 'true')\n            OR (json_valid(NEW.result) AND json_type(NEW.result,'$.notStarted') = 'true'));\n        END;`)\n    // Admissions predating roots-generation binding keep '' as an explicit\n    // unknown generation; replay never depends on this column.\n    if(!this.store.db.pragma('table_info(workspace_admissions)').some((column: any) => column.name==='roots_generation'))\n      this.store.db.exec(\"ALTER TABLE workspace_admissions ADD COLUMN roots_generation TEXT NOT NULL DEFAULT ''\")\n  }\n  /** Acquire the physical root for a live original operation; replay is idempotent. */\n  admit(operationId: string, context: Context, identity: any) {\n    identifier(operationId)\n    const root = this.verify(identity)\n    return this.immediate(() => {\n      this.store.validate(context)\n      const operation = this.store.db.prepare('SELECT * FROM operations WHERE id=?').get(operationId)\n      if (!operation) fail('OPERATION_NOT_FOUND', 404)\n      this.store.own(operation.context, context)\n      if (!ROOT_WRITING_TOOLS.includes(operation.tool)) fail('WORKSPACE_TOOL_NOT_SUPPORTED')\n      if (!LIVE.has(operation.status)) fail('OPERATION_CONFLICT', 409)\n      const saved = this.store.db.prepare('SELECT * FROM workspace_admissions WHERE operation_id=?').get(operationId)\n      if (saved) {\n        this.store.own(saved.context, context)\n        if (saved.root_key !== root.key || saved.path !== root.path || saved.platform !== root.platform || saved.ancestors !== canonical(root.ancestors)) fail('WORKSPACE_CONFLICT', 409)\n        return { fresh: false, admission: this.decode(saved) }\n      }\n      const holder = this.holder(root, operationId)\n      if (holder) fail('WORKSPACE_BUSY', 409)\n      const active = this.store.db.prepare('SELECT count(*) AS count FROM workspace_admissions').get()\n      if (active.count >= MAX_ACTIVE_ADMISSIONS) fail('WORKSPACE_ADMISSION_LIMIT', 429)\n      this.store.db.prepare('INSERT INTO workspace_admissions(operation_id,tool,root_key,path,platform,ancestors,ancestor_count,context,acquired_at,roots_generation) VALUES (?,?,?,?,?,?,?,?,?,?)')\n        .run(operationId, operation.tool, root.key, root.path, root.platform, canonical(root.ancestors), root.ancestors.length, canonical(context), Date.now(), this.generation)\n      return { fresh: true, admission: this.decode(this.store.db.prepare('SELECT * FROM workspace_admissions WHERE operation_id=?').get(operationId)) }\n    })\n  }\n  /** Read-side check: no other admitted operation may overlap this physical root. */\n  assertAvailable(identity: any, exceptOperationId?: string) {\n    const root = this.verify(identity)\n    if (exceptOperationId !== undefined) identifier(exceptOperationId)\n    this.immediate(() => { if (this.holder(root, exceptOperationId ?? '')) fail('WORKSPACE_BUSY', 409) })\n  }\n  /** Release only on a persisted terminal receipt; the receipt commit and the release share one transaction. */\n  releaseIfTerminal(operationId: string, context: Context): WorkspaceRelease {\n    identifier(operationId)\n    return this.immediate(() => {\n      this.store.validate(context)\n      const admission = this.store.db.prepare('SELECT * FROM workspace_admissions WHERE operation_id=?').get(operationId)\n      const operation = this.store.db.prepare('SELECT * FROM operations WHERE id=?').get(operationId)\n      // Whether or not the lock is still held, the original operation must belong to the caller.\n      if (admission) this.store.own(admission.context, context)\n      if (operation) this.store.own(operation.context, context)\n      if (!operation) return { operationId, status: null, released: false, reason: 'OPERATION_NOT_FOUND' }\n      if (!admission) return { operationId, status: operation.status, released: TERMINAL.has(operation.status) && this.stopped(operation), reason: TERMINAL.has(operation.status) && this.stopped(operation) ? 'ALREADY_RELEASED' : 'NOT_ADMITTED' }\n      if (!TERMINAL.has(operation.status)) return { operationId, status: operation.status, released: false, reason: 'NON_TERMINAL' }\n      if (!this.stopped(operation)) return { operationId, status: operation.status, released: false, reason: 'STOP_UNCONFIRMED' }\n      return { operationId, status: operation.status, released: this.store.db.prepare('DELETE FROM workspace_admissions WHERE operation_id=?').run(operationId).changes > 0, reason: null }\n    })\n  }\n  /** Active admissions, optionally narrowed to one grant subject. */\n  list(context?: Context) {\n    return this.immediate(() => {\n      if (context !== undefined) this.store.validate(context)\n      return this.store.db.prepare('SELECT * FROM workspace_admissions ORDER BY acquired_at,operation_id').all().map((row: any) => this.decode(row))\n        .filter((a: WorkspaceAdmission) => context === undefined || (a.clientId === context.clientId && a.botId === context.botId && a.taskId === context.taskId && a.attemptId === context.attemptId))\n    })\n  }\n  private verify(value: any): WorkspaceIdentity {\n    if (value === null || typeof value !== 'object' || Array.isArray(value)) fail('INVALID_WORKSPACE_IDENTITY')\n    const keys = Object.keys(value)\n    if (keys.length !== IDENTITY_KEYS.length || !keys.every(k => IDENTITY_KEYS.includes(k))) fail('INVALID_WORKSPACE_IDENTITY')\n    const { key, ancestors, path, platform } = value\n    if (typeof key !== 'string' || !HEX64.test(key)) fail('INVALID_WORKSPACE_IDENTITY')\n    if (!Array.isArray(ancestors) || !ancestors.length || ancestors.length > MAX_ANCESTORS || ancestors.some((x: any) => typeof x !== 'string' || !HEX64.test(x))) fail('INVALID_WORKSPACE_IDENTITY')\n    const chain = [...new Set(ancestors as string[])]\n    if (!chain.includes(key)) fail('INVALID_WORKSPACE_IDENTITY')\n    if (typeof path !== 'string' || !path.length || path.length > MAX_PATH || path.includes('\\0') || !isAbsolute(path)) fail('INVALID_WORKSPACE_IDENTITY')\n    if (typeof platform !== 'string' || !PLATFORMS.has(platform)) fail('INVALID_WORKSPACE_IDENTITY')\n    return { key, ancestors: chain, path, platform: platform as WorkspacePlatform }\n  }\n  /** Same physical root (alias) or an overlapping parent/child branch conflicts. */\n  private holder(root: WorkspaceIdentity, exceptOperationId: string) {\n    return this.store.db.prepare(`SELECT operation_id,path,root_key FROM workspace_admissions\n      WHERE operation_id <> @except AND (root_key = @key\n        OR EXISTS (SELECT 1 FROM json_each(ancestors) WHERE value = @key)\n        OR EXISTS (SELECT 1 FROM json_each(@ancestors) WHERE value = root_key))\n      ORDER BY acquired_at,operation_id LIMIT 1`).get({ except: exceptOperationId, key: root.key, ancestors: canonical(root.ancestors) }) ?? null\n  }\n  private decode(row: any): WorkspaceAdmission {\n    const context = JSON.parse(row.context)\n    return { operationId: row.operation_id, tool: row.tool, rootKey: row.root_key, path: row.path, platform: row.platform, ancestors: JSON.parse(row.ancestors), clientId: context.clientId, botId: context.botId, taskId: context.taskId, attemptId: context.attemptId, acquiredAt: row.acquired_at }\n  }\n  /** A supervisor receipt must prove the stop before a shell lock is dropped. */\n  private stopped(operation: any) {\n    if (!TERMINAL.has(operation.status)) return false\n    if (!STOP_EVIDENCE_TOOLS.has(operation.tool)) return true\n    let result: any = null\n    try { result = operation.result ? JSON.parse(operation.result) : null } catch { return false }\n    return result?.stopConfirmed === true || result?.notStarted === true\n  }\n  private immediate<T>(fn: () => T): T {\n    const db = this.store.db\n    if (db.inTransaction) return fn()\n    try { db.exec('BEGIN IMMEDIATE') } catch (e: any) { throw this.busy(e) }\n    try { const value = fn(); db.exec('COMMIT'); return value } catch (e) { try { db.exec('ROLLBACK') } catch {}; throw this.busy(e) }\n  }\n  private busy(e: any) {\n    if (e instanceof AgentError) return e\n    if (typeof e?.code === 'string' && (e.code.startsWith('SQLITE_BUSY') || e.code === 'SQLITE_LOCKED')) return new AgentError('DATABASE_BUSY', 503)\n    return e\n  }\n}\n", "import { resolve } from 'node:path'\nimport { canonical, sha } from './protocol.js'\n\nexport const ROOTS_GENERATION_META_KEY = 'workspaceRootsGeneration'\n\n/**\n * Deterministic digest of the configured roots map: which physical trees the\n * rootIds denote. Only the mapping participates \u2014 a different dataDir is a\n * different database, and executables/shell settings do not change what the\n * roots point at. Sorted by rootId so key insertion order never matters;\n * `resolve()` normalizes without touching the filesystem.\n */\nexport function rootsGeneration(roots: Record<string, string> = {}): string {\n  const entries = Object.entries(roots).map(([id, value]) => [id, resolve(value)] as const)\n  entries.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))\n  return sha(canonical(entries))\n}\n\n/**\n * Record the current roots generation and fence surviving admissions when the\n * configuration changed since the previous run.\n *\n * The fence deliberately reuses the legacy-fence liveness predicate: an\n * operation counts as unsettled when its status is\n * admitted/running/cancel_pending/unknown, or it is a shell operation whose\n * stop evidence has not settled. Fenced operations never auto-roll-back;\n * reconciliation happens through the existing terminal-with-evidence paths,\n * after which the fence goes inert.\n *\n * A first run on a database that predates generations only records the\n * digest: without an observed change there is nothing to invalidate, and\n * fencing on every upgrade would turn a routine update into a global write\n * outage. Returns the generation now in effect and whether it changed.\n */\nexport function reconcileRootsGeneration(db: any, generation: string): { changed: boolean } {\n  db.exec('CREATE TABLE IF NOT EXISTS workspace_generation_fences(operation_id TEXT PRIMARY KEY)')\n  const saved = db.prepare('SELECT value FROM meta WHERE key=?').get(ROOTS_GENERATION_META_KEY)?.value\n  if (saved === generation) return { changed: false }\n  if (saved === undefined) {\n    db.prepare('INSERT INTO meta VALUES (?,?)').run(ROOTS_GENERATION_META_KEY, generation)\n    return { changed: false }\n  }\n  const fenced = db.prepare(`INSERT OR IGNORE INTO workspace_generation_fences\n    SELECT a.operation_id FROM workspace_admissions a JOIN operations o ON o.id=a.operation_id\n    WHERE o.status IN ('admitted','running','cancel_pending','unknown')\n       OR (o.tool='shell_exec' AND NOT (o.status IN ('succeeded','failed','cancelled')\n           AND (coalesce(json_type(o.result,'$.stopConfirmed'),'null')='true'\n             OR coalesce(json_type(o.result,'$.notStarted'),'null')='true')))`).run().changes\n  db.prepare('UPDATE meta SET value=? WHERE key=?').run(generation, ROOTS_GENERATION_META_KEY)\n  return { changed: true, fenced }\n}\n", "/**\n * Directory-descriptor-pinned creation of a brand-new file (Linux only).\n *\n * Why this exists: the product `fs_write` path in `agent.ts` validates a resolved\n * path and then re-checks the parent directory identity before a plain\n * `rename()`. That re-check is a *path based* observation, so it cannot prove\n * that an external directory replacement (rename, rmdir + mkdir, bind mount) or\n * an external writer did not swap the object between the check and the rename.\n *\n * What this component provides instead:\n *  - the parent directory is opened component-by-component with\n *    `O_DIRECTORY | O_NOFOLLOW` from a held descriptor, so the final access is\n *    bound to one directory inode instead of to a name;\n *  - every host-path observation is re-verified against the held descriptor\n *    (`/proc/<pid>/fd/<n>` realpath and `dev:ino`) immediately before publish and\n *    again after publish;\n *  - publication is `link()` inside the pinned directory, which is an atomic\n *    no-clobber name creation: an existing target (file, directory, symlink,\n *    fifo, device, hard link to a protected file) makes the whole write fail.\n *\n * What this component deliberately does NOT claim:\n *  - fd pinning binds us to an inode, not to a path, a mount or a security\n *    label. A concurrent process with enough privilege can still move the held\n *    directory (or place a mount over the host path) into or onto a protected\n *    location. The component cannot prevent that; it can only detect the\n *    resulting divergence and refuse, or report an unverified outcome.\n *  - the `check` callback is host policy, not a kernel guarantee. A callback\n *    that returns normally means the host approved what it could observe at\n *    that instant, nothing more.\n *  - strict hash CAS against an existing target is NOT solved. An existing\n *    target is always refused (fail closed); this component never overwrites.\n *  - `link()` is addressed through a path string, so the publish step keeps a\n *    small path-resolution window that fd pinning alone cannot close with\n *    Node's `fs` API (no `linkat(dirfd, ...)` is exposed). The window is bounded\n *    by the immediately preceding verification and observed afterwards.\n *  - `nlink` in the result is a single observation of the published name taken\n *    after the private temp name is retired. It is evidence, not an atomic\n *    compare-and-swap against external writers: a link created after that\n *    observation is not something the component can see or prevent.\n *  - durability is best effort: the temp file is fsynced before linking, the\n *    directory is fsynced after linking and again after the private name is\n *    retired, but a crash can still lose any of those steps, and a crash between\n *    `link()` and the temp unlink leaves one private temp name behind in the\n *    target directory. Nothing else is ever published by such a crash, and the\n *    component never removes names it does not own.\n *  - the reported `sha256` is the digest of the payload the component read back\n *    through its own descriptor and compared byte for byte with the request\n *    before returning. It is evidence about the bytes on disk at that moment, not\n *    a guarantee about any later write.\n *\n * The component creates files only. `Agent` uses it solely for Linux new-file\n * writes whose expectedHash is null; existing-target overwrite stays disabled.\n */\nimport { constants, type BigIntStats, type FileHandle } from 'node:fs'\nimport { open, lstat, stat, realpath, link, unlink } from 'node:fs/promises'\nimport path from 'node:path'\nimport { randomBytes } from 'node:crypto'\nimport { AgentError, sha } from './protocol.js'\n\n/** Default and hard limits, mirroring the product `fs_write` content bound. */\nexport const PINNED_WRITE_MAX_BYTES = 1048576\nexport const PINNED_WRITE_MAX_LIMIT_BYTES = 16 * 1024 * 1024\nexport const PINNED_WRITE_MAX_PATH_BYTES = 4096\nexport const PINNED_WRITE_MAX_COMPONENTS = 64\nexport const PINNED_WRITE_MAX_COMPONENT_BYTES = 255\nconst PINNED_WRITE_TEMP_PREFIX = '.dsh-pinned-write-'\nconst DIRECTORY_FLAGS = constants.O_RDONLY | constants.O_DIRECTORY | (constants.O_NOFOLLOW ?? 0)\n/**\n * The private temp file is opened read-write, not write-only, so the published\n * payload can be read back through this very descriptor and compared with what\n * was requested. It stays mode 0600 and is never exposed under a second name.\n */\nconst TEMP_FLAGS = constants.O_RDWR | constants.O_CREAT | constants.O_EXCL\nconst BIG = { bigint: true } as const\n\nconst failWrite = (code: string, status = 409, extra: Record<string, unknown> = {}): never => { throw Object.assign(new AgentError(code, status), extra) }\n/**\n * Refusal raised once the target name exists. Such a failure must never read as\n * \"nothing was written\": the caller has to be able to tell that a file landed\n * and that the component could not certify the rest of the outcome.\n */\nconst failAfterPublish = (code: string, status = 409, extra: Record<string, unknown> = {}): never => { throw Object.assign(new AgentError(code, status), { published: true, possiblyApplied: true, ...extra }) }\n/** Give an already-thrown refusal the same post-publication receipt. */\nconst annotatePublished = (e: unknown): unknown => e instanceof AgentError ? Object.assign(e, { published: true, possiblyApplied: true }) : e\n/**\n * Retire our private temp name and report whether it is gone afterwards.\n *\n * A name that another writer already removed counts as gone, because the\n * directory is clean either way. A name that is still present does not: the\n * published target then keeps a second link and the directory keeps a private\n * entry this component failed to clean up, so the caller must not be told the\n * write finished cleanly.\n */\nconst retireTempName = async (pinned: PinnedDirectory, tempName: string): Promise<{ retired: boolean; fsCode: string }> => {\n  let code = 'OK'\n  try { await unlink(pinned.childPath(tempName)) } catch (e) { code = fsCode(e) }\n  try { if ((await pinned.lstatChild(tempName)) === null) return { retired: true, fsCode: 'OK' } } catch (e) { code = fsCode(e) }\n  return { retired: false, fsCode: code }\n}\n/** Turn an unexpected filesystem failure into a documented, fail-closed code. */\nconst guard = async <T>(work: () => Promise<T>, reason: string): Promise<T> => {\n  try { return await work() } catch (e) { if (e instanceof AgentError) throw e; throw Object.assign(new AgentError('PINNED_WRITE_FAILED', 500), { reason, fsCode: fsCode(e), cause: e }) }\n}\n/** Same, for an observation taken after publication: the receipt is part of the answer. */\nconst publishedGuard = async <T>(work: () => Promise<T>, reason: string): Promise<T> => guard(work, reason).catch(e => { throw annotatePublished(e) })\nconst fsCode = (e: unknown): string => (e && typeof e === 'object' && typeof (e as { code?: unknown }).code === 'string' ? (e as { code: string }).code : 'UNKNOWN')\nconst identityOf = (s: { dev: bigint; ino: bigint }): PinnedIdentity => ({ dev: String(s.dev), ino: String(s.ino) })\n\n/** True when this host can honour the descriptor-pinning contract. */\nexport function pinnedWriteSupported(platform: string = process.platform): boolean { return platform === 'linux' }\n\nexport type PinnedIdentity = { dev: string; ino: string }\n\n/**\n * A held descriptor for one directory inode.\n *\n * All child access goes through `/proc/<pid>/fd/<n>/<name>`, so once the\n * descriptor is held the object we operate on is the inode we verified, not\n * whatever the host path happens to name later.\n */\nexport class PinnedDirectory {\n  private constructor(private readonly handle: FileHandle, readonly hostPath: string) { }\n  /**\n   * Open `resolvedRoot` plus every `components` entry one at a time with\n   * `O_DIRECTORY|O_NOFOLLOW`, so no intermediate component of the target path\n   * can be a symlink or a non-directory. `resolvedRoot` must already be free of\n   * symlinks (the caller resolves it once with `realpath`); resolving the whole\n   * path here would silently follow a symlinked component instead of refusing.\n   */\n  static async pin(resolvedRoot: string, components: readonly string[] = []): Promise<PinnedDirectory> {\n    if (!pinnedWriteSupported()) failWrite('PINNED_WRITE_UNSUPPORTED', 503, { platform: process.platform })\n    if (typeof resolvedRoot !== 'string' || !resolvedRoot || resolvedRoot.includes('\\0') || !path.posix.isAbsolute(resolvedRoot) || Buffer.byteLength(resolvedRoot) > PINNED_WRITE_MAX_PATH_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'pin-root' })\n    for (const part of components) if (typeof part !== 'string' || !part || part.includes('\\0') || part.includes('/') || part === '.' || part === '..' || Buffer.byteLength(part) > PINNED_WRITE_MAX_COMPONENT_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'pin-component' })\n    const parts = [...resolvedRoot.split('/').filter(Boolean), ...components]\n    let handle: FileHandle\n    try { handle = await open('/', DIRECTORY_FLAGS) } catch (e) { throw await mapDirectoryError(e, '/', 'root') }\n    for (const part of parts) {\n      const child = `${descriptorPath(handle)}/${part}`\n      let next: FileHandle\n      try { next = await open(child, DIRECTORY_FLAGS) } catch (e) {\n        // Classify while this descriptor is still open: the diagnostic reads the\n        // refused entry through `/proc/<pid>/fd/<n>`, and a closed descriptor\n        // number can already have been reused by an unrelated open file.\n        let mapped: AgentError\n        try { mapped = await mapDirectoryError(e, child, 'component') } finally { await handle.close().catch(() => { }) }\n        throw mapped\n      }\n      await handle.close().catch(() => { })\n      handle = next\n    }\n    return new PinnedDirectory(handle, path.posix.join(resolvedRoot, ...components))\n  }\n  get fd(): number { return this.handle.fd }\n  /** Descriptor path of the held directory. */\n  get fdPath(): string { return descriptorPath(this.handle) }\n  /** Scan form of the descriptor path, mirroring `WorkspacePin.scanPath`. */\n  get scanPath(): string { return `${this.fdPath}/` }\n  /** Path of a child entry addressed through the held descriptor. */\n  childPath(name: string): string { return `${this.fdPath}/${name}` }\n  async identity(): Promise<PinnedIdentity> { return identityOf(await this.handle.stat(BIG)) }\n  /** lstat a child through the descriptor; `null` when the name does not exist. */\n  async lstatChild(name: string): Promise<BigIntStats | null> {\n    try { return await lstat(this.childPath(name), BIG) } catch (e) { if (fsCode(e) === 'ENOENT') return null; throw await mapDirectoryError(e, this.childPath(name), 'child') }\n  }\n  /**\n   * Re-observe the host path and require that it still denotes the held inode.\n   * Detects rename, replacement, deletion and mount swaps of the directory.\n   */\n  async verifyHostPath(expectedHostPath: string): Promise<void> {\n    const actual = await realpath(this.fdPath).catch(() => null)\n    if (actual !== expectedHostPath) failWrite('DIRECTORY_CHANGED', 409, { reason: 'descriptor-path', expected: expectedHostPath, actual })\n    const current = await stat(expectedHostPath, BIG).catch(() => null)\n    if (!current) failWrite('DIRECTORY_CHANGED', 409, { reason: 'host-path-unreadable', expected: expectedHostPath })\n    const pinned = await guard(() => this.identity(), 'descriptor-stat')\n    if (pinned.dev !== String(current.dev) || pinned.ino !== String(current.ino)) failWrite('DIRECTORY_CHANGED', 409, { reason: 'descriptor-identity', expected: identityOf(current), actual: pinned })  }\n  /** Best-effort durability of names created in this directory. */\n  async sync(): Promise<void> { await this.handle.sync().catch(() => { }) }\n  async close(): Promise<void> { await this.handle.close().catch(() => { }) }\n}\n\nconst descriptorPath = (handle: FileHandle): string => `/proc/${process.pid}/fd/${handle.fd}`\n\nasync function mapDirectoryError(e: unknown, at: string, phase: string): Promise<AgentError> {\n  const code = fsCode(e)\n  if (code === 'ELOOP') return Object.assign(new AgentError('WORKSPACE_OUTSIDE_SCOPE', 403), { reason: 'symlink-component', at, phase })\n  if (code === 'ENOTDIR') {\n    // Linux answers `O_DIRECTORY|O_NOFOLLOW` on a symlink with ENOTDIR rather\n    // than with ELOOP, and reports the same errno for a component that is\n    // genuinely not a directory, so the open flags alone cannot separate an\n    // escape attempt from a wrong-type component. Look at the entry the walk\n    // refused; the refusal itself never depended on this observation, so a race\n    // can only change the reported reason, never the outcome.\n    const entry = await lstat(at, BIG).catch(() => null)\n    if (entry?.isSymbolicLink()) return Object.assign(new AgentError('WORKSPACE_OUTSIDE_SCOPE', 403), { reason: 'symlink-component', at, phase, fsCode: code })\n    return Object.assign(new AgentError('TARGET_PARENT_INVALID', 400), { reason: entry ? 'non-directory-component' : 'component-vanished', at, phase, fsCode: code })\n  }\n  if (code === 'ENOENT' || code === 'ENOTEMPTY') return Object.assign(new AgentError('TARGET_PARENT_INVALID', 400), { reason: 'missing-component', at, phase })\n  if (code === 'EACCES' || code === 'EPERM') return Object.assign(new AgentError('PINNED_WRITE_FAILED', 500), { reason: 'permission', at, phase, fsCode: code })\n  return Object.assign(new AgentError('PINNED_WRITE_FAILED', 500), { reason: 'directory-open', at, phase, fsCode: code })\n}\n\n/** Resolve the configured root once; the descriptor walk then sees no symlinks. */\nasync function resolveRoot(rootPath: unknown): Promise<string> {\n  if (typeof rootPath !== 'string' || !rootPath || rootPath.includes('\\0') || !path.posix.isAbsolute(rootPath) || Buffer.byteLength(rootPath) > PINNED_WRITE_MAX_PATH_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'root-path' })\n  try { return await realpath(rootPath) } catch (e) {\n    const code = fsCode(e)\n    if (code === 'ENOENT' || code === 'ENOTDIR') failWrite('TARGET_PARENT_INVALID', 400, { reason: 'root-missing', fsCode: code })\n    if (code === 'ELOOP') failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'root-symlink', fsCode: code })\n    failWrite('PINNED_WRITE_FAILED', 500, { reason: 'root-unreadable', fsCode: code })\n  }\n}\n\n/** Split and bound a root-relative target path; the last component is the name. */\nfunction splitComponents(relativePath: unknown): string[] {\n  if (typeof relativePath !== 'string' || relativePath.includes('\\0') || Buffer.byteLength(relativePath) > PINNED_WRITE_MAX_PATH_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'relative-path' })\n  if (path.posix.isAbsolute(relativePath)) failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'absolute-relative-path' })\n  const parts = relativePath.split(/[\\\\/]/).filter(Boolean)\n  if (!parts.length || parts.length > PINNED_WRITE_MAX_COMPONENTS) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-count', count: parts.length })\n  for (const part of parts) {\n    if (part === '.' || part === '..') failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'dot-component', component: part })\n    if (Buffer.byteLength(part) > PINNED_WRITE_MAX_COMPONENT_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-too-long' })\n    if (/[. ]$/.test(part)) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-suffix' })\n    if (/[\\u0000-\\u001f\\u007f]/.test(part)) failWrite('INVALID_ARGUMENT', 400, { reason: 'component-control' })\n  }\n  return parts\n}\n\nfunction toBuffer(content: unknown, encoding: unknown): Buffer {\n  if (encoding !== undefined && encoding !== 'utf8' && encoding !== 'base64') failWrite('INVALID_ARGUMENT', 400, { reason: 'encoding' })\n  if (typeof content === 'string') {\n    if (encoding === 'base64') {\n      const compact = content.replace(/\\s+/g, '')\n      if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact) || compact.length % 4 !== 0) failWrite('INVALID_ARGUMENT', 400, { reason: 'base64' })\n      return Buffer.from(compact, 'base64')\n    }\n    return Buffer.from(content, 'utf8')\n  }\n  if (content instanceof Uint8Array) {\n    try { return Buffer.from(content.buffer, content.byteOffset, content.byteLength) } catch { failWrite('INVALID_ARGUMENT', 400, { reason: 'content-buffer' }) }\n  }\n  failWrite('INVALID_ARGUMENT', 400, { reason: 'content-type' })\n}\n\nasync function writeAll(handle: FileHandle, data: Buffer, signal?: AbortSignal): Promise<void> {\n  let offset = 0\n  while (offset < data.byteLength) {\n    if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'during-write', possiblyApplied: false })\n    const written = await guard(() => handle.write(data, offset, data.byteLength - offset), 'temp-write')\n    if (!written.bytesWritten) failWrite('PINNED_WRITE_FAILED', 500, { reason: 'short-write', offset })\n    offset += written.bytesWritten\n  }\n}\n\nexport type PinnedWritePhase = 'before-pin' | 'before-publish' | 'after-publish'\nexport type PinnedWriteCheckReport = {\n  /** Which decision point this report belongs to. */\n  phase: PinnedWritePhase\n  /** Real root directory the target must stay inside. */\n  rootPath: string\n  /** Real parent directory of the target. */\n  directoryPath: string\n  /**\n   * Identity of the parent directory: observed on the host path at admission,\n   * and taken from the held descriptor from `before-publish` onwards, so a\n   * replacement between admission and the pin is visible to the caller.\n   */\n  directory: PinnedIdentity\n  /** Intended target path (may not exist yet). */\n  targetPath: string\n  targetName: string\n  size: number\n  sha256: string\n  /** Present at `before-publish` only: our own private temp file, retired before the write returns. */\n  temp?: { name: string; identity: PinnedIdentity; mode: number; size: number }\n}\n/**\n * Host policy hook. Throwing aborts the write; the thrown error is propagated\n * unchanged (except after publication, see `pinnedCreateNewFile`). It is a\n * policy decision about what the host could observe, never a kernel guarantee.\n */\nexport type PinnedWriteCheck = (report: PinnedWriteCheckReport) => void | Promise<void>\n\nexport type PinnedWriteRequest = {\n  /** Configured root directory; resolved with `realpath` before pinning. */\n  rootPath: string\n  /** Root-relative path of the file to create; it must not exist yet. */\n  relativePath: string\n  content: string | Uint8Array\n  encoding?: 'utf8' | 'base64'\n  maxBytes?: number\n  signal?: AbortSignal\n  check?: PinnedWriteCheck\n}\n\nexport type PinnedWriteResult = {\n  path: string\n  directoryPath: string\n  /** Identity of the directory the write was published through, from the held descriptor. */\n  directory: PinnedIdentity\n  dev: string\n  ino: string\n  /** Links on the published name, observed after the private temp name was retired. */\n  nlink: number\n  size: number\n  sha256: string\n}\n\n/**\n * Create `relativePath` inside `rootPath` as a brand-new regular file.\n *\n * Refuses (fail closed, nothing published) when the target already exists, when\n * the directory identity diverges from the host path, when the caller cancels\n * before publication, or when the host `check` vetoes any phase.\n *\n * A refusal discovered after the target name exists carries\n * `published: true` and `possiblyApplied: true`, because by then the file is on\n * disk and the caller must not read the error as \"nothing was written\".\n */\nexport async function pinnedCreateNewFile(request: PinnedWriteRequest): Promise<PinnedWriteResult> {\n  if (!request || typeof request !== 'object') failWrite('INVALID_ARGUMENT', 400, { reason: 'request' })\n  const { rootPath, relativePath, content, encoding, maxBytes = PINNED_WRITE_MAX_BYTES, signal, check } = request\n  if (!pinnedWriteSupported()) failWrite('PINNED_WRITE_UNSUPPORTED', 503, { platform: process.platform })\n  if (check !== undefined && typeof check !== 'function') failWrite('INVALID_ARGUMENT', 400, { reason: 'check' })\n  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0 || maxBytes > PINNED_WRITE_MAX_LIMIT_BYTES) failWrite('INVALID_ARGUMENT', 400, { reason: 'max-bytes' })\n  const data = toBuffer(content, encoding)\n  if (data.byteLength > maxBytes) failWrite('INVALID_ARGUMENT', 400, { reason: 'content-too-large', limit: maxBytes })\n  const digest = sha(data)\n  const components = splitComponents(relativePath)\n  const root = await resolveRoot(rootPath)\n  const targetName = components[components.length - 1]!\n  const directoryPath = path.posix.join(root, ...components.slice(0, -1))\n  const targetPath = path.posix.join(directoryPath, targetName)\n  // lstat, not stat: a symlinked parent has to be refused as an escape attempt\n  // instead of being followed into whatever it points at, so the admission\n  // report never claims an identity for a directory we did not verify. The\n  // descriptor walk below re-checks every component with `O_NOFOLLOW`; this only\n  // keeps the reported reason and the `check` report honest.\n  const observed = await lstat(directoryPath, BIG).catch(e => {\n    const code = fsCode(e)\n    if (code === 'ENOENT' || code === 'ENOTDIR') failWrite('TARGET_PARENT_INVALID', 400, { reason: 'parent-missing', at: directoryPath })\n    if (code === 'ELOOP') failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'parent-symlink', at: directoryPath })\n    failWrite('PINNED_WRITE_FAILED', 500, { reason: 'parent-unreadable', at: directoryPath, fsCode: code })\n  })\n  if (observed.isSymbolicLink()) failWrite('WORKSPACE_OUTSIDE_SCOPE', 403, { reason: 'parent-symlink', at: directoryPath })\n  if (!observed.isDirectory()) failWrite('TARGET_PARENT_INVALID', 400, { reason: 'parent-not-directory', at: directoryPath })\n  const report = (phase: PinnedWritePhase, temp?: PinnedWriteCheckReport['temp']): PinnedWriteCheckReport => ({ phase, rootPath: root, directoryPath, directory: identityOf(observed), targetPath, targetName, size: data.byteLength, sha256: digest, ...(temp ? { temp } : {}) })\n  if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'before-pin', possiblyApplied: false })\n  if (check) await check(report('before-pin'))\n  // Pin the real parent directory: the root plus every intermediate component of\n  // the relative path, so no symlink or non-directory can hide in between.\n  const pinned = await PinnedDirectory.pin(root, components.slice(0, -1))\n  let tempName = ''\n  let held: FileHandle | undefined\n  let tempRetired = false\n  try {\n    await pinned.verifyHostPath(directoryPath)\n    if (await pinned.lstatChild(targetName)) failWrite('TARGET_EXISTS', 409, { target: targetPath })\n    tempName = `${PINNED_WRITE_TEMP_PREFIX}${randomBytes(16).toString('hex')}`\n    const temp = await open(pinned.childPath(tempName), TEMP_FLAGS, 0o600).catch(e => {\n      const code = fsCode(e)\n      if (code === 'EEXIST') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-name-collision' })\n      if (code === 'EACCES' || code === 'EPERM') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-permission', fsCode: code })\n      failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-create', fsCode: code })\n    })\n    held = temp\n    // The umask may strip owner bits, so make the private mode deterministic.\n    await temp.chmod(0o600).catch(e => failWrite('PINNED_WRITE_FAILED', 500, { reason: 'temp-chmod', fsCode: fsCode(e) }))\n    let created: BigIntStats\n    await writeAll(temp, data, signal)\n    await temp.sync().catch(() => { })\n    // Our own temp file must stay a private, unlinked, exact-size regular file.