@m8t-stack/cli 0.0.1-bootstrap

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/errors.ts","../../../packages/api-contract/src/response.ts","../../../packages/api-contract/src/errors.ts","../../../packages/api-contract/src/reasons.ts","../../../packages/api-contract/src/team.ts","../../../packages/api-contract/dist/esm/me.js","../../../packages/api-contract/src/binding.ts","../../../packages/api-contract/dist/esm/inbound-envelope.js","../../../packages/api-contract/dist/esm/service-bus.js","../../../packages/api-contract/src/brain-link.ts","../../../packages/api-contract/src/a2a-card.ts","../../../packages/api-contract/src/index.ts","../../../packages/github-app-auth/src/jwt.ts","../../../packages/github-app-auth/src/secrets.ts","../../../packages/github-app-auth/src/cache.ts","../../../packages/github-app-auth/src/mint.ts","../../../packages/github-app-auth/src/rotate.ts","../../../packages/github-app-auth/src/check.ts","../../../packages/github-app-auth/src/index.ts","../src/lib/http.ts","../src/lib/foundry-agent-get.ts","../src/lib/brain-yaml-mirror.ts","../src/lib/foundry-agents.ts","../src/lib/rbac.ts","../src/lib/enable-hosted-brain.ts","../src/cli.ts","../src/lib/package-version.ts","../src/lib/render-error.ts","../src/lib/error-hints.ts","../src/lib/output.ts","../src/commands/bind/add.ts","../src/lib/m8t-command.ts","../src/lib/api-client.ts","../src/lib/auth.ts","../src/lib/az.ts","../src/lib/config.ts","../src/lib/discovery.ts","../src/lib/gateway-context.ts","../src/commands/bind/cleanup.ts","../src/commands/bind/list.ts","../src/commands/bind/remove.ts","../src/commands/bind/show.ts","../src/commands/config/reset.ts","../src/commands/config/set.ts","../src/lib/foundry-config.ts","../src/commands/config/show.ts","../src/commands/team/add.ts","../src/commands/team/add-identity.ts","../src/commands/team/list.ts","../src/commands/team/remove.ts","../src/commands/team/remove-identity.ts","../src/commands/team/show.ts","../src/commands/brain/check-app.ts","../src/lib/brain-paths.ts","../src/commands/brain/create.ts","../src/lib/foundry-project.ts","../src/lib/agent-yaml.ts","../src/lib/gh-helpers.ts","../src/lib/brain-link.ts","../src/lib/persona-render.ts","../src/lib/brain-loader-block.ts","../src/lib/brain-seed.ts","../src/commands/brain/link.ts","../src/lib/app-install.ts","../src/commands/brain/list.ts","../src/lib/foundry-discovery.ts","../src/commands/brain/show.ts","../src/commands/brain/unlink.ts","../src/lib/brain-unlink.ts","../src/commands/agent/remove.ts","../src/lib/agent-remove.ts","../src/lib/a2a-enable.ts","../src/lib/persona-a2a.ts","../src/commands/a2a/enable.ts","../src/lib/bridge-url.ts","../src/commands/a2a/disable.ts","../src/commands/architect/check.ts","../src/lib/architect-version.ts","../src/commands/coder/deploy.ts","../src/lib/preconditions.ts","../src/lib/regions.ts","../src/lib/acr.ts","../src/lib/coder-deploy.ts","../src/lib/persona.ts","../src/lib/delivery-grant.ts","../src/lib/quota.ts","../src/commands/coder/teardown.ts","../src/commands/azure-exec/deploy.ts","../src/commands/deploy.ts","../src/lib/app-reg.ts","../src/lib/deploy.ts","../src/lib/whatif.ts","../src/lib/whatif-noise.ts","../src/commands/version.ts","../src/commands/whoami.ts","../src/commands/status.ts","../src/lib/azd.ts","../src/lib/local-context.ts","../src/commands/doctor.ts","../src/lib/doctor-checks.ts","../src/commands/switch.ts","../src/lib/profiles.ts","../src/lib/switch.ts","../src/commands/open.ts","../src/lib/open-targets.ts"],"sourcesContent":["import type { ApiErrorEnvelope } from \"@m8t-stack/api-contract\";\n\n/**\n * Thrown for failures that originate locally (no `az login`, gateway\n * discovery zero matches, etc.) — distinguished from `ApiCallError` which\n * carries a backend envelope.\n *\n * `code` is a stable string the hint table maps to a user-facing hint. It's\n * a deliberately separate namespace from backend `ApiError.code`s so local\n * + remote codes never collide.\n */\nexport class LocalCliError extends Error {\n  readonly code: string;\n  readonly hint?: string;\n  readonly cause?: unknown;\n\n  constructor(opts: { code: string; message: string; hint?: string; cause?: unknown }) {\n    super(opts.message);\n    this.name = \"LocalCliError\";\n    this.code = opts.code;\n    this.hint = opts.hint;\n    this.cause = opts.cause;\n  }\n}\n\n/**\n * Thrown by `apiCall<T>` (Task 6) when the backend returned an `ok:false`\n * envelope. Carries the parsed envelope unchanged so the CLI can render\n * hints and surface details on --verbose.\n */\nexport class ApiCallError extends Error {\n  readonly envelope: ApiErrorEnvelope;\n  readonly httpStatus: number;\n\n  constructor(envelope: ApiErrorEnvelope, httpStatus: number) {\n    super(envelope.message);\n    this.name = \"ApiCallError\";\n    this.envelope = envelope;\n    this.httpStatus = httpStatus;\n  }\n}\n","/**\n * The standard wire envelope every m8t-stack backend route returns.\n * Single source of truth shared between backend (apps/web) and CLI (apps/cli).\n */\nexport type ApiResponse<T> =\n  | { ok: true; data: T }\n  | {\n      ok: false;\n      error: {\n        code: string;\n        message: string;\n        details?: unknown;\n      };\n    };\n\n/**\n * Type-narrowing extract of the error variant. Useful when you have a known\n * failure envelope and want to dig into the error fields without re-narrowing.\n */\nexport type ApiErrorEnvelope = Extract<ApiResponse<unknown>, { ok: false }>[\"error\"];\n\n/**\n * Type guard for callers that received a parsed JSON of unknown shape.\n */\nexport function isApiResponse<T = unknown>(value: unknown): value is ApiResponse<T> {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Record<string, unknown>;\n  if (v.ok === true && \"data\" in v) return true;\n  if (v.ok === false && typeof v.error === \"object\" && v.error !== null) {\n    const e = v.error as Record<string, unknown>;\n    return typeof e.code === \"string\" && typeof e.message === \"string\";\n  }\n  return false;\n}\n","export abstract class ApiError extends Error {\n  abstract readonly code: string;\n  abstract readonly status: number;\n  readonly details?: unknown;\n\n  constructor(message: string, details?: unknown) {\n    super(message);\n    this.name = this.constructor.name;\n    this.details = details;\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, this.constructor);\n    }\n  }\n}\n\nexport class UnauthenticatedError extends ApiError {\n  readonly code = \"UNAUTHENTICATED\";\n  readonly status = 401;\n}\n\nexport class ForbiddenError extends ApiError {\n  readonly code = \"FORBIDDEN\";\n  readonly status = 403;\n}\n\nexport class BadRequestError extends ApiError {\n  readonly code = \"BAD_REQUEST\";\n  readonly status = 400;\n}\n\nexport class NotFoundError extends ApiError {\n  readonly code = \"NOT_FOUND\";\n  readonly status = 404;\n}\n\nexport class ConflictError extends ApiError {\n  readonly code = \"CONFLICT\";\n  readonly status = 409;\n}\n\nexport class RateLimitedError extends ApiError {\n  readonly code = \"RATE_LIMITED\";\n  readonly status = 429;\n}\n\nexport class UpstreamError extends ApiError {\n  readonly code = \"UPSTREAM_FAILED\";\n  readonly status = 502;\n}\n\nexport class InternalError extends ApiError {\n  readonly code = \"INTERNAL\";\n  readonly status = 500;\n}\n","/**\n * String-literal union types for the `details.reason` field carried in\n * `ApiResponse.error.details`. Centralizing these prevents drift between\n * the backend's throws and the CLI's hint-lookup table.\n */\n\nexport type BadRequestReason =\n  | \"body_not_json\"\n  | \"empty_body\"\n  | \"empty_patch\"\n  | \"empty_patch_would_orphan\"\n  | \"missing_agent_name\"\n  | \"invalid_agent_name\"\n  | \"empty_agent_name\"\n  | \"cross_agent_conversation\"\n  | \"title_required\"\n  | \"title_empty\"\n  | \"title_too_long\"\n  | \"missing_handle\"\n  | \"invalid_handle\"\n  | \"empty_handle\"\n  | \"handle_too_long\"\n  | \"missing_display_name\"\n  | \"invalid_display_name\"\n  | \"display_name_empty\"\n  | \"display_name_too_long\"\n  | \"missing_identities\"\n  | \"no_identities_provided\"\n  | \"invalid_identities\"\n  | \"invalid_channel_id\"\n  | \"channel_id_too_long\"\n  | \"channel_id_empty\"\n  | \"unknown_channel\"\n  | \"invalid_add_identities\"\n  | \"invalid_remove_identities\"\n  | \"missing_channel\"\n  | \"invalid_channel\"\n  | \"missing_binding_id\"\n  | \"invalid_binding_id\"\n  | \"empty_binding_id\"\n  | \"binding_id_too_long\"\n  | \"missing_bot_token\"\n  | \"bot_token_empty\"\n  | \"bot_token_too_long\"\n  | \"no_adapter_registered\"\n  | \"invalid_status_filter\"\n  | \"invalid_channel_filter\"\n  | \"cleanup_active_binding\"\n  | \"invalid_bot_username\"\n  | \"bot_username_too_long\"\n  | \"channel_mismatch\"\n  | \"webhook_payload_invalid\"\n  | \"webhook_registration_rejected\";\n\nexport type UnauthenticatedReason =\n  | \"missing_bearer\"\n  | \"token_decode_failed\"\n  | \"token_missing_identity\"\n  | \"header_missing\"\n  | \"downstream_auth_pattern\"\n  | \"webhook_signature_invalid\";\n\nexport type NotFoundReason =\n  | \"team_member_not_found\"\n  | \"agent_not_found\"\n  | \"conversation_not_found\"\n  | \"binding_not_found\";\n\nexport type ConflictReason = \"handle_exists\" | \"identity_claimed\" | \"binding_exists\";\n\nexport type UpstreamReason =\n  | \"downstream_auth_pattern\"\n  | \"table_storage_partial_write\"\n  | \"table_storage_unavailable\"\n  | \"key_vault_unavailable\"\n  | \"kv_secret_malformed\"\n  | \"cascade_partial_failure\"\n  | \"service_bus_unavailable\"\n  | \"webhook_registration_failed\";\n\nexport type InternalReason = \"config\";\n","/**\n * Wire DTOs for the team-management API surface.\n * `/api/team` GET/POST, `/api/team/[handle]` GET/PATCH/DELETE.\n */\n\nexport type Channel = \"telegram\" | \"slack\" | \"teams\";\n\nexport const CHANNELS: readonly Channel[] = [\"telegram\", \"slack\", \"teams\"] as const;\n\nexport function isChannel(v: unknown): v is Channel {\n  return v === \"telegram\" || v === \"slack\" || v === \"teams\";\n}\n\nexport type TeamMemberIdentities = {\n  telegram?: string;\n  slack?: string;\n  teams?: string;\n};\n\nexport type TeamMember = {\n  handle: string;\n  displayName: string;\n  identities: TeamMemberIdentities;\n  /** ISO 8601. Earliest addedAt across rows for this handle. */\n  addedAt: string;\n  /** Admin UPN who wrote the first row for this handle. */\n  addedBy: string;\n};\n\nexport type ListTeamResponse = {\n  members: TeamMember[];\n};\n\nexport type CreateTeamRequest = {\n  handle: string;\n  displayName: string;\n  identities: TeamMemberIdentities;\n};\n\nexport type PatchTeamRequest = {\n  displayName?: string;\n  addIdentities?: TeamMemberIdentities;\n  removeIdentities?: Channel[];\n};\n\nexport type DeleteTeamResponse = {\n  deleted: { handle: string; rows: number };\n};\n\n/**\n * Partial-write failure shape returned in `UpstreamError.details.partial`\n * when a multi-identity POST fails after at least one row was already written.\n *\n * `created` is the subset of `TeamMemberIdentities` we successfully persisted.\n * `failed` is the single channel we stopped on (we abort on first failure;\n * see lib/team-members.ts).\n */\nexport type PartialWriteDetails = {\n  created: TeamMemberIdentities;\n  failed: {\n    channel: Channel;\n    channelUserId: string;\n    originalMessage: string;\n  };\n};\n","export {};\n//# sourceMappingURL=me.js.map","/**\n * Wire DTOs for the binding-management API surface.\n * `/api/bindings` GET/POST, `/api/bindings/[bindingId]` GET/DELETE,\n * `/api/bindings/cleanup-orphaned` POST.\n */\n\nimport type { Channel } from \"./team.js\";\n\nexport type BindingStatus = \"active\" | \"orphaned\";\n\nexport const BINDING_STATUSES: readonly BindingStatus[] = [\"active\", \"orphaned\"] as const;\n\nexport function isBindingStatus(v: unknown): v is BindingStatus {\n  return v === \"active\" || v === \"orphaned\";\n}\n\nexport type Binding = {\n  channel: Channel;\n  bindingId: string;\n  agentName: string;\n  /** Key Vault URI for the secret blob (versioned). NEVER the token itself. */\n  botTokenSecretRef: string;\n  botUsername?: string;\n  status: BindingStatus;\n  /** ISO 8601 */\n  createdAt: string;\n  /** Admin UPN who created the binding */\n  createdBy: string;\n};\n\nexport type ListBindingsResponse = {\n  bindings: Binding[];\n};\n\nexport type CreateBindingRequest = {\n  channel: Channel;\n  bindingId: string;\n  agentName: string;\n  /** Plaintext bot token — sent on the wire (HTTPS), never persisted in the row. */\n  botToken: string;\n  botUsername?: string;\n};\n\nexport type CreateBindingResponse = {\n  binding: Binding;\n  /** Constructed from GATEWAY_PUBLIC_URL + channel + bindingId. */\n  webhookUrl: string;\n};\n\nexport type GetBindingResponse = {\n  binding: Binding;\n};\n\nexport type DeleteBindingResponse = {\n  deleted: {\n    bindingId: string;\n    channel: Channel;\n    conversationsCleared: number;\n  };\n};\n\nexport type CleanupOrphanedResponse = {\n  cleaned: { bindingId: string; channel: Channel }[];\n  failed: { bindingId: string; channel: Channel; originalMessage: string }[];\n};\n\nexport type CascadeStep = \"unregisterWebhook\" | \"kvSecret\" | \"conversations\" | \"bindingsRow\";\n\n/**\n * Carried in UpstreamError.details.partial when DELETE cascade fails mid-flow.\n * The CLI's `bind remove` command renders this inline for a structured retry hint.\n */\nexport type CascadeFailureDetails = {\n  bindingId: string;\n  channel: Channel;\n  completedSteps: CascadeStep[];\n  failedStep: CascadeStep;\n  originalMessage: string;\n};\n\n// ───────────────────────────────────────────────────────────────────────────\n// KV secret JSON payload — discriminated + versioned union.\n//\n// Each channel that uses a per-binding secret bundle defines its own variant.\n// The `channel` field is the discriminator; `version` enables forward-compat\n// schema migration if a variant ever needs to change shape.\n//\n// F4 only invokes the Telegram variant (gated by the adapter registry — POST\n// /api/bindings rejects channels without a registered adapter). The Slack +\n// Teams variants are defined now so F8/F10 just register their adapter\n// without re-touching the union shape.\n// ───────────────────────────────────────────────────────────────────────────\n\nexport type TelegramSecretPayload = {\n  version: 1;\n  channel: \"telegram\";\n  botToken: string;\n  /** 64 hex chars; set on Telegram's `setWebhook` via the `secret_token` param. */\n  webhookSecret: string;\n};\n\nexport type SlackSecretPayload = {\n  version: 1;\n  channel: \"slack\";\n  /** `xoxb-...` bot user OAuth token */\n  botToken: string;\n  /** App-level signing secret used to verify Slack request HMACs */\n  signingSecret: string;\n  /** `xapp-...` app-level token, optional, for future Socket Mode */\n  appLevelToken?: string;\n};\n\nexport type TeamsSecretPayload = {\n  version: 1;\n  channel: \"teams\";\n  appId: string;\n  appPassword: string;\n};\n\nexport type BindingSecretPayload =\n  | TelegramSecretPayload\n  | SlackSecretPayload\n  | TeamsSecretPayload;\n\n/**\n * Runtime guard for BindingSecretPayload. Used by `lib/gateway/secrets.ts`\n * to validate JSON.parse output before treating it as a typed payload.\n *\n * Strict on `version: 1` and `channel` discriminator; rejects unknown channel\n * variants so a future schema rename can't silently misroute. Field validation\n * within each variant is structural (key presence + string type) only — the\n * caller decides what to do with malformed contents.\n */\nexport function isBindingSecretPayload(v: unknown): v is BindingSecretPayload {\n  if (v === null || typeof v !== \"object\") return false;\n  const obj = v as Record<string, unknown>;\n  if (obj.version !== 1) return false;\n  if (typeof obj.channel !== \"string\") return false;\n\n  if (obj.channel === \"telegram\") {\n    return typeof obj.botToken === \"string\" && typeof obj.webhookSecret === \"string\";\n  }\n  if (obj.channel === \"slack\") {\n    return (\n      typeof obj.botToken === \"string\" &&\n      typeof obj.signingSecret === \"string\" &&\n      (obj.appLevelToken === undefined || typeof obj.appLevelToken === \"string\")\n    );\n  }\n  if (obj.channel === \"teams\") {\n    return typeof obj.appId === \"string\" && typeof obj.appPassword === \"string\";\n  }\n  return false;\n}\n","export {};\n//# sourceMappingURL=inbound-envelope.js.map","export {};\n//# sourceMappingURL=service-bus.js.map","/**\n * The worker↔repo link record. Stored on the Foundry agent under\n * `metadata.brain` as a JSON STRING (Foundry metadata is a flat\n * Record<string,string>).\n *\n * F1 shipped this in plugins/m8t-stack/server/src/brain-link.ts. F2 promotes\n * it here so the CLI + gateway + plugin all import from one place. The\n * plugin server file becomes a thin re-export for back-compat.\n *\n * F1↔F2 distinction:\n *   - PAT mode (F1):  installationId absent. Connection holds a static PAT.\n *   - App mode (F2):  installationId present. Connection holds an App-minted\n *                     installation token, rotated lazily on every invoke.\n */\nexport interface BrainLink {\n  repo: string; // \"owner/name\"\n  branch: string; // default \"main\"\n  topology: \"per-worker\" | \"shared\"; // default \"per-worker\"\n  schemaVersion: string; // brain skeleton version\n  /**\n   * Foundry project-connection name holding the GitHub credential.\n   * Special value: `\"in-container\"` is the hosted-worker sentinel — the token\n   * is minted INSIDE the container (no Foundry connection exists). Invoke-path\n   * rotation MUST skip links with this value.\n   */\n  credentialRef: string;\n  installationId?: string; // GitHub App installation id (App mode)\n  instanceFolder?: string; // topology === \"shared\"\n}\n\n/**\n * Parse the brain link from Foundry agent metadata. Defensive: absent or\n * malformed returns undefined and never throws — discovery must not break on\n * a hand-written or partial `metadata.brain`.\n */\nexport function parseBrainLink(\n  metadata: Record<string, string> | undefined,\n): BrainLink | undefined {\n  const raw = metadata?.brain;\n  if (!raw) return undefined;\n  try {\n    const obj = JSON.parse(raw) as Partial<BrainLink>;\n    if (!obj || typeof obj.repo !== \"string\" || obj.repo.length === 0) return undefined;\n    return {\n      repo: obj.repo,\n      branch: typeof obj.branch === \"string\" && obj.branch ? obj.branch : \"main\",\n      topology: obj.topology === \"shared\" ? \"shared\" : \"per-worker\",\n      schemaVersion:\n        typeof obj.schemaVersion === \"string\" && obj.schemaVersion ? obj.schemaVersion : \"1\",\n      credentialRef: typeof obj.credentialRef === \"string\" ? obj.credentialRef : \"\",\n      ...(typeof obj.installationId === \"string\" ? { installationId: obj.installationId } : {}),\n      ...(typeof obj.instanceFolder === \"string\" ? { instanceFolder: obj.instanceFolder } : {}),\n    };\n  } catch {\n    return undefined;\n  }\n}\n\n/** True when the link uses GitHub App authentication (F2 mode). */\nexport function isAppMode(link: BrainLink): boolean {\n  return typeof link.installationId === \"string\" && link.installationId.length > 0;\n}\n\n/** Sentinel credentialRef for hosted workers: the token is minted INSIDE the\n *  container (no Foundry connection). Invoke-path rotation must skip these. */\nexport const IN_CONTAINER_CREDENTIAL_REF = \"in-container\";\n\n/** True when the link is a hosted/in-container brain (token minted in-sandbox;\n *  there is NO Foundry connection to rotate). */\nexport function isInContainer(link: BrainLink): boolean {\n  return link.credentialRef === IN_CONTAINER_CREDENTIAL_REF;\n}\n\n/** Serialize a BrainLink to the Foundry-metadata JSON string. */\nexport function serializeBrainLink(link: BrainLink): string {\n  return JSON.stringify(link);\n}\n","/**\n * The A2A capability card — authored in a persona's targets.foundry.a2a-card\n * block, projected into Foundry agent metadata as the `a2aCard` JSON string\n * (mirrors metadata.brain), and returned by the bridge's discover_workers.\n *\n * Foundry agent metadata values are capped at 512 chars, so the serialized\n * card must fit one value. Maps onto the A2A AgentCard for the future\n * graduation: summary→description, whenToDelegate→skill description/tags,\n * accepts/returns→skill I/O modes, role→skill name.\n */\nexport interface A2aCard {\n  role: string;\n  summary: string;\n  whenToDelegate: string;\n  accepts: string;\n  returns: string;\n}\n\n/** Foundry agent metadata value max length (REST API project/agents). */\nexport const A2A_CARD_MAX_CHARS = 512;\n\nexport function serializeA2aCard(card: A2aCard): string {\n  return JSON.stringify(card);\n}\n\n/** Defensive parse (mirrors parseBrainLink): null on missing/malformed; never throws. */\nexport function parseA2aCard(raw: string | undefined): A2aCard | null {\n  if (!raw) return null;\n  let o: unknown;\n  try {\n    o = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n  if (typeof o !== \"object\" || o === null) return null;\n  const c = o as Partial<A2aCard>;\n  return {\n    role: typeof c.role === \"string\" ? c.role : \"\",\n    summary: typeof c.summary === \"string\" ? c.summary : \"\",\n    whenToDelegate: typeof c.whenToDelegate === \"string\" ? c.whenToDelegate : \"\",\n    accepts: typeof c.accepts === \"string\" ? c.accepts : \"\",\n    returns: typeof c.returns === \"string\" ? c.returns : \"\",\n  };\n}\n","export * from \"./response.js\";\nexport * from \"./errors.js\";\nexport * from \"./reasons.js\";\nexport * from \"./team.js\";\nexport * from \"./me.js\";\nexport * from \"./binding.js\";\nexport * from \"./inbound-envelope.js\";\nexport * from \"./service-bus.js\";\nexport type { BrainLink } from \"./brain-link.js\";\nexport { parseBrainLink, isAppMode, serializeBrainLink, isInContainer, IN_CONTAINER_CREDENTIAL_REF } from \"./brain-link.js\";\nexport type { A2aCard } from \"./a2a-card.js\";\nexport { serializeA2aCard, parseA2aCard, A2A_CARD_MAX_CHARS } from \"./a2a-card.js\";\n","import { createSign, createPrivateKey } from \"node:crypto\";\n\n/**\n * Sign a GitHub App JWT (RS256, 10-min TTL, iss=appId).\n *\n * Used to authenticate to GitHub's App-level endpoints — most importantly\n * POST /app/installations/{id}/access_tokens to mint an installation token.\n *\n * Zero npm deps — uses Node's built-in crypto. iat carries a 30-second clock-\n * skew safety margin (GitHub recommends iat slightly in the past).\n *\n * @throws if appId is not a numeric string or privateKeyPem is not a valid PEM.\n */\nexport function signAppJwt(args: { appId: string; privateKeyPem: string }): string {\n  const appIdNum = Number(args.appId);\n  if (!Number.isInteger(appIdNum) || appIdNum <= 0) {\n    throw new Error(`signAppJwt: appId must be a positive numeric string, got '${args.appId}'`);\n  }\n\n  const now = Math.floor(Date.now() / 1000);\n  const header = { alg: \"RS256\", typ: \"JWT\" };\n  const payload = { iat: now - 30, exp: now - 30 + 600, iss: appIdNum };\n\n  const b64url = (obj: unknown) =>\n    Buffer.from(JSON.stringify(obj)).toString(\"base64url\");\n  const unsigned = `${b64url(header)}.${b64url(payload)}`;\n\n  const sign = createSign(\"RSA-SHA256\");\n  sign.update(unsigned);\n  sign.end();\n  const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString(\"base64url\");\n  return `${unsigned}.${signature}`;\n}\n","import { SecretClient } from \"@azure/keyvault-secrets\";\nimport type { TokenCredential } from \"@azure/core-auth\";\n\nexport type AppSecrets = {\n  appId: string;       // numeric string\n  slug: string;        // App URL slug (e.g. \"m8t-brain\")\n  privateKeyPem: string;\n};\n\nconst SECRET_NAMES = {\n  appId: \"github-app-id\",\n  slug: \"github-app-slug\",\n  privateKeyPem: \"github-app-private-key\",\n} as const;\n\n// Per-process cache, keyed by kvUri. App secrets rotate rarely (manual\n// operator action); a process restart picks up new values. Acceptable\n// for both gateway (Container App replica) and plugin (Claude Code session).\nconst cache = new Map<string, Promise<AppSecrets>>();\n\n/** TEST-ONLY: clear the cache between tests. */\nexport function _resetAppSecretsCache(): void {\n  cache.clear();\n}\n\nasync function fetchAllSecrets(\n  credential: TokenCredential,\n  kvUri: string,\n): Promise<AppSecrets> {\n  const client = new SecretClient(kvUri, credential);\n  const [appId, slug, pem] = await Promise.all([\n    client.getSecret(SECRET_NAMES.appId),\n    client.getSecret(SECRET_NAMES.slug),\n    client.getSecret(SECRET_NAMES.privateKeyPem),\n  ]);\n  const v = (sec: { value?: string }, name: string): string => {\n    if (typeof sec?.value !== \"string\" || sec.value.length === 0) {\n      throw new Error(`readAppSecrets: secret '${name}' is missing or empty in ${kvUri}`);\n    }\n    return sec.value;\n  };\n  return {\n    appId: v(appId, SECRET_NAMES.appId),\n    slug: v(slug, SECRET_NAMES.slug),\n    privateKeyPem: v(pem, SECRET_NAMES.privateKeyPem),\n  };\n}\n\n/**\n * Read the three GitHub App secrets from Key Vault, with per-process caching\n * keyed by kvUri. Idempotent — concurrent calls share one in-flight promise.\n *\n * Throws on missing/empty secret values; callers (m8t brain check-app +\n * inline link-cascade precondition) surface a fix-up-your-KV message.\n */\nexport function readAppSecrets(args: {\n  credential: TokenCredential;\n  kvUri: string;\n}): Promise<AppSecrets> {\n  const existing = cache.get(args.kvUri);\n  if (existing) return existing;\n  const promise = fetchAllSecrets(args.credential, args.kvUri).catch((e) => {\n    // On failure, evict so the next call retries (avoid permanent breakage\n    // from a transient KV glitch).\n    cache.delete(args.kvUri);\n    throw e;\n  });\n  cache.set(args.kvUri, promise);\n  return promise;\n}\n","/**\n * In-process token cache for GitHub App installation tokens.\n *\n * Lives in the importing process — one cache per Container App replica\n * (gateway) and one per Claude Code session (local MCP plugin). Acceptable\n * because installation tokens rotate every ~50 min (60 min TTL − 10 min\n * safety margin); cold-start cost is one round-trip; replica/session\n * isolation is a tolerable tradeoff for no shared-state infra (DESIGN §10.2).\n */\n\nexport const EXPIRY_SAFETY_MS = 10 * 60 * 1000; // refresh if <10 min remaining\n\ntype Entry = { token: string; expiresAt: Date };\nconst cache = new Map<string, Entry>();\n\nfunction key(installationId: string, repository: string): string {\n  return `${installationId}:${repository}`;\n}\n\n/** TEST-ONLY: clear the cache between tests. */\nexport function _resetTokenCache(): void {\n  cache.clear();\n}\n\n/**\n * Look up a cached token. Returns null if missing, expired, or within the\n * safety margin (caller must mint fresh).\n */\nexport function getCachedToken(\n  installationId: string,\n  repository: string,\n): Entry | null {\n  const e = cache.get(key(installationId, repository));\n  if (!e) return null;\n  if (e.expiresAt.getTime() - Date.now() <= EXPIRY_SAFETY_MS) return null;\n  return e;\n}\n\n/** Cache a freshly-minted token. */\nexport function putCachedToken(\n  installationId: string,\n  repository: string,\n  token: string,\n  expiresAt: Date,\n): void {\n  cache.set(key(installationId, repository), { token, expiresAt });\n}\n","import type { TokenCredential } from \"@azure/core-auth\";\nimport { signAppJwt } from \"./jwt.js\";\nimport { readAppSecrets } from \"./secrets.js\";\nimport { getCachedToken, putCachedToken } from \"./cache.js\";\n\nexport type MintedToken = {\n  token: string;\n  expiresAt: Date;\n  permissions: Record<string, string>;\n  repositorySelection: \"all\" | \"selected\";\n};\n\n/**\n * Mint a GitHub App installation access token, optionally narrowed to a\n * single repository. Caches the result keyed by (installationId, repository)\n * with a 10-min safety margin before expiry; subsequent calls return the\n * cached value until that window closes.\n *\n * @throws on any non-2xx GitHub response; the error message carries the\n *         status code and response body so the operator can diagnose\n *         (typical: 404 = wrong installation id; 401 = bad/expired App JWT).\n */\nexport async function mintInstallationToken(args: {\n  credential: TokenCredential;\n  kvUri: string;\n  installationId: string;\n  repository: string;\n}): Promise<MintedToken> {\n  const cached = getCachedToken(args.installationId, args.repository);\n  if (cached) {\n    return {\n      token: cached.token,\n      expiresAt: cached.expiresAt,\n      permissions: {}, // not tracked in cache; callers usually don't need it on hit\n      repositorySelection: \"selected\",\n    };\n  }\n\n  const { appId, privateKeyPem } = await readAppSecrets({\n    credential: args.credential,\n    kvUri: args.kvUri,\n  });\n  const appJwt = signAppJwt({ appId, privateKeyPem });\n\n  const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;\n  // GitHub expects the bare repo name (no owner/) in `repositories` — sending\n  // \"owner/name\" 422s with \"not accessible\" as soon as the installation has\n  // more than one repo (silently worked single-repo installations because\n  // GitHub matched leniently). Callers pass \"owner/name\" for cache-key uniqueness\n  // across owners; we strip it here.\n  const repoName = args.repository.includes(\"/\")\n    ? args.repository.split(\"/\", 2)[1]\n    : args.repository;\n  const body = JSON.stringify({ repositories: [repoName] });\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${appJwt}`,\n      Accept: \"application/vnd.github+json\",\n      \"X-GitHub-Api-Version\": \"2022-11-28\",\n      \"Content-Type\": \"application/json\",\n    },\n    body,\n  });\n\n  const text = await res.text();\n  if (!res.ok) {\n    throw new Error(\n      `mintInstallationToken: HTTP ${res.status} from ${url}\\n${text.slice(0, 500)}`,\n    );\n  }\n\n  const parsed = JSON.parse(text) as {\n    token: string;\n    expires_at: string;\n    permissions: Record<string, string>;\n    repository_selection: \"all\" | \"selected\";\n  };\n  const expiresAt = new Date(parsed.expires_at);\n  putCachedToken(args.installationId, args.repository, parsed.token, expiresAt);\n  return {\n    token: parsed.token,\n    expiresAt,\n    permissions: parsed.permissions,\n    repositorySelection: parsed.repository_selection,\n  };\n}\n","import type { TokenCredential } from \"@azure/core-auth\";\nimport { mintInstallationToken } from \"./mint.js\";\n\nconst ARM_SCOPE = \"https://management.azure.com/.default\";\nconst FOUNDRY_API = \"2025-04-01-preview\";\n\n/**\n * Mint a fresh installation token + PATCH the Foundry CustomKeys project\n * connection so the worker invoke that follows finds a current Authorization\n * value in `properties.credentials.keys.Authorization`.\n *\n * The F1 attachment shape is preserved verbatim — Foundry's MCP attachment\n * (tools[type:mcp] with project_connection_id) reads the connection's keys\n * at invoke time; we just keep refreshing them under the same connection\n * name. credentialRef → connection name (no change from F1).\n *\n * Cache lives in mintInstallationToken — when cached, we skip the GitHub\n * round-trip BUT we also skip the PATCH (the connection was already PATCHed\n * with the same token on the cache-write call). Cache eviction (expiry or\n * test reset) triggers a fresh mint + PATCH.\n *\n * @throws on any non-2xx from GitHub or Foundry (error message carries\n *         status + body excerpt for operator diagnosis).\n */\nexport async function rotateConnectionAuth(args: {\n  credential: TokenCredential;\n  kvUri: string;\n  projectArmId: string; // /subscriptions/.../projects/<proj>\n  connectionName: string;\n  installationId: string;\n  repository: string;\n}): Promise<{ rotatedAt: Date; expiresAt: Date }> {\n  // mintInstallationToken returns cached value if fresh — fast path.\n  // We track whether the token came from cache to decide whether to PATCH.\n  const { getCachedToken, putCachedToken } = await import(\"./cache.js\");\n  const before = getCachedToken(args.installationId, args.repository);\n  const minted = await mintInstallationToken({\n    credential: args.credential,\n    kvUri: args.kvUri,\n    installationId: args.installationId,\n    repository: args.repository,\n  });\n  const cacheHit = before !== null && before.token === minted.token;\n\n  if (!cacheHit) {\n    // Cache miss → we have a NEW token → PATCH it into Foundry.\n    const armTokenResp = await args.credential.getToken(ARM_SCOPE);\n    if (!armTokenResp?.token) {\n      throw new Error(\"rotateConnectionAuth: failed to acquire ARM management token\");\n    }\n    const url = `https://management.azure.com${args.projectArmId}/connections/${args.connectionName}?api-version=${FOUNDRY_API}`;\n    const res = await fetch(url, {\n      method: \"PATCH\",\n      headers: {\n        Authorization: `Bearer ${armTokenResp.token}`,\n        \"Content-Type\": \"application/json\",\n      },\n      // Foundry's connection resource is polymorphic on authType; the PATCH\n      // deserializes as a full shape (NOT a shallow merge), so omitting the\n      // discriminator returns 400 \"Missing discriminator property [AuthType]\".\n      // Mirror the same auth shape the initial PUT in brain-link.ts uses.\n      body: JSON.stringify({\n        properties: {\n          authType: \"CustomKeys\",\n          category: \"CustomKeys\",\n          credentials: { keys: { Authorization: `Bearer ${minted.token}` } },\n        },\n      }),\n    });\n    if (!res.ok) {\n      const text = await res.text();\n      throw new Error(\n        `rotateConnectionAuth: HTTP ${res.status} on PATCH ${url}\\n${text.slice(0, 500)}`,\n      );\n    }\n    // Ensure the cache reflects our PATCH (mintInstallationToken cached it,\n    // but this is a belt-and-suspenders refresh — keep test contract clear).\n    putCachedToken(args.installationId, args.repository, minted.token, minted.expiresAt);\n  }\n\n  return { rotatedAt: new Date(), expiresAt: minted.expiresAt };\n}\n","import type { TokenCredential } from \"@azure/core-auth\";\nimport { readAppSecrets } from \"./secrets.js\";\nimport { signAppJwt } from \"./jwt.js\";\n\nexport type CheckOutcome = {\n  ok: boolean;\n  error?: string;\n  value?: string;\n  slug?: string;\n  installationsCount?: number;\n  count?: number;\n};\n\nexport type CheckResult = {\n  ok: boolean; // true iff every individual check passed\n  checks: {\n    kvSecretsReadable: CheckOutcome;\n    appIdNumeric: CheckOutcome;\n    privateKeyValid: CheckOutcome;\n    appJwtAccepted: CheckOutcome;\n    installationsListable: CheckOutcome;\n  };\n};\n\n/**\n * Sanity-check the platform-level GitHub App configuration. Zero side\n * effects. Used by both the `m8t brain check-app` command and as an inline\n * silent-if-pass precondition in the link/create/unlink cascades.\n *\n * Validates:\n *   1. The three KV secrets (id, slug, private-key) are present + readable.\n *   2. App ID parses as a positive integer.\n *   3. Private key parses as a valid RSA PEM (signAppJwt succeeds).\n *   4. GET /app accepts the App JWT and returns a slug matching KV.\n *   5. GET /app/installations succeeds (HTTP 200 with an array).\n */\nexport async function checkAppHealth(args: {\n  credential: TokenCredential;\n  kvUri: string;\n}): Promise<CheckResult> {\n  const checks: CheckResult[\"checks\"] = {\n    kvSecretsReadable: { ok: false },\n    appIdNumeric: { ok: false },\n    privateKeyValid: { ok: false },\n    appJwtAccepted: { ok: false },\n    installationsListable: { ok: false },\n  };\n\n  // Check 1: KV secrets readable.\n  let appId: string, slug: string, privateKeyPem: string;\n  try {\n    const secrets = await readAppSecrets({ credential: args.credential, kvUri: args.kvUri });\n    appId = secrets.appId;\n    slug = secrets.slug;\n    privateKeyPem = secrets.privateKeyPem;\n    checks.kvSecretsReadable = { ok: true };\n  } catch (e) {\n    checks.kvSecretsReadable = { ok: false, error: (e as Error).message };\n    return { ok: false, checks };\n  }\n\n  // Check 2: appId numeric.\n  const appIdNum = Number(appId);\n  if (Number.isInteger(appIdNum) && appIdNum > 0) {\n    checks.appIdNumeric = { ok: true, value: appId };\n  } else {\n    checks.appIdNumeric = { ok: false, error: `not a positive integer: '${appId}'` };\n    return { ok: false, checks };\n  }\n\n  // Check 3: private key valid (signAppJwt throws if not).\n  let appJwt: string;\n  try {\n    appJwt = signAppJwt({ appId, privateKeyPem });\n    checks.privateKeyValid = { ok: true };\n  } catch (e) {\n    checks.privateKeyValid = { ok: false, error: (e as Error).message };\n    return { ok: false, checks };\n  }\n\n  // Check 4: GET /app accepts the App JWT; slug matches.\n  try {\n    const res = await fetch(\"https://api.github.com/app\", {\n      headers: {\n        Authorization: `Bearer ${appJwt}`,\n        Accept: \"application/vnd.github+json\",\n        \"X-GitHub-Api-Version\": \"2022-11-28\",\n      },\n    });\n    const text = await res.text();\n    if (!res.ok) {\n      checks.appJwtAccepted = { ok: false, error: `HTTP ${res.status}: ${text.slice(0, 200)}` };\n      return { ok: false, checks };\n    }\n    const data = JSON.parse(text) as { slug?: string; installations_count?: number };\n    if (data.slug !== slug) {\n      checks.appJwtAccepted = {\n        ok: false,\n        error: `slug mismatch: KV says '${slug}', App says '${data.slug}'`,\n        slug: data.slug,\n        installationsCount: data.installations_count,\n      };\n      return { ok: false, checks };\n    }\n    checks.appJwtAccepted = {\n      ok: true,\n      slug: data.slug,\n      installationsCount: data.installations_count,\n    };\n  } catch (e) {\n    checks.appJwtAccepted = { ok: false, error: (e as Error).message };\n    return { ok: false, checks };\n  }\n\n  // Check 5: GET /app/installations returns 200 with an array.\n  try {\n    const res = await fetch(\"https://api.github.com/app/installations\", {\n      headers: {\n        Authorization: `Bearer ${appJwt}`,\n        Accept: \"application/vnd.github+json\",\n        \"X-GitHub-Api-Version\": \"2022-11-28\",\n      },\n    });\n    if (!res.ok) {\n      checks.installationsListable = { ok: false, error: `HTTP ${res.status}` };\n      return { ok: false, checks };\n    }\n    const arr = (await res.json()) as unknown[];\n    checks.installationsListable = { ok: true, count: arr.length };\n  } catch (e) {\n    checks.installationsListable = { ok: false, error: (e as Error).message };\n    return { ok: false, checks };\n  }\n\n  return { ok: true, checks };\n}\n","export { signAppJwt } from \"./jwt.js\";\nexport { readAppSecrets, _resetAppSecretsCache, type AppSecrets } from \"./secrets.js\";\nexport {\n  getCachedToken, putCachedToken, _resetTokenCache, EXPIRY_SAFETY_MS,\n} from \"./cache.js\";\nexport { mintInstallationToken, type MintedToken } from \"./mint.js\";\nexport { rotateConnectionAuth } from \"./rotate.js\";\nexport { checkAppHealth, type CheckResult, type CheckOutcome } from \"./check.js\";\n","import type { TokenCredential } from \"@azure/identity\";\nimport { LocalCliError } from \"./errors.js\";\n\nexport type AuthedJsonArgs = {\n  credential: TokenCredential;\n  scope: string;\n  method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\";\n  url: string;\n  body?: unknown;\n  /** HTTP statuses to treat as success-with-undefined instead of throwing (e.g. 404 for existence checks). */\n  okStatuses?: number[];\n};\n\n/** Result wrapper exposing the status for callers that branch on 404 etc. */\nexport type AuthedJsonResult<T> = { status: number; data: T | undefined };\n\nexport async function authedJsonResult<T = unknown>(args: AuthedJsonArgs): Promise<AuthedJsonResult<T>> {\n  const token = await args.credential.getToken(args.scope);\n  if (!token) {\n    throw new LocalCliError({\n      code: \"AUTH_NULL_TOKEN\",\n      message: `Azure returned no token for scope ${args.scope}.`,\n      hint: \"Run 'az login' and retry.\",\n    });\n  }\n  const res = await fetch(args.url, {\n    method: args.method,\n    headers: {\n      Authorization: `Bearer ${token.token}`,\n      ...(args.body !== undefined ? { \"Content-Type\": \"application/json\" } : {}),\n    },\n    ...(args.body !== undefined ? { body: JSON.stringify(args.body) } : {}),\n  });\n\n  const ok = res.ok || (args.okStatuses?.includes(res.status) ?? false);\n  if (!ok) {\n    const text = await res.text().catch(() => \"\");\n    throw new LocalCliError({\n      code: \"AZURE_HTTP_ERROR\",\n      message: `${args.method} ${args.url} failed: ${res.status} ${res.statusText}${text ? ` — ${text.slice(0, 400)}` : \"\"}`,\n    });\n  }\n\n  const raw = await res.text();\n  const data = raw ? (JSON.parse(raw) as T) : undefined;\n  return { status: res.status, data };\n}\n\n/** Convenience: returns the parsed body (undefined for empty), throwing on non-2xx. */\nexport async function authedJson<T = unknown>(args: AuthedJsonArgs): Promise<T | undefined> {\n  return (await authedJsonResult<T>(args)).data;\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport { LocalCliError } from \"./errors.js\";\n\nconst FOUNDRY_SCOPE = \"https://ai.azure.com/.default\";\n\nexport type McpToolDescriptor = {\n  type: \"mcp\";\n  server_label: string;\n  server_url: string;\n  project_connection_id: string;\n  require_approval: \"never\" | \"always\";\n  allowed_tools: { tool_names: string[] } | string[];\n};\n\nexport type AgentDefinition = {\n  kind: \"prompt\" | \"hosted\";\n  model?: string;\n  instructions?: string;\n  reasoning?: { effort?: \"low\" | \"medium\" | \"high\" };\n  tools?: Array<McpToolDescriptor | { type: string; [k: string]: unknown }>;\n  [extra: string]: unknown;\n};\n\nexport type AgentVersionRecord = {\n  definition: AgentDefinition;\n  metadata?: Record<string, string>;\n  version: string;\n  status?: string;\n};\n\n/**\n * GET the LATEST version of a Foundry prompt agent via REST. Returns the\n * version's definition + metadata as-is. Used by the brain link/unlink\n * cascades to read the current state before composing the update.\n *\n * Why not the SDK: project.agents.getVersion(name, 'latest') would be\n * cleaner, but the SDK doesn't expose the raw definition + metadata shape\n * we need to clone+swap for brain-rotation. The REST endpoint returns\n * exactly the shape we PATCH back via createVersion, no transform.\n */\nexport async function getAgentVersion(args: {\n  credential: TokenCredential;\n  projectEndpoint: string;\n  agentName: string;\n}): Promise<AgentVersionRecord> {\n  const token = await args.credential.getToken(FOUNDRY_SCOPE);\n  if (!token?.token) {\n    throw new LocalCliError({\n      code: \"FOUNDRY_AUTH_FAILED\",\n      message: \"Could not acquire Foundry data-plane token (scope: https://ai.azure.com/.default).\",\n    });\n  }\n  const url = `${args.projectEndpoint}/agents/${args.agentName}?api-version=v1`;\n  const res = await fetch(url, {\n    method: \"GET\",\n    headers: { Authorization: `Bearer ${token.token}` },\n  });\n  if (res.status === 404) {\n    throw new LocalCliError({\n      code: \"AGENT_NOT_FOUND\",\n      message: `Agent '${args.agentName}' not found at ${args.projectEndpoint}.`,\n    });\n  }\n  if (!res.ok) {\n    const text = await res.text();\n    throw new LocalCliError({\n      code: \"AGENT_GET_FAILED\",\n      message: `GET ${url} returned HTTP ${res.status}: ${text.slice(0, 300)}`,\n    });\n  }\n  const data = (await res.json()) as { versions?: { latest?: AgentVersionRecord } };\n  const latest = data.versions?.latest;\n  if (!latest) {\n    throw new LocalCliError({\n      code: \"AGENT_GET_NO_LATEST\",\n      message: `GET ${url} returned no versions.latest`,\n    });\n  }\n  return latest;\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport { mintInstallationToken } from \"@m8t-stack/github-app-auth\";\nimport { LocalCliError } from \"./errors.js\";\n\nfunction brainYamlContent(args: {\n  repo: string;\n  branch: string;\n  persona: string;\n  agent: string;\n}): string {\n  return [\n    `# Convenience mirror of the worker↔repo link. NOT the source of truth —`,\n    `# the Foundry agent's metadata.brain is authoritative.`,\n    `repo: \"${args.repo}\"`,\n    `branch: ${args.branch}`,\n    `topology: per-worker`,\n    `schemaVersion: \"1\"`,\n    `persona: \"${args.persona}\"`,\n    `agent: \"${args.agent}\"`,\n    ``,\n  ].join(\"\\n\");\n}\n\nexport async function mirrorBrainYaml(args: {\n  credential: TokenCredential;\n  kvUri: string;\n  installationId: string;\n  repo: string;\n  branch: string;\n  persona: string;\n  agent: string;\n}): Promise<void> {\n  const content = brainYamlContent({\n    repo: args.repo,\n    branch: args.branch,\n    persona: args.persona,\n    agent: args.agent,\n  });\n  const minted = await mintInstallationToken({\n    credential: args.credential,\n    kvUri: args.kvUri,\n    installationId: args.installationId,\n    repository: args.repo,\n  });\n  const [owner, repoName] = args.repo.split(\"/\");\n  // GET existing file (need SHA for update)\n  const getRes = await fetch(\n    `https://api.github.com/repos/${owner}/${repoName}/contents/.m8t/brain.yaml`,\n    {\n      headers: {\n        Authorization: `Bearer ${minted.token}`,\n        Accept: \"application/vnd.github+json\",\n        \"X-GitHub-Api-Version\": \"2022-11-28\",\n      },\n    },\n  );\n  let sha: string | undefined;\n  if (getRes.ok) {\n    const data = (await getRes.json()) as { sha?: string };\n    sha = data.sha;\n  }\n  const body = {\n    message: \"chore(brain): mirror .m8t/brain.yaml (m8t brain link)\",\n    content: Buffer.from(content, \"utf8\").toString(\"base64\"),\n    branch: args.branch,\n    ...(sha ? { sha } : {}),\n  };\n  const putRes = await fetch(\n    `https://api.github.com/repos/${owner}/${repoName}/contents/.m8t/brain.yaml`,\n    {\n      method: \"PUT\",\n      headers: {\n        Authorization: `Bearer ${minted.token}`,\n        Accept: \"application/vnd.github+json\",\n        \"X-GitHub-Api-Version\": \"2022-11-28\",\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(body),\n    },\n  );\n  if (!putRes.ok) {\n    const text = await putRes.text();\n    throw new LocalCliError({\n      code: \"BRAIN_YAML_MIRROR_FAILED\",\n      message: `PUT .m8t/brain.yaml: HTTP ${putRes.status}\\n${text.slice(0, 300)}`,\n    });\n  }\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport { AIProjectClient, type HostedAgentDefinition } from \"@azure/ai-projects\";\nimport { authedJson, authedJsonResult } from \"./http.js\";\nimport { LocalCliError } from \"./errors.js\";\n\nconst FOUNDRY_SCOPE = \"https://ai.azure.com/.default\";\nconst API = \"v1\";\n\nexport type CoderMetadata = {\n  source: \"m8t-stack-POC\";\n  kind: \"hosted\";\n  persona: string;\n  personaVersion: string | null;\n};\n\n/**\n * Create a hosted coding-agent version via the @azure/ai-projects SDK\n * (the F1-proven TS path). Returns the new version id (e.g. \"1\").\n *\n * NOTE: the SDK's HostedAgentDefinition uses snake_case fields\n * (`container_protocol_versions` / `environment_variables`), matching the\n * live wire shape F1 observed. Returns the version as a string.\n */\nexport async function createCoderVersion(args: {\n  credential: TokenCredential;\n  endpoint: string;\n  name: string;\n  image: string;\n  cpu: string;\n  memory: string;\n  env: Record<string, string>;\n  metadata: CoderMetadata;\n  brain?: string;\n}): Promise<string> {\n  const project = new AIProjectClient(args.endpoint, args.credential);\n\n  const definition: HostedAgentDefinition = {\n    kind: \"hosted\",\n    image: args.image,\n    cpu: args.cpu,\n    memory: args.memory,\n    container_protocol_versions: [{ protocol: \"responses\", version: \"1.0.0\" }],\n    environment_variables: args.env,\n  };\n\n  const metadata: Record<string, string> = {\n    source: args.metadata.source,\n    kind: args.metadata.kind,\n    persona: args.metadata.persona,\n  };\n  if (args.metadata.personaVersion !== null) metadata.personaVersion = args.metadata.personaVersion;\n  if (args.brain) metadata.brain = args.brain;\n\n  const version = await project.agents.createVersion(args.name, definition, {\n    foundryFeatures: \"HostedAgents=V1Preview\",\n    metadata,\n  });\n\n  const v = (version as { version?: string | number }).version;\n  if (v === undefined || v === null) {\n    throw new LocalCliError({\n      code: \"CREATE_VERSION_NO_VERSION\",\n      message: `createVersion for '${args.name}' returned no version id.`,\n    });\n  }\n  return String(v);\n}\n\n/** Read the per-version agent identity OID (instance_identity.principal_id) via REST. */\nexport async function getAgentIdentityPrincipalId(args: {\n  credential: TokenCredential;\n  endpoint: string;\n  name: string;\n  version: string;\n}): Promise<string> {\n  const url = `${args.endpoint}/agents/${args.name}/versions/${args.version}?api-version=${API}`;\n  const data = await authedJson<{ instance_identity?: { principal_id?: string } }>({\n    credential: args.credential,\n    scope: FOUNDRY_SCOPE,\n    method: \"GET\",\n    url,\n  });\n  const oid = data?.instance_identity?.principal_id;\n  if (!oid) {\n    throw new LocalCliError({\n      code: \"AGENT_IDENTITY_MISSING\",\n      message: `Could not read the agent identity for '${args.name}' version ${args.version}.`,\n      hint: \"The hosted-agent version may not have provisioned its identity yet; retry in a few seconds.\",\n    });\n  }\n  return oid;\n}\n\n/** Poll target: the version's status, lowercased (\"creating\" | \"active\" | \"failed\" | ...). */\nexport async function getVersionStatus(args: {\n  credential: TokenCredential;\n  endpoint: string;\n  name: string;\n  version: string;\n}): Promise<string> {\n  const url = `${args.endpoint}/agents/${args.name}/versions/${args.version}?api-version=${API}`;\n  const data = await authedJson<{ status?: string }>({\n    credential: args.credential,\n    scope: FOUNDRY_SCOPE,\n    method: \"GET\",\n    url,\n  });\n  return String(data?.status ?? \"\").toLowerCase();\n}\n\nexport async function agentExists(args: {\n  credential: TokenCredential;\n  endpoint: string;\n  name: string;\n}): Promise<boolean> {\n  const url = `${args.endpoint}/agents/${args.name}?api-version=${API}`;\n  const res = await authedJsonResult({\n    credential: args.credential,\n    scope: FOUNDRY_SCOPE,\n    method: \"GET\",\n    url,\n    okStatuses: [404],\n  });\n  return res.status === 200;\n}\n\n/**\n * Delete the agent (cascades the container + its identity + role assignment).\n * `force=true` also cascade-deletes active sessions — without it the platform\n * 409s (\"Agent has active sessions\") for ~15 min after a recent invoke. A\n * teardown is deliberate + confirm-gated, so forcing is the right behavior.\n */\nexport async function deleteAgent(args: {\n  credential: TokenCredential;\n  endpoint: string;\n  name: string;\n}): Promise<void> {\n  const url = `${args.endpoint}/agents/${args.name}?api-version=${API}&force=true`;\n  await authedJsonResult({\n    credential: args.credential,\n    scope: FOUNDRY_SCOPE,\n    method: \"DELETE\",\n    url,\n    okStatuses: [404], // already gone — idempotent\n  });\n}\n","import { randomUUID } from \"node:crypto\";\nimport type { TokenCredential } from \"@azure/identity\";\nimport { authedJson, authedJsonResult } from \"./http.js\";\nimport { LocalCliError } from \"./errors.js\";\n\nconst ARM = \"https://management.azure.com\";\nconst ARM_SCOPE = \"https://management.azure.com/.default\";\nconst RA_API = \"2022-04-01\";\n\nexport const FOUNDRY_USER_ROLE_ID = \"53ca6127-db72-4b80-b1b0-d745d6d5456d\";\nexport const ACR_PULL_ROLE_ID = \"7f951dda-4ed3-4680-a7ca-43fe172d538d\";\nconst OWNER_ROLE_ID = \"8e3af657-a8ff-443c-a75c-2fe8c4bcb635\";\nexport const USER_ACCESS_ADMIN_ROLE_ID = \"18d7d88d-d35e-4fb5-a5c3-7773c20a72d9\";\nconst RBAC_ADMIN_ROLE_ID = \"f58310d9-a9f6-439a-9e8d-f62e7b41a168\";\n\nconst ASSIGNING_ROLE_IDS = [OWNER_ROLE_ID, USER_ACCESS_ADMIN_ROLE_ID, RBAC_ADMIN_ROLE_ID];\n\ntype RoleAssignmentList = {\n  value?: Array<{ properties?: { roleDefinitionId?: string; principalId?: string } }>;\n};\n\n/** Grant the Foundry User role to a principal at the given (account) scope. Idempotent — 409 = already granted. */\nexport async function grantFoundryUser(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  accountScope: string;\n  principalId: string;\n}): Promise<void> {\n  const roleAssignmentId = randomUUID();\n  const url = `${ARM}${args.accountScope}/providers/Microsoft.Authorization/roleAssignments/${roleAssignmentId}?api-version=${RA_API}`;\n  await authedJsonResult({\n    credential: args.credential,\n    scope: ARM_SCOPE,\n    method: \"PUT\",\n    url,\n    body: {\n      properties: {\n        roleDefinitionId: `/subscriptions/${args.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${FOUNDRY_USER_ROLE_ID}`,\n        principalId: args.principalId,\n        principalType: \"ServicePrincipal\",\n      },\n    },\n    okStatuses: [409], // RoleAssignmentExists — already granted\n  });\n}\n\nasync function listRoleAssignments(\n  credential: TokenCredential,\n  scope: string,\n  filter?: string,\n): Promise<RoleAssignmentList> {\n  const q = `api-version=${RA_API}${filter ? `&$filter=${encodeURIComponent(filter)}` : \"\"}`;\n  const url = `${ARM}${scope}/providers/Microsoft.Authorization/roleAssignments?${q}`;\n  return (await authedJson<RoleAssignmentList>({ credential, scope: ARM_SCOPE, method: \"GET\", url })) ?? {};\n}\n\nfunction roleIdMatches(roleDefinitionId: string | undefined, roleGuid: string): boolean {\n  return (roleDefinitionId ?? \"\").toLowerCase().endsWith(roleGuid.toLowerCase());\n}\n\n/** True if `principalId` holds AcrPull at the ACR scope. */\nexport async function principalHasAcrPull(args: {\n  credential: TokenCredential;\n  acrScope: string;\n  principalId: string;\n}): Promise<boolean> {\n  const list = await listRoleAssignments(args.credential, args.acrScope);\n  return (list.value ?? []).some(\n    (a) =>\n      a.properties?.principalId === args.principalId &&\n      roleIdMatches(a.properties?.roleDefinitionId, ACR_PULL_ROLE_ID),\n  );\n}\n\n/** Grant AcrPull to a principal at the ACR scope. Idempotent. */\nexport async function grantAcrPull(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  acrScope: string;\n  principalId: string;\n}): Promise<void> {\n  const url = `${ARM}${args.acrScope}/providers/Microsoft.Authorization/roleAssignments/${randomUUID()}?api-version=${RA_API}`;\n  await authedJsonResult({\n    credential: args.credential,\n    scope: ARM_SCOPE,\n    method: \"PUT\",\n    url,\n    body: {\n      properties: {\n        roleDefinitionId: `/subscriptions/${args.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${ACR_PULL_ROLE_ID}`,\n        principalId: args.principalId,\n        principalType: \"ServicePrincipal\",\n      },\n    },\n    okStatuses: [409],\n  });\n}\n\n/** True if the caller (by object id) holds Owner / UAA / RBAC Admin at or above `scope`. */\nexport async function callerCanAssignRoles(args: {\n  credential: TokenCredential;\n  scope: string;\n  callerObjectId: string;\n}): Promise<boolean> {\n  // $filter=atScope() returns assignments at and above the scope; principalId filter\n  // includes group-inherited assignments via assignedTo().\n  const list = await listRoleAssignments(\n    args.credential,\n    args.scope,\n    `atScope() and assignedTo('${args.callerObjectId}')`,\n  );\n  return (list.value ?? []).some((a) =>\n    ASSIGNING_ROLE_IDS.some((g) => roleIdMatches(a.properties?.roleDefinitionId, g)),\n  );\n}\n\nexport const KV_SECRETS_USER_ROLE_ID = \"4633458b-17de-408a-b874-0445c86b69e6\";\n\n/** Grant Key Vault Secrets User to a principal at the KV resource scope. Idempotent — 409 = already granted. */\nexport async function grantKeyVaultSecretsUser(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  kvScope: string; // /subscriptions/.../providers/Microsoft.KeyVault/vaults/<name>\n  principalId: string;\n}): Promise<void> {\n  const url = `${ARM}${args.kvScope}/providers/Microsoft.Authorization/roleAssignments/${randomUUID()}?api-version=${RA_API}`;\n  await authedJsonResult({\n    credential: args.credential,\n    scope: ARM_SCOPE,\n    method: \"PUT\",\n    url,\n    body: {\n      properties: {\n        roleDefinitionId: `/subscriptions/${args.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${KV_SECRETS_USER_ROLE_ID}`,\n        principalId: args.principalId,\n        principalType: \"ServicePrincipal\",\n      },\n    },\n    okStatuses: [409],\n  });\n}\n\n/** True if `principalId` holds Key Vault Secrets User at the KV resource scope. */\nexport async function principalHasKvSecretsUser(args: {\n  credential: TokenCredential;\n  kvScope: string;\n  principalId: string;\n}): Promise<boolean> {\n  const list = await listRoleAssignments(args.credential, args.kvScope);\n  return (list.value ?? []).some(\n    (a) =>\n      a.properties?.principalId === args.principalId &&\n      roleIdMatches(a.properties?.roleDefinitionId, KV_SECRETS_USER_ROLE_ID),\n  );\n}\n\nexport const CONTRIBUTOR_ROLE_ID = \"b24988ac-6180-42a0-ab88-20f7382dd24c\";\n\n/** Grant the Contributor role to a principal at the given scope (RG or subscription). Idempotent — 409 = already granted. */\nexport async function grantContributor(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  scope: string; // full ARM scope id: /subscriptions/<id>[/resourceGroups/<rg>]\n  principalId: string;\n}): Promise<void> {\n  const url = `${ARM}${args.scope}/providers/Microsoft.Authorization/roleAssignments/${randomUUID()}?api-version=${RA_API}`;\n  await authedJsonResult({\n    credential: args.credential,\n    scope: ARM_SCOPE,\n    method: \"PUT\",\n    url,\n    body: {\n      properties: {\n        roleDefinitionId: `/subscriptions/${args.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${CONTRIBUTOR_ROLE_ID}`,\n        principalId: args.principalId,\n        principalType: \"ServicePrincipal\",\n      },\n    },\n    okStatuses: [409],\n  });\n}\n\n/** Grant User Access Administrator to a principal at the given scope (RG or subscription). Idempotent — 409 = already granted. */\nexport async function grantUserAccessAdmin(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  scope: string; // full ARM scope id: /subscriptions/<id>[/resourceGroups/<rg>]\n  principalId: string;\n}): Promise<void> {\n  const url = `${ARM}${args.scope}/providers/Microsoft.Authorization/roleAssignments/${randomUUID()}?api-version=${RA_API}`;\n  await authedJsonResult({\n    credential: args.credential,\n    scope: ARM_SCOPE,\n    method: \"PUT\",\n    url,\n    body: {\n      properties: {\n        roleDefinitionId: `/subscriptions/${args.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${USER_ACCESS_ADMIN_ROLE_ID}`,\n        principalId: args.principalId,\n        principalType: \"ServicePrincipal\",\n      },\n    },\n    okStatuses: [409],\n  });\n}\n\n/** Resolve a Key Vault's ARM resource id from its vault URI, via ARM resources list. */\nexport async function resolveKeyVaultResourceId(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  kvUri: string;\n}): Promise<string> {\n  const host = new URL(args.kvUri).host; // m8t-kv-xxx.vault.azure.net\n  const name = host.split(\".\")[0];\n  const url = `${ARM}/subscriptions/${args.subscriptionId}/resources?api-version=2021-04-01&$filter=${encodeURIComponent(`resourceType eq 'Microsoft.KeyVault/vaults' and name eq '${name}'`)}`;\n  const data = await authedJson<{ value?: Array<{ id?: string }> }>({\n    credential: args.credential,\n    scope: ARM_SCOPE,\n    method: \"GET\",\n    url,\n  });\n  const id = data?.value?.[0]?.id;\n  if (!id) {\n    throw new LocalCliError({\n      code: \"KV_RESOURCE_NOT_FOUND\",\n      message: `Could not resolve the ARM resource id for Key Vault '${name}' in subscription ${args.subscriptionId}.`,\n    });\n  }\n  return id;\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport { serializeBrainLink, IN_CONTAINER_CREDENTIAL_REF, type BrainLink } from \"@m8t-stack/api-contract\";\nimport { getAgentVersion } from \"./foundry-agent-get.js\";\nimport { createCoderVersion, getAgentIdentityPrincipalId } from \"./foundry-agents.js\";\nimport { grantFoundryUser, grantKeyVaultSecretsUser, resolveKeyVaultResourceId } from \"./rbac.js\";\nimport { mirrorBrainYaml } from \"./brain-yaml-mirror.js\";\nimport { LocalCliError } from \"./errors.js\";\nimport type { FoundryProject } from \"./foundry-project.js\";\n\n// Reasoning-family deployment-name whitelist (gpt-5*, o1–o9).\nconst REASONING_RE = /^(gpt-5|o[1-9])/i;\n\nexport type EnableHostedBrainArgs = {\n  credential: TokenCredential;\n  subscriptionId: string;\n  project: FoundryProject;\n  kvUri: string;\n  agentName: string;\n  repo: string;\n  branch: string;\n  installationId: string;\n  modelDeployment?: string;\n  allowNonReasoning?: boolean;\n  onProgress?: (m: string) => void;\n};\n\nexport type EnableHostedBrainResult = { version?: string; alreadyLinked: boolean };\n\nexport async function enableHostedBrain(args: EnableHostedBrainArgs): Promise<EnableHostedBrainResult> {\n  const progress = args.onProgress ?? (() => {});\n\n  const current = await getAgentVersion({\n    credential: args.credential,\n    projectEndpoint: args.project.endpoint,\n    agentName: args.agentName,\n  });\n  if (current.definition.kind !== \"hosted\") {\n    throw new LocalCliError({\n      code: \"NOT_A_HOSTED_AGENT\",\n      message: `enableHostedBrain: '${args.agentName}' is kind '${current.definition.kind}', not hosted.`,\n    });\n  }\n\n  const def = current.definition as Record<string, unknown>;\n  const currentEnv: Record<string, string> = { ...(def.environment_variables as Record<string, string> ?? {}) };\n\n  const effectiveModel = args.modelDeployment ?? currentEnv.MODEL_DEPLOYMENT_NAME ?? \"\";\n  if (!REASONING_RE.test(effectiveModel) && !args.allowNonReasoning) {\n    progress(\n      `warning: '${effectiveModel || \"(unset)\"}' is not a recognized reasoning model (gpt-5*/o*). ` +\n        `Brain workers write reliably only with reasoning + low effort; proceeding anyway. ` +\n        `Pass --allow-non-reasoning to silence, or --model-deployment gpt-5-mini to switch.`,\n    );\n  }\n\n  const link: BrainLink = {\n    repo: args.repo,\n    branch: args.branch,\n    topology: \"per-worker\",\n    schemaVersion: \"1\",\n    credentialRef: IN_CONTAINER_CREDENTIAL_REF,\n    installationId: args.installationId,\n  };\n\n  const existing = parseBrain(current.metadata?.brain);\n  if (\n    existing &&\n    existing.repo === args.repo &&\n    existing.installationId === args.installationId &&\n    existing.branch === args.branch &&\n    currentEnv.BRAIN_REPO === args.repo\n  ) {\n    progress(\"already linked — no-op (no new version, no token rotation).\");\n    return { alreadyLinked: true };\n  }\n\n  const env: Record<string, string> = {\n    ...currentEnv,\n    BRAIN_REPO: args.repo,\n    BRAIN_BRANCH: args.branch,\n    GITHUB_APP_INSTALLATION_ID: args.installationId,\n    AZURE_KEYVAULT_URI: args.kvUri,\n    REASONING_EFFORT: \"low\",\n    MODEL_DEPLOYMENT_NAME: effectiveModel,\n  };\n\n  progress(\"creating brain-enabled hosted version…\");\n  const version = await createCoderVersion({\n    credential: args.credential,\n    endpoint: args.project.endpoint,\n    name: args.agentName,\n    image: def.image as string,\n    cpu: def.cpu as string,\n    memory: def.memory as string,\n    env,\n    metadata: {\n      source: \"m8t-stack-POC\",\n      kind: \"hosted\",\n      persona: current.metadata?.persona ?? \"coding-agent\",\n      personaVersion: current.metadata?.personaVersion ?? null,\n    },\n    brain: serializeBrainLink(link),\n  });\n\n  progress(\"granting the agent identity Foundry User…\");\n  const principalId = await getAgentIdentityPrincipalId({\n    credential: args.credential,\n    endpoint: args.project.endpoint,\n    name: args.agentName,\n    version,\n  });\n  await grantFoundryUser({\n    credential: args.credential,\n    subscriptionId: args.subscriptionId,\n    accountScope: args.project.accountScope,\n    principalId,\n  });\n\n  progress(\"granting the agent identity Key Vault Secrets User…\");\n  const kvScope = await resolveKeyVaultResourceId({\n    credential: args.credential,\n    subscriptionId: args.subscriptionId,\n    kvUri: args.kvUri,\n  });\n  await grantKeyVaultSecretsUser({\n    credential: args.credential,\n    subscriptionId: args.subscriptionId,\n    kvScope,\n    principalId,\n  });\n\n  progress(\"mirroring .m8t/brain.yaml…\");\n  await mirrorBrainYaml({\n    credential: args.credential,\n    kvUri: args.kvUri,\n    installationId: args.installationId,\n    repo: args.repo,\n    branch: args.branch,\n    agent: args.agentName,\n    persona: current.metadata?.persona ?? args.agentName,\n  });\n\n  return { version, alreadyLinked: false };\n}\n\nfunction parseBrain(raw: string | undefined): BrainLink | undefined {\n  if (!raw) return undefined;\n  try { return JSON.parse(raw) as BrainLink; } catch { return undefined; }\n}\n","import { Builtins, Cli } from \"clipanion\";\nimport { CLI_VERSION } from \"./lib/package-version.js\";\nimport { renderError } from \"./lib/render-error.js\";\nimport { BindAddCommand } from \"./commands/bind/add.js\";\nimport { BindCleanupCommand } from \"./commands/bind/cleanup.js\";\nimport { BindListCommand } from \"./commands/bind/list.js\";\nimport { BindRemoveCommand } from \"./commands/bind/remove.js\";\nimport { BindShowCommand } from \"./commands/bind/show.js\";\nimport { ConfigResetCommand } from \"./commands/config/reset.js\";\nimport { ConfigSetCommand } from \"./commands/config/set.js\";\nimport { ConfigShowCommand } from \"./commands/config/show.js\";\nimport { TeamAddCommand } from \"./commands/team/add.js\";\nimport { TeamAddIdentityCommand } from \"./commands/team/add-identity.js\";\nimport { TeamListCommand } from \"./commands/team/list.js\";\nimport { TeamRemoveCommand } from \"./commands/team/remove.js\";\nimport { TeamRemoveIdentityCommand } from \"./commands/team/remove-identity.js\";\nimport { TeamShowCommand } from \"./commands/team/show.js\";\nimport { BrainCheckAppCommand } from \"./commands/brain/check-app.js\";\nimport { BrainCreateCommand } from \"./commands/brain/create.js\";\nimport { BrainLinkCommand } from \"./commands/brain/link.js\";\nimport { BrainListCommand } from \"./commands/brain/list.js\";\nimport { BrainShowCommand } from \"./commands/brain/show.js\";\nimport { BrainUnlinkCommand } from \"./commands/brain/unlink.js\";\nimport { AgentRemoveCommand } from \"./commands/agent/remove.js\";\nimport { A2aEnableCommand } from \"./commands/a2a/enable.js\";\nimport { A2aDisableCommand } from \"./commands/a2a/disable.js\";\nimport { ArchitectCheckCommand } from \"./commands/architect/check.js\";\nimport { CoderDeployCommand } from \"./commands/coder/deploy.js\";\nimport { CoderTeardownCommand } from \"./commands/coder/teardown.js\";\nimport { AzureExecDeployCommand } from \"./commands/azure-exec/deploy.js\";\nimport { DeployCommand } from \"./commands/deploy.js\";\nimport { VersionCommand } from \"./commands/version.js\";\nimport { WhoamiCommand } from \"./commands/whoami.js\";\nimport { StatusCommand } from \"./commands/status.js\";\nimport { DoctorCommand } from \"./commands/doctor.js\";\nimport { SwitchCommand } from \"./commands/switch.js\";\nimport { OpenCommand } from \"./commands/open.js\";\n\n// REGISTRY — every file under src/commands/ MUST appear here.\n// commands.registry.test.ts walks src/commands/ and asserts each is registered.\nconst cli = new Cli({\n  binaryName: \"m8t\",\n  binaryLabel: \"m8t CLI — manage m8t-stack deployments\",\n  binaryVersion: CLI_VERSION,\n});\n\ncli.register(Builtins.HelpCommand);\ncli.register(VersionCommand);\ncli.register(WhoamiCommand);\ncli.register(StatusCommand);\ncli.register(DoctorCommand);\ncli.register(SwitchCommand);\ncli.register(OpenCommand);\ncli.register(ConfigShowCommand);\ncli.register(ConfigResetCommand);\ncli.register(ConfigSetCommand);\ncli.register(BindAddCommand);\ncli.register(BindCleanupCommand);\ncli.register(BindListCommand);\ncli.register(BindRemoveCommand);\ncli.register(BindShowCommand);\ncli.register(TeamAddCommand);\ncli.register(TeamAddIdentityCommand);\ncli.register(TeamListCommand);\ncli.register(TeamRemoveCommand);\ncli.register(TeamRemoveIdentityCommand);\ncli.register(TeamShowCommand);\ncli.register(BrainCheckAppCommand);\ncli.register(BrainCreateCommand);\ncli.register(BrainLinkCommand);\ncli.register(BrainListCommand);\ncli.register(BrainShowCommand);\ncli.register(BrainUnlinkCommand);\ncli.register(ArchitectCheckCommand);\ncli.register(CoderDeployCommand);\ncli.register(CoderTeardownCommand);\ncli.register(AzureExecDeployCommand);\ncli.register(DeployCommand);\ncli.register(AgentRemoveCommand);\ncli.register(A2aEnableCommand);\ncli.register(A2aDisableCommand);\n\nasync function main(): Promise<number> {\n  try {\n    return await cli.run(process.argv.slice(2));\n  } catch (e) {\n    const verbose = process.argv.includes(\"--verbose\");\n    const outputIdx = process.argv.indexOf(\"--output\");\n    const output =\n      outputIdx >= 0 && outputIdx + 1 < process.argv.length\n        ? (process.argv[outputIdx + 1] as \"pretty\" | \"json\" | \"auto\")\n        : undefined;\n    return renderError(e, { stderr: process.stderr, verbose, output });\n  }\n}\n\nmain().then((code) => process.exit(code));\n","/**\n * The CLI version is injected at build time via tsup's `define` config.\n * In dev (tsx), CLI_VERSION may be undefined; fall back to a sentinel.\n */\nexport const CLI_VERSION: string = process.env.CLI_VERSION ?? \"0.0.0-dev\";\n","import { ApiCallError, LocalCliError } from \"./errors.js\";\nimport { resolveBackendHint, resolveLocalHint } from \"./error-hints.js\";\nimport { colors, renderJson, resolveOutputMode, type OutputMode } from \"./output.js\";\n\nexport type RenderErrorOptions = {\n  stderr: NodeJS.WriteStream;\n  output?: OutputMode;\n  verbose?: boolean;\n};\n\n/**\n * Render an unexpected error onto stderr and return the appropriate exit code.\n * - `1`: every backend or local failure\n * - `2`: user-cancelled (recognized by `error.name === \"ExitPromptError\"` from @inquirer/prompts)\n */\nexport function renderError(err: unknown, opts: RenderErrorOptions): number {\n  const mode = resolveOutputMode(opts.output, opts.stderr);\n\n  // User-cancelled (@inquirer/prompts.select / confirm)\n  if (\n    err instanceof Error &&\n    (err.name === \"ExitPromptError\" || err.message === \"User force closed the prompt\")\n  ) {\n    if (mode === \"json\") {\n      opts.stderr.write(\n        renderJson({\n          ok: false,\n          error: { code: \"CANCELLED\", message: \"User cancelled the operation.\" },\n        }) + \"\\n\",\n      );\n    } else {\n      opts.stderr.write(\"cancelled.