\n    const verifyTemp = async (label: string): Promise<BigIntStats> => {\n      const current = await guard(() => temp.stat(BIG), 'temp-stat')\n      if (!current.isFile()) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-not-regular', label })\n      if (current.size !== BigInt(data.byteLength)) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-size', label, size: String(current.size) })\n      if ((Number(current.mode) & 0o777) !== 0o600) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-mode', label, mode: Number(current.mode) & 0o777 })\n      if (current.nlink !== 1n) failWrite('PINNED_WRITE_TAMPERED', 409, { reason: 'temp-linked', label, nlink: Number(current.nlink) })\n      return current\n    }\n    created = await verifyTemp('written')\n    if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'before-publish', possiblyApplied: false })\n    if (check) await check(report('before-publish', { name: tempName, identity: identityOf(created), mode: Number(created.mode) & 0o777, size: Number(created.size) }))\n    created = await verifyTemp('pre-publish')\n    // The host may have been unable to observe anything between the previous\n    // line and the link below, so re-verify both halves of the pin here.\n    await pinned.verifyHostPath(directoryPath)\n    if (await pinned.lstatChild(targetName)) failWrite('TARGET_EXISTS', 409, { target: targetPath })\n    if (signal?.aborted) failWrite('WRITE_CANCELLED', 409, { reason: 'before-link', possiblyApplied: false })\n    await link(pinned.childPath(tempName), pinned.childPath(targetName)).catch(e => {\n      const code = fsCode(e)\n      if (code === 'EEXIST') failWrite('TARGET_EXISTS', 409, { target: targetPath })\n      if (code === 'EXDEV') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'cross-device', fsCode: code })\n      if (code === 'EACCES' || code === 'EPERM') failWrite('PINNED_WRITE_FAILED', 500, { reason: 'publish-permission', fsCode: code })\n      failWrite('PINNED_WRITE_FAILED', 500, { reason: 'publish', fsCode: code })\n    })\n    const published = await publishedGuard(() => pinned.lstatChild(targetName), 'published-initial-stat')\n    if (!published || !published.isFile() || String(published.dev) !== String(created.dev) || String(published.ino) !== String(created.ino)) failAfterPublish('PINNED_WRITE_TAMPERED', 409, { reason: 'published-mismatch' })\n    if (signal?.aborted) failAfterPublish('WRITE_CANCELLED', 409, { reason: 'after-publish', result: { path: targetPath, size: data.byteLength, sha256: digest } })\n    await pinned.sync()\n    // `link()` leaves the payload under two names for a moment. The result has\n    // to describe the directory as it is once this call is finished, so retire\n    // the private name first, make that retirement durable, and observe the\n    // published name again instead of reporting the intermediate link count.\n    const retired = await retireTempName(pinned, tempName)\n    if (!retired.retired) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'temp-cleanup-failed', temp: tempName, fsCode: retired.fsCode })\n    tempRetired = true\n    await pinned.sync()\n    /**\n     * The published name must still be the private regular file we linked: one\n     * link, the exact size, the exact mode, and the inode we wrote.\n     */\n    const verifyPublished = async (label: string, expected: { dev: string; ino: string }): Promise<BigIntStats> => {\n      const current = await publishedGuard(() => pinned.lstatChild(targetName), 'published-stat')\n      if (!current || !current.isFile() || String(current.dev) !== expected.dev || String(current.ino) !== expected.ino) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-replaced', label, target: targetPath })\n      if (current.size !== BigInt(data.byteLength)) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-size', label, target: targetPath })\n      if ((Number(current.mode) & 0o777) !== 0o600) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-mode', label, target: targetPath })\n      // A second link means a foreign writer reached our private payload, so the\n      // published file no longer has the one-link shape this component promises.\n      if (current.nlink !== 1n) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-extra-links', label, target: targetPath, nlink: Number(current.nlink) })\n      return current\n    }\n    const final = await verifyPublished('after-cleanup', { dev: String(published.dev), ino: String(published.ino) })\n    // The reported digest is evidence about the bytes on disk, not a claim about\n    // the buffer we were handed, so read the published payload back through the\n    // descriptor we wrote it with and compare it with what was requested. The\n    // descriptor still denotes the published inode: retiring the private name\n    // removed a link, not the object.\n    let offset = 0\n    while (offset < data.byteLength) {\n      const want = Math.min(65536, data.byteLength - offset)\n      const chunk = Buffer.allocUnsafe(want)\n      const read = await publishedGuard(() => temp.read(chunk, 0, want, offset), 'published-read')\n      if (read.bytesRead !== want) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-short-read', offset, expected: want, read: read.bytesRead })\n      if (chunk.compare(data.subarray(offset, offset + want)) !== 0) failAfterPublish('PINNED_WRITE_UNVERIFIED', 409, { reason: 'published-content', offset })\n      offset += want\n    }\n    if (signal?.aborted) failAfterPublish('WRITE_CANCELLED', 409, { reason: 'after-publish', result: { path: targetPath, size: data.byteLength, sha256: digest } })\n    const settled = await verifyPublished('after-read-back', { dev: String(final.dev), ino: String(final.ino) })\n    // The directory identity comes from the descriptor we wrote through, never\n    // from the admission observation: a replacement between admission and the\n    // pin would otherwise be reported as the directory that is not on disk.\n    const directory = await publishedGuard(() => pinned.identity(), 'published-directory')\n    const result: PinnedWriteResult = { path: targetPath, directoryPath, directory, dev: String(settled.dev), ino: String(settled.ino), nlink: Number(settled.nlink), size: Number(settled.size), sha256: digest }\n    // A divergence here means the name we created is no longer the name the\n    // host asked for; the caller must treat the outcome as unknown.\n    try { await pinned.verifyHostPath(directoryPath) } catch (e) { throw annotatePublished(e) }\n    if (check) {\n      const afterPublish = { ...report('after-publish'), directory }\n      try { await check(afterPublish) } catch (e) {\n        throw Object.assign(new AgentError('PINNED_WRITE_UNVERIFIED', 409), { possiblyApplied: true, published: true, cause: e })\n      }\n    }\n    return result\n  } finally {\n    // Every path that did not already retire the private name gets one more\n    // best-effort attempt: a leftover name is a workspace leak, but it must never\n    // mask the real reason this write failed.\n    if (tempName && !tempRetired) await unlink(pinned.childPath(tempName)).catch(() => { })\n    await held?.close().catch(() => { })\n    await pinned.close()\n  }\n}\n", "import { readFile, stat, writeFile } from 'node:fs/promises'\nimport { isAbsolute, join, relative, resolve } from 'node:path'\nimport { canonical, fail, sha, type Context } from './protocol.js'\nimport { Store } from './store.js'\nimport { Roots } from './scope.js'\nimport { WorkspacePin } from './workspace-identity.js'\nimport { createAgentCodexSession } from '../../packages/cli-runtime/src/agent-codex-runtime.mjs'\n\nexport type CliProfileConfig={profileId:string;rootId:string;profileRevision:number;executable:string;runtimeRoot:string;entry:{sha256:string;version:string};bots:Record<string,{credentialRef:string}>}\nconst ref=(value:any)=>typeof value==='string'&&/^[-A-Za-z0-9_.]{1,128}$/.test(value)\nconst plain=(value:any)=>value&&typeof value==='object'&&!Array.isArray(value)&&Object.getPrototypeOf(value)===Object.prototype\nconst closed=(value:any,keys:string[])=>{if(!plain(value)||Object.keys(value).some(key=>!keys.includes(key)))fail('INVALID_CLI_ARGUMENT');return value}\nconst inside=(parent:string,child:string)=>{const part=relative(parent,child);return part!==''&&!part.startsWith('..')&&!isAbsolute(part)}\n\nexport function validateCliProfiles(value:any,dataDir:string,roots:Record<string,string>):CliProfileConfig[]{\n if(value===undefined)return []\n if(!Array.isArray(value)||value.length>64||!['win32','linux'].includes(process.platform))fail('CLI_PROFILE_CONFIG_INVALID')\n const seen=new Set<string>(),runtimeRoots=new Set<string>()\n return value.map(raw=>{\n  closed(raw,['profileId','rootId','profileRevision','executable','runtimeRoot','entry','bots'])\n  if(!ref(raw.profileId)||!ref(raw.rootId)||!Object.hasOwn(roots,raw.rootId)||!Number.isSafeInteger(raw.profileRevision)||raw.profileRevision<1\n   ||!isAbsolute(raw.executable)||!isAbsolute(raw.runtimeRoot)||!inside(resolve(dataDir),resolve(raw.runtimeRoot)))fail('CLI_PROFILE_CONFIG_INVALID')\n  closed(raw.entry,['sha256','version'])\n  if(!/^[a-f0-9]{64}$/.test(raw.entry.sha256)||!/^\\d+\\.\\d+\\.\\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(raw.entry.version))fail('CLI_PROFILE_CONFIG_INVALID')\n  if(!plain(raw.bots)||!Object.keys(raw.bots).length)fail('CLI_PROFILE_CONFIG_INVALID')\n  for(const [botId,bot] of Object.entries<any>(raw.bots)){\n   if(!ref(botId))fail('CLI_PROFILE_CONFIG_INVALID');closed(bot,['credentialRef'])\n   if(!isAbsolute(bot.credentialRef)||bot.credentialRef.length>4096||bot.credentialRef.includes('\\0'))fail('CLI_PROFILE_CONFIG_INVALID')\n  }\n  const key=`${raw.rootId}/${raw.profileId}`,runtime=resolve(raw.runtimeRoot)\n  if(seen.has(key)||runtimeRoots.has(runtime))fail('CLI_PROFILE_CONFIG_INVALID');seen.add(key);runtimeRoots.add(runtime)\n  return {profileId:raw.profileId,rootId:raw.rootId,profileRevision:raw.profileRevision,executable:resolve(raw.executable),runtimeRoot:runtime,entry:{sha256:raw.entry.sha256,version:raw.entry.version},bots:structuredClone(raw.bots)}\n })\n}\n\ntype Identity={args:any;profile:CliProfileConfig;workspaceId:string;pin:WorkspacePin}\ntype Settlement={status:'succeeded'|'failed'|'cancelled'|'unknown';result:any;error:string|null}\n\nexport class CliTasks{\n private profiles:Map<string,CliProfileConfig>\n constructor(cliProfiles:CliProfileConfig[],private store:Store,private roots:Roots){\n  this.profiles=new Map(cliProfiles.map(profile=>[`${profile.rootId}/${profile.profileId}`,profile]))\n }\n private async identity(a:any,c:Context,probe:boolean):Promise<Identity>{\n  const base=['rootId','workspaceRef','profileId','profileRevision','entry','requestedModel','catalogProvider','catalogModel','billing','deadlineMs']\n  closed(a,[...base,...(probe?[]:['task'])]);closed(a.workspaceRef,['kind','machineId','rootId','relativePath','workspaceId']);closed(a.entry,['sha256','version'])\n  if(!ref(a.rootId)||!c.roots.includes(a.rootId)||!ref(a.profileId)||!Number.isSafeInteger(a.profileRevision)||a.profileRevision<1\n   ||a.workspaceRef.kind!=='remote'||a.workspaceRef.machineId!==this.store.machineId||a.workspaceRef.rootId!==a.rootId\n   ||typeof a.workspaceRef.relativePath!=='string'||a.workspaceRef.relativePath.length>2048||typeof a.workspaceRef.workspaceId!=='string'\n   ||!/^[a-f0-9]{64}$/.test(a.entry.sha256)||!/^\\d+\\.\\d+\\.\\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(a.entry.version)\n   ||!/^gpt-[A-Za-z0-9_.-]{1,100}$/.test(a.requestedModel)||typeof a.catalogProvider!=='string'||!a.catalogProvider||typeof a.catalogModel!=='string'||!a.catalogModel\n   ||!['api','subscription'].includes(a.billing)||!Number.isSafeInteger(a.deadlineMs)||a.deadlineMs<1000||a.deadlineMs>7200000)fail('INVALID_CLI_ARGUMENT')\n  if(!probe&&(typeof a.task!=='string'||!a.task.trim()||a.task.includes('\\0')||Buffer.byteLength(a.task)>16000))fail('INVALID_CLI_ARGUMENT')\n  const profile=this.profiles.get(`${a.rootId}/${a.profileId}`)\n  if(!profile||profile.profileRevision!==a.profileRevision||profile.entry.sha256!==a.entry.sha256||profile.entry.version!==a.entry.version||!Object.hasOwn(profile.bots,c.botId))fail('CLI_PROFILE_DENIED',403)\n  const workspaceId='remote_'+sha(canonical({rootId:a.rootId,workspaceRelativePath:a.workspaceRef.relativePath,profileId:a.profileId,profileRevision:a.profileRevision,entrySha256:a.entry.sha256,entryVersion:a.entry.version}))\n  if(a.workspaceRef.workspaceId!==workspaceId)fail('CLI_WORKSPACE_IDENTITY_MISMATCH',403)\n  const cwd=await this.roots.resolve(a.rootId,a.workspaceRef.relativePath)\n  if(!(await stat(cwd)).isDirectory())fail('CLI_WORKSPACE_OUTSIDE_SCOPE',403)\n  const pin=await WorkspacePin.capture(cwd);await pin.verify()\n  return {args:a,profile,workspaceId,pin}\n }\n private async provision(profile:CliProfileConfig,c:Context,home:string){\n  const reference=profile.bots[c.botId].credentialRef\n  const bytes=await readFile(reference)\n  if(bytes.length>65536)fail('CLI_CREDENTIAL_PROVISION_FAILED')\n  await writeFile(join(home,'auth.json'),bytes,{flag:'wx',mode:0o600})\n }\n private async session(identity:Identity,c:Context,operationId:string,signal:AbortSignal){\n  const {args,profile,workspaceId,pin}=identity\n  return createAgentCodexSession({context:c,validate:()=>this.store.validate(c),binding:{taskId:c.taskId,attemptId:c.attemptId,machineId:this.store.machineId,workspaceId,location:'remote'},operationId,\n   runtimeRoot:profile.runtimeRoot,workspace:pin.identity.path,entry:{executable:profile.executable,...profile.entry},requestedModel:args.requestedModel,catalogProvider:args.catalogProvider,catalogModel:args.catalogModel,\n   billing:args.billing,deadlineMs:args.deadlineMs,tools:[],handlers:[],signal,provisionCredentials:(home:string)=>this.provision(profile,c,home)})\n }\n private remoteReceipt(identity:Identity,snapshot:any){\n  const {args,pin}=identity\n  return {...snapshot,remote:{rootId:args.rootId,workspaceRelativePath:args.workspaceRef.relativePath,profileId:args.profileId,profileRevision:args.profileRevision,workspaceIdentity:pin.identity}}\n }\n async probe(a:any,c:Context,operationId?:string){\n  if(!operationId)fail('OPERATION_ID_REQUIRED')\n  const identity=await this.identity(a,c,true),controller=new AbortController();let session:any\n  try{\n   session=await this.session(identity,c,operationId,controller.signal)\n   const readiness=await session.listCapabilities(),stop=await session.close(),snapshot=this.remoteReceipt(identity,session.snapshot())\n   if(stop?.treeStopped!==true)fail('CLI_STOP_UNCONFIRMED',409)\n   return {schemaVersion:1,kind:'remote-cli-probe',status:'available',location:'remote',machineId:this.store.machineId,rootId:a.rootId,workspaceId:identity.workspaceId,\n    workspaceRelativePath:a.workspaceRef.relativePath,workspaceIdentity:identity.pin.identity,profileId:a.profileId,profileRevision:a.profileRevision,\n    entry:{sha256:a.entry.sha256,version:a.entry.version,path:session.entry.path},requestedModel:a.requestedModel,loginStatus:'unknown',versionStatus:'available',dependencyStatus:'available',\n    nativeStatus:'available',profileStatus:'available',readinessStatus:'available',readiness,home:session.home,cwd:identity.pin.identity.path,stopConfirmed:true,stopEvidence:stop,\n    capabilityProbe:snapshot.capabilityProbe,profile:snapshot.profile}\n  }finally{await session?.close().catch(()=>{});controller.abort();await identity.pin.close()}\n }\n async run(a:any,c:Context,operationId:string,hooks:{setProcess:(record:any)=>void;clearProcess:()=>void}):Promise<Settlement>{\n  let identity:Identity|undefined,session:any,stop:any=null,error:any=null\n  const controller=new AbortController()\n  hooks.setProcess({context:c,cancel:async()=>{controller.abort(new Error('CANCELLED'));await session?.close()}})\n  try{\n   identity=await this.identity(a,c,false)\n   session=await this.session(identity,c,operationId,controller.signal)\n   await identity.pin.verify();await session.run(a.task);await identity.pin.verify()\n  }catch(e){error=e}\n  finally{\n   try{stop=await session?.close()}catch(e){error??=e}\n   if(identity)await identity.pin.close();hooks.clearProcess()\n  }\n  const base=session?.snapshot(),receipt=identity&&base?this.remoteReceipt(identity,base):null,stopConfirmed=stop?.treeStopped===true\n  if(receipt&&stopConfirmed&&controller.signal.aborted&&!['completed','failed'].includes(receipt.terminal))receipt.terminal='interrupted'\n  const terminal=receipt?.terminal==='completed'?'succeeded':receipt?.terminal==='failed'?'failed':receipt?.terminal==='interrupted'?'cancelled':'unknown'\n  const status=!stopConfirmed?'unknown':error&&terminal==='succeeded'?'unknown':terminal\n  const code=status==='unknown'?'OUTCOME_UNKNOWN':status==='cancelled'?'CANCELLED':status==='failed'?(error?.code??'CLI_TASK_FAILED'):null\n  const result={kind:'remote-cli',schemaVersion:1,receipt,stopConfirmed,stopEvidence:stop??{treeStopped:false,status:'unconfirmed'},exitCode:Number.isSafeInteger(stop?.exitCode)?stop.exitCode:null,\n   ...(receipt?.cliTurnRequestsDispatched===0?{notStarted:true,possiblyApplied:false}:{})}\n  return {status,result,error:code}\n }\n}\n", "import { randomBytes } from 'node:crypto'\nimport { createCodexSessionCore, pinCodexExecutable } from './codex-session-core.mjs'\n\nexport { pinCodexExecutable }\n\nfunction agentAuthority(context, validate, requestedModel, catalogProvider, catalogModel) {\n  const leases = new Map()\n  const subject = Object.freeze({})\n  const bindingKey = value => JSON.stringify(value)\n  const current = (token, binding) => {\n    validate(context)\n    const lease = leases.get(token)\n    if (!lease || lease.binding !== bindingKey(binding) || lease.expiresAt <= Date.now()) {\n      leases.delete(token)\n      throw new Error('AGENT_CLI_LEASE_DENIED')\n    }\n    return lease\n  }\n  const authority = {\n    describe() { validate(context); return { botId: context.botId, revision: context.revision } },\n    assertModel(_subject, provider, model) {\n      validate(context)\n      if (provider !== catalogProvider || model !== catalogModel || requestedModel !== catalogModel) throw new Error('AGENT_CLI_MODEL_DENIED')\n    },\n    issue(_subject, { binding, tools, ttlMs }) {\n      validate(context)\n      if (binding?.location !== 'remote' || !Array.isArray(tools) || tools.length || !Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > 300000) throw new Error('AGENT_CLI_LEASE_DENIED')\n      const token = randomBytes(32).toString('base64url')\n      leases.set(token, { binding: bindingKey(binding), tools: new Set(tools), expiresAt: Math.min(Date.now() + ttlMs, context.expiresAt) })\n      return { token }\n    },\n    list(token, binding) { return [...current(token, binding).tools].sort() },\n    renew(token, binding, { ttlMs }) {\n      const lease = current(token, binding)\n      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > 300000) throw new Error('AGENT_CLI_LEASE_DENIED')\n      lease.expiresAt = Math.min(Date.now() + ttlMs, context.expiresAt)\n      return { ttlMs }\n    },\n    async run(token, binding, tool, execute, { signal } = {}) {\n      const lease = current(token, binding)\n      if (!lease.tools.has(tool)) throw new Error('AGENT_CLI_TOOL_DENIED')\n      validate(context)\n      return execute({ signal: signal ?? new AbortController().signal })\n    },\n    release(token) { leases.delete(token) },\n  }\n  return { authority, subject, close: () => leases.clear() }\n}\n\n/** Agent-process-only entry. The binding remains remote; no Host-local fallback exists here. */\nexport async function createAgentCodexSession(options) {\n  const { context, validate, requestedModel, catalogProvider = 'openai', catalogModel = requestedModel } = options ?? {}\n  if (options?.binding?.location !== 'remote' || !context || typeof validate !== 'function') throw new Error('AGENT_CLI_REMOTE_BINDING_REQUIRED')\n  if (!Array.isArray(options.tools) || options.tools.length || !Array.isArray(options.handlers) || options.handlers.length) throw new Error('AGENT_CLI_CAPABILITIES_FIXED')\n  const local = agentAuthority(context, validate, requestedModel, catalogProvider, catalogModel)\n  try {\n    const session = await createCodexSessionCore({ ...options, authority: local.authority, subject: local.subject })\n    const close = session.close\n    return Object.freeze({ ...session, async close() { try { return await close() } finally { local.close() } }, async cancel() { try { return await session.cancel() } finally { local.close() } } })\n  } catch (error) {\n    local.close()\n    throw error\n  }\n}\n", "import { createHash } from 'node:crypto'\nimport { readFile, realpath, stat, mkdir, writeFile } from 'node:fs/promises'\nimport { spawn } from 'node:child_process'\nimport { isAbsolute, join } from 'node:path'\nimport { capabilityProbe, nativeProcess, privateEnvironment, protectProfile } from './native-process.mjs'\nimport { createCliBootstrap } from '../../capability-broker/src/cli-bootstrap.mjs'\nimport { createCodexEvidence } from './contracts.mjs'\nimport { providerSettings, assertEffectiveProfile } from './profile-policy.mjs'\n\nconst digest = value => createHash('sha256').update(value).digest('hex')\nconst id = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value)\nconst validText = value => typeof value === 'string' && value.trim() && !value.includes('\\0') && Buffer.byteLength(value) <= 64_000\n\n/** Caller supplies an installation-attested absolute native entry and immutable expected digest. */\nexport async function pinCodexExecutable({ executable, sha256, version }, home) {\n  if (!isAbsolute(executable) || !/^[a-f0-9]{64}$/.test(sha256) || !/^\\d+\\.\\d+\\.\\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(version)) throw new TypeError('PINNED_NATIVE_ENTRY_REQUIRED')\n  const path = await realpath(executable)\n  if (!(await stat(path)).isFile() || process.platform === 'win32' && !path.toLowerCase().endsWith('.exe')) throw new Error('NATIVE_ENTRY_REQUIRED')\n  if (digest(await readFile(path)) !== sha256) throw new Error('CLI_ENTRY_CHANGED')\n  const reported = await new Promise((resolve, reject) => {\n    const child = spawn(path, ['--version'], { cwd: home, env: privateEnvironment(home), windowsHide: true, shell: false, stdio: ['ignore', 'pipe', 'pipe'] })\n    let output = '', error = ''\n    const timer = setTimeout(() => { child.kill(); reject(new Error('CLI_VERSION_TIMEOUT')) }, 10_000)\n    child.stdout.on('data', chunk => { output += chunk.toString('utf8'); if (output.length > 1024) child.kill() })\n    child.stderr.on('data', chunk => { error = (error + chunk.toString('utf8')).slice(-1024) })\n    child.once('error', reject)\n    child.once('close', code => { clearTimeout(timer); if (code === 0) resolve(output.trim()); else reject(new Error(`CLI_VERSION_FAILED: ${error.slice(0, 128)}`)) })\n  })\n  if (reported !== `codex-cli ${version}`) throw new Error('CLI_VERSION_MISMATCH')\n  return Object.freeze({ path, sha256, version })\n}\n\n/** Internal session mechanics. Public local and Agent wrappers own their disjoint binding guards. */\nexport async function createCodexSessionCore({ authority, subject, binding, operationId, tools = [], handlers = [],\n  runtimeRoot, workspace, entry: suppliedEntry, requestedModel, catalogProvider = 'openai', catalogModel = requestedModel,\n  deadlineMs = 60_000, provisionCredentials, billing = 'subscription', python, onUsage, onBeforeRequest, onProgress, signal,\n  providerConfig = {}, roleInstructions }) {\n  if (!id(operationId) || !isAbsolute(runtimeRoot) || !isAbsolute(workspace) || !/^gpt-[A-Za-z0-9_.-]{1,100}$/.test(requestedModel)) throw new TypeError('INVALID_CLI_TASK')\n  if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 1000 || deadlineMs > 7_200_000) throw new TypeError('INVALID_CLI_DEADLINE')\n  authority.assertModel(subject, catalogProvider, catalogModel)\n  const { botId, revision } = authority.describe(subject)\n  signal?.throwIfAborted()\n  const settings = providerSettings(providerConfig)\n  if (roleInstructions !== undefined && !validText(roleInstructions)) throw new TypeError('INVALID_CLI_ROLE')\n  const cwd = await realpath(workspace)\n  if (!(await stat(cwd)).isDirectory()) throw new Error('INVALID_WORKSPACE')\n  await mkdir(runtimeRoot, { recursive: true, mode: 0o700 })\n  const root = await realpath(runtimeRoot)\n  const home = join(root, `h-${operationId}`)\n  await mkdir(home, { mode: 0o700 })\n  for (const folder of ['tmp', 'cache', 'config', 'data', 'appdata', 'local', 'b']) await mkdir(join(home, folder), { mode: 0o700 })\n  const probe = await capabilityProbe({ home, python })\n  if (!probe.available) throw new Error(`NATIVE_PEER_UNAVAILABLE: ${probe.reason}`)\n  await protectProfile(probe.helper, home)\n  const entry = await pinCodexExecutable(suppliedEntry, home)\n  const bridge = await createCliBootstrap({ authority, subject, binding, tools, handlers, home: join(home, 'b'), ttlMs: deadlineMs, helper: probe.helper })\n  const config = [\n    `model = ${JSON.stringify(requestedModel)}`, 'model_provider = \"openai\"', 'approval_policy = \"never\"', 'sandbox_mode = \"read-only\"',\n    'web_search = \"disabled\"', 'cli_auth_credentials_store = \"file\"', 'suppress_unstable_features_warning = true',\n    'model_reasoning_effort = \"low\"',\n    ...settings.lines,\n    '[features]', 'shell_tool = false', 'multi_agent = false', 'memories = false',\n    '[analytics]', 'enabled = false', '[mcp_servers.dsh_task]', `command = ${JSON.stringify(bridge.command)}`,\n    `args = ${JSON.stringify(bridge.args)}`, `cwd = ${JSON.stringify(join(home, 'b'))}`, 'enabled = true', 'required = true',\n    `enabled_tools = ${JSON.stringify(tools)}`, 'env_vars = []', 'startup_timeout_sec = 20',\n    '[mcp_servers.dsh_task.env]', `HOME = ${JSON.stringify(home)}`, `USERPROFILE = ${JSON.stringify(home)}`,\n    `TEMP = ${JSON.stringify(join(home, 'tmp'))}`, `TMP = ${JSON.stringify(join(home, 'tmp'))}`,\n  ].join('\\n') + '\\n'\n  await writeFile(join(home, 'config.toml'), config, { flag: 'wx', mode: 0o600 })\n  if (provisionCredentials) await provisionCredentials(home)\n  if (digest(await readFile(join(home, 'config.toml'))) !== digest(Buffer.from(config))) { await bridge.close(); throw new Error('CLI_PROFILE_CHANGED_DURING_PROVISIONING') }\n  if (digest(await readFile(entry.path)) !== entry.sha256) { await bridge.close(); throw new Error('CLI_ENTRY_CHANGED') }\n  const evidence = createCodexEvidence({ binding, operationId, botId, requestedModel, catalogProvider, catalogModel, entry, billing })\n  const env = privateEnvironment(home)\n  const supervisor = nativeProcess(probe.helper, 'supervise', { executable: entry.path, args: ['app-server', '--listen', 'stdio://'], cwd, ttlMs: deadlineMs }, { home, env })\n  const pending = new Map(), notifications = new Set()\n  let sequence = 0, closed = false, rootProcess, stopEvidence = null, threadId = null, requestCount = 0, stopPromise, activeTurn = false, fatal = null, profileEvidence\n  let usageWrites = Promise.resolve()\n  const failPending = error => { for (const value of pending.values()) value.reject(error); pending.clear() }\n  const rpc = (method, params, timeoutMs = 30_000) => new Promise((resolve, reject) => {\n    if (closed || fatal) { reject(fatal ?? new Error('CLI_CLOSED')); return }\n    const id = ++sequence\n    const timer = setTimeout(() => { pending.delete(id); reject(new Error(`CLI_RPC_TIMEOUT:${method}`)) }, Math.min(timeoutMs, deadlineMs))\n    const settle = fn => value => { clearTimeout(timer); fn(value) }\n    pending.set(id, { resolve: settle(resolve), reject: settle(reject) })\n    void supervisor.send({ id, method, params }).catch(error => { const value = pending.get(id); pending.delete(id); value?.reject(error) })\n  })\n  const stop = () => {\n    if (stopPromise) return stopPromise\n    closed = true; failPending(new Error('CLI_STOPPING'))\n    clearInterval(grantGuard); signal?.removeEventListener('abort', onAbort)\n    stopPromise = (async () => {\n      await bridge.close()\n      // A completed turn can be immediately followed by the CLI's natural\n      // exit. Do not replace that native exit code with our cancellation code.\n      // Never grant this grace to an active, revoked, failed-protocol or aborted\n      // session, and do not treat elapsed grace as proof that anything stopped.\n      if (!fatal && !signal?.aborted && ['completed', 'failed'].includes(evidence.snapshot().terminal) && !stopEvidence?.treeStopped) {\n        await new Promise(resolve => {\n          const finish = () => { clearTimeout(grace); signal?.removeEventListener('abort', finish); resolve() }\n          const grace = setTimeout(finish, 1000)\n          supervisor.exit.then(finish); signal?.addEventListener('abort', finish, { once: true })\n          if (signal?.aborted) finish()\n        })\n      }\n      supervisor.end()\n      const result = await Promise.race([supervisor.exit, new Promise(resolve => { const t = setTimeout(() => resolve(null), 8000); t.unref() })])\n      if (!result) {\n        if (process.platform === 'linux' && rootProcess) { try { process.kill(-rootProcess.pid, 'SIGKILL') } catch {} }\n        supervisor.child.kill()\n        await supervisor.exit\n      }\n      if (!stopEvidence?.treeStopped) stopEvidence = { ...stopEvidence, treeStopped: false, status: 'unconfirmed', forcedSupervisorStop: !result }\n      return stopEvidence\n    })()\n    return stopPromise\n  }\n  supervisor.events.on('control', value => {\n    if (value.control === 'spawned') rootProcess = value\n    if (value.control === 'stopped') stopEvidence = value\n  })\n  supervisor.events.on('message', message => {\n    if (message.id !== undefined && !message.method) {\n      const value = pending.get(message.id); pending.delete(message.id)\n      if (message.error) value?.reject(Object.assign(new Error(`CLI_RPC_REFUSED:${message.error.message}`), { code: message.error.code }))\n      else value?.resolve(message.result)\n      return\n    }\n    if (message.id !== undefined) {\n      void supervisor.send({ id: message.id, error: { code: -32601, message: 'Host callback is not authorized' } }).catch(() => {})\n      return\n    }\n    const update = evidence.event(message)\n    if (onProgress && typeof message.method === 'string') onProgress({ method: message.method, errorCode: typeof message.params?.error?.codexErrorInfo === 'string' ? message.params.error.codexErrorInfo : null })\n    if (update.usageChanged && onUsage) {\n      const snapshot = evidence.snapshot()\n      usageWrites = usageWrites.then(() => onUsage(snapshot))\n      void usageWrites.catch(error => { fatal = error; void stop() })\n    }\n    if (update.mismatch) { fatal = new Error('CLI_MODEL_IDENTITY_MISMATCH'); void stop() }\n    for (const listener of notifications) listener(message, update)\n  })\n  supervisor.events.on('failure', error => { fatal = error; failPending(error); void stop() })\n  supervisor.events.once('closed', () => { closed = true; failPending(new Error('CLI_EXITED')); void bridge.close() })\n  const onAbort = () => { fatal = new Error('CLI_CANCELLED'); void stop() }\n  signal?.addEventListener('abort', onAbort, { once: true })\n  const grantGuard = setInterval(() => {\n    try { if (bridge.closed) throw new Error('CLI_BRIDGE_CLOSED'); if (authority.describe(subject).revision !== revision) throw new Error('CLI_GRANT_CHANGED'); authority.assertModel(subject, catalogProvider, catalogModel) }\n    catch { fatal = new Error('CLI_GRANT_REVOKED'); void stop() }\n  }, 100); grantGuard.unref()\n  if (signal?.aborted) onAbort()\n  const timer = setTimeout(() => { fatal = new Error('CLI_DEADLINE'); void stop() }, deadlineMs); timer.unref()\n  try {\n    const spawned = await supervisor.waitControl('spawned')\n    await bridge.bind(spawned)\n    await rpc('initialize', { clientInfo: { name: 'dsh_task_executor', title: 'DSH Task Executor', version: '0.0.0' }, capabilities: { experimentalApi: true } })\n    await supervisor.send({ method: 'initialized', params: {} })\n    profileEvidence = assertEffectiveProfile(await rpc('config/read', { cwd, includeLayers: false }), { requestedModel, bridge, home: join(home, 'b'), tools, settings })\n    const result = await rpc('thread/start', { model: requestedModel, modelProvider: 'openai', allowProviderModelFallback: false, cwd, approvalPolicy: 'never', sandbox: 'read-only', ephemeral: true,\n      ...(roleInstructions ? { developerInstructions: roleInstructions } : {}) })\n    evidence.bindThread(result); threadId = result.thread.id\n  } catch (error) { clearTimeout(timer); await stop(); error.bridgeEvidence = bridge.evidence; error.nativeError = supervisor.stderr.slice(-1024); throw error }\n  return Object.freeze({\n    home, entry, binding: Object.freeze({ ...binding }), operationId,\n    async listModels() { return rpc('model/list', { includeHidden: false, limit: 100 }) },\n    async listCapabilities() { return rpc('mcpServerStatus/list', { threadId, serverName: 'dsh_task', detail: 'toolsAndAuthOnly', limit: 100 }) },\n    async callCapability(name, args = {}) {\n      if (!tools.includes(name)) throw new Error('TOOL_DENIED')\n      return rpc('mcpServer/tool/call', { threadId, server: 'dsh_task', tool: name, arguments: args })\n    },\n    async run(prompt) {\n      if (!validText(prompt) || activeTurn || requestCount) throw new Error('INVALID_OR_REPEATED_CLI_TURN')\n      authority.assertModel(subject, catalogProvider, catalogModel)\n      authority.describe(subject)\n      if (onBeforeRequest) await onBeforeRequest({ botId, ...binding, operationId, source: 'cli', toolId: 'codex', requestedModel, entry })\n      if (closed || fatal) throw fatal ?? new Error('CLI_CLOSED')\n      if (authority.describe(subject).revision !== revision) throw new Error('CLI_GRANT_CHANGED')\n      authority.assertModel(subject, catalogProvider, catalogModel)\n      activeTurn = true; requestCount++\n      try {\n        const completion = new Promise((resolve, reject) => {\n          const listener = (_message, update) => { if (update.completed) { notifications.delete(listener); resolve(evidence.snapshot()) } }\n          notifications.add(listener)\n          supervisor.exit.then(() => { notifications.delete(listener); reject(fatal ?? new Error('CLI_EXITED_DURING_TURN')) })\n        })\n        completion.catch(() => {})\n        await rpc('turn/start', { threadId, input: [{ type: 'text', text: prompt, text_elements: [] }], model: requestedModel })\n        const result = await completion\n        await usageWrites\n        if (fatal) throw fatal\n        return { ...result, status: result.terminal === 'completed' ? 