\\n\");\n    }\n    return 2;\n  }\n\n  if (err instanceof ApiCallError) {\n    if (mode === \"json\") {\n      opts.stderr.write(renderJson({ ok: false, error: err.envelope }) + \"\\n\");\n      return 1;\n    }\n    opts.stderr.write(`${colors.error(\"error:\")} ${err.envelope.message}\\n`);\n    const hint = resolveBackendHint(err.envelope);\n    if (hint) opts.stderr.write(`  ${colors.hint(\"hint:\")} ${hint}\\n`);\n    if (opts.verbose) {\n      opts.stderr.write(\"\\n\" + colors.dim(renderJson(err.envelope)) + \"\\n\");\n    }\n    return 1;\n  }\n\n  if (err instanceof LocalCliError) {\n    if (mode === \"json\") {\n      opts.stderr.write(\n        renderJson({\n          ok: false,\n          error: {\n            code: err.code,\n            message: err.message,\n            ...(err.hint ? { details: { hint: err.hint } } : {}),\n          },\n        }) + \"\\n\",\n      );\n      return 1;\n    }\n    opts.stderr.write(`${colors.error(\"error:\")} ${err.message}\\n`);\n    const hint = err.hint ?? resolveLocalHint(err.code);\n    if (hint) opts.stderr.write(`  ${colors.hint(\"hint:\")} ${hint}\\n`);\n    if (opts.verbose && err.cause instanceof Error) {\n      opts.stderr.write(\"\\n\" + colors.dim(`caused by: ${err.cause.stack ?? err.cause.message}`) + \"\\n\");\n    }\n    return 1;\n  }\n\n  // Unknown error — print message + stack (only on verbose)\n  const e = err instanceof Error ? err : new Error(String(err));\n  if (mode === \"json\") {\n    opts.stderr.write(\n      renderJson({\n        ok: false,\n        error: { code: \"UNEXPECTED\", message: e.message },\n      }) + \"\\n\",\n    );\n    return 1;\n  }\n  opts.stderr.write(`${colors.error(\"error:\")} ${e.message}\\n`);\n  if (opts.verbose && e.stack) {\n    opts.stderr.write(\"\\n\" + colors.dim(e.stack) + \"\\n\");\n  } else {\n    opts.stderr.write(`  ${colors.hint(\"hint:\")} run with --verbose for the stack trace.\\n`);\n  }\n  return 1;\n}\n","import type { ApiErrorEnvelope } from \"@m8t-stack/api-contract\";\n\ntype HintRule = {\n  code: string;\n  reason?: string;\n  hint: (e: ApiErrorEnvelope) => string;\n};\n\nfunction getDetailField(envelope: ApiErrorEnvelope, key: string): unknown {\n  if (typeof envelope.details === \"object\" && envelope.details !== null) {\n    return (envelope.details as Record<string, unknown>)[key];\n  }\n  return undefined;\n}\n\n// BAD_REQUEST validation reasons (missing_handle, invalid_handle, empty_handle,\n// handle_too_long, missing_display_name, display_name_empty, missing_identities,\n// invalid_identities, invalid_channel_id, channel_id_empty, channel_id_too_long,\n// etc.) intentionally have no entries here — the backend's `message` field is\n// already self-explanatory (e.g. \"handle must not be empty.\") and adds nothing\n// when surfaced through a CLI hint. Only add a rule when the hint provides\n// genuinely new info (e.g. a remediation command).\nconst BACKEND_RULES: HintRule[] = [\n  // Auth-related\n  {\n    code: \"UNAUTHENTICATED\",\n    reason: \"missing_bearer\",\n    hint: () => \"you are not signed in to Azure — run 'az login' first.\",\n  },\n  {\n    code: \"UNAUTHENTICATED\",\n    reason: \"header_missing\",\n    hint: () =>\n      \"the gateway didn't receive your identity headers — this is likely a gateway misconfiguration.\",\n  },\n  {\n    code: \"UNAUTHENTICATED\",\n    hint: () => \"your Azure login may have expired — run 'az login' to re-authenticate.\",\n  },\n\n  // CONFLICT — handle_exists (POST collision)\n  {\n    code: \"CONFLICT\",\n    reason: \"handle_exists\",\n    hint: (e) => {\n      const handle = String(getDetailField(e, \"handle\") ?? \"<handle>\");\n      return `use 'm8t team add-identity ${handle} --<channel> <id>' to add another channel identity to the existing member.`;\n    },\n  },\n\n  // CONFLICT — identity_claimed (PATCH cross-handle collision)\n  {\n    code: \"CONFLICT\",\n    reason: \"identity_claimed\",\n    hint: (e) => {\n      const otherHandle = String(getDetailField(e, \"handle\") ?? \"<handle>\");\n      const channel = String(getDetailField(e, \"channel\") ?? \"<channel>\");\n      return `the ${channel} identity already belongs to '${otherHandle}'. Remove it from '${otherHandle}' first, or use a different channel ID.`;\n    },\n  },\n\n  // NOT_FOUND\n  {\n    code: \"NOT_FOUND\",\n    reason: \"team_member_not_found\",\n    hint: () => \"try 'm8t team list' to see all team members.\",\n  },\n\n  // BAD_REQUEST\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"no_identities_provided\",\n    hint: () => \"specify at least one of --telegram, --slack, --teams.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"invalid_handle\",\n    hint: () =>\n      \"handle must be lowercase letters, digits, and hyphens; must start with a letter or digit.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"handle_too_long\",\n    hint: () => \"handle must be 64 chars or fewer.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"empty_patch\",\n    hint: () =>\n      \"PATCH body must contain at least one of: --display, an identity flag, or --remove-<channel>.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"empty_patch_would_orphan\",\n    hint: (e) => {\n      const handle = String(getDetailField(e, \"handle\") ?? \"<handle>\");\n      return `removing those channels would leave '${handle}' with no identities. Use 'm8t team remove ${handle}' to remove the member entirely.`;\n    },\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"unknown_channel\",\n    hint: () => \"channel must be one of: telegram, slack, teams.\",\n  },\n\n  // BAD_REQUEST — F4 binding-validation reasons\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"no_adapter_registered\",\n    hint: (e) => {\n      const channel = String(getDetailField(e, \"channel\") ?? \"<channel>\");\n      return `no adapter for channel '${channel}'. This is expected for F4 alone; the channel-specific adapter ships in a later feature.`;\n    },\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"invalid_binding_id\",\n    hint: () =>\n      \"slug must be lowercase letters, digits, and hyphens; must start with a letter or digit. Example: cmo-tg, cpo-slack.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"binding_id_too_long\",\n    hint: () => \"slug must be 64 chars or fewer.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"invalid_status_filter\",\n    hint: () => \"--status must be 'active' or 'orphaned'.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"invalid_channel_filter\",\n    hint: () => \"--channel must be one of: telegram, slack, teams.\",\n  },\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"cleanup_active_binding\",\n    hint: (e) => {\n      const bindingId = String(getDetailField(e, \"bindingId\") ?? \"<id>\");\n      return `binding '${bindingId}' is active. Use 'm8t bind remove ${bindingId}' instead — cleanup is for orphaned bindings only.`;\n    },\n  },\n\n  // CONFLICT — binding_exists\n  {\n    code: \"CONFLICT\",\n    reason: \"binding_exists\",\n    hint: (e) => {\n      const channel = String(getDetailField(e, \"channel\") ?? \"<channel>\");\n      const bindingId = String(getDetailField(e, \"bindingId\") ?? \"<id>\");\n      return `binding '${bindingId}' already exists on channel '${channel}'. Use 'm8t bind show ${bindingId}' to inspect or 'm8t bind remove ${bindingId}' first.`;\n    },\n  },\n\n  // NOT_FOUND — binding_not_found\n  {\n    code: \"NOT_FOUND\",\n    reason: \"binding_not_found\",\n    hint: (e) => {\n      const bindingId = String(getDetailField(e, \"bindingId\") ?? \"<id>\");\n      return `no binding '${bindingId}' found. Run 'm8t bind list' to see all bindings.`;\n    },\n  },\n\n  // BAD_REQUEST — F6 webhook-registration rejection\n  {\n    code: \"BAD_REQUEST\",\n    reason: \"webhook_registration_rejected\",\n    hint: () =>\n      \"Telegram rejected the bot token. Double-check the token from BotFather and that it isn't revoked.\",\n  },\n\n  // UPSTREAM_FAILED — F6 webhook-registration transient failure\n  {\n    code: \"UPSTREAM_FAILED\",\n    reason: \"webhook_registration_failed\",\n    hint: () =>\n      \"Couldn't reach Telegram to register the webhook. Try the command again in a moment.\",\n  },\n\n  // UPSTREAM_FAILED — KV + cascade reasons\n  {\n    code: \"UPSTREAM_FAILED\",\n    reason: \"key_vault_unavailable\",\n    hint: () =>\n      \"Key Vault was unreachable. Check that the gateway's managed identity has the 'Key Vault Secrets Officer' role on the configured vault.\",\n  },\n  {\n    code: \"UPSTREAM_FAILED\",\n    reason: \"kv_secret_malformed\",\n    hint: () =>\n      \"the Key Vault secret for this binding is in an unexpected shape. Manual cleanup may be required — contact your m8t-stack admin.\",\n  },\n  // NOTE: cascade_partial_failure is handled INLINE in the bind remove +\n  // bind cleanup command files (the rendering needs the structured\n  // details.partial.{completedSteps, failedStep, originalMessage}), so\n  // no entry here intentionally.\n\n  // UPSTREAM_FAILED\n  {\n    code: \"UPSTREAM_FAILED\",\n    reason: \"table_storage_partial_write\",\n    hint: () =>\n      \"partial write — run 'm8t team show <handle>' to see what was created, then 'm8t team add-identity' to fill in the rest.\",\n  },\n  {\n    code: \"UPSTREAM_FAILED\",\n    reason: \"table_storage_unavailable\",\n    hint: () => \"Azure Table Storage is temporarily unavailable — try again in a moment.\",\n  },\n\n  // RATE_LIMITED\n  {\n    code: \"RATE_LIMITED\",\n    hint: () => \"wait a moment, then try again.\",\n  },\n\n  // INTERNAL\n  {\n    code: \"INTERNAL\",\n    reason: \"config\",\n    hint: () =>\n      \"the gateway has a configuration error — check the Container App's environment variables.\",\n  },\n];\n\nconst LOCAL_RULES: Record<string, string> = {\n  // Task 12 — foundry-agent-get\n  AGENT_CREATE_VERSION_FAILED: \"Re-run with `--verbose` for the full response body.\",\n  AGENT_CREATE_VERSION_NO_VERSION:\n    \"Foundry returned 2xx but no version — likely an API regression. Re-try; if it persists, file an issue.\",\n  AGENT_GET_FAILED: \"Re-run with `--verbose` for the full response body.\",\n  AGENT_NOT_FOUND:\n    \"Use `m8t brain create <name>` to create the worker first, OR run `m8t deploy <name>` to register an existing agent.\",\n  // Task 14 — brain-unlink\n  AGENT_REDEPLOY_FAILED: \"Re-run with `--verbose` for the full response body.\",\n  AGENT_REDEPLOY_NO_VERSION:\n    \"Foundry returned 2xx but no version. Re-try; if it persists, file an issue.\",\n  // Task 10/13/14\n  AGENT_YAML_NOT_FOUND:\n    \"Deploy the worker via `m8t deploy <name>` or the architect first.\",\n  // Task 16 — brain link command\n  APP_HEALTH_FAILED:\n    \"Run `m8t brain check-app` for details, then re-run this command.\",\n  // Task 14 — brain-unlink\n  APP_UNINSTALL_FAILED:\n    \"GitHub App-uninstall DELETE failed. Re-run with `--keep-app-install` if you want to skip this step.\",\n  // Task 13 — brain-link\n  ARM_AUTH: \"Run `az login` and retry.\",\n  // F2 smoke fix — m8t brain create: stageAsGitRepo step\n  BRAIN_GIT_INIT_FAILED:\n    \"If git is not installed, install it. Otherwise re-run with --verbose.\",\n  // Task 14 — brain-unlink\n  BRAIN_NOT_LINKED:\n    \"The worker has no brain link. Use `m8t brain link` or `m8t brain create` first.\",\n  // Task 13 — brain-link\n  BRAIN_YAML_MIRROR_FAILED:\n    \"GitHub Contents API PUT failed. Verify the App has `contents: write` permission on the repo.\",\n  // Task 13 — brain-link\n  CONN_CREATE_FAILED:\n    \"Foundry connection PUT failed. Verify Cognitive Services Contributor role on the project.\",\n  // Task 14 — brain-unlink\n  CONN_DELETE_FAILED:\n    \"Foundry connection DELETE failed. Verify your ARM subscription has Contributor on the project.\",\n  // Task 13 — brain-link\n  CONN_GET_FAILED:\n    \"Foundry connection GET failed. Verify your ARM subscription has access to the project.\",\n  // Task 13 — brain-link.ts (rename pending: should be FOUNDRY_AUTH_FAILED)\n  FOUNDRY_AUTH: \"Run `az login` and retry.\",\n  // Task 12 — foundry-agent-get\n  FOUNDRY_AUTH_FAILED: \"Run `az login` and retry.\",\n  // Task 15+16\n  KV_URI_NOT_FOUND:\n    \"Pass `--kv-uri` or set `AZURE_KEYVAULT_URI` / `KEYVAULT_URI`.\",\n  // Task 13 — brain-link\n  LINK_NO_INSTALLATION_ID:\n    \"Internal error — the CLI command must poll for the installation id before calling linkBrain. Report at https://github.com/m8t-stack/m8t-stack-poc/issues.\",\n  // Task 16 — brain link command\n  M8T_REPO_ROOT_MISSING:\n    \"Re-run `m8t install` from a fresh m8t-stack checkout — the post-install hook writes ~/.m8t-stack/repo-root.\",\n  // Task 14 — persona-render\n  PERSONA_PATH_NOT_ABSOLUTE:\n    \"The persona path in ~/.m8t-stack/foundry/<worker>.yaml must be absolute. Re-deploy the worker via the architect.\",\n  // Task 9 — persona-render\n  PERSONA_PLACEHOLDER_UNSATISFIED:\n    \"Re-deploy the worker via the architect to repopulate fillableFieldValues, OR edit ~/.m8t-stack/foundry/<worker>.yaml manually.\",\n  // Task 9 — persona-render\n  PERSONA_READ_FAILED:\n    \"Verify the persona path in ~/.m8t-stack/foundry/<worker>.yaml; the architect should have populated it at deploy time.\",\n\n  // ── pre-existing entries ──────────────────────────────────────────────────\n  AUTH_NOT_SIGNED_IN: \"you are not signed in to Azure — run 'az login' first.\",\n  AUTH_EXPIRED: \"your Azure login expired — run 'az login' to re-authenticate.\",\n  AUTH_WRONG_TENANT:\n    \"your active Azure session may be in a different tenant — run 'az login --tenant <id>'.\",\n  AUTH_NULL_TOKEN: \"no token was returned from Azure — run 'az login' and try again.\",\n  AUTH_FAILED: \"Azure token acquisition failed — re-run after 'az login'.\",\n  AZ_NOT_INSTALLED:\n    \"install the Azure CLI: https://learn.microsoft.com/cli/azure/install-azure-cli\",\n  AZ_COMMAND_FAILED: \"an 'az' command failed — re-run with the same args to see Azure's error.\",\n  AZ_OUTPUT_INVALID: \"the Azure CLI returned unexpected output — try 'az account show' to verify.\",\n  GATEWAY_DISCOVERY_ZERO:\n    \"the deployment may be in a different subscription — try 'az account set --subscription <other>'.\",\n  GATEWAY_DISCOVERY_MULTIPLE:\n    \"pass --subscription <id> to pick one, or run interactively from a TTY for the picker.\",\n  GATEWAY_DISCOVERY_SELECTION_FAILED: \"no deployment was selected — re-run and pick one.\",\n  GATEWAY_DISCOVERY_ARM_FAILED:\n    \"verify you have Reader access to the subscription and 'az account show' is correct.\",\n  GATEWAY_DISCOVERY_NO_SUBSCRIPTION:\n    \"set an active subscription with 'az account set --subscription <name>'.\",\n  GATEWAY_DISCOVERY_NO_FQDN:\n    \"the Container App is missing an external ingress FQDN — check the deployment.\",\n  GATEWAY_DISCOVERY_MISSING_ENV:\n    \"the Container App is missing AZURE_CLIENT_ID or AZURE_TENANT_ID env vars — check the deployment.\",\n  NETWORK_FAILED:\n    \"verify the gateway is deployed and reachable. 'm8t config reset' to re-discover.\",\n  BAD_RESPONSE: \"this may be a gateway version mismatch — run with --verbose for details.\",\n  USAGE: \"see 'm8t <command> --help' for details.\",\n};\n\nexport function resolveBackendHint(envelope: ApiErrorEnvelope): string | undefined {\n  const reason = getDetailField(envelope, \"reason\");\n  for (const rule of BACKEND_RULES) {\n    if (rule.code !== envelope.code) continue;\n    if (rule.reason !== undefined && rule.reason !== reason) continue;\n    return rule.hint(envelope);\n  }\n  return undefined;\n}\n\nexport function resolveLocalHint(code: string): string | undefined {\n  return LOCAL_RULES[code];\n}\n","import pc from \"picocolors\";\n\nexport type OutputMode = \"pretty\" | \"json\" | \"auto\";\nexport type ResolvedOutputMode = \"pretty\" | \"json\";\n\nexport type Column<T> = {\n  key: keyof T & string;\n  label: string;\n  format?: (value: T[keyof T & string], row: T) => string;\n};\n\n/**\n * Resolve a user-facing output mode. `auto` checks whether stdout is a TTY:\n * TTY → pretty, pipe/redirect → json. Mirrors gh, kubectl, az.\n */\nexport function resolveOutputMode(\n  flag: OutputMode | undefined,\n  stream: NodeJS.WriteStream = process.stdout,\n): ResolvedOutputMode {\n  if (flag === \"pretty\") return \"pretty\";\n  if (flag === \"json\") return \"json\";\n  return stream.isTTY ? \"pretty\" : \"json\";\n}\n\n/**\n * Render an array of records as a padded table. Single-line cells only —\n * multi-line values get joined with spaces.\n */\nexport function renderTable<T extends Record<string, unknown>>(\n  rows: T[],\n  columns: Column<T>[],\n): string {\n  if (rows.length === 0) return \"(no rows)\";\n\n  const headers = columns.map((c) => c.label);\n  const dataRows = rows.map((row) =>\n    columns.map((c) => {\n      const v = row[c.key];\n      if (c.format) return c.format(v as never, row);\n      if (v === undefined || v === null || v === \"\") return \"-\";\n      return String(v).replace(/\\s+/g, \" \");\n    }),\n  );\n\n  const widths = columns.map((_, i) => {\n    const headerWidth = headers[i].length;\n    const maxData = dataRows.reduce((m, r) => Math.max(m, r[i].length), 0);\n    return Math.max(headerWidth, maxData);\n  });\n\n  const headerLine = headers.map((h, i) => h.padEnd(widths[i])).join(\"  \");\n  const dataLines = dataRows.map((r) =>\n    r.map((cell, i) => cell.padEnd(widths[i])).join(\"  \").trimEnd(),\n  );\n\n  return [headerLine.trimEnd(), ...dataLines].join(\"\\n\");\n}\n\n/**\n * Render a single object as an aligned key-value block.\n */\nexport function renderKeyValueBlock(\n  rows: Array<{ key: string; value: string | undefined }>,\n): string {\n  if (rows.length === 0) return \"\";\n  const keyWidth = rows.reduce((m, r) => Math.max(m, r.key.length), 0);\n  return rows\n    .map((r) => `${r.key.padEnd(keyWidth)}:  ${r.value ?? \"-\"}`)\n    .join(\"\\n\");\n}\n\nexport function renderJson(data: unknown): string {\n  return JSON.stringify(data, null, 2);\n}\n\n/**\n * Color helpers — picocolors auto-strips on non-TTY and honors NO_COLOR.\n */\nexport const colors = {\n  error: (s: string) => pc.red(pc.bold(s)),\n  hint: (s: string) => pc.dim(s),\n  success: (s: string) => pc.green(s),\n  field: (s: string) => pc.bold(s),\n  dim: (s: string) => pc.dim(s),\n};\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type {\n  CreateBindingRequest,\n  CreateBindingResponse,\n} from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  colors,\n  renderJson,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class BindAddCommand extends M8tCommand {\n  static paths = [[\"bind\", \"add\"]];\n  static usage = Command.Usage({\n    description: \"Create a channel→worker binding with bot token storage.\",\n    details:\n      \"Stores the bot token in Key Vault and writes a Bindings table row. Returns the webhook URL the channel platform should call. F4-alone smoke fails with 'no_adapter_registered' until F6 (Telegram adapter) ships.\",\n    examples: [\n      [\n        \"Add a Telegram binding for the cmo worker\",\n        '$0 bind add telegram --worker cmo --bot-token <from-botfather> --slug cmo-tg --bot-username \"@startup_cmo_bot\"',\n      ],\n    ],\n  });\n\n  channel = Option.String();\n  worker = Option.String(\"--worker\");\n  botToken = Option.String(\"--bot-token\");\n  slug = Option.String(\"--slug\");\n  botUsername = Option.String(\"--bot-username\");\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    if (!this.worker) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"--worker is required.\",\n        hint: \"Example: m8t bind add telegram --worker cmo --bot-token <token> --slug cmo-tg\",\n      });\n    }\n    if (!this.botToken) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"--bot-token is required.\",\n        hint: \"Example: m8t bind add telegram --worker cmo --bot-token <token> --slug cmo-tg\",\n      });\n    }\n    if (!this.slug) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"--slug is required.\",\n        hint: \"The slug is the binding's stable id (e.g. cmo-tg). Lowercase letters, digits, hyphens only.\",\n      });\n    }\n\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n\n    const body: CreateBindingRequest = {\n      channel: this.channel as CreateBindingRequest[\"channel\"],\n      bindingId: this.slug,\n      agentName: this.worker,\n      botToken: this.botToken,\n      ...(this.botUsername ? { botUsername: this.botUsername } : {}),\n    };\n\n    const data = await apiCall<CreateBindingResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"POST\", path: \"/api/bindings\", body },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(data) + \"\\n\");\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} created binding ${colors.field(data.binding.bindingId)} (${data.binding.channel} → ${data.binding.agentName}).\\n`,\n    );\n    this.context.stdout.write(`  webhook URL: ${data.webhookUrl}\\n`);\n    this.context.stdout.write(\n      `  ${colors.hint(\"next step:\")} register this URL with the channel platform via the channel-specific adapter (see docs/channels/${data.binding.channel}.md when shipped).\\n`,\n    );\n    return 0;\n  }\n}\n","import { Command } from \"clipanion\";\nimport { renderError } from \"./render-error.js\";\nimport type { OutputMode } from \"./output.js\";\n\n/**\n * Base class for all m8t CLI commands.\n *\n * Wraps the subclass's `executeCommand()` in try/catch + `renderError()` so\n * any thrown error (LocalCliError, ApiCallError, ExitPromptError, raw Error)\n * is rendered through our friendly hint table + the right exit code is\n * returned — instead of bubbling out to clipanion's default error handler\n * which writes a raw stack trace to stderr (intercepting it BEFORE our\n * cli.ts top-level catch can run).\n *\n * Subclasses implement `executeCommand()` instead of `execute()`. The base\n * class's `execute()` is final-by-convention (do not override).\n *\n * The `verbose` + `output` flags are read from process.argv (not from the\n * command's own `Option.String(\"--verbose\")` / `Option.String(\"--output\")`)\n * to handle the case where the command class doesn't declare those flags\n * but the user still passed them (e.g., `m8t version --verbose`). Both\n * flags are widely-applicable so this fallback is acceptable.\n */\nexport abstract class M8tCommand extends Command {\n  abstract executeCommand(): Promise<number>;\n\n  async execute(): Promise<number> {\n    try {\n      return await this.executeCommand();\n    } catch (e) {\n      const verbose = process.argv.includes(\"--verbose\");\n      const outputIdx = process.argv.indexOf(\"--output\");\n      const output: OutputMode | undefined =\n        outputIdx >= 0 && outputIdx + 1 < process.argv.length\n          ? (process.argv[outputIdx + 1] as OutputMode)\n          : undefined;\n      return renderError(e, {\n        stderr: this.context.stderr as NodeJS.WriteStream,\n        verbose,\n        output,\n      });\n    }\n  }\n}\n","import { isApiResponse, type ApiResponse } from \"@m8t-stack/api-contract\";\nimport { ApiCallError, LocalCliError } from \"./errors.js\";\nimport { getBearerToken } from \"./auth.js\";\n\nexport type ApiClientOptions = {\n  gatewayUrl: string;\n  gatewayClientId: string;\n};\n\nexport type ApiRequest = {\n  method: \"GET\" | \"POST\" | \"PATCH\" | \"DELETE\";\n  path: string;\n  body?: unknown;\n};\n\nconst COLD_START_RETRY_DELAY_MS = 1000;\nconst COLD_START_RETRY_STATUS_CODES = new Set([502, 503, 504]);\n\nexport async function apiCall<T>(\n  opts: ApiClientOptions,\n  req: ApiRequest,\n  notify?: (msg: string) => void,\n): Promise<T> {\n  const token = await getBearerToken(opts.gatewayClientId);\n\n  const url = `${opts.gatewayUrl}${req.path}`;\n  const headers: Record<string, string> = {\n    authorization: `Bearer ${token}`,\n    accept: \"application/json\",\n  };\n  if (req.body !== undefined) headers[\"content-type\"] = \"application/json\";\n\n  const init: RequestInit = {\n    method: req.method,\n    headers,\n    body: req.body !== undefined ? JSON.stringify(req.body) : undefined,\n  };\n\n  let res: Response;\n  try {\n    res = await fetch(url, init);\n  } catch (e) {\n    throw new LocalCliError({\n      code: \"NETWORK_FAILED\",\n      message: `Could not reach gateway at ${opts.gatewayUrl}: ${(e as Error).message}`,\n      hint: \"Verify the gateway is deployed + reachable. 'm8t config reset' to re-discover.\",\n      cause: e,\n    });\n  }\n\n  if (COLD_START_RETRY_STATUS_CODES.has(res.status)) {\n    notify?.(\"(gateway is starting up...)\");\n    await new Promise((r) => setTimeout(r, COLD_START_RETRY_DELAY_MS));\n    try {\n      res = await fetch(url, init);\n    } catch (e) {\n      throw new LocalCliError({\n        code: \"NETWORK_FAILED\",\n        message: `Gateway unreachable after retry: ${(e as Error).message}`,\n        hint: \"Verify the gateway is deployed + reachable. 'm8t config reset' to re-discover.\",\n        cause: e,\n      });\n    }\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = await res.json();\n  } catch (e) {\n    throw new LocalCliError({\n      code: \"BAD_RESPONSE\",\n      message: `Gateway returned non-JSON (HTTP ${res.status}).`,\n      hint: \"Run with --verbose to see the raw response.\",\n      cause: e,\n    });\n  }\n\n  if (!isApiResponse(parsed)) {\n    throw new LocalCliError({\n      code: \"BAD_RESPONSE\",\n      message: `Gateway returned a response that doesn't match ApiResponse shape (HTTP ${res.status}).`,\n      hint: \"This may be a gateway version mismatch.\",\n    });\n  }\n  const envelope = parsed as ApiResponse<T>;\n\n  if (!envelope.ok) {\n    throw new ApiCallError(envelope.error, res.status);\n  }\n\n  return envelope.data;\n}\n","import { DefaultAzureCredential } from \"@azure/identity\";\nimport { LocalCliError } from \"./errors.js\";\nimport { runAz } from \"./az.js\";\n\nexport type AzAccountInfo = {\n  upn: string;\n  tenantId: string;\n  subscriptionId: string;\n  subscriptionName: string;\n  environmentName: string;\n};\n\nlet credentialSingleton: DefaultAzureCredential | null = null;\n\nfunction credential(): DefaultAzureCredential {\n  if (!credentialSingleton) {\n    credentialSingleton = new DefaultAzureCredential();\n  }\n  return credentialSingleton;\n}\n\n/**\n * Acquire a Bearer token for the m8t-stack gateway.\n *\n * Scope: `api://<gatewayClientId>/.default`. This requires the app\n * reg to have Expose-an-API configured (identifierUris populated +\n * a user_impersonation OAuth2 permission scope + Azure CLI's\n * first-party app in preAuthorizedApplications). `deploy/setup.mjs`\n * step 1 ensures this idempotently on each run.\n *\n * F3.5 resolution of F02's audience MVP debt. Pre-F3.5 the CLI\n * used `https://ai.azure.com/.default` (Foundry audience) because\n * Entra rejected clientId-scoped tokens without Expose-an-API\n * configured. The proxy accepts BOTH this clientId audience and\n * the Foundry audience (for backwards-compat with the webapp's\n * MSAL.js flow) — F02's dual-audience model is preserved.\n *\n * Reference: vault note\n * 2026-05-17-auth-audience-mvp-deferred-hardening.md (marked\n * resolved in F3.5).\n */\nexport async function getBearerToken(gatewayClientId: string): Promise<string> {\n  try {\n    const token = await credential().getToken(`api://${gatewayClientId}/.default`);\n    if (!token) {\n      throw new LocalCliError({\n        code: \"AUTH_NULL_TOKEN\",\n        message: \"Azure returned no token despite no error being raised.\",\n      });\n    }\n    return token.token;\n  } catch (e) {\n    if (e instanceof LocalCliError) throw e;\n    throw translateAzureIdentityError(e);\n  }\n}\n\n/** Acquire a data-plane token for the Foundry project API (audience ai.azure.com). */\nexport async function getFoundryToken(): Promise<string> {\n  const token = await credential().getToken(\"https://ai.azure.com/.default\");\n  if (!token) {\n    throw new LocalCliError({ code: \"AUTH_NULL_TOKEN\", message: \"Azure returned no token.\" });\n  }\n  return token.token;\n}\n\n/**\n * Shell out to `az account show --output json` to fetch the active\n * subscription's identity info. Used by `m8t whoami` (and by discovery\n * for the active subscription ID).\n *\n * Per F01 gotcha 14.3: use `az account show` (no leading double-dash) —\n * `az --account` is not a thing, and `az --version` ignores `--output json`.\n */\nexport async function getAzAccount(): Promise<AzAccountInfo> {\n  const json = await runAz([\"account\", \"show\", \"--output\", \"json\"]);\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(json) as Record<string, unknown>;\n  } catch (e) {\n    throw new LocalCliError({\n      code: \"AZ_OUTPUT_INVALID\",\n      message: `Failed to parse 'az account show' output: ${(e as Error).message}`,\n      hint: \"Try 'az account show --output json' manually to investigate.\",\n    });\n  }\n\n  const user = parsed.user as Record<string, unknown> | undefined;\n  return {\n    upn: typeof user?.name === \"string\" ? user.name : \"\",\n    tenantId: typeof parsed.tenantId === \"string\" ? parsed.tenantId : \"\",\n    subscriptionId: typeof parsed.id === \"string\" ? parsed.id : \"\",\n    subscriptionName: typeof parsed.name === \"string\" ? parsed.name : \"\",\n    environmentName: typeof parsed.environmentName === \"string\" ? parsed.environmentName : \"\",\n  };\n}\n\n/**\n * The signed-in principal's object id (oid), decoded from an ARM access\n * token. `az ad signed-in-user show` fails for personal MS accounts, so we\n * read the oid claim directly (no verification needed — it's our own token).\n */\nexport async function getCallerObjectId(): Promise<string> {\n  const token = await credential().getToken(\"https://management.azure.com/.default\");\n  if (!token) {\n    throw new LocalCliError({ code: \"AUTH_NULL_TOKEN\", message: \"Azure returned no token.\" });\n  }\n  const payload = token.token.split(\".\")[1] ?? \"\";\n  const json = Buffer.from(payload + \"=\".repeat((4 - (payload.length % 4)) % 4), \"base64\").toString(\"utf8\");\n  const oid = (JSON.parse(json) as { oid?: string }).oid;\n  if (!oid) {\n    throw new LocalCliError({\n      code: \"AUTH_NO_OID\",\n      message: \"Could not determine your object id from the Azure token.\",\n      hint: \"Run 'az login' and retry.\",\n    });\n  }\n  return oid;\n}\n\nfunction translateAzureIdentityError(e: unknown): LocalCliError {\n  const name = e instanceof Error ? e.name : \"\";\n  const message = e instanceof Error ? e.message : String(e);\n  if (name === \"CredentialUnavailableError\" || /credentialunavailable/i.test(message)) {\n    return new LocalCliError({\n      code: \"AUTH_NOT_SIGNED_IN\",\n      message: \"You are not signed in to Azure.\",\n      hint: \"Run 'az login' to sign in.\",\n      cause: e,\n    });\n  }\n  if (name === \"AuthenticationRequiredError\" || /interactive_required|invalid_grant/i.test(message)) {\n    return new LocalCliError({\n      code: \"AUTH_EXPIRED\",\n      message: \"Your Azure login has expired or requires re-authentication.\",\n      hint: \"Run 'az login' to re-authenticate.\",\n      cause: e,\n    });\n  }\n  if (/aadsts50059|tenant/i.test(message)) {\n    return new LocalCliError({\n      code: \"AUTH_WRONG_TENANT\",\n      message: `Your active Azure session may be in a different tenant: ${message}`,\n      hint: \"Run 'az login --tenant <gateway-tenant-id>' to switch.\",\n      cause: e,\n    });\n  }\n  return new LocalCliError({\n    code: \"AUTH_FAILED\",\n    message: `Azure token acquisition failed: ${message}`,\n    cause: e,\n  });\n}\n","import { spawn } from \"node:child_process\";\nimport { LocalCliError } from \"./errors.js\";\n\n/** Run an `az` CLI command, resolving stdout. Throws LocalCliError on failure. */\nexport function runAz(args: string[]): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const proc = spawn(\"az\", args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    const out: Buffer[] = [];\n    const err: Buffer[] = [];\n    proc.stdout.on(\"data\", (d: Buffer) => out.push(d));\n    proc.stderr.on(\"data\", (d: Buffer) => err.push(d));\n    proc.on(\"error\", (e) => {\n      if ((e as NodeJS.ErrnoException).code === \"ENOENT\") {\n        reject(\n          new LocalCliError({\n            code: \"AZ_NOT_INSTALLED\",\n            message: \"The 'az' command is not installed or not on PATH.\",\n            hint: \"Install Azure CLI: https://learn.microsoft.com/cli/azure/install-azure-cli\",\n          }),\n        );\n        return;\n      }\n      reject(e);\n    });\n    proc.on(\"close\", (code) => {\n      const errString = Buffer.concat(err).toString(\"utf8\");\n      if (code !== 0) {\n        if (/please run.*az login/i.test(errString) || /not logged in/i.test(errString)) {\n          reject(\n            new LocalCliError({\n              code: \"AUTH_NOT_SIGNED_IN\",\n              message: \"You are not signed in to Azure.\",\n              hint: \"Run 'az login' to sign in.\",\n            }),\n          );\n          return;\n        }\n        reject(\n          new LocalCliError({\n            code: \"AZ_COMMAND_FAILED\",\n            message: `'az ${args.join(\" \")}' failed: ${errString.trim()}`,\n          }),\n        );\n        return;\n      }\n      resolve(Buffer.concat(out).toString(\"utf8\"));\n    });\n  });\n}\n","import * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\n\nexport type CliConfig = {\n  gatewayUrl: string;\n  gatewayClientId: string;\n  gatewayTenantId: string;\n  subscriptionId: string;\n  containerAppResourceId: string;\n  cachedAt: string;\n};\n\nfunction configDir(): string {\n  const home = process.env.HOME ?? process.env.USERPROFILE ?? \"\";\n  return path.join(home, \".m8t-stack\");\n}\n\nexport function getConfigPath(): string {\n  return path.join(configDir(), \"cli-config.yaml\");\n}\n\nexport async function readConfig(): Promise<CliConfig | null> {\n  const configPath = getConfigPath();\n  try {\n    const raw = await fs.readFile(configPath, \"utf8\");\n    let parsed: Partial<CliConfig> | null;\n    try {\n      parsed = parseYaml(raw) as Partial<CliConfig> | null;\n    } catch {\n      return null;\n    }\n    if (!parsed || typeof parsed !== \"object\") return null;\n    if (\n      typeof parsed.gatewayUrl !== \"string\" ||\n      typeof parsed.gatewayClientId !== \"string\" ||\n      typeof parsed.gatewayTenantId !== \"string\" ||\n      typeof parsed.subscriptionId !== \"string\" ||\n      typeof parsed.containerAppResourceId !== \"string\" ||\n      typeof parsed.cachedAt !== \"string\"\n    ) {\n      return null;\n    }\n    return parsed as CliConfig;\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw e;\n  }\n}\n\nexport async function writeConfig(cfg: CliConfig): Promise<void> {\n  const dir = configDir();\n  const configPath = getConfigPath();\n  await fs.mkdir(dir, { recursive: true });\n  const yaml = stringifyYaml(cfg, { indent: 2 });\n  const tmp = `${configPath}.tmp`;\n  await fs.writeFile(tmp, yaml, \"utf8\");\n  await fs.rename(tmp, configPath);\n}\n\nexport async function resetConfig(): Promise<boolean> {\n  const configPath = getConfigPath();\n  try {\n    await fs.unlink(configPath);\n    return true;\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw e;\n  }\n}\n","import { ContainerAppsAPIClient } from \"@azure/arm-appcontainers\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { select } from \"@inquirer/prompts\";\nimport { LocalCliError } from \"./errors.js\";\nimport { getAzAccount } from \"./auth.js\";\n\nexport type DiscoveryResult = {\n  gatewayUrl: string;\n  gatewayClientId: string;\n  gatewayTenantId: string;\n  subscriptionId: string;\n  containerAppResourceId: string;\n  /** From the gateway's FOUNDRY_PROJECT_ENDPOINT env. Absent on pre-F2 deploys. */\n  projectEndpoint?: string;\n};\n\ntype CandidateContainerApp = {\n  resourceId: string;\n  name: string;\n  resourceGroup: string;\n  location: string;\n  fqdn?: string;\n  envVars: Map<string, string>;\n};\n\n/**\n * Find the m8t-stack gateway in Azure and return everything we need to\n * authenticate against it.\n */\nexport async function discoverGateway(opts: {\n  subscriptionId?: string;\n  interactive: boolean;\n}): Promise<DiscoveryResult> {\n  const subscriptionId = opts.subscriptionId ?? (await getAzAccount()).subscriptionId;\n  if (!subscriptionId) {\n    throw new LocalCliError({\n      code: \"GATEWAY_DISCOVERY_NO_SUBSCRIPTION\",\n      message: \"Could not determine an active Azure subscription.\",\n      hint: \"Run 'az account set --subscription <name-or-id>' or pass --subscription.\",\n    });\n  }\n\n  const client = new ContainerAppsAPIClient(new DefaultAzureCredential(), subscriptionId);\n\n  const candidates: CandidateContainerApp[] = [];\n  try {\n    for await (const app of client.containerApps.listBySubscription()) {\n      if ((app.tags ?? {})[\"m8t-stack\"] !== \"gateway\") continue;\n      const fqdn = app.configuration?.ingress?.fqdn;\n      const envs = app.template?.containers?.[0]?.env ?? [];\n      const envMap = new Map<string, string>();\n      for (const e of envs) {\n        if (e.name && typeof e.value === \"string\") {\n          envMap.set(e.name, e.value);\n        }\n      }\n      candidates.push({\n        resourceId: app.id ?? \"\",\n        name: app.name ?? \"\",\n        resourceGroup: (app.id ?? \"\").split(\"/resourceGroups/\")[1]?.split(\"/\")[0] ?? \"\",\n        location: app.location ?? \"\",\n        fqdn,\n        envVars: envMap,\n      });\n    }\n  } catch (e) {\n    throw new LocalCliError({\n      code: \"GATEWAY_DISCOVERY_ARM_FAILED\",\n      message: `Failed to query Container Apps in subscription ${subscriptionId}: ${(e as Error).message}`,\n      hint: \"Verify 'az account show' shows the right subscription and you have Reader access to it.\",\n      cause: e,\n    });\n  }\n\n  if (candidates.length === 0) {\n    throw new LocalCliError({\n      code: \"GATEWAY_DISCOVERY_ZERO\",\n      message: `No m8t-stack deployment found in subscription ${subscriptionId}.`,\n      hint: \"If the deployment is in another subscription, run 'az account set --subscription <name>'.\",\n    });\n  }\n\n  let chosen: CandidateContainerApp;\n  if (candidates.length === 1) {\n    chosen = candidates[0];\n  } else if (opts.interactive) {\n    const resourceId = await select({\n      message: `Multiple m8t-stack deployments found in subscription ${subscriptionId}. Choose one:`,\n      choices: candidates.map((c) => ({\n        name: `${c.name}  (rg=${c.resourceGroup}, ${c.location})`,\n        value: c.resourceId,\n      })),\n    });\n    const found = candidates.find((c) => c.resourceId === resourceId);\n    if (!found) {\n      throw new LocalCliError({\n        code: \"GATEWAY_DISCOVERY_SELECTION_FAILED\",\n        message: \"No deployment selected.\",\n      });\n    }\n    chosen = found;\n  } else {\n    throw new LocalCliError({\n      code: \"GATEWAY_DISCOVERY_MULTIPLE\",\n      message: `Multiple m8t-stack deployments found in subscription ${subscriptionId}: ${candidates.map((c) => c.name).join(\", \")}.`,\n      hint: \"Run an interactive command first (e.g. `m8t whoami`), or specify --subscription.\",\n    });\n  }\n\n  const fqdn = chosen.fqdn;\n  if (!fqdn) {\n    throw new LocalCliError({\n      code: \"GATEWAY_DISCOVERY_NO_FQDN\",\n      message: `Container App '${chosen.name}' has no ingress FQDN.`,\n      hint: \"Verify the deployment's ingress is configured (external=true).\",\n    });\n  }\n\n  const gatewayClientId = chosen.envVars.get(\"AZURE_CLIENT_ID\");\n  const gatewayTenantId = chosen.envVars.get(\"AZURE_TENANT_ID\");\n  if (!gatewayClientId || !gatewayTenantId) {\n    throw new LocalCliError({\n      code: \"GATEWAY_DISCOVERY_MISSING_ENV\",\n      message: `Container App '${chosen.name}' is missing AZURE_CLIENT_ID or AZURE_TENANT_ID env vars.`,\n      hint: \"Verify the deployment via 'az containerapp show -n <name> -g <rg> --query properties.template.containers[0].env'. Note: env vars set via secretRef are not supported by auto-discovery — set them as direct values.\",\n    });\n  }\n\n  const projectEndpoint = chosen.envVars.get(\"FOUNDRY_PROJECT_ENDPOINT\");\n\n  return {\n    gatewayUrl: `https://${fqdn}`,\n    gatewayClientId,\n    gatewayTenantId,\n    subscriptionId,\n    containerAppResourceId: chosen.resourceId,\n    projectEndpoint,\n  };\n}\n","import { readConfig, writeConfig, type CliConfig } from \"./config.js\";\nimport { discoverGateway } from \"./discovery.js\";\n\nexport type GatewayContext = {\n  gatewayUrl: string;\n  gatewayClientId: string;\n  gatewayTenantId: string;\n  subscriptionId: string;\n  containerAppResourceId: string;\n  /** Was this resolved from cache or freshly discovered? */\n  fromCache: boolean;\n};\n\n/**\n * Resolve the gateway context: prefer cached config; fall back to ARM\n * discovery. On discovery, writes the result to\n * ~/.m8t-stack/cli-config.yaml.\n *\n * If `subscriptionId` is provided AND differs from the cached\n * subscriptionId, the cache is skipped and discovery runs against the\n * requested subscription (F3.5 — Item #1). The same flag is forwarded\n * to discoverGateway so `m8t <cmd> --subscription <other>` works even\n * with no cache present.\n */\nexport async function resolveGatewayContext(opts: {\n  interactive: boolean;\n  subscriptionId?: string;\n  forceRediscover?: boolean;\n}): Promise<GatewayContext> {\n  const cached = opts.forceRediscover ? null : await readConfig();\n  const cacheMatches =\n    cached !== null &&\n    (opts.subscriptionId === undefined ||\n      cached.subscriptionId === opts.subscriptionId);\n\n  if (cacheMatches && cached) {\n    return {\n      gatewayUrl: cached.gatewayUrl,\n      gatewayClientId: cached.gatewayClientId,\n      gatewayTenantId: cached.gatewayTenantId,\n      subscriptionId: cached.subscriptionId,\n      containerAppResourceId: cached.containerAppResourceId,\n      fromCache: true,\n    };\n  }\n\n  const fresh = await discoverGateway({\n    interactive: opts.interactive,\n    subscriptionId: opts.subscriptionId,\n  });\n  const toCache: CliConfig = {\n    gatewayUrl: fresh.gatewayUrl,\n    gatewayClientId: fresh.gatewayClientId,\n    gatewayTenantId: fresh.gatewayTenantId,\n    subscriptionId: fresh.subscriptionId,\n    containerAppResourceId: fresh.containerAppResourceId,\n    cachedAt: new Date().toISOString(),\n  };\n  await writeConfig(toCache);\n  return { ...fresh, fromCache: false };\n}\n","import { confirm } from \"@inquirer/prompts\";\nimport { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type {\n  CleanupOrphanedResponse,\n  DeleteBindingResponse,\n  GetBindingResponse,\n  ListBindingsResponse,\n} from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  colors,\n  renderJson,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class BindCleanupCommand extends M8tCommand {\n  static paths = [[\"bind\", \"cleanup\"]];\n  static usage = Command.Usage({\n    description: \"Remove orphaned binding(s) — janitor counterpart to 'bind remove'.\",\n    details:\n      \"Refuses to clean up active bindings (use 'bind remove' instead). With --all-orphaned, bulk-cleans every orphaned binding; per-binding partial failures are collected and reported, not aborted.\",\n    examples: [\n      [\"Cleanup one orphaned binding\", \"$0 bind cleanup cpo-tg\"],\n      [\"Cleanup all orphaned bindings\", \"$0 bind cleanup --all-orphaned\"],\n      [\"Skip confirms in scripts\", \"$0 bind cleanup --all-orphaned --yes\"],\n    ],\n  });\n\n  bindingId = Option.String({ required: false });\n  allOrphaned = Option.Boolean(\"--all-orphaned\", false);\n  yes = Option.Boolean(\"--yes\", false);\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    if (this.bindingId && this.allOrphaned) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message:\n          \"specify EITHER a binding id OR --all-orphaned, not both.\",\n        hint: \"Run 'm8t bind cleanup cpo-tg' to clean one, or 'm8t bind cleanup --all-orphaned' for bulk.\",\n      });\n    }\n    if (!this.bindingId && !this.allOrphaned) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"specify a binding id or pass --all-orphaned.\",\n        hint: \"Run 'm8t bind cleanup --help' for examples.\",\n      });\n    }\n\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n\n    if (this.allOrphaned) {\n      return await this.runBulkCleanup(ctx, mode, interactive);\n    }\n    return await this.runSingleCleanup(ctx, mode, interactive, this.bindingId!);\n  }\n\n  private async runSingleCleanup(\n    ctx: { gatewayUrl: string; gatewayClientId: string },\n    mode: \"pretty\" | \"json\",\n    interactive: boolean,\n    bindingId: string,\n  ): Promise<number> {\n    // Pre-check: ensure status === orphaned before any destructive call.\n    const show = await apiCall<GetBindingResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"GET\", path: `/api/bindings/${encodeURIComponent(bindingId)}` },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (show.binding.status !== \"orphaned\") {\n      this.context.stderr.write(\n        colors.error(\"error:\") +\n          ` binding '${bindingId}' is active. Use 'm8t bind remove ${bindingId}' instead — cleanup is for orphaned bindings only.\\n`,\n      );\n      return 1;\n    }\n\n    if (!this.yes && interactive) {\n      const ok = await confirm({\n        message: `Cleanup orphaned binding '${bindingId}'? This deletes its KV secret and any conversation threads.`,\n        default: false,\n      });\n      if (!ok) {\n        this.context.stdout.write(\"cancelled — nothing removed.\\n\");\n        return 2;\n      }\n    }\n\n    const data = await apiCall<DeleteBindingResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"DELETE\", path: `/api/bindings/${encodeURIComponent(bindingId)}?cleanup=true` },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(data) + \"\\n\");\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} cleaned orphaned binding ${colors.field(data.deleted.bindingId)}.\\n`,\n    );\n    return 0;\n  }\n\n  private async runBulkCleanup(\n    ctx: { gatewayUrl: string; gatewayClientId: string },\n    mode: \"pretty\" | \"json\",\n    interactive: boolean,\n  ): Promise<number> {\n    // List orphans first for the prompt count.\n    const list = await apiCall<ListBindingsResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"GET\", path: \"/api/bindings?status=orphaned\" },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (list.bindings.length === 0) {\n      this.context.stdout.write(\"no orphaned bindings to clean up.\\n\");\n      return 0;\n    }\n\n    if (!this.yes && interactive) {\n      const ok = await confirm({\n        message: `${list.bindings.length} orphaned binding(s) found — clean up all of them?`,\n        default: false,\n      });\n      if (!ok) {\n        this.context.stdout.write(\"cancelled — nothing removed.\\n\");\n        return 2;\n      }\n    }\n\n    const data = await apiCall<CleanupOrphanedResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"POST\", path: \"/api/bindings/cleanup-orphaned\", body: {} },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(data) + \"\\n\");\n      return data.failed.length > 0 ? 1 : 0;\n    }\n\n    if (data.failed.length === 0) {\n      this.context.stdout.write(\n        `${colors.success(\"✓\")} cleaned ${data.cleaned.length} binding(s). 0 failed.\\n`,\n      );\n      return 0;\n    }\n\n    // Mixed or all-failed — render per-binding failures inline.\n    this.context.stderr.write(\n      colors.error(\"⚠\") +\n        ` cleaned ${data.cleaned.length} binding(s); ${data.failed.length} failed:\\n`,\n    );\n    for (const fail of data.failed) {\n      this.context.stderr.write(`  - ${fail.bindingId} (${fail.channel}): ${fail.originalMessage}\\n`);\n    }\n    this.context.stderr.write(\n      colors.hint(\"  hint:\") +\n        \" re-run 'm8t bind cleanup --all-orphaned' to retry failed ones; each cascade is idempotent.\\n\",\n    );\n    return 1;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type { ListBindingsResponse } from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  colors,\n  renderJson,\n  renderTable,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class BindListCommand extends M8tCommand {\n  static paths = [[\"bind\", \"list\"]];\n  static usage = Command.Usage({\n    description: \"List channel→worker bindings.\",\n    details:\n      \"Lists every binding sorted by channel + bindingId. Orphaned bindings are highlighted; the footer shows the orphan count when > 0.\",\n    examples: [\n      [\"Pretty table\", \"$0 bind list\"],\n      [\"Filter by channel\", \"$0 bind list --channel telegram\"],\n      [\"Filter by status\", \"$0 bind list --status orphaned\"],\n      [\"Machine-readable JSON\", \"$0 bind list --output json\"],\n    ],\n  });\n\n  channel = Option.String(\"--channel\");\n  status = Option.String(\"--status\");\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n\n    const qs = new URLSearchParams();\n    if (this.channel) qs.set(\"channel\", this.channel);\n    if (this.status) qs.set(\"status\", this.status);\n    const path = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : \"/api/bindings\";\n\n    const data = await apiCall<ListBindingsResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"GET\", path },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(data) + \"\\n\");\n      return 0;\n    }\n\n    if (data.bindings.length === 0) {\n      this.context.stdout.write(\n        \"no bindings yet — try 'm8t bind add telegram --worker <agent> --slug <id> --bot-token <token>'.\\n\",\n      );\n      return 0;\n    }\n\n    type Row = {\n      bindingId: string;\n      channel: string;\n      worker: string;\n      status: string;\n      botUsername: string;\n      created: string;\n      createdBy: string;\n    };\n\n    const rows: Row[] = data.bindings.map((b) => ({\n      bindingId: b.bindingId,\n      channel: b.channel,\n      worker: b.agentName,\n      status: b.status === \"orphaned\" ? colors.error(\"⚠ orphaned\") : b.status,\n      botUsername: b.botUsername ?? \"-\",\n      created: b.createdAt.slice(0, 10),\n      createdBy: b.createdBy,\n    }));\n\n    const table = renderTable<Row>(rows, [\n      { key: \"bindingId\", label: \"BINDING ID\" },\n      { key: \"channel\", label: \"CHANNEL\" },\n      { key: \"worker\", label: \"WORKER\" },\n      { key: \"status\", label: \"STATUS\" },\n      { key: \"botUsername\", label: \"BOT USERNAME\" },\n      { key: \"created\", label: \"CREATED\" },\n      { key: \"createdBy\", label: \"CREATED BY\" },\n    ]);\n    this.context.stdout.write(table + \"\\n\");\n\n    const orphanCount = data.bindings.filter((b) => b.status === \"orphaned\").length;\n    if (orphanCount > 0) {\n      this.context.stdout.write(\n        `\\n${data.bindings.length} binding(s); ${orphanCount} orphaned\\n`,\n      );\n    }\n\n    return 0;\n  }\n}\n","import { confirm } from \"@inquirer/prompts\";\nimport { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type {\n  CascadeFailureDetails,\n  DeleteBindingResponse,\n} from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { ApiCallError } from \"../../lib/errors.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  colors,\n  renderJson,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class BindRemoveCommand extends M8tCommand {\n  static paths = [[\"bind\", \"remove\"]];\n  static usage = Command.Usage({\n    description:\n      \"Remove a binding (cascade-delete: unregister webhook, delete KV secret, delete conversation threads, delete row).\",\n    details:\n      \"Works on bindings of any status (active or orphaned). For orphan-only cleanup, use 'm8t bind cleanup' instead.\",\n    examples: [\n      [\"Remove with confirm\", \"$0 bind remove cmo-tg\"],\n      [\"Remove non-interactively\", \"$0 bind remove cmo-tg --yes\"],\n    ],\n  });\n\n  bindingId = Option.String();\n  yes = Option.Boolean(\"--yes\", false);\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    if (!this.yes && interactive) {\n      const ok = await confirm({\n        message: `Remove binding '${this.bindingId}'? This unregisters its webhook and deletes all conversation threads.`,\n        default: false,\n      });\n      if (!ok) {\n        this.context.stdout.write(\"cancelled — nothing removed.\\n\");\n        return 2;\n      }\n    }\n\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n\n    try {\n      const data = await apiCall<DeleteBindingResponse>(\n        { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n        { method: \"DELETE\", path: `/api/bindings/${encodeURIComponent(this.bindingId)}` },\n        (msg) => this.context.stderr.write(msg + \"\\n\"),\n      );\n\n      if (mode === \"json\") {\n        this.context.stdout.write(renderJson(data) + \"\\n\");\n        return 0;\n      }\n\n      this.context.stdout.write(\n        `${colors.success(\"✓\")} removed binding ${colors.field(data.deleted.bindingId)} (channel: ${data.deleted.channel}). KV secret deleted; ${data.deleted.conversationsCleared} conversation thread(s) cleared.\\n`,\n      );\n      return 0;\n    } catch (e) {\n      // Inline rendering for cascade_partial_failure — needs structured details.partial.\n      // This reason is intentionally NOT in the hint table (Task 8) because it requires\n      // the structured details.partial shape rather than a simple string hint.\n      if (e instanceof ApiCallError) {\n        const details = (e.envelope.details as Record<string, unknown> | undefined) ?? {};\n        if (details.reason === \"cascade_partial_failure\" && mode !== \"json\") {\n          const partial = details.partial as CascadeFailureDetails | undefined;\n          if (partial) {\n            const completed = partial.completedSteps.join(\", \") || \"(none)\";\n            this.context.stderr.write(\n              colors.error(\"error:\") +\n                ` cascade partial failure for binding '${partial.bindingId}':\\n`,\n            );\n            this.context.stderr.write(`  completed: ${completed}\\n`);\n            this.context.stderr.write(\n              `  failed at: ${partial.failedStep} — ${partial.originalMessage}\\n`,\n            );\n            this.context.stderr.write(\n              colors.hint(\"  hint:\") +\n                ` re-run 'm8t bind remove ${partial.bindingId}' to retry; each step is idempotent.\\n`,\n            );\n            return 1;\n          }\n        }\n      }\n      throw e;\n    }\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type { GetBindingResponse } from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  renderJson,\n  renderKeyValueBlock,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class BindShowCommand extends M8tCommand {\n  static paths = [[\"bind\", \"show\"]];\n  static usage = Command.Usage({\n    description: \"Show details for one binding.\",\n    details:\n      \"Looks up a binding by its slug across channel partitions and renders every field. The plaintext bot token is NEVER returned — only the Key Vault URI (botTokenSecretRef).\",\n    examples: [[\"Pretty key-value block\", \"$0 bind show cmo-tg\"]],\n  });\n\n  bindingId = Option.String();\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n\n    const data = await apiCall<GetBindingResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"GET\", path: `/api/bindings/${encodeURIComponent(this.bindingId)}` },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(data) + \"\\n\");\n      return 0;\n    }\n\n    const { binding } = data;\n    this.context.stdout.write(\n      renderKeyValueBlock([\n        { key: \"binding id\", value: binding.bindingId },\n        { key: \"channel\", value: binding.channel },\n        { key: \"worker\", value: binding.agentName },\n        { key: \"bot username\", value: binding.botUsername },\n        { key: \"status\", value: binding.status },\n        { key: \"token (KV ref)\", value: binding.botTokenSecretRef },\n        { key: \"created\", value: binding.createdAt },\n        { key: \"created by\", value: binding.createdBy },\n      ]) + \"\\n\",\n    );\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { resetConfig } from \"../../lib/config.js\";\nimport { renderJson, resolveOutputMode } from \"../../lib/output.js\";\n\nexport class ConfigResetCommand extends M8tCommand {\n  static paths = [[\"config\", \"reset\"]];\n  static usage = Command.Usage({\n    description: \"Clear the cached gateway URL — re-discover on next command.\",\n  });\n\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const deleted = await resetConfig();\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson({ deleted }) + \"\\n\");\n      return 0;\n    }\n    if (deleted) {\n      this.context.stdout.write(\"config cleared.\\n\");\n    } else {\n      this.context.stdout.write(\"no config to clear.\\n\");\n    }\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport {\n  FOUNDRY_CONFIG_KEYS,\n  type FoundryConfigKey,\n  validateConfigValue,\n  writeFoundryConfig,\n} from \"../../lib/foundry-config.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { renderJson, resolveOutputMode } from \"../../lib/output.js\";\n\nexport class ConfigSetCommand extends M8tCommand {\n  static paths = [[\"config\", \"set\"]];\n  static usage = Command.Usage({\n    description: \"Set a value in ~/.m8t-stack/config.yaml (tenantId | clientId | projectEndpoint).\",\n  });\n\n  key = Option.String();\n  value = Option.String();\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n\n    if (!(FOUNDRY_CONFIG_KEYS as readonly string[]).includes(this.key)) {\n      throw new LocalCliError({\n        code: \"CONFIG_KEY_UNKNOWN\",\n        message: `Unknown config key '${this.key}'.`,\n        hint: `Valid keys: ${FOUNDRY_CONFIG_KEYS.join(\", \")}.`,\n      });\n    }\n    const key = this.key as FoundryConfigKey;\n    validateConfigValue(key, this.value);\n    await writeFoundryConfig({ [key]: this.value });\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson({ key, value: this.value, written: true }) + \"\\n\");\n      return 0;\n    }\n    this.context.stdout.write(`set ${key} → ${this.value}\\n`);\n    return 0;\n  }\n}\n","import * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { LocalCliError } from \"./errors.js\";\n\nexport const FOUNDRY_CONFIG_KEYS = [\"tenantId\", \"clientId\", \"projectEndpoint\"] as const;\nexport type FoundryConfigKey = (typeof FOUNDRY_CONFIG_KEYS)[number];\n\nexport type FoundryConfig = {\n  tenantId: string;\n  clientId: string;\n  projectEndpoint: string;\n  projectName: string;\n};\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nfunction configDir(): string {\n  const home = process.env.HOME ?? process.env.USERPROFILE ?? \"\";\n  return path.join(home, \".m8t-stack\");\n}\n\nexport function getFoundryConfigPath(): string {\n  return path.join(configDir(), \"config.yaml\");\n}\n\nexport function getSeedPath(): string {\n  return path.join(configDir(), \"foundry\", \"seed.yaml\");\n}\n\n/** Parse the trailing `/api/projects/<name>` segment. Throws on a bad URL. */\nexport function parseProjectName(endpoint: string): string {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw new LocalCliError({\n      code: \"CONFIG_ENDPOINT_INVALID\",\n      message: `projectEndpoint is not a valid URL: ${endpoint}`,\n      hint: \"Expected https://<account>.services.ai.azure.com/api/projects/<project>\",\n    });\n  }\n  const segs = url.pathname.split(\"/\").filter(Boolean);\n  const name = segs[segs.length - 1];\n  if (!name) {\n    throw new LocalCliError({\n      code: \"CONFIG_ENDPOINT_NO_PROJECT\",\n      message: `projectEndpoint has no project segment: ${endpoint}`,\n      hint: \"It should end with /api/projects/<project-name>.\",\n    });\n  }\n  return name;\n}\n\nexport function validateConfigValue(key: FoundryConfigKey, value: string): void {\n  if (key === \"projectEndpoint\") {\n    parseProjectName(value); // throws if invalid\n    return;\n  }\n  if (!UUID_RE.test(value)) {\n    throw new LocalCliError({\n      code: \"CONFIG_VALUE_INVALID\",\n      message: `${key} must be a UUID, got: ${value}`,\n    });\n  }\n}\n\nexport async function readFoundryConfig(): Promise<FoundryConfig | null> {\n  let raw: string;\n  try {\n    raw = await fs.readFile(getFoundryConfigPath(), \"utf8\");\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw e;\n  }\n  let parsed: unknown;\n  try {\n    parsed = parseYaml(raw);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\") return null;\n  const o = parsed as Record<string, unknown>;\n  if (\n    typeof o.tenantId !== \"string\" ||\n    typeof o.clientId !== \"string\" ||\n    typeof o.projectEndpoint !== \"string\" ||\n    o.tenantId.length === 0 ||\n    o.clientId.length === 0 ||\n    o.projectEndpoint.length === 0\n  ) {\n    return null;\n  }\n  let projectName: string;\n  try {\n    projectName = parseProjectName(o.projectEndpoint);\n  } catch {\n    return null;\n  }\n  return {\n    tenantId: o.tenantId,\n    clientId: o.clientId,\n    projectEndpoint: o.projectEndpoint.replace(/\\/$/, \"\"),\n    projectName,\n  };\n}\n\nexport async function readSeedEndpoint(): Promise<string | null> {\n  try {\n    const raw = await fs.readFile(getSeedPath(), \"utf8\");\n    const parsed = parseYaml(raw);\n    if (parsed && typeof parsed === \"object\") {\n      const ep = (parsed as Record<string, unknown>).projectEndpoint;\n      if (typeof ep === \"string\" && ep.length > 0) return ep.replace(/\\/$/, \"\");\n    }\n    return null;\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw e;\n  }\n}\n\nasync function atomicWrite(filePath: string, contents: string): Promise<void> {\n  const tmp = `${filePath}.tmp`;\n  await fs.writeFile(tmp, contents, \"utf8\");\n  await fs.rename(tmp, filePath);\n}\n\n/**\n * Merge `updates` into config.yaml (preserving any existing keys), then mirror\n * the resulting projectEndpoint into foundry/seed.yaml. Atomic writes.\n */\nexport async function writeFoundryConfig(\n  updates: Partial<Record<FoundryConfigKey, string>>,\n): Promise<void> {\n  await fs.mkdir(configDir(), { recursive: true });\n  let existing: Record<string, unknown> = {};\n  try {\n    const raw = await fs.readFile(getFoundryConfigPath(), \"utf8\");\n    const parsed = parseYaml(raw);\n    if (parsed && typeof parsed === \"object\") existing = parsed as Record<string, unknown>;\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n  }\n  const merged = { ...existing, ...updates };\n  await atomicWrite(getFoundryConfigPath(), stringifyYaml(merged, { indent: 2 }));\n\n  const endpoint = merged.projectEndpoint;\n  if (typeof endpoint === \"string\" && endpoint.length > 0) {\n    await fs.mkdir(path.dirname(getSeedPath()), { recursive: true });\n    await atomicWrite(getSeedPath(), stringifyYaml({ projectEndpoint: endpoint }, { indent: 2 }));\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { readConfig, getConfigPath } from \"../../lib/config.js\";\nimport { readFoundryConfig, getFoundryConfigPath } from \"../../lib/foundry-config.js\";\nimport {\n  colors,\n  renderJson,\n  renderKeyValueBlock,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class ConfigShowCommand extends M8tCommand {\n  static paths = [[\"config\", \"show\"]];\n  static usage = Command.Usage({\n    description: \"Show ~/.m8t-stack/config.yaml (tenant/client/project) + the cached gateway.\",\n    details:\n      \"Displays the Foundry config (config.yaml) and the gateway discovery cache (cli-config.yaml).\",\n  });\n\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const foundry = await readFoundryConfig();\n    const cache = await readConfig();\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson({ foundry, gatewayCache: cache }) + \"\\n\");\n      return 0;\n    }\n\n    const foundryBlock = foundry\n      ? renderKeyValueBlock([\n          { key: \"tenant\", value: foundry.tenantId },\n          { key: \"client id\", value: foundry.clientId },\n          { key: \"project\", value: foundry.projectName },\n          { key: \"endpoint\", value: foundry.projectEndpoint },\n        ])\n      : colors.dim(`no config.yaml — create it with 'm8t switch' or 'm8t config set'`);\n    this.context.stdout.write(colors.field(\"Foundry config\") + ` (${getFoundryConfigPath()})\\n`);\n    this.context.stdout.write(foundryBlock + \"\\n\\n\");\n\n    this.context.stdout.write(colors.field(\"Gateway cache\") + ` (${getConfigPath()})\\n`);\n    if (!cache) {\n      this.context.stdout.write(\n        colors.dim(\"no cached gateway URL — will discover on next command.\") + \"\\n\",\n      );\n      return 0;\n    }\n    this.context.stdout.write(\n      renderKeyValueBlock([\n        { key: \"gateway\", value: cache.gatewayUrl },\n        { key: \"client id\", value: cache.gatewayClientId },\n        { key: \"tenant\", value: cache.gatewayTenantId },\n        { key: \"subscription\", value: cache.subscriptionId },\n        { key: \"container app\", value: cache.containerAppResourceId },\n        { key: \"cached at\", value: cache.cachedAt },\n      ]) + \"\\n\",\n    );\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type {\n  CreateTeamRequest,\n  PartialWriteDetails,\n  TeamMember,\n  TeamMemberIdentities,\n} from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { ApiCallError, LocalCliError } from \"../../lib/errors.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  colors,\n  renderJson,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class TeamAddCommand extends M8tCommand {\n  static paths = [[\"team\", \"add\"]];\n  static usage = Command.Usage({\n    description: \"Add a new team member with one or more channel identities.\",\n    examples: [\n      [\n        \"Add with Telegram\",\n        \"$0 team add idabest --display \\\"Ilan Dabest\\\" --telegram 88112233\",\n      ],\n      [\n        \"Add with multiple identities\",\n        \"$0 team add idabest --display \\\"Ilan Dabest\\\" --telegram 88112233 --slack U01ILA\",\n      ],\n    ],\n  });\n\n  handle = Option.String();\n  display = Option.String(\"--display\", { required: true });\n  telegram = Option.String(\"--telegram\");\n  slack = Option.String(\"--slack\");\n  teams = Option.String(\"--teams\");\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const identities: TeamMemberIdentities = {};\n    if (this.telegram) identities.telegram = this.telegram;\n    if (this.slack) identities.slack = this.slack;\n    if (this.teams) identities.teams = this.teams;\n\n    if (Object.keys(identities).length === 0) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"at least one of --telegram, --slack, --teams is required.\",\n        hint: \"Example: m8t team add idabest --display \\\"Ilan\\\" --telegram 88112233\",\n      });\n    }\n\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n    const body: CreateTeamRequest = {\n      handle: this.handle,\n      displayName: this.display,\n      identities,\n    };\n\n    let member: TeamMember;\n    try {\n      member = await apiCall<TeamMember>(\n        { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n        { method: \"POST\", path: \"/api/team\", body },\n        (msg) => this.context.stderr.write(msg + \"\\n\"),\n      );\n    } catch (e) {\n      // Partial-write failures need a special pretty rendering — show\n      // which channels succeeded + remediation hint pointing at the\n      // missing identity.\n      if (e instanceof ApiCallError) {\n        const details = (e.envelope.details as Record<string, unknown> | undefined) ?? {};\n        if (details.reason === \"table_storage_partial_write\" && mode !== \"json\") {\n          const partial = details.partial as PartialWriteDetails | undefined;\n          if (partial) {\n            const created = Object.keys(partial.created).join(\", \") || \"(none)\";\n            this.context.stderr.write(\n              colors.error(\"error:\") +\n                ` partial write — ${created} succeeded, ${partial.failed.channel} failed.\\n`,\n            );\n            this.context.stderr.write(\n              colors.hint(\"  hint:\") +\n                ` run 'm8t team show ${this.handle}' to verify, then 'm8t team add-identity ${this.handle} --${partial.failed.channel} ${partial.failed.channelUserId}' to retry.\\n`,\n            );\n            return 1;\n          }\n        }\n      }\n      throw e;\n    }\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(member) + \"\\n\");\n      return 0;\n    }\n\n    const channelsCreated = Object.keys(member.identities).join(\", \");\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} created ${colors.field(member.handle)} (${member.displayName}) with ${channelsCreated} identit${Object.keys(member.identities).length === 1 ? \"y\" : \"ies\"}.\\n`,\n    );\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type {\n  PatchTeamRequest,\n  TeamMember,\n  TeamMemberIdentities,\n} from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\n\nexport class TeamAddIdentityCommand extends M8tCommand {\n  static paths = [[\"team\", \"add-identity\"]];\n  static usage = Command.Usage({\n    description: \"Add one or more channel identities to an existing team member.\",\n    examples: [\n      [\n        \"Add a Slack identity to an existing member\",\n        \"$0 team add-identity idabest --slack U01ILA\",\n      ],\n      [\n        \"Add multiple at once\",\n        \"$0 team add-identity idabest --slack U01ILA --teams ilan@example.com\",\n      ],\n    ],\n  });\n\n  handle = Option.String();\n  telegram = Option.String(\"--telegram\");\n  slack = Option.String(\"--slack\");\n  teams = Option.String(\"--teams\");\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const identities: TeamMemberIdentities = {};\n    if (this.telegram) identities.telegram = this.telegram;\n    if (this.slack) identities.slack = this.slack;\n    if (this.teams) identities.teams = this.teams;\n\n    if (Object.keys(identities).length === 0) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"at least one of --telegram, --slack, --teams is required.\",\n        hint: `Example: m8t team add-identity ${this.handle} --slack U01ILA`,\n      });\n    }\n\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n    const body: PatchTeamRequest = { addIdentities: identities };\n\n    const member = await apiCall<TeamMember>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      {\n        method: \"PATCH\",\n        path: `/api/team/${encodeURIComponent(this.handle)}`,\n        body,\n      },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(member) + \"\\n\");\n      return 0;\n    }\n\n    const added = Object.entries(identities)\n      .map(([ch, id]) => `${ch}=${id}`)\n      .join(\", \");\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} added ${added} to ${colors.field(member.handle)}.\\n`,\n    );\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type { ListTeamResponse } from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  renderJson,\n  renderTable,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class TeamListCommand extends M8tCommand {\n  static paths = [[\"team\", \"list\"]];\n  static usage = Command.Usage({\n    description: \"List team members.\",\n    details: \"Lists every team member, grouped by handle, sorted alphabetically.\",\n    examples: [\n      [\"Pretty table\", \"$0 team list\"],\n      [\"Machine-readable JSON\", \"$0 team list --output json\"],\n    ],\n  });\n\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n    const data = await apiCall<ListTeamResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"GET\", path: \"/api/team\" },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(data) + \"\\n\");\n      return 0;\n    }\n\n    if (data.members.length === 0) {\n      this.context.stdout.write(\n        \"no team members yet — try 'm8t team add <handle> --display \\\"<name>\\\" --<channel> <id>'.\\n\",\n      );\n      return 0;\n    }\n\n    type Row = {\n      handle: string;\n      display: string;\n      telegram: string;\n      slack: string;\n      teams: string;\n      added: string;\n      addedBy: string;\n    };\n\n    const rows: Row[] = data.members.map((m) => ({\n      handle: m.handle,\n      display: m.displayName,\n      telegram: m.identities.telegram ?? \"-\",\n      slack: m.identities.slack ?? \"-\",\n      teams: m.identities.teams ?? \"-\",\n      added: m.addedAt.slice(0, 10),\n      addedBy: m.addedBy,\n    }));\n\n    const table = renderTable<Row>(rows, [\n      { key: \"handle\", label: \"HANDLE\" },\n      { key: \"display\", label: \"DISPLAY\" },\n      { key: \"telegram\", label: \"TELEGRAM\" },\n      { key: \"slack\", label: \"SLACK\" },\n      { key: \"teams\", label: \"TEAMS\" },\n      { key: \"added\", label: \"ADDED\" },\n      { key: \"addedBy\", label: \"ADDED BY\" },\n    ]);\n    this.context.stdout.write(table + \"\\n\");\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { confirm } from \"@inquirer/prompts\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\n\nexport class TeamRemoveCommand extends M8tCommand {\n  static paths = [[\"team\", \"remove\"]];\n  static usage = Command.Usage({\n    description: \"Remove a team member entirely.\",\n    details:\n      \"Prompts for confirmation by default. Pass --yes to skip. Removes ALL channel identity rows for the handle.\",\n    examples: [\n      [\"With confirmation prompt\", \"$0 team remove idabest\"],\n      [\"Skip confirmation\", \"$0 team remove idabest --yes\"],\n    ],\n  });\n\n  handle = Option.String();\n  yes = Option.Boolean(\"--yes\", false, { description: \"Skip confirmation prompt.\" });\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    if (!this.yes) {\n      if (!interactive) {\n        throw new LocalCliError({\n          code: \"USAGE\",\n          message: \"remove requires --yes when running non-interactively.\",\n          hint: `m8t team remove ${this.handle} --yes`,\n        });\n      }\n      const ok = await confirm({\n        message: `Remove team member '${this.handle}' entirely?`,\n        default: false,\n      });\n      if (!ok) {\n        if (mode === \"pretty\") this.context.stdout.write(\"cancelled.\\n\");\n        return 2;\n      }\n    }\n\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n    const result = await apiCall<{ deleted: { handle: string; rows: number } }>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"DELETE\", path: `/api/team/${encodeURIComponent(this.handle)}` },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(result) + \"\\n\");\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} removed ${colors.field(result.deleted.handle)} (${result.deleted.rows} row${result.deleted.rows === 1 ? \"\" : \"s\"}).\\n`,\n    );\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type {\n  Channel,\n  PatchTeamRequest,\n  TeamMember,\n} from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\n\nexport class TeamRemoveIdentityCommand extends M8tCommand {\n  static paths = [[\"team\", \"remove-identity\"]];\n  static usage = Command.Usage({\n    description: \"Remove one channel identity from a team member.\",\n    details:\n      \"Exactly one of --telegram, --slack, --teams must be passed. Use 'm8t team remove <handle>' to remove the member entirely (last-identity removal is rejected).\",\n    examples: [\n      [\"Remove a member's Slack identity\", \"$0 team remove-identity idabest --slack\"],\n    ],\n  });\n\n  handle = Option.String();\n  telegram = Option.Boolean(\"--telegram\", false);\n  slack = Option.Boolean(\"--slack\", false);\n  teams = Option.Boolean(\"--teams\", false);\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const channels: Channel[] = [];\n    if (this.telegram) channels.push(\"telegram\");\n    if (this.slack) channels.push(\"slack\");\n    if (this.teams) channels.push(\"teams\");\n\n    if (channels.length === 0) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"exactly one of --telegram, --slack, --teams is required.\",\n        hint: `Example: m8t team remove-identity ${this.handle} --slack`,\n      });\n    }\n    if (channels.length > 1) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"only one channel flag at a time. To remove multiple, run the command twice.\",\n        hint: `m8t team remove-identity ${this.handle} --slack && m8t team remove-identity ${this.handle} --teams`,\n      });\n    }\n\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n    const body: PatchTeamRequest = { removeIdentities: channels };\n\n    const member = await apiCall<TeamMember>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      {\n        method: \"PATCH\",\n        path: `/api/team/${encodeURIComponent(this.handle)}`,\n        body,\n      },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(member) + \"\\n\");\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} removed ${channels[0]} identity from ${colors.field(member.handle)}.\\n`,\n    );\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport type { TeamMember } from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../../lib/api-client.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  renderJson,\n  renderKeyValueBlock,\n  resolveOutputMode,\n} from \"../../lib/output.js\";\n\nexport class TeamShowCommand extends M8tCommand {\n  static paths = [[\"team\", \"show\"]];\n  static usage = Command.Usage({\n    description: \"Show one team member by handle.\",\n    examples: [[\"Pretty block\", \"$0 team show idabest\"]],\n  });\n\n  handle = Option.String();\n  output = Option.String(\"--output\");\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n    const member = await apiCall<TeamMember>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"GET\", path: `/api/team/${encodeURIComponent(this.handle)}` },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(member) + \"\\n\");\n      return 0;\n    }\n\n    const identityRows: Array<{ key: string; value: string | undefined }> = [];\n    if (member.identities.telegram) identityRows.push({ key: \"  telegram\", value: member.identities.telegram });\n    if (member.identities.slack) identityRows.push({ key: \"  slack\", value: member.identities.slack });\n    if (member.identities.teams) identityRows.push({ key: \"  teams\", value: member.identities.teams });\n\n    const block = renderKeyValueBlock([\n      { key: \"handle\", value: member.handle },\n      { key: \"display\", value: member.displayName },\n      { key: \"identities\", value: \"\" },\n      ...identityRows,\n      { key: \"added\", value: member.addedAt },\n      { key: \"added by\", value: member.addedBy },\n    ]);\n    this.context.stdout.write(block + \"\\n\");\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { checkAppHealth } from \"@m8t-stack/github-app-auth\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { discoverKvUri } from \"../../lib/brain-paths.js\";\n\nexport class BrainCheckAppCommand extends M8tCommand {\n  static paths = [[\"brain\", \"check-app\"]];\n  static usage = Command.Usage({\n    description: \"Sanity-check the platform-level GitHub App configuration.\",\n    details:\n      \"5 checks: KV secrets readable, App ID numeric, private key valid, App JWT accepted by GitHub (slug matches KV), installations listable. No side effects. Run after setting up the App + KV secrets per deploy/github-app-registration-setup.md.\",\n    examples: [\n      [\"Default (uses AZURE_KEYVAULT_URI env)\", \"$0 brain check-app\"],\n      [\"Explicit KV URI\", \"$0 brain check-app --kv-uri https://m8t-kv.vault.azure.net\"],\n    ],\n  });\n\n  kvUri = Option.String(\"--kv-uri\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    // Normalize output: clipanion leaves a descriptor object on the property\n    // until argv parsing; when set directly in tests (or not supplied), treat\n    // anything that is not a plain string as \"pretty\" (our diagnostic default).\n    const outputFlag =\n      this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\"\n        ? (this.output as \"pretty\" | \"json\" | \"auto\")\n        : \"pretty\";\n    const mode = resolveOutputMode(\n      outputFlag,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const kvUri = discoverKvUri(process.env, typeof this.kvUri === \"string\" ? this.kvUri : undefined);\n    const credential = new DefaultAzureCredential();\n    const result = await checkAppHealth({ credential, kvUri });\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(result) + \"\\n\");\n      return result.ok ? 0 : 1;\n    }\n\n    this.context.stdout.write(`${colors.field(\"GitHub App health check\")} (${kvUri})\\n\\n`);\n    const row = (label: string, c: { ok: boolean; error?: string; value?: string; slug?: string; installationsCount?: number; count?: number }) => {\n      const status = c.ok ? colors.success(\"✓\") : colors.error(\"✗\");\n      const detail = c.ok\n        ? (c.value ?? c.slug ?? (c.count !== undefined ? `(${c.count} installations)` : c.installationsCount !== undefined ? `(${c.installationsCount} installations)` : \"\"))\n        : (c.error ?? \"(failed)\");\n      this.context.stdout.write(`  ${status} ${label.padEnd(28)} ${colors.dim(detail)}\\n`);\n    };\n    row(\"KV secrets readable\", result.checks.kvSecretsReadable);\n    row(\"App ID numeric\", result.checks.appIdNumeric);\n    row(\"Private key valid\", result.checks.privateKeyValid);\n    row(\"App JWT accepted\", result.checks.appJwtAccepted);\n    row(\"Installations listable\", result.checks.installationsListable);\n    this.context.stdout.write(\"\\n\");\n    this.context.stdout.write(\n      result.ok ? `${colors.success(\"✓\")} all checks passed.\\n`\n                : `${colors.error(\"✗\")} one or more checks failed — see above.\\n`,\n    );\n    return result.ok ? 0 : 1;\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { LocalCliError } from \"./errors.js\";\n\n/**\n * Resolve the Key Vault URI from (in order): explicit override, AZURE_KEYVAULT_URI,\n * KEYVAULT_URI. Throws LocalCliError(KV_URI_NOT_FOUND) when nothing resolves.\n *\n * Lifted from the four 4×-duplicated copies in apps/cli/src/commands/brain/*.ts.\n * The (env, override) shape is the canonical one; check-app.ts\n * is normalized to it.\n */\nexport function discoverKvUri(env: Record<string, string | undefined>, override?: string): string {\n  if (override) return override;\n  const v = env.AZURE_KEYVAULT_URI ?? env.KEYVAULT_URI;\n  if (v) return v;\n  throw new LocalCliError({\n    code: \"KV_URI_NOT_FOUND\",\n    message: \"Could not resolve Key Vault URI.\",\n    hint: \"Pass --kv-uri or set AZURE_KEYVAULT_URI / KEYVAULT_URI.\",\n  });\n}\n\n/**\n * Read the absolute path of the m8t-stack repo checkout from the\n * ~/.m8t-stack/repo-root marker (written by install/m8t.md). Throws when\n * the marker is missing — that means m8t-stack-POC was never installed.\n */\nexport function resolveRepoRoot(): string {\n  const marker = path.join(os.homedir(), \".m8t-stack\", \"repo-root\");\n  if (!fs.existsSync(marker)) {\n    throw new LocalCliError({\n      code: \"M8T_REPO_ROOT_MISSING\",\n      message: \"~/.m8t-stack/repo-root marker missing — m8t install never completed.\",\n    });\n  }\n  return fs.readFileSync(marker, \"utf8\").trim();\n}\n","import { Command, Option } from \"clipanion\";\nimport { spawnSync } from \"node:child_process\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { checkAppHealth, readAppSecrets, signAppJwt } from \"@m8t-stack/github-app-auth\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { readAgentYaml } from \"../../lib/agent-yaml.js\";\nimport {\n  isGhAuthed, ghAuthLoginDevice, createRepo, getRepoId,\n  installUrl, tryOpenUrl, pollForInstallation, probeAppInstallation,\n} from \"../../lib/gh-helpers.js\";\nimport { linkBrain } from \"../../lib/brain-link.js\";\nimport { discoverKvUri, resolveRepoRoot } from \"../../lib/brain-paths.js\";\nimport { resolveSeed, materializeBrainTree } from \"../../lib/brain-seed.js\";\n\nfunction stageAsGitRepo(dir: string): void {\n  const steps: Array<{ args: string[]; label: string }> = [\n    { args: [\"init\", \"-b\", \"main\"], label: \"git init\" },\n    { args: [\"add\", \".\"], label: \"git add\" },\n    { args: [\"commit\", \"-m\", \"Initial commit from brain-template\"], label: \"git commit\" },\n  ];\n  for (const { args, label } of steps) {\n    const r = spawnSync(\"git\", args, { cwd: dir, encoding: \"utf8\" });\n    if (r.status !== 0) {\n      const detail = (r.stderr ?? \"\").trim() || (r.stdout ?? \"\").trim() || `exit ${r.status ?? \"<null>\"}`;\n      throw new LocalCliError({\n        code: \"BRAIN_GIT_INIT_FAILED\",\n        message: `${label} failed in ${dir}: ${detail}`,\n      });\n    }\n  }\n}\n\nexport class BrainCreateCommand extends M8tCommand {\n  static paths = [[\"brain\", \"create\"]];\n  static usage = Command.Usage({\n    description: \"Create a new brain repo from brain-template/ (optionally seeded) and link it to <worker>.\",\n    details:\n      \"Copies ~/.m8t-stack/repo-root/brain-template/ to a tmp dir, optionally overlays brain-seeds/<name>/ (via --seed), stages it as a git repo, runs gh repo create --source --push, then the link cascade. Default --repo-name: <worker>-brain. Default visibility: private.\",\n    examples: [\n      [\"Create + link with defaults\", \"$0 brain create cmo --owner orkeren21\"],\n      [\"Custom name + public\", \"$0 brain create cmo --owner orkeren21 --repo-name cmo-second-brain --public\"],\n      [\"Seeded brain (overlay brain-seeds/<name>/)\", \"$0 brain create cmo --owner orkeren21 --seed <name>\"],\n    ],\n  });\n\n  worker = Option.String();\n  owner = Option.String(\"--owner\");\n  repoName = Option.String(\"--repo-name\");\n  branch = Option.String(\"--branch\");\n  public_ = Option.Boolean(\"--public\", false);\n  kvUri = Option.String(\"--kv-uri\");\n  subscription = Option.String(\"--subscription\");\n  endpoint = Option.String(\"--endpoint\");\n  output = Option.String(\"--output\");\n  seed = Option.String(\"--seed\");\n\n  async executeCommand(): Promise<number> {\n    // Normalize clipanion descriptor objects that appear when flags are unset in tests.\n    const owner = typeof this.owner === \"string\" ? this.owner : undefined;\n    const worker = typeof this.worker === \"string\" ? this.worker : undefined;\n    const repoName = typeof this.repoName === \"string\"\n      ? this.repoName\n      : (worker ? `${worker}-brain` : undefined);\n    const branch = (typeof this.branch === \"string\" ? this.branch : undefined) ?? \"main\";\n\n    if (!owner) {\n      throw new LocalCliError({ code: \"USAGE\", message: \"--owner is required (your GitHub username or org)\" });\n    }\n    if (!worker) {\n      throw new LocalCliError({ code: \"USAGE\", message: \"<worker> positional argument is required\" });\n    }\n    if (!repoName) {\n      throw new LocalCliError({ code: \"USAGE\", message: \"Could not determine repo name\" });\n    }\n\n    // Resolve + validate the seed early so an unknown name fails fast — before\n    // any pre-flight, tmp dir, or repo creation (no partial repo).\n    const seedName = typeof this.seed === \"string\" ? this.seed : undefined;\n    const seedDir = seedName ? resolveSeed(seedName) : undefined;\n\n    const env = (this.context.env ?? process.env) as Record<string, string | undefined>;\n    const kvUri = discoverKvUri(env, typeof this.kvUri === \"string\" ? this.kvUri : undefined);\n\n    // Normalize output: clipanion leaves a descriptor object on the property\n    // until argv parsing; when set directly in tests (or not supplied), treat\n    // anything that is not a plain string as \"pretty\" (our diagnostic default).\n    const outputFlag =\n      this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\"\n        ? (this.output as \"pretty\" | \"json\" | \"auto\")\n        : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n    const progress = mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    const credential = new DefaultAzureCredential();\n\n    // Pre-flight 1: gh auth\n    if (!(await isGhAuthed())) {\n      this.context.stdout.write(`${colors.hint(\"note:\")} gh not authed — running gh auth login --device --scopes \"repo,read:org\"\\n`);\n      await ghAuthLoginDevice();\n    }\n\n    // Pre-flight 2: inline check-app (silent if pass)\n    const health = await checkAppHealth({ credential, kvUri });\n    if (!health.ok) {\n      throw new LocalCliError({\n        code: \"APP_HEALTH_FAILED\",\n        message: \"GitHub App is not configured correctly.\",\n        hint: \"Run `m8t brain check-app` for details, then re-run this command.\",\n      });\n    }\n\n    // Pre-flight 3: resolve Foundry project (for ARM id)\n    const account = await getAzAccount();\n    const subscriptionId =\n      (typeof this.subscription === \"string\" ? this.subscription : undefined) ??\n      account.subscriptionId;\n    const agentEndpoint = readAgentYaml(worker)?.projectEndpoint;\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive: (this.context.stdout as NodeJS.WriteStream).isTTY === true,\n      endpoint: typeof this.endpoint === \"string\" ? this.endpoint : undefined,\n      agentEndpoint,\n    });\n\n    // 1. Copy brain-template/ to tmpdir\n    const repoRoot = resolveRepoRoot();\n    const templateSrc = path.join(repoRoot, \"brain-template\");\n    if (!fs.existsSync(templateSrc)) {\n      throw new LocalCliError({\n        code: \"TEMPLATE_MISSING\",\n        message: `brain-template/ missing at ${templateSrc}`,\n        hint: \"Ensure brain-template/ exists at the repo root (same level as apps/).\",\n      });\n    }\n    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `m8t-brain-create-${worker}-`));\n    let result: Awaited<ReturnType<typeof linkBrain>>;\n    let installationId: string | null = null;\n    try {\n      materializeBrainTree({ templateSrc, destDir: tmpDir, seedDir });\n      this.context.stdout.write(\n        seedName\n          ? `${colors.dim(\"→\")} copied brain-template/ + overlaid seed ${colors.field(seedName)} to ${tmpDir}\\n`\n          : `${colors.dim(\"→\")} copied brain-template/ to ${tmpDir}\\n`,\n      );\n\n      // 2. Stage as a git repo (`gh repo create --source --push` requires it)\n      stageAsGitRepo(tmpDir);\n\n      // 3. gh repo create + push\n      this.context.stdout.write(`${colors.dim(\"→\")} creating repo ${owner}/${repoName} (${this.public_ ? \"public\" : \"private\"})…\\n`);\n      await createRepo({ owner, name: repoName, private: !this.public_, source: tmpDir });\n      this.context.stdout.write(`${colors.success(\"✓\")} repo created\\n`);\n\n      // 4. App install: probe-then-open + poll\n      const repoId = await getRepoId(owner, repoName);\n      const { slug, appId, privateKeyPem } = await readAppSecrets({ credential, kvUri });\n      // Pre-probe — one-shot, safe to use a single JWT.\n      const initialJwt = signAppJwt({ appId, privateKeyPem });\n      // Probe-then-open: skip browser when the App is already\n      // installed on this repo (Ordering 3 idempotent re-link).\n      installationId = await probeAppInstallation({ owner, repo: repoName, jwt: initialJwt });\n      if (installationId) {\n        this.context.stdout.write(`  ${colors.success(\"✓\")} App already installed on ${colors.field(`${owner}/${repoName}`)} (installation ${installationId}); skipping browser open.\\n`);\n      } else {\n        const url = installUrl(slug, repoId);\n        this.context.stdout.write(`${colors.field(\"→\")} Install the m8t-brain App on ${owner}/${repoName}:\\n  ${url}\\n`);\n        await tryOpenUrl(url);\n        this.context.stdout.write(`  ${colors.dim(\"waiting for installation (Ctrl-C to cancel)…\")}\\n`);\n        installationId = await pollForInstallation({\n          owner, repo: repoName,\n          // Mint fresh JWT each tick — App JWTs are 10-min TTL, poll defaults to 5 min\n          // but the timeout is a soft default, so don't depend on the inequality.\n          probe: () => probeAppInstallation({ owner, repo: repoName, jwt: signAppJwt({ appId, privateKeyPem }) }),\n          onTick: (n) => { if (n % 5 === 0) this.context.stderr.write(`  ${colors.dim(`…still waiting (${n * 2}s)`)}\\n`); },\n        });\n        this.context.stdout.write(`  ${colors.success(\"✓\")} installation detected (id: ${installationId})\\n`);\n      }\n\n      // 5. Link cascade\n      result = await linkBrain({\n        credential, kvUri,\n        projectEndpoint: project.endpoint,\n        projectArmId: `${project.accountScope}/projects/${project.projectName}`,\n        agentName: worker,\n        repo: `${owner}/${repoName}`, branch,\n        repoRoot, installationId,\n        skipIfLinked: true,\n        onProgress: progress,\n      });\n    } finally {\n      fs.rmSync(tmpDir, { recursive: true, force: true });\n    }\n\n    if (mode === \"json\") {\n      this.context.stdout.write(\n        renderJson({\n          worker, repo: `${owner}/${repoName}`, branch,\n          installationId, connectionName: result.connectionName,\n          foundryVersion: result.foundryVersion,\n        }) + \"\\n\",\n      );\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} created + linked ${colors.field(worker)} ↔ ${colors.field(`${owner}/${repoName}`)} (agent version ${result.foundryVersion}).\\n`,\n    );\n    this.context.stdout.write(`  ${colors.hint(\"brain repo:\")} https://github.com/${owner}/${repoName}\\n`);\n    this.context.stdout.write(`  ${colors.hint(\"token:\")} rotates lazily on every invoke (60min TTL, 10min safety margin).\\n`);\n    return 0;\n  }\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport { select } from \"@inquirer/prompts\";\nimport { authedJson } from \"./http.js\";\nimport { LocalCliError } from \"./errors.js\";\n\nconst ARM = \"https://management.azure.com\";\nconst ARM_SCOPE = \"https://management.azure.com/.default\";\nconst ACCOUNTS_API = \"2024-10-01\";\nconst PROJECTS_API = \"2025-04-01-preview\";\n\nexport type FoundryProject = {\n  accountName: string;\n  accountScope: string; // ARM resource id of the account (the RBAC grant scope)\n  projectName: string;\n  region: string;\n  endpoint: string; // data-plane: https://<account>.services.ai.azure.com/api/projects/<project>\n  projectPrincipalId: string | null; // the project MI (for the AcrPull check)\n};\n\ntype AccountList = {\n  value?: Array<{ name?: string; kind?: string; location?: string; id?: string }>;\n};\ntype ProjectList = {\n  value?: Array<{ name?: string; identity?: { principalId?: string }; id?: string }>;\n};\n\nasync function listProjectsForAccount(\n  credential: TokenCredential,\n  accountId: string,\n): Promise<ProjectList> {\n  const url = `${ARM}${accountId}/projects?api-version=${PROJECTS_API}`;\n  return (await authedJson<ProjectList>({ credential, scope: ARM_SCOPE, method: \"GET\", url })) ?? {};\n}\n\n/**\n * Discover the target Foundry project. If `endpoint` is given, it is parsed\n * directly (no enumeration). Otherwise enumerate AIServices accounts +\n * projects in the subscription; single → use it; multiple → interactive\n * select or a FOUNDRY_PROJECT_MULTIPLE error.\n */\nexport async function resolveFoundryProject(opts: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  interactive: boolean;\n  endpoint?: string;\n  agentEndpoint?: string; // when supplied, auto-picks the matching candidate — skips interactive prompt\n}): Promise<FoundryProject> {\n  const candidates: FoundryProject[] = [];\n\n  const accounts =\n    (await authedJson<AccountList>({\n      credential: opts.credential,\n      scope: ARM_SCOPE,\n      method: \"GET\",\n      url: `${ARM}/subscriptions/${opts.subscriptionId}/providers/Microsoft.CognitiveServices/accounts?api-version=${ACCOUNTS_API}`,\n    })) ?? {};\n\n  for (const acc of accounts.value ?? []) {\n    if (acc.kind !== \"AIServices\" || !acc.name || !acc.id) continue;\n    const projects = await listProjectsForAccount(opts.credential, acc.id);\n    for (const proj of projects.value ?? []) {\n      if (!proj.name) continue;\n      // ARM returns the project's qualified name \"<account>/<project>\"; the\n      // data-plane endpoint wants only the bare project segment.\n      const projectName = proj.name.includes(\"/\")\n        ? proj.name.slice(proj.name.lastIndexOf(\"/\") + 1)\n        : proj.name;\n      candidates.push({\n        accountName: acc.name,\n        accountScope: acc.id,\n        projectName,\n        region: acc.location ?? \"\",\n        endpoint: `https://${acc.name}.services.ai.azure.com/api/projects/${projectName}`,\n        projectPrincipalId: proj.identity?.principalId ?? null,\n      });\n    }\n  }\n\n  // Explicit --endpoint: match a discovered candidate, else fail clearly.\n  if (opts.endpoint) {\n    const match = candidates.find((c) => c.endpoint === opts.endpoint);\n    if (match) return match;\n    throw new LocalCliError({\n      code: \"FOUNDRY_PROJECT_ENDPOINT_NOT_FOUND\",\n      message: `--endpoint '${opts.endpoint}' did not match any discovered Foundry project in subscription ${opts.subscriptionId}.`,\n      hint: `Discovered: ${candidates.map((c) => c.endpoint).join(\", \") || \"(none)\"}.`,\n    });\n  }\n\n  // When the caller supplies the agent's projectEndpoint (read from\n  // per-agent yaml), auto-pick the candidate that matches. Skips the\n  // interactive prompt + the FOUNDRY_PROJECT_MULTIPLE error for operators\n  // with > 1 Foundry project in their subscription.\n  //\n  // Precedence ladder:\n  //   1. opts.endpoint (explicit --endpoint flag) — handled above, always wins.\n  //   2. opts.agentEndpoint (from yaml) AND ∈ candidates → use it.\n  //   3. 0 candidates → error.\n  //   4. 1 candidate → use it.\n  //   5. > 1 candidates → interactive prompt (TTY) or FOUNDRY_PROJECT_MULTIPLE error.\n  //\n  // When agentEndpoint is set but doesn't match any candidate, fall through\n  // to step 3/4/5 — the yaml points at a project that no longer exists in\n  // this subscription; the operator gets a clean error or interactive pick.\n  if (opts.agentEndpoint) {\n    const match = candidates.find((c) => c.endpoint === opts.agentEndpoint);\n    if (match) return match;\n  }\n\n  if (candidates.length === 0) {\n    throw new LocalCliError({\n      code: \"FOUNDRY_PROJECT_ZERO\",\n      message: `No AIServices Foundry project found in subscription ${opts.subscriptionId}.`,\n      hint: \"Switch subscription with 'az account set --subscription <id>' or pass --endpoint.\",\n    });\n  }\n  if (candidates.length === 1) return candidates[0];\n\n  if (!opts.interactive) {\n    throw new LocalCliError({\n      code: \"FOUNDRY_PROJECT_MULTIPLE\",\n      message: `Multiple Foundry projects found: ${candidates.map((c) => `${c.projectName} (${c.region})`).join(\", \")}.`,\n      hint: \"Pass --endpoint <url> to choose, or run interactively.\",\n    });\n  }\n\n  const endpoint = await select({\n    message: `Multiple Foundry projects in subscription ${opts.subscriptionId}. Choose one:`,\n    choices: candidates.map((c) => ({\n      name: `${c.projectName}  (account=${c.accountName}, ${c.region})`,\n      value: c.endpoint,\n    })),\n  });\n  const chosen = candidates.find((c) => c.endpoint === endpoint);\n  if (!chosen) {\n    throw new LocalCliError({ code: \"FOUNDRY_PROJECT_SELECTION_FAILED\", message: \"No project selected.\" });\n  }\n  return chosen;\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as os from \"node:os\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { LocalCliError } from \"./errors.js\";\n\nexport type BrainBlock = {\n  repo: string;\n  branch: string;\n  installationId: string;\n  credentialRef: string;\n  linkedAt: string; // ISO 8601 UTC\n};\n\n/**\n * On-disk shape of ~/.m8t-stack/foundry/<agent>.yaml.\n *\n * F1 shipped the base fields (agentName, agentId, ..., environments).\n * F2 adds two optional blocks:\n *   - fillableFieldValues: populated by the architect at deploy time;\n *     used by brain-link/brain-unlink to re-render the persona body\n *     deterministically without re-prompting the operator.\n *   - brain: populated only by `m8t brain link` / `create`; absent for\n *     non-brain workers.\n */\nexport type AgentYaml = {\n  agentName: string;\n  agentId: string;\n  projectEndpoint: string;\n  model: string;\n  personaVersion: string | null;\n  personaPath: string;\n  deployedAt: string;\n  playgroundUrl: string;\n  environments: { default: { projectEndpoint: string } };\n  fillableFieldValues?: Record<string, string>; // F2\n  brain?: BrainBlock; // F2\n};\n\nexport function agentYamlPath(agentName: string, home: string = os.homedir()): string {\n  return path.join(home, \".m8t-stack\", \"foundry\", `${agentName}.yaml`);\n}\n\nexport function readAgentYaml(agentName: string, home?: string): AgentYaml | null {\n  const file = agentYamlPath(agentName, home);\n  if (!fs.existsSync(file)) return null;\n  const text = fs.readFileSync(file, \"utf8\");\n  return parseYaml(text) as AgentYaml;\n}\n\nexport function writeAgentYaml(\n  agentName: string,\n  data: AgentYaml,\n  home?: string,\n): void {\n  const file = agentYamlPath(agentName, home);\n  fs.mkdirSync(path.dirname(file), { recursive: true });\n  fs.writeFileSync(file, stringifyYaml(data), { mode: 0o600 });\n}\n\n/**\n * Patch fields in-place. `brain: null` removes the brain block (different\n * from `brain: undefined` which leaves it alone). All other null/undefined\n * fields are left alone — only explicit values overwrite.\n */\nexport function patchAgentYaml(\n  agentName: string,\n  patch: Omit<Partial<AgentYaml>, 'brain'> & { brain?: BrainBlock | null },\n  home?: string,\n): void {\n  const current = readAgentYaml(agentName, home);\n  if (!current) {\n    throw new LocalCliError({\n      code: \"AGENT_YAML_NOT_FOUND\",\n      message: `Per-agent metadata file not found for '${agentName}'.`,\n      hint: `Expected at ${agentYamlPath(agentName, home)}. Re-deploy the agent via the architect to recreate it.`,\n    });\n  }\n  // Rebuild from known fields explicitly so unknown keys on disk (e.g.\n  // deprecated fields from older versions) are dropped on the next patch —\n  // not silently preserved by a spread.\n  const next: AgentYaml = {\n    agentName: current.agentName,\n    agentId: current.agentId,\n    projectEndpoint: current.projectEndpoint,\n    model: current.model,\n    personaVersion: current.personaVersion,\n    personaPath: current.personaPath,\n    deployedAt: current.deployedAt,\n    playgroundUrl: current.playgroundUrl,\n    environments: current.environments,\n    ...(current.fillableFieldValues !== undefined && { fillableFieldValues: current.fillableFieldValues }),\n    ...(current.brain !== undefined && { brain: current.brain }),\n  };\n\n  // Apply patch — brain has special null-clears-the-block semantics; all\n  // other fields overwrite when defined.\n  for (const [k, v] of Object.entries(patch)) {\n    if (k === \"brain\") {\n      if (v === null) {\n        delete next.brain;\n      } else if (v !== undefined) {\n        next.brain = v as BrainBlock;\n      }\n    } else if (v !== undefined) {\n      (next as Record<string, unknown>)[k] = v;\n    }\n  }\n  writeAgentYaml(agentName, next, home);\n}\n","import { spawn } from \"node:child_process\";\nimport { LocalCliError } from \"./errors.js\";\n\nexport type ExecResult = { stdout: string; stderr: string; exitCode: number };\nexport type GhExec = (cmd: string, args: string[]) => Promise<ExecResult>;\n\n/**\n * Default exec — wraps Node's spawn. Tests inject a mocked GhExec.\n */\nexport const defaultGhExec: GhExec = (cmd, args) =>\n  new Promise((resolve) => {\n    const child = spawn(cmd, args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout.on(\"data\", (d) => { stdout += d.toString(); });\n    child.stderr.on(\"data\", (d) => { stderr += d.toString(); });\n    child.on(\"close\", (code) => resolve({ stdout, stderr, exitCode: code ?? -1 }));\n  });\n\n/** True iff `gh auth status` exits 0. */\nexport async function isGhAuthed(exec: GhExec = defaultGhExec): Promise<boolean> {\n  const r = await exec(\"gh\", [\"auth\", \"status\"]);\n  return r.exitCode === 0;\n}\n\n/**\n * Run `gh auth login --device --scopes \"repo,read:org\"` interactively.\n *\n * NB: device-flow prompts the operator with a browser URL + one-time code.\n * The default exec inherits stdin/stdout/stderr from the parent process,\n * so the prompt is visible to the operator. (For tests, use a custom exec\n * that simulates a successful login.)\n */\nexport async function ghAuthLoginDevice(exec: GhExec = defaultGhExec): Promise<void> {\n  const r = await exec(\"gh\", [\n    \"auth\", \"login\", \"--device\", \"--scopes\", \"repo,read:org\",\n  ]);\n  if (r.exitCode !== 0) {\n    throw new LocalCliError({\n      code: \"GH_AUTH_FAILED\",\n      message: `gh auth login failed: ${r.stderr || r.stdout}`,\n      hint: \"Re-run interactively: gh auth login --device --scopes 'repo,read:org'\",\n    });\n  }\n}\n\n/** Get a repo's numeric GitHub id (used for the App install URL). */\nexport async function getRepoId(\n  owner: string,\n  repo: string,\n  exec: GhExec = defaultGhExec,\n): Promise<number> {\n  const r = await exec(\"gh\", [\"api\", `/repos/${owner}/${repo}`, \"--jq\", \".id\"]);\n  if (r.exitCode !== 0) {\n    throw new LocalCliError({\n      code: \"GH_REPO_ID_FAILED\",\n      message: `gh api /repos/${owner}/${repo}: ${r.stderr || r.stdout}`,\n    });\n  }\n  const id = Number(r.stdout.trim());\n  if (!Number.isInteger(id) || id <= 0) {\n    throw new LocalCliError({\n      code: \"GH_REPO_ID_INVALID\",\n      message: `Expected numeric repo id, got '${r.stdout.trim()}'`,\n    });\n  }\n  return id;\n}\n\n/** Build the per-repo App install URL (`?repository_ids=<id>` preselects). */\nexport function installUrl(slug: string, repoId: number): string {\n  return `https://github.com/apps/${slug}/installations/new?repository_ids=${repoId}`;\n}\n\n/**\n * `gh repo create` from a local source dir, push to main.\n *\n * Precondition: source dir must already be a git repo with at least one\n * commit (`git init && git add . && git commit`). `gh repo create\n * --source --push` validates this and bails before creating the remote\n * repo otherwise.\n *\n * Throws on non-zero exit.\n */\nexport async function createRepo(args: {\n  owner: string;\n  name: string;\n  private?: boolean;\n  source: string;\n  exec?: GhExec;\n}): Promise<void> {\n  const exec = args.exec ?? defaultGhExec;\n  const visibility = args.private ? \"--private\" : \"--public\";\n  const r = await exec(\"gh\", [\n    \"repo\", \"create\", `${args.owner}/${args.name}`,\n    visibility, \"--source\", args.source, \"--remote\", \"origin\", \"--push\",\n  ]);\n  if (r.exitCode !== 0) {\n    throw new LocalCliError({\n      code: \"GH_REPO_CREATE_FAILED\",\n      message: `gh repo create: ${r.stderr || r.stdout}`,\n    });\n  }\n}\n\n/**\n * Poll for App installation on a repo every `intervalMs` until detected or\n * the timeout fires. Returns the installation id.\n *\n * Auth note: `GET /repos/{owner}/{repo}/installation` REQUIRES an App JWT —\n * the operator's user PAT (what `gh api` sends) returns\n * `401 \"JSON web token could not be decoded\"`. So callers MUST supply a\n * `probe` that signs an App JWT and queries the endpoint themselves. The\n * legacy gh-CLI path is only used when no probe is given; it works only on\n * a small set of public/no-auth endpoints and is preserved for back-compat.\n */\nexport async function pollForInstallation(args: {\n  owner: string;\n  repo: string;\n  intervalMs?: number;\n  timeoutMs?: number;\n  exec?: GhExec;\n  /** Custom probe; returns the installation id when detected, or null/undefined to keep waiting. */\n  probe?: () => Promise<string | null | undefined>;\n  onTick?: (attempt: number) => void;\n}): Promise<string> {\n  const exec = args.exec ?? defaultGhExec;\n  const intervalMs = args.intervalMs ?? 2000;\n  const timeoutMs = args.timeoutMs ?? 5 * 60 * 1000;\n  const start = Date.now();\n  let attempt = 0;\n  for (;;) {\n    attempt++;\n    args.onTick?.(attempt);\n    let id: string | null | undefined = null;\n    if (args.probe) {\n      try { id = await args.probe(); } catch { /* keep polling */ }\n    } else {\n      // Legacy gh-CLI path — only works if the endpoint accepts user PAT.\n      const r = await exec(\"gh\", [\n        \"api\", `/repos/${args.owner}/${args.repo}/installation`, \"--jq\", \".id\",\n      ]);\n      if (r.exitCode === 0) {\n        const v = r.stdout.trim();\n        if (v && v !== \"null\") id = v;\n      }\n    }\n    if (id) return id;\n    if (Date.now() - start >= timeoutMs) {\n      throw new LocalCliError({\n        code: \"GH_INSTALL_POLL_TIMEOUT\",\n        message: `Timed out after ${timeoutMs / 1000}s waiting for the App to be installed on ${args.owner}/${args.repo}.`,\n        hint: `Did you click 'Install' in the browser? Open the URL again if needed.`,\n      });\n    }\n    await new Promise((r) => setTimeout(r, intervalMs));\n  }\n}\n\n/**\n * Probe whether the GitHub App is installed on a given repo. Uses the\n * App-JWT identity (gh user-PAT is rejected on this endpoint).\n *\n * Returns the installation id when present (HTTP 200), null when absent\n * (HTTP 404). Throws on any other non-2xx so the caller doesn't silently\n * treat e.g. a 500 as \"not installed\".\n *\n * Lifted from the inline closures in brain/link.ts and brain/create.ts\n * so it can be reused as both: (a) the pre-tryOpenUrl probe\n * (skip browser open when already installed), and (b) the polling probe\n * for pollForInstallation.\n */\nexport async function probeAppInstallation(args: {\n  owner: string;\n  repo: string;\n  jwt: string;\n}): Promise<string | null> {\n  const res = await fetch(`https://api.github.com/repos/${args.owner}/${args.repo}/installation`, {\n    headers: {\n      Authorization: `Bearer ${args.jwt}`,\n      Accept: \"application/vnd.github+json\",\n      \"X-GitHub-Api-Version\": \"2022-11-28\",\n    },\n  });\n  if (res.ok) {\n    const j = (await res.json()) as { id?: number | string };\n    return j.id !== undefined ? String(j.id) : null;\n  }\n  if (res.status === 404) return null;\n  const body = await res.text();\n  throw new Error(`probeAppInstallation: HTTP ${res.status} from /repos/${args.owner}/${args.repo}/installation\\n${body.slice(0, 300)}`);\n}\n\n/**\n * Try to open a URL in the operator's default browser. Best-effort —\n * silently no-ops on failure so the CLI still prints the URL.\n */\nexport async function tryOpenUrl(url: string, exec: GhExec = defaultGhExec): Promise<void> {\n  const cmd = process.platform === \"darwin\" ? \"open\"\n            : process.platform === \"win32\" ? \"start\"\n            : \"xdg-open\";\n  try { await exec(cmd, [url]); } catch { /* best-effort */ }\n}\n","import * as path from \"node:path\";\nimport * as fs from \"node:fs\";\nimport type { TokenCredential } from \"@azure/identity\";\nimport {\n  rotateConnectionAuth,\n} from \"@m8t-stack/github-app-auth\";\nimport { serializeBrainLink, type BrainLink } from \"@m8t-stack/api-contract\";\nimport { LocalCliError } from \"./errors.js\";\nimport { readAgentYaml, patchAgentYaml, writeAgentYaml, type BrainBlock } from \"./agent-yaml.js\";\nimport { renderPersonaBody } from \"./persona-render.js\";\nimport { appendBrainLoader } from \"./brain-loader-block.js\";\nimport { getAgentVersion, type AgentDefinition } from \"./foundry-agent-get.js\";\nimport { mirrorBrainYaml } from \"./brain-yaml-mirror.js\";\nimport type { FoundryProject } from \"./foundry-project.js\";\n\nconst FOUNDRY_ARM_API = \"2025-04-01-preview\";\nconst FOUNDRY_DATA_SCOPE = \"https://ai.azure.com/.default\";\nconst ARM_SCOPE = \"https://management.azure.com/.default\";\nconst MCP_TOOL_NAMES = [\n  \"get_file_contents\",\n  \"create_or_update_file\",\n  \"push_files\",\n  \"search_code\",\n  \"search_repositories\",\n];\nconst MCP_SERVER_URL = \"https://api.githubcopilot.com/mcp\";\n\nexport type LinkBrainArgs = {\n  credential: TokenCredential;\n  kvUri: string;\n  projectEndpoint: string;       // data-plane URL\n  projectArmId: string;          // /subscriptions/.../projects/<proj>\n  agentName: string;\n  repo: string;                  // \"owner/name\"\n  branch: string;\n  repoRoot: string;              // path to m8t-stack repo (for brain-loader.md)\n  home?: string;                 // for testing — defaults to os.homedir()\n  installationId?: string;       // pre-known id (e.g. from CLI poll); when absent, caller polls\n  skipIfLinked?: boolean;        // if true, skip createVersion + brain.yaml write when already linked\n  onProgress?: (msg: string) => void;\n  // Hosted-agent fields — required when the agent has kind:\"hosted\"\n  subscriptionId?: string;\n  project?: FoundryProject;\n  modelDeployment?: string;\n  allowNonReasoning?: boolean;\n  personaPathOverride?: string;  // --persona: re-render from this file instead of the yaml's personaPath\n};\n\nexport type LinkBrainResult = {\n  installationId: string;\n  connectionName: string;\n  foundryVersion?: string;\n  alreadyLinked: boolean;\n};\n\n/**\n * The convergent link step (DESIGN §7.2 steps 3–8).\n *\n * Caller (CLI command) has already:\n *   - Verified agent exists (or created the repo, for `m8t brain create`)\n *   - Done the App-install poll (or expects to via this function's\n *     installationId arg if pre-known)\n *   - Run the inline `checkAppHealth` precondition\n *\n * This function:\n *   1. Reads current agent definition (to clone instructions + tools)\n *   2. Reads per-agent yaml for personaPath + fillableFieldValues\n *   3. Re-renders persona body + appends brain loader (templated with {{brain_repo}})\n *   4. Mints installation token + PATCHes Foundry connection\n *      (rotateConnectionAuth — creates connection on first run; see Step 7\n *      for the create-if-missing detail)\n *   5. Composes + POSTs createVersion with brain tool + metadata.brain\n *   6. Writes .m8t/brain.yaml mirror to the repo\n *   7. Patches local per-agent yaml with the brain block\n *\n * Idempotent: when `skipIfLinked=true` AND metadata.brain already matches\n * args, steps 5–7 are skipped but token rotation (step 4) still runs.\n */\nexport async function linkBrain(args: LinkBrainArgs): Promise<LinkBrainResult> {\n  const progress = args.onProgress ?? (() => {});\n  const connectionName = `brain-${args.agentName}`;\n\n  if (!args.installationId) {\n    throw new LocalCliError({\n      code: \"LINK_NO_INSTALLATION_ID\",\n      message: \"linkBrain requires installationId. CLI command must poll for it before calling.\",\n    });\n  }\n\n  progress(\"Reading current agent definition…\");\n  const current = await getAgentVersion({\n    credential: args.credential,\n    projectEndpoint: args.projectEndpoint,\n    agentName: args.agentName,\n  });\n\n  // Kind-aware: hosted agents bypass the MCP attachment + Foundry connection\n  // entirely — the container self-mints and reads/writes via the GitHub API.\n  if (current.definition.kind === \"hosted\") {\n    if (!args.project || !args.subscriptionId) {\n      throw new LocalCliError({\n        code: \"HOSTED_LINK_MISSING_CONTEXT\",\n        message: \"linkBrain: hosted agents require project + subscriptionId (the CLI command must resolve them).\",\n      });\n    }\n    progress(\"hosted agent — enabling in-container brain access…\");\n    const { enableHostedBrain } = await import(\"./enable-hosted-brain.js\");\n    const res = await enableHostedBrain({\n      credential: args.credential,\n      subscriptionId: args.subscriptionId,\n      project: args.project,\n      kvUri: args.kvUri,\n      agentName: args.agentName,\n      repo: args.repo,\n      branch: args.branch,\n      installationId: args.installationId,\n      modelDeployment: args.modelDeployment,\n      allowNonReasoning: args.allowNonReasoning,\n      onProgress: args.onProgress,\n    });\n    return {\n      installationId: args.installationId,\n      connectionName: \"in-container\",\n      foundryVersion: res.version,\n      alreadyLinked: res.alreadyLinked,\n    };\n  }\n\n  // Idempotency check: skip the heavy steps if metadata.brain already matches.\n  const currentLink = parseExistingBrain(current.metadata?.brain);\n  const alreadyLinked = !!(\n    args.skipIfLinked &&\n    currentLink &&\n    currentLink.repo === args.repo &&\n    currentLink.installationId === args.installationId &&\n    currentLink.credentialRef === connectionName\n  );\n\n  progress(\"Rotating App installation token in Foundry connection…\");\n  await ensureConnectionExists({\n    credential: args.credential,\n    projectArmId: args.projectArmId,\n    connectionName,\n  });\n  const rotation = await rotateConnectionAuth({\n    credential: args.credential,\n    kvUri: args.kvUri,\n    projectArmId: args.projectArmId,\n    connectionName,\n    installationId: args.installationId,\n    repository: args.repo,\n  });\n  progress(`Token rotated (expires ${rotation.expiresAt.toISOString()})`);\n\n  let foundryVersion: string | undefined;\n\n  if (!alreadyLinked) {\n    const loaderPath = path.join(args.repoRoot, \"targets/foundry/brain-loader.md\");\n    const loaderTemplate = fs.readFileSync(loaderPath, \"utf8\");\n    const loader = loaderTemplate.replaceAll(\"{{brain_repo}}\", args.repo);\n\n    const yaml = readAgentYaml(args.agentName, args.home);\n    const personaPath = args.personaPathOverride ?? yaml?.personaPath;\n\n    let base: string;\n    if (personaPath) {\n      progress(\"Re-rendering persona body with brain loader…\");\n      const resolved = personaPath.startsWith(\"/\") ? personaPath : path.join(args.repoRoot, personaPath);\n      base = renderPersonaBody(resolved, yaml?.fillableFieldValues ?? {});\n    } else {\n      // Fallback (no local yaml — e.g. a REST/SDK-created agent): base on the\n      // deployed instructions; appendBrainLoader strips any prior loader first.\n      progress(\"No local persona yaml — basing instructions on the deployed agent…\");\n      base = current.definition.instructions ?? \"\";\n    }\n    const instructionsWithLoader = appendBrainLoader(base, loader);\n\n    const link: BrainLink = {\n      repo: args.repo,\n      branch: args.branch,\n      topology: \"per-worker\",\n      schemaVersion: \"1\",\n      credentialRef: connectionName,\n      installationId: args.installationId,\n    };\n\n    progress(\"Deploying brain-enabled agent version…\");\n    foundryVersion = await createBrainEnabledVersion({\n      credential: args.credential,\n      projectEndpoint: args.projectEndpoint,\n      agentName: args.agentName,\n      currentDefinition: current.definition,\n      currentMetadata: current.metadata ?? {},\n      instructionsWithLoader,\n      connectionName,\n      brainLinkJson: serializeBrainLink(link),\n    });\n\n    progress(\"Mirroring .m8t/brain.yaml to brain repo…\");\n    await mirrorBrainYaml({\n      credential: args.credential,\n      kvUri: args.kvUri,\n      installationId: args.installationId,\n      repo: args.repo,\n      branch: args.branch,\n      persona: yaml?.personaVersion\n        ? `${current.metadata?.persona ?? args.agentName}@${yaml.personaVersion}`\n        : current.metadata?.persona ?? args.agentName,\n      agent: args.agentName,\n    });\n\n    progress(\"Recording the brain link in the per-agent yaml…\");\n    const brainBlock: BrainBlock = {\n      repo: args.repo,\n      branch: args.branch,\n      installationId: args.installationId,\n      credentialRef: connectionName,\n      linkedAt: new Date().toISOString(),\n    };\n    if (yaml) {\n      patchAgentYaml(args.agentName, { brain: brainBlock }, args.home);\n    } else {\n      // Synthesize a minimal yaml so brain unlink / agent remove / future ops work.\n      writeAgentYaml(\n        args.agentName,\n        {\n          agentName: args.agentName,\n          agentId: \"\",\n          projectEndpoint: args.projectEndpoint,\n          // model may be empty for an SDK-created agent without a deployed model field\n          model: typeof current.definition.model === \"string\" ? current.definition.model : \"\",\n          personaVersion: current.metadata?.personaVersion ?? null,\n          personaPath: \"\",\n          deployedAt: new Date().toISOString(),\n          playgroundUrl: \"\",\n          environments: { default: { projectEndpoint: args.projectEndpoint } },\n          brain: brainBlock,\n        },\n        args.home,\n      );\n    }\n  }\n\n  return {\n    installationId: args.installationId,\n    connectionName,\n    foundryVersion,\n    alreadyLinked,\n  };\n}\n\n// ──── helpers ───────────────────────────────────────────────────────────────\n\nfunction parseExistingBrain(raw: string | undefined): BrainLink | undefined {\n  if (!raw) return undefined;\n  try { return JSON.parse(raw) as BrainLink; } catch { return undefined; }\n}\n\nasync function ensureConnectionExists(args: {\n  credential: TokenCredential;\n  projectArmId: string;\n  connectionName: string;\n}): Promise<void> {\n  const armToken = await args.credential.getToken(ARM_SCOPE);\n  if (!armToken?.token) {\n    throw new LocalCliError({ code: \"ARM_AUTH\", message: \"Could not acquire ARM token\" });\n  }\n  const url = `https://management.azure.com${args.projectArmId}/connections/${args.connectionName}?api-version=${FOUNDRY_ARM_API}`;\n  // GET first — exists?\n  const getRes = await fetch(url, { headers: { Authorization: `Bearer ${armToken.token}` } });\n  if (getRes.ok) return;\n  if (getRes.status !== 404) {\n    const text = await getRes.text();\n    throw new LocalCliError({\n      code: \"CONN_GET_FAILED\",\n      message: `GET ${url}: HTTP ${getRes.status}\\n${text.slice(0, 300)}`,\n    });\n  }\n  // PUT (create with placeholder credentials; rotateConnectionAuth will PATCH the real token)\n  const body = JSON.stringify({\n    properties: {\n      authType: \"CustomKeys\", category: \"CustomKeys\",\n      target: MCP_SERVER_URL,\n      isSharedToAll: false,\n      credentials: { keys: { Authorization: \"Bearer placeholder-will-be-rotated\" } },\n      metadata: { managedBy: \"m8t-brain-f02\" },\n    },\n  });\n  const putRes = await fetch(url, {\n    method: \"PUT\",\n    headers: { Authorization: `Bearer ${armToken.token}`, \"Content-Type\": \"application/json\" },\n    body,\n  });\n  if (!putRes.ok) {\n    const text = await putRes.text();\n    throw new LocalCliError({\n      code: \"CONN_CREATE_FAILED\",\n      message: `PUT ${url}: HTTP ${putRes.status}\\n${text.slice(0, 300)}`,\n    });\n  }\n}\n\nasync function createBrainEnabledVersion(args: {\n  credential: TokenCredential;\n  projectEndpoint: string;\n  agentName: string;\n  currentDefinition: AgentDefinition;\n  currentMetadata: Record<string, string>;\n  instructionsWithLoader: string;\n  connectionName: string;\n  brainLinkJson: string;\n}): Promise<string> {\n  const fndToken = await args.credential.getToken(FOUNDRY_DATA_SCOPE);\n  if (!fndToken?.token) {\n    throw new LocalCliError({ code: \"FOUNDRY_AUTH\", message: \"Could not acquire Foundry data-plane token\" });\n  }\n  // Strip any existing brain tool, then append the canonical one.\n  const otherTools = (args.currentDefinition.tools ?? []).filter(\n    (t) => !(t.type === \"mcp\" && (t as { server_label?: string }).server_label === \"brain\"),\n  );\n  const brainTool = {\n    type: \"mcp\" as const,\n    server_label: \"brain\",\n    server_url: MCP_SERVER_URL,\n    allowed_tools: MCP_TOOL_NAMES,\n    require_approval: \"never\" as const,\n    project_connection_id: args.connectionName,\n  };\n  const definition: AgentDefinition = {\n    ...args.currentDefinition,\n    instructions: args.instructionsWithLoader,\n    tools: [...otherTools, brainTool],\n  };\n  const metadata: Record<string, string> = {\n    ...args.currentMetadata,\n    brain: args.brainLinkJson,\n  };\n  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: { Authorization: `Bearer ${fndToken.token}`, \"Content-Type\": \"application/json\" },\n    body: JSON.stringify({ definition, metadata }),\n  });\n  if (!res.ok) {\n    const text = await res.text();\n    throw new LocalCliError({\n      code: \"AGENT_CREATE_VERSION_FAILED\",\n      message: `POST ${url}: HTTP ${res.status}\\n${text.slice(0, 500)}`,\n    });\n  }\n  const data = (await res.json()) as { version?: string };\n  if (!data.version) {\n    throw new LocalCliError({ code: \"AGENT_CREATE_VERSION_NO_VERSION\", message: `createVersion returned no version` });\n  }\n  return data.version;\n}\n\n","import * as fs from \"node:fs\";\nimport { LocalCliError } from \"./errors.js\";\n\n/**\n * Render a persona's body (everything after the closing frontmatter `---`)\n * by substituting `{{field-name}}` placeholders with values from the map.\n *\n * Used by the F2 brain-link / brain-unlink cascades to re-render the body\n * deterministically without re-prompting the operator (values are persisted\n * in ~/.m8t-stack/foundry/<agent>.yaml under `fillableFieldValues`).\n *\n * Mirrors the substitution semantics of `targets/foundry/README.md` step 5:\n *   - Simple regex string-replace (no template engine).\n *   - Defensive: after substitution, scans for residual {{...}}; if any\n *     remain, throws — the persona references fields not in the map.\n *\n * @throws LocalCliError when the file is unreadable or placeholders are unsatisfied.\n */\nexport function renderPersonaBody(\n  personaPath: string,\n  fillableFieldValues: Record<string, string>,\n): string {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(personaPath, \"utf8\");\n  } catch (e) {\n    throw new LocalCliError({\n      code: \"PERSONA_READ_FAILED\",\n      message: `Could not read persona file '${personaPath}': ${(e as Error).message}`,\n    });\n  }\n\n  // Strip frontmatter: anything between the first `---` and the next `---`.\n  const fmMatch = raw.match(/^---\\n[\\s\\S]*?\\n---\\n+/);\n  const body = fmMatch ? raw.slice(fmMatch[0].length) : raw;\n\n  // Substitute placeholders.\n  let rendered = body;\n  for (const [name, value] of Object.entries(fillableFieldValues)) {\n    rendered = rendered.replaceAll(`{{${name}}}`, value);\n  }\n\n  // Defensive scan: any residual {{...}} ?\n  const residual = rendered.match(/\\{\\{([a-zA-Z][\\w-]*)\\}\\}/g);\n  if (residual && residual.length > 0) {\n    const names = [...new Set(residual.map((s) => s.slice(2, -2)))];\n    throw new LocalCliError({\n      code: \"PERSONA_PLACEHOLDER_UNSATISFIED\",\n      message: `Persona '${personaPath}' has un-substituted placeholders: ${names.join(\", \")}`,\n      hint: `Add these to fillableFieldValues in ~/.m8t-stack/foundry/<agent>.yaml, or re-deploy the agent via the architect to repopulate.`,\n    });\n  }\n\n  return rendered.replace(/\\s+$/, \"\"); // strip trailing whitespace; preserve internal layout\n}\n","export const LOADER_START = \"<!-- m8t:brain-loader:start -->\";\nexport const LOADER_END = \"<!-- m8t:brain-loader:end -->\";\n// Matches a LEGACY (pre-marker) loader by its distinctive opening (from\n// targets/foundry/brain-loader.md) — far less likely to false-match a persona\n// that merely uses \"## Your second brain\" as a heading.\nconst LEGACY_HEADER = \"## Your second brain\\n\\nYou have a persistent second brain:\";\n\n/** Remove a previously-appended brain loader (marked or legacy) from instructions. */\nexport function stripBrainLoader(instructions: string): string {\n  const s = instructions.indexOf(LOADER_START);\n  if (s !== -1) {\n    const e = instructions.indexOf(LOADER_END, s);\n    const head = instructions.slice(0, s);\n    const tail = e !== -1 ? instructions.slice(e + LOADER_END.length) : \"\";\n    return (head + tail).replace(/\\s+$/, \"\");\n  }\n  const h = instructions.lastIndexOf(LEGACY_HEADER);\n  if (h !== -1) return instructions.slice(0, h).replace(/\\s+$/, \"\");\n  return instructions.replace(/\\s+$/, \"\");\n}\n\n/** Strip any prior loader, then append `loaderText` wrapped in idempotency markers. */\nexport function appendBrainLoader(base: string, loaderText: string): string {\n  const clean = stripBrainLoader(base);\n  return `${clean}\\n\\n${LOADER_START}\\n${loaderText.replace(/\\s+$/, \"\")}\\n${LOADER_END}\\n`;\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { LocalCliError } from \"./errors.js\";\nimport { resolveRepoRoot } from \"./brain-paths.js\";\n\n/**\n * THE seed-source seam. Resolves a seed NAME to a directory of overlay content.\n *\n *   v1 (in-repo):  brain-seeds/<name>/ under the repo root.\n *   Graduation:    swap THIS body to clone/cache a remote seed/template repo and\n *                  return its local path. Callers stay agnostic to the source —\n *                  this is the single line that changes.\n *\n * Throws LocalCliError(SEED_NOT_FOUND) when the named seed dir is absent.\n */\nexport function resolveSeed(name: string): string {\n  const dir = path.join(resolveRepoRoot(), \"brain-seeds\", name);\n  if (!fs.existsSync(dir)) {\n    throw new LocalCliError({\n      code: \"SEED_NOT_FOUND\",\n      message: `--seed \"${name}\": no brain-seeds/${name}/ directory found.`,\n      hint: \"Seeds live under brain-seeds/. Check the name, or omit --seed for an unseeded brain.\",\n    });\n  }\n  return dir;\n}\n\n/**\n * Materialize a brain repo tree into destDir: copy the structural template,\n * then (if a seed is given) overlay the seed's content on top — seed wins on\n * every collision (fs.cpSync force:true; no merge). With no seedDir, the body\n * is exactly today's single cpSync → byte-identical no-seed guarantee.\n */\nexport function materializeBrainTree(opts: {\n  templateSrc: string;\n  destDir: string;\n  seedDir?: string;\n}): void {\n  fs.cpSync(opts.templateSrc, opts.destDir, { recursive: true });\n  if (opts.seedDir) {\n    fs.cpSync(opts.seedDir, opts.destDir, { recursive: true });\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { checkAppHealth, readAppSecrets } from \"@m8t-stack/github-app-auth\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { readAgentYaml } from \"../../lib/agent-yaml.js\";\nimport { isGhAuthed, ghAuthLoginDevice } from \"../../lib/gh-helpers.js\";\nimport { resolveAppInstallation } from \"../../lib/app-install.js\";\nimport { linkBrain } from \"../../lib/brain-link.js\";\nimport { discoverKvUri, resolveRepoRoot } from \"../../lib/brain-paths.js\";\n\nexport class BrainLinkCommand extends M8tCommand {\n  static paths = [[\"brain\", \"link\"]];\n  static usage = Command.Usage({\n    description: \"Link a worker to an existing brain repo. Idempotent.\",\n    details:\n      \"Installs the GitHub App on <repo> (browser click + poll), mints an installation token + PATCHes the Foundry connection, deploys a new agent version with the brain loader + tools[type:mcp] + metadata.brain JSON string, and pushes .m8t/brain.yaml to the repo. F1's PAT mode keeps working untouched.\",\n    examples: [\n      [\"Link cmo to orkeren21/cmo-brain\", \"$0 brain link cmo --repo orkeren21/cmo-brain\"],\n    ],\n  });\n\n  worker = Option.String();\n  repo = Option.String(\"--repo\");\n  branch = Option.String(\"--branch\");\n  kvUri = Option.String(\"--kv-uri\");\n  subscription = Option.String(\"--subscription\");\n  endpoint = Option.String(\"--endpoint\");\n  output = Option.String(\"--output\");\n  modelDeployment = Option.String(\"--model-deployment\");\n  personaPath = Option.String(\"--persona\");\n  allowNonReasoning = Option.Boolean(\"--allow-non-reasoning\", false);\n\n  async executeCommand(): Promise<number> {\n    const repo = typeof this.repo === \"string\" ? this.repo : undefined;\n    if (!repo) throw new LocalCliError({ code: \"USAGE\", message: \"--repo is required (owner/name)\" });\n    if (!repo.includes(\"/\")) throw new LocalCliError({ code: \"USAGE\", message: `--repo must be owner/name, got '${repo}'` });\n    const branch = this.branch ?? \"main\";\n    const env = (this.context.env ?? process.env) as Record<string, string | undefined>;\n    const kvUri = discoverKvUri(env, typeof this.kvUri === \"string\" ? this.kvUri : undefined);\n\n    // Normalize output: clipanion leaves a descriptor object on the property\n    // until argv parsing; when set directly in tests (or not supplied), treat\n    // anything that is not a plain string as \"pretty\" (our diagnostic default).\n    const outputFlag =\n      this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\"\n        ? (this.output as \"pretty\" | \"json\" | \"auto\")\n        : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n    const progress = mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    const credential = new DefaultAzureCredential();\n\n    // Pre-flight 1: gh auth\n    if (!(await isGhAuthed())) {\n      this.context.stdout.write(`${colors.hint(\"note:\")} gh not authed — running gh auth login --device --scopes \"repo,read:org\"\\n`);\n      await ghAuthLoginDevice();\n    }\n\n    // Pre-flight 2: inline check-app (silent if pass)\n    const health = await checkAppHealth({ credential, kvUri });\n    if (!health.ok) {\n      throw new LocalCliError({\n        code: \"APP_HEALTH_FAILED\",\n        message: \"GitHub App is not configured correctly.\",\n        hint: \"Run `m8t brain check-app` for details, then re-run this command.\",\n      });\n    }\n\n    // Pre-flight 3: resolve Foundry project (for ARM id)\n    const account = await getAzAccount();\n    const subscriptionId =\n      (typeof this.subscription === \"string\" ? this.subscription : undefined) ??\n      account.subscriptionId;\n    const agentEndpoint =\n      typeof this.worker === \"string\" ? readAgentYaml(this.worker)?.projectEndpoint : undefined;\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive: (this.context.stdout as NodeJS.WriteStream).isTTY === true,\n      endpoint: this.endpoint,\n      agentEndpoint,\n    });\n\n    // App install: probe-then-open + poll\n    const [owner, repoName] = repo.split(\"/\");\n    const { slug, appId, privateKeyPem } = await readAppSecrets({ credential, kvUri });\n    // Probe-then-open: skip browser when the App is already installed on this repo\n    // (Ordering 3 idempotent re-link). resolveAppInstallation handles both paths.\n    let alreadyInstalled = false;\n    const installationId = await resolveAppInstallation({\n      owner, repo: repoName, slug, appId, privateKeyPem,\n      write: (s) => {\n        this.context.stdout.write(`${colors.field(\"→\")} ${s}`);\n        this.context.stderr.write(`  ${colors.dim(\"waiting for installation (Ctrl-C to cancel)…\")}\\n`);\n      },\n      onAlreadyInstalled: (id) => {\n        alreadyInstalled = true;\n        this.context.stdout.write(`  ${colors.success(\"✓\")} App already installed on ${colors.field(repo)} (installation ${id}); skipping browser open.\\n`);\n      },\n      onTick: (n) => { if (n % 5 === 0) this.context.stderr.write(`  ${colors.dim(`…still waiting (${n * 2}s)`)}\\n`); },\n    });\n    if (!alreadyInstalled) {\n      this.context.stdout.write(`  ${colors.success(\"✓\")} installation detected (id: ${installationId})\\n`);\n    }\n\n    // The convergent link cascade\n    const result = await linkBrain({\n      credential, kvUri,\n      projectEndpoint: project.endpoint,\n      projectArmId: `${project.accountScope}/projects/${project.projectName}`,\n      agentName: this.worker!,\n      repo, branch,\n      repoRoot: resolveRepoRoot(),\n      installationId,\n      skipIfLinked: true,\n      onProgress: progress,\n      subscriptionId,\n      project,\n      modelDeployment: typeof this.modelDeployment === \"string\" ? this.modelDeployment : undefined,\n      personaPathOverride: typeof this.personaPath === \"string\" ? this.personaPath : undefined,\n      allowNonReasoning: this.allowNonReasoning === true,\n    });\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson({\n        worker: this.worker, repo, branch,\n        installationId: result.installationId,\n        connectionName: result.connectionName,\n        foundryVersion: result.foundryVersion,\n        alreadyLinked: result.alreadyLinked,\n      }) + \"\\n\");\n      return 0;\n    }\n\n    if (result.alreadyLinked) {\n      this.context.stdout.write(`${colors.success(\"✓\")} ${colors.field(this.worker!)} already linked to ${colors.field(repo)} (token rotated). No-op.\\n`);\n    } else {\n      this.context.stdout.write(`${colors.success(\"✓\")} linked ${colors.field(this.worker!)} ↔ ${colors.field(repo)} via App-mode (install ${installationId}, agent version ${result.foundryVersion}).\\n`);\n      this.context.stdout.write(`  ${colors.hint(\"brain doctrine:\")} https://github.com/${repo}/blob/${branch}/AGENTS.md\\n`);\n      this.context.stdout.write(`  ${colors.hint(\"token:\")} rotates lazily on every invoke (60min TTL, 10min safety margin).\\n`);\n    }\n    return 0;\n  }\n}\n","import { getRepoId, installUrl, tryOpenUrl, pollForInstallation, probeAppInstallation } from \"./gh-helpers.js\";\nimport { signAppJwt } from \"@m8t-stack/github-app-auth\";\n\n/**\n * Resolve the GitHub App installation id for a repo.\n *\n * 1. Probes once — fires `onAlreadyInstalled(id)` and returns immediately if\n *    the App is already installed.\n * 2. Otherwise: builds the install URL, calls `write` with the URL line,\n *    optionally opens a browser, then polls until the installation is detected\n *    (or times out).\n *\n * Shared by `m8t brain link` and `m8t coder deploy --brain`.\n */\nexport async function resolveAppInstallation(args: {\n  owner: string;\n  repo: string;\n  slug: string;\n  appId: string;\n  privateKeyPem: string;\n  /** Set to false to skip the tryOpenUrl call (e.g. in non-interactive / CI mode). */\n  openBrowser?: boolean;\n  /** Sink for user-facing messages (install URL line). */\n  write: (s: string) => void;\n  /** Called when the pre-probe finds an existing installation. Optional. */\n  onAlreadyInstalled?: (installationId: string) => void;\n  /** Called each poll tick. Optional. */\n  onTick?: (attempt: number) => void;\n}): Promise<string> {\n  // Pre-probe — one-shot, safe to use a single JWT.\n  const jwt = signAppJwt({ appId: args.appId, privateKeyPem: args.privateKeyPem });\n  const existing = await probeAppInstallation({ owner: args.owner, repo: args.repo, jwt });\n  if (existing) {\n    args.onAlreadyInstalled?.(existing);\n    return existing;\n  }\n\n  const repoId = await getRepoId(args.owner, args.repo);\n  const url = installUrl(args.slug, repoId);\n  args.write(`Install the m8t-brain App on ${args.owner}/${args.repo}:\\n  ${url}\\n`);\n  if (args.openBrowser !== false) await tryOpenUrl(url);\n\n  return pollForInstallation({\n    owner: args.owner,\n    repo: args.repo,\n    // Mint a fresh JWT on every tick — App JWTs are 10-min TTL, poll can run up to 5 min.\n    probe: () =>\n      probeAppInstallation({\n        owner: args.owner,\n        repo: args.repo,\n        jwt: signAppJwt({ appId: args.appId, privateKeyPem: args.privateKeyPem }),\n      }),\n    onTick: args.onTick,\n  });\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { listM8tAgents } from \"../../lib/foundry-discovery.js\";\nimport { parseBrainLink } from \"@m8t-stack/api-contract\";\n\nexport class BrainListCommand extends M8tCommand {\n  static paths = [[\"brain\", \"list\"]];\n  static usage = Command.Usage({ description: \"List brain-enabled workers + their repos.\" });\n\n  subscription = Option.String(\"--subscription\");\n  endpoint = Option.String(\"--endpoint\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    // Normalize output: clipanion leaves a descriptor object on the property\n    // until argv parsing; when set directly in tests (or not supplied), treat\n    // anything that is not a plain string as \"pretty\" (our diagnostic default).\n    const outputFlag =\n      this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\"\n        ? (this.output as \"pretty\" | \"json\" | \"auto\")\n        : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n\n    const credential = new DefaultAzureCredential();\n\n    // getAzAccount() fallback for subscriptionId (same pattern as Tasks 16-18).\n    const account = await getAzAccount();\n    const subscriptionId =\n      (typeof this.subscription === \"string\" ? this.subscription : undefined) ??\n      account.subscriptionId;\n\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive: (this.context.stdout as NodeJS.WriteStream).isTTY === true,\n      endpoint: typeof this.endpoint === \"string\" ? this.endpoint : undefined,\n    });\n\n    const all = await listM8tAgents({ credential, projectEndpoint: project.endpoint });\n    const brainEnabled = all\n      .map((a) => ({ ...a, brain: parseBrainLink(a.metadata) }))\n      .filter((a) => a.brain);\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(brainEnabled) + \"\\n\");\n      return 0;\n    }\n\n    if (brainEnabled.length === 0) {\n      this.context.stdout.write(`${colors.dim(\"No brain-enabled workers.\")}\\n`);\n      return 0;\n    }\n\n    for (const a of brainEnabled) {\n      const linkMode = a.brain!.installationId ? \"App\" : \"PAT\";\n      this.context.stdout.write(\n        `  ${colors.field(a.name)}  ↔  ${colors.field(a.brain!.repo)}  ${colors.dim(`(${linkMode}, conn ${a.brain!.credentialRef})`)}\\n`,\n      );\n    }\n    return 0;\n  }\n}\n","import { AIProjectClient } from \"@azure/ai-projects\";\nimport type { TokenCredential } from \"@azure/identity\";\n\nexport type DiscoveredAgent = {\n  name: string;\n  metadata: Record<string, string>;\n};\n\n// Wire shape of agent records yielded by project.agents.list().\n// The SDK's Agent type doesn't expose metadata — the actual REST payload does.\n// Mirrors the pattern in plugins/m8t-stack/server/src/foundry-client.ts.\ntype RawAgent = {\n  id?: string;\n  name?: string;\n  metadata?: Record<string, string>;\n  versions?: {\n    latest?: {\n      metadata?: Record<string, string>;\n    };\n  };\n};\n\n/** project.agents.list() filtered to metadata.source === \"m8t-stack-POC\". */\nexport async function listM8tAgents(args: {\n  credential: TokenCredential;\n  projectEndpoint: string;\n}): Promise<DiscoveredAgent[]> {\n  const project = new AIProjectClient(args.projectEndpoint, args.credential);\n  // Cast to the raw wire shape — the SDK types don't expose metadata at the\n  // top-level Agent, but the REST payload carries it there.