'succeeded' : 'failed' }\n      } finally { activeTurn = false }\n    },\n    async cancel() { clearTimeout(timer); return stop() },\n    async close() { clearTimeout(timer); return stop() },\n    snapshot() { return { ...evidence.snapshot(), cliTurnRequestsDispatched: requestCount,\n      actualProviderRequestCount: requestCount ? null : 0, actualProviderRequestCountStatus: requestCount ? 'not-reported-by-cli' : 'no-turn-dispatched',\n      process: rootProcess, stopEvidence, bridge: bridge.evidence, profile: profileEvidence,\n      enforcement: 'application-scope-with-cli-read-only', capabilityProbe: { peer: probe.peer, supervisor: probe.supervisor, limitations: probe.limitations } } },\n    get closed() { return closed },\n  })\n}\n", "import { spawn } from 'node:child_process'\nimport { EventEmitter } from 'node:events'\nimport { StringDecoder } from 'node:string_decoder'\nimport { access, realpath } from 'node:fs/promises'\nimport { isAbsolute, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nconst HERE = fileURLToPath(new URL('.', import.meta.url))\nconst MAX_FRAME = 262_144\n\n/** Deliberately small environment: profiles, credentials and proxy secrets are never inherited. */\nexport function privateEnvironment(home, source = process.env) {\n  const env = { HOME: home, USERPROFILE: home, APPDATA: join(home, 'appdata'), LOCALAPPDATA: join(home, 'local'),\n    CODEX_HOME: home, XDG_CACHE_HOME: join(home, 'cache'), XDG_CONFIG_HOME: join(home, 'config'),\n    XDG_DATA_HOME: join(home, 'data'), TEMP: join(home, 'tmp'), TMP: join(home, 'tmp'), TMPDIR: join(home, 'tmp'),\n    NO_COLOR: '1', PYTHONIOENCODING: 'utf-8', PYTHONUTF8: '1' }\n  for (const key of ['SystemRoot', 'windir', 'ComSpec', 'LANG', 'LC_ALL']) if (source[key]) env[key] = source[key]\n  // Fixed executable paths remove PATH lookup from both supervisor and bridge.\n  env.PATH = process.platform === 'win32' ? join(source.SystemRoot ?? 'C:\\\\Windows', 'System32') : '/usr/bin:/bin'\n  return env\n}\n\nexport async function resolveNativeHelper({ python = '/usr/bin/python3' } = {}) {\n  if (process.platform === 'win32') {\n    const executable = join(process.env.SystemRoot ?? 'C:\\\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe')\n    await access(executable)\n    return Object.freeze({ executable: await realpath(executable), prefix: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', join(HERE, 'native-peer.ps1')], platform: 'win32' })\n  }\n  if (process.platform !== 'linux' || !isAbsolute(python)) throw new Error('NATIVE_PEER_UNAVAILABLE')\n  await access(python)\n  return Object.freeze({ executable: await realpath(python), prefix: ['-u', join(HERE, 'native-peer.py')], platform: 'linux' })\n}\n\n/** Spawn a packaged native helper. It accepts one bounded JSON configuration on stdin. */\nexport function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home) } = {}) {\n  const events = new EventEmitter()\n  const args = helper.platform === 'win32' ? [...helper.prefix, '-Mode', mode] : [...helper.prefix, mode]\n  const child = spawn(helper.executable, args, { cwd: home, env, windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] })\n  let tail = '', buffer = '', bytes = 0, closed = false\n  const decoder = new StringDecoder('utf8'), cliDecoder = new StringDecoder('utf8')\n  let cliBuffer = ''\n  const frame = value => {\n    if (mode === 'supervise' && value.type === 'cli-output') {\n      if (typeof value.data !== 'string' || value.data.length > MAX_FRAME * 2) throw new Error('INVALID_CLI_FRAME')\n      cliBuffer += cliDecoder.write(Buffer.from(value.data, 'base64'))\n      if (Buffer.byteLength(cliBuffer) > MAX_FRAME) throw new Error('CLI_FRAME_LIMIT')\n      let end\n      while ((end = cliBuffer.indexOf('\\n')) >= 0) {\n        const line = cliBuffer.slice(0, end); cliBuffer = cliBuffer.slice(end + 1)\n        if (line.trim()) events.emit('message', JSON.parse(line))\n      }\n    } else events.emit(value.control ? 'control' : 'message', value)\n  }\n  const exit = new Promise(resolve => child.once('close', (code, signal) => { closed = true; events.emit('closed', { code, signal }); resolve({ code, signal }) }))\n  child.on('error', error => events.emit('failure', error))\n  child.stdin.on('error', () => {})\n  child.stderr.on('data', data => { tail = (tail + data.toString('utf8')).slice(-4096) })\n  child.stdout.on('data', chunk => {\n    bytes += chunk.length\n    buffer += decoder.write(chunk)\n    if (bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) { events.emit('failure', new Error('OUTPUT_LIMIT')); child.stdin.end(); return }\n    let end\n    while ((end = buffer.indexOf('\\n')) >= 0) {\n      const line = buffer.slice(0, end); buffer = buffer.slice(end + 1)\n      if (!line.trim()) continue\n      try { frame(JSON.parse(line)) }\n      catch { events.emit('failure', new Error('INVALID_NATIVE_FRAME')); child.stdin.end() }\n    }\n  })\n  const send = value => new Promise((resolve, reject) => {\n    const wire = JSON.stringify(value) + '\\n'\n    if (closed || Buffer.byteLength(wire) > MAX_FRAME) { reject(new Error(closed ? 'NATIVE_CLOSED' : 'INPUT_LIMIT')); return }\n    child.stdin.write(wire, error => error ? reject(error) : resolve())\n  })\n  if (spec) void send(spec).catch(error => events.emit('failure', error))\n  function waitControl(name, timeoutMs = 15_000) {\n    return new Promise((resolve, reject) => {\n      const clean = () => { clearTimeout(timer); events.off('control', control); events.off('closed', ended); events.off('failure', failed) }\n      const control = value => { if (value.control === name) { clean(); resolve(value) } }\n      const ended = () => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_FAILED: ${tail.slice(-256)}`)) }\n      const failed = error => { clean(); reject(error) }\n      const timer = setTimeout(() => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_TIMEOUT`)) }, timeoutMs)\n      events.on('control', control); events.once('closed', ended); events.once('failure', failed)\n      if (closed) ended()\n    })\n  }\n  return Object.freeze({ child, events, exit, send, waitControl, end: () => child.stdin.end(), get stderr() { return tail }, get closed() { return closed } })\n}\n\nexport async function capabilityProbe({ home, python } = {}) {\n  let proc\n  try {\n    const helper = await resolveNativeHelper({ python })\n    proc = nativeProcess(helper, 'probe', null, { home })\n    const value = await new Promise((resolve, reject) => {\n      proc.events.once('message', resolve)\n      proc.events.once('failure', reject)\n      proc.events.once('closed', () => reject(new Error('NATIVE_PROBE_FAILED')))\n    })\n    await proc.exit\n    return { ...value, helper, limitations: helper.platform === 'linux' ? ['Process groups are not an OS sandbox; adversarial unobserved daemon escape requires a cgroup/container boundary'] : [] }\n  } catch (error) { return { available: false, code: 'NATIVE_PEER_UNAVAILABLE', reason: error.message } }\n  finally { if (proc && !proc.closed) proc.end() }\n}\n\nexport async function protectProfile(helper, home) {\n  if (helper.platform !== 'win32') return\n  const proc = nativeProcess(helper, 'protect', { path: home }, { home })\n  const protectedValue = await new Promise((resolve, reject) => {\n    proc.events.once('message', resolve)\n    proc.events.once('failure', reject)\n    proc.events.once('closed', () => reject(new Error('PROFILE_ACL_FAILED')))\n  })\n  proc.end()\n  const exit = await proc.exit\n  if (!protectedValue.protected || exit.code !== 0) throw new Error('PROFILE_ACL_FAILED')\n}\n", "import { generateKeyPairSync, sign, randomBytes } from 'node:crypto'\nimport { mkdir, writeFile, mkdtemp, chmod, lstat, realpath, rmdir } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { isAbsolute, join } from 'node:path'\nimport { performance } from 'node:perf_hooks'\nimport { fileURLToPath } from 'node:url'\nimport { PolicyError } from './authority.mjs'\nimport { nativeProcess, resolveNativeHelper } from '../../cli-runtime/src/native-process.mjs'\n\nconst BRIDGE = fileURLToPath(new URL('./cli-stdio-bridge.mjs', import.meta.url))\nconst MAX_BYTES = 262_144\n\n/** CLI-grandchild handoff: public signed locator, OS peer identity, host-only capability lease. */\nexport async function createCliBootstrap({ authority, subject, binding, tools, handlers, home, ttlMs = 30_000, helper }) {\n  if (!isAbsolute(home)) throw new TypeError('An isolated absolute home is required')\n  const ownedBinding = Object.freeze({ ...binding })\n  const registry = new Map(handlers.map(handler => [handler.definition.name, handler]))\n  if (registry.size !== handlers.length || tools.some(name => !registry.has(name))) throw new TypeError('Unknown or duplicate bridge handler')\n  if (!Number.isSafeInteger(ttlMs) || ttlMs < 1000 || ttlMs > 7_200_000 || typeof authority.renew !== 'function') throw new TypeError('BOUNDED_RENEWABLE_LEASE_REQUIRED')\n  const leaseTtlMs = Math.min(30_000, ttlMs)\n  const startedAt = performance.now()\n  const native = helper ?? await resolveNativeHelper()\n  const { privateKey, publicKey } = generateKeyPairSync('ed25519')\n  const publicSpki = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url')\n  await mkdir(home, { recursive: true, mode: 0o700 })\n  await mkdir(join(home, 'tmp'), { recursive: true, mode: 0o700 })\n  const descriptorPath = join(home, `bridge-${randomBytes(12).toString('hex')}.json`)\n  // Locator has no authority. Its random name only prevents accidental collisions.\n  let socketDirectory\n  let endpoint = process.platform === 'win32' ? `dsh-cli-${randomBytes(18).toString('hex')}` : join(home, `p-${randomBytes(6).toString('hex')}.sock`)\n  if (process.platform === 'linux' && Buffer.byteLength(endpoint) > 103) {\n    // AF_UNIX limits the address length even when the private profile path is valid.\n    // Keep the signed descriptor/keys in the profile; only the socket uses an\n    // atomic, owner-only short directory. Peer PID/start-time/UID checks remain mandatory.\n    let parent=await realpath(tmpdir())\n    if(Buffer.byteLength(join(parent,'dsh-cli-XXXXXX','p.sock'))>103)parent=await realpath('/tmp')\n    socketDirectory=await mkdtemp(join(parent,'dsh-cli-'))\n    await chmod(socketDirectory,0o700)\n    const stat=await lstat(socketDirectory)\n    if(!stat.isDirectory()||stat.isSymbolicLink()||stat.uid!==process.getuid()||(stat.mode&0o077)!==0){await rmdir(socketDirectory);throw new Error('PRIVATE_SOCKET_DIRECTORY_REQUIRED')}\n    endpoint=join(socketDirectory,'p.sock')\n    if(Buffer.byteLength(endpoint)>103){await rmdir(socketDirectory);throw new Error('PRIVATE_SOCKET_PATH_TOO_LONG')}\n  }\n  let lease\n  try{lease=authority.issue(subject,{binding:ownedBinding,tools,ttlMs:leaseTtlMs})}\n  catch(error){if(socketDirectory)await rmdir(socketDirectory);throw error}\n  let relay, closed = false, bound = false, connected = false, closing\n  let accepted, rejected = 0, requests = 0, replies = 0\n  const active = new Map()\n  const release = () => { authority.release(lease.token); for (const controller of active.values()) controller.abort(new Error('BRIDGE_CLOSED')) }\n  const reply = (id, value) => {\n    if (!relay || relay.closed) return\n    replies++\n    const wire = { type: 'response', id, ...value }\n    void relay.send(Buffer.byteLength(JSON.stringify(wire)) > MAX_BYTES ? { type: 'response', id, ok: false, code: 'OUTPUT_LIMIT' } : wire).catch(() => {})\n  }\n  async function request(message) {\n    requests++\n    if (!message || !Number.isSafeInteger(message.id) || message.id < 1) return\n    if (message.type === 'cancel') { active.get(message.id)?.abort(new Error('REQUEST_CANCELLED')); return }\n    if (message.type !== 'request') return\n    const id = message.id\n    try {\n      if (closed) throw new PolicyError('BRIDGE_CLOSED')\n      if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES || Object.keys(message).some(key => !['type', 'id', 'op', 'name', 'args'].includes(key))) throw new PolicyError('INVALID_REQUEST')\n      if (active.has(id) || active.size >= 16) throw new PolicyError('BUSY')\n      if (message.op === 'list') { reply(id, { ok: true, value: authority.list(lease.token, ownedBinding).map(name => registry.get(name).definition) }); return }\n      if (message.op !== 'call') throw new PolicyError('INVALID_REQUEST')\n      const controller = new AbortController(); active.set(id, controller)\n      try {\n        const value = await authority.run(lease.token, ownedBinding, message.name, ({ signal }) => {\n          const handler = registry.get(message.name)\n          return handler.execute(handler.parse(message.args), { signal, binding: ownedBinding })\n        }, { signal: controller.signal })\n        reply(id, { ok: true, value })\n      } finally { active.delete(id) }\n    } catch (error) { reply(id, { ok: false, code: error instanceof PolicyError ? error.code : 'HANDLER_REFUSED' }) }\n  }\n  const close = () => {\n    if (closing) return closing\n    closed = true; release(); clearTimeout(expiry); clearInterval(renewal)\n    closing = (async () => {\n      if(relay){\n        relay.end()\n        const stopped = await Promise.race([relay.exit.then(() => true), new Promise(resolve => { const t = setTimeout(() => resolve(false), 3000); t.unref() })])\n        if (!stopped) { relay.child.kill(); await relay.exit }\n      }\n      // Nonrecursive cleanup only; an unexpected file is preserved for diagnosis.\n      if(socketDirectory)await rmdir(socketDirectory).catch(()=>{})\n    })()\n    return closing\n  }\n  const expiry = setTimeout(() => { void close() }, ttlMs); expiry.unref()\n  const renewal = setInterval(() => {\n    try { if (!closed) authority.renew(lease.token, ownedBinding, { ttlMs: Math.min(leaseTtlMs, Math.max(1, Math.floor(ttlMs - (performance.now() - startedAt)))) }) }\n    catch { void close() }\n  }, Math.max(100, Math.floor(leaseTtlMs / 3))); renewal.unref()\n  const bind = async ({ pid, start }) => {\n    if (closed || bound || !Number.isSafeInteger(pid) || pid < 1 || typeof start !== 'string') throw new Error('INVALID_CLI_BINDING')\n    authority.list(lease.token, ownedBinding)\n    bound = true\n    const remaining = Math.floor(ttlMs - (performance.now() - startedAt))\n    if (remaining < 1) { await close(); throw new Error('BOOTSTRAP_EXPIRED') }\n    relay = nativeProcess(native, 'server', { endpoint, rootPid: pid, rootStart: start, ttlMs: remaining }, { home })\n    relay.events.on('message', message => { void request(message) })\n    relay.events.on('control', value => {\n      if (value.control === 'accepted') { accepted = value; connected = true }\n      if (value.control === 'rejected') rejected++\n    })\n    relay.events.once('closed', () => { closed = true; release(); clearTimeout(expiry); clearInterval(renewal) })\n    relay.events.once('failure', () => { void close() })\n    const server = await relay.waitControl('listening')\n    const payload = JSON.stringify({ version: 1, endpoint, serverPid: server.pid, serverStart: server.start,\n      rootPid: pid, rootStart: start, expiresAt: Date.now() + Math.min(15_000, remaining), sessionExpiresAt: Date.now() + remaining, ttlMs: remaining,\n      helper: native, hostPid: process.pid, binding: ownedBinding })\n    const descriptor = JSON.stringify({ payload, signature: sign(null, Buffer.from(payload), privateKey).toString('base64url') })\n    await writeFile(descriptorPath, descriptor, { flag: 'wx', mode: 0o600 })\n  }\n  return Object.freeze({ command: process.execPath, args: [BRIDGE, descriptorPath, publicSpki], descriptorPath,\n    bind, close, get closed() { return closed }, get connected() { return connected },\n    get evidence() { return { binding: ownedBinding, connected, peer: accepted ?? null, rejectedPeers: rejected, requests, replies, nativeError: relay?.stderr ?? '', bearerInArgvOrEnv: false, closed } } })\n}\n", "import { createHash, randomBytes } from 'node:crypto'\nimport { performance } from 'node:perf_hooks'\n\nexport class PolicyError extends Error {\n  /**\n   * `detail.gate` names the checkpoint that refused, and `detail.rule` the rule\n   * text when one matched. A refusal that only says \"TOOL_DENIED\" leaves the\n   * reader to guess which of several gates stopped it, and support then runs on\n   * pasted logs.\n   */\n  constructor(code, detail = {}) {\n    super(`Capability refused: ${code}`)\n    this.name = 'PolicyError'\n    this.code = code\n    if (detail && typeof detail === 'object') {\n      if (typeof detail.gate === 'string' && detail.gate) this.gate = detail.gate\n      if (typeof detail.rule === 'string' && detail.rule) this.rule = detail.rule\n    }\n  }\n}\n\nconst refuse = code => { throw new PolicyError(code) }\nconst identifier = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value)\nconst names = values => {\n  if (!Array.isArray(values) || values.some(value => typeof value !== 'string' || !value || value.length > 256)) refuse('INVALID_GRANT')\n  return new Set(values)\n}\nconst digest = value => createHash('sha256').update(value).digest('hex')\nconst routeKey = (provider, model) => JSON.stringify([provider, model])\nconst routes = values => {\n  if (!Array.isArray(values)) refuse('INVALID_GRANT')\n  return new Set(values.map(value => {\n    if (!value || Object.keys(value).some(key => !['provider', 'model'].includes(key)) ||\n        typeof value.provider !== 'string' || !value.provider || value.provider.length > 256 ||\n        typeof value.model !== 'string' || !value.model || value.model.length > 256) refuse('INVALID_GRANT')\n    return routeKey(value.provider, value.model)\n  }))\n}\n\nfunction bindingOf(input) {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) refuse('INVALID_BINDING')\n  if (Object.keys(input).some(key => !['taskId', 'attemptId', 'machineId', 'workspaceId', 'location'].includes(key))) refuse('INVALID_BINDING')\n  for (const key of ['taskId', 'attemptId', 'machineId', 'workspaceId']) if (!identifier(input[key])) refuse('INVALID_BINDING')\n  if (!['local', 'remote'].includes(input.location)) refuse('INVALID_BINDING')\n  return JSON.stringify([input.taskId, input.attemptId, input.machineId, input.workspaceId, input.location])\n}\n\n/** Experimental in-memory authority. Host-owned object identities never come from JSON. */\nexport function createAuthority({ now = () => performance.now(), maxTtlMs = 300_000, maxLeases = 256 } = {}) {\n  if (!Number.isSafeInteger(maxTtlMs) || maxTtlMs < 1 || maxTtlMs > 300_000) refuse('INVALID_TTL')\n  if (!Number.isSafeInteger(maxLeases) || maxLeases < 1 || maxLeases > 4096) refuse('INVALID_LIMIT')\n  const subjects = new WeakMap()\n  const botIds = new Set()\n  const leases = new Map()\n  let disposed = false\n\n  const subjectOf = subject => {\n    if (disposed) refuse('AUTHORITY_CLOSED')\n    const value = subject && typeof subject === 'object' ? subjects.get(subject) : undefined\n    if (!value) refuse('UNKNOWN_SUBJECT')\n    if (value.revoked) refuse('SUBJECT_REVOKED')\n    return value\n  }\n  const cancel = (lease, code) => {\n    for (const controller of lease.active) controller.abort(new PolicyError(code))\n    leases.delete(lease.key)\n  }\n  const validLease = (token, binding) => {\n    if (disposed) refuse('AUTHORITY_CLOSED')\n    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) refuse('UNKNOWN_LEASE')\n    const lease = leases.get(digest(token))\n    if (!lease) refuse('UNKNOWN_LEASE')\n    if (now() >= lease.expiresAt) { cancel(lease, 'LEASE_EXPIRED'); refuse('LEASE_EXPIRED') }\n    const principal = subjectOf(lease.subject)\n    if (principal.revision !== lease.revision) { cancel(lease, 'GRANT_CHANGED'); refuse('GRANT_CHANGED') }\n    if (bindingOf(binding) !== lease.binding) refuse('BINDING_MISMATCH')\n    return lease\n  }\n  const invalidateSubject = (subject, code) => {\n    for (const lease of [...leases.values()]) if (lease.subject === subject) cancel(lease, code)\n  }\n\n  return Object.freeze({\n    register(subject, { botId, tools = [], modelRoutes = [] }) {\n      if (disposed) refuse('AUTHORITY_CLOSED')\n      if (!subject || typeof subject !== 'object' || !identifier(botId)) refuse('INVALID_SUBJECT')\n      if (subjects.has(subject) || botIds.has(botId)) refuse('DUPLICATE_SUBJECT')\n      const state = { botId, tools: names(tools), models: routes(modelRoutes), revision: 1, revoked: false }\n      subjects.set(subject, state)\n      botIds.add(botId)\n    },\n    assertTool(subject, name) {\n      if (!subjectOf(subject).tools.has(name)) refuse('TOOL_DENIED')\n    },\n    describe(subject) {\n      const value = subjectOf(subject)\n      return Object.freeze({ botId: value.botId, revision: value.revision })\n    },\n    assertModel(subject, provider, model) {\n      if (typeof provider !== 'string' || typeof model !== 'string' || !subjectOf(subject).models.has(routeKey(provider, model))) refuse('MODEL_DENIED')\n    },\n    replaceGrant(subject, { tools = [], modelRoutes = [] }) {\n      const state = subjectOf(subject)\n      const nextTools = names(tools)\n      const nextModels = routes(modelRoutes)\n      state.tools = nextTools\n      state.models = nextModels\n      state.revision++\n      invalidateSubject(subject, 'GRANT_CHANGED')\n    },\n    revoke(subject) {\n      const state = subjectOf(subject)\n      state.revoked = true\n      state.revision++\n      invalidateSubject(subject, 'SUBJECT_REVOKED')\n    },\n    issue(subject, { binding, tools, ttlMs = 30_000 }) {\n      const principal = subjectOf(subject)\n      const encoded = bindingOf(binding)\n      const selected = names(tools)\n      if ([...selected].some(name => !principal.tools.has(name))) refuse('TOOL_DENIED')\n      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > maxTtlMs) refuse('INVALID_TTL')\n      for (const lease of [...leases.values()]) if (now() >= lease.expiresAt) cancel(lease, 'LEASE_EXPIRED')\n      if (leases.size >= maxLeases) refuse('LEASE_LIMIT')\n      const token = randomBytes(32).toString('base64url')\n      const key = digest(token)\n      leases.set(key, { key, subject, revision: principal.revision, binding: encoded,\n        tools: selected, expiresAt: now() + ttlMs, active: new Set() })\n      return Object.freeze({ token, ttlMs })\n    },\n    list(token, binding) { return [...validLease(token, binding).tools].sort() },\n    renew(token, binding, { ttlMs = 30_000 } = {}) {\n      // Host-only in-memory token. Expired leases and old revisions never revive.\n      const lease = validLease(token, binding)\n      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > maxTtlMs) refuse('INVALID_TTL')\n      lease.expiresAt = now() + ttlMs\n      return Object.freeze({ ttlMs })\n    },\n    async run(token, binding, toolName, execute, { signal } = {}) {\n      const lease = validLease(token, binding)\n      if (!lease.tools.has(toolName)) refuse('TOOL_DENIED')\n      if (typeof execute !== 'function') refuse('INVALID_HANDLER')\n      const controller = new AbortController()\n      lease.active.add(controller)\n      let timer\n      const checkExpiry = () => {\n        if (!leases.has(lease.key)) return\n        if (now() < lease.expiresAt) { timer = setTimeout(checkExpiry, Math.max(1, Math.ceil(lease.expiresAt - now()))); return }\n        cancel(lease, 'LEASE_EXPIRED')\n        controller.abort(new PolicyError('LEASE_EXPIRED'))\n      }\n      timer = setTimeout(checkExpiry, Math.max(1, Math.ceil(lease.expiresAt - now())))\n      const combined = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal\n      try {\n        combined.throwIfAborted()\n        const value = await execute({ signal: combined })\n        combined.throwIfAborted()\n        validLease(token, binding)\n        return value\n      } finally {\n        clearTimeout(timer)\n        lease.active.delete(controller)\n      }\n    },\n    release(token) {\n      if (typeof token !== 'string') return\n      const lease = leases.get(digest(token))\n      if (lease) cancel(lease, 'LEASE_RELEASED')\n    },\n    dispose() {\n      if (disposed) return\n      disposed = true\n      for (const lease of [...leases.values()]) cancel(lease, 'AUTHORITY_CLOSED')\n    },\n  })\n}\n", "const count = value => Number.isSafeInteger(value) && value >= 0 ? value : null\n\n/** Unknown stays null. Cached/reasoning counts are components, never added twice. */\nexport function usageBreakdown(value) {\n  return Object.freeze({ inputTokens: count(value?.inputTokens), outputTokens: count(value?.outputTokens),\n    cachedInputTokens: count(value?.cachedInputTokens), cacheWriteInputTokens: count(value?.cacheWriteInputTokens),\n    reasoningOutputTokens: count(value?.reasoningOutputTokens), totalTokens: count(value?.totalTokens) })\n}\n\nexport function createCodexEvidence({ binding, operationId, botId, requestedModel, catalogModel = requestedModel, catalogProvider = 'openai', entry, billing = 'subscription' }) {\n  if (!['subscription', 'api', 'unknown'].includes(billing)) throw new TypeError('INVALID_CLI_BILLING')\n  let threadId = null, turnId = null, reportedModel = null, reportedProvider = null\n  let usage = usageBreakdown(), seenUsage = false, mismatch = false, finished = null, finalText = '', failure = null\n  const reroutes = []\n  return Object.freeze({\n    bindThread(result) {\n      threadId = result?.thread?.id ?? null\n      reportedModel = typeof result?.model === 'string' ? result.model : null\n      reportedProvider = typeof result?.modelProvider === 'string' ? result.modelProvider : null\n      mismatch = reportedModel !== requestedModel || reportedProvider !== 'openai'\n      if (!threadId || mismatch) throw new Error('CLI_MODEL_IDENTITY_MISMATCH')\n    },\n    event(message) {\n      const params = message?.params\n      if (!params || params.threadId !== threadId) return { accepted: false }\n      if (turnId && params.turnId && params.turnId !== turnId) return { accepted: false }\n      if (message.method === 'turn/started') turnId = params.turn?.id ?? turnId\n      if (message.method === 'thread/tokenUsage/updated') {\n        turnId ??= params.turnId\n        // Each notification is cumulative for a thread. Repeated snapshots do not create extra receipts.\n        usage = usageBreakdown(params.tokenUsage?.total); seenUsage = true\n        return { accepted: true, usageChanged: true }\n      }\n      if (message.method === 'model/rerouted') {\n        reroutes.push({ fromModel: params.fromModel ?? null, toModel: params.toModel ?? null, reason: params.reason ?? null })\n        if (params.toModel !== requestedModel) mismatch = true\n      }\n      if (message.method === 'item/completed' && params.item?.type === 'agentMessage' && typeof params.item.text === 'string') finalText = params.item.text\n      if (message.method === 'turn/completed') {\n        turnId ??= params.turn?.id\n        finished = params.turn?.status ?? 'unknown'\n        failure = params.turn?.error ? { code: params.turn.error.codexErrorInfo ?? null, message: String(params.turn.error.message ?? '').slice(0, 512) } : null\n      }\n      return { accepted: true, mismatch, completed: message.method === 'turn/completed' }\n    },\n    snapshot() {\n      return { schemaVersion: 1, source: 'cli', toolId: 'codex', botId, ...binding, operationId,\n        receiptId: threadId && turnId ? `codex:${operationId}:${threadId}:${turnId}` : null,\n        threadId, turnId, entry: { path: entry.path, sha256: entry.sha256, version: entry.version },\n        identity: { catalogProvider, catalogModel, requestedCliModel: requestedModel, reportedCliModel: reportedModel,\n          reportedProvider, actualResponseModel: null, verification: mismatch ? 'mismatch' : reportedModel ? 'cli-configured-model' : 'unreported',\n          actualResponseModelVerified: false, reroutes: [...reroutes] },\n        usage: { ...usage, reported: seenUsage, status: seenUsage && Object.values(usage).every(value => value !== null) ? 'complete' : seenUsage ? 'partial' : 'unknown' },\n        billing: { kind: billing, amountUsd: null, amountStatus: billing === 'subscription' ? 'not-applicable' : 'unknown' },\n        terminal: mismatch ? 'identity-mismatch' : finished, finalText, failure,\n        limitations: ['Codex thread/start reports the configured model; this protocol does not prove the response backend model', 'An independent profile and MCP scope do not provide OS file isolation'] }\n    },\n  })\n}\n", "/** Host configuration only. Endpoints are kept in the private profile, never argv, receipts or diagnostics. */\nexport function providerSettings(input = {}) {\n  if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(key => !['openaiBaseUrl', 'chatgptBaseUrl'].includes(key))) throw new TypeError('INVALID_PROVIDER_SETTINGS')\n  const entries = []\n  for (const [source, target] of [['openaiBaseUrl', 'openai_base_url'], ['chatgptBaseUrl', 'chatgpt_base_url']]) {\n    if (input[source] === undefined) continue\n    let url\n    try { url = new URL(input[source]) } catch { throw new TypeError('INVALID_PROVIDER_ENDPOINT') }\n    if (typeof input[source] !== 'string' || input[source].length > 2048 || url.username || url.password || url.search || url.hash ||\n      !(url.protocol === 'https:' || url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) throw new TypeError('INVALID_PROVIDER_ENDPOINT')\n    entries.push([target, input[source]])\n  }\n  return Object.freeze({ lines: entries.map(([key, value]) => `${key} = ${JSON.stringify(value)}`),\n    configuredKeys: entries.map(([key]) => key), values: Object.fromEntries(entries) })\n}\n\n/** An inherited system/project config cannot add a second MCP or change our native bridge. */\nexport function assertEffectiveProfile(result, { requestedModel, bridge, home, tools, settings }) {\n  const config = result?.config\n  if (!config || config.model !== requestedModel || config.model_provider !== 'openai' || config.approval_policy !== 'never' || config.sandbox_mode !== 'read-only') throw new Error('CLI_EFFECTIVE_PROFILE_MISMATCH')\n  const servers = config.mcp_servers\n  if (!servers || Object.keys(servers).length !== 1 || !servers.dsh_task) throw new Error('CLI_EXTRA_OR_MISSING_MCP')\n  const server = servers.dsh_task\n  if (server.command !== bridge.command || JSON.stringify(server.args) !== JSON.stringify(bridge.args) ||\n    server.cwd !== home || server.required !== true || JSON.stringify(server.enabled_tools) !== JSON.stringify(tools)) throw new Error('CLI_EFFECTIVE_BRIDGE_MISMATCH')\n  for (const [key, value] of Object.entries(settings.values)) if (config[key] !== value) throw new Error('CLI_PROVIDER_SETTINGS_MISMATCH')\n  return { isolatedMcpServers: ['dsh_task'], explicitProviderSettingKeys: [...settings.configuredKeys] }\n}\n", "import http from 'node:http'\nimport https from 'node:https'\nimport { readFileSync } from 'node:fs'\nimport { networkInterfaces } from 'node:os'\nimport {isIP} from 'node:net'\nimport { Server, WebStandardStreamableHTTPServerTransport, SUPPORTED_PROTOCOL_VERSIONS } from '@modelcontextprotocol/server'\nimport { AgentError, AGENT_VERSION, CATALOG, fail } from './protocol.js'\nimport type { Agent } from './agent.js'\nimport {AuthThrottle,validateAuthLimits,type AuthLimits} from './auth-throttle.js'\nimport {WebSocketServer} from 'ws'\nexport type NetworkConfig={mode?:'loopback'|'wireguard'|'tailscale'|'cloudflare-tunnel'|'public-tls';host?:string;port?:number;protectedTunnel?:boolean;allowedHosts?:string[];allowedOrigins?:string[];trustedProxies?:string[];authLimits?:AuthLimits;tls?:{keyFile:string;certFile:string;caFile?:string;requireClientCertificate?:boolean}}\nconst loopback=(host:string)=>['127.0.0.1','::1','::ffff:127.0.0.1'].includes(host)\nexport function validateNetwork(c:NetworkConfig){const host=c.host??'127.0.0.1',mode=c.mode??'loopback';if(['0.0.0.0','::','localhost'].includes(host))fail('BIND_ADDRESS_REQUIRED')\n  if(!isIP(host)||c.port!==undefined&&(!Number.isSafeInteger(c.port)||c.port<0||c.port>65535))fail('INVALID_NETWORK_CONFIG')\n  for(const key of ['allowedHosts','allowedOrigins','trustedProxies'] as const)if(c[key]!==undefined&&(!Array.isArray(c[key])||c[key]!.length>128||c[key]!.some(value=>typeof value!=='string'||!value||value.length>512||/[\\s\\u0000-\\u001f\\u007f]/.test(value))))fail('INVALID_NETWORK_CONFIG')\n  if(c.trustedProxies?.some(value=>!isIP(value)))fail('INVALID_NETWORK_CONFIG')\n  if(c.allowedOrigins?.some(value=>{try{const url=new URL(value);return !['http:','https:'].includes(url.protocol)||url.origin!==value}catch{return true}}))fail('INVALID_NETWORK_CONFIG')\n  if(c.allowedHosts?.some(value=>{try{const url=new URL(`http://${value}`);return url.host!==value.toLowerCase()||url.pathname!=='/'||!!url.username||!!url.password||!!url.search||!!url.hash}catch{return true}}))fail('INVALID_NETWORK_CONFIG')\n  validateAuthLimits(c.authLimits)\n  if(c.tls?.requireClientCertificate&&!c.tls.caFile)fail('MTLS_CA_REQUIRED')\n  if(mode==='loopback'&&!loopback(host))fail('TLS_REQUIRED')\n  if(['wireguard','tailscale'].includes(mode)){if(!Object.values(networkInterfaces()).flat().some(x=>x?.address===host))fail('BIND_INTERFACE_NOT_FOUND');if(!c.tls&&!c.protectedTunnel)fail('TUNNEL_ATTESTATION_REQUIRED')}\n  if(mode==='cloudflare-tunnel'&&(!loopback(host)||!c.protectedTunnel))fail('TUNNEL_BACKEND_MUST_BE_LOOPBACK')\n  if(mode==='public-tls'&&!c.tls&&(!loopback(host)||!c.trustedProxies?.length))fail('TLS_REQUIRED')\n  if(!c.tls&&!loopback(host)&&!c.protectedTunnel)fail('TLS_REQUIRED')\n  if(!['loopback','wireguard','tailscale','cloudflare-tunnel','public-tls'].includes(mode))fail('INVALID_NETWORK_MODE')\n}\nexport async function serve(agent:Agent,c:NetworkConfig={}){\n  c=structuredClone(c);validateNetwork(c);const throttle=new AuthThrottle(c.authLimits),host=c.host??'127.0.0.1'\n  const requestBoundary=(req:http.IncomingMessage,upgrade=false)=>{\n    const address=server.address() as any,defaultHost=`${host.includes(':')?`[${host}]`:host}:${address.port}`\n    if(!(c.allowedHosts??[defaultHost]).includes(req.headers.host??''))fail('HOST_DENIED',403)\n    const origin=req.headers.origin\n    if(origin!==undefined&&!(c.allowedOrigins??[]).includes(origin)&&!(upgrade&&agent.desktopSessions.hasOrigin(origin)))fail('ORIGIN_DENIED',403)\n    if(c.mode==='public-tls'&&!c.tls&&(!(c.trustedProxies??[]).includes(req.socket.remoteAddress??'unknown')||req.headers['x-forwarded-proto']!=='https'))fail('TLS_REQUIRED',403)\n    return defaultHost\n  }\n  const handler=async(req:http.IncomingMessage,res:http.ServerResponse)=>{\n    let context:any;const source=req.socket.remoteAddress??'unknown';const json=(status:number,value:any)=>{res.writeHead(status,{'content-type':'application/json','cache-control':'no-store','x-content-type-options':'nosniff'});res.end(JSON.stringify(value))}\n    try{\n      const defaultHost=requestBoundary(req)\n      const reject=(decision:ReturnType<AuthThrottle['failure']>)=>{\n        if(decision.audit)agent.store.audit(decision.code)\n        if(decision.retryAfterMs)res.setHeader('retry-after',String(Math.max(1,Math.ceil(decision.retryAfterMs/1000))))\n        fail(decision.code,decision.status)\n      }\n      const auth=req.headers.authorization??'';if(!