\n  const iter = (project as unknown as {\n    agents: { list: () => AsyncIterable<RawAgent> };\n  }).agents.list();\n  const result: DiscoveredAgent[] = [];\n  for await (const raw of iter) {\n    if (!raw.name && !raw.id) continue;\n    const name = String(raw.name ?? raw.id);\n    const md = raw.metadata ?? raw.versions?.latest?.metadata ?? {};\n    if (md.source === \"m8t-stack-POC\") {\n      result.push({ name, metadata: md });\n    }\n  }\n  return result;\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { getAgentVersion } from \"../../lib/foundry-agent-get.js\";\nimport { readAgentYaml } from \"../../lib/agent-yaml.js\";\nimport { parseBrainLink, isAppMode } from \"@m8t-stack/api-contract\";\n\nexport class BrainShowCommand extends M8tCommand {\n  static paths = [[\"brain\", \"show\"]];\n  static usage = Command.Usage({ description: \"Show a worker's brain link + connection diagnostics.\" });\n\n  worker = Option.String();\n  subscription = Option.String(\"--subscription\");\n  endpoint = Option.String(\"--endpoint\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    // Normalize clipanion descriptor objects that appear when flags are unset in tests.\n    const worker = typeof this.worker === \"string\" ? this.worker : undefined;\n    if (!worker) {\n      throw new LocalCliError({ code: \"USAGE\", message: \"<worker> positional argument is required\" });\n    }\n\n    // Normalize output: clipanion leaves a descriptor object on the property\n    // until argv parsing; when set directly in tests (or not supplied), treat\n    // anything that is not a plain string as \"pretty\" (our diagnostic default).\n    const outputFlag =\n      this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\"\n        ? (this.output as \"pretty\" | \"json\" | \"auto\")\n        : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n\n    const credential = new DefaultAzureCredential();\n\n    // getAzAccount() fallback for subscriptionId (same pattern as Tasks 16-18).\n    const account = await getAzAccount();\n    const subscriptionId =\n      (typeof this.subscription === \"string\" ? this.subscription : undefined) ??\n      account.subscriptionId;\n\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive: (this.context.stdout as NodeJS.WriteStream).isTTY === true,\n      endpoint: typeof this.endpoint === \"string\" ? this.endpoint : undefined,\n    });\n\n    const agent = await getAgentVersion({\n      credential,\n      projectEndpoint: project.endpoint,\n      agentName: worker,\n    });\n\n    const link = parseBrainLink(agent.metadata as Record<string, string> | undefined);\n    if (!link) {\n      throw new LocalCliError({\n        code: \"NO_LINK\",\n        message: `'${worker}' has no metadata.brain — not brain-enabled.`,\n      });\n    }\n\n    const yaml = readAgentYaml(worker);\n    const data = {\n      worker,\n      mode: isAppMode(link) ? \"App\" : \"PAT\",\n      link,\n      yamlBrain: yaml?.brain ?? null,\n    };\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(data) + \"\\n\");\n      return 0;\n    }\n\n    this.context.stdout.write(`${colors.field(worker)} (${data.mode} mode)\\n`);\n    this.context.stdout.write(`  repo: ${link.repo} (${link.branch})\\n`);\n    this.context.stdout.write(`  connection: ${link.credentialRef}\\n`);\n    if (link.installationId) {\n      this.context.stdout.write(`  installation: ${link.installationId}\\n`);\n    }\n    if (yaml?.brain) {\n      this.context.stdout.write(`  linked at: ${yaml.brain.linkedAt}\\n`);\n    }\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { readAgentYaml } from \"../../lib/agent-yaml.js\";\nimport { unlinkBrain } from \"../../lib/brain-unlink.js\";\nimport { discoverKvUri } from \"../../lib/brain-paths.js\";\n\nexport class BrainUnlinkCommand extends M8tCommand {\n  static paths = [[\"brain\", \"unlink\"]];\n  static usage = Command.Usage({\n    description: \"Unlink a worker from its brain repo (cascade teardown).\",\n    details:\n      \"Re-deploys the agent without the brain loader + MCP tool, deletes the Foundry connection, and (unless --keep-app-install) uninstalls the GitHub App on the repo. The repo itself is NOT deleted.\",\n    examples: [\n      [\"Unlink cmo non-interactively\", \"$0 brain unlink cmo --yes\"],\n      [\"Unlink but keep the App install\", \"$0 brain unlink cmo --yes --keep-app-install\"],\n    ],\n  });\n\n  worker = Option.String();\n  yes = Option.Boolean(\"--yes\", false);\n  keepAppInstall = Option.Boolean(\"--keep-app-install\", false);\n  kvUri = Option.String(\"--kv-uri\");\n  subscription = Option.String(\"--subscription\");\n  endpoint = Option.String(\"--endpoint\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    // Normalize clipanion descriptor objects that appear when flags are unset in tests.\n    const worker = typeof this.worker === \"string\" ? this.worker : undefined;\n    if (!worker) {\n      throw new LocalCliError({ code: \"USAGE\", message: \"<worker> positional argument is required\" });\n    }\n\n    const env = (this.context.env ?? process.env) as Record<string, string | undefined>;\n    const kvUri = discoverKvUri(env, typeof this.kvUri === \"string\" ? this.kvUri : undefined);\n\n    // Normalize output: clipanion leaves a descriptor object on the property\n    // until argv parsing; when set directly in tests (or not supplied), treat\n    // anything that is not a plain string as \"pretty\" (our diagnostic default).\n    const outputFlag =\n      this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\"\n        ? (this.output as \"pretty\" | \"json\" | \"auto\")\n        : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n    const progress = mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    // Normalize booleans: clipanion leaves a descriptor object on the property\n    // until argv parsing; when set directly in tests, it's the actual boolean value.\n    // Only treat as true when it's literally `true` — anything else (descriptor, false) = false.\n    const yes = this.yes === true;\n    const keepAppInstall = this.keepAppInstall === true;\n\n    // Read per-agent yaml to surface the brain block early for the confirm message.\n    const yaml = readAgentYaml(worker);\n    if (!yaml?.brain) {\n      throw new LocalCliError({\n        code: \"BRAIN_NOT_LINKED\",\n        message: `Agent '${worker}' is not linked to a brain.`,\n        hint: \"Run 'm8t brain link' or 'm8t brain create' to establish a link first.\",\n      });\n    }\n    const { repo } = yaml.brain;\n\n    // Confirm gate: require --yes in non-TTY mode (interactive TTY prompt is deferred).\n    const isTTY = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    if (!yes) {\n      if (!isTTY) {\n        throw new LocalCliError({\n          code: \"UNLINK_NO_CONFIRM\",\n          message: `Refusing to unlink '${worker}' from '${repo}' without explicit confirmation. Pass --yes to confirm non-interactively.`,\n          hint: \"Pass --yes to unlink non-interactively, or re-run in a TTY.\",\n        });\n      }\n      // Interactive TTY prompt — deferred to a follow-up.\n      throw new LocalCliError({\n        code: \"INTERACTIVE_PROMPT_NOT_IMPLEMENTED\",\n        message: `Interactive confirm prompt not yet implemented. Pass --yes to confirm.`,\n        hint: \"Pass --yes to unlink non-interactively.\",\n      });\n    }\n\n    const credential = new DefaultAzureCredential();\n\n    // Resolve Foundry project for ARM id.\n    const account = await getAzAccount();\n    const subscriptionId =\n      (typeof this.subscription === \"string\" ? this.subscription : undefined) ??\n      account.subscriptionId;\n    const agentEndpoint = yaml.projectEndpoint;\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive: (this.context.stdout as NodeJS.WriteStream).isTTY === true,\n      endpoint: typeof this.endpoint === \"string\" ? this.endpoint : undefined,\n      agentEndpoint,\n    });\n\n    const result = await unlinkBrain({\n      credential,\n      kvUri,\n      projectEndpoint: project.endpoint,\n      projectArmId: `${project.accountScope}/projects/${project.projectName}`,\n      agentName: worker,\n      keepAppInstall,\n      onProgress: progress,\n    });\n\n    if (mode === \"json\") {\n      this.context.stdout.write(\n        renderJson({\n          worker,\n          repo,\n          foundryVersion: result.foundryVersion,\n          connectionDeleted: result.connectionDeleted,\n          appUninstalled: result.appUninstalled,\n        }) + \"\\n\",\n      );\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} unlinked ${colors.field(worker)} from ${colors.field(repo)}. Repo intact — run ${colors.field(`gh repo delete ${repo}`)} to remove it.\\n`,\n    );\n    if (!keepAppInstall && result.appUninstalled) {\n      this.context.stdout.write(\n        `  ${colors.hint(\"app install removed:\")} re-link anytime with \\`m8t brain link ${worker} --repo ${repo}\\` — no re-registration needed.\\n`,\n      );\n    } else if (keepAppInstall) {\n      this.context.stdout.write(\n        `  ${colors.hint(\"note:\")} App install kept (--keep-app-install). Run \\`m8t brain link ${worker} --repo ${repo}\\` to re-link.\\n`,\n      );\n    }\n    return 0;\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport type { TokenCredential } from \"@azure/identity\";\nimport { readAppSecrets, signAppJwt } from \"@m8t-stack/github-app-auth\";\nimport { LocalCliError } from \"./errors.js\";\nimport { readAgentYaml, patchAgentYaml } from \"./agent-yaml.js\";\nimport { renderPersonaBody } from \"./persona-render.js\";\nimport { stripBrainLoader } from \"./brain-loader-block.js\";\nimport { getAgentVersion, type AgentDefinition } from \"./foundry-agent-get.js\";\n\nconst FOUNDRY_ARM_API = \"2025-04-01-preview\";\nconst FOUNDRY_DATA_SCOPE = \"https://ai.azure.com/.default\";\nconst ARM_SCOPE = \"https://management.azure.com/.default\";\nconst GITHUB_APP_API = \"https://api.github.com\";\n\nexport type UnlinkBrainArgs = {\n  credential: TokenCredential;\n  kvUri: string;\n  projectEndpoint: string;   // data-plane URL\n  projectArmId: string;      // /subscriptions/.../projects/<proj>\n  agentName: string;\n  keepAppInstall: boolean;   // skip DELETE /app/installations/{id}\n  home?: string;             // for testing — defaults to os.homedir()\n  onProgress?: (msg: string) => void;\n};\n\nexport type UnlinkBrainResult = {\n  foundryVersion?: string;\n  connectionDeleted: boolean;\n  appUninstalled: boolean;\n};\n\n/**\n * The convergent unlink step (DESIGN §7.3).\n *\n * Caller (CLI command, Task 18) has already confirmed with the operator.\n * This function performs the cascade unconditionally:\n *\n *   1. Read current agent + parse metadata.brain for installationId + credentialRef.\n *   2. Re-render persona body WITHOUT the brain loader.\n *   3. createVersion with brain-stripped definition + metadata.brain = \"\"\n *      (Foundry's metadata is Record<string,string> — null is rejected; empty-string accepted).\n *   4. DELETE the Foundry connection. 404 = idempotent success.\n *   5. Unless keepAppInstall=true: DELETE /app/installations/{id} via App JWT. 404 = idempotent.\n *   6. Patch per-agent yaml: brain = null (removes the block).\n *\n * Repo is NOT touched — operator runs `gh repo delete` themselves if needed.\n */\nexport async function unlinkBrain(args: UnlinkBrainArgs): Promise<UnlinkBrainResult> {\n  const progress = args.onProgress ?? (() => {});\n\n  progress(\"Reading current agent definition…\");\n  const current = await getAgentVersion({\n    credential: args.credential,\n    projectEndpoint: args.projectEndpoint,\n    agentName: args.agentName,\n  });\n\n  const existingBrain = parseBrainMeta(current.metadata?.brain);\n  if (!existingBrain) {\n    throw new LocalCliError({\n      code: \"BRAIN_NOT_LINKED\",\n      message: `Agent '${args.agentName}' is not linked to a brain (metadata.brain is absent or invalid).`,\n      hint: `Run 'm8t brain link' to establish a link first.`,\n    });\n  }\n\n  const { installationId, credentialRef } = existingBrain;\n  const connectionName = credentialRef;\n\n  progress(\"Re-rendering persona body (without brain loader)…\");\n  const yaml = readAgentYaml(args.agentName, args.home);\n  let strippedInstructions: string;\n  if (yaml?.personaPath) {\n    let personaPath = yaml.personaPath;\n    if (!personaPath.startsWith(\"/\")) {\n      const marker = path.join(args.home ?? os.homedir(), \".m8t-stack\", \"repo-root\");\n      if (!fs.existsSync(marker)) {\n        throw new LocalCliError({\n          code: \"PERSONA_PATH_NOT_ABSOLUTE\",\n          message: `personaPath '${personaPath}' is relative and the repo-root marker is missing.`,\n          hint: \"Re-run 'm8t install' from a fresh m8t-stack checkout (writes ~/.m8t-stack/repo-root) — or edit the personaPath to absolute.\",\n        });\n      }\n      personaPath = path.join(fs.readFileSync(marker, \"utf8\").trim(), personaPath);\n    }\n    strippedInstructions = renderPersonaBody(personaPath, yaml.fillableFieldValues ?? {});\n  } else {\n    // No persona path (e.g. a brain linked via the deployed-instructions fallback,\n    // whose synthesized yaml has personaPath \"\"): strip the loader block from the\n    // deployed instructions instead of re-rendering from a persona file.\n    progress(\"No persona yaml — stripping the loader from the deployed instructions…\");\n    strippedInstructions = stripBrainLoader(current.definition.instructions ?? \"\");\n  }\n\n  progress(\"Deploying brain-stripped agent version…\");\n  const foundryVersion = await createBrainStrippedVersion({\n    credential: args.credential,\n    projectEndpoint: args.projectEndpoint,\n    agentName: args.agentName,\n    currentDefinition: current.definition,\n    currentMetadata: current.metadata ?? {},\n    strippedInstructions,\n  });\n\n  progress(\"Deleting Foundry connection…\");\n  const connectionDeleted = await deleteConnection({\n    credential: args.credential,\n    projectArmId: args.projectArmId,\n    connectionName,\n  });\n\n  let appUninstalled = false;\n  if (!args.keepAppInstall) {\n    progress(`Uninstalling GitHub App installation ${installationId}…`);\n    appUninstalled = await uninstallApp({\n      credential: args.credential,\n      kvUri: args.kvUri,\n      installationId,\n    });\n  }\n\n  if (yaml) {\n    progress(\"Clearing brain block from per-agent yaml…\");\n    patchAgentYaml(args.agentName, { brain: null }, args.home);\n  }\n\n  return { foundryVersion, connectionDeleted, appUninstalled };\n}\n\n// ──── helpers ───────────────────────────────────────────────────────────────\n\ntype BrainMeta = {\n  installationId: string;\n  credentialRef: string;\n  [key: string]: unknown;\n};\n\nfunction parseBrainMeta(raw: string | undefined): BrainMeta | undefined {\n  if (!raw) return undefined;\n  try {\n    const parsed = JSON.parse(raw) as Record<string, unknown>;\n    if (\n      typeof parsed.installationId === \"string\" &&\n      typeof parsed.credentialRef === \"string\"\n    ) {\n      return parsed as BrainMeta;\n    }\n    return undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function createBrainStrippedVersion(args: {\n  credential: TokenCredential;\n  projectEndpoint: string;\n  agentName: string;\n  currentDefinition: AgentDefinition;\n  currentMetadata: Record<string, string>;\n  strippedInstructions: string;\n}): Promise<string> {\n  const fndToken = await args.credential.getToken(FOUNDRY_DATA_SCOPE);\n  if (!fndToken?.token) {\n    throw new LocalCliError({ code: \"FOUNDRY_AUTH\", message: \"Could not acquire Foundry data-plane token\" });\n  }\n  // Strip the brain mcp tool; keep everything else.\n  const otherTools = (args.currentDefinition.tools ?? []).filter(\n    (t) => !(t.type === \"mcp\" && (t as { server_label?: string }).server_label === \"brain\"),\n  );\n  const definition: AgentDefinition = {\n    ...args.currentDefinition,\n    instructions: args.strippedInstructions,\n    tools: otherTools,\n  };\n  // Empty-string is the correct way to clear a Foundry string metadata field\n  // (null is rejected by the API; omitting the key leaves the old value).\n  const metadata: Record<string, string> = {\n    ...args.currentMetadata,\n    brain: \"\",\n  };\n  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: { Authorization: `Bearer ${fndToken.token}`, \"Content-Type\": \"application/json\" },\n    body: JSON.stringify({ definition, metadata }),\n  });\n  if (!res.ok) {\n    const text = await res.text();\n    throw new LocalCliError({\n      code: \"AGENT_CREATE_VERSION_FAILED\",\n      message: `POST ${url}: HTTP ${res.status}\\n${text.slice(0, 500)}`,\n    });\n  }\n  const data = (await res.json()) as { version?: string };\n  if (!data.version) {\n    throw new LocalCliError({\n      code: \"AGENT_REDEPLOY_NO_VERSION\",\n      message: \"createVersion returned no version\",\n    });\n  }\n  return data.version;\n}\n\nasync function deleteConnection(args: {\n  credential: TokenCredential;\n  projectArmId: string;\n  connectionName: string;\n}): Promise<boolean> {\n  const armToken = await args.credential.getToken(ARM_SCOPE);\n  if (!armToken?.token) {\n    throw new LocalCliError({ code: \"ARM_AUTH\", message: \"Could not acquire ARM token\" });\n  }\n  const url = `https://management.azure.com${args.projectArmId}/connections/${args.connectionName}?api-version=${FOUNDRY_ARM_API}`;\n  const res = await fetch(url, {\n    method: \"DELETE\",\n    headers: { Authorization: `Bearer ${armToken.token}` },\n  });\n  // 404 = already gone — idempotent success.\n  if (res.ok || res.status === 404) return true;\n  const text = await res.text();\n  throw new LocalCliError({\n    code: \"CONN_DELETE_FAILED\",\n    message: `DELETE ${url}: HTTP ${res.status}\\n${text.slice(0, 300)}`,\n  });\n}\n\nasync function uninstallApp(args: {\n  credential: TokenCredential;\n  kvUri: string;\n  installationId: string;\n}): Promise<boolean> {\n  const secrets = await readAppSecrets({ credential: args.credential, kvUri: args.kvUri });\n  const jwt = signAppJwt({ appId: secrets.appId, privateKeyPem: secrets.privateKeyPem });\n  const url = `${GITHUB_APP_API}/app/installations/${args.installationId}`;\n  const res = await fetch(url, {\n    method: \"DELETE\",\n    headers: {\n      Authorization: `Bearer ${jwt}`,\n      Accept: \"application/vnd.github+json\",\n      \"X-GitHub-Api-Version\": \"2022-11-28\",\n    },\n  });\n  // 404 = already uninstalled — idempotent success.\n  if (res.ok || res.status === 404) return true;\n  const text = await res.text();\n  throw new LocalCliError({\n    code: \"APP_UNINSTALL_FAILED\",\n    message: `DELETE ${url}: HTTP ${res.status}\\n${text.slice(0, 300)}`,\n  });\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { readAgentYaml } from \"../../lib/agent-yaml.js\";\nimport { discoverKvUri } from \"../../lib/brain-paths.js\";\nimport { resolveGatewayContext } from \"../../lib/gateway-context.js\";\nimport {\n  planAgentRemoval,\n  executeAgentRemoval,\n  defaultRemoveAgentDeps,\n  type RemoveOpts,\n} from \"../../lib/agent-remove.js\";\n\nexport class AgentRemoveCommand extends M8tCommand {\n  static paths = [[\"agent\", \"remove\"]];\n  static usage = Command.Usage({\n    description: \"Cascade-remove an agent and all its associated resources.\",\n    details:\n      \"Removes, in order: channel bindings (table row + KV secret + conversations), a2a connection, brain connection (GitHub repo kept by default), the agent itself, and its local yaml. Idempotent and partial-failure resilient.\",\n    examples: [\n      [\"Remove an agent non-interactively\", \"$0 agent remove my-agent --yes\"],\n      [\"Remove and also delete the brain repo\", \"$0 agent remove my-agent --yes --delete-brain-repo\"],\n      [\"Remove without touching bindings\", \"$0 agent remove my-agent --yes --keep-bindings\"],\n    ],\n  });\n\n  name = Option.String();\n  yes = Option.Boolean(\"--yes\", false);\n  keepBindings = Option.Boolean(\"--keep-bindings\", false);\n  keepA2a = Option.Boolean(\"--keep-a2a\", false);\n  deleteBrainRepo = Option.Boolean(\"--delete-brain-repo\", false);\n  endpoint = Option.String(\"--endpoint\");\n  subscription = Option.String(\"--subscription\");\n  kvUri = Option.String(\"--kv-uri\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    // Normalize clipanion descriptor objects that appear when flags are unset in tests.\n    const name = typeof this.name === \"string\" ? this.name : undefined;\n    if (!name) {\n      throw new LocalCliError({ code: \"USAGE\", message: \"<name> positional argument is required\" });\n    }\n\n    const outputFlag =\n      this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\"\n        ? (this.output as \"pretty\" | \"json\" | \"auto\")\n        : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n    const progress =\n      mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    const isTTY = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    const yes = this.yes === true;\n    const keepBindings = this.keepBindings === true;\n    const keepA2a = this.keepA2a === true;\n    const deleteBrainRepo = this.deleteBrainRepo === true;\n\n    const env = (this.context.env ?? process.env) as Record<string, string | undefined>;\n    const kvUriOverride = typeof this.kvUri === \"string\" ? this.kvUri : undefined;\n    // resolveKvUri is a thunk — only called when unlinkBrain actually runs,\n    // so agents with no brain never trigger KV_URI_NOT_FOUND at startup.\n    const resolveKvUri = () => discoverKvUri(env, kvUriOverride);\n\n    const credential = new DefaultAzureCredential();\n    const account = await getAzAccount();\n    const subscriptionId =\n      (typeof this.subscription === \"string\" ? this.subscription : undefined) ??\n      account.subscriptionId;\n\n    // Use per-agent yaml to narrow project discovery (skip interactive for known endpoints).\n    const agentYaml = readAgentYaml(name);\n    const agentEndpoint = agentYaml?.projectEndpoint;\n\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive: isTTY,\n      endpoint: typeof this.endpoint === \"string\" ? this.endpoint : undefined,\n      agentEndpoint,\n    });\n\n    const gatewayCtx = await resolveGatewayContext({\n      interactive: isTTY,\n      subscriptionId,\n    });\n\n    const deps = defaultRemoveAgentDeps({\n      credential,\n      project,\n      resolveKvUri,\n      gatewayCtx,\n      home: undefined,\n      onProgress: progress,\n    });\n\n    const plan = await planAgentRemoval(name, deps);\n\n    // ── confirm gate ──────────────────────────────────────────────────────────\n    if (!yes) {\n      // Build a human-readable list of what will happen\n      const items: string[] = [];\n      if (!keepBindings && plan.bindings.length > 0) {\n        const bSummary = plan.bindings.map((b) => `${b.channel}:${b.bindingId}`).join(\", \");\n        items.push(`${plan.bindings.length} binding(s) [${bSummary}]`);\n      }\n      if (plan.hasA2a && !keepA2a) items.push(\"a2a connection\");\n      if (plan.hasBrain) {\n        const repoNote = plan.brainRepo\n          ? `repo ${plan.brainRepo} KEPT — pass --delete-brain-repo to delete`\n          : \"brain connection\";\n        items.push(`brain connection (${repoNote})`);\n      }\n      if (plan.agentExists) items.push(`the ${plan.kind ?? \"unknown\"} agent`);\n      items.push(\"local yaml\");\n\n      const itemList = items.length > 0 ? items.map((i) => `  - ${i}`).join(\"\\n\") : \"  (nothing to remove)\";\n      this.context.stderr.write(\n        `Will remove for ${colors.field(name)}:\\n${itemList}\\n\\n`,\n      );\n\n      if (!isTTY) {\n        throw new LocalCliError({\n          code: \"REMOVE_NO_CONFIRM\",\n          message: `Refusing to remove '${name}' without explicit confirmation. Pass --yes to confirm non-interactively.`,\n          hint: \"Pass --yes to remove non-interactively, or re-run in a TTY.\",\n        });\n      }\n      // Interactive TTY prompt deferred — mirror brain/unlink.ts pattern.\n      throw new LocalCliError({\n        code: \"INTERACTIVE_PROMPT_NOT_IMPLEMENTED\",\n        message: \"Interactive confirm prompt not yet implemented. Pass --yes to confirm.\",\n        hint: \"Pass --yes to remove non-interactively.\",\n      });\n    }\n\n    // ── execute cascade ───────────────────────────────────────────────────────\n    const opts: RemoveOpts = { keepBindings, keepA2a, deleteBrainRepo };\n    const { steps } = await executeAgentRemoval(plan, opts, deps);\n\n    // ── render ────────────────────────────────────────────────────────────────\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson({ agentName: name, steps }) + \"\\n\");\n      return steps.some((s) => s.status === \"failed\") ? 1 : 0;\n    }\n\n    for (const step of steps) {\n      if (step.status === \"ok\") {\n        this.context.stdout.write(`  ${colors.success(\"✓\")} ${step.name}\\n`);\n      } else if (step.status === \"skipped\") {\n        this.context.stdout.write(`  ${colors.hint(\"·\")} ${step.name} ${colors.hint(`(${step.detail ?? \"skipped\"})`)}\\n`);\n      } else {\n        this.context.stderr.write(\n          `  ${colors.error(\"✗\")} ${step.name}: ${step.detail ?? \"failed\"}\\n`,\n        );\n      }\n    }\n\n    const failedSteps = steps.filter((s) => s.status === \"failed\");\n    if (failedSteps.length > 0) {\n      this.context.stderr.write(\n        `\\n${colors.error(\"✗\")} ${failedSteps.length} step(s) failed. Re-run 'm8t agent remove ${name} --yes' to retry the failed steps.\\n`,\n      );\n      return 1;\n    }\n\n    this.context.stdout.write(`\\n${colors.success(\"✓\")} removed ${colors.field(name)}.\\n`);\n    return 0;\n  }\n}\n","import * as fs from \"node:fs\";\nimport { spawnSync } from \"node:child_process\";\nimport type { TokenCredential } from \"@azure/identity\";\nimport { LocalCliError } from \"./errors.js\";\nimport { getAgentVersion } from \"./foundry-agent-get.js\";\nimport { disableA2a } from \"./a2a-enable.js\";\nimport { unlinkBrain } from \"./brain-unlink.js\";\nimport { deleteAgent } from \"./foundry-agents.js\";\nimport { agentYamlPath, readAgentYaml } from \"./agent-yaml.js\";\nimport { apiCall, type ApiClientOptions } from \"./api-client.js\";\nimport { resolveFoundryProject, type FoundryProject } from \"./foundry-project.js\";\n\n// ──── public types ─────────────────────────────────────────────────────────────\n\nexport type RemovePlan = {\n  agentName: string;\n  agentExists: boolean;\n  kind?: \"prompt\" | \"hosted\";\n  hasBrain: boolean;\n  hasA2a: boolean;\n  brainRepo?: string;\n  bindings: Array<{ channel: string; bindingId: string }>;\n};\n\nexport type RemoveOpts = {\n  keepBindings: boolean;\n  keepA2a: boolean;\n  deleteBrainRepo: boolean;\n};\n\nexport type StepResult = {\n  name: string;\n  status: \"ok\" | \"skipped\" | \"failed\";\n  detail?: string;\n};\n\nexport type RemoveAgentDeps = {\n  getAgent: (agentName: string) => Promise<{\n    exists: boolean;\n    kind?: \"prompt\" | \"hosted\";\n    hasBrain: boolean;\n    hasA2a: boolean;\n    brainRepo?: string;\n  }>;\n  listAgentBindings: (agentName: string) => Promise<Array<{ channel: string; bindingId: string }>>;\n  deleteBinding: (bindingId: string) => Promise<void>;\n  disableA2a: (agentName: string) => Promise<void>;\n  unlinkBrain: (agentName: string) => Promise<void>;\n  deleteAgent: (agentName: string) => Promise<void>;\n  deleteBrainRepo: (repo: string) => Promise<void>;\n  removeLocalYaml: (agentName: string) => void;\n  onProgress?: (m: string) => void;\n};\n\n// ──── plan phase (read-only) ───────────────────────────────────────────────────\n\n/**\n * Build a plan describing what will be removed. No mutations.\n * Bindings are always listed (they can outlive the agent).\n * When the agent is not found, hasBrain/hasA2a are set to false.\n */\nexport async function planAgentRemoval(\n  agentName: string,\n  deps: RemoveAgentDeps,\n): Promise<RemovePlan> {\n  const [agent, bindings] = await Promise.all([\n    deps.getAgent(agentName),\n    deps.listAgentBindings(agentName),\n  ]);\n\n  return {\n    agentName,\n    agentExists: agent.exists,\n    kind: agent.kind,\n    hasBrain: agent.hasBrain,\n    hasA2a: agent.hasA2a,\n    brainRepo: agent.brainRepo,\n    bindings,\n  };\n}\n\n// ──── execute phase (mutating cascade) ────────────────────────────────────────\n\n/**\n * Execute the removal cascade in order: bindings → a2a → brain (+repo) → agent → local yaml.\n * Each step is wrapped in its own try/catch so one failure does not abort the rest.\n * Returns the results of every step.\n */\nexport async function executeAgentRemoval(\n  plan: RemovePlan,\n  opts: RemoveOpts,\n  deps: RemoveAgentDeps,\n): Promise<{ steps: StepResult[] }> {\n  const steps: StepResult[] = [];\n  const progress = deps.onProgress ?? (() => {});\n\n  // ── bindings ─────────────────────────────────────────────────────────────────\n  if (opts.keepBindings) {\n    steps.push({ name: \"bindings\", status: \"skipped\", detail: \"--keep-bindings\" });\n  } else if (plan.bindings.length === 0) {\n    steps.push({ name: \"bindings\", status: \"skipped\", detail: \"no bindings\" });\n  } else {\n    for (const b of plan.bindings) {\n      const stepName = `binding:${b.channel}:${b.bindingId}`;\n      try {\n        progress(`Deleting binding ${b.bindingId} (${b.channel})…`);\n        await deps.deleteBinding(b.bindingId);\n        steps.push({ name: stepName, status: \"ok\" });\n      } catch (e) {\n        steps.push({ name: stepName, status: \"failed\", detail: String((e as Error).message ?? e) });\n      }\n    }\n  }\n\n  // ── a2a connection ────────────────────────────────────────────────────────────\n  if (!plan.hasA2a || opts.keepA2a) {\n    steps.push({ name: \"a2a\", status: \"skipped\", detail: !plan.hasA2a ? \"no a2a\" : \"--keep-a2a\" });\n  } else if (!plan.agentExists) {\n    steps.push({ name: \"a2a\", status: \"skipped\", detail: \"agent not found\" });\n  } else if (plan.kind === \"hosted\") {\n    // Hosted a2a is metadata-only — no Foundry connection to delete.\n    // The metadata is removed when the agent itself is deleted.\n    steps.push({ name: \"a2a\", status: \"skipped\", detail: \"hosted: a2a is metadata-only, removed with the agent\" });\n  } else {\n    try {\n      progress(\"Disabling a2a…\");\n      await deps.disableA2a(plan.agentName);\n      steps.push({ name: \"a2a\", status: \"ok\" });\n    } catch (e) {\n      steps.push({ name: \"a2a\", status: \"failed\", detail: String((e as Error).message ?? e) });\n    }\n  }\n\n  // ── brain connection ──────────────────────────────────────────────────────────\n  if (!plan.hasBrain) {\n    steps.push({ name: \"brain\", status: \"skipped\", detail: \"no brain\" });\n  } else if (!plan.agentExists) {\n    steps.push({ name: \"brain\", status: \"skipped\", detail: \"agent not found\" });\n  } else if (plan.kind === \"hosted\") {\n    // Hosted brain is in-container — no Foundry connection to delete.\n    // The in-container credential dies with the agent; the GitHub App is org-wide\n    // and must not be uninstalled here.\n    steps.push({ name: \"brain\", status: \"skipped\", detail: \"hosted: in-container brain removed with the agent\" });\n\n    // The GitHub repo, however, persists and can be explicitly cleaned up.\n    if (opts.deleteBrainRepo && plan.brainRepo) {\n      try {\n        progress(`Deleting brain repo ${plan.brainRepo}…`);\n        await deps.deleteBrainRepo(plan.brainRepo);\n        steps.push({ name: \"brain-repo\", status: \"ok\" });\n      } catch (e) {\n        steps.push({ name: \"brain-repo\", status: \"failed\", detail: String((e as Error).message ?? e) });\n      }\n    }\n  } else {\n    let brainUnlinked = false;\n    try {\n      progress(\"Unlinking brain…\");\n      await deps.unlinkBrain(plan.agentName);\n      steps.push({ name: \"brain\", status: \"ok\" });\n      brainUnlinked = true;\n    } catch (e) {\n      steps.push({ name: \"brain\", status: \"failed\", detail: String((e as Error).message ?? e) });\n    }\n\n    // brain-repo deletion is separate so it can fail independently,\n    // but ONLY attempted when the unlink succeeded.\n    if (opts.deleteBrainRepo && plan.brainRepo && brainUnlinked) {\n      try {\n        progress(`Deleting brain repo ${plan.brainRepo}…`);\n        await deps.deleteBrainRepo(plan.brainRepo);\n        steps.push({ name: \"brain-repo\", status: \"ok\" });\n      } catch (e) {\n        steps.push({ name: \"brain-repo\", status: \"failed\", detail: String((e as Error).message ?? e) });\n      }\n    }\n  }\n\n  // ── agent ─────────────────────────────────────────────────────────────────────\n  if (!plan.agentExists) {\n    steps.push({ name: \"agent\", status: \"skipped\", detail: \"already gone\" });\n  } else {\n    try {\n      progress(`Deleting agent ${plan.agentName}…`);\n      await deps.deleteAgent(plan.agentName);\n      steps.push({ name: \"agent\", status: \"ok\" });\n    } catch (e) {\n      steps.push({ name: \"agent\", status: \"failed\", detail: String((e as Error).message ?? e) });\n    }\n  }\n\n  // ── local yaml (always, idempotent) ──────────────────────────────────────────\n  try {\n    deps.removeLocalYaml(plan.agentName);\n    steps.push({ name: \"yaml\", status: \"ok\" });\n  } catch (e) {\n    steps.push({ name: \"yaml\", status: \"failed\", detail: String((e as Error).message ?? e) });\n  }\n\n  return { steps };\n}\n\n// ──── gateway bindings shape ──────────────────────────────────────────────────\n\ntype BindingRecord = {\n  bindingId: string;\n  channel: string;\n  agentName: string;\n  status: string;\n};\n\ntype BindingListResponse = { bindings: BindingRecord[] };\n\n// ──── default deps factory ────────────────────────────────────────────────────\n\nexport type DefaultRemoveAgentDepsArgs = {\n  credential: TokenCredential;\n  project: FoundryProject;\n  /** Called lazily — only when unlinkBrain actually runs. Allows no-brain removals\n   *  to skip the Key Vault URI check entirely. */\n  resolveKvUri: () => string;\n  gatewayCtx: ApiClientOptions;\n  home?: string;\n  onProgress?: (m: string) => void;\n};\n\nexport function defaultRemoveAgentDeps(args: DefaultRemoveAgentDepsArgs): RemoveAgentDeps {\n  const { credential, project, resolveKvUri, gatewayCtx, home, onProgress } = args;\n  const projectEndpoint = project.endpoint;\n  const projectArmId = `${project.accountScope}/projects/${project.projectName}`;\n\n  return {\n    onProgress,\n\n    async getAgent(agentName: string) {\n      try {\n        const rec = await getAgentVersion({ credential, projectEndpoint, agentName });\n        const meta = rec.metadata ?? {};\n        const hasBrain = !!(meta.brain && meta.brain !== \"\");\n        const hasA2a = meta.a2a === \"true\";\n        let brainRepo: string | undefined;\n        if (hasBrain) {\n          try {\n            brainRepo = (JSON.parse(meta.brain) as { repo?: string }).repo;\n          } catch {\n            // malformed brain meta — treat as no repo\n          }\n        }\n        return {\n          exists: true,\n          kind: rec.definition.kind,\n          hasBrain,\n          hasA2a,\n          brainRepo,\n        };\n      } catch (e) {\n        if (e instanceof LocalCliError && e.code === \"AGENT_NOT_FOUND\") {\n          return { exists: false, hasBrain: false, hasA2a: false };\n        }\n        throw e;\n      }\n    },\n\n    async listAgentBindings(agentName: string) {\n      const data = await apiCall<BindingListResponse>(gatewayCtx, { method: \"GET\", path: \"/api/bindings\" });\n      return (data.bindings ?? [])\n        .filter((b) => b.agentName === agentName)\n        .map((b) => ({ channel: b.channel, bindingId: b.bindingId }));\n    },\n\n    async deleteBinding(bindingId: string) {\n      await apiCall<unknown>(gatewayCtx, {\n        method: \"DELETE\",\n        path: `/api/bindings/${encodeURIComponent(bindingId)}`,\n      });\n    },\n\n    async disableA2a(agentName: string) {\n      await disableA2a({\n        credential,\n        projectEndpoint,\n        projectArmId,\n        agentName,\n        onProgress,\n      });\n    },\n\n    async unlinkBrain(agentName: string) {\n      await unlinkBrain({\n        credential,\n        kvUri: resolveKvUri(),\n        projectEndpoint,\n        projectArmId,\n        agentName,\n        keepAppInstall: true,\n        home,\n        onProgress,\n      });\n    },\n\n    async deleteAgent(agentName: string) {\n      await deleteAgent({ credential, endpoint: projectEndpoint, name: agentName });\n    },\n\n    async deleteBrainRepo(repo: string) {\n      const result = spawnSync(\"gh\", [\"repo\", \"delete\", repo, \"--yes\"], { encoding: \"utf8\" });\n      if (result.status !== 0) {\n        throw new Error(result.stderr?.trim() || `gh repo delete exited with code ${result.status}`);\n      }\n    },\n\n    removeLocalYaml(agentName: string) {\n      const p = agentYamlPath(agentName, home);\n      if (fs.existsSync(p)) fs.rmSync(p);\n    },\n  };\n}\n\n// Re-export resolveFoundryProject for consumers that need it\nexport { resolveFoundryProject };\n\n// Re-export readAgentYaml for the command\nexport { readAgentYaml };\n","import { randomBytes, createHash } from \"node:crypto\";\nimport type { TokenCredential } from \"@azure/identity\";\nimport { LocalCliError } from \"./errors.js\";\nimport { getAgentVersion, type AgentDefinition } from \"./foundry-agent-get.js\";\nimport { readPersonaA2aCard } from \"./persona-a2a.js\";\n\nconst FOUNDRY_ARM_API = \"2025-04-01-preview\";\nconst FOUNDRY_DATA_SCOPE = \"https://ai.azure.com/.default\";\nconst ARM_SCOPE = \"https://management.azure.com/.default\";\nconst A2A_TOOLS = [\"discover_workers\", \"invoke_worker\", \"check_delegation\"];\nconst SNIPPET_START = \"<!-- m8t:a2a:start -->\";\nconst SNIPPET_END = \"<!-- m8t:a2a:end -->\";\n\nconst DELEGATE_SNIPPET = `${SNIPPET_START}\n## Working with other workers\nYou can delegate to other m8t workers. Before you do:\n1. Call \\`discover_workers\\` to see who's available now — each entry's card says what\n   the worker is for, when to delegate to it, and what it accepts and returns.\n2. If one is a clear fit, call \\`invoke_worker(target, task)\\` — \\`target\\` is the name\n   from the directory; \\`task\\` is a complete, self-contained instruction (the worker\n   can't ask follow-ups mid-task).\n3. If invoke_worker returns status \"in_progress\" with a taskId, the worker is taking\n   a while — call \\`check_delegation(taskId)\\` to fetch the result, repeating until the\n   status is no longer \"in_progress\".\n4. Fold the worker's result into your own answer.\nDelegate only when another worker is genuinely better suited; otherwise answer\ndirectly. Don't re-delegate the same request in a loop.\n${SNIPPET_END}`;\n\nexport type EnableA2aArgs = {\n  credential: TokenCredential;\n  projectEndpoint: string;\n  projectArmId: string;\n  agentName: string;\n  personaPath: string;\n  bridgeUrl: string;\n  onProgress?: (m: string) => void;\n};\nexport type EnableA2aResult = { mode: \"caller\" | \"target\"; connectionName?: string; foundryVersion: string };\n\nexport async function enableA2a(args: EnableA2aArgs): Promise<EnableA2aResult> {\n  const progress = args.onProgress ?? (() => {});\n  const connectionName = `a2a-${args.agentName}`;\n\n  progress(\"Reading persona a2a-card…\");\n  const { serialized: a2aCardJson } = readPersonaA2aCard(args.personaPath);\n\n  progress(\"Reading current agent definition…\");\n  const current = await getAgentVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName });\n\n  if (current.definition.kind === \"hosted\") {\n    // Hosted agents are callees only — they can't call the bridge, so they get NO\n    // caller machinery (no bearer, no connection, no a2a tool, no snippet). We only\n    // register them as a discoverable TARGET: set a2a + a2aCard metadata and clone\n    // the definition unchanged (preserving the container spec).\n    progress(\"Registering the hosted target (metadata only)…\");\n    const metadata: Record<string, string> = { ...(current.metadata ?? {}), a2a: \"true\", a2aCard: a2aCardJson };\n    // Hosted-agent version operations are preview-gated — the data-plane rejects\n    // them (403 preview_feature_required) without this header.\n    const foundryVersion = await createVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition: current.definition, metadata, extraHeaders: { \"Foundry-Features\": \"HostedAgents=V1Preview\" } });\n    return { mode: \"target\", foundryVersion };\n  }\n  if (current.definition.kind !== \"prompt\") {\n    throw new LocalCliError({\n      code: \"A2A_NOT_PROMPT\",\n      message: `Agent '${args.agentName}' is kind '${current.definition.kind}'. Agent-to-agent enablement supports prompt agents (callers) and hosted agents (callees); '${current.definition.kind}' is neither.`,\n    });\n  }\n\n  const bearer = `a2a_${randomBytes(32).toString(\"base64url\")}`;\n  const bearerHash = createHash(\"sha256\").update(bearer).digest(\"hex\");\n\n  progress(\"Provisioning the A2A connection…\");\n  await putA2aConnection({ credential: args.credential, projectArmId: args.projectArmId, connectionName, target: args.bridgeUrl, bearer });\n\n  progress(\"Deploying the a2a-enabled agent version…\");\n  const definition: AgentDefinition = {\n    ...current.definition,\n    instructions: appendSnippet(current.definition.instructions ?? \"\"),\n    tools: withA2aTool(current.definition.tools ?? [], args.bridgeUrl, connectionName),\n  };\n  const metadata: Record<string, string> = {\n    ...(current.metadata ?? {}),\n    a2a: \"true\",\n    a2aCard: a2aCardJson,\n    a2aBearerHash: bearerHash,\n  };\n  const foundryVersion = await createVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition, metadata });\n  return { mode: \"caller\", connectionName, foundryVersion };\n}\n\nexport type DisableA2aArgs = {\n  credential: TokenCredential;\n  projectEndpoint: string;\n  projectArmId: string;\n  agentName: string;\n  onProgress?: (m: string) => void;\n};\n\nexport async function disableA2a(args: DisableA2aArgs): Promise<{ connectionName: string; foundryVersion?: string }> {\n  const progress = args.onProgress ?? (() => {});\n  const connectionName = `a2a-${args.agentName}`;\n  const current = await getAgentVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName });\n\n  progress(\"Removing the a2a tool + metadata…\");\n  const tools = (current.definition.tools ?? []).filter(\n    (t) => !((t as { type?: string }).type === \"mcp\" && (t as { server_label?: string }).server_label === \"a2a\"),\n  );\n  const definition: AgentDefinition = { ...current.definition, instructions: stripSnippet(current.definition.instructions ?? \"\"), tools };\n  const metadata: Record<string, string> = { ...(current.metadata ?? {}) };\n  delete metadata.a2a;\n  delete metadata.a2aCard;\n  delete metadata.a2aBearerHash;\n  const foundryVersion = await createVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition, metadata });\n\n  progress(\"Deleting the A2A connection…\");\n  await deleteConnection({ credential: args.credential, projectArmId: args.projectArmId, connectionName }); // best-effort\n  return { connectionName, foundryVersion };\n}\n\n// ──── pure helpers (exported for tests) ───────────────────────────────────────\n\nexport function appendSnippet(instructions: string): string {\n  return `${stripSnippet(instructions).replace(/\\s+$/, \"\")}\\n\\n${DELEGATE_SNIPPET}`;\n}\n\nexport function stripSnippet(instructions: string): string {\n  const re = new RegExp(`\\\\n*${esc(SNIPPET_START)}[\\\\s\\\\S]*?${esc(SNIPPET_END)}\\\\n*`, \"g\");\n  return instructions.replace(re, \"\\n\").replace(/\\s+$/, \"\");\n}\n\nexport function withA2aTool(\n  tools: NonNullable<AgentDefinition[\"tools\"]>,\n  bridgeUrl: string,\n  connectionName: string,\n): NonNullable<AgentDefinition[\"tools\"]> {\n  const others = (tools ?? []).filter(\n    (t) => !((t as { type?: string }).type === \"mcp\" && (t as { server_label?: string }).server_label === \"a2a\"),\n  );\n  return [\n    ...others,\n    { type: \"mcp\", server_label: \"a2a\", server_url: bridgeUrl, allowed_tools: A2A_TOOLS, require_approval: \"never\", project_connection_id: connectionName },\n  ];\n}\n\nfunction esc(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n// ──── ARM / Foundry calls ─────────────────────────────────────────────────────\n\nasync function putA2aConnection(args: { credential: TokenCredential; projectArmId: string; connectionName: string; target: string; bearer: string }): Promise<void> {\n  const token = await args.credential.getToken(ARM_SCOPE);\n  if (!token?.token) throw new LocalCliError({ code: \"ARM_AUTH\", message: \"Could not acquire ARM token\" });\n  const url = `https://management.azure.com${args.projectArmId}/connections/${args.connectionName}?api-version=${FOUNDRY_ARM_API}`;\n  const body = JSON.stringify({\n    properties: {\n      authType: \"CustomKeys\",\n      category: \"CustomKeys\",\n      target: args.target,\n      isSharedToAll: false,\n      credentials: { keys: { Authorization: `Bearer ${args.bearer}` } },\n      metadata: { managedBy: \"m8t-a2a\" },\n    },\n  });\n  const res = await fetch(url, { method: \"PUT\", headers: { Authorization: `Bearer ${token.token}`, \"Content-Type\": \"application/json\" }, body });\n  if (!res.ok) {\n    const text = await res.text();\n    throw new LocalCliError({ code: \"A2A_CONN_PUT_FAILED\", message: `PUT ${url}: HTTP ${res.status}\\n${text.slice(0, 300)}` });\n  }\n}\n\nasync function deleteConnection(args: { credential: TokenCredential; projectArmId: string; connectionName: string }): Promise<void> {\n  const token = await args.credential.getToken(ARM_SCOPE);\n  if (!token?.token) return;\n  const url = `https://management.azure.com${args.projectArmId}/connections/${args.connectionName}?api-version=${FOUNDRY_ARM_API}`;\n  await fetch(url, { method: \"DELETE\", headers: { Authorization: `Bearer ${token.token}` } }).catch(() => {});\n}\n\nasync function createVersion(args: { credential: TokenCredential; projectEndpoint: string; agentName: string; definition: AgentDefinition; metadata: Record<string, string>; extraHeaders?: Record<string, string> }): Promise<string> {\n  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);\n  if (!token?.token) throw new LocalCliError({ code: \"FOUNDRY_AUTH\", message: \"Could not acquire Foundry data-plane token\" });\n  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;\n  const res = await fetch(url, { method: \"POST\", headers: { Authorization: `Bearer ${token.token}`, \"Content-Type\": \"application/json\", ...(args.extraHeaders ?? {}) }, body: JSON.stringify({ definition: args.definition, metadata: args.metadata }) });\n  if (!res.ok) {\n    const text = await res.text();\n    throw new LocalCliError({ code: \"A2A_CREATE_VERSION_FAILED\", message: `POST ${url}: HTTP ${res.status}\\n${text.slice(0, 500)}` });\n  }\n  const data = (await res.json()) as { version?: string };\n  if (!data.version) throw new LocalCliError({ code: \"A2A_CREATE_VERSION_NO_VERSION\", message: \"createVersion returned no version\" });\n  return data.version;\n}\n","import * as fs from \"node:fs\";\nimport { parse as parseYaml } from \"yaml\";\nimport { LocalCliError } from \"./errors.js\";\nimport { serializeA2aCard, A2A_CARD_MAX_CHARS, type A2aCard } from \"@m8t-stack/api-contract\";\n\n/** Read the a2a-card (targets.foundry.a2a-card) + Layer-1 role from a persona\n *  file and produce the metadata-ready A2aCard. Throws if the card block is\n *  missing or the serialized card exceeds the Foundry metadata value cap. */\nexport function readPersonaA2aCard(personaPath: string): { card: A2aCard; serialized: string } {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(personaPath, \"utf8\");\n  } catch (e) {\n    throw new LocalCliError({ code: \"PERSONA_READ_FAILED\", message: `Could not read persona '${personaPath}': ${(e as Error).message}` });\n  }\n  const fm = raw.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!fm) throw new LocalCliError({ code: \"PERSONA_NO_FRONTMATTER\", message: `Persona '${personaPath}' has no frontmatter.` });\n\n  const front = parseYaml(fm[1]) as Record<string, unknown>;\n  const role = typeof front.role === \"string\" ? front.role : \"\";\n  const cardYaml = (front.targets as { foundry?: { [\"a2a-card\"]?: Record<string, unknown> } } | undefined)?.foundry?.[\"a2a-card\"];\n  if (!cardYaml || typeof cardYaml !== \"object\") {\n    throw new LocalCliError({\n      code: \"A2A_CARD_MISSING\",\n      message: `Persona '${personaPath}' opts into a2a but has no targets.foundry.a2a-card block.`,\n      hint: \"Add a2a-card with summary / when-to-delegate / accepts / returns.\",\n    });\n  }\n  const card: A2aCard = {\n    role,\n    summary: str(cardYaml.summary),\n    whenToDelegate: str(cardYaml[\"when-to-delegate\"]),\n    accepts: str(cardYaml.accepts),\n    returns: str(cardYaml.returns),\n  };\n  const serialized = serializeA2aCard(card);\n  if (serialized.length > A2A_CARD_MAX_CHARS) {\n    throw new LocalCliError({\n      code: \"A2A_CARD_TOO_LONG\",\n      message: `a2a-card for '${personaPath}' serializes to ${serialized.length} chars (max ${A2A_CARD_MAX_CHARS}). Shorten summary / when-to-delegate / accepts / returns.`,\n    });\n  }\n  return { card, serialized };\n}\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n","import * as path from \"node:path\";\nimport { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { readAgentYaml } from \"../../lib/agent-yaml.js\";\nimport { resolveRepoRoot } from \"../../lib/brain-paths.js\";\nimport { resolveBridgeUrl } from \"../../lib/bridge-url.js\";\nimport { enableA2a } from \"../../lib/a2a-enable.js\";\n\nexport class A2aEnableCommand extends M8tCommand {\n  static paths = [[\"a2a\", \"enable\"]];\n  static usage = Command.Usage({\n    description: \"Enable a worker for agent-to-agent delegation (caller + callee). Idempotent (rotates the bearer).\",\n    details:\n      \"Attaches the A2A tool[type:mcp] (discover_workers + invoke_worker), provisions a CustomKeys connection holding a freshly-minted bearer, and projects the persona's a2a-card + sha256(bearer) into Foundry agent metadata. The bridge then lists this worker in discover_workers and recognizes it as a caller by the bearer hash.\",\n    examples: [[\"Enable the cmo persona\", \"$0 a2a enable cmo --persona cmo --gateway-url https://<gateway-fqdn>\"]],\n  });\n\n  worker = Option.String();\n  persona = Option.String(\"--persona\");\n  gatewayUrl = Option.String(\"--gateway-url\");\n  endpoint = Option.String(\"--endpoint\");\n  subscription = Option.String(\"--subscription\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const env = (this.context.env ?? process.env) as NodeJS.ProcessEnv;\n    const outputFlag = this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\" ? (this.output as \"pretty\" | \"json\" | \"auto\") : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n    const progress = mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    const credential = new DefaultAzureCredential();\n    const account = await getAzAccount();\n    const subscriptionId = (typeof this.subscription === \"string\" ? this.subscription : undefined) ?? account.subscriptionId;\n    const agentEndpoint = readAgentYaml(this.worker)?.projectEndpoint;\n    const project = await resolveFoundryProject({\n      credential, subscriptionId,\n      interactive: (this.context.stdout as NodeJS.WriteStream).isTTY === true,\n      endpoint: typeof this.endpoint === \"string\" ? this.endpoint : undefined,\n      agentEndpoint,\n    });\n\n    const personaPath = this.resolvePersonaPath();\n    const bridgeUrl = resolveBridgeUrl({ flag: typeof this.gatewayUrl === \"string\" ? this.gatewayUrl : undefined, env });\n\n    const result = await enableA2a({\n      credential,\n      projectEndpoint: project.endpoint,\n      projectArmId: `${project.accountScope}/projects/${project.projectName}`,\n      agentName: this.worker,\n      personaPath,\n      bridgeUrl,\n      onProgress: progress,\n    });\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson({ worker: this.worker, mode: result.mode, connectionName: result.connectionName, foundryVersion: result.foundryVersion, bridgeUrl }) + \"\\n\");\n      return 0;\n    }\n    if (result.mode === \"target\") {\n      this.context.stdout.write(`${colors.success(\"✓\")} ${colors.field(this.worker)} is a discoverable a2a target (agent version ${result.foundryVersion}).\\n`);\n      this.context.stdout.write(`  ${colors.hint(\"directory:\")} it now appears in every a2a caller's discover_workers as a callee. Hosted agents are callees only — no caller connection.\\n`);\n      return 0;\n    }\n    this.context.stdout.write(`${colors.success(\"✓\")} ${colors.field(this.worker)} is a2a-enabled (connection ${colors.field(result.connectionName!)}, agent version ${result.foundryVersion}).\\n`);\n    this.context.stdout.write(`  ${colors.hint(\"directory:\")} it now appears in every a2a worker's discover_workers, and can delegate via invoke_worker.\\n`);\n    return 0;\n  }\n\n  private resolvePersonaPath(): string {\n    if (typeof this.persona === \"string\" && this.persona.length > 0) {\n      if (this.persona.includes(\"/\") || this.persona.endsWith(\".md\")) return this.persona;\n      return path.join(resolveRepoRoot(), \"personas\", this.persona, \"persona.md\");\n    }\n    const yaml = readAgentYaml(this.worker);\n    if (yaml?.personaPath) {\n      return yaml.personaPath.startsWith(\"/\") ? yaml.personaPath : path.join(resolveRepoRoot(), yaml.personaPath);\n    }\n    throw new LocalCliError({ code: \"A2A_NO_PERSONA\", message: `Could not resolve a persona for '${this.worker}'. Pass --persona <name>.` });\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { parse as parseYaml } from \"yaml\";\nimport { LocalCliError } from \"./errors.js\";\n\nconst A2A_PATH = \"/api/a2a/mcp\";\n\n/** Resolve the full A2A bridge URL (<gateway-base>/api/a2a/mcp).\n *  Precedence: --gateway-url flag → M8T_GATEWAY_URL env → ~/.m8t-stack/config.yaml gatewayUrl. */\nexport function resolveBridgeUrl(opts: { flag?: string; env?: NodeJS.ProcessEnv; home?: string }): string {\n  const env = opts.env ?? process.env;\n  const base =\n    clean(opts.flag) ??\n    clean(env.M8T_GATEWAY_URL) ??\n    clean(readConfigGatewayUrl(opts.home));\n  if (!base) {\n    throw new LocalCliError({\n      code: \"A2A_NO_GATEWAY_URL\",\n      message: \"Could not resolve the gateway URL for the A2A bridge.\",\n      hint: \"Pass --gateway-url https://<gateway-fqdn>, set M8T_GATEWAY_URL, or add a gatewayUrl key to ~/.m8t-stack/config.yaml.\",\n    });\n  }\n  return `${base}${A2A_PATH}`;\n}\n\nfunction clean(v: string | undefined): string | undefined {\n  if (!v || typeof v !== \"string\") return undefined;\n  let t = v.trim().replace(/\\/+$/, \"\");\n  // Tolerate a full bridge URL being passed (with or without the path) — strip a\n  // trailing A2A_PATH so resolveBridgeUrl appends it exactly once (no doubling).\n  if (t.toLowerCase().endsWith(A2A_PATH)) t = t.slice(0, -A2A_PATH.length).replace(/\\/+$/, \"\");\n  return t.length ? t : undefined;\n}\n\nfunction readConfigGatewayUrl(home?: string): string | undefined {\n  const cfg = path.join(home ?? os.homedir(), \".m8t-stack\", \"config.yaml\");\n  if (!fs.existsSync(cfg)) return undefined;\n  try {\n    const o = parseYaml(fs.readFileSync(cfg, \"utf8\")) as Record<string, unknown>;\n    return typeof o?.gatewayUrl === \"string\" ? o.gatewayUrl : undefined;\n  } catch {\n    return undefined;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { readAgentYaml } from \"../../lib/agent-yaml.js\";\nimport { disableA2a } from \"../../lib/a2a-enable.js\";\n\nexport class A2aDisableCommand extends M8tCommand {\n  static paths = [[\"a2a\", \"disable\"]];\n  static usage = Command.Usage({\n    description: \"Disable agent-to-agent delegation for a worker (remove tool + connection + metadata). Idempotent.\",\n    examples: [[\"Disable the cmo persona\", \"$0 a2a disable cmo\"]],\n  });\n\n  worker = Option.String();\n  endpoint = Option.String(\"--endpoint\");\n  subscription = Option.String(\"--subscription\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const outputFlag = this.output === \"json\" || this.output === \"auto\" || this.output === \"pretty\" ? (this.output as \"pretty\" | \"json\" | \"auto\") : \"pretty\";\n    const mode = resolveOutputMode(outputFlag, this.context.stdout as NodeJS.WriteStream);\n    const progress = mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    const credential = new DefaultAzureCredential();\n    const account = await getAzAccount();\n    const subscriptionId = (typeof this.subscription === \"string\" ? this.subscription : undefined) ?? account.subscriptionId;\n    const project = await resolveFoundryProject({\n      credential, subscriptionId,\n      interactive: (this.context.stdout as NodeJS.WriteStream).isTTY === true,\n      endpoint: typeof this.endpoint === \"string\" ? this.endpoint : undefined,\n      agentEndpoint: readAgentYaml(this.worker)?.projectEndpoint,\n    });\n\n    const result = await disableA2a({\n      credential,\n      projectEndpoint: project.endpoint,\n      projectArmId: `${project.accountScope}/projects/${project.projectName}`,\n      agentName: this.worker,\n      onProgress: progress,\n    });\n\n    if (mode === \"json\") { this.context.stdout.write(renderJson({ worker: this.worker, ...result }) + \"\\n\"); return 0; }\n    this.context.stdout.write(`${colors.success(\"✓\")} ${colors.field(this.worker)} a2a-disabled (connection ${colors.field(result.connectionName)} removed, agent version ${result.foundryVersion}).\\n`);\n    return 0;\n  }\n}\n","import { Command } from \"clipanion\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { colors } from \"../../lib/output.js\";\nimport { checkArchitectDrift } from \"../../lib/architect-version.js\";\n\nexport class ArchitectCheckCommand extends M8tCommand {\n  static paths = [[\"architect-check\"]];\n  static usage = Command.Usage({\n    description: \"Verify the installed m8t-architect persona matches the repo source.\",\n    details:\n      \"Compares a render-time content hash (stored in ~/.claude/skills/m8t-architect/.m8t-skill.json) against a fresh hash of <repo-root>/personas/m8t-architect/persona.md. Exits 0 when they match, 1 with remediation advice when they don't. Used as a pre-flight gate by the architect persona body and as a verification step in install/m8t.md.\",\n    examples: [\n      [\"Run the architect drift check\", \"$0 architect-check\"],\n    ],\n  });\n\n  async executeCommand(): Promise<number> {\n    const r = checkArchitectDrift();\n    if (r.match) {\n      this.context.stdout.write(`${colors.success(\"✓\")} m8t-architect is in sync${r.sourceVersion ? ` (v${r.sourceVersion})` : \"\"}.\\n`);\n      return 0;\n    }\n    this.context.stdout.write(\n      `${colors.error(\"✗\")} m8t-architect drift detected. Installed v${r.installedVersion || \"(missing)\"}, source v${r.sourceVersion || \"?\"}.\\n`,\n    );\n    if (r.advice) this.context.stdout.write(`  ${colors.hint(\"→\")} ${r.advice}\\n`);\n    return 1;\n  }\n}\n","import { createHash } from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { resolveRepoRoot } from \"./brain-paths.js\";\n\n// Architect drift detection via a render-time sidecar manifest + source content hash.\n//\n// ── canonical hash (MUST stay byte-for-byte identical to the writer in\n// scripts/write-skill-sidecar.mjs — both hash the entire source file):\n//\n//   createHash(\"sha256\").update(readFileSync(sourcePath)).digest(\"hex\")\n\n/**\n * Read the `version:` frontmatter field from a markdown file.\n * Returns \"\" when the file is missing or has no version field.\n */\nfunction readVersionFrontmatter(file: string): string {\n  if (!fs.existsSync(file)) return \"\";\n  const text = fs.readFileSync(file, \"utf8\");\n  // Frontmatter is delimited by a leading `---` line and a closing `---` line.\n  if (!text.startsWith(\"---\")) return \"\";\n  const closeIdx = text.indexOf(\"\\n---\", 3);\n  if (closeIdx < 0) return \"\";\n  const fm = text.slice(3, closeIdx + 1);\n  const m = fm.match(/^version:\\s*[\"']?([^\"'\\n]+)[\"']?\\s*$/m);\n  return m ? m[1].trim() : \"\";\n}\n\n/**\n * Compute SHA-256 hex digest of a file's raw bytes.\n * Canonical algorithm — must stay in sync with scripts/write-skill-sidecar.mjs.\n */\nfunction sha256File(filePath: string): string {\n  return createHash(\"sha256\").update(fs.readFileSync(filePath)).digest(\"hex\");\n}\n\nexport type ArchitectDrift = {\n  match: boolean;\n  sourceVersion: string;       // from source frontmatter (display)\n  installedVersion: string;    // from sidecar (display); \"\" when no/unreadable sidecar\n  advice?: string;             // human-readable next step\n};\n\nexport function checkArchitectDrift(): ArchitectDrift {\n  // 1. Resolve paths\n  const sourcePath = path.join(\n    resolveRepoRoot(),\n    \"personas\",\n    \"m8t-architect\",\n    \"persona.md\",\n  );\n  const sidecarPath = path.join(\n    os.homedir(),\n    \".claude\",\n    \"skills\",\n    \"m8t-architect\",\n    \".m8t-skill.json\",\n  );\n\n  // 2. Source missing\n  if (!fs.existsSync(sourcePath)) {\n    return {\n      match: false,\n      sourceVersion: \"\",\n      installedVersion: \"\",\n      advice: `Source persona not found at ${sourcePath}. Check ~/.m8t-stack/repo-root points at a valid checkout.`,\n    };\n  }\n\n  // 3. Read source version (for display)\n  const sourceVersion = readVersionFrontmatter(sourcePath);\n\n  // 4. Sidecar missing or unreadable/malformed\n  let sidecar: { version?: string; sourceSha256?: string } | null = null;\n  if (fs.existsSync(sidecarPath)) {\n    try {\n      sidecar = JSON.parse(fs.readFileSync(sidecarPath, \"utf8\"));\n    } catch {\n      sidecar = null; // malformed JSON → treat as missing\n    }\n  }\n\n  if (!sidecar || typeof sidecar.sourceSha256 !== \"string\") {\n    return {\n      match: false,\n      sourceVersion,\n      installedVersion: \"\",\n      advice: \"Architect skill not installed (or installed before sidecar support). Run `bash install/m8t.md` to render it.\",\n    };\n  }\n\n  // 5. Compare hashes\n  const installedVersion = typeof sidecar.version === \"string\" ? sidecar.version : \"\";\n  const currentHash = sha256File(sourcePath);\n\n  if (currentHash === sidecar.sourceSha256) {\n    return { match: true, sourceVersion, installedVersion };\n  }\n\n  const sameVersion = !!installedVersion && installedVersion === sourceVersion;\n  return {\n    match: false,\n    sourceVersion,\n    installedVersion,\n    advice: sameVersion\n      ? `m8t-architect content drift (v${sourceVersion} unchanged, body edited since render). Re-render via \\`bash install/m8t.md\\`.`\n      : `Installed m8t-architect${installedVersion ? ` (v${installedVersion})` : \"\"} is out of date with source${sourceVersion ? ` (v${sourceVersion})` : \"\"}. Run \\`bash install/m8t.md\\` to re-render.`,\n  };\n}\n","import { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { checkAppHealth, readAppSecrets } from \"@m8t-stack/github-app-auth\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { getAzAccount, getCallerObjectId } from \"../../lib/auth.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { checkPreconditions } from \"../../lib/preconditions.js\";\nimport { deployHostedWorker } from \"../../lib/coder-deploy.js\";\nimport { resolvePersona } from \"../../lib/persona.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { discoverKvUri } from \"../../lib/brain-paths.js\";\nimport { resolveAppInstallation } from \"../../lib/app-install.js\";\nimport { detectDeliveryEnv, ensureDeliveryGrant, normalizeKvUri } from \"../../lib/delivery-grant.js\";\nimport { listModelQuota, modelQuotaVerdict } from \"../../lib/quota.js\";\n\nconst SIZE_PRESETS: Record<string, { cpu: string; memory: string }> = {\n  small: { cpu: \"0.5\", memory: \"1Gi\" },\n  medium: { cpu: \"1\", memory: \"2Gi\" },\n  large: { cpu: \"2\", memory: \"4Gi\" },\n};\nconst DEFAULT_ACR = \"m8tacrxn42jrnx.azurecr.io\";\nconst DEFAULT_IMAGE = \"m8t-coding-agent\";\nconst DEFAULT_TAG = \"v20260604-996b7ac\"; // A2A deliver-to-brain image (parses <m8t:deliver_to>); the prior v20260531 default predates it\nconst DEFAULT_MODEL = \"gpt-4.1-mini\";\nconst NAME_RE = /^[a-z0-9-]+$/;\n\nexport class CoderDeployCommand extends M8tCommand {\n  static paths = [[\"coder\", \"deploy\"]];\n  static usage = Command.Usage({\n    description: \"Deploy the curated coding agent as a hosted Foundry worker.\",\n    details:\n      \"Creates a hosted agent version from the ACR image, tags it as an m8t worker (kind: hosted + persona), grants its identity the Foundry User role, and polls to active. The image must already be pushed (see deploy.md §2b). Re-running creates a new version (idempotent).\",\n    examples: [\n      [\"Deploy a coder with defaults\", \"$0 coder deploy my-coder\"],\n      [\"Larger sandbox + a custom model\", \"$0 coder deploy my-coder --size large --model-deployment gpt-4.1\"],\n      [\"Override the exec timeout\", \"$0 coder deploy my-coder --env M8T_CODER_EXEC_TIMEOUT_SECONDS=300\"],\n    ],\n  });\n\n  name = Option.String();\n  persona = Option.String(\"--persona\");\n  image = Option.String(\"--image\");\n  imageTag = Option.String(\"--image-tag\");\n  size = Option.String(\"--size\");\n  modelDeployment = Option.String(\"--model-deployment\");\n  env = Option.Array(\"--env\");\n  endpoint = Option.String(\"--endpoint\");\n  subscription = Option.String(\"--subscription\");\n  output = Option.String(\"--output\");\n  brain = Option.String(\"--brain\");\n  brainBranch = Option.String(\"--branch\");\n  brainKv = Option.String(\"--brain-kv\");\n  allowNonReasoning = Option.Boolean(\"--allow-non-reasoning\", false);\n  skipQuotaCheck = Option.Boolean(\"--skip-quota-check\", false);\n\n  async executeCommand(): Promise<number> {\n    if (!NAME_RE.test(this.name ?? \"\")) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: `Invalid worker name '${this.name}'. Use lowercase letters, digits, and hyphens only.`,\n        hint: \"Example: m8t coder deploy data-coder\",\n      });\n    }\n\n    const size = (this.size ?? \"medium\").toLowerCase();\n    const preset = SIZE_PRESETS[size];\n    if (!preset) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: `Unknown --size '${this.size}'. Use one of: small, medium, large.`,\n        hint: \"small=0.5/1Gi · medium=1/2Gi · large=2/4Gi\",\n      });\n    }\n\n    const env: Record<string, string> = {\n      MODEL_DEPLOYMENT_NAME: this.modelDeployment ?? (typeof this.brain === \"string\" ? \"gpt-5-mini\" : DEFAULT_MODEL),\n    };\n    for (const pair of this.env ?? []) {\n      const eq = pair.indexOf(\"=\");\n      if (eq <= 0) {\n        throw new LocalCliError({\n          code: \"USAGE\",\n          message: `Invalid --env '${pair}'. Expected KEY=VALUE.`,\n          hint: \"Example: --env M8T_CODER_MAX_ITERATIONS=20\",\n        });\n      }\n      env[pair.slice(0, eq)] = pair.slice(eq + 1);\n    }\n\n    const persona = this.persona ?? \"coding-agent\";\n    // --image may be a bare repo (\"m8t-coding-agent\") or a full \"host/repo\" ref.\n    const imageInput = this.image ?? DEFAULT_IMAGE;\n    const repoRef = imageInput.includes(\"/\") ? imageInput : `${DEFAULT_ACR}/${imageInput}`;\n    const image = `${repoRef}:${this.imageTag ?? DEFAULT_TAG}`;\n\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const credential = new DefaultAzureCredential();\n    const account = await getAzAccount();\n    const subscriptionId = this.subscription ?? account.subscriptionId;\n    const callerObjectId = await getCallerObjectId();\n\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive,\n      endpoint: this.endpoint,\n    });\n\n    const { warnings } = await checkPreconditions({\n      credential,\n      subscriptionId,\n      project,\n      image,\n      callerObjectId,\n    });\n    for (const w of warnings) {\n      this.context.stderr.write(`${colors.hint(\"note:\")} ${w}\\n`);\n    }\n\n    if (this.skipQuotaCheck !== true) {\n      const usages = await listModelQuota(project.region);\n      const { verdict, quotad } = modelQuotaVerdict(usages, env.MODEL_DEPLOYMENT_NAME);\n      if (verdict === \"no_quota\") {\n        throw new LocalCliError({\n          code: \"MODEL_NO_QUOTA\",\n          message: `Model '${env.MODEL_DEPLOYMENT_NAME}' has 0 quota in ${project.region}.`,\n          hint: `Pick a quota'd model (e.g. --model-deployment ${quotad[0] ?? \"gpt-5-mini\"}) or request quota. Quota'd reasoning models: ${quotad.join(\", \") || \"(none)\"}. Bypass with --skip-quota-check.`,\n        });\n      }\n      if (verdict === \"unknown\") {\n        this.context.stderr.write(`${colors.hint(\"note:\")} could not confirm quota for '${env.MODEL_DEPLOYMENT_NAME}' in ${project.region}; proceeding.\\n`);\n      }\n    }\n\n    const { persona: personaName, personaVersion } = resolvePersona(persona);\n\n    const onProgress = mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    const result = await deployHostedWorker({\n      credential,\n      subscriptionId,\n      project,\n      name: this.name,\n      image,\n      cpu: preset.cpu,\n      memory: preset.memory,\n      env,\n      metadata: { source: \"m8t-stack-POC\", kind: \"hosted\", persona: personaName, personaVersion },\n      onProgress,\n    });\n\n    if (typeof this.brain === \"string\") {\n      const repo = this.brain;\n      if (!repo.includes(\"/\")) {\n        throw new LocalCliError({ code: \"USAGE\", message: `--brain must be owner/name, got '${repo}'` });\n      }\n      const processEnv = (this.context.env ?? process.env) as Record<string, string | undefined>;\n      const kvUri = discoverKvUri(processEnv);\n      onProgress?.(\"checking GitHub App health…\");\n      const health = await checkAppHealth({ credential, kvUri });\n      if (!health.ok) {\n        throw new LocalCliError({\n          code: \"APP_HEALTH_FAILED\",\n          message: \"GitHub App is not configured correctly.\",\n          hint: \"Run `m8t brain check-app` for details.\",\n        });\n      }\n      const { slug, appId, privateKeyPem } = await readAppSecrets({ credential, kvUri });\n      const [owner, repoName] = repo.split(\"/\");\n      const installationId = await resolveAppInstallation({\n        owner, repo: repoName, slug, appId, privateKeyPem,\n        write: (s) => this.context.stdout.write(s),\n      });\n      const { enableHostedBrain } = await import(\"../../lib/enable-hosted-brain.js\");\n      await enableHostedBrain({\n        credential, subscriptionId, project, kvUri,\n        agentName: this.name, repo, branch: typeof this.brainBranch === \"string\" ? this.brainBranch : \"main\",\n        installationId, modelDeployment: this.modelDeployment ?? \"gpt-5-mini\",\n        allowNonReasoning: this.allowNonReasoning === true,\n        onProgress,\n      });\n      this.context.stdout.write(`  ${colors.success(\"✓\")} brain-linked to ${colors.field(repo)} (in-container access; brain version provisioning, active shortly).\\n`);\n    } else {\n      // No --brain, but delivery creds set via raw --env → ensure the KV grant\n      // ourselves. Without it the Coder can read its model but NOT the brain\n      // token, so it silently delivers nothing (the empty-output trap). Idempotent.\n      const delivery = detectDeliveryEnv(env);\n      const kvSource = (typeof this.brainKv === \"string\" ? this.brainKv : undefined) ?? delivery.kvUri;\n      if (delivery.installationId && kvSource) {\n        const kvUri = normalizeKvUri(kvSource);\n        onProgress?.(\"granting Key Vault Secrets User for delivery…\");\n        await ensureDeliveryGrant({\n          credential,\n          subscriptionId,\n          principalId: result.principalId,\n          kvUri,\n        });\n        this.context.stdout.write(\n          `  ${colors.success(\"✓\")} granted Key Vault Secrets User to the agent identity on ${colors.field(new URL(kvUri).host)} (delivery).\\n`,\n        );\n      }\n    }\n\n    if (mode === \"json\") {\n      this.context.stdout.write(\n        renderJson({\n          name: this.name,\n          version: result.version,\n          status: result.status,\n          persona: personaName,\n          image,\n          size,\n          endpoint: project.endpoint,\n          agentPrincipalId: result.principalId,\n        }) + \"\\n\",\n      );\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} deployed hosted coder ${colors.field(this.name)} ` +\n        `(version ${result.version}, ${result.status}, ${size}, persona ${personaName}).\\n`,\n    );\n    this.context.stdout.write(`  image: ${image}\\n`);\n    this.context.stdout.write(`  project: ${project.projectName} (${project.region})\\n`);\n    this.context.stdout.write(\n      `  ${colors.hint(\"next:\")} it now appears on MCP (/m8t-stack:workers), the web app, and Telegram — chat it to crunch a task.\\n`,\n    );\n    return 0;\n  }\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport { LocalCliError } from \"./errors.js\";\nimport { HOSTED_AGENT_REGIONS, isHostedRegionSupported } from \"./regions.js\";\nimport { imageTagExists } from \"./acr.js\";\nimport { callerCanAssignRoles, grantAcrPull, principalHasAcrPull, FOUNDRY_USER_ROLE_ID } from \"./rbac.js\";\nimport type { FoundryProject } from \"./foundry-project.js\";\n\nexport type PreconditionResult = { warnings: string[] };\n\n/** Parse \"cr3be7oqz4ls27q.azurecr.io/m8t-coding-agent:tag\" → { acrName, repo, tag }. */\nexport function parseImageRef(image: string): { acrName: string; repo: string; tag: string } {\n  const [hostAndPath, tag] = image.split(\":\");\n  const slash = hostAndPath.indexOf(\"/\");\n  const host = hostAndPath.slice(0, slash);\n  const repo = hostAndPath.slice(slash + 1);\n  const acrName = host.replace(/\\.azurecr\\.io$/i, \"\");\n  return { acrName, repo, tag: tag ?? \"\" };\n}\n\n/** ARM resource id of the ACR (scope for the AcrPull check/grant). */\nfunction acrScope(subscriptionId: string, projectAccountScope: string, acrName: string): string {\n  const rg = projectAccountScope.match(/\\/resourceGroups\\/([^/]+)\\//)?.[1] ?? \"\";\n  return `/subscriptions/${subscriptionId}/resourceGroups/${rg}/providers/Microsoft.ContainerRegistry/registries/${acrName}`;\n}\n\nexport async function checkPreconditions(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  project: FoundryProject;\n  image: string;\n  callerObjectId: string;\n}): Promise<PreconditionResult> {\n  const warnings: string[] = [];\n\n  // 1. Region — hard block.\n  if (!isHostedRegionSupported(args.project.region)) {\n    throw new LocalCliError({\n      code: \"REGION_NOT_SUPPORTED\",\n      message: `Project '${args.project.projectName}' is in '${args.project.region}', which does not support hosted agents.`,\n      hint: `Hosted agents need one of: ${HOSTED_AGENT_REGIONS.join(\", \")}. Deploy against a project in a supported region.`,\n    });\n  }\n\n  // 2. Image tag in ACR — hard block if definitively absent; warn if unknown.\n  const { acrName, repo, tag } = parseImageRef(args.image);\n  const tagCheck = await imageTagExists(acrName, repo, tag);\n  if (tagCheck === \"absent\") {\n    throw new LocalCliError({\n      code: \"IMAGE_TAG_NOT_FOUND\",\n      message: `Image '${repo}:${tag}' was not found in ACR '${acrName}'.`,\n      hint: `Build + push it first: cd agents/coding-agent && docker buildx build --platform linux/amd64 -t ${acrName}.azurecr.io/${repo}:${tag} --push . (see deploy.md §2b).`,\n    });\n  }\n  if (tagCheck === \"unknown\") {\n    warnings.push(`could not verify image '${repo}:${tag}' in ACR '${acrName}' (az acr check failed) — proceeding; a bad image surfaces as a failed version.`);\n  }\n\n  // 3. Project MI AcrPull — grant if missing (operator is verified able to assign in step 4 next; grant is idempotent).\n  if (args.project.projectPrincipalId) {\n    const scope = acrScope(args.subscriptionId, args.project.accountScope, acrName);\n    const hasPull = await principalHasAcrPull({\n      credential: args.credential,\n      acrScope: scope,\n      principalId: args.project.projectPrincipalId,\n    });\n    if (!hasPull) {\n      await grantAcrPull({\n        credential: args.credential,\n        subscriptionId: args.subscriptionId,\n        acrScope: scope,\n        principalId: args.project.projectPrincipalId,\n      });\n      warnings.push(`granted AcrPull to the project managed identity on '${acrName}' (was missing).`);\n    }\n  } else {\n    warnings.push(\"could not resolve the project managed identity to verify AcrPull — ensure it can pull from the ACR.\");\n  }\n\n  // 4. Caller can assign roles — hard block (we must grant Foundry User after create).\n  const canAssign = await callerCanAssignRoles({\n    credential: args.credential,\n    scope: args.project.accountScope,\n    callerObjectId: args.callerObjectId,\n  });\n  if (!canAssign) {\n    throw new LocalCliError({\n      code: \"CALLER_CANNOT_ASSIGN_ROLES\",\n      message: \"You lack permission to create role assignments on the Foundry account, which is required to grant the hosted agent its runtime role.\",\n      hint: `Ask an Owner / User Access Administrator to grant you one of those roles on ${args.project.accountScope}, or to run (after the agent is created): az role assignment create --assignee-object-id <agentOID> --assignee-principal-type ServicePrincipal --role ${FOUNDRY_USER_ROLE_ID} --scope ${args.project.accountScope}`,\n    });\n  }\n\n  return { warnings };\n}\n","// Hosted-agents preview region list. Source (verified 2026-05-25):\n// https://learn.microsoft.com/azure/foundry/agents/concepts/hosted-agents#limits,-pricing,-and-availability-preview\n// The list moves during preview — update this constant when MS adds regions.\nexport const HOSTED_AGENT_REGIONS = [\n  \"eastus2\",\n  \"northcentralus\",\n  \"swedencentral\",\n  \"canadacentral\",\n  \"southeastasia\",\n  \"polandcentral\",\n  \"southafricanorth\",\n  \"koreacentral\",\n  \"southindia\",\n  \"brazilsouth\",\n  \"westus\",\n  \"westus3\",\n  \"norwayeast\",\n  \"japaneast\",\n  \"francecentral\",\n  \"switzerlandnorth\",\n  \"spaincentral\",\n  \"australiaeast\",\n] as const;\n\n/** Normalize a region label (\"East US 2\", \"EastUS2\") to the canonical key (\"eastus2\"). */\nfunction normalizeRegion(region: string): string {\n  return region.toLowerCase().replace(/\\s+/g, \"\");\n}\n\nexport function isHostedRegionSupported(region: string): boolean {\n  const n = normalizeRegion(region);\n  return (HOSTED_AGENT_REGIONS as readonly string[]).includes(n);\n}\n","import { runAz } from \"./az.js\";\n\nexport type TagCheck = \"present\" | \"absent\" | \"unknown\";\n\n/**\n * Best-effort check that <repo>:<tag> exists in the ACR. Returns \"unknown\"\n * if the az call fails (network/permission) so callers warn-and-proceed\n * rather than block on a flaky check — createVersion + poll-to-failed is\n * the real backstop.\n */\nexport async function imageTagExists(acrName: string, repo: string, tag: string): Promise<TagCheck> {\n  try {\n    const out = await runAz([\n      \"acr\",\n      \"repository\",\n      \"show-tags\",\n      \"-n\",\n      acrName,\n      \"--repository\",\n      repo,\n      \"-o\",\n      \"json\",\n    ]);\n    const tags = JSON.parse(out) as string[];\n    return tags.includes(tag) ? \"present\" : \"absent\";\n  } catch {\n    return \"unknown\";\n  }\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport {\n  createCoderVersion,\n  getAgentIdentityPrincipalId,\n  getVersionStatus,\n  type CoderMetadata,\n} from \"./foundry-agents.js\";\nimport { grantFoundryUser } from \"./rbac.js\";\nimport { LocalCliError } from \"./errors.js\";\nimport type { FoundryProject } from \"./foundry-project.js\";\n\nexport type DeployResult = { version: string; principalId: string; status: string };\n\nexport async function deployHostedWorker(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  project: FoundryProject;\n  name: string;\n  image: string;\n  cpu: string;\n  memory: string;\n  env: Record<string, string>;\n  metadata: CoderMetadata;\n  onProgress?: (msg: string) => void;\n  sleep?: (ms: number) => Promise<void>;\n  now?: () => number;\n  pollTimeoutMs?: number;\n  pollIntervalMs?: number;\n}): Promise<DeployResult> {\n  const onProgress = args.onProgress ?? (() => {});\n  const sleep = args.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));\n  const now = args.now ?? (() => Date.now());\n  const timeout = args.pollTimeoutMs ?? 8 * 60 * 1000;\n  const interval = args.pollIntervalMs ?? 10_000;\n\n  // 1. Create the version (SDK).\n  onProgress(`creating version for '${args.name}'…`);\n  const version = await createCoderVersion({\n    credential: args.credential,\n    endpoint: args.project.endpoint,\n    name: args.name,\n    image: args.image,\n    cpu: args.cpu,\n    memory: args.memory,\n    env: args.env,\n    metadata: args.metadata,\n  });\n\n  // 2. Read the per-version agent identity OID.\n  const principalId = await getAgentIdentityPrincipalId({\n    credential: args.credential,\n    endpoint: args.project.endpoint,\n    name: args.name,\n    version,\n  });\n\n  // 3. Grant Foundry User to the agent identity — BEFORE polling. Skipping this\n  //    is a load-bearing gotcha: the model call 401s and surfaces as a\n  //    misleading storage_error. Idempotent (per-version identity).\n  onProgress(\"granting Foundry User to the agent identity…\");\n  await grantFoundryUser({\n    credential: args.credential,\n    subscriptionId: args.subscriptionId,\n    accountScope: args.project.accountScope,\n    principalId,\n  });\n\n  // 4. Poll to active.\n  const start = now();\n  for (;;) {\n    const status = await getVersionStatus({\n      credential: args.credential,\n      endpoint: args.project.endpoint,\n      name: args.name,\n      version,\n    });\n    onProgress(`status: ${status}`);\n    if (status === \"active\") return { version, principalId, status };\n    if (status === \"failed\") {\n      throw new LocalCliError({\n        code: \"VERSION_FAILED\",\n        message: `Hosted agent '${args.name}' version ${version} entered status 'failed'.`,\n        hint: \"Inspect the container logs (App Insights exceptions / get_session_log_stream). storage_error with NO output_text.delta ⇒ a missing model-call RBAC grant; after full output ⇒ a platform persist issue.\",\n      });\n    }\n    if (now() - start > timeout) {\n      throw new LocalCliError({\n        code: \"VERSION_POLL_TIMEOUT\",\n        message: `Hosted agent '${args.name}' version ${version} did not reach 'active' within ${Math.round(timeout / 1000)}s (last status: ${status}).`,\n        hint: \"Provisioning can take 2–5 min; re-run with the same name to resume, or check the version status in the Foundry portal.\",\n      });\n    }\n    await sleep(interval);\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { parse as parseYaml } from \"yaml\";\n\nexport type ResolvedPersona = {\n  persona: string;\n  personaVersion: string | null;\n};\n\n/** Walk up from `startDir` looking for a directory that contains `personas/`. */\nfunction findRepoRoot(startDir: string): string | null {\n  let dir = path.resolve(startDir);\n  for (;;) {\n    if (fs.existsSync(path.join(dir, \"personas\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/**\n * Resolve a persona name to its metadata. `personaVersion` is best-effort:\n * read from personas/<persona>/persona.md frontmatter `version`, else null.\n * Never throws — a missing persona file just yields a null version.\n */\nexport function resolvePersona(persona: string, cwd: string = process.cwd()): ResolvedPersona {\n  const root = findRepoRoot(cwd);\n  if (!root) return { persona, personaVersion: null };\n\n  const file = path.join(root, \"personas\", persona, \"persona.md\");\n  let raw: string;\n  try {\n    raw = fs.readFileSync(file, \"utf-8\");\n  } catch {\n    return { persona, personaVersion: null };\n  }\n\n  const match = raw.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!match) return { persona, personaVersion: null };\n\n  let fm: { version?: unknown } | null = null;\n  try {\n    fm = parseYaml(match[1]) as { version?: unknown } | null;\n  } catch {\n    return { persona, personaVersion: null };\n  }\n\n  const version = fm?.version;\n  return {\n    persona,\n    personaVersion: version === undefined || version === null ? null : String(version),\n  };\n}\n","import type { TokenCredential } from \"@azure/identity\";\nimport { grantKeyVaultSecretsUser, resolveKeyVaultResourceId } from \"./rbac.js\";\n\n/** Read delivery creds out of an agent's env map (raw --env or the brain path set them). */\nexport function detectDeliveryEnv(\n  env: Record<string, string | undefined>,\n): { installationId?: string; kvUri?: string } {\n  const installationId = env.GITHUB_APP_INSTALLATION_ID?.trim() || undefined;\n  const kvUri = env.AZURE_KEYVAULT_URI?.trim() || undefined;\n  return { installationId, kvUri };\n}\n\n/** Normalize a bare vault name OR a full vault URI to a canonical vault URI. */\nexport function normalizeKvUri(input: string): string {\n  const v = input.trim();\n  return /^https?:\\/\\//i.test(v) ? v : `https://${v}.vault.azure.net/`;\n}\n\n/** Grant the agent identity Key Vault Secrets User on the delivery KV. Idempotent (409=ok). */\nexport async function ensureDeliveryGrant(args: {\n  credential: TokenCredential;\n  subscriptionId: string;\n  principalId: string;\n  kvUri: string;\n}): Promise<void> {\n  const kvScope = await resolveKeyVaultResourceId({\n    credential: args.credential,\n    subscriptionId: args.subscriptionId,\n    kvUri: args.kvUri,\n  });\n  await grantKeyVaultSecretsUser({\n    credential: args.credential,\n    subscriptionId: args.subscriptionId,\n    kvScope,\n    principalId: args.principalId,\n  });\n}\n","import { runAz } from \"./az.js\";\n\nexport type ModelQuota = { name: string; currentValue: number; limit: number };\n\n/** List Cognitive Services usages (quota) for a region. Returns [] on any az error. */\nexport async function listModelQuota(region: string): Promise<ModelQuota[]> {\n  try {\n    const out = await runAz([\"cognitiveservices\", \"usage\", \"list\", \"-l\", region, \"--output\", \"json\"]);\n    const raw = JSON.parse(out) as Array<{ name?: { value?: string }; currentValue?: number; limit?: number }>;\n    return raw.map((u) => ({ name: u.name?.value ?? \"\", currentValue: u.currentValue ?? 0, limit: u.limit ?? 0 }));\n  } catch {\n    return [];\n  }\n}\n\n/** Extract the model id from an Azure usage name `Provider.Tier.<model>` (the model may contain dots). */\nexport function usageModelName(usageName: string): string {\n  return usageName.split(\".\").slice(2).join(\".\");\n}\n\nconst REASONING_USAGE_RE = /gpt-5|o[1-9]/i;\n\n/**\n * Verdict for a model deployment name against a region's quota usages.\n *  - \"ok\":        ≥1 matching usage entry has limit > 0\n *  - \"no_quota\":  matching entries exist but ALL have limit 0 (the gpt-5.5 trap)\n *  - \"unknown\":   no matching usage entry — caller should warn, not block\n * `quotad` lists DEDUPED reasoning-family model names with quota (for the\n * remediation hint) — one model can appear under several SKU tiers\n * (GlobalStandard / DataZoneStandard / Batch), so dedup to the model name.\n */\nexport function modelQuotaVerdict(\n  usages: ModelQuota[],\n  modelDeployment: string,\n): { verdict: \"ok\" | \"no_quota\" | \"unknown\"; quotad: string[] } {\n  const token = modelDeployment.trim().toLowerCase();\n  const matches = usages.filter((u) => usageModelName(u.name).toLowerCase() === token);\n  const quotad = [\n    ...new Set(usages.filter((u) => u.limit > 0 && REASONING_USAGE_RE.test(u.name)).map((u) => usageModelName(u.name))),\n  ];\n  if (matches.length === 0) return { verdict: \"unknown\", quotad };\n  if (matches.some((m) => m.limit > 0)) return { verdict: \"ok\", quotad };\n  return { verdict: \"no_quota\", quotad };\n}\n","import { confirm } from \"@inquirer/prompts\";\nimport { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { getAzAccount } from \"../../lib/auth.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { agentExists, deleteAgent } from \"../../lib/foundry-agents.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\n\nexport class CoderTeardownCommand extends M8tCommand {\n  static paths = [[\"coder\", \"teardown\"]];\n  static usage = Command.Usage({\n    description: \"Delete a deployed hosted coder (removes its container + identity + role assignment).\",\n    details:\n      \"Idempotent: tearing down a missing coder reports 'already gone'. Only the named agent is touched. Discovery self-heals on the next worker list.\",\n    examples: [\n      [\"Tear down a coder\", \"$0 coder teardown my-coder\"],\n      [\"Skip the confirm (scripts)\", \"$0 coder teardown my-coder --yes\"],\n    ],\n  });\n\n  name = Option.String();\n  yes = Option.Boolean(\"--yes\", false);\n  endpoint = Option.String(\"--endpoint\");\n  subscription = Option.String(\"--subscription\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const credential = new DefaultAzureCredential();\n    const account = await getAzAccount();\n    const subscriptionId = this.subscription ?? account.subscriptionId;\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive,\n      endpoint: this.endpoint,\n    });\n\n    const exists = await agentExists({ credential, endpoint: project.endpoint, name: this.name });\n    if (!exists) {\n      if (mode === \"json\") {\n        this.context.stdout.write(\n          renderJson({ name: this.name, deleted: false, reason: \"not_found\", message: \"already gone\" }) + \"\\n\",\n        );\n        return 0;\n      }\n      this.context.stdout.write(`${colors.hint(\"·\")} coder ${colors.field(this.name)} not found (already gone).\\n`);\n      return 0;\n    }\n\n    if (!this.yes) {\n      if (!interactive) {\n        throw new LocalCliError({\n          code: \"USAGE\",\n          message: \"teardown requires --yes when running non-interactively.\",\n          hint: \"Re-run with --yes: m8t coder teardown <name> --yes\",\n        });\n      }\n      const ok = await confirm({\n        message: `Delete hosted coder '${this.name}'? This removes its container and identity (and any active sessions).`,\n        default: false,\n      });\n      if (!ok) {\n        this.context.stdout.write(\"cancelled — nothing removed.\\n\");\n        return 2;\n      }\n    }\n\n    await deleteAgent({ credential, endpoint: project.endpoint, name: this.name });\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson({ name: this.name, deleted: true }) + \"\\n\");\n      return 0;\n    }\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} removed hosted coder ${colors.field(this.name)} (container + identity + role assignment cascaded).\\n`,\n    );\n    this.context.stderr.write(\n      `  ${colors.hint(\"note:\")} this removes only the agent. For a full cascade (bindings, a2a, brain), use 'm8t agent remove ${this.name}'.\\n`,\n    );\n    return 0;\n  }\n}\n","import * as path from \"node:path\";\nimport { Command, Option } from \"clipanion\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { checkAppHealth, readAppSecrets } from \"@m8t-stack/github-app-auth\";\nimport { M8tCommand } from \"../../lib/m8t-command.js\";\nimport { LocalCliError } from \"../../lib/errors.js\";\nimport { getAzAccount, getCallerObjectId } from \"../../lib/auth.js\";\nimport { resolveFoundryProject } from \"../../lib/foundry-project.js\";\nimport { checkPreconditions } from \"../../lib/preconditions.js\";\nimport { deployHostedWorker } from \"../../lib/coder-deploy.js\";\nimport { resolvePersona } from \"../../lib/persona.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../../lib/output.js\";\nimport { discoverKvUri, resolveRepoRoot } from \"../../lib/brain-paths.js\";\nimport { resolveAppInstallation } from \"../../lib/app-install.js\";\nimport { ensureDeliveryGrant, normalizeKvUri } from \"../../lib/delivery-grant.js\";\nimport { grantContributor, grantUserAccessAdmin, callerCanAssignRoles } from \"../../lib/rbac.js\";\nimport { enableA2a } from \"../../lib/a2a-enable.js\";\nimport { resolveBridgeUrl } from \"../../lib/bridge-url.js\";\nimport { listModelQuota, modelQuotaVerdict } from \"../../lib/quota.js\";\n\nconst SIZE_PRESETS: Record<string, { cpu: string; memory: string }> = {\n  small: { cpu: \"0.5\", memory: \"1Gi\" },\n  medium: { cpu: \"1\", memory: \"2Gi\" },\n  large: { cpu: \"2\", memory: \"4Gi\" },\n};\nconst DEFAULT_ACR = \"m8tacrxn42jrnx.azurecr.io\";\nconst DEFAULT_IMAGE = \"m8t-azure-executor\";\nconst DEFAULT_TAG = \"dev\";\nconst DEFAULT_MODEL = \"gpt-5-mini\";\nconst NAME_RE = /^[a-z0-9-]+$/;\n\nexport class AzureExecDeployCommand extends M8tCommand {\n  static paths = [[\"azure-exec\", \"deploy\"]];\n  static usage = Command.Usage({\n    description: \"Deploy the Azure executor as a hosted Foundry worker (az CLI + tiered ops).\",\n    details:\n      \"Creates a hosted agent version from the executor image, grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. The image must already be pushed. Contributor scope is REQUIRED — pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops).\",\n    examples: [\n      [\n        \"Deploy scoped to a resource group\",\n        \"$0 azure-exec deploy azexec --resource-group rg-test --brain m8t-run/azure-exec-smoke-brain --gateway-url https://<gw>/api/a2a/mcp\",\n      ],\n    ],\n  });\n\n  name = Option.String();\n  image = Option.String(\"--image\");\n  imageTag = Option.String(\"--image-tag\");\n  size = Option.String(\"--size\");\n  scope = Option.String(\"--scope\");\n  resourceGroup = Option.String(\"--resource-group\");\n  modelDeployment = Option.String(\"--model-deployment\");\n  env = Option.Array(\"--env\");\n  brain = Option.String(\"--brain\");\n  kvUri = Option.String(\"--kv-uri\");\n  gatewayUrl = Option.String(\"--gateway-url\");\n  endpoint = Option.String(\"--endpoint\");\n  subscription = Option.String(\"--subscription\");\n  output = Option.String(\"--output\");\n  skipQuotaCheck = Option.Boolean(\"--skip-quota-check\", false);\n  grantAccessAdmin = Option.Boolean(\"--grant-access-admin\", false);\n\n  async executeCommand(): Promise<number> {\n    if (!NAME_RE.test(this.name ?? \"\")) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: `Invalid worker name '${this.name}'. Use lowercase letters, digits, and hyphens only.`,\n      });\n    }\n    if (typeof this.brain !== \"string\" || !this.brain.includes(\"/\")) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: \"--brain owner/repo is required (the executor delivers proof to a brain).\",\n        hint: \"Example: --brain m8t-run/azure-exec-smoke-brain\",\n      });\n    }\n\n    const size = (this.size ?? \"large\").toLowerCase();\n    const preset = SIZE_PRESETS[size];\n    if (!preset) {\n      throw new LocalCliError({\n        code: \"USAGE\",\n        message: `Unknown --size '${this.size}'. Use small, medium, or large.`,\n      });\n    }\n\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    const onProgress =\n      mode === \"pretty\" ? (m: string) => this.context.stderr.write(`  ${colors.dim(m)}\\n`) : undefined;\n\n    const credential = new DefaultAzureCredential();\n    const account = await getAzAccount();\n    const subscriptionId = this.subscription ?? account.subscriptionId;\n    const callerObjectId = await getCallerObjectId();\n\n    const grantScope = this.resolveScope(subscriptionId);\n\n    // Fail fast on the high-privilege grant BEFORE any side effects (deploy, Contributor):\n    // an executor that never gets UAA is just Contributor-only (safe), but the operator\n    // should learn they lack the identity-plane role before we burn a deploy.\n    if (this.grantAccessAdmin === true) {\n      const canAssign = await callerCanAssignRoles({ credential, scope: grantScope, callerObjectId });\n      if (!canAssign) {\n        throw new LocalCliError({\n          code: \"CANNOT_GRANT_UAA\",\n          message: `You lack Owner / User Access Administrator at ${grantScope}, so you cannot grant User Access Administrator to the executor.`,\n          hint: \"Re-run from a principal with Owner or UAA at that scope, or drop --grant-access-admin.\",\n        });\n      }\n    }\n\n    const imageInput = this.image ?? DEFAULT_IMAGE;\n    const repoRef = imageInput.includes(\"/\") ? imageInput : `${DEFAULT_ACR}/${imageInput}`;\n    const image = `${repoRef}:${this.imageTag ?? DEFAULT_TAG}`;\n\n    const project = await resolveFoundryProject({\n      credential,\n      subscriptionId,\n      interactive,\n      endpoint: this.endpoint,\n    });\n\n    const processEnv = (this.context.env ?? process.env) as Record<string, string | undefined>;\n    const kvUri = discoverKvUri(processEnv, typeof this.kvUri === \"string\" ? normalizeKvUri(this.kvUri) : undefined);\n\n    onProgress?.(\"checking GitHub App health…\");\n    const health = await checkAppHealth({ credential, kvUri });\n    if (!health.ok) {\n      throw new LocalCliError({\n        code: \"APP_HEALTH_FAILED\",\n        message: \"GitHub App is not configured correctly.\",\n        hint: \"Run `m8t brain check-app` for details.\",\n      });\n    }\n    const { slug, appId, privateKeyPem } = await readAppSecrets({ credential, kvUri });\n    const [owner, repoName] = this.brain.split(\"/\");\n    const installationId = await resolveAppInstallation({\n      owner,\n      repo: repoName,\n      slug,\n      appId,\n      privateKeyPem,\n      write: (s) => this.context.stdout.write(s),\n    });\n\n    const env: Record<string, string> = {\n      MODEL_DEPLOYMENT_NAME: this.modelDeployment ?? DEFAULT_MODEL,\n      REASONING_EFFORT: \"low\",\n      GITHUB_APP_INSTALLATION_ID: installationId,\n      AZURE_KEYVAULT_URI: kvUri,\n    };\n    for (const pair of this.env ?? []) {\n      const eq = pair.indexOf(\"=\");\n      if (eq <= 0) {\n        throw new LocalCliError({\n          code: \"USAGE\",\n          message: `Invalid --env '${pair}'. Expected KEY=VALUE.`,\n        });\n      }\n      env[pair.slice(0, eq)] = pair.slice(eq + 1);\n    }\n\n    const { warnings } = await checkPreconditions({\n      credential,\n      subscriptionId,\n      project,\n      image,\n      callerObjectId,\n    });\n    for (const w of warnings) {\n      this.context.stderr.write(`${colors.hint(\"note:\")} ${w}\\n`);\n    }\n\n    if (this.skipQuotaCheck !== true) {\n      const usages = await listModelQuota(project.region);\n      const { verdict, quotad } = modelQuotaVerdict(usages, env.MODEL_DEPLOYMENT_NAME);\n      if (verdict === \"no_quota\") {\n        throw new LocalCliError({\n          code: \"MODEL_NO_QUOTA\",\n          message: `Model '${env.MODEL_DEPLOYMENT_NAME}' has 0 quota in ${project.region}.`,\n          hint: `Pick a quota'd model (e.g. ${quotad[0] ?? \"gpt-5-mini\"}) or --skip-quota-check.`,\n        });\n      }\n    }\n\n    const { persona: personaName, personaVersion } = resolvePersona(\"azure-executor\");\n\n    const result = await deployHostedWorker({\n      credential,\n      subscriptionId,\n      project,\n      name: this.name,\n      image,\n      cpu: preset.cpu,\n      memory: preset.memory,\n      env,\n      metadata: { source: \"m8t-stack-POC\", kind: \"hosted\", persona: personaName, personaVersion },\n      onProgress,\n    });\n\n    onProgress?.(`granting Contributor at ${grantScope}…`);\n    await grantContributor({\n      credential,\n      subscriptionId,\n      scope: grantScope,\n      principalId: result.principalId,\n    });\n\n    if (this.grantAccessAdmin === true) {\n      // Caller's assign-roles right was verified up front (before the deploy); grant UAA now\n      // that the agent identity exists.\n      onProgress?.(`granting User Access Administrator at ${grantScope}…`);\n      await grantUserAccessAdmin({\n        credential,\n        subscriptionId,\n        scope: grantScope,\n        principalId: result.principalId,\n      });\n    }\n\n    onProgress?.(\"granting Key Vault Secrets User for delivery…\");\n    await ensureDeliveryGrant({\n      credential,\n      subscriptionId,\n      principalId: result.principalId,\n      kvUri,\n    });\n\n    onProgress?.(\"a2a-enabling as a target…\");\n    const personaPath = path.join(resolveRepoRoot(), \"personas\", \"azure-executor\", \"persona.md\");\n    const bridgeUrl = resolveBridgeUrl({\n      flag: typeof this.gatewayUrl === \"string\" ? this.gatewayUrl : undefined,\n      env: processEnv as NodeJS.ProcessEnv,\n    });\n    await enableA2a({\n      credential,\n      projectEndpoint: project.endpoint,\n      projectArmId: `${project.accountScope}/projects/${project.projectName}`,\n      agentName: this.name,\n      personaPath,\n      bridgeUrl,\n      onProgress,\n    });\n\n    if (mode === \"json\") {\n      this.context.stdout.write(\n        renderJson({\n          name: this.name,\n          version: result.version,\n          status: result.status,\n          persona: personaName,\n          image,\n          scope: grantScope,\n          endpoint: project.endpoint,\n          agentPrincipalId: result.principalId,\n        }) + \"\\n\",\n      );\n      return 0;\n    }\n\n    this.context.stdout.write(\n      `${colors.success(\"✓\")} deployed Azure executor ${colors.field(this.name)} (version ${result.version}, ${result.status}, ${size}).\\n`,\n    );\n    this.context.stdout.write(`  scope: ${grantScope}\\n  image: ${image}\\n`);\n    this.context.stdout.write(\n      this.grantAccessAdmin === true\n        ? `  ${colors.hint(\"next:\")} invoke it directly or via a2a; it provisions (Tier 0/1) and executes human-approved Tier-2 (role/delete).\\n`\n        : `  ${colors.hint(\"next:\")} invoke it directly or via a2a; it provisions (Tier 0/1) and refuses Tier-2.\\n`,\n    );\n    return 0;\n  }\n\n  private resolveScope(subscriptionId: string): string {\n    if (typeof this.scope === \"string\" && this.scope.startsWith(\"/subscriptions/\")) return this.scope;\n    if (typeof this.resourceGroup === \"string\" && this.resourceGroup.length > 0) {\n      return `/subscriptions/${subscriptionId}/resourceGroups/${this.resourceGroup}`;\n    }\n    throw new LocalCliError({\n      code: \"USAGE\",\n      message:\n        \"A Contributor scope is required. Pass --resource-group <rg> or --scope <full-arm-id>.\",\n      hint: \"This worker is least-privilege: there is no default scope. Scope it to a resource group (or pass a full --scope id).\",\n    });\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../lib/m8t-command.js\";\nimport { getAzAccount } from \"../lib/auth.js\";\nimport { runAz } from \"../lib/az.js\";\nimport { readFoundryConfig, writeFoundryConfig } from \"../lib/foundry-config.js\";\nimport { ensureAppReg, patchRedirectUris } from \"../lib/app-reg.js\";\nimport {\n  resolveRepoRoot,\n  ensureResourceGroup,\n  resolveFoundryResourceId,\n  runBicepDeployment,\n  buildBicepParams,\n  resolveAcrPullIdentity,\n  resolveAcrResourceId,\n} from \"../lib/deploy.js\";\nimport { LocalCliError } from \"../lib/errors.js\";\nimport { runWhatIf, reportWhatIf } from \"../lib/whatif.js\";\nimport { classifyWhatIf } from \"../lib/whatif-noise.js\";\nimport { colors, renderJson, renderKeyValueBlock, resolveOutputMode } from \"../lib/output.js\";\n\nconst DEFAULT_IMAGE_REF = \"ghcr.io/m8t-run/m8t:latest\";\n\nexport class DeployCommand extends M8tCommand {\n  static paths = [[\"deploy\"]];\n  static usage = Command.Usage({\n    description: \"Deploy (or update) the m8t gateway/webapp stack via Bicep.\",\n    details:\n      \"Ensures the Entra app reg (or pass --client-id to reuse an existing one — required if you can't create app regs), writes ~/.m8t-stack/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t-stack/repo-root.\",\n  });\n\n  subscription = Option.String(\"--subscription\");\n  resourceGroup = Option.String(\"--resource-group\", \"rg-m8t-stack\");\n  location = Option.String(\"--location\", \"eastus\");\n  suffix = Option.String(\"--suffix\", \"\");\n  imageRef = Option.String(\"--image-ref\", DEFAULT_IMAGE_REF);\n  acrPullIdentity = Option.String(\"--acrpull-identity\");\n  acrResourceId = Option.String(\"--acr-resource-id\");\n  foundryEndpoint = Option.String(\"--foundry-endpoint\");\n  foundryResourceId = Option.String(\"--foundry-resource-id\");\n  clientId = Option.String(\"--client-id\");\n  whatIf = Option.Boolean(\"--what-if\", false);\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const log = (msg: string) => {\n      if (mode !== \"json\") this.context.stdout.write(msg + \"\\n\");\n    };\n\n    // Prereqs: set subscription FIRST (so the account below reflects the target\n    // tenant/sub), then read the account, then resolve the foundry endpoint.\n    if (this.subscription) {\n      await runAz([\"account\", \"set\", \"--subscription\", this.subscription]);\n    }\n    const account = await getAzAccount();\n    const foundryEndpoint = this.foundryEndpoint ?? (await readFoundryConfig())?.projectEndpoint;\n    if (!foundryEndpoint) {\n      throw new LocalCliError({\n        code: \"DEPLOY_NO_FOUNDRY_ENDPOINT\",\n        message: \"No Foundry endpoint provided.\",\n        hint: \"Pass --foundry-endpoint <url> or set projectEndpoint in ~/.m8t-stack/config.yaml (m8t config set / m8t switch).\",\n      });\n    }\n\n    if (this.whatIf) {\n      // Strictly read-only: NO app-reg create, NO config write, NO RG create.\n      const clientId = this.clientId ?? (await readFoundryConfig())?.clientId;\n      if (!clientId) {\n        throw new LocalCliError({\n          code: \"DEPLOY_WHATIF_NO_CLIENT\",\n          message: \"--what-if needs a client id but none was provided or configured.\",\n          hint: \"Pass --client-id <appId>, or run from a host with ~/.m8t-stack/config.yaml.\",\n        });\n      }\n      const foundryResourceId = await resolveFoundryResourceId(foundryEndpoint, this.foundryResourceId);\n      const repoRoot = await resolveRepoRoot();\n      const acrPullIdentityResourceId = resolveAcrPullIdentity({ explicit: this.acrPullIdentity });\n      const acrResourceId = acrPullIdentityResourceId ? \"\" : await resolveAcrResourceId({ imageRef: this.imageRef, explicit: this.acrResourceId });\n      const params = buildBicepParams({\n        location: this.location, suffix: this.suffix, imageRef: this.imageRef,\n        tenantId: account.tenantId, clientId,\n        foundryResourceId, foundryProjectEndpoint: foundryEndpoint,\n        acrPullIdentityResourceId, acrResourceId,\n      });\n      const changes = await runWhatIf({ resourceGroup: this.resourceGroup, repoRoot, params });\n      const classified = classifyWhatIf(changes);\n      const { output, exitCode } = reportWhatIf(classified, { json: mode === \"json\" });\n      this.context.stdout.write(output + \"\\n\");\n      return exitCode;\n    }\n\n    // 1. App reg (BYO or managed).\n    log(this.clientId ? `using existing app reg ${this.clientId}` : \"ensuring Entra app reg…\");\n    const app = await ensureAppReg({ tenantId: account.tenantId, clientId: this.clientId });\n    if (app.appObjectId === null && this.clientId) {\n      log(colors.dim(\"  (BYO app reg — skipping Graph writes; ensure it has http://localhost:3000 + the deployed FQDN as SPA redirect URIs and Expose-an-API)\"));\n    }\n\n    // 2. Write config.yaml (Track 2 lib).\n    await writeFoundryConfig({ tenantId: app.tenantId, clientId: app.clientId, projectEndpoint: foundryEndpoint });\n\n    // 3. Resource group.\n    log(`ensuring resource group ${this.resourceGroup}…`);\n    await ensureResourceGroup(this.resourceGroup, this.location);\n\n    // 4. Bicep.\n    const foundryResourceId = await resolveFoundryResourceId(foundryEndpoint, this.foundryResourceId);\n    const repoRoot = await resolveRepoRoot();\n    const acrPullIdentityResourceId = resolveAcrPullIdentity({ explicit: this.acrPullIdentity });\n    // Skip ACR resolution on the reference path — a pure-reference deploy must\n    // not hit DEPLOY_ACR_NOT_FOUND from an unresolvable host label.\n    const acrResourceId = acrPullIdentityResourceId\n      ? \"\"\n      : await resolveAcrResourceId({ imageRef: this.imageRef, explicit: this.acrResourceId });\n    if (acrPullIdentityResourceId) {\n      log(`using AcrPull identity ${acrPullIdentityResourceId.split(\"/\").pop()}`);\n    } else if (acrResourceId) {\n      log(`provisioning AcrPull identity for ${acrResourceId.split(\"/\").pop()}…`);\n    }\n    const params = buildBicepParams({\n      location: this.location,\n      suffix: this.suffix,\n      imageRef: this.imageRef,\n      tenantId: app.tenantId,\n      clientId: app.clientId,\n      foundryResourceId,\n      foundryProjectEndpoint: foundryEndpoint,\n      acrPullIdentityResourceId,\n      acrResourceId,\n    });\n    log(\"running Bicep deployment (~3-5 min)…\");\n    const outputs = await runBicepDeployment({\n      resourceGroup: this.resourceGroup,\n      repoRoot,\n      params,\n      deploymentName: `m8t-deploy-${account.subscriptionId.slice(0, 8)}`,\n    });\n\n    // 5. Redirect URIs (managed only — BYO has no appObjectId).\n    if (app.appObjectId) {\n      await patchRedirectUris(app.appObjectId, outputs.containerAppFqdn);\n    }\n\n    const webappUrl = `https://${outputs.containerAppFqdn}`;\n    if (mode === \"json\") {\n      this.context.stdout.write(\n        renderJson({ webapp: webappUrl, resourceGroup: this.resourceGroup, clientId: app.clientId, resources: outputs.resourceNames }) + \"\\n\",\n      );\n      return 0;\n    }\n    this.context.stdout.write(\n      renderKeyValueBlock([\n        { key: \"webapp\", value: webappUrl },\n        { key: \"resource group\", value: this.resourceGroup },\n        { key: \"client id\", value: app.clientId },\n        { key: \"container app\", value: outputs.resourceNames.containerApp ?? \"-\" },\n      ]) + \"\\n\",\n    );\n    this.context.stdout.write(colors.dim(`next: 'm8t open' to sign in to the webapp.\\n`));\n    return 0;\n  }\n}\n","import { runAz } from \"./az.js\";\nimport { LocalCliError } from \"./errors.js\";\n\nconst APP_NAME = \"m8t-stack-webapp\";\n// Microsoft's first-party Azure CLI app — pre-authorized so\n// `az account get-access-token --scope api://<clientId>/.default` needs no consent.\nconst AZURE_CLI_FIRST_PARTY_APP_ID = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\";\nconst FOUNDRY_SP_APP_ID = \"18a66f5f-dbdf-4c17-9dd7-1634712a9cbe\";\nconst USER_IMPERSONATION_SCOPE_ID = \"1a7925b5-f871-417a-9b8b-303f9f29fa10\";\n\nexport type AppRegResult = { tenantId: string; clientId: string; appObjectId: string | null };\n\n/** JSON `az` helper: parse stdout, or null when empty. */\nasync function azJson<T>(args: string[]): Promise<T | null> {\n  const out = (await runAz(args)).trim();\n  if (!out) return null;\n  return JSON.parse(out) as T;\n}\n\n/**\n * Ensure the app reg has Expose-an-API configured (identifierUris +\n * user_impersonation scope + Azure CLI pre-authorization). Idempotent:\n * skips PATCH when all three pieces are already present; reuses the\n * existing scope ID on re-run; appends Azure CLI to preAuthorizedApps\n * if missing without overwriting other entries.\n *\n * Why two PATCHes: Microsoft Graph validates\n * `preAuthorizedApplications.delegatedPermissionIds` against the\n * EXISTING `api.oauth2PermissionScopes` at PATCH time — a scope being\n * added in the same body is not visible to the validator yet, so a\n * single combined PATCH fails with `InvalidValue: Property\n * api.preAuthorizedApplications.delegatedPermissionIds has a\n * Permission Id that cannot be found in the AppPermissions sets.`\n * We split into two sequential PATCHes: scopes first, then preauth.\n * Skipping either is fine when the corresponding state is already correct.\n */\nexport async function ensureExposeAnApi(appId: string, appObjectId: string): Promise<void> {\n  type AppApiShape = {\n    uris: string[];\n    scopes: Array<{ id: string; value: string; [k: string]: unknown }>;\n    preauth: Array<{ appId: string; delegatedPermissionIds: string[]; [k: string]: unknown }>;\n  };\n  const current = await azJson<AppApiShape>([\n    \"ad\", \"app\", \"show\", \"--id\", appId,\n    \"--query\", \"{uris: identifierUris, scopes: api.oauth2PermissionScopes, preauth: api.preAuthorizedApplications}\",\n    \"--output\", \"json\",\n  ]);\n\n  const targetUri = `api://${appId}`;\n  const existingUris: string[] = Array.isArray(current?.uris) ? current.uris : [];\n  const existingScopes: Array<{ id: string; value: string; [k: string]: unknown }> = Array.isArray(current?.scopes) ? current.scopes : [];\n  const existingPreauth: Array<{ appId: string; delegatedPermissionIds: string[]; [k: string]: unknown }> = Array.isArray(current?.preauth) ? current.preauth : [];\n\n  const uriPresent = existingUris.includes(targetUri);\n  const userImpersonationScope = existingScopes.find((s) => s.value === \"user_impersonation\");\n  const azureCliPreauth = existingPreauth.find((p) => p.appId === AZURE_CLI_FIRST_PARTY_APP_ID);\n\n  // Reuse existing scope ID when re-running; only generate a new one\n  // when no user_impersonation scope exists. This is the key\n  // idempotency guarantee — re-running cannot create duplicate scopes.\n  const scopeId = userImpersonationScope?.id ?? globalThis.crypto.randomUUID();\n\n  const preauthPresent = !!azureCliPreauth?.delegatedPermissionIds?.includes(scopeId);\n\n  if (uriPresent && userImpersonationScope && preauthPresent) {\n    return;\n  }\n\n  // PATCH A: identifierUris + oauth2PermissionScopes (the scope must\n  // exist on the app reg BEFORE Graph will accept a\n  // preAuthorizedApplications entry that references its id). Run when\n  // either piece is missing.\n  if (!uriPresent || !userImpersonationScope) {\n    const newScopes = userImpersonationScope\n      ? existingScopes\n      : [\n          ...existingScopes,\n          {\n            id: scopeId,\n            value: \"user_impersonation\",\n            type: \"User\",\n            adminConsentDescription:\n              \"Allow the application to access m8t-stack on behalf of the signed-in user.\",\n            adminConsentDisplayName: \"Access m8t-stack\",\n            userConsentDescription:\n              \"Allow the application to access m8t-stack on your behalf.\",\n            userConsentDisplayName: \"Access m8t-stack\",\n            isEnabled: true,\n          },\n        ];\n\n    const bodyA = {\n      identifierUris: uriPresent ? existingUris : [...existingUris, targetUri],\n      api: { oauth2PermissionScopes: newScopes },\n    };\n\n    await runAz([\n      \"rest\", \"--method\", \"PATCH\",\n      \"--url\", `https://graph.microsoft.com/v1.0/applications/${appObjectId}`,\n      \"--headers\", \"Content-Type=application/json\",\n      \"--body\", JSON.stringify(bodyA),\n    ]);\n  }\n\n  // PATCH B: preAuthorizedApplications. The scope referenced by\n  // delegatedPermissionIds now exists on the app reg (either it was\n  // there already or PATCH A just added it). Run when Azure CLI's\n  // preauth entry is missing OR doesn't include the user_impersonation\n  // scope id.\n  if (!preauthPresent) {\n    let newPreauth: Array<{ appId: string; delegatedPermissionIds: string[] }>;\n    if (azureCliPreauth) {\n      // Azure CLI is already pre-authorized for at least one scope;\n      // ensure user_impersonation is in its delegatedPermissionIds.\n      const ids = new Set(azureCliPreauth.delegatedPermissionIds ?? []);\n      ids.add(scopeId);\n      newPreauth = existingPreauth.map((p) =>\n        p.appId === AZURE_CLI_FIRST_PARTY_APP_ID\n          ? { appId: p.appId, delegatedPermissionIds: Array.from(ids) }\n          : { appId: p.appId, delegatedPermissionIds: p.delegatedPermissionIds },\n      );\n    } else {\n      newPreauth = [\n        ...existingPreauth.map((p) => ({\n          appId: p.appId,\n          delegatedPermissionIds: p.delegatedPermissionIds,\n        })),\n        {\n          appId: AZURE_CLI_FIRST_PARTY_APP_ID,\n          delegatedPermissionIds: [scopeId],\n        },\n      ];\n    }\n\n    const bodyB = {\n      api: { preAuthorizedApplications: newPreauth },\n    };\n\n    await runAz([\n      \"rest\", \"--method\", \"PATCH\",\n      \"--url\", `https://graph.microsoft.com/v1.0/applications/${appObjectId}`,\n      \"--headers\", \"Content-Type=application/json\",\n      \"--body\", JSON.stringify(bodyB),\n    ]);\n  }\n}\n\n/**\n * Discover or create the Entra app registration for m8t-stack-webapp.\n *\n * BYO path: if `opts.clientId` is provided, short-circuit immediately —\n * the operator is a directory guest and cannot create app regs.\n *\n * Managed path: port of step1_appReg from deploy/setup.mjs.\n */\nexport async function ensureAppReg(opts: {\n  tenantId: string;\n  clientId?: string;\n}): Promise<AppRegResult> {\n  // BYO short-circuit — MUST make zero runAz calls before this return.\n  if (opts.clientId) {\n    return { tenantId: opts.tenantId, clientId: opts.clientId, appObjectId: null };\n  }\n\n  // Managed path: check if app reg already exists\n  const existing = await azJson<Array<{ appId: string }>>(\n    [\"ad\", \"app\", \"list\", \"--display-name\", APP_NAME, \"--output\", \"json\"],\n  );\n\n  if (existing && existing.length > 0) {\n    const app = existing[0];\n    const objId = await azJson<string>(\n      [\"ad\", \"app\", \"show\", \"--id\", app.appId, \"--query\", \"id\", \"--output\", \"json\"],\n    );\n    if (!objId) {\n      throw new LocalCliError({\n        code: \"APP_REG_OBJECT_ID_MISSING\",\n        message: `Could not retrieve object ID for existing app reg ${app.appId}.`,\n      });\n    }\n    await ensureExposeAnApi(app.appId, objId);\n    return { tenantId: opts.tenantId, clientId: app.appId, appObjectId: objId };\n  }\n\n  // Verify a directory admin role before attempting to create the app reg.\n  const me = await azJson<{ id: string }>(\n    [\"ad\", \"signed-in-user\", \"show\", \"--output\", \"json\"],\n  );\n  if (!me) {\n    throw new LocalCliError({\n      code: \"APP_REG_NO_SIGNED_IN_USER\",\n      message: \"Could not determine the signed-in user.\",\n      hint: \"Run 'az login' to sign in.\",\n    });\n  }\n\n  // memberOf is blind to a guest's directory roles (returns [] even when the role\n  // exists); roleManagement/directory/roleAssignments returns them. A 403 here\n  // (an un-privileged guest who can't read directory roles) ⇒ inconclusive (null).\n  let roles: string[] | null;\n  try {\n    roles = (await azJson<string[]>([\n      \"rest\", \"--method\", \"GET\",\n      \"--url\",\n      `https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?$filter=principalId eq '${me.id}'&$expand=roleDefinition`,\n      \"--query\", \"value[].roleDefinition.displayName\",\n      \"--output\", \"json\",\n    ])) ?? [];\n  } catch {\n    roles = null; // read denied (403) — can't determine the user's roles\n  }\n\n  const adminRoles = [\n    \"Global Administrator\",\n    \"Application Administrator\",\n    \"Cloud Application Administrator\",\n  ];\n  const hasAdminRole = roles !== null && roles.some((r) => adminRoles.includes(r));\n\n  if (!hasAdminRole) {\n    if (roles === null) {\n      throw new LocalCliError({\n        code: \"APP_REG_ROLE_UNREADABLE\",\n        message:\n          \"Couldn't verify your directory admin role — Microsoft Graph denied the read (common for guest accounts).\",\n        hint:\n          \"If you're not a directory admin, re-run with --client-id <appId> (BYO app reg per deploy/operator-app-registration-setup.md). If you ARE an admin, ensure Application Administrator is assigned and your account can read directory roles.\",\n      });\n    }\n    throw new LocalCliError({\n      code: \"APP_REG_NO_ADMIN_ROLE\",\n      message:\n        \"You don't hold a directory admin role (Application Administrator / Global Administrator / Cloud Application Administrator).\",\n      hint:\n        \"Re-run with --client-id <appId> (BYO app reg per deploy/operator-app-registration-setup.md), or have a tenant admin assign you one.\",\n    });\n  }\n\n  // 5-command create procedure (encoded from operator-app-registration-setup.md)\n\n  // 1. Find Foundry SP object ID\n  const foundrySpObjId = (await runAz(\n    [\"ad\", \"sp\", \"show\", \"--id\", FOUNDRY_SP_APP_ID, \"--query\", \"id\", \"--output\", \"tsv\"],\n  )).trim();\n\n  // 2. Create the app reg\n  const created = await azJson<{ appId: string; id: string }>([\n    \"ad\", \"app\", \"create\",\n    \"--display-name\", APP_NAME,\n    \"--sign-in-audience\", \"AzureADMyOrg\",\n    \"--output\", \"json\",\n  ]);\n  if (!created) {\n    throw new LocalCliError({\n      code: \"APP_REG_CREATE_FAILED\",\n      message: \"App registration create returned no output.\",\n    });\n  }\n\n  // 3. PATCH SPA redirect URIs (localhost:3000 for dev)\n  await runAz([\n    \"rest\", \"--method\", \"PATCH\",\n    \"--url\", `https://graph.microsoft.com/v1.0/applications/${created.id}`,\n    \"--headers\", \"Content-Type=application/json\",\n    \"--body\", JSON.stringify({ spa: { redirectUris: [\"http://localhost:3000\"] } }),\n  ]);\n\n  // 4. Add Foundry permission\n  await runAz([\n    \"ad\", \"app\", \"permission\", \"add\",\n    \"--id\", created.appId,\n    \"--api\", FOUNDRY_SP_APP_ID,\n    \"--api-permissions\", `${USER_IMPERSONATION_SCOPE_ID}=Scope`,\n  ]);\n\n  // 5. Create app SP + grant tenant-wide admin consent (via Graph POST,\n  // not the broken CLI command)\n  const appSpObjId = (await runAz(\n    [\"ad\", \"sp\", \"create\", \"--id\", created.appId, \"--query\", \"id\", \"--output\", \"tsv\"],\n  )).trim();\n\n  await runAz([\n    \"rest\", \"--method\", \"POST\",\n    \"--url\", \"https://graph.microsoft.com/v1.0/oauth2PermissionGrants\",\n    \"--headers\", \"Content-Type=application/json\",\n    \"--body\", JSON.stringify({\n      clientId: appSpObjId,\n      consentType: \"AllPrincipals\",\n      resourceId: foundrySpObjId,\n      scope: \"user_impersonation\",\n    }),\n  ]);\n\n  await ensureExposeAnApi(created.appId, created.id);\n  return { tenantId: opts.tenantId, clientId: created.appId, appObjectId: created.id };\n}\n\n/**\n * Add the deployed Container App FQDN to the app reg's SPA redirect URIs.\n * Port of step6_patchRedirectUris from deploy/setup.mjs.\n */\nexport async function patchRedirectUris(appObjectId: string, fqdn: string): Promise<void> {\n  const targetUri = `https://${fqdn}`;\n  const existing = (await azJson<string[]>(\n    [\"ad\", \"app\", \"show\", \"--id\", appObjectId, \"--query\", \"spa.redirectUris\", \"--output\", \"json\"],\n  )) ?? [];\n\n  if (existing.includes(targetUri)) {\n    return;\n  }\n\n  const newList = [...existing, targetUri];\n  await runAz([\n    \"rest\", \"--method\", \"PATCH\",\n    \"--url\", `https://graph.microsoft.com/v1.0/applications/${appObjectId}`,\n    \"--headers\", \"Content-Type=application/json\",\n    \"--body\", JSON.stringify({ spa: { redirectUris: newList } }),\n  ]);\n}\n","import * as fs from \"node:fs/promises\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { runAz } from \"./az.js\";\nimport { LocalCliError } from \"./errors.js\";\n\nexport type BicepParams = {\n  location: string;\n  suffix: string;\n  imageRef: string;\n  tenantId: string;\n  clientId: string;\n  foundryResourceId: string;\n  foundryProjectEndpoint: string;\n  acrPullIdentityResourceId: string;\n  acrResourceId: string;\n};\n\nexport type BicepOutputs = {\n  containerAppFqdn: string;\n  resourceNames: Record<string, string>;\n};\n\n/** Build the `key=value` --parameters array for main.bicep (order is stable). */\nexport function buildBicepParams(p: BicepParams): string[] {\n  return [\n    `location=${p.location}`,\n    `suffix=${p.suffix}`,\n    `imageRef=${p.imageRef}`,\n    `tenantId=${p.tenantId}`,\n    `clientId=${p.clientId}`,\n    `foundryResourceId=${p.foundryResourceId}`,\n    `foundryProjectEndpoint=${p.foundryProjectEndpoint}`,\n    `acrPullIdentityResourceId=${p.acrPullIdentityResourceId}`,\n    `acrResourceId=${p.acrResourceId}`,\n  ];\n}\n\n/** Resolve the repo checkout dir from the ~/.m8t-stack/repo-root marker. */\nexport async function resolveRepoRoot(home: string = os.homedir()): Promise<string> {\n  const marker = path.join(home, \".m8t-stack\", \"repo-root\");\n  try {\n    const root = (await fs.readFile(marker, \"utf8\")).trim();\n    if (!root) throw new Error(\"empty\");\n    return root;\n  } catch {\n    throw new LocalCliError({\n      code: \"DEPLOY_NO_REPO_ROOT\",\n      message: \"~/.m8t-stack/repo-root marker is missing or empty.\",\n      hint: \"Run 'm8t install' from an m8t-stack checkout (it writes the marker), or run 'm8t deploy' from the repo.\",\n    });\n  }\n}\n\n/** Resolve the Foundry account ARM id from an explicit value or the endpoint. */\nexport async function resolveFoundryResourceId(\n  endpoint: string,\n  explicit?: string,\n): Promise<string> {\n  if (explicit) return explicit;\n  const m = endpoint.match(/^https:\\/\\/([^.]+)\\.services\\.ai\\.azure\\.com/);\n  if (!m) {\n    throw new LocalCliError({\n      code: \"DEPLOY_FOUNDRY_ENDPOINT_BAD\",\n      message: `Cannot parse the Foundry account name from endpoint: ${endpoint}`,\n      hint: \"Pass --foundry-resource-id <ARM-id> explicitly.\",\n    });\n  }\n  const accounts = JSON.parse(\n    await runAz([\n      \"cognitiveservices\", \"account\", \"list\",\n      \"--query\", `[?name=='${m[1]}'].id`,\n      \"--output\", \"json\",\n    ]),\n  ) as string[];\n  if (!accounts || accounts.length === 0) {\n    throw new LocalCliError({\n      code: \"DEPLOY_FOUNDRY_NOT_FOUND\",\n      message: `No Foundry account named '${m[1]}' in the active subscription.`,\n      hint: \"Check the endpoint, or pass --foundry-resource-id explicitly.\",\n    });\n  }\n  if (accounts.length > 1) {\n    throw new LocalCliError({\n      code: \"DEPLOY_FOUNDRY_AMBIGUOUS\",\n      message: `Multiple Foundry accounts named '${m[1]}' — ambiguous.`,\n      hint: \"Pass --foundry-resource-id <ARM-id> to disambiguate.\",\n    });\n  }\n  return accounts[0];\n}\n\n/**\n * Resolve the ACR ARM resource id for a private-ACR imageRef — needed to scope\n * the AcrPull role assignment when the Bicep provisions the pull identity.\n * Returns '' for public (non-*.azurecr.io) images so the public path is\n * preserved. An explicit --acr-resource-id wins (e.g. a custom login server the\n * host label can't resolve). Throws DEPLOY_ACR_NOT_FOUND when `az acr show`\n * can't find the registry.\n */\nexport async function resolveAcrResourceId(opts: {\n  imageRef: string;\n  explicit?: string;\n}): Promise<string> {\n  if (opts.explicit) return opts.explicit;\n  const host = opts.imageRef.split(\"/\")[0];\n  if (!host.endsWith(\".azurecr.io\")) return \"\";\n  const acrName = host.split(\".\")[0];\n  try {\n    const id = (await runAz([\"acr\", \"show\", \"-n\", acrName, \"--query\", \"id\", \"-o\", \"tsv\"])).trim();\n    if (!id) throw new Error(\"empty id\");\n    return id;\n  } catch (e) {\n    if (e instanceof LocalCliError) throw e;\n    throw new LocalCliError({\n      code: \"DEPLOY_ACR_NOT_FOUND\",\n      message: `Cannot resolve the ACR '${acrName}' for image ${opts.imageRef}.`,\n      hint: \"Create it (az acr create), sign in (az acr login), and push the web image (docker buildx … --push); or pass --acr-resource-id <ARM-id>.\",\n    });\n  }\n}\n\n/** Ensure the resource group exists (create with a deployment tag if not). */\nexport async function ensureResourceGroup(name: string, location: string): Promise<void> {\n  const existing = JSON.parse(\n    (await runAz([\"group\", \"show\", \"--name\", name, \"--output\", \"json\"]).catch(() => \"\")) || \"null\",\n  );\n  if (existing) return;\n  await runAz([\"group\", \"create\", \"--name\", name, \"--location\", location, \"--tags\", \"m8t-stack=deployment\"]);\n}\n\n/**\n * Resolve an explicit AcrPull UA identity override (--acrpull-identity). When\n * empty, returns '' and the Bicep provisions the identity itself (see\n * `provisionAcrPull` in deploy/main.bicep). Pass an external identity id to\n * reference it and skip provisioning (BYO-identity).\n */\nexport function resolveAcrPullIdentity(opts: { explicit?: string }): string {\n  return opts.explicit ?? \"\";\n}\n\n/** Run `az deployment group create` against <repoRoot>/deploy/main.bicep. */\nexport async function runBicepDeployment(opts: {\n  resourceGroup: string;\n  repoRoot: string;\n  params: string[];\n  deploymentName: string;\n}): Promise<BicepOutputs> {\n  const bicepPath = path.join(opts.repoRoot, \"deploy\", \"main.bicep\");\n  const result = JSON.parse(\n    await runAz([\n      \"deployment\", \"group\", \"create\",\n      \"--name\", opts.deploymentName,\n      \"--resource-group\", opts.resourceGroup,\n      \"--template-file\", bicepPath,\n      \"--parameters\", ...opts.params,\n      \"--output\", \"json\",\n    ]),\n  ) as { properties?: { outputs?: Record<string, { value: unknown }> } };\n  const outputs = result.properties?.outputs ?? {};\n  const fqdn = outputs.containerAppFqdn?.value;\n  if (typeof fqdn !== \"string\" || !fqdn) {\n    throw new LocalCliError({\n      code: \"DEPLOY_NO_FQDN\",\n      message: \"Bicep deployment did not return containerAppFqdn.\",\n      hint: \"Check deploy/main.bicep outputs and the deployment log.\",\n    });\n  }\n  return {\n    containerAppFqdn: fqdn,\n    resourceNames: (outputs.resourceNames?.value as Record<string, string>) ?? {},\n  };\n}\n","import * as path from \"node:path\";\nimport { runAz } from \"./az.js\";\nimport type { ClassifiedResult, ClassifiedChange } from \"./whatif-noise.js\";\n\n// Structured ARM What-If result (from `az deployment group what-if --no-pretty-print -o json`).\nexport type WhatIfPropertyChange = {\n  path: string;\n  propertyChangeType: string; // Modify | Create | Delete | Array | NoEffect | NoChange\n  before?: unknown;\n  after?: unknown;\n  children?: WhatIfPropertyChange[];\n};\nexport type WhatIfChange = {\n  resourceId: string;\n  changeType: string; // Modify | Unsupported | NoChange | Ignore | Create | Delete\n  delta?: WhatIfPropertyChange[];\n  unsupportedReason?: string;\n};\nexport type WhatIfResult = { changes?: WhatIfChange[] };\n\n/**\n * Derive the ARM resource type (\"Microsoft.X/type[/subtype]\") from a resourceId.\n * Returns '' for an ARM-expression resourceId (Unsupported changes carry an\n * `[extensionResourceId(...)]` expression, not a normal id).\n */\nexport function deriveResourceType(resourceId: string): string {\n  if (resourceId.startsWith(\"[\")) return \"\";\n  const afterProviders = resourceId.split(\"/providers/\")[1];\n  if (!afterProviders) return \"\";\n  const segs = afterProviders.split(\"/\");\n  const parts = [segs[0]]; // namespace\n  for (let i = 1; i < segs.length; i += 2) parts.push(segs[i]); // type segments at odd indices\n  return parts.join(\"/\");\n}\n\n/** Run `az deployment group what-if --no-pretty-print` and return the changes. Read-only. */\nexport async function runWhatIf(opts: { resourceGroup: string; repoRoot: string; params: string[] }): Promise<WhatIfChange[]> {\n  const bicepPath = path.join(opts.repoRoot, \"deploy\", \"main.bicep\");\n  const out = await runAz([\n    \"deployment\", \"group\", \"what-if\",\n    \"--resource-group\", opts.resourceGroup,\n    \"--template-file\", bicepPath,\n    \"--parameters\", ...opts.params,\n    \"--no-pretty-print\",\n    \"--output\", \"json\",\n  ]);\n  const result = JSON.parse(out) as WhatIfResult;\n  return result.changes ?? [];\n}\n\nconst fmt = (c: ClassifiedChange) =>\n  `  • ${c.resourceType} ${c.path}: ${JSON.stringify(c.before ?? null)} → ${JSON.stringify(c.after ?? null)}${c.reason ? `   [${c.reason}]` : \"\"}`;\n\n/** Build the what-if report + exit code. exitCode 0 ⇔ nothing unexpected. */\nexport function reportWhatIf(r: ClassifiedResult, opts: { json: boolean }): { output: string; exitCode: number } {\n  const exitCode = r.unexpected.length === 0 ? 0 : 1;\n  if (opts.json) {\n    return { output: JSON.stringify({ summary: { noise: r.noise.length, pending: r.pending.length, unexpected: r.unexpected.length }, pending: r.pending, unexpected: r.unexpected, exitCode }, null, 2), exitCode };\n  }\n  const lines: string[] = [];\n  lines.push(`what-if: ${r.noise.length + r.pending.length + r.unexpected.length} changes — ${r.noise.length} known-noise (dropped), ${r.pending.length} known-pending, ${r.unexpected.length} un-catalogued`);\n  if (r.pending.length) {\n    lines.push(\"\", \"known-pending (expected, will apply):\");\n    for (const c of r.pending) lines.push(fmt(c));\n  }\n  if (r.unexpected.length) {\n    lines.push(\"\", \"⚠ UN-CATALOGUED (review before any apply):\");\n    for (const c of r.unexpected) lines.push(fmt(c));\n    lines.push(\"\", `✗ ${r.unexpected.length} un-catalogued change(s) — not safe to apply blindly.`);\n  } else {\n    lines.push(\"\", \"✓ only known noise + expected pending — safe to review for an approved apply.\");\n  }\n  return { output: lines.join(\"\\n\"), exitCode };\n}\n","import { deriveResourceType, type WhatIfChange, type WhatIfPropertyChange } from \"./whatif.js\";\n\nexport type NoiseRule = { resourceType: string; pathPattern: RegExp; reason: string };\n\n// Real, intended changes that an approved apply SHOULD make. Shown, not failed.\nexport const KNOWN_PENDING: NoiseRule[] = [\n  { resourceType: \"Microsoft.ServiceBus/namespaces\", pathPattern: /(^|\\.)minimumTlsVersion$/, reason: \"TLS 1.0→1.2 (the #64 fix); apply will enforce it\" },\n];\n\n// Cosmetic / RP-owned / unanalyzable lines that an apply will NOT meaningfully change.\nexport const KNOWN_NOISE: NoiseRule[] = [\n  { resourceType: \"Microsoft.KeyVault/vaults\", pathPattern: /(^|\\.)networkAcls$/, reason: \"declares the effective default (AzureServices/Allow); verified apply-time no-op\" },\n  { resourceType: \"Microsoft.App/containerApps\", pathPattern: /(^|\\.)ingress\\.exposedPort$/, reason: \"RP runtime field\" },\n  { resourceType: \"Microsoft.App/containerApps\", pathPattern: /(^|\\.)ingress\\.traffic$/, reason: \"RP runtime field\" },\n  { resourceType: \"Microsoft.App/containerApps\", pathPattern: /(^|\\.)runningStatus$/, reason: \"RP runtime status\" },\n  { resourceType: \"Microsoft.App/managedEnvironments\", pathPattern: /(^|\\.)peerAuthentication$/, reason: \"RP default\" },\n  { resourceType: \"Microsoft.App/managedEnvironments\", pathPattern: /(^|\\.)peerTrafficConfiguration$/, reason: \"RP default\" },\n  { resourceType: \"Microsoft.CognitiveServices/accounts/connections\", pathPattern: /(^|\\.)credentials$/, reason: \"write-only credential — always re-shows\" },\n  { resourceType: \"Microsoft.CognitiveServices/accounts/connections\", pathPattern: /(^|\\.)(group|isDefault|peRequirement|peStatus|useWorkspaceManagedIdentity)$/, reason: \"RP connection metadata\" },\n  { resourceType: \"Microsoft.Insights/components\", pathPattern: /(^|\\.)(Flow_Type|Request_Source)$/, reason: \"RP-stamped\" },\n  { resourceType: \"Microsoft.ServiceBus/namespaces/queues\", pathPattern: /(^|\\.)(autoDeleteOnIdle|duplicateDetectionHistoryTimeWindow|maxMessageSizeInKilobytes|maxSizeInMegabytes)$/, reason: \"RP default the bicep doesn't declare\" },\n];\n\nexport type ClassifiedChange = {\n  resourceType: string; resourceName: string; path: string;\n  before?: unknown; after?: unknown; reason?: string;\n};\nexport type ClassifiedResult = { noise: ClassifiedChange[]; pending: ClassifiedChange[]; unexpected: ClassifiedChange[] };\n\nconst shortName = (resourceId: string) =>\n  resourceId.startsWith(\"[\") ? \"(role assignment)\" : resourceId.split(\"/\").pop() ?? resourceId;\n\n// An ARM template expression like \"[reference(...).x]\" / \"[format(...)]\" — a\n// cosmetic what-if artifact that resolves to the same value at deploy time.\nfunction isArmExpression(v: unknown): boolean {\n  return typeof v === \"string\" && /^\\[.*\\b(reference|format|guid|subscriptionResourceId|extensionResourceId)\\(/.test(v) && v.endsWith(\"]\");\n}\n\n// Flatten a delta tree into leaf property changes with dotted/indexed paths.\nfunction flattenDelta(delta: WhatIfPropertyChange[], prefix = \"\"): WhatIfPropertyChange[] {\n  const out: WhatIfPropertyChange[] = [];\n  for (const d of delta) {\n    const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : (prefix ? `.${d.path}` : d.path);\n    const path = prefix ? `${prefix}${segment}` : d.path;\n    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path));\n    else out.push({ ...d, path });\n  }\n  return out;\n}\n\n/** Classify each what-if change into noise / pending / unexpected. Pure. */\nexport function classifyWhatIf(changes: WhatIfChange[]): ClassifiedResult {\n  const noise: ClassifiedChange[] = [], pending: ClassifiedChange[] = [], unexpected: ClassifiedChange[] = [];\n  for (const c of changes) {\n    if (c.changeType === \"NoChange\" || c.changeType === \"Ignore\") continue; // not drift\n    if (c.changeType === \"Create\" || c.changeType === \"Delete\") {\n      // A whole new/removed resource is always signal — never let per-property\n      // noise rules swallow it.\n      unexpected.push({ resourceType: deriveResourceType(c.resourceId), resourceName: shortName(c.resourceId), path: `(resource ${c.changeType.toLowerCase()})` });\n      continue;\n    }\n    if (c.changeType === \"Unsupported\") {\n      const entry: ClassifiedChange = { resourceType: \"(unsupported)\", resourceName: shortName(c.resourceId), path: \"(whole resource)\" };\n      if (/Microsoft\\.Authorization\\/roleAssignments/.test(c.resourceId)) noise.push({ ...entry, reason: \"role assignment GUID from reference() — unanalyzable\" });\n      else unexpected.push(entry);\n      continue;\n    }\n    const resourceType = deriveResourceType(c.resourceId);\n    const resourceName = shortName(c.resourceId);\n    for (const leaf of flattenDelta(c.delta ?? [])) {\n      const base: ClassifiedChange = { resourceType, resourceName, path: leaf.path, before: leaf.before, after: leaf.after };\n      if (leaf.propertyChangeType === \"NoEffect\") { noise.push({ ...base, reason: \"NoEffect (no-op)\" }); continue; }\n      if (isArmExpression(leaf.after)) { noise.push({ ...base, reason: \"reference()/format() artifact — same value\" }); continue; }\n      const pend = KNOWN_PENDING.find((rule) => rule.resourceType === resourceType && rule.pathPattern.test(leaf.path));\n      if (pend) { pending.push({ ...base, reason: pend.reason }); continue; }\n      const n = KNOWN_NOISE.find((rule) => rule.resourceType === resourceType && rule.pathPattern.test(leaf.path));\n      if (n) { noise.push({ ...base, reason: n.reason }); continue; }\n      unexpected.push(base);\n    }\n  }\n  return { noise, pending, unexpected };\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../lib/m8t-command.js\";\nimport { CLI_VERSION } from \"../lib/package-version.js\";\nimport { renderJson, renderKeyValueBlock, resolveOutputMode } from \"../lib/output.js\";\n\nexport class VersionCommand extends M8tCommand {\n  static paths = [[\"version\"], [\"--version\"], [\"-v\"]];\n\n  static usage = Command.Usage({\n    description: \"Print the CLI version.\",\n    details:\n      \"Prints the m8t CLI version. With --verbose, also prints Node version and platform.\",\n    examples: [\n      [\"Print the CLI version\", \"$0 version\"],\n      [\"Print as JSON\", \"$0 version --output json\"],\n    ],\n  });\n\n  output = Option.String(\"--output\", { description: \"pretty | json | auto (default)\" });\n  verbose = Option.Boolean(\"--verbose\", false);\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      (this.output as \"pretty\" | \"json\" | \"auto\" | undefined) ?? \"auto\",\n      this.context.stdout as NodeJS.WriteStream,\n    );\n\n    if (mode === \"json\") {\n      const payload: Record<string, string> = { version: CLI_VERSION };\n      if (this.verbose) {\n        payload.node = process.version;\n        payload.platform = `${process.platform}/${process.arch}`;\n      }\n      this.context.stdout.write(renderJson(payload) + \"\\n\");\n      return 0;\n    }\n\n    if (!this.verbose) {\n      this.context.stdout.write(`${CLI_VERSION}\\n`);\n      return 0;\n    }\n\n    const block = renderKeyValueBlock([\n      { key: \"m8t\", value: CLI_VERSION },\n      { key: \"node\", value: process.version },\n      { key: \"platform\", value: `${process.platform}/${process.arch}` },\n    ]);\n    this.context.stdout.write(block + \"\\n\");\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../lib/m8t-command.js\";\nimport type { MeResponse } from \"@m8t-stack/api-contract\";\nimport { apiCall } from \"../lib/api-client.js\";\nimport { getAzAccount } from \"../lib/auth.js\";\nimport { resolveGatewayContext } from \"../lib/gateway-context.js\";\nimport {\n  colors,\n  renderJson,\n  renderKeyValueBlock,\n  resolveOutputMode,\n} from \"../lib/output.js\";\n\nexport class WhoamiCommand extends M8tCommand {\n  static paths = [[\"whoami\"]];\n  static usage = Command.Usage({\n    description: \"Show your identity + the gateway you'll talk to. Probes the backend.\",\n  });\n\n  output = Option.String(\"--output\");\n  verbose = Option.Boolean(\"--verbose\", false);\n  subscription = Option.String(\"--subscription\", {\n    description: \"Azure subscription ID to discover gateway in (defaults to active az subscription).