/^Bearer [A-Za-z0-9_-]{43}$/.test(auth)){reject(throttle.failure(source))}\n      const url=new URL(req.url??'/',`http://${defaultHost}`);let client:any\n      const authenticate=()=>{try{if(url.pathname.startsWith('/control/v1/'))client=agent.store.client(auth.slice(7));else context=agent.store.grant(auth.slice(7))}catch{reject(throttle.failure(source))}}\n      authenticate()\n      // Valid credentials bypass anonymous source cooldown, including shared proxies.\n      const limited=throttle.authenticated(client?.id??context.clientId,client?.revision??context.revision)\n      if(limited)reject(limited)\n      if(req.method!=='POST'){json(405,{error:{code:'METHOD_NOT_ALLOWED'}});return}\n      let body=Buffer.alloc(0);for await(const chunk of req){body=Buffer.concat([body,chunk]);if(body.length>2097152)fail('REQUEST_TOO_LARGE',413)}\n      let parsed:any;try{parsed=JSON.parse(body.toString('utf8'))}catch{fail('INVALID_JSON')}\n      // Rotation/revocation can happen while the authenticated body is arriving.\n      // A cached pre-body identity cannot authorize a later management action.\n      authenticate()\n      if(url.pathname==='/control/v1/grants'){json(200,agent.store.issue(client,parsed));return}\n      if(url.pathname==='/control/v1/grants/revoke'){const result=agent.store.revokeGrants(client,parsed);await agent.desktopSessions.sweep();json(200,result);return}\n      if(url.pathname==='/desktop/v1/session'){json(200,await agent.desktopSessions.open(context,parsed));return}\n      if(url.pathname==='/desktop/v1/session/renew'){json(200,await agent.desktopSessions.renew(context,parsed));return}\n      if(url.pathname==='/desktop/v1/session/close'){json(200,await agent.desktopSessions.closeSession(context,parsed));return}\n      if(url.pathname!=='/mcp')fail('NOT_FOUND',404)\n      const mcp=new Server({name:'dsh-remote-computer-agent',version:AGENT_VERSION},{capabilities:{tools:{}},supportedProtocolVersions:SUPPORTED_PROTOCOL_VERSIONS})\n      const transport=new WebStandardStreamableHTTPServerTransport({enableJsonResponse:true,sessionIdGenerator:undefined,maxRequestBodySize:2097152})\n      mcp.setRequestHandler('tools/list',async()=>{agent.store.validate(context);return {tools:CATALOG.filter(x=>context.tools.includes(x.name)).map(x=>({name:x.name,description:`Remote ${x.name}`,inputSchema:x.inputSchema,annotations:{readOnlyHint:!x.mutating,destructiveHint:x.mutating}}))}})\n      mcp.setRequestHandler('tools/call',async(request:any)=>{try{const meta=request.params._meta??{},args=request.params.arguments??{};if(Object.hasOwn(args,'operationId')&&request.params.name!=='operation_status'&&request.params.name!=='operation_cancel')fail('CONTEXT_MUST_BE_HOST_METADATA')\n          const result=await agent.call(request.params.name,args,context,meta['dsh/operationId']);agent.store.audit('TOOL_RESULT',context.botId,meta['dsh/operationId']??null);return {content:[{type:'text',text:JSON.stringify(result)}],structuredContent:result}\n        }catch(e){const code=e instanceof AgentError?e.code:'EXECUTION_FAILED';agent.store.audit(code,context.botId);return {isError:true,content:[{type:'text',text:code}]}}})\n      await mcp.connect(transport)\n      try{const response=await transport.handleRequest(new Request(`http://${defaultHost}/mcp`,{method:'POST',headers:req.headers as any,body:body.toString('utf8')}),{parsedBody:parsed});res.writeHead(response.status,Object.fromEntries(response.headers));res.end(Buffer.from(await response.arrayBuffer()))}finally{await mcp.close()}\n    }catch(e){json(e instanceof AgentError?e.status:500,{error:{code:e instanceof AgentError?e.code:'AGENT_INTERNAL'}})}\n  }\n  const tls=c.tls?{key:readFileSync(c.tls.keyFile),cert:readFileSync(c.tls.certFile),ca:c.tls.caFile?readFileSync(c.tls.caFile):undefined,requestCert:!!c.tls.requireClientCertificate,rejectUnauthorized:!!c.tls.requireClientCertificate}:null\n  const server=tls?https.createServer(tls,handler):http.createServer(handler);server.requestTimeout=30000;server.headersTimeout=10000;server.maxConnections=128\n  const websocket=new WebSocketServer({noServer:true,clientTracking:true,maxPayload:65536,perMessageDeflate:false})\n  server.on('upgrade',(req,socket,head)=>{\n    try{\n      const defaultHost=requestBoundary(req,true),url=new URL(req.url??'/',`http://${defaultHost}`)\n      if(url.pathname!=='/desktop/v1/socket'||url.search)fail('NOT_FOUND',404)\n      if(websocket.clients.size>=16)fail('DESKTOP_CONNECTION_LIMIT',429)\n      websocket.handleUpgrade(req,socket,head,ws=>{websocket.emit('connection',ws,req);agent.desktopSessions.accept(ws,req.headers.origin,c.allowedOrigins??[])})\n    }catch(e){const status=e instanceof AgentError?e.status:500;socket.end(`HTTP/1.1 ${status} Rejected\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\n\\r\\n`)}\n  })\n  await new Promise<void>((resolve,reject)=>{server.once('error',reject);server.listen(c.port??9701,host,()=>resolve())})\n  return {server,address:server.address(),supportedMcpVersions:SUPPORTED_PROTOCOL_VERSIONS,close:async()=>{await agent.desktopSessions.close();for(const client of websocket.clients)client.terminate();await new Promise<void>(resolve=>websocket.close(()=>resolve()));await new Promise<void>((resolve,reject)=>server.close(e=>e?reject(e):resolve()))}}\n}\n", "import {fail} from './protocol.js'\n\nexport type AuthLimits={windowMs?:number;failureThreshold?:number;baseBackoffMs?:number;maxBackoffMs?:number;maxSources?:number;maxClients?:number;globalFailureLimit?:number;clientRequestLimit?:number}\ntype Decision={status:401|429;code:'AUTH_INVALID'|'AUTH_RATE_LIMIT';retryAfterMs:number;audit:boolean}\ntype Source={start:number;failures:number;until:number}\ntype Client={start:number;requests:number;revision:number;limited:boolean}\nconst defaults={windowMs:60000,failureThreshold:5,baseBackoffMs:1000,maxBackoffMs:30000,maxSources:1024,maxClients:1024,globalFailureLimit:128,clientRequestLimit:120}\nexport function validateAuthLimits(input:AuthLimits={}){\n  const limits={...defaults,...input}\n  if(!input||typeof input!=='object'||Array.isArray(input)||Object.keys(input).some(key=>!Object.hasOwn(defaults,key)))fail('INVALID_AUTH_LIMITS')\n  const bounds={windowMs:[100,3600000],failureThreshold:[1,100],baseBackoffMs:[10,30000],maxBackoffMs:[10,30000],maxSources:[1,4096],maxClients:[1,4096],globalFailureLimit:[1,10000],clientRequestLimit:[1,10000]}\n  for(const key of Object.keys(bounds) as (keyof typeof defaults)[]){const [min,max]=bounds[key];if(!Number.isSafeInteger(limits[key])||limits[key]<min||limits[key]>max)fail('INVALID_AUTH_LIMITS')}\n  if(limits.baseBackoffMs>limits.maxBackoffMs||limits.maxBackoffMs>limits.windowMs)fail('INVALID_AUTH_LIMITS')\n  return Object.freeze(limits)\n}\n\n/** Anonymous inputs never establish a client identity or consume its allowance. */\nexport class AuthThrottle {\n  private sources=new Map<string,Source>();private clients=new Map<string,Client>()\n  private global={start:0,failures:0,limited:false}\n  readonly limits:ReturnType<typeof validateAuthLimits>\n  constructor(options:AuthLimits={},private now=Date.now){this.limits=validateAuthLimits(options)}\n  private save<T>(map:Map<string,T>,key:string,value:T,max:number){map.delete(key);map.set(key,value);while(map.size>max)map.delete(map.keys().next().value!)}\n  failure(source:string):Decision{\n    const now=this.now(),p=this.limits\n    if(now-this.global.start>=p.windowMs||now<this.global.start)this.global={start:now,failures:0,limited:false}\n    if(this.global.failures>=p.globalFailureLimit){const audit=!this.global.limited;this.global.limited=true;return {status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:this.global.start+p.windowMs-now,audit}}\n    let row=this.sources.get(source)\n    if(row&&now<row.start)row=undefined\n    if(row&&row.until>now)return {status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:row.until-now,audit:false}\n    if(!row||now-row.start>=p.windowMs||now<row.start)row={start:now,failures:0,until:0}\n    this.global.failures++;row.failures++\n    if(row.failures>=p.failureThreshold)row.until=now+Math.min(p.maxBackoffMs,p.baseBackoffMs*2**Math.min(16,row.failures-p.failureThreshold))\n    this.save(this.sources,source,row,p.maxSources)\n    return row.until>now?{status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:row.until-now,audit:true}:{status:401,code:'AUTH_INVALID',retryAfterMs:0,audit:true}\n  }\n  // clientId and revision come only from Store.client/grant's checked rows.\n  authenticated(clientId:string,revision:number):Decision|null{\n    const now=this.now(),p=this.limits;let row=this.clients.get(clientId)\n    if(!row||row.revision!==revision||now-row.start>=p.windowMs||now<row.start)row={start:now,requests:0,revision,limited:false}\n    if(row.requests>=p.clientRequestLimit){const audit=!row.limited;row.limited=true;return {status:429,code:'AUTH_RATE_LIMIT',retryAfterMs:row.start+p.windowMs-now,audit}}\n    row.requests++;this.save(this.clients,clientId,row,p.maxClients);return null\n  }\n  stats(){return {sources:this.sources.size,clients:this.clients.size,globalFailures:this.global.failures}}\n}\n"],
+  "mappings": ";;;AACA,SAAS,YAAAA,WAAU,aAAAC,YAAW,SAAAC,cAAa;AAC3C,SAAS,WAAAC,UAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACFvC,SAAS,YAAAC,WAAU,aAAAC,YAAW,SAAAC,QAAO,QAAQ,UAAAC,SAAe,QAAAC,OAAM,YAAAC,iBAAgB;AAClF,SAAS,QAAAC,OAAM,SAAS,WAAAC,gBAAe;AACvC,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,SAAAC,QAAO,YAAAC,iBAAgB;AAChC,SAAS,aAAAC,kBAAiB;;;ACJ1B,SAAS,YAAY,aAAa,uBAAuB;AAClD,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,aAAN,cAAyB,MAAM;AAAA,EAAE,YAAmB,MAAoB,SAAO,KAAK;AAAE,UAAM,IAAI;AAA5C;AAAoB;AAAA,EAA0B;AAAA,EAA9C;AAAA,EAAoB;AAA4B;AACpG,IAAM,OAAO,CAAC,MAAY,SAAO,QAAc;AAAE,QAAM,IAAI,WAAW,MAAK,MAAM;AAAE;AACnF,IAAM,SAAS,MAAM,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,IAAM,MAAM,CAAC,UAAwB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACpF,IAAM,UAAU,CAAC,OAAcC,YAAkB;AAAE,QAAM,IAAE,OAAO,KAAK,IAAI,KAAK,GAAE,KAAK,GAAE,IAAE,OAAO,KAAKA,SAAO,KAAK;AAAG,SAAO,EAAE,WAAS,EAAE,UAAU,gBAAgB,GAAE,CAAC;AAAE;AACzK,SAAS,UAAU,GAAc;AAAE,MAAG,MAAI,QAAM,OAAO,MAAI,SAAS,QAAO,KAAK,UAAU,CAAC;AAAE,MAAG,MAAM,QAAQ,CAAC,EAAE,QAAO,IAAI,EAAE,IAAI,SAAS,EAAE,KAAK,GAAG,CAAC;AAAI,SAAO,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,OAAG,GAAG,KAAK,UAAU,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAI;AAC1P,SAAS,WAAW,GAAc;AAAE,MAAG,OAAO,MAAI,YAAU,CAAC,0BAA0B,KAAK,CAAC,EAAE,MAAK,YAAY;AAAE,SAAO;AAAE;AAC3H,SAAS,QAAQ,GAAM,KAAW,KAAW,cAAsB;AAAE,QAAM,IAAE,KAAG;AAAa,MAAG,CAAC,OAAO,cAAc,CAAC,KAAG,IAAE,OAAK,IAAE,IAAI,MAAK,kBAAkB;AAAE,SAAO;AAAE;AAEzK,IAAM,UAAU,OAAO,OAAO;AAAA,EACnC,CAAC,gBAAe,KAAK;AAAA,EAAE,CAAC,WAAU,KAAK;AAAA,EAAE,CAAC,WAAU,KAAK;AAAA,EAAE,CAAC,YAAW,IAAI;AAAA,EAAE,CAAC,cAAa,IAAI;AAAA;AAAA;AAAA,EAG/F,CAAC,wBAAuB,IAAI;AAAA,EAC5B,CAAC,gBAAe,KAAK;AAAA,EAAE,CAAC,eAAc,IAAI;AAAA,EAC1C,CAAC,oBAAmB,KAAK;AAAA,EAAE,CAAC,oBAAmB,IAAI;AAAA,EAAE,CAAC,iBAAgB,KAAK;AAAA,EAAE,CAAC,iBAAgB,KAAK;AAAA,EACnG,CAAC,mBAAkB,IAAI;AAAA,EAAE,CAAC,iBAAgB,KAAK;AAAA,EAAE,CAAC,sBAAqB,IAAI;AAAA,EAC3E,CAAC,gBAAe,IAAI;AAAA,EAAE,CAAC,oBAAmB,KAAK;AAAA,EAAE,CAAC,iBAAgB,IAAI;AAAA,EAAE,CAAC,gBAAe,IAAI;AAAA,EAAE,CAAC,kBAAiB,IAAI;AAAA,EAAE,CAAC,kBAAiB,IAAI;AAAA,EAAE,CAAC,oBAAmB,IAAI;AAAA,EAAE,CAAC,iBAAgB,IAAI;AAAA,EAC7L,CAAC,sBAAqB,IAAI;AAAA,EAAE,CAAC,iBAAgB,IAAI;AAAA,EAAE,CAAC,gBAAe,IAAI;AAAA,EAAE,CAAC,eAAc,IAAI;AAAA,EAAE,CAAC,kBAAiB,IAAI;AACtH,EAAE,IAAI,CAAC,CAAC,MAAK,QAAQ,OAAK,EAAC,MAAK,OAAO,IAAI,GAAE,UAAS,QAAQ,QAAQ,GAAE,aAAY,EAAC,MAAK,UAAS,sBAAqB,KAAI,EAAC,EAAE,CAAC;AACzH,IAAM,aAAa,QAAQ,IAAI,OAAG,EAAE,IAAI;AACxC,IAAM,aAAa,CAAC,SAAgB,QAAQ,KAAK,OAAG,EAAE,SAAO,IAAI,GAAG,YAAU;;;ACxBrF,SAAS,WAAW,UAAU,cAAc,eAAe,WAAW,YAAY,WAAW,WAAW,iBAAiB;AACzH,SAAS,YAAY;AACrB,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAEpB,IAAM,QAAN,MAAY;AAAA,EAEjB,YAAmB,SAAe,UAAc,UAAyB,CAAC,GAAG;AAA1D;AACjB,SAAK,QAAM,QAAQ,UAAQ;AAC3B,cAAU,SAAQ,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,cAAU,SAAQ,GAAK;AACtE,SAAK,WAAS,KAAK,SAAQ,YAAY;AACvC,QAAI;AACJ,YAAM,SAAO,YAAU,cAAc,YAAY,GAAG,EAAE,gBAAgB;AACtE,UAAG,CAAC,QAAQ,OAAM;AAGhB,cAAM,YAAU,KAAK,SAAQ,uBAAuB;AACpD,YAAG;AAAC,gBAAM,IAAE,UAAU,SAAS;AAAE,cAAG,CAAC,EAAE,OAAO,KAAG,EAAE,eAAe,KAAG,EAAE,UAAQ,EAAE,MAAK,cAAc;AAAA,QAAC,SAAO,GAAM;AAAC,cAAG,EAAE,SAAO,SAAS,OAAM;AAAA,QAAC;AAC/I,aAAK,kBAAgB,IAAI,OAAO,SAAS;AACzC,aAAK,gBAAgB,OAAO,kBAAkB;AAC9C,YAAG;AAAC,eAAK,gBAAgB,KAAK,iBAAiB;AAAA,QAAC,SAAO,GAAM;AAAC,cAAG,EAAE,MAAM,WAAW,aAAa,KAAG,EAAE,MAAM,WAAW,eAAe,EAAE,MAAK,cAAc;AAAE,gBAAM;AAAA,QAAC;AACpK,YAAI;AAAC,eAAK,SAAO,SAAS,KAAK,UAAS,MAAK,GAAK;AAAA,QAAC,QAAQ;AAC3D,cAAI;AAAQ,cAAG;AAAC,kBAAI,KAAK,MAAM,aAAa,KAAK,UAAS,MAAM,CAAC;AAAA,UAAC,QAAM;AAAC,iBAAK,cAAc;AAAA,UAAC;AAC7F,cAAG,CAAC,OAAO,cAAc,KAAK,GAAG,KAAG,IAAI,OAAK,KAAG,OAAO,IAAI,eAAa,YAAU,CAAC,IAAI,WAAW,MAAK,cAAc;AACrH,cAAG;AAAC,oBAAQ,KAAK,IAAI,KAAI,CAAC;AAAE,iBAAK,cAAc;AAAA,UAAC,SAAO,GAAM;AAAC,gBAAG,EAAE,SAAO,QAAQ,OAAM;AAAA,UAAC;AACzF,qBAAW,KAAK,QAAQ;AAAE,eAAK,SAAO,SAAS,KAAK,UAAS,MAAK,GAAK;AAAA,QACzE;AACA,sBAAc,KAAK,QAAQ,KAAK,UAAU,EAAC,KAAI,QAAQ,KAAI,YAAW,WAAW,EAAC,CAAC,CAAC;AAAA,MAAC;AACnF,WAAK,KAAG,IAAI,OAAO,KAAK,SAAQ,cAAc,CAAC;AAC/C,WAAK,GAAG,OAAO,oBAAoB;AAAE,WAAK,GAAG,OAAO,oBAAoB;AAAE,WAAK,GAAG,OAAO,qBAAqB;AAC9G,WAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qIAOkH;AAC/H,WAAK,GAAG,QAAQ,yCAAyC,EAAE,IAAI,aAAY,WAAW,WAAW,CAAC,EAAE;AACpG,WAAK,YAAU,KAAK,GAAG,QAAQ,oCAAoC,EAAE,IAAI,WAAW,EAAE;AACtF,UAAG,CAAC,QAAQ,MAAM,MAAK,GAAG,QAAQ,wHAAwH,EAAE,IAAI;AAEhK,UAAG,CAAC,QAAQ,MAAM,MAAK,GAAG,QAAQ,oBAAoB,EAAE,IAAI;AAAA,IAC9D,SAAQ,GAAG;AAAC,UAAG;AAAC,aAAK,IAAI,MAAM;AAAA,MAAC,QAAM;AAAA,MAAC;AAAC;AAAC,WAAK,kBAAkB;AAAE,YAAM;AAAA,IAAC;AAAA,EAC3E;AAAA,EArCmB;AAAA,EADnB;AAAA,EAAO;AAAA,EAAyB;AAAA,EAAgC;AAAA,EAAwB;AAAA,EAA4B,SAAO;AAAA,EAAc,QAAM;AAAA,EAuCvI,oBAAmB;AACzB,QAAG;AACD,UAAG,KAAK,WAAS,QAAU;AACzB,YAAI,OAAK;AAAM,YAAG;AAAC,gBAAM,KAAG,UAAU,KAAK,MAAM,GAAE,QAAM,UAAU,KAAK,QAAQ;AAAE,iBAAK,GAAG,QAAM,MAAM,OAAK,GAAG,QAAM,MAAM,OAAK,CAAC,MAAM,eAAe;AAAA,QAAC,QAAM;AAAA,QAAC;AAC7J,kBAAU,KAAK,MAAM;AAAE,aAAK,SAAO;AACnC,YAAG,KAAK,KAAG;AAAC,qBAAW,KAAK,QAAQ;AAAA,QAAC,SAAO,GAAM;AAAC,cAAG,EAAE,SAAO,SAAS,OAAM;AAAA,QAAC;AAAA,MACjF;AAAA,IACF,UAAC;AAAQ,UAAG,KAAK,iBAAgB;AAAC,YAAG;AAAC,eAAK,gBAAgB,KAAK,UAAU;AAAA,QAAC,QAAM;AAAA,QAAC;AAAC;AAAC,aAAK,gBAAgB,MAAM;AAAE,aAAK,kBAAgB;AAAA,MAAS;AAAA,IAAC;AAAA,EAClJ;AAAA,EACA,KAAKC,KAAU,SAAmF;AAChG,eAAWA,GAAE;AACb,QAAG,CAAC,WAAS,QAAQ,oBAAkB,UAAW,OAAO,QAAQ,oBAAkB,aAAW,CAAC,MAAM,QAAQ,QAAQ,UAAQ,CAAC,CAAC,KAAG,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,CAAC,QAAQ,MAAM,UAAQ,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,CAAC,QAAQ,MAAM,UAAQ,QAAQ,MAAM,KAAK,OAAG,CAAC,WAAW,SAAS,CAAC,CAAC,EAAE,MAAK,iBAAiB;AACnT,UAAM,UAAQ,QAAQ,oBAAkB,MAAK,SAAO,QAAQ,UAAQ,CAAC;AACrE,QAAG,WAAS,CAAC,KAAK,MAAM,MAAK,kBAAiB,GAAG;AACjD,QAAG,CAAC,WAAS,CAAC,OAAO,OAAO,MAAK,iBAAiB;AAClD,WAAO,QAAQ,UAAU;AAAE,YAAQ,MAAM,QAAQ,UAAU;AAC3D,UAAM,QAAM,EAAC,QAAO,OAAM,QAAQ,OAAM,OAAM,QAAQ,OAAM,GAAI,UAAQ,EAAC,iBAAgB,KAAI,IAAE,CAAC,EAAE;AAClG,UAAM,QAAM,OAAO;AAAE,SAAK,GAAG,QAAQ,wCAAwC,EAAE,IAAIA,KAAG,IAAI,KAAK,GAAE,UAAU,KAAK,CAAC;AAAE,WAAO,EAAC,UAASA,KAAG,OAAM,WAAU,KAAK,WAAU,WAAU,gBAAgB,KAAK,SAAS,IAAIA,GAAE,IAAG,iBAAgB,QAAO;AAAA,EAChP;AAAA,EACA,OAAO,OAAc;AAAC,QAAG,OAAO,UAAQ,YAAU,MAAM,SAAO,IAAI,MAAK,gBAAe,GAAG;AAAE,UAAM,MAAI,KAAK,GAAG,QAAQ,sCAAsC,EAAE,IAAI,IAAI,KAAK,CAAC;AAAE,UAAM,WAAS,QAAQ,OAAM,KAAK,UAAQ,IAAI,OAAO,EAAE,CAAC;AAAE,QAAG,CAAC,YAAU,CAAC,OAAK,IAAI,QAAQ,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EAC3S,OAAOA,KAAW;AAAC,UAAM,QAAM,OAAO;AAAE,QAAG,CAAC,KAAK,GAAG,QAAQ,sEAAsE,EAAE,IAAI,IAAI,KAAK,GAAE,WAAWA,GAAE,CAAC,EAAE,QAAQ,MAAK,gBAAe,GAAG;AAAE,WAAO,EAAC,UAASA,KAAG,MAAK;AAAA,EAAC;AAAA,EAC9N,OAAOA,KAAW;AAAC,SAAK,GAAG,QAAQ,6DAA6D,EAAE,IAAI,WAAWA,GAAE,CAAC;AAAA,EAAC;AAAA,EAC7G,cAAc,QAAW;AAAC,UAAM,MAAI,KAAK,GAAG,QAAQ,kCAAkC,EAAE,IAAI,QAAQ,EAAE;AAAE,QAAG,CAAC,OAAK,IAAI,WAAS,IAAI,aAAW,OAAO,YAAU,IAAI,WAAS,OAAO,OAAO,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EACpO,MAAM,QAAW,SAAa;AAC5B,aAAO,KAAK,cAAc,MAAM;AAChC,UAAM,UAAQ,KAAK,MAAM,OAAO,OAAO;AAAE,eAAUC,QAAO,CAAC,SAAQ,UAAS,WAAW,EAAE,YAAW,QAAQA,IAAG,CAAC;AAChH,QAAG,QAAQ,oBAAkB,QAAM,CAAC,QAAQ,OAAO,SAAS,QAAQ,KAAK,KAAG,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAG,QAAQ,MAAM,KAAK,CAAC,MAAW,CAAC,QAAQ,MAAM,SAAS,CAAC,CAAC,KAAG,QAAQ,MAAM,KAAK,CAAC,MAAW,CAAC,QAAQ,MAAM,SAAS,CAAC,CAAC,EAAE,MAAK,gBAAe,GAAG;AACxR,UAAM,MAAI,QAAQ,SAAO;AAAO,QAAG,CAAC,OAAO,cAAc,GAAG,KAAG,MAAI,OAAM,MAAI,IAAO,MAAK,kBAAkB;AAC3G,SAAK,GAAG,QAAQ,iEAAiE,EAAE,IAAI,KAAK,IAAI,CAAC;AACjG,QAAG,KAAK,GAAG,QAAQ,sCAAsC,EAAE,IAAI,EAAE,SAAO,KAAK,MAAK,eAAc,GAAG;AACnG,UAAM,UAAQ,EAAC,UAAS,OAAO,IAAG,OAAM,QAAQ,OAAM,QAAO,QAAQ,QAAO,WAAU,QAAQ,WAAU,OAAM,QAAQ,OAAM,OAAM,QAAQ,OAAM,WAAU,KAAK,IAAI,IAAE,KAAI,UAAS,OAAO,UAAS,SAAQ,WAAW,EAAC;AACtN,UAAM,QAAM,OAAO;AAAE,SAAK,GAAG,QAAQ,iCAAiC,EAAE,IAAI,IAAI,KAAK,GAAE,UAAU,OAAO,CAAC;AAAE,WAAO,EAAC,YAAW,OAAM,WAAU,KAAK,WAAU,eAAc,GAAE,GAAG,QAAO;AAAA,EACzL;AAAA,EACA,MAAM,OAAsB;AAAC,QAAG,OAAO,UAAQ,YAAU,MAAM,SAAO,IAAI,MAAK,gBAAe,GAAG;AAAE,UAAM,MAAI,KAAK,GAAG,QAAQ,kDAAkD,EAAE,IAAI,IAAI,KAAK,CAAC;AAAE,UAAM,WAAS,QAAQ,OAAM,KAAK,UAAQ,IAAI,OAAO,EAAE,CAAC;AAAE,QAAG,CAAC,YAAU,CAAC,IAAI,MAAK,gBAAe,GAAG;AAAE,UAAM,UAAQ,KAAK,MAAM,IAAI,OAAO;AAAE,SAAK,SAAS,OAAO;AAAE,WAAO;AAAA,EAAO;AAAA,EAClX,SAAS,GAAW;AAAC,UAAM,MAAI,KAAK,GAAG,QAAQ,iDAAiD,EAAE,IAAI,EAAE,QAAQ;AAAE,QAAG,CAAC,OAAK,IAAI,WAAS,IAAI,aAAW,EAAE,YAAU,EAAE,aAAW,KAAK,IAAI,KAAG,CAAC,EAAE,WAAS,CAAC,KAAK,GAAG,QAAQ,gEAAgE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAK,iBAAgB,GAAG;AAAA,EAAC;AAAA,EACnU,aAAa,QAAW,SAAa;AACnC,aAAO,KAAK,cAAc,MAAM;AAChC,eAAW,QAAQ,KAAK;AACxB,UAAM,UAAQ,KAAK,MAAM,OAAO,OAAO;AAAE,QAAG,QAAQ,oBAAkB,QAAM,CAAC,QAAQ,OAAO,SAAS,QAAQ,KAAK,EAAE,MAAK,gBAAe,GAAG;AAE3I,UAAM,SAAO,KAAK,GAAG,QAAQ,qGAAqG,EAAE,IAAI,OAAO,IAAG,QAAQ,KAAK;AAC/J,WAAO,EAAC,WAAU,KAAK,WAAU,eAAc,GAAE,SAAQ,OAAO,SAAQ,OAAM,QAAQ,MAAK;AAAA,EAC7F;AAAA,EACA,MAAMD,KAAU,SAAgB,MAAYE,OAAU;AACpD,eAAWF,GAAE;AAAE,UAAMG,UAAO,IAAI,UAAU,EAAC,UAAS,QAAQ,UAAS,OAAM,QAAQ,OAAM,QAAO,QAAQ,QAAO,WAAU,QAAQ,WAAU,MAAK,MAAAD,MAAI,CAAC,CAAC;AACtJ,WAAO,KAAK,GAAG,YAAY,MAAI;AAAC,YAAM,MAAI,KAAK,GAAG,QAAQ,qCAAqC,EAAE,IAAIF,GAAE;AAAE,UAAG,KAAI;AAAC,YAAG,IAAI,WAASG,QAAO,MAAK,sBAAqB,GAAG;AAAE,eAAO,EAAC,OAAM,OAAM,WAAU,KAAK,OAAO,GAAG,EAAC;AAAA,MAAC;AACpN,WAAK,GAAG,QAAQ,6FAA6F,EAAE,IAAIH,KAAGG,SAAO,UAAU,OAAO,GAAE,MAAK,KAAK,IAAI,CAAC;AAAE,aAAO,EAAC,OAAM,MAAK,WAAU,KAAK,OAAOH,KAAG,OAAO,EAAC;AAAA,IAAC,CAAC,EAAE;AAAA,EAC7N;AAAA,EACA,IAAI,OAAa,GAAW;AAAC,UAAM,IAAE,KAAK,MAAM,KAAK;AAAE,QAAG,EAAE,aAAW,EAAE,YAAU,EAAE,UAAQ,EAAE,SAAO,EAAE,WAAS,EAAE,UAAQ,EAAE,cAAY,EAAE,UAAU,MAAK,gBAAe,GAAG;AAAA,EAAC;AAAA,EAC7K,OAAOA,KAAU,GAAW;AAAC,UAAM,MAAI,KAAK,GAAG,QAAQ,qCAAqC,EAAE,IAAI,WAAWA,GAAE,CAAC;AAAE,QAAG,CAAC,IAAI,MAAK,uBAAsB,GAAG;AAAE,SAAK,IAAI,IAAI,SAAQ,CAAC;AAAE,WAAO,KAAK,OAAO,GAAG;AAAA,EAAC;AAAA,EACzM,OAAO,KAAS;AAAC,WAAO,EAAC,eAAc,GAAE,WAAU,KAAK,WAAU,aAAY,IAAI,IAAG,MAAK,IAAI,MAAK,QAAO,IAAI,QAAO,WAAU,IAAI,KAAK,IAAI,OAAO,EAAE,YAAY,GAAE,YAAW,IAAI,WAAS,IAAI,KAAK,IAAI,QAAQ,EAAE,YAAY,IAAE,MAAK,QAAO,IAAI,SAAO,KAAK,MAAM,IAAI,MAAM,IAAE,MAAK,OAAM,IAAI,QAAM,EAAC,MAAK,IAAI,MAAK,IAAE,KAAI;AAAA,EAAC;AAAA,EACzT,OAAOA,KAAU,QAAc,SAAW,MAAKI,SAAkB,MAAM;AAAC,SAAK,GAAG,QAAQ,uEAAuE,EAAE,IAAI,QAAO,WAAS,OAAK,OAAK,UAAU,MAAM,GAAEA,QAAM,KAAK,IAAI,GAAEJ,GAAE;AAAA,EAAC;AAAA,EACrO,QAAQA,KAAW;AAAC,SAAK,GAAG,QAAQ,yEAAyE,EAAE,IAAIA,GAAE;AAAA,EAAC;AAAA,EACtH,MAAM,MAAY,QAAkB,MAAK,YAAsB,MAAK;AAAC,SAAK,GAAG,QAAQ,+DAA+D,EAAE,IAAI,KAAK,IAAI,GAAE,MAAK,OAAM,SAAS;AAAE,SAAK,GAAG,QAAQ,gEAAgE,EAAE,IAAI;AAAA,EAAC;AAAA,EAClR,QAAO;AAAC,QAAG,KAAK,OAAO;AAAO,SAAK,SAAO;AAAK,QAAG;AAAC,WAAK,GAAG,MAAM;AAAA,IAAC,UAAC;AAAQ,WAAK,kBAAkB;AAAA,IAAC;AAAA,EAAC;AACtG;;;ACpGA,SAAS,iBAA6B;AACtC,SAAS,OAAO,UAAU,MAAM,MAAM,eAAe;AACrD,OAAO,UAAU;AAGV,IAAM,QAAN,MAAY;AAAA,EAGjB,YAAmB,OAA4B,UAAuB,CAAC,GAAE;AAAtD;AACjB,SAAK,kBAAgB,QAAQ,kBAAgB,CAAC,GAAG,IAAI,OAAG,KAAK,QAAQ,CAAC,CAAC;AACvE,SAAK,oBAAkB,QAAQ,qBAAmB;AAClD,QAAG,CAAC,OAAO,cAAc,KAAK,iBAAiB,KAAG,KAAK,oBAAkB,KAAG,KAAK,oBAAkB,MAAM,OAAM,IAAI,MAAM,6BAA6B;AAAA,EACxJ;AAAA,EAJmB;AAAA,EAFX;AAAA,EACA;AAAA,EAMR,OAAO,MAAY,QAAc;AAAC,UAAM,MAAI,KAAK,SAAS,MAAK,MAAM;AAAE,WAAO,QAAM,MAAK,CAAC,IAAI,WAAW,KAAK,KAAK,GAAG,EAAE,KAAG,QAAM,QAAM,CAAC,KAAK,WAAW,GAAG;AAAA,EAAE;AAAA,EAC7J,MAAc,OAAO,GAAyB;AAC5C,QAAG;AAAC,aAAO,MAAM,SAAS,CAAC;AAAA,IAAC,SAAO,GAAM;AACvC,UAAG,EAAE,SAAO,YAAU,EAAE,SAAO,UAAU,OAAM;AAC/C,YAAM,SAAO,KAAK,QAAQ,CAAC;AAAE,UAAG,WAAS,EAAE,OAAM;AACjD,aAAO,KAAK,KAAK,MAAM,KAAK,OAAO,MAAM,GAAE,KAAK,SAAS,CAAC,CAAC;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAc,WAAU;AACtB,UAAM,UAAQ,IAAI,IAAY,KAAK,cAAc;AACjD,eAAU,KAAK,KAAK,eAAe,SAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;AACnE,WAAO,CAAC,GAAG,OAAO;AAAA,EACpB;AAAA,EACQ,SAAS,GAAQ;AAAC,WAAO,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG;AAAA,EAAE;AAAA,EACpD,MAAc,gBAAgB,GAAQ;AACpC,QAAG,CAAC,EAAE,OAAO,KAAG,EAAE,QAAM,KAAG,CAAC,KAAK,eAAe,OAAO,QAAO;AAC9D,UAAM,SAAO,KAAK,SAAS,CAAC,GAAE,OAAK,oBAAI,IAAY,GAAE,QAAM,CAAC,GAAG,KAAK,cAAc;AAAE,QAAIK,SAAM;AAC9F,WAAM,MAAM,QAAO;AACjB,UAAG,EAAEA,SAAM,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AACpE,YAAM,IAAE,MAAM,IAAI;AAAG,UAAI;AACzB,UAAG;AAAC,eAAK,MAAM,KAAK,CAAC;AAAA,MAAC,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,YAAU,EAAE,SAAO,UAAU;AAAS,aAAK,2BAA0B,GAAG;AAAA,MAAC;AACzH,YAAMC,MAAG,KAAK,SAAS,IAAI;AAAE,UAAGA,QAAK,OAAO,QAAO;AACnD,UAAG,KAAK,IAAIA,GAAE,EAAE;AAAS,WAAK,IAAIA,GAAE;AACpC,UAAG,KAAK,YAAY,GAAE;AACpB,YAAI;AAAe,YAAG;AAAC,kBAAM,MAAM,QAAQ,CAAC;AAAA,QAAC,QAAM;AAAC,eAAK,2BAA0B,GAAG;AAAA,QAAC;AACvF,YAAG,MAAO,SAAOD,SAAM,MAAM,SAAO,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AAC7F,mBAAU,QAAQ,MAAO,OAAM,KAAK,KAAK,KAAK,GAAE,IAAI,CAAC;AAAA,MACvD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAc,QAAQ,QAAc,SAAO,OAAM,YAAkB;AACjE,UAAM,SAAO,MAAM,KAAK,OAAO,MAAM,GAAE,WAAS,MAAM,KAAK,SAAS;AACpE,QAAG,SAAS,KAAK,OAAG,KAAK,OAAO,GAAE,MAAM,KAAG,KAAK,OAAO,GAAE,MAAM,KAAI,WAAS,KAAK,OAAO,QAAO,CAAC,KAAG,KAAK,OAAO,QAAO,CAAC,EAAG,EAAE,MAAK,0BAAyB,GAAG;AAC7J,QAAI,IAAE;AACN,QAAG,CAAC,EAAE,KAAG;AAAC,UAAE,MAAM,KAAK,MAAM;AAAA,IAAC,SAAO,GAAM;AAAC,UAAG,EAAE,SAAO,YAAU,EAAE,SAAO,UAAU,OAAM;AAAA,IAAC;AAC5F,QAAG,KAAG,MAAM,KAAK,gBAAgB,CAAC,EAAE,MAAK,0BAAyB,GAAG;AAAA,EACvE;AAAA,EACA,MAAM,iBAAiB,QAAc;AAAC,UAAM,KAAK,QAAQ,QAAO,IAAI;AAAA,EAAC;AAAA,EACrE,MAAM,oBAAoB,QAAc;AACtC,UAAM,QAAM,CAAC,MAAM;AAAE,QAAIA,SAAM;AAC/B,WAAM,MAAM,QAAO;AACjB,UAAG,EAAEA,SAAM,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AACpE,YAAM,UAAQ,MAAM,IAAI,GAAG,SAAO,MAAM,MAAM,OAAO;AACrD,UAAG,OAAO,eAAe,EAAE,MAAK,2BAA0B,GAAG;AAC7D,YAAM,KAAK,QAAQ,SAAQ,MAAK,MAAM;AACtC,UAAG,OAAO,YAAY,GAAE;AACtB,cAAM,QAAM,MAAM,QAAQ,OAAO;AACjC,YAAG,MAAM,SAAOA,SAAM,MAAM,SAAO,KAAK,kBAAkB,MAAK,2BAA0B,GAAG;AAC5F,mBAAU,QAAQ,MAAM,OAAM,KAAK,KAAK,KAAK,SAAQ,IAAI,CAAC;AAAA,MAC5D,WAAS,CAAC,OAAO,OAAO,EAAE,MAAK,2BAA0B,GAAG;AAAA,IAC9D;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAc,eAAa,IAAG,SAAO,OAAO;AACxD,UAAM,aAAW,OAAO,OAAO,KAAK,OAAM,MAAM,IAAE,KAAK,MAAM,MAAM,IAAE;AACrE,QAAG,CAAC,cAAY,OAAO,iBAAe,YAAU,aAAa,SAAS,IAAI,KAAG,KAAK,WAAW,YAAY,KAAG,2BAA2B,KAAK,YAAY,EAAE,MAAK,2BAA0B,GAAG;AAC5L,UAAM,OAAK,MAAM,SAAS,UAAW;AAAE,UAAM,QAAM,aAAa,MAAM,OAAO,EAAE,OAAO,OAAO;AAAE,QAAG,MAAM,KAAK,OAAG,MAAI,QAAM,MAAI,OAAK,QAAQ,KAAK,CAAC,CAAC,EAAE,MAAK,2BAA0B,GAAG;AACtL,QAAI,SAAO;AACX,aAAQ,IAAE,GAAE,IAAE,MAAM,QAAO,KAAI;AAAC,eAAO,KAAK,KAAK,QAAO,MAAM,CAAC,CAAC;AAAE,UAAG;AAAC,cAAM,IAAE,MAAM,MAAM,MAAM;AAAE,YAAG,EAAE,eAAe,EAAE,MAAK,2BAA0B,GAAG;AAAE,cAAM,SAAO,MAAM,SAAS,MAAM;AAAE,YAAG,CAAC,KAAK,OAAO,MAAK,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAAA,MAAC,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,YAAU,UAAQ,MAAI,MAAM,SAAO,EAAE;AAAM,cAAM;AAAA,MAAC;AAAA,IAAC;AAC7U,QAAG,CAAC,KAAK,OAAO,MAAK,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAAE,UAAM,KAAK,QAAQ,QAAO,MAAM;AAAE,WAAO;AAAA,EAC5G;AAAA,EACA,MAAM,KAAK,MAAYE,WAAgB,QAAc,QAAe;AAClE,UAAM,SAAO,MAAM,KAAK,QAAQ,MAAKA,SAAQ;AAAE,UAAM,SAAO,MAAM,KAAK,QAAO,UAAU,YAAU,UAAU,cAAY,EAAE;AAC1H,QAAG;AAAC,YAAM,SAAO,MAAM,OAAO,KAAK;AAAE,UAAG,CAAC,OAAO,OAAO,EAAE,MAAK,YAAY;AAAE,YAAM,WAAS,MAAM,KAAK,QAAQ,MAAKA,SAAQ,GAAE,QAAM,MAAM,KAAK,QAAQ;AAAE,UAAG,OAAO,QAAM,MAAM,OAAK,OAAO,QAAM,MAAM,IAAI,MAAK,gBAAe,GAAG;AAC/N,YAAM,KAAK,QAAQ,UAAS,OAAM,MAAM;AACxC,UAAG,QAAQ,aAAW,SAAQ;AAAC,cAAM,SAAO,MAAM,SAAS,iBAAiB,OAAO,EAAE,EAAE,GAAE,OAAK,MAAM,SAAS,KAAK,MAAM,IAAI,CAAC;AAAE,YAAG,CAAC,KAAK,OAAO,MAAK,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAAE,cAAM,KAAK,QAAQ,QAAO,OAAM,MAAM;AAAA,MAAC;AACvO,YAAM,OAAK,OAAO,MAAM,KAAK,IAAI,QAAO,KAAK,IAAI,GAAE,OAAO,OAAK,MAAM,CAAC,CAAC;AAAE,YAAM,EAAC,UAAS,IAAE,MAAM,OAAO,KAAK,MAAK,GAAE,KAAK,QAAO,MAAM;AAAE,aAAO,EAAC,MAAK,KAAK,SAAS,GAAE,SAAS,GAAE,MAAK,OAAO,KAAI;AAAA,IAClM,UAAC;AAAQ,YAAM,OAAO,MAAM;AAAA,IAAC;AAAA,EAC/B;AAAA,EACA,MAAM,KAAK,MAAYA,WAAgB;AACrC,UAAM,SAAO,MAAM,KAAK,QAAQ,MAAKA,SAAQ,GAAE,UAAQ,MAAM,QAAQ,QAAO,EAAC,eAAc,KAAI,CAAC,GAAE,UAAQ,CAAC;AAC3G,eAAU,SAAS,SAAQ;AACzB,UAAG;AAAC,cAAM,KAAK,QAAQ,KAAK,KAAK,QAAO,MAAM,IAAI,CAAC;AAAE,gBAAQ,KAAK,KAAK;AAAA,MAAC,SAAO,GAAM;AACnF,YAAG,CAAC,CAAC,0BAAyB,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAM;AAAA,MAClF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AC3FA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,QAAQ,OAAO,UAAU,QAAAC,OAAM,cAAc;AACtD,SAAS,QAAAC,aAAY;AAEd,IAAM,eAAN,MAAmB;AAAA,EAExB,YAAoB,SAAyB,gBAA+B,SAAO,MAAI,OAAO,YAAY,GAAU,eAAmC,CAAC,GAAE;AAAtI;AAAyB;AAA+B;AAAwC;AAAA,EAAuC;AAAA,EAAvI;AAAA,EAAyB;AAAA,EAA+B;AAAA,EAAwC;AAAA,EAD5G;AAAA,EAAoB,WAAS,oBAAI,IAAgB;AAAA,EAAU,WAAS,oBAAI,IAAgB;AAAA,EAEhG,MAAM,QAAO;AAAC,QAAG;AAAC,YAAM,KAAK,OAAO;AAAE,UAAG,KAAK,eAAe,OAAM,OAAO,KAAK,cAAc;AAAE,aAAO,EAAC,QAAO,KAAK,SAAS,YAAY,IAAE,UAAQ,oBAAmB,cAAa,KAAK,SAAS,YAAY,IAAE,aAAW,cAAa,QAAO,YAAW,WAAU,mBAAkB,gBAAe,KAAK,SAAQ,oBAAmB,OAAO,KAAK,KAAK,YAAY,EAAE,KAAK,EAAC;AAAA,IAAC,QAAM;AAAC,aAAO,EAAC,QAAO,eAAc,MAAK,iBAAgB;AAAA,IAAC;AAAA,EAAC;AAAA,EACpa,QAAQ,KAAY;AAAC,QAAI;AAAM,QAAG;AAAC,UAAE,IAAI,IAAI,GAAG;AAAA,IAAC,QAAM;AAAC,WAAK,qBAAoB,GAAG;AAAA,IAAC;AAAC,QAAG,CAAC,CAAC,SAAQ,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAG,EAAE,YAAU,EAAE,YAAU,CAAC,KAAK,QAAQ,SAAS,EAAE,MAAM,EAAE,MAAK,qBAAoB,GAAG;AAAA,EAAC;AAAA,EACzN,MAAM,IAAI,MAAY,GAAM,GAAW;AACrC,QAAG,SAAO,gBAAe;AACvB,WAAK,QAAQ,EAAE,GAAG;AAAE,UAAG,KAAK,SAAS,QAAM,GAAG,MAAK,iBAAgB,GAAG;AACtE,UAAI;AAAO,UAAG;AAAC,aAAG,MAAM,KAAK,OAAO;AAAA,MAAC,QAAM;AAAC,aAAK,kBAAiB,GAAG;AAAA,MAAC;AACtE,UAAI,SAAQ,aAAW,OAAM,YAAU;AACvC,UAAG,EAAE,cAAY,QAAU;AACzB,cAAM,OAAK,KAAK,aAAa,EAAE,SAAS;AAAE,YAAG,CAAC,KAAK,MAAK,0BAAyB,GAAG;AACpF,cAAM,QAAM,KAAK,UAAU,CAAC,EAAE,UAAS,EAAE,OAAM,EAAE,SAAS,CAAC,GAAEC,OAAIC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAChH,YAAG;AAAC,oBAAQ,KAAK,SAAS,IAAID,IAAG;AAAE,cAAG,CAAC,SAAQ;AAAC,kBAAM,UAAQE,MAAK,MAAKF,IAAG;AAAE,kBAAM,MAAM,SAAQ,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,sBAAQ,MAAM,GAAG,SAAS,wBAAwB,SAAQ,EAAC,UAAS,MAAK,gBAAe,KAAK,gBAAe,iBAAgB,MAAK,gBAAe,QAAO,CAAC;AAAE,iBAAK,SAAS,IAAIA,MAAI,OAAO;AAAA,UAAC;AAAC,uBAAW;AAAK,sBAAU,EAAE;AAAA,QACnV,QAAM;AAAC,eAAK,+BAA8B,GAAG;AAAA,QAAC;AAAA,MAChD,OAAK;AACH,YAAG;AAAC,eAAK,YAAU,MAAM,GAAG,SAAS,OAAO,EAAC,UAAS,MAAK,gBAAe,KAAK,eAAc,CAAC;AAAE,oBAAQ,MAAM,KAAK,QAAQ,WAAW,EAAC,iBAAgB,MAAK,gBAAe,QAAO,CAAC;AAAA,QAAC,QAAM;AAAC,eAAK,kBAAiB,GAAG;AAAA,QAAC;AAAA,MACvN;AACA,YAAM,QAAQ,MAAM,QAAO,OAAM,UAAY;AAAC,YAAG;AAAC,eAAK,QAAQ,MAAM,QAAQ,EAAE,IAAI,CAAC;AAAE,gBAAM,MAAM,SAAS;AAAA,QAAC,QAAM;AAAC,gBAAM,MAAM,MAAM,iBAAiB;AAAA,QAAC;AAAA,MAAC,CAAC;AACzJ,YAAM,OAAK,MAAM,QAAQ,QAAQ;AAAE,WAAK,GAAG,SAAQ,CAAC,MAAQ,KAAK,EAAE,MAAM,CAAC;AAAE,YAAMG,MAAG,WAAWC,YAAW,CAAC,IAAG,YAAU,oBAAI,IAAI;AACjI,WAAK,GAAG,YAAW,CAACC,cAAe;AAAC,cAAMC,cAAW,YAAYF,YAAW,CAAC;AAAG,kBAAU,IAAIE,aAAW,EAAC,UAAAD,WAAS,MAAKA,UAAS,KAAK,GAAE,mBAAkBA,UAAS,kBAAkB,EAAC,CAAC;AAAA,MAAC,CAAC;AACzL,WAAK,SAAS,IAAIF,KAAG,EAAC,SAAQ,MAAK,OAAM,KAAK,UAAU,CAAC,EAAE,UAAS,EAAE,OAAM,EAAE,QAAO,EAAE,SAAS,CAAC,GAAE,UAAS,MAAK,YAAW,WAAU,UAAS,CAAC;AAChJ,UAAG;AAAC,cAAM,KAAK,KAAK,EAAE,KAAI,EAAC,WAAU,oBAAmB,SAAQ,IAAK,CAAC;AAAE,eAAO,EAAC,kBAAiBA,KAAG,KAAI,KAAK,IAAI,GAAE,gBAAe,KAAK,SAAS,QAAQ,KAAG,YAAW,YAAW,UAAS;AAAA,MAAC,QAAM;AAAC,aAAK,SAAS,OAAOA,GAAE;AAAE,qBAAW,MAAM,KAAK,MAAM,IAAE,MAAM,QAAQ,MAAM;AAAE,aAAK,2BAA2B;AAAA,MAAC;AAAA,IAClT;AACA,UAAM,UAAQ,KAAK,SAAS,IAAI,EAAE,gBAAgB;AAAE,QAAG,CAAC,QAAQ,MAAK,6BAA4B,GAAG;AACpG,QAAG,QAAQ,UAAQ,KAAK,UAAU,CAAC,EAAE,UAAS,EAAE,OAAM,EAAE,QAAO,EAAE,SAAS,CAAC,EAAE,MAAK,gBAAe,GAAG;AACpG,QAAG,SAAO,iBAAgB;AAAC,cAAQ,aAAW,MAAM,QAAQ,KAAK,MAAM,IAAE,MAAM,QAAQ,QAAQ,MAAM;AAAE,WAAK,SAAS,OAAO,EAAE,gBAAgB;AAAE,aAAO,EAAC,QAAO,MAAK,YAAW,QAAQ,WAAU;AAAA,IAAC;AAClM,QAAG,SAAO,oBAAmB;AAC3B,YAAM,OAAK,QAAQ,UAAU,IAAI,EAAE,UAAU;AAAE,UAAG,CAAC,KAAK,MAAK,8BAA6B,GAAG;AAC7F,YAAMI,QAAK,MAAM,KAAK,MAAK,OAAK,MAAMC,MAAKD,KAAI;AAAE,UAAG,KAAK,OAAK,QAAQ,MAAK,8BAA6B,GAAG;AAC3G,YAAM,OAAK,MAAM,SAASA,KAAI;AAAE,YAAM,OAAOA,KAAI;AAAE,cAAQ,UAAU,OAAO,EAAE,UAAU;AACxF,aAAO,EAAC,YAAW,EAAE,YAAW,UAAS,KAAK,mBAAkB,UAAS,UAAS,SAAQ,KAAK,SAAS,QAAQ,GAAE,QAAO,IAAI,IAAI,GAAE,MAAK,KAAK,OAAM;AAAA,IACrJ;AACA,QAAG,SAAO,kBAAiB;AACzB,UAAG,OAAO,EAAE,WAAS,YAAU,CAAC,EAAE,OAAO,KAAK,KAAG,EAAE,OAAO,SAAO,SAAO,EAAE,OAAO,SAAS,IAAI,EAAE,MAAK,kBAAkB;AACvH,UAAI;AAAM,UAAG;AAAC,gBAAM,MAAM,QAAQ,KAAK,SAAS,EAAE,MAAM;AAAA,MAAC,QAAM;AAAC,aAAK,yBAAwB,GAAG;AAAA,MAAC;AACjG,UAAI;AAAK,UAAG;AAAC,eAAK,KAAK,UAAU,SAAO,IAAI;AAAA,MAAC,QAAM;AAAC,aAAK,+BAA8B,GAAG;AAAA,MAAC;AAC3F,UAAG,KAAK,SAAO,IAAO,MAAK,+BAA8B,GAAG;AAC5D,aAAO,EAAC,WAAU,MAAK,KAAI,QAAQ,KAAK,IAAI,GAAE,QAAO,SAAO,KAAI;AAAA,IAClE;AACA,QAAG,SAAO,oBAAmB;AAC3B,cAAQ,WAAS,YAAYH,YAAW,CAAC;AACzC,YAAM,QAAM,MAAM,QAAQ,KAAK,QAAQ,gDAAgD,EAAE,YAAY,CAAC,aAAiB,SAAS,MAAM,GAAE,GAAG,EAAE,IAAI,CAAC,IAAO,MAAW;AAAC,WAAG,aAAa,sBAAqB,OAAO,CAAC,CAAC;AAAE,eAAO,EAAC,KAAI,OAAO,CAAC,GAAE,KAAI,GAAG,QAAQ,YAAY,GAAE,OAAM,GAAG,aAAW,GAAG,aAAa,YAAY,KAAG,IAAI,MAAM,GAAE,GAAG,EAAC;AAAA,MAAC,CAAC,CAAC;AAC9U,aAAO,EAAC,kBAAiB,EAAE,kBAAiB,YAAW,QAAQ,UAAS,KAAI,QAAQ,KAAK,IAAI,GAAE,OAAM,MAAM,QAAQ,KAAK,QAAQ,MAAM,EAAE,UAAU,GAAG,MAAM,GAAE,GAAM,GAAE,MAAK;AAAA,IAC5K;AACA,QAAG,EAAE,eAAa,QAAQ,YAAU,CAAC,YAAY,KAAK,EAAE,GAAG,EAAE,MAAK,gBAAe,GAAG;AACpF,UAAM,OAAK,QAAQ,KAAK,QAAQ,wBAAwB,EAAE,GAAG,IAAI;AAAE,QAAG,MAAM,KAAK,MAAM,MAAI,EAAE,MAAK,gBAAe,GAAG;AACpH,YAAQ,WAAS;AACjB,QAAG,SAAO,mBAAiB,OAAO,EAAE,SAAO,YAAU,EAAE,KAAK,SAAO,OAAO,MAAK,kBAAkB;AACjG,QAAI;AACJ,QAAG,SAAO,kBAAiB;AACzB,UAAG,OAAO,EAAE,aAAW,YAAU,CAAC,EAAE,YAAU,EAAE,SAAS,SAAO,OAAK,UAAU,KAAK,EAAE,QAAQ,KAAG,OAAO,EAAE,kBAAgB,SAAS,MAAK,kBAAkB;AAC1J,YAAM,OAAK,OAAO,KAAK,EAAE,eAAc,QAAQ;AAAE,UAAG,KAAK,SAAS,QAAQ,MAAI,EAAE,iBAAe,KAAK,SAAO,QAAQ,MAAK,wBAAuB,GAAG;AAClJ,UAAG,EAAE,aAAW,WAAY,OAAO,EAAE,aAAW,YAAU,CAAC,uBAAuB,KAAK,EAAE,QAAQ,GAAG,MAAK,kBAAkB;AAC3H,eAAO,EAAC,MAAK,EAAE,UAAS,UAAS,EAAE,YAAU,cAAa,QAAO,KAAI;AAAA,IACvE;AACA,UAAM,kBAAgB,SAAO,kBAAgB,QAAQ,KAAK,aAAa,YAAW,EAAC,SAAQ,IAAI,CAAC,EAAE,MAAM,MAAI,IAAI,IAAE;AAClH,QAAG;AAAC,UAAG,SAAO,gBAAgB,OAAM,KAAK,MAAM,EAAC,SAAQ,IAAK,CAAC;AAAA,eACpD,SAAO,eAAe,OAAM,KAAK,KAAK,EAAE,MAAK,EAAC,SAAQ,IAAK,CAAC;AAAA,eAC5D,SAAO,iBAAiB,OAAM,KAAK,cAAc,QAAO,EAAC,SAAQ,IAAK,CAAC;AAAA,UAC1E,MAAK,kBAAiB,GAAG;AAAA,IAChC,QAAM;AAAC,WAAK,mBAAkB,GAAG;AAAA,IAAC;AAClC,UAAM,WAAS,MAAM,iBAAgB,aAAW,WAAS,CAAC,GAAG,QAAQ,UAAU,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,EAAC,IAAI,MAAI,KAAK,aAAW,QAAQ,IAAI,CAAC,IAAE;AACzI,WAAO,EAAC,WAAU,MAAK,KAAI,QAAQ,KAAK,IAAI,GAAE,GAAI,aAAW,EAAC,WAAU,IAAE,CAAC,EAAE;AAAA,EAC/E;AAAA,EACA,MAAM,QAAO;AAAC,eAAU,KAAK,KAAK,SAAS,OAAO,EAAE,GAAE,aAAW,MAAM,EAAE,KAAK,MAAM,IAAE,MAAM,EAAE,QAAQ,MAAM;AAAE,SAAK,SAAS,MAAM;AAAE,eAAU,WAAW,KAAK,SAAS,OAAO,EAAE,OAAM,QAAQ,MAAM;AAAE,SAAK,SAAS,MAAM;AAAE,UAAM,KAAK,SAAS,MAAM;AAAA,EAAC;AACzP;;;ACtEA,OAAO,SAAS;AAChB,SAAQ,YAAAK,iBAAe;AACvB,SAAQ,cAAAC,mBAAiB;AAKzB,IAAM,QAAM,CAAC,MAAY,kBAAgB,OAAM,gBAAc,UAAQ,OAAO,OAAO,IAAI,WAAW,MAAK,GAAG,GAAE,EAAC,iBAAgB,cAAa,CAAC;AAGpI,IAAM,eAAN,MAAmB;AAAA,EAExB,YAAoB,QAAoD,UAAgB,CAAC,GAAE;AAAvE;AAAoD;AAAA,EAAoB;AAAA,EAAxE;AAAA,EAAoD;AAAA,EADhE,QAAMC,YAAW;AAAA,EAAU,SAAO,oBAAI,IAAkB;AAAA,EAAU,UAAQ,IAAI,gBAAgB;AAAA,EAAU,SAAO,oBAAI,IAAkB;AAAA,EAErI,IAAI,GAAU;AAAC,WAAO,IAAI,UAAU,EAAC,OAAM,KAAK,OAAM,QAAO,EAAE,UAAS,KAAI,EAAE,OAAM,MAAK,EAAE,QAAO,SAAQ,EAAE,WAAU,UAAS,EAAE,SAAQ,CAAC,CAAC;AAAA,EAAC;AAAA,EAC5I,MAAM,GAAU;AACtB,UAAM,MAAI,KAAK,IAAI;AAAE,eAAU,CAACC,MAAIC,IAAG,KAAK,KAAK,OAAO,KAAG,CAACA,KAAI,UAAQ,CAACA,KAAI,aAAWA,KAAI,YAAU,MAAM,IAAI,MAAK,OAAO,OAAOD,IAAG;AACtI,UAAM,MAAI,KAAK,IAAI,CAAC;AAAE,QAAI,MAAI,KAAK,OAAO,IAAI,GAAG;AACjD,QAAG,CAAC,KAAI;AAAC,UAAG,KAAK,OAAO,QAAM,KAAK,MAAK,uBAAsB,GAAG;AAAE,YAAI,EAAC,KAAI,WAAU,EAAE,WAAU,SAAQ,OAAM,QAAO,GAAE,QAAO,GAAE,WAAU,GAAE,cAAa,EAAC;AAAE,WAAK,OAAO,IAAI,KAAI,GAAG;AAAA,IAAC;AACtL,QAAI,YAAU,KAAK,IAAI,IAAI,WAAU,EAAE,SAAS;AAAE,WAAO;AAAA,EAC3D;AAAA,EACA,MAAc,IAAIE,UAAgB,QAAW,cAAqB,MAAI;AAAA,EAAC,GAAE;AACvE,UAAM,OAAK,KAAK,OAAQ,YAAUA,WAAQ,aAAW;AACrD,WAAO,IAAI,QAAa,CAACC,UAAQ,WAAS;AACxC,YAAM,UAAQ,KAAK,QAAQ,WAAS,IAAI,kBAAkB,gBAAgB,IAAI,EAAE,GAAE,SAAgB,CAAC;AACnG,UAAI,QAAM,GAAE,OAAK,OAAM,UAAQ;AAC/B,YAAM,SAAO,CAAC,OAAU,MAAS;AAAC,YAAG,QAAQ;AAAO,kBAAQ;AAAK,qBAAa,KAAK;AAAE,eAAO,QAAQ;AAAE,YAAG,EAAE,QAAO,CAAC;AAAA,YAAO,CAAAA,SAAQ,KAAK;AAAA,MAAC;AACxI,YAAM,QAAM,WAAW,MAAI,OAAO,MAAK,MAAM,OAAK,oBAAkB,uBAAsB,CAACD,YAAS,IAAI,CAAC,GAAE,KAAK,QAAQ,aAAW,GAAK;AACxI,aAAO,KAAK,WAAU,MAAI;AAAC,YAAG;AAAC,sBAAY;AAAE,iBAAK;AAAK,iBAAO,MAAM,KAAK,UAAU,EAAC,GAAG,QAAO,iBAAgB,EAAC,CAAC,IAAE,IAAI;AAAA,QAAC,SAAO,GAAE;AAAC,iBAAO,MAAK,CAAC;AAAA,QAAC;AAAA,MAAC,CAAC;AACjJ,aAAO,GAAG,QAAO,WAAO;AACtB,cAAM,OAAK,OAAO,SAAS,KAAK,IAAE,QAAM,OAAO,KAAK,KAAK;AAAE,iBAAO,KAAK;AACvE,YAAG,QAAM,MAAS;AAAC,iBAAO,MAAK,MAAM,mBAAkB,CAACA,YAAS,IAAI,CAAC;AAAE;AAAA,QAAM;AAC9E,eAAO,KAAK,IAAI;AAChB,YAAG,KAAK,SAAS,EAAE,EAAE,KAAG;AAAC,gBAAM,MAAI,OAAO,OAAO,MAAM,GAAE,MAAI,IAAI,QAAQ,EAAE;AAAE,cAAG,IAAI,SAAS,MAAI,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,EAAE,OAAM,MAAM;AAAE,iBAAO,KAAK,MAAM,IAAI,SAAS,GAAE,GAAG,EAAE,SAAS,MAAM,CAAC,CAAC;AAAA,QAAC,QAAM;AAAC,iBAAO,MAAK,MAAM,mBAAkB,CAACA,YAAS,IAAI,CAAC;AAAA,QAAC;AAAA,MAC/P,CAAC;AACD,aAAO,KAAK,SAAQ,MAAI,OAAO,MAAK,MAAM,OAAK,oBAAkB,uBAAsB,CAACA,YAAS,IAAI,CAAC,CAAC;AACvG,aAAO,KAAK,SAAQ,MAAI,OAAO,MAAK,MAAM,OAAK,oBAAkB,uBAAsB,CAACA,YAAS,IAAI,CAAC,CAAC;AAAA,IACzG,CAAC;AAAA,EACH;AAAA,EACQ,cAAc,QAAW,kBAAgB,OAAM;AAAC,QAAG,QAAQ,oBAAkB,EAAE,OAAM,MAAM,gCAA+B,eAAe;AAAE,WAAO;AAAA,EAAM;AAAA,EAChK,MAAc,KAAK,KAAU,QAAM,OAAuB;AACxD,QAAI,UAAQ;AACZ,QAAG,CAAC,IAAI,UAAQ,CAAC,IAAI,MAAM,QAAO,CAAC,IAAI;AACvC,QAAG,IAAI,QAAM,OAAM;AAAC,YAAM,WAAS,IAAI,MAAK,UAAQ,MAAM;AAAS,UAAG,WAAS,IAAI,gBAAc,EAAE,QAAO;AAAQ,UAAG,IAAI,SAAO,SAAS,KAAI,OAAK;AAAA,IAAS;AAC3J,QAAG,CAAC,IAAI,MAAK;AAAC,UAAI;AAAe,UAAI,QAAM,YAAS;AAClD,YAAG;AACD,gBAAM,SAAO,KAAK,cAAc,MAAM,KAAK,IAAI,MAAK,EAAC,OAAM,IAAI,OAAM,MAAK,UAAS,OAAM,IAAI,KAAI,kBAAiB,IAAI,OAAM,CAAC,CAAC;AAC9H,gBAAM,UAAQ,OAAO,OAAK,QAAM,OAAO,QAAQ,qBAAmB,IAAI,UAAQ,OAAO,QAAQ,kBAAgB;AAC7G,cAAG,SAAQ;AAAC,gBAAI,YAAU;AAAE,gBAAI,SAAO;AAAA,UAAC;AAAC,iBAAO;AAAA,QAClD,QAAM;AAAC,iBAAO;AAAA,QAAK;AAAA,MACrB,GAAG;AAAA,IAAC;AACJ,WAAO,IAAI;AAAA,EACb;AAAA,EACA,MAAM,OAAO,GAAU;AAAC,UAAM,MAAI,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC;AAAE,WAAO,EAAC,eAAc,MAAI,MAAM,KAAK,KAAK,KAAI,IAAI,IAAE,KAAI;AAAA,EAAC;AAAA,EACxH,MAAM,IAAI,MAAYE,OAAS,GAAU,UAAsB;AAC7D,QAAG,QAAQ,aAAW,WAAS,CAAC,KAAK,QAAQ,WAAS,CAAC,KAAK,OAAO,MAAK,uBAAsB,GAAG;AACjG,QAAG,CAAC,mCAAmC,KAAK,KAAK,OAAO,QAAQ,EAAE,MAAK,uBAAsB,GAAG;AAChG,UAAM,MAAI,KAAK,MAAM,CAAC,GAAE,SAAO,YAAY,IAAI,CAAC,KAAK,QAAQ,QAAO,GAAI,WAAS,CAAC,QAAQ,IAAE,CAAC,CAAE,CAAC;AAIhG,QAAG,SAAO,wBAAsB,IAAI,WAAS,CAAC,KAAK,QAAQ,OAAO,SAAQ;AAAC,UAAI,UAAQ;AAAM,UAAI,OAAK;AAAU,UAAI,eAAa;AAAA,IAAC;AAClI,UAAM,QAAM,MAAI;AAAC,UAAG,OAAO,WAAS,IAAI,QAAQ,OAAM,MAAM,qBAAoB,OAAM,IAAI;AAAE,UAAG,CAAC,OAAO,cAAc,EAAE,SAAS,KAAG,EAAE,aAAW,KAAK,IAAI,EAAE,OAAM,MAAM,eAAe;AAAE,WAAK,QAAQ,WAAW,CAAC;AAAA,IAAC;AAClN,UAAM,QAAM,YAAS;AACnB,UAAI,OAAK,OAAM,aAAW;AAC1B,YAAM,QAAM,MAAI;AAAC,aAAK,KAAK,KAAK,GAAG;AAAA,MAAC;AAAE,aAAO,iBAAiB,SAAQ,OAAM,EAAC,MAAK,KAAI,CAAC;AAAE,UAAI;AAC7F,UAAG;AACD,cAAM;AAAE,cAAM,SAAO,MAAMC,UAAS,KAAK,OAAQ,YAAW,MAAM,GAAG,KAAK;AAAE,cAAM;AAClF,cAAM,QAAM,KAAK,cAAc,MAAM,KAAK,IAAI,MAAK,EAAC,OAAM,MAAK,QAAO,CAAC,CAAC;AACxE,YAAG,CAAC,MAAM,GAAG,OAAM,MAAM,MAAM,QAAM,qBAAqB;AAC1D,YAAG,MAAM,QAAQ,oBAAkB,KAAG,CAAC,iBAAiB,KAAK,MAAM,QAAQ,oBAAkB,EAAE,EAAE,OAAM,MAAM,8BAA8B;AAC3I,cAAM;AAAE,YAAI,SAAO,MAAM,OAAO;AAAiB,YAAI,QAAM;AAC3D,cAAM,WAAS,KAAK,cAAc,MAAM,KAAK,IAAI,OAAM,EAAC,OAAM,MAAK,MAAAD,OAAK,OAAM,IAAI,KAAI,WAAU,EAAE,WAAU,kBAAiB,IAAI,OAAM,GAAE,MAAI;AAAC,gBAAM;AAAE,iBAAK;AAAK,cAAI;AAAA,QAAW,CAAC,GAAE,IAAI;AAGtL,YAAI,YAAU,KAAK,IAAI,GAAE,IAAI,YAAU,CAAC;AACxC,YAAI,SAAO,KAAK,IAAI;AACpB,qBAAW,SAAS,WAAS;AAC7B,YAAG,OAAO,WAAS,IAAI,QAAQ,OAAM,MAAM,qBAAoB,QAAM,CAAC,UAAU;AAChF,aAAK,QAAQ,WAAW,CAAC;AACzB,YAAG,CAAC,SAAS,GAAG,OAAM,MAAM,SAAS,QAAM,uBAAsB,SAAS,WAAS,oBAAmB,SAAS,kBAAgB,IAAI;AACnI,YAAI,SAAO,KAAK,IAAI;AAAE,eAAO,SAAS;AAAA,MACxC,SAAO,GAAM;AACX,YAAG,EAAE,SAAO,gBAAgB,KAAI,UAAQ;AACxC,YAAG,OAAO,WAAS,IAAI,SAAQ;AAAC,gBAAM,UAAQ,MAAM,KAAK,KAAK,KAAI,IAAI;AAAE,gBAAM,MAAM,UAAQ,sBAAoB,mBAAkB,QAAM,CAAC,YAAW,OAAO;AAAA,QAAC;AAC5J,YAAG,CAAC,KAAK,GAAE,gBAAc;AACzB,cAAM;AAAA,MACR,UAAC;AAAQ,YAAI;AAAS,eAAO,oBAAoB,SAAQ,KAAK;AAAA,MAAC;AAAA,IACjE,GAAG;AACH,SAAK,OAAO,IAAI,IAAI;AACpB,QAAG;AAAC,aAAO,MAAM;AAAA,IAAI,UAAC;AAAQ,WAAK,OAAO,OAAO,IAAI;AAAA,IAAC;AAAA,EACxD;AAAA,EACA,MAAM,QAAO;AACX,SAAK,QAAQ,MAAM,MAAM,sBAAsB,CAAC;AAChD,UAAM,WAAS,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,OAAO,SAAK,IAAI,UAAQ,IAAI,aAAW,IAAI,SAAO,OAAM,KAAK,IAAI,CAAC;AAC3G,UAAM,UAAQ,MAAM,QAAQ,IAAI,SAAS,IAAI,SAAK,KAAK,KAAK,KAAI,IAAI,CAAC,CAAC;AACtE,UAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,MAAM,CAAC;AAAE,WAAO,EAAC,eAAc,QAAQ,MAAM,OAAO,EAAC;AAAA,EACzF;AACF;;;ACjGA,OAAOE,UAAS;AAChB,SAAQ,YAAAC,iBAAe;AACvB,SAAQ,oBAAmB;AAC3B,SAAQ,cAAAC,mBAAiB;AAczB,IAAM,aAAW,CAAC,iBAAgB,gBAAe,eAAc,gBAAgB;AAC/E,IAAM,UAAQ,MAAI,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,eAAc,MAAK,CAAC;AAIhH,IAAM,aAAW,CAAC,UAAY;AAAC,MAAG,UAAQ,gBAAgB,QAAO;AAAM,MAAG,OAAO,UAAQ,SAAS,MAAK,gBAAgB;AAAE,MAAG;AAAC,UAAM,MAAI,IAAI,IAAI,KAAK;AAAE,QAAG,CAAC,CAAC,SAAQ,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAG,IAAI,WAAS,MAAM,MAAK,gBAAgB;AAAE,WAAO;AAAA,EAAK,QAAM;AAAC,SAAK,gBAAgB;AAAA,EAAC;AAAC;AACzR,IAAM,gBAAc,CAAC,MAAY,UAAU,EAAC,QAAO,EAAE,UAAS,KAAI,EAAE,OAAM,MAAK,EAAE,QAAO,SAAQ,EAAE,WAAU,UAAS,EAAE,UAAS,OAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAC,CAAC;AAGnJ,IAAM,oBAAN,MAAM,2BAA0B,aAA6C;AAAA,EAClF;AAAA,EAAqB;AAAA,EAA0B;AAAA,EAA0B,SAAO,OAAO,MAAM,CAAC;AAAA,EAAU,SAAO;AAAA,EAAU,QAAM;AAAA,EAAc,gBAAc;AAAA,EACnJ,UAAQ,oBAAI,IAA6F;AAAA,EACzG,UAAQ,QAAQ,cAAmB;AAAA,EAAU;AAAA,EAAgD;AAAA,EAC7F,YAAY,QAAc,SAAY,OAAa;AACzD,UAAM;AAAE,SAAK,SAAOC,KAAI,iBAAiB,gBAAgB,OAAO,QAAQ,SAAS;AACjF,SAAK,YAAU,WAAW,MAAI,KAAK,OAAO,IAAI,WAAW,uBAAsB,GAAG,CAAC,GAAE,GAAI;AACzF,SAAK,OAAO,KAAK,WAAU,MAAI,KAAK,MAAM,EAAC,GAAG,SAAQ,eAAc,GAAE,MAAK,CAAC,CAAC;AAC7E,SAAK,OAAO,GAAG,QAAO,WAAO;AAAC,UAAG;AAAC,aAAK,QAAQ,KAAK;AAAA,MAAC,QAAM;AAAC,aAAK,OAAO,QAAQ,CAAC;AAAA,MAAC;AAAA,IAAC,CAAC;AACpF,SAAK,OAAO,KAAK,SAAQ,MAAI,KAAK,OAAO,IAAI,WAAW,KAAK,WAAS,oBAAkB,uBAAsB,GAAG,CAAC,CAAC;AACnH,SAAK,OAAO,KAAK,SAAQ,MAAI,KAAK,OAAO,QAAQ,CAAC,CAAC;AAAA,EACrD;AAAA,EACA,aAAa,KAAK,QAAc,SAAY;AAC1C,QAAG,QAAQ,aAAW,WAAS,CAAC,mCAAmC,KAAK,OAAO,QAAQ,EAAE,MAAK,uBAAsB,GAAG;AACvH,UAAM,SAAO,MAAMC,UAAS,OAAO,YAAW,MAAM,GAAG,KAAK,GAAE,OAAK,IAAI,mBAAkB,QAAO,SAAQ,KAAK;AAC7G,UAAM,KAAK,QAAQ;AAAQ,WAAO;AAAA,EACpC;AAAA,EACQ,MAAM,OAAU;AAAC,QAAG,KAAK,MAAM,OAAM,QAAQ;AAAE,UAAM,OAAK,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC;AAAE,QAAG,KAAK,SAAO,MAAM,MAAK,aAAa;AAAE,UAAM,SAAO,OAAO,YAAY,KAAK,SAAO,CAAC;AAAE,WAAO,cAAc,KAAK,SAAO,CAAC;AAAE,WAAO,CAAC,IAAE;AAAG,SAAK,KAAK,QAAO,CAAC;AAAE,SAAK,OAAO,MAAM,MAAM;AAAA,EAAC;AAAA,EACnR,QAAQ,OAAa;AAC3B,SAAK,SAAO,OAAO,OAAO,CAAC,KAAK,QAAO,KAAK,CAAC;AAAE,QAAG,KAAK,OAAO,SAAO,UAAQ,MAAM,OAAM,QAAQ;AACjG,WAAM,KAAK,OAAO,UAAQ,GAAE;AAC1B,YAAM,SAAO,KAAK,OAAO,aAAa,CAAC;AAAE,UAAG,SAAO,KAAG,SAAO,QAAQ,OAAM,QAAQ;AAAE,UAAG,KAAK,OAAO,SAAO,SAAO,EAAE;AACpH,YAAM,MAAI,KAAK,OAAO,CAAC,GAAE,OAAK,KAAK,OAAO,SAAS,GAAE,SAAO,CAAC;AAAE,WAAK,SAAO,KAAK,OAAO,SAAS,SAAO,CAAC;AACxG,UAAG,QAAM,IAAG;AAAC,YAAG,CAAC,KAAK,SAAS,OAAM,QAAQ;AAAE,aAAK,KAAK,SAAQ,MAAK,KAAK,aAAa;AAAE;AAAA,MAAQ;AAClG,UAAG,QAAM,MAAI,KAAK,SAAO,MAAM,OAAM,QAAQ;AAAE,YAAM,QAAM,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC;AAC3F,UAAG,MAAM,MAAI,UAAS;AACpB,YAAG,KAAK,SAAS,OAAM,QAAQ;AAAE,YAAG,MAAM,OAAK,MAAK;AAAC,eAAK,OAAO,IAAI,WAAW,MAAM,QAAM,uBAAsB,GAAG,CAAC;AAAE;AAAA,QAAM;AAC9H,YAAG,MAAM,kBAAgB,KAAG,CAAC,OAAO,cAAc,MAAM,KAAK,KAAG,MAAM,QAAM,KAAG,CAAC,OAAO,cAAc,MAAM,MAAM,KAAG,MAAM,SAAO,KAAG,CAAC,MAAM,QAAQ,MAAM,QAAQ,KAAG,OAAO,MAAM,cAAY,SAAS,OAAM,QAAQ;AACpN,aAAK,WAAS;AAAM,qBAAa,KAAK,SAAS;AAAE,aAAK,QAAQ,QAAQ,KAAK;AAAA,MAC7E,WAAS,MAAM,MAAI,cAAa;AAAC,aAAK,gBAAc;AAAA,MAAK,WACjD,MAAM,MAAI,OAAM;AACtB,cAAM,UAAQ,KAAK,QAAQ,IAAI,MAAM,EAAE;AAAE,YAAG,CAAC,QAAQ;AAAS,qBAAa,QAAQ,KAAK;AAAE,aAAK,QAAQ,OAAO,MAAM,EAAE;AAAE,gBAAQ,QAAQ,KAAK;AAAA,MAC/I,WAAS,MAAM,MAAI,SAAQ;AAAC,aAAK,gBAAc,MAAM,kBAAgB;AAAK,aAAK,KAAK,SAAQ,EAAC,MAAK,MAAM,QAAM,mBAAkB,eAAc,KAAK,cAAa,CAAC;AAAA,MAAC,MAC7J,OAAM,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA,EACQ,OAAOC,QAAU;AACvB,QAAG,KAAK,MAAM;AAAO,SAAK,QAAM;AAAK,iBAAa,KAAK,SAAS;AAAE,SAAK,OAAO,QAAQ;AAAE,SAAK,SAAO,OAAO,MAAM,CAAC;AAAE,SAAK,QAAQ,OAAOA,MAAK;AAC7I,eAAU,OAAO,KAAK,QAAQ,OAAO,GAAE;AAAC,mBAAa,IAAI,KAAK;AAAE,UAAI,OAAO,QAAQ,CAAC;AAAA,IAAC;AAAC,SAAK,QAAQ,MAAM;AAAE,SAAK,KAAK,SAAQ,EAAC,MAAKA,QAAO,QAAM,wBAAuB,eAAc,KAAK,cAAa,CAAC;AAAA,EAC1M;AAAA,EACA,QAAQ,SAAyB;AAC/B,QAAG,KAAK,MAAM,QAAO,QAAQ,OAAO,QAAQ,CAAC;AAAE,QAAG,KAAK,QAAQ,QAAM,GAAG,QAAO,QAAQ,OAAO,IAAI,WAAW,uBAAsB,GAAG,CAAC;AACvI,UAAMC,MAAG,EAAE,KAAK;AAChB,WAAO,IAAI,QAAQ,CAACC,UAAQ,WAAS;AAAC,YAAM,QAAM,WAAW,MAAI;AAAC,aAAK,QAAQ,OAAOD,GAAE;AAAE,eAAO,QAAQ,CAAC;AAAE,aAAK,OAAO,QAAQ,CAAC;AAAA,MAAC,GAAE,IAAI;AAAE,WAAK,QAAQ,IAAIA,KAAG,EAAC,SAAAC,UAAQ,QAAO,MAAK,CAAC;AAAE,UAAG;AAAC,aAAK,MAAM,EAAC,GAAG,SAAQ,IAAAD,IAAE,CAAC;AAAA,MAAC,SAAO,GAAE;AAAC,qBAAa,KAAK;AAAE,aAAK,QAAQ,OAAOA,GAAE;AAAE,eAAO,CAAC;AAAA,MAAC;AAAA,IAAC,CAAC;AAAA,EACxR;AAAA,EACA,MAAM,WAAS,OAAM;AAAC,QAAG;AAAC,WAAK,MAAM,EAAC,GAAE,SAAQ,GAAI,WAAS,EAAC,UAAS,KAAI,IAAE,CAAC,EAAE,CAAC;AAAA,IAAC,QAAM;AAAC,WAAK,OAAO,QAAQ,CAAC;AAAA,IAAC;AAAA,EAAC;AAAA,EAChH,QAAO;AACL,QAAG,CAAC,KAAK,SAAS,MAAK,YAAU,YAAS;AAAC,UAAG,KAAK,MAAM,QAAO,EAAC,eAAc,KAAK,cAAa;AAAE,UAAG;AAAC,cAAM,MAAI,MAAM,KAAK,QAAQ,EAAC,GAAE,QAAO,CAAC;AAAE,aAAK,gBAAc,IAAI,OAAK,QAAM,IAAI,kBAAgB;AAAK,eAAO,EAAC,eAAc,KAAK,cAAa;AAAA,MAAC,QAAM;AAAC,eAAO,EAAC,eAAc,KAAK,cAAa;AAAA,MAAC,UAAC;AAAQ,aAAK,OAAO,QAAQ,CAAC;AAAA,MAAC;AAAA,IAAC,GAAG;AACxU,WAAO,KAAK;AAAA,EACd;AACF;AAGA,IAAM,gBAAc,CAAC,EAAC,cAAa,KAAI,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,GAAE,EAAC,cAAa,IAAG,SAAQ,GAAE,CAAC;AAG5L,IAAM,kBAAN,MAAsB;AAAA,EAI3B,YAAoB,QAAgC,WAA4B,UAA8B,CAAC,GAAE;AAA7F;AAAgC;AAA4B;AAAkC,SAAK,QAAM,YAAY,MAAI,KAAK,KAAK,MAAM,GAAE,QAAQ,WAAS,GAAG;AAAE,SAAK,MAAM,MAAM;AAAA,EAAC;AAAA,EAAnL;AAAA,EAAgC;AAAA,EAA4B;AAAA,EAHxE,iBAAe,oBAAI,IAAa;AAAA,EAChC,UAAQ,oBAAI,QAA+D;AAAA,EAC3E,WAAS,oBAAI,IAAoB;AAAA,EAAU,QAAME,YAAW;AAAA,EAAU,UAAQ;AAAA,EAAc;AAAA,EAA6C,UAAQ,oBAAI,IAAe;AAAA,EAAU,UAAQ;AAAA,EAEtL,MAAM,GAAU;AAAC,QAAG,KAAK,QAAQ,MAAK,wBAAuB,GAAG;AAAE,SAAK,UAAU,SAAS,CAAC;AAAE,QAAG,CAAC,EAAE,MAAM,SAAS,oBAAoB,EAAE,MAAK,gBAAe,GAAG;AAAE,QAAG,CAAC,OAAO,cAAc,EAAE,SAAS,KAAG,EAAE,aAAW,KAAK,IAAI,EAAE,MAAK,iBAAgB,GAAG;AAAA,EAAC;AAAA,EACzP,MAAM,KAAY,MAAY,QAAU,CAAC,GAAE;AAAC,QAAI,OAAO,KAAK,EAAC,IAAG,KAAK,IAAI,GAAE,MAAK,WAAU,IAAI,IAAG,QAAO,IAAI,QAAQ,QAAO,WAAU,IAAI,QAAQ,WAAU,GAAG,MAAK,CAAC;AAAE,QAAG,IAAI,OAAO,SAAO,IAAI,KAAI,OAAO,MAAM;AAAE,QAAG,CAAC,CAAC,SAAQ,YAAY,EAAE,SAAS,IAAI,EAAE,MAAK,UAAU,QAAQ,mBAAmB,KAAK,YAAY,EAAE,WAAW,KAAI,GAAG,CAAC,IAAG,IAAI,QAAQ,OAAM,GAAG,IAAI,QAAQ,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,IAAI,EAAE,EAAE;AAAA,EAAC;AAAA,EAC5Z,OAAO,KAAY;AAAC,WAAO,EAAC,WAAU,IAAI,IAAG,OAAM,IAAI,OAAM,WAAU,IAAI,QAAQ,WAAU,MAAK,sBAAqB,WAAU,IAAI,OAAO,SAAS,WAAU,UAAS,IAAI,OAAO,SAAS,UAAS,OAAM,IAAI,OAAO,SAAS,OAAM,QAAO,IAAI,OAAO,SAAS,QAAO,MAAK,IAAI,MAAK,gBAAe,IAAI,eAAc;AAAA,EAAC;AAAA,EACvT,IAAI,GAAUF,KAAO;AAAC,SAAK,MAAM,CAAC;AAAE,UAAM,MAAI,KAAK,SAAS,IAAIA,GAAE;AAAE,QAAG,CAAC,IAAI,MAAK,6BAA4B,GAAG;AAAE,QAAG,cAAc,CAAC,MAAI,cAAc,IAAI,OAAO,EAAE,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EAC9M,MAAM,KAAK,GAAU,SAAY;AAC/B,SAAK,MAAM,CAAC;AAAE,QAAG,CAAC,KAAK,OAAO,MAAK,uBAAsB,GAAG;AAC5D,QAAG,CAAC,WAAS,OAAO,YAAU,YAAU,MAAM,QAAQ,OAAO,KAAG,OAAO,KAAK,OAAO,EAAE,KAAK,OAAG,CAAC,CAAC,QAAO,OAAM,aAAY,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,MAAK,kBAAkB;AACtK,UAAM,OAAK,QAAQ,QAAM;AAAQ,QAAG,CAAC,CAAC,SAAQ,SAAS,EAAE,SAAS,IAAI,EAAE,MAAK,kBAAkB;AAAE,UAAM,MAAI,QAAQ,QAAQ,KAAI,GAAE,IAAG,EAAE;AACtI,QAAG,QAAQ,cAAY,WAAY,OAAO,QAAQ,cAAY,YAAU,QAAQ,UAAU,SAAO,KAAK,MAAK,kBAAkB;AAC7H,UAAM,SAAO,QAAQ,WAAS,SAAU,SAAU,WAAW,QAAQ,MAAM,GAAE,iBAAe,WAAW,MAAM,UAAM,EAAE,MAAM,SAAS,IAAI,CAAC;AACzI,QAAG,SAAO,aAAW,CAAC,eAAe,MAAK,gBAAe,GAAG;AAC5D,UAAM,KAAK,MAAM;AAAE,QAAG,KAAK,UAAQ,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,OAAO,OAAG,CAAC,EAAE,MAAM,EAAE,UAAQ,KAAG,KAAK,SAAS,QAAM,IAAI,MAAK,yBAAwB,GAAG;AACvJ,UAAMA,MAAG,WAAWE,YAAW,CAAC,IAAG,QAAM,OAAO;AAChD,SAAK;AAAU,QAAI;AACnB,QAAG;AAAC,eAAO,OAAO,KAAK,QAAQ,iBAAe,kBAAkB,MAAM,KAAK,QAAO,EAAC,OAAM,IAAI,UAAU,EAAC,OAAM,KAAK,OAAM,SAAQF,KAAG,UAAS,cAAc,CAAC,EAAC,CAAC,CAAC,GAAE,WAAU,EAAE,WAAU,KAAI,gBAAe,GAAI,QAAQ,YAAU,EAAC,WAAU,QAAQ,UAAS,IAAE,CAAC,EAAE,CAAC;AAAA,IAAC,UAAC;AAAQ,WAAK;AAAA,IAAS;AAC1R,QAAG;AAAC,WAAK,MAAM,CAAC;AAAA,IAAC,SAAO,GAAE;AAAC,YAAM,OAAO,MAAM;AAAE,YAAM;AAAA,IAAC;AACvD,UAAM,MAAY,EAAC,IAAAA,KAAG,OAAM,QAAO,IAAI,KAAK,GAAE,SAAQ,gBAAgB,CAAC,GAAE,QAAO,QAAO,MAAK,SAAQ,kBAAiB,SAAO,WAAU,gBAAe,MAAK,OAAM,QAAO,OAAM,SAAQ,OAAM,OAAM,QAAQ,QAAQ,GAAE,QAAO,GAAE,UAAS,OAAM,SAAQ,OAAM,aAAY,GAAE,QAAO,CAAC,GAAE,KAAI,SAAQ,GAAE,gBAAe,GAAE,YAAW,GAAE,aAAY,GAAE,aAAY,GAAE,eAAc,GAAE,gBAAe,MAAK;AAC7X,SAAK,SAAS,IAAIA,KAAG,GAAG;AAAE,WAAO,GAAG,SAAQ,CAAC,MAAK,aAAW;AAAC,UAAI,iBAAe;AAAM,WAAK,MAAM,KAAI,MAAK,QAAQ;AAAA,IAAC,CAAC;AAAE,WAAO,GAAG,SAAQ,WAAO;AAAC,UAAI,UAAQ,MAAM,kBAAgB;AAAK,UAAG,CAAC,IAAI,QAAO;AAAC,YAAI,SAAO;AAAK,YAAI,WAAS,KAAK,IAAI;AAAE,qBAAa,IAAI,UAAU;AAAE,qBAAa,IAAI,QAAQ;AAAE,YAAI,eAAa;AAAU,aAAK,KAAK,KAAI,EAAC,MAAK,UAAS,QAAO,gBAAe,MAAK,SAAQ,MAAK,MAAM,MAAK,eAAc,IAAI,QAAO,CAAC;AAAE,YAAI,QAAQ,MAAM,KAAK,uBAAuB;AAAE,aAAK,MAAM,KAAI,SAAQ,EAAC,MAAK,MAAM,MAAK,eAAc,IAAI,QAAO,CAAC;AAAA,MAAC;AAAA,IAAC,CAAC;AACpiB,SAAK,MAAM,KAAI,QAAQ;AAAE,WAAO,KAAK,OAAO,GAAG;AAAA,EACjD;AAAA,EACA,MAAM,MAAM,GAAU,SAAY;AAChC,UAAM,MAAI,KAAK,IAAI,GAAE,SAAS,SAAS;AAAE,QAAG,IAAI,OAAO,MAAK,0BAAyB,GAAG;AACxF,QAAG,QAAQ,WAAS,UAAW,WAAW,QAAQ,MAAM,MAAI,IAAI,OAAO,MAAK,iBAAgB,GAAG;AAC/F,QAAG,CAAC,IAAI,QAAQ,MAAM,MAAM,UAAM,EAAE,MAAM,SAAS,IAAI,CAAC,EAAE,MAAK,gBAAe,GAAG;AACjF,QAAG,IAAI,SAAS,MAAK,yBAAwB,GAAG;AAAE,QAAI,WAAS;AAC/D,QAAG;AAAC,WAAK,MAAM,CAAC;AAAE,YAAM,MAAI,MAAM,IAAI,OAAO,QAAQ,EAAC,GAAE,SAAQ,WAAU,EAAE,UAAS,CAAC;AAAE,UAAG,IAAI,OAAK,KAAK,MAAK,IAAI,QAAM,wBAAuB,GAAG;AAAE,WAAK,MAAM,CAAC;AAAE,UAAG,IAAI,OAAO,MAAK,0BAAyB,GAAG;AAAE,UAAI,UAAQ,gBAAgB,CAAC;AAAE,WAAK,MAAM,KAAI,SAAS;AAAE,aAAO,KAAK,OAAO,GAAG;AAAA,IAAC,SAAO,GAAE;AAAC,YAAM,KAAK,KAAK,KAAI,sBAAsB;AAAE,YAAM;AAAA,IAAC,UAAC;AAAQ,UAAI,WAAS;AAAA,IAAK;AAAA,EAC7X;AAAA,EACA,MAAM,aAAa,GAAU,SAAY;AAAC,UAAM,MAAI,KAAK,IAAI,GAAE,SAAS,SAAS;AAAE,WAAO,KAAK,KAAK,KAAI,gBAAgB;AAAA,EAAC;AAAA,EACzH,UAAU,QAAc;AAAC,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,KAAK,SAAK,CAAC,IAAI,UAAQ,IAAI,WAAS,UAAQ,IAAI,QAAQ,YAAU,KAAK,IAAI,CAAC;AAAA,EAAC;AAAA,EACjI,KAAK,KAAY,SAAY;AAAC,QAAG,IAAI,QAAQ,eAAa,EAAE,KAAI,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC;AAAA,EAAC;AAAA,EACpG,UAAU,KAAY,QAAM,GAAE;AAAC,QAAG,IAAI,UAAQ,IAAI,kBAAgB,IAAI,gBAAc,CAAC,IAAI,UAAQ,IAAI,OAAO,eAAa,EAAE;AAAO,iBAAa,IAAI,UAAU;AAAE,QAAI,iBAAe;AAAK,QAAI,aAAW,WAAW,MAAI,MAAM,YAAS;AAAC,UAAG,IAAI,OAAO;AAAO,WAAK,MAAM,IAAI,OAAO;AAAE,UAAG,IAAI,YAAU,IAAI,gBAAe;AAAC,cAAM,MAAI,MAAM,IAAI,OAAO,QAAQ,EAAC,GAAE,SAAQ,GAAG,cAAc,IAAI,OAAO,EAAC,CAAC;AAAE,YAAG,CAAC,IAAI,GAAG,OAAM,IAAI,WAAW,IAAI,QAAM,sBAAsB;AAAE,YAAI,iBAAe,IAAI;AAAA,MAAO;AAAC,UAAG,CAAC,IAAI,OAAO,KAAI,OAAO,MAAM,KAAK,eAAe,OAAO,GAAG,CAAC;AAAA,IAAC,GAAG,EAAE,MAAM,MAAI,KAAK,KAAK,KAAI,sBAAsB,CAAC,GAAE,KAAK;AAAE,QAAI,WAAW,MAAM;AAAA,EAAC;AAAA,EACznB,UAAU,KAAY,WAAS,OAAM,WAAS,IAAI,eAAc;AACtE,QAAG,IAAI,UAAQ,IAAI,QAAQ,eAAa,EAAE;AAC1C,UAAM,MAAI,WAAS,aAAW,SAAS,QAAQ;AAC/C,QAAG,UAAS;AAAC,UAAI,UAAQ;AAAI,UAAI,cAAY,YAAY,IAAI;AAAA,IAAC;AAC9D,iBAAa,IAAI,QAAQ;AAAE,QAAI,WAAS,WAAW,MAAI,KAAK,KAAK,KAAK,KAAI,2BAA2B,GAAE,IAAK;AAAE,QAAI,SAAS,MAAM;AACjI,QAAI,OAAO,KAAK,KAAI,QAAU,CAAAD,WAAO;AAAC,UAAGA,OAAM,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,IAAC,CAAC;AAAA,EAC5F;AAAA,EACQ,MAAM,KAAY,MAAY,UAAc;AAClD,QAAG,IAAI,UAAQ,CAAC,IAAI,UAAQ,IAAI,OAAO,eAAa,EAAE;AACtD,QAAG;AAAC,WAAK,MAAM,IAAI,OAAO;AAAA,IAAC,QAAM;AAAC,WAAK,KAAK,KAAK,KAAI,eAAe;AAAE;AAAA,IAAM;AAC5E,UAAM,SAAO,IAAI;AACjB,QAAG,CAAC,OAAO,SAAS,IAAI,KAAG,KAAK,SAAO,SAAQ;AAAC,WAAK,KAAK,KAAK,KAAI,eAAe;AAAE;AAAA,IAAM;AAC1F,UAAM,UAAQ,KAAK,QAAQ,IAAI,GAAG,KAAG,oBAAI,IAAI;AAAE,SAAK,QAAQ,IAAI,KAAI,OAAO;AAG3E,UAAM,QAAM,UAAU,UAAQ,SAAS,OAAO,QAAM,SAAS,OAAO,UAAQ,IAAI,OAAO,SAAS,QAAM,IAAI,OAAO,SAAS,SAAO,QAAK,KAAK,UAAQ;AACnJ,QAAG,QAAQ,SAAO,QAAM,IAAE,IAAG;AAAC,UAAG,IAAI,cAAa;AAAC,aAAK,MAAM,KAAI,YAAY;AAAE,aAAK,eAAe,IAAI,GAAG;AAAA,MAAC;AAAC,UAAI,eAAa,EAAC,MAAK,SAAQ;AAAE;AAAA,IAAM;AACpJ,QAAG,OAAO,kBAAgB,KAAK,QAAQ,qBAAmB,SAAQ;AAAC,WAAK,MAAM,KAAI,YAAY;AAAE,WAAK,eAAe,IAAI,GAAG;AAAE,WAAK,UAAU,KAAI,GAAG;AAAE;AAAA,IAAM;AAC3J,QAAI,UAAQ;AAAK,QAAI,cAAY,YAAY,IAAI;AAAE,QAAI;AACvD,YAAQ,IAAI,SAAS,IAAI,aAAa,IAAG,EAAC,SAAQ,IAAI,aAAY,UAAS,UAAU,aAAW,KAAI,CAAC;AACrG,SAAK,KAAK,KAAI,EAAC,MAAK,SAAQ,OAAM,IAAI,OAAO,SAAS,OAAM,QAAO,IAAI,OAAO,SAAS,QAAO,YAAW,UAAU,cAAY,IAAI,OAAO,SAAS,OAAM,aAAY,UAAU,eAAa,IAAI,OAAO,SAAS,QAAO,GAAI,UAAU,SAAO,EAAC,QAAO,SAAS,QAAO,UAAS,SAAS,aAAW,KAAI,IAAE,CAAC,GAAG,SAAQ,UAAU,WAAS,IAAG,cAAa,UAAU,gBAAc,KAAI,UAAS,IAAI,eAAc,WAAU,UAAU,WAAU,UAAS,UAAU,SAAQ,CAAC;AACvc,UAAM,WAAS,IAAI;AACnB,WAAO,KAAK,MAAK,EAAC,QAAO,KAAI,GAAE,CAAAA,WAAO;AAAC,UAAGA,OAAM,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,WAAM;AAAC,aAAK,UAAU,KAAI,OAAM,QAAQ;AAAE,aAAK,UAAU,GAAG;AAAA,MAAC;AAAA,IAAC,CAAC;AAAA,EAC1J;AAAA,EACQ,QAAQ,KAAY,MAAuB;AACjD,QAAG,IAAI,UAAQ,IAAG;AAAC,WAAK,KAAK,KAAI,EAAC,MAAK,SAAQ,MAAK,sBAAqB,CAAC;AAAE;AAAA,IAAM;AAAC,QAAI;AACvF,QAAI,QAAM,IAAI,MAAM,KAAK,YAAS;AAAC,UAAG,IAAI,OAAO;AAAO,UAAG;AAAC,aAAK,MAAM,IAAI,OAAO;AAAE,cAAM,KAAK;AAAA,MAAC,SAAO,GAAM;AAAC,aAAK,KAAK,KAAI,EAAC,MAAK,SAAQ,MAAK,GAAG,QAAM,yBAAwB,CAAC;AAAE,cAAM,KAAK,KAAK,KAAI,GAAG,QAAM,wBAAwB;AAAA,MAAC;AAAA,IAAC,CAAC,EAAE,QAAQ,MAAI,IAAI,QAAQ;AAAA,EACvQ;AAAA,EACQ,MAAM,OAAU,KAAY;AAClC,QAAG,CAAC,SAAO,OAAO,UAAQ,YAAU,MAAM,QAAQ,KAAK,EAAE,MAAK,kBAAkB;AAChF,QAAG,MAAM,SAAO,WAAU;AACxB,UAAG,CAAC,CAAC,QAAO,QAAO,IAAI,EAAE,SAAS,MAAM,MAAM,KAAG,CAAC,CAAC,QAAO,UAAS,OAAO,EAAE,SAAS,MAAM,UAAQ,MAAM,EAAE,MAAK,kBAAkB;AAClI,aAAO,EAAC,MAAK,WAAU,QAAO,MAAM,QAAO,QAAO,MAAM,UAAQ,QAAO,GAAE,QAAQ,MAAM,GAAE,GAAE,IAAI,OAAO,SAAS,QAAM,CAAC,GAAE,GAAE,QAAQ,MAAM,GAAE,GAAE,IAAI,OAAO,SAAS,SAAO,CAAC,EAAC;AAAA,IAC3K;AACA,QAAG,MAAM,SAAO,OAAM;AAAC,UAAG,CAAC,CAAC,QAAO,IAAI,EAAE,SAAS,MAAM,MAAM,KAAG,OAAO,MAAM,SAAO,YAAU,CAAC,MAAM,QAAM,MAAM,KAAK,SAAO,MAAI,OAAO,MAAM,QAAM,YAAU,MAAM,IAAI,SAAO,GAAG,MAAK,kBAAkB;AAAE,aAAO,EAAC,MAAK,OAAM,QAAO,MAAM,QAAO,MAAK,MAAM,MAAK,KAAI,MAAM,IAAG;AAAA,IAAC;AACjR,QAAG,MAAM,SAAO,QAAQ,QAAO,EAAC,MAAK,SAAQ,QAAO,QAAQ,MAAM,QAAO,OAAM,IAAI,GAAE,QAAO,QAAQ,MAAM,QAAO,OAAM,IAAI,EAAC;AAC5H,QAAG,MAAM,SAAO,QAAO;AAAC,UAAG,OAAO,MAAM,SAAO,YAAU,MAAM,KAAK,SAAO,QAAM,2CAA2C,KAAK,MAAM,IAAI,EAAE,MAAK,aAAa;AAAE,aAAO,EAAC,MAAK,QAAO,MAAK,MAAM,KAAI;AAAA,IAAC;AACrM,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA,EAEA,OAAO,QAAiB,QAAe,iBAAwB,CAAC,GAAE;AAChE,SAAK,QAAQ,IAAI,MAAM;AAAE,QAAI,KAAsB,iBAAe,OAAMI,SAAM;AAC9E,UAAM,YAAU,WAAW,MAAI,OAAO,MAAM,MAAK,iCAAiC,GAAE,KAAK,QAAQ,iBAAe,GAAI;AAAE,cAAU,MAAM;AACtI,UAAM,YAAU,YAAY,MAAI;AAAC,UAAG,CAACA,QAAM;AAAC,eAAO,UAAU;AAAE;AAAA,MAAM;AAAC,MAAAA,SAAM;AAAM,aAAO,KAAK;AAAA,IAAC,GAAE,IAAK;AAAE,cAAU,MAAM;AAAE,WAAO,GAAG,QAAO,UAAM;AAC/I,MAAAA,SAAM;AAAK,UAAG,CAAC,IAAI;AACnB,YAAM,MAAI,KAAK,SAAS,GAAE,WAAS,QAAM,cAAY,IAAI,YAAU;AACnE,YAAM,UAAQ,KAAK,QAAQ,IAAI,GAAG,GAAE,SAAO,SAAS,IAAI,GAAG;AAC3D,UAAG,CAAC,YAAU,CAAC,OAAO;AACtB,mBAAa,IAAI,QAAQ;AAAE,YAAM,UAAQ,YAAY,IAAI,KAAG,WAAS,IAAI,cAAY,OAAQ;AAC7F,UAAG,UAAS;AAAC,YAAI,UAAQ;AAAU,YAAI,cAAY;AAAQ,aAAK,UAAU,GAAG;AAAE;AAAA,MAAM;AACrF,cAAS,OAAO,GAAG;AACnB,UAAI,UAAQ;AAAM,YAAM,SAAO,MAAK,IAAI,KAAI,WAAS,KAAK,IAAI,GAAE,UAAQ,IAAI,WAAW;AACvF,UAAG,CAAC,OAAQ,YAAU,WAAS,SAAO,QAAM,IAAI,UAAQ,cAAc,SAAO,GAAE;AAAC,YAAI,UAAQ,KAAK,IAAI,cAAc,SAAO,GAAE,IAAI,WAAS,WAAS,SAAO,IAAE,IAAE,EAAE;AAAE,YAAI,aAAW;AAAA,MAAC,WACzK,WAAS,SAAO,QAAK,IAAI,UAAQ,KAAG,EAAE,IAAI,cAAY,IAAG;AAAC,YAAI;AAAU,YAAI,aAAW;AAAA,MAAC,WACxF,YAAU,SAAO,KAAI,KAAI,aAAW;AAC5C,UAAG,IAAI,cAAa;AAAC,cAAM,UAAQ,IAAI;AAAa,YAAI,eAAa;AAAU,aAAK,MAAM,KAAI,QAAQ,MAAK,QAAQ,QAAQ;AAAA,MAAC,MAAM,MAAK,UAAU,GAAG;AAAA,IACtJ,CAAC;AACD,UAAM,SAAO,CAAC,SAAc;AAAC,UAAG,OAAO,eAAa,EAAE,QAAO,KAAK,KAAK,UAAU,EAAC,MAAK,SAAQ,KAAI,CAAC,CAAC;AAAE,aAAO,MAAM,MAAK,IAAI;AAAA,IAAC;AAC9H,WAAO,GAAG,WAAU,CAAC,MAAK,aAAW;AACnC,UAAI;AAAY,UAAG;AAAC,YAAG,YAAU,KAAK,SAAO,MAAM,MAAK,kBAAkB;AAAE,kBAAQ,KAAK,MAAM,KAAK,SAAS,CAAC;AAAE,YAAG,CAAC,WAAS,OAAO,YAAU,YAAU,MAAM,QAAQ,OAAO,EAAE,MAAK,kBAAkB;AAAA,MAAC,QAAM;AAAC,eAAO,kBAAkB;AAAE;AAAA,MAAM;AAC/O,UAAG,CAAC,KAAI;AACN,YAAG,gBAAe;AAAC,iBAAO,cAAc;AAAE;AAAA,QAAM;AAChD,YAAG;AACD,gBAAM,YAAU,KAAK,SAAS,IAAI,QAAQ,SAAS;AACnD,cAAG,QAAQ,SAAO,UAAQ,OAAO,QAAQ,UAAQ,YAAU,CAAC,sBAAsB,KAAK,QAAQ,KAAK,KAAG,CAAC,aAAW,CAAC,QAAQ,QAAQ,OAAM,UAAU,MAAM,EAAE,MAAK,gBAAe,GAAG;AACnL,cAAG,UAAU,UAAQ,UAAU,KAAK,MAAK,0BAAyB,GAAG;AACrE,eAAK,MAAM,UAAU,OAAO;AAC5B,cAAG,WAAS,WAAY,UAAU,SAAO,WAAS,UAAU,SAAO,CAAC,eAAe,SAAS,MAAM,GAAG,MAAK,iBAAgB,GAAG;AAC7H,cAAG,UAAU,UAAQ,WAAS,QAAU;AAAA,UAA4C;AACpF,gBAAI;AAAU,cAAI,OAAK;AAAK,cAAI,SAAO;AAAO,2BAAe;AAAK,uBAAa,SAAS;AACxF,eAAK,QAAQ,KAAI,YAAS;AACxB,gBAAG,IAAK,kBAAiB;AAAC,oBAAM,MAAI,MAAM,IAAK,OAAO,QAAQ,EAAC,GAAE,WAAU,QAAO,UAAS,CAAC;AAAE,kBAAG,CAAC,IAAI,GAAG,MAAK,IAAI,QAAM,uBAAsB,GAAG;AAAE,kBAAK,OAAK;AAAA,YAAS;AACtK,kBAAM,EAAC,GAAE,IAAG,WAAU,mBAAkB,GAAG,SAAQ,IAAE,IAAK,OAAO;AACjE,iBAAK,KAAK,KAAK,EAAC,GAAG,UAAS,MAAK,SAAQ,WAAU,IAAK,IAAG,iBAAgB,mBAAkB,MAAK,IAAK,MAAK,WAAU,IAAK,QAAQ,WAAU,gBAAe,IAAK,eAAc,CAAC;AAAE,iBAAK,MAAM,KAAK,eAAe;AAAE,iBAAK,UAAU,KAAK,IAAI;AAAA,UAC7O,CAAC;AAAA,QACH,SAAO,GAAM;AAAC,iBAAO,EAAE,QAAM,cAAc;AAAA,QAAC;AAC5C;AAAA,MACF;AACA,YAAM,UAAQ;AACd,UAAG,QAAQ,SAAO,SAAQ;AAAC,aAAK,KAAK,KAAK,SAAQ,gBAAgB;AAAE;AAAA,MAAM;AAC1E,WAAK,QAAQ,SAAQ,YAAS;AAC5B,YAAG,QAAQ,SAAO,WAAU;AAC1B,cAAG,CAAC,CAAC,WAAU,SAAS,EAAE,SAAS,QAAQ,MAAM,EAAE,MAAK,kBAAkB;AAC1E,cAAG,QAAQ,WAAS,aAAW,CAAC,QAAQ,gBAAe;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,SAAQ,IAAG,OAAM,MAAK,gBAAe,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE;AAAA,UAAM;AAC3L,cAAI;AACJ,cAAG;AAAC,kBAAI,MAAM,QAAQ,OAAO,QAAQ,EAAC,GAAE,WAAU,QAAO,QAAQ,OAAM,CAAC;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,SAAQ,IAAG,OAAM,MAAK,EAAE,QAAM,mBAAkB,iBAAgB,MAAK,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE,kBAAM,KAAK,KAAK,SAAQ,iBAAiB;AAAE;AAAA,UAAM;AACrS,cAAG,IAAI,OAAK,MAAK;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,QAAQ,MAAK,IAAG,OAAM,MAAK,IAAI,QAAM,uBAAsB,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE,gBAAG,QAAQ,WAAS,UAAU,OAAM,KAAK,KAAK,SAAQ,2BAA2B;AAAE;AAAA,UAAM;AAC9P,kBAAQ,OAAK,IAAI,SAAO,YAAU,YAAU;AAAQ,eAAK,KAAK,SAAQ,EAAC,MAAK,WAAU,MAAK,QAAQ,MAAK,IAAG,MAAK,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,EAAE,CAAC;AAAE,eAAK,MAAM,SAAQ,WAAU,EAAC,MAAK,QAAQ,KAAI,CAAC;AAAA,QACnN,WAAS,QAAQ,SAAO,SAAQ;AAC9B,cAAI;AACJ,cAAG;AAAC,oBAAQ,QAAQ,IAAG,GAAE,OAAO,gBAAgB;AAAE,gBAAG,QAAQ,MAAI,QAAQ,YAAY,MAAK,wBAAuB,GAAG;AAAE,oBAAQ,cAAY,QAAQ;AAAG,gBAAG,QAAQ,SAAO,UAAU,MAAK,uBAAsB,GAAG;AAAE,oBAAM,KAAK,MAAM,QAAQ,OAAM,OAAO;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,SAAQ,IAAG,QAAQ,IAAG,IAAG,OAAM,MAAK,EAAE,QAAM,oBAAmB,iBAAgB,MAAK,CAAC;AAAE;AAAA,UAAM;AAC3X,cAAI;AAAQ,cAAG;AAAC,kBAAI,MAAM,QAAQ,OAAO,QAAQ,EAAC,GAAE,SAAQ,GAAG,MAAK,CAAC;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,SAAQ,IAAG,QAAQ,IAAG,IAAG,OAAM,MAAK,EAAE,QAAM,mBAAkB,iBAAgB,KAAI,CAAC;AAAE,kBAAM,KAAK,KAAK,SAAQ,iBAAiB;AAAE;AAAA,UAAM;AAClP,eAAK,KAAK,SAAQ,EAAC,MAAK,SAAQ,IAAG,QAAQ,IAAG,IAAG,IAAI,OAAK,MAAK,GAAI,IAAI,KAAG,CAAC,IAAE,EAAC,MAAK,IAAI,QAAM,kBAAiB,iBAAgB,IAAI,oBAAkB,KAAI,EAAE,CAAC;AAAE,eAAK,MAAM,SAAQ,SAAQ,EAAC,IAAG,QAAQ,IAAG,OAAM,MAAM,MAAK,IAAG,IAAI,OAAK,KAAI,CAAC;AAAA,QAC3O,WAAS,QAAQ,SAAO,iBAAgB;AACtC,cAAI;AACJ,cAAG;AAAC,kBAAI,MAAM,QAAQ,OAAO,QAAQ,EAAC,GAAE,gBAAe,CAAC;AAAA,UAAC,SAAO,GAAM;AAAC,iBAAK,KAAK,SAAQ,EAAC,MAAK,iBAAgB,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,GAAG,IAAG,OAAM,MAAK,EAAE,QAAM,mBAAkB,iBAAgB,KAAI,CAAC;AAAE,kBAAM,KAAK,KAAK,SAAQ,iBAAiB;AAAE;AAAA,UAAM;AAC9Q,eAAK,KAAK,SAAQ,EAAC,MAAK,iBAAgB,GAAI,QAAQ,OAAK,SAAU,EAAC,IAAG,QAAQ,GAAE,IAAE,CAAC,GAAG,IAAG,IAAI,OAAK,MAAK,GAAI,IAAI,KAAG,CAAC,IAAE,EAAC,MAAK,IAAI,QAAM,6BAA4B,iBAAgB,KAAI,EAAE,CAAC;AAAE,eAAK,MAAM,SAAQ,eAAe;AAAE,cAAG,CAAC,IAAI,GAAG,OAAM,KAAK,KAAK,SAAQ,2BAA2B;AAAA,QAC/R,MAAM,MAAK,kBAAkB;AAAA,MAC/B,CAAC;AAAA,IACH,CAAC;AACD,WAAO,GAAG,SAAQ,MAAI;AAAC,UAAG,IAAI,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,IAAC,CAAC;AACzE,WAAO,KAAK,SAAQ,MAAI;AAAC,mBAAa,SAAS;AAAE,oBAAc,SAAS;AAAE,WAAK,QAAQ,OAAO,MAAM;AAAE,UAAG,IAAI,MAAK,KAAK,KAAK,KAAI,sBAAsB;AAAA,IAAC,CAAC;AAAA,EAC1J;AAAA,EACQ,KAAK,KAAY,QAA+C;AACtE,SAAK,eAAe,OAAO,GAAG;AAC9B,QAAG,IAAI,KAAK,QAAO,IAAI;AACvB,QAAI,SAAO;AAAK,QAAI,WAAS,KAAK,IAAI;AAAE,iBAAa,IAAI,UAAU;AAAE,iBAAa,IAAI,QAAQ;AAAE,QAAI,eAAa;AACjH,QAAI,QAAM,YAAS;AAAC,YAAM,SAAO,MAAM,IAAI,OAAO,MAAM,EAAE,MAAM,OAAK,EAAC,eAAc,MAAK,EAAE;AAAE,UAAI,UAAQ,OAAO,kBAAgB;AAAK,UAAI,OAAK;AAAQ,WAAK,KAAK,KAAI,EAAC,MAAK,UAAS,QAAO,gBAAe,MAAK,SAAQ,MAAK,QAAO,eAAc,IAAI,QAAO,CAAC;AAAE,UAAI,QAAQ,MAAM,KAAK,wBAAwB;AAAE,WAAK,MAAM,KAAI,UAAS,EAAC,QAAO,eAAc,IAAI,QAAO,CAAC;AAAE,aAAO,EAAC,eAAc,IAAI,QAAO;AAAA,IAAC,GAAG;AAChZ,WAAO,IAAI;AAAA,EACb;AAAA,EACA,MAAM,QAAO;AACX,UAAM,UAAuB,CAAC;AAC9B,eAAU,CAACH,KAAG,GAAG,KAAK,KAAK,UAAS;AAClC,UAAG,IAAI,QAAO;AAAC,YAAG,IAAI,WAAU,MAAM,KAAK,IAAI,EAAE,MAAK,SAAS,OAAOA,GAAE;AAAE;AAAA,MAAQ;AAClF,UAAG,IAAI,SAAS;AAChB,UAAG;AAAC,aAAK,MAAM,IAAI,OAAO;AAAA,MAAC,QAAM;AAAC,gBAAQ,KAAK,KAAK,KAAK,KAAI,eAAe,CAAC;AAAA,MAAC;AAAA,IAChF;AACA,UAAM,QAAQ,IAAI,OAAO;AAAA,EAC3B;AAAA,EACA,aAAa,GAAUA,KAAU;AAAC,WAAO,gBAAgB,KAAK,IAAI,GAAEA,GAAE,EAAE,MAAM;AAAA,EAAC;AAAA,EAC/E,MAAM,QAAO;AAAC,SAAK,UAAQ;AAAK,kBAAc,KAAK,KAAK;AAAE,UAAM,SAAO,MAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,SAAK,KAAK,KAAK,KAAI,sBAAsB,CAAC,CAAC;AAAE,eAAU,UAAU,KAAK,QAAQ,QAAO,UAAU;AAAE,SAAK,QAAQ,MAAM;AAAE,WAAO,EAAC,eAAc,OAAO,MAAM,OAAG,EAAE,aAAa,EAAC;AAAA,EAAC;AACxS;;;AC/OA,SAAQ,UAAS,aAAY;AAC7B,SAAQ,iBAAgB;AACxB,SAAQ,SAAAI,QAAM,QAAAC,OAAK,YAAAC,WAAS,SAAAC,cAAY;AACxC,SAAQ,YAAW,QAAAC,aAAW;AAC9B,SAAQ,cAAAC,mBAAiB;;;ACFzB,eAAsB,yBAAwB;AAC9C,QAAM,EAAC,OAAAC,OAAK,IAAE,MAAM,OAAO,oBAAoB;AAC/C,QAAM,EAAC,MAAAC,MAAI,IAAE,MAAM,OAAO,kBAAkB;AAC5C,QAAM,CAAC,cAAa,cAAa,YAAW,GAAG,IAAI,IAAE,QAAQ,KAAK,MAAM,CAAC,GAAE,WAAS,OAAO,YAAY;AACvG,MAAG,CAAC,OAAO,cAAc,QAAQ,KAAG,YAAU,KAAK,IAAI,KAAG,CAAC,WAAW,SAAQ,KAAK,GAAG;AAGtF,MAAI;AACJ,MAAG;AAAC,eAAS,KAAK,MAAM,YAAY;AAAA,EAAC,QAAM;AAAC,YAAQ,KAAK,GAAG;AAAA,EAAC;AAC7D,MAAG,CAAC,YAAU,OAAO,KAAK,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,MAAI,mBAAiB,CAAC,CAAC,SAAQ,OAAM,KAAK,EAAE,MAAM,OAAG,OAAO,SAAS,CAAC,MAAI,YAAU,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAG,SAAS,QAAM,OAAK,SAAS,UAAQ,IAAI,SAAQ,KAAK,GAAG;AAC7O,aAAUC,SAAQ,CAAC,cAAa,GAAG,GAAE;AACpC,UAAM,IAAE,MAAMD,MAAKC,OAAK,EAAC,QAAO,KAAI,CAAC;AACrC,QAAG,CAAC,EAAE,YAAY,KAAG,OAAO,EAAE,GAAG,MAAI,SAAS,OAAK,OAAO,EAAE,GAAG,MAAI,SAAS,OAAK,OAAO,EAAE,WAAW,MAAI,SAAS,MAAM,SAAQ,KAAK,GAAG;AAAA,EACzI;AACA,UAAQ,UAAU,CAAC,CAAC;AACpB,MAAI;AAGJ,QAAM,OAAK,UAAM,QAAQ,KAAK,IAAI;AAClC,QAAM,QAAM,WAAW,MAAI,KAAK,GAAG,GAAE,KAAK,IAAI,GAAE,WAAS,KAAK,IAAI,CAAC,CAAC;AACpE,UAAQ,KAAK,WAAU,MAAI,KAAK,GAAG,CAAC;AAAE,UAAQ,KAAK,UAAS,MAAI,KAAK,GAAG,CAAC;AACzE,MAAG;AACF,YAAMF,OAAM,YAAW,MAAK,EAAC,KAAI,OAAM,KAAI,OAAM,KAAI,EAAC,MAAK,gCAA+B,MAAK,WAAU,MAAK,OAAM,GAAE,OAAM,CAAC,UAAS,WAAU,SAAS,EAAC,CAAC;AAC3J,UAAM,KAAK,SAAQ,MAAI,KAAK,GAAG,CAAC;AAChC,UAAM,KAAK,SAAQ,CAAC,MAAK,WAAS;AAAC,mBAAa,KAAK;AAAE,WAAK,SAAO,SAAO,MAAI,EAAE;AAAA,IAAC,CAAC;AAAA,EACnF,QAAM;AAAC,SAAK,GAAG;AAAA,EAAC;AAChB;AAGO,IAAM,8BAA4B,IAAI,uBAAuB,SAAS,CAAC;AAAA;;;ADvB9E,IAAM,UAAQ,UAAU,QAAQ;AACzB,IAAM,kBAAgB;AAE7B,IAAM,SAAO,CAAC,MAAQ,MAAI,QAAM,OAAO,MAAI,YAAU,CAAC,MAAM,QAAQ,CAAC;AACrE,IAAM,WAAS,oBAAI,IAAI,CAAC,aAAY,UAAS,WAAW,CAAC;AACzD,IAAM,MAAI,CAAC,eAAoB,EAAC,MAAK,iCAAgC,MAAK,WAAU,MAAK,gBAAe,eAAc,UAAS;AACxH,SAAS,+BAA+B,OAA6B;AAC3E,MAAG,QAAQ,aAAW,QAAQ,MAAK,kCAAiC,GAAG;AACvE,MAAG,CAAC,OAAO,KAAK,KAAG,OAAO,KAAK,KAAK,EAAE,KAAK,OAAG,CAAC,CAAC,oBAAmB,SAAQ,eAAc,OAAO,EAAE,SAAS,CAAC,CAAC,KAAG,OAAO,MAAM,qBAAmB,YAAU,CAAC,WAAW,MAAM,gBAAgB,KAAG,MAAM,iBAAiB,SAAS,IAAI,KAAG,MAAM,UAAQ,mBAAiB,CAAC,OAAO,MAAM,WAAW,KAAG,CAAC,OAAO,KAAK,MAAM,WAAW,EAAE,UAAQ,OAAO,QAAQ,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC,MAAKG,KAAI,MAAI,CAAC,oBAAoB,KAAK,IAAI,KAAG,OAAOA,UAAO,YAAU,CAAC,wDAAwD,KAAKA,KAAI,CAAC,KAAG,MAAM,UAAQ,UAAW,OAAO,MAAM,UAAQ,UAAU,MAAK,0BAA0B;AACrlB,SAAO;AACR;AACO,SAAS,mBAAmB,EAAC,MAAK,OAAM,WAAU,WAAU,mBAAkB,QAAO,YAAW,MAAK,aAAW,KAAK,IAAI,IAAE,KAAM,iBAAe,0BAAyB,GAAgM;AAE/W,MAAG,CAAC,4BAA4B,KAAK,IAAI,KAAG,CAAC,kBAAkB,KAAK,KAAK,KAAG,CAAC,CAAC,WAAU,cAAc,EAAE,MAAM,OAAG,OAAO,MAAI,YAAU,WAAW,CAAC,KAAG,CAAC,YAAY,KAAK,CAAC,CAAC,KAAG,OAAO,sBAAoB,YAAU,kBAAkB,SAAO,OAAK,CAAC,OAAO,cAAc,UAAU,KAAG,cAAY,KAAG,KAAK,KAAK,OAAG,OAAO,MAAI,YAAU,EAAE,SAAS,IAAI,CAAC,EAAE,MAAK,4BAA4B;AACtX,MAAI;AAAa,MAAG;AAAC,eAAS,KAAK,MAAM,iBAAiB;AAAA,EAAC,QAAM;AAAC,SAAK,4BAA4B;AAAA,EAAC;AACpG,MAAG,CAAC,OAAO,QAAQ,KAAG,OAAO,KAAK,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,MAAI,mBAAiB,CAAC,CAAC,OAAM,OAAM,OAAO,EAAE,MAAM,OAAG,OAAO,SAAS,CAAC,MAAI,YAAU,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAG,SAAS,QAAM,OAAK,SAAS,UAAQ,IAAI,MAAK,4BAA4B;AACtQ,SAAO,CAAC,aAAY,UAAS,gBAAe,cAAa,eAAc,UAAS,MAAK,WAAU,oBAAoB,KAAK,IAAG,WAAU,sBAAsB,SAAS,IAAG,kBAAiB,eAAc,kBAAiB,oBAAmB,oBAAmB,oCAAmC,UAAS,OAAM,mBAAkB,iBAAgB,cAAa,0BAAyB,yBAAwB,wBAAuB,WAAU,kCAAiC,WAAU,iBAAiB,SAAS,mBAAkB,WAAU,iBAAiB,cAAc,yCAAwC,aAAY,cAAa,gBAAe,uBAAsB,OAAO,OAAM,2BAA0B,OAAO,UAAU,GAAE,mBAAkB,YAAW,GAAG,IAAI;AACrvB;AAGO,IAAM,oBAAN,MAAwB;AAAA,EAE9B,YAAoB,OAAoB,QAA8B;AAAlD;AAAoB;AACvC,mCAA+B,MAAM;AAAE,SAAK,YAAU,IAAIC,MAAK,MAAM,SAAQ,eAAe,CAAC;AAC7F,UAAM,GAAG,KAAK,mQAAmQ;AACjR,QAAG,CAAC,MAAM,GAAG,QAAQ,sCAAsC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAU,IAAI,SAAO,oBAAoB,EAAE,OAAM,GAAG,KAAK,kEAAkE;AAAA,EACrM;AAAA,EAJoB;AAAA,EAAoB;AAAA,EADhC;AAAA,EAAwC,WAAS,oBAAI,IAAiD;AAAA,EAAU,WAAS,oBAAI,IAAyB;AAAA,EAAU,WAAS;AAAA,EAAc,UAAQ;AAAA,EAAc,cAAY;AAAA,EAMzN,WAAWC,KAAU,IAAoB;AAAC,UAAM,WAAS,KAAK,SAAS,IAAIA,GAAE,KAAG,QAAQ,QAAQ,GAAG,MAAM,MAAI;AAAA,IAAC,CAAC,EAAE,KAAK,EAAE;AAAE,SAAK,SAAS,IAAIA,KAAG,OAAO;AAAE,WAAO,QAAQ,QAAQ,MAAI;AAAC,UAAG,KAAK,SAAS,IAAIA,GAAE,MAAI,QAAQ,MAAK,SAAS,OAAOA,GAAE;AAAA,IAAC,CAAC;AAAA,EAAC;AAAA,EACzP,MAAc,aAAY;AACzB,UAAMF,QAAKC,MAAK,KAAK,MAAM,SAAQ,0BAAwB,IAAI,2BAAgB,IAAE,MAAM;AACvF,QAAG;AAAC,YAAM,KAAG,MAAME,MAAKH,OAAK,MAAK,GAAK;AAAE,UAAG;AAAC,cAAM,GAAG,UAAU,2BAAgB;AAAE,cAAM,GAAG,KAAK;AAAA,MAAC,UAAC;AAAQ,cAAM,GAAG,MAAM;AAAA,MAAC;AAAA,IAAC,SAAO,GAAM;AAAC,UAAG,EAAE,SAAO,SAAS,OAAM;AAAA,IAAC;AACrK,UAAM,OAAK,MAAMI,OAAMJ,KAAI;AAAE,QAAG,CAAC,KAAK,OAAO,KAAG,KAAK,eAAe,KAAG,KAAK,UAAQ,KAAG,IAAI,MAAMK,UAASL,KAAI,CAAC,MAAI,IAAI,2BAAgB,EAAE,MAAK,gCAA+B,GAAG;AAChL,WAAOA;AAAA,EACR;AAAA,EACA,MAAc,IAAIM,OAAc,UAAQ,MAAM;AAC7C,UAAMC,OAAM,KAAK,UAAU,eAAc,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AACpE,QAAG;AAAC,cAAQ,MAAM,QAAQ,KAAK,OAAO,kBAAiBD,OAAK,EAAC,KAAI,KAAK,WAAU,UAAS,QAAO,SAAQ,WAAU,KAAG,OAAK,MAAK,aAAY,KAAI,CAAC,GAAG,OAAO,KAAK;AAAA,IAAC,QAAM;AAAC,WAAK,iCAAgC,GAAG;AAAA,IAAC;AAAA,EACjN;AAAA,EACQ,IAAIJ,KAAU,GAAU;AAAC,UAAM,MAAI,KAAK,MAAM,GAAG,QAAQ,sDAAsD,EAAE,IAAIA,GAAE;AAAE,QAAG,CAAC,IAAI,QAAO;AAAK,SAAK,MAAM,IAAI,IAAI,SAAQ,CAAC;AAAE,QAAG,CAAC,EAAE,MAAM,SAAS,IAAI,OAAO,EAAE,MAAK,gBAAe,GAAG;AAAE,WAAO;AAAA,EAAG;AAAA,EACxP,MAAc,QAAQ,KAAQ;AAC7B,UAAM,OAAK,MAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAK,cAAa,YAAW,UAAU,IAAI,IAAI,KAAI,YAAW,SAAS,CAAC,GAAG,MAAM,IAAI,EAAE,OAAO,OAAO;AACjJ,QAAG,CAAC,IAAI,OAAO,QAAO;AACtB,QAAG,IAAI,WAAS,KAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,KAAG,IAAI,OAAK,IAAI,QAAM,IAAI,CAAC,EAAE,MAAK,+BAA8B,GAAG;AACnH,QAAI;AAAU,QAAG;AAAC,cAAM,KAAK,MAAM,MAAM,KAAK,IAAI,CAAC,aAAY,WAAU,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,IAAC,QAAM;AAAC,WAAK,iCAAgC,GAAG;AAAA,IAAC;AACrI,QAAG,OAAO,OAAK,IAAI,CAAC,KAAG,MAAM,SAAO,MAAI,IAAI,QAAM,MAAM,QAAQ,SAAS,kBAAkB,MAAI,IAAI,SAAO,MAAM,QAAQ,SAAS,oBAAoB,MAAI,KAAK,MAAM,UAAU,MAAK,+BAA8B,GAAG;AACpN,UAAM,OAAK,MAAM,YAAW,SAAO,MAAM,UAAQ,CAAC,GAAG,OAAO,CAAC,MAAQ,EAAE,SAAO,MAAM;AACpF,UAAM,YAAU,MAAM,KAAK,CAAC,MAAQ,EAAE,gBAAc,YAAY,GAAE,aAAW,MAAM,KAAK,CAAC,MAAQ,EAAE,gBAAc,yBAAyB;AAC1I,UAAM,OAAK,MAAM,QAAQ,IAAI,CAAC,SAAc,KAAK,QAAQ,SAAQ,EAAE,CAAC;AACpE,QAAG,OAAO,IAAI,uBAAqB,YAAU,MAAM,QAAQ,MAAM,CAAC,MAAI,6BAA2B,MAAM,OAAO,IAAI,CAAC,MAAI,IAAI,sBAAoB,MAAM,QAAQ,YAAY,WAAS,KAAG,MAAM,OAAO,WAAW,CAAC,MAAI,sBAAsB,MAAK,6BAA4B,GAAG;AAC5Q,QAAG,MAAM,QAAQ,UAAQ,KAAK,OAAO,SAAO,MAAM,QAAQ,SAAO,SAAO,MAAM,gBAAc,UAAQ,MAAM,mBAAiB,QAAM,MAAM,eAAa,SAAO,CAAC,KAAK,SAAS,SAAS,KAAK,KAAG,MAAM,WAAS,KAAG,CAAC,KAAK,SAAS,QAAQ,KAAG,CAAC,KAAK,SAAS,QAAQ,KAAG,CAAC,KAAK,aAAa,SAAS,mBAAmB,KAAG,MAAM,WAAS,KAAG,WAAW,WAAS,IAAI,aAAW,YAAY,WAAS,MAAM,KAAK,WAAW,KAAG,YAAY,OAAK,MAAM,MAAK,6BAA4B,GAAG;AACjd,WAAO;AAAA,EACR;AAAA,EACA,MAAM,QAAO;AACZ,QAAG;AAAC,YAAM,OAAK,KAAK,MAAM,MAAM,KAAK,IAAI,CAAC,SAAQ,WAAU,KAAK,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;AAAE,UAAG,MAAM,iBAAe,WAAS,CAAC,KAAK,aAAa,SAAS,KAAK,OAAO,KAAK,EAAE,MAAK,0BAA0B;AAAE,aAAO,EAAC,MAAK,aAAY,QAAO,oBAAmB,OAAM,KAAK,OAAO,OAAM,SAAQ,QAAO,YAAW,kBAAiB,MAAK,eAAc,aAAY,2BAA0B;AAAA,IAAC,QAAM;AAAC,aAAO,EAAC,MAAK,aAAY,QAAO,eAAc,MAAK,mCAAkC;AAAA,IAAC;AAAA,EACnd;AAAA,EACQ,QAAQA,KAAU,OAAK,mBAAkB;AAChD,SAAK,MAAM,OAAOA,KAAG,WAAU,EAAC,MAAK,qBAAoB,eAAc,OAAM,iBAAgB,KAAI,GAAE,IAAI;AAAA,EACxG;AAAA,EACA,MAAc,KAAKA,KAAU;AAC5B,UAAM,QAAM,MAAM,KAAK,OAAO,kBAAiB,CAAC,aAAY,QAAOA,GAAE,GAAE,EAAC,KAAI,KAAK,WAAU,OAAM,CAAC,UAAS,QAAO,MAAM,GAAE,aAAY,KAAI,CAAC;AAC3I,UAAM,SAAgB,CAAC,GAAE,SAAgB,CAAC;AAAE,QAAI,QAAM,GAAE,SAAO;AAC/D,UAAM,OAAK,CAAC,SAAgB,CAAC,UAAe;AAAC,YAAM,IAAE,KAAK,IAAI,MAAM,QAAO,KAAK,IAAI,GAAE,IAAE,OAAK,OAAK,KAAK,CAAC;AAAE,UAAG,EAAE,MAAK,KAAK,MAAM,SAAS,GAAE,CAAC,CAAC;AAAE,eAAO;AAAA,IAAC;AACtJ,UAAM,OAAO,GAAG,QAAO,KAAK,MAAM,CAAC;AAAE,UAAM,OAAO,GAAG,QAAO,KAAK,MAAM,CAAC;AAAE,UAAM,QAAM,WAAW,MAAI;AAAC,eAAO;AAAK,YAAM,KAAK,SAAS;AAAA,IAAC,GAAE,IAAK;AAC9I,QAAG;AAAC,YAAM,OAAK,MAAM,IAAI,QAAqB,CAACM,UAAQ,WAAS;AAAC,cAAM,KAAK,SAAQ,MAAM;AAAE,cAAM,KAAK,SAAQA,QAAO;AAAA,MAAC,CAAC;AAAE,UAAG,UAAQ,SAAO,EAAE,MAAK,gCAA+B,GAAG;AAAE,aAAO,EAAC,QAAO,OAAO,OAAO,MAAM,GAAE,QAAO,OAAO,OAAO,MAAM,EAAC;AAAA,IAAC,UAAC;AAAQ,mBAAa,KAAK;AAAA,IAAC;AAAA,EACtR;AAAA,EACA,MAAc,OAAON,KAAU,GAAU,UAAa,UAA+C,QAAmB;AACvH,QAAG,CAAC,YAAU,CAAC,CAAC,UAAS,MAAM,EAAE,SAAS,SAAS,OAAO,MAAM,KAAG,SAAS,OAAO,YAAU,OAAM;AAAC,WAAK,QAAQA,GAAE;AAAE;AAAA,IAAM;AAE3H,QAAI;AACJ,QAAG;AAAC,aAAK,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAAC,QAAM;AAAC,WAAK,QAAQA,KAAG,8BAA8B;AAAE;AAAA,IAAM;AAClG,UAAM,MAAI,MAAM,SAAS,KAAK,QAAO,CAAC,GAAE,MAAI,MAAM,SAAS,KAAK,QAAO,CAAC,GAAE,WAAS,SAAS,MAAM;AAClG,UAAM,QAAM,WAAS,eAAa,WAAS,kBAAgB,cAAY,SAAO,WAAS,aAAW,IAAE,cAAY;AAChH,UAAM,SAAO,EAAC,MAAK,qBAAoB,aAAY,SAAS,IAAG,UAAS,kBAAiB,IAAI,YAAW,kBAAiB,IAAI,YAAW,WAAU,MAAK,cAAa,gBAAe,eAAc,MAAK,iBAAgB,MAAK,WAAU,EAAC,MAAK,aAAY,OAAM,KAAK,OAAO,OAAM,SAAQ,QAAO,MAAK,cAAa,EAAC;AACjT,SAAK,MAAM,GAAG,YAAY,MAAI;AAAC,WAAK,MAAM,OAAOA,KAAG,OAAM,QAAO,WAAS,UAAQ,WAAS,yBAAuB,KAAK;AAAE,WAAK,MAAM,GAAG,QAAQ,4EAA4E,EAAE,IAAI,QAAOA,GAAE;AAAA,IAAC,CAAC,EAAE;AAC9O,UAAM,KAAK,QAAQA,KAAG,CAAC,EAAE,MAAM,MAAI;AAAA,IAAC,CAAC;AAAA,EACtC;AAAA,EACA,MAAM,QAAQA,KAAU,GAAU;AACjC,UAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AAAE,QAAG,CAAC,OAAK,IAAI,UAAQ,aAAW,CAAC,SAAS,IAAI,KAAK,MAAM,OAAOA,KAAG,CAAC,EAAE,MAAM,EAAE;AACvG,UAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,QAAG,CAAC,OAAM;AAAC,WAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAE;AAAA,IAAM;AACxJ,QAAG,MAAM,OAAO,YAAU,MAAM,MAAK,8BAA6B,GAAG;AACrE,UAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AAAE,SAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,EAC9I;AAAA,EACA,MAAM,QAAQA,KAAU,GAAU,UAA+C;AAAC,WAAO,KAAK,WAAWA,KAAG,MAAI,KAAK,gBAAgBA,KAAG,GAAE,QAAQ,CAAC;AAAA,EAAC;AAAA,EACpJ,MAAc,gBAAgBA,KAAU,GAAU,UAA+C;AAChG,UAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AAAE,QAAG,CAAC,IAAI,QAAO;AACxC,QAAG,SAAS,IAAI,KAAK,MAAM,OAAOA,KAAG,CAAC,EAAE,MAAM,GAAE;AAAC,YAAM,KAAK,QAAQA,KAAG,CAAC,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAE,aAAO;AAAA,IAAI;AACnG,QAAG,KAAK,SAAS,IAAIA,GAAE,EAAE,QAAO;AAChC,QAAG;AACF,YAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,UAAG,CAAC,YAAW,SAAS,EAAE,SAAS,IAAI,KAAK,GAAE;AAC7C,YAAG,OAAO,OAAO,WAAS,SAAO,MAAM,OAAO,WAAS,WAAU;AAAC,eAAK,QAAQA,GAAE;AAAE,iBAAO;AAAA,QAAI;AAG9F,YAAG,MAAM,OAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AACnD,aAAK,MAAM,GAAG,YAAY,MAAI;AAAC,eAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,+BAA+B;AAAE,eAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,QAAC,CAAC,EAAE;AAAA,MAC3R,WAAS,MAAM,OAAM,KAAK,OAAOA,KAAG,GAAE,OAAM,UAAS,IAAI,MAAM;AAAA,UAC1D,MAAK,QAAQA,GAAE;AAAA,IACrB,QAAM;AAAC,WAAK,QAAQA,GAAE;AAAA,IAAC;AACvB,WAAO;AAAA,EACR;AAAA,EACA,MAAM,OAAOA,KAAU,GAAU,MAAI,aAAY;AAChD,UAAM,UAAQ,KAAK,SAAS,IAAIA,GAAE;AAAE,QAAG,SAAQ;AAAC,YAAM,QAAQ,OAAO,GAAG;AAAE,aAAO;AAAA,IAAI;AACrF,WAAO,KAAK,WAAWA,KAAG,MAAI,KAAK,eAAeA,KAAG,GAAE,GAAG,CAAC;AAAA,EAC5D;AAAA,EACA,MAAc,eAAeA,KAAU,GAAU,KAAW;AAC3D,UAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AAAE,QAAG,CAAC,OAAK,SAAS,IAAI,KAAK,MAAM,OAAOA,KAAG,CAAC,EAAE,MAAM,EAAE,QAAO,CAAC,CAAC;AACxF,UAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,QAAG,OAAO,OAAO,SAAQ;AAAC,WAAK,MAAM,GAAG,QAAQ,4DAA4D,EAAE,IAAI,KAAIA,GAAE;AAAE,YAAM,KAAK,IAAI,CAAC,aAAY,QAAO,iBAAgB,MAAM,EAAE,GAAE,GAAI;AAAA,IAAC,WACpL,OAAO,OAAO,WAAS,WAAU;AACxC,YAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AAC1C,WAAK,MAAM,GAAG,YAAY,MAAI;AAAC,aAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,eAAc,MAAK,iBAAgB,IAAI,UAAQ,YAAW,YAAW,IAAI,UAAQ,WAAU,GAAE,GAAG;AAAE,aAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,MAAC,CAAC,EAAE;AAAA,IAClS;AACA,WAAO;AAAA,EACR;AAAA,EACA,MAAM,MAAM,UAA+C;AAC1D,QAAG,KAAK,YAAU,KAAK,QAAQ;AAAO,SAAK,WAAS;AACpD,QAAG;AAAC,YAAM,OAAK,KAAK,MAAM,GAAG,QAAQ,4HAA4H,EAAE,IAAI,KAAK,WAAW;AAAE,UAAG,CAAC,KAAK,OAAO,MAAK,cAAY;AAAG,iBAAU,OAAO,MAAK;AAClP,YAAG,KAAK,QAAQ;AAAM,aAAK,cAAY,IAAI;AAC3C,YAAG,KAAK,SAAS,IAAI,IAAI,YAAY,EAAE;AACvC,cAAM,IAAE,KAAK,MAAM,IAAI,OAAO;AAAE,YAAI,QAAM;AAAK,YAAG;AAAC,eAAK,MAAM,SAAS,CAAC;AAAA,QAAC,QAAM;AAAC,kBAAM;AAAA,QAAK;AAC3F,YAAG,CAAC,MAAM,KAAG;AAAC,gBAAM,KAAK,OAAO,IAAI,cAAa,GAAE,eAAe;AAAA,QAAC,QAAM;AAAA,QAAC;AAC1E,YAAG,KAAK,QAAQ;AAAM,YAAG;AAAC,gBAAM,KAAK,QAAQ,IAAI,cAAa,GAAE,QAAQ;AAAA,QAAC,QAAM;AAAA,QAAC;AAAA,MACjF;AAAA,IAAC,UAAC;AAAQ,WAAK,WAAS;AAAA,IAAK;AAAA,EAC9B;AAAA,EACA,MAAM,IAAI,EAAC,IAAAA,KAAG,GAAE,QAAO,WAAU,mBAAkB,YAAW,MAAK,SAAQ,UAAS,mBAAkB,cAAa,SAAQ,GAA6P;AACvX,UAAM,OAAK,gBAAc,IAAI,UAAU,EAAC,SAAQ,KAAK,MAAM,WAAU,IAAAA,IAAE,CAAC,CAAC,EAAE,MAAM,GAAE,EAAE,GAAE,QAAMO,YAAW,GAAEC,UAAO,IAAI,UAAU,EAAC,QAAO,WAAU,mBAAkB,YAAW,MAAK,OAAM,KAAK,OAAO,MAAK,CAAC,CAAC;AAC5M,UAAM,aAAW,KAAK,IAAI,EAAE,WAAU,KAAK,IAAI,IAAE,OAAO,GAAE,iBAAe,MAAM,KAAK,WAAW;AAC/F,UAAMJ,QAAK,mBAAmB,EAAC,MAAK,OAAM,WAAU,KAAK,MAAM,WAAU,WAAU,mBAAkB,QAAO,KAAK,QAAO,YAAW,MAAK,YAAW,eAAc,CAAC;AAClK,SAAK,MAAM,GAAG,QAAQ,iLAAiL,EAAE,IAAIJ,KAAG,MAAK,OAAM,UAAU,CAAC,GAAE,QAAO,WAAUQ,SAAO,iBAAiB;AACjR,QAAI,SAAmB,MAAK,OAAU,cAAY,OAAM,YAAmCC,UAAO;AAClG,UAAM,SAAO,CAAC,QAAa;AAAC,iBAAS;AAAI,WAAK,MAAM,GAAG,QAAQ,4DAA4D,EAAE,IAAI,QAAOT,GAAE;AAAE,aAAO,gBAAc,YAAS;AAAC,YAAG;AAAC,gBAAM,MAAI,KAAK,IAAIA,KAAG,CAAC,GAAE,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,cAAG,OAAO,OAAO,QAAQ,OAAM,KAAK,IAAI,CAAC,aAAY,QAAO,iBAAgB,MAAM,EAAE,GAAE,GAAI;AAAA,QAAC,QAAM;AAAC,wBAAY;AAAA,QAAI,UAAC;AAAQ,cAAG,SAAO,CAACS,SAAO;AAAC,kBAAMC,SAAM,WAAW,MAAI;AAAC,kBAAG,CAACD,SAAO;AAAC,8BAAY;AAAK,oBAAG;AAAC,0BAAQ,KAAK,CAAC,MAAM,KAAI,SAAS;AAAA,gBAAC,QAAM;AAAA,gBAAC;AAAA,cAAC;AAAA,YAAC,GAAE,GAAI;AAAE,YAAAC,OAAM,MAAM;AAAA,UAAC;AAAA,QAAC;AAAA,MAAC,GAAG;AAAA,IAAC;AACvf,SAAK,SAAS,IAAIV,KAAG,EAAC,OAAM,CAAC;AAAE,UAAM,QAAM,WAAW,MAAI,KAAK,OAAO,iBAAiB,GAAE,OAAO;AAChG,QAAG;AACF,eAAS;AAAE,UAAG,aAAa,EAAE,UAAO;AACpC,UAAG,QAAO;AAAC,aAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,MAAM;AAAE,aAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAE;AAAA,MAAM;AACjP,YAAM,QAAM,MAAM,KAAK,MAAM;AAAE,UAAG,MAAM,WAAS,mBAAmB,MAAK,oCAAmC,GAAG;AAC/G,YAAM,kBAAkB;AAAE,eAAS;AACnC,YAAM,MAAI,MAAM,KAAK,IAAII,KAAI;AAAE,UAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,MAAK,iCAAgC,GAAG;AACtG,WAAK,MAAM,GAAG,QAAQ,yEAAyE,EAAE,IAAI,KAAIJ,GAAE;AAC3G,YAAM,kBAAkB;AAAE,eAAS;AAAE,UAAG,aAAa,EAAE,YAAS;AAChE,UAAG,QAAO;AAAC,cAAM,MAAI,KAAK,IAAIA,KAAG,CAAC,GAAE,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,YAAG,OAAO,OAAO,WAAS,UAAU,MAAK,iBAAiB;AAAE,cAAM,KAAK,IAAI,CAAC,aAAY,MAAK,GAAG,CAAC;AAAE,aAAK,MAAM,GAAG,YAAY,MAAI;AAAC,eAAK,MAAM,OAAOA,KAAG,aAAY,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,MAAM;AAAE,eAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,QAAC,CAAC,EAAE;AAAE;AAAA,MAAM;AAC9a,WAAK,MAAM,GAAG,QAAQ,oEAAoE,EAAE,IAAIA,GAAE;AAClG,cAAM,MAAM,KAAK,OAAO,kBAAiB,CAAC,aAAY,SAAQ,MAAK,GAAG,GAAE,EAAC,KAAI,KAAK,WAAU,UAAS,MAAK,OAAM,CAAC,UAAS,UAAS,QAAQ,GAAE,aAAY,KAAI,CAAC;AAC9J,YAAM,IAAI,QAAc,CAACM,UAAQ,WAAS;AAAC,cAAM,KAAK,SAAQ,MAAM;AAAE,cAAM,KAAK,SAAQ,MAAI;AAAC,UAAAG,UAAO;AAAK,UAAAH,SAAQ;AAAA,QAAC,CAAC;AAAA,MAAC,CAAC;AAAE,YAAM;AAC9H,UAAG,aAAY;AAAC,aAAK,QAAQN,GAAE;AAAE;AAAA,MAAM;AACvC,YAAM,KAAK,OAAOA,KAAG,GAAE,MAAM,KAAK,QAAQ,KAAK,IAAIA,KAAG,CAAC,CAAC,GAAE,UAAS,MAAM;AAAA,IAC1E,SAAO,GAAM;AACZ,YAAM,MAAI,KAAK,IAAIA,KAAG,CAAC;AACvB,UAAG,KAAK,UAAQ,YAAW;AAAC,aAAK,QAAQA,GAAE;AAAA,MAAC,OACxC;AAGH,YAAG;AAAC,gBAAM,QAAM,MAAM,KAAK,QAAQ,GAAG;AAAE,cAAG,OAAO,OAAO,WAAS,aAAW,UAAQ,KAAK,OAAM,MAAM;AAAE,cAAG,MAAM,OAAM,KAAK,IAAI,CAAC,aAAY,MAAK,MAAM,EAAE,CAAC;AAAE,eAAK,MAAM,GAAG,YAAY,MAAI;AAAC,iBAAK,MAAM,OAAOA,KAAG,SAAO,cAAY,UAAS,EAAC,MAAK,qBAAoB,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,GAAE,WAAS,aAAa,aAAW,EAAE,OAAK,mBAAmB;AAAE,iBAAK,MAAM,GAAG,QAAQ,mEAAmE,EAAE,IAAIA,GAAE;AAAA,UAAC,CAAC,EAAE;AAAA,QAAC,QAAM;AAAC,eAAK,QAAQA,GAAE;AAAA,QAAC;AAAA,MAC5f;AAAA,IACD,UAAC;AAAQ,mBAAa,KAAK;AAAE,WAAK,SAAS,OAAOA,GAAE;AAAA,IAAC;AAAA,EACtD;AAAA,EACA,MAAM,QAAO;AAAC,SAAK,UAAQ;AAAK,UAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,OAAG,EAAE,OAAO,WAAW,CAAC,CAAC;AAAE,UAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,CAAC;AAAE,WAAM,KAAK,SAAS,OAAM,IAAI,QAAQ,OAAG,WAAW,GAAE,EAAE,CAAC;AAAA,EAAC;AAC9N;;;AErKA,SAAQ,aAAAW,kBAAiC;AACzC,SAAQ,SAAAC,QAAM,SAAAC,QAAM,QAAAC,OAAK,YAAAC,WAAS,YAAAC,WAAS,QAAAC,OAAK,UAAAC,SAAO,iBAAgC;AACvF,OAAOC,WAAU;AAKjB,SAAS,SAAS,GAA+B;AAChD,MAAG,CAAC,EAAE,YAAY,KAAG,EAAE,OAAK,MAAI,EAAE,MAAI,MAAI,EAAE,eAAa,GAAG,MAAK,kCAAiC,GAAG;AACrG,SAAO,EAAC,KAAI,OAAO,EAAE,GAAG,GAAE,KAAI,OAAO,EAAE,GAAG,GAAE,OAAM,OAAO,EAAE,WAAW,EAAC;AACxE;AACA,IAAM,MAAI,CAAC,MAAgB,IAAI,UAAU,SAAS,CAAC,CAAC,CAAC;AAkBrD,IAAM,sBAAoB;AAE1B,IAAM,YAAU,oBAAI,IAAuC;AACpD,IAAM,mBAAiD,EAAC,mBAAkB,KAAI;AACrF,IAAM,QAAM,CAAC,QAAa;AAAC,MAAG;AAAC,YAAQ,KAAK,KAAI,CAAC;AAAE,WAAO;AAAA,EAAI,SAAO,GAAM;AAAC,WAAO,GAAG,SAAO;AAAA,EAAO;AAAC;AAErG,eAAe,gBAAgB,UAAkC;AAC/D,QAAMC,OAAM,qBAAoB,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC,EAAE,MAAM,MAAI;AAAA,EAAC,CAAC;AACzE,WAAQ,UAAQ,GAAE,UAAQ,GAAE,WAAU;AACpC,QAAI;AACJ,QAAG;AACD,eAAO,MAAMC,MAAK,UAAS,MAAK,GAAK;AACrC,YAAM,UAAU,QAAO,KAAK,UAAU,EAAC,KAAI,QAAQ,IAAG,CAAC,CAAC;AACxD,aAAO,EAAC,OAAM,GAAE,MAAK,UAAS,OAAM;AAAA,IACtC,SAAO,GAAM;AACX,YAAM,QAAQ,MAAM,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAClC,YAAM,OAAM,GAAsB;AAClC,UAAG,SAAO,YAAU,SAAO,SAAQ;AAAC,yBAAiB,oBAAkB,KAAK,IAAI;AAAE,eAAO,EAAC,OAAM,GAAE,MAAK,IAAG,QAAO,OAAkC;AAAA,MAAC;AACpJ,UAAG,SAAO,SAAS,OAAM;AAAA,IAC3B;AAGA,QAAI,SAAO;AACX,QAAG;AACD,YAAM,OAAK,MAAMA,MAAK,UAAS,GAAG,GAAE,OAAK,MAAM,KAAK,KAAK,GAAE,QAAM,MAAMC,OAAM,QAAQ;AACrF,UAAG;AACD,cAAM,QAAM,KAAK,MAAM,MAAMC,UAAS,MAAK,EAAC,UAAS,OAAM,CAAC,CAAC;AAC7D,YAAG,CAAC,MAAM,OAAO,OAAO,GAAG,CAAC,KAAG,MAAM,QAAM,KAAK,OAAK,MAAM,QAAM,KAAK,OAAK,CAAC,MAAM,eAAe,GAAE;AACjG,gBAAMC,QAAO,QAAQ,EAAE,MAAM,MAAI;AAAA,UAAC,CAAC;AAAE,mBAAO;AAAA,QAC9C;AAAA,MACF,UAAC;AAAQ,cAAM,KAAK,MAAM;AAAA,MAAC;AAAA,IAC7B,QAAM;AAAA,IAAC;AACP,QAAG,CAAC,OAAO,MAAK,kBAAiB,GAAG;AAAA,EACtC;AACA,OAAK,kBAAiB,GAAG;AAC3B;AAEA,eAAe,gBAAgBC,OAA+C;AAC5E,QAAM,UAAQ,GAAGA,MAAK,GAAG,IAAIA,MAAK,GAAG;AACrC,QAAM,WAAS,UAAU,IAAI,OAAO;AACpC,MAAG,UAAS;AAAC,UAAM,OAAK,MAAM;AAAS,SAAK;AAAQ,WAAO;AAAA,EAAI;AAC/D,QAAM,UAAQ,gBAAgB,GAAG,mBAAmB,IAAI,OAAO,EAAE,EAAE,KAAK,UAAM;AAAC,cAAU,IAAI,SAAQ,IAAI;AAAE,WAAO;AAAA,EAAI,CAAC;AACvH,YAAU,IAAI,SAAQ,OAAO;AAC7B,MAAG;AAAC,WAAO,MAAM;AAAA,EAAO,SAAO,GAAE;AAAC,cAAU,OAAO,OAAO;AAAE,UAAM;AAAA,EAAC;AACrE;AAEA,eAAe,gBAAgB,SAAe,MAA4B;AACxE,MAAG,EAAE,KAAK,QAAM,EAAE;AAClB,MAAG,UAAU,IAAI,OAAO,MAAI,KAAK,WAAU,OAAO,OAAO;AACzD,MAAG,CAAC,KAAK,OAAO;AAChB,MAAG;AACD,UAAM,OAAK,MAAM,KAAK,OAAO,KAAK,GAAE,QAAM,MAAMH,OAAM,KAAK,IAAI;AAC/D,QAAG,MAAM,QAAM,KAAK,OAAK,MAAM,QAAM,KAAK,OAAK,CAAC,MAAM,eAAe,EAAE,OAAME,QAAO,KAAK,IAAI,EAAE,MAAM,MAAI;AAAA,IAAC,CAAC;AAAA,EAC7G,QAAM;AAAA,EAAC;AACP,QAAM,KAAK,OAAO,MAAM,EAAE,MAAM,MAAI;AAAA,EAAC,CAAC;AACxC;AACA,eAAe,SAAS,QAA8E;AACrG,MAAG,CAAC,CAAC,SAAQ,OAAO,EAAE,SAAS,QAAQ,QAAQ,KAAG,OAAO,WAAS,YAAU,CAACE,MAAK,WAAW,MAAM,KAAG,OAAO,SAAO,QAAM,OAAO,SAAS,IAAI,EAAE,MAAK,kCAAiC,GAAG;AACzL,QAAM,SAAO,MAAMC,UAAS,MAAM,GAAE,QAAM,MAAMF,MAAK,QAAO,EAAC,QAAO,KAAI,CAAC,GAAE,YAAmB,CAAC;AAC/F,MAAI,UAAQ;AACZ,WAAQ,QAAM,KAAG,SAAQ;AACxB,QAAG,SAAO,IAAI,MAAK,kCAAiC,GAAG;AACvD,cAAU,KAAK,IAAI,UAAQ,IAAE,QAAM,MAAMA,MAAK,SAAQ,EAAC,QAAO,KAAI,CAAC,CAAC,CAAC;AACrE,UAAM,SAAOC,MAAK,QAAQ,OAAO;AAAE,QAAG,WAAS,QAAQ;AAAM,cAAQ;AAAA,EACtE;AACA,MAAG,IAAI,MAAMD,MAAK,QAAO,EAAC,QAAO,KAAI,CAAC,CAAC,MAAI,UAAU,CAAC,KAAG,MAAME,UAAS,MAAM,MAAI,OAAO,MAAK,qBAAoB,GAAG;AACrH,SAAO,EAAC,UAAS,EAAC,KAAI,UAAU,CAAC,GAAE,WAAU,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,GAAE,MAAK,QAAO,UAAS,QAAQ,SAA2B,GAAE,UAAS,SAAS,KAAK,EAAC;AACxJ;AAGO,IAAM,eAAN,MAAM,cAAY;AAAA,EAEhB,YAA4B,UAA2C,eAA6B,QAA2B,UAAqC;AAAxI;AAA2C;AAA6B;AAA2B;AAAA,EAAsC;AAAA,EAAzI;AAAA,EAA2C;AAAA,EAA6B;AAAA,EAA2B;AAAA,EAD/H,SAAO;AAAA,EAEf,aAAa,QAAQ,QAAc;AAClC,UAAM,QAAM,MAAM,SAAS,MAAM;AAAE,QAAI,QAA4B;AACnE,QAAG;AACF,UAAG,QAAQ,aAAW,SAAQ;AAC7B,iBAAO,MAAMN,MAAK,MAAM,SAAS,MAAKO,WAAU,WAASA,WAAU,cAAYA,WAAU,UAAU;AACnG,cAAM,OAAK,MAAM,OAAO,KAAK,EAAC,QAAO,KAAI,CAAC;AAC1C,YAAG,IAAI,IAAI,MAAI,MAAM,SAAS,IAAI,MAAK,qBAAoB,GAAG;AAE9D,cAAMH,QAAK,EAAC,KAAI,KAAK,KAAI,KAAI,KAAK,IAAG;AACrC,mBAAS,EAAC,KAAI,GAAGA,MAAK,GAAG,IAAIA,MAAK,GAAG,IAAG,MAAK,MAAM,gBAAgBA,KAAI,EAAC;AAAA,MACzE;AACA,YAAM,MAAI,IAAI,cAAa,OAAO,OAAO,EAAC,GAAG,MAAM,UAAS,WAAU,OAAO,OAAO,MAAM,SAAS,SAAS,EAAC,CAAC,GAAuB,UAAU,MAAM,QAAQ,GAAE,QAAO,QAAQ;AAC9K,YAAM,IAAI,OAAO;AAAE,aAAO;AAAA,IAC3B,SAAO,GAAE;AAAC,YAAM,QAAQ,MAAM;AAAE,UAAG,SAAS,OAAM,gBAAgB,SAAS,KAAI,SAAS,IAAI,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAE,YAAM;AAAA,IAAC;AAAA,EACpH;AAAA,EACA,IAAI,WAAU;AAAC,QAAG,KAAK,OAAO,MAAK,sBAAsB;AAAE,WAAO,KAAK,SAAO,SAAS,QAAQ,GAAG,OAAO,KAAK,OAAO,EAAE,OAAK,KAAK,SAAS;AAAA,EAAI;AAAA,EAC9I,MAAM,SAAQ;AACb,QAAG,KAAK,OAAO,MAAK,sBAAsB;AAC1C,UAAM,UAAQ,MAAM,SAAS,KAAK,SAAS,IAAI;AAC/C,QAAG,UAAU,QAAQ,QAAQ,MAAI,UAAU,KAAK,QAAQ,KAAG,QAAQ,YAAU,UAAU,QAAQ,QAAQ,MAAI,KAAK,cAAc,MAAK,qBAAoB,GAAG;AAC1J,QAAG,KAAK,WAAS,IAAI,MAAM,KAAK,OAAO,KAAK,EAAC,QAAO,KAAI,CAAC,CAAC,MAAI,KAAK,SAAS,OAAK,MAAME,UAAS,SAAS,QAAQ,GAAG,OAAO,KAAK,OAAO,EAAE,EAAE,MAAI,KAAK,SAAS,MAAM,MAAK,qBAAoB,GAAG;AAAA,EAChM;AAAA,EACA,MAAM,QAAO;AAAC,QAAG,KAAK,OAAO;AAAO,SAAK,SAAO;AAAK,QAAG,KAAK,SAAS,OAAM,gBAAgB,KAAK,SAAS,KAAI,KAAK,SAAS,IAAI,EAAE,MAAM,MAAI;AAAA,IAAC,CAAC;AAAE,UAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAC3K;;;AC7HA,SAAS,cAAAE,mBAAkB;AA2B3B,IAAM,gBAAgB,CAAC,OAAO,aAAa,QAAQ,UAAU;AAC7D,IAAM,QAAQ;AACd,IAAM,gBAAgB;AACtB,IAAM,WAAW;AACjB,IAAM,YAAY,oBAAI,IAAY,CAAC,SAAS,OAAO,CAAC;AAE7C,IAAM,qBAAwC,CAAC,YAAY,cAAc,sBAAsB;AAEtG,IAAM,sBAAsB,oBAAI,IAAY,CAAC,YAAY,CAAC;AAE1D,IAAM,wBAAwB;AAC9B,IAAM,WAAW,oBAAI,IAAY,CAAC,aAAa,UAAU,WAAW,CAAC;AACrE,IAAM,OAAO,oBAAI,IAAY,CAAC,YAAY,SAAS,CAAC;AAS7C,IAAM,sBAAN,MAA0B;AAAA,EAG/B,YAAoB,OAAsB,aAAqB,IAAI;AAA/C;AAAsB;AACxC,SAAK,MAAM,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAqBV;AAGT,QAAG,CAAC,KAAK,MAAM,GAAG,OAAO,kCAAkC,EAAE,KAAK,CAAC,WAAgB,OAAO,SAAO,kBAAkB;AACjH,WAAK,MAAM,GAAG,KAAK,uFAAuF;AAAA,EAC9G;AAAA,EA3BoB;AAAA,EAAsB;AAAA;AAAA,EADjC,wBAAwB;AAAA;AAAA,EA8BjC,MAAM,aAAqB,SAAkB,UAAe;AAC1D,eAAW,WAAW;AACtB,UAAM,OAAO,KAAK,OAAO,QAAQ;AACjC,WAAO,KAAK,UAAU,MAAM;AAC1B,WAAK,MAAM,SAAS,OAAO;AAC3B,YAAM,YAAY,KAAK,MAAM,GAAG,QAAQ,qCAAqC,EAAE,IAAI,WAAW;AAC9F,UAAI,CAAC,UAAW,MAAK,uBAAuB,GAAG;AAC/C,WAAK,MAAM,IAAI,UAAU,SAAS,OAAO;AACzC,UAAI,CAAC,mBAAmB,SAAS,UAAU,IAAI,EAAG,MAAK,8BAA8B;AACrF,UAAI,CAAC,KAAK,IAAI,UAAU,MAAM,EAAG,MAAK,sBAAsB,GAAG;AAC/D,YAAM,QAAQ,KAAK,MAAM,GAAG,QAAQ,yDAAyD,EAAE,IAAI,WAAW;AAC9G,UAAI,OAAO;AACT,aAAK,MAAM,IAAI,MAAM,SAAS,OAAO;AACrC,YAAI,MAAM,aAAa,KAAK,OAAO,MAAM,SAAS,KAAK,QAAQ,MAAM,aAAa,KAAK,YAAY,MAAM,cAAc,UAAU,KAAK,SAAS,EAAG,MAAK,sBAAsB,GAAG;AAChL,eAAO,EAAE,OAAO,OAAO,WAAW,KAAK,OAAO,KAAK,EAAE;AAAA,MACvD;AACA,YAAM,SAAS,KAAK,OAAO,MAAM,WAAW;AAC5C,UAAI,OAAQ,MAAK,kBAAkB,GAAG;AACtC,YAAM,SAAS,KAAK,MAAM,GAAG,QAAQ,oDAAoD,EAAE,IAAI;AAC/F,UAAI,OAAO,SAAS,sBAAuB,MAAK,6BAA6B,GAAG;AAChF,WAAK,MAAM,GAAG,QAAQ,uKAAuK,EAC1L,IAAI,aAAa,UAAU,MAAM,KAAK,KAAK,KAAK,MAAM,KAAK,UAAU,UAAU,KAAK,SAAS,GAAG,KAAK,UAAU,QAAQ,UAAU,OAAO,GAAG,KAAK,IAAI,GAAG,KAAK,UAAU;AACzK,aAAO,EAAE,OAAO,MAAM,WAAW,KAAK,OAAO,KAAK,MAAM,GAAG,QAAQ,yDAAyD,EAAE,IAAI,WAAW,CAAC,EAAE;AAAA,IAClJ,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,gBAAgB,UAAe,mBAA4B;AACzD,UAAM,OAAO,KAAK,OAAO,QAAQ;AACjC,QAAI,sBAAsB,OAAW,YAAW,iBAAiB;AACjE,SAAK,UAAU,MAAM;AAAE,UAAI,KAAK,OAAO,MAAM,qBAAqB,EAAE,EAAG,MAAK,kBAAkB,GAAG;AAAA,IAAE,CAAC;AAAA,EACtG;AAAA;AAAA,EAEA,kBAAkB,aAAqB,SAAoC;AACzE,eAAW,WAAW;AACtB,WAAO,KAAK,UAAU,MAAM;AAC1B,WAAK,MAAM,SAAS,OAAO;AAC3B,YAAM,YAAY,KAAK,MAAM,GAAG,QAAQ,yDAAyD,EAAE,IAAI,WAAW;AAClH,YAAM,YAAY,KAAK,MAAM,GAAG,QAAQ,qCAAqC,EAAE,IAAI,WAAW;AAE9F,UAAI,UAAW,MAAK,MAAM,IAAI,UAAU,SAAS,OAAO;AACxD,UAAI,UAAW,MAAK,MAAM,IAAI,UAAU,SAAS,OAAO;AACxD,UAAI,CAAC,UAAW,QAAO,EAAE,aAAa,QAAQ,MAAM,UAAU,OAAO,QAAQ,sBAAsB;AACnG,UAAI,CAAC,UAAW,QAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,SAAS,IAAI,UAAU,MAAM,KAAK,KAAK,QAAQ,SAAS,GAAG,QAAQ,SAAS,IAAI,UAAU,MAAM,KAAK,KAAK,QAAQ,SAAS,IAAI,qBAAqB,eAAe;AAC7O,UAAI,CAAC,SAAS,IAAI,UAAU,MAAM,EAAG,QAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,OAAO,QAAQ,eAAe;AAC7H,UAAI,CAAC,KAAK,QAAQ,SAAS,EAAG,QAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,OAAO,QAAQ,mBAAmB;AAC1H,aAAO,EAAE,aAAa,QAAQ,UAAU,QAAQ,UAAU,KAAK,MAAM,GAAG,QAAQ,uDAAuD,EAAE,IAAI,WAAW,EAAE,UAAU,GAAG,QAAQ,KAAK;AAAA,IACtL,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,KAAK,SAAmB;AACtB,WAAO,KAAK,UAAU,MAAM;AAC1B,UAAI,YAAY,OAAW,MAAK,MAAM,SAAS,OAAO;AACtD,aAAO,KAAK,MAAM,GAAG,QAAQ,sEAAsE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAa,KAAK,OAAO,GAAG,CAAC,EAC1I,OAAO,CAAC,MAA0B,YAAY,UAAc,EAAE,aAAa,QAAQ,YAAY,EAAE,UAAU,QAAQ,SAAS,EAAE,WAAW,QAAQ,UAAU,EAAE,cAAc,QAAQ,SAAU;AAAA,IAClM,CAAC;AAAA,EACH;AAAA,EACQ,OAAO,OAA+B;AAC5C,QAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,MAAK,4BAA4B;AAC1G,UAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,QAAI,KAAK,WAAW,cAAc,UAAU,CAAC,KAAK,MAAM,OAAK,cAAc,SAAS,CAAC,CAAC,EAAG,MAAK,4BAA4B;AAC1H,UAAM,EAAE,KAAAC,MAAK,WAAW,MAAAC,OAAM,SAAS,IAAI;AAC3C,QAAI,OAAOD,SAAQ,YAAY,CAAC,MAAM,KAAKA,IAAG,EAAG,MAAK,4BAA4B;AAClF,QAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,CAAC,UAAU,UAAU,UAAU,SAAS,iBAAiB,UAAU,KAAK,CAAC,MAAW,OAAO,MAAM,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAAG,MAAK,4BAA4B;AAChM,UAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,SAAqB,CAAC;AAChD,QAAI,CAAC,MAAM,SAASA,IAAG,EAAG,MAAK,4BAA4B;AAC3D,QAAI,OAAOC,UAAS,YAAY,CAACA,MAAK,UAAUA,MAAK,SAAS,YAAYA,MAAK,SAAS,IAAI,KAAK,CAACC,YAAWD,KAAI,EAAG,MAAK,4BAA4B;AACrJ,QAAI,OAAO,aAAa,YAAY,CAAC,UAAU,IAAI,QAAQ,EAAG,MAAK,4BAA4B;AAC/F,WAAO,EAAE,KAAAD,MAAK,WAAW,OAAO,MAAAC,OAAM,SAAwC;AAAA,EAChF;AAAA;AAAA,EAEQ,OAAO,MAAyB,mBAA2B;AACjE,WAAO,KAAK,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA,gDAIe,EAAE,IAAI,EAAE,QAAQ,mBAAmB,KAAK,KAAK,KAAK,WAAW,UAAU,KAAK,SAAS,EAAE,CAAC,KAAK;AAAA,EAC3I;AAAA,EACQ,OAAO,KAA8B;AAC3C,UAAM,UAAU,KAAK,MAAM,IAAI,OAAO;AACtC,WAAO,EAAE,aAAa,IAAI,cAAc,MAAM,IAAI,MAAM,SAAS,IAAI,UAAU,MAAM,IAAI,MAAM,UAAU,IAAI,UAAU,WAAW,KAAK,MAAM,IAAI,SAAS,GAAG,UAAU,QAAQ,UAAU,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,WAAW,YAAY,IAAI,YAAY;AAAA,EACnS;AAAA;AAAA,EAEQ,QAAQ,WAAgB;AAC9B,QAAI,CAAC,SAAS,IAAI,UAAU,MAAM,EAAG,QAAO;AAC5C,QAAI,CAAC,oBAAoB,IAAI,UAAU,IAAI,EAAG,QAAO;AACrD,QAAI,SAAc;AAClB,QAAI;AAAE,eAAS,UAAU,SAAS,KAAK,MAAM,UAAU,MAAM,IAAI;AAAA,IAAK,QAAQ;AAAE,aAAO;AAAA,IAAM;AAC7F,WAAO,QAAQ,kBAAkB,QAAQ,QAAQ,eAAe;AAAA,EAClE;AAAA,EACQ,UAAa,IAAgB;AACnC,UAAM,KAAK,KAAK,MAAM;AACtB,QAAI,GAAG,cAAe,QAAO,GAAG;AAChC,QAAI;AAAE,SAAG,KAAK,iBAAiB;AAAA,IAAE,SAAS,GAAQ;AAAE,YAAM,KAAK,KAAK,CAAC;AAAA,IAAE;AACvE,QAAI;AAAE,YAAM,QAAQ,GAAG;AAAG,SAAG,KAAK,QAAQ;AAAG,aAAO;AAAA,IAAM,SAAS,GAAG;AAAE,UAAI;AAAE,WAAG,KAAK,UAAU;AAAA,MAAE,QAAQ;AAAA,MAAC;AAAC;AAAE,YAAM,KAAK,KAAK,CAAC;AAAA,IAAE;AAAA,EACnI;AAAA,EACQ,KAAK,GAAQ;AACnB,QAAI,aAAa,WAAY,QAAO;AACpC,QAAI,OAAO,GAAG,SAAS,aAAa,EAAE,KAAK,WAAW,aAAa,KAAK,EAAE,SAAS,iBAAkB,QAAO,IAAI,WAAW,iBAAiB,GAAG;AAC/I,WAAO;AAAA,EACT;AACF;;;ACpLA,SAAS,eAAe;AAGjB,IAAM,4BAA4B;AASlC,SAAS,gBAAgB,QAAgC,CAAC,GAAW;AAC1E,QAAM,UAAU,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAACE,KAAI,KAAK,MAAM,CAACA,KAAI,QAAQ,KAAK,CAAC,CAAU;AACxF,UAAQ,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAE;AAC/D,SAAO,IAAI,UAAU,OAAO,CAAC;AAC/B;AAkBO,SAAS,yBAAyB,IAAS,YAA0C;AAC1F,KAAG,KAAK,uFAAuF;AAC/F,QAAM,QAAQ,GAAG,QAAQ,oCAAoC,EAAE,IAAI,yBAAyB,GAAG;AAC/F,MAAI,UAAU,WAAY,QAAO,EAAE,SAAS,MAAM;AAClD,MAAI,UAAU,QAAW;AACvB,OAAG,QAAQ,+BAA+B,EAAE,IAAI,2BAA2B,UAAU;AACrF,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,QAAM,SAAS,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,8EAKkD,EAAE,IAAI,EAAE;AACpF,KAAG,QAAQ,qCAAqC,EAAE,IAAI,YAAY,yBAAyB;AAC3F,SAAO,EAAE,SAAS,MAAM,OAAO;AACjC;;;ACGA,SAAS,aAAAC,kBAAoD;AAC7D,SAAS,QAAAC,OAAM,SAAAC,QAAO,QAAAC,OAAM,YAAAC,WAAU,MAAM,UAAAC,eAAc;AAC1D,OAAOC,WAAU;AACjB,SAAS,eAAAC,oBAAmB;AAIrB,IAAM,yBAAyB;AAC/B,IAAM,+BAA+B,KAAK,OAAO;AACjD,IAAM,8BAA8B;AACpC,IAAM,8BAA8B;AACpC,IAAM,mCAAmC;AAChD,IAAM,2BAA2B;AACjC,IAAM,kBAAkBC,WAAU,WAAWA,WAAU,eAAeA,WAAU,cAAc;AAM9F,IAAM,aAAaA,WAAU,SAASA,WAAU,UAAUA,WAAU;AACpE,IAAM,MAAM,EAAE,QAAQ,KAAK;AAE3B,IAAM,YAAY,CAAC,MAAc,SAAS,KAAK,QAAiC,CAAC,MAAa;AAAE,QAAM,OAAO,OAAO,IAAI,WAAW,MAAM,MAAM,GAAG,KAAK;AAAE;AAMzJ,IAAM,mBAAmB,CAAC,MAAc,SAAS,KAAK,QAAiC,CAAC,MAAa;AAAE,QAAM,OAAO,OAAO,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE,WAAW,MAAM,iBAAiB,MAAM,GAAG,MAAM,CAAC;AAAE;AAE/M,IAAM,oBAAoB,CAAC,MAAwB,aAAa,aAAa,OAAO,OAAO,GAAG,EAAE,WAAW,MAAM,iBAAiB,KAAK,CAAC,IAAI;AAU5I,IAAM,iBAAiB,OAAO,QAAyB,aAAoE;AACzH,MAAI,OAAO;AACX,MAAI;AAAE,UAAMC,QAAO,OAAO,UAAU,QAAQ,CAAC;AAAA,EAAE,SAAS,GAAG;AAAE,WAAO,OAAO,CAAC;AAAA,EAAE;AAC9E,MAAI;AAAE,QAAK,MAAM,OAAO,WAAW,QAAQ,MAAO,KAAM,QAAO,EAAE,SAAS,MAAM,QAAQ,KAAK;AAAA,EAAE,SAAS,GAAG;AAAE,WAAO,OAAO,CAAC;AAAA,EAAE;AAC9H,SAAO,EAAE,SAAS,OAAO,QAAQ,KAAK;AACxC;AAEA,IAAM,QAAQ,OAAU,MAAwB,WAA+B;AAC7E,MAAI;AAAE,WAAO,MAAM,KAAK;AAAA,EAAE,SAAS,GAAG;AAAE,QAAI,aAAa,WAAY,OAAM;AAAG,UAAM,OAAO,OAAO,IAAI,WAAW,uBAAuB,GAAG,GAAG,EAAE,QAAQ,QAAQ,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAAA,EAAE;AACzL;AAEA,IAAM,iBAAiB,OAAU,MAAwB,WAA+B,MAAM,MAAM,MAAM,EAAE,MAAM,OAAK;AAAE,QAAM,kBAAkB,CAAC;AAAE,CAAC;AACrJ,IAAM,SAAS,CAAC,MAAwB,KAAK,OAAO,MAAM,YAAY,OAAQ,EAAyB,SAAS,WAAY,EAAuB,OAAO;AAC1J,IAAM,aAAa,CAAC,OAAqD,EAAE,KAAK,OAAO,EAAE,GAAG,GAAG,KAAK,OAAO,EAAE,GAAG,EAAE;AAG3G,SAAS,qBAAqB,WAAmB,QAAQ,UAAmB;AAAE,SAAO,aAAa;AAAQ;AAW1G,IAAM,kBAAN,MAAM,iBAAgB;AAAA,EACnB,YAA6B,QAA6B,UAAkB;AAA/C;AAA6B;AAAA,EAAoB;AAAA,EAAjD;AAAA,EAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlE,aAAa,IAAI,cAAsB,aAAgC,CAAC,GAA6B;AACnG,QAAI,CAAC,qBAAqB,EAAG,WAAU,4BAA4B,KAAK,EAAE,UAAU,QAAQ,SAAS,CAAC;AACtG,QAAI,OAAO,iBAAiB,YAAY,CAAC,gBAAgB,aAAa,SAAS,IAAI,KAAK,CAACC,MAAK,MAAM,WAAW,YAAY,KAAK,OAAO,WAAW,YAAY,IAAI,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,WAAW,CAAC;AACxP,eAAW,QAAQ,WAAY,KAAI,OAAO,SAAS,YAAY,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,GAAG,KAAK,SAAS,OAAO,SAAS,QAAQ,OAAO,WAAW,IAAI,IAAI,iCAAkC,WAAU,oBAAoB,KAAK,EAAE,QAAQ,gBAAgB,CAAC;AAChR,UAAM,QAAQ,CAAC,GAAG,aAAa,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG,GAAG,UAAU;AACxE,QAAI;AACJ,QAAI;AAAE,eAAS,MAAMC,MAAK,KAAK,eAAe;AAAA,IAAE,SAAS,GAAG;AAAE,YAAM,MAAM,kBAAkB,GAAG,KAAK,MAAM;AAAA,IAAE;AAC5G,eAAW,QAAQ,OAAO;AACxB,YAAM,QAAQ,GAAG,eAAe,MAAM,CAAC,IAAI,IAAI;AAC/C,UAAI;AACJ,UAAI;AAAE,eAAO,MAAMA,MAAK,OAAO,eAAe;AAAA,MAAE,SAAS,GAAG;AAI1D,YAAI;AACJ,YAAI;AAAE,mBAAS,MAAM,kBAAkB,GAAG,OAAO,WAAW;AAAA,QAAE,UAAE;AAAU,gBAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,UAAE,CAAC;AAAA,QAAE;AAChH,cAAM;AAAA,MACR;AACA,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAAE,CAAC;AACpC,eAAS;AAAA,IACX;AACA,WAAO,IAAI,iBAAgB,QAAQD,MAAK,MAAM,KAAK,cAAc,GAAG,UAAU,CAAC;AAAA,EACjF;AAAA,EACA,IAAI,KAAa;AAAE,WAAO,KAAK,OAAO;AAAA,EAAG;AAAA;AAAA,EAEzC,IAAI,SAAiB;AAAE,WAAO,eAAe,KAAK,MAAM;AAAA,EAAE;AAAA;AAAA,EAE1D,IAAI,WAAmB;AAAE,WAAO,GAAG,KAAK,MAAM;AAAA,EAAI;AAAA;AAAA,EAElD,UAAU,MAAsB;AAAE,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAAG;AAAA,EAClE,MAAM,WAAoC;AAAE,WAAO,WAAW,MAAM,KAAK,OAAO,KAAK,GAAG,CAAC;AAAA,EAAE;AAAA;AAAA,EAE3F,MAAM,WAAW,MAA2C;AAC1D,QAAI;AAAE,aAAO,MAAME,OAAM,KAAK,UAAU,IAAI,GAAG,GAAG;AAAA,IAAE,SAAS,GAAG;AAAE,UAAI,OAAO,CAAC,MAAM,SAAU,QAAO;AAAM,YAAM,MAAM,kBAAkB,GAAG,KAAK,UAAU,IAAI,GAAG,OAAO;AAAA,IAAE;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,kBAAyC;AAC5D,UAAM,SAAS,MAAMC,UAAS,KAAK,MAAM,EAAE,MAAM,MAAM,IAAI;AAC3D,QAAI,WAAW,iBAAkB,WAAU,qBAAqB,KAAK,EAAE,QAAQ,mBAAmB,UAAU,kBAAkB,OAAO,CAAC;AACtI,UAAM,UAAU,MAAMC,MAAK,kBAAkB,GAAG,EAAE,MAAM,MAAM,IAAI;AAClE,QAAI,CAAC,QAAS,WAAU,qBAAqB,KAAK,EAAE,QAAQ,wBAAwB,UAAU,iBAAiB,CAAC;AAChH,UAAM,SAAS,MAAM,MAAM,MAAM,KAAK,SAAS,GAAG,iBAAiB;AACnE,QAAI,OAAO,QAAQ,OAAO,QAAQ,GAAG,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG,EAAG,WAAU,qBAAqB,KAAK,EAAE,QAAQ,uBAAuB,UAAU,WAAW,OAAO,GAAG,QAAQ,OAAO,CAAC;AAAA,EAAG;AAAA;AAAA,EAEvM,MAAM,OAAsB;AAAE,UAAM,KAAK,OAAO,KAAK,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AAAA,EAAE;AAAA,EACxE,MAAM,QAAuB;AAAE,UAAM,KAAK,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AAAA,EAAE;AAC5E;AAEA,IAAM,iBAAiB,CAAC,WAA+B,SAAS,QAAQ,GAAG,OAAO,OAAO,EAAE;AAE3F,eAAe,kBAAkB,GAAY,IAAY,OAAoC;AAC3F,QAAM,OAAO,OAAO,CAAC;AACrB,MAAI,SAAS,QAAS,QAAO,OAAO,OAAO,IAAI,WAAW,2BAA2B,GAAG,GAAG,EAAE,QAAQ,qBAAqB,IAAI,MAAM,CAAC;AACrI,MAAI,SAAS,WAAW;AAOtB,UAAM,QAAQ,MAAMF,OAAM,IAAI,GAAG,EAAE,MAAM,MAAM,IAAI;AACnD,QAAI,OAAO,eAAe,EAAG,QAAO,OAAO,OAAO,IAAI,WAAW,2BAA2B,GAAG,GAAG,EAAE,QAAQ,qBAAqB,IAAI,OAAO,QAAQ,KAAK,CAAC;AAC1J,WAAO,OAAO,OAAO,IAAI,WAAW,yBAAyB,GAAG,GAAG,EAAE,QAAQ,QAAQ,4BAA4B,sBAAsB,IAAI,OAAO,QAAQ,KAAK,CAAC;AAAA,EAClK;AACA,MAAI,SAAS,YAAY,SAAS,YAAa,QAAO,OAAO,OAAO,IAAI,WAAW,yBAAyB,GAAG,GAAG,EAAE,QAAQ,qBAAqB,IAAI,MAAM,CAAC;AAC5J,MAAI,SAAS,YAAY,SAAS,QAAS,QAAO,OAAO,OAAO,IAAI,WAAW,uBAAuB,GAAG,GAAG,EAAE,QAAQ,cAAc,IAAI,OAAO,QAAQ,KAAK,CAAC;AAC7J,SAAO,OAAO,OAAO,IAAI,WAAW,uBAAuB,GAAG,GAAG,EAAE,QAAQ,kBAAkB,IAAI,OAAO,QAAQ,KAAK,CAAC;AACxH;AAGA,eAAe,YAAY,UAAoC;AAC7D,MAAI,OAAO,aAAa,YAAY,CAAC,YAAY,SAAS,SAAS,IAAI,KAAK,CAACF,MAAK,MAAM,WAAW,QAAQ,KAAK,OAAO,WAAW,QAAQ,IAAI,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,YAAY,CAAC;AACrO,MAAI;AAAE,WAAO,MAAMG,UAAS,QAAQ;AAAA,EAAE,SAAS,GAAG;AAChD,UAAM,OAAO,OAAO,CAAC;AACrB,QAAI,SAAS,YAAY,SAAS,UAAW,WAAU,yBAAyB,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,KAAK,CAAC;AAC7H,QAAI,SAAS,QAAS,WAAU,2BAA2B,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,KAAK,CAAC;AACxG,cAAU,uBAAuB,KAAK,EAAE,QAAQ,mBAAmB,QAAQ,KAAK,CAAC;AAAA,EACnF;AACF;AAGA,SAAS,gBAAgB,cAAiC;AACxD,MAAI,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,KAAK,OAAO,WAAW,YAAY,IAAI,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,gBAAgB,CAAC;AACpM,MAAIH,MAAK,MAAM,WAAW,YAAY,EAAG,WAAU,2BAA2B,KAAK,EAAE,QAAQ,yBAAyB,CAAC;AACvH,QAAM,QAAQ,aAAa,MAAM,OAAO,EAAE,OAAO,OAAO;AACxD,MAAI,CAAC,MAAM,UAAU,MAAM,SAAS,4BAA6B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,mBAAmB,OAAO,MAAM,OAAO,CAAC;AACtJ,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,OAAO,SAAS,KAAM,WAAU,2BAA2B,KAAK,EAAE,QAAQ,iBAAiB,WAAW,KAAK,CAAC;AACzH,QAAI,OAAO,WAAW,IAAI,IAAI,iCAAkC,WAAU,oBAAoB,KAAK,EAAE,QAAQ,qBAAqB,CAAC;AACnI,QAAI,QAAQ,KAAK,IAAI,EAAG,WAAU,oBAAoB,KAAK,EAAE,QAAQ,mBAAmB,CAAC;AACzF,QAAI,wBAAwB,KAAK,IAAI,EAAG,WAAU,oBAAoB,KAAK,EAAE,QAAQ,oBAAoB,CAAC;AAAA,EAC5G;AACA,SAAO;AACT;AAEA,SAAS,SAAS,SAAkB,UAA2B;AAC7D,MAAI,aAAa,UAAa,aAAa,UAAU,aAAa,SAAU,WAAU,oBAAoB,KAAK,EAAE,QAAQ,WAAW,CAAC;AACrI,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI,aAAa,UAAU;AACzB,YAAM,UAAU,QAAQ,QAAQ,QAAQ,EAAE;AAC1C,UAAI,CAAC,yBAAyB,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAM,EAAG,WAAU,oBAAoB,KAAK,EAAE,QAAQ,SAAS,CAAC;AAChI,aAAO,OAAO,KAAK,SAAS,QAAQ;AAAA,IACtC;AACA,WAAO,OAAO,KAAK,SAAS,MAAM;AAAA,EACpC;AACA,MAAI,mBAAmB,YAAY;AACjC,QAAI;AAAE,aAAO,OAAO,KAAK,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU;AAAA,IAAE,QAAQ;AAAE,gBAAU,oBAAoB,KAAK,EAAE,QAAQ,iBAAiB,CAAC;AAAA,IAAE;AAAA,EAC9J;AACA,YAAU,oBAAoB,KAAK,EAAE,QAAQ,eAAe,CAAC;AAC/D;AAEA,eAAe,SAAS,QAAoB,MAAc,QAAqC;AAC7F,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,YAAY;AAC/B,QAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,gBAAgB,iBAAiB,MAAM,CAAC;AACzG,UAAM,UAAU,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,QAAQ,KAAK,aAAa,MAAM,GAAG,YAAY;AACpG,QAAI,CAAC,QAAQ,aAAc,WAAU,uBAAuB,KAAK,EAAE,QAAQ,eAAe,OAAO,CAAC;AAClG,cAAU,QAAQ;AAAA,EACpB;AACF;AAmEA,eAAsB,oBAAoB,SAAyD;AACjG,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,WAAU,oBAAoB,KAAK,EAAE,QAAQ,UAAU,CAAC;AACrG,QAAM,EAAE,UAAU,cAAc,SAAS,UAAU,WAAW,wBAAwB,QAAQ,MAAM,IAAI;AACxG,MAAI,CAAC,qBAAqB,EAAG,WAAU,4BAA4B,KAAK,EAAE,UAAU,QAAQ,SAAS,CAAC;AACtG,MAAI,UAAU,UAAa,OAAO,UAAU,WAAY,WAAU,oBAAoB,KAAK,EAAE,QAAQ,QAAQ,CAAC;AAC9G,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,KAAK,WAAW,6BAA8B,WAAU,oBAAoB,KAAK,EAAE,QAAQ,YAAY,CAAC;AAC1J,QAAM,OAAO,SAAS,SAAS,QAAQ;AACvC,MAAI,KAAK,aAAa,SAAU,WAAU,oBAAoB,KAAK,EAAE,QAAQ,qBAAqB,OAAO,SAAS,CAAC;AACnH,QAAMK,UAAS,IAAI,IAAI;AACvB,QAAM,aAAa,gBAAgB,YAAY;AAC/C,QAAM,OAAO,MAAM,YAAY,QAAQ;AACvC,QAAM,aAAa,WAAW,WAAW,SAAS,CAAC;AACnD,QAAM,gBAAgBL,MAAK,MAAM,KAAK,MAAM,GAAG,WAAW,MAAM,GAAG,EAAE,CAAC;AACtE,QAAM,aAAaA,MAAK,MAAM,KAAK,eAAe,UAAU;AAM5D,QAAM,WAAW,MAAME,OAAM,eAAe,GAAG,EAAE,MAAM,OAAK;AAC1D,UAAM,OAAO,OAAO,CAAC;AACrB,QAAI,SAAS,YAAY,SAAS,UAAW,WAAU,yBAAyB,KAAK,EAAE,QAAQ,kBAAkB,IAAI,cAAc,CAAC;AACpI,QAAI,SAAS,QAAS,WAAU,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,IAAI,cAAc,CAAC;AAC/G,cAAU,uBAAuB,KAAK,EAAE,QAAQ,qBAAqB,IAAI,eAAe,QAAQ,KAAK,CAAC;AAAA,EACxG,CAAC;AACD,MAAI,SAAS,eAAe,EAAG,WAAU,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,IAAI,cAAc,CAAC;AACxH,MAAI,CAAC,SAAS,YAAY,EAAG,WAAU,yBAAyB,KAAK,EAAE,QAAQ,wBAAwB,IAAI,cAAc,CAAC;AAC1H,QAAM,SAAS,CAAC,OAAyB,UAAmE,EAAE,OAAO,UAAU,MAAM,eAAe,WAAW,WAAW,QAAQ,GAAG,YAAY,YAAY,MAAM,KAAK,YAAY,QAAQG,SAAQ,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG;AAC9Q,MAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,cAAc,iBAAiB,MAAM,CAAC;AACvG,MAAI,MAAO,OAAM,MAAM,OAAO,YAAY,CAAC;AAG3C,QAAM,SAAS,MAAM,gBAAgB,IAAI,MAAM,WAAW,MAAM,GAAG,EAAE,CAAC;AACtE,MAAI,WAAW;AACf,MAAI;AACJ,MAAI,cAAc;AAClB,MAAI;AACF,UAAM,OAAO,eAAe,aAAa;AACzC,QAAI,MAAM,OAAO,WAAW,UAAU,EAAG,WAAU,iBAAiB,KAAK,EAAE,QAAQ,WAAW,CAAC;AAC/F,eAAW,GAAG,wBAAwB,GAAGC,aAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AACxE,UAAM,OAAO,MAAML,MAAK,OAAO,UAAU,QAAQ,GAAG,YAAY,GAAK,EAAE,MAAM,OAAK;AAChF,YAAM,OAAO,OAAO,CAAC;AACrB,UAAI,SAAS,SAAU,WAAU,uBAAuB,KAAK,EAAE,QAAQ,sBAAsB,CAAC;AAC9F,UAAI,SAAS,YAAY,SAAS,QAAS,WAAU,uBAAuB,KAAK,EAAE,QAAQ,mBAAmB,QAAQ,KAAK,CAAC;AAC5H,gBAAU,uBAAuB,KAAK,EAAE,QAAQ,eAAe,QAAQ,KAAK,CAAC;AAAA,IAC/E,CAAC;AACD,WAAO;AAEP,UAAM,KAAK,MAAM,GAAK,EAAE,MAAM,OAAK,UAAU,uBAAuB,KAAK,EAAE,QAAQ,cAAc,QAAQ,OAAO,CAAC,EAAE,CAAC,CAAC;AACrH,QAAI;AACJ,UAAM,SAAS,MAAM,MAAM,MAAM;AACjC,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AAEjC,UAAM,aAAa,OAAO,UAAwC;AAChE,YAAM,UAAU,MAAM,MAAM,MAAM,KAAK,KAAK,GAAG,GAAG,WAAW;AAC7D,UAAI,CAAC,QAAQ,OAAO,EAAG,WAAU,yBAAyB,KAAK,EAAE,QAAQ,oBAAoB,MAAM,CAAC;AACpG,UAAI,QAAQ,SAAS,OAAO,KAAK,UAAU,EAAG,WAAU,yBAAyB,KAAK,EAAE,QAAQ,aAAa,OAAO,MAAM,OAAO,QAAQ,IAAI,EAAE,CAAC;AAChJ,WAAK,OAAO,QAAQ,IAAI,IAAI,SAAW,IAAO,WAAU,yBAAyB,KAAK,EAAE,QAAQ,aAAa,OAAO,MAAM,OAAO,QAAQ,IAAI,IAAI,IAAM,CAAC;AACxJ,UAAI,QAAQ,UAAU,GAAI,WAAU,yBAAyB,KAAK,EAAE,QAAQ,eAAe,OAAO,OAAO,OAAO,QAAQ,KAAK,EAAE,CAAC;AAChI,aAAO;AAAA,IACT;AACA,cAAU,MAAM,WAAW,SAAS;AACpC,QAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,kBAAkB,iBAAiB,MAAM,CAAC;AAC3G,QAAI,MAAO,OAAM,MAAM,OAAO,kBAAkB,EAAE,MAAM,UAAU,UAAU,WAAW,OAAO,GAAG,MAAM,OAAO,QAAQ,IAAI,IAAI,KAAO,MAAM,OAAO,QAAQ,IAAI,EAAE,CAAC,CAAC;AAClK,cAAU,MAAM,WAAW,aAAa;AAGxC,UAAM,OAAO,eAAe,aAAa;AACzC,QAAI,MAAM,OAAO,WAAW,UAAU,EAAG,WAAU,iBAAiB,KAAK,EAAE,QAAQ,WAAW,CAAC;AAC/F,QAAI,QAAQ,QAAS,WAAU,mBAAmB,KAAK,EAAE,QAAQ,eAAe,iBAAiB,MAAM,CAAC;AACxG,UAAM,KAAK,OAAO,UAAU,QAAQ,GAAG,OAAO,UAAU,UAAU,CAAC,EAAE,MAAM,OAAK;AAC9E,YAAM,OAAO,OAAO,CAAC;AACrB,UAAI,SAAS,SAAU,WAAU,iBAAiB,KAAK,EAAE,QAAQ,WAAW,CAAC;AAC7E,UAAI,SAAS,QAAS,WAAU,uBAAuB,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,KAAK,CAAC;AACpG,UAAI,SAAS,YAAY,SAAS,QAAS,WAAU,uBAAuB,KAAK,EAAE,QAAQ,sBAAsB,QAAQ,KAAK,CAAC;AAC/H,gBAAU,uBAAuB,KAAK,EAAE,QAAQ,WAAW,QAAQ,KAAK,CAAC;AAAA,IAC3E,CAAC;AACD,UAAM,YAAY,MAAM,eAAe,MAAM,OAAO,WAAW,UAAU,GAAG,wBAAwB;AACpG,QAAI,CAAC,aAAa,CAAC,UAAU,OAAO,KAAK,OAAO,UAAU,GAAG,MAAM,OAAO,QAAQ,GAAG,KAAK,OAAO,UAAU,GAAG,MAAM,OAAO,QAAQ,GAAG,EAAG,kBAAiB,yBAAyB,KAAK,EAAE,QAAQ,qBAAqB,CAAC;AACxN,QAAI,QAAQ,QAAS,kBAAiB,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQI,QAAO,EAAE,CAAC;AAC9J,UAAM,OAAO,KAAK;AAKlB,UAAM,UAAU,MAAM,eAAe,QAAQ,QAAQ;AACrD,QAAI,CAAC,QAAQ,QAAS,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,uBAAuB,MAAM,UAAU,QAAQ,QAAQ,OAAO,CAAC;AAChJ,kBAAc;AACd,UAAM,OAAO,KAAK;AAKlB,UAAM,kBAAkB,OAAO,OAAe,aAAiE;AAC7G,YAAM,UAAU,MAAM,eAAe,MAAM,OAAO,WAAW,UAAU,GAAG,gBAAgB;AAC1F,UAAI,CAAC,WAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,GAAG,MAAM,SAAS,OAAO,OAAO,QAAQ,GAAG,MAAM,SAAS,IAAK,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,sBAAsB,OAAO,QAAQ,WAAW,CAAC;AAC/N,UAAI,QAAQ,SAAS,OAAO,KAAK,UAAU,EAAG,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,OAAO,QAAQ,WAAW,CAAC;AACtJ,WAAK,OAAO,QAAQ,IAAI,IAAI,SAAW,IAAO,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,kBAAkB,OAAO,QAAQ,WAAW,CAAC;AAGtJ,UAAI,QAAQ,UAAU,GAAI,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,yBAAyB,OAAO,QAAQ,YAAY,OAAO,OAAO,QAAQ,KAAK,EAAE,CAAC;AACvK,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM,gBAAgB,iBAAiB,EAAE,KAAK,OAAO,UAAU,GAAG,GAAG,KAAK,OAAO,UAAU,GAAG,EAAE,CAAC;AAM/G,QAAI,SAAS;AACb,WAAO,SAAS,KAAK,YAAY;AAC/B,YAAM,OAAO,KAAK,IAAI,OAAO,KAAK,aAAa,MAAM;AACrD,YAAM,QAAQ,OAAO,YAAY,IAAI;AACrC,YAAM,OAAO,MAAM,eAAe,MAAM,KAAK,KAAK,OAAO,GAAG,MAAM,MAAM,GAAG,gBAAgB;AAC3F,UAAI,KAAK,cAAc,KAAM,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,wBAAwB,QAAQ,UAAU,MAAM,MAAM,KAAK,UAAU,CAAC;AAC9J,UAAI,MAAM,QAAQ,KAAK,SAAS,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAG,kBAAiB,2BAA2B,KAAK,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AACvJ,gBAAU;AAAA,IACZ;AACA,QAAI,QAAQ,QAAS,kBAAiB,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQA,QAAO,EAAE,CAAC;AAC9J,UAAM,UAAU,MAAM,gBAAgB,mBAAmB,EAAE,KAAK,OAAO,MAAM,GAAG,GAAG,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC;AAI3G,UAAM,YAAY,MAAM,eAAe,MAAM,OAAO,SAAS,GAAG,qBAAqB;AACrF,UAAM,SAA4B,EAAE,MAAM,YAAY,eAAe,WAAW,KAAK,OAAO,QAAQ,GAAG,GAAG,KAAK,OAAO,QAAQ,GAAG,GAAG,OAAO,OAAO,QAAQ,KAAK,GAAG,MAAM,OAAO,QAAQ,IAAI,GAAG,QAAQA,QAAO;AAG7M,QAAI;AAAE,YAAM,OAAO,eAAe,aAAa;AAAA,IAAE,SAAS,GAAG;AAAE,YAAM,kBAAkB,CAAC;AAAA,IAAE;AAC1F,QAAI,OAAO;AACT,YAAM,eAAe,EAAE,GAAG,OAAO,eAAe,GAAG,UAAU;AAC7D,UAAI;AAAE,cAAM,MAAM,YAAY;AAAA,MAAE,SAAS,GAAG;AAC1C,cAAM,OAAO,OAAO,IAAI,WAAW,2BAA2B,GAAG,GAAG,EAAE,iBAAiB,MAAM,WAAW,MAAM,OAAO,EAAE,CAAC;AAAA,MAC1H;AAAA,IACF;AACA,WAAO;AAAA,EACT,UAAE;AAIA,QAAI,YAAY,CAAC,YAAa,OAAMN,QAAO,OAAO,UAAU,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AACtF,UAAM,MAAM,MAAM,EAAE,MAAM,MAAM;AAAA,IAAE,CAAC;AACnC,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;;;AC7cA,SAAS,YAAAQ,WAAU,QAAAC,OAAM,aAAAC,kBAAiB;AAC1C,SAAS,cAAAC,aAAY,QAAAC,OAAM,UAAU,WAAAC,gBAAe;;;ACDpD,SAAS,eAAAC,oBAAmB;;;ACA5B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,YAAAC,WAAU,YAAAC,WAAU,QAAAC,OAAM,SAAAC,QAAO,aAAAC,kBAAiB;AAC3D,SAAS,SAAAC,cAAa;AACtB,SAAS,cAAAC,aAAY,QAAAC,aAAY;;;ACHjC,SAAS,SAAAC,cAAa;AACtB,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,UAAAC,SAAQ,YAAAC,iBAAgB;AACjC,SAAS,cAAAC,aAAY,QAAAC,aAAY;AACjC,SAAS,qBAAqB;AAE9B,IAAM,OAAO,cAAc,IAAI,IAAI,KAAK,YAAY,GAAG,CAAC;AACxD,IAAM,YAAY;AAGX,SAAS,mBAAmB,MAAM,SAAS,QAAQ,KAAK;AAC7D,QAAMC,OAAM;AAAA,IAAE,MAAM;AAAA,IAAM,aAAa;AAAA,IAAM,SAASD,MAAK,MAAM,SAAS;AAAA,IAAG,cAAcA,MAAK,MAAM,OAAO;AAAA,IAC3G,YAAY;AAAA,IAAM,gBAAgBA,MAAK,MAAM,OAAO;AAAA,IAAG,iBAAiBA,MAAK,MAAM,QAAQ;AAAA,IAC3F,eAAeA,MAAK,MAAM,MAAM;AAAA,IAAG,MAAMA,MAAK,MAAM,KAAK;AAAA,IAAG,KAAKA,MAAK,MAAM,KAAK;AAAA,IAAG,QAAQA,MAAK,MAAM,KAAK;AAAA,IAC5G,UAAU;AAAA,IAAK,kBAAkB;AAAA,IAAS,YAAY;AAAA,EAAI;AAC5D,aAAWE,QAAO,CAAC,cAAc,UAAU,WAAW,QAAQ,QAAQ,EAAG,KAAI,OAAOA,IAAG,EAAG,CAAAD,KAAIC,IAAG,IAAI,OAAOA,IAAG;AAE/G,EAAAD,KAAI,OAAO,QAAQ,aAAa,UAAUD,MAAK,OAAO,cAAc,eAAe,UAAU,IAAI;AACjG,SAAOC;AACT;AAEA,eAAsB,oBAAoB,EAAE,SAAS,mBAAmB,IAAI,CAAC,GAAG;AAC9E,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,aAAaD,MAAK,QAAQ,IAAI,cAAc,eAAe,gDAAgD;AACjH,UAAMH,QAAO,UAAU;AACvB,WAAO,OAAO,OAAO,EAAE,YAAY,MAAMC,UAAS,UAAU,GAAG,QAAQ,CAAC,WAAW,cAAc,mBAAmB,oBAAoB,UAAU,SAASE,MAAK,MAAM,iBAAiB,CAAC,GAAG,UAAU,QAAQ,CAAC;AAAA,EAChN;AACA,MAAI,QAAQ,aAAa,WAAW,CAACD,YAAW,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAClG,QAAMF,QAAO,MAAM;AACnB,SAAO,OAAO,OAAO,EAAE,YAAY,MAAMC,UAAS,MAAM,GAAG,QAAQ,CAAC,MAAME,MAAK,MAAM,gBAAgB,CAAC,GAAG,UAAU,QAAQ,CAAC;AAC9H;AAGO,SAAS,cAAc,QAAQ,MAAM,MAAM,EAAE,MAAM,KAAAC,OAAM,mBAAmB,IAAI,EAAE,IAAI,CAAC,GAAG;AAC/F,QAAM,SAAS,IAAIL,cAAa;AAChC,QAAMO,QAAO,OAAO,aAAa,UAAU,CAAC,GAAG,OAAO,QAAQ,SAAS,IAAI,IAAI,CAAC,GAAG,OAAO,QAAQ,IAAI;AACtG,QAAM,QAAQR,OAAM,OAAO,YAAYQ,OAAM,EAAE,KAAK,MAAM,KAAAF,MAAK,aAAa,MAAM,OAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AACjI,MAAI,OAAO,IAAI,SAAS,IAAI,QAAQ,GAAGG,UAAS;AAChD,QAAM,UAAU,IAAI,cAAc,MAAM,GAAG,aAAa,IAAI,cAAc,MAAM;AAChF,MAAI,YAAY;AAChB,QAAM,QAAQ,WAAS;AACrB,QAAI,SAAS,eAAe,MAAM,SAAS,cAAc;AACvD,UAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAC5G,mBAAa,WAAW,MAAM,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAC/D,UAAI,OAAO,WAAW,SAAS,IAAI,UAAW,OAAM,IAAI,MAAM,iBAAiB;AAC/E,UAAI;AACJ,cAAQ,MAAM,UAAU,QAAQ,IAAI,MAAM,GAAG;AAC3C,cAAM,OAAO,UAAU,MAAM,GAAG,GAAG;AAAG,oBAAY,UAAU,MAAM,MAAM,CAAC;AACzE,YAAI,KAAK,KAAK,EAAG,QAAO,KAAK,WAAW,KAAK,MAAM,IAAI,CAAC;AAAA,MAC1D;AAAA,IACF,MAAO,QAAO,KAAK,MAAM,UAAU,YAAY,WAAW,KAAK;AAAA,EACjE;AACA,QAAM,OAAO,IAAI,QAAQ,CAAAC,aAAW,MAAM,KAAK,SAAS,CAAC,MAAM,WAAW;AAAE,IAAAD,UAAS;AAAM,WAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAAG,IAAAC,SAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,EAAE,CAAC,CAAC;AAChK,QAAM,GAAG,SAAS,CAAAC,WAAS,OAAO,KAAK,WAAWA,MAAK,CAAC;AACxD,QAAM,MAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAChC,QAAM,OAAO,GAAG,QAAQ,UAAQ;AAAE,YAAQ,OAAO,KAAK,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,EAAE,CAAC;AACtF,QAAM,OAAO,GAAG,QAAQ,WAAS;AAC/B,aAAS,MAAM;AACf,cAAU,QAAQ,MAAM,KAAK;AAC7B,QAAI,QAAQ,IAAI,OAAO,QAAQ,OAAO,WAAW,MAAM,IAAI,WAAW;AAAE,aAAO,KAAK,WAAW,IAAI,MAAM,cAAc,CAAC;AAAG,YAAM,MAAM,IAAI;AAAG;AAAA,IAAO;AACrJ,QAAI;AACJ,YAAQ,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG;AACxC,YAAM,OAAO,OAAO,MAAM,GAAG,GAAG;AAAG,eAAS,OAAO,MAAM,MAAM,CAAC;AAChE,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AAAE,cAAM,KAAK,MAAM,IAAI,CAAC;AAAA,MAAE,QACxB;AAAE,eAAO,KAAK,WAAW,IAAI,MAAM,sBAAsB,CAAC;AAAG,cAAM,MAAM,IAAI;AAAA,MAAE;AAAA,IACvF;AAAA,EACF,CAAC;AACD,QAAM,OAAO,WAAS,IAAI,QAAQ,CAACD,UAAS,WAAW;AACrD,UAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAID,WAAU,OAAO,WAAW,IAAI,IAAI,WAAW;AAAE,aAAO,IAAI,MAAMA,UAAS,kBAAkB,aAAa,CAAC;AAAG;AAAA,IAAO;AACzH,UAAM,MAAM,MAAM,MAAM,CAAAE,WAASA,SAAQ,OAAOA,MAAK,IAAID,SAAQ,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,KAAM,MAAK,KAAK,IAAI,EAAE,MAAM,CAAAC,WAAS,OAAO,KAAK,WAAWA,MAAK,CAAC;AACtE,WAAS,YAAY,MAAM,YAAY,MAAQ;AAC7C,WAAO,IAAI,QAAQ,CAACD,UAAS,WAAW;AACtC,YAAM,QAAQ,MAAM;AAAE,qBAAa,KAAK;AAAG,eAAO,IAAI,WAAWE,QAAO;AAAG,eAAO,IAAI,UAAU,KAAK;AAAG,eAAO,IAAI,WAAW,MAAM;AAAA,MAAE;AACtI,YAAMA,WAAU,WAAS;AAAE,YAAI,MAAM,YAAY,MAAM;AAAE,gBAAM;AAAG,UAAAF,SAAQ,KAAK;AAAA,QAAE;AAAA,MAAE;AACnF,YAAM,QAAQ,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC;AAAA,MAAE;AAC7G,YAAM,SAAS,CAAAC,WAAS;AAAE,cAAM;AAAG,eAAOA,MAAK;AAAA,MAAE;AACjD,YAAM,QAAQ,WAAW,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,UAAU,CAAC;AAAA,MAAE,GAAG,SAAS;AAChH,aAAO,GAAG,WAAWC,QAAO;AAAG,aAAO,KAAK,UAAU,KAAK;AAAG,aAAO,KAAK,WAAW,MAAM;AAC1F,UAAIH,QAAQ,OAAM;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,QAAQ,MAAM,MAAM,aAAa,KAAK,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,SAAS;AAAE,WAAO;AAAA,EAAK,GAAG,IAAI,SAAS;AAAE,WAAOA;AAAA,EAAO,EAAE,CAAC;AAC7J;AAEA,eAAsB,gBAAgB,EAAE,MAAM,OAAO,IAAI,CAAC,GAAG;AAC3D,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,oBAAoB,EAAE,OAAO,CAAC;AACnD,WAAO,cAAc,QAAQ,SAAS,MAAM,EAAE,KAAK,CAAC;AACpD,UAAM,QAAQ,MAAM,IAAI,QAAQ,CAACC,UAAS,WAAW;AACnD,WAAK,OAAO,KAAK,WAAWA,QAAO;AACnC,WAAK,OAAO,KAAK,WAAW,MAAM;AAClC,WAAK,OAAO,KAAK,UAAU,MAAM,OAAO,IAAI,MAAM,qBAAqB,CAAC,CAAC;AAAA,IAC3E,CAAC;AACD,UAAM,KAAK;AACX,WAAO,EAAE,GAAG,OAAO,QAAQ,aAAa,OAAO,aAAa,UAAU,CAAC,iHAAiH,IAAI,CAAC,EAAE;AAAA,EACjM,SAASC,QAAO;AAAE,WAAO,EAAE,WAAW,OAAO,MAAM,2BAA2B,QAAQA,OAAM,QAAQ;AAAA,EAAE,UACtG;AAAU,QAAI,QAAQ,CAAC,KAAK,OAAQ,MAAK,IAAI;AAAA,EAAE;AACjD;AAEA,eAAsB,eAAe,QAAQ,MAAM;AACjD,MAAI,OAAO,aAAa,QAAS;AACjC,QAAM,OAAO,cAAc,QAAQ,WAAW,EAAE,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC;AACtE,QAAM,iBAAiB,MAAM,IAAI,QAAQ,CAACD,UAAS,WAAW;AAC5D,SAAK,OAAO,KAAK,WAAWA,QAAO;AACnC,SAAK,OAAO,KAAK,WAAW,MAAM;AAClC,SAAK,OAAO,KAAK,UAAU,MAAM,OAAO,IAAI,MAAM,oBAAoB,CAAC,CAAC;AAAA,EAC1E,CAAC;AACD,OAAK,IAAI;AACT,QAAM,OAAO,MAAM,KAAK;AACxB,MAAI,CAAC,eAAe,aAAa,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACxF;;;ACpHA,SAAS,qBAAqB,MAAM,eAAAG,oBAAmB;AACvD,SAAS,SAAAC,QAAO,aAAAC,YAAW,SAAS,OAAO,SAAAC,QAAO,YAAAC,WAAU,aAAa;AACzE,SAAS,cAAc;AACvB,SAAS,cAAAC,aAAY,QAAAC,aAAY;AACjC,SAAS,eAAAC,oBAAmB;AAC5B,SAAS,iBAAAC,sBAAqB;;;ACFvB,IAAM,cAAN,cAA0B,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrC,YAAY,MAAM,SAAS,CAAC,GAAG;AAC7B,UAAM,uBAAuB,IAAI,EAAE;AACnC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,QAAI,UAAU,OAAO,WAAW,UAAU;AACxC,UAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAM,MAAK,OAAO,OAAO;AACvE,UAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAM,MAAK,OAAO,OAAO;AAAA,IACzE;AAAA,EACF;AACF;;;ADVA,IAAM,SAASC,eAAc,IAAI,IAAI,0BAA0B,YAAY,GAAG,CAAC;AAC/E,IAAM,YAAY;AAGlB,eAAsB,mBAAmB,EAAE,WAAW,SAAS,SAAS,OAAO,UAAU,MAAM,QAAQ,KAAQ,OAAO,GAAG;AACvH,MAAI,CAACC,YAAW,IAAI,EAAG,OAAM,IAAI,UAAU,uCAAuC;AAClF,QAAM,eAAe,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;AACjD,QAAM,WAAW,IAAI,IAAI,SAAS,IAAI,aAAW,CAAC,QAAQ,WAAW,MAAM,OAAO,CAAC,CAAC;AACpF,MAAI,SAAS,SAAS,SAAS,UAAU,MAAM,KAAK,UAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,EAAG,OAAM,IAAI,UAAU,qCAAqC;AAC3I,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,OAAQ,QAAQ,QAAa,OAAO,UAAU,UAAU,WAAY,OAAM,IAAI,UAAU,kCAAkC;AACtK,QAAM,aAAa,KAAK,IAAI,KAAQ,KAAK;AACzC,QAAM,YAAYC,aAAY,IAAI;AAClC,QAAM,SAAS,UAAU,MAAM,oBAAoB;AACnD,QAAM,EAAE,YAAY,UAAU,IAAI,oBAAoB,SAAS;AAC/D,QAAM,aAAa,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,CAAC,EAAE,SAAS,WAAW;AACzF,QAAMC,OAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAMA,OAAMC,MAAK,MAAM,KAAK,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC/D,QAAMC,kBAAiBD,MAAK,MAAM,UAAUE,aAAY,EAAE,EAAE,SAAS,KAAK,CAAC,OAAO;AAElF,MAAI;AACJ,MAAI,WAAW,QAAQ,aAAa,UAAU,WAAWA,aAAY,EAAE,EAAE,SAAS,KAAK,CAAC,KAAKF,MAAK,MAAM,KAAKE,aAAY,CAAC,EAAE,SAAS,KAAK,CAAC,OAAO;AAClJ,MAAI,QAAQ,aAAa,WAAW,OAAO,WAAW,QAAQ,IAAI,KAAK;AAIrE,QAAI,SAAO,MAAMC,UAAS,OAAO,CAAC;AAClC,QAAG,OAAO,WAAWH,MAAK,QAAO,kBAAiB,QAAQ,CAAC,IAAE,IAAI,UAAO,MAAMG,UAAS,MAAM;AAC7F,sBAAgB,MAAM,QAAQH,MAAK,QAAO,UAAU,CAAC;AACrD,UAAM,MAAM,iBAAgB,GAAK;AACjC,UAAMI,QAAK,MAAMC,OAAM,eAAe;AACtC,QAAG,CAACD,MAAK,YAAY,KAAGA,MAAK,eAAe,KAAGA,MAAK,QAAM,QAAQ,OAAO,MAAIA,MAAK,OAAK,QAAS,GAAE;AAAC,YAAM,MAAM,eAAe;AAAE,YAAM,IAAI,MAAM,mCAAmC;AAAA,IAAC;AACpL,eAASJ,MAAK,iBAAgB,QAAQ;AACtC,QAAG,OAAO,WAAW,QAAQ,IAAE,KAAI;AAAC,YAAM,MAAM,eAAe;AAAE,YAAM,IAAI,MAAM,8BAA8B;AAAA,IAAC;AAAA,EAClH;AACA,MAAI;AACJ,MAAG;AAAC,YAAM,UAAU,MAAM,SAAQ,EAAC,SAAQ,cAAa,OAAM,OAAM,WAAU,CAAC;AAAA,EAAC,SAC1EM,QAAM;AAAC,QAAG,gBAAgB,OAAM,MAAM,eAAe;AAAE,UAAMA;AAAA,EAAK;AACxE,MAAI,OAAOC,UAAS,OAAO,QAAQ,OAAO,YAAY,OAAO;AAC7D,MAAI,UAAU,WAAW,GAAG,WAAW,GAAG,UAAU;AACpD,QAAM,SAAS,oBAAI,IAAI;AACvB,QAAM,UAAU,MAAM;AAAE,cAAU,QAAQ,MAAM,KAAK;AAAG,eAAW,cAAc,OAAO,OAAO,EAAG,YAAW,MAAM,IAAI,MAAM,eAAe,CAAC;AAAA,EAAE;AAC/I,QAAM,QAAQ,CAACC,KAAI,UAAU;AAC3B,QAAI,CAAC,SAAS,MAAM,OAAQ;AAC5B;AACA,UAAM,OAAO,EAAE,MAAM,YAAY,IAAAA,KAAI,GAAG,MAAM;AAC9C,SAAK,MAAM,KAAK,OAAO,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,YAAY,EAAE,MAAM,YAAY,IAAAA,KAAI,IAAI,OAAO,MAAM,eAAe,IAAI,IAAI,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACxJ;AACA,iBAAe,QAAQ,SAAS;AAC9B;AACA,QAAI,CAAC,WAAW,CAAC,OAAO,cAAc,QAAQ,EAAE,KAAK,QAAQ,KAAK,EAAG;AACrE,QAAI,QAAQ,SAAS,UAAU;AAAE,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,IAAI,MAAM,mBAAmB,CAAC;AAAG;AAAA,IAAO;AACvG,QAAI,QAAQ,SAAS,UAAW;AAChC,UAAMA,MAAK,QAAQ;AACnB,QAAI;AACF,UAAID,QAAQ,OAAM,IAAI,YAAY,eAAe;AACjD,UAAI,OAAO,WAAW,KAAK,UAAU,OAAO,CAAC,IAAI,aAAa,OAAO,KAAK,OAAO,EAAE,KAAK,CAAAE,SAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,QAAQ,MAAM,EAAE,SAASA,IAAG,CAAC,EAAG,OAAM,IAAI,YAAY,iBAAiB;AAC5L,UAAI,OAAO,IAAID,GAAE,KAAK,OAAO,QAAQ,GAAI,OAAM,IAAI,YAAY,MAAM;AACrE,UAAI,QAAQ,OAAO,QAAQ;AAAE,cAAMA,KAAI,EAAE,IAAI,MAAM,OAAO,UAAU,KAAK,MAAM,OAAO,YAAY,EAAE,IAAI,UAAQ,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;AAAG;AAAA,MAAO;AAC1J,UAAI,QAAQ,OAAO,OAAQ,OAAM,IAAI,YAAY,iBAAiB;AAClE,YAAM,aAAa,IAAI,gBAAgB;AAAG,aAAO,IAAIA,KAAI,UAAU;AACnE,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,IAAI,MAAM,OAAO,cAAc,QAAQ,MAAM,CAAC,EAAE,OAAO,MAAM;AACzF,gBAAM,UAAU,SAAS,IAAI,QAAQ,IAAI;AACzC,iBAAO,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,IAAI,GAAG,EAAE,QAAQ,SAAS,aAAa,CAAC;AAAA,QACvF,GAAG,EAAE,QAAQ,WAAW,OAAO,CAAC;AAChC,cAAMA,KAAI,EAAE,IAAI,MAAM,MAAM,CAAC;AAAA,MAC/B,UAAE;AAAU,eAAO,OAAOA,GAAE;AAAA,MAAE;AAAA,IAChC,SAASF,QAAO;AAAE,YAAME,KAAI,EAAE,IAAI,OAAO,MAAMF,kBAAiB,cAAcA,OAAM,OAAO,kBAAkB,CAAC;AAAA,IAAE;AAAA,EAClH;AACA,QAAM,QAAQ,MAAM;AAClB,QAAI,QAAS,QAAO;AACpB,IAAAC,UAAS;AAAM,YAAQ;AAAG,iBAAa,MAAM;AAAG,kBAAc,OAAO;AACrE,eAAW,YAAY;AACrB,UAAG,OAAM;AACP,cAAM,IAAI;AACV,cAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,KAAK,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAAG,aAAW;AAAE,gBAAM,IAAI,WAAW,MAAMA,SAAQ,KAAK,GAAG,GAAI;AAAG,YAAE,MAAM;AAAA,QAAE,CAAC,CAAC,CAAC;AACzJ,YAAI,CAAC,SAAS;AAAE,gBAAM,MAAM,KAAK;AAAG,gBAAM,MAAM;AAAA,QAAK;AAAA,MACvD;AAEA,UAAG,gBAAgB,OAAM,MAAM,eAAe,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IAC9D,GAAG;AACH,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,MAAM;AAAE,SAAK,MAAM;AAAA,EAAE,GAAG,KAAK;AAAG,SAAO,MAAM;AACvE,QAAM,UAAU,YAAY,MAAM;AAChC,QAAI;AAAE,UAAI,CAACH,QAAQ,WAAU,MAAM,MAAM,OAAO,cAAc,EAAE,OAAO,KAAK,IAAI,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,SAAST,aAAY,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC;AAAA,IAAE,QAC3J;AAAE,WAAK,MAAM;AAAA,IAAE;AAAA,EACvB,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC;AAAG,UAAQ,MAAM;AAC7D,QAAM,OAAO,OAAO,EAAE,KAAK,MAAM,MAAM;AACrC,QAAIS,WAAU,SAAS,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,KAAK,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,qBAAqB;AAChI,cAAU,KAAK,MAAM,OAAO,YAAY;AACxC,YAAQ;AACR,UAAM,YAAY,KAAK,MAAM,SAAST,aAAY,IAAI,IAAI,UAAU;AACpE,QAAI,YAAY,GAAG;AAAE,YAAM,MAAM;AAAG,YAAM,IAAI,MAAM,mBAAmB;AAAA,IAAE;AACzE,YAAQ,cAAc,QAAQ,UAAU,EAAE,UAAU,SAAS,KAAK,WAAW,OAAO,OAAO,UAAU,GAAG,EAAE,KAAK,CAAC;AAChH,UAAM,OAAO,GAAG,WAAW,aAAW;AAAE,WAAK,QAAQ,OAAO;AAAA,IAAE,CAAC;AAC/D,UAAM,OAAO,GAAG,WAAW,WAAS;AAClC,UAAI,MAAM,YAAY,YAAY;AAAE,mBAAW;AAAO,oBAAY;AAAA,MAAK;AACvE,UAAI,MAAM,YAAY,WAAY;AAAA,IACpC,CAAC;AACD,UAAM,OAAO,KAAK,UAAU,MAAM;AAAE,MAAAS,UAAS;AAAM,cAAQ;AAAG,mBAAa,MAAM;AAAG,oBAAc,OAAO;AAAA,IAAE,CAAC;AAC5G,UAAM,OAAO,KAAK,WAAW,MAAM;AAAE,WAAK,MAAM;AAAA,IAAE,CAAC;AACnD,UAAM,SAAS,MAAM,MAAM,YAAY,WAAW;AAClD,UAAM,UAAU,KAAK,UAAU;AAAA,MAAE,SAAS;AAAA,MAAG;AAAA,MAAU,WAAW,OAAO;AAAA,MAAK,aAAa,OAAO;AAAA,MAChG,SAAS;AAAA,MAAK,WAAW;AAAA,MAAO,WAAW,KAAK,IAAI,IAAI,KAAK,IAAI,MAAQ,SAAS;AAAA,MAAG,kBAAkB,KAAK,IAAI,IAAI;AAAA,MAAW,OAAO;AAAA,MACtI,QAAQ;AAAA,MAAQ,SAAS,QAAQ;AAAA,MAAK,SAAS;AAAA,IAAa,CAAC;AAC/D,UAAM,aAAa,KAAK,UAAU,EAAE,SAAS,WAAW,KAAK,MAAM,OAAO,KAAK,OAAO,GAAG,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;AAC5H,UAAMI,WAAUV,iBAAgB,YAAY,EAAE,MAAM,MAAM,MAAM,IAAM,CAAC;AAAA,EACzE;AACA,SAAO,OAAO,OAAO;AAAA,IAAE,SAAS,QAAQ;AAAA,IAAU,MAAM,CAAC,QAAQA,iBAAgB,UAAU;AAAA,IAAG,gBAAAA;AAAA,IAC5F;AAAA,IAAM;AAAA,IAAO,IAAI,SAAS;AAAE,aAAOM;AAAA,IAAO;AAAA,IAAG,IAAI,YAAY;AAAE,aAAO;AAAA,IAAU;AAAA,IAChF,IAAI,WAAW;AAAE,aAAO,EAAE,SAAS,cAAc,WAAW,MAAM,YAAY,MAAM,eAAe,UAAU,UAAU,SAAS,aAAa,OAAO,UAAU,IAAI,mBAAmB,OAAO,QAAAA,QAAO;AAAA,IAAE;AAAA,EAAE,CAAC;AAC5M;;;AEzHA,IAAM,QAAQ,WAAS,OAAO,cAAc,KAAK,KAAK,SAAS,IAAI,QAAQ;AAGpE,SAAS,eAAe,OAAO;AACpC,SAAO,OAAO,OAAO;AAAA,IAAE,aAAa,MAAM,OAAO,WAAW;AAAA,IAAG,cAAc,MAAM,OAAO,YAAY;AAAA,IACpG,mBAAmB,MAAM,OAAO,iBAAiB;AAAA,IAAG,uBAAuB,MAAM,OAAO,qBAAqB;AAAA,IAC7G,uBAAuB,MAAM,OAAO,qBAAqB;AAAA,IAAG,aAAa,MAAM,OAAO,WAAW;AAAA,EAAE,CAAC;AACxG;AAEO,SAAS,oBAAoB,EAAE,SAAS,aAAa,OAAO,gBAAgB,eAAe,gBAAgB,kBAAkB,UAAU,OAAO,UAAU,eAAe,GAAG;AAC/K,MAAI,CAAC,CAAC,gBAAgB,OAAO,SAAS,EAAE,SAAS,OAAO,EAAG,OAAM,IAAI,UAAU,qBAAqB;AACpG,MAAI,WAAW,MAAM,SAAS,MAAM,gBAAgB,MAAM,mBAAmB;AAC7E,MAAI,QAAQ,eAAe,GAAG,YAAY,OAAO,WAAW,OAAO,WAAW,MAAM,YAAY,IAAI,UAAU;AAC9G,QAAM,WAAW,CAAC;AAClB,SAAO,OAAO,OAAO;AAAA,IACnB,WAAW,QAAQ;AACjB,iBAAW,QAAQ,QAAQ,MAAM;AACjC,sBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACnE,yBAAmB,OAAO,QAAQ,kBAAkB,WAAW,OAAO,gBAAgB;AACtF,iBAAW,kBAAkB,kBAAkB,qBAAqB;AACpE,UAAI,CAAC,YAAY,SAAU,OAAM,IAAI,MAAM,6BAA6B;AAAA,IAC1E;AAAA,IACA,MAAM,SAAS;AACb,YAAM,SAAS,SAAS;AACxB,UAAI,CAAC,UAAU,OAAO,aAAa,SAAU,QAAO,EAAE,UAAU,MAAM;AACtE,UAAI,UAAU,OAAO,UAAU,OAAO,WAAW,OAAQ,QAAO,EAAE,UAAU,MAAM;AAClF,UAAI,QAAQ,WAAW,eAAgB,UAAS,OAAO,MAAM,MAAM;AACnE,UAAI,QAAQ,WAAW,6BAA6B;AAClD,mBAAW,OAAO;AAElB,gBAAQ,eAAe,OAAO,YAAY,KAAK;AAAG,oBAAY;AAC9D,eAAO,EAAE,UAAU,MAAM,cAAc,KAAK;AAAA,MAC9C;AACA,UAAI,QAAQ,WAAW,kBAAkB;AACvC,iBAAS,KAAK,EAAE,WAAW,OAAO,aAAa,MAAM,SAAS,OAAO,WAAW,MAAM,QAAQ,OAAO,UAAU,KAAK,CAAC;AACrH,YAAI,OAAO,YAAY,eAAgB,YAAW;AAAA,MACpD;AACA,UAAI,QAAQ,WAAW,oBAAoB,OAAO,MAAM,SAAS,kBAAkB,OAAO,OAAO,KAAK,SAAS,SAAU,aAAY,OAAO,KAAK;AACjJ,UAAI,QAAQ,WAAW,kBAAkB;AACvC,mBAAW,OAAO,MAAM;AACxB,mBAAW,OAAO,MAAM,UAAU;AAClC,kBAAU,OAAO,MAAM,QAAQ,EAAE,MAAM,OAAO,KAAK,MAAM,kBAAkB,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,EAAE,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI;AAAA,MACtJ;AACA,aAAO,EAAE,UAAU,MAAM,UAAU,WAAW,QAAQ,WAAW,iBAAiB;AAAA,IACpF;AAAA,IACA,WAAW;AACT,aAAO;AAAA,QAAE,eAAe;AAAA,QAAG,QAAQ;AAAA,QAAO,QAAQ;AAAA,QAAS;AAAA,QAAO,GAAG;AAAA,QAAS;AAAA,QAC5E,WAAW,YAAY,SAAS,SAAS,WAAW,IAAI,QAAQ,IAAI,MAAM,KAAK;AAAA,QAC/E;AAAA,QAAU;AAAA,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM,QAAQ;AAAA,QAC1F,UAAU;AAAA,UAAE;AAAA,UAAiB;AAAA,UAAc,mBAAmB;AAAA,UAAgB,kBAAkB;AAAA,UAC9F;AAAA,UAAkB,qBAAqB;AAAA,UAAM,cAAc,WAAW,aAAa,gBAAgB,yBAAyB;AAAA,UAC5H,6BAA6B;AAAA,UAAO,UAAU,CAAC,GAAG,QAAQ;AAAA,QAAE;AAAA,QAC9D,OAAO,EAAE,GAAG,OAAO,UAAU,WAAW,QAAQ,aAAa,OAAO,OAAO,KAAK,EAAE,MAAM,WAAS,UAAU,IAAI,IAAI,aAAa,YAAY,YAAY,UAAU;AAAA,QAClK,SAAS,EAAE,MAAM,SAAS,WAAW,MAAM,cAAc,YAAY,iBAAiB,mBAAmB,UAAU;AAAA,QACnH,UAAU,WAAW,sBAAsB;AAAA,QAAU;AAAA,QAAW;AAAA,QAChE,aAAa,CAAC,4GAA4G,uEAAuE;AAAA,MAAE;AAAA,IACvM;AAAA,EACF,CAAC;AACH;;;ACzDO,SAAS,iBAAiB,QAAQ,CAAC,GAAG;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,CAAAK,SAAO,CAAC,CAAC,iBAAiB,gBAAgB,EAAE,SAASA,IAAG,CAAC,EAAG,OAAM,IAAI,UAAU,2BAA2B;AACtM,QAAM,UAAU,CAAC;AACjB,aAAW,CAAC,QAAQ,MAAM,KAAK,CAAC,CAAC,iBAAiB,iBAAiB,GAAG,CAAC,kBAAkB,kBAAkB,CAAC,GAAG;AAC7G,QAAI,MAAM,MAAM,MAAM,OAAW;AACjC,QAAI;AACJ,QAAI;AAAE,YAAM,IAAI,IAAI,MAAM,MAAM,CAAC;AAAA,IAAE,QAAQ;AAAE,YAAM,IAAI,UAAU,2BAA2B;AAAA,IAAE;AAC9F,QAAI,OAAO,MAAM,MAAM,MAAM,YAAY,MAAM,MAAM,EAAE,SAAS,QAAQ,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,QACxH,EAAE,IAAI,aAAa,YAAY,IAAI,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ,GAAI,OAAM,IAAI,UAAU,2BAA2B;AACzK,YAAQ,KAAK,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,EACtC;AACA,SAAO,OAAO,OAAO;AAAA,IAAE,OAAO,QAAQ,IAAI,CAAC,CAACA,MAAK,KAAK,MAAM,GAAGA,IAAG,MAAM,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC7F,gBAAgB,QAAQ,IAAI,CAAC,CAACA,IAAG,MAAMA,IAAG;AAAA,IAAG,QAAQ,OAAO,YAAY,OAAO;AAAA,EAAE,CAAC;AACtF;AAGO,SAAS,uBAAuB,QAAQ,EAAE,gBAAgB,QAAQ,MAAM,OAAO,SAAS,GAAG;AAChG,QAAM,SAAS,QAAQ;AACvB,MAAI,CAAC,UAAU,OAAO,UAAU,kBAAkB,OAAO,mBAAmB,YAAY,OAAO,oBAAoB,WAAW,OAAO,iBAAiB,YAAa,OAAM,IAAI,MAAM,gCAAgC;AACnN,QAAM,UAAU,OAAO;AACvB,MAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,KAAK,CAAC,QAAQ,SAAU,OAAM,IAAI,MAAM,0BAA0B;AAClH,QAAM,SAAS,QAAQ;AACvB,MAAI,OAAO,YAAY,OAAO,WAAW,KAAK,UAAU,OAAO,IAAI,MAAM,KAAK,UAAU,OAAO,IAAI,KACjG,OAAO,QAAQ,QAAQ,OAAO,aAAa,QAAQ,KAAK,UAAU,OAAO,aAAa,MAAM,KAAK,UAAU,KAAK,EAAG,OAAM,IAAI,MAAM,+BAA+B;AACpK,aAAW,CAACA,MAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,EAAG,KAAI,OAAOA,IAAG,MAAM,MAAO,OAAM,IAAI,MAAM,gCAAgC;AACvI,SAAO,EAAE,oBAAoB,CAAC,UAAU,GAAG,6BAA6B,CAAC,GAAG,SAAS,cAAc,EAAE;AACvG;;;ALlBA,IAAM,SAAS,WAASC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACvE,IAAM,KAAK,WAAS,OAAO,UAAU,YAAY,yBAAyB,KAAK,KAAK;AACpF,IAAM,YAAY,WAAS,OAAO,UAAU,YAAY,MAAM,KAAK,KAAK,CAAC,MAAM,SAAS,IAAI,KAAK,OAAO,WAAW,KAAK,KAAK;AAG7H,eAAsB,mBAAmB,EAAE,YAAY,QAAQ,QAAQ,GAAG,MAAM;AAC9E,MAAI,CAACC,YAAW,UAAU,KAAK,CAAC,iBAAiB,KAAK,MAAM,KAAK,CAAC,yCAAyC,KAAK,OAAO,EAAG,OAAM,IAAI,UAAU,8BAA8B;AAC5K,QAAMC,QAAO,MAAMC,UAAS,UAAU;AACtC,MAAI,EAAE,MAAMC,MAAKF,KAAI,GAAG,OAAO,KAAK,QAAQ,aAAa,WAAW,CAACA,MAAK,YAAY,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACjJ,MAAI,OAAO,MAAMG,UAASH,KAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,mBAAmB;AAChF,QAAM,WAAW,MAAM,IAAI,QAAQ,CAACI,UAAS,WAAW;AACtD,UAAM,QAAQC,OAAML,OAAM,CAAC,WAAW,GAAG,EAAE,KAAK,MAAM,KAAK,mBAAmB,IAAI,GAAG,aAAa,MAAM,OAAO,OAAO,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACzJ,QAAI,SAAS,IAAIM,SAAQ;AACzB,UAAM,QAAQ,WAAW,MAAM;AAAE,YAAM,KAAK;AAAG,aAAO,IAAI,MAAM,qBAAqB,CAAC;AAAA,IAAE,GAAG,GAAM;AACjG,UAAM,OAAO,GAAG,QAAQ,WAAS;AAAE,gBAAU,MAAM,SAAS,MAAM;AAAG,UAAI,OAAO,SAAS,KAAM,OAAM,KAAK;AAAA,IAAE,CAAC;AAC7G,UAAM,OAAO,GAAG,QAAQ,WAAS;AAAE,MAAAA,UAASA,SAAQ,MAAM,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,IAAE,CAAC;AAC1F,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,SAAS,UAAQ;AAAE,mBAAa,KAAK;AAAG,UAAI,SAAS,EAAG,CAAAF,SAAQ,OAAO,KAAK,CAAC;AAAA,UAAQ,QAAO,IAAI,MAAM,uBAAuBE,OAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;AAAA,IAAE,CAAC;AAAA,EACnK,CAAC;AACD,MAAI,aAAa,aAAa,OAAO,GAAI,OAAM,IAAI,MAAM,sBAAsB;AAC/E,SAAO,OAAO,OAAO,EAAE,MAAAN,OAAM,QAAQ,QAAQ,CAAC;AAChD;AAGA,eAAsB,uBAAuB;AAAA,EAAE;AAAA,EAAW;AAAA,EAAS;AAAA,EAAS;AAAA,EAAa,QAAQ,CAAC;AAAA,EAAG,WAAW,CAAC;AAAA,EAC/G;AAAA,EAAa;AAAA,EAAW,OAAO;AAAA,EAAe;AAAA,EAAgB,kBAAkB;AAAA,EAAU,eAAe;AAAA,EACzG,aAAa;AAAA,EAAQ;AAAA,EAAsB,UAAU;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAiB;AAAA,EAAY;AAAA,EACnH,iBAAiB,CAAC;AAAA,EAAG;AAAiB,GAAG;AACzC,MAAI,CAAC,GAAG,WAAW,KAAK,CAACD,YAAW,WAAW,KAAK,CAACA,YAAW,SAAS,KAAK,CAAC,8BAA8B,KAAK,cAAc,EAAG,OAAM,IAAI,UAAU,kBAAkB;AACzK,MAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,OAAQ,aAAa,KAAW,OAAM,IAAI,UAAU,sBAAsB;AAChI,YAAU,YAAY,SAAS,iBAAiB,YAAY;AAC5D,QAAM,EAAE,OAAO,SAAS,IAAI,UAAU,SAAS,OAAO;AACtD,UAAQ,eAAe;AACvB,QAAM,WAAW,iBAAiB,cAAc;AAChD,MAAI,qBAAqB,UAAa,CAAC,UAAU,gBAAgB,EAAG,OAAM,IAAI,UAAU,kBAAkB;AAC1G,QAAM,MAAM,MAAME,UAAS,SAAS;AACpC,MAAI,EAAE,MAAMC,MAAK,GAAG,GAAG,YAAY,EAAG,OAAM,IAAI,MAAM,mBAAmB;AACzE,QAAMK,OAAM,aAAa,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,QAAM,OAAO,MAAMN,UAAS,WAAW;AACvC,QAAM,OAAOO,MAAK,MAAM,KAAK,WAAW,EAAE;AAC1C,QAAMD,OAAM,MAAM,EAAE,MAAM,IAAM,CAAC;AACjC,aAAW,UAAU,CAAC,OAAO,SAAS,UAAU,QAAQ,WAAW,SAAS,GAAG,EAAG,OAAMA,OAAMC,MAAK,MAAM,MAAM,GAAG,EAAE,MAAM,IAAM,CAAC;AACjI,QAAM,QAAQ,MAAM,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACpD,MAAI,CAAC,MAAM,UAAW,OAAM,IAAI,MAAM,4BAA4B,MAAM,MAAM,EAAE;AAChF,QAAM,eAAe,MAAM,QAAQ,IAAI;AACvC,QAAM,QAAQ,MAAM,mBAAmB,eAAe,IAAI;AAC1D,QAAM,SAAS,MAAM,mBAAmB,EAAE,WAAW,SAAS,SAAS,OAAO,UAAU,MAAMA,MAAK,MAAM,GAAG,GAAG,OAAO,YAAY,QAAQ,MAAM,OAAO,CAAC;AACxJ,QAAM,SAAS;AAAA,IACb,WAAW,KAAK,UAAU,cAAc,CAAC;AAAA,IAAI;AAAA,IAA6B;AAAA,IAA6B;AAAA,IACvG;AAAA,IAA2B;AAAA,IAAuC;AAAA,IAClE;AAAA,IACA,GAAG,SAAS;AAAA,IACZ;AAAA,IAAc;AAAA,IAAsB;AAAA,IAAuB;AAAA,IAC3D;AAAA,IAAe;AAAA,IAAmB;AAAA,IAA0B,aAAa,KAAK,UAAU,OAAO,OAAO,CAAC;AAAA,IACvG,UAAU,KAAK,UAAU,OAAO,IAAI,CAAC;AAAA,IAAI,SAAS,KAAK,UAAUA,MAAK,MAAM,GAAG,CAAC,CAAC;AAAA,IAAI;AAAA,IAAkB;AAAA,IACvG,mBAAmB,KAAK,UAAU,KAAK,CAAC;AAAA,IAAI;AAAA,IAAiB;AAAA,IAC7D;AAAA,IAA8B,UAAU,KAAK,UAAU,IAAI,CAAC;AAAA,IAAI,iBAAiB,KAAK,UAAU,IAAI,CAAC;AAAA,IACrG,UAAU,KAAK,UAAUA,MAAK,MAAM,KAAK,CAAC,CAAC;AAAA,IAAI,SAAS,KAAK,UAAUA,MAAK,MAAM,KAAK,CAAC,CAAC;AAAA,EAC3F,EAAE,KAAK,IAAI,IAAI;AACf,QAAMC,WAAUD,MAAK,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,MAAM,MAAM,IAAM,CAAC;AAC9E,MAAI,qBAAsB,OAAM,qBAAqB,IAAI;AACzD,MAAI,OAAO,MAAML,UAASK,MAAK,MAAM,aAAa,CAAC,CAAC,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,GAAG;AAAE,UAAM,OAAO,MAAM;AAAG,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAAE;AAC1K,MAAI,OAAO,MAAML,UAAS,MAAM,IAAI,CAAC,MAAM,MAAM,QAAQ;AAAE,UAAM,OAAO,MAAM;AAAG,UAAM,IAAI,MAAM,mBAAmB;AAAA,EAAE;AACtH,QAAM,WAAW,oBAAoB,EAAE,SAAS,aAAa,OAAO,gBAAgB,iBAAiB,cAAc,OAAO,QAAQ,CAAC;AACnI,QAAMO,OAAM,mBAAmB,IAAI;AACnC,QAAM,aAAa,cAAc,MAAM,QAAQ,aAAa,EAAE,YAAY,MAAM,MAAM,MAAM,CAAC,cAAc,YAAY,UAAU,GAAG,KAAK,OAAO,WAAW,GAAG,EAAE,MAAM,KAAAA,KAAI,CAAC;AAC3K,QAAM,UAAU,oBAAI,IAAI,GAAG,gBAAgB,oBAAI,IAAI;AACnD,MAAI,WAAW,GAAGC,UAAS,OAAO,aAAa,eAAe,MAAM,WAAW,MAAM,eAAe,GAAG,aAAa,aAAa,OAAO,QAAQ,MAAM;AACtJ,MAAI,cAAc,QAAQ,QAAQ;AAClC,QAAM,cAAc,CAAAL,WAAS;AAAE,eAAW,SAAS,QAAQ,OAAO,EAAG,OAAM,OAAOA,MAAK;AAAG,YAAQ,MAAM;AAAA,EAAE;AAC1G,QAAM,MAAM,CAAC,QAAQ,QAAQ,YAAY,QAAW,IAAI,QAAQ,CAACF,UAAS,WAAW;AACnF,QAAIO,WAAU,OAAO;AAAE,aAAO,SAAS,IAAI,MAAM,YAAY,CAAC;AAAG;AAAA,IAAO;AACxE,UAAMC,MAAK,EAAE;AACb,UAAMC,SAAQ,WAAW,MAAM;AAAE,cAAQ,OAAOD,GAAE;AAAG,aAAO,IAAI,MAAM,mBAAmB,MAAM,EAAE,CAAC;AAAA,IAAE,GAAG,KAAK,IAAI,WAAW,UAAU,CAAC;AACtI,UAAM,SAAS,QAAM,WAAS;AAAE,mBAAaC,MAAK;AAAG,SAAG,KAAK;AAAA,IAAE;AAC/D,YAAQ,IAAID,KAAI,EAAE,SAAS,OAAOR,QAAO,GAAG,QAAQ,OAAO,MAAM,EAAE,CAAC;AACpE,SAAK,WAAW,KAAK,EAAE,IAAAQ,KAAI,QAAQ,OAAO,CAAC,EAAE,MAAM,CAAAN,WAAS;AAAE,YAAM,QAAQ,QAAQ,IAAIM,GAAE;AAAG,cAAQ,OAAOA,GAAE;AAAG,aAAO,OAAON,MAAK;AAAA,IAAE,CAAC;AAAA,EACzI,CAAC;AACD,QAAM,OAAO,MAAM;AACjB,QAAI,YAAa,QAAO;AACxB,IAAAK,UAAS;AAAM,gBAAY,IAAI,MAAM,cAAc,CAAC;AACpD,kBAAc,UAAU;AAAG,YAAQ,oBAAoB,SAAS,OAAO;AACvE,mBAAe,YAAY;AACzB,YAAM,OAAO,MAAM;AAKnB,UAAI,CAAC,SAAS,CAAC,QAAQ,WAAW,CAAC,aAAa,QAAQ,EAAE,SAAS,SAAS,SAAS,EAAE,QAAQ,KAAK,CAAC,cAAc,aAAa;AAC9H,cAAM,IAAI,QAAQ,CAAAP,aAAW;AAC3B,gBAAM,SAAS,MAAM;AAAE,yBAAa,KAAK;AAAG,oBAAQ,oBAAoB,SAAS,MAAM;AAAG,YAAAA,SAAQ;AAAA,UAAE;AACpG,gBAAM,QAAQ,WAAW,QAAQ,GAAI;AACrC,qBAAW,KAAK,KAAK,MAAM;AAAG,kBAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACtF,cAAI,QAAQ,QAAS,QAAO;AAAA,QAC9B,CAAC;AAAA,MACH;AACA,iBAAW,IAAI;AACf,YAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,WAAW,MAAM,IAAI,QAAQ,CAAAA,aAAW;AAAE,cAAM,IAAI,WAAW,MAAMA,SAAQ,IAAI,GAAG,GAAI;AAAG,UAAE,MAAM;AAAA,MAAE,CAAC,CAAC,CAAC;AAC3I,UAAI,CAAC,QAAQ;AACX,YAAI,QAAQ,aAAa,WAAW,aAAa;AAAE,cAAI;AAAE,oBAAQ,KAAK,CAAC,YAAY,KAAK,SAAS;AAAA,UAAE,QAAQ;AAAA,UAAC;AAAA,QAAE;AAC9G,mBAAW,MAAM,KAAK;AACtB,cAAM,WAAW;AAAA,MACnB;AACA,UAAI,CAAC,cAAc,YAAa,gBAAe,EAAE,GAAG,cAAc,aAAa,OAAO,QAAQ,eAAe,sBAAsB,CAAC,OAAO;AAC3I,aAAO;AAAA,IACT,GAAG;AACH,WAAO;AAAA,EACT;AACA,aAAW,OAAO,GAAG,WAAW,WAAS;AACvC,QAAI,MAAM,YAAY,UAAW,eAAc;AAC/C,QAAI,MAAM,YAAY,UAAW,gBAAe;AAAA,EAClD,CAAC;AACD,aAAW,OAAO,GAAG,WAAW,aAAW;AACzC,QAAI,QAAQ,OAAO,UAAa,CAAC,QAAQ,QAAQ;AAC/C,YAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;AAAG,cAAQ,OAAO,QAAQ,EAAE;AAChE,UAAI,QAAQ,MAAO,QAAO,OAAO,OAAO,OAAO,IAAI,MAAM,mBAAmB,QAAQ,MAAM,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,UAC9H,QAAO,QAAQ,QAAQ,MAAM;AAClC;AAAA,IACF;AACA,QAAI,QAAQ,OAAO,QAAW;AAC5B,WAAK,WAAW,KAAK,EAAE,IAAI,QAAQ,IAAI,OAAO,EAAE,MAAM,QAAQ,SAAS,kCAAkC,EAAE,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAC5H;AAAA,IACF;AACA,UAAM,SAAS,SAAS,MAAM,OAAO;AACrC,QAAI,cAAc,OAAO,QAAQ,WAAW,SAAU,YAAW,EAAE,QAAQ,QAAQ,QAAQ,WAAW,OAAO,QAAQ,QAAQ,OAAO,mBAAmB,WAAW,QAAQ,OAAO,MAAM,iBAAiB,KAAK,CAAC;AAC9M,QAAI,OAAO,gBAAgB,SAAS;AAClC,YAAMU,YAAW,SAAS,SAAS;AACnC,oBAAc,YAAY,KAAK,MAAM,QAAQA,SAAQ,CAAC;AACtD,WAAK,YAAY,MAAM,CAAAR,WAAS;AAAE,gBAAQA;AAAO,aAAK,KAAK;AAAA,MAAE,CAAC;AAAA,IAChE;AACA,QAAI,OAAO,UAAU;AAAE,cAAQ,IAAI,MAAM,6BAA6B;AAAG,WAAK,KAAK;AAAA,IAAE;AACrF,eAAW,YAAY,cAAe,UAAS,SAAS,MAAM;AAAA,EAChE,CAAC;AACD,aAAW,OAAO,GAAG,WAAW,CAAAA,WAAS;AAAE,YAAQA;AAAO,gBAAYA,MAAK;AAAG,SAAK,KAAK;AAAA,EAAE,CAAC;AAC3F,aAAW,OAAO,KAAK,UAAU,MAAM;AAAE,IAAAK,UAAS;AAAM,gBAAY,IAAI,MAAM,YAAY,CAAC;AAAG,SAAK,OAAO,MAAM;AAAA,EAAE,CAAC;AACnH,QAAM,UAAU,MAAM;AAAE,YAAQ,IAAI,MAAM,eAAe;AAAG,SAAK,KAAK;AAAA,EAAE;AACxE,UAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACzD,QAAM,aAAa,YAAY,MAAM;AACnC,QAAI;AAAE,UAAI,OAAO,OAAQ,OAAM,IAAI,MAAM,mBAAmB;AAAG,UAAI,UAAU,SAAS,OAAO,EAAE,aAAa,SAAU,OAAM,IAAI,MAAM,mBAAmB;AAAG,gBAAU,YAAY,SAAS,iBAAiB,YAAY;AAAA,IAAE,QACpN;AAAE,cAAQ,IAAI,MAAM,mBAAmB;AAAG,WAAK,KAAK;AAAA,IAAE;AAAA,EAC9D,GAAG,GAAG;AAAG,aAAW,MAAM;AAC1B,MAAI,QAAQ,QAAS,SAAQ;AAC7B,QAAM,QAAQ,WAAW,MAAM;AAAE,YAAQ,IAAI,MAAM,cAAc;AAAG,SAAK,KAAK;AAAA,EAAE,GAAG,UAAU;AAAG,QAAM,MAAM;AAC5G,MAAI;AACF,UAAM,UAAU,MAAM,WAAW,YAAY,SAAS;AACtD,UAAM,OAAO,KAAK,OAAO;AACzB,UAAM,IAAI,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,OAAO,qBAAqB,SAAS,QAAQ,GAAG,cAAc,EAAE,iBAAiB,KAAK,EAAE,CAAC;AAC5J,UAAM,WAAW,KAAK,EAAE,QAAQ,eAAe,QAAQ,CAAC,EAAE,CAAC;AAC3D,sBAAkB,uBAAuB,MAAM,IAAI,eAAe,EAAE,KAAK,eAAe,MAAM,CAAC,GAAG,EAAE,gBAAgB,QAAQ,MAAMH,MAAK,MAAM,GAAG,GAAG,OAAO,SAAS,CAAC;AACpK,UAAM,SAAS,MAAM,IAAI,gBAAgB;AAAA,MAAE,OAAO;AAAA,MAAgB,eAAe;AAAA,MAAU,4BAA4B;AAAA,MAAO;AAAA,MAAK,gBAAgB;AAAA,MAAS,SAAS;AAAA,MAAa,WAAW;AAAA,MAC3L,GAAI,mBAAmB,EAAE,uBAAuB,iBAAiB,IAAI,CAAC;AAAA,IAAG,CAAC;AAC5E,aAAS,WAAW,MAAM;AAAG,eAAW,OAAO,OAAO;AAAA,EACxD,SAASF,QAAO;AAAE,iBAAa,KAAK;AAAG,UAAM,KAAK;AAAG,IAAAA,OAAM,iBAAiB,OAAO;AAAU,IAAAA,OAAM,cAAc,WAAW,OAAO,MAAM,KAAK;AAAG,UAAMA;AAAA,EAAM;AAC7J,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IAAM;AAAA,IAAO,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;AAAA,IAAG;AAAA,IACrD,MAAM,aAAa;AAAE,aAAO,IAAI,cAAc,EAAE,eAAe,OAAO,OAAO,IAAI,CAAC;AAAA,IAAE;AAAA,IACpF,MAAM,mBAAmB;AAAE,aAAO,IAAI,wBAAwB,EAAE,UAAU,YAAY,YAAY,QAAQ,oBAAoB,OAAO,IAAI,CAAC;AAAA,IAAE;AAAA,IAC5I,MAAM,eAAe,MAAMS,QAAO,CAAC,GAAG;AACpC,UAAI,CAAC,MAAM,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,aAAa;AACxD,aAAO,IAAI,uBAAuB,EAAE,UAAU,QAAQ,YAAY,MAAM,MAAM,WAAWA,MAAK,CAAC;AAAA,IACjG;AAAA,IACA,MAAM,IAAI,QAAQ;AAChB,UAAI,CAAC,UAAU,MAAM,KAAK,cAAc,aAAc,OAAM,IAAI,MAAM,8BAA8B;AACpG,gBAAU,YAAY,SAAS,iBAAiB,YAAY;AAC5D,gBAAU,SAAS,OAAO;AAC1B,UAAI,gBAAiB,OAAM,gBAAgB,EAAE,OAAO,GAAG,SAAS,aAAa,QAAQ,OAAO,QAAQ,SAAS,gBAAgB,MAAM,CAAC;AACpI,UAAIJ,WAAU,MAAO,OAAM,SAAS,IAAI,MAAM,YAAY;AAC1D,UAAI,UAAU,SAAS,OAAO,EAAE,aAAa,SAAU,OAAM,IAAI,MAAM,mBAAmB;AAC1F,gBAAU,YAAY,SAAS,iBAAiB,YAAY;AAC5D,mBAAa;AAAM;AACnB,UAAI;AACF,cAAM,aAAa,IAAI,QAAQ,CAACP,UAAS,WAAW;AAClD,gBAAM,WAAW,CAAC,UAAU,WAAW;AAAE,gBAAI,OAAO,WAAW;AAAE,4BAAc,OAAO,QAAQ;AAAG,cAAAA,SAAQ,SAAS,SAAS,CAAC;AAAA,YAAE;AAAA,UAAE;AAChI,wBAAc,IAAI,QAAQ;AAC1B,qBAAW,KAAK,KAAK,MAAM;AAAE,0BAAc,OAAO,QAAQ;AAAG,mBAAO,SAAS,IAAI,MAAM,wBAAwB,CAAC;AAAA,UAAE,CAAC;AAAA,QACrH,CAAC;AACD,mBAAW,MAAM,MAAM;AAAA,QAAC,CAAC;AACzB,cAAM,IAAI,cAAc,EAAE,UAAU,OAAO,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,eAAe,CAAC,EAAE,CAAC,GAAG,OAAO,eAAe,CAAC;AACvH,cAAM,SAAS,MAAM;AACrB,cAAM;AACN,YAAI,MAAO,OAAM;AACjB,eAAO,EAAE,GAAG,QAAQ,QAAQ,OAAO,aAAa,cAAc,cAAc,SAAS;AAAA,MACvF,UAAE;AAAU,qBAAa;AAAA,MAAM;AAAA,IACjC;AAAA,IACA,MAAM,SAAS;AAAE,mBAAa,KAAK;AAAG,aAAO,KAAK;AAAA,IAAE;AAAA,IACpD,MAAM,QAAQ;AAAE,mBAAa,KAAK;AAAG,aAAO,KAAK;AAAA,IAAE;AAAA,IACnD,WAAW;AAAE,aAAO;AAAA,QAAE,GAAG,SAAS,SAAS;AAAA,QAAG,2BAA2B;AAAA,QACvE,4BAA4B,eAAe,OAAO;AAAA,QAAG,kCAAkC,eAAe,wBAAwB;AAAA,QAC9H,SAAS;AAAA,QAAa;AAAA,QAAc,QAAQ,OAAO;AAAA,QAAU,SAAS;AAAA,QACtE,aAAa;AAAA,QAAwC,iBAAiB,EAAE,MAAM,MAAM,MAAM,YAAY,MAAM,YAAY,aAAa,MAAM,YAAY;AAAA,MAAE;AAAA,IAAE;AAAA,IAC7J,IAAI,SAAS;AAAE,aAAOO;AAAA,IAAO;AAAA,EAC/B,CAAC;AACH;;;ADpMA,SAAS,eAAe,SAAS,UAAU,gBAAgB,iBAAiB,cAAc;AACxF,QAAM,SAAS,oBAAI,IAAI;AACvB,QAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAChC,QAAM,aAAa,WAAS,KAAK,UAAU,KAAK;AAChD,QAAM,UAAU,CAAC,OAAO,YAAY;AAClC,aAAS,OAAO;AAChB,UAAM,QAAQ,OAAO,IAAI,KAAK;AAC9B,QAAI,CAAC,SAAS,MAAM,YAAY,WAAW,OAAO,KAAK,MAAM,aAAa,KAAK,IAAI,GAAG;AACpF,aAAO,OAAO,KAAK;AACnB,YAAM,IAAI,MAAM,wBAAwB;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY;AAAA,IAChB,WAAW;AAAE,eAAS,OAAO;AAAG,aAAO,EAAE,OAAO,QAAQ,OAAO,UAAU,QAAQ,SAAS;AAAA,IAAE;AAAA,IAC5F,YAAY,UAAU,UAAU,OAAO;AACrC,eAAS,OAAO;AAChB,UAAI,aAAa,mBAAmB,UAAU,gBAAgB,mBAAmB,aAAc,OAAM,IAAI,MAAM,wBAAwB;AAAA,IACzI;AAAA,IACA,MAAM,UAAU,EAAE,SAAS,OAAO,MAAM,GAAG;AACzC,eAAS,OAAO;AAChB,UAAI,SAAS,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAQ,OAAM,IAAI,MAAM,wBAAwB;AACpL,YAAM,QAAQK,aAAY,EAAE,EAAE,SAAS,WAAW;AAClD,aAAO,IAAI,OAAO,EAAE,SAAS,WAAW,OAAO,GAAG,OAAO,IAAI,IAAI,KAAK,GAAG,WAAW,KAAK,IAAI,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAS,EAAE,CAAC;AACrI,aAAO,EAAE,MAAM;AAAA,IACjB;AAAA,IACA,KAAK,OAAO,SAAS;AAAE,aAAO,CAAC,GAAG,QAAQ,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK;AAAA,IAAE;AAAA,IACxE,MAAM,OAAO,SAAS,EAAE,MAAM,GAAG;AAC/B,YAAM,QAAQ,QAAQ,OAAO,OAAO;AACpC,UAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAQ,OAAM,IAAI,MAAM,wBAAwB;AACzG,YAAM,YAAY,KAAK,IAAI,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAS;AAChE,aAAO,EAAE,MAAM;AAAA,IACjB;AAAA,IACA,MAAM,IAAI,OAAO,SAAS,MAAM,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG;AACxD,YAAM,QAAQ,QAAQ,OAAO,OAAO;AACpC,UAAI,CAAC,MAAM,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACnE,eAAS,OAAO;AAChB,aAAO,QAAQ,EAAE,QAAQ,UAAU,IAAI,gBAAgB,EAAE,OAAO,CAAC;AAAA,IACnE;AAAA,IACA,QAAQ,OAAO;AAAE,aAAO,OAAO,KAAK;AAAA,IAAE;AAAA,EACxC;AACA,SAAO,EAAE,WAAW,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE;AAC3D;AAGA,eAAsB,wBAAwB,SAAS;AACrD,QAAM,EAAE,SAAS,UAAU,gBAAgB,kBAAkB,UAAU,eAAe,eAAe,IAAI,WAAW,CAAC;AACrH,MAAI,SAAS,SAAS,aAAa,YAAY,CAAC,WAAW,OAAO,aAAa,WAAY,OAAM,IAAI,MAAM,mCAAmC;AAC9I,MAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,MAAM,UAAU,CAAC,MAAM,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,SAAS,OAAQ,OAAM,IAAI,MAAM,8BAA8B;AACxK,QAAM,QAAQ,eAAe,SAAS,UAAU,gBAAgB,iBAAiB,YAAY;AAC7F,MAAI;AACF,UAAM,UAAU,MAAM,uBAAuB,EAAE,GAAG,SAAS,WAAW,MAAM,WAAW,SAAS,MAAM,QAAQ,CAAC;AAC/G,UAAM,QAAQ,QAAQ;AACtB,WAAO,OAAO,OAAO,EAAE,GAAG,SAAS,MAAM,QAAQ;AAAE,UAAI;AAAE,eAAO,MAAM,MAAM;AAAA,MAAE,UAAE;AAAU,cAAM,MAAM;AAAA,MAAE;AAAA,IAAE,GAAG,MAAM,SAAS;AAAE,UAAI;AAAE,eAAO,MAAM,QAAQ,OAAO;AAAA,MAAE,UAAE;AAAU,cAAM,MAAM;AAAA,MAAE;AAAA,IAAE,EAAE,CAAC;AAAA,EACnM,SAASC,QAAO;AACd,UAAM,MAAM;AACZ,UAAMA;AAAA,EACR;AACF;;;ADtDA,IAAM,MAAI,CAAC,UAAY,OAAO,UAAQ,YAAU,0BAA0B,KAAK,KAAK;AACpF,IAAM,QAAM,CAAC,UAAY,SAAO,OAAO,UAAQ,YAAU,CAAC,MAAM,QAAQ,KAAK,KAAG,OAAO,eAAe,KAAK,MAAI,OAAO;AACtH,IAAM,SAAO,CAAC,OAAU,SAAgB;AAAC,MAAG,CAAC,MAAM,KAAK,KAAG,OAAO,KAAK,KAAK,EAAE,KAAK,CAAAC,SAAK,CAAC,KAAK,SAASA,IAAG,CAAC,EAAE,MAAK,sBAAsB;AAAE,SAAO;AAAK;AACtJ,IAAM,SAAO,CAAC,QAAc,UAAe;AAAC,QAAM,OAAK,SAAS,QAAO,KAAK;AAAE,SAAO,SAAO,MAAI,CAAC,KAAK,WAAW,IAAI,KAAG,CAACC,YAAW,IAAI;AAAC;AAElI,SAAS,oBAAoB,OAAU,SAAe,OAA+C;AAC3G,MAAG,UAAQ,OAAU,QAAO,CAAC;AAC7B,MAAG,CAAC,MAAM,QAAQ,KAAK,KAAG,MAAM,SAAO,MAAI,CAAC,CAAC,SAAQ,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAAE,MAAK,4BAA4B;AAC1H,QAAM,OAAK,oBAAI,IAAY,GAAE,eAAa,oBAAI,IAAY;AAC1D,SAAO,MAAM,IAAI,SAAK;AACrB,WAAO,KAAI,CAAC,aAAY,UAAS,mBAAkB,cAAa,eAAc,SAAQ,MAAM,CAAC;AAC7F,QAAG,CAAC,IAAI,IAAI,SAAS,KAAG,CAAC,IAAI,IAAI,MAAM,KAAG,CAAC,OAAO,OAAO,OAAM,IAAI,MAAM,KAAG,CAAC,OAAO,cAAc,IAAI,eAAe,KAAG,IAAI,kBAAgB,KACzI,CAACA,YAAW,IAAI,UAAU,KAAG,CAACA,YAAW,IAAI,WAAW,KAAG,CAAC,OAAOC,SAAQ,OAAO,GAAEA,SAAQ,IAAI,WAAW,CAAC,EAAE,MAAK,4BAA4B;AAClJ,WAAO,IAAI,OAAM,CAAC,UAAS,SAAS,CAAC;AACrC,QAAG,CAAC,iBAAiB,KAAK,IAAI,MAAM,MAAM,KAAG,CAAC,yCAAyC,KAAK,IAAI,MAAM,OAAO,EAAE,MAAK,4BAA4B;AAChJ,QAAG,CAAC,MAAM,IAAI,IAAI,KAAG,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,OAAO,MAAK,4BAA4B;AACpF,eAAU,CAAC,OAAM,GAAG,KAAK,OAAO,QAAa,IAAI,IAAI,GAAE;AACtD,UAAG,CAAC,IAAI,KAAK,EAAE,MAAK,4BAA4B;AAAE,aAAO,KAAI,CAAC,eAAe,CAAC;AAC9E,UAAG,CAACD,YAAW,IAAI,aAAa,KAAG,IAAI,cAAc,SAAO,QAAM,IAAI,cAAc,SAAS,IAAI,EAAE,MAAK,4BAA4B;AAAA,IACrI;AACA,UAAMD,OAAI,GAAG,IAAI,MAAM,IAAI,IAAI,SAAS,IAAG,UAAQE,SAAQ,IAAI,WAAW;AAC1E,QAAG,KAAK,IAAIF,IAAG,KAAG,aAAa,IAAI,OAAO,EAAE,MAAK,4BAA4B;AAAE,SAAK,IAAIA,IAAG;AAAE,iBAAa,IAAI,OAAO;AACrH,WAAO,EAAC,WAAU,IAAI,WAAU,QAAO,IAAI,QAAO,iBAAgB,IAAI,iBAAgB,YAAWE,SAAQ,IAAI,UAAU,GAAE,aAAY,SAAQ,OAAM,EAAC,QAAO,IAAI,MAAM,QAAO,SAAQ,IAAI,MAAM,QAAO,GAAE,MAAK,gBAAgB,IAAI,IAAI,EAAC;AAAA,EACtO,CAAC;AACF;AAKO,IAAM,WAAN,MAAc;AAAA,EAEpB,YAAY,aAAuC,OAAoB,OAAY;AAAhC;AAAoB;AACtE,SAAK,WAAS,IAAI,IAAI,YAAY,IAAI,aAAS,CAAC,GAAG,QAAQ,MAAM,IAAI,QAAQ,SAAS,IAAG,OAAO,CAAC,CAAC;AAAA,EACnG;AAAA,EAFmD;AAAA,EAAoB;AAAA,EAD/D;AAAA,EAIR,MAAc,SAAS,GAAM,GAAU,OAAgC;AACtE,UAAM,OAAK,CAAC,UAAS,gBAAe,aAAY,mBAAkB,SAAQ,kBAAiB,mBAAkB,gBAAe,WAAU,YAAY;AAClJ,WAAO,GAAE,CAAC,GAAG,MAAK,GAAI,QAAM,CAAC,IAAE,CAAC,MAAM,CAAE,CAAC;AAAE,WAAO,EAAE,cAAa,CAAC,QAAO,aAAY,UAAS,gBAAe,aAAa,CAAC;AAAE,WAAO,EAAE,OAAM,CAAC,UAAS,SAAS,CAAC;AAChK,QAAG,CAAC,IAAI,EAAE,MAAM,KAAG,CAAC,EAAE,MAAM,SAAS,EAAE,MAAM,KAAG,CAAC,IAAI,EAAE,SAAS,KAAG,CAAC,OAAO,cAAc,EAAE,eAAe,KAAG,EAAE,kBAAgB,KAC5H,EAAE,aAAa,SAAO,YAAU,EAAE,aAAa,cAAY,KAAK,MAAM,aAAW,EAAE,aAAa,WAAS,EAAE,UAC3G,OAAO,EAAE,aAAa,iBAAe,YAAU,EAAE,aAAa,aAAa,SAAO,QAAM,OAAO,EAAE,aAAa,gBAAc,YAC5H,CAAC,iBAAiB,KAAK,EAAE,MAAM,MAAM,KAAG,CAAC,yCAAyC,KAAK,EAAE,MAAM,OAAO,KACtG,CAAC,8BAA8B,KAAK,EAAE,cAAc,KAAG,OAAO,EAAE,oBAAkB,YAAU,CAAC,EAAE,mBAAiB,OAAO,EAAE,iBAAe,YAAU,CAAC,EAAE,gBACrJ,CAAC,CAAC,OAAM,cAAc,EAAE,SAAS,EAAE,OAAO,KAAG,CAAC,OAAO,cAAc,EAAE,UAAU,KAAG,EAAE,aAAW,OAAM,EAAE,aAAW,KAAQ,MAAK,sBAAsB;AACxJ,QAAG,CAAC,UAAQ,OAAO,EAAE,SAAO,YAAU,CAAC,EAAE,KAAK,KAAK,KAAG,EAAE,KAAK,SAAS,IAAI,KAAG,OAAO,WAAW,EAAE,IAAI,IAAE,MAAO,MAAK,sBAAsB;AACzI,UAAM,UAAQ,KAAK,SAAS,IAAI,GAAG,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE;AAC5D,QAAG,CAAC,WAAS,QAAQ,oBAAkB,EAAE,mBAAiB,QAAQ,MAAM,WAAS,EAAE,MAAM,UAAQ,QAAQ,MAAM,YAAU,EAAE,MAAM,WAAS,CAAC,OAAO,OAAO,QAAQ,MAAK,EAAE,KAAK,EAAE,MAAK,sBAAqB,GAAG;AAC5M,UAAM,cAAY,YAAU,IAAI,UAAU,EAAC,QAAO,EAAE,QAAO,uBAAsB,EAAE,aAAa,cAAa,WAAU,EAAE,WAAU,iBAAgB,EAAE,iBAAgB,aAAY,EAAE,MAAM,QAAO,cAAa,EAAE,MAAM,QAAO,CAAC,CAAC;AAC9N,QAAG,EAAE,aAAa,gBAAc,YAAY,MAAK,mCAAkC,GAAG;AACtF,UAAM,MAAI,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,aAAa,YAAY;AACvE,QAAG,EAAE,MAAMC,MAAK,GAAG,GAAG,YAAY,EAAE,MAAK,+BAA8B,GAAG;AAC1E,UAAM,MAAI,MAAM,aAAa,QAAQ,GAAG;AAAE,UAAM,IAAI,OAAO;AAC3D,WAAO,EAAC,MAAK,GAAE,SAAQ,aAAY,IAAG;AAAA,EACvC;AAAA,EACA,MAAc,UAAU,SAAyB,GAAU,MAAY;AACtE,UAAM,YAAU,QAAQ,KAAK,EAAE,KAAK,EAAE;AACtC,UAAM,QAAM,MAAMC,UAAS,SAAS;AACpC,QAAG,MAAM,SAAO,MAAM,MAAK,iCAAiC;AAC5D,UAAMC,WAAUC,MAAK,MAAK,WAAW,GAAE,OAAM,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AAAA,EACpE;AAAA,EACA,MAAc,QAAQ,UAAkB,GAAU,aAAmB,QAAmB;AACvF,UAAM,EAAC,MAAAC,OAAK,SAAQ,aAAY,IAAG,IAAE;AACrC,WAAO,wBAAwB;AAAA,MAAC,SAAQ;AAAA,MAAE,UAAS,MAAI,KAAK,MAAM,SAAS,CAAC;AAAA,MAAE,SAAQ,EAAC,QAAO,EAAE,QAAO,WAAU,EAAE,WAAU,WAAU,KAAK,MAAM,WAAU,aAAY,UAAS,SAAQ;AAAA,MAAE;AAAA,MAC1L,aAAY,QAAQ;AAAA,MAAY,WAAU,IAAI,SAAS;AAAA,MAAK,OAAM,EAAC,YAAW,QAAQ,YAAW,GAAG,QAAQ,MAAK;AAAA,MAAE,gBAAeA,MAAK;AAAA,MAAe,iBAAgBA,MAAK;AAAA,MAAgB,cAAaA,MAAK;AAAA,MAC7M,SAAQA,MAAK;AAAA,MAAQ,YAAWA,MAAK;AAAA,MAAW,OAAM,CAAC;AAAA,MAAE,UAAS,CAAC;AAAA,MAAE;AAAA,MAAO,sBAAqB,CAAC,SAAc,KAAK,UAAU,SAAQ,GAAE,IAAI;AAAA,IAAC,CAAC;AAAA,EACjJ;AAAA,EACQ,cAAc,UAAkBC,WAAa;AACpD,UAAM,EAAC,MAAAD,OAAK,IAAG,IAAE;AACjB,WAAO,EAAC,GAAGC,WAAS,QAAO,EAAC,QAAOD,MAAK,QAAO,uBAAsBA,MAAK,aAAa,cAAa,WAAUA,MAAK,WAAU,iBAAgBA,MAAK,iBAAgB,mBAAkB,IAAI,SAAQ,EAAC;AAAA,EAClM;AAAA,EACA,MAAM,MAAM,GAAM,GAAU,aAAoB;AAC/C,QAAG,CAAC,YAAY,MAAK,uBAAuB;AAC5C,UAAM,WAAS,MAAM,KAAK,SAAS,GAAE,GAAE,IAAI,GAAE,aAAW,IAAI,gBAAgB;AAAE,QAAI;AAClF,QAAG;AACF,gBAAQ,MAAM,KAAK,QAAQ,UAAS,GAAE,aAAY,WAAW,MAAM;AACnE,YAAM,YAAU,MAAM,QAAQ,iBAAiB,GAAE,OAAK,MAAM,QAAQ,MAAM,GAAEC,YAAS,KAAK,cAAc,UAAS,QAAQ,SAAS,CAAC;AACnI,UAAG,MAAM,gBAAc,KAAK,MAAK,wBAAuB,GAAG;AAC3D,aAAO;AAAA,QAAC,eAAc;AAAA,QAAE,MAAK;AAAA,QAAmB,QAAO;AAAA,QAAY,UAAS;AAAA,QAAS,WAAU,KAAK,MAAM;AAAA,QAAU,QAAO,EAAE;AAAA,QAAO,aAAY,SAAS;AAAA,QACxJ,uBAAsB,EAAE,aAAa;AAAA,QAAa,mBAAkB,SAAS,IAAI;AAAA,QAAS,WAAU,EAAE;AAAA,QAAU,iBAAgB,EAAE;AAAA,QAClI,OAAM,EAAC,QAAO,EAAE,MAAM,QAAO,SAAQ,EAAE,MAAM,SAAQ,MAAK,QAAQ,MAAM,KAAI;AAAA,QAAE,gBAAe,EAAE;AAAA,QAAe,aAAY;AAAA,QAAU,eAAc;AAAA,QAAY,kBAAiB;AAAA,QAC/K,cAAa;AAAA,QAAY,eAAc;AAAA,QAAY,iBAAgB;AAAA,QAAY;AAAA,QAAU,MAAK,QAAQ;AAAA,QAAK,KAAI,SAAS,IAAI,SAAS;AAAA,QAAK,eAAc;AAAA,QAAK,cAAa;AAAA,QAC1K,iBAAgBA,UAAS;AAAA,QAAgB,SAAQA,UAAS;AAAA,MAAO;AAAA,IACnE,UAAC;AAAQ,YAAM,SAAS,MAAM,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAE,iBAAW,MAAM;AAAE,YAAM,SAAS,IAAI,MAAM;AAAA,IAAC;AAAA,EAC5F;AAAA,EACA,MAAM,IAAI,GAAM,GAAU,aAAmB,OAAgF;AAC5H,QAAI,UAA4B,SAAY,OAAS,MAAKC,SAAU;AACpE,UAAM,aAAW,IAAI,gBAAgB;AACrC,UAAM,WAAW,EAAC,SAAQ,GAAE,QAAO,YAAS;AAAC,iBAAW,MAAM,IAAI,MAAM,WAAW,CAAC;AAAE,YAAM,SAAS,MAAM;AAAA,IAAC,EAAC,CAAC;AAC9G,QAAG;AACF,iBAAS,MAAM,KAAK,SAAS,GAAE,GAAE,KAAK;AACtC,gBAAQ,MAAM,KAAK,QAAQ,UAAS,GAAE,aAAY,WAAW,MAAM;AACnE,YAAM,SAAS,IAAI,OAAO;AAAE,YAAM,QAAQ,IAAI,EAAE,IAAI;AAAE,YAAM,SAAS,IAAI,OAAO;AAAA,IACjF,SAAO,GAAE;AAAC,MAAAA,SAAM;AAAA,IAAC,UACjB;AACC,UAAG;AAAC,eAAK,MAAM,SAAS,MAAM;AAAA,MAAC,SAAO,GAAE;AAAC,QAAAA,WAAQ;AAAA,MAAC;AAClD,UAAG,SAAS,OAAM,SAAS,IAAI,MAAM;AAAE,YAAM,aAAa;AAAA,IAC3D;AACA,UAAM,OAAK,SAAS,SAAS,GAAE,UAAQ,YAAU,OAAK,KAAK,cAAc,UAAS,IAAI,IAAE,MAAK,gBAAc,MAAM,gBAAc;AAC/H,QAAG,WAAS,iBAAe,WAAW,OAAO,WAAS,CAAC,CAAC,aAAY,QAAQ,EAAE,SAAS,QAAQ,QAAQ,EAAE,SAAQ,WAAS;AAC1H,UAAMC,YAAS,SAAS,aAAW,cAAY,cAAY,SAAS,aAAW,WAAS,WAAS,SAAS,aAAW,gBAAc,cAAY;AAC/I,UAAM,SAAO,CAAC,gBAAc,YAAUD,UAAOC,cAAW,cAAY,YAAUA;AAC9E,UAAM,OAAK,WAAS,YAAU,oBAAkB,WAAS,cAAY,cAAY,WAAS,WAAUD,QAAO,QAAM,oBAAmB;AACpI,UAAM,SAAO;AAAA,MAAC,MAAK;AAAA,MAAa,eAAc;AAAA,MAAE;AAAA,MAAQ;AAAA,MAAc,cAAa,QAAM,EAAC,aAAY,OAAM,QAAO,cAAa;AAAA,MAAE,UAAS,OAAO,cAAc,MAAM,QAAQ,IAAE,KAAK,WAAS;AAAA,MAC7L,GAAI,SAAS,8BAA4B,IAAE,EAAC,YAAW,MAAK,iBAAgB,MAAK,IAAE,CAAC;AAAA,IAAE;AACvF,WAAO,EAAC,QAAO,QAAO,OAAM,KAAI;AAAA,EACjC;AACD;;;AbjGA,IAAM,gBAAcE,WAAUC,SAAQ;AACtC,IAAM,uBAAqB,MAAI,OAAK;AAE7B,IAAM,QAAN,MAAY;AAAA,EAEjB,YAAmB,QAAmB,UAAc;AAAjC;AAAkC,UAAM,cAAY,oBAAoB,OAAO,aAAY,OAAO,SAAQ,OAAO,KAAK;AAAE,SAAK,QAAM,IAAI,MAAMC,SAAQ,OAAO,OAAO,GAAE,QAAQ;AAAE,SAAK,QAAM,IAAI,MAAM,OAAO,OAAM,EAAC,gBAAe,CAACA,SAAQ,OAAO,OAAO,GAAE,GAAI,OAAO,UAAQ,CAACA,SAAQ,OAAO,QAAQ,UAAU,CAAC,IAAE,CAAC,CAAE,EAAC,CAAC;AAAE,SAAK,WAAS,IAAI,SAAS,aAAY,KAAK,OAAM,KAAK,KAAK;AAAE,SAAK,UAAQ,IAAI,aAAa,OAAO,kBAAgB,CAAC,GAAE,OAAO,uBAAsB,QAAU,OAAO,eAAe;AAAE,SAAK,UAAQ,IAAI,aAAa,OAAO,SAAQ,EAAC,UAAS,OAAG,KAAK,MAAM,SAAS,CAAC,EAAC,CAAC;AAChlB,QAAG;AAIF,WAAK,kBAAgB,gBAAgB,OAAO,KAAK;AACjD,WAAK,aAAW,IAAI,oBAAoB,KAAK,OAAM,KAAK,eAAe;AACvE,WAAK,MAAM,GAAG,KAAK,6HAA6H;AAGhJ,WAAK,MAAM,GAAG,KAAK;AAAA,mTAC2R;AAC9S,YAAM,mBAAiB,yBAAyB,KAAK,MAAM,IAAG,KAAK,eAAe;AAClF,UAAG,iBAAiB,QAAQ,MAAK,MAAM,MAAM,oCAAoC;AACjF,UAAG,OAAO,WAAU;AAAC,YAAG,OAAO,cAAY,eAAa,OAAO,KAAK,OAAO,eAAa,CAAC,CAAC,EAAE,UAAQ,OAAO,SAAO,OAAO,iBAAiB,MAAK,0BAA0B;AAAE,aAAK,YAAU,IAAI,kBAAkB,KAAK,OAAM,OAAO,SAAS;AAAA,MAAC,WAAS,OAAO,cAAY,YAAY,MAAK,0BAA0B;AAAA,IACpT,SAAO,GAAE;AAAC,WAAK,MAAM,MAAM;AAAE,YAAM;AAAA,IAAC;AACpC,SAAK,kBAAgB,IAAI,gBAAgB,OAAO,SAAQ,EAAC,UAAS,OAAG,KAAK,MAAM,SAAS,CAAC,GAAE,OAAM,CAAC,MAAK,OAAM,cAAY,KAAK,MAAM,MAAM,MAAK,OAAM,SAAS,EAAC,CAAC;AACjK,SAAK,YAAU,YAAY,MAAI;AAAC,iBAAU,KAAK,CAAC,GAAG,KAAK,UAAU,OAAO,GAAE,GAAG,KAAK,YAAY,OAAO,CAAC,GAAE;AAAC,YAAG;AAAC,eAAK,MAAM,SAAS,EAAE,OAAO;AAAA,QAAC,QAAM;AAAC,eAAK,EAAE,OAAO,eAAe;AAAA,QAAC;AAAA,MAAC;AAAC;AAAC,WAAK,KAAK,WAAW,MAAM,CAAC,MAAK,MAAI,KAAK,SAAS,MAAK,GAAE,YAAY,CAAC,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IAAC,GAAE,GAAG;AAAE,SAAK,UAAU,MAAM;AAAA,EAAC;AAAA,EAjBtR;AAAA,EADnB;AAAA,EAAY;AAAA,EAAY;AAAA,EAAqB;AAAA,EAAqB;AAAA,EAAgC;AAAA,EAA+B;AAAA,EAA6B;AAAA,EAAkB;AAAA,EAA+B,YAAU,oBAAI,IAAgB;AAAA,EAAU,OAAK,oBAAI,IAAyB;AAAA,EAAU,cAAY,oBAAI,IAAiE;AAAA,EAAU,kBAAgB,oBAAI,IAAY;AAAA,EAAU,SAAO,oBAAI,IAAY;AAAA,EAAU;AAAA,EAmBzc,MAAM,KAAK,MAAYC,OAAS,GAAU,aAAqB;AAC7D,SAAK,MAAM,SAAS,CAAC;AAAE,QAAG,CAAC,WAAW,SAAS,IAAI,KAAG,CAAC,EAAE,MAAM,SAAS,IAAI,EAAE,MAAK,gBAAe,GAAG;AACrG,QAAGA,OAAM,UAAQ,CAAC,EAAE,MAAM,SAASA,MAAK,MAAM,EAAE,MAAK,gBAAe,GAAG;AACvE,QAAG,SAAO,eAAe,QAAO,KAAK,SAAS,MAAMA,OAAK,GAAE,WAAW;AACtE,QAAG,SAAO,eAAe,QAAO,EAAC,eAAc,GAAE,WAAU,KAAK,MAAM,WAAU,cAAa,eAAc,eAAc,iBAAgB,iBAAgB,KAAK,iBAAgB,IAAG,EAAC,UAAS,QAAQ,UAAS,MAAK,QAAQ,KAAI,GAAE,MAAK,QAAQ,SAAQ,WAAU,KAAK,OAAO,aAAW,eAAc,iBAAgB,KAAK,YAAU,sBAAoB,sBAAqB,WAAU,KAAK,YAAU,MAAM,KAAK,UAAU,MAAM,IAAE,MAAK,cAAa,WAAW,OAAO,QAAI,CAAC,EAAE,WAAW,UAAU,KAAG,CAAC,CAAC,KAAK,OAAO,aAAW,CAAC,KAAK,aAAW,CAAC,EAAE,WAAW,WAAW,EAAE,GAAE,SAAQ,MAAM,KAAK,QAAQ,MAAM,GAAE,OAAM,EAAC,YAAW,CAAC,CAAC,KAAK,aAAW,CAAC,CAAC,OAAO,KAAK