\",\n  });\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const interactive = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n\n    const azAccount = await getAzAccount();\n    const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription });\n\n    const me = await apiCall<MeResponse>(\n      { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },\n      { method: \"GET\", path: \"/api/me\" },\n      (msg) => this.context.stderr.write(msg + \"\\n\"),\n    );\n\n    const tenantMatch = azAccount.tenantId === ctx.gatewayTenantId;\n\n    if (mode === \"json\") {\n      this.context.stdout.write(\n        renderJson({\n          upn: me.upn,\n          oid: me.oid,\n          tenant: me.tenantId ?? azAccount.tenantId,\n          subscription: azAccount.subscriptionId,\n          subscriptionName: azAccount.subscriptionName,\n          gateway: ctx.gatewayUrl,\n          gatewayTenant: ctx.gatewayTenantId,\n          tenantMatch,\n          backend: \"reachable\",\n          fromCache: ctx.fromCache,\n        }) + \"\\n\",\n      );\n      return 0;\n    }\n\n    const tenantLine = me.tenantId ?? azAccount.tenantId ?? \"(unknown)\";\n    const tenantSuffix = tenantMatch\n      ? colors.dim(\" (matches local az login ✓)\")\n      : colors.dim(\" (mismatch — see hint below)\");\n\n    const block = renderKeyValueBlock([\n      { key: \"upn\", value: me.upn },\n      { key: \"oid\", value: me.oid },\n      { key: \"tenant\", value: tenantLine + tenantSuffix },\n      {\n        key: \"subscription\",\n        value: `${azAccount.subscriptionId} (${azAccount.subscriptionName})`,\n      },\n      { key: \"gateway\", value: ctx.gatewayUrl },\n      {\n        key: \"backend\",\n        value: colors.success(\"reachable (HTTP 200 on /api/me)\"),\n      },\n      ...(ctx.fromCache\n        ? []\n        : [{ key: \"discovery\", value: colors.dim(\"just-discovered (cached for next run)\") }]),\n    ]);\n    this.context.stdout.write(block + \"\\n\");\n\n    if (!tenantMatch) {\n      this.context.stderr.write(\n        colors.hint(\n          `  hint: your active az session is in tenant ${azAccount.tenantId}, but the gateway expects ${ctx.gatewayTenantId}. Run 'az login --tenant ${ctx.gatewayTenantId}'.\\n`,\n        ),\n      );\n    }\n    return 0;\n  }\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../lib/m8t-command.js\";\nimport { resolveLocalContext } from \"../lib/local-context.js\";\nimport {\n  colors,\n  renderJson,\n  renderKeyValueBlock,\n  resolveOutputMode,\n} from \"../lib/output.js\";\n\nexport class StatusCommand extends M8tCommand {\n  static paths = [[\"status\"]];\n  static usage = Command.Usage({\n    description: \"Show the local m8t context: identity, config.yaml, gateway cache, azd mode.\",\n  });\n\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const ctx = await resolveLocalContext();\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(ctx) + \"\\n\");\n      return 0;\n    }\n\n    const block = renderKeyValueBlock([\n      { key: \"az upn\", value: ctx.az?.upn ?? colors.dim(\"(not signed in)\") },\n      { key: \"az tenant\", value: ctx.az?.tenantId ?? \"-\" },\n      {\n        key: \"az subscription\",\n        value: ctx.az ? `${ctx.az.subscriptionId} (${ctx.az.subscriptionName})` : \"-\",\n      },\n      { key: \"config tenant\", value: ctx.foundry?.tenantId ?? colors.dim(\"(no config.yaml)\") },\n      { key: \"config clientId\", value: ctx.foundry?.clientId ?? \"-\" },\n      { key: \"config project\", value: ctx.foundry?.projectName ?? \"-\" },\n      { key: \"config endpoint\", value: ctx.foundry?.projectEndpoint ?? \"-\" },\n      {\n        key: \"tenant aligned\",\n        value: ctx.tenantAligned\n          ? colors.success(\"yes ✓\")\n          : colors.dim(\"no — config.yaml tenant vs az tenant differ\"),\n      },\n      {\n        key: \"gateway cache\",\n        value: ctx.gatewayCache?.gatewayUrl ?? colors.dim(\"none — discovers on next command\"),\n      },\n      { key: \"azd follows az\", value: ctx.azdFollowsAz ? \"yes\" : \"no\" },\n    ]);\n    this.context.stdout.write(block + \"\\n\");\n    return 0;\n  }\n}\n","import { spawn } from \"node:child_process\";\nimport { LocalCliError } from \"./errors.js\";\n\n/** Run an `azd` CLI command, resolving stdout. Throws LocalCliError on failure. */\nexport function runAzd(args: string[]): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const proc = spawn(\"azd\", args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    const out: Buffer[] = [];\n    const err: Buffer[] = [];\n    proc.stdout.on(\"data\", (d: Buffer) => out.push(d));\n    proc.stderr.on(\"data\", (d: Buffer) => err.push(d));\n    proc.on(\"error\", (e) => {\n      if ((e as NodeJS.ErrnoException).code === \"ENOENT\") {\n        reject(\n          new LocalCliError({\n            code: \"AZD_NOT_INSTALLED\",\n            message: \"The 'azd' command is not installed or not on PATH.\",\n            hint: \"Install the Azure Developer CLI: https://aka.ms/azd-install\",\n          }),\n        );\n        return;\n      }\n      reject(e);\n    });\n    proc.on(\"close\", (code) => {\n      if (code !== 0) {\n        reject(\n          new LocalCliError({\n            code: \"AZD_COMMAND_FAILED\",\n            message: `'azd ${args.join(\" \")}' failed: ${Buffer.concat(err).toString(\"utf8\").trim()}`,\n          }),\n        );\n        return;\n      }\n      resolve(Buffer.concat(out).toString(\"utf8\"));\n    });\n  });\n}\n\n/** True when azd is configured to reuse the az CLI login. False if unset/errored. */\nexport async function getAzdFollowsAz(): Promise<boolean> {\n  try {\n    const out = await runAzd([\"config\", \"get\", \"auth.useAzCliAuth\"]);\n    return out.trim().replace(/^\"|\"$/g, \"\") === \"true\";\n  } catch {\n    return false;\n  }\n}\n\nexport async function setAzdFollowAz(): Promise<void> {\n  await runAzd([\"config\", \"set\", \"auth.useAzCliAuth\", \"true\"]);\n}\n","import { getAzAccount, type AzAccountInfo } from \"./auth.js\";\nimport { readFoundryConfig, readSeedEndpoint, type FoundryConfig } from \"./foundry-config.js\";\nimport { readConfig, type CliConfig } from \"./config.js\";\nimport { getAzdFollowsAz } from \"./azd.js\";\n\nexport type LocalContext = {\n  az: AzAccountInfo | null;\n  foundry: FoundryConfig | null;\n  seedEndpoint: string | null;\n  gatewayCache: CliConfig | null;\n  azdFollowsAz: boolean;\n  tenantAligned: boolean;\n};\n\n/** Gather the full local m8t picture. Never throws on a missing/unauthenticated\n *  piece — each absent surface becomes null/false. */\nexport async function resolveLocalContext(): Promise<LocalContext> {\n  const az = await getAzAccount().catch(() => null);\n  const foundry = await readFoundryConfig();\n  const seedEndpoint = await readSeedEndpoint();\n  const gatewayCache = await readConfig();\n  const azdFollowsAz = await getAzdFollowsAz();\n  const tenantAligned = az !== null && foundry !== null && az.tenantId === foundry.tenantId;\n  return { az, foundry, seedEndpoint, gatewayCache, azdFollowsAz, tenantAligned };\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../lib/m8t-command.js\";\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { getAzAccount, getBearerToken, getFoundryToken, getCallerObjectId } from \"../lib/auth.js\";\nimport { readFoundryConfig } from \"../lib/foundry-config.js\";\nimport { resolveGatewayContext } from \"../lib/gateway-context.js\";\nimport { runAz } from \"../lib/az.js\";\nimport {\n  checkAzSignedIn,\n  checkFoundryConfig,\n  checkTenantAlignment,\n  checkGatewayReachable,\n  checkDataPlane,\n  checkReasoningCapacity,\n  checkDeliveryGrant,\n  checkModelQuota,\n  type CheckResult,\n  type ModelDeployment,\n} from \"../lib/doctor-checks.js\";\nimport { listModelQuota } from \"../lib/quota.js\";\nimport { getAgentVersion } from \"../lib/foundry-agent-get.js\";\nimport { getAgentIdentityPrincipalId } from \"../lib/foundry-agents.js\";\nimport { resolveKeyVaultResourceId, principalHasKvSecretsUser } from \"../lib/rbac.js\";\nimport { colors, renderJson, resolveOutputMode } from \"../lib/output.js\";\n\nasync function resolveFoundryAccountId(endpoint: string): Promise<string | null> {\n  const m = endpoint.match(/^https:\\/\\/([^.]+)\\.services\\.ai\\.azure\\.com/);\n  if (!m) return null;\n  try {\n    const out = await runAz([\n      \"cognitiveservices\", \"account\", \"list\",\n      \"--query\", `[?name=='${m[1]}'].id`,\n      \"--output\", \"json\",\n    ]);\n    const ids = JSON.parse(out) as string[];\n    return ids[0] ?? null;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseAccountId(id: string): { rg: string; name: string } | null {\n  const m = id.match(/\\/resourceGroups\\/([^/]+)\\/.*\\/accounts\\/([^/]+)$/i);\n  return m ? { rg: m[1], name: m[2] } : null;\n}\n\nasync function listModelDeployments(accountId: string): Promise<ModelDeployment[]> {\n  const parsed = parseAccountId(accountId);\n  if (!parsed) return [];\n  try {\n    const out = await runAz([\n      \"cognitiveservices\", \"account\", \"deployment\", \"list\",\n      \"-g\", parsed.rg, \"-n\", parsed.name,\n      \"--output\", \"json\",\n    ]);\n    const raw = JSON.parse(out) as Array<{\n      name?: string;\n      sku?: { capacity?: number };\n      properties?: { model?: { name?: string } };\n    }>;\n    return raw.map((d) => ({\n      name: d.name ?? \"\",\n      model: d.properties?.model?.name ?? \"\",\n      capacity: d.sku?.capacity ?? 0,\n    }));\n  } catch {\n    return [];\n  }\n}\n\nasync function resolveAccountLocation(accountId: string): Promise<string | null> {\n  const parsed = parseAccountId(accountId);\n  if (!parsed) return null;\n  try {\n    const out = await runAz([\"cognitiveservices\", \"account\", \"show\", \"-g\", parsed.rg, \"-n\", parsed.name, \"--query\", \"location\", \"--output\", \"tsv\"]);\n    return out.trim() || null;\n  } catch {\n    return null;\n  }\n}\n\nexport class DoctorCommand extends M8tCommand {\n  static paths = [[\"doctor\"]];\n  static usage = Command.Usage({\n    description: \"Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane.\",\n  });\n\n  output = Option.String(\"--output\");\n  agent = Option.String(\"--agent\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const json = mode === \"json\";\n\n    const glyph: Record<string, string> = {\n      PASS: colors.success(\"PASS\"),\n      WARN: colors.hint(\"WARN\"),\n      FAIL: colors.error(\"FAIL\"),\n      INFO: colors.dim(\"INFO\"),\n    };\n\n    // Several checks do network I/O (gateway probe, Foundry data-plane probe)\n    // that can take a few seconds. In pretty mode we STREAM each result the\n    // moment it resolves so the terminal isn't dead; JSON mode accumulates and\n    // emits one object at the end so `--output json` stays parseable.\n    const checks: CheckResult[] = [];\n    const emit = (c: CheckResult): void => {\n      checks.push(c);\n      if (json) return;\n      this.context.stdout.write(`[${glyph[c.status]}] ${c.name}: ${c.detail}\\n`);\n      if (c.remediation) {\n        this.context.stdout.write(colors.hint(`        fix: ${c.remediation}`) + \"\\n\");\n      }\n    };\n    // Activity hint before a slow probe → stderr (keeps stdout clean for pipes).\n    const checking = (what: string): void => {\n      if (!json) this.context.stderr.write(colors.dim(`  checking ${what}…`) + \"\\n\");\n    };\n\n    if (!json) this.context.stdout.write(colors.dim(\"running m8t doctor…\") + \"\\n\");\n\n    // Fast local checks.\n    const az = await getAzAccount().catch(() => null);\n    emit(checkAzSignedIn(az));\n    const foundry = await readFoundryConfig();\n    emit(checkFoundryConfig(foundry));\n    emit(checkTenantAlignment(az, foundry));\n\n    // Gateway probe (network): discover + GET /api/me with a bearer token.\n    checking(\"gateway\");\n    let gw = { ok: false, detail: \"not probed\" };\n    try {\n      const ctx = await resolveGatewayContext({ interactive: false });\n      const token = await getBearerToken(ctx.gatewayClientId);\n      const res = await fetch(`${ctx.gatewayUrl}/api/me`, {\n        headers: { Authorization: `Bearer ${token}` },\n      });\n      gw = { ok: res.ok, detail: `HTTP ${res.status} on ${ctx.gatewayUrl}/api/me` };\n    } catch (e) {\n      gw = { ok: false, detail: (e as Error).message };\n    }\n    emit(checkGatewayReachable(gw));\n\n    // Data-plane probe (network, only if we have a project endpoint).\n    if (foundry) {\n      checking(\"Foundry data-plane\");\n      let status = 0;\n      try {\n        const token = await getFoundryToken();\n        const res = await fetch(`${foundry.projectEndpoint}/assistants?api-version=2025-05-01`, {\n          headers: { Authorization: `Bearer ${token}` },\n        });\n        status = res.status;\n      } catch {\n        status = 0;\n      }\n      const foundryAccountId = await resolveFoundryAccountId(foundry.projectEndpoint);\n      const oid = await getCallerObjectId().catch(() => null);\n      emit(checkDataPlane({ status, foundryAccountId, oid }));\n\n      // Capacity preflight: warn if the reasoning/brain model deployment is\n      // under ~250 TPM (F3.5 hit 429s at the Foundry default 50). Reuses the\n      // foundryAccountId resolved above; INFO-degrades on any az/parse error.\n      checking(\"model capacity\");\n      const deployments = foundryAccountId ? await listModelDeployments(foundryAccountId) : [];\n      emit(checkReasoningCapacity(deployments));\n\n      checking(\"model quota\");\n      const region = foundryAccountId ? await resolveAccountLocation(foundryAccountId) : null;\n      const usages = region ? await listModelQuota(region) : [];\n      emit(checkModelQuota(deployments, usages));\n\n      // Targeted delivery-grant net: when --agent is given, verify that agent can\n      // read its brain token. Uses only proven single-agent REST calls; INFO-degrades.\n      if (typeof this.agent === \"string\" && this.agent) {\n        checking(`delivery grant for ${this.agent}`);\n        try {\n          const credential = new DefaultAzureCredential();\n          const cur = await getAgentVersion({\n            credential,\n            projectEndpoint: foundry.projectEndpoint,\n            agentName: this.agent,\n          });\n          const agentEnv = ((cur.definition as Record<string, unknown>).environment_variables as Record<string, string> | undefined) ?? {};\n          const installationId = agentEnv.GITHUB_APP_INSTALLATION_ID?.trim();\n          const kvUri = agentEnv.AZURE_KEYVAULT_URI?.trim();\n          if (installationId && kvUri) {\n            const principalId = await getAgentIdentityPrincipalId({\n              credential,\n              endpoint: foundry.projectEndpoint,\n              name: this.agent,\n              version: cur.version,\n            });\n            const subscriptionId = az?.subscriptionId;\n            if (!subscriptionId) {\n              emit({ name: \"delivery KV grant\", status: \"INFO\", detail: `skipped '${this.agent}' — az not signed in (run az login)` });\n            } else {\n              const kvScope = await resolveKeyVaultResourceId({ credential, subscriptionId, kvUri });\n              const hasGrant = await principalHasKvSecretsUser({ credential, kvScope, principalId });\n              emit(checkDeliveryGrant([{ agentName: this.agent, hasDeliveryEnv: true, hasGrant }]));\n            }\n          } else {\n            emit(checkDeliveryGrant([{ agentName: this.agent, hasDeliveryEnv: false, hasGrant: false }]));\n          }\n        } catch (e) {\n          emit({ name: \"delivery KV grant\", status: \"INFO\", detail: `could not check '${this.agent}': ${(e as Error).message}` });\n        }\n      }\n    } else {\n      emit({ name: \"foundry data-plane\", status: \"INFO\", detail: \"skipped — no config.yaml\" });\n    }\n\n    const failed = checks.some((c) => c.status === \"FAIL\");\n    if (json) {\n      this.context.stdout.write(renderJson({ ok: !failed, checks }) + \"\\n\");\n    }\n    return failed ? 1 : 0;\n  }\n}\n","import type { AzAccountInfo } from \"./auth.js\";\nimport type { FoundryConfig } from \"./foundry-config.js\";\nimport { type ModelQuota, usageModelName } from \"./quota.js\";\n\nexport type CheckStatus = \"PASS\" | \"WARN\" | \"FAIL\" | \"INFO\";\nexport type CheckResult = {\n  name: string;\n  status: CheckStatus;\n  detail: string;\n  remediation?: string;\n};\n\nexport function checkAzSignedIn(az: AzAccountInfo | null): CheckResult {\n  if (!az || !az.tenantId) {\n    return { name: \"az signed in\", status: \"FAIL\", detail: \"not signed in to Azure\", remediation: \"az login\" };\n  }\n  return { name: \"az signed in\", status: \"PASS\", detail: `${az.upn} (tenant ${az.tenantId})` };\n}\n\nexport function checkFoundryConfig(cfg: FoundryConfig | null): CheckResult {\n  if (!cfg) {\n    return {\n      name: \"config.yaml\",\n      status: \"FAIL\",\n      detail: \"missing or invalid ~/.m8t-stack/config.yaml\",\n      remediation: \"m8t switch   (or  m8t config set tenantId|clientId|projectEndpoint <value>)\",\n    };\n  }\n  return { name: \"config.yaml\", status: \"PASS\", detail: `project ${cfg.projectName}` };\n}\n\nexport function checkTenantAlignment(az: AzAccountInfo | null, cfg: FoundryConfig | null): CheckResult {\n  if (!az || !cfg) {\n    return { name: \"tenant alignment\", status: \"WARN\", detail: \"cannot compare — az or config.yaml missing\" };\n  }\n  if (az.tenantId === cfg.tenantId) {\n    return { name: \"tenant alignment\", status: \"PASS\", detail: `both ${az.tenantId}` };\n  }\n  return {\n    name: \"tenant alignment\",\n    status: \"WARN\",\n    detail: `az tenant ${az.tenantId} ≠ config tenant ${cfg.tenantId}`,\n    remediation: `m8t switch   (or  az login --tenant ${cfg.tenantId})`,\n  };\n}\n\nexport function checkGatewayReachable(probe: { ok: boolean; detail: string }): CheckResult {\n  return probe.ok\n    ? { name: \"gateway reachable\", status: \"PASS\", detail: probe.detail }\n    : {\n        name: \"gateway reachable\",\n        status: \"FAIL\",\n        detail: probe.detail,\n        remediation: \"m8t whoami --verbose   to see the discovery/probe error\",\n      };\n}\n\nexport function checkDataPlane(probe: {\n  status: number;\n  foundryAccountId: string | null;\n  oid: string | null;\n}): CheckResult {\n  if (probe.status >= 200 && probe.status < 300) {\n    return { name: \"foundry data-plane\", status: \"PASS\", detail: `HTTP ${probe.status}` };\n  }\n  if (probe.status === 401 || probe.status === 403) {\n    const scope = probe.foundryAccountId ?? \"<foundry-account-resource-id>\";\n    const oid = probe.oid ?? \"<your-object-id>\";\n    return {\n      name: \"foundry data-plane\",\n      status: \"FAIL\",\n      detail: `HTTP ${probe.status} — your identity lacks a data-plane role on the Foundry account`,\n      remediation: `az role assignment create --assignee-object-id ${oid} --assignee-principal-type User --role \"Cognitive Services User\" --scope ${scope}`,\n    };\n  }\n  return {\n    name: \"foundry data-plane\",\n    status: \"WARN\",\n    detail: `HTTP ${probe.status || \"(unreachable)\"} — unexpected; re-run with --verbose`,\n  };\n}\n\nexport type ModelDeployment = { name: string; model: string; capacity: number };\n\nexport type DeliveryGrantProbe = { agentName: string; hasDeliveryEnv: boolean; hasGrant: boolean };\n\nexport function checkDeliveryGrant(probes: DeliveryGrantProbe[]): CheckResult {\n  const withDelivery = probes.filter((p) => p.hasDeliveryEnv);\n  if (withDelivery.length === 0) {\n    return {\n      name: \"delivery KV grant\",\n      status: \"INFO\",\n      detail: \"no checked agent has delivery creds (GITHUB_APP_INSTALLATION_ID + AZURE_KEYVAULT_URI) set\",\n    };\n  }\n  const missing = withDelivery.filter((p) => !p.hasGrant);\n  if (missing.length === 0) {\n    return {\n      name: \"delivery KV grant\",\n      status: \"PASS\",\n      detail: `${withDelivery.map((p) => p.agentName).join(\", \")} can read the brain token`,\n    };\n  }\n  return {\n    name: \"delivery KV grant\",\n    status: \"WARN\",\n    detail: `${missing.map((p) => p.agentName).join(\", \")} ${missing.length === 1 ? \"has\" : \"have\"} delivery env but lack Key Vault Secrets User — can't read the brain token (silent empty output)`,\n    remediation: `re-run 'm8t coder deploy <name> --env GITHUB_APP_INSTALLATION_ID=… --env AZURE_KEYVAULT_URI=…' (now auto-grants), or grant manually: az role assignment create --role \"Key Vault Secrets User\" --assignee <agent-principal> --scope <kv-resource-id>`,\n  };\n}\n\n// Reasoning-family models (the brain/reasoning workers run on these). F3.5 hit\n// 429s at the Foundry default capacity 50 (= 50k TPM) and bumped to 250.\nconst REASONING_MODEL_RE = /^(gpt-5|o1|o3|o4)/i;\nconst MIN_REASONING_CAPACITY = 250;\n\nexport function checkReasoningCapacity(\n  deployments: ModelDeployment[],\n  threshold = MIN_REASONING_CAPACITY,\n): CheckResult {\n  const reasoning = deployments.filter((d) => REASONING_MODEL_RE.test(d.model));\n  if (reasoning.length === 0) {\n    return {\n      name: \"reasoning model capacity\",\n      status: \"INFO\",\n      detail: \"no reasoning-family (gpt-5*/o*) model deployment found — brain/reasoning workers need one provisioned\",\n    };\n  }\n  const under = reasoning.filter((d) => d.capacity < threshold);\n  if (under.length === 0) {\n    return {\n      name: \"reasoning model capacity\",\n      status: \"PASS\",\n      detail: reasoning.map((d) => `${d.name} (${d.model}) capacity ${d.capacity}`).join(\", \"),\n    };\n  }\n  return {\n    name: \"reasoning model capacity\",\n    status: \"WARN\",\n    detail: `${under\n      .map((d) => `${d.name} (${d.model}) capacity ${d.capacity} < ${threshold}`)\n      .join(\"; \")} — heavy/brain turns may 429 (each unit ≈ 1k TPM)`,\n    remediation: `raise to ≥${threshold}: az cognitiveservices account deployment create -g <rg> -n <account> --deployment-name ${under[0].name} --sku-capacity ${threshold} --model-name <model> --model-format OpenAI --model-version <ver> (quota permitting; see deploy/README.md Prerequisites)`,\n  };\n}\n\nexport function checkModelQuota(deployments: ModelDeployment[], usages: ModelQuota[]): CheckResult {\n  if (usages.length === 0) {\n    return { name: \"model quota\", status: \"INFO\", detail: \"could not read 'az cognitiveservices usage list'\" };\n  }\n  const zero = deployments.filter((d) => {\n    if (!d.model) return false;\n    const dt = d.model.toLowerCase();\n    const u = usages.filter((x) => usageModelName(x.name).toLowerCase() === dt);\n    return u.length > 0 && u.every((x) => x.limit === 0);\n  });\n  if (zero.length === 0) {\n    const quotad = [...new Set(usages.filter((u) => u.limit > 0 && /gpt-5|o[1-9]/i.test(u.name)).map((u) => usageModelName(u.name)))];\n    return { name: \"model quota\", status: \"PASS\", detail: `quota'd reasoning models: ${quotad.join(\", \") || \"(none gpt-5*/o*)\"}` };\n  }\n  return {\n    name: \"model quota\",\n    status: \"WARN\",\n    detail: `deployed model(s) with 0 quota: ${zero.map((d) => `${d.name} (${d.model})`).join(\", \")} — redeploy/scale will fail`,\n    remediation: \"switch to a quota'd model or request quota (see 'az cognitiveservices usage list -l <region>')\",\n  };\n}\n","import { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../lib/m8t-command.js\";\nimport { discoverySwitch, profileSwitch, type SwitchResult } from \"../lib/switch.js\";\nimport { listProfiles } from \"../lib/profiles.js\";\nimport { readFoundryConfig } from \"../lib/foundry-config.js\";\nimport { LocalCliError } from \"../lib/errors.js\";\nimport { colors, renderJson, renderKeyValueBlock, resolveOutputMode } from \"../lib/output.js\";\n\nexport class SwitchCommand extends M8tCommand {\n  static paths = [[\"switch\"]];\n  static usage = Command.Usage({\n    description:\n      \"Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>.\",\n  });\n\n  profile = Option.String({ required: false });\n  subscription = Option.String(\"--subscription\");\n  list = Option.Boolean(\"--list\", false);\n  as = Option.String(\"--as\");\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n\n    if (this.list) {\n      const profiles = await listProfiles();\n      const current = await readFoundryConfig();\n      if (mode === \"json\") {\n        this.context.stdout.write(\n          renderJson({ profiles, currentTenant: current?.tenantId ?? null }) + \"\\n\",\n        );\n        return 0;\n      }\n      this.context.stdout.write(\n        profiles.length\n          ? \"saved profiles:\\n\" + profiles.map((p) => `  ${p}`).join(\"\\n\") + \"\\n\"\n          : \"no saved profiles yet.\\n\",\n      );\n      if (current) {\n        this.context.stdout.write(colors.dim(`current tenant: ${current.tenantId}`) + \"\\n\");\n      }\n      return 0;\n    }\n\n    let result: SwitchResult;\n    if (this.subscription) {\n      result = await discoverySwitch(this.subscription, this.as);\n    } else if (this.profile) {\n      result = await profileSwitch(this.profile, this.as);\n    } else {\n      throw new LocalCliError({\n        code: \"SWITCH_NO_TARGET\",\n        message: \"No switch target specified.\",\n        hint: \"Use 'm8t switch --subscription <id|name>' or 'm8t switch <profile>' (list with --list).\",\n      });\n    }\n\n    if (mode === \"json\") {\n      this.context.stdout.write(renderJson(result) + \"\\n\");\n      return 0;\n    }\n    this.context.stdout.write(\n      renderKeyValueBlock([\n        { key: \"tenant\", value: result.tenantId },\n        { key: \"clientId\", value: result.clientId },\n        { key: \"endpoint\", value: result.projectEndpoint },\n        { key: \"subscription\", value: result.subscriptionId },\n        { key: \"saved profile\", value: result.snapshot ?? colors.dim(\"(nothing to snapshot)\") },\n      ]) + \"\\n\",\n    );\n    this.context.stdout.write(\n      colors.dim(\"next: run 'm8t doctor' to verify gateway + data-plane access.\\n\"),\n    );\n    return 0;\n  }\n}\n","import * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\n\nexport type Profile = {\n  name: string;\n  savedAt: string;\n  subscriptionId: string;\n  tenantId: string;\n  config: { tenantId: string; clientId: string; projectEndpoint: string };\n  seedEndpoint: string;\n};\n\nfunction profilesDir(): string {\n  const home = process.env.HOME ?? process.env.USERPROFILE ?? \"\";\n  return path.join(home, \".m8t-stack\", \"profiles\");\n}\n\nexport function getProfilePath(name: string): string {\n  return path.join(profilesDir(), `${path.basename(name)}.yaml`);\n}\n\n/** Friendly slug from a tenant domain (or id): lowercase, prefix before the\n *  first dot, alnum+dash only. Falls back to \"profile\". */\nexport function slugifyTenant(domainOrId: string): string {\n  const base = domainOrId.split(\".\")[0].toLowerCase();\n  const slug = base.replace(/[^a-z0-9-]/g, \"\");\n  return slug.length > 0 ? slug : \"profile\";\n}\n\nexport async function listProfiles(): Promise<string[]> {\n  try {\n    const entries = await fs.readdir(profilesDir());\n    return entries\n      .filter((e) => e.endsWith(\".yaml\"))\n      .map((e) => e.replace(/\\.yaml$/, \"\"))\n      .sort();\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw e;\n  }\n}\n\nexport async function readProfile(name: string): Promise<Profile | null> {\n  try {\n    const raw = await fs.readFile(getProfilePath(name), \"utf8\");\n    const parsed = parseYaml(raw);\n    if (!parsed || typeof parsed !== \"object\") return null;\n    return parsed as Profile;\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw e;\n  }\n}\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await fs.stat(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Save a profile. If `name` is taken, append -2, -3, … Returns the saved name. */\nexport async function saveProfile(p: Profile): Promise<string> {\n  await fs.mkdir(profilesDir(), { recursive: true });\n  let name = p.name;\n  let n = 2;\n  while (await exists(getProfilePath(name))) {\n    name = `${p.name}-${n}`;\n    n++;\n  }\n  const target = getProfilePath(name);\n  const tmp = `${target}.tmp`;\n  await fs.writeFile(tmp, stringifyYaml({ ...p, name }, { indent: 2 }), \"utf8\");\n  await fs.rename(tmp, target);\n  return name;\n}\n","import { runAz } from \"./az.js\";\nimport { getAzAccount } from \"./auth.js\";\nimport { discoverGateway } from \"./discovery.js\";\nimport { readFoundryConfig, readSeedEndpoint, writeFoundryConfig } from \"./foundry-config.js\";\nimport { saveProfile, readProfile, slugifyTenant, type Profile } from \"./profiles.js\";\nimport { resolveGatewayContext } from \"./gateway-context.js\";\nimport { setAzdFollowAz } from \"./azd.js\";\nimport { LocalCliError } from \"./errors.js\";\n\nexport type SwitchResult = {\n  tenantId: string;\n  clientId: string;\n  projectEndpoint: string;\n  subscriptionId: string;\n  /** Profile name the OUTGOING config was snapshotted as (null if nothing to save). */\n  snapshot: string | null;\n};\n\n/** Snapshot the current config.yaml + az context to a profile so a switch is\n *  reversible. Returns the saved name, or null if there's nothing coherent. */\nasync function snapshotOutgoing(asName?: string): Promise<string | null> {\n  const az = await getAzAccount().catch(() => null);\n  const cfg = await readFoundryConfig();\n  if (!az || !cfg) return null;\n  const seed = await readSeedEndpoint();\n  const profile: Profile = {\n    name: asName ?? slugifyTenant(cfg.tenantId),\n    savedAt: new Date().toISOString(),\n    subscriptionId: az.subscriptionId,\n    tenantId: az.tenantId,\n    config: { tenantId: cfg.tenantId, clientId: cfg.clientId, projectEndpoint: cfg.projectEndpoint },\n    seedEndpoint: seed ?? cfg.projectEndpoint,\n  };\n  return await saveProfile(profile);\n}\n\nexport async function discoverySwitch(subscription: string, asName?: string): Promise<SwitchResult> {\n  const subs = JSON.parse(await runAz([\"account\", \"list\", \"--all\", \"--output\", \"json\"])) as Array<{\n    id: string;\n    name: string;\n    tenantId: string;\n  }>;\n  const target = subs.find((s) => s.id === subscription || s.name === subscription);\n  if (!target) {\n    throw new LocalCliError({\n      code: \"SWITCH_SUB_NOT_FOUND\",\n      message: `Subscription '${subscription}' is not in your az login.`,\n      hint: \"Run 'az login --tenant <tenant-id> --use-device-code' for the target directory, then retry.\",\n    });\n  }\n  // Snapshot the OUTGOING context (old sub + old config.yaml) BEFORE switching az.\n  const snapshot = await snapshotOutgoing(asName);\n  await runAz([\"account\", \"set\", \"--subscription\", target.id]);\n  const gw = await discoverGateway({ interactive: false, subscriptionId: target.id });\n  if (!gw.projectEndpoint) {\n    throw new LocalCliError({\n      code: \"SWITCH_NO_ENDPOINT\",\n      message: `The gateway in '${target.name}' has no FOUNDRY_PROJECT_ENDPOINT env var.`,\n      hint: \"Set it manually: 'm8t config set projectEndpoint <url>'.\",\n    });\n  }\n  await writeFoundryConfig({\n    tenantId: gw.gatewayTenantId,\n    clientId: gw.gatewayClientId,\n    projectEndpoint: gw.projectEndpoint,\n  });\n  await resolveGatewayContext({ interactive: false, forceRediscover: true });\n  await setAzdFollowAz();\n  return {\n    tenantId: gw.gatewayTenantId,\n    clientId: gw.gatewayClientId,\n    projectEndpoint: gw.projectEndpoint,\n    subscriptionId: target.id,\n    snapshot,\n  };\n}\n\nexport async function profileSwitch(name: string, asName?: string): Promise<SwitchResult> {\n  const prof = await readProfile(name);\n  if (!prof) {\n    throw new LocalCliError({\n      code: \"SWITCH_PROFILE_NOT_FOUND\",\n      message: `No saved profile '${name}'.`,\n      hint: \"List profiles with 'm8t switch --list'.\",\n    });\n  }\n  const snapshot = await snapshotOutgoing(asName);\n  await runAz([\"account\", \"set\", \"--subscription\", prof.subscriptionId]).catch(() => undefined);\n  await writeFoundryConfig(prof.config);\n  await resolveGatewayContext({ interactive: false, forceRediscover: true }).catch(() => undefined);\n  await setAzdFollowAz();\n  return {\n    tenantId: prof.config.tenantId,\n    clientId: prof.config.clientId,\n    projectEndpoint: prof.config.projectEndpoint,\n    subscriptionId: prof.subscriptionId,\n    snapshot,\n  };\n}\n","import { spawn } from \"node:child_process\";\nimport { Command, Option } from \"clipanion\";\nimport { M8tCommand } from \"../lib/m8t-command.js\";\nimport { resolveGatewayContext } from \"../lib/gateway-context.js\";\nimport {\n  OPEN_TARGETS,\n  type OpenTarget,\n  type GatewayLocator,\n  resolveOpenUrl,\n} from \"../lib/open-targets.js\";\nimport { LocalCliError } from \"../lib/errors.js\";\nimport { renderJson, resolveOutputMode } from \"../lib/output.js\";\n\n/** Open a URL in the OS default browser (best-effort, detached). The URL is\n *  always printed too, so a failure here just means the user opens it manually. */\nfunction openUrl(url: string): void {\n  const [cmd, args] =\n    process.platform === \"darwin\"\n      ? [\"open\", [url]]\n      : process.platform === \"win32\"\n        ? [\"cmd\", [\"/c\", \"start\", \"\", url]]\n        : [\"xdg-open\", [url]];\n  const child = spawn(cmd, args as string[], { stdio: \"ignore\", detached: true });\n  child.on(\"error\", () => {\n    /* swallow — the URL was printed; opening is best-effort */\n  });\n  child.unref();\n}\n\nexport class OpenCommand extends M8tCommand {\n  static paths = [[\"open\"]];\n  static usage = Command.Usage({\n    description: \"Open the deployed webapp (default), the Foundry portal, or the resource group.\",\n    details:\n      \"Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY).\",\n  });\n\n  target = Option.String({ required: false });\n  print = Option.Boolean(\"--print\", false);\n  output = Option.String(\"--output\");\n\n  async executeCommand(): Promise<number> {\n    const mode = resolveOutputMode(\n      this.output as \"pretty\" | \"json\" | \"auto\" | undefined,\n      this.context.stdout as NodeJS.WriteStream,\n    );\n    const target = (this.target ?? \"webapp\") as string;\n    if (!(OPEN_TARGETS as readonly string[]).includes(target)) {\n      throw new LocalCliError({\n        code: \"OPEN_UNKNOWN_TARGET\",\n        message: `Unknown target '${target}'.`,\n        hint: `Valid targets: ${OPEN_TARGETS.join(\", \")}.`,\n      });\n    }\n\n    let gw: GatewayLocator | null = null;\n    if (target !== \"foundry\") {\n      const ctx = await resolveGatewayContext({ interactive: false });\n      gw = {\n        gatewayUrl: ctx.gatewayUrl,\n        gatewayTenantId: ctx.gatewayTenantId,\n        subscriptionId: ctx.subscriptionId,\n        containerAppResourceId: ctx.containerAppResourceId,\n      };\n    }\n    const url = resolveOpenUrl(target as OpenTarget, gw);\n\n    // --print always emits the bare URL (pipe-friendly), winning over the\n    // non-TTY auto-JSON default; explicit `--output json` (without --print)\n    // still emits JSON for scripting.\n    if (mode === \"json\" && !this.print) {\n      this.context.stdout.write(renderJson({ target, url }) + \"\\n\");\n      return 0;\n    }\n\n    const isTTY = (this.context.stdout as NodeJS.WriteStream).isTTY === true;\n    if (this.print || !isTTY) {\n      this.context.stdout.write(url + \"\\n\");\n      return 0;\n    }\n    this.context.stdout.write(`opening ${target}: ${url}\\n`);\n    openUrl(url);\n    return 0;\n  }\n}\n","import { LocalCliError } from \"./errors.js\";\n\nexport const OPEN_TARGETS = [\"webapp\", \"foundry\", \"portal\"] as const;\nexport type OpenTarget = (typeof OPEN_TARGETS)[number];\n\n/** The Microsoft Foundry portal. The new portal switches projects in-UI; there\n *  is no documented stable per-project deep link, so we open the portal home. */\nexport const FOUNDRY_PORTAL_URL = \"https://ai.azure.com\";\n\n/** The minimal gateway facts `resolveOpenUrl` needs (subset of GatewayContext). */\nexport type GatewayLocator = {\n  gatewayUrl: string;\n  gatewayTenantId: string;\n  subscriptionId: string;\n  containerAppResourceId: string;\n};\n\n/** Azure portal deep link to a resource group's overview blade. */\nexport function azurePortalRgUrl(\n  tenantId: string,\n  subscriptionId: string,\n  resourceGroup: string,\n): string {\n  return `https://portal.azure.com/#@${tenantId}/resource/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/overview`;\n}\n\n/** Parse subscriptionId + resourceGroup out of an ARM resource id. */\nexport function parseSubAndRg(\n  armId: string,\n): { subscriptionId: string; resourceGroup: string } | null {\n  const subscriptionId = armId.match(/\\/subscriptions\\/([^/]+)/i)?.[1];\n  const resourceGroup = armId.match(/\\/resourceGroups\\/([^/]+)/i)?.[1];\n  if (!subscriptionId || !resourceGroup) return null;\n  return { subscriptionId, resourceGroup };\n}\n\n/**\n * Resolve the URL to open for a target. `foundry` needs no gateway; `webapp` and\n * `portal` require the resolved gateway locator. Pure — the caller supplies the\n * gateway (or null) so this is fully unit-testable.\n */\nexport function resolveOpenUrl(target: OpenTarget, gw: GatewayLocator | null): string {\n  if (target === \"foundry\") return FOUNDRY_PORTAL_URL;\n  if (!gw) {\n    throw new LocalCliError({\n      code: \"OPEN_NO_GATEWAY\",\n      message: `Cannot resolve the '${target}' URL — no m8t gateway found in the active subscription.`,\n      hint: \"Sign in with 'az login' and check 'az account show', then retry. (webapp/portal need a deployed gateway.)\",\n    });\n  }\n  if (target === \"webapp\") return gw.gatewayUrl;\n  // portal → the resource group's blade in the Azure portal\n  const parsed = parseSubAndRg(gw.containerAppResourceId);\n  if (!parsed) {\n    throw new LocalCliError({\n      code: \"OPEN_BAD_RESOURCE_ID\",\n      message: `Could not parse subscription/resource-group from the gateway resource id: ${gw.containerAppResourceId}`,\n    });\n  }\n  return azurePortalRgUrl(gw.gatewayTenantId, parsed.subscriptionId, parsed.resourceGroup);\n}\n"],"mappings":";;;;;;;;;;;;AAAA,IAWa,eAmBA;AA9Bb;AAAA;AAAA;AAWO,IAAM,gBAAN,cAA4B,MAAM;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,MAET,YAAY,MAAyE;AACnF,cAAM,KAAK,OAAO;AAClB,aAAK,OAAO;AACZ,aAAK,OAAO,KAAK;AACjB,aAAK,OAAO,KAAK;AACjB,aAAK,QAAQ,KAAK;AAAA,MACpB;AAAA,IACF;AAOO,IAAM,eAAN,cAA2B,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MAET,YAAY,UAA4B,YAAoB;AAC1D,cAAM,SAAS,OAAO;AACtB,aAAK,OAAO;AACZ,aAAK,WAAW;AAChB,aAAK,aAAa;AAAA,MACpB;AAAA,IACF;AAAA;AAAA;;;AChBM,SAAU,cAA2B,OAAc;AACvD,MAAI,OAAO,UAAU,YAAY,UAAU;AAAM,WAAO;AACxD,QAAM,IAAI;AACV,MAAI,EAAE,OAAO,QAAQ,UAAU;AAAG,WAAO;AACzC,MAAI,EAAE,OAAO,SAAS,OAAO,EAAE,UAAU,YAAY,EAAE,UAAU,MAAM;AACrE,UAAM,IAAI,EAAE;AACZ,WAAO,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,YAAY;EAC5D;AACA,SAAO;AACT;AAZA;;;;;;;ACrBA,IAAAA,eAAA;;;;;;;ACAA;;;;;;;ACAA;;;;;;;ACAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;;;;;;;ACAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;;;ACmCM,SAAU,eACd,UAA4C;AAE5C,QAAM,MAAM,UAAU;AACtB,MAAI,CAAC;AAAK,WAAO;AACjB,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,QAAI,CAAC,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,WAAW;AAAG,aAAO;AAC1E,WAAO;MACL,MAAM,IAAI;MACV,QAAQ,OAAO,IAAI,WAAW,YAAY,IAAI,SAAS,IAAI,SAAS;MACpE,UAAU,IAAI,aAAa,WAAW,WAAW;MACjD,eACE,OAAO,IAAI,kBAAkB,YAAY,IAAI,gBAAgB,IAAI,gBAAgB;MACnF,eAAe,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB;MAC3E,GAAI,OAAO,IAAI,mBAAmB,WAAW,EAAE,gBAAgB,IAAI,eAAc,IAAK,CAAA;MACtF,GAAI,OAAO,IAAI,mBAAmB,WAAW,EAAE,gBAAgB,IAAI,eAAc,IAAK,CAAA;;EAE1F,QAAQ;AACN,WAAO;EACT;AACF;AAGM,SAAU,UAAU,MAAe;AACvC,SAAO,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,SAAS;AACjF;AAaM,SAAU,mBAAmB,MAAe;AAChD,SAAO,KAAK,UAAU,IAAI;AAC5B;AA9CA,IAmCa;AAnCb;;;AAmCO,IAAM,8BAA8B;;;;;AC5CrC,SAAU,iBAAiB,MAAa;AAC5C,SAAO,KAAK,UAAU,IAAI;AAC5B;AALA,IACa;AADb;;;AACO,IAAM,qBAAqB;;;;;ACnBlC;;;;AACA,IAAAC;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAEA;;;;;ACXA,SAAS,YAAY,wBAAwB;AAavC,SAAU,WAAW,MAA8C;AACvE,QAAM,WAAW,OAAO,KAAK,KAAK;AAClC,MAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,YAAY,GAAG;AAChD,UAAM,IAAI,MAAM,6DAA6D,KAAK,KAAK,GAAG;EAC5F;AAEA,QAAM,MAAM,KAAK,MAAM,KAAK,IAAG,IAAK,GAAI;AACxC,QAAM,SAAS,EAAE,KAAK,SAAS,KAAK,MAAK;AACzC,QAAM,UAAU,EAAE,KAAK,MAAM,IAAI,KAAK,MAAM,KAAK,KAAK,KAAK,SAAQ;AAEnE,QAAM,SAAS,CAAC,QACd,OAAO,KAAK,KAAK,UAAU,GAAG,CAAC,EAAE,SAAS,WAAW;AACvD,QAAM,WAAW,GAAG,OAAO,MAAM,CAAC,IAAI,OAAO,OAAO,CAAC;AAErD,QAAM,OAAO,WAAW,YAAY;AACpC,OAAK,OAAO,QAAQ;AACpB,OAAK,IAAG;AACR,QAAM,YAAY,KAAK,KAAK,iBAAiB,KAAK,aAAa,CAAC,EAAE,SAAS,WAAW;AACtF,SAAO,GAAG,QAAQ,IAAI,SAAS;AACjC;AAhCA;;;;;;;ACAA,SAAS,oBAAoB;AAyB7B,eAAe,gBACbC,aACA,OAAa;AAEb,QAAM,SAAS,IAAI,aAAa,OAAOA,WAAU;AACjD,QAAM,CAAC,OAAO,MAAM,GAAG,IAAI,MAAM,QAAQ,IAAI;IAC3C,OAAO,UAAU,aAAa,KAAK;IACnC,OAAO,UAAU,aAAa,IAAI;IAClC,OAAO,UAAU,aAAa,aAAa;GAC5C;AACD,QAAM,IAAI,CAAC,KAAyB,SAAwB;AAC1D,QAAI,OAAO,KAAK,UAAU,YAAY,IAAI,MAAM,WAAW,GAAG;AAC5D,YAAM,IAAI,MAAM,2BAA2B,IAAI,4BAA4B,KAAK,EAAE;IACpF;AACA,WAAO,IAAI;EACb;AACA,SAAO;IACL,OAAO,EAAE,OAAO,aAAa,KAAK;IAClC,MAAM,EAAE,MAAM,aAAa,IAAI;IAC/B,eAAe,EAAE,KAAK,aAAa,aAAa;;AAEpD;AASM,SAAU,eAAe,MAG9B;AACC,QAAM,WAAW,MAAM,IAAI,KAAK,KAAK;AACrC,MAAI;AAAU,WAAO;AACrB,QAAM,UAAU,gBAAgB,KAAK,YAAY,KAAK,KAAK,EAAE,MAAM,CAAC,MAAK;AAGvE,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM;EACR,CAAC;AACD,QAAM,IAAI,KAAK,OAAO,OAAO;AAC7B,SAAO;AACT;AArEA,IASM,cASA;AAlBN;;;AASA,IAAM,eAAe;MACnB,OAAO;MACP,MAAM;MACN,eAAe;;AAMjB,IAAM,QAAQ,oBAAI,IAAG;;;;;AClBrB;;;;;;;AAeA,SAAS,IAAI,gBAAwB,YAAkB;AACrD,SAAO,GAAG,cAAc,IAAI,UAAU;AACxC;AAGM,SAAU,mBAAgB;AAC9B,EAAAC,OAAM,MAAK;AACb;AAMM,SAAU,eACd,gBACA,YAAkB;AAElB,QAAM,IAAIA,OAAM,IAAI,IAAI,gBAAgB,UAAU,CAAC;AACnD,MAAI,CAAC;AAAG,WAAO;AACf,MAAI,EAAE,UAAU,QAAO,IAAK,KAAK,IAAG,KAAM;AAAkB,WAAO;AACnE,SAAO;AACT;AAGM,SAAU,eACd,gBACA,YACA,OACA,WAAe;AAEf,EAAAA,OAAM,IAAI,IAAI,gBAAgB,UAAU,GAAG,EAAE,OAAO,UAAS,CAAE;AACjE;AA9CA,IAUa,kBAGPA;AAbN;;;AAUO,IAAM,mBAAmB,KAAK,KAAK;AAG1C,IAAMA,SAAQ,oBAAI,IAAG;;;;;ACSrB,eAAsB,sBAAsB,MAK3C;AACC,QAAM,SAAS,eAAe,KAAK,gBAAgB,KAAK,UAAU;AAClE,MAAI,QAAQ;AACV,WAAO;MACL,OAAO,OAAO;MACd,WAAW,OAAO;MAClB,aAAa,CAAA;;MACb,qBAAqB;;EAEzB;AAEA,QAAM,EAAE,OAAO,cAAa,IAAK,MAAM,eAAe;IACpD,YAAY,KAAK;IACjB,OAAO,KAAK;GACb;AACD,QAAM,SAAS,WAAW,EAAE,OAAO,cAAa,CAAE;AAElD,QAAM,MAAM,4CAA4C,KAAK,cAAc;AAM3E,QAAM,WAAW,KAAK,WAAW,SAAS,GAAG,IACzC,KAAK,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC,IAC/B,KAAK;AACT,QAAM,OAAO,KAAK,UAAU,EAAE,cAAc,CAAC,QAAQ,EAAC,CAAE;AACxD,QAAM,MAAM,MAAM,MAAM,KAAK;IAC3B,QAAQ;IACR,SAAS;MACP,eAAe,UAAU,MAAM;MAC/B,QAAQ;MACR,wBAAwB;MACxB,gBAAgB;;IAElB;GACD;AAED,QAAM,OAAO,MAAM,IAAI,KAAI;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MACR,+BAA+B,IAAI,MAAM,SAAS,GAAG;EAAK,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;EAElF;AAEA,QAAM,SAAS,KAAK,MAAM,IAAI;AAM9B,QAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAC5C,iBAAe,KAAK,gBAAgB,KAAK,YAAY,OAAO,OAAO,SAAS;AAC5E,SAAO;IACL,OAAO,OAAO;IACd;IACA,aAAa,OAAO;IACpB,qBAAqB,OAAO;;AAEhC;AArFA;;;;AACA;AACA;;;;;ACqBA,eAAsB,qBAAqB,MAO1C;AAGC,QAAM,EAAE,gBAAAC,iBAAgB,gBAAAC,gBAAc,IAAK,MAAM;AACjD,QAAM,SAASD,gBAAe,KAAK,gBAAgB,KAAK,UAAU;AAClE,QAAM,SAAS,MAAM,sBAAsB;IACzC,YAAY,KAAK;IACjB,OAAO,KAAK;IACZ,gBAAgB,KAAK;IACrB,YAAY,KAAK;GAClB;AACD,QAAM,WAAW,WAAW,QAAQ,OAAO,UAAU,OAAO;AAE5D,MAAI,CAAC,UAAU;AAEb,UAAM,eAAe,MAAM,KAAK,WAAW,SAAS,SAAS;AAC7D,QAAI,CAAC,cAAc,OAAO;AACxB,YAAM,IAAI,MAAM,8DAA8D;IAChF;AACA,UAAM,MAAM,+BAA+B,KAAK,YAAY,gBAAgB,KAAK,cAAc,gBAAgB,WAAW;AAC1H,UAAM,MAAM,MAAM,MAAM,KAAK;MAC3B,QAAQ;MACR,SAAS;QACP,eAAe,UAAU,aAAa,KAAK;QAC3C,gBAAgB;;;;;;MAMlB,MAAM,KAAK,UAAU;QACnB,YAAY;UACV,UAAU;UACV,UAAU;UACV,aAAa,EAAE,MAAM,EAAE,eAAe,UAAU,OAAO,KAAK,GAAE,EAAE;;OAEnE;KACF;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAO,MAAM,IAAI,KAAI;AAC3B,YAAM,IAAI,MACR,8BAA8B,IAAI,MAAM,aAAa,GAAG;EAAK,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;IAErF;AAGA,IAAAC,gBAAe,KAAK,gBAAgB,KAAK,YAAY,OAAO,OAAO,OAAO,SAAS;EACrF;AAEA,SAAO,EAAE,WAAW,oBAAI,KAAI,GAAI,WAAW,OAAO,UAAS;AAC7D;AAhFA,IAEM,WACA;AAHN;;;;AAEA,IAAM,YAAY;AAClB,IAAM,cAAc;;;;;ACgCpB,eAAsB,eAAe,MAGpC;AACC,QAAM,SAAgC;IACpC,mBAAmB,EAAE,IAAI,MAAK;IAC9B,cAAc,EAAE,IAAI,MAAK;IACzB,iBAAiB,EAAE,IAAI,MAAK;IAC5B,gBAAgB,EAAE,IAAI,MAAK;IAC3B,uBAAuB,EAAE,IAAI,MAAK;;AAIpC,MAAI,OAAe,MAAc;AACjC,MAAI;AACF,UAAM,UAAU,MAAM,eAAe,EAAE,YAAY,KAAK,YAAY,OAAO,KAAK,MAAK,CAAE;AACvF,YAAQ,QAAQ;AAChB,WAAO,QAAQ;AACf,oBAAgB,QAAQ;AACxB,WAAO,oBAAoB,EAAE,IAAI,KAAI;EACvC,SAAS,GAAG;AACV,WAAO,oBAAoB,EAAE,IAAI,OAAO,OAAQ,EAAY,QAAO;AACnE,WAAO,EAAE,IAAI,OAAO,OAAM;EAC5B;AAGA,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG;AAC9C,WAAO,eAAe,EAAE,IAAI,MAAM,OAAO,MAAK;EAChD,OAAO;AACL,WAAO,eAAe,EAAE,IAAI,OAAO,OAAO,4BAA4B,KAAK,IAAG;AAC9E,WAAO,EAAE,IAAI,OAAO,OAAM;EAC5B;AAGA,MAAI;AACJ,MAAI;AACF,aAAS,WAAW,EAAE,OAAO,cAAa,CAAE;AAC5C,WAAO,kBAAkB,EAAE,IAAI,KAAI;EACrC,SAAS,GAAG;AACV,WAAO,kBAAkB,EAAE,IAAI,OAAO,OAAQ,EAAY,QAAO;AACjE,WAAO,EAAE,IAAI,OAAO,OAAM;EAC5B;AAGA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,8BAA8B;MACpD,SAAS;QACP,eAAe,UAAU,MAAM;QAC/B,QAAQ;QACR,wBAAwB;;KAE3B;AACD,UAAM,OAAO,MAAM,IAAI,KAAI;AAC3B,QAAI,CAAC,IAAI,IAAI;AACX,aAAO,iBAAiB,EAAE,IAAI,OAAO,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAAE;AACvF,aAAO,EAAE,IAAI,OAAO,OAAM;IAC5B;AACA,UAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,QAAI,KAAK,SAAS,MAAM;AACtB,aAAO,iBAAiB;QACtB,IAAI;QACJ,OAAO,2BAA2B,IAAI,gBAAgB,KAAK,IAAI;QAC/D,MAAM,KAAK;QACX,oBAAoB,KAAK;;AAE3B,aAAO,EAAE,IAAI,OAAO,OAAM;IAC5B;AACA,WAAO,iBAAiB;MACtB,IAAI;MACJ,MAAM,KAAK;MACX,oBAAoB,KAAK;;EAE7B,SAAS,GAAG;AACV,WAAO,iBAAiB,EAAE,IAAI,OAAO,OAAQ,EAAY,QAAO;AAChE,WAAO,EAAE,IAAI,OAAO,OAAM;EAC5B;AAGA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,4CAA4C;MAClE,SAAS;QACP,eAAe,UAAU,MAAM;QAC/B,QAAQ;QACR,wBAAwB;;KAE3B;AACD,QAAI,CAAC,IAAI,IAAI;AACX,aAAO,wBAAwB,EAAE,IAAI,OAAO,OAAO,QAAQ,IAAI,MAAM,GAAE;AACvE,aAAO,EAAE,IAAI,OAAO,OAAM;IAC5B;AACA,UAAM,MAAO,MAAM,IAAI,KAAI;AAC3B,WAAO,wBAAwB,EAAE,IAAI,MAAM,OAAO,IAAI,OAAM;EAC9D,SAAS,GAAG;AACV,WAAO,wBAAwB,EAAE,IAAI,OAAO,OAAQ,EAAY,QAAO;AACvE,WAAO,EAAE,IAAI,OAAO,OAAM;EAC5B;AAEA,SAAO,EAAE,IAAI,MAAM,OAAM;AAC3B;AAtIA;;;;AACA;;;;;ACFA,IAAAC,YAAA;;;;AACA;AACA;AAGA;AACA;AACA;;;;;ACSA,eAAsB,iBAA8B,MAAoD;AACtG,QAAM,QAAQ,MAAM,KAAK,WAAW,SAAS,KAAK,KAAK;AACvD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,qCAAqC,KAAK,KAAK;AAAA,MACxD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,MAAM,MAAM,MAAM,KAAK,KAAK;AAAA,IAChC,QAAQ,KAAK;AAAA,IACb,SAAS;AAAA,MACP,eAAe,UAAU,MAAM,KAAK;AAAA,MACpC,GAAI,KAAK,SAAS,SAAY,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,IAC1E;AAAA,IACA,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,KAAK,IAAI,EAAE,IAAI,CAAC;AAAA,EACvE,CAAC;AAED,QAAM,KAAK,IAAI,OAAO,KAAK,YAAY,SAAS,IAAI,MAAM,KAAK;AAC/D,MAAI,CAAC,IAAI;AACP,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,GAAG,KAAK,MAAM,IAAI,KAAK,GAAG,YAAY,IAAI,MAAM,IAAI,IAAI,UAAU,GAAG,OAAO,WAAM,KAAK,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE;AAAA,IACtH,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,QAAM,OAAO,MAAO,KAAK,MAAM,GAAG,IAAU;AAC5C,SAAO,EAAE,QAAQ,IAAI,QAAQ,KAAK;AACpC;AAGA,eAAsB,WAAwB,MAA8C;AAC1F,UAAQ,MAAM,iBAAoB,IAAI,GAAG;AAC3C;AAnDA;AAAA;AAAA;AACA;AAAA;AAAA;;;ACuCA,eAAsB,gBAAgB,MAIN;AAC9B,QAAM,QAAQ,MAAM,KAAK,WAAW,SAAS,aAAa;AAC1D,MAAI,CAAC,OAAO,OAAO;AACjB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,MAAM,GAAG,KAAK,eAAe,WAAW,KAAK,SAAS;AAC5D,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,KAAK,GAAG;AAAA,EACpD,CAAC;AACD,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,UAAU,KAAK,SAAS,kBAAkB,KAAK,eAAe;AAAA,IACzE,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,OAAO,GAAG,kBAAkB,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IACxE,CAAC;AAAA,EACH;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,OAAO,GAAG;AAAA,IACrB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AA/EA,IAGM;AAHN;AAAA;AAAA;AACA;AAEA,IAAM,gBAAgB;AAAA;AAAA;;;ACCtB,SAAS,iBAAiB,MAKf;AACT,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UAAU,KAAK,IAAI;AAAA,IACnB,WAAW,KAAK,MAAM;AAAA,IACtB;AAAA,IACA;AAAA,IACA,aAAa,KAAK,OAAO;AAAA,IACzB,WAAW,KAAK,KAAK;AAAA,IACrB;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,gBAAgB,MAQpB;AAChB,QAAM,UAAU,iBAAiB;AAAA,IAC/B,MAAM,KAAK;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,OAAO,KAAK;AAAA,EACd,CAAC;AACD,QAAM,SAAS,MAAM,sBAAsB;AAAA,IACzC,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK;AAAA,IACZ,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,QAAM,CAAC,OAAO,QAAQ,IAAI,KAAK,KAAK,MAAM,GAAG;AAE7C,QAAM,SAAS,MAAM;AAAA,IACnB,gCAAgC,KAAK,IAAI,QAAQ;AAAA,IACjD;AAAA,MACE,SAAS;AAAA,QACP,eAAe,UAAU,OAAO,KAAK;AAAA,QACrC,QAAQ;AAAA,QACR,wBAAwB;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI,OAAO,IAAI;AACb,UAAM,OAAQ,MAAM,OAAO,KAAK;AAChC,UAAM,KAAK;AAAA,EACb;AACA,QAAM,OAAO;AAAA,IACX,SAAS;AAAA,IACT,SAAS,OAAO,KAAK,SAAS,MAAM,EAAE,SAAS,QAAQ;AAAA,IACvD,QAAQ,KAAK;AAAA,IACb,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,EACvB;AACA,QAAM,SAAS,MAAM;AAAA,IACnB,gCAAgC,KAAK,IAAI,QAAQ;AAAA,IACjD;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,OAAO,KAAK;AAAA,QACrC,QAAQ;AAAA,QACR,wBAAwB;AAAA,QACxB,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,6BAA6B,OAAO,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IAC5E,CAAC;AAAA,EACH;AACF;AAvFA;AAAA;AAAA;AACA,IAAAC;AACA;AAAA;AAAA;;;ACDA,SAAS,uBAAmD;AAsB5D,eAAsB,mBAAmB,MAUrB;AAClB,QAAM,UAAU,IAAI,gBAAgB,KAAK,UAAU,KAAK,UAAU;AAElE,QAAM,aAAoC;AAAA,IACxC,MAAM;AAAA,IACN,OAAO,KAAK;AAAA,IACZ,KAAK,KAAK;AAAA,IACV,QAAQ,KAAK;AAAA,IACb,6BAA6B,CAAC,EAAE,UAAU,aAAa,SAAS,QAAQ,CAAC;AAAA,IACzE,uBAAuB,KAAK;AAAA,EAC9B;AAEA,QAAM,WAAmC;AAAA,IACvC,QAAQ,KAAK,SAAS;AAAA,IACtB,MAAM,KAAK,SAAS;AAAA,IACpB,SAAS,KAAK,SAAS;AAAA,EACzB;AACA,MAAI,KAAK,SAAS,mBAAmB,KAAM,UAAS,iBAAiB,KAAK,SAAS;AACnF,MAAI,KAAK,MAAO,UAAS,QAAQ,KAAK;AAEtC,QAAM,UAAU,MAAM,QAAQ,OAAO,cAAc,KAAK,MAAM,YAAY;AAAA,IACxE,iBAAiB;AAAA,IACjB;AAAA,EACF,CAAC;AAED,QAAM,IAAK,QAA0C;AACrD,MAAI,MAAM,UAAa,MAAM,MAAM;AACjC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,sBAAsB,KAAK,IAAI;AAAA,IAC1C,CAAC;AAAA,EACH;AACA,SAAO,OAAO,CAAC;AACjB;AAGA,eAAsB,4BAA4B,MAK9B;AAClB,QAAM,MAAM,GAAG,KAAK,QAAQ,WAAW,KAAK,IAAI,aAAa,KAAK,OAAO,gBAAgB,GAAG;AAC5F,QAAM,OAAO,MAAM,WAA8D;AAAA,IAC/E,YAAY,KAAK;AAAA,IACjB,OAAOC;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACD,QAAM,MAAM,MAAM,mBAAmB;AACrC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,0CAA0C,KAAK,IAAI,aAAa,KAAK,OAAO;AAAA,MACrF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGA,eAAsB,iBAAiB,MAKnB;AAClB,QAAM,MAAM,GAAG,KAAK,QAAQ,WAAW,KAAK,IAAI,aAAa,KAAK,OAAO,gBAAgB,GAAG;AAC5F,QAAM,OAAO,MAAM,WAAgC;AAAA,IACjD,YAAY,KAAK;AAAA,IACjB,OAAOA;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACD,SAAO,OAAO,MAAM,UAAU,EAAE,EAAE,YAAY;AAChD;AAEA,eAAsB,YAAY,MAIb;AACnB,QAAM,MAAM,GAAG,KAAK,QAAQ,WAAW,KAAK,IAAI,gBAAgB,GAAG;AACnE,QAAM,MAAM,MAAM,iBAAiB;AAAA,IACjC,YAAY,KAAK;AAAA,IACjB,OAAOA;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,IACA,YAAY,CAAC,GAAG;AAAA,EAClB,CAAC;AACD,SAAO,IAAI,WAAW;AACxB;AAQA,eAAsB,YAAY,MAIhB;AAChB,QAAM,MAAM,GAAG,KAAK,QAAQ,WAAW,KAAK,IAAI,gBAAgB,GAAG;AACnE,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,OAAOA;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,IACA,YAAY,CAAC,GAAG;AAAA;AAAA,EAClB,CAAC;AACH;AAjJA,IAKMA,gBACA;AANN;AAAA;AAAA;AAEA;AACA;AAEA,IAAMA,iBAAgB;AACtB,IAAM,MAAM;AAAA;AAAA;;;ACNZ,SAAS,kBAAkB;AAsB3B,eAAsB,iBAAiB,MAKrB;AAChB,QAAM,mBAAmB,WAAW;AACpC,QAAM,MAAM,GAAGC,IAAG,GAAG,KAAK,YAAY,sDAAsD,gBAAgB,gBAAgB,MAAM;AAClI,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,OAAOC;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,MACJ,YAAY;AAAA,QACV,kBAAkB,kBAAkB,KAAK,cAAc,sDAAsD,oBAAoB;AAAA,QACjI,aAAa,KAAK;AAAA,QAClB,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,YAAY,CAAC,GAAG;AAAA;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,oBACbC,aACA,OACA,QAC6B;AAC7B,QAAM,IAAI,eAAe,MAAM,GAAG,SAAS,YAAY,mBAAmB,MAAM,CAAC,KAAK,EAAE;AACxF,QAAM,MAAM,GAAGF,IAAG,GAAG,KAAK,sDAAsD,CAAC;AACjF,SAAQ,MAAM,WAA+B,EAAE,YAAAE,aAAY,OAAOD,YAAW,QAAQ,OAAO,IAAI,CAAC,KAAM,CAAC;AAC1G;AAEA,SAAS,cAAc,kBAAsC,UAA2B;AACtF,UAAQ,oBAAoB,IAAI,YAAY,EAAE,SAAS,SAAS,YAAY,CAAC;AAC/E;AAGA,eAAsB,oBAAoB,MAIrB;AACnB,QAAM,OAAO,MAAM,oBAAoB,KAAK,YAAY,KAAK,QAAQ;AACrE,UAAQ,KAAK,SAAS,CAAC,GAAG;AAAA,IACxB,CAAC,MACC,EAAE,YAAY,gBAAgB,KAAK,eACnC,cAAc,EAAE,YAAY,kBAAkB,gBAAgB;AAAA,EAClE;AACF;AAGA,eAAsB,aAAa,MAKjB;AAChB,QAAM,MAAM,GAAGD,IAAG,GAAG,KAAK,QAAQ,sDAAsD,WAAW,CAAC,gBAAgB,MAAM;AAC1H,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,OAAOC;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,MACJ,YAAY;AAAA,QACV,kBAAkB,kBAAkB,KAAK,cAAc,sDAAsD,gBAAgB;AAAA,QAC7H,aAAa,KAAK;AAAA,QAClB,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,YAAY,CAAC,GAAG;AAAA,EAClB,CAAC;AACH;AAGA,eAAsB,qBAAqB,MAItB;AAGnB,QAAM,OAAO,MAAM;AAAA,IACjB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,6BAA6B,KAAK,cAAc;AAAA,EAClD;AACA,UAAQ,KAAK,SAAS,CAAC,GAAG;AAAA,IAAK,CAAC,MAC9B,mBAAmB,KAAK,CAAC,MAAM,cAAc,EAAE,YAAY,kBAAkB,CAAC,CAAC;AAAA,EACjF;AACF;AAKA,eAAsB,yBAAyB,MAK7B;AAChB,QAAM,MAAM,GAAGD,IAAG,GAAG,KAAK,OAAO,sDAAsD,WAAW,CAAC,gBAAgB,MAAM;AACzH,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,OAAOC;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,MACJ,YAAY;AAAA,QACV,kBAAkB,kBAAkB,KAAK,cAAc,sDAAsD,uBAAuB;AAAA,QACpI,aAAa,KAAK;AAAA,QAClB,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,YAAY,CAAC,GAAG;AAAA,EAClB,CAAC;AACH;AAGA,eAAsB,0BAA0B,MAI3B;AACnB,QAAM,OAAO,MAAM,oBAAoB,KAAK,YAAY,KAAK,OAAO;AACpE,UAAQ,KAAK,SAAS,CAAC,GAAG;AAAA,IACxB,CAAC,MACC,EAAE,YAAY,gBAAgB,KAAK,eACnC,cAAc,EAAE,YAAY,kBAAkB,uBAAuB;AAAA,EACzE;AACF;AAKA,eAAsB,iBAAiB,MAKrB;AAChB,QAAM,MAAM,GAAGD,IAAG,GAAG,KAAK,KAAK,sDAAsD,WAAW,CAAC,gBAAgB,MAAM;AACvH,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,OAAOC;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,MACJ,YAAY;AAAA,QACV,kBAAkB,kBAAkB,KAAK,cAAc,sDAAsD,mBAAmB;AAAA,QAChI,aAAa,KAAK;AAAA,QAClB,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,YAAY,CAAC,GAAG;AAAA,EAClB,CAAC;AACH;AAGA,eAAsB,qBAAqB,MAKzB;AAChB,QAAM,MAAM,GAAGD,IAAG,GAAG,KAAK,KAAK,sDAAsD,WAAW,CAAC,gBAAgB,MAAM;AACvH,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,OAAOC;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,MACJ,YAAY;AAAA,QACV,kBAAkB,kBAAkB,KAAK,cAAc,sDAAsD,yBAAyB;AAAA,QACtI,aAAa,KAAK;AAAA,QAClB,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,YAAY,CAAC,GAAG;AAAA,EAClB,CAAC;AACH;AAGA,eAAsB,0BAA0B,MAI5B;AAClB,QAAM,OAAO,IAAI,IAAI,KAAK,KAAK,EAAE;AACjC,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAC9B,QAAM,MAAM,GAAGD,IAAG,kBAAkB,KAAK,cAAc,6CAA6C,mBAAmB,4DAA4D,IAAI,GAAG,CAAC;AAC3L,QAAM,OAAO,MAAM,WAA+C;AAAA,IAChE,YAAY,KAAK;AAAA,IACjB,OAAOC;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACD,QAAM,KAAK,MAAM,QAAQ,CAAC,GAAG;AAC7B,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,wDAAwD,IAAI,qBAAqB,KAAK,cAAc;AAAA,IAC/G,CAAC;AAAA,EACH;AACA,SAAO;AACT;AArOA,IAKMD,MACAC,YACA,QAEO,sBACA,kBACP,eACO,2BACP,oBAEA,oBAqGO,yBAwCA;AA5Jb;AAAA;AAAA;AAEA;AACA;AAEA,IAAMD,OAAM;AACZ,IAAMC,aAAY;AAClB,IAAM,SAAS;AAER,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAChC,IAAM,gBAAgB;AACf,IAAM,4BAA4B;AACzC,IAAM,qBAAqB;AAE3B,IAAM,qBAAqB,CAAC,eAAe,2BAA2B,kBAAkB;AAqGjF,IAAM,0BAA0B;AAwChC,IAAM,sBAAsB;AAAA;AAAA;;;AC5JnC;AAAA;AAAA;AAAA;AA4BA,eAAsB,kBAAkB,MAA+D;AACrG,QAAM,WAAW,KAAK,eAAe,MAAM;AAAA,EAAC;AAE5C,QAAM,UAAU,MAAM,gBAAgB;AAAA,IACpC,YAAY,KAAK;AAAA,IACjB,iBAAiB,KAAK,QAAQ;AAAA,IAC9B,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,MAAI,QAAQ,WAAW,SAAS,UAAU;AACxC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,uBAAuB,KAAK,SAAS,cAAc,QAAQ,WAAW,IAAI;AAAA,IACrF,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,QAAQ;AACpB,QAAM,aAAqC,EAAE,GAAI,IAAI,yBAAmD,CAAC,EAAG;AAE5G,QAAM,iBAAiB,KAAK,mBAAmB,WAAW,yBAAyB;AACnF,MAAI,CAAC,aAAa,KAAK,cAAc,KAAK,CAAC,KAAK,mBAAmB;AACjE;AAAA,MACE,aAAa,kBAAkB,SAAS;AAAA,IAG1C;AAAA,EACF;AAEA,QAAM,OAAkB;AAAA,IACtB,MAAM,KAAK;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,IACf,eAAe;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB;AAEA,QAAM,WAAW,WAAW,QAAQ,UAAU,KAAK;AACnD,MACE,YACA,SAAS,SAAS,KAAK,QACvB,SAAS,mBAAmB,KAAK,kBACjC,SAAS,WAAW,KAAK,UACzB,WAAW,eAAe,KAAK,MAC/B;AACA,aAAS,kEAA6D;AACtE,WAAO,EAAE,eAAe,KAAK;AAAA,EAC/B;AAEA,QAAM,MAA8B;AAAA,IAClC,GAAG;AAAA,IACH,YAAY,KAAK;AAAA,IACjB,cAAc,KAAK;AAAA,IACnB,4BAA4B,KAAK;AAAA,IACjC,oBAAoB,KAAK;AAAA,IACzB,kBAAkB;AAAA,IAClB,uBAAuB;AAAA,EACzB;AAEA,WAAS,6CAAwC;AACjD,QAAM,UAAU,MAAM,mBAAmB;AAAA,IACvC,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,MAAM,KAAK;AAAA,IACX,OAAO,IAAI;AAAA,IACX,KAAK,IAAI;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,SAAS,QAAQ,UAAU,WAAW;AAAA,MACtC,gBAAgB,QAAQ,UAAU,kBAAkB;AAAA,IACtD;AAAA,IACA,OAAO,mBAAmB,IAAI;AAAA,EAChC,CAAC;AAED,WAAS,gDAA2C;AACpD,QAAM,cAAc,MAAM,4BAA4B;AAAA,IACpD,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,MAAM,KAAK;AAAA,IACX;AAAA,EACF,CAAC;AACD,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,gBAAgB,KAAK;AAAA,IACrB,cAAc,KAAK,QAAQ;AAAA,IAC3B;AAAA,EACF,CAAC;AAED,WAAS,0DAAqD;AAC9D,QAAM,UAAU,MAAM,0BAA0B;AAAA,IAC9C,YAAY,KAAK;AAAA,IACjB,gBAAgB,KAAK;AAAA,IACrB,OAAO,KAAK;AAAA,EACd,CAAC;AACD,QAAM,yBAAyB;AAAA,IAC7B,YAAY,KAAK;AAAA,IACjB,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA;AAAA,EACF,CAAC;AAED,WAAS,iCAA4B;AACrC,QAAM,gBAAgB;AAAA,IACpB,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK;AAAA,IACZ,gBAAgB,KAAK;AAAA,IACrB,MAAM,KAAK;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,SAAS,QAAQ,UAAU,WAAW,KAAK;AAAA,EAC7C,CAAC;AAED,SAAO,EAAE,SAAS,eAAe,MAAM;AACzC;AAEA,SAAS,WAAW,KAAgD;AAClE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AAAE,WAAO,KAAK,MAAM,GAAG;AAAA,EAAgB,QAAQ;AAAE,WAAO;AAAA,EAAW;AACzE;AApJA,IAUM;AAVN;AAAA;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA,IAAM,eAAe;AAAA;AAAA;;;ACVrB,SAAS,UAAU,WAAW;;;ACIvB,IAAM,cAAsB;;;ACJnC;;;ACQA,SAAS,eAAe,UAA4BE,MAAsB;AACxE,MAAI,OAAO,SAAS,YAAY,YAAY,SAAS,YAAY,MAAM;AACrE,WAAQ,SAAS,QAAoCA,IAAG;AAAA,EAC1D;AACA,SAAO;AACT;AASA,IAAM,gBAA4B;AAAA;AAAA,EAEhC;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,EACd;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,MAAM;AACX,YAAM,SAAS,OAAO,eAAe,GAAG,QAAQ,KAAK,UAAU;AAC/D,aAAO,8BAA8B,MAAM;AAAA,IAC7C;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,MAAM;AACX,YAAM,cAAc,OAAO,eAAe,GAAG,QAAQ,KAAK,UAAU;AACpE,YAAM,UAAU,OAAO,eAAe,GAAG,SAAS,KAAK,WAAW;AAClE,aAAO,OAAO,OAAO,iCAAiC,WAAW,sBAAsB,WAAW;AAAA,IACpG;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,MAAM;AACX,YAAM,SAAS,OAAO,eAAe,GAAG,QAAQ,KAAK,UAAU;AAC/D,aAAO,wCAAwC,MAAM,8CAA8C,MAAM;AAAA,IAC3G;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,MAAM;AACX,YAAM,UAAU,OAAO,eAAe,GAAG,SAAS,KAAK,WAAW;AAClE,aAAO,2BAA2B,OAAO;AAAA,IAC3C;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,MAAM;AACX,YAAM,YAAY,OAAO,eAAe,GAAG,WAAW,KAAK,MAAM;AACjE,aAAO,YAAY,SAAS,qCAAqC,SAAS;AAAA,IAC5E;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,MAAM;AACX,YAAM,UAAU,OAAO,eAAe,GAAG,SAAS,KAAK,WAAW;AAClE,YAAM,YAAY,OAAO,eAAe,GAAG,WAAW,KAAK,MAAM;AACjE,aAAO,YAAY,SAAS,gCAAgC,OAAO,yBAAyB,SAAS,oCAAoC,SAAS;AAAA,IACpJ;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,MAAM;AACX,YAAM,YAAY,OAAO,eAAe,GAAG,WAAW,KAAK,MAAM;AACjE,aAAO,eAAe,SAAS;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,EACd;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,EACd;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MACJ;AAAA,EACJ;AACF;AAEA,IAAM,cAAsC;AAAA;AAAA,EAE1C,6BAA6B;AAAA,EAC7B,iCACE;AAAA,EACF,kBAAkB;AAAA,EAClB,iBACE;AAAA;AAAA,EAEF,uBAAuB;AAAA,EACvB,2BACE;AAAA;AAAA,EAEF,sBACE;AAAA;AAAA,EAEF,mBACE;AAAA;AAAA,EAEF,sBACE;AAAA;AAAA,EAEF,UAAU;AAAA;AAAA,EAEV,uBACE;AAAA;AAAA,EAEF,kBACE;AAAA;AAAA,EAEF,0BACE;AAAA;AAAA,EAEF,oBACE;AAAA;AAAA,EAEF,oBACE;AAAA;AAAA,EAEF,iBACE;AAAA;AAAA,EAEF,cAAc;AAAA;AAAA,EAEd,qBAAqB;AAAA;AAAA,EAErB,kBACE;AAAA;AAAA,EAEF,yBACE;AAAA;AAAA,EAEF,uBACE;AAAA;AAAA,EAEF,2BACE;AAAA;AAAA,EAEF,iCACE;AAAA;AAAA,EAEF,qBACE;AAAA;AAAA,EAGF,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,mBACE;AAAA,EACF,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,kBACE;AAAA,EACF,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,wBACE;AAAA,EACF,4BACE;AAAA,EACF,oCAAoC;AAAA,EACpC,8BACE;AAAA,EACF,mCACE;AAAA,EACF,2BACE;AAAA,EACF,+BACE;AAAA,EACF,gBACE;AAAA,EACF,cAAc;AAAA,EACd,OAAO;AACT;AAEO,SAAS,mBAAmB,UAAgD;AACjF,QAAM,SAAS,eAAe,UAAU,QAAQ;AAChD,aAAW,QAAQ,eAAe;AAChC,QAAI,KAAK,SAAS,SAAS,KAAM;AACjC,QAAI,KAAK,WAAW,UAAa,KAAK,WAAW,OAAQ;AACzD,WAAO,KAAK,KAAK,QAAQ;AAAA,EAC3B;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAkC;AACjE,SAAO,YAAY,IAAI;AACzB;;;AC7UA,OAAO,QAAQ;AAeR,SAAS,kBACd,MACA,SAA6B,QAAQ,QACjB;AACpB,MAAI,SAAS,SAAU,QAAO;AAC9B,MAAI,SAAS,OAAQ,QAAO;AAC5B,SAAO,OAAO,QAAQ,WAAW;AACnC;AAMO,SAAS,YACd,MACA,SACQ;AACR,MAAI,KAAK,WAAW,EAAG,QAAO;AAE9B,QAAM,UAAU,QAAQ,IAAI,CAAC,MAAM,EAAE,KAAK;AAC1C,QAAM,WAAW,KAAK;AAAA,IAAI,CAAC,QACzB,QAAQ,IAAI,CAAC,MAAM;AACjB,YAAM,IAAI,IAAI,EAAE,GAAG;AACnB,UAAI,EAAE,OAAQ,QAAO,EAAE,OAAO,GAAY,GAAG;AAC7C,UAAI,MAAM,UAAa,MAAM,QAAQ,MAAM,GAAI,QAAO;AACtD,aAAO,OAAO,CAAC,EAAE,QAAQ,QAAQ,GAAG;AAAA,IACtC,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,QAAQ,IAAI,CAAC,GAAG,MAAM;AACnC,UAAM,cAAc,QAAQ,CAAC,EAAE;AAC/B,UAAM,UAAU,SAAS,OAAO,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC;AACrE,WAAO,KAAK,IAAI,aAAa,OAAO;AAAA,EACtC,CAAC;AAED,QAAM,aAAa,QAAQ,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI;AACvE,QAAM,YAAY,SAAS;AAAA,IAAI,CAAC,MAC9B,EAAE,IAAI,CAAC,MAAM,MAAM,KAAK,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ;AAAA,EAChE;AAEA,SAAO,CAAC,WAAW,QAAQ,GAAG,GAAG,SAAS,EAAE,KAAK,IAAI;AACvD;AAKO,SAAS,oBACd,MACQ;AACR,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,QAAM,WAAW,KAAK,OAAO,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,EAAE,IAAI,MAAM,GAAG,CAAC;AACnE,SAAO,KACJ,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,OAAO,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,EAAE,EAC1D,KAAK,IAAI;AACd;AAEO,SAAS,WAAW,MAAuB;AAChD,SAAO,KAAK,UAAU,MAAM,MAAM,CAAC;AACrC;AAKO,IAAM,SAAS;AAAA,EACpB,OAAO,CAAC,MAAc,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,EACvC,MAAM,CAAC,MAAc,GAAG,IAAI,CAAC;AAAA,EAC7B,SAAS,CAAC,MAAc,GAAG,MAAM,CAAC;AAAA,EAClC,OAAO,CAAC,MAAc,GAAG,KAAK,CAAC;AAAA,EAC/B,KAAK,CAAC,MAAc,GAAG,IAAI,CAAC;AAC9B;;;AFrEO,SAAS,YAAY,KAAc,MAAkC;AAC1E,QAAM,OAAO,kBAAkB,KAAK,QAAQ,KAAK,MAAM;AAGvD,MACE,eAAe,UACd,IAAI,SAAS,qBAAqB,IAAI,YAAY,iCACnD;AACA,QAAI,SAAS,QAAQ;AACnB,WAAK,OAAO;AAAA,QACV,WAAW;AAAA,UACT,IAAI;AAAA,UACJ,OAAO,EAAE,MAAM,aAAa,SAAS,gCAAgC;AAAA,QACvE,CAAC,IAAI;AAAA,MACP;AAAA,IACF,OAAO;AACL,WAAK,OAAO,MAAM,cAAc;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,cAAc;AAC/B,QAAI,SAAS,QAAQ;AACnB,WAAK,OAAO,MAAM,WAAW,EAAE,IAAI,OAAO,OAAO,IAAI,SAAS,CAAC,IAAI,IAAI;AACvE,aAAO;AAAA,IACT;AACA,SAAK,OAAO,MAAM,GAAG,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,SAAS,OAAO;AAAA,CAAI;AACvE,UAAM,OAAO,mBAAmB,IAAI,QAAQ;AAC5C,QAAI,KAAM,MAAK,OAAO,MAAM,KAAK,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI;AAAA,CAAI;AACjE,QAAI,KAAK,SAAS;AAChB,WAAK,OAAO,MAAM,OAAO,OAAO,IAAI,WAAW,IAAI,QAAQ,CAAC,IAAI,IAAI;AAAA,IACtE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,eAAe;AAChC,QAAI,SAAS,QAAQ;AACnB,WAAK,OAAO;AAAA,QACV,WAAW;AAAA,UACT,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,MAAM,IAAI;AAAA,YACV,SAAS,IAAI;AAAA,YACb,GAAI,IAAI,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,KAAK,EAAE,IAAI,CAAC;AAAA,UACpD;AAAA,QACF,CAAC,IAAI;AAAA,MACP;AACA,aAAO;AAAA,IACT;AACA,SAAK,OAAO,MAAM,GAAG,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,OAAO;AAAA,CAAI;AAC9D,UAAM,OAAO,IAAI,QAAQ,iBAAiB,IAAI,IAAI;AAClD,QAAI,KAAM,MAAK,OAAO,MAAM,KAAK,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI;AAAA,CAAI;AACjE,QAAI,KAAK,WAAW,IAAI,iBAAiB,OAAO;AAC9C,WAAK,OAAO,MAAM,OAAO,OAAO,IAAI,cAAc,IAAI,MAAM,SAAS,IAAI,MAAM,OAAO,EAAE,IAAI,IAAI;AAAA,IAClG;AACA,WAAO;AAAA,EACT;AAGA,QAAM,IAAI,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC5D,MAAI,SAAS,QAAQ;AACnB,SAAK,OAAO;AAAA,MACV,WAAW;AAAA,QACT,IAAI;AAAA,QACJ,OAAO,EAAE,MAAM,cAAc,SAAS,EAAE,QAAQ;AAAA,MAClD,CAAC,IAAI;AAAA,IACP;AACA,WAAO;AAAA,EACT;AACA,OAAK,OAAO,MAAM,GAAG,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO;AAAA,CAAI;AAC5D,MAAI,KAAK,WAAW,EAAE,OAAO;AAC3B,SAAK,OAAO,MAAM,OAAO,OAAO,IAAI,EAAE,KAAK,IAAI,IAAI;AAAA,EACrD,OAAO;AACL,SAAK,OAAO,MAAM,KAAK,OAAO,KAAK,OAAO,CAAC;AAAA,CAA4C;AAAA,EACzF;AACA,SAAO;AACT;;;AG3FA,SAAS,WAAAC,UAAS,cAAc;;;ACAhC,SAAS,eAAe;AAuBjB,IAAe,aAAf,cAAkC,QAAQ;AAAA,EAG/C,MAAM,UAA2B;AAC/B,QAAI;AACF,aAAO,MAAM,KAAK,eAAe;AAAA,IACnC,SAAS,GAAG;AACV,YAAM,UAAU,QAAQ,KAAK,SAAS,WAAW;AACjD,YAAM,YAAY,QAAQ,KAAK,QAAQ,UAAU;AACjD,YAAM,SACJ,aAAa,KAAK,YAAY,IAAI,QAAQ,KAAK,SAC1C,QAAQ,KAAK,YAAY,CAAC,IAC3B;AACN,aAAO,YAAY,GAAG;AAAA,QACpB,QAAQ,KAAK,QAAQ;AAAA,QACrB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC3CA;AACA;;;ACAA;AADA,SAAS,8BAA8B;;;ACCvC;AADA,SAAS,aAAa;AAIf,SAAS,MAAM,MAAiC;AACrD,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,OAAO,MAAM,MAAM,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACpE,UAAM,MAAgB,CAAC;AACvB,UAAM,MAAgB,CAAC;AACvB,SAAK,OAAO,GAAG,QAAQ,CAAC,MAAc,IAAI,KAAK,CAAC,CAAC;AACjD,SAAK,OAAO,GAAG,QAAQ,CAAC,MAAc,IAAI,KAAK,CAAC,CAAC;AACjD,SAAK,GAAG,SAAS,CAAC,MAAM;AACtB,UAAK,EAA4B,SAAS,UAAU;AAClD;AAAA,UACE,IAAI,cAAc;AAAA,YAChB,MAAM;AAAA,YACN,SAAS;AAAA,YACT,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AACA;AAAA,MACF;AACA,aAAO,CAAC;AAAA,IACV,CAAC;AACD,SAAK,GAAG,SAAS,CAAC,SAAS;AACzB,YAAM,YAAY,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AACpD,UAAI,SAAS,GAAG;AACd,YAAI,wBAAwB,KAAK,SAAS,KAAK,iBAAiB,KAAK,SAAS,GAAG;AAC/E;AAAA,YACE,IAAI,cAAc;AAAA,cAChB,MAAM;AAAA,cACN,SAAS;AAAA,cACT,MAAM;AAAA,YACR,CAAC;AAAA,UACH;AACA;AAAA,QACF;AACA;AAAA,UACE,IAAI,cAAc;AAAA,YAChB,MAAM;AAAA,YACN,SAAS,OAAO,KAAK,KAAK,GAAG,CAAC,aAAa,UAAU,KAAK,CAAC;AAAA,UAC7D,CAAC;AAAA,QACH;AACA;AAAA,MACF;AACA,MAAAA,SAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM,CAAC;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC;AACH;;;ADpCA,IAAI,sBAAqD;AAEzD,SAAS,aAAqC;AAC5C,MAAI,CAAC,qBAAqB;AACxB,0BAAsB,IAAI,uBAAuB;AAAA,EACnD;AACA,SAAO;AACT;AAsBA,eAAsB,eAAe,iBAA0C;AAC7E,MAAI;AACF,UAAM,QAAQ,MAAM,WAAW,EAAE,SAAS,SAAS,eAAe,WAAW;AAC7E,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,WAAO,MAAM;AAAA,EACf,SAAS,GAAG;AACV,QAAI,aAAa,cAAe,OAAM;AACtC,UAAM,4BAA4B,CAAC;AAAA,EACrC;AACF;AAGA,eAAsB,kBAAmC;AACvD,QAAM,QAAQ,MAAM,WAAW,EAAE,SAAS,+BAA+B;AACzE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,EAAE,MAAM,mBAAmB,SAAS,2BAA2B,CAAC;AAAA,EAC1F;AACA,SAAO,MAAM;AACf;AAUA,eAAsB,eAAuC;AAC3D,QAAM,OAAO,MAAM,MAAM,CAAC,WAAW,QAAQ,YAAY,MAAM,CAAC;AAChE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,6CAA8C,EAAY,OAAO;AAAA,MAC1E,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,OAAO;AACpB,SAAO;AAAA,IACL,KAAK,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AAAA,IAClE,gBAAgB,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AAAA,IAC5D,kBAAkB,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,IAClE,iBAAiB,OAAO,OAAO,oBAAoB,WAAW,OAAO,kBAAkB;AAAA,EACzF;AACF;AAOA,eAAsB,oBAAqC;AACzD,QAAM,QAAQ,MAAM,WAAW,EAAE,SAAS,uCAAuC;AACjF,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,EAAE,MAAM,mBAAmB,SAAS,2BAA2B,CAAC;AAAA,EAC1F;AACA,QAAM,UAAU,MAAM,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAC7C,QAAM,OAAO,OAAO,KAAK,UAAU,IAAI,QAAQ,IAAK,QAAQ,SAAS,KAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AACxG,QAAM,MAAO,KAAK,MAAM,IAAI,EAAuB;AACnD,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,4BAA4B,GAA2B;AAC9D,QAAM,OAAO,aAAa,QAAQ,EAAE,OAAO;AAC3C,QAAM,UAAU,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACzD,MAAI,SAAS,gCAAgC,yBAAyB,KAAK,OAAO,GAAG;AACnF,WAAO,IAAI,cAAc;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,SAAS,iCAAiC,sCAAsC,KAAK,OAAO,GAAG;AACjG,WAAO,IAAI,cAAc;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,sBAAsB,KAAK,OAAO,GAAG;AACvC,WAAO,IAAI,cAAc;AAAA,MACvB,MAAM;AAAA,MACN,SAAS,2DAA2D,OAAO;AAAA,MAC3E,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,IAAI,cAAc;AAAA,IACvB,MAAM;AAAA,IACN,SAAS,mCAAmC,OAAO;AAAA,IACnD,OAAO;AAAA,EACT,CAAC;AACH;;;ADzIA,IAAM,4BAA4B;AAClC,IAAM,gCAAgC,oBAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC;AAE7D,eAAsB,QACpB,MACA,KACA,QACY;AACZ,QAAM,QAAQ,MAAM,eAAe,KAAK,eAAe;AAEvD,QAAM,MAAM,GAAG,KAAK,UAAU,GAAG,IAAI,IAAI;AACzC,QAAM,UAAkC;AAAA,IACtC,eAAe,UAAU,KAAK;AAAA,IAC9B,QAAQ;AAAA,EACV;AACA,MAAI,IAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAEtD,QAAM,OAAoB;AAAA,IACxB,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,IAAI,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI,IAAI;AAAA,EAC5D;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,IAAI;AAAA,EAC7B,SAAS,GAAG;AACV,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,8BAA8B,KAAK,UAAU,KAAM,EAAY,OAAO;AAAA,MAC/E,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,MAAI,8BAA8B,IAAI,IAAI,MAAM,GAAG;AACjD,aAAS,6BAA6B;AACtC,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AACjE,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,IAAI;AAAA,IAC7B,SAAS,GAAG;AACV,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,oCAAqC,EAAY,OAAO;AAAA,QACjE,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,IAAI,KAAK;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,mCAAmC,IAAI,MAAM;AAAA,MACtD,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,0EAA0E,IAAI,MAAM;AAAA,MAC7F,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,WAAW;AAEjB,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,aAAa,SAAS,OAAO,IAAI,MAAM;AAAA,EACnD;AAEA,SAAO,SAAS;AAClB;;;AFpFA;;;AKPA,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,SAAS,SAAS,WAAW,aAAa,qBAAqB;AAW/D,SAAS,YAAoB;AAC3B,QAAM,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,SAAY,UAAK,MAAM,YAAY;AACrC;AAEO,SAAS,gBAAwB;AACtC,SAAY,UAAK,UAAU,GAAG,iBAAiB;AACjD;AAEA,eAAsB,aAAwC;AAC5D,QAAM,aAAa,cAAc;AACjC,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,YAAY,MAAM;AAChD,QAAI;AACJ,QAAI;AACF,eAAS,UAAU,GAAG;AAAA,IACxB,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QACE,OAAO,OAAO,eAAe,YAC7B,OAAO,OAAO,oBAAoB,YAClC,OAAO,OAAO,oBAAoB,YAClC,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,2BAA2B,YACzC,OAAO,OAAO,aAAa,UAC3B;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,YAAY,KAA+B;AAC/D,QAAM,MAAM,UAAU;AACtB,QAAM,aAAa,cAAc;AACjC,QAAS,SAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,OAAO,cAAc,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7C,QAAM,MAAM,GAAG,UAAU;AACzB,QAAS,aAAU,KAAK,MAAM,MAAM;AACpC,QAAS,UAAO,KAAK,UAAU;AACjC;AAEA,eAAsB,cAAgC;AACpD,QAAM,aAAa,cAAc;AACjC,MAAI;AACF,UAAS,UAAO,UAAU;AAC1B,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACF;;;AClEA;AAHA,SAAS,8BAA8B;AACvC,SAAS,0BAAAC,+BAA8B;AACvC,SAAS,cAAc;AA2BvB,eAAsB,gBAAgB,MAGT;AAC3B,QAAM,iBAAiB,KAAK,mBAAmB,MAAM,aAAa,GAAG;AACrE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,IAAI,uBAAuB,IAAIC,wBAAuB,GAAG,cAAc;AAEtF,QAAM,aAAsC,CAAC;AAC7C,MAAI;AACF,qBAAiB,OAAO,OAAO,cAAc,mBAAmB,GAAG;AACjE,WAAK,IAAI,QAAQ,CAAC,GAAG,WAAW,MAAM,UAAW;AACjD,YAAMC,QAAO,IAAI,eAAe,SAAS;AACzC,YAAM,OAAO,IAAI,UAAU,aAAa,CAAC,GAAG,OAAO,CAAC;AACpD,YAAM,SAAS,oBAAI,IAAoB;AACvC,iBAAW,KAAK,MAAM;AACpB,YAAI,EAAE,QAAQ,OAAO,EAAE,UAAU,UAAU;AACzC,iBAAO,IAAI,EAAE,MAAM,EAAE,KAAK;AAAA,QAC5B;AAAA,MACF;AACA,iBAAW,KAAK;AAAA,QACd,YAAY,IAAI,MAAM;AAAA,QACtB,MAAM,IAAI,QAAQ;AAAA,QAClB,gBAAgB,IAAI,MAAM,IAAI,MAAM,kBAAkB,EAAE,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,QAC7E,UAAU,IAAI,YAAY;AAAA,QAC1B,MAAAA;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,SAAS,GAAG;AACV,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,kDAAkD,cAAc,KAAM,EAAY,OAAO;AAAA,MAClG,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,iDAAiD,cAAc;AAAA,MACxE,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI,WAAW,WAAW,GAAG;AAC3B,aAAS,WAAW,CAAC;AAAA,EACvB,WAAW,KAAK,aAAa;AAC3B,UAAM,aAAa,MAAM,OAAO;AAAA,MAC9B,SAAS,wDAAwD,cAAc;AAAA,MAC/E,SAAS,WAAW,IAAI,CAAC,OAAO;AAAA,QAC9B,MAAM,GAAG,EAAE,IAAI,SAAS,EAAE,aAAa,KAAK,EAAE,QAAQ;AAAA,QACtD,OAAO,EAAE;AAAA,MACX,EAAE;AAAA,IACJ,CAAC;AACD,UAAM,QAAQ,WAAW,KAAK,CAAC,MAAM,EAAE,eAAe,UAAU;AAChE,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,aAAS;AAAA,EACX,OAAO;AACL,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,wDAAwD,cAAc,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,MAC5H,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,OAAO;AACpB,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,kBAAkB,OAAO,IAAI;AAAA,MACtC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,OAAO,QAAQ,IAAI,iBAAiB;AAC5D,QAAM,kBAAkB,OAAO,QAAQ,IAAI,iBAAiB;AAC5D,MAAI,CAAC,mBAAmB,CAAC,iBAAiB;AACxC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,kBAAkB,OAAO,IAAI;AAAA,MACtC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,OAAO,QAAQ,IAAI,0BAA0B;AAErE,SAAO;AAAA,IACL,YAAY,WAAW,IAAI;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,OAAO;AAAA,IAC/B;AAAA,EACF;AACF;;;AClHA,eAAsB,sBAAsB,MAIhB;AAC1B,QAAM,SAAS,KAAK,kBAAkB,OAAO,MAAM,WAAW;AAC9D,QAAM,eACJ,WAAW,SACV,KAAK,mBAAmB,UACvB,OAAO,mBAAmB,KAAK;AAEnC,MAAI,gBAAgB,QAAQ;AAC1B,WAAO;AAAA,MACL,YAAY,OAAO;AAAA,MACnB,iBAAiB,OAAO;AAAA,MACxB,iBAAiB,OAAO;AAAA,MACxB,gBAAgB,OAAO;AAAA,MACvB,wBAAwB,OAAO;AAAA,MAC/B,WAAW;AAAA,IACb;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,gBAAgB;AAAA,IAClC,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,UAAqB;AAAA,IACzB,YAAY,MAAM;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,iBAAiB,MAAM;AAAA,IACvB,gBAAgB,MAAM;AAAA,IACtB,wBAAwB,MAAM;AAAA,IAC9B,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC;AACA,QAAM,YAAY,OAAO;AACzB,SAAO,EAAE,GAAG,OAAO,WAAW,MAAM;AACtC;;;AP7CO,IAAM,iBAAN,cAA6B,WAAW;AAAA,EAC7C,OAAO,QAAQ,CAAC,CAAC,QAAQ,KAAK,CAAC;AAAA,EAC/B,OAAO,QAAQC,SAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAAA,EAED,UAAU,OAAO,OAAO;AAAA,EACxB,SAAS,OAAO,OAAO,UAAU;AAAA,EACjC,WAAW,OAAO,OAAO,aAAa;AAAA,EACtC,OAAO,OAAO,OAAO,QAAQ;AAAA,EAC7B,cAAc,OAAO,OAAO,gBAAgB;AAAA,EAC5C,SAAS,OAAO,OAAO,UAAU;AAAA,EACjC,eAAe,OAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAC1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAE1F,UAAM,OAA6B;AAAA,MACjC,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,IAC9D;AAEA,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,QAAQ,MAAM,iBAAiB,KAAK;AAAA,MAC9C,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,oBAAoB,OAAO,MAAM,KAAK,QAAQ,SAAS,CAAC,KAAK,KAAK,QAAQ,OAAO,WAAM,KAAK,QAAQ,SAAS;AAAA;AAAA,IACrI;AACA,SAAK,QAAQ,OAAO,MAAM,kBAAkB,KAAK,UAAU;AAAA,CAAI;AAC/D,SAAK,QAAQ,OAAO;AAAA,MAClB,KAAK,OAAO,KAAK,YAAY,CAAC,oGAAoG,KAAK,QAAQ,OAAO;AAAA;AAAA,IACxJ;AACA,WAAO;AAAA,EACT;AACF;;;AQjGA,SAAS,eAAe;AACxB,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAShC;AAQO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,OAAO,QAAQ,CAAC,CAAC,QAAQ,SAAS,CAAC;AAAA,EACnC,OAAO,QAAQC,SAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,gCAAgC,wBAAwB;AAAA,MACzD,CAAC,iCAAiC,gCAAgC;AAAA,MAClE,CAAC,4BAA4B,sCAAsC;AAAA,IACrE;AAAA,EACF,CAAC;AAAA,EAED,YAAYC,QAAO,OAAO,EAAE,UAAU,MAAM,CAAC;AAAA,EAC7C,cAAcA,QAAO,QAAQ,kBAAkB,KAAK;AAAA,EACpD,MAAMA,QAAO,QAAQ,SAAS,KAAK;AAAA,EACnC,SAASA,QAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,QAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,QAAI,KAAK,aAAa,KAAK,aAAa;AACtC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SACE;AAAA,QACF,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,aAAa;AACxC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAC1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAE1F,QAAI,KAAK,aAAa;AACpB,aAAO,MAAM,KAAK,eAAe,KAAK,MAAM,WAAW;AAAA,IACzD;AACA,WAAO,MAAM,KAAK,iBAAiB,KAAK,MAAM,aAAa,KAAK,SAAU;AAAA,EAC5E;AAAA,EAEA,MAAc,iBACZ,KACA,MACA,aACA,WACiB;AAEjB,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,OAAO,MAAM,iBAAiB,mBAAmB,SAAS,CAAC,GAAG;AAAA,MACxE,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,KAAK,QAAQ,WAAW,YAAY;AACtC,WAAK,QAAQ,OAAO;AAAA,QAClB,OAAO,MAAM,QAAQ,IACnB,aAAa,SAAS,qCAAqC,SAAS;AAAA;AAAA,MACxE;AACA,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,KAAK,OAAO,aAAa;AAC5B,YAAM,KAAK,MAAM,QAAQ;AAAA,QACvB,SAAS,6BAA6B,SAAS;AAAA,QAC/C,SAAS;AAAA,MACX,CAAC;AACD,UAAI,CAAC,IAAI;AACP,aAAK,QAAQ,OAAO,MAAM,qCAAgC;AAC1D,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,UAAU,MAAM,iBAAiB,mBAAmB,SAAS,CAAC,gBAAgB;AAAA,MACxF,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,6BAA6B,OAAO,MAAM,KAAK,QAAQ,SAAS,CAAC;AAAA;AAAA,IACzF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,eACZ,KACA,MACA,aACiB;AAEjB,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,OAAO,MAAM,gCAAgC;AAAA,MACvD,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,WAAK,QAAQ,OAAO,MAAM,qCAAqC;AAC/D,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,KAAK,OAAO,aAAa;AAC5B,YAAM,KAAK,MAAM,QAAQ;AAAA,QACvB,SAAS,GAAG,KAAK,SAAS,MAAM;AAAA,QAChC,SAAS;AAAA,MACX,CAAC;AACD,UAAI,CAAC,IAAI;AACP,aAAK,QAAQ,OAAO,MAAM,qCAAgC;AAC1D,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,QAAQ,MAAM,kCAAkC,MAAM,CAAC,EAAE;AAAA,MACnE,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,aAAO,KAAK,OAAO,SAAS,IAAI,IAAI;AAAA,IACtC;AAEA,QAAI,KAAK,OAAO,WAAW,GAAG;AAC5B,WAAK,QAAQ,OAAO;AAAA,QAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,YAAY,KAAK,QAAQ,MAAM;AAAA;AAAA,MACvD;AACA,aAAO;AAAA,IACT;AAGA,SAAK,QAAQ,OAAO;AAAA,MAClB,OAAO,MAAM,QAAG,IACd,YAAY,KAAK,QAAQ,MAAM,gBAAgB,KAAK,OAAO,MAAM;AAAA;AAAA,IACrE;AACA,eAAW,QAAQ,KAAK,QAAQ;AAC9B,WAAK,QAAQ,OAAO,MAAM,OAAO,KAAK,SAAS,KAAK,KAAK,OAAO,MAAM,KAAK,eAAe;AAAA,CAAI;AAAA,IAChG;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,OAAO,KAAK,SAAS,IACnB;AAAA,IACJ;AACA,WAAO;AAAA,EACT;AACF;;;AClLA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAYzB,IAAM,kBAAN,cAA8B,WAAW;AAAA,EAC9C,OAAO,QAAQ,CAAC,CAAC,QAAQ,MAAM,CAAC;AAAA,EAChC,OAAO,QAAQC,SAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,gBAAgB,cAAc;AAAA,MAC/B,CAAC,qBAAqB,iCAAiC;AAAA,MACvD,CAAC,oBAAoB,gCAAgC;AAAA,MACrD,CAAC,yBAAyB,4BAA4B;AAAA,IACxD;AAAA,EACF,CAAC;AAAA,EAED,UAAUC,QAAO,OAAO,WAAW;AAAA,EACnC,SAASA,QAAO,OAAO,UAAU;AAAA,EACjC,SAASA,QAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,QAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAC1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAE1F,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,KAAK,QAAS,IAAG,IAAI,WAAW,KAAK,OAAO;AAChD,QAAI,KAAK,OAAQ,IAAG,IAAI,UAAU,KAAK,MAAM;AAC7C,UAAMC,SAAO,GAAG,SAAS,EAAE,SAAS,IAAI,iBAAiB,GAAG,SAAS,CAAC,KAAK;AAE3E,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,OAAO,MAAAA,OAAK;AAAA,MACtB,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,aAAO;AAAA,IACT;AAEA,QAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,WAAK,QAAQ,OAAO;AAAA,QAClB;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAYA,UAAM,OAAc,KAAK,SAAS,IAAI,CAAC,OAAO;AAAA,MAC5C,WAAW,EAAE;AAAA,MACb,SAAS,EAAE;AAAA,MACX,QAAQ,EAAE;AAAA,MACV,QAAQ,EAAE,WAAW,aAAa,OAAO,MAAM,iBAAY,IAAI,EAAE;AAAA,MACjE,aAAa,EAAE,eAAe;AAAA,MAC9B,SAAS,EAAE,UAAU,MAAM,GAAG,EAAE;AAAA,MAChC,WAAW,EAAE;AAAA,IACf,EAAE;AAEF,UAAM,QAAQ,YAAiB,MAAM;AAAA,MACnC,EAAE,KAAK,aAAa,OAAO,aAAa;AAAA,MACxC,EAAE,KAAK,WAAW,OAAO,UAAU;AAAA,MACnC,EAAE,KAAK,UAAU,OAAO,SAAS;AAAA,MACjC,EAAE,KAAK,UAAU,OAAO,SAAS;AAAA,MACjC,EAAE,KAAK,eAAe,OAAO,eAAe;AAAA,MAC5C,EAAE,KAAK,WAAW,OAAO,UAAU;AAAA,MACnC,EAAE,KAAK,aAAa,OAAO,aAAa;AAAA,IAC1C,CAAC;AACD,SAAK,QAAQ,OAAO,MAAM,QAAQ,IAAI;AAEtC,UAAM,cAAc,KAAK,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE;AACzE,QAAI,cAAc,GAAG;AACnB,WAAK,QAAQ,OAAO;AAAA,QAClB;AAAA,EAAK,KAAK,SAAS,MAAM,gBAAgB,WAAW;AAAA;AAAA,MACtD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACxGA,SAAS,WAAAC,gBAAe;AACxB,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAOhC;AAQO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,OAAO,QAAQ,CAAC,CAAC,QAAQ,QAAQ,CAAC;AAAA,EAClC,OAAO,QAAQC,SAAQ,MAAM;AAAA,IAC3B,aACE;AAAA,IACF,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,uBAAuB,uBAAuB;AAAA,MAC/C,CAAC,4BAA4B,6BAA6B;AAAA,IAC5D;AAAA,EACF,CAAC;AAAA,EAED,YAAYC,QAAO,OAAO;AAAA,EAC1B,MAAMA,QAAO,QAAQ,SAAS,KAAK;AAAA,EACnC,SAASA,QAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,QAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,QAAI,CAAC,KAAK,OAAO,aAAa;AAC5B,YAAM,KAAK,MAAMC,SAAQ;AAAA,QACvB,SAAS,mBAAmB,KAAK,SAAS;AAAA,QAC1C,SAAS;AAAA,MACX,CAAC;AACD,UAAI,CAAC,IAAI;AACP,aAAK,QAAQ,OAAO,MAAM,qCAAgC;AAC1D,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAE1F,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,QACnE,EAAE,QAAQ,UAAU,MAAM,iBAAiB,mBAAmB,KAAK,SAAS,CAAC,GAAG;AAAA,QAChF,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,MAC/C;AAEA,UAAI,SAAS,QAAQ;AACnB,aAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,eAAO;AAAA,MACT;AAEA,WAAK,QAAQ,OAAO;AAAA,QAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,oBAAoB,OAAO,MAAM,KAAK,QAAQ,SAAS,CAAC,cAAc,KAAK,QAAQ,OAAO,yBAAyB,KAAK,QAAQ,oBAAoB;AAAA;AAAA,MAC5K;AACA,aAAO;AAAA,IACT,SAAS,GAAG;AAIV,UAAI,aAAa,cAAc;AAC7B,cAAM,UAAW,EAAE,SAAS,WAAmD,CAAC;AAChF,YAAI,QAAQ,WAAW,6BAA6B,SAAS,QAAQ;AACnE,gBAAM,UAAU,QAAQ;AACxB,cAAI,SAAS;AACX,kBAAM,YAAY,QAAQ,eAAe,KAAK,IAAI,KAAK;AACvD,iBAAK,QAAQ,OAAO;AAAA,cAClB,OAAO,MAAM,QAAQ,IACnB,yCAAyC,QAAQ,SAAS;AAAA;AAAA,YAC9D;AACA,iBAAK,QAAQ,OAAO,MAAM,gBAAgB,SAAS;AAAA,CAAI;AACvD,iBAAK,QAAQ,OAAO;AAAA,cAClB,gBAAgB,QAAQ,UAAU,WAAM,QAAQ,eAAe;AAAA;AAAA,YACjE;AACA,iBAAK,QAAQ,OAAO;AAAA,cAClB,OAAO,KAAK,SAAS,IACnB,4BAA4B,QAAQ,SAAS;AAAA;AAAA,YACjD;AACA,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;ACrGA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAWzB,IAAM,kBAAN,cAA8B,WAAW;AAAA,EAC9C,OAAO,QAAQ,CAAC,CAAC,QAAQ,MAAM,CAAC;AAAA,EAChC,OAAO,QAAQC,SAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU,CAAC,CAAC,0BAA0B,qBAAqB,CAAC;AAAA,EAC9D,CAAC;AAAA,EAED,YAAYC,QAAO,OAAO;AAAA,EAC1B,SAASA,QAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,QAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAC1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAE1F,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,OAAO,MAAM,iBAAiB,mBAAmB,KAAK,SAAS,CAAC,GAAG;AAAA,MAC7E,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,aAAO;AAAA,IACT;AAEA,UAAM,EAAE,QAAQ,IAAI;AACpB,SAAK,QAAQ,OAAO;AAAA,MAClB,oBAAoB;AAAA,QAClB,EAAE,KAAK,cAAc,OAAO,QAAQ,UAAU;AAAA,QAC9C,EAAE,KAAK,WAAW,OAAO,QAAQ,QAAQ;AAAA,QACzC,EAAE,KAAK,UAAU,OAAO,QAAQ,UAAU;AAAA,QAC1C,EAAE,KAAK,gBAAgB,OAAO,QAAQ,YAAY;AAAA,QAClD,EAAE,KAAK,UAAU,OAAO,QAAQ,OAAO;AAAA,QACvC,EAAE,KAAK,kBAAkB,OAAO,QAAQ,kBAAkB;AAAA,QAC1D,EAAE,KAAK,WAAW,OAAO,QAAQ,UAAU;AAAA,QAC3C,EAAE,KAAK,cAAc,OAAO,QAAQ,UAAU;AAAA,MAChD,CAAC,IAAI;AAAA,IACP;AACA,WAAO;AAAA,EACT;AACF;;;AC5DA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAKzB,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,OAAO,QAAQ,CAAC,CAAC,UAAU,OAAO,CAAC;AAAA,EACnC,OAAO,QAAQC,SAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,EACf,CAAC;AAAA,EAED,SAASC,QAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,UAAU,MAAM,YAAY;AAClC,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,IAAI,IAAI;AACxD,aAAO;AAAA,IACT;AACA,QAAI,SAAS;AACX,WAAK,QAAQ,OAAO,MAAM,mBAAmB;AAAA,IAC/C,OAAO;AACL,WAAK,QAAQ,OAAO,MAAM,uBAAuB;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AACF;;;AC9BA,SAAS,WAAAC,UAAS,UAAAC,eAAc;;;ACGhC;AAHA,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AACtB,SAAS,SAASC,YAAW,aAAaC,sBAAqB;AAGxD,IAAM,sBAAsB,CAAC,YAAY,YAAY,iBAAiB;AAU7E,IAAM,UACJ;AAEF,SAASC,aAAoB;AAC3B,QAAM,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,SAAY,WAAK,MAAM,YAAY;AACrC;AAEO,SAAS,uBAA+B;AAC7C,SAAY,WAAKA,WAAU,GAAG,aAAa;AAC7C;AAEO,SAAS,cAAsB;AACpC,SAAY,WAAKA,WAAU,GAAG,WAAW,WAAW;AACtD;AAGO,SAAS,iBAAiB,UAA0B;AACzD,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,uCAAuC,QAAQ;AAAA,MACxD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,OAAO,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACnD,QAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,2CAA2C,QAAQ;AAAA,MAC5D,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,oBAAoBC,MAAuB,OAAqB;AAC9E,MAAIA,SAAQ,mBAAmB;AAC7B,qBAAiB,KAAK;AACtB;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,KAAK,KAAK,GAAG;AACxB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,GAAGA,IAAG,yBAAyB,KAAK;AAAA,IAC/C,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,oBAAmD;AACvE,MAAI;AACJ,MAAI;AACF,UAAM,MAAS,aAAS,qBAAqB,GAAG,MAAM;AAAA,EACxD,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAASH,WAAU,GAAG;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,IAAI;AACV,MACE,OAAO,EAAE,aAAa,YACtB,OAAO,EAAE,aAAa,YACtB,OAAO,EAAE,oBAAoB,YAC7B,EAAE,SAAS,WAAW,KACtB,EAAE,SAAS,WAAW,KACtB,EAAE,gBAAgB,WAAW,GAC7B;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,iBAAiB,EAAE,eAAe;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,UAAU,EAAE;AAAA,IACZ,iBAAiB,EAAE,gBAAgB,QAAQ,OAAO,EAAE;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAsB,mBAA2C;AAC/D,MAAI;AACF,UAAM,MAAM,MAAS,aAAS,YAAY,GAAG,MAAM;AACnD,UAAM,SAASA,WAAU,GAAG;AAC5B,QAAI,UAAU,OAAO,WAAW,UAAU;AACxC,YAAM,KAAM,OAAmC;AAC/C,UAAI,OAAO,OAAO,YAAY,GAAG,SAAS,EAAG,QAAO,GAAG,QAAQ,OAAO,EAAE;AAAA,IAC1E;AACA,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACF;AAEA,eAAe,YAAY,UAAkB,UAAiC;AAC5E,QAAM,MAAM,GAAG,QAAQ;AACvB,QAAS,cAAU,KAAK,UAAU,MAAM;AACxC,QAAS,WAAO,KAAK,QAAQ;AAC/B;AAMA,eAAsB,mBACpB,SACe;AACf,QAAS,UAAME,WAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,MAAI,WAAoC,CAAC;AACzC,MAAI;AACF,UAAM,MAAM,MAAS,aAAS,qBAAqB,GAAG,MAAM;AAC5D,UAAM,SAASF,WAAU,GAAG;AAC5B,QAAI,UAAU,OAAO,WAAW,SAAU,YAAW;AAAA,EACvD,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,OAAM;AAAA,EAC5D;AACA,QAAM,SAAS,EAAE,GAAG,UAAU,GAAG,QAAQ;AACzC,QAAM,YAAY,qBAAqB,GAAGC,eAAc,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE9E,QAAM,WAAW,OAAO;AACxB,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,UAAS,UAAW,cAAQ,YAAY,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/D,UAAM,YAAY,YAAY,GAAGA,eAAc,EAAE,iBAAiB,SAAS,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAAA,EAC9F;AACF;;;ADjJA;AAGO,IAAM,mBAAN,cAA+B,WAAW;AAAA,EAC/C,OAAO,QAAQ,CAAC,CAAC,UAAU,KAAK,CAAC;AAAA,EACjC,OAAO,QAAQG,SAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAMC,QAAO,OAAO;AAAA,EACpB,QAAQA,QAAO,OAAO;AAAA,EACtB,SAASA,QAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AAEA,QAAI,CAAE,oBAA0C,SAAS,KAAK,GAAG,GAAG;AAClE,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,uBAAuB,KAAK,GAAG;AAAA,QACxC,MAAM,eAAe,oBAAoB,KAAK,IAAI,CAAC;AAAA,MACrD,CAAC;AAAA,IACH;AACA,UAAMC,OAAM,KAAK;AACjB,wBAAoBA,MAAK,KAAK,KAAK;AACnC,UAAM,mBAAmB,EAAE,CAACA,IAAG,GAAG,KAAK,MAAM,CAAC;AAE9C,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,KAAAA,MAAK,OAAO,KAAK,OAAO,SAAS,KAAK,CAAC,IAAI,IAAI;AACtF,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO,MAAM,OAAOA,IAAG,WAAM,KAAK,KAAK;AAAA,CAAI;AACxD,WAAO;AAAA,EACT;AACF;;;AE7CA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAWzB,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,OAAO,QAAQ,CAAC,CAAC,UAAU,MAAM,CAAC;AAAA,EAClC,OAAO,QAAQC,SAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,EACJ,CAAC;AAAA,EAED,SAASC,QAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,UAAU,MAAM,kBAAkB;AACxC,UAAMC,SAAQ,MAAM,WAAW;AAE/B,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,SAAS,cAAcA,OAAM,CAAC,IAAI,IAAI;AAC7E,aAAO;AAAA,IACT;AAEA,UAAM,eAAe,UACjB,oBAAoB;AAAA,MAClB,EAAE,KAAK,UAAU,OAAO,QAAQ,SAAS;AAAA,MACzC,EAAE,KAAK,aAAa,OAAO,QAAQ,SAAS;AAAA,MAC5C,EAAE,KAAK,WAAW,OAAO,QAAQ,YAAY;AAAA,MAC7C,EAAE,KAAK,YAAY,OAAO,QAAQ,gBAAgB;AAAA,IACpD,CAAC,IACD,OAAO,IAAI,uEAAkE;AACjF,SAAK,QAAQ,OAAO,MAAM,OAAO,MAAM,gBAAgB,IAAI,KAAK,qBAAqB,CAAC;AAAA,CAAK;AAC3F,SAAK,QAAQ,OAAO,MAAM,eAAe,MAAM;AAE/C,SAAK,QAAQ,OAAO,MAAM,OAAO,MAAM,eAAe,IAAI,KAAK,cAAc,CAAC;AAAA,CAAK;AACnF,QAAI,CAACA,QAAO;AACV,WAAK,QAAQ,OAAO;AAAA,QAClB,OAAO,IAAI,6DAAwD,IAAI;AAAA,MACzE;AACA,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,oBAAoB;AAAA,QAClB,EAAE,KAAK,WAAW,OAAOA,OAAM,WAAW;AAAA,QAC1C,EAAE,KAAK,aAAa,OAAOA,OAAM,gBAAgB;AAAA,QACjD,EAAE,KAAK,UAAU,OAAOA,OAAM,gBAAgB;AAAA,QAC9C,EAAE,KAAK,gBAAgB,OAAOA,OAAM,eAAe;AAAA,QACnD,EAAE,KAAK,iBAAiB,OAAOA,OAAM,uBAAuB;AAAA,QAC5D,EAAE,KAAK,aAAa,OAAOA,OAAM,SAAS;AAAA,MAC5C,CAAC,IAAI;AAAA,IACP;AACA,WAAO;AAAA,EACT;AACF;;;AChEA,SAAS,WAAAC,WAAS,UAAAC,eAAc;AAShC;AAQO,IAAM,iBAAN,cAA6B,WAAW;AAAA,EAC7C,OAAO,QAAQ,CAAC,CAAC,QAAQ,KAAK,CAAC;AAAA,EAC/B,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAAA,EAED,SAASC,QAAO,OAAO;AAAA,EACvB,UAAUA,QAAO,OAAO,aAAa,EAAE,UAAU,KAAK,CAAC;AAAA,EACvD,WAAWA,QAAO,OAAO,YAAY;AAAA,EACrC,QAAQA,QAAO,OAAO,SAAS;AAAA,EAC/B,QAAQA,QAAO,OAAO,SAAS;AAAA,EAC/B,SAASA,QAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,QAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,aAAmC,CAAC;AAC1C,QAAI,KAAK,SAAU,YAAW,WAAW,KAAK;AAC9C,QAAI,KAAK,MAAO,YAAW,QAAQ,KAAK;AACxC,QAAI,KAAK,MAAO,YAAW,QAAQ,KAAK;AAExC,QAAI,OAAO,KAAK,UAAU,EAAE,WAAW,GAAG;AACxC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAC1F,UAAM,OAA0B;AAAA,MAC9B,QAAQ,KAAK;AAAA,MACb,aAAa,KAAK;AAAA,MAClB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM;AAAA,QACb,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,QACnE,EAAE,QAAQ,QAAQ,MAAM,aAAa,KAAK;AAAA,QAC1C,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,MAC/C;AAAA,IACF,SAAS,GAAG;AAIV,UAAI,aAAa,cAAc;AAC7B,cAAM,UAAW,EAAE,SAAS,WAAmD,CAAC;AAChF,YAAI,QAAQ,WAAW,iCAAiC,SAAS,QAAQ;AACvE,gBAAM,UAAU,QAAQ;AACxB,cAAI,SAAS;AACX,kBAAM,UAAU,OAAO,KAAK,QAAQ,OAAO,EAAE,KAAK,IAAI,KAAK;AAC3D,iBAAK,QAAQ,OAAO;AAAA,cAClB,OAAO,MAAM,QAAQ,IACnB,yBAAoB,OAAO,eAAe,QAAQ,OAAO,OAAO;AAAA;AAAA,YACpE;AACA,iBAAK,QAAQ,OAAO;AAAA,cAClB,OAAO,KAAK,SAAS,IACnB,uBAAuB,KAAK,MAAM,4CAA4C,KAAK,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,QAAQ,OAAO,aAAa;AAAA;AAAA,YACzJ;AACA,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,kBAAkB,OAAO,KAAK,OAAO,UAAU,EAAE,KAAK,IAAI;AAChE,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,YAAY,OAAO,MAAM,OAAO,MAAM,CAAC,KAAK,OAAO,WAAW,UAAU,eAAe,WAAW,OAAO,KAAK,OAAO,UAAU,EAAE,WAAW,IAAI,MAAM,KAAK;AAAA;AAAA,IACnL;AACA,WAAO;AAAA,EACT;AACF;;;ACjHA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAQhC;AAIO,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,OAAO,QAAQ,CAAC,CAAC,QAAQ,cAAc,CAAC;AAAA,EACxC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,SAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,aAAmC,CAAC;AAC1C,QAAI,KAAK,SAAU,YAAW,WAAW,KAAK;AAC9C,QAAI,KAAK,MAAO,YAAW,QAAQ,KAAK;AACxC,QAAI,KAAK,MAAO,YAAW,QAAQ,KAAK;AAExC,QAAI,OAAO,KAAK,UAAU,EAAE,WAAW,GAAG;AACxC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,kCAAkC,KAAK,MAAM;AAAA,MACrD,CAAC;AAAA,IACH;AAEA,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAC1F,UAAM,OAAyB,EAAE,eAAe,WAAW;AAE3D,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE;AAAA,QACE,QAAQ;AAAA,QACR,MAAM,aAAa,mBAAmB,KAAK,MAAM,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,MACA,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,OAAO,QAAQ,UAAU,EACpC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI,EAAE,EAAE,EAC/B,KAAK,IAAI;AACZ,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,UAAU,KAAK,OAAO,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AACF;;;ACnFA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAWzB,IAAM,kBAAN,cAA8B,WAAW;AAAA,EAC9C,OAAO,QAAQ,CAAC,CAAC,QAAQ,MAAM,CAAC;AAAA,EAChC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,MACR,CAAC,gBAAgB,cAAc;AAAA,MAC/B,CAAC,yBAAyB,4BAA4B;AAAA,IACxD;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,SAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAC1F,UAAM,OAAO,MAAM;AAAA,MACjB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,OAAO,MAAM,YAAY;AAAA,MACnC,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,aAAO;AAAA,IACT;AAEA,QAAI,KAAK,QAAQ,WAAW,GAAG;AAC7B,WAAK,QAAQ,OAAO;AAAA,QAClB;AAAA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAYA,UAAM,OAAc,KAAK,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3C,QAAQ,EAAE;AAAA,MACV,SAAS,EAAE;AAAA,MACX,UAAU,EAAE,WAAW,YAAY;AAAA,MACnC,OAAO,EAAE,WAAW,SAAS;AAAA,MAC7B,OAAO,EAAE,WAAW,SAAS;AAAA,MAC7B,OAAO,EAAE,QAAQ,MAAM,GAAG,EAAE;AAAA,MAC5B,SAAS,EAAE;AAAA,IACb,EAAE;AAEF,UAAM,QAAQ,YAAiB,MAAM;AAAA,MACnC,EAAE,KAAK,UAAU,OAAO,SAAS;AAAA,MACjC,EAAE,KAAK,WAAW,OAAO,UAAU;AAAA,MACnC,EAAE,KAAK,YAAY,OAAO,WAAW;AAAA,MACrC,EAAE,KAAK,SAAS,OAAO,QAAQ;AAAA,MAC/B,EAAE,KAAK,SAAS,OAAO,QAAQ;AAAA,MAC/B,EAAE,KAAK,SAAS,OAAO,QAAQ;AAAA,MAC/B,EAAE,KAAK,WAAW,OAAO,WAAW;AAAA,IACtC,CAAC;AACD,SAAK,QAAQ,OAAO,MAAM,QAAQ,IAAI;AACtC,WAAO;AAAA,EACT;AACF;;;ACrFA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAEhC,SAAS,WAAAC,gBAAe;AAExB;AAIO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,OAAO,QAAQ,CAAC,CAAC,QAAQ,QAAQ,CAAC;AAAA,EAClC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,4BAA4B,wBAAwB;AAAA,MACrD,CAAC,qBAAqB,8BAA8B;AAAA,IACtD;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,MAAMA,SAAO,QAAQ,SAAS,OAAO,EAAE,aAAa,4BAA4B,CAAC;AAAA,EACjF,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,SAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,QAAI,CAAC,KAAK,KAAK;AACb,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,mBAAmB,KAAK,MAAM;AAAA,QACtC,CAAC;AAAA,MACH;AACA,YAAM,KAAK,MAAMC,SAAQ;AAAA,QACvB,SAAS,uBAAuB,KAAK,MAAM;AAAA,QAC3C,SAAS;AAAA,MACX,CAAC;AACD,UAAI,CAAC,IAAI;AACP,YAAI,SAAS,SAAU,MAAK,QAAQ,OAAO,MAAM,cAAc;AAC/D,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAC1F,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,UAAU,MAAM,aAAa,mBAAmB,KAAK,MAAM,CAAC,GAAG;AAAA,MACzE,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,YAAY,OAAO,MAAM,OAAO,QAAQ,MAAM,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,OAAO,QAAQ,SAAS,IAAI,KAAK,GAAG;AAAA;AAAA,IAC1I;AACA,WAAO;AAAA,EACT;AACF;;;ACrEA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAQhC;AAIO,IAAM,4BAAN,cAAwC,WAAW;AAAA,EACxD,OAAO,QAAQ,CAAC,CAAC,QAAQ,iBAAiB,CAAC;AAAA,EAC3C,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,oCAAoC,yCAAyC;AAAA,IAChF;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,WAAWA,SAAO,QAAQ,cAAc,KAAK;AAAA,EAC7C,QAAQA,SAAO,QAAQ,WAAW,KAAK;AAAA,EACvC,QAAQA,SAAO,QAAQ,WAAW,KAAK;AAAA,EACvC,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,SAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,WAAsB,CAAC;AAC7B,QAAI,KAAK,SAAU,UAAS,KAAK,UAAU;AAC3C,QAAI,KAAK,MAAO,UAAS,KAAK,OAAO;AACrC,QAAI,KAAK,MAAO,UAAS,KAAK,OAAO;AAErC,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,qCAAqC,KAAK,MAAM;AAAA,MACxD,CAAC;AAAA,IACH;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,4BAA4B,KAAK,MAAM,wCAAwC,KAAK,MAAM;AAAA,MAClG,CAAC;AAAA,IACH;AAEA,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAC1F,UAAM,OAAyB,EAAE,kBAAkB,SAAS;AAE5D,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE;AAAA,QACE,QAAQ;AAAA,QACR,MAAM,aAAa,mBAAmB,KAAK,MAAM,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,MACA,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,YAAY,SAAS,CAAC,CAAC,kBAAkB,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA;AAAA,IAC5F;AACA,WAAO;AAAA,EACT;AACF;;;AClFA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAWzB,IAAM,kBAAN,cAA8B,WAAW;AAAA,EAC9C,OAAO,QAAQ,CAAC,CAAC,QAAQ,MAAM,CAAC;AAAA,EAChC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU,CAAC,CAAC,gBAAgB,sBAAsB,CAAC;AAAA,EACrD,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,eAAeA,SAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAC1F,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,OAAO,MAAM,aAAa,mBAAmB,KAAK,MAAM,CAAC,GAAG;AAAA,MACtE,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,eAAkE,CAAC;AACzE,QAAI,OAAO,WAAW,SAAU,cAAa,KAAK,EAAE,KAAK,cAAc,OAAO,OAAO,WAAW,SAAS,CAAC;AAC1G,QAAI,OAAO,WAAW,MAAO,cAAa,KAAK,EAAE,KAAK,WAAW,OAAO,OAAO,WAAW,MAAM,CAAC;AACjG,QAAI,OAAO,WAAW,MAAO,cAAa,KAAK,EAAE,KAAK,WAAW,OAAO,OAAO,WAAW,MAAM,CAAC;AAEjG,UAAM,QAAQ,oBAAoB;AAAA,MAChC,EAAE,KAAK,UAAU,OAAO,OAAO,OAAO;AAAA,MACtC,EAAE,KAAK,WAAW,OAAO,OAAO,YAAY;AAAA,MAC5C,EAAE,KAAK,cAAc,OAAO,GAAG;AAAA,MAC/B,GAAG;AAAA,MACH,EAAE,KAAK,SAAS,OAAO,OAAO,QAAQ;AAAA,MACtC,EAAE,KAAK,YAAY,OAAO,OAAO,QAAQ;AAAA,IAC3C,CAAC;AACD,SAAK,QAAQ,OAAO,MAAM,QAAQ,IAAI;AACtC,WAAO;AAAA,EACT;AACF;;;ACzDAC;AAFA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,+BAA8B;;;ACEvC;AAHA,YAAYC,SAAQ;AACpB,YAAY,QAAQ;AACpB,YAAYC,WAAU;AAWf,SAAS,cAAc,KAAyC,UAA2B;AAChG,MAAI,SAAU,QAAO;AACrB,QAAM,IAAI,IAAI,sBAAsB,IAAI;AACxC,MAAI,EAAG,QAAO;AACd,QAAM,IAAI,cAAc;AAAA,IACtB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM;AAAA,EACR,CAAC;AACH;AAOO,SAAS,kBAA0B;AACxC,QAAM,SAAc,WAAQ,WAAQ,GAAG,cAAc,WAAW;AAChE,MAAI,CAAI,eAAW,MAAM,GAAG;AAC1B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAU,iBAAa,QAAQ,MAAM,EAAE,KAAK;AAC9C;;;AD/BO,IAAM,uBAAN,cAAmC,WAAW;AAAA,EACnD,OAAO,QAAQ,CAAC,CAAC,SAAS,WAAW,CAAC;AAAA,EACtC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,yCAAyC,oBAAoB;AAAA,MAC9D,CAAC,mBAAmB,4DAA4D;AAAA,IAClF;AAAA,EACF,CAAC;AAAA,EAED,QAAQC,SAAO,OAAO,UAAU;AAAA,EAChC,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AAItC,UAAM,aACJ,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAC/D,KAAK,SACN;AACN,UAAM,OAAO;AAAA,MACX;AAAA,MACA,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,QAAQ,cAAc,QAAQ,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,MAAS;AAChG,UAAMC,cAAa,IAAIC,wBAAuB;AAC9C,UAAM,SAAS,MAAM,eAAe,EAAE,YAAAD,aAAY,MAAM,CAAC;AAEzD,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI;AACnD,aAAO,OAAO,KAAK,IAAI;AAAA,IACzB;AAEA,SAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,MAAM,yBAAyB,CAAC,KAAK,KAAK;AAAA;AAAA,CAAO;AACrF,UAAM,MAAM,CAAC,OAAe,MAAmH;AAC7I,YAAM,SAAS,EAAE,KAAK,OAAO,QAAQ,QAAG,IAAI,OAAO,MAAM,QAAG;AAC5D,YAAM,SAAS,EAAE,KACZ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,SAAY,IAAI,EAAE,KAAK,oBAAoB,EAAE,uBAAuB,SAAY,IAAI,EAAE,kBAAkB,oBAAoB,MAC9J,EAAE,SAAS;AAChB,WAAK,QAAQ,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,OAAO,EAAE,CAAC,IAAI,OAAO,IAAI,MAAM,CAAC;AAAA,CAAI;AAAA,IACrF;AACA,QAAI,uBAAuB,OAAO,OAAO,iBAAiB;AAC1D,QAAI,kBAAkB,OAAO,OAAO,YAAY;AAChD,QAAI,qBAAqB,OAAO,OAAO,eAAe;AACtD,QAAI,oBAAoB,OAAO,OAAO,cAAc;AACpD,QAAI,0BAA0B,OAAO,OAAO,qBAAqB;AACjE,SAAK,QAAQ,OAAO,MAAM,IAAI;AAC9B,SAAK,QAAQ,OAAO;AAAA,MAClB,OAAO,KAAK,GAAG,OAAO,QAAQ,QAAG,CAAC;AAAA,IACtB,GAAG,OAAO,MAAM,QAAG,CAAC;AAAA;AAAA,IAClC;AACA,WAAO,OAAO,KAAK,IAAI;AAAA,EACzB;AACF;;;AEzDAE;AANA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAChC,SAAS,iBAAiB;AAC1B,YAAYC,SAAQ;AACpB,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AACtB,SAAS,0BAAAC,+BAA8B;AAGvC;;;ACNA;AACA;AAFA,SAAS,UAAAC,eAAc;AAIvB,IAAM,MAAM;AACZ,IAAMC,aAAY;AAClB,IAAM,eAAe;AACrB,IAAM,eAAe;AAkBrB,eAAe,uBACbC,aACA,WACsB;AACtB,QAAM,MAAM,GAAG,GAAG,GAAG,SAAS,yBAAyB,YAAY;AACnE,SAAQ,MAAM,WAAwB,EAAE,YAAAA,aAAY,OAAOD,YAAW,QAAQ,OAAO,IAAI,CAAC,KAAM,CAAC;AACnG;AAQA,eAAsB,sBAAsB,MAMhB;AAC1B,QAAM,aAA+B,CAAC;AAEtC,QAAM,WACH,MAAM,WAAwB;AAAA,IAC7B,YAAY,KAAK;AAAA,IACjB,OAAOA;AAAA,IACP,QAAQ;AAAA,IACR,KAAK,GAAG,GAAG,kBAAkB,KAAK,cAAc,+DAA+D,YAAY;AAAA,EAC7H,CAAC,KAAM,CAAC;AAEV,aAAW,OAAO,SAAS,SAAS,CAAC,GAAG;AACtC,QAAI,IAAI,SAAS,gBAAgB,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAI;AACvD,UAAM,WAAW,MAAM,uBAAuB,KAAK,YAAY,IAAI,EAAE;AACrE,eAAW,QAAQ,SAAS,SAAS,CAAC,GAAG;AACvC,UAAI,CAAC,KAAK,KAAM;AAGhB,YAAM,cAAc,KAAK,KAAK,SAAS,GAAG,IACtC,KAAK,KAAK,MAAM,KAAK,KAAK,YAAY,GAAG,IAAI,CAAC,IAC9C,KAAK;AACT,iBAAW,KAAK;AAAA,QACd,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI;AAAA,QAClB;AAAA,QACA,QAAQ,IAAI,YAAY;AAAA,QACxB,UAAU,WAAW,IAAI,IAAI,uCAAuC,WAAW;AAAA,QAC/E,oBAAoB,KAAK,UAAU,eAAe;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,KAAK,UAAU;AACjB,UAAM,QAAQ,WAAW,KAAK,CAAC,MAAM,EAAE,aAAa,KAAK,QAAQ;AACjE,QAAI,MAAO,QAAO;AAClB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,eAAe,KAAK,QAAQ,kEAAkE,KAAK,cAAc;AAAA,MAC1H,MAAM,eAAe,WAAW,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,IAAI,KAAK,QAAQ;AAAA,IAC/E,CAAC;AAAA,EACH;AAiBA,MAAI,KAAK,eAAe;AACtB,UAAM,QAAQ,WAAW,KAAK,CAAC,MAAM,EAAE,aAAa,KAAK,aAAa;AACtE,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,uDAAuD,KAAK,cAAc;AAAA,MACnF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,WAAW,WAAW,EAAG,QAAO,WAAW,CAAC;AAEhD,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,oCAAoC,WAAW,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,KAAK,EAAE,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,MAC/G,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAMD,QAAO;AAAA,IAC5B,SAAS,6CAA6C,KAAK,cAAc;AAAA,IACzE,SAAS,WAAW,IAAI,CAAC,OAAO;AAAA,MAC9B,MAAM,GAAG,EAAE,WAAW,cAAc,EAAE,WAAW,KAAK,EAAE,MAAM;AAAA,MAC9D,OAAO,EAAE;AAAA,IACX,EAAE;AAAA,EACJ,CAAC;AACD,QAAM,SAAS,WAAW,KAAK,CAAC,MAAM,EAAE,aAAa,QAAQ;AAC7D,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,EAAE,MAAM,oCAAoC,SAAS,uBAAuB,CAAC;AAAA,EACvG;AACA,SAAO;AACT;;;ACtIA;AAJA,YAAYG,SAAQ;AACpB,YAAYC,WAAU;AACtB,YAAYC,SAAQ;AACpB,SAAS,SAASC,YAAW,aAAaC,sBAAqB;AAoCxD,SAAS,cAAc,WAAmB,OAAkB,YAAQ,GAAW;AACpF,SAAY,WAAK,MAAM,cAAc,WAAW,GAAG,SAAS,OAAO;AACrE;AAEO,SAAS,cAAc,WAAmB,MAAiC;AAChF,QAAM,OAAO,cAAc,WAAW,IAAI;AAC1C,MAAI,CAAI,eAAW,IAAI,EAAG,QAAO;AACjC,QAAM,OAAU,iBAAa,MAAM,MAAM;AACzC,SAAOD,WAAU,IAAI;AACvB;AAEO,SAAS,eACd,WACA,MACA,MACM;AACN,QAAM,OAAO,cAAc,WAAW,IAAI;AAC1C,EAAG,cAAe,cAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AACpD,EAAG,kBAAc,MAAMC,eAAc,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;AAC7D;AAOO,SAAS,eACd,WACA,OACA,MACM;AACN,QAAM,UAAU,cAAc,WAAW,IAAI;AAC7C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,0CAA0C,SAAS;AAAA,MAC5D,MAAM,eAAe,cAAc,WAAW,IAAI,CAAC;AAAA,IACrD,CAAC;AAAA,EACH;AAIA,QAAM,OAAkB;AAAA,IACtB,WAAW,QAAQ;AAAA,IACnB,SAAS,QAAQ;AAAA,IACjB,iBAAiB,QAAQ;AAAA,IACzB,OAAO,QAAQ;AAAA,IACf,gBAAgB,QAAQ;AAAA,IACxB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,cAAc,QAAQ;AAAA,IACtB,GAAI,QAAQ,wBAAwB,UAAa,EAAE,qBAAqB,QAAQ,oBAAoB;AAAA,IACpG,GAAI,QAAQ,UAAU,UAAa,EAAE,OAAO,QAAQ,MAAM;AAAA,EAC5D;AAIA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,SAAS;AACjB,UAAI,MAAM,MAAM;AACd,eAAO,KAAK;AAAA,MACd,WAAW,MAAM,QAAW;AAC1B,aAAK,QAAQ;AAAA,MACf;AAAA,IACF,WAAW,MAAM,QAAW;AAC1B,MAAC,KAAiC,CAAC,IAAI;AAAA,IACzC;AAAA,EACF;AACA,iBAAe,WAAW,MAAM,IAAI;AACtC;;;AC5GA;AADA,SAAS,SAAAC,cAAa;AASf,IAAM,gBAAwB,CAAC,KAAK,SACzC,IAAI,QAAQ,CAACC,aAAY;AACvB,QAAM,QAAQD,OAAM,KAAK,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACpE,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;AAAE,cAAU,EAAE,SAAS;AAAA,EAAG,CAAC;AAC1D,QAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;AAAE,cAAU,EAAE,SAAS;AAAA,EAAG,CAAC;AAC1D,QAAM,GAAG,SAAS,CAAC,SAASC,SAAQ,EAAE,QAAQ,QAAQ,UAAU,QAAQ,GAAG,CAAC,CAAC;AAC/E,CAAC;AAGH,eAAsB,WAAW,OAAe,eAAiC;AAC/E,QAAM,IAAI,MAAM,KAAK,MAAM,CAAC,QAAQ,QAAQ,CAAC;AAC7C,SAAO,EAAE,aAAa;AACxB;AAUA,eAAsB,kBAAkB,OAAe,eAA8B;AACnF,QAAM,IAAI,MAAM,KAAK,MAAM;AAAA,IACzB;AAAA,IAAQ;AAAA,IAAS;AAAA,IAAY;AAAA,IAAY;AAAA,EAC3C,CAAC;AACD,MAAI,EAAE,aAAa,GAAG;AACpB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,yBAAyB,EAAE,UAAU,EAAE,MAAM;AAAA,MACtD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAGA,eAAsB,UACpB,OACA,MACA,OAAe,eACE;AACjB,QAAM,IAAI,MAAM,KAAK,MAAM,CAAC,OAAO,UAAU,KAAK,IAAI,IAAI,IAAI,QAAQ,KAAK,CAAC;AAC5E,MAAI,EAAE,aAAa,GAAG;AACpB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,iBAAiB,KAAK,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,MAAM;AAAA,IAClE,CAAC;AAAA,EACH;AACA,QAAM,KAAK,OAAO,EAAE,OAAO,KAAK,CAAC;AACjC,MAAI,CAAC,OAAO,UAAU,EAAE,KAAK,MAAM,GAAG;AACpC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,kCAAkC,EAAE,OAAO,KAAK,CAAC;AAAA,IAC5D,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGO,SAAS,WAAW,MAAc,QAAwB;AAC/D,SAAO,2BAA2B,IAAI,qCAAqC,MAAM;AACnF;AAYA,eAAsB,WAAW,MAMf;AAChB,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,aAAa,KAAK,UAAU,cAAc;AAChD,QAAM,IAAI,MAAM,KAAK,MAAM;AAAA,IACzB;AAAA,IAAQ;AAAA,IAAU,GAAG,KAAK,KAAK,IAAI,KAAK,IAAI;AAAA,IAC5C;AAAA,IAAY;AAAA,IAAY,KAAK;AAAA,IAAQ;AAAA,IAAY;AAAA,IAAU;AAAA,EAC7D,CAAC;AACD,MAAI,EAAE,aAAa,GAAG;AACpB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,mBAAmB,EAAE,UAAU,EAAE,MAAM;AAAA,IAClD,CAAC;AAAA,EACH;AACF;AAaA,eAAsB,oBAAoB,MAStB;AAClB,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,YAAY,KAAK,aAAa,IAAI,KAAK;AAC7C,QAAM,QAAQ,KAAK,IAAI;AACvB,MAAI,UAAU;AACd,aAAS;AACP;AACA,SAAK,SAAS,OAAO;AACrB,QAAI,KAAgC;AACpC,QAAI,KAAK,OAAO;AACd,UAAI;AAAE,aAAK,MAAM,KAAK,MAAM;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC9D,OAAO;AAEL,YAAM,IAAI,MAAM,KAAK,MAAM;AAAA,QACzB;AAAA,QAAO,UAAU,KAAK,KAAK,IAAI,KAAK,IAAI;AAAA,QAAiB;AAAA,QAAQ;AAAA,MACnE,CAAC;AACD,UAAI,EAAE,aAAa,GAAG;AACpB,cAAM,IAAI,EAAE,OAAO,KAAK;AACxB,YAAI,KAAK,MAAM,OAAQ,MAAK;AAAA,MAC9B;AAAA,IACF;AACA,QAAI,GAAI,QAAO;AACf,QAAI,KAAK,IAAI,IAAI,SAAS,WAAW;AACnC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,mBAAmB,YAAY,GAAI,4CAA4C,KAAK,KAAK,IAAI,KAAK,IAAI;AAAA,QAC/G,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAAA,EACpD;AACF;AAeA,eAAsB,qBAAqB,MAIhB;AACzB,QAAM,MAAM,MAAM,MAAM,gCAAgC,KAAK,KAAK,IAAI,KAAK,IAAI,iBAAiB;AAAA,IAC9F,SAAS;AAAA,MACP,eAAe,UAAU,KAAK,GAAG;AAAA,MACjC,QAAQ;AAAA,MACR,wBAAwB;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,MAAI,IAAI,IAAI;AACV,UAAM,IAAK,MAAM,IAAI,KAAK;AAC1B,WAAO,EAAE,OAAO,SAAY,OAAO,EAAE,EAAE,IAAI;AAAA,EAC7C;AACA,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,gBAAgB,KAAK,KAAK,IAAI,KAAK,IAAI;AAAA,EAAkB,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AACvI;AAMA,eAAsB,WAAW,KAAa,OAAe,eAA8B;AACzF,QAAM,MAAM,QAAQ,aAAa,WAAW,SAChC,QAAQ,aAAa,UAAU,UAC/B;AACZ,MAAI;AAAE,UAAM,KAAK,KAAK,CAAC,GAAG,CAAC;AAAA,EAAG,QAAQ;AAAA,EAAoB;AAC5D;;;ACvMAC;AAGA;AACA;AAPA,YAAYC,WAAU;AACtB,YAAYC,SAAQ;;;ACApB;AADA,YAAYC,SAAQ;AAkBb,SAAS,kBACd,aACA,qBACQ;AACR,MAAI;AACJ,MAAI;AACF,UAAS,iBAAa,aAAa,MAAM;AAAA,EAC3C,SAAS,GAAG;AACV,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,gCAAgC,WAAW,MAAO,EAAY,OAAO;AAAA,IAChF,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,IAAI,MAAM,wBAAwB;AAClD,QAAM,OAAO,UAAU,IAAI,MAAM,QAAQ,CAAC,EAAE,MAAM,IAAI;AAGtD,MAAI,WAAW;AACf,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,mBAAmB,GAAG;AAC/D,eAAW,SAAS,WAAW,KAAK,IAAI,MAAM,KAAK;AAAA,EACrD;AAGA,QAAM,WAAW,SAAS,MAAM,2BAA2B;AAC3D,MAAI,YAAY,SAAS,SAAS,GAAG;AACnC,UAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AAC9D,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,YAAY,WAAW,sCAAsC,MAAM,KAAK,IAAI,CAAC;AAAA,MACtF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO,SAAS,QAAQ,QAAQ,EAAE;AACpC;;;ACtDO,IAAM,eAAe;AACrB,IAAM,aAAa;AAI1B,IAAM,gBAAgB;AAGf,SAAS,iBAAiB,cAA8B;AAC7D,QAAM,IAAI,aAAa,QAAQ,YAAY;AAC3C,MAAI,MAAM,IAAI;AACZ,UAAM,IAAI,aAAa,QAAQ,YAAY,CAAC;AAC5C,UAAM,OAAO,aAAa,MAAM,GAAG,CAAC;AACpC,UAAM,OAAO,MAAM,KAAK,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI;AACpE,YAAQ,OAAO,MAAM,QAAQ,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,IAAI,aAAa,YAAY,aAAa;AAChD,MAAI,MAAM,GAAI,QAAO,aAAa,MAAM,GAAG,CAAC,EAAE,QAAQ,QAAQ,EAAE;AAChE,SAAO,aAAa,QAAQ,QAAQ,EAAE;AACxC;AAGO,SAAS,kBAAkB,MAAc,YAA4B;AAC1E,QAAMC,SAAQ,iBAAiB,IAAI;AACnC,SAAO,GAAGA,MAAK;AAAA;AAAA,EAAO,YAAY;AAAA,EAAK,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,EAAK,UAAU;AAAA;AACtF;;;AFdA;AACA;AAGA,IAAM,kBAAkB;AACxB,IAAM,qBAAqB;AAC3B,IAAMC,aAAY;AAClB,IAAM,iBAAiB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,iBAAiB;AAqDvB,eAAsB,UAAU,MAA+C;AAC7E,QAAM,WAAW,KAAK,eAAe,MAAM;AAAA,EAAC;AAC5C,QAAM,iBAAiB,SAAS,KAAK,SAAS;AAE9C,MAAI,CAAC,KAAK,gBAAgB;AACxB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,WAAS,wCAAmC;AAC5C,QAAM,UAAU,MAAM,gBAAgB;AAAA,IACpC,YAAY,KAAK;AAAA,IACjB,iBAAiB,KAAK;AAAA,IACtB,WAAW,KAAK;AAAA,EAClB,CAAC;AAID,MAAI,QAAQ,WAAW,SAAS,UAAU;AACxC,QAAI,CAAC,KAAK,WAAW,CAAC,KAAK,gBAAgB;AACzC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,aAAS,8DAAoD;AAC7D,UAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,UAAM,MAAM,MAAMA,mBAAkB;AAAA,MAClC,YAAY,KAAK;AAAA,MACjB,gBAAgB,KAAK;AAAA,MACrB,SAAS,KAAK;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK;AAAA,MACrB,iBAAiB,KAAK;AAAA,MACtB,mBAAmB,KAAK;AAAA,MACxB,YAAY,KAAK;AAAA,IACnB,CAAC;AACD,WAAO;AAAA,MACL,gBAAgB,KAAK;AAAA,MACrB,gBAAgB;AAAA,MAChB,gBAAgB,IAAI;AAAA,MACpB,eAAe,IAAI;AAAA,IACrB;AAAA,EACF;AAGA,QAAM,cAAc,mBAAmB,QAAQ,UAAU,KAAK;AAC9D,QAAM,gBAAgB,CAAC,EACrB,KAAK,gBACL,eACA,YAAY,SAAS,KAAK,QAC1B,YAAY,mBAAmB,KAAK,kBACpC,YAAY,kBAAkB;AAGhC,WAAS,6DAAwD;AACjE,QAAM,uBAAuB;AAAA,IAC3B,YAAY,KAAK;AAAA,IACjB,cAAc,KAAK;AAAA,IACnB;AAAA,EACF,CAAC;AACD,QAAM,WAAW,MAAM,qBAAqB;AAAA,IAC1C,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK;AAAA,IACZ,cAAc,KAAK;AAAA,IACnB;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,WAAS,0BAA0B,SAAS,UAAU,YAAY,CAAC,GAAG;AAEtE,MAAI;AAEJ,MAAI,CAAC,eAAe;AAClB,UAAM,aAAkB,WAAK,KAAK,UAAU,iCAAiC;AAC7E,UAAM,iBAAoB,iBAAa,YAAY,MAAM;AACzD,UAAM,SAAS,eAAe,WAAW,kBAAkB,KAAK,IAAI;AAEpE,UAAM,OAAO,cAAc,KAAK,WAAW,KAAK,IAAI;AACpD,UAAM,cAAc,KAAK,uBAAuB,MAAM;AAEtD,QAAI;AACJ,QAAI,aAAa;AACf,eAAS,mDAA8C;AACvD,YAAM,WAAW,YAAY,WAAW,GAAG,IAAI,cAAmB,WAAK,KAAK,UAAU,WAAW;AACjG,aAAO,kBAAkB,UAAU,MAAM,uBAAuB,CAAC,CAAC;AAAA,IACpE,OAAO;AAGL,eAAS,8EAAoE;AAC7E,aAAO,QAAQ,WAAW,gBAAgB;AAAA,IAC5C;AACA,UAAM,yBAAyB,kBAAkB,MAAM,MAAM;AAE7D,UAAM,OAAkB;AAAA,MACtB,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,UAAU;AAAA,MACV,eAAe;AAAA,MACf,eAAe;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB;AAEA,aAAS,6CAAwC;AACjD,qBAAiB,MAAM,0BAA0B;AAAA,MAC/C,YAAY,KAAK;AAAA,MACjB,iBAAiB,KAAK;AAAA,MACtB,WAAW,KAAK;AAAA,MAChB,mBAAmB,QAAQ;AAAA,MAC3B,iBAAiB,QAAQ,YAAY,CAAC;AAAA,MACtC;AAAA,MACA;AAAA,MACA,eAAe,mBAAmB,IAAI;AAAA,IACxC,CAAC;AAED,aAAS,+CAA0C;AACnD,UAAM,gBAAgB;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,OAAO,KAAK;AAAA,MACZ,gBAAgB,KAAK;AAAA,MACrB,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,SAAS,MAAM,iBACX,GAAG,QAAQ,UAAU,WAAW,KAAK,SAAS,IAAI,KAAK,cAAc,KACrE,QAAQ,UAAU,WAAW,KAAK;AAAA,MACtC,OAAO,KAAK;AAAA,IACd,CAAC;AAED,aAAS,sDAAiD;AAC1D,UAAM,aAAyB;AAAA,MAC7B,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK;AAAA,MACrB,eAAe;AAAA,MACf,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC;AACA,QAAI,MAAM;AACR,qBAAe,KAAK,WAAW,EAAE,OAAO,WAAW,GAAG,KAAK,IAAI;AAAA,IACjE,OAAO;AAEL;AAAA,QACE,KAAK;AAAA,QACL;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,SAAS;AAAA,UACT,iBAAiB,KAAK;AAAA;AAAA,UAEtB,OAAO,OAAO,QAAQ,WAAW,UAAU,WAAW,QAAQ,WAAW,QAAQ;AAAA,UACjF,gBAAgB,QAAQ,UAAU,kBAAkB;AAAA,UACpD,aAAa;AAAA,UACb,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,UACnC,eAAe;AAAA,UACf,cAAc,EAAE,SAAS,EAAE,iBAAiB,KAAK,gBAAgB,EAAE;AAAA,UACnE,OAAO;AAAA,QACT;AAAA,QACA,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAIA,SAAS,mBAAmB,KAAgD;AAC1E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AAAE,WAAO,KAAK,MAAM,GAAG;AAAA,EAAgB,QAAQ;AAAE,WAAO;AAAA,EAAW;AACzE;AAEA,eAAe,uBAAuB,MAIpB;AAChB,QAAM,WAAW,MAAM,KAAK,WAAW,SAASD,UAAS;AACzD,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,cAAc,EAAE,MAAM,YAAY,SAAS,8BAA8B,CAAC;AAAA,EACtF;AACA,QAAM,MAAM,+BAA+B,KAAK,YAAY,gBAAgB,KAAK,cAAc,gBAAgB,eAAe;AAE9H,QAAM,SAAS,MAAM,MAAM,KAAK,EAAE,SAAS,EAAE,eAAe,UAAU,SAAS,KAAK,GAAG,EAAE,CAAC;AAC1F,MAAI,OAAO,GAAI;AACf,MAAI,OAAO,WAAW,KAAK;AACzB,UAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,OAAO,GAAG,UAAU,OAAO,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IACnE,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,KAAK,UAAU;AAAA,IAC1B,YAAY;AAAA,MACV,UAAU;AAAA,MAAc,UAAU;AAAA,MAClC,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,aAAa,EAAE,MAAM,EAAE,eAAe,qCAAqC,EAAE;AAAA,MAC7E,UAAU,EAAE,WAAW,gBAAgB;AAAA,IACzC;AAAA,EACF,CAAC;AACD,QAAM,SAAS,MAAM,MAAM,KAAK;AAAA,IAC9B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,SAAS,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IACzF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,OAAO,GAAG,UAAU,OAAO,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IACnE,CAAC;AAAA,EACH;AACF;AAEA,eAAe,0BAA0B,MASrB;AAClB,QAAM,WAAW,MAAM,KAAK,WAAW,SAAS,kBAAkB;AAClE,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,cAAc,EAAE,MAAM,gBAAgB,SAAS,6CAA6C,CAAC;AAAA,EACzG;AAEA,QAAM,cAAc,KAAK,kBAAkB,SAAS,CAAC,GAAG;AAAA,IACtD,CAAC,MAAM,EAAE,EAAE,SAAS,SAAU,EAAgC,iBAAiB;AAAA,EACjF;AACA,QAAM,YAAY;AAAA,IAChB,MAAM;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,eAAe;AAAA,IACf,kBAAkB;AAAA,IAClB,uBAAuB,KAAK;AAAA,EAC9B;AACA,QAAM,aAA8B;AAAA,IAClC,GAAG,KAAK;AAAA,IACR,cAAc,KAAK;AAAA,IACnB,OAAO,CAAC,GAAG,YAAY,SAAS;AAAA,EAClC;AACA,QAAM,WAAmC;AAAA,IACvC,GAAG,KAAK;AAAA,IACR,OAAO,KAAK;AAAA,EACd;AACA,QAAM,MAAM,GAAG,KAAK,eAAe,WAAW,KAAK,SAAS;AAC5D,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,SAAS,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IACzF,MAAM,KAAK,UAAU,EAAE,YAAY,SAAS,CAAC;AAAA,EAC/C,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,QAAQ,GAAG,UAAU,IAAI,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IACjE,CAAC;AAAA,EACH;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,SAAS;AACjB,UAAM,IAAI,cAAc,EAAE,MAAM,mCAAmC,SAAS,oCAAoC,CAAC;AAAA,EACnH;AACA,SAAO,KAAK;AACd;;;AGjWA;AAFA,YAAYE,SAAQ;AACpB,YAAYC,WAAU;AAcf,SAAS,YAAY,MAAsB;AAChD,QAAM,MAAW,WAAK,gBAAgB,GAAG,eAAe,IAAI;AAC5D,MAAI,CAAI,eAAW,GAAG,GAAG;AACvB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,WAAW,IAAI,qBAAqB,IAAI;AAAA,MACjD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAQO,SAAS,qBAAqB,MAI5B;AACP,EAAG,WAAO,KAAK,aAAa,KAAK,SAAS,EAAE,WAAW,KAAK,CAAC;AAC7D,MAAI,KAAK,SAAS;AAChB,IAAG,WAAO,KAAK,SAAS,KAAK,SAAS,EAAE,WAAW,KAAK,CAAC;AAAA,EAC3D;AACF;;;APrBA,SAAS,eAAe,KAAmB;AACzC,QAAM,QAAkD;AAAA,IACtD,EAAE,MAAM,CAAC,QAAQ,MAAM,MAAM,GAAG,OAAO,WAAW;AAAA,IAClD,EAAE,MAAM,CAAC,OAAO,GAAG,GAAG,OAAO,UAAU;AAAA,IACvC,EAAE,MAAM,CAAC,UAAU,MAAM,oCAAoC,GAAG,OAAO,aAAa;AAAA,EACtF;AACA,aAAW,EAAE,MAAM,MAAM,KAAK,OAAO;AACnC,UAAM,IAAI,UAAU,OAAO,MAAM,EAAE,KAAK,KAAK,UAAU,OAAO,CAAC;AAC/D,QAAI,EAAE,WAAW,GAAG;AAClB,YAAM,UAAU,EAAE,UAAU,IAAI,KAAK,MAAM,EAAE,UAAU,IAAI,KAAK,KAAK,QAAQ,EAAE,UAAU,QAAQ;AACjG,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,GAAG,KAAK,cAAc,GAAG,KAAK,MAAM;AAAA,MAC/C,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,OAAO,QAAQ,CAAC,CAAC,SAAS,QAAQ,CAAC;AAAA,EACnC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,+BAA+B,uCAAuC;AAAA,MACvE,CAAC,wBAAwB,6EAA6E;AAAA,MACtG,CAAC,8CAA8C,qDAAqD;AAAA,IACtG;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,WAAWA,SAAO,OAAO,aAAa;AAAA,EACtC,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,UAAUA,SAAO,QAAQ,YAAY,KAAK;AAAA,EAC1C,QAAQA,SAAO,OAAO,UAAU;AAAA,EAChC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,OAAOA,SAAO,OAAO,QAAQ;AAAA,EAE7B,MAAM,iBAAkC;AAEtC,UAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAC5D,UAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,UAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACJ,SAAS,GAAG,MAAM,WAAW;AAClC,UAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,WAAc;AAE9E,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,oDAAoD,CAAC;AAAA,IACzG;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,2CAA2C,CAAC;AAAA,IAChG;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,gCAAgC,CAAC;AAAA,IACrF;AAIA,UAAM,WAAW,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAC7D,UAAM,UAAU,WAAW,YAAY,QAAQ,IAAI;AAEnD,UAAM,MAAO,KAAK,QAAQ,OAAO,QAAQ;AACzC,UAAM,QAAQ,cAAc,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,MAAS;AAKxF,UAAM,aACJ,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAC/D,KAAK,SACN;AACN,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AACpF,UAAM,WAAW,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAExG,UAAMC,cAAa,IAAIC,wBAAuB;AAG9C,QAAI,CAAE,MAAM,WAAW,GAAI;AACzB,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC;AAAA,CAA4E;AAC7H,YAAM,kBAAkB;AAAA,IAC1B;AAGA,UAAM,SAAS,MAAM,eAAe,EAAE,YAAAD,aAAY,MAAM,CAAC;AACzD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAGA,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBACH,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAC7D,QAAQ;AACV,UAAM,gBAAgB,cAAc,MAAM,GAAG;AAC7C,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAA;AAAA,MACA;AAAA,MACA,aAAc,KAAK,QAAQ,OAA8B,UAAU;AAAA,MACnE,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,MAC9D;AAAA,IACF,CAAC;AAGD,UAAM,WAAW,gBAAgB;AACjC,UAAM,cAAmB,WAAK,UAAU,gBAAgB;AACxD,QAAI,CAAI,eAAW,WAAW,GAAG;AAC/B,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,8BAA8B,WAAW;AAAA,QAClD,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,UAAM,SAAY,gBAAiB,WAAQ,WAAO,GAAG,oBAAoB,MAAM,GAAG,CAAC;AACnF,QAAI;AACJ,QAAI,iBAAgC;AACpC,QAAI;AACF,2BAAqB,EAAE,aAAa,SAAS,QAAQ,QAAQ,CAAC;AAC9D,WAAK,QAAQ,OAAO;AAAA,QAClB,WACI,GAAG,OAAO,IAAI,QAAG,CAAC,2CAA2C,OAAO,MAAM,QAAQ,CAAC,OAAO,MAAM;AAAA,IAChG,GAAG,OAAO,IAAI,QAAG,CAAC,8BAA8B,MAAM;AAAA;AAAA,MAC5D;AAGA,qBAAe,MAAM;AAGrB,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,IAAI,QAAG,CAAC,kBAAkB,KAAK,IAAI,QAAQ,KAAK,KAAK,UAAU,WAAW,SAAS;AAAA,CAAM;AAC7H,YAAM,WAAW,EAAE,OAAO,MAAM,UAAU,SAAS,CAAC,KAAK,SAAS,QAAQ,OAAO,CAAC;AAClF,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,QAAG,CAAC;AAAA,CAAiB;AAGjE,YAAM,SAAS,MAAM,UAAU,OAAO,QAAQ;AAC9C,YAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM,eAAe,EAAE,YAAAA,aAAY,MAAM,CAAC;AAEjF,YAAM,aAAa,WAAW,EAAE,OAAO,cAAc,CAAC;AAGtD,uBAAiB,MAAM,qBAAqB,EAAE,OAAO,MAAM,UAAU,KAAK,WAAW,CAAC;AACtF,UAAI,gBAAgB;AAClB,aAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,QAAG,CAAC,6BAA6B,OAAO,MAAM,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC,kBAAkB,cAAc;AAAA,CAA6B;AAAA,MAClL,OAAO;AACL,cAAM,MAAM,WAAW,MAAM,MAAM;AACnC,aAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,MAAM,QAAG,CAAC,iCAAiC,KAAK,IAAI,QAAQ;AAAA,IAAQ,GAAG;AAAA,CAAI;AAC/G,cAAM,WAAW,GAAG;AACpB,aAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,mDAA8C,CAAC;AAAA,CAAI;AAC7F,yBAAiB,MAAM,oBAAoB;AAAA,UACzC;AAAA,UAAO,MAAM;AAAA;AAAA;AAAA,UAGb,OAAO,MAAM,qBAAqB,EAAE,OAAO,MAAM,UAAU,KAAK,WAAW,EAAE,OAAO,cAAc,CAAC,EAAE,CAAC;AAAA,UACtG,QAAQ,CAAC,MAAM;AAAE,gBAAI,IAAI,MAAM,EAAG,MAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,wBAAmB,IAAI,CAAC,IAAI,CAAC;AAAA,CAAI;AAAA,UAAG;AAAA,QAClH,CAAC;AACD,aAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,QAAG,CAAC,+BAA+B,cAAc;AAAA,CAAK;AAAA,MACtG;AAGA,eAAS,MAAM,UAAU;AAAA,QACvB,YAAAA;AAAA,QAAY;AAAA,QACZ,iBAAiB,QAAQ;AAAA,QACzB,cAAc,GAAG,QAAQ,YAAY,aAAa,QAAQ,WAAW;AAAA,QACrE,WAAW;AAAA,QACX,MAAM,GAAG,KAAK,IAAI,QAAQ;AAAA,QAAI;AAAA,QAC9B;AAAA,QAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AAAA,IACH,UAAE;AACA,MAAG,WAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACpD;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO;AAAA,QAClB,WAAW;AAAA,UACT;AAAA,UAAQ,MAAM,GAAG,KAAK,IAAI,QAAQ;AAAA,UAAI;AAAA,UACtC;AAAA,UAAgB,gBAAgB,OAAO;AAAA,UACvC,gBAAgB,OAAO;AAAA,QACzB,CAAC,IAAI;AAAA,MACP;AACA,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,qBAAqB,OAAO,MAAM,MAAM,CAAC,WAAM,OAAO,MAAM,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC,mBAAmB,OAAO,cAAc;AAAA;AAAA,IACnJ;AACA,SAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,aAAa,CAAC,uBAAuB,KAAK,IAAI,QAAQ;AAAA,CAAI;AACrG,SAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,QAAQ,CAAC;AAAA,CAAqE;AACzH,WAAO;AAAA,EACT;AACF;;;AQzNAE;AAFA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,+BAA8B;AAGvC;;;ACHAC;AAaA,eAAsB,uBAAuB,MAczB;AAElB,QAAM,MAAM,WAAW,EAAE,OAAO,KAAK,OAAO,eAAe,KAAK,cAAc,CAAC;AAC/E,QAAM,WAAW,MAAM,qBAAqB,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,IAAI,CAAC;AACvF,MAAI,UAAU;AACZ,SAAK,qBAAqB,QAAQ;AAClC,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,MAAM,UAAU,KAAK,OAAO,KAAK,IAAI;AACpD,QAAM,MAAM,WAAW,KAAK,MAAM,MAAM;AACxC,OAAK,MAAM,gCAAgC,KAAK,KAAK,IAAI,KAAK,IAAI;AAAA,IAAQ,GAAG;AAAA,CAAI;AACjF,MAAI,KAAK,gBAAgB,MAAO,OAAM,WAAW,GAAG;AAEpD,SAAO,oBAAoB;AAAA,IACzB,OAAO,KAAK;AAAA,IACZ,MAAM,KAAK;AAAA;AAAA,IAEX,OAAO,MACL,qBAAqB;AAAA,MACnB,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,KAAK,WAAW,EAAE,OAAO,KAAK,OAAO,eAAe,KAAK,cAAc,CAAC;AAAA,IAC1E,CAAC;AAAA,IACH,QAAQ,KAAK;AAAA,EACf,CAAC;AACH;;;ADxCO,IAAM,mBAAN,cAA+B,WAAW;AAAA,EAC/C,OAAO,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC;AAAA,EACjC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,mCAAmC,8CAA8C;AAAA,IACpF;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,OAAOA,SAAO,OAAO,QAAQ;AAAA,EAC7B,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,QAAQA,SAAO,OAAO,UAAU;AAAA,EAChC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,kBAAkBA,SAAO,OAAO,oBAAoB;AAAA,EACpD,cAAcA,SAAO,OAAO,WAAW;AAAA,EACvC,oBAAoBA,SAAO,QAAQ,yBAAyB,KAAK;AAAA,EAEjE,MAAM,iBAAkC;AACtC,UAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACzD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,kCAAkC,CAAC;AAChG,QAAI,CAAC,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,mCAAmC,IAAI,IAAI,CAAC;AACvH,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,MAAO,KAAK,QAAQ,OAAO,QAAQ;AACzC,UAAM,QAAQ,cAAc,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,MAAS;AAKxF,UAAM,aACJ,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAC/D,KAAK,SACN;AACN,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AACpF,UAAM,WAAW,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAExG,UAAMC,cAAa,IAAIC,wBAAuB;AAG9C,QAAI,CAAE,MAAM,WAAW,GAAI;AACzB,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC;AAAA,CAA4E;AAC7H,YAAM,kBAAkB;AAAA,IAC1B;AAGA,UAAM,SAAS,MAAM,eAAe,EAAE,YAAAD,aAAY,MAAM,CAAC;AACzD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAGA,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBACH,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAC7D,QAAQ;AACV,UAAM,gBACJ,OAAO,KAAK,WAAW,WAAW,cAAc,KAAK,MAAM,GAAG,kBAAkB;AAClF,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAA;AAAA,MACA;AAAA,MACA,aAAc,KAAK,QAAQ,OAA8B,UAAU;AAAA,MACnE,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AAGD,UAAM,CAAC,OAAO,QAAQ,IAAI,KAAK,MAAM,GAAG;AACxC,UAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM,eAAe,EAAE,YAAAA,aAAY,MAAM,CAAC;AAGjF,QAAI,mBAAmB;AACvB,UAAM,iBAAiB,MAAM,uBAAuB;AAAA,MAClD;AAAA,MAAO,MAAM;AAAA,MAAU;AAAA,MAAM;AAAA,MAAO;AAAA,MACpC,OAAO,CAAC,MAAM;AACZ,aAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,MAAM,QAAG,CAAC,IAAI,CAAC,EAAE;AACrD,aAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,mDAA8C,CAAC;AAAA,CAAI;AAAA,MAC/F;AAAA,MACA,oBAAoB,CAAC,OAAO;AAC1B,2BAAmB;AACnB,aAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,QAAG,CAAC,6BAA6B,OAAO,MAAM,IAAI,CAAC,kBAAkB,EAAE;AAAA,CAA6B;AAAA,MACpJ;AAAA,MACA,QAAQ,CAAC,MAAM;AAAE,YAAI,IAAI,MAAM,EAAG,MAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,wBAAmB,IAAI,CAAC,IAAI,CAAC;AAAA,CAAI;AAAA,MAAG;AAAA,IAClH,CAAC;AACD,QAAI,CAAC,kBAAkB;AACrB,WAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,QAAG,CAAC,+BAA+B,cAAc;AAAA,CAAK;AAAA,IACtG;AAGA,UAAM,SAAS,MAAM,UAAU;AAAA,MAC7B,YAAAA;AAAA,MAAY;AAAA,MACZ,iBAAiB,QAAQ;AAAA,MACzB,cAAc,GAAG,QAAQ,YAAY,aAAa,QAAQ,WAAW;AAAA,MACrE,WAAW,KAAK;AAAA,MAChB;AAAA,MAAM;AAAA,MACN,UAAU,gBAAgB;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA,iBAAiB,OAAO,KAAK,oBAAoB,WAAW,KAAK,kBAAkB;AAAA,MACnF,qBAAqB,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,MAC/E,mBAAmB,KAAK,sBAAsB;AAAA,IAChD,CAAC;AAED,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW;AAAA,QACnC,QAAQ,KAAK;AAAA,QAAQ;AAAA,QAAM;AAAA,QAC3B,gBAAgB,OAAO;AAAA,QACvB,gBAAgB,OAAO;AAAA,QACvB,gBAAgB,OAAO;AAAA,QACvB,eAAe,OAAO;AAAA,MACxB,CAAC,IAAI,IAAI;AACT,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,eAAe;AACxB,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,QAAG,CAAC,IAAI,OAAO,MAAM,KAAK,MAAO,CAAC,sBAAsB,OAAO,MAAM,IAAI,CAAC;AAAA,CAA4B;AAAA,IACpJ,OAAO;AACL,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,QAAG,CAAC,WAAW,OAAO,MAAM,KAAK,MAAO,CAAC,WAAM,OAAO,MAAM,IAAI,CAAC,0BAA0B,cAAc,mBAAmB,OAAO,cAAc;AAAA,CAAM;AACnM,WAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,iBAAiB,CAAC,uBAAuB,IAAI,SAAS,MAAM;AAAA,CAAc;AACrH,WAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,QAAQ,CAAC;AAAA,CAAqE;AAAA,IAC3H;AACA,WAAO;AAAA,EACT;AACF;;;AEnJA,SAAS,WAAAE,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,+BAA8B;;;ACDvC,SAAS,mBAAAC,wBAAuB;AAuBhC,eAAsB,cAAc,MAGL;AAC7B,QAAM,UAAU,IAAIA,iBAAgB,KAAK,iBAAiB,KAAK,UAAU;AAGzE,QAAM,OAAQ,QAEX,OAAO,KAAK;AACf,QAAM,SAA4B,CAAC;AACnC,mBAAiB,OAAO,MAAM;AAC5B,QAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAI;AAC1B,UAAM,OAAO,OAAO,IAAI,QAAQ,IAAI,EAAE;AACtC,UAAM,KAAK,IAAI,YAAY,IAAI,UAAU,QAAQ,YAAY,CAAC;AAC9D,QAAI,GAAG,WAAW,iBAAiB;AACjC,aAAO,KAAK,EAAE,MAAM,UAAU,GAAG,CAAC;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;;;ADpCA;AAEO,IAAM,mBAAN,cAA+B,WAAW;AAAA,EAC/C,OAAO,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC;AAAA,EACjC,OAAO,QAAQC,UAAQ,MAAM,EAAE,aAAa,4CAA4C,CAAC;AAAA,EAEzF,eAAeC,SAAO,OAAO,gBAAgB;AAAA,EAC7C,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AAItC,UAAM,aACJ,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAC/D,KAAK,SACN;AACN,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AAEpF,UAAMC,cAAa,IAAIC,wBAAuB;AAG9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBACH,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAC7D,QAAQ;AAEV,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MACA;AAAA,MACA,aAAc,KAAK,QAAQ,OAA8B,UAAU;AAAA,MACnE,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAChE,CAAC;AAED,UAAM,MAAM,MAAM,cAAc,EAAE,YAAAA,aAAY,iBAAiB,QAAQ,SAAS,CAAC;AACjF,UAAM,eAAe,IAClB,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,eAAe,EAAE,QAAQ,EAAE,EAAE,EACxD,OAAO,CAAC,MAAM,EAAE,KAAK;AAExB,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,YAAY,IAAI,IAAI;AACzD,aAAO;AAAA,IACT;AAEA,QAAI,aAAa,WAAW,GAAG;AAC7B,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,IAAI,2BAA2B,CAAC;AAAA,CAAI;AACxE,aAAO;AAAA,IACT;AAEA,eAAW,KAAK,cAAc;AAC5B,YAAM,WAAW,EAAE,MAAO,iBAAiB,QAAQ;AACnD,WAAK,QAAQ,OAAO;AAAA,QAClB,KAAK,OAAO,MAAM,EAAE,IAAI,CAAC,aAAQ,OAAO,MAAM,EAAE,MAAO,IAAI,CAAC,KAAK,OAAO,IAAI,IAAI,QAAQ,UAAU,EAAE,MAAO,aAAa,GAAG,CAAC;AAAA;AAAA,MAC9H;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AEjEA,SAAS,WAAAE,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,+BAA8B;AAEvC;AAIA;AAEA;AAEO,IAAM,mBAAN,cAA+B,WAAW;AAAA,EAC/C,OAAO,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC;AAAA,EACjC,OAAO,QAAQC,UAAQ,MAAM,EAAE,aAAa,uDAAuD,CAAC;AAAA,EAEpG,SAASC,SAAO,OAAO;AAAA,EACvB,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AAEtC,UAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,2CAA2C,CAAC;AAAA,IAChG;AAKA,UAAM,aACJ,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAC/D,KAAK,SACN;AACN,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AAEpF,UAAMC,cAAa,IAAIC,wBAAuB;AAG9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBACH,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAC7D,QAAQ;AAEV,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MACA;AAAA,MACA,aAAc,KAAK,QAAQ,OAA8B,UAAU;AAAA,MACnE,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAChE,CAAC;AAED,UAAM,QAAQ,MAAM,gBAAgB;AAAA,MAClC,YAAAA;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,WAAW;AAAA,IACb,CAAC;AAED,UAAM,OAAO,eAAe,MAAM,QAA8C;AAChF,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,IAAI,MAAM;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,cAAc,MAAM;AACjC,UAAM,OAAO;AAAA,MACX;AAAA,MACA,MAAM,UAAU,IAAI,IAAI,QAAQ;AAAA,MAChC;AAAA,MACA,WAAW,MAAM,SAAS;AAAA,IAC5B;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,IAAI,IAAI,IAAI;AACjD,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,MAAM,MAAM,CAAC,KAAK,KAAK,IAAI;AAAA,CAAU;AACzE,SAAK,QAAQ,OAAO,MAAM,WAAW,KAAK,IAAI,KAAK,KAAK,MAAM;AAAA,CAAK;AACnE,SAAK,QAAQ,OAAO,MAAM,iBAAiB,KAAK,aAAa;AAAA,CAAI;AACjE,QAAI,KAAK,gBAAgB;AACvB,WAAK,QAAQ,OAAO,MAAM,mBAAmB,KAAK,cAAc;AAAA,CAAI;AAAA,IACtE;AACA,QAAI,MAAM,OAAO;AACf,WAAK,QAAQ,OAAO,MAAM,gBAAgB,KAAK,MAAM,QAAQ;AAAA,CAAI;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACF;;;ACzFA,SAAS,WAAAE,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,+BAA8B;AAEvC;;;ACCAC;AACA;AALA,YAAYC,SAAQ;AACpB,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AAOtB;AAEA,IAAMC,mBAAkB;AACxB,IAAMC,sBAAqB;AAC3B,IAAMC,aAAY;AAClB,IAAM,iBAAiB;AAmCvB,eAAsB,YAAY,MAAmD;AACnF,QAAM,WAAW,KAAK,eAAe,MAAM;AAAA,EAAC;AAE5C,WAAS,wCAAmC;AAC5C,QAAM,UAAU,MAAM,gBAAgB;AAAA,IACpC,YAAY,KAAK;AAAA,IACjB,iBAAiB,KAAK;AAAA,IACtB,WAAW,KAAK;AAAA,EAClB,CAAC;AAED,QAAM,gBAAgB,eAAe,QAAQ,UAAU,KAAK;AAC5D,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,UAAU,KAAK,SAAS;AAAA,MACjC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,EAAE,gBAAgB,cAAc,IAAI;AAC1C,QAAM,iBAAiB;AAEvB,WAAS,wDAAmD;AAC5D,QAAM,OAAO,cAAc,KAAK,WAAW,KAAK,IAAI;AACpD,MAAI;AACJ,MAAI,MAAM,aAAa;AACrB,QAAI,cAAc,KAAK;AACvB,QAAI,CAAC,YAAY,WAAW,GAAG,GAAG;AAChC,YAAM,SAAc,WAAK,KAAK,QAAW,YAAQ,GAAG,cAAc,WAAW;AAC7E,UAAI,CAAI,eAAW,MAAM,GAAG;AAC1B,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,gBAAgB,WAAW;AAAA,UACpC,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,oBAAmB,WAAQ,iBAAa,QAAQ,MAAM,EAAE,KAAK,GAAG,WAAW;AAAA,IAC7E;AACA,2BAAuB,kBAAkB,aAAa,KAAK,uBAAuB,CAAC,CAAC;AAAA,EACtF,OAAO;AAIL,aAAS,kFAAwE;AACjF,2BAAuB,iBAAiB,QAAQ,WAAW,gBAAgB,EAAE;AAAA,EAC/E;AAEA,WAAS,8CAAyC;AAClD,QAAM,iBAAiB,MAAM,2BAA2B;AAAA,IACtD,YAAY,KAAK;AAAA,IACjB,iBAAiB,KAAK;AAAA,IACtB,WAAW,KAAK;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,iBAAiB,QAAQ,YAAY,CAAC;AAAA,IACtC;AAAA,EACF,CAAC;AAED,WAAS,mCAA8B;AACvC,QAAM,oBAAoB,MAAM,iBAAiB;AAAA,IAC/C,YAAY,KAAK;AAAA,IACjB,cAAc,KAAK;AAAA,IACnB;AAAA,EACF,CAAC;AAED,MAAI,iBAAiB;AACrB,MAAI,CAAC,KAAK,gBAAgB;AACxB,aAAS,wCAAwC,cAAc,QAAG;AAClE,qBAAiB,MAAM,aAAa;AAAA,MAClC,YAAY,KAAK;AAAA,MACjB,OAAO,KAAK;AAAA,MACZ;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,MAAM;AACR,aAAS,gDAA2C;AACpD,mBAAe,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG,KAAK,IAAI;AAAA,EAC3D;AAEA,SAAO,EAAE,gBAAgB,mBAAmB,eAAe;AAC7D;AAUA,SAAS,eAAe,KAAgD;AACtE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QACE,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,kBAAkB,UAChC;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BAA2B,MAOtB;AAClB,QAAM,WAAW,MAAM,KAAK,WAAW,SAASD,mBAAkB;AAClE,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,cAAc,EAAE,MAAM,gBAAgB,SAAS,6CAA6C,CAAC;AAAA,EACzG;AAEA,QAAM,cAAc,KAAK,kBAAkB,SAAS,CAAC,GAAG;AAAA,IACtD,CAAC,MAAM,EAAE,EAAE,SAAS,SAAU,EAAgC,iBAAiB;AAAA,EACjF;AACA,QAAM,aAA8B;AAAA,IAClC,GAAG,KAAK;AAAA,IACR,cAAc,KAAK;AAAA,IACnB,OAAO;AAAA,EACT;AAGA,QAAM,WAAmC;AAAA,IACvC,GAAG,KAAK;AAAA,IACR,OAAO;AAAA,EACT;AACA,QAAM,MAAM,GAAG,KAAK,eAAe,WAAW,KAAK,SAAS;AAC5D,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,SAAS,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IACzF,MAAM,KAAK,UAAU,EAAE,YAAY,SAAS,CAAC;AAAA,EAC/C,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,QAAQ,GAAG,UAAU,IAAI,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IACjE,CAAC;AAAA,EACH;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,SAAS;AACjB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,KAAK;AACd;AAEA,eAAe,iBAAiB,MAIX;AACnB,QAAM,WAAW,MAAM,KAAK,WAAW,SAASC,UAAS;AACzD,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,cAAc,EAAE,MAAM,YAAY,SAAS,8BAA8B,CAAC;AAAA,EACtF;AACA,QAAM,MAAM,+BAA+B,KAAK,YAAY,gBAAgB,KAAK,cAAc,gBAAgBF,gBAAe;AAC9H,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,SAAS,KAAK,GAAG;AAAA,EACvD,CAAC;AAED,MAAI,IAAI,MAAM,IAAI,WAAW,IAAK,QAAO;AACzC,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAM,IAAI,cAAc;AAAA,IACtB,MAAM;AAAA,IACN,SAAS,UAAU,GAAG,UAAU,IAAI,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,EACnE,CAAC;AACH;AAEA,eAAe,aAAa,MAIP;AACnB,QAAM,UAAU,MAAM,eAAe,EAAE,YAAY,KAAK,YAAY,OAAO,KAAK,MAAM,CAAC;AACvF,QAAM,MAAM,WAAW,EAAE,OAAO,QAAQ,OAAO,eAAe,QAAQ,cAAc,CAAC;AACrF,QAAM,MAAM,GAAG,cAAc,sBAAsB,KAAK,cAAc;AACtE,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,GAAG;AAAA,MAC5B,QAAQ;AAAA,MACR,wBAAwB;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,MAAI,IAAI,MAAM,IAAI,WAAW,IAAK,QAAO;AACzC,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAM,IAAI,cAAc;AAAA,IACtB,MAAM;AAAA,IACN,SAAS,UAAU,GAAG,UAAU,IAAI,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,EACnE,CAAC;AACH;;;ADhPO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,OAAO,QAAQ,CAAC,CAAC,SAAS,QAAQ,CAAC;AAAA,EACnC,OAAO,QAAQG,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,gCAAgC,2BAA2B;AAAA,MAC5D,CAAC,mCAAmC,8CAA8C;AAAA,IACpF;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,MAAMA,SAAO,QAAQ,SAAS,KAAK;AAAA,EACnC,iBAAiBA,SAAO,QAAQ,sBAAsB,KAAK;AAAA,EAC3D,QAAQA,SAAO,OAAO,UAAU;AAAA,EAChC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AAEtC,UAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,2CAA2C,CAAC;AAAA,IAChG;AAEA,UAAM,MAAO,KAAK,QAAQ,OAAO,QAAQ;AACzC,UAAM,QAAQ,cAAc,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,MAAS;AAKxF,UAAM,aACJ,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAC/D,KAAK,SACN;AACN,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AACpF,UAAM,WAAW,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAKxG,UAAM,MAAM,KAAK,QAAQ;AACzB,UAAM,iBAAiB,KAAK,mBAAmB;AAG/C,UAAM,OAAO,cAAc,MAAM;AACjC,QAAI,CAAC,MAAM,OAAO;AAChB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,UAAU,MAAM;AAAA,QACzB,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,UAAM,EAAE,KAAK,IAAI,KAAK;AAGtB,UAAM,QAAS,KAAK,QAAQ,OAA8B,UAAU;AACpE,QAAI,CAAC,KAAK;AACR,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,uBAAuB,MAAM,WAAW,IAAI;AAAA,UACrD,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAEA,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAMC,cAAa,IAAIC,wBAAuB;AAG9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBACH,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAC7D,QAAQ;AACV,UAAM,gBAAgB,KAAK;AAC3B,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MACA;AAAA,MACA,aAAc,KAAK,QAAQ,OAA8B,UAAU;AAAA,MACnE,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,MAC9D;AAAA,IACF,CAAC;AAED,UAAM,SAAS,MAAM,YAAY;AAAA,MAC/B,YAAAA;AAAA,MACA;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,cAAc,GAAG,QAAQ,YAAY,aAAa,QAAQ,WAAW;AAAA,MACrE,WAAW;AAAA,MACX;AAAA,MACA,YAAY;AAAA,IACd,CAAC;AAED,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO;AAAA,QAClB,WAAW;AAAA,UACT;AAAA,UACA;AAAA,UACA,gBAAgB,OAAO;AAAA,UACvB,mBAAmB,OAAO;AAAA,UAC1B,gBAAgB,OAAO;AAAA,QACzB,CAAC,IAAI;AAAA,MACP;AACA,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,aAAa,OAAO,MAAM,MAAM,CAAC,SAAS,OAAO,MAAM,IAAI,CAAC,4BAAuB,OAAO,MAAM,kBAAkB,IAAI,EAAE,CAAC;AAAA;AAAA,IACjJ;AACA,QAAI,CAAC,kBAAkB,OAAO,gBAAgB;AAC5C,WAAK,QAAQ,OAAO;AAAA,QAClB,KAAK,OAAO,KAAK,sBAAsB,CAAC,0CAA0C,MAAM,WAAW,IAAI;AAAA;AAAA,MACzG;AAAA,IACF,WAAW,gBAAgB;AACzB,WAAK,QAAQ,OAAO;AAAA,QAClB,KAAK,OAAO,KAAK,OAAO,CAAC,gEAAgE,MAAM,WAAW,IAAI;AAAA;AAAA,MAChH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AE3IA,SAAS,WAAAE,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,+BAA8B;AAEvC;;;ACAA;AACA;AAJA,YAAYC,UAAQ;AACpB,SAAS,aAAAC,kBAAiB;;;ACC1B;AACA;AAHA,SAAS,aAAa,kBAAkB;;;ACExC;AACA;AAHA,YAAYC,UAAQ;AACpB,SAAS,SAASC,kBAAiB;AAO5B,SAAS,mBAAmB,aAA4D;AAC7F,MAAI;AACJ,MAAI;AACF,UAAS,kBAAa,aAAa,MAAM;AAAA,EAC3C,SAAS,GAAG;AACV,UAAM,IAAI,cAAc,EAAE,MAAM,uBAAuB,SAAS,2BAA2B,WAAW,MAAO,EAAY,OAAO,GAAG,CAAC;AAAA,EACtI;AACA,QAAM,KAAK,IAAI,MAAM,uBAAuB;AAC5C,MAAI,CAAC,GAAI,OAAM,IAAI,cAAc,EAAE,MAAM,0BAA0B,SAAS,YAAY,WAAW,wBAAwB,CAAC;AAE5H,QAAM,QAAQA,WAAU,GAAG,CAAC,CAAC;AAC7B,QAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAC3D,QAAM,WAAY,MAAM,SAAkF,UAAU,UAAU;AAC9H,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,YAAY,WAAW;AAAA,MAChC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,OAAgB;AAAA,IACpB;AAAA,IACA,SAAS,IAAI,SAAS,OAAO;AAAA,IAC7B,gBAAgB,IAAI,SAAS,kBAAkB,CAAC;AAAA,IAChD,SAAS,IAAI,SAAS,OAAO;AAAA,IAC7B,SAAS,IAAI,SAAS,OAAO;AAAA,EAC/B;AACA,QAAM,aAAa,iBAAiB,IAAI;AACxC,MAAI,WAAW,SAAS,oBAAoB;AAC1C,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,iBAAiB,WAAW,mBAAmB,WAAW,MAAM,eAAe,kBAAkB;AAAA,IAC5G,CAAC;AAAA,EACH;AACA,SAAO,EAAE,MAAM,WAAW;AAC5B;AAEA,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AAC5C;;;ADzCA,IAAMC,mBAAkB;AACxB,IAAMC,sBAAqB;AAC3B,IAAMC,aAAY;AAClB,IAAM,YAAY,CAAC,oBAAoB,iBAAiB,kBAAkB;AAC1E,IAAM,gBAAgB;AACtB,IAAM,cAAc;AAEpB,IAAM,mBAAmB,GAAG,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcvC,WAAW;AAab,eAAsB,UAAU,MAA+C;AAC7E,QAAM,WAAW,KAAK,eAAe,MAAM;AAAA,EAAC;AAC5C,QAAM,iBAAiB,OAAO,KAAK,SAAS;AAE5C,WAAS,gCAA2B;AACpC,QAAM,EAAE,YAAY,YAAY,IAAI,mBAAmB,KAAK,WAAW;AAEvE,WAAS,wCAAmC;AAC5C,QAAM,UAAU,MAAM,gBAAgB,EAAE,YAAY,KAAK,YAAY,iBAAiB,KAAK,iBAAiB,WAAW,KAAK,UAAU,CAAC;AAEvI,MAAI,QAAQ,WAAW,SAAS,UAAU;AAKxC,aAAS,qDAAgD;AACzD,UAAMC,YAAmC,EAAE,GAAI,QAAQ,YAAY,CAAC,GAAI,KAAK,QAAQ,SAAS,YAAY;AAG1G,UAAMC,kBAAiB,MAAM,cAAc,EAAE,YAAY,KAAK,YAAY,iBAAiB,KAAK,iBAAiB,WAAW,KAAK,WAAW,YAAY,QAAQ,YAAY,UAAAD,WAAU,cAAc,EAAE,oBAAoB,yBAAyB,EAAE,CAAC;AACtP,WAAO,EAAE,MAAM,UAAU,gBAAAC,gBAAe;AAAA,EAC1C;AACA,MAAI,QAAQ,WAAW,SAAS,UAAU;AACxC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,UAAU,KAAK,SAAS,cAAc,QAAQ,WAAW,IAAI,+FAA+F,QAAQ,WAAW,IAAI;AAAA,IAC9L,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW,CAAC;AAC3D,QAAM,aAAa,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AAEnE,WAAS,uCAAkC;AAC3C,QAAM,iBAAiB,EAAE,YAAY,KAAK,YAAY,cAAc,KAAK,cAAc,gBAAgB,QAAQ,KAAK,WAAW,OAAO,CAAC;AAEvI,WAAS,+CAA0C;AACnD,QAAM,aAA8B;AAAA,IAClC,GAAG,QAAQ;AAAA,IACX,cAAc,cAAc,QAAQ,WAAW,gBAAgB,EAAE;AAAA,IACjE,OAAO,YAAY,QAAQ,WAAW,SAAS,CAAC,GAAG,KAAK,WAAW,cAAc;AAAA,EACnF;AACA,QAAM,WAAmC;AAAA,IACvC,GAAI,QAAQ,YAAY,CAAC;AAAA,IACzB,KAAK;AAAA,IACL,SAAS;AAAA,IACT,eAAe;AAAA,EACjB;AACA,QAAM,iBAAiB,MAAM,cAAc,EAAE,YAAY,KAAK,YAAY,iBAAiB,KAAK,iBAAiB,WAAW,KAAK,WAAW,YAAY,SAAS,CAAC;AAClK,SAAO,EAAE,MAAM,UAAU,gBAAgB,eAAe;AAC1D;AAUA,eAAsB,WAAW,MAAoF;AACnH,QAAM,WAAW,KAAK,eAAe,MAAM;AAAA,EAAC;AAC5C,QAAM,iBAAiB,OAAO,KAAK,SAAS;AAC5C,QAAM,UAAU,MAAM,gBAAgB,EAAE,YAAY,KAAK,YAAY,iBAAiB,KAAK,iBAAiB,WAAW,KAAK,UAAU,CAAC;AAEvI,WAAS,wCAAmC;AAC5C,QAAM,SAAS,QAAQ,WAAW,SAAS,CAAC,GAAG;AAAA,IAC7C,CAAC,MAAM,EAAG,EAAwB,SAAS,SAAU,EAAgC,iBAAiB;AAAA,EACxG;AACA,QAAM,aAA8B,EAAE,GAAG,QAAQ,YAAY,cAAc,aAAa,QAAQ,WAAW,gBAAgB,EAAE,GAAG,MAAM;AACtI,QAAM,WAAmC,EAAE,GAAI,QAAQ,YAAY,CAAC,EAAG;AACvE,SAAO,SAAS;AAChB,SAAO,SAAS;AAChB,SAAO,SAAS;AAChB,QAAM,iBAAiB,MAAM,cAAc,EAAE,YAAY,KAAK,YAAY,iBAAiB,KAAK,iBAAiB,WAAW,KAAK,WAAW,YAAY,SAAS,CAAC;AAElK,WAAS,mCAA8B;AACvC,QAAMC,kBAAiB,EAAE,YAAY,KAAK,YAAY,cAAc,KAAK,cAAc,eAAe,CAAC;AACvG,SAAO,EAAE,gBAAgB,eAAe;AAC1C;AAIO,SAAS,cAAc,cAA8B;AAC1D,SAAO,GAAG,aAAa,YAAY,EAAE,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA,EAAO,gBAAgB;AACjF;AAEO,SAAS,aAAa,cAA8B;AACzD,QAAM,KAAK,IAAI,OAAO,OAAO,IAAI,aAAa,CAAC,aAAa,IAAI,WAAW,CAAC,QAAQ,GAAG;AACvF,SAAO,aAAa,QAAQ,IAAI,IAAI,EAAE,QAAQ,QAAQ,EAAE;AAC1D;AAEO,SAAS,YACd,OACA,WACA,gBACuC;AACvC,QAAM,UAAU,SAAS,CAAC,GAAG;AAAA,IAC3B,CAAC,MAAM,EAAG,EAAwB,SAAS,SAAU,EAAgC,iBAAiB;AAAA,EACxG;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,EAAE,MAAM,OAAO,cAAc,OAAO,YAAY,WAAW,eAAe,WAAW,kBAAkB,SAAS,uBAAuB,eAAe;AAAA,EACxJ;AACF;AAEA,SAAS,IAAI,GAAmB;AAC9B,SAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAIA,eAAe,iBAAiB,MAAoI;AAClK,QAAM,QAAQ,MAAM,KAAK,WAAW,SAASH,UAAS;AACtD,MAAI,CAAC,OAAO,MAAO,OAAM,IAAI,cAAc,EAAE,MAAM,YAAY,SAAS,8BAA8B,CAAC;AACvG,QAAM,MAAM,+BAA+B,KAAK,YAAY,gBAAgB,KAAK,cAAc,gBAAgBF,gBAAe;AAC9H,QAAM,OAAO,KAAK,UAAU;AAAA,IAC1B,YAAY;AAAA,MACV,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,KAAK;AAAA,MACb,eAAe;AAAA,MACf,aAAa,EAAE,MAAM,EAAE,eAAe,UAAU,KAAK,MAAM,GAAG,EAAE;AAAA,MAChE,UAAU,EAAE,WAAW,UAAU;AAAA,IACnC;AAAA,EACF,CAAC;AACD,QAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,OAAO,SAAS,EAAE,eAAe,UAAU,MAAM,KAAK,IAAI,gBAAgB,mBAAmB,GAAG,KAAK,CAAC;AAC7I,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,cAAc,EAAE,MAAM,uBAAuB,SAAS,OAAO,GAAG,UAAU,IAAI,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;AAAA,EAC3H;AACF;AAEA,eAAeK,kBAAiB,MAAoG;AAClI,QAAM,QAAQ,MAAM,KAAK,WAAW,SAASH,UAAS;AACtD,MAAI,CAAC,OAAO,MAAO;AACnB,QAAM,MAAM,+BAA+B,KAAK,YAAY,gBAAgB,KAAK,cAAc,gBAAgBF,gBAAe;AAC9H,QAAM,MAAM,KAAK,EAAE,QAAQ,UAAU,SAAS,EAAE,eAAe,UAAU,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAC5G;AAEA,eAAe,cAAc,MAA0M;AACrO,QAAM,QAAQ,MAAM,KAAK,WAAW,SAASC,mBAAkB;AAC/D,MAAI,CAAC,OAAO,MAAO,OAAM,IAAI,cAAc,EAAE,MAAM,gBAAgB,SAAS,6CAA6C,CAAC;AAC1H,QAAM,MAAM,GAAG,KAAK,eAAe,WAAW,KAAK,SAAS;AAC5D,QAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,QAAQ,SAAS,EAAE,eAAe,UAAU,MAAM,KAAK,IAAI,gBAAgB,oBAAoB,GAAI,KAAK,gBAAgB,CAAC,EAAG,GAAG,MAAM,KAAK,UAAU,EAAE,YAAY,KAAK,YAAY,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;AACtP,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,cAAc,EAAE,MAAM,6BAA6B,SAAS,QAAQ,GAAG,UAAU,IAAI,MAAM;AAAA,EAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;AAAA,EAClI;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,QAAS,OAAM,IAAI,cAAc,EAAE,MAAM,iCAAiC,SAAS,oCAAoC,CAAC;AAClI,SAAO,KAAK;AACd;;;ADxLA;AAsDA,eAAsB,iBACpB,WACA,MACqB;AACrB,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1C,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,kBAAkB,SAAS;AAAA,EAClC,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,IACd,WAAW,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AASA,eAAsB,oBACpB,MACA,MACA,MACkC;AAClC,QAAM,QAAsB,CAAC;AAC7B,QAAM,WAAW,KAAK,eAAe,MAAM;AAAA,EAAC;AAG5C,MAAI,KAAK,cAAc;AACrB,UAAM,KAAK,EAAE,MAAM,YAAY,QAAQ,WAAW,QAAQ,kBAAkB,CAAC;AAAA,EAC/E,WAAW,KAAK,SAAS,WAAW,GAAG;AACrC,UAAM,KAAK,EAAE,MAAM,YAAY,QAAQ,WAAW,QAAQ,cAAc,CAAC;AAAA,EAC3E,OAAO;AACL,eAAW,KAAK,KAAK,UAAU;AAC7B,YAAM,WAAW,WAAW,EAAE,OAAO,IAAI,EAAE,SAAS;AACpD,UAAI;AACF,iBAAS,oBAAoB,EAAE,SAAS,KAAK,EAAE,OAAO,SAAI;AAC1D,cAAM,KAAK,cAAc,EAAE,SAAS;AACpC,cAAM,KAAK,EAAE,MAAM,UAAU,QAAQ,KAAK,CAAC;AAAA,MAC7C,SAAS,GAAG;AACV,cAAM,KAAK,EAAE,MAAM,UAAU,QAAQ,UAAU,QAAQ,OAAQ,EAAY,WAAW,CAAC,EAAE,CAAC;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,KAAK,UAAU,KAAK,SAAS;AAChC,UAAM,KAAK,EAAE,MAAM,OAAO,QAAQ,WAAW,QAAQ,CAAC,KAAK,SAAS,WAAW,aAAa,CAAC;AAAA,EAC/F,WAAW,CAAC,KAAK,aAAa;AAC5B,UAAM,KAAK,EAAE,MAAM,OAAO,QAAQ,WAAW,QAAQ,kBAAkB,CAAC;AAAA,EAC1E,WAAW,KAAK,SAAS,UAAU;AAGjC,UAAM,KAAK,EAAE,MAAM,OAAO,QAAQ,WAAW,QAAQ,uDAAuD,CAAC;AAAA,EAC/G,OAAO;AACL,QAAI;AACF,eAAS,qBAAgB;AACzB,YAAM,KAAK,WAAW,KAAK,SAAS;AACpC,YAAM,KAAK,EAAE,MAAM,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC1C,SAAS,GAAG;AACV,YAAM,KAAK,EAAE,MAAM,OAAO,QAAQ,UAAU,QAAQ,OAAQ,EAAY,WAAW,CAAC,EAAE,CAAC;AAAA,IACzF;AAAA,EACF;AAGA,MAAI,CAAC,KAAK,UAAU;AAClB,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,WAAW,QAAQ,WAAW,CAAC;AAAA,EACrE,WAAW,CAAC,KAAK,aAAa;AAC5B,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,WAAW,QAAQ,kBAAkB,CAAC;AAAA,EAC5E,WAAW,KAAK,SAAS,UAAU;AAIjC,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,WAAW,QAAQ,oDAAoD,CAAC;AAG5G,QAAI,KAAK,mBAAmB,KAAK,WAAW;AAC1C,UAAI;AACF,iBAAS,uBAAuB,KAAK,SAAS,QAAG;AACjD,cAAM,KAAK,gBAAgB,KAAK,SAAS;AACzC,cAAM,KAAK,EAAE,MAAM,cAAc,QAAQ,KAAK,CAAC;AAAA,MACjD,SAAS,GAAG;AACV,cAAM,KAAK,EAAE,MAAM,cAAc,QAAQ,UAAU,QAAQ,OAAQ,EAAY,WAAW,CAAC,EAAE,CAAC;AAAA,MAChG;AAAA,IACF;AAAA,EACF,OAAO;AACL,QAAI,gBAAgB;AACpB,QAAI;AACF,eAAS,uBAAkB;AAC3B,YAAM,KAAK,YAAY,KAAK,SAAS;AACrC,YAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,KAAK,CAAC;AAC1C,sBAAgB;AAAA,IAClB,SAAS,GAAG;AACV,YAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAQ,EAAY,WAAW,CAAC,EAAE,CAAC;AAAA,IAC3F;AAIA,QAAI,KAAK,mBAAmB,KAAK,aAAa,eAAe;AAC3D,UAAI;AACF,iBAAS,uBAAuB,KAAK,SAAS,QAAG;AACjD,cAAM,KAAK,gBAAgB,KAAK,SAAS;AACzC,cAAM,KAAK,EAAE,MAAM,cAAc,QAAQ,KAAK,CAAC;AAAA,MACjD,SAAS,GAAG;AACV,cAAM,KAAK,EAAE,MAAM,cAAc,QAAQ,UAAU,QAAQ,OAAQ,EAAY,WAAW,CAAC,EAAE,CAAC;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,WAAW,QAAQ,eAAe,CAAC;AAAA,EACzE,OAAO;AACL,QAAI;AACF,eAAS,kBAAkB,KAAK,SAAS,QAAG;AAC5C,YAAM,KAAK,YAAY,KAAK,SAAS;AACrC,YAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,KAAK,CAAC;AAAA,IAC5C,SAAS,GAAG;AACV,YAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAQ,EAAY,WAAW,CAAC,EAAE,CAAC;AAAA,IAC3F;AAAA,EACF;AAGA,MAAI;AACF,SAAK,gBAAgB,KAAK,SAAS;AACnC,UAAM,KAAK,EAAE,MAAM,QAAQ,QAAQ,KAAK,CAAC;AAAA,EAC3C,SAAS,GAAG;AACV,UAAM,KAAK,EAAE,MAAM,QAAQ,QAAQ,UAAU,QAAQ,OAAQ,EAAY,WAAW,CAAC,EAAE,CAAC;AAAA,EAC1F;AAEA,SAAO,EAAE,MAAM;AACjB;AA0BO,SAAS,uBAAuB,MAAmD;AACxF,QAAM,EAAE,YAAAK,aAAY,SAAS,cAAc,YAAY,MAAM,WAAW,IAAI;AAC5E,QAAM,kBAAkB,QAAQ;AAChC,QAAM,eAAe,GAAG,QAAQ,YAAY,aAAa,QAAQ,WAAW;AAE5E,SAAO;AAAA,IACL;AAAA,IAEA,MAAM,SAAS,WAAmB;AAChC,UAAI;AACF,cAAM,MAAM,MAAM,gBAAgB,EAAE,YAAAA,aAAY,iBAAiB,UAAU,CAAC;AAC5E,cAAM,OAAO,IAAI,YAAY,CAAC;AAC9B,cAAM,WAAW,CAAC,EAAE,KAAK,SAAS,KAAK,UAAU;AACjD,cAAM,SAAS,KAAK,QAAQ;AAC5B,YAAI;AACJ,YAAI,UAAU;AACZ,cAAI;AACF,wBAAa,KAAK,MAAM,KAAK,KAAK,EAAwB;AAAA,UAC5D,QAAQ;AAAA,UAER;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM,IAAI,WAAW;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAAS,GAAG;AACV,YAAI,aAAa,iBAAiB,EAAE,SAAS,mBAAmB;AAC9D,iBAAO,EAAE,QAAQ,OAAO,UAAU,OAAO,QAAQ,MAAM;AAAA,QACzD;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,MAAM,kBAAkB,WAAmB;AACzC,YAAM,OAAO,MAAM,QAA6B,YAAY,EAAE,QAAQ,OAAO,MAAM,gBAAgB,CAAC;AACpG,cAAQ,KAAK,YAAY,CAAC,GACvB,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS,EACvC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,WAAW,EAAE,UAAU,EAAE;AAAA,IAChE;AAAA,IAEA,MAAM,cAAc,WAAmB;AACrC,YAAM,QAAiB,YAAY;AAAA,QACjC,QAAQ;AAAA,QACR,MAAM,iBAAiB,mBAAmB,SAAS,CAAC;AAAA,MACtD,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,WAAW,WAAmB;AAClC,YAAM,WAAW;AAAA,QACf,YAAAA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,YAAY,WAAmB;AACnC,YAAM,YAAY;AAAA,QAChB,YAAAA;AAAA,QACA,OAAO,aAAa;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,YAAY,WAAmB;AACnC,YAAM,YAAY,EAAE,YAAAA,aAAY,UAAU,iBAAiB,MAAM,UAAU,CAAC;AAAA,IAC9E;AAAA,IAEA,MAAM,gBAAgB,MAAc;AAClC,YAAM,SAASC,WAAU,MAAM,CAAC,QAAQ,UAAU,MAAM,OAAO,GAAG,EAAE,UAAU,OAAO,CAAC;AACtF,UAAI,OAAO,WAAW,GAAG;AACvB,cAAM,IAAI,MAAM,OAAO,QAAQ,KAAK,KAAK,mCAAmC,OAAO,MAAM,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,IAEA,gBAAgB,WAAmB;AACjC,YAAM,IAAI,cAAc,WAAW,IAAI;AACvC,UAAO,gBAAW,CAAC,EAAG,CAAG,YAAO,CAAC;AAAA,IACnC;AAAA,EACF;AACF;;;AD3SO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,OAAO,QAAQ,CAAC,CAAC,SAAS,QAAQ,CAAC;AAAA,EACnC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,qCAAqC,gCAAgC;AAAA,MACtE,CAAC,yCAAyC,oDAAoD;AAAA,MAC9F,CAAC,oCAAoC,gDAAgD;AAAA,IACvF;AAAA,EACF,CAAC;AAAA,EAED,OAAOC,SAAO,OAAO;AAAA,EACrB,MAAMA,SAAO,QAAQ,SAAS,KAAK;AAAA,EACnC,eAAeA,SAAO,QAAQ,mBAAmB,KAAK;AAAA,EACtD,UAAUA,SAAO,QAAQ,cAAc,KAAK;AAAA,EAC5C,kBAAkBA,SAAO,QAAQ,uBAAuB,KAAK;AAAA,EAC7D,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,QAAQA,SAAO,OAAO,UAAU;AAAA,EAChC,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AAEtC,UAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACzD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,yCAAyC,CAAC;AAAA,IAC9F;AAEA,UAAM,aACJ,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAC/D,KAAK,SACN;AACN,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AACpF,UAAM,WACJ,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAEzF,UAAM,QAAS,KAAK,QAAQ,OAA8B,UAAU;AACpE,UAAM,MAAM,KAAK,QAAQ;AACzB,UAAM,eAAe,KAAK,iBAAiB;AAC3C,UAAM,UAAU,KAAK,YAAY;AACjC,UAAM,kBAAkB,KAAK,oBAAoB;AAEjD,UAAM,MAAO,KAAK,QAAQ,OAAO,QAAQ;AACzC,UAAM,gBAAgB,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAGpE,UAAM,eAAe,MAAM,cAAc,KAAK,aAAa;AAE3D,UAAMC,cAAa,IAAIC,wBAAuB;AAC9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBACH,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAC7D,QAAQ;AAGV,UAAM,YAAY,cAAc,IAAI;AACpC,UAAM,gBAAgB,WAAW;AAEjC,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,MAC9D;AAAA,IACF,CAAC;AAED,UAAM,aAAa,MAAM,sBAAsB;AAAA,MAC7C,aAAa;AAAA,MACb;AAAA,IACF,CAAC;AAED,UAAM,OAAO,uBAAuB;AAAA,MAClC,YAAAA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,YAAY;AAAA,IACd,CAAC;AAED,UAAM,OAAO,MAAM,iBAAiB,MAAM,IAAI;AAG9C,QAAI,CAAC,KAAK;AAER,YAAM,QAAkB,CAAC;AACzB,UAAI,CAAC,gBAAgB,KAAK,SAAS,SAAS,GAAG;AAC7C,cAAM,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI;AAClF,cAAM,KAAK,GAAG,KAAK,SAAS,MAAM,gBAAgB,QAAQ,GAAG;AAAA,MAC/D;AACA,UAAI,KAAK,UAAU,CAAC,QAAS,OAAM,KAAK,gBAAgB;AACxD,UAAI,KAAK,UAAU;AACjB,cAAM,WAAW,KAAK,YAClB,QAAQ,KAAK,SAAS,oDACtB;AACJ,cAAM,KAAK,qBAAqB,QAAQ,GAAG;AAAA,MAC7C;AACA,UAAI,KAAK,YAAa,OAAM,KAAK,OAAO,KAAK,QAAQ,SAAS,QAAQ;AACtE,YAAM,KAAK,YAAY;AAEvB,YAAM,WAAW,MAAM,SAAS,IAAI,MAAM,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI;AAC9E,WAAK,QAAQ,OAAO;AAAA,QAClB,mBAAmB,OAAO,MAAM,IAAI,CAAC;AAAA,EAAM,QAAQ;AAAA;AAAA;AAAA,MACrD;AAEA,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,uBAAuB,IAAI;AAAA,UACpC,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAEA,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAGA,UAAM,OAAmB,EAAE,cAAc,SAAS,gBAAgB;AAClE,UAAM,EAAE,MAAM,IAAI,MAAM,oBAAoB,MAAM,MAAM,IAAI;AAG5D,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,WAAW,MAAM,MAAM,CAAC,IAAI,IAAI;AACvE,aAAO,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,IACxD;AAEA,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,WAAW,MAAM;AACxB,aAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,QAAG,CAAC,IAAI,KAAK,IAAI;AAAA,CAAI;AAAA,MACrE,WAAW,KAAK,WAAW,WAAW;AACpC,aAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,MAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,KAAK,UAAU,SAAS,GAAG,CAAC;AAAA,CAAI;AAAA,MAClH,OAAO;AACL,aAAK,QAAQ,OAAO;AAAA,UAClB,KAAK,OAAO,MAAM,QAAG,CAAC,IAAI,KAAK,IAAI,KAAK,KAAK,UAAU,QAAQ;AAAA;AAAA,QACjE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ;AAC7D,QAAI,YAAY,SAAS,GAAG;AAC1B,WAAK,QAAQ,OAAO;AAAA,QAClB;AAAA,EAAK,OAAO,MAAM,QAAG,CAAC,IAAI,YAAY,MAAM,6CAA6C,IAAI;AAAA;AAAA,MAC/F;AACA,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO,MAAM;AAAA,EAAK,OAAO,QAAQ,QAAG,CAAC,YAAY,OAAO,MAAM,IAAI,CAAC;AAAA,CAAK;AACrF,WAAO;AAAA,EACT;AACF;;;AI5KA,YAAYE,YAAU;AACtB,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,gCAA8B;AAEvC;;;ACAA;AAJA,YAAYC,UAAQ;AACpB,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AACtB,SAAS,SAASC,kBAAiB;AAGnC,IAAM,WAAW;AAIV,SAAS,iBAAiB,MAAyE;AACxG,QAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,QAAM,OACJ,MAAM,KAAK,IAAI,KACf,MAAM,IAAI,eAAe,KACzB,MAAM,qBAAqB,KAAK,IAAI,CAAC;AACvC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,GAAG,IAAI,GAAG,QAAQ;AAC3B;AAEA,SAAS,MAAM,GAA2C;AACxD,MAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;AACxC,MAAI,IAAI,EAAE,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAGnC,MAAI,EAAE,YAAY,EAAE,SAAS,QAAQ,EAAG,KAAI,EAAE,MAAM,GAAG,CAAC,SAAS,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC3F,SAAO,EAAE,SAAS,IAAI;AACxB;AAEA,SAAS,qBAAqB,MAAmC;AAC/D,QAAM,MAAW,WAAK,QAAW,YAAQ,GAAG,cAAc,aAAa;AACvE,MAAI,CAAI,gBAAW,GAAG,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,IAAIA,WAAa,kBAAa,KAAK,MAAM,CAAC;AAChD,WAAO,OAAO,GAAG,eAAe,WAAW,EAAE,aAAa;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AD/BO,IAAM,mBAAN,cAA+B,WAAW;AAAA,EAC/C,OAAO,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;AAAA,EACjC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU,CAAC,CAAC,0BAA0B,sEAAsE,CAAC;AAAA,EAC/G,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,UAAUA,SAAO,OAAO,WAAW;AAAA,EACnC,aAAaA,SAAO,OAAO,eAAe;AAAA,EAC1C,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,MAAO,KAAK,QAAQ,OAAO,QAAQ;AACzC,UAAM,aAAa,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAAY,KAAK,SAAwC;AAChJ,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AACpF,UAAM,WAAW,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAExG,UAAMC,cAAa,IAAIC,yBAAuB;AAC9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBAAkB,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAAc,QAAQ;AAC1G,UAAM,gBAAgB,cAAc,KAAK,MAAM,GAAG;AAClD,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MAAY;AAAA,MACZ,aAAc,KAAK,QAAQ,OAA8B,UAAU;AAAA,MACnE,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,MAC9D;AAAA,IACF,CAAC;AAED,UAAM,cAAc,KAAK,mBAAmB;AAC5C,UAAM,YAAY,iBAAiB,EAAE,MAAM,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa,QAAW,IAAI,CAAC;AAEnH,UAAM,SAAS,MAAM,UAAU;AAAA,MAC7B,YAAAA;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,cAAc,GAAG,QAAQ,YAAY,aAAa,QAAQ,WAAW;AAAA,MACrE,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA,YAAY;AAAA,IACd,CAAC;AAED,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,MAAM,OAAO,MAAM,gBAAgB,OAAO,gBAAgB,gBAAgB,OAAO,gBAAgB,UAAU,CAAC,IAAI,IAAI;AAChL,aAAO;AAAA,IACT;AACA,QAAI,OAAO,SAAS,UAAU;AAC5B,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,QAAG,CAAC,IAAI,OAAO,MAAM,KAAK,MAAM,CAAC,gDAAgD,OAAO,cAAc;AAAA,CAAM;AACxJ,WAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,YAAY,CAAC;AAAA,CAA8H;AACtL,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,QAAG,CAAC,IAAI,OAAO,MAAM,KAAK,MAAM,CAAC,+BAA+B,OAAO,MAAM,OAAO,cAAe,CAAC,mBAAmB,OAAO,cAAc;AAAA,CAAM;AAC9L,SAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,YAAY,CAAC;AAAA,CAA+F;AACvJ,WAAO;AAAA,EACT;AAAA,EAEQ,qBAA6B;AACnC,QAAI,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,SAAS,GAAG;AAC/D,UAAI,KAAK,QAAQ,SAAS,GAAG,KAAK,KAAK,QAAQ,SAAS,KAAK,EAAG,QAAO,KAAK;AAC5E,aAAY,YAAK,gBAAgB,GAAG,YAAY,KAAK,SAAS,YAAY;AAAA,IAC5E;AACA,UAAM,OAAO,cAAc,KAAK,MAAM;AACtC,QAAI,MAAM,aAAa;AACrB,aAAO,KAAK,YAAY,WAAW,GAAG,IAAI,KAAK,cAAmB,YAAK,gBAAgB,GAAG,KAAK,WAAW;AAAA,IAC5G;AACA,UAAM,IAAI,cAAc,EAAE,MAAM,kBAAkB,SAAS,oCAAoC,KAAK,MAAM,4BAA4B,CAAC;AAAA,EACzI;AACF;;;AEpFA,SAAS,WAAAE,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,gCAA8B;AAQhC,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,OAAO,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC;AAAA,EAClC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU,CAAC,CAAC,2BAA2B,oBAAoB,CAAC;AAAA,EAC9D,CAAC;AAAA,EAED,SAASC,SAAO,OAAO;AAAA,EACvB,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,aAAa,KAAK,WAAW,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,WAAY,KAAK,SAAwC;AAChJ,UAAM,OAAO,kBAAkB,YAAY,KAAK,QAAQ,MAA4B;AACpF,UAAM,WAAW,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAExG,UAAMC,cAAa,IAAIC,yBAAuB;AAC9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBAAkB,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,WAAc,QAAQ;AAC1G,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MAAY;AAAA,MACZ,aAAc,KAAK,QAAQ,OAA8B,UAAU;AAAA,MACnE,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,MAC9D,eAAe,cAAc,KAAK,MAAM,GAAG;AAAA,IAC7C,CAAC;AAED,UAAM,SAAS,MAAM,WAAW;AAAA,MAC9B,YAAAA;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,cAAc,GAAG,QAAQ,YAAY,aAAa,QAAQ,WAAW;AAAA,MACrE,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,IACd,CAAC;AAED,QAAI,SAAS,QAAQ;AAAE,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI;AAAG,aAAO;AAAA,IAAG;AACnH,SAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,QAAG,CAAC,IAAI,OAAO,MAAM,KAAK,MAAM,CAAC,6BAA6B,OAAO,MAAM,OAAO,cAAc,CAAC,2BAA2B,OAAO,cAAc;AAAA,CAAM;AACnM,WAAO;AAAA,EACT;AACF;;;AChDA,SAAS,WAAAE,iBAAe;;;ACAxB,SAAS,cAAAC,mBAAkB;AAC3B,YAAYC,UAAQ;AACpB,YAAYC,SAAQ;AACpB,YAAYC,YAAU;AActB,SAAS,uBAAuB,MAAsB;AACpD,MAAI,CAAI,gBAAW,IAAI,EAAG,QAAO;AACjC,QAAM,OAAU,kBAAa,MAAM,MAAM;AAEzC,MAAI,CAAC,KAAK,WAAW,KAAK,EAAG,QAAO;AACpC,QAAM,WAAW,KAAK,QAAQ,SAAS,CAAC;AACxC,MAAI,WAAW,EAAG,QAAO;AACzB,QAAM,KAAK,KAAK,MAAM,GAAG,WAAW,CAAC;AACrC,QAAM,IAAI,GAAG,MAAM,uCAAuC;AAC1D,SAAO,IAAI,EAAE,CAAC,EAAE,KAAK,IAAI;AAC3B;AAMA,SAAS,WAAW,UAA0B;AAC5C,SAAOC,YAAW,QAAQ,EAAE,OAAU,kBAAa,QAAQ,CAAC,EAAE,OAAO,KAAK;AAC5E;AASO,SAAS,sBAAsC;AAEpD,QAAM,aAAkB;AAAA,IACtB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAmB;AAAA,IACpB,YAAQ;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGA,MAAI,CAAI,gBAAW,UAAU,GAAG;AAC9B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,QAAQ,+BAA+B,UAAU;AAAA,IACnD;AAAA,EACF;AAGA,QAAM,gBAAgB,uBAAuB,UAAU;AAGvD,MAAI,UAA8D;AAClE,MAAO,gBAAW,WAAW,GAAG;AAC9B,QAAI;AACF,gBAAU,KAAK,MAAS,kBAAa,aAAa,MAAM,CAAC;AAAA,IAC3D,QAAQ;AACN,gBAAU;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AACxD,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA,kBAAkB;AAAA,MAClB,QAAQ;AAAA,IACV;AAAA,EACF;AAGA,QAAM,mBAAmB,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AACjF,QAAM,cAAc,WAAW,UAAU;AAEzC,MAAI,gBAAgB,QAAQ,cAAc;AACxC,WAAO,EAAE,OAAO,MAAM,eAAe,iBAAiB;AAAA,EACxD;AAEA,QAAM,cAAc,CAAC,CAAC,oBAAoB,qBAAqB;AAC/D,SAAO;AAAA,IACL,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,QAAQ,cACJ,iCAAiC,aAAa,kFAC9C,0BAA0B,mBAAmB,MAAM,gBAAgB,MAAM,EAAE,8BAA8B,gBAAgB,MAAM,aAAa,MAAM,EAAE;AAAA,EAC1J;AACF;;;ADxGO,IAAM,wBAAN,cAAoC,WAAW;AAAA,EACpD,OAAO,QAAQ,CAAC,CAAC,iBAAiB,CAAC;AAAA,EACnC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,iCAAiC,oBAAoB;AAAA,IACxD;AAAA,EACF,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,IAAI,oBAAoB;AAC9B,QAAI,EAAE,OAAO;AACX,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,QAAG,CAAC,4BAA4B,EAAE,gBAAgB,MAAM,EAAE,aAAa,MAAM,EAAE;AAAA,CAAK;AAChI,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,MAAM,QAAG,CAAC,6CAA6C,EAAE,oBAAoB,WAAW,aAAa,EAAE,iBAAiB,GAAG;AAAA;AAAA,IACvI;AACA,QAAI,EAAE,OAAQ,MAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,KAAK,QAAG,CAAC,IAAI,EAAE,MAAM;AAAA,CAAI;AAC7E,WAAO;AAAA,EACT;AACF;;;AE1BAC;AAFA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,gCAA8B;AAGvC;;;ACHA;;;ACEO,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,SAAS,gBAAgB,QAAwB;AAC/C,SAAO,OAAO,YAAY,EAAE,QAAQ,QAAQ,EAAE;AAChD;AAEO,SAAS,wBAAwB,QAAyB;AAC/D,QAAM,IAAI,gBAAgB,MAAM;AAChC,SAAQ,qBAA2C,SAAS,CAAC;AAC/D;;;ACtBA,eAAsB,eAAe,SAAiB,MAAc,KAAgC;AAClG,MAAI;AACF,UAAM,MAAM,MAAM,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,WAAO,KAAK,SAAS,GAAG,IAAI,YAAY;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AFxBA;AAMO,SAAS,cAAc,OAA+D;AAC3F,QAAM,CAAC,aAAa,GAAG,IAAI,MAAM,MAAM,GAAG;AAC1C,QAAM,QAAQ,YAAY,QAAQ,GAAG;AACrC,QAAM,OAAO,YAAY,MAAM,GAAG,KAAK;AACvC,QAAM,OAAO,YAAY,MAAM,QAAQ,CAAC;AACxC,QAAM,UAAU,KAAK,QAAQ,mBAAmB,EAAE;AAClD,SAAO,EAAE,SAAS,MAAM,KAAK,OAAO,GAAG;AACzC;AAGA,SAAS,SAAS,gBAAwB,qBAA6B,SAAyB;AAC9F,QAAM,KAAK,oBAAoB,MAAM,6BAA6B,IAAI,CAAC,KAAK;AAC5E,SAAO,kBAAkB,cAAc,mBAAmB,EAAE,qDAAqD,OAAO;AAC1H;AAEA,eAAsB,mBAAmB,MAMT;AAC9B,QAAM,WAAqB,CAAC;AAG5B,MAAI,CAAC,wBAAwB,KAAK,QAAQ,MAAM,GAAG;AACjD,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,YAAY,KAAK,QAAQ,WAAW,YAAY,KAAK,QAAQ,MAAM;AAAA,MAC5E,MAAM,8BAA8B,qBAAqB,KAAK,IAAI,CAAC;AAAA,IACrE,CAAC;AAAA,EACH;AAGA,QAAM,EAAE,SAAS,MAAM,IAAI,IAAI,cAAc,KAAK,KAAK;AACvD,QAAM,WAAW,MAAM,eAAe,SAAS,MAAM,GAAG;AACxD,MAAI,aAAa,UAAU;AACzB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,UAAU,IAAI,IAAI,GAAG,2BAA2B,OAAO;AAAA,MAChE,MAAM,kGAAkG,OAAO,eAAe,IAAI,IAAI,GAAG;AAAA,IAC3I,CAAC;AAAA,EACH;AACA,MAAI,aAAa,WAAW;AAC1B,aAAS,KAAK,2BAA2B,IAAI,IAAI,GAAG,aAAa,OAAO,sFAAiF;AAAA,EAC3J;AAGA,MAAI,KAAK,QAAQ,oBAAoB;AACnC,UAAM,QAAQ,SAAS,KAAK,gBAAgB,KAAK,QAAQ,cAAc,OAAO;AAC9E,UAAM,UAAU,MAAM,oBAAoB;AAAA,MACxC,YAAY,KAAK;AAAA,MACjB,UAAU;AAAA,MACV,aAAa,KAAK,QAAQ;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,SAAS;AACZ,YAAM,aAAa;AAAA,QACjB,YAAY,KAAK;AAAA,QACjB,gBAAgB,KAAK;AAAA,QACrB,UAAU;AAAA,QACV,aAAa,KAAK,QAAQ;AAAA,MAC5B,CAAC;AACD,eAAS,KAAK,uDAAuD,OAAO,kBAAkB;AAAA,IAChG;AAAA,EACF,OAAO;AACL,aAAS,KAAK,0GAAqG;AAAA,EACrH;AAGA,QAAM,YAAY,MAAM,qBAAqB;AAAA,IAC3C,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK,QAAQ;AAAA,IACpB,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,+EAA+E,KAAK,QAAQ,YAAY,yJAAyJ,oBAAoB,YAAY,KAAK,QAAQ,YAAY;AAAA,IAClU,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,SAAS;AACpB;;;AG5FA;AAMA;AACA;AAKA,eAAsB,mBAAmB,MAef;AACxB,QAAM,aAAa,KAAK,eAAe,MAAM;AAAA,EAAC;AAC9C,QAAM,QAAQ,KAAK,UAAU,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvF,QAAM,MAAM,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,QAAM,UAAU,KAAK,iBAAiB,IAAI,KAAK;AAC/C,QAAM,WAAW,KAAK,kBAAkB;AAGxC,aAAW,yBAAyB,KAAK,IAAI,SAAI;AACjD,QAAM,UAAU,MAAM,mBAAmB;AAAA,IACvC,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,KAAK,KAAK;AAAA,IACV,QAAQ,KAAK;AAAA,IACb,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,EACjB,CAAC;AAGD,QAAM,cAAc,MAAM,4BAA4B;AAAA,IACpD,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,MAAM,KAAK;AAAA,IACX;AAAA,EACF,CAAC;AAKD,aAAW,mDAA8C;AACzD,QAAM,iBAAiB;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,gBAAgB,KAAK;AAAA,IACrB,cAAc,KAAK,QAAQ;AAAA,IAC3B;AAAA,EACF,CAAC;AAGD,QAAM,QAAQ,IAAI;AAClB,aAAS;AACP,UAAM,SAAS,MAAM,iBAAiB;AAAA,MACpC,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK,QAAQ;AAAA,MACvB,MAAM,KAAK;AAAA,MACX;AAAA,IACF,CAAC;AACD,eAAW,WAAW,MAAM,EAAE;AAC9B,QAAI,WAAW,SAAU,QAAO,EAAE,SAAS,aAAa,OAAO;AAC/D,QAAI,WAAW,UAAU;AACvB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,iBAAiB,KAAK,IAAI,aAAa,OAAO;AAAA,QACvD,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,QAAI,IAAI,IAAI,QAAQ,SAAS;AAC3B,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,iBAAiB,KAAK,IAAI,aAAa,OAAO,kCAAkC,KAAK,MAAM,UAAU,GAAI,CAAC,mBAAmB,MAAM;AAAA,QAC5I,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,UAAM,MAAM,QAAQ;AAAA,EACtB;AACF;;;AC9FA,YAAYC,UAAQ;AACpB,YAAYC,YAAU;AACtB,SAAS,SAASC,kBAAiB;AAQnC,SAAS,aAAa,UAAiC;AACrD,MAAI,MAAW,eAAQ,QAAQ;AAC/B,aAAS;AACP,QAAO,gBAAgB,YAAK,KAAK,UAAU,CAAC,EAAG,QAAO;AACtD,UAAM,SAAc,eAAQ,GAAG;AAC/B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAOO,SAAS,eAAe,SAAiB,MAAc,QAAQ,IAAI,GAAoB;AAC5F,QAAM,OAAO,aAAa,GAAG;AAC7B,MAAI,CAAC,KAAM,QAAO,EAAE,SAAS,gBAAgB,KAAK;AAElD,QAAM,OAAY,YAAK,MAAM,YAAY,SAAS,YAAY;AAC9D,MAAI;AACJ,MAAI;AACF,UAAS,kBAAa,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO,EAAE,SAAS,gBAAgB,KAAK;AAAA,EACzC;AAEA,QAAM,QAAQ,IAAI,MAAM,uBAAuB;AAC/C,MAAI,CAAC,MAAO,QAAO,EAAE,SAAS,gBAAgB,KAAK;AAEnD,MAAI,KAAmC;AACvC,MAAI;AACF,SAAKA,WAAU,MAAM,CAAC,CAAC;AAAA,EACzB,QAAQ;AACN,WAAO,EAAE,SAAS,gBAAgB,KAAK;AAAA,EACzC;AAEA,QAAM,UAAU,IAAI;AACpB,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,YAAY,UAAa,YAAY,OAAO,OAAO,OAAO,OAAO;AAAA,EACnF;AACF;;;ACnDA;AAGO,SAAS,kBACd,KAC6C;AAC7C,QAAM,iBAAiB,IAAI,4BAA4B,KAAK,KAAK;AACjE,QAAM,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AAChD,SAAO,EAAE,gBAAgB,MAAM;AACjC;AAGO,SAAS,eAAe,OAAuB;AACpD,QAAM,IAAI,MAAM,KAAK;AACrB,SAAO,gBAAgB,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;AACnD;AAGA,eAAsB,oBAAoB,MAKxB;AAChB,QAAM,UAAU,MAAM,0BAA0B;AAAA,IAC9C,YAAY,KAAK;AAAA,IACjB,gBAAgB,KAAK;AAAA,IACrB,OAAO,KAAK;AAAA,EACd,CAAC;AACD,QAAM,yBAAyB;AAAA,IAC7B,YAAY,KAAK;AAAA,IACjB,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;;;AC/BA,eAAsB,eAAe,QAAuC;AAC1E,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,CAAC,qBAAqB,SAAS,QAAQ,MAAM,QAAQ,YAAY,MAAM,CAAC;AAChG,UAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,WAAO,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,IAAI,cAAc,EAAE,gBAAgB,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE;AAAA,EAC/G,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGO,SAAS,eAAe,WAA2B;AACxD,SAAO,UAAU,MAAM,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,GAAG;AAC/C;AAEA,IAAM,qBAAqB;AAWpB,SAAS,kBACd,QACA,iBAC8D;AAC9D,QAAM,QAAQ,gBAAgB,KAAK,EAAE,YAAY;AACjD,QAAM,UAAU,OAAO,OAAO,CAAC,MAAM,eAAe,EAAE,IAAI,EAAE,YAAY,MAAM,KAAK;AACnF,QAAM,SAAS;AAAA,IACb,GAAG,IAAI,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,KAAK,mBAAmB,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,eAAe,EAAE,IAAI,CAAC,CAAC;AAAA,EACpH;AACA,MAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,SAAS,WAAW,OAAO;AAC9D,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAG,QAAO,EAAE,SAAS,MAAM,OAAO;AACrE,SAAO,EAAE,SAAS,YAAY,OAAO;AACvC;;;AP3BA,IAAM,eAAgE;AAAA,EACpE,OAAO,EAAE,KAAK,OAAO,QAAQ,MAAM;AAAA,EACnC,QAAQ,EAAE,KAAK,KAAK,QAAQ,MAAM;AAAA,EAClC,OAAO,EAAE,KAAK,KAAK,QAAQ,MAAM;AACnC;AACA,IAAM,cAAc;AACpB,IAAM,gBAAgB;AACtB,IAAM,cAAc;AACpB,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAET,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,OAAO,QAAQ,CAAC,CAAC,SAAS,QAAQ,CAAC;AAAA,EACnC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,gCAAgC,0BAA0B;AAAA,MAC3D,CAAC,mCAAmC,kEAAkE;AAAA,MACtG,CAAC,6BAA6B,mEAAmE;AAAA,IACnG;AAAA,EACF,CAAC;AAAA,EAED,OAAOC,SAAO,OAAO;AAAA,EACrB,UAAUA,SAAO,OAAO,WAAW;AAAA,EACnC,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,WAAWA,SAAO,OAAO,aAAa;AAAA,EACtC,OAAOA,SAAO,OAAO,QAAQ;AAAA,EAC7B,kBAAkBA,SAAO,OAAO,oBAAoB;AAAA,EACpD,MAAMA,SAAO,MAAM,OAAO;AAAA,EAC1B,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,cAAcA,SAAO,OAAO,UAAU;AAAA,EACtC,UAAUA,SAAO,OAAO,YAAY;AAAA,EACpC,oBAAoBA,SAAO,QAAQ,yBAAyB,KAAK;AAAA,EACjE,iBAAiBA,SAAO,QAAQ,sBAAsB,KAAK;AAAA,EAE3D,MAAM,iBAAkC;AACtC,QAAI,CAAC,QAAQ,KAAK,KAAK,QAAQ,EAAE,GAAG;AAClC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,wBAAwB,KAAK,IAAI;AAAA,QAC1C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,KAAK,QAAQ,UAAU,YAAY;AACjD,UAAM,SAAS,aAAa,IAAI;AAChC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,mBAAmB,KAAK,IAAI;AAAA,QACrC,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,MAA8B;AAAA,MAClC,uBAAuB,KAAK,oBAAoB,OAAO,KAAK,UAAU,WAAW,eAAe;AAAA,IAClG;AACA,eAAW,QAAQ,KAAK,OAAO,CAAC,GAAG;AACjC,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,MAAM,GAAG;AACX,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,IAAI;AAAA,UAC/B,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,UAAI,KAAK,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC;AAAA,IAC5C;AAEA,UAAM,UAAU,KAAK,WAAW;AAEhC,UAAM,aAAa,KAAK,SAAS;AACjC,UAAM,UAAU,WAAW,SAAS,GAAG,IAAI,aAAa,GAAG,WAAW,IAAI,UAAU;AACpF,UAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,YAAY,WAAW;AAExD,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAMC,cAAa,IAAIC,yBAAuB;AAC9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,iBAAiB,KAAK,gBAAgB,QAAQ;AACpD,UAAM,iBAAiB,MAAM,kBAAkB;AAE/C,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,UAAM,EAAE,SAAS,IAAI,MAAM,mBAAmB;AAAA,MAC5C,YAAAA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,eAAW,KAAK,UAAU;AACxB,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC;AAAA,CAAI;AAAA,IAC5D;AAEA,QAAI,KAAK,mBAAmB,MAAM;AAChC,YAAM,SAAS,MAAM,eAAe,QAAQ,MAAM;AAClD,YAAM,EAAE,SAAS,OAAO,IAAI,kBAAkB,QAAQ,IAAI,qBAAqB;AAC/E,UAAI,YAAY,YAAY;AAC1B,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,UAAU,IAAI,qBAAqB,oBAAoB,QAAQ,MAAM;AAAA,UAC9E,MAAM,iDAAiD,OAAO,CAAC,KAAK,YAAY,iDAAiD,OAAO,KAAK,IAAI,KAAK,QAAQ;AAAA,QAChK,CAAC;AAAA,MACH;AACA,UAAI,YAAY,WAAW;AACzB,aAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,iCAAiC,IAAI,qBAAqB,QAAQ,QAAQ,MAAM;AAAA,CAAiB;AAAA,MACpJ;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,aAAa,eAAe,IAAI,eAAe,OAAO;AAEvE,UAAM,aAAa,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAE1G,UAAM,SAAS,MAAM,mBAAmB;AAAA,MACtC,YAAAA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,UAAU,EAAE,QAAQ,iBAAiB,MAAM,UAAU,SAAS,aAAa,eAAe;AAAA,MAC1F;AAAA,IACF,CAAC;AAED,QAAI,OAAO,KAAK,UAAU,UAAU;AAClC,YAAM,OAAO,KAAK;AAClB,UAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AACvB,cAAM,IAAI,cAAc,EAAE,MAAM,SAAS,SAAS,oCAAoC,IAAI,IAAI,CAAC;AAAA,MACjG;AACA,YAAM,aAAc,KAAK,QAAQ,OAAO,QAAQ;AAChD,YAAM,QAAQ,cAAc,UAAU;AACtC,mBAAa,kCAA6B;AAC1C,YAAM,SAAS,MAAM,eAAe,EAAE,YAAAA,aAAY,MAAM,CAAC;AACzD,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,YAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM,eAAe,EAAE,YAAAA,aAAY,MAAM,CAAC;AACjF,YAAM,CAAC,OAAO,QAAQ,IAAI,KAAK,MAAM,GAAG;AACxC,YAAM,iBAAiB,MAAM,uBAAuB;AAAA,QAClD;AAAA,QAAO,MAAM;AAAA,QAAU;AAAA,QAAM;AAAA,QAAO;AAAA,QACpC,OAAO,CAAC,MAAM,KAAK,QAAQ,OAAO,MAAM,CAAC;AAAA,MAC3C,CAAC;AACD,YAAM,EAAE,mBAAAE,mBAAkB,IAAI,MAAM;AACpC,YAAMA,mBAAkB;AAAA,QACtB,YAAAF;AAAA,QAAY;AAAA,QAAgB;AAAA,QAAS;AAAA,QACrC,WAAW,KAAK;AAAA,QAAM;AAAA,QAAM,QAAQ,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,QAC9F;AAAA,QAAgB,iBAAiB,KAAK,mBAAmB;AAAA,QACzD,mBAAmB,KAAK,sBAAsB;AAAA,QAC9C;AAAA,MACF,CAAC;AACD,WAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,QAAG,CAAC,oBAAoB,OAAO,MAAM,IAAI,CAAC;AAAA,CAAuE;AAAA,IACjK,OAAO;AAIL,YAAM,WAAW,kBAAkB,GAAG;AACtC,YAAM,YAAY,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,WAAc,SAAS;AAC3F,UAAI,SAAS,kBAAkB,UAAU;AACvC,cAAM,QAAQ,eAAe,QAAQ;AACrC,qBAAa,oDAA+C;AAC5D,cAAM,oBAAoB;AAAA,UACxB,YAAAA;AAAA,UACA;AAAA,UACA,aAAa,OAAO;AAAA,UACpB;AAAA,QACF,CAAC;AACD,aAAK,QAAQ,OAAO;AAAA,UAClB,KAAK,OAAO,QAAQ,QAAG,CAAC,4DAA4D,OAAO,MAAM,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC;AAAA;AAAA,QACvH;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO;AAAA,QAClB,WAAW;AAAA,UACT,MAAM,KAAK;AAAA,UACX,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO;AAAA,UACf,SAAS;AAAA,UACT;AAAA,UACA;AAAA,UACA,UAAU,QAAQ;AAAA,UAClB,kBAAkB,OAAO;AAAA,QAC3B,CAAC,IAAI;AAAA,MACP;AACA,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,0BAA0B,OAAO,MAAM,KAAK,IAAI,CAAC,aACzD,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,IAAI,aAAa,WAAW;AAAA;AAAA,IACjF;AACA,SAAK,QAAQ,OAAO,MAAM,YAAY,KAAK;AAAA,CAAI;AAC/C,SAAK,QAAQ,OAAO,MAAM,cAAc,QAAQ,WAAW,KAAK,QAAQ,MAAM;AAAA,CAAK;AACnF,SAAK,QAAQ,OAAO;AAAA,MAClB,KAAK,OAAO,KAAK,OAAO,CAAC;AAAA;AAAA,IAC3B;AACA,WAAO;AAAA,EACT;AACF;;;AQ5OA,SAAS,WAAAG,gBAAe;AACxB,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,gCAA8B;AAIvC;AACA;AAGO,IAAM,uBAAN,cAAmC,WAAW;AAAA,EACnD,OAAO,QAAQ,CAAC,CAAC,SAAS,UAAU,CAAC;AAAA,EACrC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,qBAAqB,4BAA4B;AAAA,MAClD,CAAC,8BAA8B,kCAAkC;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAOC,SAAO,OAAO;AAAA,EACrB,MAAMA,SAAO,QAAQ,SAAS,KAAK;AAAA,EACnC,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAMC,cAAa,IAAIC,yBAAuB;AAC9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,iBAAiB,KAAK,gBAAgB,QAAQ;AACpD,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAD;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,UAAME,UAAS,MAAM,YAAY,EAAE,YAAAF,aAAY,UAAU,QAAQ,UAAU,MAAM,KAAK,KAAK,CAAC;AAC5F,QAAI,CAACE,SAAQ;AACX,UAAI,SAAS,QAAQ;AACnB,aAAK,QAAQ,OAAO;AAAA,UAClB,WAAW,EAAE,MAAM,KAAK,MAAM,SAAS,OAAO,QAAQ,aAAa,SAAS,eAAe,CAAC,IAAI;AAAA,QAClG;AACA,eAAO;AAAA,MACT;AACA,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,MAAG,CAAC,UAAU,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA,CAA8B;AAC5G,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,YAAM,KAAK,MAAMC,SAAQ;AAAA,QACvB,SAAS,wBAAwB,KAAK,IAAI;AAAA,QAC1C,SAAS;AAAA,MACX,CAAC;AACD,UAAI,CAAC,IAAI;AACP,aAAK,QAAQ,OAAO,MAAM,qCAAgC;AAC1D,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,YAAY,EAAE,YAAAH,aAAY,UAAU,QAAQ,UAAU,MAAM,KAAK,KAAK,CAAC;AAE7E,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,CAAC,IAAI,IAAI;AAC/E,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,yBAAyB,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA;AAAA,IACxE;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,KAAK,OAAO,KAAK,OAAO,CAAC,kGAAkG,KAAK,IAAI;AAAA;AAAA,IACtI;AACA,WAAO;AAAA,EACT;AACF;;;ACtFAI;AAHA,YAAYC,YAAU;AACtB,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAChC,SAAS,0BAAAC,gCAA8B;AAGvC;AAUA;AAKA,IAAMC,gBAAgE;AAAA,EACpE,OAAO,EAAE,KAAK,OAAO,QAAQ,MAAM;AAAA,EACnC,QAAQ,EAAE,KAAK,KAAK,QAAQ,MAAM;AAAA,EAClC,OAAO,EAAE,KAAK,KAAK,QAAQ,MAAM;AACnC;AACA,IAAMC,eAAc;AACpB,IAAMC,iBAAgB;AACtB,IAAMC,eAAc;AACpB,IAAMC,iBAAgB;AACtB,IAAMC,WAAU;AAET,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,OAAO,QAAQ,CAAC,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAAA,EAED,OAAOC,SAAO,OAAO;AAAA,EACrB,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,WAAWA,SAAO,OAAO,aAAa;AAAA,EACtC,OAAOA,SAAO,OAAO,QAAQ;AAAA,EAC7B,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,gBAAgBA,SAAO,OAAO,kBAAkB;AAAA,EAChD,kBAAkBA,SAAO,OAAO,oBAAoB;AAAA,EACpD,MAAMA,SAAO,MAAM,OAAO;AAAA,EAC1B,QAAQA,SAAO,OAAO,SAAS;AAAA,EAC/B,QAAQA,SAAO,OAAO,UAAU;AAAA,EAChC,aAAaA,SAAO,OAAO,eAAe;AAAA,EAC1C,WAAWA,SAAO,OAAO,YAAY;AAAA,EACrC,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,SAASA,SAAO,OAAO,UAAU;AAAA,EACjC,iBAAiBA,SAAO,QAAQ,sBAAsB,KAAK;AAAA,EAC3D,mBAAmBA,SAAO,QAAQ,wBAAwB,KAAK;AAAA,EAE/D,MAAM,iBAAkC;AACtC,QAAI,CAACF,SAAQ,KAAK,KAAK,QAAQ,EAAE,GAAG;AAClC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,wBAAwB,KAAK,IAAI;AAAA,MAC5C,CAAC;AAAA,IACH;AACA,QAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAM,SAAS,GAAG,GAAG;AAC/D,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,KAAK,QAAQ,SAAS,YAAY;AAChD,UAAM,SAASL,cAAa,IAAI;AAChC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,mBAAmB,KAAK,IAAI;AAAA,MACvC,CAAC;AAAA,IACH;AAEA,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAC1E,UAAM,aACJ,SAAS,WAAW,CAAC,MAAc,KAAK,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,CAAI,IAAI;AAEzF,UAAMQ,cAAa,IAAIC,yBAAuB;AAC9C,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,iBAAiB,KAAK,gBAAgB,QAAQ;AACpD,UAAM,iBAAiB,MAAM,kBAAkB;AAE/C,UAAM,aAAa,KAAK,aAAa,cAAc;AAKnD,QAAI,KAAK,qBAAqB,MAAM;AAClC,YAAM,YAAY,MAAM,qBAAqB,EAAE,YAAAD,aAAY,OAAO,YAAY,eAAe,CAAC;AAC9F,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,iDAAiD,UAAU;AAAA,UACpE,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,SAASN;AACjC,UAAM,UAAU,WAAW,SAAS,GAAG,IAAI,aAAa,GAAGD,YAAW,IAAI,UAAU;AACpF,UAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,YAAYE,YAAW;AAExD,UAAM,UAAU,MAAM,sBAAsB;AAAA,MAC1C,YAAAK;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,UAAM,aAAc,KAAK,QAAQ,OAAO,QAAQ;AAChD,UAAM,QAAQ,cAAc,YAAY,OAAO,KAAK,UAAU,WAAW,eAAe,KAAK,KAAK,IAAI,MAAS;AAE/G,iBAAa,kCAA6B;AAC1C,UAAM,SAAS,MAAM,eAAe,EAAE,YAAAA,aAAY,MAAM,CAAC;AACzD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,UAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM,eAAe,EAAE,YAAAA,aAAY,MAAM,CAAC;AACjF,UAAM,CAAC,OAAO,QAAQ,IAAI,KAAK,MAAM,MAAM,GAAG;AAC9C,UAAM,iBAAiB,MAAM,uBAAuB;AAAA,MAClD;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,CAAC,MAAM,KAAK,QAAQ,OAAO,MAAM,CAAC;AAAA,IAC3C,CAAC;AAED,UAAM,MAA8B;AAAA,MAClC,uBAAuB,KAAK,mBAAmBJ;AAAA,MAC/C,kBAAkB;AAAA,MAClB,4BAA4B;AAAA,MAC5B,oBAAoB;AAAA,IACtB;AACA,eAAW,QAAQ,KAAK,OAAO,CAAC,GAAG;AACjC,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,MAAM,GAAG;AACX,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,IAAI;AAAA,QACjC,CAAC;AAAA,MACH;AACA,UAAI,KAAK,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC;AAAA,IAC5C;AAEA,UAAM,EAAE,SAAS,IAAI,MAAM,mBAAmB;AAAA,MAC5C,YAAAI;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,eAAW,KAAK,UAAU;AACxB,WAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC;AAAA,CAAI;AAAA,IAC5D;AAEA,QAAI,KAAK,mBAAmB,MAAM;AAChC,YAAM,SAAS,MAAM,eAAe,QAAQ,MAAM;AAClD,YAAM,EAAE,SAAS,OAAO,IAAI,kBAAkB,QAAQ,IAAI,qBAAqB;AAC/E,UAAI,YAAY,YAAY;AAC1B,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,UAAU,IAAI,qBAAqB,oBAAoB,QAAQ,MAAM;AAAA,UAC9E,MAAM,8BAA8B,OAAO,CAAC,KAAK,YAAY;AAAA,QAC/D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,aAAa,eAAe,IAAI,eAAe,gBAAgB;AAEhF,UAAM,SAAS,MAAM,mBAAmB;AAAA,MACtC,YAAAA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,UAAU,EAAE,QAAQ,iBAAiB,MAAM,UAAU,SAAS,aAAa,eAAe;AAAA,MAC1F;AAAA,IACF,CAAC;AAED,iBAAa,2BAA2B,UAAU,QAAG;AACrD,UAAM,iBAAiB;AAAA,MACrB,YAAAA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,aAAa,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,KAAK,qBAAqB,MAAM;AAGlC,mBAAa,yCAAyC,UAAU,QAAG;AACnE,YAAM,qBAAqB;AAAA,QACzB,YAAAA;AAAA,QACA;AAAA,QACA,OAAO;AAAA,QACP,aAAa,OAAO;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,iBAAa,oDAA+C;AAC5D,UAAM,oBAAoB;AAAA,MACxB,YAAAA;AAAA,MACA;AAAA,MACA,aAAa,OAAO;AAAA,MACpB;AAAA,IACF,CAAC;AAED,iBAAa,gCAA2B;AACxC,UAAM,cAAmB,YAAK,gBAAgB,GAAG,YAAY,kBAAkB,YAAY;AAC3F,UAAM,YAAY,iBAAiB;AAAA,MACjC,MAAM,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAAA,MAC9D,KAAK;AAAA,IACP,CAAC;AACD,UAAM,UAAU;AAAA,MACd,YAAAA;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,cAAc,GAAG,QAAQ,YAAY,aAAa,QAAQ,WAAW;AAAA,MACrE,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO;AAAA,QAClB,WAAW;AAAA,UACT,MAAM,KAAK;AAAA,UACX,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO;AAAA,UACf,SAAS;AAAA,UACT;AAAA,UACA,OAAO;AAAA,UACP,UAAU,QAAQ;AAAA,UAClB,kBAAkB,OAAO;AAAA,QAC3B,CAAC,IAAI;AAAA,MACP;AACA,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO;AAAA,MAClB,GAAG,OAAO,QAAQ,QAAG,CAAC,4BAA4B,OAAO,MAAM,KAAK,IAAI,CAAC,aAAa,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,IAAI;AAAA;AAAA,IACjI;AACA,SAAK,QAAQ,OAAO,MAAM,YAAY,UAAU;AAAA,WAAc,KAAK;AAAA,CAAI;AACvE,SAAK,QAAQ,OAAO;AAAA,MAClB,KAAK,qBAAqB,OACtB,KAAK,OAAO,KAAK,OAAO,CAAC;AAAA,IACzB,KAAK,OAAO,KAAK,OAAO,CAAC;AAAA;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,gBAAgC;AACnD,QAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,WAAW,iBAAiB,EAAG,QAAO,KAAK;AAC5F,QAAI,OAAO,KAAK,kBAAkB,YAAY,KAAK,cAAc,SAAS,GAAG;AAC3E,aAAO,kBAAkB,cAAc,mBAAmB,KAAK,aAAa;AAAA,IAC9E;AACA,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SACE;AAAA,MACF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;;;AChSA,SAAS,WAAAE,WAAS,UAAAC,gBAAc;;;ACChC;AAEA,IAAM,WAAW;AAGjB,IAAM,+BAA+B;AACrC,IAAM,oBAAoB;AAC1B,IAAM,8BAA8B;AAKpC,eAAe,OAAU,MAAmC;AAC1D,QAAM,OAAO,MAAM,MAAM,IAAI,GAAG,KAAK;AACrC,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,KAAK,MAAM,GAAG;AACvB;AAmBA,eAAsB,kBAAkB,OAAe,aAAoC;AAMzF,QAAM,UAAU,MAAM,OAAoB;AAAA,IACxC;AAAA,IAAM;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC7B;AAAA,IAAW;AAAA,IACX;AAAA,IAAY;AAAA,EACd,CAAC;AAED,QAAM,YAAY,SAAS,KAAK;AAChC,QAAM,eAAyB,MAAM,QAAQ,SAAS,IAAI,IAAI,QAAQ,OAAO,CAAC;AAC9E,QAAM,iBAA6E,MAAM,QAAQ,SAAS,MAAM,IAAI,QAAQ,SAAS,CAAC;AACtI,QAAM,kBAAoG,MAAM,QAAQ,SAAS,OAAO,IAAI,QAAQ,UAAU,CAAC;AAE/J,QAAM,aAAa,aAAa,SAAS,SAAS;AAClD,QAAM,yBAAyB,eAAe,KAAK,CAAC,MAAM,EAAE,UAAU,oBAAoB;AAC1F,QAAM,kBAAkB,gBAAgB,KAAK,CAAC,MAAM,EAAE,UAAU,4BAA4B;AAK5F,QAAM,UAAU,wBAAwB,MAAM,WAAW,OAAO,WAAW;AAE3E,QAAM,iBAAiB,CAAC,CAAC,iBAAiB,wBAAwB,SAAS,OAAO;AAElF,MAAI,cAAc,0BAA0B,gBAAgB;AAC1D;AAAA,EACF;AAMA,MAAI,CAAC,cAAc,CAAC,wBAAwB;AAC1C,UAAM,YAAY,yBACd,iBACA;AAAA,MACE,GAAG;AAAA,MACH;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,QACN,yBACE;AAAA,QACF,yBAAyB;AAAA,QACzB,wBACE;AAAA,QACF,wBAAwB;AAAA,QACxB,WAAW;AAAA,MACb;AAAA,IACF;AAEJ,UAAM,QAAQ;AAAA,MACZ,gBAAgB,aAAa,eAAe,CAAC,GAAG,cAAc,SAAS;AAAA,MACvE,KAAK,EAAE,wBAAwB,UAAU;AAAA,IAC3C;AAEA,UAAM,MAAM;AAAA,MACV;AAAA,MAAQ;AAAA,MAAY;AAAA,MACpB;AAAA,MAAS,iDAAiD,WAAW;AAAA,MACrE;AAAA,MAAa;AAAA,MACb;AAAA,MAAU,KAAK,UAAU,KAAK;AAAA,IAChC,CAAC;AAAA,EACH;AAOA,MAAI,CAAC,gBAAgB;AACnB,QAAI;AACJ,QAAI,iBAAiB;AAGnB,YAAM,MAAM,IAAI,IAAI,gBAAgB,0BAA0B,CAAC,CAAC;AAChE,UAAI,IAAI,OAAO;AACf,mBAAa,gBAAgB;AAAA,QAAI,CAAC,MAChC,EAAE,UAAU,+BACR,EAAE,OAAO,EAAE,OAAO,wBAAwB,MAAM,KAAK,GAAG,EAAE,IAC1D,EAAE,OAAO,EAAE,OAAO,wBAAwB,EAAE,uBAAuB;AAAA,MACzE;AAAA,IACF,OAAO;AACL,mBAAa;AAAA,QACX,GAAG,gBAAgB,IAAI,CAAC,OAAO;AAAA,UAC7B,OAAO,EAAE;AAAA,UACT,wBAAwB,EAAE;AAAA,QAC5B,EAAE;AAAA,QACF;AAAA,UACE,OAAO;AAAA,UACP,wBAAwB,CAAC,OAAO;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ;AAAA,MACZ,KAAK,EAAE,2BAA2B,WAAW;AAAA,IAC/C;AAEA,UAAM,MAAM;AAAA,MACV;AAAA,MAAQ;AAAA,MAAY;AAAA,MACpB;AAAA,MAAS,iDAAiD,WAAW;AAAA,MACrE;AAAA,MAAa;AAAA,MACb;AAAA,MAAU,KAAK,UAAU,KAAK;AAAA,IAChC,CAAC;AAAA,EACH;AACF;AAUA,eAAsB,aAAa,MAGT;AAExB,MAAI,KAAK,UAAU;AACjB,WAAO,EAAE,UAAU,KAAK,UAAU,UAAU,KAAK,UAAU,aAAa,KAAK;AAAA,EAC/E;AAGA,QAAM,WAAW,MAAM;AAAA,IACrB,CAAC,MAAM,OAAO,QAAQ,kBAAkB,UAAU,YAAY,MAAM;AAAA,EACtE;AAEA,MAAI,YAAY,SAAS,SAAS,GAAG;AACnC,UAAM,MAAM,SAAS,CAAC;AACtB,UAAM,QAAQ,MAAM;AAAA,MAClB,CAAC,MAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO,WAAW,MAAM,YAAY,MAAM;AAAA,IAC9E;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,qDAAqD,IAAI,KAAK;AAAA,MACzE,CAAC;AAAA,IACH;AACA,UAAM,kBAAkB,IAAI,OAAO,KAAK;AACxC,WAAO,EAAE,UAAU,KAAK,UAAU,UAAU,IAAI,OAAO,aAAa,MAAM;AAAA,EAC5E;AAGA,QAAM,KAAK,MAAM;AAAA,IACf,CAAC,MAAM,kBAAkB,QAAQ,YAAY,MAAM;AAAA,EACrD;AACA,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAKA,MAAI;AACJ,MAAI;AACF,YAAS,MAAM,OAAiB;AAAA,MAC9B;AAAA,MAAQ;AAAA,MAAY;AAAA,MACpB;AAAA,MACA,qGAAqG,GAAG,EAAE;AAAA,MAC1G;AAAA,MAAW;AAAA,MACX;AAAA,MAAY;AAAA,IACd,CAAC,KAAM,CAAC;AAAA,EACV,QAAQ;AACN,YAAQ;AAAA,EACV;AAEA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe,UAAU,QAAQ,MAAM,KAAK,CAAC,MAAM,WAAW,SAAS,CAAC,CAAC;AAE/E,MAAI,CAAC,cAAc;AACjB,QAAI,UAAU,MAAM;AAClB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SACE;AAAA,QACF,MACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SACE;AAAA,MACF,MACE;AAAA,IACJ,CAAC;AAAA,EACH;AAKA,QAAM,kBAAkB,MAAM;AAAA,IAC5B,CAAC,MAAM,MAAM,QAAQ,QAAQ,mBAAmB,WAAW,MAAM,YAAY,KAAK;AAAA,EACpF,GAAG,KAAK;AAGR,QAAM,UAAU,MAAM,OAAsC;AAAA,IAC1D;AAAA,IAAM;AAAA,IAAO;AAAA,IACb;AAAA,IAAkB;AAAA,IAClB;AAAA,IAAsB;AAAA,IACtB;AAAA,IAAY;AAAA,EACd,CAAC;AACD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,QAAM,MAAM;AAAA,IACV;AAAA,IAAQ;AAAA,IAAY;AAAA,IACpB;AAAA,IAAS,iDAAiD,QAAQ,EAAE;AAAA,IACpE;AAAA,IAAa;AAAA,IACb;AAAA,IAAU,KAAK,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC,uBAAuB,EAAE,EAAE,CAAC;AAAA,EAC/E,CAAC;AAGD,QAAM,MAAM;AAAA,IACV;AAAA,IAAM;AAAA,IAAO;AAAA,IAAc;AAAA,IAC3B;AAAA,IAAQ,QAAQ;AAAA,IAChB;AAAA,IAAS;AAAA,IACT;AAAA,IAAqB,GAAG,2BAA2B;AAAA,EACrD,CAAC;AAID,QAAM,cAAc,MAAM;AAAA,IACxB,CAAC,MAAM,MAAM,UAAU,QAAQ,QAAQ,OAAO,WAAW,MAAM,YAAY,KAAK;AAAA,EAClF,GAAG,KAAK;AAER,QAAM,MAAM;AAAA,IACV;AAAA,IAAQ;AAAA,IAAY;AAAA,IACpB;AAAA,IAAS;AAAA,IACT;AAAA,IAAa;AAAA,IACb;AAAA,IAAU,KAAK,UAAU;AAAA,MACvB,UAAU;AAAA,MACV,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AAED,QAAM,kBAAkB,QAAQ,OAAO,QAAQ,EAAE;AACjD,SAAO,EAAE,UAAU,KAAK,UAAU,UAAU,QAAQ,OAAO,aAAa,QAAQ,GAAG;AACrF;AAMA,eAAsB,kBAAkB,aAAqB,MAA6B;AACxF,QAAM,YAAY,WAAW,IAAI;AACjC,QAAM,WAAY,MAAM;AAAA,IACtB,CAAC,MAAM,OAAO,QAAQ,QAAQ,aAAa,WAAW,oBAAoB,YAAY,MAAM;AAAA,EAC9F,KAAM,CAAC;AAEP,MAAI,SAAS,SAAS,SAAS,GAAG;AAChC;AAAA,EACF;AAEA,QAAM,UAAU,CAAC,GAAG,UAAU,SAAS;AACvC,QAAM,MAAM;AAAA,IACV;AAAA,IAAQ;AAAA,IAAY;AAAA,IACpB;AAAA,IAAS,iDAAiD,WAAW;AAAA,IACrE;AAAA,IAAa;AAAA,IACb;AAAA,IAAU,KAAK,UAAU,EAAE,KAAK,EAAE,cAAc,QAAQ,EAAE,CAAC;AAAA,EAC7D,CAAC;AACH;;;AC9TA,YAAYC,UAAQ;AACpB,YAAYC,SAAQ;AACpB,YAAYC,YAAU;AAEtB;AAoBO,SAAS,iBAAiB,GAA0B;AACzD,SAAO;AAAA,IACL,YAAY,EAAE,QAAQ;AAAA,IACtB,UAAU,EAAE,MAAM;AAAA,IAClB,YAAY,EAAE,QAAQ;AAAA,IACtB,YAAY,EAAE,QAAQ;AAAA,IACtB,YAAY,EAAE,QAAQ;AAAA,IACtB,qBAAqB,EAAE,iBAAiB;AAAA,IACxC,0BAA0B,EAAE,sBAAsB;AAAA,IAClD,6BAA6B,EAAE,yBAAyB;AAAA,IACxD,iBAAiB,EAAE,aAAa;AAAA,EAClC;AACF;AAGA,eAAsBC,iBAAgB,OAAkB,YAAQ,GAAoB;AAClF,QAAM,SAAc,YAAK,MAAM,cAAc,WAAW;AACxD,MAAI;AACF,UAAM,QAAQ,MAAS,cAAS,QAAQ,MAAM,GAAG,KAAK;AACtD,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,OAAO;AAClC,WAAO;AAAA,EACT,QAAQ;AACN,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAGA,eAAsB,yBACpB,UACA,UACiB;AACjB,MAAI,SAAU,QAAO;AACrB,QAAM,IAAI,SAAS,MAAM,8CAA8C;AACvE,MAAI,CAAC,GAAG;AACN,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,wDAAwD,QAAQ;AAAA,MACzE,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,WAAW,KAAK;AAAA,IACpB,MAAM,MAAM;AAAA,MACV;AAAA,MAAqB;AAAA,MAAW;AAAA,MAChC;AAAA,MAAW,YAAY,EAAE,CAAC,CAAC;AAAA,MAC3B;AAAA,MAAY;AAAA,IACd,CAAC;AAAA,EACH;AACA,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,6BAA6B,EAAE,CAAC,CAAC;AAAA,MAC1C,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,oCAAoC,EAAE,CAAC,CAAC;AAAA,MACjD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,SAAS,CAAC;AACnB;AAUA,eAAsB,qBAAqB,MAGvB;AAClB,MAAI,KAAK,SAAU,QAAO,KAAK;AAC/B,QAAM,OAAO,KAAK,SAAS,MAAM,GAAG,EAAE,CAAC;AACvC,MAAI,CAAC,KAAK,SAAS,aAAa,EAAG,QAAO;AAC1C,QAAM,UAAU,KAAK,MAAM,GAAG,EAAE,CAAC;AACjC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,CAAC,OAAO,QAAQ,MAAM,SAAS,WAAW,MAAM,MAAM,KAAK,CAAC,GAAG,KAAK;AAC5F,QAAI,CAAC,GAAI,OAAM,IAAI,MAAM,UAAU;AACnC,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAI,aAAa,cAAe,OAAM;AACtC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,2BAA2B,OAAO,eAAe,KAAK,QAAQ;AAAA,MACvE,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAGA,eAAsB,oBAAoB,MAAc,UAAiC;AACvF,QAAM,WAAW,KAAK;AAAA,IACnB,MAAM,MAAM,CAAC,SAAS,QAAQ,UAAU,MAAM,YAAY,MAAM,CAAC,EAAE,MAAM,MAAM,EAAE,KAAM;AAAA,EAC1F;AACA,MAAI,SAAU;AACd,QAAM,MAAM,CAAC,SAAS,UAAU,UAAU,MAAM,cAAc,UAAU,UAAU,sBAAsB,CAAC;AAC3G;AAQO,SAAS,uBAAuB,MAAqC;AAC1E,SAAO,KAAK,YAAY;AAC1B;AAGA,eAAsB,mBAAmB,MAKf;AACxB,QAAM,YAAiB,YAAK,KAAK,UAAU,UAAU,YAAY;AACjE,QAAM,SAAS,KAAK;AAAA,IAClB,MAAM,MAAM;AAAA,MACV;AAAA,MAAc;AAAA,MAAS;AAAA,MACvB;AAAA,MAAU,KAAK;AAAA,MACf;AAAA,MAAoB,KAAK;AAAA,MACzB;AAAA,MAAmB;AAAA,MACnB;AAAA,MAAgB,GAAG,KAAK;AAAA,MACxB;AAAA,MAAY;AAAA,IACd,CAAC;AAAA,EACH;AACA,QAAM,UAAU,OAAO,YAAY,WAAW,CAAC;AAC/C,QAAM,OAAO,QAAQ,kBAAkB;AACvC,MAAI,OAAO,SAAS,YAAY,CAAC,MAAM;AACrC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,eAAgB,QAAQ,eAAe,SAAoC,CAAC;AAAA,EAC9E;AACF;;;AF7JA;;;AGfA,YAAYC,YAAU;AAyBf,SAAS,mBAAmB,YAA4B;AAC7D,MAAI,WAAW,WAAW,GAAG,EAAG,QAAO;AACvC,QAAM,iBAAiB,WAAW,MAAM,aAAa,EAAE,CAAC;AACxD,MAAI,CAAC,eAAgB,QAAO;AAC5B,QAAM,OAAO,eAAe,MAAM,GAAG;AACrC,QAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtB,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,EAAG,OAAM,KAAK,KAAK,CAAC,CAAC;AAC3D,SAAO,MAAM,KAAK,GAAG;AACvB;AAGA,eAAsB,UAAU,MAA8F;AAC5H,QAAM,YAAiB,YAAK,KAAK,UAAU,UAAU,YAAY;AACjE,QAAM,MAAM,MAAM,MAAM;AAAA,IACtB;AAAA,IAAc;AAAA,IAAS;AAAA,IACvB;AAAA,IAAoB,KAAK;AAAA,IACzB;AAAA,IAAmB;AAAA,IACnB;AAAA,IAAgB,GAAG,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IAAY;AAAA,EACd,CAAC;AACD,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,SAAO,OAAO,WAAW,CAAC;AAC5B;AAEA,IAAM,MAAM,CAAC,MACX,YAAO,EAAE,YAAY,IAAI,EAAE,IAAI,KAAK,KAAK,UAAU,EAAE,UAAU,IAAI,CAAC,WAAM,KAAK,UAAU,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,MAAM,MAAM,EAAE;AAGzI,SAAS,aAAa,GAAqB,MAA+D;AAC/G,QAAM,WAAW,EAAE,WAAW,WAAW,IAAI,IAAI;AACjD,MAAI,KAAK,MAAM;AACb,WAAO,EAAE,QAAQ,KAAK,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,QAAQ,SAAS,EAAE,QAAQ,QAAQ,YAAY,EAAE,WAAW,OAAO,GAAG,SAAS,EAAE,SAAS,YAAY,EAAE,YAAY,SAAS,GAAG,MAAM,CAAC,GAAG,SAAS;AAAA,EACjN;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,YAAY,EAAE,MAAM,SAAS,EAAE,QAAQ,SAAS,EAAE,WAAW,MAAM,mBAAc,EAAE,MAAM,MAAM,2BAA2B,EAAE,QAAQ,MAAM,mBAAmB,EAAE,WAAW,MAAM,gBAAgB;AAC3M,MAAI,EAAE,QAAQ,QAAQ;AACpB,UAAM,KAAK,IAAI,uCAAuC;AACtD,eAAW,KAAK,EAAE,QAAS,OAAM,KAAK,IAAI,CAAC,CAAC;AAAA,EAC9C;AACA,MAAI,EAAE,WAAW,QAAQ;AACvB,UAAM,KAAK,IAAI,iDAA4C;AAC3D,eAAW,KAAK,EAAE,WAAY,OAAM,KAAK,IAAI,CAAC,CAAC;AAC/C,UAAM,KAAK,IAAI,UAAK,EAAE,WAAW,MAAM,4DAAuD;AAAA,EAChG,OAAO;AACL,UAAM,KAAK,IAAI,yFAA+E;AAAA,EAChG;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,SAAS;AAC9C;;;ACpEO,IAAM,gBAA6B;AAAA,EACxC,EAAE,cAAc,mCAAmC,aAAa,4BAA4B,QAAQ,wDAAmD;AACzJ;AAGO,IAAM,cAA2B;AAAA,EACtC,EAAE,cAAc,6BAA6B,aAAa,sBAAsB,QAAQ,kFAAkF;AAAA,EAC1K,EAAE,cAAc,+BAA+B,aAAa,+BAA+B,QAAQ,mBAAmB;AAAA,EACtH,EAAE,cAAc,+BAA+B,aAAa,2BAA2B,QAAQ,mBAAmB;AAAA,EAClH,EAAE,cAAc,+BAA+B,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,EAChH,EAAE,cAAc,qCAAqC,aAAa,6BAA6B,QAAQ,aAAa;AAAA,EACpH,EAAE,cAAc,qCAAqC,aAAa,mCAAmC,QAAQ,aAAa;AAAA,EAC1H,EAAE,cAAc,oDAAoD,aAAa,sBAAsB,QAAQ,+CAA0C;AAAA,EACzJ,EAAE,cAAc,oDAAoD,aAAa,+EAA+E,QAAQ,yBAAyB;AAAA,EACjM,EAAE,cAAc,iCAAiC,aAAa,qCAAqC,QAAQ,aAAa;AAAA,EACxH,EAAE,cAAc,0CAA0C,aAAa,8GAA8G,QAAQ,uCAAuC;AACtO;AAQA,IAAM,YAAY,CAAC,eACjB,WAAW,WAAW,GAAG,IAAI,sBAAsB,WAAW,MAAM,GAAG,EAAE,IAAI,KAAK;AAIpF,SAAS,gBAAgB,GAAqB;AAC5C,SAAO,OAAO,MAAM,YAAY,8EAA8E,KAAK,CAAC,KAAK,EAAE,SAAS,GAAG;AACzI;AAGA,SAAS,aAAa,OAA+B,SAAS,IAA4B;AACxF,QAAM,MAA8B,CAAC;AACrC,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,WAAW,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,MAAO,SAAS,IAAI,EAAE,IAAI,KAAK,EAAE;AACrF,UAAMC,SAAO,SAAS,GAAG,MAAM,GAAG,OAAO,KAAK,EAAE;AAChD,QAAI,EAAE,YAAY,EAAE,SAAS,SAAS,EAAG,KAAI,KAAK,GAAG,aAAa,EAAE,UAAUA,MAAI,CAAC;AAAA,QAC9E,KAAI,KAAK,EAAE,GAAG,GAAG,MAAAA,OAAK,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAGO,SAAS,eAAe,SAA2C;AACxE,QAAM,QAA4B,CAAC,GAAG,UAA8B,CAAC,GAAG,aAAiC,CAAC;AAC1G,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,eAAe,cAAc,EAAE,eAAe,SAAU;AAC9D,QAAI,EAAE,eAAe,YAAY,EAAE,eAAe,UAAU;AAG1D,iBAAW,KAAK,EAAE,cAAc,mBAAmB,EAAE,UAAU,GAAG,cAAc,UAAU,EAAE,UAAU,GAAG,MAAM,aAAa,EAAE,WAAW,YAAY,CAAC,IAAI,CAAC;AAC3J;AAAA,IACF;AACA,QAAI,EAAE,eAAe,eAAe;AAClC,YAAM,QAA0B,EAAE,cAAc,iBAAiB,cAAc,UAAU,EAAE,UAAU,GAAG,MAAM,mBAAmB;AACjI,UAAI,4CAA4C,KAAK,EAAE,UAAU,EAAG,OAAM,KAAK,EAAE,GAAG,OAAO,QAAQ,4DAAuD,CAAC;AAAA,UACtJ,YAAW,KAAK,KAAK;AAC1B;AAAA,IACF;AACA,UAAM,eAAe,mBAAmB,EAAE,UAAU;AACpD,UAAM,eAAe,UAAU,EAAE,UAAU;AAC3C,eAAW,QAAQ,aAAa,EAAE,SAAS,CAAC,CAAC,GAAG;AAC9C,YAAM,OAAyB,EAAE,cAAc,cAAc,MAAM,KAAK,MAAM,QAAQ,KAAK,QAAQ,OAAO,KAAK,MAAM;AACrH,UAAI,KAAK,uBAAuB,YAAY;AAAE,cAAM,KAAK,EAAE,GAAG,MAAM,QAAQ,mBAAmB,CAAC;AAAG;AAAA,MAAU;AAC7G,UAAI,gBAAgB,KAAK,KAAK,GAAG;AAAE,cAAM,KAAK,EAAE,GAAG,MAAM,QAAQ,kDAA6C,CAAC;AAAG;AAAA,MAAU;AAC5H,YAAM,OAAO,cAAc,KAAK,CAAC,SAAS,KAAK,iBAAiB,gBAAgB,KAAK,YAAY,KAAK,KAAK,IAAI,CAAC;AAChH,UAAI,MAAM;AAAE,gBAAQ,KAAK,EAAE,GAAG,MAAM,QAAQ,KAAK,OAAO,CAAC;AAAG;AAAA,MAAU;AACtE,YAAM,IAAI,YAAY,KAAK,CAAC,SAAS,KAAK,iBAAiB,gBAAgB,KAAK,YAAY,KAAK,KAAK,IAAI,CAAC;AAC3G,UAAI,GAAG;AAAE,cAAM,KAAK,EAAE,GAAG,MAAM,QAAQ,EAAE,OAAO,CAAC;AAAG;AAAA,MAAU;AAC9D,iBAAW,KAAK,IAAI;AAAA,IACtB;AAAA,EACF;AACA,SAAO,EAAE,OAAO,SAAS,WAAW;AACtC;;;AJ7DA,IAAM,oBAAoB;AAEnB,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,OAAO,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAAA,EAC1B,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,EACJ,CAAC;AAAA,EAED,eAAeC,SAAO,OAAO,gBAAgB;AAAA,EAC7C,gBAAgBA,SAAO,OAAO,oBAAoB,cAAc;AAAA,EAChE,WAAWA,SAAO,OAAO,cAAc,QAAQ;AAAA,EAC/C,SAASA,SAAO,OAAO,YAAY,EAAE;AAAA,EACrC,WAAWA,SAAO,OAAO,eAAe,iBAAiB;AAAA,EACzD,kBAAkBA,SAAO,OAAO,oBAAoB;AAAA,EACpD,gBAAgBA,SAAO,OAAO,mBAAmB;AAAA,EACjD,kBAAkBA,SAAO,OAAO,oBAAoB;AAAA,EACpD,oBAAoBA,SAAO,OAAO,uBAAuB;AAAA,EACzD,WAAWA,SAAO,OAAO,aAAa;AAAA,EACtC,SAASA,SAAO,QAAQ,aAAa,KAAK;AAAA,EAC1C,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,MAAM,CAAC,QAAgB;AAC3B,UAAI,SAAS,OAAQ,MAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC3D;AAIA,QAAI,KAAK,cAAc;AACrB,YAAM,MAAM,CAAC,WAAW,OAAO,kBAAkB,KAAK,YAAY,CAAC;AAAA,IACrE;AACA,UAAM,UAAU,MAAM,aAAa;AACnC,UAAM,kBAAkB,KAAK,oBAAoB,MAAM,kBAAkB,IAAI;AAC7E,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,QAAI,KAAK,QAAQ;AAEf,YAAM,WAAW,KAAK,aAAa,MAAM,kBAAkB,IAAI;AAC/D,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,YAAMC,qBAAoB,MAAM,yBAAyB,iBAAiB,KAAK,iBAAiB;AAChG,YAAMC,YAAW,MAAMC,iBAAgB;AACvC,YAAMC,6BAA4B,uBAAuB,EAAE,UAAU,KAAK,gBAAgB,CAAC;AAC3F,YAAMC,iBAAgBD,6BAA4B,KAAK,MAAM,qBAAqB,EAAE,UAAU,KAAK,UAAU,UAAU,KAAK,cAAc,CAAC;AAC3I,YAAME,UAAS,iBAAiB;AAAA,QAC9B,UAAU,KAAK;AAAA,QAAU,QAAQ,KAAK;AAAA,QAAQ,UAAU,KAAK;AAAA,QAC7D,UAAU,QAAQ;AAAA,QAAU;AAAA,QAC5B,mBAAAL;AAAA,QAAmB,wBAAwB;AAAA,QAC3C,2BAAAG;AAAA,QAA2B,eAAAC;AAAA,MAC7B,CAAC;AACD,YAAM,UAAU,MAAM,UAAU,EAAE,eAAe,KAAK,eAAe,UAAAH,WAAU,QAAAI,QAAO,CAAC;AACvF,YAAM,aAAa,eAAe,OAAO;AACzC,YAAM,EAAE,QAAQ,SAAS,IAAI,aAAa,YAAY,EAAE,MAAM,SAAS,OAAO,CAAC;AAC/E,WAAK,QAAQ,OAAO,MAAM,SAAS,IAAI;AACvC,aAAO;AAAA,IACT;AAGA,QAAI,KAAK,WAAW,0BAA0B,KAAK,QAAQ,KAAK,8BAAyB;AACzF,UAAM,MAAM,MAAM,aAAa,EAAE,UAAU,QAAQ,UAAU,UAAU,KAAK,SAAS,CAAC;AACtF,QAAI,IAAI,gBAAgB,QAAQ,KAAK,UAAU;AAC7C,UAAI,OAAO,IAAI,8IAAyI,CAAC;AAAA,IAC3J;AAGA,UAAM,mBAAmB,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,UAAU,iBAAiB,gBAAgB,CAAC;AAG7G,QAAI,2BAA2B,KAAK,aAAa,QAAG;AACpD,UAAM,oBAAoB,KAAK,eAAe,KAAK,QAAQ;AAG3D,UAAM,oBAAoB,MAAM,yBAAyB,iBAAiB,KAAK,iBAAiB;AAChG,UAAM,WAAW,MAAMH,iBAAgB;AACvC,UAAM,4BAA4B,uBAAuB,EAAE,UAAU,KAAK,gBAAgB,CAAC;AAG3F,UAAM,gBAAgB,4BAClB,KACA,MAAM,qBAAqB,EAAE,UAAU,KAAK,UAAU,UAAU,KAAK,cAAc,CAAC;AACxF,QAAI,2BAA2B;AAC7B,UAAI,0BAA0B,0BAA0B,MAAM,GAAG,EAAE,IAAI,CAAC,EAAE;AAAA,IAC5E,WAAW,eAAe;AACxB,UAAI,qCAAqC,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAG;AAAA,IAC5E;AACA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd;AAAA,MACA,wBAAwB;AAAA,MACxB;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,2CAAsC;AAC1C,UAAM,UAAU,MAAM,mBAAmB;AAAA,MACvC,eAAe,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,MACA,gBAAgB,cAAc,QAAQ,eAAe,MAAM,GAAG,CAAC,CAAC;AAAA,IAClE,CAAC;AAGD,QAAI,IAAI,aAAa;AACnB,YAAM,kBAAkB,IAAI,aAAa,QAAQ,gBAAgB;AAAA,IACnE;AAEA,UAAM,YAAY,WAAW,QAAQ,gBAAgB;AACrD,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO;AAAA,QAClB,WAAW,EAAE,QAAQ,WAAW,eAAe,KAAK,eAAe,UAAU,IAAI,UAAU,WAAW,QAAQ,cAAc,CAAC,IAAI;AAAA,MACnI;AACA,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,oBAAoB;AAAA,QAClB,EAAE,KAAK,UAAU,OAAO,UAAU;AAAA,QAClC,EAAE,KAAK,kBAAkB,OAAO,KAAK,cAAc;AAAA,QACnD,EAAE,KAAK,aAAa,OAAO,IAAI,SAAS;AAAA,QACxC,EAAE,KAAK,iBAAiB,OAAO,QAAQ,cAAc,gBAAgB,IAAI;AAAA,MAC3E,CAAC,IAAI;AAAA,IACP;AACA,SAAK,QAAQ,OAAO,MAAM,OAAO,IAAI;AAAA,CAA8C,CAAC;AACpF,WAAO;AAAA,EACT;AACF;;;AKpKA,SAAS,WAAAI,WAAS,UAAAC,gBAAc;AAKzB,IAAM,iBAAN,cAA6B,WAAW;AAAA,EAC7C,OAAO,QAAQ,CAAC,CAAC,SAAS,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC;AAAA,EAElD,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,IACF,UAAU;AAAA,MACR,CAAC,yBAAyB,YAAY;AAAA,MACtC,CAAC,iBAAiB,0BAA0B;AAAA,IAC9C;AAAA,EACF,CAAC;AAAA,EAED,SAASC,SAAO,OAAO,YAAY,EAAE,aAAa,iCAAiC,CAAC;AAAA,EACpF,UAAUA,SAAO,QAAQ,aAAa,KAAK;AAAA,EAE3C,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACV,KAAK,UAAqD;AAAA,MAC3D,KAAK,QAAQ;AAAA,IACf;AAEA,QAAI,SAAS,QAAQ;AACnB,YAAM,UAAkC,EAAE,SAAS,YAAY;AAC/D,UAAI,KAAK,SAAS;AAChB,gBAAQ,OAAO,QAAQ;AACvB,gBAAQ,WAAW,GAAG,QAAQ,QAAQ,IAAI,QAAQ,IAAI;AAAA,MACxD;AACA,WAAK,QAAQ,OAAO,MAAM,WAAW,OAAO,IAAI,IAAI;AACpD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,KAAK,SAAS;AACjB,WAAK,QAAQ,OAAO,MAAM,GAAG,WAAW;AAAA,CAAI;AAC5C,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,oBAAoB;AAAA,MAChC,EAAE,KAAK,OAAO,OAAO,YAAY;AAAA,MACjC,EAAE,KAAK,QAAQ,OAAO,QAAQ,QAAQ;AAAA,MACtC,EAAE,KAAK,YAAY,OAAO,GAAG,QAAQ,QAAQ,IAAI,QAAQ,IAAI,GAAG;AAAA,IAClE,CAAC;AACD,SAAK,QAAQ,OAAO,MAAM,QAAQ,IAAI;AACtC,WAAO;AAAA,EACT;AACF;;;AClDA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAazB,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,OAAO,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAAA,EAC1B,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,EACf,CAAC;AAAA,EAED,SAASC,SAAO,OAAO,UAAU;AAAA,EACjC,UAAUA,SAAO,QAAQ,aAAa,KAAK;AAAA,EAC3C,eAAeA,SAAO,OAAO,kBAAkB;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,cAAe,KAAK,QAAQ,OAA8B,UAAU;AAE1E,UAAM,YAAY,MAAM,aAAa;AACrC,UAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,gBAAgB,KAAK,aAAa,CAAC;AAE1F,UAAM,KAAK,MAAM;AAAA,MACf,EAAE,YAAY,IAAI,YAAY,iBAAiB,IAAI,gBAAgB;AAAA,MACnE,EAAE,QAAQ,OAAO,MAAM,UAAU;AAAA,MACjC,CAAC,QAAQ,KAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,IAC/C;AAEA,UAAM,cAAc,UAAU,aAAa,IAAI;AAE/C,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO;AAAA,QAClB,WAAW;AAAA,UACT,KAAK,GAAG;AAAA,UACR,KAAK,GAAG;AAAA,UACR,QAAQ,GAAG,YAAY,UAAU;AAAA,UACjC,cAAc,UAAU;AAAA,UACxB,kBAAkB,UAAU;AAAA,UAC5B,SAAS,IAAI;AAAA,UACb,eAAe,IAAI;AAAA,UACnB;AAAA,UACA,SAAS;AAAA,UACT,WAAW,IAAI;AAAA,QACjB,CAAC,IAAI;AAAA,MACP;AACA,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,GAAG,YAAY,UAAU,YAAY;AACxD,UAAM,eAAe,cACjB,OAAO,IAAI,kCAA6B,IACxC,OAAO,IAAI,mCAA8B;AAE7C,UAAM,QAAQ,oBAAoB;AAAA,MAChC,EAAE,KAAK,OAAO,OAAO,GAAG,IAAI;AAAA,MAC5B,EAAE,KAAK,OAAO,OAAO,GAAG,IAAI;AAAA,MAC5B,EAAE,KAAK,UAAU,OAAO,aAAa,aAAa;AAAA,MAClD;AAAA,QACE,KAAK;AAAA,QACL,OAAO,GAAG,UAAU,cAAc,KAAK,UAAU,gBAAgB;AAAA,MACnE;AAAA,MACA,EAAE,KAAK,WAAW,OAAO,IAAI,WAAW;AAAA,MACxC;AAAA,QACE,KAAK;AAAA,QACL,OAAO,OAAO,QAAQ,iCAAiC;AAAA,MACzD;AAAA,MACA,GAAI,IAAI,YACJ,CAAC,IACD,CAAC,EAAE,KAAK,aAAa,OAAO,OAAO,IAAI,uCAAuC,EAAE,CAAC;AAAA,IACvF,CAAC;AACD,SAAK,QAAQ,OAAO,MAAM,QAAQ,IAAI;AAEtC,QAAI,CAAC,aAAa;AAChB,WAAK,QAAQ,OAAO;AAAA,QAClB,OAAO;AAAA,UACL,+CAA+C,UAAU,QAAQ,6BAA6B,IAAI,eAAe,4BAA4B,IAAI,eAAe;AAAA;AAAA,QAClK;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AC9FA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;;;ACChC;AADA,SAAS,SAAAC,cAAa;AAIf,SAAS,OAAO,MAAiC;AACtD,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,OAAOD,OAAM,OAAO,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACrE,UAAM,MAAgB,CAAC;AACvB,UAAM,MAAgB,CAAC;AACvB,SAAK,OAAO,GAAG,QAAQ,CAAC,MAAc,IAAI,KAAK,CAAC,CAAC;AACjD,SAAK,OAAO,GAAG,QAAQ,CAAC,MAAc,IAAI,KAAK,CAAC,CAAC;AACjD,SAAK,GAAG,SAAS,CAAC,MAAM;AACtB,UAAK,EAA4B,SAAS,UAAU;AAClD;AAAA,UACE,IAAI,cAAc;AAAA,YAChB,MAAM;AAAA,YACN,SAAS;AAAA,YACT,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AACA;AAAA,MACF;AACA,aAAO,CAAC;AAAA,IACV,CAAC;AACD,SAAK,GAAG,SAAS,CAAC,SAAS;AACzB,UAAI,SAAS,GAAG;AACd;AAAA,UACE,IAAI,cAAc;AAAA,YAChB,MAAM;AAAA,YACN,SAAS,QAAQ,KAAK,KAAK,GAAG,CAAC,aAAa,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM,EAAE,KAAK,CAAC;AAAA,UACxF,CAAC;AAAA,QACH;AACA;AAAA,MACF;AACA,MAAAC,SAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM,CAAC;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC;AACH;AAGA,eAAsB,kBAAoC;AACxD,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,mBAAmB,CAAC;AAC/D,WAAO,IAAI,KAAK,EAAE,QAAQ,UAAU,EAAE,MAAM;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,iBAAgC;AACpD,QAAM,OAAO,CAAC,UAAU,OAAO,qBAAqB,MAAM,CAAC;AAC7D;;;ACnCA,eAAsB,sBAA6C;AACjE,QAAM,KAAK,MAAM,aAAa,EAAE,MAAM,MAAM,IAAI;AAChD,QAAM,UAAU,MAAM,kBAAkB;AACxC,QAAM,eAAe,MAAM,iBAAiB;AAC5C,QAAM,eAAe,MAAM,WAAW;AACtC,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,gBAAgB,OAAO,QAAQ,YAAY,QAAQ,GAAG,aAAa,QAAQ;AACjF,SAAO,EAAE,IAAI,SAAS,cAAc,cAAc,cAAc,cAAc;AAChF;;;AFdO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,OAAO,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAAA,EAC1B,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,EACf,CAAC;AAAA,EAED,SAASC,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,MAAM,MAAM,oBAAoB;AAEtC,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,GAAG,IAAI,IAAI;AAChD,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,oBAAoB;AAAA,MAChC,EAAE,KAAK,UAAU,OAAO,IAAI,IAAI,OAAO,OAAO,IAAI,iBAAiB,EAAE;AAAA,MACrE,EAAE,KAAK,aAAa,OAAO,IAAI,IAAI,YAAY,IAAI;AAAA,MACnD;AAAA,QACE,KAAK;AAAA,QACL,OAAO,IAAI,KAAK,GAAG,IAAI,GAAG,cAAc,KAAK,IAAI,GAAG,gBAAgB,MAAM;AAAA,MAC5E;AAAA,MACA,EAAE,KAAK,iBAAiB,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,kBAAkB,EAAE;AAAA,MACvF,EAAE,KAAK,mBAAmB,OAAO,IAAI,SAAS,YAAY,IAAI;AAAA,MAC9D,EAAE,KAAK,kBAAkB,OAAO,IAAI,SAAS,eAAe,IAAI;AAAA,MAChE,EAAE,KAAK,mBAAmB,OAAO,IAAI,SAAS,mBAAmB,IAAI;AAAA,MACrE;AAAA,QACE,KAAK;AAAA,QACL,OAAO,IAAI,gBACP,OAAO,QAAQ,YAAO,IACtB,OAAO,IAAI,kDAA6C;AAAA,MAC9D;AAAA,MACA;AAAA,QACE,KAAK;AAAA,QACL,OAAO,IAAI,cAAc,cAAc,OAAO,IAAI,uCAAkC;AAAA,MACtF;AAAA,MACA,EAAE,KAAK,kBAAkB,OAAO,IAAI,eAAe,QAAQ,KAAK;AAAA,IAClE,CAAC;AACD,SAAK,QAAQ,OAAO,MAAM,QAAQ,IAAI;AACtC,WAAO;AAAA,EACT;AACF;;;AGxDA,SAAS,WAAAC,WAAS,UAAAC,gBAAc;AAEhC,SAAS,0BAAAC,gCAA8B;;;ACUhC,SAAS,gBAAgB,IAAuC;AACrE,MAAI,CAAC,MAAM,CAAC,GAAG,UAAU;AACvB,WAAO,EAAE,MAAM,gBAAgB,QAAQ,QAAQ,QAAQ,0BAA0B,aAAa,WAAW;AAAA,EAC3G;AACA,SAAO,EAAE,MAAM,gBAAgB,QAAQ,QAAQ,QAAQ,GAAG,GAAG,GAAG,YAAY,GAAG,QAAQ,IAAI;AAC7F;AAEO,SAAS,mBAAmB,KAAwC;AACzE,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,IACf;AAAA,EACF;AACA,SAAO,EAAE,MAAM,eAAe,QAAQ,QAAQ,QAAQ,WAAW,IAAI,WAAW,GAAG;AACrF;AAEO,SAAS,qBAAqB,IAA0B,KAAwC;AACrG,MAAI,CAAC,MAAM,CAAC,KAAK;AACf,WAAO,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,QAAQ,kDAA6C;AAAA,EAC1G;AACA,MAAI,GAAG,aAAa,IAAI,UAAU;AAChC,WAAO,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,QAAQ,QAAQ,GAAG,QAAQ,GAAG;AAAA,EACnF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,aAAa,GAAG,QAAQ,yBAAoB,IAAI,QAAQ;AAAA,IAChE,aAAa,uCAAuC,IAAI,QAAQ;AAAA,EAClE;AACF;AAEO,SAAS,sBAAsB,OAAqD;AACzF,SAAO,MAAM,KACT,EAAE,MAAM,qBAAqB,QAAQ,QAAQ,QAAQ,MAAM,OAAO,IAClE;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,MAAM;AAAA,IACd,aAAa;AAAA,EACf;AACN;AAEO,SAAS,eAAe,OAIf;AACd,MAAI,MAAM,UAAU,OAAO,MAAM,SAAS,KAAK;AAC7C,WAAO,EAAE,MAAM,sBAAsB,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,MAAM,GAAG;AAAA,EACtF;AACA,MAAI,MAAM,WAAW,OAAO,MAAM,WAAW,KAAK;AAChD,UAAM,QAAQ,MAAM,oBAAoB;AACxC,UAAM,MAAM,MAAM,OAAO;AACzB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,MAAM,MAAM;AAAA,MAC5B,aAAa,kDAAkD,GAAG,4EAA4E,KAAK;AAAA,IACrJ;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,QAAQ,MAAM,UAAU,eAAe;AAAA,EACjD;AACF;AAMO,SAAS,mBAAmB,QAA2C;AAC5E,QAAM,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc;AAC1D,MAAI,aAAa,WAAW,GAAG;AAC7B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,UAAU,aAAa,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ;AACtD,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,GAAG,aAAa,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC,IAAI,QAAQ,WAAW,IAAI,QAAQ,MAAM;AAAA,IAC9F,aAAa;AAAA,EACf;AACF;AAIA,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAExB,SAAS,uBACd,aACA,YAAY,wBACC;AACb,QAAM,YAAY,YAAY,OAAO,CAAC,MAAM,mBAAmB,KAAK,EAAE,KAAK,CAAC;AAC5E,MAAI,UAAU,WAAW,GAAG;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,QAAQ,UAAU,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AAC5D,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,UAAU,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,cAAc,EAAE,QAAQ,EAAE,EAAE,KAAK,IAAI;AAAA,IACzF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,GAAG,MACR,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,cAAc,EAAE,QAAQ,MAAM,SAAS,EAAE,EACzE,KAAK,IAAI,CAAC;AAAA,IACb,aAAa,kBAAa,SAAS,2FAA2F,MAAM,CAAC,EAAE,IAAI,mBAAmB,SAAS;AAAA,EACzK;AACF;AAEO,SAAS,gBAAgB,aAAgC,QAAmC;AACjG,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,EAAE,MAAM,eAAe,QAAQ,QAAQ,QAAQ,mDAAmD;AAAA,EAC3G;AACA,QAAM,OAAO,YAAY,OAAO,CAAC,MAAM;AACrC,QAAI,CAAC,EAAE,MAAO,QAAO;AACrB,UAAM,KAAK,EAAE,MAAM,YAAY;AAC/B,UAAM,IAAI,OAAO,OAAO,CAAC,MAAM,eAAe,EAAE,IAAI,EAAE,YAAY,MAAM,EAAE;AAC1E,WAAO,EAAE,SAAS,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;AAAA,EACrD,CAAC;AACD,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,KAAK,gBAAgB,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC;AAChI,WAAO,EAAE,MAAM,eAAe,QAAQ,QAAQ,QAAQ,6BAA6B,OAAO,KAAK,IAAI,KAAK,kBAAkB,GAAG;AAAA,EAC/H;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,mCAAmC,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,IAC/F,aAAa;AAAA,EACf;AACF;;;ADlJA;AACA;AACA;AAGA,eAAe,wBAAwB,UAA0C;AAC/E,QAAM,IAAI,SAAS,MAAM,8CAA8C;AACvE,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,UAAM,MAAM,MAAM,MAAM;AAAA,MACtB;AAAA,MAAqB;AAAA,MAAW;AAAA,MAChC;AAAA,MAAW,YAAY,EAAE,CAAC,CAAC;AAAA,MAC3B;AAAA,MAAY;AAAA,IACd,CAAC;AACD,UAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,WAAO,IAAI,CAAC,KAAK;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,IAAiD;AACvE,QAAM,IAAI,GAAG,MAAM,oDAAoD;AACvE,SAAO,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,IAAI;AACxC;AAEA,eAAe,qBAAqB,WAA+C;AACjF,QAAM,SAAS,eAAe,SAAS;AACvC,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,MAAI;AACF,UAAM,MAAM,MAAM,MAAM;AAAA,MACtB;AAAA,MAAqB;AAAA,MAAW;AAAA,MAAc;AAAA,MAC9C;AAAA,MAAM,OAAO;AAAA,MAAI;AAAA,MAAM,OAAO;AAAA,MAC9B;AAAA,MAAY;AAAA,IACd,CAAC;AACD,UAAM,MAAM,KAAK,MAAM,GAAG;AAK1B,WAAO,IAAI,IAAI,CAAC,OAAO;AAAA,MACrB,MAAM,EAAE,QAAQ;AAAA,MAChB,OAAO,EAAE,YAAY,OAAO,QAAQ;AAAA,MACpC,UAAU,EAAE,KAAK,YAAY;AAAA,IAC/B,EAAE;AAAA,EACJ,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,uBAAuB,WAA2C;AAC/E,QAAM,SAAS,eAAe,SAAS;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,CAAC,qBAAqB,WAAW,QAAQ,MAAM,OAAO,IAAI,MAAM,OAAO,MAAM,WAAW,YAAY,YAAY,KAAK,CAAC;AAC9I,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,OAAO,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAAA,EAC1B,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,EACf,CAAC;AAAA,EAED,SAASC,SAAO,OAAO,UAAU;AAAA,EACjC,QAAQA,SAAO,OAAO,SAAS;AAAA,EAE/B,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,OAAO,SAAS;AAEtB,UAAM,QAAgC;AAAA,MACpC,MAAM,OAAO,QAAQ,MAAM;AAAA,MAC3B,MAAM,OAAO,KAAK,MAAM;AAAA,MACxB,MAAM,OAAO,MAAM,MAAM;AAAA,MACzB,MAAM,OAAO,IAAI,MAAM;AAAA,IACzB;AAMA,UAAM,SAAwB,CAAC;AAC/B,UAAM,OAAO,CAAC,MAAyB;AACrC,aAAO,KAAK,CAAC;AACb,UAAI,KAAM;AACV,WAAK,QAAQ,OAAO,MAAM,IAAI,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,EAAE,MAAM;AAAA,CAAI;AACzE,UAAI,EAAE,aAAa;AACjB,aAAK,QAAQ,OAAO,MAAM,OAAO,KAAK,gBAAgB,EAAE,WAAW,EAAE,IAAI,IAAI;AAAA,MAC/E;AAAA,IACF;AAEA,UAAM,WAAW,CAAC,SAAuB;AACvC,UAAI,CAAC,KAAM,MAAK,QAAQ,OAAO,MAAM,OAAO,IAAI,cAAc,IAAI,QAAG,IAAI,IAAI;AAAA,IAC/E;AAEA,QAAI,CAAC,KAAM,MAAK,QAAQ,OAAO,MAAM,OAAO,IAAI,0BAAqB,IAAI,IAAI;AAG7E,UAAM,KAAK,MAAM,aAAa,EAAE,MAAM,MAAM,IAAI;AAChD,SAAK,gBAAgB,EAAE,CAAC;AACxB,UAAM,UAAU,MAAM,kBAAkB;AACxC,SAAK,mBAAmB,OAAO,CAAC;AAChC,SAAK,qBAAqB,IAAI,OAAO,CAAC;AAGtC,aAAS,SAAS;AAClB,QAAI,KAAK,EAAE,IAAI,OAAO,QAAQ,aAAa;AAC3C,QAAI;AACF,YAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,MAAM,CAAC;AAC9D,YAAM,QAAQ,MAAM,eAAe,IAAI,eAAe;AACtD,YAAM,MAAM,MAAM,MAAM,GAAG,IAAI,UAAU,WAAW;AAAA,QAClD,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,WAAK,EAAE,IAAI,IAAI,IAAI,QAAQ,QAAQ,IAAI,MAAM,OAAO,IAAI,UAAU,UAAU;AAAA,IAC9E,SAAS,GAAG;AACV,WAAK,EAAE,IAAI,OAAO,QAAS,EAAY,QAAQ;AAAA,IACjD;AACA,SAAK,sBAAsB,EAAE,CAAC;AAG9B,QAAI,SAAS;AACX,eAAS,oBAAoB;AAC7B,UAAI,SAAS;AACb,UAAI;AACF,cAAM,QAAQ,MAAM,gBAAgB;AACpC,cAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,eAAe,sCAAsC;AAAA,UACtF,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,QAC9C,CAAC;AACD,iBAAS,IAAI;AAAA,MACf,QAAQ;AACN,iBAAS;AAAA,MACX;AACA,YAAM,mBAAmB,MAAM,wBAAwB,QAAQ,eAAe;AAC9E,YAAM,MAAM,MAAM,kBAAkB,EAAE,MAAM,MAAM,IAAI;AACtD,WAAK,eAAe,EAAE,QAAQ,kBAAkB,IAAI,CAAC,CAAC;AAKtD,eAAS,gBAAgB;AACzB,YAAM,cAAc,mBAAmB,MAAM,qBAAqB,gBAAgB,IAAI,CAAC;AACvF,WAAK,uBAAuB,WAAW,CAAC;AAExC,eAAS,aAAa;AACtB,YAAM,SAAS,mBAAmB,MAAM,uBAAuB,gBAAgB,IAAI;AACnF,YAAM,SAAS,SAAS,MAAM,eAAe,MAAM,IAAI,CAAC;AACxD,WAAK,gBAAgB,aAAa,MAAM,CAAC;AAIzC,UAAI,OAAO,KAAK,UAAU,YAAY,KAAK,OAAO;AAChD,iBAAS,sBAAsB,KAAK,KAAK,EAAE;AAC3C,YAAI;AACF,gBAAMC,cAAa,IAAIC,yBAAuB;AAC9C,gBAAM,MAAM,MAAM,gBAAgB;AAAA,YAChC,YAAAD;AAAA,YACA,iBAAiB,QAAQ;AAAA,YACzB,WAAW,KAAK;AAAA,UAClB,CAAC;AACD,gBAAM,WAAa,IAAI,WAAuC,yBAAgE,CAAC;AAC/H,gBAAM,iBAAiB,SAAS,4BAA4B,KAAK;AACjE,gBAAM,QAAQ,SAAS,oBAAoB,KAAK;AAChD,cAAI,kBAAkB,OAAO;AAC3B,kBAAM,cAAc,MAAM,4BAA4B;AAAA,cACpD,YAAAA;AAAA,cACA,UAAU,QAAQ;AAAA,cAClB,MAAM,KAAK;AAAA,cACX,SAAS,IAAI;AAAA,YACf,CAAC;AACD,kBAAM,iBAAiB,IAAI;AAC3B,gBAAI,CAAC,gBAAgB;AACnB,mBAAK,EAAE,MAAM,qBAAqB,QAAQ,QAAQ,QAAQ,YAAY,KAAK,KAAK,2CAAsC,CAAC;AAAA,YACzH,OAAO;AACL,oBAAM,UAAU,MAAM,0BAA0B,EAAE,YAAAA,aAAY,gBAAgB,MAAM,CAAC;AACrF,oBAAM,WAAW,MAAM,0BAA0B,EAAE,YAAAA,aAAY,SAAS,YAAY,CAAC;AACrF,mBAAK,mBAAmB,CAAC,EAAE,WAAW,KAAK,OAAO,gBAAgB,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,YACtF;AAAA,UACF,OAAO;AACL,iBAAK,mBAAmB,CAAC,EAAE,WAAW,KAAK,OAAO,gBAAgB,OAAO,UAAU,MAAM,CAAC,CAAC,CAAC;AAAA,UAC9F;AAAA,QACF,SAAS,GAAG;AACV,eAAK,EAAE,MAAM,qBAAqB,QAAQ,QAAQ,QAAQ,oBAAoB,KAAK,KAAK,MAAO,EAAY,OAAO,GAAG,CAAC;AAAA,QACxH;AAAA,MACF;AAAA,IACF,OAAO;AACL,WAAK,EAAE,MAAM,sBAAsB,QAAQ,QAAQ,QAAQ,gCAA2B,CAAC;AAAA,IACzF;AAEA,UAAM,SAAS,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM;AACrD,QAAI,MAAM;AACR,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,IAAI;AAAA,IACtE;AACA,WAAO,SAAS,IAAI;AAAA,EACtB;AACF;;;AE7NA,SAAS,WAAAE,WAAS,UAAAC,gBAAc;;;ACAhC,YAAYC,UAAQ;AACpB,YAAYC,YAAU;AACtB,SAAS,SAASC,YAAW,aAAaC,sBAAqB;AAW/D,SAAS,cAAsB;AAC7B,QAAM,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,SAAY,YAAK,MAAM,cAAc,UAAU;AACjD;AAEO,SAAS,eAAe,MAAsB;AACnD,SAAY,YAAK,YAAY,GAAG,GAAQ,gBAAS,IAAI,CAAC,OAAO;AAC/D;AAIO,SAAS,cAAc,YAA4B;AACxD,QAAM,OAAO,WAAW,MAAM,GAAG,EAAE,CAAC,EAAE,YAAY;AAClD,QAAM,OAAO,KAAK,QAAQ,eAAe,EAAE;AAC3C,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,eAAsB,eAAkC;AACtD,MAAI;AACF,UAAM,UAAU,MAAS,aAAQ,YAAY,CAAC;AAC9C,WAAO,QACJ,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC,EACjC,IAAI,CAAC,MAAM,EAAE,QAAQ,WAAW,EAAE,CAAC,EACnC,KAAK;AAAA,EACV,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,QAAO,CAAC;AAC5D,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,YAAY,MAAuC;AACvE,MAAI;AACF,UAAM,MAAM,MAAS,cAAS,eAAe,IAAI,GAAG,MAAM;AAC1D,UAAM,SAASD,WAAU,GAAG;AAC5B,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACF;AAEA,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAS,UAAK,CAAC;AACf,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,YAAY,GAA6B;AAC7D,QAAS,WAAM,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,MAAI,OAAO,EAAE;AACb,MAAI,IAAI;AACR,SAAO,MAAM,OAAO,eAAe,IAAI,CAAC,GAAG;AACzC,WAAO,GAAG,EAAE,IAAI,IAAI,CAAC;AACrB;AAAA,EACF;AACA,QAAM,SAAS,eAAe,IAAI;AAClC,QAAM,MAAM,GAAG,MAAM;AACrB,QAAS,eAAU,KAAKC,eAAc,EAAE,GAAG,GAAG,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM;AAC5E,QAAS,YAAO,KAAK,MAAM;AAC3B,SAAO;AACT;;;ACvEA;AAaA,eAAe,iBAAiB,QAAyC;AACvE,QAAM,KAAK,MAAM,aAAa,EAAE,MAAM,MAAM,IAAI;AAChD,QAAM,MAAM,MAAM,kBAAkB;AACpC,MAAI,CAAC,MAAM,CAAC,IAAK,QAAO;AACxB,QAAM,OAAO,MAAM,iBAAiB;AACpC,QAAM,UAAmB;AAAA,IACvB,MAAM,UAAU,cAAc,IAAI,QAAQ;AAAA,IAC1C,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,IAChC,gBAAgB,GAAG;AAAA,IACnB,UAAU,GAAG;AAAA,IACb,QAAQ,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,UAAU,iBAAiB,IAAI,gBAAgB;AAAA,IAC/F,cAAc,QAAQ,IAAI;AAAA,EAC5B;AACA,SAAO,MAAM,YAAY,OAAO;AAClC;AAEA,eAAsB,gBAAgB,cAAsB,QAAwC;AAClG,QAAM,OAAO,KAAK,MAAM,MAAM,MAAM,CAAC,WAAW,QAAQ,SAAS,YAAY,MAAM,CAAC,CAAC;AAKrF,QAAM,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,SAAS,YAAY;AAChF,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,iBAAiB,YAAY;AAAA,MACtC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAM,iBAAiB,MAAM;AAC9C,QAAM,MAAM,CAAC,WAAW,OAAO,kBAAkB,OAAO,EAAE,CAAC;AAC3D,QAAM,KAAK,MAAM,gBAAgB,EAAE,aAAa,OAAO,gBAAgB,OAAO,GAAG,CAAC;AAClF,MAAI,CAAC,GAAG,iBAAiB;AACvB,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,mBAAmB,OAAO,IAAI;AAAA,MACvC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,mBAAmB;AAAA,IACvB,UAAU,GAAG;AAAA,IACb,UAAU,GAAG;AAAA,IACb,iBAAiB,GAAG;AAAA,EACtB,CAAC;AACD,QAAM,sBAAsB,EAAE,aAAa,OAAO,iBAAiB,KAAK,CAAC;AACzE,QAAM,eAAe;AACrB,SAAO;AAAA,IACL,UAAU,GAAG;AAAA,IACb,UAAU,GAAG;AAAA,IACb,iBAAiB,GAAG;AAAA,IACpB,gBAAgB,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAAc,QAAwC;AACxF,QAAM,OAAO,MAAM,YAAY,IAAI;AACnC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,qBAAqB,IAAI;AAAA,MAClC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,WAAW,MAAM,iBAAiB,MAAM;AAC9C,QAAM,MAAM,CAAC,WAAW,OAAO,kBAAkB,KAAK,cAAc,CAAC,EAAE,MAAM,MAAM,MAAS;AAC5F,QAAM,mBAAmB,KAAK,MAAM;AACpC,QAAM,sBAAsB,EAAE,aAAa,OAAO,iBAAiB,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChG,QAAM,eAAe;AACrB,SAAO;AAAA,IACL,UAAU,KAAK,OAAO;AAAA,IACtB,UAAU,KAAK,OAAO;AAAA,IACtB,iBAAiB,KAAK,OAAO;AAAA,IAC7B,gBAAgB,KAAK;AAAA,IACrB;AAAA,EACF;AACF;;;AF7FA;AAGO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,OAAO,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAAA,EAC1B,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aACE;AAAA,EACJ,CAAC;AAAA,EAED,UAAUC,SAAO,OAAO,EAAE,UAAU,MAAM,CAAC;AAAA,EAC3C,eAAeA,SAAO,OAAO,gBAAgB;AAAA,EAC7C,OAAOA,SAAO,QAAQ,UAAU,KAAK;AAAA,EACrC,KAAKA,SAAO,OAAO,MAAM;AAAA,EACzB,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AAEA,QAAI,KAAK,MAAM;AACb,YAAM,WAAW,MAAM,aAAa;AACpC,YAAM,UAAU,MAAM,kBAAkB;AACxC,UAAI,SAAS,QAAQ;AACnB,aAAK,QAAQ,OAAO;AAAA,UAClB,WAAW,EAAE,UAAU,eAAe,SAAS,YAAY,KAAK,CAAC,IAAI;AAAA,QACvE;AACA,eAAO;AAAA,MACT;AACA,WAAK,QAAQ,OAAO;AAAA,QAClB,SAAS,SACL,sBAAsB,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI,OACjE;AAAA,MACN;AACA,UAAI,SAAS;AACX,aAAK,QAAQ,OAAO,MAAM,OAAO,IAAI,mBAAmB,QAAQ,QAAQ,EAAE,IAAI,IAAI;AAAA,MACpF;AACA,aAAO;AAAA,IACT;AAEA,QAAI;AACJ,QAAI,KAAK,cAAc;AACrB,eAAS,MAAM,gBAAgB,KAAK,cAAc,KAAK,EAAE;AAAA,IAC3D,WAAW,KAAK,SAAS;AACvB,eAAS,MAAM,cAAc,KAAK,SAAS,KAAK,EAAE;AAAA,IACpD,OAAO;AACL,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,QAAI,SAAS,QAAQ;AACnB,WAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI;AACnD,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,oBAAoB;AAAA,QAClB,EAAE,KAAK,UAAU,OAAO,OAAO,SAAS;AAAA,QACxC,EAAE,KAAK,YAAY,OAAO,OAAO,SAAS;AAAA,QAC1C,EAAE,KAAK,YAAY,OAAO,OAAO,gBAAgB;AAAA,QACjD,EAAE,KAAK,gBAAgB,OAAO,OAAO,eAAe;AAAA,QACpD,EAAE,KAAK,iBAAiB,OAAO,OAAO,YAAY,OAAO,IAAI,uBAAuB,EAAE;AAAA,MACxF,CAAC,IAAI;AAAA,IACP;AACA,SAAK,QAAQ,OAAO;AAAA,MAClB,OAAO,IAAI,iEAAiE;AAAA,IAC9E;AACA,WAAO;AAAA,EACT;AACF;;;AG9EA,SAAS,SAAAC,cAAa;AACtB,SAAS,WAAAC,WAAS,UAAAC,gBAAc;;;ACDhC;AAEO,IAAM,eAAe,CAAC,UAAU,WAAW,QAAQ;AAKnD,IAAM,qBAAqB;AAW3B,SAAS,iBACd,UACA,gBACA,eACQ;AACR,SAAO,8BAA8B,QAAQ,2BAA2B,cAAc,mBAAmB,aAAa;AACxH;AAGO,SAAS,cACd,OAC0D;AAC1D,QAAM,iBAAiB,MAAM,MAAM,2BAA2B,IAAI,CAAC;AACnE,QAAM,gBAAgB,MAAM,MAAM,4BAA4B,IAAI,CAAC;AACnE,MAAI,CAAC,kBAAkB,CAAC,cAAe,QAAO;AAC9C,SAAO,EAAE,gBAAgB,cAAc;AACzC;AAOO,SAAS,eAAe,QAAoB,IAAmC;AACpF,MAAI,WAAW,UAAW,QAAO;AACjC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,uBAAuB,MAAM;AAAA,MACtC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,WAAW,SAAU,QAAO,GAAG;AAEnC,QAAM,SAAS,cAAc,GAAG,sBAAsB;AACtD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,6EAA6E,GAAG,sBAAsB;AAAA,IACjH,CAAC;AAAA,EACH;AACA,SAAO,iBAAiB,GAAG,iBAAiB,OAAO,gBAAgB,OAAO,aAAa;AACzF;;;ADlDA;AAKA,SAAS,QAAQ,KAAmB;AAClC,QAAM,CAAC,KAAK,IAAI,IACd,QAAQ,aAAa,WACjB,CAAC,QAAQ,CAAC,GAAG,CAAC,IACd,QAAQ,aAAa,UACnB,CAAC,OAAO,CAAC,MAAM,SAAS,IAAI,GAAG,CAAC,IAChC,CAAC,YAAY,CAAC,GAAG,CAAC;AAC1B,QAAM,QAAQC,OAAM,KAAK,MAAkB,EAAE,OAAO,UAAU,UAAU,KAAK,CAAC;AAC9E,QAAM,GAAG,SAAS,MAAM;AAAA,EAExB,CAAC;AACD,QAAM,MAAM;AACd;AAEO,IAAM,cAAN,cAA0B,WAAW;AAAA,EAC1C,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC;AAAA,EACxB,OAAO,QAAQC,UAAQ,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,SACE;AAAA,EACJ,CAAC;AAAA,EAED,SAASC,SAAO,OAAO,EAAE,UAAU,MAAM,CAAC;AAAA,EAC1C,QAAQA,SAAO,QAAQ,WAAW,KAAK;AAAA,EACvC,SAASA,SAAO,OAAO,UAAU;AAAA,EAEjC,MAAM,iBAAkC;AACtC,UAAM,OAAO;AAAA,MACX,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,UAAM,SAAU,KAAK,UAAU;AAC/B,QAAI,CAAE,aAAmC,SAAS,MAAM,GAAG;AACzD,YAAM,IAAI,cAAc;AAAA,QACtB,MAAM;AAAA,QACN,SAAS,mBAAmB,MAAM;AAAA,QAClC,MAAM,kBAAkB,aAAa,KAAK,IAAI,CAAC;AAAA,MACjD,CAAC;AAAA,IACH;AAEA,QAAI,KAA4B;AAChC,QAAI,WAAW,WAAW;AACxB,YAAM,MAAM,MAAM,sBAAsB,EAAE,aAAa,MAAM,CAAC;AAC9D,WAAK;AAAA,QACH,YAAY,IAAI;AAAA,QAChB,iBAAiB,IAAI;AAAA,QACrB,gBAAgB,IAAI;AAAA,QACpB,wBAAwB,IAAI;AAAA,MAC9B;AAAA,IACF;AACA,UAAM,MAAM,eAAe,QAAsB,EAAE;AAKnD,QAAI,SAAS,UAAU,CAAC,KAAK,OAAO;AAClC,WAAK,QAAQ,OAAO,MAAM,WAAW,EAAE,QAAQ,IAAI,CAAC,IAAI,IAAI;AAC5D,aAAO;AAAA,IACT;AAEA,UAAM,QAAS,KAAK,QAAQ,OAA8B,UAAU;AACpE,QAAI,KAAK,SAAS,CAAC,OAAO;AACxB,WAAK,QAAQ,OAAO,MAAM,MAAM,IAAI;AACpC,aAAO;AAAA,IACT;AACA,SAAK,QAAQ,OAAO,MAAM,WAAW,MAAM,KAAK,GAAG;AAAA,CAAI;AACvD,YAAQ,GAAG;AACX,WAAO;AAAA,EACT;AACF;;;A9E5CA,IAAM,MAAM,IAAI,IAAI;AAAA,EAClB,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,eAAe;AACjB,CAAC;AAED,IAAI,SAAS,SAAS,WAAW;AACjC,IAAI,SAAS,cAAc;AAC3B,IAAI,SAAS,aAAa;AAC1B,IAAI,SAAS,aAAa;AAC1B,IAAI,SAAS,aAAa;AAC1B,IAAI,SAAS,aAAa;AAC1B,IAAI,SAAS,WAAW;AACxB,IAAI,SAAS,iBAAiB;AAC9B,IAAI,SAAS,kBAAkB;AAC/B,IAAI,SAAS,gBAAgB;AAC7B,IAAI,SAAS,cAAc;AAC3B,IAAI,SAAS,kBAAkB;AAC/B,IAAI,SAAS,eAAe;AAC5B,IAAI,SAAS,iBAAiB;AAC9B,IAAI,SAAS,eAAe;AAC5B,IAAI,SAAS,cAAc;AAC3B,IAAI,SAAS,sBAAsB;AACnC,IAAI,SAAS,eAAe;AAC5B,IAAI,SAAS,iBAAiB;AAC9B,IAAI,SAAS,yBAAyB;AACtC,IAAI,SAAS,eAAe;AAC5B,IAAI,SAAS,oBAAoB;AACjC,IAAI,SAAS,kBAAkB;AAC/B,IAAI,SAAS,gBAAgB;AAC7B,IAAI,SAAS,gBAAgB;AAC7B,IAAI,SAAS,gBAAgB;AAC7B,IAAI,SAAS,kBAAkB;AAC/B,IAAI,SAAS,qBAAqB;AAClC,IAAI,SAAS,kBAAkB;AAC/B,IAAI,SAAS,oBAAoB;AACjC,IAAI,SAAS,sBAAsB;AACnC,IAAI,SAAS,aAAa;AAC1B,IAAI,SAAS,kBAAkB;AAC/B,IAAI,SAAS,gBAAgB;AAC7B,IAAI,SAAS,iBAAiB;AAE9B,eAAe,OAAwB;AACrC,MAAI;AACF,WAAO,MAAM,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC;AAAA,EAC5C,SAAS,GAAG;AACV,UAAM,UAAU,QAAQ,KAAK,SAAS,WAAW;AACjD,UAAM,YAAY,QAAQ,KAAK,QAAQ,UAAU;AACjD,UAAM,SACJ,aAAa,KAAK,YAAY,IAAI,QAAQ,KAAK,SAC1C,QAAQ,KAAK,YAAY,CAAC,IAC3B;AACN,WAAO,YAAY,GAAG,EAAE,QAAQ,QAAQ,QAAQ,SAAS,OAAO,CAAC;AAAA,EACnE;AACF;AAEA,KAAK,EAAE,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;","names":["init_errors","init_errors","credential","cache","getCachedToken","putCachedToken","init_esm","init_esm","FOUNDRY_SCOPE","ARM","ARM_SCOPE","credential","key","Command","resolve","DefaultAzureCredential","DefaultAzureCredential","fqdn","Command","Command","Option","Command","Option","Command","Option","Command","Option","path","confirm","Command","Option","Command","Option","confirm","Command","Option","Command","Option","Command","Option","Command","Option","Command","Option","fs","path","parseYaml","stringifyYaml","configDir","key","Command","Option","key","Command","Option","Command","Option","cache","Command","Option","Command","Option","Command","Option","Command","Option","Command","Option","Command","Option","Command","Option","confirm","Command","Option","confirm","Command","Option","Command","Option","Command","Option","Command","Option","init_esm","Command","Option","DefaultAzureCredential","fs","path","Command","Option","credential","DefaultAzureCredential","init_esm","Command","Option","fs","os","path","DefaultAzureCredential","select","ARM_SCOPE","credential","fs","path","os","parseYaml","stringifyYaml","spawn","resolve","init_esm","path","fs","fs","clean","ARM_SCOPE","enableHostedBrain","fs","path","Command","Option","credential","DefaultAzureCredential","init_esm","Command","Option","DefaultAzureCredential","init_esm","Command","Option","credential","DefaultAzureCredential","Command","Option","DefaultAzureCredential","AIProjectClient","Command","Option","credential","DefaultAzureCredential","Command","Option","DefaultAzureCredential","Command","Option","credential","DefaultAzureCredential","Command","Option","DefaultAzureCredential","init_esm","fs","os","path","FOUNDRY_ARM_API","FOUNDRY_DATA_SCOPE","ARM_SCOPE","Command","Option","credential","DefaultAzureCredential","Command","Option","DefaultAzureCredential","fs","spawnSync","fs","parseYaml","FOUNDRY_ARM_API","FOUNDRY_DATA_SCOPE","ARM_SCOPE","metadata","foundryVersion","deleteConnection","credential","spawnSync","Command","Option","credential","DefaultAzureCredential","path","Command","Option","DefaultAzureCredential","fs","os","path","parseYaml","Command","Option","credential","DefaultAzureCredential","Command","Option","DefaultAzureCredential","Command","Option","credential","DefaultAzureCredential","Command","createHash","fs","os","path","createHash","Command","init_esm","Command","Option","DefaultAzureCredential","fs","path","parseYaml","Command","Option","credential","DefaultAzureCredential","enableHostedBrain","confirm","Command","Option","DefaultAzureCredential","Command","Option","credential","DefaultAzureCredential","exists","confirm","init_esm","path","Command","Option","DefaultAzureCredential","SIZE_PRESETS","DEFAULT_ACR","DEFAULT_IMAGE","DEFAULT_TAG","DEFAULT_MODEL","NAME_RE","Command","Option","credential","DefaultAzureCredential","Command","Option","fs","os","path","resolveRepoRoot","path","path","Command","Option","foundryResourceId","repoRoot","resolveRepoRoot","acrPullIdentityResourceId","acrResourceId","params","Command","Option","Command","Option","Command","Option","Command","Option","Command","Option","spawn","resolve","Command","Option","Command","Option","DefaultAzureCredential","Command","Option","credential","DefaultAzureCredential","Command","Option","fs","path","parseYaml","stringifyYaml","Command","Option","spawn","Command","Option","spawn","Command","Option"]}