,KAAK,OAAO,eAAa,CAAC,CAAC,EAAE,UAAQ,CAAC,CAAC,KAAK,OAAO,OAAM,kBAAiB,KAAK,YAAU,cAAY,QAAQ,aAAW,UAAS,KAAK,OAAO,mBAAiB,0BAAwB,gBAAe,gBAAe,GAAE,SAAQ,EAAC,YAAW,CAAC,CAAC,KAAK,OAAO,SAAQ,QAAO,KAAK,OAAO,UAAQ,eAAa,cAAa,EAAC;AACt7B,QAAG,SAAO,oBAAmB;AAAC,UAAG,KAAK,WAAU;AAAC,cAAM,KAAK,UAAU,QAAQA,MAAK,aAAY,GAAE,CAAC,MAAK,YAAU,KAAK,SAAS,MAAK,SAAQ,YAAY,CAAC;AAAE,aAAK,MAAM,SAAS,CAAC;AAAA,MAAC;AAAC,aAAO,KAAK,gBAAgBA,MAAK,aAAY,CAAC;AAAA,IAAC;AACjO,QAAG,SAAO,oBAAmB;AAC3B,WAAK,MAAM,OAAOA,MAAK,aAAY,CAAC;AACpC,YAAM,IAAE,KAAK,UAAU,IAAIA,MAAK,WAAW,GAAE,UAAQ,KAAK,YAAY,IAAIA,MAAK,WAAW,GAAE,UAAQ,KAAK,KAAK,IAAIA,MAAK,WAAW;AAClI,UAAI,YAAU,CAAC,CAAC,KAAG,CAAC,CAAC,WAAS;AAC9B,UAAG,EAAE,OAAM,EAAE,OAAO,WAAW;AAAA,eAAU,QAAQ,OAAM,QAAQ,OAAO,WAAW;AAAA,eAAU,QAAQ,MAAK,gBAAgB,IAAIA,MAAK,WAAW;AAAA,eAAU,KAAK,UAAU,aAAU,MAAM,KAAK,UAAU,OAAOA,MAAK,aAAY,CAAC;AAC7N,UAAG,KAAK,WAAU;AAAC,cAAM,KAAK,UAAU,QAAQA,MAAK,aAAY,GAAE,CAAC,MAAK,YAAU,KAAK,SAAS,MAAK,SAAQ,YAAY,CAAC;AAAE,aAAK,MAAM,SAAS,CAAC;AAAA,MAAC;AACnJ,YAAM,YAAU,KAAK,gBAAgBA,MAAK,aAAY,CAAC;AACvD,YAAMC,YAAS,CAAC,aAAY,UAAS,WAAW,EAAE,SAAS,UAAU,MAAM;AAU3E,YAAM,iBAAe,UAAU,SAAO,cAAY,CAAC,CAAC,UAAU;AAC9D,YAAM,WAAS,UAAU,SAAO,eAAa,UAAU,QAAQ,kBAAgB,QAAM,UAAU,QAAQ,eAAa;AACpH,YAAM,eAAa,UAAU,SAAO,cAAa,CAAC,KAAK,KAAK,IAAID,MAAK,WAAW,KAAG,CAAC,KAAK,UAAU,IAAIA,MAAK,WAAW;AACvH,YAAM,gBAAcC,aAAU,iBAAe,kBAAgB;AAC7D,aAAO,EAAC,iBAAgB,WAAU,eAAc,GAAI,iBAAe,UAAU,YAAU,EAAC,WAAU,UAAU,UAAS,IAAE,CAAC,GAAG,UAAS;AAAA,IACtI;AACA,QAAG,CAAC,WAAW,IAAI,EAAE,QAAO,KAAK,QAAQ,MAAKD,OAAK,CAAC;AACpD,QAAG,CAAC,YAAY,MAAK,uBAAuB;AAAE,UAAM,WAAS,KAAK,MAAM,MAAM,aAAY,GAAE,MAAKA,KAAI;AAAE,QAAG,CAAC,SAAS,MAAM,QAAO,SAAO,aAAW,KAAK,gBAAgB,aAAY,CAAC,IAAE,SAAS;AAChM,SAAK,MAAM,QAAQ,WAAW;AAC9B,QAAG,SAAO,eAAc;AACtB,YAAM,OAAK,YAAS;AAClB,YAAI;AACJ,YAAG;AAAC,oBAAQ,MAAM,KAAK,SAAS,IAAIA,OAAK,GAAE,aAAY,EAAC,YAAW,YAAQ,KAAK,UAAU,IAAI,aAAY,MAAM,GAAE,cAAa,MAAI,KAAK,UAAU,OAAO,WAAW,EAAC,CAAC;AAAA,QAAC,SACjK,GAAM;AAAC,oBAAQ,EAAC,QAAO,WAAU,QAAO,EAAC,MAAK,cAAa,eAAc,GAAE,SAAQ,MAAK,eAAc,OAAM,cAAa,EAAC,aAAY,OAAM,QAAO,cAAa,EAAC,GAAE,OAAM,kBAAiB;AAAA,QAAC;AACjM,aAAK,KAAK,OAAO,WAAW;AAAE,aAAK,UAAU,OAAO,WAAW;AAAE,aAAK,gBAAgB,OAAO,WAAW;AACxG,aAAK,MAAM,OAAO,aAAY,QAAQ,QAAO,QAAQ,QAAO,QAAQ,KAAK;AACzE,eAAO,KAAK,gBAAgB,aAAY,CAAC;AAAA,MAC3C,GAAG,EAAE,QAAQ,MAAI;AAAC,aAAK,KAAK,OAAO,WAAW;AAAE,aAAK,UAAU,OAAO,WAAW;AAAE,aAAK,gBAAgB,OAAO,WAAW;AAAA,MAAC,CAAC;AAC5H,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,aAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,IACvE;AACA,QAAG,SAAO,gBAAc,SAAO,wBAAuB;AAMpD,YAAM,cAAY,SAAO;AACzB,YAAM,OAAK,YAAS;AAClB,YAAG,aAAY;AACb,cAAG,CAAC,KAAK,UAAU,MAAK,iCAAgC,GAAG;AAC3D,cAAGA,OAAM,WAAS,UAAW,CAACA,OAAM,cAAc,OAAO,MAAK,kBAAkB;AAAA,QAClF;AACA,eAAO,KAAK,YAAU,KAAK,cAAcA,MAAK,cAAc,QAAO,GAAE,aAAY,MAAI,KAAK,MAAMA,OAAK,GAAE,WAAW,CAAC,IAAE,KAAK,MAAMA,OAAK,GAAE,WAAW;AAAA,MACpJ,GAAG,EAAE,MAAM,OAAG;AACZ,cAAM,aAAW,eAAa,CAAC,KAAK,aAAY,KAAK,aAAW,CAAC,KAAK,MAAM,GAAG,QAAQ,sDAAsD,EAAE,IAAI,WAAW;AAC9J,aAAK,MAAM,OAAO,aAAY,UAAS,aAAW,EAAC,YAAW,MAAK,eAAc,MAAK,iBAAgB,MAAK,IAAE,MAAK,aAAa,aAAW,EAAE,OAAK,kBAAkB;AAAA,MACrK,CAAC,EAAE,QAAQ,MAAI;AAAC,aAAK,KAAK,OAAO,WAAW;AAAE,aAAK,gBAAgB,OAAO,WAAW;AAAA,MAAC,CAAC;AAAE,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,aAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,IAAC;AACjK,QAAG,SAAO,YAAW;AACnB,YAAM,aAAW,IAAI,gBAAgB;AACrC,WAAK,UAAU,IAAI,aAAY,EAAC,SAAQ,GAAE,QAAO,OAAM,QAAa;AAAC,mBAAW,MAAM,IAAI,WAAW,GAAG,CAAC;AAAA,MAAC,EAAC,CAAC;AAC5G,YAAM,OAAK,YAAS;AACnB,YAAG;AACF,gBAAM,SAAO,MAAM,KAAK,cAAcA,MAAK,QAAO,GAAE,aAAY,SAAK,KAAK,QAAQ,MAAKA,OAAK,GAAE,WAAW,QAAO,GAAG,CAAC;AACpH,eAAK,MAAM,OAAO,aAAY,WAAW,OAAO,UAAQ,cAAY,aAAY,WAAW,OAAO,UAAQ,EAAC,GAAG,QAAO,eAAc,MAAK,iBAAgB,KAAI,IAAE,EAAC,GAAG,QAAO,eAAc,KAAI,GAAE,WAAW,OAAO,UAAQ,cAAY,IAAI;AAAA,QACxO,SAAO,GAAM;AACZ,gBAAM,YAAU,GAAG,SAAO,mBAAkB,YAAU,GAAG,cAAY,MAAKE,WAAQ,CAAC,cAAY,aAAW,GAAG,SAAO;AAIpH,gBAAMC,UAAO,aAAW,aAAW,GAAG,UAAQ,iBAAiB,KAAK,EAAE,OAAO,MAAM,KAAG,OAAO,cAAc,EAAE,OAAO,IAAI,KAAG,EAAE,OAAO,QAAM,KAAG,EAAE,OAAO,QAAM,UAAQ,EAAC,QAAO,EAAE,OAAO,QAAO,MAAK,EAAE,OAAO,KAAI,IAAE,CAAC;AACjN,eAAK,MAAM,OAAO,aAAY,YAAU,cAAYD,WAAQ,YAAU,UAASA,WAAQ,OAAK,EAAC,eAAc,MAAK,iBAAgB,aAAW,GAAG,oBAAkB,QAAM,QAAM,MAAK,GAAGC,QAAM,GAAE,aAAW,YAAU,cAAYD,WAAQ,oBAAkB,aAAa,aAAW,EAAE,OAAK,kBAAkB;AAAA,QACzS,UACA;AAAQ,eAAK,KAAK,OAAO,WAAW;AAAE,eAAK,UAAU,OAAO,WAAW;AAAE,eAAK,gBAAgB,OAAO,WAAW;AAAA,QAAC;AAGjH,cAAM,YAAU,KAAK,MAAM,OAAO,aAAY,CAAC;AAC/C,YAAG,CAAC,aAAY,UAAS,WAAW,EAAE,SAAS,UAAU,MAAM,GAAE;AAChE,gBAAM,QAAM,EAAC,eAAc,GAAE,MAAK,sBAAqB,QAAO,oBAAmB,WAAU,KAAK,MAAM,WAAU,QAAO,EAAE,QAAO,WAAU,EAAE,WAAU,aAAY,MAAK,YAAW,QAAO,UAAU,QAAO,aAAY,IAAI,UAAU,SAAS,CAAC,EAAC;AAC/O,eAAK,MAAM,GAAG,QAAQ,wDAAwD,EAAE,IAAI,aAAY,UAAU,KAAK,CAAC;AAAA,QACjH;AACA,eAAO,KAAK,gBAAgB,aAAY,CAAC;AAAA,MAC1C,GAAG;AACH,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,aAAO;AAAA,IACxC;AACA,QAAG,KAAK,WAAW,UAAU,GAAE;AAC7B,YAAM,aAAW,IAAI,gBAAgB;AAAE,UAAI;AAC3C,YAAM,SAAO,OAAM,QAAa;AAAC,mBAAW,MAAM,IAAI,WAAW,GAAG,CAAC;AAAE,cAAM,KAAK,QAAQ,OAAO,CAAC;AAAE,cAAM;AAAA,MAAG;AAC7G,aAAK,YAAS;AACZ,YAAG;AAAC,gBAAM,SAAO,MAAM,KAAK,QAAQ,MAAKF,OAAK,GAAE,WAAW,MAAM;AAAE,eAAK,MAAM,SAAS,CAAC;AAAE,cAAG,WAAW,OAAO,SAAQ;AAAC,kBAAM,OAAK,MAAM,KAAK,QAAQ,OAAO,CAAC;AAAE,kBAAM,OAAO,OAAO,IAAI,WAAW,KAAK,gBAAc,sBAAoB,iBAAiB,GAAE,EAAC,eAAc,KAAK,eAAc,iBAAgB,SAAO,qBAAoB,CAAC;AAAA,UAAC;AAAC,eAAK,MAAM,OAAO,aAAY,aAAY,MAAM;AAAA,QAAC,SACxX,GAAM;AACV,cAAG,EAAE,SAAO,iBAAgB;AAAC,uBAAW,MAAM,CAAC;AAAE,kBAAM,OAAK,MAAM,KAAK,QAAQ,OAAO,CAAC;AAAE,gBAAE,OAAO,OAAO,IAAI,WAAW,KAAK,gBAAc,sBAAoB,iBAAiB,GAAE,EAAC,eAAc,KAAK,eAAc,iBAAgB,SAAO,qBAAoB,CAAC;AAAA,UAAC;AACjQ,gBAAM,OAAK,aAAa,aAAW,EAAE,OAAK,oBAAmB,UAAQ,EAAE,kBAAgB,MAAK,kBAAgB,EAAE,oBAAkB;AAChI,gBAAM,QAAM,SAAO,uBAAqB,UAAQ,cAAY,SAAO,qBAAmB,kBAAgB,YAAU;AAChH,eAAK,MAAM,OAAO,aAAY,OAAM,EAAC,eAAc,SAAQ,iBAAgB,cAAa,WAAW,OAAO,UAAS,WAAW,OAAO,QAAQ,QAAM,cAAa,KAAI,GAAE,IAAI;AAAA,QAC5K,UAAC;AAAQ,eAAK,YAAY,OAAO,WAAW;AAAE,eAAK,KAAK,OAAO,WAAW;AAAA,QAAC;AAC3E,eAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,MACxC,GAAG;AACH,WAAK,KAAK,IAAI,aAAY,GAAG;AAAE,WAAK,YAAY,IAAI,aAAY,EAAC,SAAQ,GAAE,OAAM,CAAC;AAAE,aAAO;AAAA,IAC7F;AACA,QAAG;AAAC,YAAM,SAAO,MAAM,KAAK,QAAQ,MAAKA,OAAK,CAAC;AAAE,WAAK,MAAM,OAAO,aAAY,aAAY,MAAM;AAAA,IAAC,SAAO,GAAE;AAAC,WAAK,MAAM,OAAO,aAAY,aAAa,cAAY,EAAE,SAAO,oBAAkB,YAAU,UAAS,MAAK,aAAa,aAAW,EAAE,OAAK,kBAAkB;AAAA,IAAC;AACxQ,WAAO,KAAK,MAAM,OAAO,aAAY,CAAC;AAAA,EACxC;AAAA,EACQ,gBAAgBI,KAAU,GAAU;AAC1C,UAAM,YAAU,KAAK,MAAM,OAAOA,KAAG,CAAC,GAAE,QAAM,KAAK,MAAM,GAAG,QAAQ,4DAA4D,EAAE,IAAIA,GAAE;AACxI,QAAG,CAAC,SAAO,KAAK,KAAK,IAAIA,GAAE,KAAG,KAAK,UAAU,IAAIA,GAAE,EAAE,QAAO;AAC5D,UAAM,QAAM,KAAK,MAAM,MAAM,KAAK;AAClC,QAAG,MAAM,kBAAgB,KAAG,MAAM,SAAO,wBAAsB,MAAM,WAAS,sBAAoB,MAAM,cAAY,UAAU,aAAW,MAAM,WAAS,EAAE,UAAQ,MAAM,cAAY,EAAE,aAAW,MAAM,gBAAcA,OAAI,MAAM,SAAO,UAAU,QAAM,MAAM,WAAS,UAAU,UAAQ,MAAM,gBAAc,IAAI,UAAU,SAAS,CAAC,EAAE,QAAO;AAC5U,WAAO,EAAC,GAAG,WAAU,WAAU,MAAK;AAAA,EACtC;AAAA,EACA,MAAM,SAAS,MAAY,GAAU,QAAM,4BAA2B;AACpE,QAAG,KAAK,SAAO,IAAE,OAAK,KAAK,MAAK,kBAAiB,GAAG;AAKpD,UAAM,QAAM,MAAM,KAAK,eAAe,KAAK,MAAM;AACjD,QAAG,QAAM,KAAK,SAAO,qBAAqB,MAAK,kBAAiB,GAAG;AACnE,UAAMA,MAAG,YAAYC,YAAW,CAAC;AAAG,UAAMC,OAAMC,MAAK,KAAK,OAAO,SAAQ,WAAW,GAAE,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,UAAMC,WAAUD,MAAK,KAAK,OAAO,SAAQ,aAAYH,GAAE,GAAE,MAAK,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AACvM,SAAK,MAAM,GAAG,QAAQ,0CAA0C,EAAE,IAAIA,KAAG,UAAU,CAAC,GAAE,IAAI,IAAI,GAAE,KAAK,QAAO,KAAK;AAAE,WAAO,EAAC,YAAWA,KAAG,QAAO,IAAI,IAAI,GAAE,MAAK,KAAK,QAAO,WAAU,MAAK;AAAA,EAC5L;AAAA,EACA,MAAc,eAAe,QAAc;AACzC,QAAI,QAAa,KAAK,MAAM,GAAG,QAAQ,qDAAqD,EAAE,IAAI,EAAE;AACpG,QAAG,QAAM,UAAQ,qBAAqB,QAAO;AAC7C,UAAM,OAAW,KAAK,MAAM,GAAG,QAAQ,kDAAkD,EAAE,IAAI;AAC/F,eAAU,OAAO,MAAK;AACpB,UAAG,QAAM,UAAQ,qBAAqB;AACtC,WAAK,MAAM,GAAG,QAAQ,kCAAkC,EAAE,IAAI,IAAI,EAAE;AACpE,eAAO,IAAI;AACX,YAAMK,QAAOF,MAAK,KAAK,OAAO,SAAQ,aAAY,IAAI,EAAE,CAAC,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAM,QAAQ,MAAY,GAAM,GAAU,QAAoB,KAA+B;AAC3F,QAAG,SAAO,WAAU;AAAC,YAAM,MAAI,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,gBAAc,EAAE;AAAE,UAAI,KAAK,CAAC,GAAE,MAAI,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAE,YAAM,SAAO,QAAQ,EAAE,SAAO,OAAO,EAAE,MAAM,IAAE,GAAE,GAAE,GAAG,GAAE,QAAM,QAAQ,EAAE,OAAM,GAAE,KAAK,GAAG;AAAE,aAAO,EAAC,SAAQ,IAAI,MAAM,QAAO,SAAO,KAAK,EAAE,IAAI,QAAI,EAAC,MAAK,EAAE,MAAK,MAAK,EAAE,eAAe,IAAE,SAAO,EAAE,YAAY,IAAE,cAAY,OAAM,EAAE,GAAE,QAAO,SAAO,QAAM,IAAI,SAAO,OAAO,SAAO,KAAK,IAAE,KAAI;AAAA,IAAC;AAC5Z,QAAG,SAAO,WAAU;AAAC,YAAM,SAAO,QAAQ,EAAE,QAAO,GAAE,OAAO,kBAAiB,CAAC,GAAE,SAAO,QAAQ,EAAE,QAAO,GAAE,SAAQ,KAAK;AAAE,YAAM,EAAC,MAAK,KAAI,IAAE,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,QAAO,MAAM;AAAE,aAAO,EAAC,UAAS,UAAS,SAAQ,KAAK,SAAS,QAAQ,GAAE,QAAO,IAAI,IAAI,GAAE,QAAO,MAAK,KAAI,SAAO,KAAK,UAAQ,KAAI;AAAA,IAAC;AAC5T,QAAG,SAAO,WAAW,QAAO,KAAK,MAAM,GAAE,GAAE,QAAO,GAAG;AACrD,QAAG,KAAK,WAAW,WAAW,GAAE;AAAC,YAAM,MAAI,KAAK,MAAM,GAAG,QAAQ,oCAAoC,EAAE,IAAI,EAAE,UAAU;AAAE,UAAG,CAAC,IAAI,MAAK,sBAAqB,GAAG;AAAE,WAAK,MAAM,IAAI,IAAI,SAAQ,CAAC;AAAE,UAAG,SAAO,gBAAgB,QAAO,EAAC,YAAW,IAAI,IAAG,QAAO,IAAI,MAAK,MAAK,IAAI,MAAK,WAAU,IAAI,MAAK;AAAE,YAAM,SAAO,QAAQ,EAAE,QAAO,GAAE,OAAO,kBAAiB,CAAC,GAAE,SAAO,QAAQ,EAAE,QAAO,GAAE,SAAQ,KAAK,GAAE,OAAK,MAAMG,UAASH,MAAK,KAAK,OAAO,SAAQ,aAAY,IAAI,EAAE,CAAC;AAAE,UAAG,IAAI,IAAI,MAAI,IAAI,KAAK,MAAK,kBAAkB;AAAE,aAAO,EAAC,UAAS,UAAS,SAAQ,KAAK,SAAS,QAAO,SAAO,MAAM,EAAE,SAAS,QAAQ,GAAE,KAAI,SAAO,UAAQ,IAAI,KAAI;AAAA,IAAC;AACjnB,QAAG,KAAK,WAAW,UAAU,EAAE,QAAO,KAAK,QAAQ,IAAI,MAAK,GAAE,CAAC;AAC/D,QAAG,KAAK,WAAW,UAAU,GAAE;AAAC,YAAM,SAAO,MAAM,KAAK,QAAQ,IAAI,MAAK,GAAE,GAAE,MAAM;AAAE,WAAK,MAAM,SAAS,CAAC;AAAE,UAAG,OAAO,WAAU;AAAC,cAAM,WAAS,MAAM,KAAK,SAAS,OAAO,KAAK,OAAO,WAAU,QAAQ,GAAE,GAAE,WAAW;AAAE,eAAO,OAAO;AAAU,eAAO,EAAC,GAAG,QAAO,GAAG,SAAQ;AAAA,MAAC;AAAC,aAAO;AAAA,IAAM;AAC9R,QAAG,KAAK,WAAW,WAAW,EAAE,QAAO,KAAK,SAAS,MAAK,GAAE,CAAC;AAC7D,SAAK,kBAAiB,GAAG;AAAA,EAC3B;AAAA,EACA,MAAc,cAAc,QAAc,GAAUH,KAAU,KAAqC;AACjG,QAAG,OAAO,WAAS,YAAU,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,MAAK,2BAA0B,GAAG;AACzF,UAAM,MAAI,MAAM,aAAa,QAAQ,MAAM,KAAK,MAAM,QAAQ,QAAO,EAAE,CAAC;AACxE,QAAG;AACF,YAAM,SAAO,KAAK,MAAM,GAAG,QAAQ,qXAAqX,EAAE,IAAI;AAC9Z,UAAG,OAAO,MAAK,+BAA8B,GAAG;AAIhD,YAAM,mBAAiB,KAAK,MAAM,GAAG,QAAQ,yXAAyX,EAAE,IAAI;AAC5a,UAAG,iBAAiB,MAAK,+BAA8B,GAAG;AAC1D,WAAK,WAAW,MAAMA,KAAG,GAAE,IAAI,QAAQ;AAAE,YAAM,IAAI,OAAO;AAAE,aAAO,MAAM,IAAI,GAAG;AAAA,IACjF,UAAC;AAAQ,YAAM,IAAI,MAAM;AAAA,IAAC;AAAA,EAC5B;AAAA,EACA,MAAM,MAAM,GAAM,GAAU,QAAoB,KAAkB;AAChE,QAAG,QAAQ,QAAQ,OAAM,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,CAAC;AACpG,QAAG,CAAC,OAAO,OAAO,GAAE,cAAc,KAAI,EAAE,iBAAe,QAAM,CAAC,iBAAiB,KAAK,EAAE,YAAY,EAAG,MAAK,wBAAwB;AAClI,QAAG,OAAO,EAAE,YAAU,YAAU,OAAO,WAAW,EAAE,OAAO,IAAE,WAAS,CAAC,CAAC,QAAO,UAAS,MAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAK,kBAAkB;AAC/I,UAAM,SAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,cAAa,IAAI;AAAE,QAAG,KAAK,OAAO,IAAI,MAAM,EAAE,MAAK,gBAAe,GAAG;AAAE,SAAK,OAAO,IAAI,MAAM;AAC9I,QAAG;AACD,UAAG,qBAAqB,EAAE,QAAO,MAAM,KAAK,YAAY,GAAE,GAAE,QAAO,QAAO,GAAG;AAC7E,aAAO,MAAM,KAAK,YAAY,GAAE,GAAE,QAAO,MAAM;AAAA,IACjD,UAAC;AAAQ,WAAK,OAAO,OAAO,MAAM;AAAA,IAAC;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,YAAY,GAAM,GAAU,QAA6B,QAAc,KAAkB;AACrG,QAAG,EAAE,iBAAe,MAAK;AAIvB,UAAG;AAAC,cAAM,QAAM,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,GAAE,OAAO,GAAG;AAAK,YAAG,KAAK,SAAO,QAAQ,MAAK,gBAAgB;AAAE,aAAK,IAAI,IAAI,MAAI,EAAE,eAAa,0BAAwB,gBAAe,IAAI,IAAI,MAAI,EAAE,eAAa,MAAI,GAAG;AAAA,MAAC,SACjO,GAAM;AAAC,YAAG,EAAE,SAAO,SAAS,OAAM;AAAE,aAAK,gBAAe,GAAG;AAAA,MAAC;AAAA,IACpE;AACA,QAAG;AACD,YAAM,SAAO,MAAM,oBAAoB;AAAA,QACrC,UAAS,MAAI,IAAI,SAAS,OAAK,MAAMO,UAAS,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,CAAC;AAAA,QACnF,cAAa,EAAE;AAAA,QAAa,SAAQ,EAAE;AAAA,QAAQ,UAAS,EAAE;AAAA,QAAS;AAAA,QAClE,OAAM,YAAQ,KAAK,kBAAkB,GAAE,GAAE,KAAI,MAAM;AAAA,MAAC,CAAC;AACvD,aAAO,EAAC,QAAO,OAAO,QAAO,MAAK,OAAO,KAAI;AAAA,IAC/C,SAAO,GAAM;AACX,UAAG,aAAa,cAAY,EAAE,SAAO,gBAAgB,MAAK,gBAAe,GAAG;AAC5E,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAEA,MAAgB,kBAAkB,GAAM,GAAU,KAA2B,QAAwC;AACnH,SAAK,MAAM,SAAS,CAAC;AACrB,UAAM,KAAK,MAAM,iBAAiB,OAAO,UAAU;AACnD,QAAG,IAAI,OAAM,IAAI,OAAO;AAAA,EAC1B;AAAA,EACA,MAAc,YAAY,GAAM,GAAU,QAA6B,QAAc;AACnF,UAAM,OAAKJ,MAAK,QAAQ,MAAM,GAAE,cAAcF,YAAW,CAAC,EAAE;AAC5D,QAAG;AAAC,YAAM,SAAO,MAAMO,MAAK,QAAQ,MAAM,CAAC;AAAE,UAAI,WAAqB;AAAK,UAAG;AAAC,oBAAU,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,GAAE,OAAO,GAAG;AAAK,YAAG,SAAS,SAAO,QAAQ,MAAK,gBAAgB;AAAA,MAAC,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,SAAS,OAAM;AAAA,MAAC;AACjP,WAAI,aAAW,OAAK,OAAK,IAAI,QAAQ,OAAK,EAAE,aAAa,MAAK,gBAAe,GAAG;AAChF,YAAM,OAAK,OAAO,KAAK,EAAE,SAAQ,EAAE,YAAU,MAAM;AAAE,YAAMJ,WAAU,MAAK,MAAK,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AACrG,UAAG,QAAQ,QAAQ,OAAM,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,CAAC;AACpG,WAAK,MAAM,SAAS,CAAC;AAAE,YAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,cAAa,IAAI;AAAE,YAAM,MAAI,MAAMI,MAAK,QAAQ,MAAM,CAAC;AAAE,UAAG,IAAI,QAAM,OAAO,OAAK,IAAI,QAAM,OAAO,IAAI,MAAK,gBAAe,GAAG;AACzL,UAAI,UAAoB;AAAK,UAAG;AAAC,mBAAS,MAAM,KAAK,MAAM,KAAK,EAAE,QAAO,EAAE,cAAa,GAAE,OAAO,GAAG;AAAA,MAAI,SAAO,GAAM;AAAC,YAAG,EAAE,SAAO,SAAS,OAAM;AAAA,MAAC;AAClJ,WAAI,YAAU,OAAK,OAAK,IAAI,OAAO,OAAK,EAAE,aAAa,MAAK,gBAAe,GAAG;AAC9E,UAAG,QAAQ,QAAQ,OAAM,OAAO,OAAO,IAAI,WAAW,mBAAkB,GAAG,GAAE,EAAC,iBAAgB,MAAK,CAAC;AACpG,YAAM,OAAO,MAAK,MAAM;AAAE,aAAO,EAAC,QAAO,IAAI,IAAI,GAAE,MAAK,KAAK,OAAM;AAAA,IACrE,UAAC;AAAQ,YAAMH,QAAO,IAAI,EAAE,MAAM,MAAI;AAAA,MAAC,CAAC;AAAA,IAAC;AAAA,EAC3C;AAAA,EACA,MAAM,MAAM,GAAM,GAAUL,KAAU;AACpC,QAAG,CAAC,EAAE,gBAAc,EAAE,aAAa,SAAO,YAAU,EAAE,aAAa,cAAY,KAAK,MAAM,aAAW,CAAC,EAAE,MAAM,SAAS,EAAE,aAAa,MAAM,EAAE,MAAK,2BAA0B,GAAG;AAChL,UAAM,MAAI,MAAM,KAAK,MAAM,QAAQ,EAAE,aAAa,QAAO,EAAE,aAAa,gBAAc,EAAE;AAAE,QAAG,EAAE,MAAMQ,MAAK,GAAG,GAAG,YAAY,EAAE,MAAK,yBAAyB;AAC5J,UAAM,UAAQ,QAAQ,EAAE,WAAU,GAAE,MAAQ,GAAK;AAAE,QAAI,YAAkB;AACzE,QAAG,KAAK,WAAU;AAChB,UAAG,EAAE,MAAK;AAAC,YAAG,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAG,EAAE,KAAK,SAAO,KAAG,EAAE,KAAK,SAAO,OAAK,EAAE,KAAK,KAAK,CAAC,MAAQ,OAAO,MAAI,YAAU,EAAE,SAAS,IAAI,CAAC,EAAE,MAAK,kBAAkB;AAAE,qBAAW,KAAK,OAAO,UAAW,YAAY,EAAE,KAAK,CAAC,CAAC;AAAE,YAAG,CAAC,WAAW,MAAK,0BAAyB,GAAG;AAAE,eAAK,EAAE,KAAK,MAAM,CAAC;AAAA,MAAC,OAC1R;AAAC,YAAG,KAAK,OAAO,UAAW,UAAQ,QAAM,OAAO,EAAE,WAAS,YAAU,EAAE,OAAO,SAAO,QAAQ,MAAK,sBAAqB,GAAG;AAAE,qBAAW;AAAU,eAAK,CAAC,MAAK,EAAE,MAAM;AAAA,MAAC;AACzK,YAAM,MAAI,MAAM,aAAa,QAAQ,GAAG;AACxC,UAAG;AACF,cAAM,KAAK,MAAM,oBAAoB,IAAI,QAAQ;AACjD,aAAK,UAAU,IAAIR,KAAG,EAAC,SAAQ,GAAE,QAAO,CAAC,QAAa,KAAK,UAAW,OAAOA,KAAG,GAAE,GAAG,EAAC,CAAC;AACvF,cAAM,KAAK,UAAU,IAAI,EAAC,IAAAA,KAAG,GAAE,QAAO,EAAE,aAAa,QAAO,WAAU,IAAI,SAAS,MAAK,mBAAkB,IAAI,eAAc,YAAW,MAAK,SAAQ,UAAS,MAAI,KAAK,MAAM,SAAS,CAAC,GAAE,mBAAkB,MAAI,IAAI,OAAO,GAAE,cAAa,MAAI,KAAK,gBAAgB,IAAIA,GAAE,GAAE,UAAS,CAAC,MAAK,YAAU,KAAK,SAAS,MAAK,SAAQ,YAAY,EAAC,CAAC;AAAA,MAC5U,UAAC;AAAQ,aAAK,UAAU,OAAOA,GAAE;AAAE,cAAM,IAAI,MAAM;AAAA,MAAC;AACpD;AAAA,IACF;AACA,QAAG,EAAE,MAAK;AAAC,UAAG,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAG,EAAE,KAAK,SAAO,KAAG,EAAE,KAAK,SAAO,OAAK,EAAE,KAAK,KAAK,CAAC,MAAQ,OAAO,MAAI,YAAU,EAAE,SAAS,IAAI,CAAC,EAAE,MAAK,kBAAkB;AAAE,mBAAW,KAAK,OAAO,cAAc,EAAE,KAAK,CAAC,CAAC;AAAE,UAAG,CAAC,WAAW,MAAK,0BAAyB,GAAG;AAAE,aAAK,EAAE,KAAK,MAAM,CAAC;AAAA,IAAC,OAChR;AAAC,UAAG,CAAC,KAAK,OAAO,SAAO,OAAO,EAAE,WAAS,YAAU,EAAE,OAAO,SAAO,QAAQ,MAAK,sBAAqB,GAAG;AAAE,mBAAW,KAAK,OAAO;AAAM,aAAK,QAAQ,aAAW,UAAQ,CAAC,WAAU,cAAa,mBAAkB,mBAAkB,OAAO,KAAK,EAAE,QAAO,SAAS,EAAE,SAAS,QAAQ,CAAC,IAAE,CAAC,MAAK,EAAE,MAAM;AAAA,IAAC;AAC5S,SAAK,MAAM,SAAS,CAAC;AAAE,QAAG,KAAK,gBAAgB,IAAIA,GAAE,GAAE;AAAC,WAAK,MAAM,OAAOA,KAAG,aAAY,MAAK,WAAW;AAAE;AAAA,IAAM;AACjH,QAAG,QAAQ,aAAW,WAAS,CAAC,KAAK,OAAO,iBAAiB,MAAK,iCAAgC,GAAG;AACrG,UAAM,QAAMS,OAAM,QAAQ,aAAW,UAAQ,KAAK,OAAO,mBAAkB,YAAW,QAAQ,aAAW,UAAQ,CAAC,IAAE,MAAK,EAAC,KAAI,aAAY,MAAK,UAAS,QAAQ,aAAW,SAAQ,KAAI,EAAC,MAAK,QAAQ,IAAI,QAAM,IAAG,YAAW,QAAQ,IAAI,cAAY,IAAG,MAAK,QAAQ,IAAI,QAAM,IAAG,KAAI,QAAQ,IAAI,OAAK,IAAG,MAAK,UAAS,GAAE,OAAM,CAAC,QAAO,QAAO,MAAM,EAAC,CAAC;AACvV,QAAG,QAAQ,aAAW,QAAQ,OAAM,MAAM,IAAI,KAAK,UAAU,EAAC,YAAW,MAAK,MAAK,IAAG,CAAC,IAAE,IAAI;AAAA,QAAO,OAAM,MAAM,IAAI;AACpH,UAAM,MAAM,GAAG,SAAQ,MAAI;AAAA,IAAC,CAAC;AAC7B,QAAI,SAAgB,CAAC,GAAE,SAAgB,CAAC,GAAE,QAAM,GAAE,YAAU,OAAM,SAAmB,MAAK,gBAAiC;AAC3H,UAAM,UAAQ,CAAC,WAAoB,CAAC,UAAe;AAAC,YAAM,YAAU,IAAE,OAAK,OAAK;AAAM,UAAG,YAAU,GAAE;AAAC,eAAO,KAAK,MAAM,SAAS,GAAE,SAAS,CAAC;AAAE,iBAAO,KAAK,IAAI,WAAU,MAAM,MAAM;AAAA,MAAC;AAAC,UAAG,MAAM,SAAO,UAAU,aAAU;AAAA,IAAI;AAC/N,UAAM,OAAO,GAAG,QAAO,QAAQ,MAAM,CAAC;AAAE,UAAM,OAAO,GAAG,QAAO,QAAQ,MAAM,CAAC;AAC9E,UAAM,SAAO,CAAC,QAAa;AAAC,UAAG,cAAc,QAAO;AAAc,eAAO;AAAI,uBAAe,YAAS;AAAC,YAAG,MAAM,aAAW,QAAM,MAAM,eAAa,KAAK;AACtJ,YAAG,QAAQ,aAAW,SAAQ;AAAC,cAAG,CAAC,MAAM,KAAK,SAAS,KAAG,MAAM,aAAW,QAAM,MAAM,eAAa,KAAK,MAAK,MAAM,GAAG,QAAQ,iFAAiF,EAAE,IAAIT,GAAE;AAAA,QAAC,OACpN;AAAC,cAAG;AAAC,oBAAQ,KAAK,CAAC,MAAM,KAAK,SAAS;AAAA,UAAC,QAAM;AAAA,UAAC;AAAC,gBAAM,IAAI,QAAQ,OAAG,WAAW,GAAE,GAAG,CAAC;AAAE,cAAG;AAAC,oBAAQ,KAAK,CAAC,MAAM,KAAK,SAAS;AAAA,UAAC,QAAM;AAAA,UAAC;AAAA,QAAC;AAAA,MAC9I,GAAG;AAAE,aAAO;AAAA,IAAa;AACzB,SAAK,UAAU,IAAIA,KAAG,EAAC,OAAM,SAAQ,GAAE,OAAM,CAAC;AAAE,UAAM,QAAM,WAAW,MAAI,KAAK,OAAO,iBAAiB,GAAE,OAAO;AACjH,QAAG;AAAC,YAAM,OAAK,MAAM,IAAI,QAAa,CAACL,UAAQ,WAAS;AAAC,cAAM,KAAK,SAAQ,MAAM;AAAE,cAAM,KAAK,SAAQ,CAAC,MAAK,WAASA,SAAQ,EAAC,UAAS,MAAK,OAAM,CAAC,CAAC;AAAA,MAAC,CAAC;AAAE,YAAM;AAC7J,YAAM,MAAI,MAAM,KAAK,SAAS,OAAO,OAAO,MAAM,GAAE,GAAE,YAAY,GAAE,MAAI,MAAM,KAAK,SAAS,OAAO,OAAO,MAAM,GAAE,GAAE,YAAY;AAChI,WAAK,MAAM,OAAOK,KAAG,WAAS,cAAY,cAAY,SAAO,WAAS,KAAK,aAAW,IAAE,cAAY,UAAS,EAAC,GAAG,MAAK,kBAAiB,IAAI,YAAW,kBAAiB,IAAI,YAAW,UAAS,GAAE,WAAS,KAAK,aAAW,IAAE,OAAK,uBAAuB;AAAA,IAC1P,UAAC;AAAQ,mBAAa,KAAK;AAAE,WAAK,UAAU,OAAOA,GAAE;AAAA,IAAC;AAAA,EACxD;AAAA,EACA,MAAM,IAAI,KAAWJ,OAAc;AAAC,YAAQ,MAAM,cAAc,OAAM,CAAC,MAAK,4BAA2B,GAAGA,KAAI,GAAE,EAAC,KAAI,SAAQ,KAAM,WAAU,IAAE,OAAK,MAAK,aAAY,MAAK,KAAI,EAAC,GAAG,QAAQ,KAAI,mBAAkB,QAAQ,aAAW,UAAQ,QAAM,aAAY,qBAAoB,KAAI,qBAAoB,IAAG,EAAC,CAAC,GAAG,OAAO,KAAK;AAAA,EAAC;AAAA,EAC9T,MAAM,SAAS,MAAY,GAAM,GAAU;AAGzC,QAAG,KAAK,UAAU,MAAK,8BAA6B,GAAG;AACvD,QAAG,SAAO,mBAAkB;AAC1B,YAAM,SAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAO,EAAE,gBAAc,EAAE;AAAE,YAAM,KAAK,MAAM,iBAAiB,MAAM;AAAE,UAAG,MAAM,KAAK,IAAI,QAAO,CAAC,UAAS,aAAa,CAAC,EAAE,MAAK,mBAAkB,GAAG;AAC1L,YAAM,OAAK,MAAM,KAAK,IAAI,QAAO,CAAC,aAAY,MAAM,CAAC;AAAE,YAAMI,MAAG,YAAYC,YAAW,CAAC,IAAGS,YAAS,EAAE;AACtG,UAAG,OAAOA,cAAW,SAAS,MAAK,kBAAkB;AAAE,YAAM,SAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,QAAOA,WAAS,IAAI;AAAE,UAAG,WAAS,UAAQ,KAAK,MAAM,OAAO,QAAO,MAAM,EAAE,MAAK,uBAAuB;AACtM,WAAK,MAAM,SAAS,CAAC;AAAE,YAAM,KAAK,IAAI,QAAO,CAAC,YAAW,OAAM,YAAW,QAAO,IAAI,CAAC;AAAE,WAAK,MAAM,GAAG,QAAQ,4CAA4C,EAAE,IAAIV,KAAG,UAAU,CAAC,GAAE,EAAE,QAAO,QAAO,MAAK,MAAM;AAAE,aAAO,EAAC,YAAWA,KAAG,QAAO,EAAE,QAAO,cAAaU,WAAS,YAAW,KAAI;AAAA,IAC1R;AACA,UAAM,MAAI,KAAK,MAAM,GAAG,QAAQ,oCAAoC,EAAE,IAAI,EAAE,UAAU;AAAE,QAAG,CAAC,IAAI,MAAK,sBAAqB,GAAG;AAAE,SAAK,MAAM,IAAI,IAAI,SAAQ,CAAC;AAAE,QAAG,CAAC,EAAE,MAAM,SAAS,IAAI,IAAI,EAAE,MAAK,gBAAe,GAAG;AACnN,UAAM,OAAK,MAAMH,UAAS,KAAK,OAAO,MAAM,IAAI,IAAI,CAAC;AAAE,eAAU,KAAK,CAAC,IAAI,MAAK,IAAI,MAAM,GAAE;AAAC,UAAG,CAAC,KAAK,MAAM,OAAO,MAAK,MAAMA,UAAS,CAAC,CAAC,EAAE,MAAK,2BAA0B,GAAG;AAAE,YAAM,KAAK,MAAM,iBAAiB,CAAC;AAAA,IAAC;AACnN,UAAM,QAAM,MAAM,KAAK,IAAI,IAAI,MAAK,CAAC,QAAO,YAAW,IAAI,IAAI,CAAC;AAAE,QAAG,SAAO,gBAAgB,QAAO,EAAC,YAAW,IAAI,MAAK,GAAG,MAAM,KAAK,SAAS,OAAO,KAAK,QAAM,IAAI,GAAE,GAAE,aAAa,EAAC;AACvL,QAAG,MAAM,KAAK,IAAI,IAAI,MAAK,CAAC,aAAY,MAAM,CAAC,MAAI,IAAI,QAAM,MAAM,KAAK,IAAI,IAAI,QAAO,CAAC,aAAY,MAAM,CAAC,MAAI,IAAI,QAAM,MAAM,KAAK,IAAI,IAAI,QAAO,CAAC,UAAS,aAAa,CAAC,EAAE,QAAO,EAAC,QAAO,uBAAsB,QAAO,kBAAiB,YAAW,EAAE,WAAU;AACjQ,UAAM,YAAUJ,MAAK,KAAK,OAAO,SAAQ,SAASF,YAAW,CAAC,EAAE;AAAE,UAAMG,WAAU,WAAU,QAAM,MAAK,EAAC,MAAK,IAAK,CAAC;AACnH,QAAG;AAAC,UAAG,CAAC,MAAM,QAAO,EAAC,QAAO,aAAY;AAAE,YAAM,KAAK,IAAI,IAAI,QAAO,CAAC,SAAQ,WAAU,SAAS,CAAC;AAAE,WAAK,MAAM,SAAS,CAAC;AAAE,YAAM,KAAK,IAAI,IAAI,QAAO,CAAC,SAAQ,SAAS,CAAC;AAAE,aAAO,EAAC,QAAO,cAAa,YAAW,IAAI,MAAK,aAAY,IAAI,KAAK,EAAC;AAAA,IAAC,SAAO,GAAE;AAAC,UAAG,aAAa,WAAW,OAAM;AAAE,aAAO,EAAC,QAAO,uBAAsB,QAAO,kBAAiB,YAAW,EAAE,WAAU;AAAA,IAAC,UAAC;AAAQ,YAAMC,QAAO,SAAS;AAAA,IAAC;AAAA,EACrZ;AAAA,EACA,MAAM,QAAO;AAAC,kBAAc,KAAK,SAAS;AAAE,UAAM,WAAS,MAAM,KAAK,gBAAgB,MAAM;AAAE,eAAUL,OAAM,KAAK,KAAK,KAAK,EAAE,MAAK,gBAAgB,IAAIA,GAAE;AAAE,UAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,GAAE,GAAG,KAAK,YAAY,OAAO,CAAC,EAAE,IAAI,OAAG,EAAE,OAAO,WAAW,CAAC,CAAC;AAAE,UAAM,KAAK,WAAW,MAAM;AAAE,UAAM,UAAQ,MAAM,KAAK,QAAQ,MAAM;AAAE,UAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC;AAAE,UAAM,KAAK,QAAQ,MAAM;AAAE,SAAK,MAAM,MAAM;AAAE,WAAO,EAAC,sBAAqB,QAAQ,iBAAe,SAAS,cAAa;AAAA,EAAC;AACpf;;;AqBnTA,OAAO,UAAU;AACjB,OAAO,WAAW;AAClB,SAAS,gBAAAW,qBAAoB;AAC7B,SAAS,yBAAyB;AAClC,SAAQ,YAAW;AACnB,SAAS,QAAQ,0CAA0C,mCAAmC;;;ACC9F,IAAM,WAAS,EAAC,UAAS,KAAM,kBAAiB,GAAE,eAAc,KAAK,cAAa,KAAM,YAAW,MAAK,YAAW,MAAK,oBAAmB,KAAI,oBAAmB,IAAG;AAC9J,SAAS,mBAAmB,QAAiB,CAAC,GAAE;AACrD,QAAM,SAAO,EAAC,GAAG,UAAS,GAAG,MAAK;AAClC,MAAG,CAAC,SAAO,OAAO,UAAQ,YAAU,MAAM,QAAQ,KAAK,KAAG,OAAO,KAAK,KAAK,EAAE,KAAK,CAAAC,SAAK,CAAC,OAAO,OAAO,UAASA,IAAG,CAAC,EAAE,MAAK,qBAAqB;AAC/I,QAAM,SAAO,EAAC,UAAS,CAAC,KAAI,IAAO,GAAE,kBAAiB,CAAC,GAAE,GAAG,GAAE,eAAc,CAAC,IAAG,GAAK,GAAE,cAAa,CAAC,IAAG,GAAK,GAAE,YAAW,CAAC,GAAE,IAAI,GAAE,YAAW,CAAC,GAAE,IAAI,GAAE,oBAAmB,CAAC,GAAE,GAAK,GAAE,oBAAmB,CAAC,GAAE,GAAK,EAAC;AAChN,aAAUA,QAAO,OAAO,KAAK,MAAM,GAA+B;AAAC,UAAM,CAAC,KAAI,GAAG,IAAE,OAAOA,IAAG;AAAE,QAAG,CAAC,OAAO,cAAc,OAAOA,IAAG,CAAC,KAAG,OAAOA,IAAG,IAAE,OAAK,OAAOA,IAAG,IAAE,IAAI,MAAK,qBAAqB;AAAA,EAAC;AAClM,MAAG,OAAO,gBAAc,OAAO,gBAAc,OAAO,eAAa,OAAO,SAAS,MAAK,qBAAqB;AAC3G,SAAO,OAAO,OAAO,MAAM;AAC7B;AAGO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAAY,UAAmB,CAAC,GAAU,MAAI,KAAK,KAAI;AAAb;AAAc,SAAK,SAAO,mBAAmB,OAAO;AAAA,EAAC;AAAA,EAArD;AAAA,EAHlC,UAAQ,oBAAI,IAAmB;AAAA,EAAU,UAAQ,oBAAI,IAAmB;AAAA,EACxE,SAAO,EAAC,OAAM,GAAE,UAAS,GAAE,SAAQ,MAAK;AAAA,EACvC;AAAA,EAED,KAAQ,KAAkBA,MAAW,OAAQ,KAAW;AAAC,QAAI,OAAOA,IAAG;AAAE,QAAI,IAAIA,MAAI,KAAK;AAAE,WAAM,IAAI,OAAK,IAAI,KAAI,OAAO,IAAI,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,EAAC;AAAA,EAC3J,QAAQ,QAAuB;AAC7B,UAAM,MAAI,KAAK,IAAI,GAAE,IAAE,KAAK;AAC5B,QAAG,MAAI,KAAK,OAAO,SAAO,EAAE,YAAU,MAAI,KAAK,OAAO,MAAM,MAAK,SAAO,EAAC,OAAM,KAAI,UAAS,GAAE,SAAQ,MAAK;AAC3G,QAAG,KAAK,OAAO,YAAU,EAAE,oBAAmB;AAAC,YAAM,QAAM,CAAC,KAAK,OAAO;AAAQ,WAAK,OAAO,UAAQ;AAAK,aAAO,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,KAAK,OAAO,QAAM,EAAE,WAAS,KAAI,MAAK;AAAA,IAAC;AACvM,QAAI,MAAI,KAAK,QAAQ,IAAI,MAAM;AAC/B,QAAG,OAAK,MAAI,IAAI,MAAM,OAAI;AAC1B,QAAG,OAAK,IAAI,QAAM,IAAI,QAAO,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,IAAI,QAAM,KAAI,OAAM,MAAK;AACtG,QAAG,CAAC,OAAK,MAAI,IAAI,SAAO,EAAE,YAAU,MAAI,IAAI,MAAM,OAAI,EAAC,OAAM,KAAI,UAAS,GAAE,OAAM,EAAC;AACnF,SAAK,OAAO;AAAW,QAAI;AAC3B,QAAG,IAAI,YAAU,EAAE,iBAAiB,KAAI,QAAM,MAAI,KAAK,IAAI,EAAE,cAAa,EAAE,gBAAc,KAAG,KAAK,IAAI,IAAG,IAAI,WAAS,EAAE,gBAAgB,CAAC;AACzI,SAAK,KAAK,KAAK,SAAQ,QAAO,KAAI,EAAE,UAAU;AAC9C,WAAO,IAAI,QAAM,MAAI,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,IAAI,QAAM,KAAI,OAAM,KAAI,IAAE,EAAC,QAAO,KAAI,MAAK,gBAAe,cAAa,GAAE,OAAM,KAAI;AAAA,EAC1J;AAAA;AAAA,EAEA,cAAc,UAAgB,UAA8B;AAC1D,UAAM,MAAI,KAAK,IAAI,GAAE,IAAE,KAAK;AAAO,QAAI,MAAI,KAAK,QAAQ,IAAI,QAAQ;AACpE,QAAG,CAAC,OAAK,IAAI,aAAW,YAAU,MAAI,IAAI,SAAO,EAAE,YAAU,MAAI,IAAI,MAAM,OAAI,EAAC,OAAM,KAAI,UAAS,GAAE,UAAS,SAAQ,MAAK;AAC3H,QAAG,IAAI,YAAU,EAAE,oBAAmB;AAAC,YAAM,QAAM,CAAC,IAAI;AAAQ,UAAI,UAAQ;AAAK,aAAO,EAAC,QAAO,KAAI,MAAK,mBAAkB,cAAa,IAAI,QAAM,EAAE,WAAS,KAAI,MAAK;AAAA,IAAC;AACvK,QAAI;AAAW,SAAK,KAAK,KAAK,SAAQ,UAAS,KAAI,EAAE,UAAU;AAAE,WAAO;AAAA,EAC1E;AAAA,EACA,QAAO;AAAC,WAAO,EAAC,SAAQ,KAAK,QAAQ,MAAK,SAAQ,KAAK,QAAQ,MAAK,gBAAe,KAAK,OAAO,SAAQ;AAAA,EAAC;AAC1G;;;ADnCA,SAAQ,uBAAsB;AAE9B,IAAM,WAAS,CAAC,SAAc,CAAC,aAAY,OAAM,kBAAkB,EAAE,SAAS,IAAI;AAC3E,SAAS,gBAAgB,GAAgB;AAAC,QAAM,OAAK,EAAE,QAAM,aAAY,OAAK,EAAE,QAAM;AAAW,MAAG,CAAC,WAAU,MAAK,WAAW,EAAE,SAAS,IAAI,EAAE,MAAK,uBAAuB;AACjL,MAAG,CAAC,KAAK,IAAI,KAAG,EAAE,SAAO,WAAY,CAAC,OAAO,cAAc,EAAE,IAAI,KAAG,EAAE,OAAK,KAAG,EAAE,OAAK,OAAO,MAAK,wBAAwB;AACzH,aAAUC,QAAO,CAAC,gBAAe,kBAAiB,gBAAgB,EAAW,KAAG,EAAEA,IAAG,MAAI,WAAY,CAAC,MAAM,QAAQ,EAAEA,IAAG,CAAC,KAAG,EAAEA,IAAG,EAAG,SAAO,OAAK,EAAEA,IAAG,EAAG,KAAK,WAAO,OAAO,UAAQ,YAAU,CAAC,SAAO,MAAM,SAAO,OAAK,0BAA0B,KAAK,KAAK,CAAC,GAAG,MAAK,wBAAwB;AAC7R,MAAG,EAAE,gBAAgB,KAAK,WAAO,CAAC,KAAK,KAAK,CAAC,EAAE,MAAK,wBAAwB;AAC5E,MAAG,EAAE,gBAAgB,KAAK,WAAO;AAAC,QAAG;AAAC,YAAM,MAAI,IAAI,IAAI,KAAK;AAAE,aAAO,CAAC,CAAC,SAAQ,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAG,IAAI,WAAS;AAAA,IAAK,QAAM;AAAC,aAAO;AAAA,IAAI;AAAA,EAAC,CAAC,EAAE,MAAK,wBAAwB;AACvL,MAAG,EAAE,cAAc,KAAK,WAAO;AAAC,QAAG;AAAC,YAAM,MAAI,IAAI,IAAI,UAAU,KAAK,EAAE;AAAE,aAAO,IAAI,SAAO,MAAM,YAAY,KAAG,IAAI,aAAW,OAAK,CAAC,CAAC,IAAI,YAAU,CAAC,CAAC,IAAI,YAAU,CAAC,CAAC,IAAI,UAAQ,CAAC,CAAC,IAAI;AAAA,IAAI,QAAM;AAAC,aAAO;AAAA,IAAI;AAAA,EAAC,CAAC,EAAE,MAAK,wBAAwB;AAC/O,qBAAmB,EAAE,UAAU;AAC/B,MAAG,EAAE,KAAK,4BAA0B,CAAC,EAAE,IAAI,OAAO,MAAK,kBAAkB;AACzE,MAAG,SAAO,cAAY,CAAC,SAAS,IAAI,EAAE,MAAK,cAAc;AACzD,MAAG,CAAC,aAAY,WAAW,EAAE,SAAS,IAAI,GAAE;AAAC,QAAG,CAAC,OAAO,OAAO,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,OAAG,GAAG,YAAU,IAAI,EAAE,MAAK,0BAA0B;AAAE,QAAG,CAAC,EAAE,OAAK,CAAC,EAAE,gBAAgB,MAAK,6BAA6B;AAAA,EAAC;AACxN,MAAG,SAAO,wBAAsB,CAAC,SAAS,IAAI,KAAG,CAAC,EAAE,iBAAiB,MAAK,iCAAiC;AAC3G,MAAG,SAAO,gBAAc,CAAC,EAAE,QAAM,CAAC,SAAS,IAAI,KAAG,CAAC,EAAE,gBAAgB,QAAQ,MAAK,cAAc;AAChG,MAAG,CAAC,EAAE,OAAK,CAAC,SAAS,IAAI,KAAG,CAAC,EAAE,gBAAgB,MAAK,cAAc;AAClE,MAAG,CAAC,CAAC,YAAW,aAAY,aAAY,qBAAoB,YAAY,EAAE,SAAS,IAAI,EAAE,MAAK,sBAAsB;AACtH;AACA,eAAsB,MAAM,OAAY,IAAgB,CAAC,GAAE;AACzD,MAAE,gBAAgB,CAAC;AAAE,kBAAgB,CAAC;AAAE,QAAM,WAAS,IAAI,aAAa,EAAE,UAAU,GAAE,OAAK,EAAE,QAAM;AACnG,QAAM,kBAAgB,CAAC,KAAyB,UAAQ,UAAQ;AAC9D,UAAM,UAAQ,OAAO,QAAQ,GAAS,cAAY,GAAG,KAAK,SAAS,GAAG,IAAE,IAAI,IAAI,MAAI,IAAI,IAAI,QAAQ,IAAI;AACxG,QAAG,EAAE,EAAE,gBAAc,CAAC,WAAW,GAAG,SAAS,IAAI,QAAQ,QAAM,EAAE,EAAE,MAAK,eAAc,GAAG;AACzF,UAAM,SAAO,IAAI,QAAQ;AACzB,QAAG,WAAS,UAAW,EAAE,EAAE,kBAAgB,CAAC,GAAG,SAAS,MAAM,KAAG,EAAE,WAAS,MAAM,gBAAgB,UAAU,MAAM,GAAG,MAAK,iBAAgB,GAAG;AAC7I,QAAG,EAAE,SAAO,gBAAc,CAAC,EAAE,QAAM,EAAE,EAAE,kBAAgB,CAAC,GAAG,SAAS,IAAI,OAAO,iBAAe,SAAS,KAAG,IAAI,QAAQ,mBAAmB,MAAI,SAAS,MAAK,gBAAe,GAAG;AAC7K,WAAO;AAAA,EACT;AACA,QAAM,UAAQ,OAAM,KAAyB,QAA0B;AACrE,QAAI;AAAY,UAAM,SAAO,IAAI,OAAO,iBAAe;AAAU,UAAM,OAAK,CAAC,QAAc,UAAY;AAAC,UAAI,UAAU,QAAO,EAAC,gBAAe,oBAAmB,iBAAgB,YAAW,0BAAyB,UAAS,CAAC;AAAE,UAAI,IAAI,KAAK,UAAU,KAAK,CAAC;AAAA,IAAC;AAC9P,QAAG;AACD,YAAM,cAAY,gBAAgB,GAAG;AACrC,YAAM,SAAO,CAAC,aAA+C;AAC3D,YAAG,SAAS,MAAM,OAAM,MAAM,MAAM,SAAS,IAAI;AACjD,YAAG,SAAS,aAAa,KAAI,UAAU,eAAc,OAAO,KAAK,IAAI,GAAE,KAAK,KAAK,SAAS,eAAa,GAAI,CAAC,CAAC,CAAC;AAC9G,aAAK,SAAS,MAAK,SAAS,MAAM;AAAA,MACpC;AACA,YAAM,OAAK,IAAI,QAAQ,iBAAe;AAAG,UAAG,CAAC,6BAA6B,KAAK,IAAI,GAAE;AAAC,eAAO,SAAS,QAAQ,MAAM,CAAC;AAAA,MAAC;AACtH,YAAM,MAAI,IAAI,IAAI,IAAI,OAAK,KAAI,UAAU,WAAW,EAAE;AAAE,UAAI;AAC5D,YAAM,eAAa,MAAI;AAAC,YAAG;AAAC,cAAG,IAAI,SAAS,WAAW,cAAc,EAAE,UAAO,MAAM,MAAM,OAAO,KAAK,MAAM,CAAC,CAAC;AAAA,cAAO,WAAQ,MAAM,MAAM,MAAM,KAAK,MAAM,CAAC,CAAC;AAAA,QAAC,QAAM;AAAC,iBAAO,SAAS,QAAQ,MAAM,CAAC;AAAA,QAAC;AAAA,MAAC;AACrM,mBAAa;AAEb,YAAM,UAAQ,SAAS,cAAc,QAAQ,MAAI,QAAQ,UAAS,QAAQ,YAAU,QAAQ,QAAQ;AACpG,UAAG,QAAQ,QAAO,OAAO;AACzB,UAAG,IAAI,WAAS,QAAO;AAAC,aAAK,KAAI,EAAC,OAAM,EAAC,MAAK,qBAAoB,EAAC,CAAC;AAAE;AAAA,MAAM;AAC5E,UAAI,OAAK,OAAO,MAAM,CAAC;AAAE,uBAAgB,SAAS,KAAI;AAAC,eAAK,OAAO,OAAO,CAAC,MAAK,KAAK,CAAC;AAAE,YAAG,KAAK,SAAO,QAAQ,MAAK,qBAAoB,GAAG;AAAA,MAAC;AAC5I,UAAI;AAAW,UAAG;AAAC,iBAAO,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC;AAAA,MAAC,QAAM;AAAC,aAAK,cAAc;AAAA,MAAC;AAGtF,mBAAa;AACb,UAAG,IAAI,aAAW,sBAAqB;AAAC,aAAK,KAAI,MAAM,MAAM,MAAM,QAAO,MAAM,CAAC;AAAE;AAAA,MAAM;AACzF,UAAG,IAAI,aAAW,6BAA4B;AAAC,cAAM,SAAO,MAAM,MAAM,aAAa,QAAO,MAAM;AAAE,cAAM,MAAM,gBAAgB,MAAM;AAAE,aAAK,KAAI,MAAM;AAAE;AAAA,MAAM;AAC/J,UAAG,IAAI,aAAW,uBAAsB;AAAC,aAAK,KAAI,MAAM,MAAM,gBAAgB,KAAK,SAAQ,MAAM,CAAC;AAAE;AAAA,MAAM;AAC1G,UAAG,IAAI,aAAW,6BAA4B;AAAC,aAAK,KAAI,MAAM,MAAM,gBAAgB,MAAM,SAAQ,MAAM,CAAC;AAAE;AAAA,MAAM;AACjH,UAAG,IAAI,aAAW,6BAA4B;AAAC,aAAK,KAAI,MAAM,MAAM,gBAAgB,aAAa,SAAQ,MAAM,CAAC;AAAE;AAAA,MAAM;AACxH,UAAG,IAAI,aAAW,OAAO,MAAK,aAAY,GAAG;AAC7C,YAAM,MAAI,IAAI,OAAO,EAAC,MAAK,6BAA4B,SAAQ,cAAa,GAAE,EAAC,cAAa,EAAC,OAAM,CAAC,EAAC,GAAE,2BAA0B,4BAA2B,CAAC;AAC7J,YAAM,YAAU,IAAI,yCAAyC,EAAC,oBAAmB,MAAK,oBAAmB,QAAU,oBAAmB,QAAO,CAAC;AAC9I,UAAI,kBAAkB,cAAa,YAAS;AAAC,cAAM,MAAM,SAAS,OAAO;AAAE,eAAO,EAAC,OAAM,QAAQ,OAAO,OAAG,QAAQ,MAAM,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,QAAI,EAAC,MAAK,EAAE,MAAK,aAAY,UAAU,EAAE,IAAI,IAAG,aAAY,EAAE,aAAY,aAAY,EAAC,cAAa,CAAC,EAAE,UAAS,iBAAgB,EAAE,SAAQ,EAAC,EAAE,EAAC;AAAA,MAAC,CAAC;AAC/R,UAAI,kBAAkB,cAAa,OAAM,YAAc;AAAC,YAAG;AAAC,gBAAM,OAAK,QAAQ,OAAO,SAAO,CAAC,GAAEC,QAAK,QAAQ,OAAO,aAAW,CAAC;AAAE,cAAG,OAAO,OAAOA,OAAK,aAAa,KAAG,QAAQ,OAAO,SAAO,sBAAoB,QAAQ,OAAO,SAAO,mBAAmB,MAAK,+BAA+B;AAC3R,gBAAM,SAAO,MAAM,MAAM,KAAK,QAAQ,OAAO,MAAKA,OAAK,SAAQ,KAAK,iBAAiB,CAAC;AAAE,gBAAM,MAAM,MAAM,eAAc,QAAQ,OAAM,KAAK,iBAAiB,KAAG,IAAI;AAAE,iBAAO,EAAC,SAAQ,CAAC,EAAC,MAAK,QAAO,MAAK,KAAK,UAAU,MAAM,EAAC,CAAC,GAAE,mBAAkB,OAAM;AAAA,QAC3P,SAAO,GAAE;AAAC,gBAAM,OAAK,aAAa,aAAW,EAAE,OAAK;AAAmB,gBAAM,MAAM,MAAM,MAAK,QAAQ,KAAK;AAAE,iBAAO,EAAC,SAAQ,MAAK,SAAQ,CAAC,EAAC,MAAK,QAAO,MAAK,KAAI,CAAC,EAAC;AAAA,QAAC;AAAA,MAAC,CAAC;AACxK,YAAM,IAAI,QAAQ,SAAS;AAC3B,UAAG;AAAC,cAAM,WAAS,MAAM,UAAU,cAAc,IAAI,QAAQ,UAAU,WAAW,QAAO,EAAC,QAAO,QAAO,SAAQ,IAAI,SAAe,MAAK,KAAK,SAAS,MAAM,EAAC,CAAC,GAAE,EAAC,YAAW,OAAM,CAAC;AAAE,YAAI,UAAU,SAAS,QAAO,OAAO,YAAY,SAAS,OAAO,CAAC;AAAE,YAAI,IAAI,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,MAAC,UAAC;AAAQ,cAAM,IAAI,MAAM;AAAA,MAAC;AAAA,IACvU,SAAO,GAAE;AAAC,WAAK,aAAa,aAAW,EAAE,SAAO,KAAI,EAAC,OAAM,EAAC,MAAK,aAAa,aAAW,EAAE,OAAK,iBAAgB,EAAC,CAAC;AAAA,IAAC;AAAA,EACrH;AACA,QAAM,MAAI,EAAE,MAAI,EAAC,KAAIC,cAAa,EAAE,IAAI,OAAO,GAAE,MAAKA,cAAa,EAAE,IAAI,QAAQ,GAAE,IAAG,EAAE,IAAI,SAAOA,cAAa,EAAE,IAAI,MAAM,IAAE,QAAU,aAAY,CAAC,CAAC,EAAE,IAAI,0BAAyB,oBAAmB,CAAC,CAAC,EAAE,IAAI,yBAAwB,IAAE;AAC1O,QAAM,SAAO,MAAI,MAAM,aAAa,KAAI,OAAO,IAAE,KAAK,aAAa,OAAO;AAAE,SAAO,iBAAe;AAAM,SAAO,iBAAe;AAAM,SAAO,iBAAe;AAC1J,QAAM,YAAU,IAAI,gBAAgB,EAAC,UAAS,MAAK,gBAAe,MAAK,YAAW,OAAM,mBAAkB,MAAK,CAAC;AAChH,SAAO,GAAG,WAAU,CAAC,KAAI,QAAO,SAAO;AACrC,QAAG;AACD,YAAM,cAAY,gBAAgB,KAAI,IAAI,GAAE,MAAI,IAAI,IAAI,IAAI,OAAK,KAAI,UAAU,WAAW,EAAE;AAC5F,UAAG,IAAI,aAAW,wBAAsB,IAAI,OAAO,MAAK,aAAY,GAAG;AACvE,UAAG,UAAU,QAAQ,QAAM,GAAG,MAAK,4BAA2B,GAAG;AACjE,gBAAU,cAAc,KAAI,QAAO,MAAK,QAAI;AAAC,kBAAU,KAAK,cAAa,IAAG,GAAG;AAAE,cAAM,gBAAgB,OAAO,IAAG,IAAI,QAAQ,QAAO,EAAE,kBAAgB,CAAC,CAAC;AAAA,MAAC,CAAC;AAAA,IAC5J,SAAO,GAAE;AAAC,YAAM,SAAO,aAAa,aAAW,EAAE,SAAO;AAAI,aAAO,IAAI,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA,CAA6D;AAAA,IAAC;AAAA,EACzJ,CAAC;AACD,QAAM,IAAI,QAAc,CAACC,UAAQ,WAAS;AAAC,WAAO,KAAK,SAAQ,MAAM;AAAE,WAAO,OAAO,EAAE,QAAM,MAAK,MAAK,MAAIA,SAAQ,CAAC;AAAA,EAAC,CAAC;AACtH,SAAO,EAAC,QAAO,SAAQ,OAAO,QAAQ,GAAE,sBAAqB,6BAA4B,OAAM,YAAS;AAAC,UAAM,MAAM,gBAAgB,MAAM;AAAE,eAAU,UAAU,UAAU,QAAQ,QAAO,UAAU;AAAE,UAAM,IAAI,QAAc,CAAAA,aAAS,UAAU,MAAM,MAAIA,SAAQ,CAAC,CAAC;AAAE,UAAM,IAAI,QAAc,CAACA,UAAQ,WAAS,OAAO,MAAM,OAAG,IAAE,OAAO,CAAC,IAAEA,SAAQ,CAAC,CAAC;AAAA,EAAC,EAAC;AAC3V;;;AtBjFA,IAAM,CAAC,SAAQ,YAAW,GAAG,IAAI,IAAE,QAAQ,KAAK,MAAM,CAAC;AACvD,IAAG;AACD,MAAG,CAAC,WAAW,MAAK,6FAA6F;AACjH,QAAM,OAAKC,SAAQ,UAAU;AAC7B,MAAG,YAAU,QAAO;AAClB,UAAM,OAAKA,SAAQ,KAAK,CAAC,KAAG,GAAG;AAAE,UAAM,SAAO,EAAC,SAAQC,MAAKC,SAAQ,IAAI,GAAE,MAAM,GAAE,OAAM,EAAC,SAAQ,KAAI,GAAE,WAAU,eAAc,SAAQ,EAAC,MAAK,YAAW,MAAK,aAAY,MAAK,KAAI,GAAE,aAAY,EAAC,MAAK,QAAQ,SAAQ,GAAE,gBAAe,CAAC,EAAC;AACzO,UAAMC,OAAMD,SAAQ,IAAI,GAAE,EAAC,WAAU,MAAK,MAAK,IAAK,CAAC;AAAE,UAAME,WAAU,MAAK,KAAK,UAAU,QAAO,MAAK,CAAC,IAAE,MAAK,EAAC,MAAK,MAAK,MAAK,IAAK,CAAC;AAAE,YAAQ,IAAI,KAAK,UAAU,EAAC,YAAW,MAAK,MAAK,+DAA8D,CAAC,CAAC;AAAA,EAC1P,OAAK;AACH,UAAM,SAAO,KAAK,MAAM,MAAMC,UAAS,MAAK,MAAM,CAAC;AACnD,QAAG,YAAU,SAAQ;AACnB,YAAM,QAAM,IAAI,MAAM,MAAM;AAAE,UAAI;AAAW,UAAG;AAAC,iBAAO,MAAM,MAAM,OAAM,OAAO,OAAO;AAAA,MAAC,SAAO,GAAE;AAAC,cAAM,MAAM,MAAM;AAAE,cAAM;AAAA,MAAC;AAC9H,cAAQ,IAAI,KAAK,UAAU,EAAC,WAAU,MAAM,MAAM,WAAU,WAAU,OAAO,SAAQ,WAAU,OAAO,qBAAoB,CAAC,CAAC;AAAE,UAAI,WAAS;AAC3I,YAAM,OAAK,YAAS;AAAC,YAAG,SAAS;AAAO,mBAAS;AAAK,cAAM,OAAO,MAAM;AAAE,cAAM,MAAM,MAAM;AAAA,MAAC;AAAE,cAAQ,KAAK,UAAS,MAAI,KAAK,KAAK,CAAC;AAAE,cAAQ,KAAK,WAAU,MAAI,KAAK,KAAK,CAAC;AAAA,IAC/K,OAAK;AACH,YAAM,QAAM,IAAI,MAAM,OAAO,SAAQ,QAAU,EAAC,OAAM,KAAI,CAAC;AAAE,UAAG;AAAC,YAAI;AAAW,YAAG,YAAU,QAAO;AAAC,gBAAM,UAAQ,KAAK,MAAM,MAAMA,UAASL,SAAQ,KAAK,CAAC,CAAC,GAAE,MAAM,CAAC;AAAE,qBAAU,QAAQ,QAAQ,SAAO,CAAC,EAAE,KAAG,CAAC,OAAO,MAAM,IAAI,EAAE,MAAK,cAAc;AAAE,mBAAO,MAAM,KAAK,KAAK,CAAC,GAAE,OAAO;AAAA,QAAC,WAAS,YAAU,SAAS,UAAO,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,iBAAU,YAAU,UAAS;AAAC,gBAAM,OAAO,KAAK,CAAC,CAAC;AAAE,mBAAO,EAAC,SAAQ,KAAI;AAAA,QAAC,MAAM,MAAK,iBAAiB;AAAE,gBAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAAA,MAAC,UAAC;AAAQ,cAAM,MAAM;AAAA,MAAC;AAAA,IAClf;AAAA,EACF;AACF,SAAO,GAAM;AAAC,UAAQ,MAAM,EAAE,QAAM,oBAAoB;AAAE,UAAQ,WAAS;AAAC;",
   "names": ["readFile", "writeFile", "mkdir", "resolve", "dirname", "join", "readFile", "writeFile", "mkdir", "unlink", "stat", "realpath", "join", "resolve", "randomUUID", "spawn", "execFile", "promisify", "digest", "id", "key", "args", "digest", "error", "count", "id", "relative", "randomUUID", "createHash", "stat", "join", "key", "createHash", "join", "id", "randomUUID", "download", "downloadId", "path", "stat", "readFile", "randomUUID", "randomUUID", "tag", "row", "control", "resolve", "args", "readFile", "net", "readFile", "randomUUID", "net", "readFile", "error", "id", "resolve", "randomUUID", "alive", "mkdir", "open", "readFile", "lstat", "join", "randomUUID", "spawn", "stat", "path", "path", "join", "id", "open", "lstat", "readFile", "args", "mkdir", "resolve", "randomUUID", "digest", "closed", "timer", "constants", "lstat", "mkdir", "open", "readFile", "realpath", "stat", "unlink", "path", "mkdir", "open", "lstat", "readFile", "unlink", "stat", "path", "realpath", "constants", "isAbsolute", "key", "path", "isAbsolute", "id", "constants", "open", "lstat", "stat", "realpath", "unlink", "path", "randomBytes", "constants", "unlink", "path", "open", "lstat", "realpath", "stat", "digest", "randomBytes", "readFile", "stat", "writeFile", "isAbsolute", "join", "resolve", "randomBytes", "createHash", "readFile", "realpath", "stat", "mkdir", "writeFile", "spawn", "isAbsolute", "join", "spawn", "EventEmitter", "access", "realpath", "isAbsolute", "join", "env", "key", "args", "closed", "resolve", "error", "control", "randomBytes", "mkdir", "writeFile", "lstat", "realpath", "isAbsolute", "join", "performance", "fileURLToPath", "fileURLToPath", "isAbsolute", "performance", "mkdir", "join", "descriptorPath", "randomBytes", "realpath", "stat", "lstat", "error", "closed", "id", "key", "resolve", "writeFile", "key", "createHash", "isAbsolute", "path", "realpath", "stat", "readFile", "resolve", "spawn", "error", "mkdir", "join", "writeFile", "env", "closed", "id", "timer", "snapshot", "args", "randomBytes", "error", "key", "isAbsolute", "resolve", "stat", "readFile", "writeFile", "join", "args", "snapshot", "error", "terminal", "promisify", "execFile", "resolve", "args", "terminal", "unknown", "digest", "id", "randomUUID", "mkdir", "join", "writeFile", "unlink", "readFile", "realpath", "stat", "spawn", "relative", "readFileSync", "key", "key", "args", "readFileSync", "resolve", "resolve", "join", "dirname", "mkdir", "writeFile", "readFile"]
 }